Merge branch 'master' of /repos/git/net-next-2.6

Conflicts:
	net/bridge/br_device.c
	net/bridge/br_forward.c

Signed-off-by: Patrick McHardy <kaber@trash.net>

744 files changed, 38108 insertions, 17661 deletions

diff --git a/Documentation/RCU/NMI-RCU.txt b/Documentation/RCU/NMI-RCU.txt
index a6d32e65d222..a8536cb88091 100644
--- a/Documentation/RCU/NMI-RCU.txt
+++ b/Documentation/RCU/NMI-RCU.txt
@@ -34,7 +34,7 @@ NMI handler.
                 cpu = smp_processor_id();
                 ++nmi_count(cpu);
 
-                if (!rcu_dereference(nmi_callback)(regs, cpu))
+                if (!rcu_dereference_sched(nmi_callback)(regs, cpu))
                         default_do_nmi(regs);
 
                 nmi_exit();
@@ -47,12 +47,13 @@ function pointer.  If this handler returns zero, do_nmi() invokes the
 default_do_nmi() function to handle a machine-specific NMI.  Finally,
 preemption is restored.
 
-Strictly speaking, rcu_dereference() is not needed, since this code runs
-only on i386, which does not need rcu_dereference() anyway.  However,
-it is a good documentation aid, particularly for anyone attempting to
-do something similar on Alpha.
+In theory, rcu_dereference_sched() is not needed, since this code runs
+only on i386, which in theory does not need rcu_dereference_sched()
+anyway.  However, in practice it is a good documentation aid, particularly
+for anyone attempting to do something similar on Alpha or on systems
+with aggressive optimizing compilers.
 
-Quick Quiz:  Why might the rcu_dereference() be necessary on Alpha,
+Quick Quiz:  Why might the rcu_dereference_sched() be necessary on Alpha,
              given that the code referenced by the pointer is read-only?
 
 
@@ -99,17 +100,21 @@ invoke irq_enter() and irq_exit() on NMI entry and exit, respectively.
 
 Answer to Quick Quiz
 
-        Why might the rcu_dereference() be necessary on Alpha, given
+        Why might the rcu_dereference_sched() be necessary on Alpha, given
         that the code referenced by the pointer is read-only?
 
         Answer: The caller to set_nmi_callback() might well have
-                initialized some data that is to be used by the
-                new NMI handler.  In this case, the rcu_dereference()
-                would be needed, because otherwise a CPU that received
-                an NMI just after the new handler was set might see
-                the pointer to the new NMI handler, but the old
-                pre-initialized version of the handler's data.
-
-                More important, the rcu_dereference() makes it clear
-                to someone reading the code that the pointer is being
-                protected by RCU.
+                initialized some data that is to be used by the new NMI
+                handler.  In this case, the rcu_dereference_sched() would
+                be needed, because otherwise a CPU that received an NMI
+                just after the new handler was set might see the pointer
+                to the new NMI handler, but the old pre-initialized
+                version of the handler's data.
+
+                This same sad story can happen on other CPUs when using
+                a compiler with aggressive pointer-value speculation
+                optimizations.
+
+                More important, the rcu_dereference_sched() makes it
+                clear to someone reading the code that the pointer is
+                being protected by RCU-sched.
diff --git a/Documentation/RCU/checklist.txt b/Documentation/RCU/checklist.txt
index cbc180f90194..790d1a812376 100644
--- a/Documentation/RCU/checklist.txt
+++ b/Documentation/RCU/checklist.txt
@@ -260,7 +260,8 @@ over a rather long period of time, but improvements are always welcome!
         The reason that it is permissible to use RCU list-traversal
         primitives when the update-side lock is held is that doing so
         can be quite helpful in reducing code bloat when common code is
-        shared between readers and updaters.
+        shared between readers and updaters.  Additional primitives
+        are provided for this case, as discussed in lockdep.txt.
 
 10.     Conversely, if you are in an RCU read-side critical section,
         and you don't hold the appropriate update-side lock, you -must-
@@ -344,8 +345,8 @@ over a rather long period of time, but improvements are always welcome!
         requiring SRCU's read-side deadlock immunity or low read-side
         realtime latency.
 
-        Note that, rcu_assign_pointer() and rcu_dereference() relate to
-        SRCU just as they do to other forms of RCU.
+        Note that, rcu_assign_pointer() relates to SRCU just as they do
+        to other forms of RCU.
 
 15.     The whole point of call_rcu(), synchronize_rcu(), and friends
         is to wait until all pre-existing readers have finished before
diff --git a/Documentation/RCU/lockdep.txt b/Documentation/RCU/lockdep.txt
index fe24b58627bd..d7a49b2f6994 100644
--- a/Documentation/RCU/lockdep.txt
+++ b/Documentation/RCU/lockdep.txt
@@ -32,9 +32,20 @@ checking of rcu_dereference() primitives:
         srcu_dereference(p, sp):
                 Check for SRCU read-side critical section.
         rcu_dereference_check(p, c):
-                Use explicit check expression "c".
+                Use explicit check expression "c".  This is useful in
+                code that is invoked by both readers and updaters.
         rcu_dereference_raw(p)
                 Don't check.  (Use sparingly, if at all.)
+        rcu_dereference_protected(p, c):
+                Use explicit check expression "c", and omit all barriers
+                and compiler constraints.  This is useful when the data
+                structure cannot change, for example, in code that is
+                invoked only by updaters.
+        rcu_access_pointer(p):
+                Return the value of the pointer and omit all barriers,
+                but retain the compiler constraints that prevent duplicating
+                or coalescsing.  This is useful when when testing the
+                value of the pointer itself, for example, against NULL.
 
 The rcu_dereference_check() check expression can be any boolean
 expression, but would normally include one of the rcu_read_lock_held()
@@ -59,7 +70,20 @@ In case (1), the pointer is picked up in an RCU-safe manner for vanilla
 RCU read-side critical sections, in case (2) the ->file_lock prevents
 any change from taking place, and finally, in case (3) the current task
 is the only task accessing the file_struct, again preventing any change
-from taking place.
+from taking place.  If the above statement was invoked only from updater
+code, it could instead be written as follows:
+
+        file = rcu_dereference_protected(fdt->fd[fd],
+                                         lockdep_is_held(&files->file_lock) ||
+                                         atomic_read(&files->count) == 1);
+
+This would verify cases #2 and #3 above, and furthermore lockdep would
+complain if this was used in an RCU read-side critical section unless one
+of these two cases held.  Because rcu_dereference_protected() omits all
+barriers and compiler constraints, it generates better code than do the
+other flavors of rcu_dereference().  On the other hand, it is illegal
+to use rcu_dereference_protected() if either the RCU-protected pointer
+or the RCU-protected data that it points to can change concurrently.
 
 There are currently only "universal" versions of the rcu_assign_pointer()
 and RCU list-/tree-traversal primitives, which do not (yet) check for
diff --git a/Documentation/RCU/whatisRCU.txt b/Documentation/RCU/whatisRCU.txt
index 1dc00ee97163..cfaac34c4557 100644
--- a/Documentation/RCU/whatisRCU.txt
+++ b/Documentation/RCU/whatisRCU.txt
@@ -840,6 +840,12 @@ SRCU:	Initialization/cleanup
         init_srcu_struct
         cleanup_srcu_struct
 
+All:  lockdep-checked RCU-protected pointer access
+
+        rcu_dereference_check
+        rcu_dereference_protected
+        rcu_access_pointer
+
 See the comment headers in the source code (or the docbook generated
 from them) for more information.
 
diff --git a/Documentation/input/multi-touch-protocol.txt b/Documentation/input/multi-touch-protocol.txt
index 8490480ce432..c0fc1c75fd88 100644
--- a/Documentation/input/multi-touch-protocol.txt
+++ b/Documentation/input/multi-touch-protocol.txt
@@ -68,6 +68,22 @@ like:
    SYN_MT_REPORT
    SYN_REPORT
 
+Here is the sequence after lifting one of the fingers:
+
+   ABS_MT_POSITION_X
+   ABS_MT_POSITION_Y
+   SYN_MT_REPORT
+   SYN_REPORT
+
+And here is the sequence after lifting the remaining finger:
+
+   SYN_MT_REPORT
+   SYN_REPORT
+
+If the driver reports one of BTN_TOUCH or ABS_PRESSURE in addition to the
+ABS_MT events, the last SYN_MT_REPORT event may be omitted. Otherwise, the
+last SYN_REPORT will be dropped by the input core, resulting in no
+zero-finger event reaching userland.
 
 Event Semantics
 ---------------
@@ -217,11 +233,6 @@ where examples can be found.
 difference between the contact position and the approaching tool position
 could be used to derive tilt.
 [2] The list can of course be extended.
-[3] The multi-touch X driver is currently in the prototyping stage. At the
-time of writing (April 2009), the MT protocol is not yet merged, and the
-prototype implements finger matching, basic mouse support and two-finger
-scrolling. The project aims at improving the quality of current multi-touch
-functionality available in the Synaptics X driver, and in addition
-implement more advanced gestures.
+[3] Multitouch X driver project: http://bitmath.org/code/multitouch/.
 [4] See the section on event computation.
 [5] See the section on finger tracking.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index e4cbca58536c..e2202e93b148 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -320,11 +320,6 @@ and is between 256 and 4096 characters. It is defined in the file
         amd_iommu=      [HW,X86-84]
                         Pass parameters to the AMD IOMMU driver in the system.
                         Possible values are:
-                        isolate - enable device isolation (each device, as far
-                                  as possible, will get its own protection
-                                  domain) [default]
-                        share - put every device behind one IOMMU into the
-                                same protection domain
                         fullflush - enable flushing of IO/TLB entries when
                                     they are unmapped. Otherwise they are
                                     flushed before they will be reused, which
diff --git a/Documentation/networking/x25-iface.txt b/Documentation/networking/x25-iface.txt
index 975cc87ebdd1..78f662ee0622 100644
--- a/Documentation/networking/x25-iface.txt
+++ b/Documentation/networking/x25-iface.txt
@@ -20,23 +20,23 @@ the rest of the skbuff, if any more information does exist.
 Packet Layer to Device Driver
 -----------------------------
 
-First Byte = 0x00
+First Byte = 0x00 (X25_IFACE_DATA)
 
 This indicates that the rest of the skbuff contains data to be transmitted
 over the LAPB link. The LAPB link should already exist before any data is
 passed down.
 
-First Byte = 0x01
+First Byte = 0x01 (X25_IFACE_CONNECT)
 
 Establish the LAPB link. If the link is already established then the connect
 confirmation message should be returned as soon as possible.
 
-First Byte = 0x02
+First Byte = 0x02 (X25_IFACE_DISCONNECT)
 
 Terminate the LAPB link. If it is already disconnected then the disconnect
 confirmation message should be returned as soon as possible.
 
-First Byte = 0x03
+First Byte = 0x03 (X25_IFACE_PARAMS)
 
 LAPB parameters. To be defined.
 
@@ -44,22 +44,22 @@ LAPB parameters. To be defined.
 Device Driver to Packet Layer
 -----------------------------
 
-First Byte = 0x00
+First Byte = 0x00 (X25_IFACE_DATA)
 
 This indicates that the rest of the skbuff contains data that has been
 received over the LAPB link.
 
-First Byte = 0x01
+First Byte = 0x01 (X25_IFACE_CONNECT)
 
 LAPB link has been established. The same message is used for both a LAPB
 link connect_confirmation and a connect_indication.
 
-First Byte = 0x02
+First Byte = 0x02 (X25_IFACE_DISCONNECT)
 
 LAPB link has been terminated. This same message is used for both a LAPB
 link disconnect_confirmation and a disconnect_indication.
 
-First Byte = 0x03
+First Byte = 0x03 (X25_IFACE_PARAMS)
 
 LAPB parameters. To be defined.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index a7ff13e7ae23..a73b9b3cffad 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -485,8 +485,8 @@ S:	Maintained
 F:      drivers/input/mouse/bcm5974.c
 
 APPLE SMC DRIVER
-M:      Nicolas Boichat <nicolas@boichat.ch>
-L:      mactel-linux-devel@lists.sourceforge.net
+M:      Henrik Rydberg <rydberg@euromail.se>
+L:      lm-sensors@lm-sensors.org
 S:      Maintained
 F:      drivers/hwmon/applesmc.c
 
@@ -971,6 +971,16 @@ L:	linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 W:      http://www.mcuos.com
 S:      Maintained
 
+ARM/U300 MACHINE SUPPORT
+M:      Linus Walleij <linus.walleij@stericsson.com>
+L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
+S:      Supported
+F:      arch/arm/mach-u300/
+F:      drivers/i2c/busses/i2c-stu300.c
+F:      drivers/rtc/rtc-coh901331.c
+F:      drivers/watchdog/coh901327_wdt.c
+F:      drivers/dma/coh901318*
+
 ARM/U8500 ARM ARCHITECTURE
 M:      Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
@@ -3946,6 +3956,7 @@ F:	net/rfkill/
 F:      net/wireless/
 F:      include/net/ieee80211*
 F:      include/linux/wireless.h
+F:      include/linux/iw_handler.h
 F:      drivers/net/wireless/
 
 NETWORKING DRIVERS
diff --git a/Makefile b/Makefile
index 67c1001cfbf5..fa1db9001754 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,8 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 34
-EXTRAVERSION = -rc3
-NAME = Man-Eating Seals of Antiquity
+EXTRAVERSION = -rc5
+NAME = Sheep on Meth
 
 # *DOCUMENTATION*
 # To see a list of typical targets execute "make help"
diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
index 0f23009170a1..6ab6b337a913 100644
--- a/arch/arm/boot/compressed/head.S
+++ b/arch/arm/boot/compressed/head.S
@@ -172,7 +172,7 @@ not_angel:
                 adr     r0, LC0
  ARM(           ldmia   r0, {r1, r2, r3, r4, r5, r6, r11, ip, sp})
  THUMB(         ldmia   r0, {r1, r2, r3, r4, r5, r6, r11, ip}   )
- THUMB(         ldr     sp, [r0, #28]                           )
+ THUMB(         ldr     sp, [r0, #32]                           )
                 subs    r0, r0, r1              @ calculate the delta offset
 
                                                 @ if delta is zero, we are
diff --git a/arch/arm/include/asm/highmem.h b/arch/arm/include/asm/highmem.h
index 7f36d00600b4..feb988a7ec37 100644
--- a/arch/arm/include/asm/highmem.h
+++ b/arch/arm/include/asm/highmem.h
@@ -11,7 +11,11 @@
 
 #define kmap_prot               PAGE_KERNEL
 
-#define flush_cache_kmaps()     flush_cache_all()
+#define flush_cache_kmaps() \
+        do { \
+                if (cache_is_vivt()) \
+                        flush_cache_all(); \
+        } while (0)
 
 extern pte_t *pkmap_page_table;
 
@@ -21,11 +25,20 @@ extern void *kmap_high(struct page *page);
 extern void *kmap_high_get(struct page *page);
 extern void kunmap_high(struct page *page);
 
+extern void *kmap_high_l1_vipt(struct page *page, pte_t *saved_pte);
+extern void kunmap_high_l1_vipt(struct page *page, pte_t saved_pte);
+
+/*
+ * The following functions are already defined by <linux/highmem.h>
+ * when CONFIG_HIGHMEM is not set.
+ */
+#ifdef CONFIG_HIGHMEM
 extern void *kmap(struct page *page);
 extern void kunmap(struct page *page);
 extern void *kmap_atomic(struct page *page, enum km_type type);
 extern void kunmap_atomic(void *kvaddr, enum km_type type);
 extern void *kmap_atomic_pfn(unsigned long pfn, enum km_type type);
 extern struct page *kmap_atomic_to_page(const void *ptr);
+#endif
 
 #endif
diff --git a/arch/arm/include/asm/kmap_types.h b/arch/arm/include/asm/kmap_types.h
index c019949a5189..c4b2ea3fbe42 100644
--- a/arch/arm/include/asm/kmap_types.h
+++ b/arch/arm/include/asm/kmap_types.h
@@ -18,6 +18,7 @@ enum km_type {
         KM_IRQ1,
         KM_SOFTIRQ0,
         KM_SOFTIRQ1,
+        KM_L1_CACHE,
         KM_L2_CACHE,
         KM_TYPE_NR
 };
diff --git a/arch/arm/include/asm/ucontext.h b/arch/arm/include/asm/ucontext.h
index bf65e9f4525d..47f023aa8495 100644
--- a/arch/arm/include/asm/ucontext.h
+++ b/arch/arm/include/asm/ucontext.h
@@ -59,23 +59,22 @@ struct iwmmxt_sigframe {
 #endif /* CONFIG_IWMMXT */
 
 #ifdef CONFIG_VFP
-#if __LINUX_ARM_ARCH__ < 6
-/* For ARM pre-v6, we use fstmiax and fldmiax.  This adds one extra
- * word after the registers, and a word of padding at the end for
- * alignment.  */
 #define VFP_MAGIC               0x56465001
-#define VFP_STORAGE_SIZE        152
-#else
-#define VFP_MAGIC               0x56465002
-#define VFP_STORAGE_SIZE        144
-#endif
 
 struct vfp_sigframe
 {
         unsigned long           magic;
         unsigned long           size;
-        union vfp_state         storage;
-};
+        struct user_vfp         ufp;
+        struct user_vfp_exc     ufp_exc;
+} __attribute__((__aligned__(8)));
+
+/*
+ *  8 byte for magic and size, 264 byte for ufp, 12 bytes for ufp_exc,
+ *  4 bytes padding.
+ */
+#define VFP_STORAGE_SIZE        sizeof(struct vfp_sigframe)
+
 #endif /* CONFIG_VFP */
 
 /*
@@ -91,7 +90,7 @@ struct aux_sigframe {
 #ifdef CONFIG_IWMMXT
         struct iwmmxt_sigframe  iwmmxt;
 #endif
-#if 0 && defined CONFIG_VFP /* Not yet saved.  */
+#ifdef CONFIG_VFP
         struct vfp_sigframe     vfp;
 #endif
         /* Something that isn't a valid magic number for any coprocessor.  */
diff --git a/arch/arm/include/asm/user.h b/arch/arm/include/asm/user.h
index df95e050f9dd..05ac4b06876a 100644
--- a/arch/arm/include/asm/user.h
+++ b/arch/arm/include/asm/user.h
@@ -83,11 +83,21 @@ struct user{
 
 /*
  * User specific VFP registers. If only VFPv2 is present, registers 16 to 31
- * are ignored by the ptrace system call.
+ * are ignored by the ptrace system call and the signal handler.
  */
 struct user_vfp {
         unsigned long long fpregs[32];
         unsigned long fpscr;
 };
 
+/*
+ * VFP exception registers exposed to user space during signal delivery.
+ * Fields not relavant to the current VFP architecture are ignored.
+ */
+struct user_vfp_exc {
+        unsigned long   fpexc;
+        unsigned long   fpinst;
+        unsigned long   fpinst2;
+};
+
 #endif /* _ARM_USER_H */
diff --git a/arch/arm/kernel/signal.c b/arch/arm/kernel/signal.c
index e7714f367eb8..907d5a620bca 100644
--- a/arch/arm/kernel/signal.c
+++ b/arch/arm/kernel/signal.c
@@ -18,6 +18,7 @@
 #include <asm/cacheflush.h>
 #include <asm/ucontext.h>
 #include <asm/unistd.h>
+#include <asm/vfp.h>
 
 #include "ptrace.h"
 #include "signal.h"
@@ -175,6 +176,90 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)
 
 #endif
 
+#ifdef CONFIG_VFP
+
+static int preserve_vfp_context(struct vfp_sigframe __user *frame)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *h = &thread->vfpstate.hard;
+        const unsigned long magic = VFP_MAGIC;
+        const unsigned long size = VFP_STORAGE_SIZE;
+        int err = 0;
+
+        vfp_sync_hwstate(thread);
+        __put_user_error(magic, &frame->magic, err);
+        __put_user_error(size, &frame->size, err);
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_to_user(&frame->ufp.fpregs, &h->fpregs,
+                              sizeof(h->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __put_user_error(h->fpscr, &frame->ufp.fpscr, err);
+
+        /*
+         * Copy the exception registers.
+         */
+        __put_user_error(h->fpexc, &frame->ufp_exc.fpexc, err);
+        __put_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
+        __put_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+
+        return err ? -EFAULT : 0;
+}
+
+static int restore_vfp_context(struct vfp_sigframe __user *frame)
+{
+        struct thread_info *thread = current_thread_info();
+        struct vfp_hard_struct *h = &thread->vfpstate.hard;
+        unsigned long magic;
+        unsigned long size;
+        unsigned long fpexc;
+        int err = 0;
+
+        __get_user_error(magic, &frame->magic, err);
+        __get_user_error(size, &frame->size, err);
+
+        if (err)
+                return -EFAULT;
+        if (magic != VFP_MAGIC || size != VFP_STORAGE_SIZE)
+                return -EINVAL;
+
+        /*
+         * Copy the floating point registers. There can be unused
+         * registers see asm/hwcap.h for details.
+         */
+        err |= __copy_from_user(&h->fpregs, &frame->ufp.fpregs,
+                                sizeof(h->fpregs));
+        /*
+         * Copy the status and control register.
+         */
+        __get_user_error(h->fpscr, &frame->ufp.fpscr, err);
+
+        /*
+         * Sanitise and restore the exception registers.
+         */
+        __get_user_error(fpexc, &frame->ufp_exc.fpexc, err);
+        /* Ensure the VFP is enabled. */
+        fpexc |= FPEXC_EN;
+        /* Ensure FPINST2 is invalid and the exception flag is cleared. */
+        fpexc &= ~(FPEXC_EX | FPEXC_FP2V);
+        h->fpexc = fpexc;
+
+        __get_user_error(h->fpinst, &frame->ufp_exc.fpinst, err);
+        __get_user_error(h->fpinst2, &frame->ufp_exc.fpinst2, err);
+
+        if (!err)
+                vfp_flush_hwstate(thread);
+
+        return err ? -EFAULT : 0;
+}
+
+#endif
+
 /*
  * Do a signal return; undo the signal stack.  These are aligned to 64-bit.
  */
@@ -233,8 +318,8 @@ static int restore_sigframe(struct pt_regs *regs, struct sigframe __user *sf)
                 err |= restore_iwmmxt_context(&aux->iwmmxt);
 #endif
 #ifdef CONFIG_VFP
-//      if (err == 0)
-//              err |= vfp_restore_state(&sf->aux.vfp);
+        if (err == 0)
+                err |= restore_vfp_context(&aux->vfp);
 #endif
 
         return err;
@@ -348,8 +433,8 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)
                 err |= preserve_iwmmxt_context(&aux->iwmmxt);
 #endif
 #ifdef CONFIG_VFP
-//      if (err == 0)
-//              err |= vfp_save_state(&sf->aux.vfp);
+        if (err == 0)
+                err |= preserve_vfp_context(&aux->vfp);
 #endif
         __put_user_error(0, &aux->end_magic, err);
 
diff --git a/arch/arm/mach-at91/Makefile b/arch/arm/mach-at91/Makefile
index 027dd570dcc3..d4004557532a 100644
--- a/arch/arm/mach-at91/Makefile
+++ b/arch/arm/mach-at91/Makefile
@@ -16,8 +16,8 @@ obj-$(CONFIG_ARCH_AT91SAM9261)	+= at91sam9261.o at91sam926x_time.o at91sam9261_d
 obj-$(CONFIG_ARCH_AT91SAM9G10)  += at91sam9261.o at91sam926x_time.o at91sam9261_devices.o sam9_smc.o
 obj-$(CONFIG_ARCH_AT91SAM9263)  += at91sam9263.o at91sam926x_time.o at91sam9263_devices.o sam9_smc.o
 obj-$(CONFIG_ARCH_AT91SAM9RL)   += at91sam9rl.o at91sam926x_time.o at91sam9rl_devices.o sam9_smc.o
-obj-$(CONFIG_ARCH_AT91SAM9G20)  += at91sam9260.o at91sam926x_time.o at91sam9260_devices.o  sam9_smc.o
- obj-$(CONFIG_ARCH_AT91SAM9G45) += at91sam9g45.o at91sam926x_time.o at91sam9g45_devices.o sam9_smc.o
+obj-$(CONFIG_ARCH_AT91SAM9G20)  += at91sam9260.o at91sam926x_time.o at91sam9260_devices.o sam9_smc.o
+obj-$(CONFIG_ARCH_AT91SAM9G45)  += at91sam9g45.o at91sam926x_time.o at91sam9g45_devices.o sam9_smc.o
 obj-$(CONFIG_ARCH_AT91CAP9)     += at91cap9.o at91sam926x_time.o at91cap9_devices.o sam9_smc.o
 obj-$(CONFIG_ARCH_AT572D940HF)  += at572d940hf.o at91sam926x_time.o at572d940hf_devices.o sam9_smc.o
 obj-$(CONFIG_ARCH_AT91X40)      += at91x40.o at91x40_time.o
diff --git a/arch/arm/mach-at91/pm_slowclock.S b/arch/arm/mach-at91/pm_slowclock.S
index 987fab3d846a..9c5b48e68a71 100644
--- a/arch/arm/mach-at91/pm_slowclock.S
+++ b/arch/arm/mach-at91/pm_slowclock.S
@@ -175,8 +175,6 @@ ENTRY(at91_slow_clock)
         orr     r3, r3, #(1 << 29)              /* bit 29 always set */
         str     r3, [r1, #(AT91_CKGR_PLLAR - AT91_PMC)]
 
-        wait_pllalock
-
         /* Save PLLB setting and disable it */
         ldr     r3, [r1, #(AT91_CKGR_PLLBR - AT91_PMC)]
         str     r3, .saved_pllbr
@@ -184,8 +182,6 @@ ENTRY(at91_slow_clock)
         mov     r3, #AT91_PMC_PLLCOUNT
         str     r3, [r1, #(AT91_CKGR_PLLBR - AT91_PMC)]
 
-        wait_pllblock
-
         /* Turn off the main oscillator */
         ldr     r3, [r1, #(AT91_CKGR_MOR - AT91_PMC)]
         bic     r3, r3, #AT91_PMC_MOSCEN
@@ -205,13 +201,25 @@ ENTRY(at91_slow_clock)
         ldr     r3, .saved_pllbr
         str     r3, [r1, #(AT91_CKGR_PLLBR - AT91_PMC)]
 
+        tst     r3, #(AT91_PMC_MUL &  0xff0000)
+        bne     1f
+        tst     r3, #(AT91_PMC_MUL & ~0xff0000)
+        beq     2f
+1:
         wait_pllblock
+2:
 
         /* Restore PLLA setting */
         ldr     r3, .saved_pllar
         str     r3, [r1, #(AT91_CKGR_PLLAR - AT91_PMC)]
 
+        tst     r3, #(AT91_PMC_MUL &  0xff0000)
+        bne     3f
+        tst     r3, #(AT91_PMC_MUL & ~0xff0000)
+        beq     4f
+3:
         wait_pllalock
+4:
 
 #ifdef SLOWDOWN_MASTER_CLOCK
         /*
diff --git a/arch/arm/mach-bcmring/dma.c b/arch/arm/mach-bcmring/dma.c
index 2ccf670ce1ac..29c0a911df26 100644
--- a/arch/arm/mach-bcmring/dma.c
+++ b/arch/arm/mach-bcmring/dma.c
@@ -2221,11 +2221,15 @@ EXPORT_SYMBOL(dma_map_create_descriptor_ring);
 int dma_unmap(DMA_MemMap_t *memMap,     /* Stores state information about the map */
               int dirtied       /* non-zero if any of the pages were modified */
     ) {
+
+        int rc = 0;
         int regionIdx;
         int segmentIdx;
         DMA_Region_t *region;
         DMA_Segment_t *segment;
 
+        down(&memMap->lock);
+
         for (regionIdx = 0; regionIdx < memMap->numRegionsUsed; regionIdx++) {
                 region = &memMap->region[regionIdx];
 
@@ -2239,7 +2243,8 @@ int dma_unmap(DMA_MemMap_t *memMap,	/* Stores state information about the map */
                                         printk(KERN_ERR
                                                "%s: vmalloc'd pages are not yet supported\n",
                                                __func__);
-                                        return -EINVAL;
+                                        rc = -EINVAL;
+                                        goto out;
                                 }
 
                         case DMA_MEM_TYPE_KMALLOC:
@@ -2276,7 +2281,8 @@ int dma_unmap(DMA_MemMap_t *memMap,	/* Stores state information about the map */
                                         printk(KERN_ERR
                                                "%s: Unsupported memory type: %d\n",
                                                __func__, region->memType);
-                                        return -EINVAL;
+                                        rc = -EINVAL;
+                                        goto out;
                                 }
                         }
 
@@ -2314,9 +2320,10 @@ int dma_unmap(DMA_MemMap_t *memMap,	/* Stores state information about the map */
         memMap->numRegionsUsed = 0;
         memMap->inUse = 0;
 
+out:
         up(&memMap->lock);
 
-        return 0;
+        return rc;
 }
 
 EXPORT_SYMBOL(dma_unmap);
diff --git a/arch/arm/mach-ep93xx/gpio.c b/arch/arm/mach-ep93xx/gpio.c
index cc377ae8c428..cf547ad7ebd4 100644
--- a/arch/arm/mach-ep93xx/gpio.c
+++ b/arch/arm/mach-ep93xx/gpio.c
@@ -25,7 +25,7 @@
 #include <mach/hardware.h>
 
 /*************************************************************************
- * GPIO handling for EP93xx
+ * Interrupt handling for EP93xx on-chip GPIOs
  *************************************************************************/
 static unsigned char gpio_int_unmasked[3];
 static unsigned char gpio_int_enabled[3];
@@ -40,7 +40,7 @@ static const u8 eoi_register_offset[3]		= { 0x98, 0xb4, 0x54 };
 static const u8 int_en_register_offset[3]       = { 0x9c, 0xb8, 0x58 };
 static const u8 int_debounce_register_offset[3] = { 0xa8, 0xc4, 0x64 };
 
-void ep93xx_gpio_update_int_params(unsigned port)
+static void ep93xx_gpio_update_int_params(unsigned port)
 {
         BUG_ON(port > 2);
 
@@ -56,7 +56,7 @@ void ep93xx_gpio_update_int_params(unsigned port)
                 EP93XX_GPIO_REG(int_en_register_offset[port]));
 }
 
-void ep93xx_gpio_int_mask(unsigned line)
+static inline void ep93xx_gpio_int_mask(unsigned line)
 {
         gpio_int_unmasked[line >> 3] &= ~(1 << (line & 7));
 }
diff --git a/arch/arm/mach-mx3/Kconfig b/arch/arm/mach-mx3/Kconfig
index 3872af1cf2c3..170f68e46dd5 100644
--- a/arch/arm/mach-mx3/Kconfig
+++ b/arch/arm/mach-mx3/Kconfig
@@ -62,6 +62,15 @@ config MACH_MX31_3DS
           Include support for MX31PDK (3DS) platform. This includes specific
           configurations for the board and its peripherals.
 
+config MACH_MX31_3DS_MXC_NAND_USE_BBT
+        bool "Make the MXC NAND driver use the in flash Bad Block Table"
+        depends on MACH_MX31_3DS
+        depends on MTD_NAND_MXC
+        help
+          Enable this if you want that the MXC NAND driver uses the in flash
+          Bad Block Table to know what blocks are bad instead of scanning the
+          entire flash looking for bad block markers.
+
 config MACH_MX31MOBOARD
         bool "Support mx31moboard platforms (EPFL Mobots group)"
         select ARCH_MX31
@@ -95,6 +104,7 @@ config MACH_PCM043
 config MACH_ARMADILLO5X0
         bool "Support Atmark Armadillo-500 Development Base Board"
         select ARCH_MX31
+        select MXC_ULPI if USB_ULPI
         help
           Include support for Atmark Armadillo-500 platform. This includes
           specific configurations for the board and its peripherals.
diff --git a/arch/arm/mach-mx3/clock-imx31.c b/arch/arm/mach-mx3/clock-imx31.c
index 80dba9966b5e..9a9eb6de6127 100644
--- a/arch/arm/mach-mx3/clock-imx31.c
+++ b/arch/arm/mach-mx3/clock-imx31.c
@@ -468,6 +468,7 @@ static struct clk ahb_clk = {
         }
 
 DEFINE_CLOCK(perclk_clk,  0, NULL,          0, NULL, NULL, &ipg_clk);
+DEFINE_CLOCK(ckil_clk,    0, NULL,          0, clk_ckil_get_rate, NULL, NULL);
 
 DEFINE_CLOCK(sdhc1_clk,   0, MXC_CCM_CGR0,  0, NULL, NULL, &perclk_clk);
 DEFINE_CLOCK(sdhc2_clk,   1, MXC_CCM_CGR0,  2, NULL, NULL, &perclk_clk);
@@ -490,7 +491,7 @@ DEFINE_CLOCK(mpeg4_clk,   0, MXC_CCM_CGR1,  0, NULL, NULL, &ahb_clk);
 DEFINE_CLOCK(mstick1_clk, 0, MXC_CCM_CGR1,  2, mstick1_get_rate, NULL, &usb_pll_clk);
 DEFINE_CLOCK(mstick2_clk, 1, MXC_CCM_CGR1,  4, mstick2_get_rate, NULL, &usb_pll_clk);
 DEFINE_CLOCK1(csi_clk,    0, MXC_CCM_CGR1,  6, csi, NULL, &serial_pll_clk);
-DEFINE_CLOCK(rtc_clk,     0, MXC_CCM_CGR1,  8, NULL, NULL, &ipg_clk);
+DEFINE_CLOCK(rtc_clk,     0, MXC_CCM_CGR1,  8, NULL, NULL, &ckil_clk);
 DEFINE_CLOCK(wdog_clk,    0, MXC_CCM_CGR1, 10, NULL, NULL, &ipg_clk);
 DEFINE_CLOCK(pwm_clk,     0, MXC_CCM_CGR1, 12, NULL, NULL, &perclk_clk);
 DEFINE_CLOCK(usb_clk2,    0, MXC_CCM_CGR1, 18, usb_get_rate, NULL, &ahb_clk);
@@ -514,7 +515,6 @@ DEFINE_CLOCK(usb_clk1,    0, NULL,          0, usb_get_rate, NULL, &usb_pll_clk)
 DEFINE_CLOCK(nfc_clk,     0, NULL,          0, nfc_get_rate, NULL, &ahb_clk);
 DEFINE_CLOCK(scc_clk,     0, NULL,          0, NULL, NULL, &ipg_clk);
 DEFINE_CLOCK(ipg_clk,     0, NULL,          0, ipg_get_rate, NULL, &ahb_clk);
-DEFINE_CLOCK(ckil_clk,    0, NULL,          0, clk_ckil_get_rate, NULL, NULL);
 
 #define _REGISTER_CLOCK(d, n, c) \
         { \
@@ -572,7 +572,6 @@ static struct clk_lookup lookups[] = {
         _REGISTER_CLOCK(NULL, "iim", iim_clk)
         _REGISTER_CLOCK(NULL, "mpeg4", mpeg4_clk)
         _REGISTER_CLOCK(NULL, "mbx", mbx_clk)
-        _REGISTER_CLOCK("mxc_rtc", NULL, ckil_clk)
 };
 
 int __init mx31_clocks_init(unsigned long fref)
diff --git a/arch/arm/mach-mx3/devices.c b/arch/arm/mach-mx3/devices.c
index 6adb586515ea..f8911154a9fa 100644
--- a/arch/arm/mach-mx3/devices.c
+++ b/arch/arm/mach-mx3/devices.c
@@ -575,11 +575,26 @@ struct platform_device imx_ssi_device1 = {
         .resource = imx_ssi_resources1,
 };
 
-static int mx3_devices_init(void)
+static struct resource imx_wdt_resources[] = {
+        {
+                .flags = IORESOURCE_MEM,
+        },
+};
+
+struct platform_device imx_wdt_device0 = {
+        .name           = "imx-wdt",
+        .id             = 0,
+        .num_resources  = ARRAY_SIZE(imx_wdt_resources),
+        .resource       = imx_wdt_resources,
+};
+
+static int __init mx3_devices_init(void)
 {
         if (cpu_is_mx31()) {
                 mxc_nand_resources[0].start = MX31_NFC_BASE_ADDR;
                 mxc_nand_resources[0].end = MX31_NFC_BASE_ADDR + 0xfff;
+                imx_wdt_resources[0].start = MX31_WDOG_BASE_ADDR;
+                imx_wdt_resources[0].end = MX31_WDOG_BASE_ADDR + 0x3fff;
                 mxc_register_device(&mxc_rnga_device, NULL);
         }
         if (cpu_is_mx35()) {
@@ -597,6 +612,8 @@ static int mx3_devices_init(void)
                 imx_ssi_resources0[1].end = MX35_INT_SSI1;
                 imx_ssi_resources1[1].start = MX35_INT_SSI2;
                 imx_ssi_resources1[1].end = MX35_INT_SSI2;
+                imx_wdt_resources[0].start = MX35_WDOG_BASE_ADDR;
+                imx_wdt_resources[0].end = MX35_WDOG_BASE_ADDR + 0x3fff;
         }
 
         return 0;
diff --git a/arch/arm/mach-mx3/devices.h b/arch/arm/mach-mx3/devices.h
index 42cf175eac6b..4f77eb501274 100644
--- a/arch/arm/mach-mx3/devices.h
+++ b/arch/arm/mach-mx3/devices.h
@@ -25,4 +25,5 @@ extern struct platform_device mxc_spi_device1;
 extern struct platform_device mxc_spi_device2;
 extern struct platform_device imx_ssi_device0;
 extern struct platform_device imx_ssi_device1;
-
+extern struct platform_device imx_ssi_device1;
+extern struct platform_device imx_wdt_device0;
diff --git a/arch/arm/mach-mx3/mach-armadillo5x0.c b/arch/arm/mach-mx3/mach-armadillo5x0.c
index 3d72b0b89705..5f72ec91af2d 100644
--- a/arch/arm/mach-mx3/mach-armadillo5x0.c
+++ b/arch/arm/mach-mx3/mach-armadillo5x0.c
@@ -36,6 +36,9 @@
 #include <linux/input.h>
 #include <linux/gpio_keys.h>
 #include <linux/i2c.h>
+#include <linux/usb/otg.h>
+#include <linux/usb/ulpi.h>
+#include <linux/delay.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -52,6 +55,8 @@
 #include <mach/ipu.h>
 #include <mach/mx3fb.h>
 #include <mach/mxc_nand.h>
+#include <mach/mxc_ehci.h>
+#include <mach/ulpi.h>
 
 #include "devices.h"
 #include "crm_regs.h"
@@ -103,8 +108,158 @@ static int armadillo5x0_pins[] = {
         /* I2C2 */
         MX31_PIN_CSPI2_MOSI__SCL,
         MX31_PIN_CSPI2_MISO__SDA,
+        /* OTG */
+        MX31_PIN_USBOTG_DATA0__USBOTG_DATA0,
+        MX31_PIN_USBOTG_DATA1__USBOTG_DATA1,
+        MX31_PIN_USBOTG_DATA2__USBOTG_DATA2,
+        MX31_PIN_USBOTG_DATA3__USBOTG_DATA3,
+        MX31_PIN_USBOTG_DATA4__USBOTG_DATA4,
+        MX31_PIN_USBOTG_DATA5__USBOTG_DATA5,
+        MX31_PIN_USBOTG_DATA6__USBOTG_DATA6,
+        MX31_PIN_USBOTG_DATA7__USBOTG_DATA7,
+        MX31_PIN_USBOTG_CLK__USBOTG_CLK,
+        MX31_PIN_USBOTG_DIR__USBOTG_DIR,
+        MX31_PIN_USBOTG_NXT__USBOTG_NXT,
+        MX31_PIN_USBOTG_STP__USBOTG_STP,
+        /* USB host 2 */
+        IOMUX_MODE(MX31_PIN_USBH2_CLK, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_USBH2_DIR, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_USBH2_NXT, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_USBH2_STP, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_USBH2_DATA0, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_USBH2_DATA1, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_STXD3, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_SRXD3, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_SCK3, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_SFS3, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_STXD6, IOMUX_CONFIG_FUNC),
+        IOMUX_MODE(MX31_PIN_SRXD6, IOMUX_CONFIG_FUNC),
 };
 
+/* USB */
+#if defined(CONFIG_USB_ULPI)
+
+#define OTG_RESET IOMUX_TO_GPIO(MX31_PIN_STXD4)
+#define USBH2_RESET IOMUX_TO_GPIO(MX31_PIN_SCK6)
+#define USBH2_CS IOMUX_TO_GPIO(MX31_PIN_GPIO1_3)
+
+#define USB_PAD_CFG (PAD_CTL_DRV_MAX | PAD_CTL_SRE_FAST | PAD_CTL_HYS_CMOS | \
+                        PAD_CTL_ODE_CMOS | PAD_CTL_100K_PU)
+
+static int usbotg_init(struct platform_device *pdev)
+{
+        int err;
+
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA0, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA1, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA2, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA3, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA4, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA5, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA6, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DATA7, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_CLK, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_DIR, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_NXT, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBOTG_STP, USB_PAD_CFG);
+
+        /* Chip already enabled by hardware */
+        /* OTG phy reset*/
+        err = gpio_request(OTG_RESET, "USB-OTG-RESET");
+        if (err) {
+                pr_err("Failed to request the usb otg reset gpio\n");
+                return err;
+        }
+
+        err = gpio_direction_output(OTG_RESET, 1/*HIGH*/);
+        if (err) {
+                pr_err("Failed to reset the usb otg phy\n");
+                goto otg_free_reset;
+        }
+
+        gpio_set_value(OTG_RESET, 0/*LOW*/);
+        mdelay(5);
+        gpio_set_value(OTG_RESET, 1/*HIGH*/);
+
+        return 0;
+
+otg_free_reset:
+        gpio_free(OTG_RESET);
+        return err;
+}
+
+static int usbh2_init(struct platform_device *pdev)
+{
+        int err;
+
+        mxc_iomux_set_pad(MX31_PIN_USBH2_CLK, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBH2_DIR, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBH2_NXT, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBH2_STP, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBH2_DATA0, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_USBH2_DATA1, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_SRXD6, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_STXD6, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_SFS3, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_SCK3, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_SRXD3, USB_PAD_CFG);
+        mxc_iomux_set_pad(MX31_PIN_STXD3, USB_PAD_CFG);
+
+        mxc_iomux_set_gpr(MUX_PGP_UH2, true);
+
+
+        /* Enable the chip */
+        err = gpio_request(USBH2_CS, "USB-H2-CS");
+        if (err) {
+                pr_err("Failed to request the usb host 2 CS gpio\n");
+                return err;
+        }
+
+        err = gpio_direction_output(USBH2_CS, 0/*Enabled*/);
+        if (err) {
+                pr_err("Failed to drive the usb host 2 CS gpio\n");
+                goto h2_free_cs;
+        }
+
+        /* H2 phy reset*/
+        err = gpio_request(USBH2_RESET, "USB-H2-RESET");
+        if (err) {
+                pr_err("Failed to request the usb host 2 reset gpio\n");
+                goto h2_free_cs;
+        }
+
+        err = gpio_direction_output(USBH2_RESET, 1/*HIGH*/);
+        if (err) {
+                pr_err("Failed to reset the usb host 2 phy\n");
+                goto h2_free_reset;
+        }
+
+        gpio_set_value(USBH2_RESET, 0/*LOW*/);
+        mdelay(5);
+        gpio_set_value(USBH2_RESET, 1/*HIGH*/);
+
+        return 0;
+
+h2_free_reset:
+        gpio_free(USBH2_RESET);
+h2_free_cs:
+        gpio_free(USBH2_CS);
+        return err;
+}
+
+static struct mxc_usbh_platform_data usbotg_pdata = {
+        .init   = usbotg_init,
+        .portsc = MXC_EHCI_MODE_ULPI | MXC_EHCI_UTMI_8BIT,
+        .flags  = MXC_EHCI_POWER_PINS_ENABLED | MXC_EHCI_INTERFACE_DIFF_UNI,
+};
+
+static struct mxc_usbh_platform_data usbh2_pdata = {
+        .init   = usbh2_init,
+        .portsc = MXC_EHCI_MODE_ULPI | MXC_EHCI_UTMI_8BIT,
+        .flags  = MXC_EHCI_POWER_PINS_ENABLED | MXC_EHCI_INTERFACE_DIFF_UNI,
+};
+#endif /* CONFIG_USB_ULPI */
+
 /* RTC over I2C*/
 #define ARMADILLO5X0_RTC_GPIO   IOMUX_TO_GPIO(MX31_PIN_SRXD4)
 
@@ -393,6 +548,17 @@ static void __init armadillo5x0_init(void)
         if (armadillo5x0_i2c_rtc.irq == 0)
                 pr_warning("armadillo5x0_init: failed to get RTC IRQ\n");
         i2c_register_board_info(1, &armadillo5x0_i2c_rtc, 1);
+
+        /* USB */
+#if defined(CONFIG_USB_ULPI)
+        usbotg_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                        USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+        usbh2_pdata.otg = otg_ulpi_create(&mxc_ulpi_access_ops,
+                        USB_OTG_DRV_VBUS | USB_OTG_DRV_VBUS_EXT);
+
+        mxc_register_device(&mxc_otg_host, &usbotg_pdata);
+        mxc_register_device(&mxc_usbh2, &usbh2_pdata);
+#endif
 }
 
 static void __init armadillo5x0_timer_init(void)
diff --git a/arch/arm/mach-mx3/mach-mx31_3ds.c b/arch/arm/mach-mx3/mach-mx31_3ds.c
index b88c18ad7698..f54af1e29ca4 100644
--- a/arch/arm/mach-mx3/mach-mx31_3ds.c
+++ b/arch/arm/mach-mx3/mach-mx31_3ds.c
@@ -23,6 +23,9 @@
 #include <linux/gpio.h>
 #include <linux/smsc911x.h>
 #include <linux/platform_device.h>
+#include <linux/mfd/mc13783.h>
+#include <linux/spi/spi.h>
+#include <linux/regulator/machine.h>
 
 #include <mach/hardware.h>
 #include <asm/mach-types.h>
@@ -31,26 +34,96 @@
 #include <asm/memory.h>
 #include <asm/mach/map.h>
 #include <mach/common.h>
-#include <mach/board-mx31pdk.h>
+#include <mach/board-mx31_3ds.h>
 #include <mach/imx-uart.h>
 #include <mach/iomux-mx3.h>
+#include <mach/mxc_nand.h>
+#include <mach/spi.h>
 #include "devices.h"
 
 /*!
- * @file mx31pdk.c
+ * @file mx31_3ds.c
  *
  * @brief This file contains the board-specific initialization routines.
  *
  * @ingroup System
  */
 
-static int mx31pdk_pins[] = {
+static int mx31_3ds_pins[] = {
         /* UART1 */
         MX31_PIN_CTS1__CTS1,
         MX31_PIN_RTS1__RTS1,
         MX31_PIN_TXD1__TXD1,
         MX31_PIN_RXD1__RXD1,
         IOMUX_MODE(MX31_PIN_GPIO1_1, IOMUX_CONFIG_GPIO),
+        /* SPI 1 */
+        MX31_PIN_CSPI2_SCLK__SCLK,
+        MX31_PIN_CSPI2_MOSI__MOSI,
+        MX31_PIN_CSPI2_MISO__MISO,
+        MX31_PIN_CSPI2_SPI_RDY__SPI_RDY,
+        MX31_PIN_CSPI2_SS0__SS0,
+        MX31_PIN_CSPI2_SS2__SS2, /*CS for MC13783 */
+        /* MC13783 IRQ */
+        IOMUX_MODE(MX31_PIN_GPIO1_3, IOMUX_CONFIG_GPIO),
+};
+
+/* Regulators */
+static struct regulator_init_data pwgtx_init = {
+        .constraints = {
+                .boot_on        = 1,
+                .always_on      = 1,
+        },
+};
+
+static struct mc13783_regulator_init_data mx31_3ds_regulators[] = {
+        {
+                .id = MC13783_REGU_PWGT1SPI, /* Power Gate for ARM core. */
+                .init_data = &pwgtx_init,
+        }, {
+                .id = MC13783_REGU_PWGT2SPI, /* Power Gate for L2 Cache. */
+                .init_data = &pwgtx_init,
+        },
+};
+
+/* MC13783 */
+static struct mc13783_platform_data mc13783_pdata __initdata = {
+        .regulators = mx31_3ds_regulators,
+        .num_regulators = ARRAY_SIZE(mx31_3ds_regulators),
+        .flags  = MC13783_USE_REGULATOR,
+};
+
+/* SPI */
+static int spi1_internal_chipselect[] = {
+        MXC_SPI_CS(0),
+        MXC_SPI_CS(2),
+};
+
+static struct spi_imx_master spi1_pdata = {
+        .chipselect     = spi1_internal_chipselect,
+        .num_chipselect = ARRAY_SIZE(spi1_internal_chipselect),
+};
+
+static struct spi_board_info mx31_3ds_spi_devs[] __initdata = {
+        {
+                .modalias       = "mc13783",
+                .max_speed_hz   = 1000000,
+                .bus_num        = 1,
+                .chip_select    = 1, /* SS2 */
+                .platform_data  = &mc13783_pdata,
+                .irq            = IOMUX_TO_IRQ(MX31_PIN_GPIO1_3),
+                .mode = SPI_CS_HIGH,
+        },
+};
+
+/*
+ * NAND Flash
+ */
+static struct mxc_nand_platform_data imx31_3ds_nand_flash_pdata = {
+        .width          = 1,
+        .hw_ecc         = 1,
+#ifdef MACH_MX31_3DS_MXC_NAND_USE_BBT
+        .flash_bbt      = 1,
+#endif
 };
 
 static struct imxuart_platform_data uart_pdata = {
@@ -95,7 +168,7 @@ static struct platform_device smsc911x_device = {
  * LEDs, switches, interrupts for Ethernet.
  */
 
-static void mx31pdk_expio_irq_handler(uint32_t irq, struct irq_desc *desc)
+static void mx31_3ds_expio_irq_handler(uint32_t irq, struct irq_desc *desc)
 {
         uint32_t imr_val;
         uint32_t int_valid;
@@ -163,7 +236,7 @@ static struct irq_chip expio_irq_chip = {
         .unmask = expio_unmask_irq,
 };
 
-static int __init mx31pdk_init_expio(void)
+static int __init mx31_3ds_init_expio(void)
 {
         int i;
         int ret;
@@ -176,7 +249,7 @@ static int __init mx31pdk_init_expio(void)
                 return -ENODEV;
         }
 
-        pr_info("i.MX31PDK Debug board detected, rev = 0x%04X\n",
+        pr_info("i.MX31 3DS Debug board detected, rev = 0x%04X\n",
                 __raw_readw(CPLD_CODE_VER_REG));
 
         /*
@@ -201,7 +274,7 @@ static int __init mx31pdk_init_expio(void)
                 set_irq_flags(i, IRQF_VALID);
         }
         set_irq_type(EXPIO_PARENT_INT, IRQ_TYPE_LEVEL_LOW);
-        set_irq_chained_handler(EXPIO_PARENT_INT, mx31pdk_expio_irq_handler);
+        set_irq_chained_handler(EXPIO_PARENT_INT, mx31_3ds_expio_irq_handler);
 
         return 0;
 }
@@ -209,7 +282,7 @@ static int __init mx31pdk_init_expio(void)
 /*
  * This structure defines the MX31 memory map.
  */
-static struct map_desc mx31pdk_io_desc[] __initdata = {
+static struct map_desc mx31_3ds_io_desc[] __initdata = {
         {
                 .virtual = MX31_CS5_BASE_ADDR_VIRT,
                 .pfn = __phys_to_pfn(MX31_CS5_BASE_ADDR),
@@ -221,10 +294,10 @@ static struct map_desc mx31pdk_io_desc[] __initdata = {
 /*
  * Set up static virtual mappings.
  */
-static void __init mx31pdk_map_io(void)
+static void __init mx31_3ds_map_io(void)
 {
         mx31_map_io();
-        iotable_init(mx31pdk_io_desc, ARRAY_SIZE(mx31pdk_io_desc));
+        iotable_init(mx31_3ds_io_desc, ARRAY_SIZE(mx31_3ds_io_desc));
 }
 
 /*!
@@ -232,35 +305,40 @@ static void __init mx31pdk_map_io(void)
  */
 static void __init mxc_board_init(void)
 {
-        mxc_iomux_setup_multiple_pins(mx31pdk_pins, ARRAY_SIZE(mx31pdk_pins),
-                                      "mx31pdk");
+        mxc_iomux_setup_multiple_pins(mx31_3ds_pins, ARRAY_SIZE(mx31_3ds_pins),
+                                      "mx31_3ds");
 
         mxc_register_device(&mxc_uart_device0, &uart_pdata);
+        mxc_register_device(&mxc_nand_device, &imx31_3ds_nand_flash_pdata);
+
+        mxc_register_device(&mxc_spi_device1, &spi1_pdata);
+        spi_register_board_info(mx31_3ds_spi_devs,
+                                                ARRAY_SIZE(mx31_3ds_spi_devs));
 
-        if (!mx31pdk_init_expio())
+        if (!mx31_3ds_init_expio())
                 platform_device_register(&smsc911x_device);
 }
 
-static void __init mx31pdk_timer_init(void)
+static void __init mx31_3ds_timer_init(void)
 {
         mx31_clocks_init(26000000);
 }
 
-static struct sys_timer mx31pdk_timer = {
-        .init   = mx31pdk_timer_init,
+static struct sys_timer mx31_3ds_timer = {
+        .init   = mx31_3ds_timer_init,
 };
 
 /*
  * The following uses standard kernel macros defined in arch.h in order to
- * initialize __mach_desc_MX31PDK data structure.
+ * initialize __mach_desc_MX31_3DS data structure.
  */
 MACHINE_START(MX31_3DS, "Freescale MX31PDK (3DS)")
         /* Maintainer: Freescale Semiconductor, Inc. */
         .phys_io        = MX31_AIPS1_BASE_ADDR,
         .io_pg_offst    = (MX31_AIPS1_BASE_ADDR_VIRT >> 18) & 0xfffc,
         .boot_params    = MX3x_PHYS_OFFSET + 0x100,
-        .map_io         = mx31pdk_map_io,
+        .map_io         = mx31_3ds_map_io,
         .init_irq       = mx31_init_irq,
         .init_machine   = mxc_board_init,
-        .timer          = &mx31pdk_timer,
+        .timer          = &mx31_3ds_timer,
 MACHINE_END
diff --git a/arch/arm/mach-mx3/mach-pcm037.c b/arch/arm/mach-mx3/mach-pcm037.c
index 034ec8190065..2df1ec55a97e 100644
--- a/arch/arm/mach-mx3/mach-pcm037.c
+++ b/arch/arm/mach-mx3/mach-pcm037.c
@@ -35,7 +35,6 @@
 #include <linux/can/platform/sja1000.h>
 #include <linux/usb/otg.h>
 #include <linux/usb/ulpi.h>
-#include <linux/fsl_devices.h>
 #include <linux/gfp.h>
 
 #include <media/soc_camera.h>
diff --git a/arch/arm/mach-mx3/mx31lite-db.c b/arch/arm/mach-mx3/mx31lite-db.c
index ccd874225c3b..093c595ca581 100644
--- a/arch/arm/mach-mx3/mx31lite-db.c
+++ b/arch/arm/mach-mx3/mx31lite-db.c
@@ -28,7 +28,6 @@
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/gpio.h>
-#include <linux/platform_device.h>
 #include <linux/leds.h>
 #include <linux/platform_device.h>
 
@@ -206,5 +205,6 @@ void __init mx31lite_db_init(void)
         mxc_register_device(&mxcsdhc_device0, &mmc_pdata);
         mxc_register_device(&mxc_spi_device0, &spi0_pdata);
         platform_device_register(&litekit_led_device);
+        mxc_register_device(&imx_wdt_device0, NULL);
 }
 
diff --git a/arch/arm/mach-mx5/clock-mx51.c b/arch/arm/mach-mx5/clock-mx51.c
index be90c03101cd..8f85f73b83a8 100644
--- a/arch/arm/mach-mx5/clock-mx51.c
+++ b/arch/arm/mach-mx5/clock-mx51.c
@@ -757,7 +757,7 @@ DEFINE_CLOCK(uart3_ipg_clk, 2, MXC_CCM_CCGR1, MXC_CCM_CCGRx_CG7_OFFSET,
 
 /* GPT */
 DEFINE_CLOCK(gpt_clk, 0, MXC_CCM_CCGR2, MXC_CCM_CCGRx_CG9_OFFSET,
-        NULL,  NULL, &ipg_perclk, NULL);
+        NULL,  NULL, &ipg_clk, NULL);
 DEFINE_CLOCK(gpt_ipg_clk, 0, MXC_CCM_CCGR2, MXC_CCM_CCGRx_CG10_OFFSET,
         NULL,  NULL, &ipg_clk, NULL);
 
diff --git a/arch/arm/mach-mx5/cpu.c b/arch/arm/mach-mx5/cpu.c
index 41c769f08c4d..2d37785e3857 100644
--- a/arch/arm/mach-mx5/cpu.c
+++ b/arch/arm/mach-mx5/cpu.c
@@ -14,9 +14,62 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/module.h>
 #include <mach/hardware.h>
 #include <asm/io.h>
 
+static int cpu_silicon_rev = -1;
+
+#define SI_REV 0x48
+
+static void query_silicon_parameter(void)
+{
+        void __iomem *rom = ioremap(MX51_IROM_BASE_ADDR, MX51_IROM_SIZE);
+        u32 rev;
+
+        if (!rom) {
+                cpu_silicon_rev = -EINVAL;
+                return;
+        }
+
+        rev = readl(rom + SI_REV);
+        switch (rev) {
+        case 0x1:
+                cpu_silicon_rev = MX51_CHIP_REV_1_0;
+                break;
+        case 0x2:
+                cpu_silicon_rev = MX51_CHIP_REV_1_1;
+                break;
+        case 0x10:
+                cpu_silicon_rev = MX51_CHIP_REV_2_0;
+                break;
+        case 0x20:
+                cpu_silicon_rev = MX51_CHIP_REV_3_0;
+                break;
+        default:
+                cpu_silicon_rev = 0;
+        }
+
+        iounmap(rom);
+}
+
+/*
+ * Returns:
+ *      the silicon revision of the cpu
+ *      -EINVAL - not a mx51
+ */
+int mx51_revision(void)
+{
+        if (!cpu_is_mx51())
+                return -EINVAL;
+
+        if (cpu_silicon_rev == -1)
+                query_silicon_parameter();
+
+        return cpu_silicon_rev;
+}
+EXPORT_SYMBOL(mx51_revision);
+
 static int __init post_cpu_init(void)
 {
         unsigned int reg;
diff --git a/arch/arm/mach-mx5/mm.c b/arch/arm/mach-mx5/mm.c
index c21e18be7af8..b7677ef80cc4 100644
--- a/arch/arm/mach-mx5/mm.c
+++ b/arch/arm/mach-mx5/mm.c
@@ -35,11 +35,6 @@ static struct map_desc mxc_io_desc[] __initdata = {
                 .length = MX51_DEBUG_SIZE,
                 .type = MT_DEVICE
         }, {
-                .virtual = MX51_TZIC_BASE_ADDR_VIRT,
-                .pfn = __phys_to_pfn(MX51_TZIC_BASE_ADDR),
-                .length = MX51_TZIC_SIZE,
-                .type = MT_DEVICE
-        }, {
                 .virtual = MX51_AIPS1_BASE_ADDR_VIRT,
                 .pfn = __phys_to_pfn(MX51_AIPS1_BASE_ADDR),
                 .length = MX51_AIPS1_SIZE,
@@ -54,11 +49,6 @@ static struct map_desc mxc_io_desc[] __initdata = {
                 .pfn = __phys_to_pfn(MX51_AIPS2_BASE_ADDR),
                 .length = MX51_AIPS2_SIZE,
                 .type = MT_DEVICE
-        }, {
-                .virtual = MX51_NFC_AXI_BASE_ADDR_VIRT,
-                .pfn = __phys_to_pfn(MX51_NFC_AXI_BASE_ADDR),
-                .length = MX51_NFC_AXI_SIZE,
-                .type = MT_DEVICE
         },
 };
 
@@ -69,14 +59,6 @@ static struct map_desc mxc_io_desc[] __initdata = {
  */
 void __init mx51_map_io(void)
 {
-        u32 tzic_addr;
-
-        if (mx51_revision() < MX51_CHIP_REV_2_0)
-                tzic_addr = 0x8FFFC000;
-        else
-                tzic_addr = 0xE0003000;
-        mxc_io_desc[2].pfn =  __phys_to_pfn(tzic_addr);
-
         mxc_set_cpu_type(MXC_CPU_MX51);
         mxc_iomux_v3_init(MX51_IO_ADDRESS(MX51_IOMUXC_BASE_ADDR));
         mxc_arch_reset_init(MX51_IO_ADDRESS(MX51_WDOG_BASE_ADDR));
@@ -85,5 +67,17 @@ void __init mx51_map_io(void)
 
 void __init mx51_init_irq(void)
 {
-        tzic_init_irq(MX51_IO_ADDRESS(MX51_TZIC_BASE_ADDR));
+        unsigned long tzic_addr;
+        void __iomem *tzic_virt;
+
+        if (mx51_revision() < MX51_CHIP_REV_2_0)
+                tzic_addr = MX51_TZIC_BASE_ADDR_TO1;
+        else
+                tzic_addr = MX51_TZIC_BASE_ADDR;
+
+        tzic_virt = ioremap(tzic_addr, SZ_16K);
+        if (!tzic_virt)
+                panic("unable to map TZIC interrupt controller\n");
+
+        tzic_init_irq(tzic_virt);
 }
diff --git a/arch/arm/mm/copypage-v6.c b/arch/arm/mm/copypage-v6.c
index 8bca4dea6dfa..f55fa1044f72 100644
--- a/arch/arm/mm/copypage-v6.c
+++ b/arch/arm/mm/copypage-v6.c
@@ -41,14 +41,7 @@ static void v6_copy_user_highpage_nonaliasing(struct page *to,
         kfrom = kmap_atomic(from, KM_USER0);
         kto = kmap_atomic(to, KM_USER1);
         copy_page(kto, kfrom);
-#ifdef CONFIG_HIGHMEM
-        /*
-         * kmap_atomic() doesn't set the page virtual address, and
-         * kunmap_atomic() takes care of cache flushing already.
-         */
-        if (page_address(to) != NULL)
-#endif
-                __cpuc_flush_dcache_area(kto, PAGE_SIZE);
+        __cpuc_flush_dcache_area(kto, PAGE_SIZE);
         kunmap_atomic(kto, KM_USER1);
         kunmap_atomic(kfrom, KM_USER0);
 }
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 1351edc0b26f..13fa536d82e6 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -464,6 +464,11 @@ static void dma_cache_maint_page(struct page *page, unsigned long offset,
                                 vaddr += offset;
                                 op(vaddr, len, dir);
                                 kunmap_high(page);
+                        } else if (cache_is_vipt()) {
+                                pte_t saved_pte;
+                                vaddr = kmap_high_l1_vipt(page, &saved_pte);
+                                op(vaddr + offset, len, dir);
+                                kunmap_high_l1_vipt(page, saved_pte);
                         }
                 } else {
                         vaddr = page_address(page) + offset;
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index e34f095e2090..c6844cb9b508 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -13,6 +13,7 @@
 
 #include <asm/cacheflush.h>
 #include <asm/cachetype.h>
+#include <asm/highmem.h>
 #include <asm/smp_plat.h>
 #include <asm/system.h>
 #include <asm/tlbflush.h>
@@ -152,21 +153,25 @@ void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
 
 void __flush_dcache_page(struct address_space *mapping, struct page *page)
 {
-        void *addr = page_address(page);
-
         /*
          * Writeback any data associated with the kernel mapping of this
          * page.  This ensures that data in the physical page is mutually
          * coherent with the kernels mapping.
          */
-#ifdef CONFIG_HIGHMEM
-        /*
-         * kmap_atomic() doesn't set the page virtual address, and
-         * kunmap_atomic() takes care of cache flushing already.
-         */
-        if (addr)
-#endif
-                __cpuc_flush_dcache_area(addr, PAGE_SIZE);
+        if (!PageHighMem(page)) {
+                __cpuc_flush_dcache_area(page_address(page), PAGE_SIZE);
+        } else {
+                void *addr = kmap_high_get(page);
+                if (addr) {
+                        __cpuc_flush_dcache_area(addr, PAGE_SIZE);
+                        kunmap_high(page);
+                } else if (cache_is_vipt()) {
+                        pte_t saved_pte;
+                        addr = kmap_high_l1_vipt(page, &saved_pte);
+                        __cpuc_flush_dcache_area(addr, PAGE_SIZE);
+                        kunmap_high_l1_vipt(page, saved_pte);
+                }
+        }
 
         /*
          * If this is a page cache page, and we have an aliasing VIPT cache,
diff --git a/arch/arm/mm/highmem.c b/arch/arm/mm/highmem.c
index 2be1ec7c1b41..77b030f5ec09 100644
--- a/arch/arm/mm/highmem.c
+++ b/arch/arm/mm/highmem.c
@@ -79,7 +79,8 @@ void kunmap_atomic(void *kvaddr, enum km_type type)
         unsigned int idx = type + KM_TYPE_NR * smp_processor_id();
 
         if (kvaddr >= (void *)FIXADDR_START) {
-                __cpuc_flush_dcache_area((void *)vaddr, PAGE_SIZE);
+                if (cache_is_vivt())
+                        __cpuc_flush_dcache_area((void *)vaddr, PAGE_SIZE);
 #ifdef CONFIG_DEBUG_HIGHMEM
                 BUG_ON(vaddr != __fix_to_virt(FIX_KMAP_BEGIN + idx));
                 set_pte_ext(TOP_PTE(vaddr), __pte(0), 0);
@@ -124,3 +125,87 @@ struct page *kmap_atomic_to_page(const void *ptr)
         pte = TOP_PTE(vaddr);
         return pte_page(*pte);
 }
+
+#ifdef CONFIG_CPU_CACHE_VIPT
+
+#include <linux/percpu.h>
+
+/*
+ * The VIVT cache of a highmem page is always flushed before the page
+ * is unmapped. Hence unmapped highmem pages need no cache maintenance
+ * in that case.
+ *
+ * However unmapped pages may still be cached with a VIPT cache, and
+ * it is not possible to perform cache maintenance on them using physical
+ * addresses unfortunately.  So we have no choice but to set up a temporary
+ * virtual mapping for that purpose.
+ *
+ * Yet this VIPT cache maintenance may be triggered from DMA support
+ * functions which are possibly called from interrupt context. As we don't
+ * want to keep interrupt disabled all the time when such maintenance is
+ * taking place, we therefore allow for some reentrancy by preserving and
+ * restoring the previous fixmap entry before the interrupted context is
+ * resumed.  If the reentrancy depth is 0 then there is no need to restore
+ * the previous fixmap, and leaving the current one in place allow it to
+ * be reused the next time without a TLB flush (common with DMA).
+ */
+
+static DEFINE_PER_CPU(int, kmap_high_l1_vipt_depth);
+
+void *kmap_high_l1_vipt(struct page *page, pte_t *saved_pte)
+{
+        unsigned int idx, cpu = smp_processor_id();
+        int *depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
+        unsigned long vaddr, flags;
+        pte_t pte, *ptep;
+
+        idx = KM_L1_CACHE + KM_TYPE_NR * cpu;
+        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+        ptep = TOP_PTE(vaddr);
+        pte = mk_pte(page, kmap_prot);
+
+        if (!in_interrupt())
+                preempt_disable();
+
+        raw_local_irq_save(flags);
+        (*depth)++;
+        if (pte_val(*ptep) == pte_val(pte)) {
+                *saved_pte = pte;
+        } else {
+                *saved_pte = *ptep;
+                set_pte_ext(ptep, pte, 0);
+                local_flush_tlb_kernel_page(vaddr);
+        }
+        raw_local_irq_restore(flags);
+
+        return (void *)vaddr;
+}
+
+void kunmap_high_l1_vipt(struct page *page, pte_t saved_pte)
+{
+        unsigned int idx, cpu = smp_processor_id();
+        int *depth = &per_cpu(kmap_high_l1_vipt_depth, cpu);
+        unsigned long vaddr, flags;
+        pte_t pte, *ptep;
+
+        idx = KM_L1_CACHE + KM_TYPE_NR * cpu;
+        vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+        ptep = TOP_PTE(vaddr);
+        pte = mk_pte(page, kmap_prot);
+
+        BUG_ON(pte_val(*ptep) != pte_val(pte));
+        BUG_ON(*depth <= 0);
+
+        raw_local_irq_save(flags);
+        (*depth)--;
+        if (*depth != 0 && pte_val(pte) != pte_val(saved_pte)) {
+                set_pte_ext(ptep, saved_pte, 0);
+                local_flush_tlb_kernel_page(vaddr);
+        }
+        raw_local_irq_restore(flags);
+
+        if (!in_interrupt())
+                preempt_enable();
+}
+
+#endif  /* CONFIG_CPU_CACHE_VIPT */
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 9d4da6ac28eb..241c24a1c18f 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -420,6 +420,10 @@ static void __init build_mem_type_table(void)
                 user_pgprot |= L_PTE_SHARED;
                 kern_pgprot |= L_PTE_SHARED;
                 vecs_pgprot |= L_PTE_SHARED;
+                mem_types[MT_DEVICE_WC].prot_sect |= PMD_SECT_S;
+                mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_SHARED;
+                mem_types[MT_DEVICE_CACHED].prot_sect |= PMD_SECT_S;
+                mem_types[MT_DEVICE_CACHED].prot_pte |= L_PTE_SHARED;
                 mem_types[MT_MEMORY].prot_sect |= PMD_SECT_S;
                 mem_types[MT_MEMORY_NONCACHED].prot_sect |= PMD_SECT_S;
 #endif
@@ -1050,10 +1054,12 @@ void setup_mm_for_reboot(char mode)
         pgd_t *pgd;
         int i;
 
-        if (current->mm && current->mm->pgd)
-                pgd = current->mm->pgd;
-        else
-                pgd = init_mm.pgd;
+        /*
+         * We need to access to user-mode page tables here. For kernel threads
+         * we don't have any user-mode mappings so we use the context that we
+         * "borrowed".
+         */
+        pgd = current->active_mm->pgd;
 
         base_pmdval = PMD_SECT_AP_WRITE | PMD_SECT_AP_READ | PMD_TYPE_SECT;
         if (cpu_architecture() <= CPU_ARCH_ARMv5TEJ && !cpu_is_xscale())
diff --git a/arch/arm/plat-mxc/include/mach/board-mx31pdk.h b/arch/arm/plat-mxc/include/mach/board-mx31_3ds.h
index 2bbd6ed17f50..da92933a233b 100644
--- a/arch/arm/plat-mxc/include/mach/board-mx31pdk.h
+++ b/arch/arm/plat-mxc/include/mach/board-mx31_3ds.h
@@ -8,8 +8,8 @@
  * published by the Free Software Foundation.
  */
 
-#ifndef __ASM_ARCH_MXC_BOARD_MX31PDK_H__
-#define __ASM_ARCH_MXC_BOARD_MX31PDK_H__
+#ifndef __ASM_ARCH_MXC_BOARD_MX31_3DS_H__
+#define __ASM_ARCH_MXC_BOARD_MX31_3DS_H__
 
 /* Definitions for components on the Debug board */
 
@@ -56,4 +56,4 @@
 
 #define MXC_MAX_EXP_IO_LINES    16
 
-#endif /* __ASM_ARCH_MXC_BOARD_MX31PDK_H__ */
+#endif /* __ASM_ARCH_MXC_BOARD_MX31_3DS_H__ */
diff --git a/arch/arm/plat-mxc/include/mach/mx51.h b/arch/arm/plat-mxc/include/mach/mx51.h
index 771532b6b4a6..5aad344d5651 100644
--- a/arch/arm/plat-mxc/include/mach/mx51.h
+++ b/arch/arm/plat-mxc/include/mach/mx51.h
@@ -14,7 +14,7 @@
  * FB100000     70000000        1M      SPBA 0
  * FB000000     73F00000        1M      AIPS 1
  * FB200000     83F00000        1M      AIPS 2
- * FA100000     8FFFC000        16K     TZIC (interrupt controller)
+ *              8FFFC000        16K     TZIC (interrupt controller)
  *              90000000        256M    CSD0 SDRAM/DDR
  *              A0000000        256M    CSD1 SDRAM/DDR
  *              B0000000        128M    CS0 Flash
@@ -23,11 +23,17 @@
  *              C8000000        64M     CS3 Flash
  *              CC000000        32M     CS4 SRAM
  *              CE000000        32M     CS5 SRAM
- * F9000000     CFFF0000        64K     NFC (NAND Flash AXI)
+ *              CFFF0000        64K     NFC (NAND Flash AXI)
  *
  */
 
 /*
+ * IROM
+ */
+#define MX51_IROM_BASE_ADDR             0x0
+#define MX51_IROM_SIZE                  SZ_64K
+
+/*
  * IRAM
  */
 #define MX51_IRAM_BASE_ADDR             0x1FFE0000      /* internal ram */
@@ -40,7 +46,6 @@
  * NFC
  */
 #define MX51_NFC_AXI_BASE_ADDR          0xCFFF0000      /* NAND flash AXI */
-#define MX51_NFC_AXI_BASE_ADDR_VIRT     0xF9000000
 #define MX51_NFC_AXI_SIZE               SZ_64K
 
 /*
@@ -49,9 +54,8 @@
 #define MX51_GPU_BASE_ADDR              0x20000000
 #define MX51_GPU2D_BASE_ADDR            0xD0000000
 
-#define MX51_TZIC_BASE_ADDR             0x8FFFC000
-#define MX51_TZIC_BASE_ADDR_VIRT        0xFA100000
-#define MX51_TZIC_SIZE                  SZ_16K
+#define MX51_TZIC_BASE_ADDR_TO1         0x8FFFC000
+#define MX51_TZIC_BASE_ADDR             0xE0000000
 
 #define MX51_DEBUG_BASE_ADDR            0x60000000
 #define MX51_DEBUG_BASE_ADDR_VIRT       0xFA200000
@@ -232,12 +236,10 @@
 #define MX51_IO_ADDRESS(x)                                      \
         (void __iomem *)                                        \
         (MX51_IS_MODULE(x, IRAM) ? MX51_IRAM_IO_ADDRESS(x) :    \
-        MX51_IS_MODULE(x, TZIC) ? MX51_TZIC_IO_ADDRESS(x) :     \
         MX51_IS_MODULE(x, DEBUG) ? MX51_DEBUG_IO_ADDRESS(x) :   \
         MX51_IS_MODULE(x, SPBA0) ? MX51_SPBA0_IO_ADDRESS(x) :   \
         MX51_IS_MODULE(x, AIPS1) ? MX51_AIPS1_IO_ADDRESS(x) :   \
-        MX51_IS_MODULE(x, AIPS2) ? MX51_AIPS2_IO_ADDRESS(x) :   \
-        MX51_IS_MODULE(x, NFC_AXI) ? MX51_NFC_AXI_IO_ADDRESS(x) : \
+        MX51_IS_MODULE(x, AIPS2) ? MX51_AIPS2_IO_ADDRESS(x) : \
         0xDEADBEEF)
 
 /*
@@ -246,9 +248,6 @@
 #define MX51_IRAM_IO_ADDRESS(x)  \
         (((x) - MX51_IRAM_BASE_ADDR) + MX51_IRAM_BASE_ADDR_VIRT)
 
-#define MX51_TZIC_IO_ADDRESS(x)  \
-        (((x) - MX51_TZIC_BASE_ADDR) + MX51_TZIC_BASE_ADDR_VIRT)
-
 #define MX51_DEBUG_IO_ADDRESS(x)  \
         (((x) - MX51_DEBUG_BASE_ADDR) + MX51_DEBUG_BASE_ADDR_VIRT)
 
@@ -261,9 +260,6 @@
 #define MX51_AIPS2_IO_ADDRESS(x)  \
         (((x) - MX51_AIPS2_BASE_ADDR) + MX51_AIPS2_BASE_ADDR_VIRT)
 
-#define MX51_NFC_AXI_IO_ADDRESS(x) \
-        (((x) - MX51_NFC_AXI_BASE_ADDR) + MX51_NFC_AXI_BASE_ADDR_VIRT)
-
 #define MX51_IS_MEM_DEVICE_NONSHARED(x)         0
 
 /*
@@ -443,12 +439,7 @@
 
 #if !defined(__ASSEMBLY__) && !defined(__MXC_BOOT_UNCOMPRESS)
 
-extern unsigned int system_rev;
-
-static inline unsigned int mx51_revision(void)
-{
-        return system_rev;
-}
+extern int mx51_revision(void);
 #endif
 
 #endif  /*  __ASM_ARCH_MXC_MX51_H__ */
diff --git a/arch/arm/plat-mxc/include/mach/uncompress.h b/arch/arm/plat-mxc/include/mach/uncompress.h
index 52e476a150ca..b6d3d0fddc48 100644
--- a/arch/arm/plat-mxc/include/mach/uncompress.h
+++ b/arch/arm/plat-mxc/include/mach/uncompress.h
@@ -66,6 +66,7 @@ static inline void flush(void)
 #define MX2X_UART1_BASE_ADDR    0x1000a000
 #define MX3X_UART1_BASE_ADDR    0x43F90000
 #define MX3X_UART2_BASE_ADDR    0x43F94000
+#define MX51_UART1_BASE_ADDR    0x73fbc000
 
 static __inline__ void __arch_decomp_setup(unsigned long arch_id)
 {
@@ -101,6 +102,9 @@ static __inline__ void __arch_decomp_setup(unsigned long arch_id)
         case MACH_TYPE_MAGX_ZN5:
                 uart_base = MX3X_UART2_BASE_ADDR;
                 break;
+        case MACH_TYPE_MX51_BABBAGE:
+                uart_base = MX51_UART1_BASE_ADDR;
+                break;
         default:
                 break;
         }
diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c
index a420cb949328..315a540c7ce5 100644
--- a/arch/arm/vfp/vfpmodule.c
+++ b/arch/arm/vfp/vfpmodule.c
@@ -428,26 +428,6 @@ static void vfp_pm_init(void)
 static inline void vfp_pm_init(void) { }
 #endif /* CONFIG_PM */
 
-/*
- * Synchronise the hardware VFP state of a thread other than current with the
- * saved one. This function is used by the ptrace mechanism.
- */
-#ifdef CONFIG_SMP
-void vfp_sync_hwstate(struct thread_info *thread)
-{
-}
-
-void vfp_flush_hwstate(struct thread_info *thread)
-{
-        /*
-         * On SMP systems, the VFP state is automatically saved at every
-         * context switch. We mark the thread VFP state as belonging to a
-         * non-existent CPU so that the saved one will be reloaded when
-         * needed.
-         */
-        thread->vfpstate.hard.cpu = NR_CPUS;
-}
-#else
 void vfp_sync_hwstate(struct thread_info *thread)
 {
         unsigned int cpu = get_cpu();
@@ -490,9 +470,18 @@ void vfp_flush_hwstate(struct thread_info *thread)
                 last_VFP_context[cpu] = NULL;
         }
 
+#ifdef CONFIG_SMP
+        /*
+         * For SMP we still have to take care of the case where the thread
+         * migrates to another CPU and then back to the original CPU on which
+         * the last VFP user is still the same thread. Mark the thread VFP
+         * state as belonging to a non-existent CPU so that the saved one will
+         * be reloaded in the above case.
+         */
+        thread->vfpstate.hard.cpu = NR_CPUS;
+#endif
         put_cpu();
 }
-#endif
 
 #include <linux/smp.h>
 
diff --git a/arch/m68k/include/asm/atomic_mm.h b/arch/m68k/include/asm/atomic_mm.h
index 88b7af20a996..d9d2ed647435 100644
--- a/arch/m68k/include/asm/atomic_mm.h
+++ b/arch/m68k/include/asm/atomic_mm.h
@@ -148,14 +148,18 @@ static inline int atomic_xchg(atomic_t *v, int new)
 static inline int atomic_sub_and_test(int i, atomic_t *v)
 {
         char c;
-        __asm__ __volatile__("subl %2,%1; seq %0" : "=d" (c), "+m" (*v): "g" (i));
+        __asm__ __volatile__("subl %2,%1; seq %0"
+                             : "=d" (c), "+m" (*v)
+                             : "id" (i));
         return c != 0;
 }
 
 static inline int atomic_add_negative(int i, atomic_t *v)
 {
         char c;
-        __asm__ __volatile__("addl %2,%1; smi %0" : "=d" (c), "+m" (*v): "g" (i));
+        __asm__ __volatile__("addl %2,%1; smi %0"
+                             : "=d" (c), "+m" (*v)
+                             : "id" (i));
         return c != 0;
 }
 
diff --git a/arch/m68k/include/asm/sigcontext.h b/arch/m68k/include/asm/sigcontext.h
index 1320eaa4cc2a..a29dd74a17cb 100644
--- a/arch/m68k/include/asm/sigcontext.h
+++ b/arch/m68k/include/asm/sigcontext.h
@@ -17,13 +17,11 @@ struct sigcontext {
 #ifndef __uClinux__
 # ifdef __mcoldfire__
         unsigned long  sc_fpregs[2][2]; /* room for two fp registers */
-        unsigned long  sc_fpcntl[3];
-        unsigned char  sc_fpstate[16+6*8];
 # else
         unsigned long  sc_fpregs[2*3];  /* room for two fp registers */
+# endif
         unsigned long  sc_fpcntl[3];
         unsigned char  sc_fpstate[216];
-# endif
 #endif
 };
 
diff --git a/arch/mips/alchemy/devboards/db1200/setup.c b/arch/mips/alchemy/devboards/db1200/setup.c
index 379536e3abd1..be7e92ea01f3 100644
--- a/arch/mips/alchemy/devboards/db1200/setup.c
+++ b/arch/mips/alchemy/devboards/db1200/setup.c
@@ -60,43 +60,6 @@ void __init board_setup(void)
         wmb();
 }
 
-/* use the hexleds to count the number of times the cpu has entered
- * wait, the dots to indicate whether the CPU is currently idle or
- * active (dots off = sleeping, dots on = working) for cases where
- * the number doesn't change for a long(er) period of time.
- */
-static void db1200_wait(void)
-{
-        __asm__("       .set    push                    \n"
-                "       .set    mips3                   \n"
-                "       .set    noreorder               \n"
-                "       cache   0x14, 0(%0)             \n"
-                "       cache   0x14, 32(%0)            \n"
-                "       cache   0x14, 64(%0)            \n"
-                /* dots off: we're about to call wait */
-                "       lui     $26, 0xb980             \n"
-                "       ori     $27, $0, 3              \n"
-                "       sb      $27, 0x18($26)          \n"
-                "       sync                            \n"
-                "       nop                             \n"
-                "       wait                            \n"
-                "       nop                             \n"
-                "       nop                             \n"
-                "       nop                             \n"
-                "       nop                             \n"
-                "       nop                             \n"
-                /* dots on: there's work to do, increment cntr */
-                "       lui     $26, 0xb980             \n"
-                "       sb      $0, 0x18($26)           \n"
-                "       lui     $26, 0xb9c0             \n"
-                "       lb      $27, 0($26)             \n"
-                "       addiu   $27, $27, 1             \n"
-                "       sb      $27, 0($26)             \n"
-                "       sync                            \n"
-                "       .set    pop                     \n"
-                : : "r" (db1200_wait));
-}
-
 static int __init db1200_arch_init(void)
 {
         /* GPIO7 is low-level triggered CPLD cascade */
@@ -110,9 +73,6 @@ static int __init db1200_arch_init(void)
         irq_to_desc(DB1200_SD0_INSERT_INT)->status |= IRQ_NOAUTOEN;
         irq_to_desc(DB1200_SD0_EJECT_INT)->status |= IRQ_NOAUTOEN;
 
-        if (cpu_wait)
-                cpu_wait = db1200_wait;
-
         return 0;
 }
 arch_initcall(db1200_arch_init);
diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c
index 246df7aca2e7..2fafc78e5ce1 100644
--- a/arch/mips/ar7/platform.c
+++ b/arch/mips/ar7/platform.c
@@ -168,7 +168,7 @@ static struct plat_vlynq_data vlynq_high_data = {
                 .on     = vlynq_on,
                 .off    = vlynq_off,
         },
-        .reset_bit      = 26,
+        .reset_bit      = 16,
         .gpio_bit       = 19,
 };
 
@@ -600,6 +600,7 @@ static int __init ar7_register_devices(void)
         }
 
         if (ar7_has_high_cpmac()) {
+                res = fixed_phy_add(PHY_POLL, cpmac_high.id, &fixed_phy_status);
                 if (!res) {
                         cpmac_get_mac(1, cpmac_high_data.dev_addr);
 
diff --git a/arch/mips/bcm63xx/boards/board_bcm963xx.c b/arch/mips/bcm63xx/boards/board_bcm963xx.c
index ea17941168ca..8dba8cfb752f 100644
--- a/arch/mips/bcm63xx/boards/board_bcm963xx.c
+++ b/arch/mips/bcm63xx/boards/board_bcm963xx.c
@@ -18,6 +18,7 @@
 #include <asm/addrspace.h>
 #include <bcm63xx_board.h>
 #include <bcm63xx_cpu.h>
+#include <bcm63xx_dev_uart.h>
 #include <bcm63xx_regs.h>
 #include <bcm63xx_io.h>
 #include <bcm63xx_dev_pci.h>
@@ -40,6 +41,7 @@ static struct board_info __initdata board_96338gw = {
         .name                           = "96338GW",
         .expected_cpu_id                = 0x6338,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .enet0 = {
                 .force_speed_100        = 1,
@@ -82,6 +84,7 @@ static struct board_info __initdata board_96338w = {
         .name                           = "96338W",
         .expected_cpu_id                = 0x6338,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .enet0 = {
                 .force_speed_100        = 1,
@@ -126,6 +129,8 @@ static struct board_info __initdata board_96338w = {
 static struct board_info __initdata board_96345gw2 = {
         .name                           = "96345GW2",
         .expected_cpu_id                = 0x6345,
+
+        .has_uart0                      = 1,
 };
 #endif
 
@@ -137,6 +142,7 @@ static struct board_info __initdata board_96348r = {
         .name                           = "96348R",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_pci                        = 1,
 
@@ -180,6 +186,7 @@ static struct board_info __initdata board_96348gw_10 = {
         .name                           = "96348GW-10",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -239,6 +246,7 @@ static struct board_info __initdata board_96348gw_11 = {
         .name                           = "96348GW-11",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -292,6 +300,7 @@ static struct board_info __initdata board_96348gw = {
         .name                           = "96348GW",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -349,9 +358,10 @@ static struct board_info __initdata board_FAST2404 = {
         .name                           = "F@ST2404",
         .expected_cpu_id                = 0x6348,
 
-        .has_enet0                      = 1,
-        .has_enet1                      = 1,
-        .has_pci                        = 1,
+        .has_uart0                      = 1,
+        .has_enet0                      = 1,
+        .has_enet1                      = 1,
+        .has_pci                        = 1,
 
         .enet0 = {
                 .has_phy                = 1,
@@ -368,10 +378,30 @@ static struct board_info __initdata board_FAST2404 = {
         .has_ehci0                      = 1,
 };
 
+static struct board_info __initdata board_rta1025w_16 = {
+        .name                           = "RTA1025W_16",
+        .expected_cpu_id                = 0x6348,
+
+        .has_enet0                      = 1,
+        .has_enet1                      = 1,
+        .has_pci                        = 1,
+
+        .enet0 = {
+                .has_phy                = 1,
+                .use_internal_phy       = 1,
+        },
+        .enet1 = {
+                .force_speed_100        = 1,
+                .force_duplex_full      = 1,
+        },
+};
+
+
 static struct board_info __initdata board_DV201AMR = {
         .name                           = "DV201AMR",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_pci                        = 1,
         .has_ohci0                      = 1,
 
@@ -391,6 +421,7 @@ static struct board_info __initdata board_96348gw_a = {
         .name                           = "96348GW-A",
         .expected_cpu_id                = 0x6348,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -416,6 +447,7 @@ static struct board_info __initdata board_96358vw = {
         .name                           = "96358VW",
         .expected_cpu_id                = 0x6358,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -467,6 +499,7 @@ static struct board_info __initdata board_96358vw2 = {
         .name                           = "96358VW2",
         .expected_cpu_id                = 0x6358,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -514,6 +547,7 @@ static struct board_info __initdata board_AGPFS0 = {
         .name                           = "AGPF-S0",
         .expected_cpu_id                = 0x6358,
 
+        .has_uart0                      = 1,
         .has_enet0                      = 1,
         .has_enet1                      = 1,
         .has_pci                        = 1,
@@ -531,6 +565,27 @@ static struct board_info __initdata board_AGPFS0 = {
         .has_ohci0 = 1,
         .has_ehci0 = 1,
 };
+
+static struct board_info __initdata board_DWVS0 = {
+        .name                           = "DWV-S0",
+        .expected_cpu_id                = 0x6358,
+
+        .has_enet0                      = 1,
+        .has_enet1                      = 1,
+        .has_pci                        = 1,
+
+        .enet0 = {
+                .has_phy                = 1,
+                .use_internal_phy       = 1,
+        },
+
+        .enet1 = {
+                .force_speed_100        = 1,
+                .force_duplex_full      = 1,
+        },
+
+        .has_ohci0                      = 1,
+};
 #endif
 
 /*
@@ -552,16 +607,88 @@ static const struct board_info __initdata *bcm963xx_boards[] = {
         &board_FAST2404,
         &board_DV201AMR,
         &board_96348gw_a,
+        &board_rta1025w_16,
 #endif
 
 #ifdef CONFIG_BCM63XX_CPU_6358
         &board_96358vw,
         &board_96358vw2,
         &board_AGPFS0,
+        &board_DWVS0,
 #endif
 };
 
 /*
+ * Register a sane SPROMv2 to make the on-board
+ * bcm4318 WLAN work
+ */
+#ifdef CONFIG_SSB_PCIHOST
+static struct ssb_sprom bcm63xx_sprom = {
+        .revision               = 0x02,
+        .board_rev              = 0x17,
+        .country_code           = 0x0,
+        .ant_available_bg       = 0x3,
+        .pa0b0                  = 0x15ae,
+        .pa0b1                  = 0xfa85,
+        .pa0b2                  = 0xfe8d,
+        .pa1b0                  = 0xffff,
+        .pa1b1                  = 0xffff,
+        .pa1b2                  = 0xffff,
+        .gpio0                  = 0xff,
+        .gpio1                  = 0xff,
+        .gpio2                  = 0xff,
+        .gpio3                  = 0xff,
+        .maxpwr_bg              = 0x004c,
+        .itssi_bg               = 0x00,
+        .boardflags_lo          = 0x2848,
+        .boardflags_hi          = 0x0000,
+};
+#endif
+
+/*
+ * return board name for /proc/cpuinfo
+ */
+const char *board_get_name(void)
+{
+        return board.name;
+}
+
+/*
+ * register & return a new board mac address
+ */
+static int board_get_mac_address(u8 *mac)
+{
+        u8 *p;
+        int count;
+
+        if (mac_addr_used >= nvram.mac_addr_count) {
+                printk(KERN_ERR PFX "not enough mac address\n");
+                return -ENODEV;
+        }
+
+        memcpy(mac, nvram.mac_addr_base, ETH_ALEN);
+        p = mac + ETH_ALEN - 1;
+        count = mac_addr_used;
+
+        while (count--) {
+                do {
+                        (*p)++;
+                        if (*p != 0)
+                                break;
+                        p--;
+                } while (p != mac);
+        }
+
+        if (p == mac) {
+                printk(KERN_ERR PFX "unable to fetch mac address\n");
+                return -ENODEV;
+        }
+
+        mac_addr_used++;
+        return 0;
+}
+
+/*
  * early init callback, read nvram data from flash and checksum it
  */
 void __init board_prom_init(void)
@@ -659,6 +786,17 @@ void __init board_prom_init(void)
         }
 
         bcm_gpio_writel(val, GPIO_MODE_REG);
+
+        /* Generate MAC address for WLAN and
+         * register our SPROM */
+#ifdef CONFIG_SSB_PCIHOST
+        if (!board_get_mac_address(bcm63xx_sprom.il0mac)) {
+                memcpy(bcm63xx_sprom.et0mac, bcm63xx_sprom.il0mac, ETH_ALEN);
+                memcpy(bcm63xx_sprom.et1mac, bcm63xx_sprom.il0mac, ETH_ALEN);
+                if (ssb_arch_set_fallback_sprom(&bcm63xx_sprom) < 0)
+                        printk(KERN_ERR "failed to register fallback SPROM\n");
+        }
+#endif
 }
 
 /*
@@ -676,49 +814,6 @@ void __init board_setup(void)
                 panic("unexpected CPU for bcm963xx board");
 }
 
-/*
- * return board name for /proc/cpuinfo
- */
-const char *board_get_name(void)
-{
-        return board.name;
-}
-
-/*
- * register & return a new board mac address
- */
-static int board_get_mac_address(u8 *mac)
-{
-        u8 *p;
-        int count;
-
-        if (mac_addr_used >= nvram.mac_addr_count) {
-                printk(KERN_ERR PFX "not enough mac address\n");
-                return -ENODEV;
-        }
-
-        memcpy(mac, nvram.mac_addr_base, ETH_ALEN);
-        p = mac + ETH_ALEN - 1;
-        count = mac_addr_used;
-
-        while (count--) {
-                do {
-                        (*p)++;
-                        if (*p != 0)
-                                break;
-                        p--;
-                } while (p != mac);
-        }
-
-        if (p == mac) {
-                printk(KERN_ERR PFX "unable to fetch mac address\n");
-                return -ENODEV;
-        }
-
-        mac_addr_used++;
-        return 0;
-}
-
 static struct mtd_partition mtd_partitions[] = {
         {
                 .name           = "cfe",
@@ -750,33 +845,6 @@ static struct platform_device mtd_dev = {
         },
 };
 
-/*
- * Register a sane SPROMv2 to make the on-board
- * bcm4318 WLAN work
- */
-#ifdef CONFIG_SSB_PCIHOST
-static struct ssb_sprom bcm63xx_sprom = {
-        .revision               = 0x02,
-        .board_rev              = 0x17,
-        .country_code           = 0x0,
-        .ant_available_bg       = 0x3,
-        .pa0b0                  = 0x15ae,
-        .pa0b1                  = 0xfa85,
-        .pa0b2                  = 0xfe8d,
-        .pa1b0                  = 0xffff,
-        .pa1b1                  = 0xffff,
-        .pa1b2                  = 0xffff,
-        .gpio0                  = 0xff,
-        .gpio1                  = 0xff,
-        .gpio2                  = 0xff,
-        .gpio3                  = 0xff,
-        .maxpwr_bg              = 0x004c,
-        .itssi_bg               = 0x00,
-        .boardflags_lo          = 0x2848,
-        .boardflags_hi          = 0x0000,
-};
-#endif
-
 static struct gpio_led_platform_data bcm63xx_led_data;
 
 static struct platform_device bcm63xx_gpio_leds = {
@@ -792,6 +860,12 @@ int __init board_register_devices(void)
 {
         u32 val;
 
+        if (board.has_uart0)
+                bcm63xx_uart_register(0);
+
+        if (board.has_uart1)
+                bcm63xx_uart_register(1);
+
         if (board.has_pccard)
                 bcm63xx_pcmcia_register();
 
@@ -806,17 +880,6 @@ int __init board_register_devices(void)
         if (board.has_dsp)
                 bcm63xx_dsp_register(&board.dsp);
 
-        /* Generate MAC address for WLAN and
-         * register our SPROM */
-#ifdef CONFIG_SSB_PCIHOST
-        if (!board_get_mac_address(bcm63xx_sprom.il0mac)) {
-                memcpy(bcm63xx_sprom.et0mac, bcm63xx_sprom.il0mac, ETH_ALEN);
-                memcpy(bcm63xx_sprom.et1mac, bcm63xx_sprom.il0mac, ETH_ALEN);
-                if (ssb_arch_set_fallback_sprom(&bcm63xx_sprom) < 0)
-                        printk(KERN_ERR "failed to register fallback SPROM\n");
-        }
-#endif
-
         /* read base address of boot chip select (0) */
         if (BCMCPU_IS_6345())
                 val = 0x1fc00000;
diff --git a/arch/mips/bcm63xx/cpu.c b/arch/mips/bcm63xx/cpu.c
index 70378bb5e3f9..cbb7caf86d77 100644
--- a/arch/mips/bcm63xx/cpu.c
+++ b/arch/mips/bcm63xx/cpu.c
@@ -36,6 +36,7 @@ static const unsigned long bcm96338_regs_base[] = {
         [RSET_TIMER]            = BCM_6338_TIMER_BASE,
         [RSET_WDT]              = BCM_6338_WDT_BASE,
         [RSET_UART0]            = BCM_6338_UART0_BASE,
+        [RSET_UART1]            = BCM_6338_UART1_BASE,
         [RSET_GPIO]             = BCM_6338_GPIO_BASE,
         [RSET_SPI]              = BCM_6338_SPI_BASE,
         [RSET_OHCI0]            = BCM_6338_OHCI0_BASE,
@@ -72,6 +73,7 @@ static const unsigned long bcm96345_regs_base[] = {
         [RSET_TIMER]            = BCM_6345_TIMER_BASE,
         [RSET_WDT]              = BCM_6345_WDT_BASE,
         [RSET_UART0]            = BCM_6345_UART0_BASE,
+        [RSET_UART1]            = BCM_6345_UART1_BASE,
         [RSET_GPIO]             = BCM_6345_GPIO_BASE,
         [RSET_SPI]              = BCM_6345_SPI_BASE,
         [RSET_UDC0]             = BCM_6345_UDC0_BASE,
@@ -109,6 +111,7 @@ static const unsigned long bcm96348_regs_base[] = {
         [RSET_TIMER]            = BCM_6348_TIMER_BASE,
         [RSET_WDT]              = BCM_6348_WDT_BASE,
         [RSET_UART0]            = BCM_6348_UART0_BASE,
+        [RSET_UART1]            = BCM_6348_UART1_BASE,
         [RSET_GPIO]             = BCM_6348_GPIO_BASE,
         [RSET_SPI]              = BCM_6348_SPI_BASE,
         [RSET_OHCI0]            = BCM_6348_OHCI0_BASE,
@@ -150,6 +153,7 @@ static const unsigned long bcm96358_regs_base[] = {
         [RSET_TIMER]            = BCM_6358_TIMER_BASE,
         [RSET_WDT]              = BCM_6358_WDT_BASE,
         [RSET_UART0]            = BCM_6358_UART0_BASE,
+        [RSET_UART1]            = BCM_6358_UART1_BASE,
         [RSET_GPIO]             = BCM_6358_GPIO_BASE,
         [RSET_SPI]              = BCM_6358_SPI_BASE,
         [RSET_OHCI0]            = BCM_6358_OHCI0_BASE,
@@ -170,6 +174,7 @@ static const unsigned long bcm96358_regs_base[] = {
 static const int bcm96358_irqs[] = {
         [IRQ_TIMER]             = BCM_6358_TIMER_IRQ,
         [IRQ_UART0]             = BCM_6358_UART0_IRQ,
+        [IRQ_UART1]             = BCM_6358_UART1_IRQ,
         [IRQ_DSL]               = BCM_6358_DSL_IRQ,
         [IRQ_ENET0]             = BCM_6358_ENET0_IRQ,
         [IRQ_ENET1]             = BCM_6358_ENET1_IRQ,
diff --git a/arch/mips/bcm63xx/dev-uart.c b/arch/mips/bcm63xx/dev-uart.c
index b0519461ad9b..c2963da0253e 100644
--- a/arch/mips/bcm63xx/dev-uart.c
+++ b/arch/mips/bcm63xx/dev-uart.c
@@ -11,31 +11,65 @@
 #include <linux/platform_device.h>
 #include <bcm63xx_cpu.h>
 
-static struct resource uart_resources[] = {
+static struct resource uart0_resources[] = {
         {
-                .start          = -1, /* filled at runtime */
-                .end            = -1, /* filled at runtime */
+                /* start & end filled at runtime */
                 .flags          = IORESOURCE_MEM,
         },
         {
-                .start          = -1, /* filled at runtime */
+                /* start filled at runtime */
                 .flags          = IORESOURCE_IRQ,
         },
 };
 
-static struct platform_device bcm63xx_uart_device = {
-        .name           = "bcm63xx_uart",
-        .id             = 0,
-        .num_resources  = ARRAY_SIZE(uart_resources),
-        .resource       = uart_resources,
+static struct resource uart1_resources[] = {
+        {
+                /* start & end filled at runtime */
+                .flags          = IORESOURCE_MEM,
+        },
+        {
+                /* start filled at runtime */
+                .flags          = IORESOURCE_IRQ,
+        },
+};
+
+static struct platform_device bcm63xx_uart_devices[] = {
+        {
+                .name           = "bcm63xx_uart",
+                .id             = 0,
+                .num_resources  = ARRAY_SIZE(uart0_resources),
+                .resource       = uart0_resources,
+        },
+
+        {
+                .name           = "bcm63xx_uart",
+                .id             = 1,
+                .num_resources  = ARRAY_SIZE(uart1_resources),
+                .resource       = uart1_resources,
+        }
 };
 
-int __init bcm63xx_uart_register(void)
+int __init bcm63xx_uart_register(unsigned int id)
 {
-        uart_resources[0].start = bcm63xx_regset_address(RSET_UART0);
-        uart_resources[0].end = uart_resources[0].start;
-        uart_resources[0].end += RSET_UART_SIZE - 1;
-        uart_resources[1].start = bcm63xx_get_irq_number(IRQ_UART0);
-        return platform_device_register(&bcm63xx_uart_device);
+        if (id >= ARRAY_SIZE(bcm63xx_uart_devices))
+                return -ENODEV;
+
+        if (id == 1 && !BCMCPU_IS_6358())
+                return -ENODEV;
+
+        if (id == 0) {
+                uart0_resources[0].start = bcm63xx_regset_address(RSET_UART0);
+                uart0_resources[0].end = uart0_resources[0].start +
+                        RSET_UART_SIZE - 1;
+                uart0_resources[1].start = bcm63xx_get_irq_number(IRQ_UART0);
+        }
+
+        if (id == 1) {
+                uart1_resources[0].start = bcm63xx_regset_address(RSET_UART1);
+                uart1_resources[0].end = uart1_resources[0].start +
+                        RSET_UART_SIZE - 1;
+                uart1_resources[1].start = bcm63xx_get_irq_number(IRQ_UART1);
+        }
+
+        return platform_device_register(&bcm63xx_uart_devices[id]);
 }
-arch_initcall(bcm63xx_uart_register);
diff --git a/arch/mips/bcm63xx/gpio.c b/arch/mips/bcm63xx/gpio.c
index 87ca39046334..315bc7f79ce1 100644
--- a/arch/mips/bcm63xx/gpio.c
+++ b/arch/mips/bcm63xx/gpio.c
@@ -125,10 +125,10 @@ static struct gpio_chip bcm63xx_gpio_chip = {
 
 int __init bcm63xx_gpio_init(void)
 {
+        gpio_out_low = bcm_gpio_readl(GPIO_DATA_LO_REG);
+        gpio_out_high = bcm_gpio_readl(GPIO_DATA_HI_REG);
         bcm63xx_gpio_chip.ngpio = bcm63xx_gpio_count();
         pr_info("registering %d GPIOs\n", bcm63xx_gpio_chip.ngpio);
 
         return gpiochip_add(&bcm63xx_gpio_chip);
 }
-
-arch_initcall(bcm63xx_gpio_init);
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index b321d3b16877..9a06fa9f9f0c 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -45,9 +45,6 @@ extern struct plat_smp_ops octeon_smp_ops;
 extern void pci_console_init(const char *arg);
 #endif
 
-#ifdef CONFIG_CAVIUM_RESERVE32
-extern uint64_t octeon_reserve32_memory;
-#endif
 static unsigned long long MAX_MEMORY = 512ull << 20;
 
 struct octeon_boot_descriptor *octeon_boot_desc_ptr;
@@ -186,54 +183,6 @@ void octeon_check_cpu_bist(void)
         write_octeon_c0_dcacheerr(0);
 }
 
-#ifdef CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB
-/**
- * Called on every core to setup the wired tlb entry needed
- * if CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB is set.
- *
- */
-static void octeon_hal_setup_per_cpu_reserved32(void *unused)
-{
-        /*
-         * The config has selected to wire the reserve32 memory for all
-         * userspace applications. We need to put a wired TLB entry in for each
-         * 512MB of reserve32 memory. We only handle double 256MB pages here,
-         * so reserve32 must be multiple of 512MB.
-         */
-        uint32_t size = CONFIG_CAVIUM_RESERVE32;
-        uint32_t entrylo0 =
-                0x7 | ((octeon_reserve32_memory & ((1ul << 40) - 1)) >> 6);
-        uint32_t entrylo1 = entrylo0 + (256 << 14);
-        uint32_t entryhi = (0x80000000UL - (CONFIG_CAVIUM_RESERVE32 << 20));
-        while (size >= 512) {
-#if 0
-                pr_info("CPU%d: Adding double wired TLB entry for 0x%lx\n",
-                        smp_processor_id(), entryhi);
-#endif
-                add_wired_entry(entrylo0, entrylo1, entryhi, PM_256M);
-                entrylo0 += 512 << 14;
-                entrylo1 += 512 << 14;
-                entryhi += 512 << 20;
-                size -= 512;
-        }
-}
-#endif /* CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB */
-
-/**
- * Called to release the named block which was used to made sure
- * that nobody used the memory for something else during
- * init. Now we'll free it so userspace apps can use this
- * memory region with bootmem_alloc.
- *
- * This function is called only once from prom_free_prom_memory().
- */
-void octeon_hal_setup_reserved32(void)
-{
-#ifdef CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB
-        on_each_cpu(octeon_hal_setup_per_cpu_reserved32, NULL, 0, 1);
-#endif
-}
-
 /**
  * Reboot Octeon
  *
@@ -294,18 +243,6 @@ static void octeon_halt(void)
         octeon_kill_core(NULL);
 }
 
-#if 0
-/**
- * Platform time init specifics.
- * Returns
- */
-void __init plat_time_init(void)
-{
-        /* Nothing special here, but we are required to have one */
-}
-
-#endif
-
 /**
  * Handle all the error condition interrupts that might occur.
  *
@@ -502,25 +439,13 @@ void __init prom_init(void)
          * memory when it is getting memory from the
          * bootloader. Later, after the memory allocations are
          * complete, the reserve32 will be freed.
-         */
-#ifdef CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB
-        if (CONFIG_CAVIUM_RESERVE32 & 0x1ff)
-                pr_err("CAVIUM_RESERVE32 isn't a multiple of 512MB. "
-                       "This is required if CAVIUM_RESERVE32_USE_WIRED_TLB "
-                       "is set\n");
-        else
-                addr = cvmx_bootmem_phy_named_block_alloc(CONFIG_CAVIUM_RESERVE32 << 20,
-                                                        0, 0, 512 << 20,
-                                                        "CAVIUM_RESERVE32", 0);
-#else
-        /*
+         *
          * Allocate memory for RESERVED32 aligned on 2MB boundary. This
          * is in case we later use hugetlb entries with it.
          */
         addr = cvmx_bootmem_phy_named_block_alloc(CONFIG_CAVIUM_RESERVE32 << 20,
                                                 0, 0, 2 << 20,
                                                 "CAVIUM_RESERVE32", 0);
-#endif
         if (addr < 0)
                 pr_err("Failed to allocate CAVIUM_RESERVE32 memory area\n");
         else
@@ -817,9 +742,4 @@ void prom_free_prom_memory(void)
                 panic("Unable to request_irq(OCTEON_IRQ_RML)\n");
         }
 #endif
-
-        /* This call is here so that it is performed after any TLB
-           initializations. It needs to be after these in case the
-           CONFIG_CAVIUM_RESERVE32_USE_WIRED_TLB option is set */
-        octeon_hal_setup_reserved32();
 }
diff --git a/arch/mips/cavium-octeon/smp.c b/arch/mips/cavium-octeon/smp.c
index 51e980290ce1..6d99b9d8887d 100644
--- a/arch/mips/cavium-octeon/smp.c
+++ b/arch/mips/cavium-octeon/smp.c
@@ -279,14 +279,6 @@ static void octeon_cpu_die(unsigned int cpu)
         uint32_t avail_coremask;
         struct cvmx_bootmem_named_block_desc *block_desc;
 
-#ifdef CONFIG_CAVIUM_OCTEON_WATCHDOG
-        /* Disable the watchdog */
-        cvmx_ciu_wdogx_t ciu_wdog;
-        ciu_wdog.u64 = cvmx_read_csr(CVMX_CIU_WDOGX(cpu));
-        ciu_wdog.s.mode = 0;
-        cvmx_write_csr(CVMX_CIU_WDOGX(cpu), ciu_wdog.u64);
-#endif
-
         while (per_cpu(cpu_state, cpu) != CPU_DEAD)
                 cpu_relax();
 
diff --git a/arch/mips/configs/bigsur_defconfig b/arch/mips/configs/bigsur_defconfig
index c2f06e38c854..0583bb29150f 100644
--- a/arch/mips/configs/bigsur_defconfig
+++ b/arch/mips/configs/bigsur_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.26-rc8
-# Wed Jul  2 17:02:55 2008
+# Linux kernel version: 2.6.34-rc3
+# Sat Apr  3 16:32:11 2010
 #
 CONFIG_MIPS=y
 
@@ -9,20 +9,25 @@ CONFIG_MIPS=y
 # Machine selection
 #
 # CONFIG_MACH_ALCHEMY is not set
+# CONFIG_AR7 is not set
 # CONFIG_BCM47XX is not set
+# CONFIG_BCM63XX is not set
 # CONFIG_MIPS_COBALT is not set
 # CONFIG_MACH_DECSTATION is not set
 # CONFIG_MACH_JAZZ is not set
 # CONFIG_LASAT is not set
-# CONFIG_LEMOTE_FULONG is not set
+# CONFIG_MACH_LOONGSON is not set
 # CONFIG_MIPS_MALTA is not set
 # CONFIG_MIPS_SIM is not set
-# CONFIG_MARKEINS is not set
+# CONFIG_NEC_MARKEINS is not set
 # CONFIG_MACH_VR41XX is not set
+# CONFIG_NXP_STB220 is not set
+# CONFIG_NXP_STB225 is not set
 # CONFIG_PNX8550_JBS is not set
 # CONFIG_PNX8550_STB810 is not set
 # CONFIG_PMC_MSP is not set
 # CONFIG_PMC_YOSEMITE is not set
+# CONFIG_POWERTV is not set
 # CONFIG_SGI_IP22 is not set
 # CONFIG_SGI_IP27 is not set
 # CONFIG_SGI_IP28 is not set
@@ -36,10 +41,13 @@ CONFIG_MIPS=y
 # CONFIG_SIBYTE_SENTOSA is not set
 CONFIG_SIBYTE_BIGSUR=y
 # CONFIG_SNI_RM is not set
-# CONFIG_TOSHIBA_JMR3927 is not set
-# CONFIG_TOSHIBA_RBTX4927 is not set
-# CONFIG_TOSHIBA_RBTX4938 is not set
+# CONFIG_MACH_TX39XX is not set
+# CONFIG_MACH_TX49XX is not set
+# CONFIG_MIKROTIK_RB532 is not set
 # CONFIG_WR_PPMC is not set
+# CONFIG_CAVIUM_OCTEON_SIMULATOR is not set
+# CONFIG_CAVIUM_OCTEON_REFERENCE_BOARD is not set
+# CONFIG_ALCHEMY_GPIO_INDIRECT is not set
 CONFIG_SIBYTE_BCM1x80=y
 CONFIG_SIBYTE_SB1xxx_SOC=y
 # CONFIG_CPU_SB1_PASS_1 is not set
@@ -48,14 +56,13 @@ CONFIG_SIBYTE_SB1xxx_SOC=y
 # CONFIG_CPU_SB1_PASS_4 is not set
 # CONFIG_CPU_SB1_PASS_2_112x is not set
 # CONFIG_CPU_SB1_PASS_3 is not set
-# CONFIG_SIMULATION is not set
 # CONFIG_SB1_CEX_ALWAYS_FATAL is not set
 # CONFIG_SB1_CERR_STALL is not set
-CONFIG_SIBYTE_CFE=y
 # CONFIG_SIBYTE_CFE_CONSOLE is not set
 # CONFIG_SIBYTE_BUS_WATCHER is not set
 # CONFIG_SIBYTE_TBPROF is not set
 CONFIG_SIBYTE_HAS_ZBUS_PROFILING=y
+CONFIG_LOONGSON_UART_BASE=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 # CONFIG_ARCH_HAS_ILOG2_U32 is not set
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
@@ -66,15 +73,13 @@ CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CMOS_UPDATE=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
-# CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ is not set
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
+CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_CEVT_BCM1480=y
 CONFIG_CSRC_BCM1480=y
 CONFIG_CFE=y
 CONFIG_DMA_COHERENT=y
-CONFIG_EARLY_PRINTK=y
 CONFIG_SYS_HAS_EARLY_PRINTK=y
-# CONFIG_HOTPLUG_CPU is not set
 # CONFIG_NO_IOPORT is not set
 CONFIG_CPU_BIG_ENDIAN=y
 # CONFIG_CPU_LITTLE_ENDIAN is not set
@@ -88,7 +93,8 @@ CONFIG_MIPS_L1_CACHE_SHIFT=5
 #
 # CPU selection
 #
-# CONFIG_CPU_LOONGSON2 is not set
+# CONFIG_CPU_LOONGSON2E is not set
+# CONFIG_CPU_LOONGSON2F is not set
 # CONFIG_CPU_MIPS32_R1 is not set
 # CONFIG_CPU_MIPS32_R2 is not set
 # CONFIG_CPU_MIPS64_R1 is not set
@@ -101,6 +107,7 @@ CONFIG_MIPS_L1_CACHE_SHIFT=5
 # CONFIG_CPU_TX49XX is not set
 # CONFIG_CPU_R5000 is not set
 # CONFIG_CPU_R5432 is not set
+# CONFIG_CPU_R5500 is not set
 # CONFIG_CPU_R6000 is not set
 # CONFIG_CPU_NEVADA is not set
 # CONFIG_CPU_R8000 is not set
@@ -108,6 +115,7 @@ CONFIG_MIPS_L1_CACHE_SHIFT=5
 # CONFIG_CPU_RM7000 is not set
 # CONFIG_CPU_RM9000 is not set
 CONFIG_CPU_SB1=y
+# CONFIG_CPU_CAVIUM_OCTEON is not set
 CONFIG_SYS_HAS_CPU_SB1=y
 CONFIG_WEAK_ORDERING=y
 CONFIG_SYS_SUPPORTS_32BIT_KERNEL=y
@@ -123,11 +131,13 @@ CONFIG_64BIT=y
 CONFIG_PAGE_SIZE_4KB=y
 # CONFIG_PAGE_SIZE_8KB is not set
 # CONFIG_PAGE_SIZE_16KB is not set
+# CONFIG_PAGE_SIZE_32KB is not set
 # CONFIG_PAGE_SIZE_64KB is not set
 # CONFIG_SIBYTE_DMA_PAGEOPS is not set
 CONFIG_MIPS_MT_DISABLED=y
 # CONFIG_MIPS_MT_SMP is not set
 # CONFIG_MIPS_MT_SMTC is not set
+# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 CONFIG_CPU_HAS_SYNC=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
@@ -142,18 +152,17 @@ CONFIG_FLATMEM_MANUAL=y
 # CONFIG_SPARSEMEM_MANUAL is not set
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
-# CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
-CONFIG_RESOURCES_64BIT=y
+CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=0
 CONFIG_VIRT_TO_BUS=y
+# CONFIG_KSM is not set
+CONFIG_DEFAULT_MMAP_MIN_ADDR=4096
 CONFIG_SMP=y
 CONFIG_SYS_SUPPORTS_SMP=y
 CONFIG_NR_CPUS_DEFAULT_4=y
 CONFIG_NR_CPUS=4
-# CONFIG_MIPS_CMP is not set
 CONFIG_TICK_ONESHOT=y
 CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
@@ -175,6 +184,7 @@ CONFIG_SECCOMP=y
 CONFIG_LOCKDEP_SUPPORT=y
 CONFIG_STACKTRACE_SUPPORT=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
+CONFIG_CONSTRUCTORS=y
 
 #
 # General setup
@@ -188,6 +198,7 @@ CONFIG_SWAP=y
 CONFIG_SYSVIPC=y
 CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_POSIX_MQUEUE=y
+CONFIG_POSIX_MQUEUE_SYSCTL=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
@@ -195,23 +206,39 @@ CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_AUDIT=y
+
+#
+# RCU Subsystem
+#
+CONFIG_TREE_RCU=y
+# CONFIG_TREE_PREEMPT_RCU is not set
+# CONFIG_TINY_RCU is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RCU_FANOUT=64
+# CONFIG_RCU_FANOUT_EXACT is not set
+# CONFIG_RCU_FAST_NO_HZ is not set
+# CONFIG_TREE_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=16
 # CONFIG_CGROUPS is not set
-CONFIG_GROUP_SCHED=y
-CONFIG_FAIR_GROUP_SCHED=y
-# CONFIG_RT_GROUP_SCHED is not set
-CONFIG_USER_SCHED=y
-# CONFIG_CGROUP_SCHED is not set
-CONFIG_SYSFS_DEPRECATED=y
-CONFIG_SYSFS_DEPRECATED_V2=y
+# CONFIG_SYSFS_DEPRECATED_V2 is not set
 CONFIG_RELAY=y
-# CONFIG_NAMESPACES is not set
+CONFIG_NAMESPACES=y
+CONFIG_UTS_NS=y
+CONFIG_IPC_NS=y
+CONFIG_USER_NS=y
+CONFIG_PID_NS=y
+CONFIG_NET_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
+CONFIG_RD_GZIP=y
+# CONFIG_RD_BZIP2 is not set
+# CONFIG_RD_LZMA is not set
+# CONFIG_RD_LZO is not set
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
 CONFIG_SYSCTL=y
+CONFIG_ANON_INODES=y
 CONFIG_EMBEDDED=y
 # CONFIG_SYSCTL_SYSCALL is not set
 CONFIG_KALLSYMS=y
@@ -222,29 +249,36 @@ CONFIG_PRINTK=y
 CONFIG_BUG=y
 CONFIG_ELF_CORE=y
 # CONFIG_PCSPKR_PLATFORM is not set
-CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
-CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
+CONFIG_AIO=y
+
+#
+# Kernel Performance Events And Counters
+#
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
+CONFIG_COMPAT_BRK=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
-# CONFIG_HAVE_KPROBES is not set
-# CONFIG_HAVE_KRETPROBES is not set
-# CONFIG_HAVE_DMA_ATTRS is not set
-CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_HAVE_SYSCALL_WRAPPERS=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
+
+#
+# GCOV-based kernel profiling
+#
+# CONFIG_SLOW_WORK is not set
+CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -252,26 +286,52 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 CONFIG_MODVERSIONS=y
 CONFIG_MODULE_SRCVERSION_ALL=y
-CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
-# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
 CONFIG_BLOCK_COMPAT=y
 
 #
 # IO Schedulers
 #
 CONFIG_IOSCHED_NOOP=y
-CONFIG_IOSCHED_AS=y
 CONFIG_IOSCHED_DEADLINE=y
 CONFIG_IOSCHED_CFQ=y
-CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_DEADLINE is not set
-# CONFIG_DEFAULT_CFQ is not set
+CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
-CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
+CONFIG_DEFAULT_IOSCHED="cfq"
+# CONFIG_INLINE_SPIN_TRYLOCK is not set
+# CONFIG_INLINE_SPIN_TRYLOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK is not set
+# CONFIG_INLINE_SPIN_LOCK_BH is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQ is not set
+# CONFIG_INLINE_SPIN_LOCK_IRQSAVE is not set
+CONFIG_INLINE_SPIN_UNLOCK=y
+# CONFIG_INLINE_SPIN_UNLOCK_BH is not set
+CONFIG_INLINE_SPIN_UNLOCK_IRQ=y
+# CONFIG_INLINE_SPIN_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_READ_TRYLOCK is not set
+# CONFIG_INLINE_READ_LOCK is not set
+# CONFIG_INLINE_READ_LOCK_BH is not set
+# CONFIG_INLINE_READ_LOCK_IRQ is not set
+# CONFIG_INLINE_READ_LOCK_IRQSAVE is not set
+CONFIG_INLINE_READ_UNLOCK=y
+# CONFIG_INLINE_READ_UNLOCK_BH is not set
+CONFIG_INLINE_READ_UNLOCK_IRQ=y
+# CONFIG_INLINE_READ_UNLOCK_IRQRESTORE is not set
+# CONFIG_INLINE_WRITE_TRYLOCK is not set
+# CONFIG_INLINE_WRITE_LOCK is not set
+# CONFIG_INLINE_WRITE_LOCK_BH is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQ is not set
+# CONFIG_INLINE_WRITE_LOCK_IRQSAVE is not set
+CONFIG_INLINE_WRITE_UNLOCK=y
+# CONFIG_INLINE_WRITE_UNLOCK_BH is not set
+CONFIG_INLINE_WRITE_UNLOCK_IRQ=y
+# CONFIG_INLINE_WRITE_UNLOCK_IRQRESTORE is not set
+CONFIG_MUTEX_SPIN_ON_OWNER=y
+# CONFIG_FREEZER is not set
 
 #
 # Bus options (PCI, PCMCIA, EISA, ISA, TC)
@@ -280,8 +340,9 @@ CONFIG_HW_HAS_PCI=y
 CONFIG_PCI=y
 CONFIG_PCI_DOMAINS=y
 # CONFIG_ARCH_SUPPORTS_MSI is not set
-CONFIG_PCI_LEGACY=y
 CONFIG_PCI_DEBUG=y
+# CONFIG_PCI_STUB is not set
+# CONFIG_PCI_IOV is not set
 CONFIG_MMU=y
 CONFIG_ZONE_DMA32=y
 # CONFIG_PCCARD is not set
@@ -291,6 +352,8 @@ CONFIG_ZONE_DMA32=y
 # Executable file formats
 #
 CONFIG_BINFMT_ELF=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
 CONFIG_MIPS32_COMPAT=y
 CONFIG_COMPAT=y
@@ -304,23 +367,20 @@ CONFIG_BINFMT_ELF32=y
 #
 CONFIG_PM=y
 # CONFIG_PM_DEBUG is not set
-
-#
-# Networking
-#
+# CONFIG_PM_RUNTIME is not set
 CONFIG_NET=y
 
 #
 # Networking options
 #
 CONFIG_PACKET=y
-CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
 CONFIG_XFRM=y
 CONFIG_XFRM_USER=m
 # CONFIG_XFRM_SUB_POLICY is not set
 CONFIG_XFRM_MIGRATE=y
 # CONFIG_XFRM_STATISTICS is not set
+CONFIG_XFRM_IPCOMP=m
 CONFIG_NET_KEY=y
 CONFIG_NET_KEY_MIGRATE=y
 CONFIG_INET=y
@@ -353,36 +413,6 @@ CONFIG_INET_TCP_DIAG=y
 CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_TCP_MD5SIG=y
-CONFIG_IP_VS=m
-# CONFIG_IP_VS_DEBUG is not set
-CONFIG_IP_VS_TAB_BITS=12
-
-#
-# IPVS transport protocol load balancing support
-#
-CONFIG_IP_VS_PROTO_TCP=y
-CONFIG_IP_VS_PROTO_UDP=y
-CONFIG_IP_VS_PROTO_ESP=y
-CONFIG_IP_VS_PROTO_AH=y
-
-#
-# IPVS scheduler
-#
-CONFIG_IP_VS_RR=m
-CONFIG_IP_VS_WRR=m
-CONFIG_IP_VS_LC=m
-CONFIG_IP_VS_WLC=m
-CONFIG_IP_VS_LBLC=m
-CONFIG_IP_VS_LBLCR=m
-CONFIG_IP_VS_DH=m
-CONFIG_IP_VS_SH=m
-CONFIG_IP_VS_SED=m
-CONFIG_IP_VS_NQ=m
-
-#
-# IPVS application helper
-#
-CONFIG_IP_VS_FTP=m
 CONFIG_IPV6=m
 CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
@@ -399,11 +429,13 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m
 CONFIG_INET6_XFRM_MODE_BEET=m
 CONFIG_INET6_XFRM_MODE_ROUTEOPTIMIZATION=m
 CONFIG_IPV6_SIT=m
+CONFIG_IPV6_SIT_6RD=y
 CONFIG_IPV6_NDISC_NODETYPE=y
 CONFIG_IPV6_TUNNEL=m
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_SUBTREES=y
 # CONFIG_IPV6_MROUTE is not set
+CONFIG_NETLABEL=y
 CONFIG_NETWORK_SECMARK=y
 CONFIG_NETFILTER=y
 # CONFIG_NETFILTER_DEBUG is not set
@@ -421,19 +453,53 @@ CONFIG_NF_CONNTRACK_IRC=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CT_NETLINK=m
 CONFIG_NETFILTER_XTABLES=m
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
 CONFIG_NETFILTER_XT_TARGET_MARK=m
 CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_SECMARK=m
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
 CONFIG_NETFILTER_XT_MATCH_MARK=m
 CONFIG_NETFILTER_XT_MATCH_POLICY=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
+CONFIG_IP_VS=m
+CONFIG_IP_VS_IPV6=y
+# CONFIG_IP_VS_DEBUG is not set
+CONFIG_IP_VS_TAB_BITS=12
+
+#
+# IPVS transport protocol load balancing support
+#
+CONFIG_IP_VS_PROTO_TCP=y
+CONFIG_IP_VS_PROTO_UDP=y
+CONFIG_IP_VS_PROTO_AH_ESP=y
+CONFIG_IP_VS_PROTO_ESP=y
+CONFIG_IP_VS_PROTO_AH=y
+CONFIG_IP_VS_PROTO_SCTP=y
+
+#
+# IPVS scheduler
+#
+CONFIG_IP_VS_RR=m
+CONFIG_IP_VS_WRR=m
+CONFIG_IP_VS_LC=m
+CONFIG_IP_VS_WLC=m
+CONFIG_IP_VS_LBLC=m
+CONFIG_IP_VS_LBLCR=m
+CONFIG_IP_VS_DH=m
+CONFIG_IP_VS_SH=m
+CONFIG_IP_VS_SED=m
+CONFIG_IP_VS_NQ=m
+
+#
+# IPVS application helper
+#
+CONFIG_IP_VS_FTP=m
 
 #
 # IP: Netfilter Configuration
 #
+CONFIG_NF_DEFRAG_IPV4=m
 CONFIG_NF_CONNTRACK_IPV4=m
 CONFIG_NF_CONNTRACK_PROC_COMPAT=y
 CONFIG_IP_NF_IPTABLES=m
@@ -459,22 +525,44 @@ CONFIG_IP_NF_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_LOG=m
+CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
 CONFIG_IP6_NF_MANGLE=m
-# CONFIG_IP_DCCP is not set
+CONFIG_IP_DCCP=m
+CONFIG_INET_DCCP_DIAG=m
+
+#
+# DCCP CCIDs Configuration (EXPERIMENTAL)
+#
+# CONFIG_IP_DCCP_CCID2_DEBUG is not set
+CONFIG_IP_DCCP_CCID3=y
+# CONFIG_IP_DCCP_CCID3_DEBUG is not set
+CONFIG_IP_DCCP_CCID3_RTO=100
+CONFIG_IP_DCCP_TFRC_LIB=y
+
+#
+# DCCP Kernel Hacking
+#
+# CONFIG_IP_DCCP_DEBUG is not set
 CONFIG_IP_SCTP=m
 # CONFIG_SCTP_DBG_MSG is not set
 # CONFIG_SCTP_DBG_OBJCNT is not set
 # CONFIG_SCTP_HMAC_NONE is not set
-# CONFIG_SCTP_HMAC_SHA1 is not set
-CONFIG_SCTP_HMAC_MD5=y
+CONFIG_SCTP_HMAC_SHA1=y
+# CONFIG_SCTP_HMAC_MD5 is not set
+# CONFIG_RDS is not set
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
-# CONFIG_BRIDGE is not set
-# CONFIG_VLAN_8021Q is not set
+CONFIG_STP=m
+CONFIG_GARP=m
+CONFIG_BRIDGE=m
+CONFIG_BRIDGE_IGMP_SNOOPING=y
+# CONFIG_NET_DSA is not set
+CONFIG_VLAN_8021Q=m
+CONFIG_VLAN_8021Q_GVRP=y
 # CONFIG_DECNET is not set
+CONFIG_LLC=m
 # CONFIG_LLC2 is not set
 # CONFIG_IPX is not set
 # CONFIG_ATALK is not set
@@ -482,26 +570,47 @@ CONFIG_SCTP_HMAC_MD5=y
 # CONFIG_LAPB is not set
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
+# CONFIG_PHONET is not set
+# CONFIG_IEEE802154 is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
 #
 # CONFIG_NET_PKTGEN is not set
-# CONFIG_HAMRADIO is not set
+CONFIG_HAMRADIO=y
+
+#
+# Packet Radio protocols
+#
+CONFIG_AX25=m
+CONFIG_AX25_DAMA_SLAVE=y
+CONFIG_NETROM=m
+CONFIG_ROSE=m
+
+#
+# AX.25 network device drivers
+#
+CONFIG_MKISS=m
+CONFIG_6PACK=m
+CONFIG_BPQETHER=m
+CONFIG_BAYCOM_SER_FDX=m
+CONFIG_BAYCOM_SER_HDX=m
+CONFIG_YAM=m
 # CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
 CONFIG_FIB_RULES=y
+CONFIG_WIRELESS=y
+# CONFIG_CFG80211 is not set
+# CONFIG_LIB80211 is not set
 
 #
-# Wireless
+# CFG80211 needs to be enabled for MAC80211
 #
-# CONFIG_CFG80211 is not set
-# CONFIG_WIRELESS_EXT is not set
-# CONFIG_MAC80211 is not set
-# CONFIG_IEEE80211 is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -513,9 +622,12 @@ CONFIG_FIB_RULES=y
 # Generic Driver Options
 #
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+# CONFIG_DEVTMPFS is not set
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 CONFIG_FW_LOADER=m
+CONFIG_FIRMWARE_IN_KERNEL=y
+CONFIG_EXTRA_FIRMWARE=""
 # CONFIG_DEBUG_DRIVER is not set
 # CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
@@ -530,33 +642,53 @@ CONFIG_BLK_DEV=y
 # CONFIG_BLK_DEV_COW_COMMON is not set
 CONFIG_BLK_DEV_LOOP=m
 CONFIG_BLK_DEV_CRYPTOLOOP=m
+
+#
+# DRBD disabled because PROC_FS, INET or CONNECTOR not selected
+#
 CONFIG_BLK_DEV_NBD=m
 # CONFIG_BLK_DEV_SX8 is not set
 # CONFIG_BLK_DEV_RAM is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
+# CONFIG_AD525X_DPOT is not set
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 CONFIG_SGI_IOC4=m
 # CONFIG_TIFM_CORE is not set
+# CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
+# CONFIG_HP_ILO is not set
+# CONFIG_ISL29003 is not set
+# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_DS1682 is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+CONFIG_EEPROM_LEGACY=y
+CONFIG_EEPROM_MAX6875=y
+# CONFIG_EEPROM_93CX6 is not set
+# CONFIG_CB710_CORE is not set
 CONFIG_HAVE_IDE=y
 CONFIG_IDE=y
-CONFIG_IDE_MAX_HWIFS=4
-CONFIG_BLK_DEV_IDE=y
 
 #
 # Please see Documentation/ide/ide.txt for help/info on IDE drives
 #
+CONFIG_IDE_XFER_MODE=y
+CONFIG_IDE_TIMINGS=y
+CONFIG_IDE_ATAPI=y
 # CONFIG_BLK_DEV_IDE_SATA is not set
-CONFIG_BLK_DEV_IDEDISK=y
-# CONFIG_IDEDISK_MULTI_MODE is not set
+CONFIG_IDE_GD=y
+CONFIG_IDE_GD_ATA=y
+# CONFIG_IDE_GD_ATAPI is not set
 CONFIG_BLK_DEV_IDECD=y
 CONFIG_BLK_DEV_IDECD_VERBOSE_ERRORS=y
 CONFIG_BLK_DEV_IDETAPE=y
-CONFIG_BLK_DEV_IDEFLOPPY=y
-# CONFIG_BLK_DEV_IDESCSI is not set
 # CONFIG_IDE_TASK_IOCTL is not set
 CONFIG_IDE_PROC_FS=y
 
@@ -581,14 +713,13 @@ CONFIG_BLK_DEV_IDEDMA_PCI=y
 # CONFIG_BLK_DEV_AMD74XX is not set
 CONFIG_BLK_DEV_CMD64X=y
 # CONFIG_BLK_DEV_TRIFLEX is not set
-# CONFIG_BLK_DEV_CY82C693 is not set
 # CONFIG_BLK_DEV_CS5520 is not set
 # CONFIG_BLK_DEV_CS5530 is not set
-# CONFIG_BLK_DEV_HPT34X is not set
 # CONFIG_BLK_DEV_HPT366 is not set
 # CONFIG_BLK_DEV_JMICRON is not set
 # CONFIG_BLK_DEV_SC1200 is not set
 # CONFIG_BLK_DEV_PIIX is not set
+# CONFIG_BLK_DEV_IT8172 is not set
 CONFIG_BLK_DEV_IT8213=m
 # CONFIG_BLK_DEV_IT821X is not set
 # CONFIG_BLK_DEV_NS87415 is not set
@@ -600,14 +731,12 @@ CONFIG_BLK_DEV_IT8213=m
 # CONFIG_BLK_DEV_TRM290 is not set
 # CONFIG_BLK_DEV_VIA82CXXX is not set
 CONFIG_BLK_DEV_TC86C001=m
-# CONFIG_BLK_DEV_IDE_SWARM is not set
 CONFIG_BLK_DEV_IDEDMA=y
-# CONFIG_BLK_DEV_HD_ONLY is not set
-# CONFIG_BLK_DEV_HD is not set
 
 #
 # SCSI device support
 #
+CONFIG_SCSI_MOD=y
 # CONFIG_RAID_ATTRS is not set
 CONFIG_SCSI=y
 CONFIG_SCSI_DMA=y
@@ -625,10 +754,6 @@ CONFIG_BLK_DEV_SR=m
 CONFIG_BLK_DEV_SR_VENDOR=y
 CONFIG_CHR_DEV_SG=m
 CONFIG_CHR_DEV_SCH=m
-
-#
-# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
-#
 # CONFIG_SCSI_MULTI_LUN is not set
 # CONFIG_SCSI_CONSTANTS is not set
 # CONFIG_SCSI_LOGGING is not set
@@ -645,27 +770,36 @@ CONFIG_SCSI_WAIT_SCAN=m
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_SCSI_CXGB3_ISCSI is not set
+# CONFIG_SCSI_BNX2_ISCSI is not set
+# CONFIG_BE2ISCSI is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
+# CONFIG_SCSI_HPSA is not set
 # CONFIG_SCSI_3W_9XXX is not set
+# CONFIG_SCSI_3W_SAS is not set
 # CONFIG_SCSI_ACARD is not set
 # CONFIG_SCSI_AACRAID is not set
 # CONFIG_SCSI_AIC7XXX is not set
 # CONFIG_SCSI_AIC7XXX_OLD is not set
 # CONFIG_SCSI_AIC79XX is not set
 # CONFIG_SCSI_AIC94XX is not set
+# CONFIG_SCSI_MVSAS is not set
 # CONFIG_SCSI_DPT_I2O is not set
 # CONFIG_SCSI_ADVANSYS is not set
 # CONFIG_SCSI_ARCMSR is not set
 # CONFIG_MEGARAID_NEWGEN is not set
 # CONFIG_MEGARAID_LEGACY is not set
 # CONFIG_MEGARAID_SAS is not set
+# CONFIG_SCSI_MPT2SAS is not set
 # CONFIG_SCSI_HPTIOP is not set
+# CONFIG_LIBFC is not set
+# CONFIG_LIBFCOE is not set
+# CONFIG_FCOE is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
 # CONFIG_SCSI_IPS is not set
 # CONFIG_SCSI_INITIO is not set
 # CONFIG_SCSI_INIA100 is not set
-# CONFIG_SCSI_MVSAS is not set
 # CONFIG_SCSI_STEX is not set
 # CONFIG_SCSI_SYM53C8XX_2 is not set
 # CONFIG_SCSI_IPR is not set
@@ -676,9 +810,15 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_SCSI_DC395x is not set
 # CONFIG_SCSI_DC390T is not set
 # CONFIG_SCSI_DEBUG is not set
+# CONFIG_SCSI_PMCRAID is not set
+# CONFIG_SCSI_PM8001 is not set
 # CONFIG_SCSI_SRP is not set
+# CONFIG_SCSI_BFA_FC is not set
+# CONFIG_SCSI_DH is not set
+# CONFIG_SCSI_OSD_INITIATOR is not set
 CONFIG_ATA=y
 # CONFIG_ATA_NONSTANDARD is not set
+CONFIG_ATA_VERBOSE_ERROR=y
 CONFIG_SATA_PMP=y
 # CONFIG_SATA_AHCI is not set
 CONFIG_SATA_SIL24=y
@@ -700,6 +840,7 @@ CONFIG_ATA_SFF=y
 # CONFIG_PATA_ALI is not set
 # CONFIG_PATA_AMD is not set
 # CONFIG_PATA_ARTOP is not set
+# CONFIG_PATA_ATP867X is not set
 # CONFIG_PATA_ATIIXP is not set
 # CONFIG_PATA_CMD640_PCI is not set
 # CONFIG_PATA_CMD64X is not set
@@ -715,6 +856,7 @@ CONFIG_ATA_SFF=y
 # CONFIG_PATA_IT821X is not set
 # CONFIG_PATA_IT8213 is not set
 # CONFIG_PATA_JMICRON is not set
+# CONFIG_PATA_LEGACY is not set
 # CONFIG_PATA_TRIFLEX is not set
 # CONFIG_PATA_MARVELL is not set
 # CONFIG_PATA_MPIIX is not set
@@ -725,14 +867,16 @@ CONFIG_ATA_SFF=y
 # CONFIG_PATA_NS87415 is not set
 # CONFIG_PATA_OPTI is not set
 # CONFIG_PATA_OPTIDMA is not set
+# CONFIG_PATA_PDC2027X is not set
 # CONFIG_PATA_PDC_OLD is not set
 # CONFIG_PATA_RADISYS is not set
+# CONFIG_PATA_RDC is not set
 # CONFIG_PATA_RZ1000 is not set
 # CONFIG_PATA_SC1200 is not set
 # CONFIG_PATA_SERVERWORKS is not set
-# CONFIG_PATA_PDC2027X is not set
 CONFIG_PATA_SIL680=y
 # CONFIG_PATA_SIS is not set
+# CONFIG_PATA_TOSHIBA is not set
 # CONFIG_PATA_VIA is not set
 # CONFIG_PATA_WINBOND is not set
 # CONFIG_PATA_PLATFORM is not set
@@ -745,13 +889,16 @@ CONFIG_PATA_SIL680=y
 #
 
 #
-# Enable only one of the two stacks, unless you know what you are doing
+# You can enable one or both FireWire driver stacks.
+#
+
+#
+# The newer stack is recommended.
 #
 # CONFIG_FIREWIRE is not set
 # CONFIG_IEEE1394 is not set
 # CONFIG_I2O is not set
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -774,6 +921,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -783,23 +933,33 @@ CONFIG_MII=y
 # CONFIG_SUNGEM is not set
 # CONFIG_CASSINI is not set
 # CONFIG_NET_VENDOR_3COM is not set
+# CONFIG_SMC91X is not set
 # CONFIG_DM9000 is not set
+# CONFIG_ETHOC is not set
+# CONFIG_SMSC911X is not set
+# CONFIG_DNET is not set
 # CONFIG_NET_TULIP is not set
 # CONFIG_HP100 is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_NET_PCI is not set
 # CONFIG_B44 is not set
+# CONFIG_KS8842 is not set
+# CONFIG_KS8851_MLL is not set
+# CONFIG_ATL2 is not set
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
 # CONFIG_DL2K is not set
 # CONFIG_E1000 is not set
 # CONFIG_E1000E is not set
-# CONFIG_E1000E_ENABLED is not set
 # CONFIG_IP1000 is not set
 # CONFIG_IGB is not set
+# CONFIG_IGBVF is not set
 # CONFIG_NS83820 is not set
 # CONFIG_HAMACHI is not set
 # CONFIG_YELLOWFIN is not set
@@ -811,29 +971,42 @@ CONFIG_SB1250_MAC=y
 # CONFIG_VIA_VELOCITY is not set
 # CONFIG_TIGON3 is not set
 # CONFIG_BNX2 is not set
+# CONFIG_CNIC is not set
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
+# CONFIG_ATL1E is not set
+# CONFIG_ATL1C is not set
+# CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
+CONFIG_MDIO=m
 # CONFIG_CHELSIO_T1 is not set
+CONFIG_CHELSIO_T3_DEPENDS=y
 CONFIG_CHELSIO_T3=m
+# CONFIG_ENIC is not set
 # CONFIG_IXGBE is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
+# CONFIG_VXGE is not set
 # CONFIG_MYRI10GE is not set
 CONFIG_NETXEN_NIC=m
 # CONFIG_NIU is not set
+# CONFIG_MLX4_EN is not set
 # CONFIG_MLX4_CORE is not set
 # CONFIG_TEHUTI is not set
 # CONFIG_BNX2X is not set
+# CONFIG_QLCNIC is not set
+# CONFIG_QLGE is not set
 # CONFIG_SFC is not set
+# CONFIG_BE2NET is not set
 # CONFIG_TR is not set
+CONFIG_WLAN=y
+# CONFIG_ATMEL is not set
+# CONFIG_PRISM54 is not set
+# CONFIG_HOSTAP is not set
 
 #
-# Wireless LAN
+# Enable WiMAX (Networking options) to see the WiMAX drivers
 #
-# CONFIG_WLAN_PRE80211 is not set
-# CONFIG_WLAN_80211 is not set
-# CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
@@ -856,6 +1029,7 @@ CONFIG_SLIP_MODE_SLIP6=y
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
+# CONFIG_VMXNET3 is not set
 # CONFIG_ISDN is not set
 # CONFIG_PHONE is not set
 
@@ -873,6 +1047,7 @@ CONFIG_SERIO_SERPORT=y
 # CONFIG_SERIO_PCIPS2 is not set
 # CONFIG_SERIO_LIBPS2 is not set
 CONFIG_SERIO_RAW=m
+# CONFIG_SERIO_ALTERA_PS2 is not set
 # CONFIG_GAMEPORT is not set
 
 #
@@ -893,8 +1068,6 @@ CONFIG_SERIAL_NONSTANDARD=y
 # CONFIG_N_HDLC is not set
 # CONFIG_RISCOM8 is not set
 # CONFIG_SPECIALIX is not set
-# CONFIG_SX is not set
-# CONFIG_RIO is not set
 # CONFIG_STALDRV is not set
 # CONFIG_NOZOMI is not set
 
@@ -911,7 +1084,9 @@ CONFIG_SERIAL_SB1250_DUART_CONSOLE=y
 CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
+# CONFIG_SERIAL_TIMBERDALE is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_IPMI_HANDLER is not set
@@ -923,89 +1098,99 @@ CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_DEVPORT=y
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
+CONFIG_I2C_COMPAT=y
 CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_HELPER_AUTO=y
 
 #
 # I2C Hardware Bus support
 #
+
+#
+# PC SMBus host controller drivers
+#
 # CONFIG_I2C_ALI1535 is not set
 # CONFIG_I2C_ALI1563 is not set
 # CONFIG_I2C_ALI15X3 is not set
 # CONFIG_I2C_AMD756 is not set
 # CONFIG_I2C_AMD8111 is not set
 # CONFIG_I2C_I801 is not set
-# CONFIG_I2C_I810 is not set
+# CONFIG_I2C_ISCH is not set
 # CONFIG_I2C_PIIX4 is not set
 # CONFIG_I2C_NFORCE2 is not set
-# CONFIG_I2C_OCORES is not set
-# CONFIG_I2C_PARPORT_LIGHT is not set
-# CONFIG_I2C_PROSAVAGE is not set
-# CONFIG_I2C_SAVAGE4 is not set
-CONFIG_I2C_SIBYTE=y
-# CONFIG_I2C_SIMTEC is not set
 # CONFIG_I2C_SIS5595 is not set
 # CONFIG_I2C_SIS630 is not set
 # CONFIG_I2C_SIS96X is not set
-# CONFIG_I2C_TAOS_EVM is not set
-# CONFIG_I2C_STUB is not set
 # CONFIG_I2C_VIA is not set
 # CONFIG_I2C_VIAPRO is not set
-# CONFIG_I2C_VOODOO3 is not set
-# CONFIG_I2C_PCA_PLATFORM is not set
 
 #
-# Miscellaneous I2C Chip support
+# I2C system bus drivers (mostly embedded / system-on-chip)
 #
-# CONFIG_DS1682 is not set
-CONFIG_EEPROM_LEGACY=y
-CONFIG_SENSORS_PCF8574=y
-# CONFIG_PCF8575 is not set
-CONFIG_SENSORS_PCF8591=y
-CONFIG_EEPROM_MAX6875=y
-# CONFIG_SENSORS_TSL2550 is not set
+# CONFIG_I2C_OCORES is not set
+# CONFIG_I2C_SIMTEC is not set
+# CONFIG_I2C_XILINX is not set
+
+#
+# External I2C/SMBus adapter drivers
+#
+# CONFIG_I2C_PARPORT_LIGHT is not set
+# CONFIG_I2C_TAOS_EVM is not set
+
+#
+# Other I2C/SMBus bus drivers
+#
+# CONFIG_I2C_PCA_PLATFORM is not set
+CONFIG_I2C_SIBYTE=y
+# CONFIG_I2C_STUB is not set
 CONFIG_I2C_DEBUG_CORE=y
 CONFIG_I2C_DEBUG_ALGO=y
 CONFIG_I2C_DEBUG_BUS=y
-CONFIG_I2C_DEBUG_CHIP=y
 # CONFIG_SPI is not set
+
+#
+# PPS support
+#
+# CONFIG_PPS is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 # CONFIG_HWMON is not set
 # CONFIG_THERMAL is not set
-# CONFIG_THERMAL_HWMON is not set
 # CONFIG_WATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
 
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
 # CONFIG_SSB is not set
 
 #
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
+# CONFIG_MFD_88PM860X is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
-
-#
-# Multimedia devices
-#
-
-#
-# Multimedia core support
-#
-# CONFIG_VIDEO_DEV is not set
-# CONFIG_DVB_CORE is not set
-# CONFIG_VIDEO_MEDIA is not set
-
-#
-# Multimedia drivers
-#
-# CONFIG_DAB is not set
+# CONFIG_TWL4030_CORE is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_PMIC_ADP5520 is not set
+# CONFIG_MFD_MAX8925 is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM831X is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_WM8994 is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_AB3100_CORE is not set
+# CONFIG_LPC_SCH is not set
+# CONFIG_REGULATOR is not set
+# CONFIG_MEDIA_SUPPORT is not set
 
 #
 # Graphics support
 #
+CONFIG_VGA_ARB=y
+CONFIG_VGA_ARB_MAX_GPUS=16
 # CONFIG_DRM is not set
 # CONFIG_VGASTATE is not set
 # CONFIG_VIDEO_OUTPUT_CONTROL is not set
@@ -1016,10 +1201,6 @@ CONFIG_SSB_POSSIBLE=y
 # Display device support
 #
 # CONFIG_DISPLAY_SUPPORT is not set
-
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -1030,9 +1211,18 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_USB_OTG_BLACKLIST_HUB is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# Enable Host or Gadget support to see Inventra options
+#
+
+#
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may
 #
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
@@ -1040,41 +1230,66 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_INFINIBAND is not set
 CONFIG_RTC_LIB=y
 # CONFIG_RTC_CLASS is not set
+# CONFIG_DMADEVICES is not set
+# CONFIG_AUXDISPLAY is not set
 # CONFIG_UIO is not set
 
 #
+# TI VLYNQ
+#
+# CONFIG_STAGING is not set
+
+#
 # File systems
 #
 CONFIG_EXT2_FS=m
 CONFIG_EXT2_FS_XATTR=y
-# CONFIG_EXT2_FS_POSIX_ACL is not set
-# CONFIG_EXT2_FS_SECURITY is not set
-# CONFIG_EXT2_FS_XIP is not set
-CONFIG_EXT3_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT2_FS_SECURITY=y
+CONFIG_EXT2_FS_XIP=y
+CONFIG_EXT3_FS=m
+CONFIG_EXT3_DEFAULTS_TO_ORDERED=y
 CONFIG_EXT3_FS_XATTR=y
-# CONFIG_EXT3_FS_POSIX_ACL is not set
-# CONFIG_EXT3_FS_SECURITY is not set
-# CONFIG_EXT4DEV_FS is not set
-CONFIG_JBD=y
+CONFIG_EXT3_FS_POSIX_ACL=y
+CONFIG_EXT3_FS_SECURITY=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_XATTR=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+# CONFIG_EXT4_DEBUG is not set
+CONFIG_FS_XIP=y
+CONFIG_JBD=m
+CONFIG_JBD2=y
 CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
-# CONFIG_FS_POSIX_ACL is not set
+CONFIG_FS_POSIX_ACL=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
+# CONFIG_NILFS2_FS is not set
+CONFIG_FILE_LOCKING=y
+CONFIG_FSNOTIFY=y
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_QUOTA_TREE=m
 # CONFIG_QFMT_V1 is not set
 CONFIG_QFMT_V2=m
 CONFIG_QUOTACTL=y
 CONFIG_AUTOFS_FS=m
 CONFIG_AUTOFS4_FS=m
 CONFIG_FUSE_FS=m
+# CONFIG_CUSE is not set
+
+#
+# Caches
+#
+# CONFIG_FSCACHE is not set
 
 #
 # CD-ROM/DVD Filesystems
@@ -1103,15 +1318,13 @@ CONFIG_NTFS_RW=y
 CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_CONFIGFS_FS=m
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_ECRYPT_FS is not set
@@ -1120,9 +1333,12 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BEFS_FS is not set
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
+# CONFIG_LOGFS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
 # CONFIG_ROMFS_FS is not set
@@ -1133,16 +1349,17 @@ CONFIG_NFS_FS=y
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
-# CONFIG_NFSD is not set
 CONFIG_ROOT_NFS=y
+# CONFIG_NFSD is not set
 CONFIG_LOCKD=y
 CONFIG_LOCKD_V4=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
-# CONFIG_SUNRPC_BIND34 is not set
-# CONFIG_RPCSEC_GSS_KRB5 is not set
-# CONFIG_RPCSEC_GSS_SPKM3 is not set
+CONFIG_SUNRPC_GSS=m
+CONFIG_RPCSEC_GSS_KRB5=m
+CONFIG_RPCSEC_GSS_SPKM3=m
 # CONFIG_SMB_FS is not set
+# CONFIG_CEPH_FS is not set
 # CONFIG_CIFS is not set
 # CONFIG_NCP_FS is not set
 # CONFIG_CODA_FS is not set
@@ -1205,12 +1422,18 @@ CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=2048
 CONFIG_MAGIC_SYSRQ=y
+# CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 # CONFIG_DEBUG_FS is not set
 # CONFIG_HEADERS_CHECK is not set
 CONFIG_DEBUG_KERNEL=y
 # CONFIG_DEBUG_SHIRQ is not set
 CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set
+CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0
 CONFIG_SCHED_DEBUG=y
 # CONFIG_SCHEDSTATS is not set
 # CONFIG_TIMER_STATS is not set
@@ -1219,23 +1442,53 @@ CONFIG_SCHED_DEBUG=y
 # CONFIG_DEBUG_RT_MUTEXES is not set
 # CONFIG_RT_MUTEX_TESTER is not set
 # CONFIG_DEBUG_SPINLOCK is not set
-CONFIG_DEBUG_MUTEXES=y
+# CONFIG_DEBUG_MUTEXES is not set
 # CONFIG_DEBUG_LOCK_ALLOC is not set
 # CONFIG_PROVE_LOCKING is not set
 # CONFIG_LOCK_STAT is not set
-# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+CONFIG_DEBUG_SPINLOCK_SLEEP=y
 # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
 # CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
 # CONFIG_DEBUG_WRITECOUNT is not set
-# CONFIG_DEBUG_LIST is not set
+CONFIG_DEBUG_MEMORY_INIT=y
+CONFIG_DEBUG_LIST=y
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+# CONFIG_DEBUG_CREDENTIALS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+CONFIG_RCU_CPU_STALL_DETECTOR=y
 # CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set
 # CONFIG_FAULT_INJECTION is not set
+# CONFIG_SYSCTL_SYSCALL_CHECK is not set
+# CONFIG_PAGE_POISONING is not set
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_TRACING_SUPPORT=y
+CONFIG_FTRACE=y
+# CONFIG_FUNCTION_TRACER is not set
+# CONFIG_IRQSOFF_TRACER is not set
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_ENABLE_DEFAULT_TRACERS is not set
+# CONFIG_BOOT_TRACER is not set
+CONFIG_BRANCH_PROFILE_NONE=y
+# CONFIG_PROFILE_ANNOTATED_BRANCHES is not set
+# CONFIG_PROFILE_ALL_BRANCHES is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_KMEMTRACE is not set
+# CONFIG_WORKQUEUE_TRACER is not set
+# CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+# CONFIG_KGDB is not set
+CONFIG_EARLY_PRINTK=y
 # CONFIG_CMDLINE_BOOL is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_SB1XXX_CORELIS is not set
@@ -1246,20 +1499,50 @@ CONFIG_DEBUG_MUTEXES=y
 #
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
-# CONFIG_SECURITY is not set
-# CONFIG_SECURITY_FILE_CAPABILITIES is not set
+CONFIG_SECURITY=y
+# CONFIG_SECURITYFS is not set
+CONFIG_SECURITY_NETWORK=y
+CONFIG_SECURITY_NETWORK_XFRM=y
+# CONFIG_SECURITY_PATH is not set
+CONFIG_LSM_MMAP_MIN_ADDR=65536
+CONFIG_SECURITY_SELINUX=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM=y
+CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE=1
+CONFIG_SECURITY_SELINUX_DISABLE=y
+CONFIG_SECURITY_SELINUX_DEVELOP=y
+CONFIG_SECURITY_SELINUX_AVC_STATS=y
+CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
+# CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
+# CONFIG_SECURITY_SMACK is not set
+# CONFIG_SECURITY_TOMOYO is not set
+# CONFIG_DEFAULT_SECURITY_SELINUX is not set
+# CONFIG_DEFAULT_SECURITY_SMACK is not set
+# CONFIG_DEFAULT_SECURITY_TOMOYO is not set
+CONFIG_DEFAULT_SECURITY_DAC=y
+CONFIG_DEFAULT_SECURITY=""
 CONFIG_CRYPTO=y
 
 #
 # Crypto core or helper
 #
+# CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
 CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
+CONFIG_CRYPTO_PCOMP=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_GF128MUL=m
 CONFIG_CRYPTO_NULL=y
+# CONFIG_CRYPTO_PCRYPT is not set
+CONFIG_CRYPTO_WORKQUEUE=y
 # CONFIG_CRYPTO_CRYPTD is not set
 CONFIG_CRYPTO_AUTHENC=m
 # CONFIG_CRYPTO_TEST is not set
@@ -1276,7 +1559,7 @@ CONFIG_CRYPTO_SEQIV=m
 #
 CONFIG_CRYPTO_CBC=m
 CONFIG_CRYPTO_CTR=m
-# CONFIG_CRYPTO_CTS is not set
+CONFIG_CRYPTO_CTS=m
 CONFIG_CRYPTO_ECB=m
 CONFIG_CRYPTO_LRW=m
 CONFIG_CRYPTO_PCBC=m
@@ -1287,14 +1570,20 @@ CONFIG_CRYPTO_XTS=m
 #
 CONFIG_CRYPTO_HMAC=y
 CONFIG_CRYPTO_XCBC=m
+CONFIG_CRYPTO_VMAC=m
 
 #
 # Digest
 #
-# CONFIG_CRYPTO_CRC32C is not set
+CONFIG_CRYPTO_CRC32C=m
+CONFIG_CRYPTO_GHASH=m
 CONFIG_CRYPTO_MD4=m
 CONFIG_CRYPTO_MD5=y
 CONFIG_CRYPTO_MICHAEL_MIC=m
+CONFIG_CRYPTO_RMD128=m
+CONFIG_CRYPTO_RMD160=m
+CONFIG_CRYPTO_RMD256=m
+CONFIG_CRYPTO_RMD320=m
 CONFIG_CRYPTO_SHA1=m
 CONFIG_CRYPTO_SHA256=m
 CONFIG_CRYPTO_SHA512=m
@@ -1325,25 +1614,36 @@ CONFIG_CRYPTO_TWOFISH_COMMON=m
 # Compression
 #
 CONFIG_CRYPTO_DEFLATE=m
-# CONFIG_CRYPTO_LZO is not set
+CONFIG_CRYPTO_ZLIB=m
+CONFIG_CRYPTO_LZO=m
+
+#
+# Random Number Generation
+#
+CONFIG_CRYPTO_ANSI_CPRNG=m
 CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_DEV_HIFN_795X is not set
+# CONFIG_BINARY_PRINTF is not set
 
 #
 # Library routines
 #
 CONFIG_BITREVERSE=y
-# CONFIG_GENERIC_FIND_FIRST_BIT is not set
+CONFIG_GENERIC_FIND_LAST_BIT=y
 CONFIG_CRC_CCITT=m
-# CONFIG_CRC16 is not set
+CONFIG_CRC16=y
+CONFIG_CRC_T10DIF=m
 CONFIG_CRC_ITU_T=m
 CONFIG_CRC32=y
-# CONFIG_CRC7 is not set
+CONFIG_CRC7=m
 CONFIG_LIBCRC32C=m
 CONFIG_AUDIT_GENERIC=y
-CONFIG_ZLIB_INFLATE=m
+CONFIG_ZLIB_INFLATE=y
 CONFIG_ZLIB_DEFLATE=m
-CONFIG_PLIST=y
+CONFIG_LZO_COMPRESS=m
+CONFIG_LZO_DECOMPRESS=m
+CONFIG_DECOMPRESS_GZIP=y
 CONFIG_HAS_IOMEM=y
 CONFIG_HAS_IOPORT=y
 CONFIG_HAS_DMA=y
+CONFIG_NLATTR=y
diff --git a/arch/mips/include/asm/abi.h b/arch/mips/include/asm/abi.h
index 1dd74fbdc09b..9252d9b50e59 100644
--- a/arch/mips/include/asm/abi.h
+++ b/arch/mips/include/asm/abi.h
@@ -13,12 +13,14 @@
 #include <asm/siginfo.h>
 
 struct mips_abi {
-        int (* const setup_frame)(struct k_sigaction * ka,
+        int (* const setup_frame)(void *sig_return, struct k_sigaction *ka,
                                   struct pt_regs *regs, int signr,
                                   sigset_t *set);
-        int (* const setup_rt_frame)(struct k_sigaction * ka,
+        const unsigned long     signal_return_offset;
+        int (* const setup_rt_frame)(void *sig_return, struct k_sigaction *ka,
                                struct pt_regs *regs, int signr,
                                sigset_t *set, siginfo_t *info);
+        const unsigned long     rt_signal_return_offset;
         const unsigned long     restart;
 };
 
diff --git a/arch/mips/include/asm/elf.h b/arch/mips/include/asm/elf.h
index e53d7bed5cda..ea77a42c5f8c 100644
--- a/arch/mips/include/asm/elf.h
+++ b/arch/mips/include/asm/elf.h
@@ -310,6 +310,7 @@ do {									\
 
 #endif /* CONFIG_64BIT */
 
+struct pt_regs;
 struct task_struct;
 
 extern void elf_dump_regs(elf_greg_t *, struct pt_regs *regs);
@@ -367,4 +368,8 @@ extern const char *__elf_platform;
 #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
 #endif
 
+#define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
+struct linux_binprm;
+extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+                                       int uses_interp);
 #endif /* _ASM_ELF_H */
diff --git a/arch/mips/include/asm/fpu_emulator.h b/arch/mips/include/asm/fpu_emulator.h
index aecada6f6117..3b4092705567 100644
--- a/arch/mips/include/asm/fpu_emulator.h
+++ b/arch/mips/include/asm/fpu_emulator.h
@@ -41,7 +41,11 @@ struct mips_fpu_emulator_stats {
 DECLARE_PER_CPU(struct mips_fpu_emulator_stats, fpuemustats);
 
 #define MIPS_FPU_EMU_INC_STATS(M)                                       \
-        cpu_local_wrap(__local_inc(&__get_cpu_var(fpuemustats).M))
+do {                                                                    \
+        preempt_disable();                                              \
+        __local_inc(&__get_cpu_var(fpuemustats).M);                     \
+        preempt_enable();                                               \
+} while (0)
 
 #else
 #define MIPS_FPU_EMU_INC_STATS(M) do { } while (0)
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_cpu.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_cpu.h
index b12c4aca2cc9..96a2391ad85b 100644
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_cpu.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_cpu.h
@@ -85,6 +85,7 @@ enum bcm63xx_regs_set {
         RSET_TIMER,
         RSET_WDT,
         RSET_UART0,
+        RSET_UART1,
         RSET_GPIO,
         RSET_SPI,
         RSET_UDC0,
@@ -123,6 +124,7 @@ enum bcm63xx_regs_set {
 #define BCM_6338_TIMER_BASE             (0xfffe0200)
 #define BCM_6338_WDT_BASE               (0xfffe021c)
 #define BCM_6338_UART0_BASE             (0xfffe0300)
+#define BCM_6338_UART1_BASE             (0xdeadbeef)
 #define BCM_6338_GPIO_BASE              (0xfffe0400)
 #define BCM_6338_SPI_BASE               (0xfffe0c00)
 #define BCM_6338_UDC0_BASE              (0xdeadbeef)
@@ -153,6 +155,7 @@ enum bcm63xx_regs_set {
 #define BCM_6345_TIMER_BASE             (0xfffe0200)
 #define BCM_6345_WDT_BASE               (0xfffe021c)
 #define BCM_6345_UART0_BASE             (0xfffe0300)
+#define BCM_6345_UART1_BASE             (0xdeadbeef)
 #define BCM_6345_GPIO_BASE              (0xfffe0400)
 #define BCM_6345_SPI_BASE               (0xdeadbeef)
 #define BCM_6345_UDC0_BASE              (0xdeadbeef)
@@ -182,6 +185,7 @@ enum bcm63xx_regs_set {
 #define BCM_6348_TIMER_BASE             (0xfffe0200)
 #define BCM_6348_WDT_BASE               (0xfffe021c)
 #define BCM_6348_UART0_BASE             (0xfffe0300)
+#define BCM_6348_UART1_BASE             (0xdeadbeef)
 #define BCM_6348_GPIO_BASE              (0xfffe0400)
 #define BCM_6348_SPI_BASE               (0xfffe0c00)
 #define BCM_6348_UDC0_BASE              (0xfffe1000)
@@ -208,6 +212,7 @@ enum bcm63xx_regs_set {
 #define BCM_6358_TIMER_BASE             (0xfffe0040)
 #define BCM_6358_WDT_BASE               (0xfffe005c)
 #define BCM_6358_UART0_BASE             (0xfffe0100)
+#define BCM_6358_UART1_BASE             (0xfffe0120)
 #define BCM_6358_GPIO_BASE              (0xfffe0080)
 #define BCM_6358_SPI_BASE               (0xdeadbeef)
 #define BCM_6358_UDC0_BASE              (0xfffe0800)
@@ -246,6 +251,8 @@ static inline unsigned long bcm63xx_regset_address(enum bcm63xx_regs_set set)
                 return BCM_6338_WDT_BASE;
         case RSET_UART0:
                 return BCM_6338_UART0_BASE;
+        case RSET_UART1:
+                return BCM_6338_UART1_BASE;
         case RSET_GPIO:
                 return BCM_6338_GPIO_BASE;
         case RSET_SPI:
@@ -292,6 +299,8 @@ static inline unsigned long bcm63xx_regset_address(enum bcm63xx_regs_set set)
                 return BCM_6345_WDT_BASE;
         case RSET_UART0:
                 return BCM_6345_UART0_BASE;
+        case RSET_UART1:
+                return BCM_6345_UART1_BASE;
         case RSET_GPIO:
                 return BCM_6345_GPIO_BASE;
         case RSET_SPI:
@@ -338,6 +347,8 @@ static inline unsigned long bcm63xx_regset_address(enum bcm63xx_regs_set set)
                 return BCM_6348_WDT_BASE;
         case RSET_UART0:
                 return BCM_6348_UART0_BASE;
+        case RSET_UART1:
+                return BCM_6348_UART1_BASE;
         case RSET_GPIO:
                 return BCM_6348_GPIO_BASE;
         case RSET_SPI:
@@ -384,6 +395,8 @@ static inline unsigned long bcm63xx_regset_address(enum bcm63xx_regs_set set)
                 return BCM_6358_WDT_BASE;
         case RSET_UART0:
                 return BCM_6358_UART0_BASE;
+        case RSET_UART1:
+                return BCM_6358_UART1_BASE;
         case RSET_GPIO:
                 return BCM_6358_GPIO_BASE;
         case RSET_SPI:
@@ -429,6 +442,7 @@ static inline unsigned long bcm63xx_regset_address(enum bcm63xx_regs_set set)
 enum bcm63xx_irq {
         IRQ_TIMER = 0,
         IRQ_UART0,
+        IRQ_UART1,
         IRQ_DSL,
         IRQ_ENET0,
         IRQ_ENET1,
@@ -510,6 +524,7 @@ enum bcm63xx_irq {
  */
 #define BCM_6358_TIMER_IRQ              (IRQ_INTERNAL_BASE + 0)
 #define BCM_6358_UART0_IRQ              (IRQ_INTERNAL_BASE + 2)
+#define BCM_6358_UART1_IRQ              (IRQ_INTERNAL_BASE + 3)
 #define BCM_6358_OHCI0_IRQ              (IRQ_INTERNAL_BASE + 5)
 #define BCM_6358_ENET1_IRQ              (IRQ_INTERNAL_BASE + 6)
 #define BCM_6358_ENET0_IRQ              (IRQ_INTERNAL_BASE + 8)
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_uart.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_uart.h
new file mode 100644
index 000000000000..23c705baf171
--- /dev/null
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_dev_uart.h
@@ -0,0 +1,6 @@
+#ifndef BCM63XX_DEV_UART_H_
+#define BCM63XX_DEV_UART_H_
+
+int bcm63xx_uart_register(unsigned int id);
+
+#endif /* BCM63XX_DEV_UART_H_ */
diff --git a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h
index 76a0b7216af5..43d4da0b1e9f 100644
--- a/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h
+++ b/arch/mips/include/asm/mach-bcm63xx/bcm63xx_gpio.h
@@ -10,6 +10,10 @@ static inline unsigned long bcm63xx_gpio_count(void)
         switch (bcm63xx_get_cpu_id()) {
         case BCM6358_CPU_ID:
                 return 40;
+        case BCM6338_CPU_ID:
+                return 8;
+        case BCM6345_CPU_ID:
+                return 16;
         case BCM6348_CPU_ID:
         default:
                 return 37;
diff --git a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
index 6479090a4106..474daaa53497 100644
--- a/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
+++ b/arch/mips/include/asm/mach-bcm63xx/board_bcm963xx.h
@@ -45,6 +45,8 @@ struct board_info {
         unsigned int    has_ohci0:1;
         unsigned int    has_ehci0:1;
         unsigned int    has_dsp:1;
+        unsigned int    has_uart0:1;
+        unsigned int    has_uart1:1;
 
         /* ethernet config */
         struct bcm63xx_enet_platform_data enet0;
diff --git a/arch/mips/include/asm/mach-bcm63xx/cpu-feature-overrides.h b/arch/mips/include/asm/mach-bcm63xx/cpu-feature-overrides.h
index 71742bac940d..f453c01d0672 100644
--- a/arch/mips/include/asm/mach-bcm63xx/cpu-feature-overrides.h
+++ b/arch/mips/include/asm/mach-bcm63xx/cpu-feature-overrides.h
@@ -24,7 +24,7 @@
 #define cpu_has_smartmips               0
 #define cpu_has_vtag_icache             0
 
-#if !defined(BCMCPU_RUNTIME_DETECT) && (defined(CONFIG_BCMCPU_IS_6348) || defined(CONFIG_CPU_IS_6338) || defined(CONFIG_CPU_IS_BCM6345))
+#if !defined(BCMCPU_RUNTIME_DETECT) && (defined(CONFIG_BCM63XX_CPU_6348) || defined(CONFIG_BCM63XX_CPU_6345) || defined(CONFIG_BCM63XX_CPU_6338))
 #define cpu_has_dc_aliases              0
 #endif
 
diff --git a/arch/mips/include/asm/mach-sibyte/war.h b/arch/mips/include/asm/mach-sibyte/war.h
index 7950ef4f032c..743385d7b5f2 100644
--- a/arch/mips/include/asm/mach-sibyte/war.h
+++ b/arch/mips/include/asm/mach-sibyte/war.h
@@ -16,7 +16,11 @@
 #if defined(CONFIG_SB1_PASS_1_WORKAROUNDS) || \
     defined(CONFIG_SB1_PASS_2_WORKAROUNDS)
 
-#define BCM1250_M3_WAR  1
+#ifndef __ASSEMBLY__
+extern int sb1250_m3_workaround_needed(void);
+#endif
+
+#define BCM1250_M3_WAR  sb1250_m3_workaround_needed()
 #define SIBYTE_1956_WAR 1
 
 #else
diff --git a/arch/mips/include/asm/mmu.h b/arch/mips/include/asm/mmu.h
index 4063edd79623..c436138945a8 100644
--- a/arch/mips/include/asm/mmu.h
+++ b/arch/mips/include/asm/mmu.h
@@ -1,6 +1,9 @@
 #ifndef __ASM_MMU_H
 #define __ASM_MMU_H
 
-typedef unsigned long mm_context_t[NR_CPUS];
+typedef struct {
+        unsigned long asid[NR_CPUS];
+        void *vdso;
+} mm_context_t;
 
 #endif /* __ASM_MMU_H */
diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index 145bb81ccaa5..d9592733a7ba 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -104,7 +104,7 @@ extern unsigned long smtc_asid_mask;
 
 #endif
 
-#define cpu_context(cpu, mm)    ((mm)->context[cpu])
+#define cpu_context(cpu, mm)    ((mm)->context.asid[cpu])
 #define cpu_asid(cpu, mm)       (cpu_context((cpu), (mm)) & ASID_MASK)
 #define asid_cache(cpu)         (cpu_data[cpu].asid_cache)
 
diff --git a/arch/mips/include/asm/page.h b/arch/mips/include/asm/page.h
index ac32572430f4..a16beafcea91 100644
--- a/arch/mips/include/asm/page.h
+++ b/arch/mips/include/asm/page.h
@@ -188,8 +188,10 @@ typedef struct { unsigned long pgprot; } pgprot_t;
 #define VM_DATA_DEFAULT_FLAGS   (VM_READ | VM_WRITE | VM_EXEC | \
                                  VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
-#define UNCAC_ADDR(addr)        ((addr) - PAGE_OFFSET + UNCAC_BASE)
-#define CAC_ADDR(addr)          ((addr) - UNCAC_BASE + PAGE_OFFSET)
+#define UNCAC_ADDR(addr)        ((addr) - PAGE_OFFSET + UNCAC_BASE +    \
+                                                                PHYS_OFFSET)
+#define CAC_ADDR(addr)          ((addr) - UNCAC_BASE + PAGE_OFFSET -    \
+                                                                PHYS_OFFSET)
 
 #include <asm-generic/memory_model.h>
 #include <asm-generic/getorder.h>
diff --git a/arch/mips/include/asm/processor.h b/arch/mips/include/asm/processor.h
index 087a8884ef06..ab387910009a 100644
--- a/arch/mips/include/asm/processor.h
+++ b/arch/mips/include/asm/processor.h
@@ -33,13 +33,19 @@ extern void (*cpu_wait)(void);
 
 extern unsigned int vced_count, vcei_count;
 
+/*
+ * A special page (the vdso) is mapped into all processes at the very
+ * top of the virtual memory space.
+ */
+#define SPECIAL_PAGES_SIZE PAGE_SIZE
+
 #ifdef CONFIG_32BIT
 /*
  * User space process size: 2GB. This is hardcoded into a few places,
  * so don't change it unless you know what you are doing.
  */
 #define TASK_SIZE       0x7fff8000UL
-#define STACK_TOP       TASK_SIZE
+#define STACK_TOP       ((TASK_SIZE & PAGE_MASK) - SPECIAL_PAGES_SIZE)
 
 /*
  * This decides where the kernel will search for a free chunk of vm
@@ -59,7 +65,8 @@ extern unsigned int vced_count, vcei_count;
 #define TASK_SIZE32     0x7fff8000UL
 #define TASK_SIZE       0x10000000000UL
 #define STACK_TOP       \
-      (test_thread_flag(TIF_32BIT_ADDR) ? TASK_SIZE32 : TASK_SIZE)
+        (((test_thread_flag(TIF_32BIT_ADDR) ?                           \
+           TASK_SIZE32 : TASK_SIZE) & PAGE_MASK) - SPECIAL_PAGES_SIZE)
 
 /*
  * This decides where the kernel will search for a free chunk of vm
diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h
index 3b6da3330e32..c8419129e770 100644
--- a/arch/mips/include/asm/stackframe.h
+++ b/arch/mips/include/asm/stackframe.h
@@ -121,6 +121,25 @@
                 .endm
 #else
                 .macro  get_saved_sp    /* Uniprocessor variation */
+#ifdef CONFIG_CPU_LOONGSON2F
+                /*
+                 * Clear BTB (branch target buffer), forbid RAS (return address
+                 * stack) to workaround the Out-of-order Issue in Loongson2F
+                 * via its diagnostic register.
+                 */
+                move    k0, ra
+                jal     1f
+                 nop
+1:              jal     1f
+                 nop
+1:              jal     1f
+                 nop
+1:              jal     1f
+                 nop
+1:              move    ra, k0
+                li      k0, 3
+                mtc0    k0, $22
+#endif /* CONFIG_CPU_LOONGSON2F */
 #if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32)
                 lui     k1, %hi(kernelsp)
 #else
diff --git a/arch/mips/include/asm/uasm.h b/arch/mips/include/asm/uasm.h
index b99bd07e199b..11a8b5252549 100644
--- a/arch/mips/include/asm/uasm.h
+++ b/arch/mips/include/asm/uasm.h
@@ -84,6 +84,7 @@ Ip_u2s3u1(_lw);
 Ip_u1u2u3(_mfc0);
 Ip_u1u2u3(_mtc0);
 Ip_u2u1u3(_ori);
+Ip_u3u1u2(_or);
 Ip_u2s3u1(_pref);
 Ip_0(_rfe);
 Ip_u2s3u1(_sc);
@@ -102,6 +103,7 @@ Ip_0(_tlbwr);
 Ip_u3u1u2(_xor);
 Ip_u2u1u3(_xori);
 Ip_u2u1msbu3(_dins);
+Ip_u1(_syscall);
 
 /* Handle labels. */
 struct uasm_label {
diff --git a/arch/mips/include/asm/vdso.h b/arch/mips/include/asm/vdso.h
new file mode 100644
index 000000000000..cca56aa40ff4
--- /dev/null
+++ b/arch/mips/include/asm/vdso.h
@@ -0,0 +1,29 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2009 Cavium Networks
+ */
+
+#ifndef __ASM_VDSO_H
+#define __ASM_VDSO_H
+
+#include <linux/types.h>
+
+
+#ifdef CONFIG_32BIT
+struct mips_vdso {
+        u32 signal_trampoline[2];
+        u32 rt_signal_trampoline[2];
+};
+#else  /* !CONFIG_32BIT */
+struct mips_vdso {
+        u32 o32_signal_trampoline[2];
+        u32 o32_rt_signal_trampoline[2];
+        u32 rt_signal_trampoline[2];
+        u32 n32_rt_signal_trampoline[2];
+};
+#endif /* CONFIG_32BIT */
+
+#endif /* __ASM_VDSO_H */
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index ef20957ca14b..7a6ac501cbb5 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -6,7 +6,7 @@ extra-y		:= head.o init_task.o vmlinux.lds
 
 obj-y           += cpu-probe.o branch.o entry.o genex.o irq.o process.o \
                    ptrace.o reset.o setup.o signal.o syscall.o \
-                   time.o topology.o traps.o unaligned.o watch.o
+                   time.o topology.o traps.o unaligned.o watch.o vdso.o
 
 ifdef CONFIG_FUNCTION_TRACER
 CFLAGS_REMOVE_ftrace.o = -pg
diff --git a/arch/mips/kernel/cpufreq/loongson2_clock.c b/arch/mips/kernel/cpufreq/loongson2_clock.c
index d7ca256e33ef..cefc6e259baf 100644
--- a/arch/mips/kernel/cpufreq/loongson2_clock.c
+++ b/arch/mips/kernel/cpufreq/loongson2_clock.c
@@ -164,3 +164,7 @@ void loongson2_cpu_wait(void)
         spin_unlock_irqrestore(&loongson2_wait_lock, flags);
 }
 EXPORT_SYMBOL_GPL(loongson2_cpu_wait);
+
+MODULE_AUTHOR("Yanhua <yanh@lemote.com>");
+MODULE_DESCRIPTION("cpufreq driver for Loongson 2F");
+MODULE_LICENSE("GPL");
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index 463b71b90a00..99960940d4a4 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -63,8 +63,13 @@ void __noreturn cpu_idle(void)
 
                         smtc_idle_loop_hook();
 #endif
-                        if (cpu_wait)
+
+                        if (cpu_wait) {
+                                /* Don't trace irqs off for idle */
+                                stop_critical_timings();
                                 (*cpu_wait)();
+                                start_critical_timings();
+                        }
                 }
 #ifdef CONFIG_HOTPLUG_CPU
                 if (!cpu_online(cpu) && !cpu_isset(cpu, cpu_callin_map) &&
diff --git a/arch/mips/kernel/signal-common.h b/arch/mips/kernel/signal-common.h
index 6c8e8c4246f7..10263b405981 100644
--- a/arch/mips/kernel/signal-common.h
+++ b/arch/mips/kernel/signal-common.h
@@ -26,11 +26,6 @@
  */
 extern void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
                                  size_t frame_size);
-/*
- * install trampoline code to get back from the sig handler
- */
-extern int install_sigtramp(unsigned int __user *tramp, unsigned int syscall);
-
 /* Check and clear pending FPU exceptions in saved CSR */
 extern int fpcsr_pending(unsigned int __user *fpcsr);
 
diff --git a/arch/mips/kernel/signal.c b/arch/mips/kernel/signal.c
index d0c68b5d717b..2099d5a4c4b7 100644
--- a/arch/mips/kernel/signal.c
+++ b/arch/mips/kernel/signal.c
@@ -32,6 +32,7 @@
 #include <asm/ucontext.h>
 #include <asm/cpu-features.h>
 #include <asm/war.h>
+#include <asm/vdso.h>
 
 #include "signal-common.h"
 
@@ -44,47 +45,20 @@ extern asmlinkage int _restore_fp_context(struct sigcontext __user *sc);
 extern asmlinkage int fpu_emulator_save_context(struct sigcontext __user *sc);
 extern asmlinkage int fpu_emulator_restore_context(struct sigcontext __user *sc);
 
-/*
- * Horribly complicated - with the bloody RM9000 workarounds enabled
- * the signal trampolines is moving to the end of the structure so we can
- * increase the alignment without breaking software compatibility.
- */
-#if ICACHE_REFILLS_WORKAROUND_WAR == 0
-
 struct sigframe {
         u32 sf_ass[4];          /* argument save space for o32 */
-        u32 sf_code[2];         /* signal trampoline */
+        u32 sf_pad[2];          /* Was: signal trampoline */
         struct sigcontext sf_sc;
         sigset_t sf_mask;
 };
 
 struct rt_sigframe {
         u32 rs_ass[4];          /* argument save space for o32 */
-        u32 rs_code[2];         /* signal trampoline */
+        u32 rs_pad[2];          /* Was: signal trampoline */
         struct siginfo rs_info;
         struct ucontext rs_uc;
 };
 
-#else
-
-struct sigframe {
-        u32 sf_ass[4];                  /* argument save space for o32 */
-        u32 sf_pad[2];
-        struct sigcontext sf_sc;        /* hw context */
-        sigset_t sf_mask;
-        u32 sf_code[8] ____cacheline_aligned;   /* signal trampoline */
-};
-
-struct rt_sigframe {
-        u32 rs_ass[4];                  /* argument save space for o32 */
-        u32 rs_pad[2];
-        struct siginfo rs_info;
-        struct ucontext rs_uc;
-        u32 rs_code[8] ____cacheline_aligned;   /* signal trampoline */
-};
-
-#endif
-
 /*
  * Helper routines
  */
@@ -266,32 +240,6 @@ void __user *get_sigframe(struct k_sigaction *ka, struct pt_regs *regs,
         return (void __user *)((sp - frame_size) & (ICACHE_REFILLS_WORKAROUND_WAR ? ~(cpu_icache_line_size()-1) : ALMASK));
 }
 
-int install_sigtramp(unsigned int __user *tramp, unsigned int syscall)
-{
-        int err;
-
-        /*
-         * Set up the return code ...
-         *
-         *         li      v0, __NR__foo_sigreturn
-         *         syscall
-         */
-
-        err = __put_user(0x24020000 + syscall, tramp + 0);
-        err |= __put_user(0x0000000c         , tramp + 1);
-        if (ICACHE_REFILLS_WORKAROUND_WAR) {
-                err |= __put_user(0, tramp + 2);
-                err |= __put_user(0, tramp + 3);
-                err |= __put_user(0, tramp + 4);
-                err |= __put_user(0, tramp + 5);
-                err |= __put_user(0, tramp + 6);
-                err |= __put_user(0, tramp + 7);
-        }
-        flush_cache_sigtramp((unsigned long) tramp);
-
-        return err;
-}
-
 /*
  * Atomically swap in the new signal mask, and wait for a signal.
  */
@@ -484,8 +432,8 @@ badframe:
 }
 
 #ifdef CONFIG_TRAD_SIGNALS
-static int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
-        int signr, sigset_t *set)
+static int setup_frame(void *sig_return, struct k_sigaction *ka,
+                       struct pt_regs *regs, int signr, sigset_t *set)
 {
         struct sigframe __user *frame;
         int err = 0;
@@ -494,8 +442,6 @@ static int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
         if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
                 goto give_sigsegv;
 
-        err |= install_sigtramp(frame->sf_code, __NR_sigreturn);
-
         err |= setup_sigcontext(regs, &frame->sf_sc);
         err |= __copy_to_user(&frame->sf_mask, set, sizeof(*set));
         if (err)
@@ -515,7 +461,7 @@ static int setup_frame(struct k_sigaction * ka, struct pt_regs *regs,
         regs->regs[ 5] = 0;
         regs->regs[ 6] = (unsigned long) &frame->sf_sc;
         regs->regs[29] = (unsigned long) frame;
-        regs->regs[31] = (unsigned long) frame->sf_code;
+        regs->regs[31] = (unsigned long) sig_return;
         regs->cp0_epc = regs->regs[25] = (unsigned long) ka->sa.sa_handler;
 
         DEBUGP("SIG deliver (%s:%d): sp=0x%p pc=0x%lx ra=0x%lx\n",
@@ -529,8 +475,9 @@ give_sigsegv:
 }
 #endif
 
-static int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
-        int signr, sigset_t *set, siginfo_t *info)
+static int setup_rt_frame(void *sig_return, struct k_sigaction *ka,
+                          struct pt_regs *regs, int signr, sigset_t *set,
+                          siginfo_t *info)
 {
         struct rt_sigframe __user *frame;
         int err = 0;
@@ -539,8 +486,6 @@ static int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
         if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
                 goto give_sigsegv;
 
-        err |= install_sigtramp(frame->rs_code, __NR_rt_sigreturn);
-
         /* Create siginfo.  */
         err |= copy_siginfo_to_user(&frame->rs_info, info);
 
@@ -573,7 +518,7 @@ static int setup_rt_frame(struct k_sigaction * ka, struct pt_regs *regs,
         regs->regs[ 5] = (unsigned long) &frame->rs_info;
         regs->regs[ 6] = (unsigned long) &frame->rs_uc;
         regs->regs[29] = (unsigned long) frame;
-        regs->regs[31] = (unsigned long) frame->rs_code;
+        regs->regs[31] = (unsigned long) sig_return;
         regs->cp0_epc = regs->regs[25] = (unsigned long) ka->sa.sa_handler;
 
         DEBUGP("SIG deliver (%s:%d): sp=0x%p pc=0x%lx ra=0x%lx\n",
@@ -590,8 +535,11 @@ give_sigsegv:
 struct mips_abi mips_abi = {
 #ifdef CONFIG_TRAD_SIGNALS
         .setup_frame    = setup_frame,
+        .signal_return_offset = offsetof(struct mips_vdso, signal_trampoline),
 #endif
         .setup_rt_frame = setup_rt_frame,
+        .rt_signal_return_offset =
+                offsetof(struct mips_vdso, rt_signal_trampoline),
         .restart        = __NR_restart_syscall
 };
 
@@ -599,6 +547,8 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         struct k_sigaction *ka, sigset_t *oldset, struct pt_regs *regs)
 {
         int ret;
+        struct mips_abi *abi = current->thread.abi;
+        void *vdso = current->mm->context.vdso;
 
         switch(regs->regs[0]) {
         case ERESTART_RESTARTBLOCK:
@@ -619,9 +569,11 @@ static int handle_signal(unsigned long sig, siginfo_t *info,
         regs->regs[0] = 0;              /* Don't deal with this again.  */
 
         if (sig_uses_siginfo(ka))
-                ret = current->thread.abi->setup_rt_frame(ka, regs, sig, oldset, info);
+                ret = abi->setup_rt_frame(vdso + abi->rt_signal_return_offset,
+                                          ka, regs, sig, oldset, info);
         else
-                ret = current->thread.abi->setup_frame(ka, regs, sig, oldset);
+                ret = abi->setup_frame(vdso + abi->signal_return_offset,
+                                       ka, regs, sig, oldset);
 
         spin_lock_irq(&current->sighand->siglock);
         sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c
index 03abaf048f09..a0ed0e052b2e 100644
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -32,6 +32,7 @@
 #include <asm/system.h>
 #include <asm/fpu.h>
 #include <asm/war.h>
+#include <asm/vdso.h>
 
 #include "signal-common.h"
 
@@ -47,8 +48,6 @@ extern asmlinkage int fpu_emulator_restore_context32(struct sigcontext32 __user
 /*
  * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
  */
-#define __NR_O32_sigreturn              4119
-#define __NR_O32_rt_sigreturn           4193
 #define __NR_O32_restart_syscall        4253
 
 /* 32-bit compatibility types */
@@ -77,47 +76,20 @@ struct ucontext32 {
         compat_sigset_t     uc_sigmask;   /* mask last for extensibility */
 };
 
-/*
- * Horribly complicated - with the bloody RM9000 workarounds enabled
- * the signal trampolines is moving to the end of the structure so we can
- * increase the alignment without breaking software compatibility.
- */
-#if ICACHE_REFILLS_WORKAROUND_WAR == 0
-
 struct sigframe32 {
         u32 sf_ass[4];          /* argument save space for o32 */
-        u32 sf_code[2];         /* signal trampoline */
+        u32 sf_pad[2];          /* Was: signal trampoline */
         struct sigcontext32 sf_sc;
         compat_sigset_t sf_mask;
 };
 
 struct rt_sigframe32 {
         u32 rs_ass[4];                  /* argument save space for o32 */
-        u32 rs_code[2];                 /* signal trampoline */
+        u32 rs_pad[2];                  /* Was: signal trampoline */
         compat_siginfo_t rs_info;
         struct ucontext32 rs_uc;
 };
 
-#else  /* ICACHE_REFILLS_WORKAROUND_WAR */
-
-struct sigframe32 {
-        u32 sf_ass[4];                  /* argument save space for o32 */
-        u32 sf_pad[2];
-        struct sigcontext32 sf_sc;      /* hw context */
-        compat_sigset_t sf_mask;
-        u32 sf_code[8] ____cacheline_aligned;   /* signal trampoline */
-};
-
-struct rt_sigframe32 {
-        u32 rs_ass[4];                  /* argument save space for o32 */
-        u32 rs_pad[2];
-        compat_siginfo_t rs_info;
-        struct ucontext32 rs_uc;
-        u32 rs_code[8] __attribute__((aligned(32)));    /* signal trampoline */
-};
-
-#endif  /* !ICACHE_REFILLS_WORKAROUND_WAR */
-
 /*
  * sigcontext handlers
  */
@@ -598,8 +570,8 @@ badframe:
         force_sig(SIGSEGV, current);
 }
 
-static int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
-        int signr, sigset_t *set)
+static int setup_frame_32(void *sig_return, struct k_sigaction *ka,
+                          struct pt_regs *regs, int signr, sigset_t *set)
 {
         struct sigframe32 __user *frame;
         int err = 0;
@@ -608,8 +580,6 @@ static int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
                 goto give_sigsegv;
 
-        err |= install_sigtramp(frame->sf_code, __NR_O32_sigreturn);
-
         err |= setup_sigcontext32(regs, &frame->sf_sc);
         err |= __copy_conv_sigset_to_user(&frame->sf_mask, set);
 
@@ -630,7 +600,7 @@ static int setup_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         regs->regs[ 5] = 0;
         regs->regs[ 6] = (unsigned long) &frame->sf_sc;
         regs->regs[29] = (unsigned long) frame;
-        regs->regs[31] = (unsigned long) frame->sf_code;
+        regs->regs[31] = (unsigned long) sig_return;
         regs->cp0_epc = regs->regs[25] = (unsigned long) ka->sa.sa_handler;
 
         DEBUGP("SIG deliver (%s:%d): sp=0x%p pc=0x%lx ra=0x%lx\n",
@@ -644,8 +614,9 @@ give_sigsegv:
         return -EFAULT;
 }
 
-static int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
-        int signr, sigset_t *set, siginfo_t *info)
+static int setup_rt_frame_32(void *sig_return, struct k_sigaction *ka,
+                             struct pt_regs *regs, int signr, sigset_t *set,
+                             siginfo_t *info)
 {
         struct rt_sigframe32 __user *frame;
         int err = 0;
@@ -655,8 +626,6 @@ static int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
                 goto give_sigsegv;
 
-        err |= install_sigtramp(frame->rs_code, __NR_O32_rt_sigreturn);
-
         /* Convert (siginfo_t -> compat_siginfo_t) and copy to user. */
         err |= copy_siginfo_to_user32(&frame->rs_info, info);
 
@@ -690,7 +659,7 @@ static int setup_rt_frame_32(struct k_sigaction * ka, struct pt_regs *regs,
         regs->regs[ 5] = (unsigned long) &frame->rs_info;
         regs->regs[ 6] = (unsigned long) &frame->rs_uc;
         regs->regs[29] = (unsigned long) frame;
-        regs->regs[31] = (unsigned long) frame->rs_code;
+        regs->regs[31] = (unsigned long) sig_return;
         regs->cp0_epc = regs->regs[25] = (unsigned long) ka->sa.sa_handler;
 
         DEBUGP("SIG deliver (%s:%d): sp=0x%p pc=0x%lx ra=0x%lx\n",
@@ -709,7 +678,11 @@ give_sigsegv:
  */
 struct mips_abi mips_abi_32 = {
         .setup_frame    = setup_frame_32,
+        .signal_return_offset =
+                offsetof(struct mips_vdso, o32_signal_trampoline),
         .setup_rt_frame = setup_rt_frame_32,
+        .rt_signal_return_offset =
+                offsetof(struct mips_vdso, o32_rt_signal_trampoline),
         .restart        = __NR_O32_restart_syscall
 };
 
diff --git a/arch/mips/kernel/signal_n32.c b/arch/mips/kernel/signal_n32.c
index bb277e82d421..2c5df818c65a 100644
--- a/arch/mips/kernel/signal_n32.c
+++ b/arch/mips/kernel/signal_n32.c
@@ -39,13 +39,13 @@
 #include <asm/fpu.h>
 #include <asm/cpu-features.h>
 #include <asm/war.h>
+#include <asm/vdso.h>
 
 #include "signal-common.h"
 
 /*
  * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
  */
-#define __NR_N32_rt_sigreturn           6211
 #define __NR_N32_restart_syscall        6214
 
 extern int setup_sigcontext(struct pt_regs *, struct sigcontext __user *);
@@ -67,27 +67,13 @@ struct ucontextn32 {
         compat_sigset_t     uc_sigmask;   /* mask last for extensibility */
 };
 
-#if ICACHE_REFILLS_WORKAROUND_WAR == 0
-
-struct rt_sigframe_n32 {
-        u32 rs_ass[4];                  /* argument save space for o32 */
-        u32 rs_code[2];                 /* signal trampoline */
-        struct compat_siginfo rs_info;
-        struct ucontextn32 rs_uc;
-};
-
-#else  /* ICACHE_REFILLS_WORKAROUND_WAR */
-
 struct rt_sigframe_n32 {
         u32 rs_ass[4];                  /* argument save space for o32 */
-        u32 rs_pad[2];
+        u32 rs_pad[2];                  /* Was: signal trampoline */
         struct compat_siginfo rs_info;
         struct ucontextn32 rs_uc;
-        u32 rs_code[8] ____cacheline_aligned;           /* signal trampoline */
 };
 
-#endif  /* !ICACHE_REFILLS_WORKAROUND_WAR */
-
 extern void sigset_from_compat(sigset_t *set, compat_sigset_t *compat);
 
 asmlinkage int sysn32_rt_sigsuspend(nabi_no_regargs struct pt_regs regs)
@@ -173,7 +159,7 @@ badframe:
         force_sig(SIGSEGV, current);
 }
 
-static int setup_rt_frame_n32(struct k_sigaction * ka,
+static int setup_rt_frame_n32(void *sig_return, struct k_sigaction *ka,
         struct pt_regs *regs, int signr, sigset_t *set, siginfo_t *info)
 {
         struct rt_sigframe_n32 __user *frame;
@@ -184,8 +170,6 @@ static int setup_rt_frame_n32(struct k_sigaction * ka,
         if (!access_ok(VERIFY_WRITE, frame, sizeof (*frame)))
                 goto give_sigsegv;
 
-        install_sigtramp(frame->rs_code, __NR_N32_rt_sigreturn);
-
         /* Create siginfo.  */
         err |= copy_siginfo_to_user32(&frame->rs_info, info);
 
@@ -219,7 +203,7 @@ static int setup_rt_frame_n32(struct k_sigaction * ka,
         regs->regs[ 5] = (unsigned long) &frame->rs_info;
         regs->regs[ 6] = (unsigned long) &frame->rs_uc;
         regs->regs[29] = (unsigned long) frame;
-        regs->regs[31] = (unsigned long) frame->rs_code;
+        regs->regs[31] = (unsigned long) sig_return;
         regs->cp0_epc = regs->regs[25] = (unsigned long) ka->sa.sa_handler;
 
         DEBUGP("SIG deliver (%s:%d): sp=0x%p pc=0x%lx ra=0x%lx\n",
@@ -235,5 +219,7 @@ give_sigsegv:
 
 struct mips_abi mips_abi_n32 = {
         .setup_rt_frame = setup_rt_frame_n32,
+        .rt_signal_return_offset =
+                offsetof(struct mips_vdso, n32_rt_signal_trampoline),
         .restart        = __NR_N32_restart_syscall
 };
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index 25e825aea327..a95dea5459c4 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -182,7 +182,7 @@ static int vpemask[2][8] = {
         {0, 0, 0, 0, 0, 0, 0, 1}
 };
 int tcnoprog[NR_CPUS];
-static atomic_t idle_hook_initialized = {0};
+static atomic_t idle_hook_initialized = ATOMIC_INIT(0);
 static int clock_hang_reported[NR_CPUS];
 
 #endif /* CONFIG_SMTC_IDLE_HOOK_DEBUG */
diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c
index 9587abc67f35..dd81b0f87518 100644
--- a/arch/mips/kernel/syscall.c
+++ b/arch/mips/kernel/syscall.c
@@ -79,7 +79,11 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
         int do_color_align;
         unsigned long task_size;
 
-        task_size = STACK_TOP;
+#ifdef CONFIG_32BIT
+        task_size = TASK_SIZE;
+#else /* Must be CONFIG_64BIT*/
+        task_size = test_thread_flag(TIF_32BIT_ADDR) ? TASK_SIZE32 : TASK_SIZE;
+#endif
 
         if (len > task_size)
                 return -ENOMEM;
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 4e00f9bc23ee..1a4dd657ccb9 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -1599,7 +1599,7 @@ void __init trap_init(void)
                 ebase = (unsigned long)
                         __alloc_bootmem(size, 1 << fls(size), 0);
         } else {
-                ebase = CAC_BASE;
+                ebase = CKSEG0;
                 if (cpu_has_mips_r2)
                         ebase += (read_c0_ebase() & 0x3ffff000);
         }
diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c
new file mode 100644
index 000000000000..b773c1112b14
--- /dev/null
+++ b/arch/mips/kernel/vdso.c
@@ -0,0 +1,112 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2009, 2010 Cavium Networks, Inc.
+ */
+
+
+#include <linux/kernel.h>
+#include <linux/err.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/init.h>
+#include <linux/binfmts.h>
+#include <linux/elf.h>
+#include <linux/vmalloc.h>
+#include <linux/unistd.h>
+
+#include <asm/vdso.h>
+#include <asm/uasm.h>
+
+/*
+ * Including <asm/unistd.h> would give use the 64-bit syscall numbers ...
+ */
+#define __NR_O32_sigreturn              4119
+#define __NR_O32_rt_sigreturn           4193
+#define __NR_N32_rt_sigreturn           6211
+
+static struct page *vdso_page;
+
+static void __init install_trampoline(u32 *tramp, unsigned int sigreturn)
+{
+        uasm_i_addiu(&tramp, 2, 0, sigreturn);  /* li v0, sigreturn */
+        uasm_i_syscall(&tramp, 0);
+}
+
+static int __init init_vdso(void)
+{
+        struct mips_vdso *vdso;
+
+        vdso_page = alloc_page(GFP_KERNEL);
+        if (!vdso_page)
+                panic("Cannot allocate vdso");
+
+        vdso = vmap(&vdso_page, 1, 0, PAGE_KERNEL);
+        if (!vdso)
+                panic("Cannot map vdso");
+        clear_page(vdso);
+
+        install_trampoline(vdso->rt_signal_trampoline, __NR_rt_sigreturn);
+#ifdef CONFIG_32BIT
+        install_trampoline(vdso->signal_trampoline, __NR_sigreturn);
+#else
+        install_trampoline(vdso->n32_rt_signal_trampoline,
+                           __NR_N32_rt_sigreturn);
+        install_trampoline(vdso->o32_signal_trampoline, __NR_O32_sigreturn);
+        install_trampoline(vdso->o32_rt_signal_trampoline,
+                           __NR_O32_rt_sigreturn);
+#endif
+
+        vunmap(vdso);
+
+        pr_notice("init_vdso successfull\n");
+
+        return 0;
+}
+device_initcall(init_vdso);
+
+static unsigned long vdso_addr(unsigned long start)
+{
+        return STACK_TOP;
+}
+
+int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp)
+{
+        int ret;
+        unsigned long addr;
+        struct mm_struct *mm = current->mm;
+
+        down_write(&mm->mmap_sem);
+
+        addr = vdso_addr(mm->start_stack);
+
+        addr = get_unmapped_area(NULL, addr, PAGE_SIZE, 0, 0);
+        if (IS_ERR_VALUE(addr)) {
+                ret = addr;
+                goto up_fail;
+        }
+
+        ret = install_special_mapping(mm, addr, PAGE_SIZE,
+                                      VM_READ|VM_EXEC|
+                                      VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC|
+                                      VM_ALWAYSDUMP,
+                                      &vdso_page);
+
+        if (ret)
+                goto up_fail;
+
+        mm->context.vdso = (void *)addr;
+
+up_fail:
+        up_write(&mm->mmap_sem);
+        return ret;
+}
+
+const char *arch_vma_name(struct vm_area_struct *vma)
+{
+        if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
+                return "[vdso]";
+        return NULL;
+}
diff --git a/arch/mips/lib/delay.c b/arch/mips/lib/delay.c
index 6b3b1de9dcae..5995969e8c42 100644
--- a/arch/mips/lib/delay.c
+++ b/arch/mips/lib/delay.c
@@ -41,7 +41,7 @@ EXPORT_SYMBOL(__delay);
 
 void __udelay(unsigned long us)
 {
-        unsigned int lpj = current_cpu_data.udelay_val;
+        unsigned int lpj = raw_current_cpu_data.udelay_val;
 
         __delay((us * 0x000010c7ull * HZ * lpj) >> 32);
 }
@@ -49,7 +49,7 @@ EXPORT_SYMBOL(__udelay);
 
 void __ndelay(unsigned long ns)
 {
-        unsigned int lpj = current_cpu_data.udelay_val;
+        unsigned int lpj = raw_current_cpu_data.udelay_val;
 
         __delay((ns * 0x00000005ull * HZ * lpj) >> 32);
 }
diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h
index 3f19d1c5d942..05909d58e2fe 100644
--- a/arch/mips/lib/libgcc.h
+++ b/arch/mips/lib/libgcc.h
@@ -17,8 +17,7 @@ struct DWstruct {
 #error I feel sick.
 #endif
 
-typedef union
-{
+typedef union {
         struct DWstruct s;
         long long ll;
 } DWunion;
diff --git a/arch/mips/mm/cache.c b/arch/mips/mm/cache.c
index be8627bc5b02..12af739048fa 100644
--- a/arch/mips/mm/cache.c
+++ b/arch/mips/mm/cache.c
@@ -133,7 +133,7 @@ void __update_cache(struct vm_area_struct *vma, unsigned long address,
 }
 
 unsigned long _page_cachable_default;
-EXPORT_SYMBOL_GPL(_page_cachable_default);
+EXPORT_SYMBOL(_page_cachable_default);
 
 static inline void setup_protection_map(void)
 {
diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
index 0de0e4127d66..d1f68aadbc4c 100644
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -788,10 +788,15 @@ static void __cpuinit build_r4000_tlb_refill_handler(void)
          * create the plain linear handler
          */
         if (bcm1250_m3_war()) {
-                UASM_i_MFC0(&p, K0, C0_BADVADDR);
-                UASM_i_MFC0(&p, K1, C0_ENTRYHI);
+                unsigned int segbits = 44;
+
+                uasm_i_dmfc0(&p, K0, C0_BADVADDR);
+                uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
                 uasm_i_xor(&p, K0, K0, K1);
-                UASM_i_SRL(&p, K0, K0, PAGE_SHIFT + 1);
+                uasm_i_dsrl32(&p, K1, K0, 62 - 32);
+                uasm_i_dsrl(&p, K0, K0, 12 + 1);
+                uasm_i_dsll32(&p, K0, K0, 64 + 12 + 1 - segbits - 32);
+                uasm_i_or(&p, K0, K0, K1);
                 uasm_il_bnez(&p, &r, K0, label_leave);
                 /* No need for uasm_i_nop */
         }
@@ -1312,10 +1317,15 @@ static void __cpuinit build_r4000_tlb_load_handler(void)
         memset(relocs, 0, sizeof(relocs));
 
         if (bcm1250_m3_war()) {
-                UASM_i_MFC0(&p, K0, C0_BADVADDR);
-                UASM_i_MFC0(&p, K1, C0_ENTRYHI);
+                unsigned int segbits = 44;
+
+                uasm_i_dmfc0(&p, K0, C0_BADVADDR);
+                uasm_i_dmfc0(&p, K1, C0_ENTRYHI);
                 uasm_i_xor(&p, K0, K0, K1);
-                UASM_i_SRL(&p, K0, K0, PAGE_SHIFT + 1);
+                uasm_i_dsrl32(&p, K1, K0, 62 - 32);
+                uasm_i_dsrl(&p, K0, K0, 12 + 1);
+                uasm_i_dsll32(&p, K0, K0, 64 + 12 + 1 - segbits - 32);
+                uasm_i_or(&p, K0, K0, K1);
                 uasm_il_bnez(&p, &r, K0, label_leave);
                 /* No need for uasm_i_nop */
         }
diff --git a/arch/mips/mm/uasm.c b/arch/mips/mm/uasm.c
index 1581e9852461..611d564fdcf1 100644
--- a/arch/mips/mm/uasm.c
+++ b/arch/mips/mm/uasm.c
@@ -31,7 +31,8 @@ enum fields {
         BIMM = 0x040,
         JIMM = 0x080,
         FUNC = 0x100,
-        SET = 0x200
+        SET = 0x200,
+        SCIMM = 0x400
 };
 
 #define OP_MASK         0x3f
@@ -52,6 +53,8 @@ enum fields {
 #define FUNC_SH         0
 #define SET_MASK        0x7
 #define SET_SH          0
+#define SCIMM_MASK      0xfffff
+#define SCIMM_SH        6
 
 enum opcode {
         insn_invalid,
@@ -61,10 +64,10 @@ enum opcode {
         insn_dmtc0, insn_dsll, insn_dsll32, insn_dsra, insn_dsrl,
         insn_dsrl32, insn_drotr, insn_dsubu, insn_eret, insn_j, insn_jal,
         insn_jr, insn_ld, insn_ll, insn_lld, insn_lui, insn_lw, insn_mfc0,
-        insn_mtc0, insn_ori, insn_pref, insn_rfe, insn_sc, insn_scd,
+        insn_mtc0, insn_or, insn_ori, insn_pref, insn_rfe, insn_sc, insn_scd,
         insn_sd, insn_sll, insn_sra, insn_srl, insn_rotr, insn_subu, insn_sw,
         insn_tlbp, insn_tlbr, insn_tlbwi, insn_tlbwr, insn_xor, insn_xori,
-        insn_dins
+        insn_dins, insn_syscall
 };
 
 struct insn {
@@ -117,6 +120,7 @@ static struct insn insn_table[] __cpuinitdata = {
         { insn_lw,  M(lw_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_mfc0,  M(cop0_op, mfc_op, 0, 0, 0, 0),  RT | RD | SET},
         { insn_mtc0,  M(cop0_op, mtc_op, 0, 0, 0, 0),  RT | RD | SET},
+        { insn_or,  M(spec_op, 0, 0, 0, 0, or_op),  RS | RT | RD },
         { insn_ori,  M(ori_op, 0, 0, 0, 0, 0),  RS | RT | UIMM },
         { insn_pref,  M(pref_op, 0, 0, 0, 0, 0),  RS | RT | SIMM },
         { insn_rfe,  M(cop0_op, cop_op, 0, 0, 0, rfe_op),  0 },
@@ -136,6 +140,7 @@ static struct insn insn_table[] __cpuinitdata = {
         { insn_xor,  M(spec_op, 0, 0, 0, 0, xor_op),  RS | RT | RD },
         { insn_xori,  M(xori_op, 0, 0, 0, 0, 0),  RS | RT | UIMM },
         { insn_dins, M(spec3_op, 0, 0, 0, 0, dins_op), RS | RT | RD | RE },
+        { insn_syscall, M(spec_op, 0, 0, 0, 0, syscall_op), SCIMM},
         { insn_invalid, 0, 0 }
 };
 
@@ -208,6 +213,14 @@ static inline __cpuinit u32 build_jimm(u32 arg)
         return (arg >> 2) & JIMM_MASK;
 }
 
+static inline __cpuinit u32 build_scimm(u32 arg)
+{
+        if (arg & ~SCIMM_MASK)
+                printk(KERN_WARNING "Micro-assembler field overflow\n");
+
+        return (arg & SCIMM_MASK) << SCIMM_SH;
+}
+
 static inline __cpuinit u32 build_func(u32 arg)
 {
         if (arg & ~FUNC_MASK)
@@ -266,6 +279,8 @@ static void __cpuinit build_insn(u32 **buf, enum opcode opc, ...)
                 op |= build_func(va_arg(ap, u32));
         if (ip->fields & SET)
                 op |= build_set(va_arg(ap, u32));
+        if (ip->fields & SCIMM)
+                op |= build_scimm(va_arg(ap, u32));
         va_end(ap);
 
         **buf = op;
@@ -373,6 +388,7 @@ I_u2s3u1(_lw)
 I_u1u2u3(_mfc0)
 I_u1u2u3(_mtc0)
 I_u2u1u3(_ori)
+I_u3u1u2(_or)
 I_u2s3u1(_pref)
 I_0(_rfe)
 I_u2s3u1(_sc)
@@ -391,6 +407,7 @@ I_0(_tlbwr)
 I_u3u1u2(_xor)
 I_u2u1u3(_xori)
 I_u2u1msbu3(_dins);
+I_u1(_syscall);
 
 /* Handle labels. */
 void __cpuinit uasm_build_label(struct uasm_label **lab, u32 *addr, int lid)
diff --git a/arch/mips/pci/ops-loongson2.c b/arch/mips/pci/ops-loongson2.c
index 2bb4057bf6c7..d657ee0bc131 100644
--- a/arch/mips/pci/ops-loongson2.c
+++ b/arch/mips/pci/ops-loongson2.c
@@ -180,15 +180,21 @@ struct pci_ops loongson_pci_ops = {
 };
 
 #ifdef CONFIG_CS5536
+DEFINE_RAW_SPINLOCK(msr_lock);
+
 void _rdmsr(u32 msr, u32 *hi, u32 *lo)
 {
         struct pci_bus bus = {
                 .number = PCI_BUS_CS5536
         };
         u32 devfn = PCI_DEVFN(PCI_IDSEL_CS5536, 0);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&msr_lock, flags);
         loongson_pcibios_write(&bus, devfn, PCI_MSR_ADDR, 4, msr);
         loongson_pcibios_read(&bus, devfn, PCI_MSR_DATA_LO, 4, lo);
         loongson_pcibios_read(&bus, devfn, PCI_MSR_DATA_HI, 4, hi);
+        raw_spin_unlock_irqrestore(&msr_lock, flags);
 }
 EXPORT_SYMBOL(_rdmsr);
 
@@ -198,9 +204,13 @@ void _wrmsr(u32 msr, u32 hi, u32 lo)
                 .number = PCI_BUS_CS5536
         };
         u32 devfn = PCI_DEVFN(PCI_IDSEL_CS5536, 0);
+        unsigned long flags;
+
+        raw_spin_lock_irqsave(&msr_lock, flags);
         loongson_pcibios_write(&bus, devfn, PCI_MSR_ADDR, 4, msr);
         loongson_pcibios_write(&bus, devfn, PCI_MSR_DATA_LO, 4, lo);
         loongson_pcibios_write(&bus, devfn, PCI_MSR_DATA_HI, 4, hi);
+        raw_spin_unlock_irqrestore(&msr_lock, flags);
 }
 EXPORT_SYMBOL(_wrmsr);
 #endif
diff --git a/arch/mips/sibyte/sb1250/setup.c b/arch/mips/sibyte/sb1250/setup.c
index 0444da1e23c2..92da3155ce07 100644
--- a/arch/mips/sibyte/sb1250/setup.c
+++ b/arch/mips/sibyte/sb1250/setup.c
@@ -87,6 +87,21 @@ static int __init setup_bcm1250(void)
         return ret;
 }
 
+int sb1250_m3_workaround_needed(void)
+{
+        switch (soc_type) {
+        case K_SYS_SOC_TYPE_BCM1250:
+        case K_SYS_SOC_TYPE_BCM1250_ALT:
+        case K_SYS_SOC_TYPE_BCM1250_ALT2:
+        case K_SYS_SOC_TYPE_BCM1125:
+        case K_SYS_SOC_TYPE_BCM1125H:
+                return soc_pass < K_SYS_REVISION_BCM1250_C0;
+
+        default:
+                return 0;
+        }
+}
+
 static int __init setup_bcm112x(void)
 {
         int ret = 0;
diff --git a/arch/mips/sibyte/swarm/platform.c b/arch/mips/sibyte/swarm/platform.c
index 54847fe1e564..097335262fb3 100644
--- a/arch/mips/sibyte/swarm/platform.c
+++ b/arch/mips/sibyte/swarm/platform.c
@@ -83,3 +83,57 @@ static int __init swarm_pata_init(void)
 device_initcall(swarm_pata_init);
 
 #endif /* defined(CONFIG_SIBYTE_SWARM) || defined(CONFIG_SIBYTE_LITTLESUR) */
+
+#define sb1250_dev_struct(num) \
+        static struct resource sb1250_res##num = {              \
+                .name = "SB1250 MAC " __stringify(num),         \
+                .flags = IORESOURCE_MEM,                \
+                .start = A_MAC_CHANNEL_BASE(num),       \
+                .end = A_MAC_CHANNEL_BASE(num + 1) -1,  \
+        };\
+        static struct platform_device sb1250_dev##num = {       \
+                .name = "sb1250-mac",                   \
+        .id = num,                                      \
+        .resource = &sb1250_res##num,                   \
+        .num_resources = 1,                             \
+        }
+
+sb1250_dev_struct(0);
+sb1250_dev_struct(1);
+sb1250_dev_struct(2);
+sb1250_dev_struct(3);
+
+static struct platform_device *sb1250_devs[] __initdata = {
+        &sb1250_dev0,
+        &sb1250_dev1,
+        &sb1250_dev2,
+        &sb1250_dev3,
+};
+
+static int __init sb1250_device_init(void)
+{
+        int ret;
+
+        /* Set the number of available units based on the SOC type.  */
+        switch (soc_type) {
+        case K_SYS_SOC_TYPE_BCM1250:
+        case K_SYS_SOC_TYPE_BCM1250_ALT:
+                ret = platform_add_devices(sb1250_devs, 3);
+                break;
+        case K_SYS_SOC_TYPE_BCM1120:
+        case K_SYS_SOC_TYPE_BCM1125:
+        case K_SYS_SOC_TYPE_BCM1125H:
+        case K_SYS_SOC_TYPE_BCM1250_ALT2:       /* Hybrid */
+                ret = platform_add_devices(sb1250_devs, 2);
+                break;
+        case K_SYS_SOC_TYPE_BCM1x55:
+        case K_SYS_SOC_TYPE_BCM1x80:
+                ret = platform_add_devices(sb1250_devs, 4);
+                break;
+        default:
+                ret = -ENODEV;
+                break;
+        }
+        return ret;
+}
+device_initcall(sb1250_device_init);
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 6db513674050..9908d477ccd9 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -37,6 +37,9 @@ config SPARC64
         def_bool 64BIT
         select ARCH_SUPPORTS_MSI
         select HAVE_FUNCTION_TRACER
+        select HAVE_FUNCTION_GRAPH_TRACER
+        select HAVE_FUNCTION_GRAPH_FP_TEST
+        select HAVE_FUNCTION_TRACE_MCOUNT_TEST
         select HAVE_KRETPROBES
         select HAVE_KPROBES
         select HAVE_LMB
diff --git a/arch/sparc/Kconfig.debug b/arch/sparc/Kconfig.debug
index 9d3c889718ac..1b4a831565f9 100644
--- a/arch/sparc/Kconfig.debug
+++ b/arch/sparc/Kconfig.debug
@@ -19,13 +19,10 @@ config DEBUG_DCFLUSH
         bool "D-cache flush debugging"
         depends on SPARC64 && DEBUG_KERNEL
 
-config STACK_DEBUG
-        bool "Stack Overflow Detection Support"
-
 config MCOUNT
         bool
         depends on SPARC64
-        depends on STACK_DEBUG || FUNCTION_TRACER
+        depends on FUNCTION_TRACER
         default y
 
 config FRAME_POINTER
diff --git a/arch/sparc/include/asm/cpudata_64.h b/arch/sparc/include/asm/cpudata_64.h
index 926397d345ff..050ef35b9dcf 100644
--- a/arch/sparc/include/asm/cpudata_64.h
+++ b/arch/sparc/include/asm/cpudata_64.h
@@ -17,7 +17,7 @@ typedef struct {
         unsigned int    __nmi_count;
         unsigned long   clock_tick;     /* %tick's per second */
         unsigned long   __pad;
-        unsigned int    __pad1;
+        unsigned int    irq0_irqs;
         unsigned int    __pad2;
 
         /* Dcache line 2, rarely used */
diff --git a/arch/sparc/include/asm/irqflags_64.h b/arch/sparc/include/asm/irqflags_64.h
index 8b49bf920df3..bfa1ea45b4cd 100644
--- a/arch/sparc/include/asm/irqflags_64.h
+++ b/arch/sparc/include/asm/irqflags_64.h
@@ -76,9 +76,26 @@ static inline int raw_irqs_disabled(void)
  */
 static inline unsigned long __raw_local_irq_save(void)
 {
-        unsigned long flags = __raw_local_save_flags();
-
-        raw_local_irq_disable();
+        unsigned long flags, tmp;
+
+        /* Disable interrupts to PIL_NORMAL_MAX unless we already
+         * are using PIL_NMI, in which case PIL_NMI is retained.
+         *
+         * The only values we ever program into the %pil are 0,
+         * PIL_NORMAL_MAX and PIL_NMI.
+         *
+         * Since PIL_NMI is the largest %pil value and all bits are
+         * set in it (0xf), it doesn't matter what PIL_NORMAL_MAX
+         * actually is.
+         */
+        __asm__ __volatile__(
+                "rdpr   %%pil, %0\n\t"
+                "or     %0, %2, %1\n\t"
+                "wrpr   %1, 0x0, %%pil"
+                : "=r" (flags), "=r" (tmp)
+                : "i" (PIL_NORMAL_MAX)
+                : "memory"
+        );
 
         return flags;
 }
diff --git a/arch/sparc/include/asm/thread_info_64.h b/arch/sparc/include/asm/thread_info_64.h
index 9e2d9447f2ad..4827a3aeac7f 100644
--- a/arch/sparc/include/asm/thread_info_64.h
+++ b/arch/sparc/include/asm/thread_info_64.h
@@ -111,7 +111,7 @@ struct thread_info {
 #define THREAD_SHIFT PAGE_SHIFT
 #endif /* PAGE_SHIFT == 13 */
 
-#define PREEMPT_ACTIVE          0x4000000
+#define PREEMPT_ACTIVE          0x10000000
 
 /*
  * macros/functions for gaining access to the thread information structure
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index c6316142db4e..0c2dc1f24a9a 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -13,6 +13,14 @@ extra-y     += init_task.o
 CPPFLAGS_vmlinux.lds := -Usparc -m$(BITS)
 extra-y              += vmlinux.lds
 
+ifdef CONFIG_FUNCTION_TRACER
+# Do not profile debug and lowlevel utilities
+CFLAGS_REMOVE_ftrace.o := -pg
+CFLAGS_REMOVE_time_$(BITS).o := -pg
+CFLAGS_REMOVE_perf_event.o := -pg
+CFLAGS_REMOVE_pcr.o := -pg
+endif
+
 obj-$(CONFIG_SPARC32)   += entry.o wof.o wuf.o
 obj-$(CONFIG_SPARC32)   += etrap_32.o
 obj-$(CONFIG_SPARC32)   += rtrap_32.o
@@ -85,7 +93,7 @@ obj-$(CONFIG_KGDB)        += kgdb_$(BITS).o
 
 
 obj-$(CONFIG_DYNAMIC_FTRACE) += ftrace.o
-CFLAGS_REMOVE_ftrace.o := -pg
+obj-$(CONFIG_FUNCTION_GRAPH_TRACER) += ftrace.o
 
 obj-$(CONFIG_EARLYFB) += btext.o
 obj-$(CONFIG_STACKTRACE)     += stacktrace.o
diff --git a/arch/sparc/kernel/ftrace.c b/arch/sparc/kernel/ftrace.c
index 9103a56b39e8..03ab022e51c5 100644
--- a/arch/sparc/kernel/ftrace.c
+++ b/arch/sparc/kernel/ftrace.c
@@ -13,7 +13,7 @@ static const u32 ftrace_nop = 0x01000000;
 
 static u32 ftrace_call_replace(unsigned long ip, unsigned long addr)
 {
-        static u32 call;
+        u32 call;
         s32 off;
 
         off = ((s32)addr - (s32)ip);
@@ -91,3 +91,61 @@ int __init ftrace_dyn_arch_init(void *data)
         return 0;
 }
 #endif
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+
+#ifdef CONFIG_DYNAMIC_FTRACE
+extern void ftrace_graph_call(void);
+
+int ftrace_enable_ftrace_graph_caller(void)
+{
+        unsigned long ip = (unsigned long)(&ftrace_graph_call);
+        u32 old, new;
+
+        old = *(u32 *) &ftrace_graph_call;
+        new = ftrace_call_replace(ip, (unsigned long) &ftrace_graph_caller);
+        return ftrace_modify_code(ip, old, new);
+}
+
+int ftrace_disable_ftrace_graph_caller(void)
+{
+        unsigned long ip = (unsigned long)(&ftrace_graph_call);
+        u32 old, new;
+
+        old = *(u32 *) &ftrace_graph_call;
+        new = ftrace_call_replace(ip, (unsigned long) &ftrace_stub);
+
+        return ftrace_modify_code(ip, old, new);
+}
+
+#endif /* !CONFIG_DYNAMIC_FTRACE */
+
+/*
+ * Hook the return address and push it in the stack of return addrs
+ * in current thread info.
+ */
+unsigned long prepare_ftrace_return(unsigned long parent,
+                                    unsigned long self_addr,
+                                    unsigned long frame_pointer)
+{
+        unsigned long return_hooker = (unsigned long) &return_to_handler;
+        struct ftrace_graph_ent trace;
+
+        if (unlikely(atomic_read(&current->tracing_graph_pause)))
+                return parent + 8UL;
+
+        if (ftrace_push_return_trace(parent, self_addr, &trace.depth,
+                                     frame_pointer) == -EBUSY)
+                return parent + 8UL;
+
+        trace.func = self_addr;
+
+        /* Only trace if the calling function expects to */
+        if (!ftrace_graph_entry(&trace)) {
+                current->curr_ret_stack--;
+                return parent + 8UL;
+        }
+
+        return return_hooker;
+}
+#endif /* CONFIG_FUNCTION_GRAPH_TRACER */
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index e1cbdb94d97b..830d70a3e20b 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -20,7 +20,9 @@
 #include <linux/delay.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/ftrace.h>
 #include <linux/irq.h>
+#include <linux/kmemleak.h>
 
 #include <asm/ptrace.h>
 #include <asm/processor.h>
@@ -45,6 +47,7 @@
 
 #include "entry.h"
 #include "cpumap.h"
+#include "kstack.h"
 
 #define NUM_IVECS       (IMAP_INR + 1)
 
@@ -647,6 +650,14 @@ unsigned int sun4v_build_virq(u32 devhandle, unsigned int devino)
         bucket = kzalloc(sizeof(struct ino_bucket), GFP_ATOMIC);
         if (unlikely(!bucket))
                 return 0;
+
+        /* The only reference we store to the IRQ bucket is
+         * by physical address which kmemleak can't see, tell
+         * it that this object explicitly is not a leak and
+         * should be scanned.
+         */
+        kmemleak_not_leak(bucket);
+
         __flush_dcache_range((unsigned long) bucket,
                              ((unsigned long) bucket +
                               sizeof(struct ino_bucket)));
@@ -703,25 +714,7 @@ void ack_bad_irq(unsigned int virt_irq)
 void *hardirq_stack[NR_CPUS];
 void *softirq_stack[NR_CPUS];
 
-static __attribute__((always_inline)) void *set_hardirq_stack(void)
-{
-        void *orig_sp, *sp = hardirq_stack[smp_processor_id()];
-
-        __asm__ __volatile__("mov %%sp, %0" : "=r" (orig_sp));
-        if (orig_sp < sp ||
-            orig_sp > (sp + THREAD_SIZE)) {
-                sp += THREAD_SIZE - 192 - STACK_BIAS;
-                __asm__ __volatile__("mov %0, %%sp" : : "r" (sp));
-        }
-
-        return orig_sp;
-}
-static __attribute__((always_inline)) void restore_hardirq_stack(void *orig_sp)
-{
-        __asm__ __volatile__("mov %0, %%sp" : : "r" (orig_sp));
-}
-
-void handler_irq(int irq, struct pt_regs *regs)
+void __irq_entry handler_irq(int irq, struct pt_regs *regs)
 {
         unsigned long pstate, bucket_pa;
         struct pt_regs *old_regs;
diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
index f5a0fd490b59..0a2bd0f99fc1 100644
--- a/arch/sparc/kernel/kgdb_64.c
+++ b/arch/sparc/kernel/kgdb_64.c
@@ -5,6 +5,7 @@
 
 #include <linux/kgdb.h>
 #include <linux/kdebug.h>
+#include <linux/ftrace.h>
 
 #include <asm/kdebug.h>
 #include <asm/ptrace.h>
@@ -108,7 +109,7 @@ void gdb_regs_to_pt_regs(unsigned long *gdb_regs, struct pt_regs *regs)
 }
 
 #ifdef CONFIG_SMP
-void smp_kgdb_capture_client(int irq, struct pt_regs *regs)
+void __irq_entry smp_kgdb_capture_client(int irq, struct pt_regs *regs)
 {
         unsigned long flags;
 
diff --git a/arch/sparc/kernel/kstack.h b/arch/sparc/kernel/kstack.h
index 5247283d1c03..53dfb92e09fb 100644
--- a/arch/sparc/kernel/kstack.h
+++ b/arch/sparc/kernel/kstack.h
@@ -61,4 +61,23 @@ check_magic:
 
 }
 
+static inline __attribute__((always_inline)) void *set_hardirq_stack(void)
+{
+        void *orig_sp, *sp = hardirq_stack[smp_processor_id()];
+
+        __asm__ __volatile__("mov %%sp, %0" : "=r" (orig_sp));
+        if (orig_sp < sp ||
+            orig_sp > (sp + THREAD_SIZE)) {
+                sp += THREAD_SIZE - 192 - STACK_BIAS;
+                __asm__ __volatile__("mov %0, %%sp" : : "r" (sp));
+        }
+
+        return orig_sp;
+}
+
+static inline __attribute__((always_inline)) void restore_hardirq_stack(void *orig_sp)
+{
+        __asm__ __volatile__("mov %0, %%sp" : : "r" (orig_sp));
+}
+
 #endif /* _KSTACK_H */
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
index b287b62c7ea3..a4bd7ba74c89 100644
--- a/arch/sparc/kernel/nmi.c
+++ b/arch/sparc/kernel/nmi.c
@@ -23,6 +23,8 @@
 #include <asm/ptrace.h>
 #include <asm/pcr.h>
 
+#include "kstack.h"
+
 /* We don't have a real NMI on sparc64, but we can fake one
  * up using profiling counter overflow interrupts and interrupt
  * levels.
@@ -92,7 +94,7 @@ static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
 notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
 {
         unsigned int sum, touched = 0;
-        int cpu = smp_processor_id();
+        void *orig_sp;
 
         clear_softint(1 << irq);
 
@@ -100,13 +102,15 @@ notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
 
         nmi_enter();
 
+        orig_sp = set_hardirq_stack();
+
         if (notify_die(DIE_NMI, "nmi", regs, 0,
                        pt_regs_trap_type(regs), SIGINT) == NOTIFY_STOP)
                 touched = 1;
         else
                 pcr_ops->write(PCR_PIC_PRIV);
 
-        sum = kstat_irqs_cpu(0, cpu);
+        sum = local_cpu_data().irq0_irqs;
         if (__get_cpu_var(nmi_touch)) {
                 __get_cpu_var(nmi_touch) = 0;
                 touched = 1;
@@ -125,6 +129,8 @@ notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
                 pcr_ops->write(pcr_enable);
         }
 
+        restore_hardirq_stack(orig_sp);
+
         nmi_exit();
 }
 
diff --git a/arch/sparc/kernel/pci_common.c b/arch/sparc/kernel/pci_common.c
index b775658a927d..8a000583b5cf 100644
--- a/arch/sparc/kernel/pci_common.c
+++ b/arch/sparc/kernel/pci_common.c
@@ -371,14 +371,19 @@ static void pci_register_iommu_region(struct pci_pbm_info *pbm)
                 struct resource *rp = kzalloc(sizeof(*rp), GFP_KERNEL);
 
                 if (!rp) {
-                        prom_printf("Cannot allocate IOMMU resource.\n");
-                        prom_halt();
+                        pr_info("%s: Cannot allocate IOMMU resource.\n",
+                                pbm->name);
+                        return;
                 }
                 rp->name = "IOMMU";
                 rp->start = pbm->mem_space.start + (unsigned long) vdma[0];
                 rp->end = rp->start + (unsigned long) vdma[1] - 1UL;
                 rp->flags = IORESOURCE_BUSY;
-                request_resource(&pbm->mem_space, rp);
+                if (request_resource(&pbm->mem_space, rp)) {
+                        pr_info("%s: Unable to request IOMMU resource.\n",
+                                pbm->name);
+                        kfree(rp);
+                }
         }
 }
 
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
index 2d94e7a03af5..c4a6a50b4849 100644
--- a/arch/sparc/kernel/pcr.c
+++ b/arch/sparc/kernel/pcr.c
@@ -8,6 +8,7 @@
 #include <linux/irq.h>
 
 #include <linux/perf_event.h>
+#include <linux/ftrace.h>
 
 #include <asm/pil.h>
 #include <asm/pcr.h>
@@ -34,7 +35,7 @@ unsigned int picl_shift;
  * Therefore in such situations we defer the work by signalling
  * a lower level cpu IRQ.
  */
-void deferred_pcr_work_irq(int irq, struct pt_regs *regs)
+void __irq_entry deferred_pcr_work_irq(int irq, struct pt_regs *regs)
 {
         struct pt_regs *old_regs;
 
diff --git a/arch/sparc/kernel/rtrap_64.S b/arch/sparc/kernel/rtrap_64.S
index 83f1873c6c13..090b9e9ad5e3 100644
--- a/arch/sparc/kernel/rtrap_64.S
+++ b/arch/sparc/kernel/rtrap_64.S
@@ -130,7 +130,17 @@ rtrap_xcall:
                  nop
                 call                    trace_hardirqs_on
                  nop
-                wrpr                    %l4, %pil
+                /* Do not actually set the %pil here.  We will do that
+                 * below after we clear PSTATE_IE in the %pstate register.
+                 * If we re-enable interrupts here, we can recurse down
+                 * the hardirq stack potentially endlessly, causing a
+                 * stack overflow.
+                 *
+                 * It is tempting to put this test and trace_hardirqs_on
+                 * call at the 'rt_continue' label, but that will not work
+                 * as that path hits unconditionally and we do not want to
+                 * execute this in NMI return paths, for example.
+                 */
 #endif
 rtrap_no_irq_enable:
                 andcc                   %l1, TSTATE_PRIV, %l3
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 4c5334528109..b6a2b8f47040 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -22,6 +22,7 @@
 #include <linux/profile.h>
 #include <linux/bootmem.h>
 #include <linux/vmalloc.h>
+#include <linux/ftrace.h>
 #include <linux/cpu.h>
 #include <linux/slab.h>
 
@@ -823,13 +824,13 @@ void arch_send_call_function_single_ipi(int cpu)
                       &cpumask_of_cpu(cpu));
 }
 
-void smp_call_function_client(int irq, struct pt_regs *regs)
+void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
         generic_smp_call_function_interrupt();
 }
 
-void smp_call_function_single_client(int irq, struct pt_regs *regs)
+void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
         generic_smp_call_function_single_interrupt();
@@ -965,7 +966,7 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page)
         put_cpu();
 }
 
-void smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
+void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs)
 {
         struct mm_struct *mm;
         unsigned long flags;
@@ -1149,7 +1150,7 @@ void smp_release(void)
  */
 extern void prom_world(int);
 
-void smp_penguin_jailcell(int irq, struct pt_regs *regs)
+void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
 
@@ -1365,7 +1366,7 @@ void smp_send_reschedule(int cpu)
                       &cpumask_of_cpu(cpu));
 }
 
-void smp_receive_signal_client(int irq, struct pt_regs *regs)
+void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs)
 {
         clear_softint(1 << irq);
 }
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 67e165102885..c7bbe6cf7b85 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -35,6 +35,7 @@
 #include <linux/clocksource.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
+#include <linux/ftrace.h>
 
 #include <asm/oplib.h>
 #include <asm/timer.h>
@@ -717,7 +718,7 @@ static struct clock_event_device sparc64_clockevent = {
 };
 static DEFINE_PER_CPU(struct clock_event_device, sparc64_events);
 
-void timer_interrupt(int irq, struct pt_regs *regs)
+void __irq_entry timer_interrupt(int irq, struct pt_regs *regs)
 {
         struct pt_regs *old_regs = set_irq_regs(regs);
         unsigned long tick_mask = tick_ops->softint_mask;
@@ -728,6 +729,7 @@ void timer_interrupt(int irq, struct pt_regs *regs)
 
         irq_enter();
 
+        local_cpu_data().irq0_irqs++;
         kstat_incr_irqs_this_cpu(0, irq_to_desc(0));
 
         if (unlikely(!evt->event_handler)) {
diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c
index 837dfc2390d6..9da57f032983 100644
--- a/arch/sparc/kernel/traps_64.c
+++ b/arch/sparc/kernel/traps_64.c
@@ -2203,27 +2203,6 @@ void dump_stack(void)
 
 EXPORT_SYMBOL(dump_stack);
 
-static inline int is_kernel_stack(struct task_struct *task,
-                                  struct reg_window *rw)
-{
-        unsigned long rw_addr = (unsigned long) rw;
-        unsigned long thread_base, thread_end;
-
-        if (rw_addr < PAGE_OFFSET) {
-                if (task != &init_task)
-                        return 0;
-        }
-
-        thread_base = (unsigned long) task_stack_page(task);
-        thread_end = thread_base + sizeof(union thread_union);
-        if (rw_addr >= thread_base &&
-            rw_addr < thread_end &&
-            !(rw_addr & 0x7UL))
-                return 1;
-
-        return 0;
-}
-
 static inline struct reg_window *kernel_stack_up(struct reg_window *rw)
 {
         unsigned long fp = rw->ins[6];
@@ -2252,6 +2231,7 @@ void die_if_kernel(char *str, struct pt_regs *regs)
         show_regs(regs);
         add_taint(TAINT_DIE);
         if (regs->tstate & TSTATE_PRIV) {
+                struct thread_info *tp = current_thread_info();
                 struct reg_window *rw = (struct reg_window *)
                         (regs->u_regs[UREG_FP] + STACK_BIAS);
 
@@ -2259,8 +2239,8 @@ void die_if_kernel(char *str, struct pt_regs *regs)
                  * find some badly aligned kernel stack.
                  */
                 while (rw &&
-                       count++ < 30&&
-                       is_kernel_stack(current, rw)) {
+                       count++ < 30 &&
+                       kstack_valid(tp, (unsigned long) rw)) {
                         printk("Caller[%016lx]: %pS\n", rw->ins[7],
                                (void *) rw->ins[7]);
 
diff --git a/arch/sparc/kernel/unaligned_64.c b/arch/sparc/kernel/unaligned_64.c
index ebce43018c49..c752c4c479bd 100644
--- a/arch/sparc/kernel/unaligned_64.c
+++ b/arch/sparc/kernel/unaligned_64.c
@@ -50,7 +50,7 @@ static inline enum direction decode_direction(unsigned int insn)
 }
 
 /* 16 = double-word, 8 = extra-word, 4 = word, 2 = half-word */
-static inline int decode_access_size(unsigned int insn)
+static inline int decode_access_size(struct pt_regs *regs, unsigned int insn)
 {
         unsigned int tmp;
 
@@ -66,7 +66,7 @@ static inline int decode_access_size(unsigned int insn)
                 return 2;
         else {
                 printk("Impossible unaligned trap. insn=%08x\n", insn);
-                die_if_kernel("Byte sized unaligned access?!?!", current_thread_info()->kregs);
+                die_if_kernel("Byte sized unaligned access?!?!", regs);
 
                 /* GCC should never warn that control reaches the end
                  * of this function without returning a value because
@@ -286,7 +286,7 @@ static void log_unaligned(struct pt_regs *regs)
 asmlinkage void kernel_unaligned_trap(struct pt_regs *regs, unsigned int insn)
 {
         enum direction dir = decode_direction(insn);
-        int size = decode_access_size(insn);
+        int size = decode_access_size(regs, insn);
         int orig_asi, asi;
 
         current_thread_info()->kern_una_regs = regs;
diff --git a/arch/sparc/kernel/vmlinux.lds.S b/arch/sparc/kernel/vmlinux.lds.S
index 4e5992593967..0c1e6783657f 100644
--- a/arch/sparc/kernel/vmlinux.lds.S
+++ b/arch/sparc/kernel/vmlinux.lds.S
@@ -46,11 +46,16 @@ SECTIONS
                 SCHED_TEXT
                 LOCK_TEXT
                 KPROBES_TEXT
+                IRQENTRY_TEXT
                 *(.gnu.warning)
         } = 0
         _etext = .;
 
         RO_DATA(PAGE_SIZE)
+
+        /* Start of data section */
+        _sdata = .;
+
         .data1 : {
                 *(.data1)
         }
diff --git a/arch/sparc/lib/mcount.S b/arch/sparc/lib/mcount.S
index 24b8b12deed2..3ad6cbdc2163 100644
--- a/arch/sparc/lib/mcount.S
+++ b/arch/sparc/lib/mcount.S
@@ -7,26 +7,11 @@
 
 #include <linux/linkage.h>
 
-#include <asm/ptrace.h>
-#include <asm/thread_info.h>
-
 /*
  * This is the main variant and is called by C code.  GCC's -pg option
  * automatically instruments every C function with a call to this.
  */
 
-#ifdef CONFIG_STACK_DEBUG
-
-#define OVSTACKSIZE     4096            /* lets hope this is enough */
-
-        .data
-        .align          8
-panicstring:
-        .asciz          "Stack overflow\n"
-        .align          8
-ovstack:
-        .skip           OVSTACKSIZE
-#endif
         .text
         .align          32
         .globl          _mcount
@@ -35,84 +20,48 @@ ovstack:
         .type           mcount,#function
 _mcount:
 mcount:
-#ifdef CONFIG_STACK_DEBUG
-        /*
-         * Check whether %sp is dangerously low.
-         */
-        ldub            [%g6 + TI_FPDEPTH], %g1
-        srl             %g1, 1, %g3
-        add             %g3, 1, %g3
-        sllx            %g3, 8, %g3                     ! each fpregs frame is 256b
-        add             %g3, 192, %g3
-        add             %g6, %g3, %g3                   ! where does task_struct+frame end?
-        sub             %g3, STACK_BIAS, %g3
-        cmp             %sp, %g3
-        bg,pt           %xcc, 1f
-         nop
-        lduh            [%g6 + TI_CPU], %g1
-        sethi           %hi(hardirq_stack), %g3
-        or              %g3, %lo(hardirq_stack), %g3
-        sllx            %g1, 3, %g1
-        ldx             [%g3 + %g1], %g7
-        sub             %g7, STACK_BIAS, %g7
-        cmp             %sp, %g7
-        bleu,pt         %xcc, 2f
-         sethi          %hi(THREAD_SIZE), %g3
-        add             %g7, %g3, %g7
-        cmp             %sp, %g7
-        blu,pn          %xcc, 1f
-2:       sethi          %hi(softirq_stack), %g3
-        or              %g3, %lo(softirq_stack), %g3
-        ldx             [%g3 + %g1], %g7
-        sub             %g7, STACK_BIAS, %g7
-        cmp             %sp, %g7
-        bleu,pt         %xcc, 3f
-         sethi          %hi(THREAD_SIZE), %g3
-        add             %g7, %g3, %g7
-        cmp             %sp, %g7
-        blu,pn          %xcc, 1f
-         nop
-        /* If we are already on ovstack, don't hop onto it
-         * again, we are already trying to output the stack overflow
-         * message.
-         */
-3:      sethi           %hi(ovstack), %g7               ! cant move to panic stack fast enough
-         or             %g7, %lo(ovstack), %g7
-        add             %g7, OVSTACKSIZE, %g3
-        sub             %g3, STACK_BIAS + 192, %g3
-        sub             %g7, STACK_BIAS, %g7
-        cmp             %sp, %g7
-        blu,pn          %xcc, 2f
-         cmp            %sp, %g3
-        bleu,pn         %xcc, 1f
-         nop
-2:      mov             %g3, %sp
-        sethi           %hi(panicstring), %g3
-        call            prom_printf
-         or             %g3, %lo(panicstring), %o0
-        call            prom_halt
-         nop
-1:
-#endif
 #ifdef CONFIG_FUNCTION_TRACER
 #ifdef CONFIG_DYNAMIC_FTRACE
-        mov             %o7, %o0
-        .globl          mcount_call
-mcount_call:
-        call            ftrace_stub
-         mov            %o0, %o7
+        /* Do nothing, the retl/nop below is all we need.  */
 #else
-        sethi           %hi(ftrace_trace_function), %g1
+        sethi           %hi(function_trace_stop), %g1
+        lduw            [%g1 + %lo(function_trace_stop)], %g2
+        brnz,pn         %g2, 2f
+         sethi          %hi(ftrace_trace_function), %g1
         sethi           %hi(ftrace_stub), %g2
         ldx             [%g1 + %lo(ftrace_trace_function)], %g1
         or              %g2, %lo(ftrace_stub), %g2
         cmp             %g1, %g2
         be,pn           %icc, 1f
-         mov            %i7, %o1
-        jmpl            %g1, %g0
-         mov            %o7, %o0
+         mov            %i7, %g3
+        save            %sp, -176, %sp
+        mov             %g3, %o1
+        jmpl            %g1, %o7
+         mov            %i7, %o0
+        ret
+         restore
         /* not reached */
 1:
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        sethi           %hi(ftrace_graph_return), %g1
+        ldx             [%g1 + %lo(ftrace_graph_return)], %g3
+        cmp             %g2, %g3
+        bne,pn          %xcc, 5f
+         sethi          %hi(ftrace_graph_entry_stub), %g2
+        sethi           %hi(ftrace_graph_entry), %g1
+        or              %g2, %lo(ftrace_graph_entry_stub), %g2
+        ldx             [%g1 + %lo(ftrace_graph_entry)], %g1
+        cmp             %g1, %g2
+        be,pt           %xcc, 2f
+         nop
+5:      mov             %i7, %g2
+        mov             %fp, %g3
+        save            %sp, -176, %sp
+        mov             %g2, %l0
+        ba,pt           %xcc, ftrace_graph_caller
+         mov            %g3, %l1
+#endif
+2:
 #endif
 #endif
         retl
@@ -131,14 +80,50 @@ ftrace_stub:
         .globl          ftrace_caller
         .type           ftrace_caller,#function
 ftrace_caller:
-        mov             %i7, %o1
-        mov             %o7, %o0
+        sethi           %hi(function_trace_stop), %g1
+        mov             %i7, %g2
+        lduw            [%g1 + %lo(function_trace_stop)], %g1
+        brnz,pn         %g1, ftrace_stub
+         mov            %fp, %g3
+        save            %sp, -176, %sp
+        mov             %g2, %o1
+        mov             %g2, %l0
+        mov             %g3, %l1
         .globl          ftrace_call
 ftrace_call:
         call            ftrace_stub
-         mov            %o0, %o7
-        retl
+         mov            %i7, %o0
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        .globl          ftrace_graph_call
+ftrace_graph_call:
+        call            ftrace_stub
          nop
+#endif
+        ret
+         restore
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+        .size           ftrace_graph_call,.-ftrace_graph_call
+#endif
+        .size           ftrace_call,.-ftrace_call
         .size           ftrace_caller,.-ftrace_caller
 #endif
 #endif
+
+#ifdef CONFIG_FUNCTION_GRAPH_TRACER
+ENTRY(ftrace_graph_caller)
+        mov             %l0, %o0
+        mov             %i7, %o1
+        call            prepare_ftrace_return
+         mov            %l1, %o2
+        ret
+         restore        %o0, -8, %i7
+END(ftrace_graph_caller)
+
+ENTRY(return_to_handler)
+        save            %sp, -176, %sp
+        call            ftrace_return_to_handler
+         mov            %fp, %o0
+        jmpl            %o0 + 8, %g0
+         restore
+END(return_to_handler)
+#endif
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 59b4556a5b92..e790bc1fbfa3 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -626,7 +626,7 @@ ia32_sys_call_table:
         .quad stub32_sigreturn
         .quad stub32_clone              /* 120 */
         .quad sys_setdomainname
-        .quad sys_uname
+        .quad sys_newuname
         .quad sys_modify_ldt
         .quad compat_sys_adjtimex
         .quad sys32_mprotect            /* 125 */
diff --git a/arch/x86/include/asm/amd_iommu_types.h b/arch/x86/include/asm/amd_iommu_types.h
index ba19ad4c47d0..86a0ff0aeac7 100644
--- a/arch/x86/include/asm/amd_iommu_types.h
+++ b/arch/x86/include/asm/amd_iommu_types.h
@@ -21,6 +21,7 @@
 #define _ASM_X86_AMD_IOMMU_TYPES_H
 
 #include <linux/types.h>
+#include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
 
@@ -140,6 +141,7 @@
 
 /* constants to configure the command buffer */
 #define CMD_BUFFER_SIZE    8192
+#define CMD_BUFFER_UNINITIALIZED 1
 #define CMD_BUFFER_ENTRIES 512
 #define MMIO_CMD_SIZE_SHIFT 56
 #define MMIO_CMD_SIZE_512 (0x9ULL << MMIO_CMD_SIZE_SHIFT)
@@ -237,6 +239,7 @@ struct protection_domain {
         struct list_head list;  /* for list of all protection domains */
         struct list_head dev_list; /* List of all devices in this domain */
         spinlock_t lock;        /* mostly used to lock the page table*/
+        struct mutex api_lock;  /* protect page tables in the iommu-api path */
         u16 id;                 /* the domain id written to the device table */
         int mode;               /* paging mode (0-6 levels) */
         u64 *pt_root;           /* page table root pointer */
diff --git a/arch/x86/include/asm/lguest_hcall.h b/arch/x86/include/asm/lguest_hcall.h
index ba0eed8aa1a6..b60f2924c413 100644
--- a/arch/x86/include/asm/lguest_hcall.h
+++ b/arch/x86/include/asm/lguest_hcall.h
@@ -28,22 +28,39 @@
 
 #ifndef __ASSEMBLY__
 #include <asm/hw_irq.h>
-#include <asm/kvm_para.h>
 
 /*G:030
  * But first, how does our Guest contact the Host to ask for privileged
  * operations?  There are two ways: the direct way is to make a "hypercall",
  * to make requests of the Host Itself.
  *
- * We use the KVM hypercall mechanism, though completely different hypercall
- * numbers. Seventeen hypercalls are available: the hypercall number is put in
- * the %eax register, and the arguments (when required) are placed in %ebx,
- * %ecx, %edx and %esi.  If a return value makes sense, it's returned in %eax.
+ * Our hypercall mechanism uses the highest unused trap code (traps 32 and
+ * above are used by real hardware interrupts).  Seventeen hypercalls are
+ * available: the hypercall number is put in the %eax register, and the
+ * arguments (when required) are placed in %ebx, %ecx, %edx and %esi.
+ * If a return value makes sense, it's returned in %eax.
  *
  * Grossly invalid calls result in Sudden Death at the hands of the vengeful
  * Host, rather than returning failure.  This reflects Winston Churchill's
  * definition of a gentleman: "someone who is only rude intentionally".
-:*/
+ */
+static inline unsigned long
+hcall(unsigned long call,
+      unsigned long arg1, unsigned long arg2, unsigned long arg3,
+      unsigned long arg4)
+{
+        /* "int" is the Intel instruction to trigger a trap. */
+        asm volatile("int $" __stringify(LGUEST_TRAP_ENTRY)
+                     /* The call in %eax (aka "a") might be overwritten */
+                     : "=a"(call)
+                       /* The arguments are in %eax, %ebx, %ecx, %edx & %esi */
+                     : "a"(call), "b"(arg1), "c"(arg2), "d"(arg3), "S"(arg4)
+                       /* "memory" means this might write somewhere in memory.
+                        * This isn't true for all calls, but it's safe to tell
+                        * gcc that it might happen so it doesn't get clever. */
+                     : "memory");
+        return call;
+}
 
 /* Can't use our min() macro here: needs to be a constant */
 #define LGUEST_IRQS (NR_IRQS < 32 ? NR_IRQS: 32)
diff --git a/arch/x86/kernel/amd_iommu.c b/arch/x86/kernel/amd_iommu.c
index f3dadb571d9b..f854d89b7edf 100644
--- a/arch/x86/kernel/amd_iommu.c
+++ b/arch/x86/kernel/amd_iommu.c
@@ -118,7 +118,7 @@ static bool check_device(struct device *dev)
                 return false;
 
         /* No device or no PCI device */
-        if (!dev || dev->bus != &pci_bus_type)
+        if (dev->bus != &pci_bus_type)
                 return false;
 
         devid = get_device_id(dev);
@@ -392,6 +392,7 @@ static int __iommu_queue_command(struct amd_iommu *iommu, struct iommu_cmd *cmd)
         u32 tail, head;
         u8 *target;
 
+        WARN_ON(iommu->cmd_buf_size & CMD_BUFFER_UNINITIALIZED);
         tail = readl(iommu->mmio_base + MMIO_CMD_TAIL_OFFSET);
         target = iommu->cmd_buf + tail;
         memcpy_toio(target, cmd, sizeof(*cmd));
@@ -2186,7 +2187,7 @@ static void prealloc_protection_domains(void)
         struct dma_ops_domain *dma_dom;
         u16 devid;
 
-        while ((dev = pci_get_device(PCI_ANY_ID, PCI_ANY_ID, dev)) != NULL) {
+        for_each_pci_dev(dev) {
 
                 /* Do we handle this device? */
                 if (!check_device(&dev->dev))
@@ -2298,7 +2299,7 @@ static void cleanup_domain(struct protection_domain *domain)
         list_for_each_entry_safe(dev_data, next, &domain->dev_list, list) {
                 struct device *dev = dev_data->dev;
 
-                do_detach(dev);
+                __detach_device(dev);
                 atomic_set(&dev_data->bind, 0);
         }
 
@@ -2327,6 +2328,7 @@ static struct protection_domain *protection_domain_alloc(void)
                 return NULL;
 
         spin_lock_init(&domain->lock);
+        mutex_init(&domain->api_lock);
         domain->id = domain_id_alloc();
         if (!domain->id)
                 goto out_err;
@@ -2379,9 +2381,7 @@ static void amd_iommu_domain_destroy(struct iommu_domain *dom)
 
         free_pagetable(domain);
 
-        domain_id_free(domain->id);
-
-        kfree(domain);
+        protection_domain_free(domain);
 
         dom->priv = NULL;
 }
@@ -2456,6 +2456,8 @@ static int amd_iommu_map_range(struct iommu_domain *dom,
         iova  &= PAGE_MASK;
         paddr &= PAGE_MASK;
 
+        mutex_lock(&domain->api_lock);
+
         for (i = 0; i < npages; ++i) {
                 ret = iommu_map_page(domain, iova, paddr, prot, PM_MAP_4k);
                 if (ret)
@@ -2465,6 +2467,8 @@ static int amd_iommu_map_range(struct iommu_domain *dom,
                 paddr += PAGE_SIZE;
         }
 
+        mutex_unlock(&domain->api_lock);
+
         return 0;
 }
 
@@ -2477,12 +2481,16 @@ static void amd_iommu_unmap_range(struct iommu_domain *dom,
 
         iova  &= PAGE_MASK;
 
+        mutex_lock(&domain->api_lock);
+
         for (i = 0; i < npages; ++i) {
                 iommu_unmap_page(domain, iova, PM_MAP_4k);
                 iova  += PAGE_SIZE;
         }
 
         iommu_flush_tlb_pde(domain);
+
+        mutex_unlock(&domain->api_lock);
 }
 
 static phys_addr_t amd_iommu_iova_to_phys(struct iommu_domain *dom,
diff --git a/arch/x86/kernel/amd_iommu_init.c b/arch/x86/kernel/amd_iommu_init.c
index 42f5350b908f..6360abf993d4 100644
--- a/arch/x86/kernel/amd_iommu_init.c
+++ b/arch/x86/kernel/amd_iommu_init.c
@@ -138,9 +138,9 @@ int amd_iommus_present;
 bool amd_iommu_np_cache __read_mostly;
 
 /*
- * Set to true if ACPI table parsing and hardware intialization went properly
+ * The ACPI table parsing functions set this variable on an error
  */
-static bool amd_iommu_initialized;
+static int __initdata amd_iommu_init_err;
 
 /*
  * List of protection domains - used during resume
@@ -391,9 +391,11 @@ static int __init find_last_devid_acpi(struct acpi_table_header *table)
          */
         for (i = 0; i < table->length; ++i)
                 checksum += p[i];
-        if (checksum != 0)
+        if (checksum != 0) {
                 /* ACPI table corrupt */
-                return -ENODEV;
+                amd_iommu_init_err = -ENODEV;
+                return 0;
+        }
 
         p += IVRS_HEADER_LENGTH;
 
@@ -436,7 +438,7 @@ static u8 * __init alloc_command_buffer(struct amd_iommu *iommu)
         if (cmd_buf == NULL)
                 return NULL;
 
-        iommu->cmd_buf_size = CMD_BUFFER_SIZE;
+        iommu->cmd_buf_size = CMD_BUFFER_SIZE | CMD_BUFFER_UNINITIALIZED;
 
         return cmd_buf;
 }
@@ -472,12 +474,13 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
                     &entry, sizeof(entry));
 
         amd_iommu_reset_cmd_buffer(iommu);
+        iommu->cmd_buf_size &= ~(CMD_BUFFER_UNINITIALIZED);
 }
 
 static void __init free_command_buffer(struct amd_iommu *iommu)
 {
         free_pages((unsigned long)iommu->cmd_buf,
-                   get_order(iommu->cmd_buf_size));
+                   get_order(iommu->cmd_buf_size & ~(CMD_BUFFER_UNINITIALIZED)));
 }
 
 /* allocates the memory where the IOMMU will log its events to */
@@ -920,11 +923,16 @@ static int __init init_iommu_all(struct acpi_table_header *table)
                                     h->mmio_phys);
 
                         iommu = kzalloc(sizeof(struct amd_iommu), GFP_KERNEL);
-                        if (iommu == NULL)
-                                return -ENOMEM;
+                        if (iommu == NULL) {
+                                amd_iommu_init_err = -ENOMEM;
+                                return 0;
+                        }
+
                         ret = init_iommu_one(iommu, h);
-                        if (ret)
-                                return ret;
+                        if (ret) {
+                                amd_iommu_init_err = ret;
+                                return 0;
+                        }
                         break;
                 default:
                         break;
@@ -934,8 +942,6 @@ static int __init init_iommu_all(struct acpi_table_header *table)
         }
         WARN_ON(p != end);
 
-        amd_iommu_initialized = true;
-
         return 0;
 }
 
@@ -1211,6 +1217,10 @@ static int __init amd_iommu_init(void)
         if (acpi_table_parse("IVRS", find_last_devid_acpi) != 0)
                 return -ENODEV;
 
+        ret = amd_iommu_init_err;
+        if (ret)
+                goto out;
+
         dev_table_size     = tbl_size(DEV_TABLE_ENTRY_SIZE);
         alias_table_size   = tbl_size(ALIAS_TABLE_ENTRY_SIZE);
         rlookup_table_size = tbl_size(RLOOKUP_TABLE_ENTRY_SIZE);
@@ -1270,12 +1280,19 @@ static int __init amd_iommu_init(void)
         if (acpi_table_parse("IVRS", init_iommu_all) != 0)
                 goto free;
 
-        if (!amd_iommu_initialized)
+        if (amd_iommu_init_err) {
+                ret = amd_iommu_init_err;
                 goto free;
+        }
 
         if (acpi_table_parse("IVRS", init_memory_definitions) != 0)
                 goto free;
 
+        if (amd_iommu_init_err) {
+                ret = amd_iommu_init_err;
+                goto free;
+        }
+
         ret = sysdev_class_register(&amd_iommu_sysdev_class);
         if (ret)
                 goto free;
@@ -1288,6 +1305,8 @@ static int __init amd_iommu_init(void)
         if (ret)
                 goto free;
 
+        enable_iommus();
+
         if (iommu_pass_through)
                 ret = amd_iommu_init_passthrough();
         else
@@ -1300,8 +1319,6 @@ static int __init amd_iommu_init(void)
 
         amd_iommu_init_notifier();
 
-        enable_iommus();
-
         if (iommu_pass_through)
                 goto out;
 
@@ -1315,6 +1332,7 @@ out:
         return ret;
 
 free:
+        disable_iommus();
 
         amd_iommu_uninit_devices();
 
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 3704997e8b25..b5d8b0bcf235 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -393,6 +393,7 @@ void __init gart_iommu_hole_init(void)
         for (i = 0; i < ARRAY_SIZE(bus_dev_ranges); i++) {
                 int bus;
                 int dev_base, dev_limit;
+                u32 ctl;
 
                 bus = bus_dev_ranges[i].bus;
                 dev_base = bus_dev_ranges[i].dev_base;
@@ -406,7 +407,19 @@ void __init gart_iommu_hole_init(void)
                         gart_iommu_aperture = 1;
                         x86_init.iommu.iommu_init = gart_iommu_init;
 
-                        aper_order = (read_pci_config(bus, slot, 3, AMD64_GARTAPERTURECTL) >> 1) & 7;
+                        ctl = read_pci_config(bus, slot, 3,
+                                              AMD64_GARTAPERTURECTL);
+
+                        /*
+                         * Before we do anything else disable the GART. It may
+                         * still be enabled if we boot into a crash-kernel here.
+                         * Reconfiguring the GART while it is enabled could have
+                         * unknown side-effects.
+                         */
+                        ctl &= ~GARTEN;
+                        write_pci_config(bus, slot, 3, AMD64_GARTAPERTURECTL, ctl);
+
+                        aper_order = (ctl >> 1) & 7;
                         aper_size = (32 * 1024 * 1024) << aper_order;
                         aper_base = read_pci_config(bus, slot, 3, AMD64_GARTAPERTUREBASE) & 0x7fff;
                         aper_base <<= 25;
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index a4849c10a77e..ebd4c51d096a 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -27,7 +27,6 @@
 #include <asm/cpu.h>
 #include <asm/reboot.h>
 #include <asm/virtext.h>
-#include <asm/x86_init.h>
 
 #if defined(CONFIG_SMP) && defined(CONFIG_X86_LOCAL_APIC)
 
@@ -103,10 +102,5 @@ void native_machine_crash_shutdown(struct pt_regs *regs)
 #ifdef CONFIG_HPET_TIMER
         hpet_disable();
 #endif
-
-#ifdef CONFIG_X86_64
-        x86_platform.iommu_shutdown();
-#endif
-
         crash_save_cpu(regs, safe_smp_processor_id());
 }
diff --git a/arch/x86/kernel/dumpstack.h b/arch/x86/kernel/dumpstack.h
index e39e77168a37..e1a93be4fd44 100644
--- a/arch/x86/kernel/dumpstack.h
+++ b/arch/x86/kernel/dumpstack.h
@@ -14,6 +14,8 @@
 #define get_bp(bp) asm("movq %%rbp, %0" : "=r" (bp) :)
 #endif
 
+#include <linux/uaccess.h>
+
 extern void
 show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
                 unsigned long *stack, unsigned long bp, char *log_lvl);
@@ -42,8 +44,10 @@ static inline unsigned long rewind_frame_pointer(int n)
         get_bp(frame);
 
 #ifdef CONFIG_FRAME_POINTER
-        while (n--)
-                frame = frame->next_frame;
+        while (n--) {
+                if (probe_kernel_address(&frame->next_frame, frame))
+                        break;
+        }
 #endif
 
         return (unsigned long)frame;
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 68cd24f9deae..0f7f130caa67 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -565,6 +565,9 @@ static void enable_gart_translations(void)
 
                 enable_gart_translation(dev, __pa(agp_gatt_table));
         }
+
+        /* Flush the GART-TLB to remove stale entries */
+        k8_flush_garts();
 }
 
 /*
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 7e59dc1d3fc2..2bdf628066bd 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -115,7 +115,7 @@ static void async_hcall(unsigned long call, unsigned long arg1,
         local_irq_save(flags);
         if (lguest_data.hcall_status[next_call] != 0xFF) {
                 /* Table full, so do normal hcall which will flush table. */
-                kvm_hypercall4(call, arg1, arg2, arg3, arg4);
+                hcall(call, arg1, arg2, arg3, arg4);
         } else {
                 lguest_data.hcalls[next_call].arg0 = call;
                 lguest_data.hcalls[next_call].arg1 = arg1;
@@ -145,46 +145,45 @@ static void async_hcall(unsigned long call, unsigned long arg1,
  * So, when we're in lazy mode, we call async_hcall() to store the call for
  * future processing:
  */
-static void lazy_hcall1(unsigned long call,
-                       unsigned long arg1)
+static void lazy_hcall1(unsigned long call, unsigned long arg1)
 {
         if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_NONE)
-                kvm_hypercall1(call, arg1);
+                hcall(call, arg1, 0, 0, 0);
         else
                 async_hcall(call, arg1, 0, 0, 0);
 }
 
 /* You can imagine what lazy_hcall2, 3 and 4 look like. :*/
 static void lazy_hcall2(unsigned long call,
-                       unsigned long arg1,
-                       unsigned long arg2)
+                        unsigned long arg1,
+                        unsigned long arg2)
 {
         if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_NONE)
-                kvm_hypercall2(call, arg1, arg2);
+                hcall(call, arg1, arg2, 0, 0);
         else
                 async_hcall(call, arg1, arg2, 0, 0);
 }
 
 static void lazy_hcall3(unsigned long call,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3)
+                        unsigned long arg1,
+                        unsigned long arg2,
+                        unsigned long arg3)
 {
         if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_NONE)
-                kvm_hypercall3(call, arg1, arg2, arg3);
+                hcall(call, arg1, arg2, arg3, 0);
         else
                 async_hcall(call, arg1, arg2, arg3, 0);
 }
 
 #ifdef CONFIG_X86_PAE
 static void lazy_hcall4(unsigned long call,
-                       unsigned long arg1,
-                       unsigned long arg2,
-                       unsigned long arg3,
-                       unsigned long arg4)
+                        unsigned long arg1,
+                        unsigned long arg2,
+                        unsigned long arg3,
+                        unsigned long arg4)
 {
         if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_NONE)
-                kvm_hypercall4(call, arg1, arg2, arg3, arg4);
+                hcall(call, arg1, arg2, arg3, arg4);
         else
                 async_hcall(call, arg1, arg2, arg3, arg4);
 }
@@ -196,13 +195,13 @@ static void lazy_hcall4(unsigned long call,
 :*/
 static void lguest_leave_lazy_mmu_mode(void)
 {
-        kvm_hypercall0(LHCALL_FLUSH_ASYNC);
+        hcall(LHCALL_FLUSH_ASYNC, 0, 0, 0, 0);
         paravirt_leave_lazy_mmu();
 }
 
 static void lguest_end_context_switch(struct task_struct *next)
 {
-        kvm_hypercall0(LHCALL_FLUSH_ASYNC);
+        hcall(LHCALL_FLUSH_ASYNC, 0, 0, 0, 0);
         paravirt_end_context_switch(next);
 }
 
@@ -286,7 +285,7 @@ static void lguest_write_idt_entry(gate_desc *dt,
         /* Keep the local copy up to date. */
         native_write_idt_entry(dt, entrynum, g);
         /* Tell Host about this new entry. */
-        kvm_hypercall3(LHCALL_LOAD_IDT_ENTRY, entrynum, desc[0], desc[1]);
+        hcall(LHCALL_LOAD_IDT_ENTRY, entrynum, desc[0], desc[1], 0);
 }
 
 /*
@@ -300,7 +299,7 @@ static void lguest_load_idt(const struct desc_ptr *desc)
         struct desc_struct *idt = (void *)desc->address;
 
         for (i = 0; i < (desc->size+1)/8; i++)
-                kvm_hypercall3(LHCALL_LOAD_IDT_ENTRY, i, idt[i].a, idt[i].b);
+                hcall(LHCALL_LOAD_IDT_ENTRY, i, idt[i].a, idt[i].b, 0);
 }
 
 /*
@@ -321,7 +320,7 @@ static void lguest_load_gdt(const struct desc_ptr *desc)
         struct desc_struct *gdt = (void *)desc->address;
 
         for (i = 0; i < (desc->size+1)/8; i++)
-                kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, i, gdt[i].a, gdt[i].b);
+                hcall(LHCALL_LOAD_GDT_ENTRY, i, gdt[i].a, gdt[i].b, 0);
 }
 
 /*
@@ -334,8 +333,8 @@ static void lguest_write_gdt_entry(struct desc_struct *dt, int entrynum,
 {
         native_write_gdt_entry(dt, entrynum, desc, type);
         /* Tell Host about this new entry. */
-        kvm_hypercall3(LHCALL_LOAD_GDT_ENTRY, entrynum,
-                       dt[entrynum].a, dt[entrynum].b);
+        hcall(LHCALL_LOAD_GDT_ENTRY, entrynum,
+              dt[entrynum].a, dt[entrynum].b, 0);
 }
 
 /*
@@ -931,7 +930,7 @@ static int lguest_clockevent_set_next_event(unsigned long delta,
         }
 
         /* Please wake us this far in the future. */
-        kvm_hypercall1(LHCALL_SET_CLOCKEVENT, delta);
+        hcall(LHCALL_SET_CLOCKEVENT, delta, 0, 0, 0);
         return 0;
 }
 
@@ -942,7 +941,7 @@ static void lguest_clockevent_set_mode(enum clock_event_mode mode,
         case CLOCK_EVT_MODE_UNUSED:
         case CLOCK_EVT_MODE_SHUTDOWN:
                 /* A 0 argument shuts the clock down. */
-                kvm_hypercall0(LHCALL_SET_CLOCKEVENT);
+                hcall(LHCALL_SET_CLOCKEVENT, 0, 0, 0, 0);
                 break;
         case CLOCK_EVT_MODE_ONESHOT:
                 /* This is what we expect. */
@@ -1100,7 +1099,7 @@ static void set_lguest_basic_apic_ops(void)
 /* STOP!  Until an interrupt comes in. */
 static void lguest_safe_halt(void)
 {
-        kvm_hypercall0(LHCALL_HALT);
+        hcall(LHCALL_HALT, 0, 0, 0, 0);
 }
 
 /*
@@ -1112,8 +1111,8 @@ static void lguest_safe_halt(void)
  */
 static void lguest_power_off(void)
 {
-        kvm_hypercall2(LHCALL_SHUTDOWN, __pa("Power down"),
-                                        LGUEST_SHUTDOWN_POWEROFF);
+        hcall(LHCALL_SHUTDOWN, __pa("Power down"),
+              LGUEST_SHUTDOWN_POWEROFF, 0, 0);
 }
 
 /*
@@ -1123,7 +1122,7 @@ static void lguest_power_off(void)
  */
 static int lguest_panic(struct notifier_block *nb, unsigned long l, void *p)
 {
-        kvm_hypercall2(LHCALL_SHUTDOWN, __pa(p), LGUEST_SHUTDOWN_POWEROFF);
+        hcall(LHCALL_SHUTDOWN, __pa(p), LGUEST_SHUTDOWN_POWEROFF, 0, 0);
         /* The hcall won't return, but to keep gcc happy, we're "done". */
         return NOTIFY_DONE;
 }
@@ -1162,7 +1161,7 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
                 len = sizeof(scratch) - 1;
         scratch[len] = '\0';
         memcpy(scratch, buf, len);
-        kvm_hypercall1(LHCALL_NOTIFY, __pa(scratch));
+        hcall(LHCALL_NOTIFY, __pa(scratch), 0, 0, 0);
 
         /* This routine returns the number of bytes actually written. */
         return len;
@@ -1174,7 +1173,7 @@ static __init int early_put_chars(u32 vtermno, const char *buf, int count)
  */
 static void lguest_restart(char *reason)
 {
-        kvm_hypercall2(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART);
+        hcall(LHCALL_SHUTDOWN, __pa(reason), LGUEST_SHUTDOWN_RESTART, 0, 0);
 }
 
 /*G:050
diff --git a/arch/x86/lguest/i386_head.S b/arch/x86/lguest/i386_head.S
index 27eac0faee48..4f420c2f2d55 100644
--- a/arch/x86/lguest/i386_head.S
+++ b/arch/x86/lguest/i386_head.S
@@ -32,7 +32,7 @@ ENTRY(lguest_entry)
          */
         movl $LHCALL_LGUEST_INIT, %eax
         movl $lguest_data - __PAGE_OFFSET, %ebx
-        .byte 0x0f,0x01,0xc1 /* KVM_HYPERCALL */
+        int $LGUEST_TRAP_ENTRY
 
         /* Set up the initial stack so we can run C code. */
         movl $(init_thread_union+THREAD_SIZE),%esp
diff --git a/drivers/acpi/acpica/exprep.c b/drivers/acpi/acpica/exprep.c
index a610ebe18edd..2fbfe51fb141 100644
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -471,13 +471,18 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)
                 /* allow full data read from EC address space */
                 if (obj_desc->field.region_obj->region.space_id ==
                         ACPI_ADR_SPACE_EC) {
-                        if (obj_desc->common_field.bit_length > 8)
-                                obj_desc->common_field.access_bit_width =
-                                ACPI_ROUND_UP(obj_desc->common_field.
-                                                        bit_length, 8);
+                        if (obj_desc->common_field.bit_length > 8) {
+                                unsigned width =
+                                        ACPI_ROUND_BITS_UP_TO_BYTES(
+                                        obj_desc->common_field.bit_length);
+                                // access_bit_width is u8, don't overflow it
+                                if (width > 8)
+                                        width = 8;
                                 obj_desc->common_field.access_byte_width =
-                                ACPI_DIV_8(obj_desc->common_field.
-                                                        access_bit_width);
+                                                        width;
+                                obj_desc->common_field.access_bit_width =
+                                                        8 * width;
+                        }
                 }
 
                 ACPI_DEBUG_PRINT((ACPI_DB_BFIELD,
diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
index b86712167eb8..b9101818b47b 100644
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@@ -68,7 +68,7 @@ static int atmtcp_send_control(struct atm_vcc *vcc,int type,
         *(struct atm_vcc **) &new_msg->vcc = vcc;
         old_test = test_bit(flag,&vcc->flags);
         out_vcc->push(out_vcc,skb);
-        add_wait_queue(sk_atm(vcc)->sk_sleep, &wait);
+        add_wait_queue(sk_sleep(sk_atm(vcc)), &wait);
         while (test_bit(flag,&vcc->flags) == old_test) {
                 mb();
                 out_vcc = PRIV(vcc->dev) ? PRIV(vcc->dev)->vcc : NULL;
@@ -80,7 +80,7 @@ static int atmtcp_send_control(struct atm_vcc *vcc,int type,
                 schedule();
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk_atm(vcc)->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk_atm(vcc)), &wait);
         return error;
 }
 
@@ -105,7 +105,7 @@ static int atmtcp_recv_control(const struct atmtcp_control *msg)
                     msg->type);
                 return -EINVAL;
         }
-        wake_up(sk_atm(vcc)->sk_sleep);
+        wake_up(sk_sleep(sk_atm(vcc)));
         return 0;
 }
 
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index d41331bc2aa7..aa4248efc5d8 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -1817,8 +1817,6 @@ static int intel_845_configure(void)
         pci_write_config_byte(agp_bridge->dev, INTEL_I845_AGPM, temp2 | (1 << 1));
         /* clear any possible error conditions */
         pci_write_config_word(agp_bridge->dev, INTEL_I845_ERRSTS, 0x001c);
-
-        intel_i830_setup_flush();
         return 0;
 }
 
@@ -2188,7 +2186,6 @@ static const struct agp_bridge_driver intel_845_driver = {
         .agp_destroy_page       = agp_generic_destroy_page,
         .agp_destroy_pages      = agp_generic_destroy_pages,
         .agp_type_to_mask_type  = agp_generic_type_to_mask_type,
-        .chipset_flush          = intel_i830_chipset_flush,
 };
 
 static const struct agp_bridge_driver intel_850_driver = {
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index c9bc896d68af..90b199f97bec 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1026,14 +1026,16 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
 
         xoutb(0, REG_FLAGS1(iobase));   /* clear detectCMM */
         /* last check before exit */
-        if (!io_detect_cm4000(iobase, dev))
-                count = -ENODEV;
+        if (!io_detect_cm4000(iobase, dev)) {
+                rc = -ENODEV;
+                goto release_io;
+        }
 
         if (test_bit(IS_INVREV, &dev->flags) && count > 0)
                 str_invert_revert(dev->rbuf, count);
 
         if (copy_to_user(buf, dev->rbuf, count))
-                return -EFAULT;
+                rc = -EFAULT;
 
 release_io:
         clear_bit(LOCK_IO, &dev->flags);
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index 702dcc98c074..14a34d99eea2 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -960,6 +960,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                 u.packet.header_length = GET_HEADER_LENGTH(control);
 
                 if (ctx->type == FW_ISO_CONTEXT_TRANSMIT) {
+                        if (u.packet.header_length % 4 != 0)
+                                return -EINVAL;
                         header_length = u.packet.header_length;
                 } else {
                         /*
@@ -969,7 +971,8 @@ static int ioctl_queue_iso(struct client *client, union ioctl_arg *arg)
                         if (ctx->header_size == 0) {
                                 if (u.packet.header_length > 0)
                                         return -EINVAL;
-                        } else if (u.packet.header_length % ctx->header_size != 0) {
+                        } else if (u.packet.header_length == 0 ||
+                                   u.packet.header_length % ctx->header_size != 0) {
                                 return -EINVAL;
                         }
                         header_length = 0;
@@ -1354,24 +1357,24 @@ static int dispatch_ioctl(struct client *client,
                 return -ENODEV;
 
         if (_IOC_TYPE(cmd) != '#' ||
-            _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers))
+            _IOC_NR(cmd) >= ARRAY_SIZE(ioctl_handlers) ||
+            _IOC_SIZE(cmd) > sizeof(buffer))
                 return -EINVAL;
 
-        if (_IOC_DIR(cmd) & _IOC_WRITE) {
-                if (_IOC_SIZE(cmd) > sizeof(buffer) ||
-                    copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
+        if (_IOC_DIR(cmd) == _IOC_READ)
+                memset(&buffer, 0, _IOC_SIZE(cmd));
+
+        if (_IOC_DIR(cmd) & _IOC_WRITE)
+                if (copy_from_user(&buffer, arg, _IOC_SIZE(cmd)))
                         return -EFAULT;
-        }
 
         ret = ioctl_handlers[_IOC_NR(cmd)](client, &buffer);
         if (ret < 0)
                 return ret;
 
-        if (_IOC_DIR(cmd) & _IOC_READ) {
-                if (_IOC_SIZE(cmd) > sizeof(buffer) ||
-                    copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
+        if (_IOC_DIR(cmd) & _IOC_READ)
+                if (copy_to_user(arg, &buffer, _IOC_SIZE(cmd)))
                         return -EFAULT;
-        }
 
         return ret;
 }
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index b743411d8144..a0c365f2e521 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -516,8 +516,6 @@ void drm_put_dev(struct drm_device *dev)
         }
         driver = dev->driver;
 
-        drm_vblank_cleanup(dev);
-
         drm_lastclose(dev);
 
         if (drm_core_has_MTRR(dev) && drm_core_has_AGP(dev) &&
@@ -537,6 +535,8 @@ void drm_put_dev(struct drm_device *dev)
                 dev->agp = NULL;
         }
 
+        drm_vblank_cleanup(dev);
+
         list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                 drm_rmmap(dev, r_list->map);
         drm_ht_remove(&dev->map_hash);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index b574503dddd0..a0b8447b06e7 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -226,7 +226,7 @@ static int i915_gem_fence_regs_info(struct seq_file *m, void *data)
                 } else {
                         struct drm_i915_gem_object *obj_priv;
 
-                        obj_priv = obj->driver_private;
+                        obj_priv = to_intel_bo(obj);
                         seq_printf(m, "Fenced object[%2d] = %p: %s "
                                    "%08x %08zx %08x %s %08x %08x %d",
                                    i, obj, get_pin_flag(obj_priv),
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 4b26919abdb2..0af3dcc85ce9 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -80,14 +80,14 @@ const static struct intel_device_info intel_i915g_info = {
         .is_i915g = 1, .is_i9xx = 1, .cursor_needs_physical = 1,
 };
 const static struct intel_device_info intel_i915gm_info = {
-        .is_i9xx = 1,  .is_mobile = 1, .has_fbc = 1,
+        .is_i9xx = 1,  .is_mobile = 1,
         .cursor_needs_physical = 1,
 };
 const static struct intel_device_info intel_i945g_info = {
         .is_i9xx = 1, .has_hotplug = 1, .cursor_needs_physical = 1,
 };
 const static struct intel_device_info intel_i945gm_info = {
-        .is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1, .has_fbc = 1,
+        .is_i945gm = 1, .is_i9xx = 1, .is_mobile = 1,
         .has_hotplug = 1, .cursor_needs_physical = 1,
 };
 
@@ -361,7 +361,7 @@ int i965_reset(struct drm_device *dev, u8 flags)
             !dev_priv->mm.suspended) {
                 drm_i915_ring_buffer_t *ring = &dev_priv->ring;
                 struct drm_gem_object *obj = ring->ring_obj;
-                struct drm_i915_gem_object *obj_priv = obj->driver_private;
+                struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
                 dev_priv->mm.suspended = 0;
 
                 /* Stop the ring if it's running. */
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index aba8260fbc5e..6960849522f8 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -611,6 +611,8 @@ typedef struct drm_i915_private {
         /* Reclocking support */
         bool render_reclock_avail;
         bool lvds_downclock_avail;
+        /* indicate whether the LVDS EDID is OK */
+        bool lvds_edid_good;
         /* indicates the reduced downclock for LVDS*/
         int lvds_downclock;
         struct work_struct idle_work;
@@ -731,6 +733,8 @@ struct drm_i915_gem_object {
         atomic_t pending_flip;
 };
 
+#define to_intel_bo(x) ((struct drm_i915_gem_object *) (x)->driver_private)
+
 /**
  * Request queue structure.
  *
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 368d726853d1..80871c62a571 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -163,7 +163,7 @@ fast_shmem_read(struct page **pages,
 static int i915_gem_object_needs_bit17_swizzle(struct drm_gem_object *obj)
 {
         drm_i915_private_t *dev_priv = obj->dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         return dev_priv->mm.bit_6_swizzle_x == I915_BIT_6_SWIZZLE_9_10_17 &&
                 obj_priv->tiling_mode != I915_TILING_NONE;
@@ -264,7 +264,7 @@ i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
                           struct drm_i915_gem_pread *args,
                           struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         ssize_t remain;
         loff_t offset, page_base;
         char __user *user_data;
@@ -285,7 +285,7 @@ i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret != 0)
                 goto fail_put_pages;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = args->offset;
 
         while (remain > 0) {
@@ -354,7 +354,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
                           struct drm_i915_gem_pread *args,
                           struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct mm_struct *mm = current->mm;
         struct page **user_pages;
         ssize_t remain;
@@ -403,7 +403,7 @@ i915_gem_shmem_pread_slow(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret != 0)
                 goto fail_put_pages;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = args->offset;
 
         while (remain > 0) {
@@ -479,7 +479,7 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (obj == NULL)
                 return -EBADF;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         /* Bounds check source.
          *
@@ -581,7 +581,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
                          struct drm_i915_gem_pwrite *args,
                          struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         drm_i915_private_t *dev_priv = dev->dev_private;
         ssize_t remain;
         loff_t offset, page_base;
@@ -605,7 +605,7 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret)
                 goto fail;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = obj_priv->gtt_offset + args->offset;
 
         while (remain > 0) {
@@ -655,7 +655,7 @@ i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                          struct drm_i915_gem_pwrite *args,
                          struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         drm_i915_private_t *dev_priv = dev->dev_private;
         ssize_t remain;
         loff_t gtt_page_base, offset;
@@ -699,7 +699,7 @@ i915_gem_gtt_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret)
                 goto out_unpin_object;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = obj_priv->gtt_offset + args->offset;
 
         while (remain > 0) {
@@ -761,7 +761,7 @@ i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
                            struct drm_i915_gem_pwrite *args,
                            struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         ssize_t remain;
         loff_t offset, page_base;
         char __user *user_data;
@@ -781,7 +781,7 @@ i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret != 0)
                 goto fail_put_pages;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = args->offset;
         obj_priv->dirty = 1;
 
@@ -829,7 +829,7 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
                            struct drm_i915_gem_pwrite *args,
                            struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct mm_struct *mm = current->mm;
         struct page **user_pages;
         ssize_t remain;
@@ -877,7 +877,7 @@ i915_gem_shmem_pwrite_slow(struct drm_device *dev, struct drm_gem_object *obj,
         if (ret != 0)
                 goto fail_put_pages;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         offset = args->offset;
         obj_priv->dirty = 1;
 
@@ -952,7 +952,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (obj == NULL)
                 return -EBADF;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         /* Bounds check destination.
          *
@@ -1034,7 +1034,7 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (obj == NULL)
                 return -EBADF;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         mutex_lock(&dev->struct_mutex);
 
@@ -1096,7 +1096,7 @@ i915_gem_sw_finish_ioctl(struct drm_device *dev, void *data,
         DRM_INFO("%s: sw_finish %d (%p %zd)\n",
                  __func__, args->handle, obj, obj->size);
 #endif
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         /* Pinned buffers may be scanout, so flush the cache */
         if (obj_priv->pin_count)
@@ -1167,7 +1167,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         struct drm_gem_object *obj = vma->vm_private_data;
         struct drm_device *dev = obj->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         pgoff_t page_offset;
         unsigned long pfn;
         int ret = 0;
@@ -1234,7 +1234,7 @@ i915_gem_create_mmap_offset(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         struct drm_gem_mm *mm = dev->mm_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_map_list *list;
         struct drm_local_map *map;
         int ret = 0;
@@ -1305,7 +1305,7 @@ void
 i915_gem_release_mmap(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         if (dev->dev_mapping)
                 unmap_mapping_range(dev->dev_mapping,
@@ -1316,7 +1316,7 @@ static void
 i915_gem_free_mmap_offset(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_gem_mm *mm = dev->mm_private;
         struct drm_map_list *list;
 
@@ -1347,7 +1347,7 @@ static uint32_t
 i915_gem_get_gtt_alignment(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int start, i;
 
         /*
@@ -1406,7 +1406,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 
         mutex_lock(&dev->struct_mutex);
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         if (obj_priv->madv != I915_MADV_WILLNEED) {
                 DRM_ERROR("Attempting to mmap a purgeable buffer\n");
@@ -1450,7 +1450,7 @@ i915_gem_mmap_gtt_ioctl(struct drm_device *dev, void *data,
 void
 i915_gem_object_put_pages(struct drm_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page_count = obj->size / PAGE_SIZE;
         int i;
 
@@ -1486,7 +1486,7 @@ i915_gem_object_move_to_active(struct drm_gem_object *obj, uint32_t seqno)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         /* Add a reference if we're newly entering the active list. */
         if (!obj_priv->active) {
@@ -1506,7 +1506,7 @@ i915_gem_object_move_to_flushing(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         BUG_ON(!obj_priv->active);
         list_move_tail(&obj_priv->list, &dev_priv->mm.flushing_list);
@@ -1517,7 +1517,7 @@ i915_gem_object_move_to_flushing(struct drm_gem_object *obj)
 static void
 i915_gem_object_truncate(struct drm_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct inode *inode;
 
         inode = obj->filp->f_path.dentry->d_inode;
@@ -1538,7 +1538,7 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         i915_verify_inactive(dev, __FILE__, __LINE__);
         if (obj_priv->pin_count != 0)
@@ -1965,7 +1965,7 @@ static int
 i915_gem_object_wait_rendering(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int ret;
 
         /* This function only exists to support waiting for existing rendering,
@@ -1997,7 +1997,7 @@ i915_gem_object_unbind(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int ret = 0;
 
 #if WATCH_BUF
@@ -2173,7 +2173,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size)
 #if WATCH_LRU
                         DRM_INFO("%s: evicting %p\n", __func__, obj);
 #endif
-                        obj_priv = obj->driver_private;
+                        obj_priv = to_intel_bo(obj);
                         BUG_ON(obj_priv->pin_count != 0);
                         BUG_ON(obj_priv->active);
 
@@ -2244,7 +2244,7 @@ int
 i915_gem_object_get_pages(struct drm_gem_object *obj,
                           gfp_t gfpmask)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page_count, i;
         struct address_space *mapping;
         struct inode *inode;
@@ -2297,7 +2297,7 @@ static void sandybridge_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_gem_object *obj = reg->obj;
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int regnum = obj_priv->fence_reg;
         uint64_t val;
 
@@ -2319,7 +2319,7 @@ static void i965_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_gem_object *obj = reg->obj;
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int regnum = obj_priv->fence_reg;
         uint64_t val;
 
@@ -2339,7 +2339,7 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_gem_object *obj = reg->obj;
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int regnum = obj_priv->fence_reg;
         int tile_width;
         uint32_t fence_reg, val;
@@ -2381,7 +2381,7 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
         struct drm_gem_object *obj = reg->obj;
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int regnum = obj_priv->fence_reg;
         uint32_t val;
         uint32_t pitch_val;
@@ -2425,7 +2425,7 @@ static int i915_find_fence_reg(struct drm_device *dev)
                 if (!reg->obj)
                         return i;
 
-                obj_priv = reg->obj->driver_private;
+                obj_priv = to_intel_bo(reg->obj);
                 if (!obj_priv->pin_count)
                     avail++;
         }
@@ -2480,7 +2480,7 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_i915_fence_reg *reg = NULL;
         int ret;
 
@@ -2547,7 +2547,7 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         if (IS_GEN6(dev)) {
                 I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 +
@@ -2583,7 +2583,7 @@ int
 i915_gem_object_put_fence_reg(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         if (obj_priv->fence_reg == I915_FENCE_REG_NONE)
                 return 0;
@@ -2621,7 +2621,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         struct drm_mm_node *free_space;
         gfp_t gfpmask =  __GFP_NORETRY | __GFP_NOWARN;
         int ret;
@@ -2728,7 +2728,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
 void
 i915_gem_clflush_object(struct drm_gem_object *obj)
 {
-        struct drm_i915_gem_object      *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object      *obj_priv = to_intel_bo(obj);
 
         /* If we don't have a page list set up, then we're not pinned
          * to GPU, and we can ignore the cache flush because it'll happen
@@ -2829,7 +2829,7 @@ i915_gem_object_flush_write_domain(struct drm_gem_object *obj)
 int
 i915_gem_object_set_to_gtt_domain(struct drm_gem_object *obj, int write)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         uint32_t old_write_domain, old_read_domains;
         int ret;
 
@@ -2879,7 +2879,7 @@ int
 i915_gem_object_set_to_display_plane(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         uint32_t old_write_domain, old_read_domains;
         int ret;
 
@@ -3092,7 +3092,7 @@ static void
 i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj)
 {
         struct drm_device               *dev = obj->dev;
-        struct drm_i915_gem_object      *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object      *obj_priv = to_intel_bo(obj);
         uint32_t                        invalidate_domains = 0;
         uint32_t                        flush_domains = 0;
         uint32_t                        old_read_domains;
@@ -3177,7 +3177,7 @@ i915_gem_object_set_to_gpu_domain(struct drm_gem_object *obj)
 static void
 i915_gem_object_set_to_full_cpu_read_domain(struct drm_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         if (!obj_priv->page_cpu_valid)
                 return;
@@ -3217,7 +3217,7 @@ static int
 i915_gem_object_set_cpu_read_domain_range(struct drm_gem_object *obj,
                                           uint64_t offset, uint64_t size)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         uint32_t old_read_domains;
         int i, ret;
 
@@ -3286,7 +3286,7 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int i, ret;
         void __iomem *reloc_page;
         bool need_fence;
@@ -3337,7 +3337,7 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                         i915_gem_object_unpin(obj);
                         return -EBADF;
                 }
-                target_obj_priv = target_obj->driver_private;
+                target_obj_priv = to_intel_bo(target_obj);
 
 #if WATCH_RELOC
                 DRM_INFO("%s: obj %p offset %08x target %d "
@@ -3689,7 +3689,7 @@ i915_gem_wait_for_pending_flip(struct drm_device *dev,
                 prepare_to_wait(&dev_priv->pending_flip_queue,
                                 &wait, TASK_INTERRUPTIBLE);
                 for (i = 0; i < count; i++) {
-                        obj_priv = object_list[i]->driver_private;
+                        obj_priv = to_intel_bo(object_list[i]);
                         if (atomic_read(&obj_priv->pending_flip) > 0)
                                 break;
                 }
@@ -3798,7 +3798,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                         goto err;
                 }
 
-                obj_priv = object_list[i]->driver_private;
+                obj_priv = to_intel_bo(object_list[i]);
                 if (obj_priv->in_execbuffer) {
                         DRM_ERROR("Object %p appears more than once in object list\n",
                                    object_list[i]);
@@ -3924,7 +3924,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
 
         for (i = 0; i < args->buffer_count; i++) {
                 struct drm_gem_object *obj = object_list[i];
-                struct drm_i915_gem_object *obj_priv = obj->driver_private;
+                struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
                 uint32_t old_write_domain = obj->write_domain;
 
                 obj->write_domain = obj->pending_write_domain;
@@ -3999,7 +3999,7 @@ err:
 
         for (i = 0; i < args->buffer_count; i++) {
                 if (object_list[i]) {
-                        obj_priv = object_list[i]->driver_private;
+                        obj_priv = to_intel_bo(object_list[i]);
                         obj_priv->in_execbuffer = false;
                 }
                 drm_gem_object_unreference(object_list[i]);
@@ -4177,7 +4177,7 @@ int
 i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int ret;
 
         i915_verify_inactive(dev, __FILE__, __LINE__);
@@ -4210,7 +4210,7 @@ i915_gem_object_unpin(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         i915_verify_inactive(dev, __FILE__, __LINE__);
         obj_priv->pin_count--;
@@ -4250,7 +4250,7 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
                 mutex_unlock(&dev->struct_mutex);
                 return -EBADF;
         }
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         if (obj_priv->madv != I915_MADV_WILLNEED) {
                 DRM_ERROR("Attempting to pin a purgeable buffer\n");
@@ -4307,7 +4307,7 @@ i915_gem_unpin_ioctl(struct drm_device *dev, void *data,
                 return -EBADF;
         }
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         if (obj_priv->pin_filp != file_priv) {
                 DRM_ERROR("Not pinned by caller in i915_gem_pin_ioctl(): %d\n",
                           args->handle);
@@ -4349,7 +4349,7 @@ i915_gem_busy_ioctl(struct drm_device *dev, void *data,
          */
         i915_gem_retire_requests(dev);
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         /* Don't count being on the flushing list against the object being
          * done.  Otherwise, a buffer left on the flushing list but not getting
          * flushed (because nobody's flushing that domain) won't ever return
@@ -4395,7 +4395,7 @@ i915_gem_madvise_ioctl(struct drm_device *dev, void *data,
         }
 
         mutex_lock(&dev->struct_mutex);
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         if (obj_priv->pin_count) {
                 drm_gem_object_unreference(obj);
@@ -4456,7 +4456,7 @@ int i915_gem_init_object(struct drm_gem_object *obj)
 void i915_gem_free_object(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         trace_i915_gem_object_destroy(obj);
 
@@ -4565,7 +4565,7 @@ i915_gem_init_hws(struct drm_device *dev)
                 DRM_ERROR("Failed to allocate status page\n");
                 return -ENOMEM;
         }
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
 
         ret = i915_gem_object_pin(obj, 4096);
@@ -4609,7 +4609,7 @@ i915_gem_cleanup_hws(struct drm_device *dev)
                 return;
 
         obj = dev_priv->hws_obj;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         kunmap(obj_priv->pages[0]);
         i915_gem_object_unpin(obj);
@@ -4643,7 +4643,7 @@ i915_gem_init_ringbuffer(struct drm_device *dev)
                 i915_gem_cleanup_hws(dev);
                 return -ENOMEM;
         }
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         ret = i915_gem_object_pin(obj, 4096);
         if (ret != 0) {
@@ -4936,7 +4936,7 @@ void i915_gem_detach_phys_object(struct drm_device *dev,
         int ret;
         int page_count;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         if (!obj_priv->phys_obj)
                 return;
 
@@ -4975,7 +4975,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
         if (id > I915_MAX_PHYS_OBJECT)
                 return -EINVAL;
 
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         if (obj_priv->phys_obj) {
                 if (obj_priv->phys_obj->id == id)
@@ -5026,7 +5026,7 @@ i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
                      struct drm_i915_gem_pwrite *args,
                      struct drm_file *file_priv)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         void *obj_addr;
         int ret;
         char __user *user_data;
diff --git a/drivers/gpu/drm/i915/i915_gem_debug.c b/drivers/gpu/drm/i915/i915_gem_debug.c
index e602614bd3f8..35507cf53fa3 100644
--- a/drivers/gpu/drm/i915/i915_gem_debug.c
+++ b/drivers/gpu/drm/i915/i915_gem_debug.c
@@ -72,7 +72,7 @@ void
 i915_gem_dump_object(struct drm_gem_object *obj, int len,
                      const char *where, uint32_t mark)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page;
 
         DRM_INFO("%s: object at offset %08x\n", where, obj_priv->gtt_offset);
@@ -137,7 +137,7 @@ void
 i915_gem_object_check_coherency(struct drm_gem_object *obj, int handle)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page;
         uint32_t *gtt_mapping;
         uint32_t *backing_map = NULL;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index c01c878e51ba..449157f71610 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -240,7 +240,7 @@ bool
 i915_gem_object_fence_offset_ok(struct drm_gem_object *obj, int tiling_mode)
 {
         struct drm_device *dev = obj->dev;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
 
         if (obj_priv->gtt_space == NULL)
                 return true;
@@ -280,7 +280,7 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (obj == NULL)
                 return -EINVAL;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         if (!i915_tiling_ok(dev, args->stride, obj->size, args->tiling_mode)) {
                 drm_gem_object_unreference_unlocked(obj);
@@ -364,7 +364,7 @@ i915_gem_get_tiling(struct drm_device *dev, void *data,
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (obj == NULL)
                 return -EINVAL;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         mutex_lock(&dev->struct_mutex);
 
@@ -427,7 +427,7 @@ i915_gem_object_do_bit_17_swizzle(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page_count = obj->size >> PAGE_SHIFT;
         int i;
 
@@ -456,7 +456,7 @@ i915_gem_object_save_bit_17_swizzle(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
         drm_i915_private_t *dev_priv = dev->dev_private;
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         int page_count = obj->size >> PAGE_SHIFT;
         int i;
 
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 49c458bc6502..6421481d6222 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -260,10 +260,10 @@ static void i915_hotplug_work_func(struct work_struct *work)
 
         if (mode_config->num_connector) {
                 list_for_each_entry(connector, &mode_config->connector_list, head) {
-                        struct intel_output *intel_output = to_intel_output(connector);
+                        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
         
-                        if (intel_output->hot_plug)
-                                (*intel_output->hot_plug) (intel_output);
+                        if (intel_encoder->hot_plug)
+                                (*intel_encoder->hot_plug) (intel_encoder);
                 }
         }
         /* Just fire off a uevent and let userspace tell us what to do */
@@ -444,7 +444,7 @@ i915_error_object_create(struct drm_device *dev,
         if (src == NULL)
                 return NULL;
 
-        src_priv = src->driver_private;
+        src_priv = to_intel_bo(src);
         if (src_priv->pages == NULL)
                 return NULL;
 
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 38110ce742a5..759c2ef72eff 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -247,19 +247,19 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
 
 static bool intel_crt_detect_ddc(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
         /* CRT should always be at 0, but check anyway */
-        if (intel_output->type != INTEL_OUTPUT_ANALOG)
+        if (intel_encoder->type != INTEL_OUTPUT_ANALOG)
                 return false;
 
-        return intel_ddc_probe(intel_output);
+        return intel_ddc_probe(intel_encoder);
 }
 
 static enum drm_connector_status
-intel_crt_load_detect(struct drm_crtc *crtc, struct intel_output *intel_output)
+intel_crt_load_detect(struct drm_crtc *crtc, struct intel_encoder *intel_encoder)
 {
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
@@ -387,8 +387,8 @@ intel_crt_load_detect(struct drm_crtc *crtc, struct intel_output *intel_output)
 static enum drm_connector_status intel_crt_detect(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_crtc *crtc;
         int dpms_mode;
         enum drm_connector_status status;
@@ -405,13 +405,13 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
 
         /* for pre-945g platforms use load detect */
         if (encoder->crtc && encoder->crtc->enabled) {
-                status = intel_crt_load_detect(encoder->crtc, intel_output);
+                status = intel_crt_load_detect(encoder->crtc, intel_encoder);
         } else {
-                crtc = intel_get_load_detect_pipe(intel_output,
+                crtc = intel_get_load_detect_pipe(intel_encoder,
                                                   NULL, &dpms_mode);
                 if (crtc) {
-                        status = intel_crt_load_detect(crtc, intel_output);
-                        intel_release_load_detect_pipe(intel_output, dpms_mode);
+                        status = intel_crt_load_detect(crtc, intel_encoder);
+                        intel_release_load_detect_pipe(intel_encoder, dpms_mode);
                 } else
                         status = connector_status_unknown;
         }
@@ -421,9 +421,9 @@ static enum drm_connector_status intel_crt_detect(struct drm_connector *connecto
 
 static void intel_crt_destroy(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
-        intel_i2c_destroy(intel_output->ddc_bus);
+        intel_i2c_destroy(intel_encoder->ddc_bus);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
         kfree(connector);
@@ -432,28 +432,28 @@ static void intel_crt_destroy(struct drm_connector *connector)
 static int intel_crt_get_modes(struct drm_connector *connector)
 {
         int ret;
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
         struct i2c_adapter *ddcbus;
         struct drm_device *dev = connector->dev;
 
 
-        ret = intel_ddc_get_modes(intel_output);
+        ret = intel_ddc_get_modes(intel_encoder);
         if (ret || !IS_G4X(dev))
                 goto end;
 
-        ddcbus = intel_output->ddc_bus;
+        ddcbus = intel_encoder->ddc_bus;
         /* Try to probe digital port for output in DVI-I -> VGA mode. */
-        intel_output->ddc_bus =
+        intel_encoder->ddc_bus =
                 intel_i2c_create(connector->dev, GPIOD, "CRTDDC_D");
 
-        if (!intel_output->ddc_bus) {
-                intel_output->ddc_bus = ddcbus;
+        if (!intel_encoder->ddc_bus) {
+                intel_encoder->ddc_bus = ddcbus;
                 dev_printk(KERN_ERR, &connector->dev->pdev->dev,
                            "DDC bus registration failed for CRTDDC_D.\n");
                 goto end;
         }
         /* Try to get modes by GPIOD port */
-        ret = intel_ddc_get_modes(intel_output);
+        ret = intel_ddc_get_modes(intel_encoder);
         intel_i2c_destroy(ddcbus);
 
 end:
@@ -506,23 +506,23 @@ static const struct drm_encoder_funcs intel_crt_enc_funcs = {
 void intel_crt_init(struct drm_device *dev)
 {
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 i2c_reg;
 
-        intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
-        if (!intel_output)
+        intel_encoder = kzalloc(sizeof(struct intel_encoder), GFP_KERNEL);
+        if (!intel_encoder)
                 return;
 
-        connector = &intel_output->base;
-        drm_connector_init(dev, &intel_output->base,
+        connector = &intel_encoder->base;
+        drm_connector_init(dev, &intel_encoder->base,
                            &intel_crt_connector_funcs, DRM_MODE_CONNECTOR_VGA);
 
-        drm_encoder_init(dev, &intel_output->enc, &intel_crt_enc_funcs,
+        drm_encoder_init(dev, &intel_encoder->enc, &intel_crt_enc_funcs,
                          DRM_MODE_ENCODER_DAC);
 
-        drm_mode_connector_attach_encoder(&intel_output->base,
-                                          &intel_output->enc);
+        drm_mode_connector_attach_encoder(&intel_encoder->base,
+                                          &intel_encoder->enc);
 
         /* Set up the DDC bus. */
         if (HAS_PCH_SPLIT(dev))
@@ -533,22 +533,22 @@ void intel_crt_init(struct drm_device *dev)
                 if (dev_priv->crt_ddc_bus != 0)
                         i2c_reg = dev_priv->crt_ddc_bus;
         }
-        intel_output->ddc_bus = intel_i2c_create(dev, i2c_reg, "CRTDDC_A");
-        if (!intel_output->ddc_bus) {
+        intel_encoder->ddc_bus = intel_i2c_create(dev, i2c_reg, "CRTDDC_A");
+        if (!intel_encoder->ddc_bus) {
                 dev_printk(KERN_ERR, &dev->pdev->dev, "DDC bus registration "
                            "failed.\n");
                 return;
         }
 
-        intel_output->type = INTEL_OUTPUT_ANALOG;
-        intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+        intel_encoder->type = INTEL_OUTPUT_ANALOG;
+        intel_encoder->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                    (1 << INTEL_ANALOG_CLONE_BIT) |
                                    (1 << INTEL_SDVO_LVDS_CLONE_BIT);
-        intel_output->crtc_mask = (1 << 0) | (1 << 1);
+        intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
         connector->interlace_allowed = 0;
         connector->doublescan_allowed = 0;
 
-        drm_encoder_helper_add(&intel_output->enc, &intel_crt_helper_funcs);
+        drm_encoder_helper_add(&intel_encoder->enc, &intel_crt_helper_funcs);
         drm_connector_helper_add(connector, &intel_crt_connector_helper_funcs);
 
         drm_sysfs_connector_add(connector);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index e7e753b2845f..e7356fb6c918 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -747,16 +747,16 @@ bool intel_pipe_has_type (struct drm_crtc *crtc, int type)
     list_for_each_entry(l_entry, &mode_config->connector_list, head) {
             if (l_entry->encoder &&
                 l_entry->encoder->crtc == crtc) {
-                    struct intel_output *intel_output = to_intel_output(l_entry);
-                    if (intel_output->type == type)
+                    struct intel_encoder *intel_encoder = to_intel_encoder(l_entry);
+                    if (intel_encoder->type == type)
                             return true;
             }
     }
     return false;
 }
 
-struct drm_connector *
-intel_pipe_get_output (struct drm_crtc *crtc)
+static struct drm_connector *
+intel_pipe_get_connector (struct drm_crtc *crtc)
 {
     struct drm_device *dev = crtc->dev;
     struct drm_mode_config *mode_config = &dev->mode_config;
@@ -1003,7 +1003,7 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_framebuffer *fb = crtc->fb;
         struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_i915_gem_object *obj_priv = intel_fb->obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(intel_fb->obj);
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         int plane, i;
         u32 fbc_ctl, fbc_ctl2;
@@ -1080,7 +1080,7 @@ static void g4x_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_framebuffer *fb = crtc->fb;
         struct intel_framebuffer *intel_fb = to_intel_framebuffer(fb);
-        struct drm_i915_gem_object *obj_priv = intel_fb->obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(intel_fb->obj);
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         int plane = (intel_crtc->plane == 0 ? DPFC_CTL_PLANEA :
                      DPFC_CTL_PLANEB);
@@ -1176,7 +1176,7 @@ static void intel_update_fbc(struct drm_crtc *crtc,
                 return;
 
         intel_fb = to_intel_framebuffer(fb);
-        obj_priv = intel_fb->obj->driver_private;
+        obj_priv = to_intel_bo(intel_fb->obj);
 
         /*
          * If FBC is already on, we just have to verify that we can
@@ -1243,7 +1243,7 @@ out_disable:
 static int
 intel_pin_and_fence_fb_obj(struct drm_device *dev, struct drm_gem_object *obj)
 {
-        struct drm_i915_gem_object *obj_priv = obj->driver_private;
+        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
         u32 alignment;
         int ret;
 
@@ -1323,7 +1323,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 
         intel_fb = to_intel_framebuffer(crtc->fb);
         obj = intel_fb->obj;
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
 
         mutex_lock(&dev->struct_mutex);
         ret = intel_pin_and_fence_fb_obj(dev, obj);
@@ -1401,7 +1401,7 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
 
         if (old_fb) {
                 intel_fb = to_intel_framebuffer(old_fb);
-                obj_priv = intel_fb->obj->driver_private;
+                obj_priv = to_intel_bo(intel_fb->obj);
                 i915_gem_object_unpin(intel_fb->obj);
         }
         intel_increase_pllclock(crtc, true);
@@ -2917,7 +2917,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
         int dspsize_reg = (plane == 0) ? DSPASIZE : DSPBSIZE;
         int dsppos_reg = (plane == 0) ? DSPAPOS : DSPBPOS;
         int pipesrc_reg = (pipe == 0) ? PIPEASRC : PIPEBSRC;
-        int refclk, num_outputs = 0;
+        int refclk, num_connectors = 0;
         intel_clock_t clock, reduced_clock;
         u32 dpll = 0, fp = 0, fp2 = 0, dspcntr, pipeconf;
         bool ok, has_reduced_clock = false, is_sdvo = false, is_dvo = false;
@@ -2943,19 +2943,19 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
         drm_vblank_pre_modeset(dev, pipe);
 
         list_for_each_entry(connector, &mode_config->connector_list, head) {
-                struct intel_output *intel_output = to_intel_output(connector);
+                struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
                 if (!connector->encoder || connector->encoder->crtc != crtc)
                         continue;
 
-                switch (intel_output->type) {
+                switch (intel_encoder->type) {
                 case INTEL_OUTPUT_LVDS:
                         is_lvds = true;
                         break;
                 case INTEL_OUTPUT_SDVO:
                 case INTEL_OUTPUT_HDMI:
                         is_sdvo = true;
-                        if (intel_output->needs_tv_clock)
+                        if (intel_encoder->needs_tv_clock)
                                 is_tv = true;
                         break;
                 case INTEL_OUTPUT_DVO:
@@ -2975,10 +2975,10 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                         break;
                 }
 
-                num_outputs++;
+                num_connectors++;
         }
 
-        if (is_lvds && dev_priv->lvds_use_ssc && num_outputs < 2) {
+        if (is_lvds && dev_priv->lvds_use_ssc && num_connectors < 2) {
                 refclk = dev_priv->lvds_ssc_freq * 1000;
                 DRM_DEBUG_KMS("using SSC reference clock of %d MHz\n",
                                         refclk / 1000);
@@ -3049,8 +3049,8 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                 if (is_edp) {
                         struct drm_connector *edp;
                         target_clock = mode->clock;
-                        edp = intel_pipe_get_output(crtc);
-                        intel_edp_link_config(to_intel_output(edp),
+                        edp = intel_pipe_get_connector(crtc);
+                        intel_edp_link_config(to_intel_encoder(edp),
                                         &lane, &link_bw);
                 } else {
                         /* DP over FDI requires target mode clock
@@ -3231,7 +3231,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                 /* XXX: just matching BIOS for now */
                 /*      dpll |= PLL_REF_INPUT_TVCLKINBC; */
                 dpll |= 3;
-        else if (is_lvds && dev_priv->lvds_use_ssc && num_outputs < 2)
+        else if (is_lvds && dev_priv->lvds_use_ssc && num_connectors < 2)
                 dpll |= PLLB_REF_INPUT_SPREADSPECTRUMIN;
         else
                 dpll |= PLL_REF_INPUT_DREFCLK;
@@ -3511,7 +3511,7 @@ static int intel_crtc_cursor_set(struct drm_crtc *crtc,
         if (!bo)
                 return -ENOENT;
 
-        obj_priv = bo->driver_private;
+        obj_priv = to_intel_bo(bo);
 
         if (bo->size < width * height * 4) {
                 DRM_ERROR("buffer is to small\n");
@@ -3655,9 +3655,9 @@ static void intel_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green,
  * detection.
  *
  * It will be up to the load-detect code to adjust the pipe as appropriate for
- * its requirements.  The pipe will be connected to no other outputs.
+ * its requirements.  The pipe will be connected to no other encoders.
  *
- * Currently this code will only succeed if there is a pipe with no outputs
+ * Currently this code will only succeed if there is a pipe with no encoders
  * configured for it.  In the future, it could choose to temporarily disable
  * some outputs to free up a pipe for its use.
  *
@@ -3670,14 +3670,14 @@ static struct drm_display_mode load_detect_mode = {
                  704, 832, 0, 480, 489, 491, 520, 0, DRM_MODE_FLAG_NHSYNC | DRM_MODE_FLAG_NVSYNC),
 };
 
-struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
+struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
                                             struct drm_display_mode *mode,
                                             int *dpms_mode)
 {
         struct intel_crtc *intel_crtc;
         struct drm_crtc *possible_crtc;
         struct drm_crtc *supported_crtc =NULL;
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_crtc *crtc = NULL;
         struct drm_device *dev = encoder->dev;
         struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
@@ -3729,8 +3729,8 @@ struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
         }
 
         encoder->crtc = crtc;
-        intel_output->base.encoder = encoder;
-        intel_output->load_detect_temp = true;
+        intel_encoder->base.encoder = encoder;
+        intel_encoder->load_detect_temp = true;
 
         intel_crtc = to_intel_crtc(crtc);
         *dpms_mode = intel_crtc->dpms_mode;
@@ -3755,23 +3755,23 @@ struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
         return crtc;
 }
 
-void intel_release_load_detect_pipe(struct intel_output *intel_output, int dpms_mode)
+void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder, int dpms_mode)
 {
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_device *dev = encoder->dev;
         struct drm_crtc *crtc = encoder->crtc;
         struct drm_encoder_helper_funcs *encoder_funcs = encoder->helper_private;
         struct drm_crtc_helper_funcs *crtc_funcs = crtc->helper_private;
 
-        if (intel_output->load_detect_temp) {
+        if (intel_encoder->load_detect_temp) {
                 encoder->crtc = NULL;
-                intel_output->base.encoder = NULL;
-                intel_output->load_detect_temp = false;
+                intel_encoder->base.encoder = NULL;
+                intel_encoder->load_detect_temp = false;
                 crtc->enabled = drm_helper_crtc_in_use(crtc);
                 drm_helper_disable_unused_functions(dev);
         }
 
-        /* Switch crtc and output back off if necessary */
+        /* Switch crtc and encoder back off if necessary */
         if (crtc->enabled && dpms_mode != DRM_MODE_DPMS_ON) {
                 if (encoder->crtc == crtc)
                         encoder_funcs->dpms(encoder, dpms_mode);
@@ -4156,7 +4156,7 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
         work = intel_crtc->unpin_work;
         if (work == NULL || !work->pending) {
                 if (work && !work->pending) {
-                        obj_priv = work->pending_flip_obj->driver_private;
+                        obj_priv = to_intel_bo(work->pending_flip_obj);
                         DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n",
                                          obj_priv,
                                          atomic_read(&obj_priv->pending_flip));
@@ -4181,7 +4181,7 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
 
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
-        obj_priv = work->pending_flip_obj->driver_private;
+        obj_priv = to_intel_bo(work->pending_flip_obj);
 
         /* Initial scanout buffer will have a 0 pending flip count */
         if ((atomic_read(&obj_priv->pending_flip) == 0) ||
@@ -4252,7 +4252,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         ret = intel_pin_and_fence_fb_obj(dev, obj);
         if (ret != 0) {
                 DRM_DEBUG_DRIVER("flip queue: %p pin & fence failed\n",
-                          obj->driver_private);
+                          to_intel_bo(obj));
                 kfree(work);
                 intel_crtc->unpin_work = NULL;
                 mutex_unlock(&dev->struct_mutex);
@@ -4266,7 +4266,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         crtc->fb = fb;
         i915_gem_object_flush_write_domain(obj);
         drm_vblank_get(dev, intel_crtc->pipe);
-        obj_priv = obj->driver_private;
+        obj_priv = to_intel_bo(obj);
         atomic_inc(&obj_priv->pending_flip);
         work->pending_flip_obj = obj;
 
@@ -4399,8 +4399,8 @@ static int intel_connector_clones(struct drm_device *dev, int type_mask)
         int entry = 0;
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                struct intel_output *intel_output = to_intel_output(connector);
-                if (type_mask & intel_output->clone_mask)
+                struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+                if (type_mask & intel_encoder->clone_mask)
                         index_mask |= (1 << entry);
                 entry++;
         }
@@ -4495,12 +4495,12 @@ static void intel_setup_outputs(struct drm_device *dev)
                 intel_tv_init(dev);
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                struct intel_output *intel_output = to_intel_output(connector);
-                struct drm_encoder *encoder = &intel_output->enc;
+                struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+                struct drm_encoder *encoder = &intel_encoder->enc;
 
-                encoder->possible_crtcs = intel_output->crtc_mask;
+                encoder->possible_crtcs = intel_encoder->crtc_mask;
                 encoder->possible_clones = intel_connector_clones(dev,
-                                                intel_output->clone_mask);
+                                                intel_encoder->clone_mask);
         }
 }
 
@@ -4779,14 +4779,14 @@ void intel_init_clock_gating(struct drm_device *dev)
                 struct drm_i915_gem_object *obj_priv = NULL;
 
                 if (dev_priv->pwrctx) {
-                        obj_priv = dev_priv->pwrctx->driver_private;
+                        obj_priv = to_intel_bo(dev_priv->pwrctx);
                 } else {
                         struct drm_gem_object *pwrctx;
 
                         pwrctx = intel_alloc_power_context(dev);
                         if (pwrctx) {
                                 dev_priv->pwrctx = pwrctx;
-                                obj_priv = pwrctx->driver_private;
+                                obj_priv = to_intel_bo(pwrctx);
                         }
                 }
 
@@ -4815,7 +4815,7 @@ static void intel_init_display(struct drm_device *dev)
                         dev_priv->display.fbc_enabled = g4x_fbc_enabled;
                         dev_priv->display.enable_fbc = g4x_enable_fbc;
                         dev_priv->display.disable_fbc = g4x_disable_fbc;
-                } else if (IS_I965GM(dev) || IS_I945GM(dev) || IS_I915GM(dev)) {
+                } else if (IS_I965GM(dev)) {
                         dev_priv->display.fbc_enabled = i8xx_fbc_enabled;
                         dev_priv->display.enable_fbc = i8xx_enable_fbc;
                         dev_priv->display.disable_fbc = i8xx_disable_fbc;
@@ -4957,7 +4957,7 @@ void intel_modeset_cleanup(struct drm_device *dev)
         if (dev_priv->pwrctx) {
                 struct drm_i915_gem_object *obj_priv;
 
-                obj_priv = dev_priv->pwrctx->driver_private;
+                obj_priv = to_intel_bo(dev_priv->pwrctx);
                 I915_WRITE(PWRCTXA, obj_priv->gtt_offset &~ PWRCTX_EN);
                 I915_READ(PWRCTXA);
                 i915_gem_object_unpin(dev_priv->pwrctx);
@@ -4978,9 +4978,9 @@ void intel_modeset_cleanup(struct drm_device *dev)
 */
 struct drm_encoder *intel_best_encoder(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
-        return &intel_output->enc;
+        return &intel_encoder->enc;
 }
 
 /*
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 8e283f75941d..77e40cfcf216 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -55,23 +55,23 @@ struct intel_dp_priv {
         uint8_t link_bw;
         uint8_t lane_count;
         uint8_t dpcd[4];
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct i2c_adapter adapter;
         struct i2c_algo_dp_aux_data algo;
 };
 
 static void
-intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
+intel_dp_link_train(struct intel_encoder *intel_encoder, uint32_t DP,
                     uint8_t link_configuration[DP_LINK_CONFIGURATION_SIZE]);
 
 static void
-intel_dp_link_down(struct intel_output *intel_output, uint32_t DP);
+intel_dp_link_down(struct intel_encoder *intel_encoder, uint32_t DP);
 
 void
-intel_edp_link_config (struct intel_output *intel_output,
+intel_edp_link_config (struct intel_encoder *intel_encoder,
                 int *lane_num, int *link_bw)
 {
-        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv   *dp_priv = intel_encoder->dev_priv;
 
         *lane_num = dp_priv->lane_count;
         if (dp_priv->link_bw == DP_LINK_BW_1_62)
@@ -81,9 +81,9 @@ intel_edp_link_config (struct intel_output *intel_output,
 }
 
 static int
-intel_dp_max_lane_count(struct intel_output *intel_output)
+intel_dp_max_lane_count(struct intel_encoder *intel_encoder)
 {
-        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv   *dp_priv = intel_encoder->dev_priv;
         int max_lane_count = 4;
 
         if (dp_priv->dpcd[0] >= 0x11) {
@@ -99,9 +99,9 @@ intel_dp_max_lane_count(struct intel_output *intel_output)
 }
 
 static int
-intel_dp_max_link_bw(struct intel_output *intel_output)
+intel_dp_max_link_bw(struct intel_encoder *intel_encoder)
 {
-        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv   *dp_priv = intel_encoder->dev_priv;
         int max_link_bw = dp_priv->dpcd[1];
 
         switch (max_link_bw) {
@@ -127,11 +127,11 @@ intel_dp_link_clock(uint8_t link_bw)
 /* I think this is a fiction */
 static int
 intel_dp_link_required(struct drm_device *dev,
-                       struct intel_output *intel_output, int pixel_clock)
+                       struct intel_encoder *intel_encoder, int pixel_clock)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        if (IS_eDP(intel_output))
+        if (IS_eDP(intel_encoder))
                 return (pixel_clock * dev_priv->edp_bpp) / 8;
         else
                 return pixel_clock * 3;
@@ -141,11 +141,11 @@ static int
 intel_dp_mode_valid(struct drm_connector *connector,
                     struct drm_display_mode *mode)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_output));
-        int max_lanes = intel_dp_max_lane_count(intel_output);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        int max_link_clock = intel_dp_link_clock(intel_dp_max_link_bw(intel_encoder));
+        int max_lanes = intel_dp_max_lane_count(intel_encoder);
 
-        if (intel_dp_link_required(connector->dev, intel_output, mode->clock)
+        if (intel_dp_link_required(connector->dev, intel_encoder, mode->clock)
                         > max_link_clock * max_lanes)
                 return MODE_CLOCK_HIGH;
 
@@ -209,13 +209,13 @@ intel_hrawclk(struct drm_device *dev)
 }
 
 static int
-intel_dp_aux_ch(struct intel_output *intel_output,
+intel_dp_aux_ch(struct intel_encoder *intel_encoder,
                 uint8_t *send, int send_bytes,
                 uint8_t *recv, int recv_size)
 {
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         uint32_t output_reg = dp_priv->output_reg;
-        struct drm_device *dev = intel_output->base.dev;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t ch_ctl = output_reg + 0x10;
         uint32_t ch_data = ch_ctl + 4;
@@ -230,7 +230,7 @@ intel_dp_aux_ch(struct intel_output *intel_output,
          * and would like to run at 2MHz. So, take the
          * hrawclk value and divide by 2 and use that
          */
-        if (IS_eDP(intel_output))
+        if (IS_eDP(intel_encoder))
                 aux_clock_divider = 225; /* eDP input clock at 450Mhz */
         else if (HAS_PCH_SPLIT(dev))
                 aux_clock_divider = 62; /* IRL input clock fixed at 125Mhz */
@@ -313,7 +313,7 @@ intel_dp_aux_ch(struct intel_output *intel_output,
 
 /* Write data to the aux channel in native mode */
 static int
-intel_dp_aux_native_write(struct intel_output *intel_output,
+intel_dp_aux_native_write(struct intel_encoder *intel_encoder,
                           uint16_t address, uint8_t *send, int send_bytes)
 {
         int ret;
@@ -330,7 +330,7 @@ intel_dp_aux_native_write(struct intel_output *intel_output,
         memcpy(&msg[4], send, send_bytes);
         msg_bytes = send_bytes + 4;
         for (;;) {
-                ret = intel_dp_aux_ch(intel_output, msg, msg_bytes, &ack, 1);
+                ret = intel_dp_aux_ch(intel_encoder, msg, msg_bytes, &ack, 1);
                 if (ret < 0)
                         return ret;
                 if ((ack & AUX_NATIVE_REPLY_MASK) == AUX_NATIVE_REPLY_ACK)
@@ -345,15 +345,15 @@ intel_dp_aux_native_write(struct intel_output *intel_output,
 
 /* Write a single byte to the aux channel in native mode */
 static int
-intel_dp_aux_native_write_1(struct intel_output *intel_output,
+intel_dp_aux_native_write_1(struct intel_encoder *intel_encoder,
                             uint16_t address, uint8_t byte)
 {
-        return intel_dp_aux_native_write(intel_output, address, &byte, 1);
+        return intel_dp_aux_native_write(intel_encoder, address, &byte, 1);
 }
 
 /* read bytes from a native aux channel */
 static int
-intel_dp_aux_native_read(struct intel_output *intel_output,
+intel_dp_aux_native_read(struct intel_encoder *intel_encoder,
                          uint16_t address, uint8_t *recv, int recv_bytes)
 {
         uint8_t msg[4];
@@ -372,7 +372,7 @@ intel_dp_aux_native_read(struct intel_output *intel_output,
         reply_bytes = recv_bytes + 1;
 
         for (;;) {
-                ret = intel_dp_aux_ch(intel_output, msg, msg_bytes,
+                ret = intel_dp_aux_ch(intel_encoder, msg, msg_bytes,
                                       reply, reply_bytes);
                 if (ret == 0)
                         return -EPROTO;
@@ -398,7 +398,7 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
         struct intel_dp_priv *dp_priv = container_of(adapter,
                                                      struct intel_dp_priv,
                                                      adapter);
-        struct intel_output *intel_output = dp_priv->intel_output;
+        struct intel_encoder *intel_encoder = dp_priv->intel_encoder;
         uint16_t address = algo_data->address;
         uint8_t msg[5];
         uint8_t reply[2];
@@ -437,7 +437,7 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
         }
 
         for (;;) {
-          ret = intel_dp_aux_ch(intel_output,
+          ret = intel_dp_aux_ch(intel_encoder,
                                 msg, msg_bytes,
                                 reply, reply_bytes);
                 if (ret < 0) {
@@ -465,9 +465,9 @@ intel_dp_i2c_aux_ch(struct i2c_adapter *adapter, int mode,
 }
 
 static int
-intel_dp_i2c_init(struct intel_output *intel_output, const char *name)
+intel_dp_i2c_init(struct intel_encoder *intel_encoder, const char *name)
 {
-        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv   *dp_priv = intel_encoder->dev_priv;
 
         DRM_DEBUG_KMS("i2c_init %s\n", name);
         dp_priv->algo.running = false;
@@ -480,7 +480,7 @@ intel_dp_i2c_init(struct intel_output *intel_output, const char *name)
         strncpy (dp_priv->adapter.name, name, sizeof(dp_priv->adapter.name) - 1);
         dp_priv->adapter.name[sizeof(dp_priv->adapter.name) - 1] = '\0';
         dp_priv->adapter.algo_data = &dp_priv->algo;
-        dp_priv->adapter.dev.parent = &intel_output->base.kdev;
+        dp_priv->adapter.dev.parent = &intel_encoder->base.kdev;
         
         return i2c_dp_aux_add_bus(&dp_priv->adapter);
 }
@@ -489,18 +489,18 @@ static bool
 intel_dp_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
                     struct drm_display_mode *adjusted_mode)
 {
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dp_priv   *dp_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dp_priv   *dp_priv = intel_encoder->dev_priv;
         int lane_count, clock;
-        int max_lane_count = intel_dp_max_lane_count(intel_output);
-        int max_clock = intel_dp_max_link_bw(intel_output) == DP_LINK_BW_2_7 ? 1 : 0;
+        int max_lane_count = intel_dp_max_lane_count(intel_encoder);
+        int max_clock = intel_dp_max_link_bw(intel_encoder) == DP_LINK_BW_2_7 ? 1 : 0;
         static int bws[2] = { DP_LINK_BW_1_62, DP_LINK_BW_2_7 };
 
         for (lane_count = 1; lane_count <= max_lane_count; lane_count <<= 1) {
                 for (clock = 0; clock <= max_clock; clock++) {
                         int link_avail = intel_dp_link_clock(bws[clock]) * lane_count;
 
-                        if (intel_dp_link_required(encoder->dev, intel_output, mode->clock)
+                        if (intel_dp_link_required(encoder->dev, intel_encoder, mode->clock)
                                         <= link_avail) {
                                 dp_priv->link_bw = bws[clock];
                                 dp_priv->lane_count = lane_count;
@@ -562,16 +562,16 @@ intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
         struct intel_dp_m_n m_n;
 
         /*
-         * Find the lane count in the intel_output private
+         * Find the lane count in the intel_encoder private
          */
         list_for_each_entry(connector, &mode_config->connector_list, head) {
-                struct intel_output *intel_output = to_intel_output(connector);
-                struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+                struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+                struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
 
                 if (!connector->encoder || connector->encoder->crtc != crtc)
                         continue;
 
-                if (intel_output->type == INTEL_OUTPUT_DISPLAYPORT) {
+                if (intel_encoder->type == INTEL_OUTPUT_DISPLAYPORT) {
                         lane_count = dp_priv->lane_count;
                         break;
                 }
@@ -626,9 +626,9 @@ static void
 intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
                   struct drm_display_mode *adjusted_mode)
 {
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
-        struct drm_crtc *crtc = intel_output->enc.crtc;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
+        struct drm_crtc *crtc = intel_encoder->enc.crtc;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
 
         dp_priv->DP = (DP_LINK_TRAIN_OFF |
@@ -667,7 +667,7 @@ intel_dp_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
         if (intel_crtc->pipe == 1)
                 dp_priv->DP |= DP_PIPEB_SELECT;
 
-        if (IS_eDP(intel_output)) {
+        if (IS_eDP(intel_encoder)) {
                 /* don't miss out required setting for eDP */
                 dp_priv->DP |= DP_PLL_ENABLE;
                 if (adjusted_mode->clock < 200000)
@@ -702,22 +702,22 @@ static void ironlake_edp_backlight_off (struct drm_device *dev)
 static void
 intel_dp_dpms(struct drm_encoder *encoder, int mode)
 {
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
-        struct drm_device *dev = intel_output->base.dev;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         uint32_t dp_reg = I915_READ(dp_priv->output_reg);
 
         if (mode != DRM_MODE_DPMS_ON) {
                 if (dp_reg & DP_PORT_EN) {
-                        intel_dp_link_down(intel_output, dp_priv->DP);
-                        if (IS_eDP(intel_output))
+                        intel_dp_link_down(intel_encoder, dp_priv->DP);
+                        if (IS_eDP(intel_encoder))
                                 ironlake_edp_backlight_off(dev);
                 }
         } else {
                 if (!(dp_reg & DP_PORT_EN)) {
-                        intel_dp_link_train(intel_output, dp_priv->DP, dp_priv->link_configuration);
-                        if (IS_eDP(intel_output))
+                        intel_dp_link_train(intel_encoder, dp_priv->DP, dp_priv->link_configuration);
+                        if (IS_eDP(intel_encoder))
                                 ironlake_edp_backlight_on(dev);
                 }
         }
@@ -729,12 +729,12 @@ intel_dp_dpms(struct drm_encoder *encoder, int mode)
  * link status information
  */
 static bool
-intel_dp_get_link_status(struct intel_output *intel_output,
+intel_dp_get_link_status(struct intel_encoder *intel_encoder,
                          uint8_t link_status[DP_LINK_STATUS_SIZE])
 {
         int ret;
 
-        ret = intel_dp_aux_native_read(intel_output,
+        ret = intel_dp_aux_native_read(intel_encoder,
                                        DP_LANE0_1_STATUS,
                                        link_status, DP_LINK_STATUS_SIZE);
         if (ret != DP_LINK_STATUS_SIZE)
@@ -752,13 +752,13 @@ intel_dp_link_status(uint8_t link_status[DP_LINK_STATUS_SIZE],
 static void
 intel_dp_save(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct drm_device *dev = intel_output->base.dev;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
 
         dp_priv->save_DP = I915_READ(dp_priv->output_reg);
-        intel_dp_aux_native_read(intel_output, DP_LINK_BW_SET,
+        intel_dp_aux_native_read(intel_encoder, DP_LINK_BW_SET,
                                  dp_priv->save_link_configuration,
                                  sizeof (dp_priv->save_link_configuration));
 }
@@ -825,7 +825,7 @@ intel_dp_pre_emphasis_max(uint8_t voltage_swing)
 }
 
 static void
-intel_get_adjust_train(struct intel_output *intel_output,
+intel_get_adjust_train(struct intel_encoder *intel_encoder,
                        uint8_t link_status[DP_LINK_STATUS_SIZE],
                        int lane_count,
                        uint8_t train_set[4])
@@ -942,15 +942,15 @@ intel_channel_eq_ok(uint8_t link_status[DP_LINK_STATUS_SIZE], int lane_count)
 }
 
 static bool
-intel_dp_set_link_train(struct intel_output *intel_output,
+intel_dp_set_link_train(struct intel_encoder *intel_encoder,
                         uint32_t dp_reg_value,
                         uint8_t dp_train_pat,
                         uint8_t train_set[4],
                         bool first)
 {
-        struct drm_device *dev = intel_output->base.dev;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         int ret;
 
         I915_WRITE(dp_priv->output_reg, dp_reg_value);
@@ -958,11 +958,11 @@ intel_dp_set_link_train(struct intel_output *intel_output,
         if (first)
                 intel_wait_for_vblank(dev);
 
-        intel_dp_aux_native_write_1(intel_output,
+        intel_dp_aux_native_write_1(intel_encoder,
                                     DP_TRAINING_PATTERN_SET,
                                     dp_train_pat);
 
-        ret = intel_dp_aux_native_write(intel_output,
+        ret = intel_dp_aux_native_write(intel_encoder,
                                         DP_TRAINING_LANE0_SET, train_set, 4);
         if (ret != 4)
                 return false;
@@ -971,12 +971,12 @@ intel_dp_set_link_train(struct intel_output *intel_output,
 }
 
 static void
-intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
+intel_dp_link_train(struct intel_encoder *intel_encoder, uint32_t DP,
                     uint8_t link_configuration[DP_LINK_CONFIGURATION_SIZE])
 {
-        struct drm_device *dev = intel_output->base.dev;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         uint8_t train_set[4];
         uint8_t link_status[DP_LINK_STATUS_SIZE];
         int i;
@@ -987,7 +987,7 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
         int tries;
 
         /* Write the link configuration data */
-        intel_dp_aux_native_write(intel_output, 0x100,
+        intel_dp_aux_native_write(intel_encoder, 0x100,
                                   link_configuration, DP_LINK_CONFIGURATION_SIZE);
 
         DP |= DP_PORT_EN;
@@ -1001,14 +1001,14 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
                 uint32_t    signal_levels = intel_dp_signal_levels(train_set[0], dp_priv->lane_count);
                 DP = (DP & ~(DP_VOLTAGE_MASK|DP_PRE_EMPHASIS_MASK)) | signal_levels;
 
-                if (!intel_dp_set_link_train(intel_output, DP | DP_LINK_TRAIN_PAT_1,
+                if (!intel_dp_set_link_train(intel_encoder, DP | DP_LINK_TRAIN_PAT_1,
                                              DP_TRAINING_PATTERN_1, train_set, first))
                         break;
                 first = false;
                 /* Set training pattern 1 */
 
                 udelay(100);
-                if (!intel_dp_get_link_status(intel_output, link_status))
+                if (!intel_dp_get_link_status(intel_encoder, link_status))
                         break;
 
                 if (intel_clock_recovery_ok(link_status, dp_priv->lane_count)) {
@@ -1033,7 +1033,7 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
                 voltage = train_set[0] & DP_TRAIN_VOLTAGE_SWING_MASK;
 
                 /* Compute new train_set as requested by target */
-                intel_get_adjust_train(intel_output, link_status, dp_priv->lane_count, train_set);
+                intel_get_adjust_train(intel_encoder, link_status, dp_priv->lane_count, train_set);
         }
 
         /* channel equalization */
@@ -1045,13 +1045,13 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
                 DP = (DP & ~(DP_VOLTAGE_MASK|DP_PRE_EMPHASIS_MASK)) | signal_levels;
 
                 /* channel eq pattern */
-                if (!intel_dp_set_link_train(intel_output, DP | DP_LINK_TRAIN_PAT_2,
+                if (!intel_dp_set_link_train(intel_encoder, DP | DP_LINK_TRAIN_PAT_2,
                                              DP_TRAINING_PATTERN_2, train_set,
                                              false))
                         break;
 
                 udelay(400);
-                if (!intel_dp_get_link_status(intel_output, link_status))
+                if (!intel_dp_get_link_status(intel_encoder, link_status))
                         break;
 
                 if (intel_channel_eq_ok(link_status, dp_priv->lane_count)) {
@@ -1064,26 +1064,26 @@ intel_dp_link_train(struct intel_output *intel_output, uint32_t DP,
                         break;
 
                 /* Compute new train_set as requested by target */
-                intel_get_adjust_train(intel_output, link_status, dp_priv->lane_count, train_set);
+                intel_get_adjust_train(intel_encoder, link_status, dp_priv->lane_count, train_set);
                 ++tries;
         }
 
         I915_WRITE(dp_priv->output_reg, DP | DP_LINK_TRAIN_OFF);
         POSTING_READ(dp_priv->output_reg);
-        intel_dp_aux_native_write_1(intel_output,
+        intel_dp_aux_native_write_1(intel_encoder,
                                     DP_TRAINING_PATTERN_SET, DP_TRAINING_PATTERN_DISABLE);
 }
 
 static void
-intel_dp_link_down(struct intel_output *intel_output, uint32_t DP)
+intel_dp_link_down(struct intel_encoder *intel_encoder, uint32_t DP)
 {
-        struct drm_device *dev = intel_output->base.dev;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
 
         DRM_DEBUG_KMS("\n");
 
-        if (IS_eDP(intel_output)) {
+        if (IS_eDP(intel_encoder)) {
                 DP &= ~DP_PLL_ENABLE;
                 I915_WRITE(dp_priv->output_reg, DP);
                 POSTING_READ(dp_priv->output_reg);
@@ -1096,7 +1096,7 @@ intel_dp_link_down(struct intel_output *intel_output, uint32_t DP)
 
         udelay(17000);
 
-        if (IS_eDP(intel_output))
+        if (IS_eDP(intel_encoder))
                 DP |= DP_LINK_TRAIN_OFF;
         I915_WRITE(dp_priv->output_reg, DP & ~DP_PORT_EN);
         POSTING_READ(dp_priv->output_reg);
@@ -1105,13 +1105,13 @@ intel_dp_link_down(struct intel_output *intel_output, uint32_t DP)
 static void
 intel_dp_restore(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
 
         if (dp_priv->save_DP & DP_PORT_EN)
-                intel_dp_link_train(intel_output, dp_priv->save_DP, dp_priv->save_link_configuration);
+                intel_dp_link_train(intel_encoder, dp_priv->save_DP, dp_priv->save_link_configuration);
         else
-                intel_dp_link_down(intel_output,  dp_priv->save_DP);
+                intel_dp_link_down(intel_encoder,  dp_priv->save_DP);
 }
 
 /*
@@ -1124,32 +1124,32 @@ intel_dp_restore(struct drm_connector *connector)
  */
 
 static void
-intel_dp_check_link_status(struct intel_output *intel_output)
+intel_dp_check_link_status(struct intel_encoder *intel_encoder)
 {
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         uint8_t link_status[DP_LINK_STATUS_SIZE];
 
-        if (!intel_output->enc.crtc)
+        if (!intel_encoder->enc.crtc)
                 return;
 
-        if (!intel_dp_get_link_status(intel_output, link_status)) {
-                intel_dp_link_down(intel_output, dp_priv->DP);
+        if (!intel_dp_get_link_status(intel_encoder, link_status)) {
+                intel_dp_link_down(intel_encoder, dp_priv->DP);
                 return;
         }
 
         if (!intel_channel_eq_ok(link_status, dp_priv->lane_count))
-                intel_dp_link_train(intel_output, dp_priv->DP, dp_priv->link_configuration);
+                intel_dp_link_train(intel_encoder, dp_priv->DP, dp_priv->link_configuration);
 }
 
 static enum drm_connector_status
 ironlake_dp_detect(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         enum drm_connector_status status;
 
         status = connector_status_disconnected;
-        if (intel_dp_aux_native_read(intel_output,
+        if (intel_dp_aux_native_read(intel_encoder,
                                      0x000, dp_priv->dpcd,
                                      sizeof (dp_priv->dpcd)) == sizeof (dp_priv->dpcd))
         {
@@ -1168,10 +1168,10 @@ ironlake_dp_detect(struct drm_connector *connector)
 static enum drm_connector_status
 intel_dp_detect(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct drm_device *dev = intel_output->base.dev;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
         uint32_t temp, bit;
         enum drm_connector_status status;
 
@@ -1210,7 +1210,7 @@ intel_dp_detect(struct drm_connector *connector)
                 return connector_status_disconnected;
 
         status = connector_status_disconnected;
-        if (intel_dp_aux_native_read(intel_output,
+        if (intel_dp_aux_native_read(intel_encoder,
                                      0x000, dp_priv->dpcd,
                                      sizeof (dp_priv->dpcd)) == sizeof (dp_priv->dpcd))
         {
@@ -1222,20 +1222,20 @@ intel_dp_detect(struct drm_connector *connector)
 
 static int intel_dp_get_modes(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct drm_device *dev = intel_output->base.dev;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         int ret;
 
         /* We should parse the EDID data and find out if it has an audio sink
          */
 
-        ret = intel_ddc_get_modes(intel_output);
+        ret = intel_ddc_get_modes(intel_encoder);
         if (ret)
                 return ret;
 
         /* if eDP has no EDID, try to use fixed panel mode from VBT */
-        if (IS_eDP(intel_output)) {
+        if (IS_eDP(intel_encoder)) {
                 if (dev_priv->panel_fixed_mode != NULL) {
                         struct drm_display_mode *mode;
                         mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
@@ -1249,13 +1249,13 @@ static int intel_dp_get_modes(struct drm_connector *connector)
 static void
 intel_dp_destroy (struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
-        if (intel_output->i2c_bus)
-                intel_i2c_destroy(intel_output->i2c_bus);
+        if (intel_encoder->i2c_bus)
+                intel_i2c_destroy(intel_encoder->i2c_bus);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
 
 static const struct drm_encoder_helper_funcs intel_dp_helper_funcs = {
@@ -1291,12 +1291,12 @@ static const struct drm_encoder_funcs intel_dp_enc_funcs = {
 };
 
 void
-intel_dp_hot_plug(struct intel_output *intel_output)
+intel_dp_hot_plug(struct intel_encoder *intel_encoder)
 {
-        struct intel_dp_priv *dp_priv = intel_output->dev_priv;
+        struct intel_dp_priv *dp_priv = intel_encoder->dev_priv;
 
         if (dp_priv->dpms_mode == DRM_MODE_DPMS_ON)
-                intel_dp_check_link_status(intel_output);
+                intel_dp_check_link_status(intel_encoder);
 }
 
 void
@@ -1304,53 +1304,53 @@ intel_dp_init(struct drm_device *dev, int output_reg)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_dp_priv *dp_priv;
         const char *name = NULL;
 
-        intel_output = kcalloc(sizeof(struct intel_output) + 
+        intel_encoder = kcalloc(sizeof(struct intel_encoder) +
                                sizeof(struct intel_dp_priv), 1, GFP_KERNEL);
-        if (!intel_output)
+        if (!intel_encoder)
                 return;
 
-        dp_priv = (struct intel_dp_priv *)(intel_output + 1);
+        dp_priv = (struct intel_dp_priv *)(intel_encoder + 1);
 
-        connector = &intel_output->base;
+        connector = &intel_encoder->base;
         drm_connector_init(dev, connector, &intel_dp_connector_funcs,
                            DRM_MODE_CONNECTOR_DisplayPort);
         drm_connector_helper_add(connector, &intel_dp_connector_helper_funcs);
 
         if (output_reg == DP_A)
-                intel_output->type = INTEL_OUTPUT_EDP;
+                intel_encoder->type = INTEL_OUTPUT_EDP;
         else
-                intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
+                intel_encoder->type = INTEL_OUTPUT_DISPLAYPORT;
 
         if (output_reg == DP_B || output_reg == PCH_DP_B)
-                intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
+                intel_encoder->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
         else if (output_reg == DP_C || output_reg == PCH_DP_C)
-                intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
+                intel_encoder->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
         else if (output_reg == DP_D || output_reg == PCH_DP_D)
-                intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
+                intel_encoder->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
 
-        if (IS_eDP(intel_output))
-                intel_output->clone_mask = (1 << INTEL_EDP_CLONE_BIT);
+        if (IS_eDP(intel_encoder))
+                intel_encoder->clone_mask = (1 << INTEL_EDP_CLONE_BIT);
 
-        intel_output->crtc_mask = (1 << 0) | (1 << 1);
+        intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
         connector->interlace_allowed = true;
         connector->doublescan_allowed = 0;
 
-        dp_priv->intel_output = intel_output;
+        dp_priv->intel_encoder = intel_encoder;
         dp_priv->output_reg = output_reg;
         dp_priv->has_audio = false;
         dp_priv->dpms_mode = DRM_MODE_DPMS_ON;
-        intel_output->dev_priv = dp_priv;
+        intel_encoder->dev_priv = dp_priv;
 
-        drm_encoder_init(dev, &intel_output->enc, &intel_dp_enc_funcs,
+        drm_encoder_init(dev, &intel_encoder->enc, &intel_dp_enc_funcs,
                          DRM_MODE_ENCODER_TMDS);
-        drm_encoder_helper_add(&intel_output->enc, &intel_dp_helper_funcs);
+        drm_encoder_helper_add(&intel_encoder->enc, &intel_dp_helper_funcs);
 
-        drm_mode_connector_attach_encoder(&intel_output->base,
-                                          &intel_output->enc);
+        drm_mode_connector_attach_encoder(&intel_encoder->base,
+                                          &intel_encoder->enc);
         drm_sysfs_connector_add(connector);
 
         /* Set up the DDC bus. */
@@ -1378,10 +1378,10 @@ intel_dp_init(struct drm_device *dev, int output_reg)
                         break;
         }
 
-        intel_dp_i2c_init(intel_output, name);
+        intel_dp_i2c_init(intel_encoder, name);
 
-        intel_output->ddc_bus = &dp_priv->adapter;
-        intel_output->hot_plug = intel_dp_hot_plug;
+        intel_encoder->ddc_bus = &dp_priv->adapter;
+        intel_encoder->hot_plug = intel_dp_hot_plug;
 
         if (output_reg == DP_A) {
                 /* initialize panel mode from VBT if available for eDP */
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 3a467ca57857..e30253755f12 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -95,7 +95,7 @@ struct intel_framebuffer {
 };
 
 
-struct intel_output {
+struct intel_encoder {
         struct drm_connector base;
 
         struct drm_encoder enc;
@@ -105,7 +105,7 @@ struct intel_output {
         bool load_detect_temp;
         bool needs_tv_clock;
         void *dev_priv;
-        void (*hot_plug)(struct intel_output *);
+        void (*hot_plug)(struct intel_encoder *);
         int crtc_mask;
         int clone_mask;
 };
@@ -152,15 +152,15 @@ struct intel_crtc {
 };
 
 #define to_intel_crtc(x) container_of(x, struct intel_crtc, base)
-#define to_intel_output(x) container_of(x, struct intel_output, base)
-#define enc_to_intel_output(x) container_of(x, struct intel_output, enc)
+#define to_intel_encoder(x) container_of(x, struct intel_encoder, base)
+#define enc_to_intel_encoder(x) container_of(x, struct intel_encoder, enc)
 #define to_intel_framebuffer(x) container_of(x, struct intel_framebuffer, base)
 
 struct i2c_adapter *intel_i2c_create(struct drm_device *dev, const u32 reg,
                                      const char *name);
 void intel_i2c_destroy(struct i2c_adapter *adapter);
-int intel_ddc_get_modes(struct intel_output *intel_output);
-extern bool intel_ddc_probe(struct intel_output *intel_output);
+int intel_ddc_get_modes(struct intel_encoder *intel_encoder);
+extern bool intel_ddc_probe(struct intel_encoder *intel_encoder);
 void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
 void intel_i2c_reset_gmbus(struct drm_device *dev);
 
@@ -175,7 +175,7 @@ extern void intel_dp_init(struct drm_device *dev, int dp_reg);
 void
 intel_dp_set_m_n(struct drm_crtc *crtc, struct drm_display_mode *mode,
                  struct drm_display_mode *adjusted_mode);
-extern void intel_edp_link_config (struct intel_output *, int *, int *);
+extern void intel_edp_link_config (struct intel_encoder *, int *, int *);
 
 
 extern int intel_panel_fitter_pipe (struct drm_device *dev);
@@ -191,10 +191,10 @@ int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                 struct drm_file *file_priv);
 extern void intel_wait_for_vblank(struct drm_device *dev);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
-extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
+extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
                                                    struct drm_display_mode *mode,
                                                    int *dpms_mode);
-extern void intel_release_load_detect_pipe(struct intel_output *intel_output,
+extern void intel_release_load_detect_pipe(struct intel_encoder *intel_encoder,
                                            int dpms_mode);
 
 extern struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB);
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 0427ca5a2514..ebf213c96b9c 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -80,8 +80,8 @@ static struct intel_dvo_device intel_dvo_devices[] = {
 static void intel_dvo_dpms(struct drm_encoder *encoder, int mode)
 {
         struct drm_i915_private *dev_priv = encoder->dev->dev_private;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
         u32 dvo_reg = dvo->dvo_reg;
         u32 temp = I915_READ(dvo_reg);
 
@@ -99,8 +99,8 @@ static void intel_dvo_dpms(struct drm_encoder *encoder, int mode)
 static void intel_dvo_save(struct drm_connector *connector)
 {
         struct drm_i915_private *dev_priv = connector->dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         /* Each output should probably just save the registers it touches,
          * but for now, use more overkill.
@@ -115,8 +115,8 @@ static void intel_dvo_save(struct drm_connector *connector)
 static void intel_dvo_restore(struct drm_connector *connector)
 {
         struct drm_i915_private *dev_priv = connector->dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         dvo->dev_ops->restore(dvo);
 
@@ -128,8 +128,8 @@ static void intel_dvo_restore(struct drm_connector *connector)
 static int intel_dvo_mode_valid(struct drm_connector *connector,
                                 struct drm_display_mode *mode)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
                 return MODE_NO_DBLESCAN;
@@ -150,8 +150,8 @@ static bool intel_dvo_mode_fixup(struct drm_encoder *encoder,
                                  struct drm_display_mode *mode,
                                  struct drm_display_mode *adjusted_mode)
 {
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         /* If we have timings from the BIOS for the panel, put them in
          * to the adjusted mode.  The CRTC will be set up for this mode,
@@ -186,8 +186,8 @@ static void intel_dvo_mode_set(struct drm_encoder *encoder,
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(encoder->crtc);
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
         int pipe = intel_crtc->pipe;
         u32 dvo_val;
         u32 dvo_reg = dvo->dvo_reg, dvo_srcdim_reg;
@@ -241,23 +241,23 @@ static void intel_dvo_mode_set(struct drm_encoder *encoder,
  */
 static enum drm_connector_status intel_dvo_detect(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         return dvo->dev_ops->detect(dvo);
 }
 
 static int intel_dvo_get_modes(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         /* We should probably have an i2c driver get_modes function for those
          * devices which will have a fixed set of modes determined by the chip
          * (TV-out, for example), but for now with just TMDS and LVDS,
          * that's not the case.
          */
-        intel_ddc_get_modes(intel_output);
+        intel_ddc_get_modes(intel_encoder);
         if (!list_empty(&connector->probed_modes))
                 return 1;
 
@@ -275,8 +275,8 @@ static int intel_dvo_get_modes(struct drm_connector *connector)
 
 static void intel_dvo_destroy (struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
 
         if (dvo) {
                 if (dvo->dev_ops->destroy)
@@ -286,13 +286,13 @@ static void intel_dvo_destroy (struct drm_connector *connector)
                 /* no need, in i830_dvoices[] now */
                 //kfree(dvo);
         }
-        if (intel_output->i2c_bus)
-                intel_i2c_destroy(intel_output->i2c_bus);
-        if (intel_output->ddc_bus)
-                intel_i2c_destroy(intel_output->ddc_bus);
+        if (intel_encoder->i2c_bus)
+                intel_i2c_destroy(intel_encoder->i2c_bus);
+        if (intel_encoder->ddc_bus)
+                intel_i2c_destroy(intel_encoder->ddc_bus);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
 
 #ifdef RANDR_GET_CRTC_INTERFACE
@@ -300,8 +300,8 @@ static struct drm_crtc *intel_dvo_get_crtc(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
         int pipe = !!(I915_READ(dvo->dvo_reg) & SDVO_PIPE_B_SELECT);
 
         return intel_pipe_to_crtc(pScrn, pipe);
@@ -352,8 +352,8 @@ intel_dvo_get_current_mode (struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_dvo_device *dvo = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_dvo_device *dvo = intel_encoder->dev_priv;
         uint32_t dvo_reg = dvo->dvo_reg;
         uint32_t dvo_val = I915_READ(dvo_reg);
         struct drm_display_mode *mode = NULL;
@@ -383,24 +383,24 @@ intel_dvo_get_current_mode (struct drm_connector *connector)
 
 void intel_dvo_init(struct drm_device *dev)
 {
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_dvo_device *dvo;
         struct i2c_adapter *i2cbus = NULL;
         int ret = 0;
         int i;
         int encoder_type = DRM_MODE_ENCODER_NONE;
-        intel_output = kzalloc (sizeof(struct intel_output), GFP_KERNEL);
-        if (!intel_output)
+        intel_encoder = kzalloc (sizeof(struct intel_encoder), GFP_KERNEL);
+        if (!intel_encoder)
                 return;
 
         /* Set up the DDC bus */
-        intel_output->ddc_bus = intel_i2c_create(dev, GPIOD, "DVODDC_D");
-        if (!intel_output->ddc_bus)
+        intel_encoder->ddc_bus = intel_i2c_create(dev, GPIOD, "DVODDC_D");
+        if (!intel_encoder->ddc_bus)
                 goto free_intel;
 
         /* Now, try to find a controller */
         for (i = 0; i < ARRAY_SIZE(intel_dvo_devices); i++) {
-                struct drm_connector *connector = &intel_output->base;
+                struct drm_connector *connector = &intel_encoder->base;
                 int gpio;
 
                 dvo = &intel_dvo_devices[i];
@@ -435,11 +435,11 @@ void intel_dvo_init(struct drm_device *dev)
                 if (!ret)
                         continue;
 
-                intel_output->type = INTEL_OUTPUT_DVO;
-                intel_output->crtc_mask = (1 << 0) | (1 << 1);
+                intel_encoder->type = INTEL_OUTPUT_DVO;
+                intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
                 switch (dvo->type) {
                 case INTEL_DVO_CHIP_TMDS:
-                        intel_output->clone_mask =
+                        intel_encoder->clone_mask =
                                 (1 << INTEL_DVO_TMDS_CLONE_BIT) |
                                 (1 << INTEL_ANALOG_CLONE_BIT);
                         drm_connector_init(dev, connector,
@@ -448,7 +448,7 @@ void intel_dvo_init(struct drm_device *dev)
                         encoder_type = DRM_MODE_ENCODER_TMDS;
                         break;
                 case INTEL_DVO_CHIP_LVDS:
-                        intel_output->clone_mask =
+                        intel_encoder->clone_mask =
                                 (1 << INTEL_DVO_LVDS_CLONE_BIT);
                         drm_connector_init(dev, connector,
                                            &intel_dvo_connector_funcs,
@@ -463,16 +463,16 @@ void intel_dvo_init(struct drm_device *dev)
                 connector->interlace_allowed = false;
                 connector->doublescan_allowed = false;
 
-                intel_output->dev_priv = dvo;
-                intel_output->i2c_bus = i2cbus;
+                intel_encoder->dev_priv = dvo;
+                intel_encoder->i2c_bus = i2cbus;
 
-                drm_encoder_init(dev, &intel_output->enc,
+                drm_encoder_init(dev, &intel_encoder->enc,
                                  &intel_dvo_enc_funcs, encoder_type);
-                drm_encoder_helper_add(&intel_output->enc,
+                drm_encoder_helper_add(&intel_encoder->enc,
                                        &intel_dvo_helper_funcs);
 
-                drm_mode_connector_attach_encoder(&intel_output->base,
-                                                  &intel_output->enc);
+                drm_mode_connector_attach_encoder(&intel_encoder->base,
+                                                  &intel_encoder->enc);
                 if (dvo->type == INTEL_DVO_CHIP_LVDS) {
                         /* For our LVDS chipsets, we should hopefully be able
                          * to dig the fixed panel mode out of the BIOS data.
@@ -490,10 +490,10 @@ void intel_dvo_init(struct drm_device *dev)
                 return;
         }
 
-        intel_i2c_destroy(intel_output->ddc_bus);
+        intel_i2c_destroy(intel_encoder->ddc_bus);
         /* Didn't find a chip, so tear down. */
         if (i2cbus != NULL)
                 intel_i2c_destroy(i2cbus);
 free_intel:
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 69bbef92f130..8a0b3bcdc7b1 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -144,7 +144,7 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
                 ret = -ENOMEM;
                 goto out;
         }
-        obj_priv = fbo->driver_private;
+        obj_priv = to_intel_bo(fbo);
 
         mutex_lock(&dev->struct_mutex);
 
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 1ed02f641258..48cade0cf7b1 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -51,8 +51,8 @@ static void intel_hdmi_mode_set(struct drm_encoder *encoder,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_crtc *crtc = encoder->crtc;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_hdmi_priv *hdmi_priv = intel_encoder->dev_priv;
         u32 sdvox;
 
         sdvox = SDVO_ENCODING_HDMI |
@@ -74,8 +74,8 @@ static void intel_hdmi_dpms(struct drm_encoder *encoder, int mode)
 {
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_hdmi_priv *hdmi_priv = intel_encoder->dev_priv;
         u32 temp;
 
         temp = I915_READ(hdmi_priv->sdvox_reg);
@@ -110,8 +110,8 @@ static void intel_hdmi_save(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_hdmi_priv *hdmi_priv = intel_encoder->dev_priv;
 
         hdmi_priv->save_SDVOX = I915_READ(hdmi_priv->sdvox_reg);
 }
@@ -120,8 +120,8 @@ static void intel_hdmi_restore(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_hdmi_priv *hdmi_priv = intel_encoder->dev_priv;
 
         I915_WRITE(hdmi_priv->sdvox_reg, hdmi_priv->save_SDVOX);
         POSTING_READ(hdmi_priv->sdvox_reg);
@@ -151,21 +151,21 @@ static bool intel_hdmi_mode_fixup(struct drm_encoder *encoder,
 static enum drm_connector_status
 intel_hdmi_detect(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_hdmi_priv *hdmi_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_hdmi_priv *hdmi_priv = intel_encoder->dev_priv;
         struct edid *edid = NULL;
         enum drm_connector_status status = connector_status_disconnected;
 
         hdmi_priv->has_hdmi_sink = false;
-        edid = drm_get_edid(&intel_output->base,
-                            intel_output->ddc_bus);
+        edid = drm_get_edid(&intel_encoder->base,
+                            intel_encoder->ddc_bus);
 
         if (edid) {
                 if (edid->input & DRM_EDID_INPUT_DIGITAL) {
                         status = connector_status_connected;
                         hdmi_priv->has_hdmi_sink = drm_detect_hdmi_monitor(edid);
                 }
-                intel_output->base.display_info.raw_edid = NULL;
+                intel_encoder->base.display_info.raw_edid = NULL;
                 kfree(edid);
         }
 
@@ -174,24 +174,24 @@ intel_hdmi_detect(struct drm_connector *connector)
 
 static int intel_hdmi_get_modes(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
         /* We should parse the EDID data and find out if it's an HDMI sink so
          * we can send audio to it.
          */
 
-        return intel_ddc_get_modes(intel_output);
+        return intel_ddc_get_modes(intel_encoder);
 }
 
 static void intel_hdmi_destroy(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
-        if (intel_output->i2c_bus)
-                intel_i2c_destroy(intel_output->i2c_bus);
+        if (intel_encoder->i2c_bus)
+                intel_i2c_destroy(intel_encoder->i2c_bus);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
 
 static const struct drm_encoder_helper_funcs intel_hdmi_helper_funcs = {
@@ -230,63 +230,63 @@ void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_hdmi_priv *hdmi_priv;
 
-        intel_output = kcalloc(sizeof(struct intel_output) +
+        intel_encoder = kcalloc(sizeof(struct intel_encoder) +
                                sizeof(struct intel_hdmi_priv), 1, GFP_KERNEL);
-        if (!intel_output)
+        if (!intel_encoder)
                 return;
-        hdmi_priv = (struct intel_hdmi_priv *)(intel_output + 1);
+        hdmi_priv = (struct intel_hdmi_priv *)(intel_encoder + 1);
 
-        connector = &intel_output->base;
+        connector = &intel_encoder->base;
         drm_connector_init(dev, connector, &intel_hdmi_connector_funcs,
                            DRM_MODE_CONNECTOR_HDMIA);
         drm_connector_helper_add(connector, &intel_hdmi_connector_helper_funcs);
 
-        intel_output->type = INTEL_OUTPUT_HDMI;
+        intel_encoder->type = INTEL_OUTPUT_HDMI;
 
         connector->interlace_allowed = 0;
         connector->doublescan_allowed = 0;
-        intel_output->crtc_mask = (1 << 0) | (1 << 1);
+        intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
 
         /* Set up the DDC bus. */
         if (sdvox_reg == SDVOB) {
-                intel_output->clone_mask = (1 << INTEL_HDMIB_CLONE_BIT);
-                intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "HDMIB");
+                intel_encoder->clone_mask = (1 << INTEL_HDMIB_CLONE_BIT);
+                intel_encoder->ddc_bus = intel_i2c_create(dev, GPIOE, "HDMIB");
                 dev_priv->hotplug_supported_mask |= HDMIB_HOTPLUG_INT_STATUS;
         } else if (sdvox_reg == SDVOC) {
-                intel_output->clone_mask = (1 << INTEL_HDMIC_CLONE_BIT);
-                intel_output->ddc_bus = intel_i2c_create(dev, GPIOD, "HDMIC");
+                intel_encoder->clone_mask = (1 << INTEL_HDMIC_CLONE_BIT);
+                intel_encoder->ddc_bus = intel_i2c_create(dev, GPIOD, "HDMIC");
                 dev_priv->hotplug_supported_mask |= HDMIC_HOTPLUG_INT_STATUS;
         } else if (sdvox_reg == HDMIB) {
-                intel_output->clone_mask = (1 << INTEL_HDMID_CLONE_BIT);
-                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOE,
+                intel_encoder->clone_mask = (1 << INTEL_HDMID_CLONE_BIT);
+                intel_encoder->ddc_bus = intel_i2c_create(dev, PCH_GPIOE,
                                                                 "HDMIB");
                 dev_priv->hotplug_supported_mask |= HDMIB_HOTPLUG_INT_STATUS;
         } else if (sdvox_reg == HDMIC) {
-                intel_output->clone_mask = (1 << INTEL_HDMIE_CLONE_BIT);
-                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOD,
+                intel_encoder->clone_mask = (1 << INTEL_HDMIE_CLONE_BIT);
+                intel_encoder->ddc_bus = intel_i2c_create(dev, PCH_GPIOD,
                                                                 "HDMIC");
                 dev_priv->hotplug_supported_mask |= HDMIC_HOTPLUG_INT_STATUS;
         } else if (sdvox_reg == HDMID) {
-                intel_output->clone_mask = (1 << INTEL_HDMIF_CLONE_BIT);
-                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOF,
+                intel_encoder->clone_mask = (1 << INTEL_HDMIF_CLONE_BIT);
+                intel_encoder->ddc_bus = intel_i2c_create(dev, PCH_GPIOF,
                                                                 "HDMID");
                 dev_priv->hotplug_supported_mask |= HDMID_HOTPLUG_INT_STATUS;
         }
-        if (!intel_output->ddc_bus)
+        if (!intel_encoder->ddc_bus)
                 goto err_connector;
 
         hdmi_priv->sdvox_reg = sdvox_reg;
-        intel_output->dev_priv = hdmi_priv;
+        intel_encoder->dev_priv = hdmi_priv;
 
-        drm_encoder_init(dev, &intel_output->enc, &intel_hdmi_enc_funcs,
+        drm_encoder_init(dev, &intel_encoder->enc, &intel_hdmi_enc_funcs,
                          DRM_MODE_ENCODER_TMDS);
-        drm_encoder_helper_add(&intel_output->enc, &intel_hdmi_helper_funcs);
+        drm_encoder_helper_add(&intel_encoder->enc, &intel_hdmi_helper_funcs);
 
-        drm_mode_connector_attach_encoder(&intel_output->base,
-                                          &intel_output->enc);
+        drm_mode_connector_attach_encoder(&intel_encoder->base,
+                                          &intel_encoder->enc);
         drm_sysfs_connector_add(connector);
 
         /* For G4X desktop chip, PEG_BAND_GAP_DATA 3:0 must first be written
@@ -302,7 +302,7 @@ void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
 
 err_connector:
         drm_connector_cleanup(connector);
-        kfree(intel_output);
+        kfree(intel_encoder);
 
         return;
 }
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 216e9f52b6e0..b66806a37d37 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -239,8 +239,8 @@ static bool intel_lvds_mode_fixup(struct drm_encoder *encoder,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_crtc *intel_crtc = to_intel_crtc(encoder->crtc);
         struct drm_encoder *tmp_encoder;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_lvds_priv *lvds_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_lvds_priv *lvds_priv = intel_encoder->dev_priv;
         u32 pfit_control = 0, pfit_pgm_ratios = 0;
         int left_border = 0, right_border = 0, top_border = 0;
         int bottom_border = 0;
@@ -587,8 +587,8 @@ static void intel_lvds_mode_set(struct drm_encoder *encoder,
 {
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_lvds_priv *lvds_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_lvds_priv *lvds_priv = intel_encoder->dev_priv;
 
         /*
          * The LVDS pin pair will already have been turned on in the
@@ -635,14 +635,16 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
 static int intel_lvds_get_modes(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
         struct drm_i915_private *dev_priv = dev->dev_private;
         int ret = 0;
 
-        ret = intel_ddc_get_modes(intel_output);
+        if (dev_priv->lvds_edid_good) {
+                ret = intel_ddc_get_modes(intel_encoder);
 
-        if (ret)
-                return ret;
+                if (ret)
+                        return ret;
+        }
 
         /* Didn't get an EDID, so
          * Set wide sync ranges so we get all modes
@@ -715,11 +717,11 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
 static void intel_lvds_destroy(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        if (intel_output->ddc_bus)
-                intel_i2c_destroy(intel_output->ddc_bus);
+        if (intel_encoder->ddc_bus)
+                intel_i2c_destroy(intel_encoder->ddc_bus);
         if (dev_priv->lid_notifier.notifier_call)
                 acpi_lid_notifier_unregister(&dev_priv->lid_notifier);
         drm_sysfs_connector_remove(connector);
@@ -732,13 +734,13 @@ static int intel_lvds_set_property(struct drm_connector *connector,
                                    uint64_t value)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output =
-                        to_intel_output(connector);
+        struct intel_encoder *intel_encoder =
+                        to_intel_encoder(connector);
 
         if (property == dev->mode_config.scaling_mode_property &&
                                 connector->encoder) {
                 struct drm_crtc *crtc = connector->encoder->crtc;
-                struct intel_lvds_priv *lvds_priv = intel_output->dev_priv;
+                struct intel_lvds_priv *lvds_priv = intel_encoder->dev_priv;
                 if (value == DRM_MODE_SCALE_NONE) {
                         DRM_DEBUG_KMS("no scaling not supported\n");
                         return 0;
@@ -858,6 +860,14 @@ static const struct dmi_system_id intel_no_lvds[] = {
                         DMI_MATCH(DMI_PRODUCT_VERSION, "AO00001JW"),
                 },
         },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Clientron U800",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Clientron"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "U800"),
+                },
+        },
 
         { }     /* terminating entry */
 };
@@ -968,7 +978,7 @@ static int lvds_is_present_in_vbt(struct drm_device *dev)
 void intel_lvds_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct drm_connector *connector;
         struct drm_encoder *encoder;
         struct drm_display_mode *scan; /* *modes, *bios_mode; */
@@ -996,40 +1006,40 @@ void intel_lvds_init(struct drm_device *dev)
                 gpio = PCH_GPIOC;
         }
 
-        intel_output = kzalloc(sizeof(struct intel_output) +
+        intel_encoder = kzalloc(sizeof(struct intel_encoder) +
                                 sizeof(struct intel_lvds_priv), GFP_KERNEL);
-        if (!intel_output) {
+        if (!intel_encoder) {
                 return;
         }
 
-        connector = &intel_output->base;
-        encoder = &intel_output->enc;
-        drm_connector_init(dev, &intel_output->base, &intel_lvds_connector_funcs,
+        connector = &intel_encoder->base;
+        encoder = &intel_encoder->enc;
+        drm_connector_init(dev, &intel_encoder->base, &intel_lvds_connector_funcs,
                            DRM_MODE_CONNECTOR_LVDS);
 
-        drm_encoder_init(dev, &intel_output->enc, &intel_lvds_enc_funcs,
+        drm_encoder_init(dev, &intel_encoder->enc, &intel_lvds_enc_funcs,
                          DRM_MODE_ENCODER_LVDS);
 
-        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
-        intel_output->type = INTEL_OUTPUT_LVDS;
+        drm_mode_connector_attach_encoder(&intel_encoder->base, &intel_encoder->enc);
+        intel_encoder->type = INTEL_OUTPUT_LVDS;
 
-        intel_output->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
-        intel_output->crtc_mask = (1 << 1);
+        intel_encoder->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
+        intel_encoder->crtc_mask = (1 << 1);
         drm_encoder_helper_add(encoder, &intel_lvds_helper_funcs);
         drm_connector_helper_add(connector, &intel_lvds_connector_helper_funcs);
         connector->display_info.subpixel_order = SubPixelHorizontalRGB;
         connector->interlace_allowed = false;
         connector->doublescan_allowed = false;
 
-        lvds_priv = (struct intel_lvds_priv *)(intel_output + 1);
-        intel_output->dev_priv = lvds_priv;
+        lvds_priv = (struct intel_lvds_priv *)(intel_encoder + 1);
+        intel_encoder->dev_priv = lvds_priv;
         /* create the scaling mode property */
         drm_mode_create_scaling_mode_property(dev);
         /*
          * the initial panel fitting mode will be FULL_SCREEN.
          */
 
-        drm_connector_attach_property(&intel_output->base,
+        drm_connector_attach_property(&intel_encoder->base,
                                       dev->mode_config.scaling_mode_property,
                                       DRM_MODE_SCALE_FULLSCREEN);
         lvds_priv->fitting_mode = DRM_MODE_SCALE_FULLSCREEN;
@@ -1044,8 +1054,8 @@ void intel_lvds_init(struct drm_device *dev)
          */
 
         /* Set up the DDC bus. */
-        intel_output->ddc_bus = intel_i2c_create(dev, gpio, "LVDSDDC_C");
-        if (!intel_output->ddc_bus) {
+        intel_encoder->ddc_bus = intel_i2c_create(dev, gpio, "LVDSDDC_C");
+        if (!intel_encoder->ddc_bus) {
                 dev_printk(KERN_ERR, &dev->pdev->dev, "DDC bus registration "
                            "failed.\n");
                 goto failed;
@@ -1055,7 +1065,10 @@ void intel_lvds_init(struct drm_device *dev)
          * Attempt to get the fixed panel mode from DDC.  Assume that the
          * preferred mode is the right one.
          */
-        intel_ddc_get_modes(intel_output);
+        dev_priv->lvds_edid_good = true;
+
+        if (!intel_ddc_get_modes(intel_encoder))
+                dev_priv->lvds_edid_good = false;
 
         list_for_each_entry(scan, &connector->probed_modes, head) {
                 mutex_lock(&dev->mode_config.mutex);
@@ -1133,9 +1146,9 @@ out:
 
 failed:
         DRM_DEBUG_KMS("No LVDS modes found, disabling.\n");
-        if (intel_output->ddc_bus)
-                intel_i2c_destroy(intel_output->ddc_bus);
+        if (intel_encoder->ddc_bus)
+                intel_i2c_destroy(intel_encoder->ddc_bus);
         drm_connector_cleanup(connector);
         drm_encoder_cleanup(encoder);
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 89d303d1d3fb..8e5c83b2d120 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -34,7 +34,7 @@
  * intel_ddc_probe
  *
  */
-bool intel_ddc_probe(struct intel_output *intel_output)
+bool intel_ddc_probe(struct intel_encoder *intel_encoder)
 {
         u8 out_buf[] = { 0x0, 0x0};
         u8 buf[2];
@@ -54,9 +54,9 @@ bool intel_ddc_probe(struct intel_output *intel_output)
                 }
         };
 
-        intel_i2c_quirk_set(intel_output->base.dev, true);
-        ret = i2c_transfer(intel_output->ddc_bus, msgs, 2);
-        intel_i2c_quirk_set(intel_output->base.dev, false);
+        intel_i2c_quirk_set(intel_encoder->base.dev, true);
+        ret = i2c_transfer(intel_encoder->ddc_bus, msgs, 2);
+        intel_i2c_quirk_set(intel_encoder->base.dev, false);
         if (ret == 2)
                 return true;
 
@@ -69,19 +69,19 @@ bool intel_ddc_probe(struct intel_output *intel_output)
  *
  * Fetch the EDID information from @connector using the DDC bus.
  */
-int intel_ddc_get_modes(struct intel_output *intel_output)
+int intel_ddc_get_modes(struct intel_encoder *intel_encoder)
 {
         struct edid *edid;
         int ret = 0;
 
-        intel_i2c_quirk_set(intel_output->base.dev, true);
-        edid = drm_get_edid(&intel_output->base, intel_output->ddc_bus);
-        intel_i2c_quirk_set(intel_output->base.dev, false);
+        intel_i2c_quirk_set(intel_encoder->base.dev, true);
+        edid = drm_get_edid(&intel_encoder->base, intel_encoder->ddc_bus);
+        intel_i2c_quirk_set(intel_encoder->base.dev, false);
         if (edid) {
-                drm_mode_connector_update_edid_property(&intel_output->base,
+                drm_mode_connector_update_edid_property(&intel_encoder->base,
                                                         edid);
-                ret = drm_add_edid_modes(&intel_output->base, edid);
-                intel_output->base.display_info.raw_edid = NULL;
+                ret = drm_add_edid_modes(&intel_encoder->base, edid);
+                intel_encoder->base.display_info.raw_edid = NULL;
                 kfree(edid);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index 60595fc26fdd..6d524a1fc271 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -724,7 +724,7 @@ int intel_overlay_do_put_image(struct intel_overlay *overlay,
         int ret, tmp_width;
         struct overlay_registers *regs;
         bool scale_changed = false;
-        struct drm_i915_gem_object *bo_priv = new_bo->driver_private;
+        struct drm_i915_gem_object *bo_priv = to_intel_bo(new_bo);
         struct drm_device *dev = overlay->dev;
 
         BUG_ON(!mutex_is_locked(&dev->struct_mutex));
@@ -809,7 +809,7 @@ int intel_overlay_do_put_image(struct intel_overlay *overlay,
         intel_overlay_continue(overlay, scale_changed);
 
         overlay->old_vid_bo = overlay->vid_bo;
-        overlay->vid_bo = new_bo->driver_private;
+        overlay->vid_bo = to_intel_bo(new_bo);
 
         return 0;
 
@@ -1344,7 +1344,7 @@ void intel_setup_overlay(struct drm_device *dev)
         reg_bo = drm_gem_object_alloc(dev, PAGE_SIZE);
         if (!reg_bo)
                 goto out_free;
-        overlay->reg_bo = reg_bo->driver_private;
+        overlay->reg_bo = to_intel_bo(reg_bo);
 
         if (OVERLAY_NONPHYSICAL(dev)) {
                 ret = i915_gem_object_pin(reg_bo, PAGE_SIZE);
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 26e13a0bf30b..87d953664cb0 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -54,7 +54,7 @@ struct intel_sdvo_priv {
         u8 slave_addr;
 
         /* Register for the SDVO device: SDVOB or SDVOC */
-        int output_device;
+        int sdvo_reg;
 
         /* Active outputs controlled by this SDVO output */
         uint16_t controlled_output;
@@ -124,7 +124,7 @@ struct intel_sdvo_priv {
          */
         struct intel_sdvo_encode encode;
 
-        /* DDC bus used by this SDVO output */
+        /* DDC bus used by this SDVO encoder */
         uint8_t ddc_bus;
 
         /* Mac mini hack -- use the same DDC as the analog connector */
@@ -162,22 +162,22 @@ struct intel_sdvo_priv {
 };
 
 static bool
-intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags);
+intel_sdvo_output_setup(struct intel_encoder *intel_encoder, uint16_t flags);
 
 /**
  * Writes the SDVOB or SDVOC with the given value, but always writes both
  * SDVOB and SDVOC to work around apparent hardware issues (according to
  * comments in the BIOS).
  */
-static void intel_sdvo_write_sdvox(struct intel_output *intel_output, u32 val)
+static void intel_sdvo_write_sdvox(struct intel_encoder *intel_encoder, u32 val)
 {
-        struct drm_device *dev = intel_output->base.dev;
+        struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_sdvo_priv   *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv   *sdvo_priv = intel_encoder->dev_priv;
         u32 bval = val, cval = val;
         int i;
 
-        if (sdvo_priv->output_device == SDVOB) {
+        if (sdvo_priv->sdvo_reg == SDVOB) {
                 cval = I915_READ(SDVOC);
         } else {
                 bval = I915_READ(SDVOB);
@@ -196,10 +196,10 @@ static void intel_sdvo_write_sdvox(struct intel_output *intel_output, u32 val)
         }
 }
 
-static bool intel_sdvo_read_byte(struct intel_output *intel_output, u8 addr,
+static bool intel_sdvo_read_byte(struct intel_encoder *intel_encoder, u8 addr,
                                  u8 *ch)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         u8 out_buf[2];
         u8 buf[2];
         int ret;
@@ -222,7 +222,7 @@ static bool intel_sdvo_read_byte(struct intel_output *intel_output, u8 addr,
         out_buf[0] = addr;
         out_buf[1] = 0;
 
-        if ((ret = i2c_transfer(intel_output->i2c_bus, msgs, 2)) == 2)
+        if ((ret = i2c_transfer(intel_encoder->i2c_bus, msgs, 2)) == 2)
         {
                 *ch = buf[0];
                 return true;
@@ -232,10 +232,10 @@ static bool intel_sdvo_read_byte(struct intel_output *intel_output, u8 addr,
         return false;
 }
 
-static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
+static bool intel_sdvo_write_byte(struct intel_encoder *intel_encoder, int addr,
                                   u8 ch)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         u8 out_buf[2];
         struct i2c_msg msgs[] = {
                 {
@@ -249,7 +249,7 @@ static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
         out_buf[0] = addr;
         out_buf[1] = ch;
 
-        if (i2c_transfer(intel_output->i2c_bus, msgs, 1) == 1)
+        if (i2c_transfer(intel_encoder->i2c_bus, msgs, 1) == 1)
         {
                 return true;
         }
@@ -353,13 +353,13 @@ static const struct _sdvo_cmd_name {
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_DATA),
 };
 
-#define SDVO_NAME(dev_priv) ((dev_priv)->output_device == SDVOB ? "SDVOB" : "SDVOC")
-#define SDVO_PRIV(output)   ((struct intel_sdvo_priv *) (output)->dev_priv)
+#define SDVO_NAME(dev_priv) ((dev_priv)->sdvo_reg == SDVOB ? "SDVOB" : "SDVOC")
+#define SDVO_PRIV(encoder)   ((struct intel_sdvo_priv *) (encoder)->dev_priv)
 
-static void intel_sdvo_debug_write(struct intel_output *intel_output, u8 cmd,
+static void intel_sdvo_debug_write(struct intel_encoder *intel_encoder, u8 cmd,
                                    void *args, int args_len)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int i;
 
         DRM_DEBUG_KMS("%s: W: %02X ",
@@ -379,19 +379,19 @@ static void intel_sdvo_debug_write(struct intel_output *intel_output, u8 cmd,
         DRM_LOG_KMS("\n");
 }
 
-static void intel_sdvo_write_cmd(struct intel_output *intel_output, u8 cmd,
+static void intel_sdvo_write_cmd(struct intel_encoder *intel_encoder, u8 cmd,
                                  void *args, int args_len)
 {
         int i;
 
-        intel_sdvo_debug_write(intel_output, cmd, args, args_len);
+        intel_sdvo_debug_write(intel_encoder, cmd, args, args_len);
 
         for (i = 0; i < args_len; i++) {
-                intel_sdvo_write_byte(intel_output, SDVO_I2C_ARG_0 - i,
+                intel_sdvo_write_byte(intel_encoder, SDVO_I2C_ARG_0 - i,
                                       ((u8*)args)[i]);
         }
 
-        intel_sdvo_write_byte(intel_output, SDVO_I2C_OPCODE, cmd);
+        intel_sdvo_write_byte(intel_encoder, SDVO_I2C_OPCODE, cmd);
 }
 
 static const char *cmd_status_names[] = {
@@ -404,11 +404,11 @@ static const char *cmd_status_names[] = {
         "Scaling not supported"
 };
 
-static void intel_sdvo_debug_response(struct intel_output *intel_output,
+static void intel_sdvo_debug_response(struct intel_encoder *intel_encoder,
                                       void *response, int response_len,
                                       u8 status)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int i;
 
         DRM_DEBUG_KMS("%s: R: ", SDVO_NAME(sdvo_priv));
@@ -423,7 +423,7 @@ static void intel_sdvo_debug_response(struct intel_output *intel_output,
         DRM_LOG_KMS("\n");
 }
 
-static u8 intel_sdvo_read_response(struct intel_output *intel_output,
+static u8 intel_sdvo_read_response(struct intel_encoder *intel_encoder,
                                    void *response, int response_len)
 {
         int i;
@@ -433,16 +433,16 @@ static u8 intel_sdvo_read_response(struct intel_output *intel_output,
         while (retry--) {
                 /* Read the command response */
                 for (i = 0; i < response_len; i++) {
-                        intel_sdvo_read_byte(intel_output,
+                        intel_sdvo_read_byte(intel_encoder,
                                              SDVO_I2C_RETURN_0 + i,
                                              &((u8 *)response)[i]);
                 }
 
                 /* read the return status */
-                intel_sdvo_read_byte(intel_output, SDVO_I2C_CMD_STATUS,
+                intel_sdvo_read_byte(intel_encoder, SDVO_I2C_CMD_STATUS,
                                      &status);
 
-                intel_sdvo_debug_response(intel_output, response, response_len,
+                intel_sdvo_debug_response(intel_encoder, response, response_len,
                                           status);
                 if (status != SDVO_CMD_STATUS_PENDING)
                         return status;
@@ -470,10 +470,10 @@ static int intel_sdvo_get_pixel_multiplier(struct drm_display_mode *mode)
  * another I2C transaction after issuing the DDC bus switch, it will be
  * switched to the internal SDVO register.
  */
-static void intel_sdvo_set_control_bus_switch(struct intel_output *intel_output,
+static void intel_sdvo_set_control_bus_switch(struct intel_encoder *intel_encoder,
                                               u8 target)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         u8 out_buf[2], cmd_buf[2], ret_value[2], ret;
         struct i2c_msg msgs[] = {
                 {
@@ -497,10 +497,10 @@ static void intel_sdvo_set_control_bus_switch(struct intel_output *intel_output,
                 },
         };
 
-        intel_sdvo_debug_write(intel_output, SDVO_CMD_SET_CONTROL_BUS_SWITCH,
+        intel_sdvo_debug_write(intel_encoder, SDVO_CMD_SET_CONTROL_BUS_SWITCH,
                                         &target, 1);
         /* write the DDC switch command argument */
-        intel_sdvo_write_byte(intel_output, SDVO_I2C_ARG_0, target);
+        intel_sdvo_write_byte(intel_encoder, SDVO_I2C_ARG_0, target);
 
         out_buf[0] = SDVO_I2C_OPCODE;
         out_buf[1] = SDVO_CMD_SET_CONTROL_BUS_SWITCH;
@@ -509,7 +509,7 @@ static void intel_sdvo_set_control_bus_switch(struct intel_output *intel_output,
         ret_value[0] = 0;
         ret_value[1] = 0;
 
-        ret = i2c_transfer(intel_output->i2c_bus, msgs, 3);
+        ret = i2c_transfer(intel_encoder->i2c_bus, msgs, 3);
         if (ret != 3) {
                 /* failure in I2C transfer */
                 DRM_DEBUG_KMS("I2c transfer returned %d\n", ret);
@@ -523,7 +523,7 @@ static void intel_sdvo_set_control_bus_switch(struct intel_output *intel_output,
         return;
 }
 
-static bool intel_sdvo_set_target_input(struct intel_output *intel_output, bool target_0, bool target_1)
+static bool intel_sdvo_set_target_input(struct intel_encoder *intel_encoder, bool target_0, bool target_1)
 {
         struct intel_sdvo_set_target_input_args targets = {0};
         u8 status;
@@ -534,10 +534,10 @@ static bool intel_sdvo_set_target_input(struct intel_output *intel_output, bool
         if (target_1)
                 targets.target_1 = 1;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_TARGET_INPUT, &targets,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_TARGET_INPUT, &targets,
                              sizeof(targets));
 
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
 
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
@@ -548,13 +548,13 @@ static bool intel_sdvo_set_target_input(struct intel_output *intel_output, bool
  * This function is making an assumption about the layout of the response,
  * which should be checked against the docs.
  */
-static bool intel_sdvo_get_trained_inputs(struct intel_output *intel_output, bool *input_1, bool *input_2)
+static bool intel_sdvo_get_trained_inputs(struct intel_encoder *intel_encoder, bool *input_1, bool *input_2)
 {
         struct intel_sdvo_get_trained_inputs_response response;
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_TRAINED_INPUTS, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &response, sizeof(response));
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_TRAINED_INPUTS, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, &response, sizeof(response));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
@@ -563,29 +563,29 @@ static bool intel_sdvo_get_trained_inputs(struct intel_output *intel_output, boo
         return true;
 }
 
-static bool intel_sdvo_get_active_outputs(struct intel_output *intel_output,
+static bool intel_sdvo_get_active_outputs(struct intel_encoder *intel_encoder,
                                           u16 *outputs)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_ACTIVE_OUTPUTS, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, outputs, sizeof(*outputs));
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_ACTIVE_OUTPUTS, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, outputs, sizeof(*outputs));
 
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
-static bool intel_sdvo_set_active_outputs(struct intel_output *intel_output,
+static bool intel_sdvo_set_active_outputs(struct intel_encoder *intel_encoder,
                                           u16 outputs)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_ACTIVE_OUTPUTS, &outputs,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_ACTIVE_OUTPUTS, &outputs,
                              sizeof(outputs));
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
-static bool intel_sdvo_set_encoder_power_state(struct intel_output *intel_output,
+static bool intel_sdvo_set_encoder_power_state(struct intel_encoder *intel_encoder,
                                                int mode)
 {
         u8 status, state = SDVO_ENCODER_STATE_ON;
@@ -605,24 +605,24 @@ static bool intel_sdvo_set_encoder_power_state(struct intel_output *intel_output
                 break;
         }
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_ENCODER_POWER_STATE, &state,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_ENCODER_POWER_STATE, &state,
                              sizeof(state));
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
 
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
-static bool intel_sdvo_get_input_pixel_clock_range(struct intel_output *intel_output,
+static bool intel_sdvo_get_input_pixel_clock_range(struct intel_encoder *intel_encoder,
                                                    int *clock_min,
                                                    int *clock_max)
 {
         struct intel_sdvo_pixel_clock_range clocks;
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_INPUT_PIXEL_CLOCK_RANGE,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_INPUT_PIXEL_CLOCK_RANGE,
                              NULL, 0);
 
-        status = intel_sdvo_read_response(intel_output, &clocks, sizeof(clocks));
+        status = intel_sdvo_read_response(intel_encoder, &clocks, sizeof(clocks));
 
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
@@ -634,31 +634,31 @@ static bool intel_sdvo_get_input_pixel_clock_range(struct intel_output *intel_ou
         return true;
 }
 
-static bool intel_sdvo_set_target_output(struct intel_output *intel_output,
+static bool intel_sdvo_set_target_output(struct intel_encoder *intel_encoder,
                                          u16 outputs)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_TARGET_OUTPUT, &outputs,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_TARGET_OUTPUT, &outputs,
                              sizeof(outputs));
 
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
-static bool intel_sdvo_get_timing(struct intel_output *intel_output, u8 cmd,
+static bool intel_sdvo_get_timing(struct intel_encoder *intel_encoder, u8 cmd,
                                   struct intel_sdvo_dtd *dtd)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, cmd, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &dtd->part1,
+        intel_sdvo_write_cmd(intel_encoder, cmd, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, &dtd->part1,
                                           sizeof(dtd->part1));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
-        intel_sdvo_write_cmd(intel_output, cmd + 1, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &dtd->part2,
+        intel_sdvo_write_cmd(intel_encoder, cmd + 1, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, &dtd->part2,
                                           sizeof(dtd->part2));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
@@ -666,60 +666,60 @@ static bool intel_sdvo_get_timing(struct intel_output *intel_output, u8 cmd,
         return true;
 }
 
-static bool intel_sdvo_get_input_timing(struct intel_output *intel_output,
+static bool intel_sdvo_get_input_timing(struct intel_encoder *intel_encoder,
                                          struct intel_sdvo_dtd *dtd)
 {
-        return intel_sdvo_get_timing(intel_output,
+        return intel_sdvo_get_timing(intel_encoder,
                                      SDVO_CMD_GET_INPUT_TIMINGS_PART1, dtd);
 }
 
-static bool intel_sdvo_get_output_timing(struct intel_output *intel_output,
+static bool intel_sdvo_get_output_timing(struct intel_encoder *intel_encoder,
                                          struct intel_sdvo_dtd *dtd)
 {
-        return intel_sdvo_get_timing(intel_output,
+        return intel_sdvo_get_timing(intel_encoder,
                                      SDVO_CMD_GET_OUTPUT_TIMINGS_PART1, dtd);
 }
 
-static bool intel_sdvo_set_timing(struct intel_output *intel_output, u8 cmd,
+static bool intel_sdvo_set_timing(struct intel_encoder *intel_encoder, u8 cmd,
                                   struct intel_sdvo_dtd *dtd)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, cmd, &dtd->part1, sizeof(dtd->part1));
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        intel_sdvo_write_cmd(intel_encoder, cmd, &dtd->part1, sizeof(dtd->part1));
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
-        intel_sdvo_write_cmd(intel_output, cmd + 1, &dtd->part2, sizeof(dtd->part2));
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        intel_sdvo_write_cmd(intel_encoder, cmd + 1, &dtd->part2, sizeof(dtd->part2));
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
         return true;
 }
 
-static bool intel_sdvo_set_input_timing(struct intel_output *intel_output,
+static bool intel_sdvo_set_input_timing(struct intel_encoder *intel_encoder,
                                          struct intel_sdvo_dtd *dtd)
 {
-        return intel_sdvo_set_timing(intel_output,
+        return intel_sdvo_set_timing(intel_encoder,
                                      SDVO_CMD_SET_INPUT_TIMINGS_PART1, dtd);
 }
 
-static bool intel_sdvo_set_output_timing(struct intel_output *intel_output,
+static bool intel_sdvo_set_output_timing(struct intel_encoder *intel_encoder,
                                          struct intel_sdvo_dtd *dtd)
 {
-        return intel_sdvo_set_timing(intel_output,
+        return intel_sdvo_set_timing(intel_encoder,
                                      SDVO_CMD_SET_OUTPUT_TIMINGS_PART1, dtd);
 }
 
 static bool
-intel_sdvo_create_preferred_input_timing(struct intel_output *output,
+intel_sdvo_create_preferred_input_timing(struct intel_encoder *intel_encoder,
                                          uint16_t clock,
                                          uint16_t width,
                                          uint16_t height)
 {
         struct intel_sdvo_preferred_input_timing_args args;
-        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         uint8_t status;
 
         memset(&args, 0, sizeof(args));
@@ -733,32 +733,33 @@ intel_sdvo_create_preferred_input_timing(struct intel_output *output,
             sdvo_priv->sdvo_lvds_fixed_mode->vdisplay != height))
                 args.scaled = 1;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_CREATE_PREFERRED_INPUT_TIMING,
+        intel_sdvo_write_cmd(intel_encoder,
+                             SDVO_CMD_CREATE_PREFERRED_INPUT_TIMING,
                              &args, sizeof(args));
-        status = intel_sdvo_read_response(output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
         return true;
 }
 
-static bool intel_sdvo_get_preferred_input_timing(struct intel_output *output,
+static bool intel_sdvo_get_preferred_input_timing(struct intel_encoder *intel_encoder,
                                                   struct intel_sdvo_dtd *dtd)
 {
         bool status;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART1,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART1,
                              NULL, 0);
 
-        status = intel_sdvo_read_response(output, &dtd->part1,
+        status = intel_sdvo_read_response(intel_encoder, &dtd->part1,
                                           sizeof(dtd->part1));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART2,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART2,
                              NULL, 0);
 
-        status = intel_sdvo_read_response(output, &dtd->part2,
+        status = intel_sdvo_read_response(intel_encoder, &dtd->part2,
                                           sizeof(dtd->part2));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
@@ -766,12 +767,12 @@ static bool intel_sdvo_get_preferred_input_timing(struct intel_output *output,
         return false;
 }
 
-static int intel_sdvo_get_clock_rate_mult(struct intel_output *intel_output)
+static int intel_sdvo_get_clock_rate_mult(struct intel_encoder *intel_encoder)
 {
         u8 response, status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_CLOCK_RATE_MULT, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &response, 1);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_CLOCK_RATE_MULT, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, &response, 1);
 
         if (status != SDVO_CMD_STATUS_SUCCESS) {
                 DRM_DEBUG_KMS("Couldn't get SDVO clock rate multiplier\n");
@@ -783,12 +784,12 @@ static int intel_sdvo_get_clock_rate_mult(struct intel_output *intel_output)
         return response;
 }
 
-static bool intel_sdvo_set_clock_rate_mult(struct intel_output *intel_output, u8 val)
+static bool intel_sdvo_set_clock_rate_mult(struct intel_encoder *intel_encoder, u8 val)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_CLOCK_RATE_MULT, &val, 1);
-        status = intel_sdvo_read_response(intel_output, NULL, 0);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_CLOCK_RATE_MULT, &val, 1);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
@@ -877,13 +878,13 @@ static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode * mode,
                 mode->flags |= DRM_MODE_FLAG_PVSYNC;
 }
 
-static bool intel_sdvo_get_supp_encode(struct intel_output *output,
+static bool intel_sdvo_get_supp_encode(struct intel_encoder *intel_encoder,
                                        struct intel_sdvo_encode *encode)
 {
         uint8_t status;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_GET_SUPP_ENCODE, NULL, 0);
-        status = intel_sdvo_read_response(output, encode, sizeof(*encode));
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_SUPP_ENCODE, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, encode, sizeof(*encode));
         if (status != SDVO_CMD_STATUS_SUCCESS) { /* non-support means DVI */
                 memset(encode, 0, sizeof(*encode));
                 return false;
@@ -892,29 +893,30 @@ static bool intel_sdvo_get_supp_encode(struct intel_output *output,
         return true;
 }
 
-static bool intel_sdvo_set_encode(struct intel_output *output, uint8_t mode)
+static bool intel_sdvo_set_encode(struct intel_encoder *intel_encoder,
+                                  uint8_t mode)
 {
         uint8_t status;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_SET_ENCODE, &mode, 1);
-        status = intel_sdvo_read_response(output, NULL, 0);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_ENCODE, &mode, 1);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
 
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
-static bool intel_sdvo_set_colorimetry(struct intel_output *output,
+static bool intel_sdvo_set_colorimetry(struct intel_encoder *intel_encoder,
                                        uint8_t mode)
 {
         uint8_t status;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_SET_COLORIMETRY, &mode, 1);
-        status = intel_sdvo_read_response(output, NULL, 0);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_COLORIMETRY, &mode, 1);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
 
         return (status == SDVO_CMD_STATUS_SUCCESS);
 }
 
 #if 0
-static void intel_sdvo_dump_hdmi_buf(struct intel_output *output)
+static void intel_sdvo_dump_hdmi_buf(struct intel_encoder *intel_encoder)
 {
         int i, j;
         uint8_t set_buf_index[2];
@@ -923,43 +925,45 @@ static void intel_sdvo_dump_hdmi_buf(struct intel_output *output)
         uint8_t buf[48];
         uint8_t *pos;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_AV_SPLIT, NULL, 0);
-        intel_sdvo_read_response(output, &av_split, 1);
+        intel_sdvo_write_cmd(encoder, SDVO_CMD_GET_HBUF_AV_SPLIT, NULL, 0);
+        intel_sdvo_read_response(encoder, &av_split, 1);
 
         for (i = 0; i <= av_split; i++) {
                 set_buf_index[0] = i; set_buf_index[1] = 0;
-                intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX,
+                intel_sdvo_write_cmd(encoder, SDVO_CMD_SET_HBUF_INDEX,
                                      set_buf_index, 2);
-                intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_INFO, NULL, 0);
-                intel_sdvo_read_response(output, &buf_size, 1);
+                intel_sdvo_write_cmd(encoder, SDVO_CMD_GET_HBUF_INFO, NULL, 0);
+                intel_sdvo_read_response(encoder, &buf_size, 1);
 
                 pos = buf;
                 for (j = 0; j <= buf_size; j += 8) {
-                        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_DATA,
+                        intel_sdvo_write_cmd(encoder, SDVO_CMD_GET_HBUF_DATA,
                                              NULL, 0);
-                        intel_sdvo_read_response(output, pos, 8);
+                        intel_sdvo_read_response(encoder, pos, 8);
                         pos += 8;
                 }
         }
 }
 #endif
 
-static void intel_sdvo_set_hdmi_buf(struct intel_output *output, int index,
-                                uint8_t *data, int8_t size, uint8_t tx_rate)
+static void intel_sdvo_set_hdmi_buf(struct intel_encoder *intel_encoder,
+                                    int index,
+                                    uint8_t *data, int8_t size, uint8_t tx_rate)
 {
     uint8_t set_buf_index[2];
 
     set_buf_index[0] = index;
     set_buf_index[1] = 0;
 
-    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX, set_buf_index, 2);
+    intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_HBUF_INDEX,
+                         set_buf_index, 2);
 
     for (; size > 0; size -= 8) {
-        intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_DATA, data, 8);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_HBUF_DATA, data, 8);
         data += 8;
     }
 
-    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_TXRATE, &tx_rate, 1);
+    intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_HBUF_TXRATE, &tx_rate, 1);
 }
 
 static uint8_t intel_sdvo_calc_hbuf_csum(uint8_t *data, uint8_t size)
@@ -1034,7 +1038,7 @@ struct dip_infoframe {
         } __attribute__ ((packed)) u;
 } __attribute__((packed));
 
-static void intel_sdvo_set_avi_infoframe(struct intel_output *output,
+static void intel_sdvo_set_avi_infoframe(struct intel_encoder *intel_encoder,
                                          struct drm_display_mode * mode)
 {
         struct dip_infoframe avi_if = {
@@ -1045,15 +1049,16 @@ static void intel_sdvo_set_avi_infoframe(struct intel_output *output,
 
         avi_if.checksum = intel_sdvo_calc_hbuf_csum((uint8_t *)&avi_if,
                                                     4 + avi_if.len);
-        intel_sdvo_set_hdmi_buf(output, 1, (uint8_t *)&avi_if, 4 + avi_if.len,
+        intel_sdvo_set_hdmi_buf(intel_encoder, 1, (uint8_t *)&avi_if,
+                                4 + avi_if.len,
                                 SDVO_HBUF_TX_VSYNC);
 }
 
-static void intel_sdvo_set_tv_format(struct intel_output *output)
+static void intel_sdvo_set_tv_format(struct intel_encoder *intel_encoder)
 {
 
         struct intel_sdvo_tv_format format;
-        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         uint32_t format_map, i;
         uint8_t status;
 
@@ -1066,10 +1071,10 @@ static void intel_sdvo_set_tv_format(struct intel_output *output)
         memcpy(&format, &format_map, sizeof(format_map) > sizeof(format) ?
                         sizeof(format) : sizeof(format_map));
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_SET_TV_FORMAT, &format_map,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_TV_FORMAT, &format_map,
                              sizeof(format));
 
-        status = intel_sdvo_read_response(output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 DRM_DEBUG_KMS("%s: Failed to set TV format\n",
                           SDVO_NAME(sdvo_priv));
@@ -1079,8 +1084,8 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
                                   struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode)
 {
-        struct intel_output *output = enc_to_intel_output(encoder);
-        struct intel_sdvo_priv *dev_priv = output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_sdvo_priv *dev_priv = intel_encoder->dev_priv;
 
         if (dev_priv->is_tv) {
                 struct intel_sdvo_dtd output_dtd;
@@ -1095,22 +1100,22 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
 
                 /* Set output timings */
                 intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
-                intel_sdvo_set_target_output(output,
+                intel_sdvo_set_target_output(intel_encoder,
                                              dev_priv->controlled_output);
-                intel_sdvo_set_output_timing(output, &output_dtd);
+                intel_sdvo_set_output_timing(intel_encoder, &output_dtd);
 
                 /* Set the input timing to the screen. Assume always input 0. */
-                intel_sdvo_set_target_input(output, true, false);
+                intel_sdvo_set_target_input(intel_encoder, true, false);
 
 
-                success = intel_sdvo_create_preferred_input_timing(output,
+                success = intel_sdvo_create_preferred_input_timing(intel_encoder,
                                                                    mode->clock / 10,
                                                                    mode->hdisplay,
                                                                    mode->vdisplay);
                 if (success) {
                         struct intel_sdvo_dtd input_dtd;
 
-                        intel_sdvo_get_preferred_input_timing(output,
+                        intel_sdvo_get_preferred_input_timing(intel_encoder,
                                                              &input_dtd);
                         intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
                         dev_priv->sdvo_flags = input_dtd.part2.sdvo_flags;
@@ -1133,16 +1138,16 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
                 intel_sdvo_get_dtd_from_mode(&output_dtd,
                                 dev_priv->sdvo_lvds_fixed_mode);
 
-                intel_sdvo_set_target_output(output,
+                intel_sdvo_set_target_output(intel_encoder,
                                              dev_priv->controlled_output);
-                intel_sdvo_set_output_timing(output, &output_dtd);
+                intel_sdvo_set_output_timing(intel_encoder, &output_dtd);
 
                 /* Set the input timing to the screen. Assume always input 0. */
-                intel_sdvo_set_target_input(output, true, false);
+                intel_sdvo_set_target_input(intel_encoder, true, false);
 
 
                 success = intel_sdvo_create_preferred_input_timing(
-                                output,
+                                intel_encoder,
                                 mode->clock / 10,
                                 mode->hdisplay,
                                 mode->vdisplay);
@@ -1150,7 +1155,7 @@ static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
                 if (success) {
                         struct intel_sdvo_dtd input_dtd;
 
-                        intel_sdvo_get_preferred_input_timing(output,
+                        intel_sdvo_get_preferred_input_timing(intel_encoder,
                                                              &input_dtd);
                         intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
                         dev_priv->sdvo_flags = input_dtd.part2.sdvo_flags;
@@ -1182,8 +1187,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_crtc *crtc = encoder->crtc;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct intel_output *output = enc_to_intel_output(encoder);
-        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         u32 sdvox = 0;
         int sdvo_pixel_multiply;
         struct intel_sdvo_in_out_map in_out;
@@ -1202,12 +1207,12 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         in_out.in0 = sdvo_priv->controlled_output;
         in_out.in1 = 0;
 
-        intel_sdvo_write_cmd(output, SDVO_CMD_SET_IN_OUT_MAP,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_IN_OUT_MAP,
                              &in_out, sizeof(in_out));
-        status = intel_sdvo_read_response(output, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, NULL, 0);
 
         if (sdvo_priv->is_hdmi) {
-                intel_sdvo_set_avi_infoframe(output, mode);
+                intel_sdvo_set_avi_infoframe(intel_encoder, mode);
                 sdvox |= SDVO_AUDIO_ENABLE;
         }
 
@@ -1224,16 +1229,16 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
          */
         if (!sdvo_priv->is_tv && !sdvo_priv->is_lvds) {
                 /* Set the output timing to the screen */
-                intel_sdvo_set_target_output(output,
+                intel_sdvo_set_target_output(intel_encoder,
                                              sdvo_priv->controlled_output);
-                intel_sdvo_set_output_timing(output, &input_dtd);
+                intel_sdvo_set_output_timing(intel_encoder, &input_dtd);
         }
 
         /* Set the input timing to the screen. Assume always input 0. */
-        intel_sdvo_set_target_input(output, true, false);
+        intel_sdvo_set_target_input(intel_encoder, true, false);
 
         if (sdvo_priv->is_tv)
-                intel_sdvo_set_tv_format(output);
+                intel_sdvo_set_tv_format(intel_encoder);
 
         /* We would like to use intel_sdvo_create_preferred_input_timing() to
          * provide the device with a timing it can support, if it supports that
@@ -1241,29 +1246,29 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
          * output the preferred timing, and we don't support that currently.
          */
 #if 0
-        success = intel_sdvo_create_preferred_input_timing(output, clock,
+        success = intel_sdvo_create_preferred_input_timing(encoder, clock,
                                                            width, height);
         if (success) {
                 struct intel_sdvo_dtd *input_dtd;
 
-                intel_sdvo_get_preferred_input_timing(output, &input_dtd);
-                intel_sdvo_set_input_timing(output, &input_dtd);
+                intel_sdvo_get_preferred_input_timing(encoder, &input_dtd);
+                intel_sdvo_set_input_timing(encoder, &input_dtd);
         }
 #else
-        intel_sdvo_set_input_timing(output, &input_dtd);
+        intel_sdvo_set_input_timing(intel_encoder, &input_dtd);
 #endif
 
         switch (intel_sdvo_get_pixel_multiplier(mode)) {
         case 1:
-                intel_sdvo_set_clock_rate_mult(output,
+                intel_sdvo_set_clock_rate_mult(intel_encoder,
                                                SDVO_CLOCK_RATE_MULT_1X);
                 break;
         case 2:
-                intel_sdvo_set_clock_rate_mult(output,
+                intel_sdvo_set_clock_rate_mult(intel_encoder,
                                                SDVO_CLOCK_RATE_MULT_2X);
                 break;
         case 4:
-                intel_sdvo_set_clock_rate_mult(output,
+                intel_sdvo_set_clock_rate_mult(intel_encoder,
                                                SDVO_CLOCK_RATE_MULT_4X);
                 break;
         }
@@ -1274,8 +1279,8 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
                         SDVO_VSYNC_ACTIVE_HIGH |
                         SDVO_HSYNC_ACTIVE_HIGH;
         } else {
-                sdvox |= I915_READ(sdvo_priv->output_device);
-                switch (sdvo_priv->output_device) {
+                sdvox |= I915_READ(sdvo_priv->sdvo_reg);
+                switch (sdvo_priv->sdvo_reg) {
                 case SDVOB:
                         sdvox &= SDVOB_PRESERVE_MASK;
                         break;
@@ -1299,26 +1304,26 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
 
         if (sdvo_priv->sdvo_flags & SDVO_NEED_TO_STALL)
                 sdvox |= SDVO_STALL_SELECT;
-        intel_sdvo_write_sdvox(output, sdvox);
+        intel_sdvo_write_sdvox(intel_encoder, sdvox);
 }
 
 static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
 {
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         u32 temp;
 
         if (mode != DRM_MODE_DPMS_ON) {
-                intel_sdvo_set_active_outputs(intel_output, 0);
+                intel_sdvo_set_active_outputs(intel_encoder, 0);
                 if (0)
-                        intel_sdvo_set_encoder_power_state(intel_output, mode);
+                        intel_sdvo_set_encoder_power_state(intel_encoder, mode);
 
                 if (mode == DRM_MODE_DPMS_OFF) {
-                        temp = I915_READ(sdvo_priv->output_device);
+                        temp = I915_READ(sdvo_priv->sdvo_reg);
                         if ((temp & SDVO_ENABLE) != 0) {
-                                intel_sdvo_write_sdvox(intel_output, temp & ~SDVO_ENABLE);
+                                intel_sdvo_write_sdvox(intel_encoder, temp & ~SDVO_ENABLE);
                         }
                 }
         } else {
@@ -1326,13 +1331,13 @@ static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
                 int i;
                 u8 status;
 
-                temp = I915_READ(sdvo_priv->output_device);
+                temp = I915_READ(sdvo_priv->sdvo_reg);
                 if ((temp & SDVO_ENABLE) == 0)
-                        intel_sdvo_write_sdvox(intel_output, temp | SDVO_ENABLE);
+                        intel_sdvo_write_sdvox(intel_encoder, temp | SDVO_ENABLE);
                 for (i = 0; i < 2; i++)
                   intel_wait_for_vblank(dev);
 
-                status = intel_sdvo_get_trained_inputs(intel_output, &input1,
+                status = intel_sdvo_get_trained_inputs(intel_encoder, &input1,
                                                        &input2);
 
 
@@ -1346,8 +1351,8 @@ static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
                 }
 
                 if (0)
-                        intel_sdvo_set_encoder_power_state(intel_output, mode);
-                intel_sdvo_set_active_outputs(intel_output, sdvo_priv->controlled_output);
+                        intel_sdvo_set_encoder_power_state(intel_encoder, mode);
+                intel_sdvo_set_active_outputs(intel_encoder, sdvo_priv->controlled_output);
         }
         return;
 }
@@ -1356,22 +1361,22 @@ static void intel_sdvo_save(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int o;
 
-        sdvo_priv->save_sdvo_mult = intel_sdvo_get_clock_rate_mult(intel_output);
-        intel_sdvo_get_active_outputs(intel_output, &sdvo_priv->save_active_outputs);
+        sdvo_priv->save_sdvo_mult = intel_sdvo_get_clock_rate_mult(intel_encoder);
+        intel_sdvo_get_active_outputs(intel_encoder, &sdvo_priv->save_active_outputs);
 
         if (sdvo_priv->caps.sdvo_inputs_mask & 0x1) {
-                intel_sdvo_set_target_input(intel_output, true, false);
-                intel_sdvo_get_input_timing(intel_output,
+                intel_sdvo_set_target_input(intel_encoder, true, false);
+                intel_sdvo_get_input_timing(intel_encoder,
                                             &sdvo_priv->save_input_dtd_1);
         }
 
         if (sdvo_priv->caps.sdvo_inputs_mask & 0x2) {
-                intel_sdvo_set_target_input(intel_output, false, true);
-                intel_sdvo_get_input_timing(intel_output,
+                intel_sdvo_set_target_input(intel_encoder, false, true);
+                intel_sdvo_get_input_timing(intel_encoder,
                                             &sdvo_priv->save_input_dtd_2);
         }
 
@@ -1380,8 +1385,8 @@ static void intel_sdvo_save(struct drm_connector *connector)
                 u16  this_output = (1 << o);
                 if (sdvo_priv->caps.output_flags & this_output)
                 {
-                        intel_sdvo_set_target_output(intel_output, this_output);
-                        intel_sdvo_get_output_timing(intel_output,
+                        intel_sdvo_set_target_output(intel_encoder, this_output);
+                        intel_sdvo_get_output_timing(intel_encoder,
                                                      &sdvo_priv->save_output_dtd[o]);
                 }
         }
@@ -1389,66 +1394,66 @@ static void intel_sdvo_save(struct drm_connector *connector)
                 /* XXX: Save TV format/enhancements. */
         }
 
-        sdvo_priv->save_SDVOX = I915_READ(sdvo_priv->output_device);
+        sdvo_priv->save_SDVOX = I915_READ(sdvo_priv->sdvo_reg);
 }
 
 static void intel_sdvo_restore(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int o;
         int i;
         bool input1, input2;
         u8 status;
 
-        intel_sdvo_set_active_outputs(intel_output, 0);
+        intel_sdvo_set_active_outputs(intel_encoder, 0);
 
         for (o = SDVO_OUTPUT_FIRST; o <= SDVO_OUTPUT_LAST; o++)
         {
                 u16  this_output = (1 << o);
                 if (sdvo_priv->caps.output_flags & this_output) {
-                        intel_sdvo_set_target_output(intel_output, this_output);
-                        intel_sdvo_set_output_timing(intel_output, &sdvo_priv->save_output_dtd[o]);
+                        intel_sdvo_set_target_output(intel_encoder, this_output);
+                        intel_sdvo_set_output_timing(intel_encoder, &sdvo_priv->save_output_dtd[o]);
                 }
         }
 
         if (sdvo_priv->caps.sdvo_inputs_mask & 0x1) {
-                intel_sdvo_set_target_input(intel_output, true, false);
-                intel_sdvo_set_input_timing(intel_output, &sdvo_priv->save_input_dtd_1);
+                intel_sdvo_set_target_input(intel_encoder, true, false);
+                intel_sdvo_set_input_timing(intel_encoder, &sdvo_priv->save_input_dtd_1);
         }
 
         if (sdvo_priv->caps.sdvo_inputs_mask & 0x2) {
-                intel_sdvo_set_target_input(intel_output, false, true);
-                intel_sdvo_set_input_timing(intel_output, &sdvo_priv->save_input_dtd_2);
+                intel_sdvo_set_target_input(intel_encoder, false, true);
+                intel_sdvo_set_input_timing(intel_encoder, &sdvo_priv->save_input_dtd_2);
         }
 
-        intel_sdvo_set_clock_rate_mult(intel_output, sdvo_priv->save_sdvo_mult);
+        intel_sdvo_set_clock_rate_mult(intel_encoder, sdvo_priv->save_sdvo_mult);
 
         if (sdvo_priv->is_tv) {
                 /* XXX: Restore TV format/enhancements. */
         }
 
-        intel_sdvo_write_sdvox(intel_output, sdvo_priv->save_SDVOX);
+        intel_sdvo_write_sdvox(intel_encoder, sdvo_priv->save_SDVOX);
 
         if (sdvo_priv->save_SDVOX & SDVO_ENABLE)
         {
                 for (i = 0; i < 2; i++)
                         intel_wait_for_vblank(dev);
-                status = intel_sdvo_get_trained_inputs(intel_output, &input1, &input2);
+                status = intel_sdvo_get_trained_inputs(intel_encoder, &input1, &input2);
                 if (status == SDVO_CMD_STATUS_SUCCESS && !input1)
                         DRM_DEBUG_KMS("First %s output reported failure to "
                                         "sync\n", SDVO_NAME(sdvo_priv));
         }
 
-        intel_sdvo_set_active_outputs(intel_output, sdvo_priv->save_active_outputs);
+        intel_sdvo_set_active_outputs(intel_encoder, sdvo_priv->save_active_outputs);
 }
 
 static int intel_sdvo_mode_valid(struct drm_connector *connector,
                                  struct drm_display_mode *mode)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
 
         if (mode->flags & DRM_MODE_FLAG_DBLSCAN)
                 return MODE_NO_DBLESCAN;
@@ -1473,12 +1478,12 @@ static int intel_sdvo_mode_valid(struct drm_connector *connector,
         return MODE_OK;
 }
 
-static bool intel_sdvo_get_capabilities(struct intel_output *intel_output, struct intel_sdvo_caps *caps)
+static bool intel_sdvo_get_capabilities(struct intel_encoder *intel_encoder, struct intel_sdvo_caps *caps)
 {
         u8 status;
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_DEVICE_CAPS, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, caps, sizeof(*caps));
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_DEVICE_CAPS, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, caps, sizeof(*caps));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return false;
 
@@ -1488,22 +1493,22 @@ static bool intel_sdvo_get_capabilities(struct intel_output *intel_output, struc
 struct drm_connector* intel_sdvo_find(struct drm_device *dev, int sdvoB)
 {
         struct drm_connector *connector = NULL;
-        struct intel_output *iout = NULL;
+        struct intel_encoder *iout = NULL;
         struct intel_sdvo_priv *sdvo;
 
         /* find the sdvo connector */
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                iout = to_intel_output(connector);
+                iout = to_intel_encoder(connector);
 
                 if (iout->type != INTEL_OUTPUT_SDVO)
                         continue;
 
                 sdvo = iout->dev_priv;
 
-                if (sdvo->output_device == SDVOB && sdvoB)
+                if (sdvo->sdvo_reg == SDVOB && sdvoB)
                         return connector;
 
-                if (sdvo->output_device == SDVOC && !sdvoB)
+                if (sdvo->sdvo_reg == SDVOC && !sdvoB)
                         return connector;
 
         }
@@ -1515,16 +1520,16 @@ int intel_sdvo_supports_hotplug(struct drm_connector *connector)
 {
         u8 response[2];
         u8 status;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         DRM_DEBUG_KMS("\n");
 
         if (!connector)
                 return 0;
 
-        intel_output = to_intel_output(connector);
+        intel_encoder = to_intel_encoder(connector);
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &response, 2);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
+        status = intel_sdvo_read_response(intel_encoder, &response, 2);
 
         if (response[0] !=0)
                 return 1;
@@ -1536,30 +1541,30 @@ void intel_sdvo_set_hotplug(struct drm_connector *connector, int on)
 {
         u8 response[2];
         u8 status;
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
-        intel_sdvo_read_response(intel_output, &response, 2);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
+        intel_sdvo_read_response(intel_encoder, &response, 2);
 
         if (on) {
-                intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
-                status = intel_sdvo_read_response(intel_output, &response, 2);
+                intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_HOT_PLUG_SUPPORT, NULL, 0);
+                status = intel_sdvo_read_response(intel_encoder, &response, 2);
 
-                intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
+                intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
         } else {
                 response[0] = 0;
                 response[1] = 0;
-                intel_sdvo_write_cmd(intel_output, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
+                intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_SET_ACTIVE_HOT_PLUG, &response, 2);
         }
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
-        intel_sdvo_read_response(intel_output, &response, 2);
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_ACTIVE_HOT_PLUG, NULL, 0);
+        intel_sdvo_read_response(intel_encoder, &response, 2);
 }
 
 static bool
-intel_sdvo_multifunc_encoder(struct intel_output *intel_output)
+intel_sdvo_multifunc_encoder(struct intel_encoder *intel_encoder)
 {
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int caps = 0;
 
         if (sdvo_priv->caps.output_flags &
@@ -1593,11 +1598,11 @@ static struct drm_connector *
 intel_find_analog_connector(struct drm_device *dev)
 {
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
-                intel_output = to_intel_output(connector);
-                if (intel_output->type == INTEL_OUTPUT_ANALOG)
+                intel_encoder = to_intel_encoder(connector);
+                if (intel_encoder->type == INTEL_OUTPUT_ANALOG)
                         return connector;
         }
         return NULL;
@@ -1622,16 +1627,16 @@ intel_analog_is_connected(struct drm_device *dev)
 enum drm_connector_status
 intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         enum drm_connector_status status = connector_status_connected;
         struct edid *edid = NULL;
 
-        edid = drm_get_edid(&intel_output->base,
-                            intel_output->ddc_bus);
+        edid = drm_get_edid(&intel_encoder->base,
+                            intel_encoder->ddc_bus);
 
         /* This is only applied to SDVO cards with multiple outputs */
-        if (edid == NULL && intel_sdvo_multifunc_encoder(intel_output)) {
+        if (edid == NULL && intel_sdvo_multifunc_encoder(intel_encoder)) {
                 uint8_t saved_ddc, temp_ddc;
                 saved_ddc = sdvo_priv->ddc_bus;
                 temp_ddc = sdvo_priv->ddc_bus >> 1;
@@ -1641,8 +1646,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
                  */
                 while(temp_ddc > 1) {
                         sdvo_priv->ddc_bus = temp_ddc;
-                        edid = drm_get_edid(&intel_output->base,
-                                intel_output->ddc_bus);
+                        edid = drm_get_edid(&intel_encoder->base,
+                                intel_encoder->ddc_bus);
                         if (edid) {
                                 /*
                                  * When we can get the EDID, maybe it is the
@@ -1661,8 +1666,8 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
          */
         if (edid == NULL &&
             sdvo_priv->analog_ddc_bus &&
-            !intel_analog_is_connected(intel_output->base.dev))
-                edid = drm_get_edid(&intel_output->base,
+            !intel_analog_is_connected(intel_encoder->base.dev))
+                edid = drm_get_edid(&intel_encoder->base,
                                     sdvo_priv->analog_ddc_bus);
         if (edid != NULL) {
                 /* Don't report the output as connected if it's a DVI-I
@@ -1677,7 +1682,7 @@ intel_sdvo_hdmi_sink_detect(struct drm_connector *connector, u16 response)
                 }
 
                 kfree(edid);
-                intel_output->base.display_info.raw_edid = NULL;
+                intel_encoder->base.display_info.raw_edid = NULL;
 
         } else if (response & (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1))
                 status = connector_status_disconnected;
@@ -1689,16 +1694,16 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
 {
         uint16_t response;
         u8 status;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
 
-        intel_sdvo_write_cmd(intel_output,
+        intel_sdvo_write_cmd(intel_encoder,
                              SDVO_CMD_GET_ATTACHED_DISPLAYS, NULL, 0);
         if (sdvo_priv->is_tv) {
                 /* add 30ms delay when the output type is SDVO-TV */
                 mdelay(30);
         }
-        status = intel_sdvo_read_response(intel_output, &response, 2);
+        status = intel_sdvo_read_response(intel_encoder, &response, 2);
 
         DRM_DEBUG_KMS("SDVO response %d %d\n", response & 0xff, response >> 8);
 
@@ -1708,10 +1713,10 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
         if (response == 0)
                 return connector_status_disconnected;
 
-        if (intel_sdvo_multifunc_encoder(intel_output) &&
+        if (intel_sdvo_multifunc_encoder(intel_encoder) &&
                 sdvo_priv->attached_output != response) {
                 if (sdvo_priv->controlled_output != response &&
-                        intel_sdvo_output_setup(intel_output, response) != true)
+                        intel_sdvo_output_setup(intel_encoder, response) != true)
                         return connector_status_unknown;
                 sdvo_priv->attached_output = response;
         }
@@ -1720,12 +1725,12 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
 
 static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         int num_modes;
 
         /* set the bus switch and get the modes */
-        num_modes = intel_ddc_get_modes(intel_output);
+        num_modes = intel_ddc_get_modes(intel_encoder);
 
         /*
          * Mac mini hack.  On this device, the DVI-I connector shares one DDC
@@ -1735,17 +1740,17 @@ static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
          */
         if (num_modes == 0 &&
             sdvo_priv->analog_ddc_bus &&
-            !intel_analog_is_connected(intel_output->base.dev)) {
+            !intel_analog_is_connected(intel_encoder->base.dev)) {
                 struct i2c_adapter *digital_ddc_bus;
 
                 /* Switch to the analog ddc bus and try that
                  */
-                digital_ddc_bus = intel_output->ddc_bus;
-                intel_output->ddc_bus = sdvo_priv->analog_ddc_bus;
+                digital_ddc_bus = intel_encoder->ddc_bus;
+                intel_encoder->ddc_bus = sdvo_priv->analog_ddc_bus;
 
-                (void) intel_ddc_get_modes(intel_output);
+                (void) intel_ddc_get_modes(intel_encoder);
 
-                intel_output->ddc_bus = digital_ddc_bus;
+                intel_encoder->ddc_bus = digital_ddc_bus;
         }
 }
 
@@ -1816,7 +1821,7 @@ struct drm_display_mode sdvo_tv_modes[] = {
 
 static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
 {
-        struct intel_output *output = to_intel_output(connector);
+        struct intel_encoder *output = to_intel_encoder(connector);
         struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
         struct intel_sdvo_sdtv_resolution_request tv_res;
         uint32_t reply = 0, format_map = 0;
@@ -1858,9 +1863,9 @@ static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
 
 static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
         struct drm_i915_private *dev_priv = connector->dev->dev_private;
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         struct drm_display_mode *newmode;
 
         /*
@@ -1868,7 +1873,7 @@ static void intel_sdvo_get_lvds_modes(struct drm_connector *connector)
          * Assume that the preferred modes are
          * arranged in priority order.
          */
-        intel_ddc_get_modes(intel_output);
+        intel_ddc_get_modes(intel_encoder);
         if (list_empty(&connector->probed_modes) == false)
                 goto end;
 
@@ -1897,7 +1902,7 @@ end:
 
 static int intel_sdvo_get_modes(struct drm_connector *connector)
 {
-        struct intel_output *output = to_intel_output(connector);
+        struct intel_encoder *output = to_intel_encoder(connector);
         struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
 
         if (sdvo_priv->is_tv)
@@ -1915,8 +1920,8 @@ static int intel_sdvo_get_modes(struct drm_connector *connector)
 static
 void intel_sdvo_destroy_enhance_property(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         struct drm_device *dev = connector->dev;
 
         if (sdvo_priv->is_tv) {
@@ -1953,13 +1958,13 @@ void intel_sdvo_destroy_enhance_property(struct drm_connector *connector)
 
 static void intel_sdvo_destroy(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
 
-        if (intel_output->i2c_bus)
-                intel_i2c_destroy(intel_output->i2c_bus);
-        if (intel_output->ddc_bus)
-                intel_i2c_destroy(intel_output->ddc_bus);
+        if (intel_encoder->i2c_bus)
+                intel_i2c_destroy(intel_encoder->i2c_bus);
+        if (intel_encoder->ddc_bus)
+                intel_i2c_destroy(intel_encoder->ddc_bus);
         if (sdvo_priv->analog_ddc_bus)
                 intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
 
@@ -1977,7 +1982,7 @@ static void intel_sdvo_destroy(struct drm_connector *connector)
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
 
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
 
 static int
@@ -1985,9 +1990,9 @@ intel_sdvo_set_property(struct drm_connector *connector,
                         struct drm_property *property,
                         uint64_t val)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_crtc *crtc = encoder->crtc;
         int ret = 0;
         bool changed = false;
@@ -2095,8 +2100,8 @@ intel_sdvo_set_property(struct drm_connector *connector,
                         sdvo_priv->cur_brightness = temp_value;
                 }
                 if (cmd) {
-                        intel_sdvo_write_cmd(intel_output, cmd, &temp_value, 2);
-                        status = intel_sdvo_read_response(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder, cmd, &temp_value, 2);
+                        status = intel_sdvo_read_response(intel_encoder,
                                                                 NULL, 0);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO command \n");
@@ -2191,7 +2196,7 @@ intel_sdvo_select_ddc_bus(struct intel_sdvo_priv *dev_priv)
 }
 
 static bool
-intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
+intel_sdvo_get_digital_encoding_mode(struct intel_encoder *output)
 {
         struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
         uint8_t status;
@@ -2205,42 +2210,42 @@ intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
         return true;
 }
 
-static struct intel_output *
-intel_sdvo_chan_to_intel_output(struct intel_i2c_chan *chan)
+static struct intel_encoder *
+intel_sdvo_chan_to_intel_encoder(struct intel_i2c_chan *chan)
 {
         struct drm_device *dev = chan->drm_dev;
         struct drm_connector *connector;
-        struct intel_output *intel_output = NULL;
+        struct intel_encoder *intel_encoder = NULL;
 
         list_for_each_entry(connector,
                         &dev->mode_config.connector_list, head) {
-                if (to_intel_output(connector)->ddc_bus == &chan->adapter) {
-                        intel_output = to_intel_output(connector);
+                if (to_intel_encoder(connector)->ddc_bus == &chan->adapter) {
+                        intel_encoder = to_intel_encoder(connector);
                         break;
                 }
         }
-        return intel_output;
+        return intel_encoder;
 }
 
 static int intel_sdvo_master_xfer(struct i2c_adapter *i2c_adap,
                                   struct i2c_msg msgs[], int num)
 {
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_sdvo_priv *sdvo_priv;
         struct i2c_algo_bit_data *algo_data;
         const struct i2c_algorithm *algo;
 
         algo_data = (struct i2c_algo_bit_data *)i2c_adap->algo_data;
-        intel_output =
-                intel_sdvo_chan_to_intel_output(
+        intel_encoder =
+                intel_sdvo_chan_to_intel_encoder(
                                 (struct intel_i2c_chan *)(algo_data->data));
-        if (intel_output == NULL)
+        if (intel_encoder == NULL)
                 return -EINVAL;
 
-        sdvo_priv = intel_output->dev_priv;
-        algo = intel_output->i2c_bus->algo;
+        sdvo_priv = intel_encoder->dev_priv;
+        algo = intel_encoder->i2c_bus->algo;
 
-        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
+        intel_sdvo_set_control_bus_switch(intel_encoder, sdvo_priv->ddc_bus);
         return algo->master_xfer(i2c_adap, msgs, num);
 }
 
@@ -2249,12 +2254,12 @@ static struct i2c_algorithm intel_sdvo_i2c_bit_algo = {
 };
 
 static u8
-intel_sdvo_get_slave_addr(struct drm_device *dev, int output_device)
+intel_sdvo_get_slave_addr(struct drm_device *dev, int sdvo_reg)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct sdvo_device_mapping *my_mapping, *other_mapping;
 
-        if (output_device == SDVOB) {
+        if (sdvo_reg == SDVOB) {
                 my_mapping = &dev_priv->sdvo_mappings[0];
                 other_mapping = &dev_priv->sdvo_mappings[1];
         } else {
@@ -2279,7 +2284,7 @@ intel_sdvo_get_slave_addr(struct drm_device *dev, int output_device)
         /* No SDVO device info is found for another DVO port,
          * so use mapping assumption we had before BIOS parsing.
          */
-        if (output_device == SDVOB)
+        if (sdvo_reg == SDVOB)
                 return 0x70;
         else
                 return 0x72;
@@ -2305,15 +2310,15 @@ static struct dmi_system_id intel_sdvo_bad_tv[] = {
 };
 
 static bool
-intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
+intel_sdvo_output_setup(struct intel_encoder *intel_encoder, uint16_t flags)
 {
-        struct drm_connector *connector = &intel_output->base;
-        struct drm_encoder *encoder = &intel_output->enc;
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct drm_connector *connector = &intel_encoder->base;
+        struct drm_encoder *encoder = &intel_encoder->enc;
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         bool ret = true, registered = false;
 
         sdvo_priv->is_tv = false;
-        intel_output->needs_tv_clock = false;
+        intel_encoder->needs_tv_clock = false;
         sdvo_priv->is_lvds = false;
 
         if (device_is_registered(&connector->kdev)) {
@@ -2331,16 +2336,16 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                 encoder->encoder_type = DRM_MODE_ENCODER_TMDS;
                 connector->connector_type = DRM_MODE_CONNECTOR_DVID;
 
-                if (intel_sdvo_get_supp_encode(intel_output,
+                if (intel_sdvo_get_supp_encode(intel_encoder,
                                                &sdvo_priv->encode) &&
-                    intel_sdvo_get_digital_encoding_mode(intel_output) &&
+                    intel_sdvo_get_digital_encoding_mode(intel_encoder) &&
                     sdvo_priv->is_hdmi) {
                         /* enable hdmi encoding mode if supported */
-                        intel_sdvo_set_encode(intel_output, SDVO_ENCODE_HDMI);
-                        intel_sdvo_set_colorimetry(intel_output,
+                        intel_sdvo_set_encode(intel_encoder, SDVO_ENCODE_HDMI);
+                        intel_sdvo_set_colorimetry(intel_encoder,
                                                    SDVO_COLORIMETRY_RGB256);
                         connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
-                        intel_output->clone_mask =
+                        intel_encoder->clone_mask =
                                         (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                         (1 << INTEL_ANALOG_CLONE_BIT);
                 }
@@ -2351,21 +2356,21 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                 encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
                 connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                 sdvo_priv->is_tv = true;
-                intel_output->needs_tv_clock = true;
-                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
+                intel_encoder->needs_tv_clock = true;
+                intel_encoder->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
         } else if (flags & SDVO_OUTPUT_RGB0) {
 
                 sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
                 encoder->encoder_type = DRM_MODE_ENCODER_DAC;
                 connector->connector_type = DRM_MODE_CONNECTOR_VGA;
-                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                intel_encoder->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                         (1 << INTEL_ANALOG_CLONE_BIT);
         } else if (flags & SDVO_OUTPUT_RGB1) {
 
                 sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
                 encoder->encoder_type = DRM_MODE_ENCODER_DAC;
                 connector->connector_type = DRM_MODE_CONNECTOR_VGA;
-                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                intel_encoder->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                         (1 << INTEL_ANALOG_CLONE_BIT);
         } else if (flags & SDVO_OUTPUT_CVBS0) {
 
@@ -2373,15 +2378,15 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                 encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
                 connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                 sdvo_priv->is_tv = true;
-                intel_output->needs_tv_clock = true;
-                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
+                intel_encoder->needs_tv_clock = true;
+                intel_encoder->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
         } else if (flags & SDVO_OUTPUT_LVDS0) {
 
                 sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
                 encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                 connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                 sdvo_priv->is_lvds = true;
-                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                intel_encoder->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
                                         (1 << INTEL_SDVO_LVDS_CLONE_BIT);
         } else if (flags & SDVO_OUTPUT_LVDS1) {
 
@@ -2389,7 +2394,7 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                 encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                 connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                 sdvo_priv->is_lvds = true;
-                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                intel_encoder->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
                                         (1 << INTEL_SDVO_LVDS_CLONE_BIT);
         } else {
 
@@ -2402,7 +2407,7 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                               bytes[0], bytes[1]);
                 ret = false;
         }
-        intel_output->crtc_mask = (1 << 0) | (1 << 1);
+        intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
 
         if (ret && registered)
                 ret = drm_sysfs_connector_add(connector) == 0 ? true : false;
@@ -2414,18 +2419,18 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
 
 static void intel_sdvo_tv_create_property(struct drm_connector *connector)
 {
-      struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+      struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         struct intel_sdvo_tv_format format;
         uint32_t format_map, i;
         uint8_t status;
 
-        intel_sdvo_set_target_output(intel_output,
+        intel_sdvo_set_target_output(intel_encoder,
                                      sdvo_priv->controlled_output);
 
-        intel_sdvo_write_cmd(intel_output,
+        intel_sdvo_write_cmd(intel_encoder,
                              SDVO_CMD_GET_SUPPORTED_TV_FORMATS, NULL, 0);
-        status = intel_sdvo_read_response(intel_output,
+        status = intel_sdvo_read_response(intel_encoder,
                                           &format, sizeof(format));
         if (status != SDVO_CMD_STATUS_SUCCESS)
                 return;
@@ -2463,16 +2468,16 @@ static void intel_sdvo_tv_create_property(struct drm_connector *connector)
 
 static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_encoder->dev_priv;
         struct intel_sdvo_enhancements_reply sdvo_data;
         struct drm_device *dev = connector->dev;
         uint8_t status;
         uint16_t response, data_value[2];
 
-        intel_sdvo_write_cmd(intel_output, SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
+        intel_sdvo_write_cmd(intel_encoder, SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
                                                 NULL, 0);
-        status = intel_sdvo_read_response(intel_output, &sdvo_data,
+        status = intel_sdvo_read_response(intel_encoder, &sdvo_data,
                                         sizeof(sdvo_data));
         if (status != SDVO_CMD_STATUS_SUCCESS) {
                 DRM_DEBUG_KMS(" incorrect response is returned\n");
@@ -2488,18 +2493,18 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                  * property
                  */
                 if (sdvo_data.overscan_h) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_OVERSCAN_H, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO max "
                                                 "h_overscan\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_OVERSCAN_H, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO h_overscan\n");
@@ -2529,18 +2534,18 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                                         data_value[0], data_value[1], response);
                 }
                 if (sdvo_data.overscan_v) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_OVERSCAN_V, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO max "
                                                 "v_overscan\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_OVERSCAN_V, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO v_overscan\n");
@@ -2570,17 +2575,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                                         data_value[0], data_value[1], response);
                 }
                 if (sdvo_data.position_h) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_POSITION_H, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max h_pos\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_POSITION_H, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get h_postion\n");
@@ -2601,17 +2606,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                                         data_value[0], data_value[1], response);
                 }
                 if (sdvo_data.position_v) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_POSITION_V, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max v_pos\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_POSITION_V, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get v_postion\n");
@@ -2634,17 +2639,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
         }
         if (sdvo_priv->is_tv) {
                 if (sdvo_data.saturation) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_SATURATION, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max sat\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_SATURATION, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get sat\n");
@@ -2666,17 +2671,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                                         data_value[0], data_value[1], response);
                 }
                 if (sdvo_data.contrast) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_CONTRAST, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max contrast\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_CONTRAST, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get contrast\n");
@@ -2697,17 +2702,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
                                         data_value[0], data_value[1], response);
                 }
                 if (sdvo_data.hue) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_HUE, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max hue\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_HUE, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get hue\n");
@@ -2730,17 +2735,17 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
         }
         if (sdvo_priv->is_tv || sdvo_priv->is_lvds) {
                 if (sdvo_data.brightness) {
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_MAX_BRIGHTNESS, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &data_value, 4);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO Max bright\n");
                                 return;
                         }
-                        intel_sdvo_write_cmd(intel_output,
+                        intel_sdvo_write_cmd(intel_encoder,
                                 SDVO_CMD_GET_BRIGHTNESS, NULL, 0);
-                        status = intel_sdvo_read_response(intel_output,
+                        status = intel_sdvo_read_response(intel_encoder,
                                 &response, 2);
                         if (status != SDVO_CMD_STATUS_SUCCESS) {
                                 DRM_DEBUG_KMS("Incorrect SDVO get brigh\n");
@@ -2765,81 +2770,81 @@ static void intel_sdvo_create_enhance_property(struct drm_connector *connector)
         return;
 }
 
-bool intel_sdvo_init(struct drm_device *dev, int output_device)
+bool intel_sdvo_init(struct drm_device *dev, int sdvo_reg)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_sdvo_priv *sdvo_priv;
 
         u8 ch[0x40];
         int i;
 
-        intel_output = kcalloc(sizeof(struct intel_output)+sizeof(struct intel_sdvo_priv), 1, GFP_KERNEL);
-        if (!intel_output) {
+        intel_encoder = kcalloc(sizeof(struct intel_encoder)+sizeof(struct intel_sdvo_priv), 1, GFP_KERNEL);
+        if (!intel_encoder) {
                 return false;
         }
 
-        sdvo_priv = (struct intel_sdvo_priv *)(intel_output + 1);
-        sdvo_priv->output_device = output_device;
+        sdvo_priv = (struct intel_sdvo_priv *)(intel_encoder + 1);
+        sdvo_priv->sdvo_reg = sdvo_reg;
 
-        intel_output->dev_priv = sdvo_priv;
-        intel_output->type = INTEL_OUTPUT_SDVO;
+        intel_encoder->dev_priv = sdvo_priv;
+        intel_encoder->type = INTEL_OUTPUT_SDVO;
 
         /* setup the DDC bus. */
-        if (output_device == SDVOB)
-                intel_output->i2c_bus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOB");
+        if (sdvo_reg == SDVOB)
+                intel_encoder->i2c_bus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOB");
         else
-                intel_output->i2c_bus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOC");
+                intel_encoder->i2c_bus = intel_i2c_create(dev, GPIOE, "SDVOCTRL_E for SDVOC");
 
-        if (!intel_output->i2c_bus)
+        if (!intel_encoder->i2c_bus)
                 goto err_inteloutput;
 
-        sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, output_device);
+        sdvo_priv->slave_addr = intel_sdvo_get_slave_addr(dev, sdvo_reg);
 
         /* Save the bit-banging i2c functionality for use by the DDC wrapper */
-        intel_sdvo_i2c_bit_algo.functionality = intel_output->i2c_bus->algo->functionality;
+        intel_sdvo_i2c_bit_algo.functionality = intel_encoder->i2c_bus->algo->functionality;
 
         /* Read the regs to test if we can talk to the device */
         for (i = 0; i < 0x40; i++) {
-                if (!intel_sdvo_read_byte(intel_output, i, &ch[i])) {
+                if (!intel_sdvo_read_byte(intel_encoder, i, &ch[i])) {
                         DRM_DEBUG_KMS("No SDVO device found on SDVO%c\n",
-                                        output_device == SDVOB ? 'B' : 'C');
+                                        sdvo_reg == SDVOB ? 'B' : 'C');
                         goto err_i2c;
                 }
         }
 
         /* setup the DDC bus. */
-        if (output_device == SDVOB) {
-                intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
+        if (sdvo_reg == SDVOB) {
+                intel_encoder->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOB DDC BUS");
                 sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
                                                 "SDVOB/VGA DDC BUS");
                 dev_priv->hotplug_supported_mask |= SDVOB_HOTPLUG_INT_STATUS;
         } else {
-                intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
+                intel_encoder->ddc_bus = intel_i2c_create(dev, GPIOE, "SDVOC DDC BUS");
                 sdvo_priv->analog_ddc_bus = intel_i2c_create(dev, GPIOA,
                                                 "SDVOC/VGA DDC BUS");
                 dev_priv->hotplug_supported_mask |= SDVOC_HOTPLUG_INT_STATUS;
         }
 
-        if (intel_output->ddc_bus == NULL)
+        if (intel_encoder->ddc_bus == NULL)
                 goto err_i2c;
 
         /* Wrap with our custom algo which switches to DDC mode */
-        intel_output->ddc_bus->algo = &intel_sdvo_i2c_bit_algo;
+        intel_encoder->ddc_bus->algo = &intel_sdvo_i2c_bit_algo;
 
         /* In default case sdvo lvds is false */
-        intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
+        intel_sdvo_get_capabilities(intel_encoder, &sdvo_priv->caps);
 
-        if (intel_sdvo_output_setup(intel_output,
+        if (intel_sdvo_output_setup(intel_encoder,
                                     sdvo_priv->caps.output_flags) != true) {
                 DRM_DEBUG_KMS("SDVO output failed to setup on SDVO%c\n",
-                          output_device == SDVOB ? 'B' : 'C');
+                          sdvo_reg == SDVOB ? 'B' : 'C');
                 goto err_i2c;
         }
 
 
-        connector = &intel_output->base;
+        connector = &intel_encoder->base;
         drm_connector_init(dev, connector, &intel_sdvo_connector_funcs,
                            connector->connector_type);
 
@@ -2848,12 +2853,12 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         connector->doublescan_allowed = 0;
         connector->display_info.subpixel_order = SubPixelHorizontalRGB;
 
-        drm_encoder_init(dev, &intel_output->enc,
-                        &intel_sdvo_enc_funcs, intel_output->enc.encoder_type);
+        drm_encoder_init(dev, &intel_encoder->enc,
+                        &intel_sdvo_enc_funcs, intel_encoder->enc.encoder_type);
 
-        drm_encoder_helper_add(&intel_output->enc, &intel_sdvo_helper_funcs);
+        drm_encoder_helper_add(&intel_encoder->enc, &intel_sdvo_helper_funcs);
 
-        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
+        drm_mode_connector_attach_encoder(&intel_encoder->base, &intel_encoder->enc);
         if (sdvo_priv->is_tv)
                 intel_sdvo_tv_create_property(connector);
 
@@ -2865,9 +2870,9 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         intel_sdvo_select_ddc_bus(sdvo_priv);
 
         /* Set the input timing to the screen. Assume always input 0. */
-        intel_sdvo_set_target_input(intel_output, true, false);
+        intel_sdvo_set_target_input(intel_encoder, true, false);
 
-        intel_sdvo_get_input_pixel_clock_range(intel_output,
+        intel_sdvo_get_input_pixel_clock_range(intel_encoder,
                                                &sdvo_priv->pixel_clock_min,
                                                &sdvo_priv->pixel_clock_max);
 
@@ -2894,12 +2899,12 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
 err_i2c:
         if (sdvo_priv->analog_ddc_bus != NULL)
                 intel_i2c_destroy(sdvo_priv->analog_ddc_bus);
-        if (intel_output->ddc_bus != NULL)
-                intel_i2c_destroy(intel_output->ddc_bus);
-        if (intel_output->i2c_bus != NULL)
-                intel_i2c_destroy(intel_output->i2c_bus);
+        if (intel_encoder->ddc_bus != NULL)
+                intel_i2c_destroy(intel_encoder->ddc_bus);
+        if (intel_encoder->i2c_bus != NULL)
+                intel_i2c_destroy(intel_encoder->i2c_bus);
 err_inteloutput:
-        kfree(intel_output);
+        kfree(intel_encoder);
 
         return false;
 }
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index 552ec110b741..d7d39b2327df 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -921,8 +921,8 @@ intel_tv_save(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
         int i;
 
         tv_priv->save_TV_H_CTL_1 = I915_READ(TV_H_CTL_1);
@@ -971,8 +971,8 @@ intel_tv_restore(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
         struct drm_crtc *crtc = connector->encoder->crtc;
         struct intel_crtc *intel_crtc;
         int i;
@@ -1068,9 +1068,9 @@ intel_tv_mode_lookup (char *tv_format)
 }
 
 static const struct tv_mode *
-intel_tv_mode_find (struct intel_output *intel_output)
+intel_tv_mode_find (struct intel_encoder *intel_encoder)
 {
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
 
         return intel_tv_mode_lookup(tv_priv->tv_format);
 }
@@ -1078,8 +1078,8 @@ intel_tv_mode_find (struct intel_output *intel_output)
 static enum drm_mode_status
 intel_tv_mode_valid(struct drm_connector *connector, struct drm_display_mode *mode)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_encoder);
 
         /* Ensure TV refresh is close to desired refresh */
         if (tv_mode && abs(tv_mode->refresh - drm_mode_vrefresh(mode) * 1000)
@@ -1095,8 +1095,8 @@ intel_tv_mode_fixup(struct drm_encoder *encoder, struct drm_display_mode *mode,
 {
         struct drm_device *dev = encoder->dev;
         struct drm_mode_config *drm_config = &dev->mode_config;
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        const struct tv_mode *tv_mode = intel_tv_mode_find (intel_output);
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        const struct tv_mode *tv_mode = intel_tv_mode_find (intel_encoder);
         struct drm_encoder *other_encoder;
 
         if (!tv_mode)
@@ -1121,9 +1121,9 @@ intel_tv_mode_set(struct drm_encoder *encoder, struct drm_display_mode *mode,
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_crtc *crtc = encoder->crtc;
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
-        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        struct intel_encoder *intel_encoder = enc_to_intel_encoder(encoder);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_encoder);
         u32 tv_ctl;
         u32 hctl1, hctl2, hctl3;
         u32 vctl1, vctl2, vctl3, vctl4, vctl5, vctl6, vctl7;
@@ -1360,9 +1360,9 @@ static const struct drm_display_mode reported_modes[] = {
  * \return false if TV is disconnected.
  */
 static int
-intel_tv_detect_type (struct drm_crtc *crtc, struct intel_output *intel_output)
+intel_tv_detect_type (struct drm_crtc *crtc, struct intel_encoder *intel_encoder)
 {
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_device *dev = encoder->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         unsigned long irqflags;
@@ -1441,9 +1441,9 @@ intel_tv_detect_type (struct drm_crtc *crtc, struct intel_output *intel_output)
  */
 static void intel_tv_find_better_format(struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
-        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_encoder);
         int i;
 
         if ((tv_priv->type == DRM_MODE_CONNECTOR_Component) ==
@@ -1475,9 +1475,9 @@ intel_tv_detect(struct drm_connector *connector)
 {
         struct drm_crtc *crtc;
         struct drm_display_mode mode;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         int dpms_mode;
         int type = tv_priv->type;
 
@@ -1485,12 +1485,12 @@ intel_tv_detect(struct drm_connector *connector)
         drm_mode_set_crtcinfo(&mode, CRTC_INTERLACE_HALVE_V);
 
         if (encoder->crtc && encoder->crtc->enabled) {
-                type = intel_tv_detect_type(encoder->crtc, intel_output);
+                type = intel_tv_detect_type(encoder->crtc, intel_encoder);
         } else {
-                crtc = intel_get_load_detect_pipe(intel_output, &mode, &dpms_mode);
+                crtc = intel_get_load_detect_pipe(intel_encoder, &mode, &dpms_mode);
                 if (crtc) {
-                        type = intel_tv_detect_type(crtc, intel_output);
-                        intel_release_load_detect_pipe(intel_output, dpms_mode);
+                        type = intel_tv_detect_type(crtc, intel_encoder);
+                        intel_release_load_detect_pipe(intel_encoder, dpms_mode);
                 } else
                         type = -1;
         }
@@ -1525,8 +1525,8 @@ static void
 intel_tv_chose_preferred_modes(struct drm_connector *connector,
                                struct drm_display_mode *mode_ptr)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
-        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_encoder);
 
         if (tv_mode->nbr_end < 480 && mode_ptr->vdisplay == 480)
                 mode_ptr->type |= DRM_MODE_TYPE_PREFERRED;
@@ -1550,8 +1550,8 @@ static int
 intel_tv_get_modes(struct drm_connector *connector)
 {
         struct drm_display_mode *mode_ptr;
-        struct intel_output *intel_output = to_intel_output(connector);
-        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_output);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        const struct tv_mode *tv_mode = intel_tv_mode_find(intel_encoder);
         int j, count = 0;
         u64 tmp;
 
@@ -1604,11 +1604,11 @@ intel_tv_get_modes(struct drm_connector *connector)
 static void
 intel_tv_destroy (struct drm_connector *connector)
 {
-        struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
 
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
-        kfree(intel_output);
+        kfree(intel_encoder);
 }
 
 
@@ -1617,9 +1617,9 @@ intel_tv_set_property(struct drm_connector *connector, struct drm_property *prop
                       uint64_t val)
 {
         struct drm_device *dev = connector->dev;
-        struct intel_output *intel_output = to_intel_output(connector);
-        struct intel_tv_priv *tv_priv = intel_output->dev_priv;
-        struct drm_encoder *encoder = &intel_output->enc;
+        struct intel_encoder *intel_encoder = to_intel_encoder(connector);
+        struct intel_tv_priv *tv_priv = intel_encoder->dev_priv;
+        struct drm_encoder *encoder = &intel_encoder->enc;
         struct drm_crtc *crtc = encoder->crtc;
         int ret = 0;
         bool changed = false;
@@ -1740,7 +1740,7 @@ intel_tv_init(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
-        struct intel_output *intel_output;
+        struct intel_encoder *intel_encoder;
         struct intel_tv_priv *tv_priv;
         u32 tv_dac_on, tv_dac_off, save_tv_dac;
         char **tv_format_names;
@@ -1780,28 +1780,28 @@ intel_tv_init(struct drm_device *dev)
             (tv_dac_off & TVDAC_STATE_CHG_EN) != 0)
                 return;
 
-        intel_output = kzalloc(sizeof(struct intel_output) +
+        intel_encoder = kzalloc(sizeof(struct intel_encoder) +
                                sizeof(struct intel_tv_priv), GFP_KERNEL);
-        if (!intel_output) {
+        if (!intel_encoder) {
                 return;
         }
 
-        connector = &intel_output->base;
+        connector = &intel_encoder->base;
 
         drm_connector_init(dev, connector, &intel_tv_connector_funcs,
                            DRM_MODE_CONNECTOR_SVIDEO);
 
-        drm_encoder_init(dev, &intel_output->enc, &intel_tv_enc_funcs,
+        drm_encoder_init(dev, &intel_encoder->enc, &intel_tv_enc_funcs,
                          DRM_MODE_ENCODER_TVDAC);
 
-        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
-        tv_priv = (struct intel_tv_priv *)(intel_output + 1);
-        intel_output->type = INTEL_OUTPUT_TVOUT;
-        intel_output->crtc_mask = (1 << 0) | (1 << 1);
-        intel_output->clone_mask = (1 << INTEL_TV_CLONE_BIT);
-        intel_output->enc.possible_crtcs = ((1 << 0) | (1 << 1));
-        intel_output->enc.possible_clones = (1 << INTEL_OUTPUT_TVOUT);
-        intel_output->dev_priv = tv_priv;
+        drm_mode_connector_attach_encoder(&intel_encoder->base, &intel_encoder->enc);
+        tv_priv = (struct intel_tv_priv *)(intel_encoder + 1);
+        intel_encoder->type = INTEL_OUTPUT_TVOUT;
+        intel_encoder->crtc_mask = (1 << 0) | (1 << 1);
+        intel_encoder->clone_mask = (1 << INTEL_TV_CLONE_BIT);
+        intel_encoder->enc.possible_crtcs = ((1 << 0) | (1 << 1));
+        intel_encoder->enc.possible_clones = (1 << INTEL_OUTPUT_TVOUT);
+        intel_encoder->dev_priv = tv_priv;
         tv_priv->type = DRM_MODE_CONNECTOR_Unknown;
 
         /* BIOS margin values */
@@ -1812,7 +1812,7 @@ intel_tv_init(struct drm_device *dev)
 
         tv_priv->tv_format = kstrdup(tv_modes[initial_mode].name, GFP_KERNEL);
 
-        drm_encoder_helper_add(&intel_output->enc, &intel_tv_helper_funcs);
+        drm_encoder_helper_add(&intel_encoder->enc, &intel_tv_helper_funcs);
         drm_connector_helper_add(connector, &intel_tv_connector_helper_funcs);
         connector->interlace_allowed = false;
         connector->doublescan_allowed = false;
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index bcec2d79636e..1d569830ed99 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -908,11 +908,16 @@ static void atom_op_shl(atom_exec_context *ctx, int *ptr, int arg)
         uint8_t attr = U8((*ptr)++), shift;
         uint32_t saved, dst;
         int dptr = *ptr;
+        uint32_t dst_align = atom_dst_to_src[(attr >> 3) & 7][(attr >> 6) & 3];
         SDEBUG("   dst: ");
         dst = atom_get_dst(ctx, arg, attr, ptr, &saved, 1);
+        /* op needs to full dst value */
+        dst = saved;
         shift = atom_get_src(ctx, attr, ptr);
         SDEBUG("   shift: %d\n", shift);
         dst <<= shift;
+        dst &= atom_arg_mask[dst_align];
+        dst >>= atom_arg_shift[dst_align];
         SDEBUG("   dst: ");
         atom_put_dst(ctx, arg, attr, &dptr, dst, saved);
 }
@@ -922,11 +927,16 @@ static void atom_op_shr(atom_exec_context *ctx, int *ptr, int arg)
         uint8_t attr = U8((*ptr)++), shift;
         uint32_t saved, dst;
         int dptr = *ptr;
+        uint32_t dst_align = atom_dst_to_src[(attr >> 3) & 7][(attr >> 6) & 3];
         SDEBUG("   dst: ");
         dst = atom_get_dst(ctx, arg, attr, ptr, &saved, 1);
+        /* op needs to full dst value */
+        dst = saved;
         shift = atom_get_src(ctx, attr, ptr);
         SDEBUG("   shift: %d\n", shift);
         dst >>= shift;
+        dst &= atom_arg_mask[dst_align];
+        dst >>= atom_arg_shift[dst_align];
         SDEBUG("   dst: ");
         atom_put_dst(ctx, arg, attr, &dptr, dst, saved);
 }
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index fd4ef6d18849..a87990b3ae84 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -521,6 +521,10 @@ static u32 atombios_adjust_pll(struct drm_crtc *crtc,
                                 /* DVO wants 2x pixel clock if the DVO chip is in 12 bit mode */
                                 if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1)
                                         adjusted_clock = mode->clock * 2;
+                                if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)) {
+                                        pll->algo = PLL_ALGO_LEGACY;
+                                        pll->flags |= RADEON_PLL_PREFER_CLOSEST_LOWER;
+                                }
                         } else {
                                 if (encoder->encoder_type != DRM_MODE_ENCODER_DAC)
                                         pll->flags |= RADEON_PLL_NO_ODD_POST_DIV;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index c9580497ede4..d7388fdb6d0b 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2891,7 +2891,7 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
 {
         struct radeon_bo *robj;
         unsigned long size;
-        unsigned u, i, w, h;
+        unsigned u, i, w, h, d;
         int ret;
 
         for (u = 0; u < track->num_texture; u++) {
@@ -2923,20 +2923,25 @@ static int r100_cs_track_texture_check(struct radeon_device *rdev,
                         h = h / (1 << i);
                         if (track->textures[u].roundup_h)
                                 h = roundup_pow_of_two(h);
+                        if (track->textures[u].tex_coord_type == 1) {
+                                d = (1 << track->textures[u].txdepth) / (1 << i);
+                                if (!d)
+                                        d = 1;
+                        } else {
+                                d = 1;
+                        }
                         if (track->textures[u].compress_format) {
 
-                                size += r100_track_compress_size(track->textures[u].compress_format, w, h);
+                                size += r100_track_compress_size(track->textures[u].compress_format, w, h) * d;
                                 /* compressed textures are block based */
                         } else
-                                size += w * h;
+                                size += w * h * d;
                 }
                 size *= track->textures[u].cpp;
 
                 switch (track->textures[u].tex_coord_type) {
                 case 0:
-                        break;
                 case 1:
-                        size *= (1 << track->textures[u].txdepth);
                         break;
                 case 2:
                         if (track->separate_cube) {
@@ -3007,7 +3012,11 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
                 }
         }
         prim_walk = (track->vap_vf_cntl >> 4) & 0x3;
-        nverts = (track->vap_vf_cntl >> 16) & 0xFFFF;
+        if (track->vap_vf_cntl & (1 << 14)) {
+                nverts = track->vap_alt_nverts;
+        } else {
+                nverts = (track->vap_vf_cntl >> 16) & 0xFFFF;
+        }
         switch (prim_walk) {
         case 1:
                 for (i = 0; i < track->num_arrays; i++) {
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index b27a6999d219..fadfe68de9cc 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -64,6 +64,7 @@ struct r100_cs_track {
         unsigned                        maxy;
         unsigned                        vtx_size;
         unsigned                        vap_vf_cntl;
+        unsigned                        vap_alt_nverts;
         unsigned                        immd_dwords;
         unsigned                        num_arrays;
         unsigned                        max_indx;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 2b9affe754ce..bd75f99bd65e 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -730,6 +730,12 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 /* VAP_VF_MAX_VTX_INDX */
                 track->max_indx = idx_value & 0x00FFFFFFUL;
                 break;
+        case 0x2088:
+                /* VAP_ALT_NUM_VERTICES - only valid on r500 */
+                if (p->rdev->family < CHIP_RV515)
+                        goto fail;
+                track->vap_alt_nverts = idx_value & 0xFFFFFF;
+                break;
         case 0x43E4:
                 /* SC_SCISSOR1 */
                 track->maxy = ((idx_value >> 13) & 0x1FFF) + 1;
@@ -767,7 +773,6 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                 tmp = idx_value & ~(0x7 << 16);
                 tmp |= tile_flags;
                 ib[idx] = tmp;
-
                 i = (reg - 0x4E38) >> 2;
                 track->cb[i].pitch = idx_value & 0x3FFE;
                 switch (((idx_value >> 21) & 0xF)) {
@@ -1052,11 +1057,13 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                         break;
                 /* fallthrough do not move */
         default:
-                printk(KERN_ERR "Forbidden register 0x%04X in cs at %d\n",
-                       reg, idx);
-                return -EINVAL;
+                goto fail;
         }
         return 0;
+fail:
+        printk(KERN_ERR "Forbidden register 0x%04X in cs at %d\n",
+               reg, idx);
+        return -EINVAL;
 }
 
 static int r300_packet3_check(struct radeon_cs_parser *p,
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index dac7042b797e..1d898051c631 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -35,7 +35,7 @@
  */
 static int r600_audio_chipset_supported(struct radeon_device *rdev)
 {
-        return rdev->family >= CHIP_R600
+        return (rdev->family >= CHIP_R600 && rdev->family < CHIP_CEDAR)
                 || rdev->family == CHIP_RS600
                 || rdev->family == CHIP_RS690
                 || rdev->family == CHIP_RS740;
diff --git a/drivers/gpu/drm/radeon/r600_hdmi.c b/drivers/gpu/drm/radeon/r600_hdmi.c
index 029fa1406d1d..2616b822ba68 100644
--- a/drivers/gpu/drm/radeon/r600_hdmi.c
+++ b/drivers/gpu/drm/radeon/r600_hdmi.c
@@ -314,6 +314,9 @@ void r600_hdmi_setmode(struct drm_encoder *encoder, struct drm_display_mode *mod
         struct radeon_device *rdev = dev->dev_private;
         uint32_t offset = to_radeon_encoder(encoder)->hdmi_offset;
 
+        if (ASIC_IS_DCE4(rdev))
+                return;
+
         if (!offset)
                 return;
 
@@ -484,6 +487,9 @@ void r600_hdmi_enable(struct drm_encoder *encoder)
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
+        if (ASIC_IS_DCE4(rdev))
+                return;
+
         if (!radeon_encoder->hdmi_offset) {
                 r600_hdmi_assign_block(encoder);
                 if (!radeon_encoder->hdmi_offset) {
@@ -525,6 +531,9 @@ void r600_hdmi_disable(struct drm_encoder *encoder)
         struct radeon_device *rdev = dev->dev_private;
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
 
+        if (ASIC_IS_DCE4(rdev))
+                return;
+
         if (!radeon_encoder->hdmi_offset) {
                 dev_err(rdev->dev, "Disabling not enabled HDMI\n");
                 return;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 3fba50540f72..1331351c5178 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -162,12 +162,14 @@ radeon_connector_analog_encoder_conflict_solve(struct drm_connector *connector,
 {
         struct drm_device *dev = connector->dev;
         struct drm_connector *conflict;
+        struct radeon_connector *radeon_conflict;
         int i;
 
         list_for_each_entry(conflict, &dev->mode_config.connector_list, head) {
                 if (conflict == connector)
                         continue;
 
+                radeon_conflict = to_radeon_connector(conflict);
                 for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
                         if (conflict->encoder_ids[i] == 0)
                                 break;
@@ -177,6 +179,9 @@ radeon_connector_analog_encoder_conflict_solve(struct drm_connector *connector,
                                 if (conflict->status != connector_status_connected)
                                         continue;
 
+                                if (radeon_conflict->use_digital)
+                                        continue;
+
                                 if (priority == true) {
                                         DRM_INFO("1: conflicting encoders switching off %s\n", drm_get_connector_name(conflict));
                                         DRM_INFO("in favor of %s\n", drm_get_connector_name(connector));
@@ -287,6 +292,7 @@ int radeon_connector_set_property(struct drm_connector *connector, struct drm_pr
 
         if (property == rdev->mode_info.coherent_mode_property) {
                 struct radeon_encoder_atom_dig *dig;
+                bool new_coherent_mode;
 
                 /* need to find digital encoder on connector */
                 encoder = radeon_find_encoder(connector, DRM_MODE_ENCODER_TMDS);
@@ -299,8 +305,11 @@ int radeon_connector_set_property(struct drm_connector *connector, struct drm_pr
                         return 0;
 
                 dig = radeon_encoder->enc_priv;
-                dig->coherent_mode = val ? true : false;
-                radeon_property_change_mode(&radeon_encoder->base);
+                new_coherent_mode = val ? true : false;
+                if (dig->coherent_mode != new_coherent_mode) {
+                        dig->coherent_mode = new_coherent_mode;
+                        radeon_property_change_mode(&radeon_encoder->base);
+                }
         }
 
         if (property == rdev->mode_info.tv_std_property) {
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index bddf17f97da8..7b629e305560 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -36,6 +36,54 @@
 #include "radeon.h"
 #include "atom.h"
 
+static const char radeon_family_name[][16] = {
+        "R100",
+        "RV100",
+        "RS100",
+        "RV200",
+        "RS200",
+        "R200",
+        "RV250",
+        "RS300",
+        "RV280",
+        "R300",
+        "R350",
+        "RV350",
+        "RV380",
+        "R420",
+        "R423",
+        "RV410",
+        "RS400",
+        "RS480",
+        "RS600",
+        "RS690",
+        "RS740",
+        "RV515",
+        "R520",
+        "RV530",
+        "RV560",
+        "RV570",
+        "R580",
+        "R600",
+        "RV610",
+        "RV630",
+        "RV670",
+        "RV620",
+        "RV635",
+        "RS780",
+        "RS880",
+        "RV770",
+        "RV730",
+        "RV710",
+        "RV740",
+        "CEDAR",
+        "REDWOOD",
+        "JUNIPER",
+        "CYPRESS",
+        "HEMLOCK",
+        "LAST",
+};
+
 /*
  * Clear GPU surface registers.
  */
@@ -526,7 +574,6 @@ int radeon_device_init(struct radeon_device *rdev,
         int r;
         int dma_bits;
 
-        DRM_INFO("radeon: Initializing kernel modesetting.\n");
         rdev->shutdown = false;
         rdev->dev = &pdev->dev;
         rdev->ddev = ddev;
@@ -538,6 +585,10 @@ int radeon_device_init(struct radeon_device *rdev,
         rdev->mc.gtt_size = radeon_gart_size * 1024 * 1024;
         rdev->gpu_lockup = false;
         rdev->accel_working = false;
+
+        DRM_INFO("initializing kernel modesetting (%s 0x%04X:0x%04X).\n",
+                radeon_family_name[rdev->family], pdev->vendor, pdev->device);
+
         /* mutex initialization are all done here so we
          * can recall function without having locking issues */
         mutex_init(&rdev->cs_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 055a51732dcb..4b05563d99e1 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -43,9 +43,10 @@
  * - 2.0.0 - initial interface
  * - 2.1.0 - add square tiling interface
  * - 2.2.0 - add r6xx/r7xx const buffer support
+ * - 2.3.0 - add MSPOS + 3D texture + r500 VAP regs
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        2
+#define KMS_DRIVER_MINOR        3
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index c52fc3080b67..30293bec0801 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -865,6 +865,8 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                 else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
                         if (dig->coherent_mode)
                                 args.v3.acConfig.fCoherentMode = 1;
+                        if (radeon_encoder->pixel_clock > 165000)
+                                args.v3.acConfig.fDualLinkConnector = 1;
                 }
         } else if (ASIC_IS_DCE32(rdev)) {
                 args.v2.acConfig.ucEncoderSel = dig->dig_encoder;
@@ -888,6 +890,8 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                 else if (radeon_encoder->devices & (ATOM_DEVICE_DFP_SUPPORT)) {
                         if (dig->coherent_mode)
                                 args.v2.acConfig.fCoherentMode = 1;
+                        if (radeon_encoder->pixel_clock > 165000)
+                                args.v2.acConfig.fDualLinkConnector = 1;
                 }
         } else {
                 args.v1.ucConfig = ATOM_TRANSMITTER_CONFIG_CLKSRC_PPLL;
@@ -1373,8 +1377,12 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
         case ENCODER_OBJECT_ID_INTERNAL_DAC2:
         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC2:
                 atombios_dac_setup(encoder, ATOM_ENABLE);
-                if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))
-                        atombios_tv_setup(encoder, ATOM_ENABLE);
+                if (radeon_encoder->devices & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT)) {
+                        if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT | ATOM_DEVICE_CV_SUPPORT))
+                                atombios_tv_setup(encoder, ATOM_ENABLE);
+                        else
+                                atombios_tv_setup(encoder, ATOM_DISABLE);
+                }
                 break;
         }
         atombios_apply_encoder_quirks(encoder, adjusted_mode);
diff --git a/drivers/gpu/drm/radeon/radeon_family.h b/drivers/gpu/drm/radeon/radeon_family.h
index 93c7d5d41914..e329066dcabd 100644
--- a/drivers/gpu/drm/radeon/radeon_family.h
+++ b/drivers/gpu/drm/radeon/radeon_family.h
@@ -36,7 +36,7 @@
  * Radeon chip families
  */
 enum radeon_family {
-        CHIP_R100,
+        CHIP_R100 = 0,
         CHIP_RV100,
         CHIP_RS100,
         CHIP_RV200,
@@ -99,4 +99,5 @@ enum radeon_chip_flags {
         RADEON_IS_PCI = 0x00800000UL,
         RADEON_IS_IGPGART = 0x01000000UL,
 };
+
 #endif
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r300 b/drivers/gpu/drm/radeon/reg_srcs/r300
index 19c4663fa9c6..1e97b2d129fd 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r300
+++ b/drivers/gpu/drm/radeon/reg_srcs/r300
@@ -125,6 +125,8 @@ r300 0x4f60
 0x4000 GB_VAP_RASTER_VTX_FMT_0
 0x4004 GB_VAP_RASTER_VTX_FMT_1
 0x4008 GB_ENABLE
+0x4010 GB_MSPOS0
+0x4014 GB_MSPOS1
 0x401C GB_SELECT
 0x4020 GB_AA_CONFIG
 0x4024 GB_FIFO_SIZE
diff --git a/drivers/gpu/drm/radeon/reg_srcs/r420 b/drivers/gpu/drm/radeon/reg_srcs/r420
index 989f7a020832..e958980d00f1 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/r420
+++ b/drivers/gpu/drm/radeon/reg_srcs/r420
@@ -125,6 +125,8 @@ r420 0x4f60
 0x4000 GB_VAP_RASTER_VTX_FMT_0
 0x4004 GB_VAP_RASTER_VTX_FMT_1
 0x4008 GB_ENABLE
+0x4010 GB_MSPOS0
+0x4014 GB_MSPOS1
 0x401C GB_SELECT
 0x4020 GB_AA_CONFIG
 0x4024 GB_FIFO_SIZE
diff --git a/drivers/gpu/drm/radeon/reg_srcs/rs600 b/drivers/gpu/drm/radeon/reg_srcs/rs600
index 6801b865d1c4..83e8bc0c2bb2 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/rs600
+++ b/drivers/gpu/drm/radeon/reg_srcs/rs600
@@ -125,6 +125,8 @@ rs600 0x6d40
 0x4000 GB_VAP_RASTER_VTX_FMT_0
 0x4004 GB_VAP_RASTER_VTX_FMT_1
 0x4008 GB_ENABLE
+0x4010 GB_MSPOS0
+0x4014 GB_MSPOS1
 0x401C GB_SELECT
 0x4020 GB_AA_CONFIG
 0x4024 GB_FIFO_SIZE
diff --git a/drivers/gpu/drm/radeon/reg_srcs/rv515 b/drivers/gpu/drm/radeon/reg_srcs/rv515
index 38abf63bf2cd..1e46233985eb 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/rv515
+++ b/drivers/gpu/drm/radeon/reg_srcs/rv515
@@ -35,6 +35,7 @@ rv515 0x6d40
 0x1DA8 VAP_VPORT_ZSCALE
 0x1DAC VAP_VPORT_ZOFFSET
 0x2080 VAP_CNTL
+0x208C VAP_INDEX_OFFSET
 0x2090 VAP_OUT_VTX_FMT_0
 0x2094 VAP_OUT_VTX_FMT_1
 0x20B0 VAP_VTE_CNTL
@@ -158,6 +159,8 @@ rv515 0x6d40
 0x4000 GB_VAP_RASTER_VTX_FMT_0
 0x4004 GB_VAP_RASTER_VTX_FMT_1
 0x4008 GB_ENABLE
+0x4010 GB_MSPOS0
+0x4014 GB_MSPOS1
 0x401C GB_SELECT
 0x4020 GB_AA_CONFIG
 0x4024 GB_FIFO_SIZE
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index abf824c2123d..a81bc7a21e14 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -159,7 +159,7 @@ void rs600_gart_tlb_flush(struct radeon_device *rdev)
         WREG32_MC(R_000100_MC_PT0_CNTL, tmp);
 
         tmp = RREG32_MC(R_000100_MC_PT0_CNTL);
-        tmp |= S_000100_INVALIDATE_ALL_L1_TLBS(1) & S_000100_INVALIDATE_L2_CACHE(1);
+        tmp |= S_000100_INVALIDATE_ALL_L1_TLBS(1) | S_000100_INVALIDATE_L2_CACHE(1);
         WREG32_MC(R_000100_MC_PT0_CNTL, tmp);
 
         tmp = RREG32_MC(R_000100_MC_PT0_CNTL);
diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index c1605b528e8f..0f28d91f29d8 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -142,6 +142,12 @@ static const char *temperature_sensors_sets[][41] = {
           "TM1S", "TM2P", "TM2S", "TM3S", "TM8P", "TM8S", "TM9P", "TM9S",
           "TN0C", "TN0D", "TN0H", "TS0C", "Tp0C", "Tp1C", "Tv0S", "Tv1S",
           NULL },
+/* Set 17: iMac 9,1 */
+        { "TA0P", "TC0D", "TC0H", "TC0P", "TG0D", "TG0H", "TH0P", "TL0P",
+          "TN0D", "TN0H", "TN0P", "TO0P", "Tm0P", "Tp0P", NULL },
+/* Set 18: MacBook Pro 2,2 */
+        { "TB0T", "TC0D", "TC0P", "TG0H", "TG0P", "TG0T", "TM0P", "TTF0",
+          "Th0H", "Th1H", "Tm0P", "Ts0P", NULL },
 };
 
 /* List of keys used to read/write fan speeds */
@@ -1350,6 +1356,10 @@ static __initdata struct dmi_match_data applesmc_dmi_data[] = {
         { .accelerometer = 1, .light = 1, .temperature_set = 15 },
 /* MacPro3,1: temperature set 16 */
         { .accelerometer = 0, .light = 0, .temperature_set = 16 },
+/* iMac 9,1: light sensor only, temperature set 17 */
+        { .accelerometer = 0, .light = 0, .temperature_set = 17 },
+/* MacBook Pro 2,2: accelerometer, backlight and temperature set 18 */
+        { .accelerometer = 1, .light = 1, .temperature_set = 18 },
 };
 
 /* Note that DMI_MATCH(...,"MacBook") will match "MacBookPro1,1".
@@ -1375,6 +1385,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro3") },
                 &applesmc_dmi_data[9]},
+        { applesmc_dmi_match, "Apple MacBook Pro 2,2", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple Computer, Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME, "MacBookPro2,2") },
+                &applesmc_dmi_data[18]},
         { applesmc_dmi_match, "Apple MacBook Pro", {
           DMI_MATCH(DMI_BOARD_VENDOR,"Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME,"MacBookPro") },
@@ -1415,6 +1429,10 @@ static __initdata struct dmi_system_id applesmc_whitelist[] = {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "MacPro") },
                 &applesmc_dmi_data[4]},
+        { applesmc_dmi_match, "Apple iMac 9,1", {
+          DMI_MATCH(DMI_BOARD_VENDOR, "Apple Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME, "iMac9,1") },
+                &applesmc_dmi_data[17]},
         { applesmc_dmi_match, "Apple iMac 8", {
           DMI_MATCH(DMI_BOARD_VENDOR, "Apple"),
           DMI_MATCH(DMI_PRODUCT_NAME, "iMac8") },
diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c
index 1002befd87d5..5be09c048c5f 100644
--- a/drivers/hwmon/it87.c
+++ b/drivers/hwmon/it87.c
@@ -539,14 +539,14 @@ static ssize_t set_sensor(struct device *dev, struct device_attribute *attr,
 
         struct it87_data *data = dev_get_drvdata(dev);
         long val;
+        u8 reg;
 
         if (strict_strtol(buf, 10, &val) < 0)
                 return -EINVAL;
 
-        mutex_lock(&data->update_lock);
-
-        data->sensor &= ~(1 << nr);
-        data->sensor &= ~(8 << nr);
+        reg = it87_read_value(data, IT87_REG_TEMP_ENABLE);
+        reg &= ~(1 << nr);
+        reg &= ~(8 << nr);
         if (val == 2) { /* backwards compatibility */
                 dev_warn(dev, "Sensor type 2 is deprecated, please use 4 "
                          "instead\n");
@@ -554,14 +554,16 @@ static ssize_t set_sensor(struct device *dev, struct device_attribute *attr,
         }
         /* 3 = thermal diode; 4 = thermistor; 0 = disabled */
         if (val == 3)
-                data->sensor |= 1 << nr;
+                reg |= 1 << nr;
         else if (val == 4)
-                data->sensor |= 8 << nr;
-        else if (val != 0) {
-                mutex_unlock(&data->update_lock);
+                reg |= 8 << nr;
+        else if (val != 0)
                 return -EINVAL;
-        }
+
+        mutex_lock(&data->update_lock);
+        data->sensor = reg;
         it87_write_value(data, IT87_REG_TEMP_ENABLE, data->sensor);
+        data->valid = 0;        /* Force cache refresh */
         mutex_unlock(&data->update_lock);
         return count;
 }
@@ -1841,14 +1843,10 @@ static void __devinit it87_init_device(struct platform_device *pdev)
                         it87_write_value(data, IT87_REG_TEMP_HIGH(i), 127);
         }
 
-        /* Check if temperature channels are reset manually or by some reason */
-        tmp = it87_read_value(data, IT87_REG_TEMP_ENABLE);
-        if ((tmp & 0x3f) == 0) {
-                /* Temp1,Temp3=thermistor; Temp2=thermal diode */
-                tmp = (tmp & 0xc0) | 0x2a;
-                it87_write_value(data, IT87_REG_TEMP_ENABLE, tmp);
-        }
-        data->sensor = tmp;
+        /* Temperature channels are not forcibly enabled, as they can be
+         * set to two different sensor types and we can't guess which one
+         * is correct for a given system. These channels can be enabled at
+         * run-time through the temp{1-3}_type sysfs accessors if needed. */
 
         /* Check if voltage monitors are reset manually or by some reason */
         tmp = it87_read_value(data, IT87_REG_VIN_ENABLE);
diff --git a/drivers/hwmon/sht15.c b/drivers/hwmon/sht15.c
index 6b2d8ae64fe1..a610e7880fb3 100644
--- a/drivers/hwmon/sht15.c
+++ b/drivers/hwmon/sht15.c
@@ -303,13 +303,13 @@ error_ret:
  **/
 static inline int sht15_calc_temp(struct sht15_data *data)
 {
-        int d1 = 0;
+        int d1 = temppoints[0].d1;
         int i;
 
-        for (i = 1; i < ARRAY_SIZE(temppoints); i++)
+        for (i = ARRAY_SIZE(temppoints) - 1; i > 0; i--)
                 /* Find pointer to interpolate */
                 if (data->supply_uV > temppoints[i - 1].vdd) {
-                        d1 = (data->supply_uV/1000 - temppoints[i - 1].vdd)
+                        d1 = (data->supply_uV - temppoints[i - 1].vdd)
                                 * (temppoints[i].d1 - temppoints[i - 1].d1)
                                 / (temppoints[i].vdd - temppoints[i - 1].vdd)
                                 + temppoints[i - 1].d1;
@@ -542,7 +542,12 @@ static int __devinit sht15_probe(struct platform_device *pdev)
 /* If a regulator is available, query what the supply voltage actually is!*/
         data->reg = regulator_get(data->dev, "vcc");
         if (!IS_ERR(data->reg)) {
-                data->supply_uV = regulator_get_voltage(data->reg);
+                int voltage;
+
+                voltage = regulator_get_voltage(data->reg);
+                if (voltage)
+                        data->supply_uV = voltage;
+
                 regulator_enable(data->reg);
                 /* setup a notifier block to update this if another device
                  *  causes the voltage to change */
diff --git a/drivers/input/input.c b/drivers/input/input.c
index afd4e2b7658c..9c79bd56b51a 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -660,7 +660,14 @@ static int input_default_setkeycode(struct input_dev *dev,
 int input_get_keycode(struct input_dev *dev,
                       unsigned int scancode, unsigned int *keycode)
 {
-        return dev->getkeycode(dev, scancode, keycode);
+        unsigned long flags;
+        int retval;
+
+        spin_lock_irqsave(&dev->event_lock, flags);
+        retval = dev->getkeycode(dev, scancode, keycode);
+        spin_unlock_irqrestore(&dev->event_lock, flags);
+
+        return retval;
 }
 EXPORT_SYMBOL(input_get_keycode);
 
diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
index ffc25cfcef7a..b443e088fd3c 100644
--- a/drivers/input/keyboard/matrix_keypad.c
+++ b/drivers/input/keyboard/matrix_keypad.c
@@ -374,7 +374,9 @@ static int __devinit matrix_keypad_probe(struct platform_device *pdev)
         input_dev->name         = pdev->name;
         input_dev->id.bustype   = BUS_HOST;
         input_dev->dev.parent   = &pdev->dev;
-        input_dev->evbit[0]     = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP);
+        input_dev->evbit[0]     = BIT_MASK(EV_KEY);
+        if (!pdata->no_autorepeat)
+                input_dev->evbit[0] |= BIT_MASK(EV_REP);
         input_dev->open         = matrix_keypad_start;
         input_dev->close        = matrix_keypad_stop;
 
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 99d58764ef03..0d22cb9ce42e 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -64,6 +64,7 @@ static const struct alps_model_info alps_model_data[] = {
         { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
         { { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },          /* Dell Vostro 1400 */
+        { { 0x73, 0x02, 0x64 }, 0xf8, 0xf8, 0 },                          /* HP Pavilion dm3 */
         { { 0x52, 0x01, 0x14 }, 0xff, 0xff,
                 ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },      /* Toshiba Tecra A11-11L */
 };
diff --git a/drivers/input/mouse/bcm5974.c b/drivers/input/mouse/bcm5974.c
index 4f8fe0886b2a..b89879bd860f 100644
--- a/drivers/input/mouse/bcm5974.c
+++ b/drivers/input/mouse/bcm5974.c
@@ -803,7 +803,6 @@ static struct usb_driver bcm5974_driver = {
         .disconnect             = bcm5974_disconnect,
         .suspend                = bcm5974_suspend,
         .resume                 = bcm5974_resume,
-        .reset_resume           = bcm5974_resume,
         .id_table               = bcm5974_table,
         .supports_autosuspend   = 1,
 };
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index 577688b5b951..6440a8f55686 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -39,7 +39,7 @@ MODULE_PARM_DESC(noaux, "Do not probe or use AUX (mouse) port.");
 
 static bool i8042_nomux;
 module_param_named(nomux, i8042_nomux, bool, 0);
-MODULE_PARM_DESC(nomux, "Do not check whether an active multiplexing conrtoller is present.");
+MODULE_PARM_DESC(nomux, "Do not check whether an active multiplexing controller is present.");
 
 static bool i8042_unlock;
 module_param_named(unlock, i8042_unlock, bool, 0);
diff --git a/drivers/input/sparse-keymap.c b/drivers/input/sparse-keymap.c
index 82ae18d29685..014248344763 100644
--- a/drivers/input/sparse-keymap.c
+++ b/drivers/input/sparse-keymap.c
@@ -68,12 +68,14 @@ static int sparse_keymap_getkeycode(struct input_dev *dev,
                                     unsigned int scancode,
                                     unsigned int *keycode)
 {
-        const struct key_entry *key =
-                        sparse_keymap_entry_from_scancode(dev, scancode);
+        const struct key_entry *key;
 
-        if (key && key->type == KE_KEY) {
-                *keycode = key->keycode;
-                return 0;
+        if (dev->keycode) {
+                key = sparse_keymap_entry_from_scancode(dev, scancode);
+                if (key && key->type == KE_KEY) {
+                        *keycode = key->keycode;
+                        return 0;
+                }
         }
 
         return -EINVAL;
@@ -86,17 +88,16 @@ static int sparse_keymap_setkeycode(struct input_dev *dev,
         struct key_entry *key;
         int old_keycode;
 
-        if (keycode < 0 || keycode > KEY_MAX)
-                return -EINVAL;
-
-        key = sparse_keymap_entry_from_scancode(dev, scancode);
-        if (key && key->type == KE_KEY) {
-                old_keycode = key->keycode;
-                key->keycode = keycode;
-                set_bit(keycode, dev->keybit);
-                if (!sparse_keymap_entry_from_keycode(dev, old_keycode))
-                        clear_bit(old_keycode, dev->keybit);
-                return 0;
+        if (dev->keycode) {
+                key = sparse_keymap_entry_from_scancode(dev, scancode);
+                if (key && key->type == KE_KEY) {
+                        old_keycode = key->keycode;
+                        key->keycode = keycode;
+                        set_bit(keycode, dev->keybit);
+                        if (!sparse_keymap_entry_from_keycode(dev, old_keycode))
+                                clear_bit(old_keycode, dev->keybit);
+                        return 0;
+                }
         }
 
         return -EINVAL;
@@ -164,7 +165,7 @@ int sparse_keymap_setup(struct input_dev *dev,
         return 0;
 
  err_out:
-        kfree(keymap);
+        kfree(map);
         return error;
 
 }
@@ -176,14 +177,27 @@ EXPORT_SYMBOL(sparse_keymap_setup);
  *
  * This function is used to free memory allocated by sparse keymap
  * in an input device that was set up by sparse_keymap_setup().
+ * NOTE: It is safe to cal this function while input device is
+ * still registered (however the drivers should care not to try to
+ * use freed keymap and thus have to shut off interrups/polling
+ * before freeing the keymap).
  */
 void sparse_keymap_free(struct input_dev *dev)
 {
+        unsigned long flags;
+
+        /*
+         * Take event lock to prevent racing with input_get_keycode()
+         * and input_set_keycode() if we are called while input device
+         * is still registered.
+         */
+        spin_lock_irqsave(&dev->event_lock, flags);
+
         kfree(dev->keycode);
         dev->keycode = NULL;
         dev->keycodemax = 0;
-        dev->getkeycode = NULL;
-        dev->setkeycode = NULL;
+
+        spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 EXPORT_SYMBOL(sparse_keymap_free);
 
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 8b5d2873f0c4..f46502589e4e 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -673,13 +673,15 @@ static int wacom_resume(struct usb_interface *intf)
         int rv;
 
         mutex_lock(&wacom->lock);
-        if (wacom->open) {
+
+        /* switch to wacom mode first */
+        wacom_query_tablet_data(intf, features);
+
+        if (wacom->open)
                 rv = usb_submit_urb(wacom->irq, GFP_NOIO);
-                /* switch to wacom mode if needed */
-                if (!wacom_retrieve_hid_descriptor(intf, features))
-                        wacom_query_tablet_data(intf, features);
-        } else
+        else
                 rv = 0;
+
         mutex_unlock(&wacom->lock);
 
         return rv;
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index b3ba3437a2eb..4a852d815c68 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -155,19 +155,19 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 {
         struct wacom_features *features = &wacom->features;
         unsigned char *data = wacom->data;
-        int x, y, prox;
-        int rw = 0;
-        int retval = 0;
+        int x, y, rw;
+        static int penData = 0;
 
         if (data[0] != WACOM_REPORT_PENABLED) {
                 dbg("wacom_graphire_irq: received unknown report #%d", data[0]);
-                goto exit;
+                return 0;
         }
 
-        prox = data[1] & 0x80;
-        if (prox || wacom->id[0]) {
-                if (prox) {
-                        switch ((data[1] >> 5) & 3) {
+        if (data[1] & 0x80) {
+                /* in prox and not a pad data */
+                penData = 1;
+
+                switch ((data[1] >> 5) & 3) {
 
                         case 0: /* Pen */
                                 wacom->tool[0] = BTN_TOOL_PEN;
@@ -181,13 +181,23 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
 
                         case 2: /* Mouse with wheel */
                                 wacom_report_key(wcombo, BTN_MIDDLE, data[1] & 0x04);
+                                if (features->type == WACOM_G4 || features->type == WACOM_MO) {
+                                        rw = data[7] & 0x04 ? (data[7] & 0x03)-4 : (data[7] & 0x03);
+                                        wacom_report_rel(wcombo, REL_WHEEL, -rw);
+                                } else
+                                        wacom_report_rel(wcombo, REL_WHEEL, -(signed char) data[6]);
                                 /* fall through */
 
                         case 3: /* Mouse without wheel */
                                 wacom->tool[0] = BTN_TOOL_MOUSE;
                                 wacom->id[0] = CURSOR_DEVICE_ID;
+                                wacom_report_key(wcombo, BTN_LEFT, data[1] & 0x01);
+                                wacom_report_key(wcombo, BTN_RIGHT, data[1] & 0x02);
+                                if (features->type == WACOM_G4 || features->type == WACOM_MO)
+                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[6] & 0x3f);
+                                else
+                                        wacom_report_abs(wcombo, ABS_DISTANCE, data[7] & 0x3f);
                                 break;
-                        }
                 }
                 x = wacom_le16_to_cpu(&data[2]);
                 y = wacom_le16_to_cpu(&data[4]);
@@ -198,32 +208,36 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
                         wacom_report_key(wcombo, BTN_TOUCH, data[1] & 0x01);
                         wacom_report_key(wcombo, BTN_STYLUS, data[1] & 0x02);
                         wacom_report_key(wcombo, BTN_STYLUS2, data[1] & 0x04);
-                } else {
-                        wacom_report_key(wcombo, BTN_LEFT, data[1] & 0x01);
-                        wacom_report_key(wcombo, BTN_RIGHT, data[1] & 0x02);
-                        if (features->type == WACOM_G4 ||
-                                        features->type == WACOM_MO) {
-                                wacom_report_abs(wcombo, ABS_DISTANCE, data[6] & 0x3f);
-                                rw = (signed)(data[7] & 0x04) - (data[7] & 0x03);
-                        } else {
-                                wacom_report_abs(wcombo, ABS_DISTANCE, data[7] & 0x3f);
-                                rw = -(signed)data[6];
-                        }
-                        wacom_report_rel(wcombo, REL_WHEEL, rw);
                 }
-
-                if (!prox)
-                        wacom->id[0] = 0;
                 wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]); /* report tool id */
-                wacom_report_key(wcombo, wacom->tool[0], prox);
-                wacom_input_sync(wcombo); /* sync last event */
+                wacom_report_key(wcombo, wacom->tool[0], 1);
+        } else if (wacom->id[0]) {
+                wacom_report_abs(wcombo, ABS_X, 0);
+                wacom_report_abs(wcombo, ABS_Y, 0);
+                if (wacom->tool[0] == BTN_TOOL_MOUSE) {
+                        wacom_report_key(wcombo, BTN_LEFT, 0);
+                        wacom_report_key(wcombo, BTN_RIGHT, 0);
+                        wacom_report_abs(wcombo, ABS_DISTANCE, 0);
+                } else {
+                        wacom_report_abs(wcombo, ABS_PRESSURE, 0);
+                        wacom_report_key(wcombo, BTN_TOUCH, 0);
+                        wacom_report_key(wcombo, BTN_STYLUS, 0);
+                        wacom_report_key(wcombo, BTN_STYLUS2, 0);
+                }
+                wacom->id[0] = 0;
+                wacom_report_abs(wcombo, ABS_MISC, 0); /* reset tool id */
+                wacom_report_key(wcombo, wacom->tool[0], 0);
         }
 
         /* send pad data */
         switch (features->type) {
             case WACOM_G4:
-                prox = data[7] & 0xf8;
-                if (prox || wacom->id[1]) {
+                if (data[7] & 0xf8) {
+                        if (penData) {
+                                wacom_input_sync(wcombo); /* sync last event */
+                                if (!wacom->id[0])
+                                        penData = 0;
+                        }
                         wacom->id[1] = PAD_DEVICE_ID;
                         wacom_report_key(wcombo, BTN_0, (data[7] & 0x40));
                         wacom_report_key(wcombo, BTN_4, (data[7] & 0x80));
@@ -231,16 +245,29 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
                         wacom_report_rel(wcombo, REL_WHEEL, rw);
                         wacom_report_key(wcombo, BTN_TOOL_FINGER, 0xf0);
                         wacom_report_abs(wcombo, ABS_MISC, wacom->id[1]);
-                        if (!prox)
-                                wacom->id[1] = 0;
-                        wacom_report_abs(wcombo, ABS_MISC, wacom->id[1]);
+                        wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
+                } else if (wacom->id[1]) {
+                        if (penData) {
+                                wacom_input_sync(wcombo); /* sync last event */
+                                if (!wacom->id[0])
+                                        penData = 0;
+                        }
+                        wacom->id[1] = 0;
+                        wacom_report_key(wcombo, BTN_0, (data[7] & 0x40));
+                        wacom_report_key(wcombo, BTN_4, (data[7] & 0x80));
+                        wacom_report_rel(wcombo, REL_WHEEL, 0);
+                        wacom_report_key(wcombo, BTN_TOOL_FINGER, 0);
+                        wacom_report_abs(wcombo, ABS_MISC, 0);
                         wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
                 }
-                retval = 1;
                 break;
             case WACOM_MO:
-                prox = (data[7] & 0xf8) || data[8];
-                if (prox || wacom->id[1]) {
+                if ((data[7] & 0xf8) || (data[8] & 0xff)) {
+                        if (penData) {
+                                wacom_input_sync(wcombo); /* sync last event */
+                                if (!wacom->id[0])
+                                        penData = 0;
+                        }
                         wacom->id[1] = PAD_DEVICE_ID;
                         wacom_report_key(wcombo, BTN_0, (data[7] & 0x08));
                         wacom_report_key(wcombo, BTN_1, (data[7] & 0x20));
@@ -248,16 +275,27 @@ static int wacom_graphire_irq(struct wacom_wac *wacom, void *wcombo)
                         wacom_report_key(wcombo, BTN_5, (data[7] & 0x40));
                         wacom_report_abs(wcombo, ABS_WHEEL, (data[8] & 0x7f));
                         wacom_report_key(wcombo, BTN_TOOL_FINGER, 0xf0);
-                        if (!prox)
-                                wacom->id[1] = 0;
                         wacom_report_abs(wcombo, ABS_MISC, wacom->id[1]);
                         wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
+                } else if (wacom->id[1]) {
+                        if (penData) {
+                                wacom_input_sync(wcombo); /* sync last event */
+                                if (!wacom->id[0])
+                                        penData = 0;
+                        }
+                        wacom->id[1] = 0;
+                        wacom_report_key(wcombo, BTN_0, (data[7] & 0x08));
+                        wacom_report_key(wcombo, BTN_1, (data[7] & 0x20));
+                        wacom_report_key(wcombo, BTN_4, (data[7] & 0x10));
+                        wacom_report_key(wcombo, BTN_5, (data[7] & 0x40));
+                        wacom_report_abs(wcombo, ABS_WHEEL, (data[8] & 0x7f));
+                        wacom_report_key(wcombo, BTN_TOOL_FINGER, 0);
+                        wacom_report_abs(wcombo, ABS_MISC, 0);
+                        wacom_input_event(wcombo, EV_MSC, MSC_SERIAL, 0xf0);
                 }
-                retval = 1;
                 break;
         }
-exit:
-        return retval;
+        return 1;
 }
 
 static int wacom_intuos_inout(struct wacom_wac *wacom, void *wcombo)
@@ -598,9 +636,9 @@ static int wacom_intuos_irq(struct wacom_wac *wacom, void *wcombo)
 static void wacom_tpc_finger_in(struct wacom_wac *wacom, void *wcombo, char *data, int idx)
 {
         wacom_report_abs(wcombo, ABS_X,
-                data[2 + idx * 2] | ((data[3 + idx * 2] & 0x7f) << 8));
+                (data[2 + idx * 2] & 0xff) | ((data[3 + idx * 2] & 0x7f) << 8));
         wacom_report_abs(wcombo, ABS_Y,
-                data[6 + idx * 2] | ((data[7 + idx * 2] & 0x7f) << 8));
+                (data[6 + idx * 2] & 0xff) | ((data[7 + idx * 2] & 0x7f) << 8));
         wacom_report_abs(wcombo, ABS_MISC, wacom->id[0]);
         wacom_report_key(wcombo, wacom->tool[idx], 1);
         if (idx)
@@ -744,24 +782,31 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, void *wcombo)
 
                 touchInProx = 0;
 
-                if (!wacom->id[0]) { /* first in prox */
-                        /* Going into proximity select tool */
-                        wacom->tool[0] = (data[1] & 0x0c) ? BTN_TOOL_RUBBER : BTN_TOOL_PEN;
-                        if (wacom->tool[0] == BTN_TOOL_PEN)
-                                wacom->id[0] = STYLUS_DEVICE_ID;
-                        else
-                                wacom->id[0] = ERASER_DEVICE_ID;
-                }
-                wacom_report_key(wcombo, BTN_STYLUS, data[1] & 0x02);
-                wacom_report_key(wcombo, BTN_STYLUS2, data[1] & 0x10);
-                wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[2]));
-                wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[4]));
-                pressure = ((data[7] & 0x01) << 8) | data[6];
-                if (pressure < 0)
-                        pressure = features->pressure_max + pressure + 1;
-                wacom_report_abs(wcombo, ABS_PRESSURE, pressure);
-                wacom_report_key(wcombo, BTN_TOUCH, data[1] & 0x05);
-                if (!prox) { /* out-prox */
+                if (prox) { /* in prox */
+                        if (!wacom->id[0]) {
+                                /* Going into proximity select tool */
+                                wacom->tool[0] = (data[1] & 0x0c) ? BTN_TOOL_RUBBER : BTN_TOOL_PEN;
+                                if (wacom->tool[0] == BTN_TOOL_PEN)
+                                        wacom->id[0] = STYLUS_DEVICE_ID;
+                                else
+                                        wacom->id[0] = ERASER_DEVICE_ID;
+                        }
+                        wacom_report_key(wcombo, BTN_STYLUS, data[1] & 0x02);
+                        wacom_report_key(wcombo, BTN_STYLUS2, data[1] & 0x10);
+                        wacom_report_abs(wcombo, ABS_X, wacom_le16_to_cpu(&data[2]));
+                        wacom_report_abs(wcombo, ABS_Y, wacom_le16_to_cpu(&data[4]));
+                        pressure = ((data[7] & 0x01) << 8) | data[6];
+                        if (pressure < 0)
+                                pressure = features->pressure_max + pressure + 1;
+                        wacom_report_abs(wcombo, ABS_PRESSURE, pressure);
+                        wacom_report_key(wcombo, BTN_TOUCH, data[1] & 0x05);
+                } else {
+                        wacom_report_abs(wcombo, ABS_X, 0);
+                        wacom_report_abs(wcombo, ABS_Y, 0);
+                        wacom_report_abs(wcombo, ABS_PRESSURE, 0);
+                        wacom_report_key(wcombo, BTN_STYLUS, 0);
+                        wacom_report_key(wcombo, BTN_STYLUS2, 0);
+                        wacom_report_key(wcombo, BTN_TOUCH, 0);
                         wacom->id[0] = 0;
                         /* pen is out so touch can be enabled now */
                         touchInProx = 1;
diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c
index 0be15c70c16d..47a5ffec55a3 100644
--- a/drivers/isdn/gigaset/bas-gigaset.c
+++ b/drivers/isdn/gigaset/bas-gigaset.c
@@ -14,11 +14,6 @@
  */
 
 #include "gigaset.h"
-
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/timer.h>
 #include <linux/usb.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index eb7e27105a82..964a55fb1486 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -12,8 +12,6 @@
  */
 
 #include "gigaset.h"
-#include <linux/slab.h>
-#include <linux/ctype.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/isdn/capilli.h>
diff --git a/drivers/isdn/gigaset/common.c b/drivers/isdn/gigaset/common.c
index 0b39b387c125..f6f45f221920 100644
--- a/drivers/isdn/gigaset/common.c
+++ b/drivers/isdn/gigaset/common.c
@@ -14,10 +14,8 @@
  */
 
 #include "gigaset.h"
-#include <linux/ctype.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/slab.h>
 
 /* Version Information */
 #define DRIVER_AUTHOR "Hansjoerg Lipp <hjlipp@web.de>, Tilman Schmidt <tilman@imap.cc>, Stefan Eilers"
diff --git a/drivers/isdn/gigaset/gigaset.h b/drivers/isdn/gigaset/gigaset.h
index 9ef5b0463fd5..05947f9c1849 100644
--- a/drivers/isdn/gigaset/gigaset.h
+++ b/drivers/isdn/gigaset/gigaset.h
@@ -20,11 +20,12 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/compiler.h>
 #include <linux/types.h>
+#include <linux/ctype.h>
 #include <linux/slab.h>
 #include <linux/spinlock.h>
-#include <linux/usb.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
 #include <linux/ppp_defs.h>
diff --git a/drivers/isdn/gigaset/i4l.c b/drivers/isdn/gigaset/i4l.c
index c99fb9790a13..c22e5ace8276 100644
--- a/drivers/isdn/gigaset/i4l.c
+++ b/drivers/isdn/gigaset/i4l.c
@@ -15,7 +15,6 @@
 
 #include "gigaset.h"
 #include <linux/isdnif.h>
-#include <linux/slab.h>
 
 #define HW_HDR_LEN      2       /* Header size used to store ack info */
 
diff --git a/drivers/isdn/gigaset/interface.c b/drivers/isdn/gigaset/interface.c
index f0dc6c9cc283..c9f28dd40d5c 100644
--- a/drivers/isdn/gigaset/interface.c
+++ b/drivers/isdn/gigaset/interface.c
@@ -13,7 +13,6 @@
 
 #include "gigaset.h"
 #include <linux/gigaset_dev.h>
-#include <linux/tty.h>
 #include <linux/tty_flip.h>
 
 /*** our ioctls ***/
diff --git a/drivers/isdn/gigaset/proc.c b/drivers/isdn/gigaset/proc.c
index b69f73a0668f..b943efbff44d 100644
--- a/drivers/isdn/gigaset/proc.c
+++ b/drivers/isdn/gigaset/proc.c
@@ -14,7 +14,6 @@
  */
 
 #include "gigaset.h"
-#include <linux/ctype.h>
 
 static ssize_t show_cidmode(struct device *dev,
                             struct device_attribute *attr, char *buf)
diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
index 8b0afd203a07..e96c0586886c 100644
--- a/drivers/isdn/gigaset/ser-gigaset.c
+++ b/drivers/isdn/gigaset/ser-gigaset.c
@@ -11,13 +11,10 @@
  */
 
 #include "gigaset.h"
-
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/platform_device.h>
-#include <linux/tty.h>
 #include <linux/completion.h>
-#include <linux/slab.h>
 
 /* Version Information */
 #define DRIVER_AUTHOR "Tilman Schmidt"
diff --git a/drivers/isdn/gigaset/usb-gigaset.c b/drivers/isdn/gigaset/usb-gigaset.c
index 9430a2bbb523..76dbb20f3065 100644
--- a/drivers/isdn/gigaset/usb-gigaset.c
+++ b/drivers/isdn/gigaset/usb-gigaset.c
@@ -16,10 +16,6 @@
  */
 
 #include "gigaset.h"
-
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/slab.h>
 #include <linux/usb.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
diff --git a/drivers/isdn/i4l/isdn_x25iface.c b/drivers/isdn/i4l/isdn_x25iface.c
index efcf1f9327e5..fd10d7c785d4 100644
--- a/drivers/isdn/i4l/isdn_x25iface.c
+++ b/drivers/isdn/i4l/isdn_x25iface.c
@@ -194,7 +194,7 @@ static int isdn_x25iface_receive(struct concap_proto *cprot, struct sk_buff *skb
         if ( ( (ix25_pdata_t*) (cprot->proto_data) ) 
              -> state == WAN_CONNECTED ){
                 if( skb_push(skb, 1)){
-                        skb -> data[0]=0x00;
+                        skb->data[0] = X25_IFACE_DATA;
                         skb->protocol = x25_type_trans(skb, cprot->net_dev);
                         netif_rx(skb);
                         return 0;
@@ -224,7 +224,7 @@ static int isdn_x25iface_connect_ind(struct concap_proto *cprot)
 
         skb = dev_alloc_skb(1);
         if( skb ){
-                *( skb_put(skb, 1) ) = 0x01;
+                *(skb_put(skb, 1)) = X25_IFACE_CONNECT;
                 skb->protocol = x25_type_trans(skb, cprot->net_dev);
                 netif_rx(skb);
                 return 0;
@@ -253,7 +253,7 @@ static int isdn_x25iface_disconn_ind(struct concap_proto *cprot)
         *state_p = WAN_DISCONNECTED;
         skb = dev_alloc_skb(1);
         if( skb ){
-                *( skb_put(skb, 1) ) = 0x02;
+                *(skb_put(skb, 1)) = X25_IFACE_DISCONNECT;
                 skb->protocol = x25_type_trans(skb, cprot->net_dev);
                 netif_rx(skb);
                 return 0;
@@ -272,9 +272,10 @@ static int isdn_x25iface_xmit(struct concap_proto *cprot, struct sk_buff *skb)
         unsigned char firstbyte = skb->data[0];
         enum wan_states *state = &((ix25_pdata_t*)cprot->proto_data)->state;
         int ret = 0;
-        IX25DEBUG( "isdn_x25iface_xmit: %s first=%x state=%d \n", MY_DEVNAME(cprot -> net_dev), firstbyte, *state );
+        IX25DEBUG("isdn_x25iface_xmit: %s first=%x state=%d\n",
+                MY_DEVNAME(cprot->net_dev), firstbyte, *state);
         switch ( firstbyte ){
-        case 0x00: /* dl_data request */
+        case X25_IFACE_DATA:
                 if( *state == WAN_CONNECTED ){
                         skb_pull(skb, 1);
                         cprot -> net_dev -> trans_start = jiffies;
@@ -285,7 +286,7 @@ static int isdn_x25iface_xmit(struct concap_proto *cprot, struct sk_buff *skb)
                 }
                 illegal_state_warn( *state, firstbyte ); 
                 break;
-        case 0x01: /* dl_connect request */
+        case X25_IFACE_CONNECT:
                 if( *state == WAN_DISCONNECTED ){
                         *state = WAN_CONNECTING;
                         ret = cprot -> dops -> connect_req(cprot);
@@ -298,7 +299,7 @@ static int isdn_x25iface_xmit(struct concap_proto *cprot, struct sk_buff *skb)
                         illegal_state_warn( *state, firstbyte );
                 }
                 break;
-        case 0x02: /* dl_disconnect request */
+        case X25_IFACE_DISCONNECT:
                 switch ( *state ){
                 case WAN_DISCONNECTED: 
                         /* Should not happen. However, give upper layer a
@@ -318,7 +319,7 @@ static int isdn_x25iface_xmit(struct concap_proto *cprot, struct sk_buff *skb)
                         illegal_state_warn( *state, firstbyte );
                 }
                 break;
-        case 0x03: /* changing lapb parameters requested */
+        case X25_IFACE_PARAMS:
                 printk(KERN_WARNING "isdn_x25iface_xmit: setting of lapb"
                        " options not yet supported\n");
                 break;
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 07090f379c63..69c84a1d88ea 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -178,7 +178,7 @@ static void set_status(struct virtio_device *vdev, u8 status)
 
         /* We set the status. */
         to_lgdev(vdev)->desc->status = status;
-        kvm_hypercall1(LHCALL_NOTIFY, (max_pfn << PAGE_SHIFT) + offset);
+        hcall(LHCALL_NOTIFY, (max_pfn << PAGE_SHIFT) + offset, 0, 0, 0);
 }
 
 static void lg_set_status(struct virtio_device *vdev, u8 status)
@@ -229,7 +229,7 @@ static void lg_notify(struct virtqueue *vq)
          */
         struct lguest_vq_info *lvq = vq->priv;
 
-        kvm_hypercall1(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT);
+        hcall(LHCALL_NOTIFY, lvq->config.pfn << PAGE_SHIFT, 0, 0, 0);
 }
 
 /* An extern declaration inside a C file is bad form.  Don't do it. */
diff --git a/drivers/lguest/x86/core.c b/drivers/lguest/x86/core.c
index fb2b7ef7868e..b4eb675a807e 100644
--- a/drivers/lguest/x86/core.c
+++ b/drivers/lguest/x86/core.c
@@ -288,6 +288,18 @@ static int emulate_insn(struct lg_cpu *cpu)
         insn = lgread(cpu, physaddr, u8);
 
         /*
+         * Around 2.6.33, the kernel started using an emulation for the
+         * cmpxchg8b instruction in early boot on many configurations.  This
+         * code isn't paravirtualized, and it tries to disable interrupts.
+         * Ignore it, which will Mostly Work.
+         */
+        if (insn == 0xfa) {
+                /* "cli", or Clear Interrupt Enable instruction.  Skip it. */
+                cpu->regs->eip++;
+                return 1;
+        }
+
+        /*
          * 0x66 is an "operand prefix".  It means it's using the upper 16 bits
          * of the eax register.
          */
diff --git a/drivers/net/3c507.c b/drivers/net/3c507.c
index b32b7a1710b7..9e95afa49fbe 100644
--- a/drivers/net/3c507.c
+++ b/drivers/net/3c507.c
@@ -449,7 +449,6 @@ static int __init el16_probe1(struct net_device *dev, int ioaddr)
                 pr_debug("%s", version);
 
         lp = netdev_priv(dev);
-        memset(lp, 0, sizeof(*lp));
         spin_lock_init(&lp->lock);
         lp->base = ioremap(dev->mem_start, RX_BUF_END);
         if (!lp->base) {
diff --git a/drivers/net/3c523.c b/drivers/net/3c523.c
index 8c70686d43a1..55d219e585fb 100644
--- a/drivers/net/3c523.c
+++ b/drivers/net/3c523.c
@@ -503,7 +503,6 @@ static int __init do_elmc_probe(struct net_device *dev)
                 break;
         }
 
-        memset(pr, 0, sizeof(struct priv));
         pr->slot = slot;
 
         pr_info("%s: 3Com 3c523 Rev 0x%x at %#lx\n", dev->name, (int) revision,
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index d149624b4a44..d0cb372a0f0d 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                 netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                           __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                                DUMP_PREFIX_OFFSET, 16, 1,
                                &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index dbd26f992158..b9e7618a1473 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1453,20 +1453,6 @@ config FORCEDETH
           To compile this driver as a module, choose M here. The module
           will be called forcedeth.
 
-config FORCEDETH_NAPI
-        bool "Use Rx Polling (NAPI) (EXPERIMENTAL)"
-        depends on FORCEDETH && EXPERIMENTAL
-        help
-          NAPI is a new driver API designed to reduce CPU and interrupt load
-          when the driver is receiving lots of packets from the card. It is
-          still somewhat experimental and thus not yet enabled by default.
-
-          If your estimated Rx load is 10kpps or more, or if the card will be
-          deployed on potentially unfriendly networks (e.g. in a firewall),
-          then say Y here.
-
-          If in doubt, say N.
-
 config CS89x0
         tristate "CS89x0 support"
         depends on NET_ETHERNET && (ISA || EISA || MACH_IXDP2351 \
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index ebf80b983063..0a0512ae77da 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/arm/ks8695net.c b/drivers/net/arm/ks8695net.c
index 7413a87e40ff..6404704f7eac 100644
--- a/drivers/net/arm/ks8695net.c
+++ b/drivers/net/arm/ks8695net.c
@@ -1472,7 +1472,6 @@ ks8695_probe(struct platform_device *pdev)
 
         /* Configure our private structure a little */
         ksp = netdev_priv(ndev);
-        memset(ksp, 0, sizeof(struct ks8695_priv));
 
         ksp->dev = &pdev->dev;
         ksp->ndev = ndev;
diff --git a/drivers/net/bcm63xx_enet.c b/drivers/net/bcm63xx_enet.c
index 9a8bdea4a8ec..f48ba80025a2 100644
--- a/drivers/net/bcm63xx_enet.c
+++ b/drivers/net/bcm63xx_enet.c
@@ -1647,7 +1647,6 @@ static int __devinit bcm_enet_probe(struct platform_device *pdev)
         if (!dev)
                 return -ENOMEM;
         priv = netdev_priv(dev);
-        memset(priv, 0, sizeof(*priv));
 
         ret = compute_hw_mtu(priv, dev->mtu);
         if (ret)
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index 53326fed6c81..667f4196dc29 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_VERSION      "2.0.9"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
         if (netif_running(bp->dev)) {
                 int i;
 
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
         if (atomic_dec_and_test(&bp->intr_sem)) {
                 if (netif_running(bp->dev)) {
                         netif_tx_wake_all_queues(bp->dev);
                         bnx2_napi_enable(bp);
                         bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                 }
         }
 }
@@ -2717,6 +2719,7 @@ bnx2_alloc_rx_skb(struct bnx2 *bp, struct bnx2_rx_ring_info *rxr, u16 index)
         }
 
         rx_buf->skb = skb;
+        rx_buf->desc = (struct l2_fhdr *) skb->data;
         dma_unmap_addr_set(rx_buf, mapping, mapping);
 
         rxbd->rx_bd_haddr_hi = (u64) mapping >> 32;
@@ -2939,6 +2942,7 @@ bnx2_reuse_rx_skb(struct bnx2 *bp, struct bnx2_rx_ring_info *rxr,
         rxr->rx_prod_bseq += bp->rx_buf_use_size;
 
         prod_rx_buf->skb = skb;
+        prod_rx_buf->desc = (struct l2_fhdr *) skb->data;
 
         if (cons == prod)
                 return;
@@ -3072,6 +3076,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
         u16 hw_cons, sw_cons, sw_ring_cons, sw_prod, sw_ring_prod;
         struct l2_fhdr *rx_hdr;
         int rx_pkt = 0, pg_ring_used = 0;
+        struct pci_dev *pdev = bp->pdev;
 
         hw_cons = bnx2_get_hw_rx_cons(bnapi);
         sw_cons = rxr->rx_cons;
@@ -3084,7 +3089,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
         while (sw_cons != hw_cons) {
                 unsigned int len, hdr_len;
                 u32 status;
-                struct sw_bd *rx_buf;
+                struct sw_bd *rx_buf, *next_rx_buf;
                 struct sk_buff *skb;
                 dma_addr_t dma_addr;
                 u16 vtag = 0;
@@ -3095,7 +3100,14 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
 
                 rx_buf = &rxr->rx_buf_ring[sw_ring_cons];
                 skb = rx_buf->skb;
+                prefetchw(skb);
 
+                if (!get_dma_ops(&pdev->dev)->sync_single_for_cpu) {
+                        next_rx_buf =
+                                &rxr->rx_buf_ring[
+                                        RX_RING_IDX(NEXT_RX_BD(sw_cons))];
+                        prefetch(next_rx_buf->desc);
+                }
                 rx_buf->skb = NULL;
 
                 dma_addr = dma_unmap_addr(rx_buf, mapping);
@@ -3104,7 +3116,7 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
                         BNX2_RX_OFFSET + BNX2_RX_COPY_THRESH,
                         PCI_DMA_FROMDEVICE);
 
-                rx_hdr = (struct l2_fhdr *) skb->data;
+                rx_hdr = rx_buf->desc;
                 len = rx_hdr->l2_fhdr_pkt_len;
                 status = rx_hdr->l2_fhdr_status;
 
@@ -3205,10 +3217,10 @@ bnx2_rx_int(struct bnx2 *bp, struct bnx2_napi *bnapi, int budget)
 
 #ifdef BCM_VLAN
                 if (hw_vlan)
-                        vlan_hwaccel_receive_skb(skb, bp->vlgrp, vtag);
+                        vlan_gro_receive(&bnapi->napi, bp->vlgrp, vtag, skb);
                 else
 #endif
-                        netif_receive_skb(skb);
+                        napi_gro_receive(&bnapi->napi, skb);
 
                 rx_pkt++;
 
@@ -4758,8 +4770,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                 rc = bnx2_alloc_bad_rbuf(bp);
         }
 
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                 bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
 
         return rc;
 }
@@ -5758,7 +5774,7 @@ bnx2_run_loopback(struct bnx2 *bp, int loopback_mode)
         rx_buf = &rxr->rx_buf_ring[rx_start_idx];
         rx_skb = rx_buf->skb;
 
-        rx_hdr = (struct l2_fhdr *) rx_skb->data;
+        rx_hdr = rx_buf->desc;
         skb_reserve(rx_skb, BNX2_RX_OFFSET);
 
         pci_dma_sync_single_for_cpu(bp->pdev,
@@ -6272,12 +6288,12 @@ bnx2_reset_task(struct work_struct *work)
                 return;
         }
 
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
 
         bnx2_init_nic(bp, 1);
 
         atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         rtnl_unlock();
 }
 
@@ -6319,7 +6335,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         struct bnx2 *bp = netdev_priv(dev);
 
         if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
 
         bp->vlgrp = vlgrp;
 
@@ -6330,7 +6346,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
         if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                 bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
 
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
 
@@ -7050,9 +7066,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
         bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
 
         return 0;
@@ -7082,7 +7098,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                 /* Reset will erase chipset stats; save them */
                 bnx2_save_stats(bp);
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                 bnx2_free_skbs(bp);
                 bnx2_free_mem(bp);
@@ -7110,7 +7126,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                         bnx2_setup_cnic_irq_info(bp);
                 mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
         }
         return 0;
 }
@@ -7363,7 +7379,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
         if (etest->flags & ETH_TEST_FL_OFFLINE) {
                 int i;
 
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                 bnx2_free_skbs(bp);
 
@@ -7382,7 +7398,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                         bnx2_shutdown_chip(bp);
                 else {
                         bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                 }
 
                 /* wait for link up */
@@ -8290,7 +8306,7 @@ bnx2_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         memcpy(dev->dev_addr, bp->mac_addr, 6);
         memcpy(dev->perm_addr, bp->mac_addr, 6);
 
-        dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
+        dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG | NETIF_F_GRO;
         vlan_features_add(dev, NETIF_F_IP_CSUM | NETIF_F_SG);
         if (CHIP_NUM(bp) == CHIP_NUM_5709) {
                 dev->features |= NETIF_F_IPV6_CSUM;
@@ -8376,7 +8392,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                 return 0;
 
         flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
         netif_device_detach(dev);
         del_timer_sync(&bp->timer);
         bnx2_shutdown_chip(bp);
@@ -8398,7 +8414,7 @@ bnx2_resume(struct pci_dev *pdev)
         bnx2_set_power_state(bp, PCI_D0);
         netif_device_attach(dev);
         bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
         return 0;
 }
 
@@ -8425,7 +8441,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
         }
 
         if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                 del_timer_sync(&bp->timer);
                 bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
         }
@@ -8482,7 +8498,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
 
         rtnl_lock();
         if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
 
         netif_device_attach(dev);
         rtnl_unlock();
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index ab34a5d86f86..dd35bd0b7e05 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6551,6 +6551,7 @@ struct l2_fhdr {
 
 struct sw_bd {
         struct sk_buff          *skb;
+        struct l2_fhdr          *desc;
         DEFINE_DMA_UNMAP_ADDR(mapping);
 };
 
diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index 081953005b84..8bd23687c530 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -1330,7 +1330,7 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
                 AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \
                 AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
 
-#define MULTI_FLAGS(bp) \
+#define RSS_FLAGS(bp) \
                 (TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_CAPABILITY | \
                  TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV4_TCP_CAPABILITY | \
                  TSTORM_ETH_FUNCTION_COMMON_CONFIG_RSS_IPV6_CAPABILITY | \
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 0c6dba24e37e..2bc35c794aec 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -1582,7 +1582,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                 struct sw_rx_bd *rx_buf = NULL;
                 struct sk_buff *skb;
                 union eth_rx_cqe *cqe;
-                u8 cqe_fp_flags;
+                u8 cqe_fp_flags, cqe_fp_status_flags;
                 u16 len, pad;
 
                 comp_ring_cons = RCQ_BD(sw_comp_cons);
@@ -1598,6 +1598,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
 
                 cqe = &fp->rx_comp_ring[comp_ring_cons];
                 cqe_fp_flags = cqe->fast_path_cqe.type_error_flags;
+                cqe_fp_status_flags = cqe->fast_path_cqe.status_flags;
 
                 DP(NETIF_MSG_RX_STATUS, "CQE type %x  err %x  status %x"
                    "  queue %x  vlan %x  len %u\n", CQE_TYPE(cqe_fp_flags),
@@ -1616,7 +1617,6 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                         rx_buf = &fp->rx_buf_ring[bd_cons];
                         skb = rx_buf->skb;
                         prefetch(skb);
-                        prefetch((u8 *)skb + 256);
                         len = le16_to_cpu(cqe->fast_path_cqe.pkt_len);
                         pad = cqe->fast_path_cqe.placement_offset;
 
@@ -1667,7 +1667,6 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                                         dma_unmap_addr(rx_buf, mapping),
                                                    pad + RX_COPY_THRESH,
                                                    DMA_FROM_DEVICE);
-                        prefetch(skb);
                         prefetch(((char *)(skb)) + 128);
 
                         /* is this an error packet? */
@@ -1727,6 +1726,12 @@ reuse_rx:
 
                         skb->protocol = eth_type_trans(skb, bp->dev);
 
+                        if ((bp->dev->features & NETIF_F_RXHASH) &&
+                            (cqe_fp_status_flags &
+                             ETH_FAST_PATH_RX_CQE_RSS_HASH_FLG))
+                                skb->rxhash = le32_to_cpu(
+                                    cqe->fast_path_cqe.rss_hash_result);
+
                         skb->ip_summed = CHECKSUM_NONE;
                         if (bp->rx_csum) {
                                 if (likely(BNX2X_RX_CSUM_OK(cqe)))
@@ -5750,10 +5755,10 @@ static void bnx2x_init_internal_func(struct bnx2x *bp)
         u32 offset;
         u16 max_agg_size;
 
-        if (is_multi(bp)) {
-                tstorm_config.config_flags = MULTI_FLAGS(bp);
+        tstorm_config.config_flags = RSS_FLAGS(bp);
+
+        if (is_multi(bp))
                 tstorm_config.rss_result_mask = MULTI_MASK;
-        }
 
         /* Enable TPA if needed */
         if (bp->flags & TPA_ENABLE_FLAG)
@@ -6629,10 +6634,8 @@ static int bnx2x_init_common(struct bnx2x *bp)
         bnx2x_init_block(bp, PBF_BLOCK, COMMON_STAGE);
 
         REG_WR(bp, SRC_REG_SOFT_RST, 1);
-        for (i = SRC_REG_KEYRSS0_0; i <= SRC_REG_KEYRSS1_9; i += 4) {
-                REG_WR(bp, i, 0xc0cac01a);
-                /* TODO: replace with something meaningful */
-        }
+        for (i = SRC_REG_KEYRSS0_0; i <= SRC_REG_KEYRSS1_9; i += 4)
+                REG_WR(bp, i, random32());
         bnx2x_init_block(bp, SRCH_BLOCK, COMMON_STAGE);
 #ifdef BCM_CNIC
         REG_WR(bp, SRC_REG_KEYSEARCH_0, 0x63285672);
@@ -11001,6 +11004,11 @@ static int bnx2x_set_flags(struct net_device *dev, u32 data)
                 changed = 1;
         }
 
+        if (data & ETH_FLAG_RXHASH)
+                dev->features |= NETIF_F_RXHASH;
+        else
+                dev->features &= ~NETIF_F_RXHASH;
+
         if (changed && netif_running(dev)) {
                 bnx2x_nic_unload(bp, UNLOAD_NORMAL);
                 rc = bnx2x_nic_load(bp, LOAD_NORMAL);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 85e813c7762b..5e12462a9d5e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -59,6 +59,7 @@
 #include <linux/uaccess.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
+#include <linux/netpoll.h>
 #include <linux/inetdevice.h>
 #include <linux/igmp.h>
 #include <linux/etherdevice.h>
@@ -430,7 +431,18 @@ int bond_dev_queue_xmit(struct bonding *bond, struct sk_buff *skb,
         }
 
         skb->priority = 1;
-        dev_queue_xmit(skb);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (unlikely(bond->dev->priv_flags & IFF_IN_NETPOLL)) {
+                struct netpoll *np = bond->dev->npinfo->netpoll;
+                slave_dev->npinfo = bond->dev->npinfo;
+                np->real_dev = np->dev = skb->dev;
+                slave_dev->priv_flags |= IFF_IN_NETPOLL;
+                netpoll_send_skb(np, skb);
+                slave_dev->priv_flags &= ~IFF_IN_NETPOLL;
+                np->dev = bond->dev;
+        } else
+#endif
+                dev_queue_xmit(skb);
 
         return 0;
 }
@@ -1256,6 +1268,61 @@ static void bond_detach_slave(struct bonding *bond, struct slave *slave)
         bond->slave_cnt--;
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+/*
+ * You must hold read lock on bond->lock before calling this.
+ */
+static bool slaves_support_netpoll(struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        int i = 0;
+        bool ret = true;
+
+        bond_for_each_slave(bond, slave, i) {
+                if ((slave->dev->priv_flags & IFF_DISABLE_NETPOLL) ||
+                    !slave->dev->netdev_ops->ndo_poll_controller)
+                        ret = false;
+        }
+        return i != 0 && ret;
+}
+
+static void bond_poll_controller(struct net_device *bond_dev)
+{
+        struct net_device *dev = bond_dev->npinfo->netpoll->real_dev;
+        if (dev != bond_dev)
+                netpoll_poll_dev(dev);
+}
+
+static void bond_netpoll_cleanup(struct net_device *bond_dev)
+{
+        struct bonding *bond = netdev_priv(bond_dev);
+        struct slave *slave;
+        const struct net_device_ops *ops;
+        int i;
+
+        read_lock(&bond->lock);
+        bond_dev->npinfo = NULL;
+        bond_for_each_slave(bond, slave, i) {
+                if (slave->dev) {
+                        ops = slave->dev->netdev_ops;
+                        if (ops->ndo_netpoll_cleanup)
+                                ops->ndo_netpoll_cleanup(slave->dev);
+                        else
+                                slave->dev->npinfo = NULL;
+                }
+        }
+        read_unlock(&bond->lock);
+}
+
+#else
+
+static void bond_netpoll_cleanup(struct net_device *bond_dev)
+{
+}
+
+#endif
+
 /*---------------------------------- IOCTL ----------------------------------*/
 
 static int bond_sethwaddr(struct net_device *bond_dev,
@@ -1674,6 +1741,18 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         bond_set_carrier(bond);
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (slaves_support_netpoll(bond_dev)) {
+                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+                if (bond_dev->npinfo)
+                        slave_dev->npinfo = bond_dev->npinfo;
+        } else if (!(bond_dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+                bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
+                pr_info("New slave device %s does not support netpoll\n",
+                        slave_dev->name);
+                pr_info("Disabling netpoll support for %s\n", bond_dev->name);
+        }
+#endif
         read_unlock(&bond->lock);
 
         res = bond_create_slave_symlinks(bond_dev, slave_dev);
@@ -1740,6 +1819,7 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
                 return -EINVAL;
         }
 
+        netdev_bonding_change(bond_dev, NETDEV_BONDING_DESLAVE);
         write_lock_bh(&bond->lock);
 
         slave = bond_get_slave_by_dev(bond, slave_dev);
@@ -1868,6 +1948,17 @@ int bond_release(struct net_device *bond_dev, struct net_device *slave_dev)
 
         netdev_set_master(slave_dev, NULL);
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        read_lock_bh(&bond->lock);
+        if (slaves_support_netpoll(bond_dev))
+                bond_dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+        read_unlock_bh(&bond->lock);
+        if (slave_dev->netdev_ops->ndo_netpoll_cleanup)
+                slave_dev->netdev_ops->ndo_netpoll_cleanup(slave_dev);
+        else
+                slave_dev->npinfo = NULL;
+#endif
+
         /* close slave before restoring its mac address */
         dev_close(slave_dev);
 
@@ -4406,6 +4497,10 @@ static const struct net_device_ops bond_netdev_ops = {
         .ndo_vlan_rx_register   = bond_vlan_rx_register,
         .ndo_vlan_rx_add_vid    = bond_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = bond_vlan_rx_kill_vid,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_netpoll_cleanup    = bond_netpoll_cleanup,
+        .ndo_poll_controller    = bond_poll_controller,
+#endif
 };
 
 static void bond_destructor(struct net_device *bond_dev)
@@ -4499,6 +4594,8 @@ static void bond_uninit(struct net_device *bond_dev)
 {
         struct bonding *bond = netdev_priv(bond_dev);
 
+        bond_netpoll_cleanup(bond_dev);
+
         /* Release the bonded slaves */
         bond_release_all(bond_dev);
 
diff --git a/drivers/net/caif/caif_serial.c b/drivers/net/caif/caif_serial.c
index 38c0186cfbc2..09257ca8f563 100644
--- a/drivers/net/caif/caif_serial.c
+++ b/drivers/net/caif/caif_serial.c
@@ -197,7 +197,8 @@ static void ldisc_receive(struct tty_struct *tty, const u8 *data,
 
         /* Get a suitable caif packet and copy in data. */
         skb = netdev_alloc_skb(ser->dev, count+1);
-        BUG_ON(skb == NULL);
+        if (skb == NULL)
+                return;
         p = skb_put(skb, count);
         memcpy(p, data, count);
 
@@ -315,6 +316,8 @@ static int ldisc_open(struct tty_struct *tty)
         /* No write no play */
         if (tty->ops->write == NULL)
                 return -EOPNOTSUPP;
+        if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_TTY_CONFIG))
+                return -EPERM;
 
         sprintf(name, "cf%s", tty->name);
         dev = alloc_netdev(sizeof(*ser), name, caifdev_setup);
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
         if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                 return -ENOMEM;
         }
 
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
 
         dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                 goto cleanup_candev;
         }
 
         dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
         if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                 goto cleanup_intr_urb;
         }
 
         dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                      sizeof(struct ems_cpc_msg), GFP_KERNEL);
         if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                 goto cleanup_intr_in_buffer;
         }
 
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                             int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                   SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                   "10GBASE-CX4");
         return 0;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index aced6c5e635c..e3f1b8566495 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -439,7 +439,7 @@ static void free_irq_resources(struct adapter *adapter)
 static int await_mgmt_replies(struct adapter *adap, unsigned long init_cnt,
                               unsigned long n)
 {
-        int attempts = 5;
+        int attempts = 10;
 
         while (adap->sge.qs[0].rspq.offload_pkts < init_cnt + n) {
                 if (!--attempts)
diff --git a/drivers/net/cxgb4/cxgb4.h b/drivers/net/cxgb4/cxgb4.h
index 3d8ff4889b56..8856a75fcc94 100644
--- a/drivers/net/cxgb4/cxgb4.h
+++ b/drivers/net/cxgb4/cxgb4.h
@@ -53,7 +53,7 @@
 
 enum {
         MAX_NPORTS = 4,     /* max # of ports */
-        SERNUM_LEN = 16,    /* Serial # length */
+        SERNUM_LEN = 24,    /* Serial # length */
         EC_LEN     = 16,    /* E/C length */
         ID_LEN     = 16,    /* ID length */
 };
@@ -651,8 +651,6 @@ int t4_link_start(struct adapter *adap, unsigned int mbox, unsigned int port,
                   struct link_config *lc);
 int t4_restart_aneg(struct adapter *adap, unsigned int mbox, unsigned int port);
 int t4_seeprom_wp(struct adapter *adapter, bool enable);
-int t4_read_flash(struct adapter *adapter, unsigned int addr,
-                  unsigned int nwords, u32 *data, int byte_oriented);
 int t4_load_fw(struct adapter *adapter, const u8 *fw_data, unsigned int size);
 int t4_check_fw_version(struct adapter *adapter);
 int t4_prep_adapter(struct adapter *adapter);
diff --git a/drivers/net/cxgb4/cxgb4_main.c b/drivers/net/cxgb4/cxgb4_main.c
index 5f582dba928f..1bad50041427 100644
--- a/drivers/net/cxgb4/cxgb4_main.c
+++ b/drivers/net/cxgb4/cxgb4_main.c
@@ -1711,6 +1711,18 @@ static int set_tso(struct net_device *dev, u32 value)
         return 0;
 }
 
+static int set_flags(struct net_device *dev, u32 flags)
+{
+        if (flags & ~ETH_FLAG_RXHASH)
+                return -EOPNOTSUPP;
+
+        if (flags & ETH_FLAG_RXHASH)
+                dev->features |= NETIF_F_RXHASH;
+        else
+                dev->features &= ~NETIF_F_RXHASH;
+        return 0;
+}
+
 static struct ethtool_ops cxgb_ethtool_ops = {
         .get_settings      = get_settings,
         .set_settings      = set_settings,
@@ -1741,6 +1753,7 @@ static struct ethtool_ops cxgb_ethtool_ops = {
         .get_wol           = get_wol,
         .set_wol           = set_wol,
         .set_tso           = set_tso,
+        .set_flags         = set_flags,
         .flash_device      = set_flash,
 };
 
@@ -3203,7 +3216,7 @@ static int __devinit init_one(struct pci_dev *pdev,
 
                 netdev->features |= NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6;
                 netdev->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
-                netdev->features |= NETIF_F_GRO | highdma;
+                netdev->features |= NETIF_F_GRO | NETIF_F_RXHASH | highdma;
                 netdev->features |= NETIF_F_HW_VLAN_TX | NETIF_F_HW_VLAN_RX;
                 netdev->vlan_features = netdev->features & VLAN_FEAT;
 
diff --git a/drivers/net/cxgb4/sge.c b/drivers/net/cxgb4/sge.c
index 14adc58e71c3..d1f8f225e45a 100644
--- a/drivers/net/cxgb4/sge.c
+++ b/drivers/net/cxgb4/sge.c
@@ -1471,7 +1471,7 @@ EXPORT_SYMBOL(cxgb4_pktgl_to_skb);
  *      Releases the pages of a packet gather list.  We do not own the last
  *      page on the list and do not free it.
  */
-void t4_pktgl_free(const struct pkt_gl *gl)
+static void t4_pktgl_free(const struct pkt_gl *gl)
 {
         int n;
         const skb_frag_t *p;
@@ -1524,6 +1524,8 @@ static void do_gro(struct sge_eth_rxq *rxq, const struct pkt_gl *gl,
         skb->truesize += skb->data_len;
         skb->ip_summed = CHECKSUM_UNNECESSARY;
         skb_record_rx_queue(skb, rxq->rspq.idx);
+        if (rxq->rspq.netdev->features & NETIF_F_RXHASH)
+                skb->rxhash = (__force u32)pkt->rsshdr.hash_val;
 
         if (unlikely(pkt->vlan_ex)) {
                 struct port_info *pi = netdev_priv(rxq->rspq.netdev);
@@ -1565,7 +1567,7 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
         if (unlikely(*(u8 *)rsp == CPL_TRACE_PKT))
                 return handle_trace_pkt(q->adap, si);
 
-        pkt = (void *)&rsp[1];
+        pkt = (const struct cpl_rx_pkt *)rsp;
         csum_ok = pkt->csum_calc && !pkt->err_vec;
         if ((pkt->l2info & htonl(RXF_TCP)) &&
             (q->netdev->features & NETIF_F_GRO) && csum_ok && !pkt->ip_frag) {
@@ -1583,6 +1585,9 @@ int t4_ethrx_handler(struct sge_rspq *q, const __be64 *rsp,
         __skb_pull(skb, RX_PKT_PAD);      /* remove ethernet header padding */
         skb->protocol = eth_type_trans(skb, q->netdev);
         skb_record_rx_queue(skb, q->idx);
+        if (skb->dev->features & NETIF_F_RXHASH)
+                skb->rxhash = (__force u32)pkt->rsshdr.hash_val;
+
         pi = netdev_priv(skb->dev);
         rxq->stats.pkts++;
 
@@ -2047,7 +2052,7 @@ int t4_sge_alloc_rxq(struct adapter *adap, struct sge_rspq *iq, bool fwevtq,
         adap->sge.ingr_map[iq->cntxt_id] = iq;
 
         if (fl) {
-                fl->cntxt_id = htons(c.fl0id);
+                fl->cntxt_id = ntohs(c.fl0id);
                 fl->avail = fl->pend_cred = 0;
                 fl->pidx = fl->cidx = 0;
                 fl->alloc_failed = fl->large_alloc_failed = fl->starving = 0;
diff --git a/drivers/net/cxgb4/t4_hw.c b/drivers/net/cxgb4/t4_hw.c
index a814a3afe123..2923dd43523d 100644
--- a/drivers/net/cxgb4/t4_hw.c
+++ b/drivers/net/cxgb4/t4_hw.c
@@ -53,8 +53,8 @@
  *      at the time it indicated completion is stored there.  Returns 0 if the
  *      operation completes and -EAGAIN otherwise.
  */
-int t4_wait_op_done_val(struct adapter *adapter, int reg, u32 mask,
-                        int polarity, int attempts, int delay, u32 *valp)
+static int t4_wait_op_done_val(struct adapter *adapter, int reg, u32 mask,
+                               int polarity, int attempts, int delay, u32 *valp)
 {
         while (1) {
                 u32 val = t4_read_reg(adapter, reg);
@@ -109,9 +109,9 @@ void t4_set_reg_field(struct adapter *adapter, unsigned int addr, u32 mask,
  *      Reads registers that are accessed indirectly through an address/data
  *      register pair.
  */
-void t4_read_indirect(struct adapter *adap, unsigned int addr_reg,
-                      unsigned int data_reg, u32 *vals, unsigned int nregs,
-                      unsigned int start_idx)
+static void t4_read_indirect(struct adapter *adap, unsigned int addr_reg,
+                             unsigned int data_reg, u32 *vals,
+                             unsigned int nregs, unsigned int start_idx)
 {
         while (nregs--) {
                 t4_write_reg(adap, addr_reg, start_idx);
@@ -120,6 +120,7 @@ void t4_read_indirect(struct adapter *adap, unsigned int addr_reg,
         }
 }
 
+#if 0
 /**
  *      t4_write_indirect - write indirectly addressed registers
  *      @adap: the adapter
@@ -132,15 +133,16 @@ void t4_read_indirect(struct adapter *adap, unsigned int addr_reg,
  *      Writes a sequential block of registers that are accessed indirectly
  *      through an address/data register pair.
  */
-void t4_write_indirect(struct adapter *adap, unsigned int addr_reg,
-                       unsigned int data_reg, const u32 *vals,
-                       unsigned int nregs, unsigned int start_idx)
+static void t4_write_indirect(struct adapter *adap, unsigned int addr_reg,
+                              unsigned int data_reg, const u32 *vals,
+                              unsigned int nregs, unsigned int start_idx)
 {
         while (nregs--) {
                 t4_write_reg(adap, addr_reg, start_idx++);
                 t4_write_reg(adap, data_reg, *vals++);
         }
 }
+#endif
 
 /*
  * Get the reply to a mailbox command and store it in @rpl in big-endian order.
@@ -345,33 +347,21 @@ int t4_edc_read(struct adapter *adap, int idx, u32 addr, __be32 *data, u64 *ecc)
         return 0;
 }
 
-#define VPD_ENTRY(name, len) \
-        u8 name##_kword[2]; u8 name##_len; u8 name##_data[len]
-
 /*
  * Partial EEPROM Vital Product Data structure.  Includes only the ID and
- * VPD-R sections.
+ * VPD-R header.
  */
-struct t4_vpd {
+struct t4_vpd_hdr {
         u8  id_tag;
         u8  id_len[2];
         u8  id_data[ID_LEN];
         u8  vpdr_tag;
         u8  vpdr_len[2];
-        VPD_ENTRY(pn, 16);                     /* part number */
-        VPD_ENTRY(ec, EC_LEN);                 /* EC level */
-        VPD_ENTRY(sn, SERNUM_LEN);             /* serial number */
-        VPD_ENTRY(na, 12);                     /* MAC address base */
-        VPD_ENTRY(port_type, 8);               /* port types */
-        VPD_ENTRY(gpio, 14);                   /* GPIO usage */
-        VPD_ENTRY(cclk, 6);                    /* core clock */
-        VPD_ENTRY(port_addr, 8);               /* port MDIO addresses */
-        VPD_ENTRY(rv, 1);                      /* csum */
-        u32 pad;                  /* for multiple-of-4 sizing and alignment */
 };
 
 #define EEPROM_STAT_ADDR   0x7bfc
 #define VPD_BASE           0
+#define VPD_LEN            512
 
 /**
  *      t4_seeprom_wp - enable/disable EEPROM write protection
@@ -396,16 +386,36 @@ int t4_seeprom_wp(struct adapter *adapter, bool enable)
  */
 static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
 {
-        int ret;
-        struct t4_vpd vpd;
-        u8 *q = (u8 *)&vpd, csum;
+        int i, ret;
+        int ec, sn, v2;
+        u8 vpd[VPD_LEN], csum;
+        unsigned int vpdr_len;
+        const struct t4_vpd_hdr *v;
 
-        ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), &vpd);
+        ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
         if (ret < 0)
                 return ret;
 
-        for (csum = 0; q <= vpd.rv_data; q++)
-                csum += *q;
+        v = (const struct t4_vpd_hdr *)vpd;
+        vpdr_len = pci_vpd_lrdt_size(&v->vpdr_tag);
+        if (vpdr_len + sizeof(struct t4_vpd_hdr) > VPD_LEN) {
+                dev_err(adapter->pdev_dev, "bad VPD-R length %u\n", vpdr_len);
+                return -EINVAL;
+        }
+
+#define FIND_VPD_KW(var, name) do { \
+        var = pci_vpd_find_info_keyword(&v->id_tag, sizeof(struct t4_vpd_hdr), \
+                                        vpdr_len, name); \
+        if (var < 0) { \
+                dev_err(adapter->pdev_dev, "missing VPD keyword " name "\n"); \
+                return -EINVAL; \
+        } \
+        var += PCI_VPD_INFO_FLD_HDR_SIZE; \
+} while (0)
+
+        FIND_VPD_KW(i, "RV");
+        for (csum = 0; i >= 0; i--)
+                csum += vpd[i];
 
         if (csum) {
                 dev_err(adapter->pdev_dev,
@@ -413,12 +423,18 @@ static int get_vpd_params(struct adapter *adapter, struct vpd_params *p)
                 return -EINVAL;
         }
 
-        p->cclk = simple_strtoul(vpd.cclk_data, NULL, 10);
-        memcpy(p->id, vpd.id_data, sizeof(vpd.id_data));
+        FIND_VPD_KW(ec, "EC");
+        FIND_VPD_KW(sn, "SN");
+        FIND_VPD_KW(v2, "V2");
+#undef FIND_VPD_KW
+
+        p->cclk = simple_strtoul(vpd + v2, NULL, 10);
+        memcpy(p->id, v->id_data, ID_LEN);
         strim(p->id);
-        memcpy(p->ec, vpd.ec_data, sizeof(vpd.ec_data));
+        memcpy(p->ec, vpd + ec, EC_LEN);
         strim(p->ec);
-        memcpy(p->sn, vpd.sn_data, sizeof(vpd.sn_data));
+        i = pci_vpd_info_field_size(vpd + sn - PCI_VPD_INFO_FLD_HDR_SIZE);
+        memcpy(p->sn, vpd + sn, min(i, SERNUM_LEN));
         strim(p->sn);
         return 0;
 }
@@ -537,8 +553,8 @@ static int flash_wait_op(struct adapter *adapter, int attempts, int delay)
  *      (i.e., big-endian), otherwise as 32-bit words in the platform's
  *      natural endianess.
  */
-int t4_read_flash(struct adapter *adapter, unsigned int addr,
-                  unsigned int nwords, u32 *data, int byte_oriented)
+static int t4_read_flash(struct adapter *adapter, unsigned int addr,
+                         unsigned int nwords, u32 *data, int byte_oriented)
 {
         int ret;
 
diff --git a/drivers/net/cxgb4/t4_msg.h b/drivers/net/cxgb4/t4_msg.h
index fdb117443144..7a981b81afaf 100644
--- a/drivers/net/cxgb4/t4_msg.h
+++ b/drivers/net/cxgb4/t4_msg.h
@@ -503,6 +503,7 @@ struct cpl_rx_data_ack {
 };
 
 struct cpl_rx_pkt {
+        struct rss_header rsshdr;
         u8 opcode;
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         u8 iff:4;
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 3e8d0005540f..ef97bfcef9dd 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -168,6 +168,7 @@
 #include <linux/ethtool.h>
 #include <linux/string.h>
 #include <linux/firmware.h>
+#include <linux/rtnetlink.h>
 #include <asm/unaligned.h>
 
 
@@ -2280,8 +2281,13 @@ static void e100_tx_timeout_task(struct work_struct *work)
 
         netif_printk(nic, tx_err, KERN_DEBUG, nic->netdev,
                      "scb.status=0x%02X\n", ioread8(&nic->csr->scb.status));
-        e100_down(netdev_priv(netdev));
-        e100_up(netdev_priv(netdev));
+
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                e100_down(netdev_priv(netdev));
+                e100_up(netdev_priv(netdev));
+        }
+        rtnl_unlock();
 }
 
 static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
diff --git a/drivers/net/e1000/e1000.h b/drivers/net/e1000/e1000.h
index 2f29c2131851..40b62b406b08 100644
--- a/drivers/net/e1000/e1000.h
+++ b/drivers/net/e1000/e1000.h
@@ -81,23 +81,6 @@ struct e1000_adapter;
 
 #include "e1000_hw.h"
 
-#ifdef DBG
-#define E1000_DBG(args...) printk(KERN_DEBUG "e1000: " args)
-#else
-#define E1000_DBG(args...)
-#endif
-
-#define E1000_ERR(args...) printk(KERN_ERR "e1000: " args)
-
-#define PFX "e1000: "
-
-#define DPRINTK(nlevel, klevel, fmt, args...)                           \
-do {                                                                    \
-        if (NETIF_MSG_##nlevel & adapter->msg_enable)                   \
-                printk(KERN_##klevel PFX "%s: %s: " fmt,                \
-                       adapter->netdev->name, __func__, ##args);        \
-} while (0)
-
 #define E1000_MAX_INTR 10
 
 /* TX/RX descriptor defines */
@@ -335,6 +318,25 @@ enum e1000_state_t {
         __E1000_DOWN
 };
 
+#undef pr_fmt
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+extern struct net_device *e1000_get_hw_dev(struct e1000_hw *hw);
+#define e_dbg(format, arg...) \
+        netdev_dbg(e1000_get_hw_dev(hw), format, ## arg)
+#define e_err(format, arg...) \
+        netdev_err(adapter->netdev, format, ## arg)
+#define e_info(format, arg...) \
+        netdev_info(adapter->netdev, format, ## arg)
+#define e_warn(format, arg...) \
+        netdev_warn(adapter->netdev, format, ## arg)
+#define e_notice(format, arg...) \
+        netdev_notice(adapter->netdev, format, ## arg)
+#define e_dev_info(format, arg...) \
+        dev_info(&adapter->pdev->dev, format, ## arg)
+#define e_dev_warn(format, arg...) \
+        dev_warn(&adapter->pdev->dev, format, ## arg)
+
 extern char e1000_driver_name[];
 extern const char e1000_driver_version[];
 
@@ -352,5 +354,6 @@ extern bool e1000_has_link(struct e1000_adapter *adapter);
 extern void e1000_power_up_phy(struct e1000_adapter *);
 extern void e1000_set_ethtool_ops(struct net_device *netdev);
 extern void e1000_check_options(struct e1000_adapter *adapter);
+extern char *e1000_get_hw_dev_name(struct e1000_hw *hw);
 
 #endif /* _E1000_H_ */
diff --git a/drivers/net/e1000/e1000_ethtool.c b/drivers/net/e1000/e1000_ethtool.c
index c67e93117271..2a3b2dccd06d 100644
--- a/drivers/net/e1000/e1000_ethtool.c
+++ b/drivers/net/e1000/e1000_ethtool.c
@@ -346,7 +346,7 @@ static int e1000_set_tso(struct net_device *netdev, u32 data)
 
         netdev->features &= ~NETIF_F_TSO6;
 
-        DPRINTK(PROBE, INFO, "TSO is %s\n", data ? "Enabled" : "Disabled");
+        e_info("TSO is %s\n", data ? "Enabled" : "Disabled");
         adapter->tso_force = true;
         return 0;
 }
@@ -714,9 +714,9 @@ static bool reg_pattern_test(struct e1000_adapter *adapter, u64 *data, int reg,
                 writel(write & test[i], address);
                 read = readl(address);
                 if (read != (write & test[i] & mask)) {
-                        DPRINTK(DRV, ERR, "pattern test reg %04X failed: "
-                                "got 0x%08X expected 0x%08X\n",
-                                reg, read, (write & test[i] & mask));
+                        e_info("pattern test reg %04X failed: "
+                               "got 0x%08X expected 0x%08X\n",
+                               reg, read, (write & test[i] & mask));
                         *data = reg;
                         return true;
                 }
@@ -734,9 +734,9 @@ static bool reg_set_and_check(struct e1000_adapter *adapter, u64 *data, int reg,
         writel(write & mask, address);
         read = readl(address);
         if ((read & mask) != (write & mask)) {
-                DPRINTK(DRV, ERR, "set/check reg %04X test failed: "
-                        "got 0x%08X expected 0x%08X\n",
-                        reg, (read & mask), (write & mask));
+                e_err("set/check reg %04X test failed: "
+                      "got 0x%08X expected 0x%08X\n",
+                      reg, (read & mask), (write & mask));
                 *data = reg;
                 return true;
         }
@@ -779,8 +779,8 @@ static int e1000_reg_test(struct e1000_adapter *adapter, u64 *data)
         ew32(STATUS, toggle);
         after = er32(STATUS) & toggle;
         if (value != after) {
-                DPRINTK(DRV, ERR, "failed STATUS register test got: "
-                        "0x%08X expected: 0x%08X\n", after, value);
+                e_err("failed STATUS register test got: "
+                      "0x%08X expected: 0x%08X\n", after, value);
                 *data = 1;
                 return 1;
         }
@@ -894,8 +894,7 @@ static int e1000_intr_test(struct e1000_adapter *adapter, u64 *data)
                 *data = 1;
                 return -1;
         }
-        DPRINTK(HW, INFO, "testing %s interrupt\n",
-                (shared_int ? "shared" : "unshared"));
+        e_info("testing %s interrupt\n", (shared_int ? "shared" : "unshared"));
 
         /* Disable all the interrupts */
         ew32(IMC, 0xFFFFFFFF);
@@ -980,9 +979,10 @@ static void e1000_free_desc_rings(struct e1000_adapter *adapter)
         if (txdr->desc && txdr->buffer_info) {
                 for (i = 0; i < txdr->count; i++) {
                         if (txdr->buffer_info[i].dma)
-                                pci_unmap_single(pdev, txdr->buffer_info[i].dma,
+                                dma_unmap_single(&pdev->dev,
+                                                 txdr->buffer_info[i].dma,
                                                  txdr->buffer_info[i].length,
-                                                 PCI_DMA_TODEVICE);
+                                                 DMA_TO_DEVICE);
                         if (txdr->buffer_info[i].skb)
                                 dev_kfree_skb(txdr->buffer_info[i].skb);
                 }
@@ -991,20 +991,23 @@ static void e1000_free_desc_rings(struct e1000_adapter *adapter)
         if (rxdr->desc && rxdr->buffer_info) {
                 for (i = 0; i < rxdr->count; i++) {
                         if (rxdr->buffer_info[i].dma)
-                                pci_unmap_single(pdev, rxdr->buffer_info[i].dma,
+                                dma_unmap_single(&pdev->dev,
+                                                 rxdr->buffer_info[i].dma,
                                                  rxdr->buffer_info[i].length,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         if (rxdr->buffer_info[i].skb)
                                 dev_kfree_skb(rxdr->buffer_info[i].skb);
                 }
         }
 
         if (txdr->desc) {
-                pci_free_consistent(pdev, txdr->size, txdr->desc, txdr->dma);
+                dma_free_coherent(&pdev->dev, txdr->size, txdr->desc,
+                                  txdr->dma);
                 txdr->desc = NULL;
         }
         if (rxdr->desc) {
-                pci_free_consistent(pdev, rxdr->size, rxdr->desc, rxdr->dma);
+                dma_free_coherent(&pdev->dev, rxdr->size, rxdr->desc,
+                                  rxdr->dma);
                 rxdr->desc = NULL;
         }
 
@@ -1039,7 +1042,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
 
         txdr->size = txdr->count * sizeof(struct e1000_tx_desc);
         txdr->size = ALIGN(txdr->size, 4096);
-        txdr->desc = pci_alloc_consistent(pdev, txdr->size, &txdr->dma);
+        txdr->desc = dma_alloc_coherent(&pdev->dev, txdr->size, &txdr->dma,
+                                        GFP_KERNEL);
         if (!txdr->desc) {
                 ret_val = 2;
                 goto err_nomem;
@@ -1070,8 +1074,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 txdr->buffer_info[i].skb = skb;
                 txdr->buffer_info[i].length = skb->len;
                 txdr->buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, skb->len,
-                                       PCI_DMA_TODEVICE);
+                        dma_map_single(&pdev->dev, skb->data, skb->len,
+                                       DMA_TO_DEVICE);
                 tx_desc->buffer_addr = cpu_to_le64(txdr->buffer_info[i].dma);
                 tx_desc->lower.data = cpu_to_le32(skb->len);
                 tx_desc->lower.data |= cpu_to_le32(E1000_TXD_CMD_EOP |
@@ -1093,7 +1097,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
         }
 
         rxdr->size = rxdr->count * sizeof(struct e1000_rx_desc);
-        rxdr->desc = pci_alloc_consistent(pdev, rxdr->size, &rxdr->dma);
+        rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
+                                        GFP_KERNEL);
         if (!rxdr->desc) {
                 ret_val = 5;
                 goto err_nomem;
@@ -1126,8 +1131,8 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 rxdr->buffer_info[i].skb = skb;
                 rxdr->buffer_info[i].length = E1000_RXBUFFER_2048;
                 rxdr->buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, E1000_RXBUFFER_2048,
-                                       PCI_DMA_FROMDEVICE);
+                        dma_map_single(&pdev->dev, skb->data,
+                                       E1000_RXBUFFER_2048, DMA_FROM_DEVICE);
                 rx_desc->buffer_addr = cpu_to_le64(rxdr->buffer_info[i].dma);
                 memset(skb->data, 0x00, skb->len);
         }
@@ -1444,10 +1449,10 @@ static int e1000_run_loopback_test(struct e1000_adapter *adapter)
                 for (i = 0; i < 64; i++) { /* send the packets */
                         e1000_create_lbtest_frame(txdr->buffer_info[i].skb,
                                         1024);
-                        pci_dma_sync_single_for_device(pdev,
-                                        txdr->buffer_info[k].dma,
-                                        txdr->buffer_info[k].length,
-                                        PCI_DMA_TODEVICE);
+                        dma_sync_single_for_device(&pdev->dev,
+                                                   txdr->buffer_info[k].dma,
+                                                   txdr->buffer_info[k].length,
+                                                   DMA_TO_DEVICE);
                         if (unlikely(++k == txdr->count)) k = 0;
                 }
                 ew32(TDT, k);
@@ -1455,10 +1460,10 @@ static int e1000_run_loopback_test(struct e1000_adapter *adapter)
                 time = jiffies; /* set the start time for the receive */
                 good_cnt = 0;
                 do { /* receive the sent packets */
-                        pci_dma_sync_single_for_cpu(pdev,
-                                        rxdr->buffer_info[l].dma,
-                                        rxdr->buffer_info[l].length,
-                                        PCI_DMA_FROMDEVICE);
+                        dma_sync_single_for_cpu(&pdev->dev,
+                                                rxdr->buffer_info[l].dma,
+                                                rxdr->buffer_info[l].length,
+                                                DMA_FROM_DEVICE);
 
                         ret_val = e1000_check_lbtest_frame(
                                         rxdr->buffer_info[l].skb,
@@ -1558,7 +1563,7 @@ static void e1000_diag_test(struct net_device *netdev,
                 u8 forced_speed_duplex = hw->forced_speed_duplex;
                 u8 autoneg = hw->autoneg;
 
-                DPRINTK(HW, INFO, "offline testing starting\n");
+                e_info("offline testing starting\n");
 
                 /* Link test performed before hardware reset so autoneg doesn't
                  * interfere with test result */
@@ -1598,7 +1603,7 @@ static void e1000_diag_test(struct net_device *netdev,
                 if (if_running)
                         dev_open(netdev);
         } else {
-                DPRINTK(HW, INFO, "online testing starting\n");
+                e_info("online testing starting\n");
                 /* Online tests */
                 if (e1000_link_test(adapter, &data[4]))
                         eth_test->flags |= ETH_TEST_FL_FAILED;
@@ -1691,7 +1696,7 @@ static void e1000_get_wol(struct net_device *netdev,
                 wol->supported &= ~WAKE_UCAST;
 
                 if (adapter->wol & E1000_WUFC_EX)
-                        DPRINTK(DRV, ERR, "Interface does not support "
+                        e_err("Interface does not support "
                         "directed (unicast) frame wake-up packets\n");
                 break;
         default:
@@ -1725,8 +1730,8 @@ static int e1000_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
         switch (hw->device_id) {
         case E1000_DEV_ID_82546GB_QUAD_COPPER_KSP3:
                 if (wol->wolopts & WAKE_UCAST) {
-                        DPRINTK(DRV, ERR, "Interface does not support "
-                        "directed (unicast) frame wake-up packets\n");
+                        e_err("Interface does not support "
+                              "directed (unicast) frame wake-up packets\n");
                         return -EOPNOTSUPP;
                 }
                 break;
@@ -1803,7 +1808,7 @@ static int e1000_get_coalesce(struct net_device *netdev,
         if (adapter->hw.mac_type < e1000_82545)
                 return -EOPNOTSUPP;
 
-        if (adapter->itr_setting <= 3)
+        if (adapter->itr_setting <= 4)
                 ec->rx_coalesce_usecs = adapter->itr_setting;
         else
                 ec->rx_coalesce_usecs = 1000000 / adapter->itr_setting;
@@ -1821,12 +1826,14 @@ static int e1000_set_coalesce(struct net_device *netdev,
                 return -EOPNOTSUPP;
 
         if ((ec->rx_coalesce_usecs > E1000_MAX_ITR_USECS) ||
-            ((ec->rx_coalesce_usecs > 3) &&
+            ((ec->rx_coalesce_usecs > 4) &&
              (ec->rx_coalesce_usecs < E1000_MIN_ITR_USECS)) ||
             (ec->rx_coalesce_usecs == 2))
                 return -EINVAL;
 
-        if (ec->rx_coalesce_usecs <= 3) {
+        if (ec->rx_coalesce_usecs == 4) {
+                adapter->itr = adapter->itr_setting = 4;
+        } else if (ec->rx_coalesce_usecs <= 3) {
                 adapter->itr = 20000;
                 adapter->itr_setting = ec->rx_coalesce_usecs;
         } else {
diff --git a/drivers/net/e1000/e1000_hw.c b/drivers/net/e1000/e1000_hw.c
index e2b6e6e7ba6a..c7e242b69a18 100644
--- a/drivers/net/e1000/e1000_hw.c
+++ b/drivers/net/e1000/e1000_hw.c
@@ -30,7 +30,7 @@
  * Shared functions for accessing and configuring the MAC
  */
 
-#include "e1000_hw.h"
+#include "e1000.h"
 
 static s32 e1000_check_downshift(struct e1000_hw *hw);
 static s32 e1000_check_polarity(struct e1000_hw *hw,
@@ -114,7 +114,7 @@ static DEFINE_SPINLOCK(e1000_eeprom_lock);
  */
 static s32 e1000_set_phy_type(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_set_phy_type");
+        e_dbg("e1000_set_phy_type");
 
         if (hw->mac_type == e1000_undefined)
                 return -E1000_ERR_PHY_TYPE;
@@ -152,7 +152,7 @@ static void e1000_phy_init_script(struct e1000_hw *hw)
         u32 ret_val;
         u16 phy_saved_data;
 
-        DEBUGFUNC("e1000_phy_init_script");
+        e_dbg("e1000_phy_init_script");
 
         if (hw->phy_init_script) {
                 msleep(20);
@@ -245,7 +245,7 @@ static void e1000_phy_init_script(struct e1000_hw *hw)
  */
 s32 e1000_set_mac_type(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_set_mac_type");
+        e_dbg("e1000_set_mac_type");
 
         switch (hw->device_id) {
         case E1000_DEV_ID_82542:
@@ -354,7 +354,7 @@ void e1000_set_media_type(struct e1000_hw *hw)
 {
         u32 status;
 
-        DEBUGFUNC("e1000_set_media_type");
+        e_dbg("e1000_set_media_type");
 
         if (hw->mac_type != e1000_82543) {
                 /* tbi_compatibility is only valid on 82543 */
@@ -401,16 +401,16 @@ s32 e1000_reset_hw(struct e1000_hw *hw)
         u32 led_ctrl;
         s32 ret_val;
 
-        DEBUGFUNC("e1000_reset_hw");
+        e_dbg("e1000_reset_hw");
 
         /* For 82542 (rev 2.0), disable MWI before issuing a device reset */
         if (hw->mac_type == e1000_82542_rev2_0) {
-                DEBUGOUT("Disabling MWI on 82542 rev 2.0\n");
+                e_dbg("Disabling MWI on 82542 rev 2.0\n");
                 e1000_pci_clear_mwi(hw);
         }
 
         /* Clear interrupt mask to stop board from generating interrupts */
-        DEBUGOUT("Masking off all interrupts\n");
+        e_dbg("Masking off all interrupts\n");
         ew32(IMC, 0xffffffff);
 
         /* Disable the Transmit and Receive units.  Then delay to allow
@@ -442,7 +442,7 @@ s32 e1000_reset_hw(struct e1000_hw *hw)
          * the current PCI configuration.  The global reset bit is self-
          * clearing, and should clear within a microsecond.
          */
-        DEBUGOUT("Issuing a global reset to MAC\n");
+        e_dbg("Issuing a global reset to MAC\n");
 
         switch (hw->mac_type) {
         case e1000_82544:
@@ -516,7 +516,7 @@ s32 e1000_reset_hw(struct e1000_hw *hw)
         }
 
         /* Clear interrupt mask to stop board from generating interrupts */
-        DEBUGOUT("Masking off all interrupts\n");
+        e_dbg("Masking off all interrupts\n");
         ew32(IMC, 0xffffffff);
 
         /* Clear any pending interrupt events. */
@@ -549,12 +549,12 @@ s32 e1000_init_hw(struct e1000_hw *hw)
         u32 mta_size;
         u32 ctrl_ext;
 
-        DEBUGFUNC("e1000_init_hw");
+        e_dbg("e1000_init_hw");
 
         /* Initialize Identification LED */
         ret_val = e1000_id_led_init(hw);
         if (ret_val) {
-                DEBUGOUT("Error Initializing Identification LED\n");
+                e_dbg("Error Initializing Identification LED\n");
                 return ret_val;
         }
 
@@ -562,14 +562,14 @@ s32 e1000_init_hw(struct e1000_hw *hw)
         e1000_set_media_type(hw);
 
         /* Disabling VLAN filtering. */
-        DEBUGOUT("Initializing the IEEE VLAN\n");
+        e_dbg("Initializing the IEEE VLAN\n");
         if (hw->mac_type < e1000_82545_rev_3)
                 ew32(VET, 0);
         e1000_clear_vfta(hw);
 
         /* For 82542 (rev 2.0), disable MWI and put the receiver into reset */
         if (hw->mac_type == e1000_82542_rev2_0) {
-                DEBUGOUT("Disabling MWI on 82542 rev 2.0\n");
+                e_dbg("Disabling MWI on 82542 rev 2.0\n");
                 e1000_pci_clear_mwi(hw);
                 ew32(RCTL, E1000_RCTL_RST);
                 E1000_WRITE_FLUSH();
@@ -591,7 +591,7 @@ s32 e1000_init_hw(struct e1000_hw *hw)
         }
 
         /* Zero out the Multicast HASH table */
-        DEBUGOUT("Zeroing the MTA\n");
+        e_dbg("Zeroing the MTA\n");
         mta_size = E1000_MC_TBL_SIZE;
         for (i = 0; i < mta_size; i++) {
                 E1000_WRITE_REG_ARRAY(hw, MTA, i, 0);
@@ -662,7 +662,7 @@ static s32 e1000_adjust_serdes_amplitude(struct e1000_hw *hw)
         u16 eeprom_data;
         s32 ret_val;
 
-        DEBUGFUNC("e1000_adjust_serdes_amplitude");
+        e_dbg("e1000_adjust_serdes_amplitude");
 
         if (hw->media_type != e1000_media_type_internal_serdes)
                 return E1000_SUCCESS;
@@ -709,7 +709,7 @@ s32 e1000_setup_link(struct e1000_hw *hw)
         s32 ret_val;
         u16 eeprom_data;
 
-        DEBUGFUNC("e1000_setup_link");
+        e_dbg("e1000_setup_link");
 
         /* Read and store word 0x0F of the EEPROM. This word contains bits
          * that determine the hardware's default PAUSE (flow control) mode,
@@ -723,7 +723,7 @@ s32 e1000_setup_link(struct e1000_hw *hw)
                 ret_val = e1000_read_eeprom(hw, EEPROM_INIT_CONTROL2_REG,
                                             1, &eeprom_data);
                 if (ret_val) {
-                        DEBUGOUT("EEPROM Read Error\n");
+                        e_dbg("EEPROM Read Error\n");
                         return -E1000_ERR_EEPROM;
                 }
                 if ((eeprom_data & EEPROM_WORD0F_PAUSE_MASK) == 0)
@@ -747,7 +747,7 @@ s32 e1000_setup_link(struct e1000_hw *hw)
 
         hw->original_fc = hw->fc;
 
-        DEBUGOUT1("After fix-ups FlowControl is now = %x\n", hw->fc);
+        e_dbg("After fix-ups FlowControl is now = %x\n", hw->fc);
 
         /* Take the 4 bits from EEPROM word 0x0F that determine the initial
          * polarity value for the SW controlled pins, and setup the
@@ -760,7 +760,7 @@ s32 e1000_setup_link(struct e1000_hw *hw)
                 ret_val = e1000_read_eeprom(hw, EEPROM_INIT_CONTROL2_REG,
                                             1, &eeprom_data);
                 if (ret_val) {
-                        DEBUGOUT("EEPROM Read Error\n");
+                        e_dbg("EEPROM Read Error\n");
                         return -E1000_ERR_EEPROM;
                 }
                 ctrl_ext = ((eeprom_data & EEPROM_WORD0F_SWPDIO_EXT) <<
@@ -777,8 +777,7 @@ s32 e1000_setup_link(struct e1000_hw *hw)
          * control is disabled, because it does not hurt anything to
          * initialize these registers.
          */
-        DEBUGOUT
-            ("Initializing the Flow Control address, type and timer regs\n");
+        e_dbg("Initializing the Flow Control address, type and timer regs\n");
 
         ew32(FCT, FLOW_CONTROL_TYPE);
         ew32(FCAH, FLOW_CONTROL_ADDRESS_HIGH);
@@ -827,7 +826,7 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
         u32 signal = 0;
         s32 ret_val;
 
-        DEBUGFUNC("e1000_setup_fiber_serdes_link");
+        e_dbg("e1000_setup_fiber_serdes_link");
 
         /* On adapters with a MAC newer than 82544, SWDP 1 will be
          * set when the optics detect a signal. On older adapters, it will be
@@ -893,7 +892,7 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
                 txcw = (E1000_TXCW_ANE | E1000_TXCW_FD | E1000_TXCW_PAUSE_MASK);
                 break;
         default:
-                DEBUGOUT("Flow control param set incorrectly\n");
+                e_dbg("Flow control param set incorrectly\n");
                 return -E1000_ERR_CONFIG;
                 break;
         }
@@ -904,7 +903,7 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
          * link-up status bit will be set and the flow control enable bits (RFCE
          * and TFCE) will be set according to their negotiated value.
          */
-        DEBUGOUT("Auto-negotiation enabled\n");
+        e_dbg("Auto-negotiation enabled\n");
 
         ew32(TXCW, txcw);
         ew32(CTRL, ctrl);
@@ -921,7 +920,7 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
          */
         if (hw->media_type == e1000_media_type_internal_serdes ||
             (er32(CTRL) & E1000_CTRL_SWDPIN1) == signal) {
-                DEBUGOUT("Looking for Link\n");
+                e_dbg("Looking for Link\n");
                 for (i = 0; i < (LINK_UP_TIMEOUT / 10); i++) {
                         msleep(10);
                         status = er32(STATUS);
@@ -929,7 +928,7 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
                                 break;
                 }
                 if (i == (LINK_UP_TIMEOUT / 10)) {
-                        DEBUGOUT("Never got a valid link from auto-neg!!!\n");
+                        e_dbg("Never got a valid link from auto-neg!!!\n");
                         hw->autoneg_failed = 1;
                         /* AutoNeg failed to achieve a link, so we'll call
                          * e1000_check_for_link. This routine will force the link up if
@@ -938,16 +937,16 @@ static s32 e1000_setup_fiber_serdes_link(struct e1000_hw *hw)
                          */
                         ret_val = e1000_check_for_link(hw);
                         if (ret_val) {
-                                DEBUGOUT("Error while checking for link\n");
+                                e_dbg("Error while checking for link\n");
                                 return ret_val;
                         }
                         hw->autoneg_failed = 0;
                 } else {
                         hw->autoneg_failed = 0;
-                        DEBUGOUT("Valid Link Found\n");
+                        e_dbg("Valid Link Found\n");
                 }
         } else {
-                DEBUGOUT("No Signal Detected\n");
+                e_dbg("No Signal Detected\n");
         }
         return E1000_SUCCESS;
 }
@@ -964,7 +963,7 @@ static s32 e1000_copper_link_preconfig(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_copper_link_preconfig");
+        e_dbg("e1000_copper_link_preconfig");
 
         ctrl = er32(CTRL);
         /* With 82543, we need to force speed and duplex on the MAC equal to what
@@ -987,10 +986,10 @@ static s32 e1000_copper_link_preconfig(struct e1000_hw *hw)
         /* Make sure we have a valid PHY */
         ret_val = e1000_detect_gig_phy(hw);
         if (ret_val) {
-                DEBUGOUT("Error, did not detect valid phy.\n");
+                e_dbg("Error, did not detect valid phy.\n");
                 return ret_val;
         }
-        DEBUGOUT1("Phy ID = %x\n", hw->phy_id);
+        e_dbg("Phy ID = %x\n", hw->phy_id);
 
         /* Set PHY to class A mode (if necessary) */
         ret_val = e1000_set_phy_mode(hw);
@@ -1025,14 +1024,14 @@ static s32 e1000_copper_link_igp_setup(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_copper_link_igp_setup");
+        e_dbg("e1000_copper_link_igp_setup");
 
         if (hw->phy_reset_disable)
                 return E1000_SUCCESS;
 
         ret_val = e1000_phy_reset(hw);
         if (ret_val) {
-                DEBUGOUT("Error Resetting the PHY\n");
+                e_dbg("Error Resetting the PHY\n");
                 return ret_val;
         }
 
@@ -1049,7 +1048,7 @@ static s32 e1000_copper_link_igp_setup(struct e1000_hw *hw)
                 /* disable lplu d3 during driver init */
                 ret_val = e1000_set_d3_lplu_state(hw, false);
                 if (ret_val) {
-                        DEBUGOUT("Error Disabling LPLU D3\n");
+                        e_dbg("Error Disabling LPLU D3\n");
                         return ret_val;
                 }
         }
@@ -1166,7 +1165,7 @@ static s32 e1000_copper_link_mgp_setup(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_copper_link_mgp_setup");
+        e_dbg("e1000_copper_link_mgp_setup");
 
         if (hw->phy_reset_disable)
                 return E1000_SUCCESS;
@@ -1255,7 +1254,7 @@ static s32 e1000_copper_link_mgp_setup(struct e1000_hw *hw)
         /* SW Reset the PHY so all changes take effect */
         ret_val = e1000_phy_reset(hw);
         if (ret_val) {
-                DEBUGOUT("Error Resetting the PHY\n");
+                e_dbg("Error Resetting the PHY\n");
                 return ret_val;
         }
 
@@ -1274,7 +1273,7 @@ static s32 e1000_copper_link_autoneg(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_copper_link_autoneg");
+        e_dbg("e1000_copper_link_autoneg");
 
         /* Perform some bounds checking on the hw->autoneg_advertised
          * parameter.  If this variable is zero, then set it to the default.
@@ -1287,13 +1286,13 @@ static s32 e1000_copper_link_autoneg(struct e1000_hw *hw)
         if (hw->autoneg_advertised == 0)
                 hw->autoneg_advertised = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
-        DEBUGOUT("Reconfiguring auto-neg advertisement params\n");
+        e_dbg("Reconfiguring auto-neg advertisement params\n");
         ret_val = e1000_phy_setup_autoneg(hw);
         if (ret_val) {
-                DEBUGOUT("Error Setting up Auto-Negotiation\n");
+                e_dbg("Error Setting up Auto-Negotiation\n");
                 return ret_val;
         }
-        DEBUGOUT("Restarting Auto-Neg\n");
+        e_dbg("Restarting Auto-Neg\n");
 
         /* Restart auto-negotiation by setting the Auto Neg Enable bit and
          * the Auto Neg Restart bit in the PHY control register.
@@ -1313,7 +1312,7 @@ static s32 e1000_copper_link_autoneg(struct e1000_hw *hw)
         if (hw->wait_autoneg_complete) {
                 ret_val = e1000_wait_autoneg(hw);
                 if (ret_val) {
-                        DEBUGOUT
+                        e_dbg
                             ("Error while waiting for autoneg to complete\n");
                         return ret_val;
                 }
@@ -1340,20 +1339,20 @@ static s32 e1000_copper_link_autoneg(struct e1000_hw *hw)
 static s32 e1000_copper_link_postconfig(struct e1000_hw *hw)
 {
         s32 ret_val;
-        DEBUGFUNC("e1000_copper_link_postconfig");
+        e_dbg("e1000_copper_link_postconfig");
 
         if (hw->mac_type >= e1000_82544) {
                 e1000_config_collision_dist(hw);
         } else {
                 ret_val = e1000_config_mac_to_phy(hw);
                 if (ret_val) {
-                        DEBUGOUT("Error configuring MAC to PHY settings\n");
+                        e_dbg("Error configuring MAC to PHY settings\n");
                         return ret_val;
                 }
         }
         ret_val = e1000_config_fc_after_link_up(hw);
         if (ret_val) {
-                DEBUGOUT("Error Configuring Flow Control\n");
+                e_dbg("Error Configuring Flow Control\n");
                 return ret_val;
         }
 
@@ -1361,7 +1360,7 @@ static s32 e1000_copper_link_postconfig(struct e1000_hw *hw)
         if (hw->phy_type == e1000_phy_igp) {
                 ret_val = e1000_config_dsp_after_link_change(hw, true);
                 if (ret_val) {
-                        DEBUGOUT("Error Configuring DSP after link up\n");
+                        e_dbg("Error Configuring DSP after link up\n");
                         return ret_val;
                 }
         }
@@ -1381,7 +1380,7 @@ static s32 e1000_setup_copper_link(struct e1000_hw *hw)
         u16 i;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_setup_copper_link");
+        e_dbg("e1000_setup_copper_link");
 
         /* Check if it is a valid PHY and set PHY mode if necessary. */
         ret_val = e1000_copper_link_preconfig(hw);
@@ -1407,10 +1406,10 @@ static s32 e1000_setup_copper_link(struct e1000_hw *hw)
         } else {
                 /* PHY will be set to 10H, 10F, 100H,or 100F
                  * depending on value from forced_speed_duplex. */
-                DEBUGOUT("Forcing speed and duplex\n");
+                e_dbg("Forcing speed and duplex\n");
                 ret_val = e1000_phy_force_speed_duplex(hw);
                 if (ret_val) {
-                        DEBUGOUT("Error Forcing Speed and Duplex\n");
+                        e_dbg("Error Forcing Speed and Duplex\n");
                         return ret_val;
                 }
         }
@@ -1432,13 +1431,13 @@ static s32 e1000_setup_copper_link(struct e1000_hw *hw)
                         if (ret_val)
                                 return ret_val;
 
-                        DEBUGOUT("Valid link established!!!\n");
+                        e_dbg("Valid link established!!!\n");
                         return E1000_SUCCESS;
                 }
                 udelay(10);
         }
 
-        DEBUGOUT("Unable to establish link!!!\n");
+        e_dbg("Unable to establish link!!!\n");
         return E1000_SUCCESS;
 }
 
@@ -1454,7 +1453,7 @@ s32 e1000_phy_setup_autoneg(struct e1000_hw *hw)
         u16 mii_autoneg_adv_reg;
         u16 mii_1000t_ctrl_reg;
 
-        DEBUGFUNC("e1000_phy_setup_autoneg");
+        e_dbg("e1000_phy_setup_autoneg");
 
         /* Read the MII Auto-Neg Advertisement Register (Address 4). */
         ret_val = e1000_read_phy_reg(hw, PHY_AUTONEG_ADV, &mii_autoneg_adv_reg);
@@ -1481,41 +1480,41 @@ s32 e1000_phy_setup_autoneg(struct e1000_hw *hw)
         mii_autoneg_adv_reg &= ~REG4_SPEED_MASK;
         mii_1000t_ctrl_reg &= ~REG9_SPEED_MASK;
 
-        DEBUGOUT1("autoneg_advertised %x\n", hw->autoneg_advertised);
+        e_dbg("autoneg_advertised %x\n", hw->autoneg_advertised);
 
         /* Do we want to advertise 10 Mb Half Duplex? */
         if (hw->autoneg_advertised & ADVERTISE_10_HALF) {
-                DEBUGOUT("Advertise 10mb Half duplex\n");
+                e_dbg("Advertise 10mb Half duplex\n");
                 mii_autoneg_adv_reg |= NWAY_AR_10T_HD_CAPS;
         }
 
         /* Do we want to advertise 10 Mb Full Duplex? */
         if (hw->autoneg_advertised & ADVERTISE_10_FULL) {
-                DEBUGOUT("Advertise 10mb Full duplex\n");
+                e_dbg("Advertise 10mb Full duplex\n");
                 mii_autoneg_adv_reg |= NWAY_AR_10T_FD_CAPS;
         }
 
         /* Do we want to advertise 100 Mb Half Duplex? */
         if (hw->autoneg_advertised & ADVERTISE_100_HALF) {
-                DEBUGOUT("Advertise 100mb Half duplex\n");
+                e_dbg("Advertise 100mb Half duplex\n");
                 mii_autoneg_adv_reg |= NWAY_AR_100TX_HD_CAPS;
         }
 
         /* Do we want to advertise 100 Mb Full Duplex? */
         if (hw->autoneg_advertised & ADVERTISE_100_FULL) {
-                DEBUGOUT("Advertise 100mb Full duplex\n");
+                e_dbg("Advertise 100mb Full duplex\n");
                 mii_autoneg_adv_reg |= NWAY_AR_100TX_FD_CAPS;
         }
 
         /* We do not allow the Phy to advertise 1000 Mb Half Duplex */
         if (hw->autoneg_advertised & ADVERTISE_1000_HALF) {
-                DEBUGOUT
+                e_dbg
                     ("Advertise 1000mb Half duplex requested, request denied!\n");
         }
 
         /* Do we want to advertise 1000 Mb Full Duplex? */
         if (hw->autoneg_advertised & ADVERTISE_1000_FULL) {
-                DEBUGOUT("Advertise 1000mb Full duplex\n");
+                e_dbg("Advertise 1000mb Full duplex\n");
                 mii_1000t_ctrl_reg |= CR_1000T_FD_CAPS;
         }
 
@@ -1568,7 +1567,7 @@ s32 e1000_phy_setup_autoneg(struct e1000_hw *hw)
                 mii_autoneg_adv_reg |= (NWAY_AR_ASM_DIR | NWAY_AR_PAUSE);
                 break;
         default:
-                DEBUGOUT("Flow control param set incorrectly\n");
+                e_dbg("Flow control param set incorrectly\n");
                 return -E1000_ERR_CONFIG;
         }
 
@@ -1576,7 +1575,7 @@ s32 e1000_phy_setup_autoneg(struct e1000_hw *hw)
         if (ret_val)
                 return ret_val;
 
-        DEBUGOUT1("Auto-Neg Advertising %x\n", mii_autoneg_adv_reg);
+        e_dbg("Auto-Neg Advertising %x\n", mii_autoneg_adv_reg);
 
         ret_val = e1000_write_phy_reg(hw, PHY_1000T_CTRL, mii_1000t_ctrl_reg);
         if (ret_val)
@@ -1600,12 +1599,12 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
         u16 phy_data;
         u16 i;
 
-        DEBUGFUNC("e1000_phy_force_speed_duplex");
+        e_dbg("e1000_phy_force_speed_duplex");
 
         /* Turn off Flow control if we are forcing speed and duplex. */
         hw->fc = E1000_FC_NONE;
 
-        DEBUGOUT1("hw->fc = %d\n", hw->fc);
+        e_dbg("hw->fc = %d\n", hw->fc);
 
         /* Read the Device Control Register. */
         ctrl = er32(CTRL);
@@ -1634,14 +1633,14 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
                  */
                 ctrl |= E1000_CTRL_FD;
                 mii_ctrl_reg |= MII_CR_FULL_DUPLEX;
-                DEBUGOUT("Full Duplex\n");
+                e_dbg("Full Duplex\n");
         } else {
                 /* We want to force half duplex so we CLEAR the full duplex bits in
                  * the Device and MII Control Registers.
                  */
                 ctrl &= ~E1000_CTRL_FD;
                 mii_ctrl_reg &= ~MII_CR_FULL_DUPLEX;
-                DEBUGOUT("Half Duplex\n");
+                e_dbg("Half Duplex\n");
         }
 
         /* Are we forcing 100Mbps??? */
@@ -1651,13 +1650,13 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
                 ctrl |= E1000_CTRL_SPD_100;
                 mii_ctrl_reg |= MII_CR_SPEED_100;
                 mii_ctrl_reg &= ~(MII_CR_SPEED_1000 | MII_CR_SPEED_10);
-                DEBUGOUT("Forcing 100mb ");
+                e_dbg("Forcing 100mb ");
         } else {
                 /* Set the 10Mb bit and turn off the 1000Mb and 100Mb bits. */
                 ctrl &= ~(E1000_CTRL_SPD_1000 | E1000_CTRL_SPD_100);
                 mii_ctrl_reg |= MII_CR_SPEED_10;
                 mii_ctrl_reg &= ~(MII_CR_SPEED_1000 | MII_CR_SPEED_100);
-                DEBUGOUT("Forcing 10mb ");
+                e_dbg("Forcing 10mb ");
         }
 
         e1000_config_collision_dist(hw);
@@ -1680,7 +1679,7 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
                 if (ret_val)
                         return ret_val;
 
-                DEBUGOUT1("M88E1000 PSCR: %x\n", phy_data);
+                e_dbg("M88E1000 PSCR: %x\n", phy_data);
 
                 /* Need to reset the PHY or these changes will be ignored */
                 mii_ctrl_reg |= MII_CR_RESET;
@@ -1720,7 +1719,7 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
          */
         if (hw->wait_autoneg_complete) {
                 /* We will wait for autoneg to complete. */
-                DEBUGOUT("Waiting for forced speed/duplex link.\n");
+                e_dbg("Waiting for forced speed/duplex link.\n");
                 mii_status_reg = 0;
 
                 /* We will wait for autoneg to complete or 4.5 seconds to expire. */
@@ -1746,7 +1745,7 @@ static s32 e1000_phy_force_speed_duplex(struct e1000_hw *hw)
                         /* We didn't get link.  Reset the DSP and wait again for link. */
                         ret_val = e1000_phy_reset_dsp(hw);
                         if (ret_val) {
-                                DEBUGOUT("Error Resetting PHY DSP\n");
+                                e_dbg("Error Resetting PHY DSP\n");
                                 return ret_val;
                         }
                 }
@@ -1826,7 +1825,7 @@ void e1000_config_collision_dist(struct e1000_hw *hw)
 {
         u32 tctl, coll_dist;
 
-        DEBUGFUNC("e1000_config_collision_dist");
+        e_dbg("e1000_config_collision_dist");
 
         if (hw->mac_type < e1000_82543)
                 coll_dist = E1000_COLLISION_DISTANCE_82542;
@@ -1857,7 +1856,7 @@ static s32 e1000_config_mac_to_phy(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_config_mac_to_phy");
+        e_dbg("e1000_config_mac_to_phy");
 
         /* 82544 or newer MAC, Auto Speed Detection takes care of
          * MAC speed/duplex configuration.*/
@@ -1913,7 +1912,7 @@ s32 e1000_force_mac_fc(struct e1000_hw *hw)
 {
         u32 ctrl;
 
-        DEBUGFUNC("e1000_force_mac_fc");
+        e_dbg("e1000_force_mac_fc");
 
         /* Get the current configuration of the Device Control Register */
         ctrl = er32(CTRL);
@@ -1952,7 +1951,7 @@ s32 e1000_force_mac_fc(struct e1000_hw *hw)
                 ctrl |= (E1000_CTRL_TFCE | E1000_CTRL_RFCE);
                 break;
         default:
-                DEBUGOUT("Flow control param set incorrectly\n");
+                e_dbg("Flow control param set incorrectly\n");
                 return -E1000_ERR_CONFIG;
         }
 
@@ -1984,7 +1983,7 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
         u16 speed;
         u16 duplex;
 
-        DEBUGFUNC("e1000_config_fc_after_link_up");
+        e_dbg("e1000_config_fc_after_link_up");
 
         /* Check for the case where we have fiber media and auto-neg failed
          * so we had to force link.  In this case, we need to force the
@@ -1997,7 +1996,7 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                 && (!hw->autoneg))) {
                 ret_val = e1000_force_mac_fc(hw);
                 if (ret_val) {
-                        DEBUGOUT("Error forcing flow control settings\n");
+                        e_dbg("Error forcing flow control settings\n");
                         return ret_val;
                 }
         }
@@ -2079,10 +2078,10 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                                  */
                                 if (hw->original_fc == E1000_FC_FULL) {
                                         hw->fc = E1000_FC_FULL;
-                                        DEBUGOUT("Flow Control = FULL.\n");
+                                        e_dbg("Flow Control = FULL.\n");
                                 } else {
                                         hw->fc = E1000_FC_RX_PAUSE;
-                                        DEBUGOUT
+                                        e_dbg
                                             ("Flow Control = RX PAUSE frames only.\n");
                                 }
                         }
@@ -2100,7 +2099,7 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                                  (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR))
                         {
                                 hw->fc = E1000_FC_TX_PAUSE;
-                                DEBUGOUT
+                                e_dbg
                                     ("Flow Control = TX PAUSE frames only.\n");
                         }
                         /* For transmitting PAUSE frames ONLY.
@@ -2117,7 +2116,7 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                                  (mii_nway_lp_ability_reg & NWAY_LPAR_ASM_DIR))
                         {
                                 hw->fc = E1000_FC_RX_PAUSE;
-                                DEBUGOUT
+                                e_dbg
                                     ("Flow Control = RX PAUSE frames only.\n");
                         }
                         /* Per the IEEE spec, at this point flow control should be
@@ -2144,10 +2143,10 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                                   hw->original_fc == E1000_FC_TX_PAUSE) ||
                                  hw->fc_strict_ieee) {
                                 hw->fc = E1000_FC_NONE;
-                                DEBUGOUT("Flow Control = NONE.\n");
+                                e_dbg("Flow Control = NONE.\n");
                         } else {
                                 hw->fc = E1000_FC_RX_PAUSE;
-                                DEBUGOUT
+                                e_dbg
                                     ("Flow Control = RX PAUSE frames only.\n");
                         }
 
@@ -2158,7 +2157,7 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                         ret_val =
                             e1000_get_speed_and_duplex(hw, &speed, &duplex);
                         if (ret_val) {
-                                DEBUGOUT
+                                e_dbg
                                     ("Error getting link speed and duplex\n");
                                 return ret_val;
                         }
@@ -2171,12 +2170,12 @@ static s32 e1000_config_fc_after_link_up(struct e1000_hw *hw)
                          */
                         ret_val = e1000_force_mac_fc(hw);
                         if (ret_val) {
-                                DEBUGOUT
+                                e_dbg
                                     ("Error forcing flow control settings\n");
                                 return ret_val;
                         }
                 } else {
-                        DEBUGOUT
+                        e_dbg
                             ("Copper PHY and Auto Neg has not completed.\n");
                 }
         }
@@ -2197,7 +2196,7 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
         u32 status;
         s32 ret_val = E1000_SUCCESS;
 
-        DEBUGFUNC("e1000_check_for_serdes_link_generic");
+        e_dbg("e1000_check_for_serdes_link_generic");
 
         ctrl = er32(CTRL);
         status = er32(STATUS);
@@ -2216,7 +2215,7 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
                         hw->autoneg_failed = 1;
                         goto out;
                 }
-                DEBUGOUT("NOT RXing /C/, disable AutoNeg and force link.\n");
+                e_dbg("NOT RXing /C/, disable AutoNeg and force link.\n");
 
                 /* Disable auto-negotiation in the TXCW register */
                 ew32(TXCW, (hw->txcw & ~E1000_TXCW_ANE));
@@ -2229,7 +2228,7 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
                 /* Configure Flow Control after forcing link up. */
                 ret_val = e1000_config_fc_after_link_up(hw);
                 if (ret_val) {
-                        DEBUGOUT("Error configuring flow control\n");
+                        e_dbg("Error configuring flow control\n");
                         goto out;
                 }
         } else if ((ctrl & E1000_CTRL_SLU) && (rxcw & E1000_RXCW_C)) {
@@ -2239,7 +2238,7 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
                  * and disable forced link in the Device Control register
                  * in an attempt to auto-negotiate with our link partner.
                  */
-                DEBUGOUT("RXing /C/, enable AutoNeg and stop forcing link.\n");
+                e_dbg("RXing /C/, enable AutoNeg and stop forcing link.\n");
                 ew32(TXCW, hw->txcw);
                 ew32(CTRL, (ctrl & ~E1000_CTRL_SLU));
 
@@ -2256,11 +2255,11 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
                 if (rxcw & E1000_RXCW_SYNCH) {
                         if (!(rxcw & E1000_RXCW_IV)) {
                                 hw->serdes_has_link = true;
-                                DEBUGOUT("SERDES: Link up - forced.\n");
+                                e_dbg("SERDES: Link up - forced.\n");
                         }
                 } else {
                         hw->serdes_has_link = false;
-                        DEBUGOUT("SERDES: Link down - force failed.\n");
+                        e_dbg("SERDES: Link down - force failed.\n");
                 }
         }
 
@@ -2273,20 +2272,20 @@ static s32 e1000_check_for_serdes_link_generic(struct e1000_hw *hw)
                         if (rxcw & E1000_RXCW_SYNCH) {
                                 if (!(rxcw & E1000_RXCW_IV)) {
                                         hw->serdes_has_link = true;
-                                        DEBUGOUT("SERDES: Link up - autoneg "
+                                        e_dbg("SERDES: Link up - autoneg "
                                                  "completed successfully.\n");
                                 } else {
                                         hw->serdes_has_link = false;
-                                        DEBUGOUT("SERDES: Link down - invalid"
+                                        e_dbg("SERDES: Link down - invalid"
                                                  "codewords detected in autoneg.\n");
                                 }
                         } else {
                                 hw->serdes_has_link = false;
-                                DEBUGOUT("SERDES: Link down - no sync.\n");
+                                e_dbg("SERDES: Link down - no sync.\n");
                         }
                 } else {
                         hw->serdes_has_link = false;
-                        DEBUGOUT("SERDES: Link down - autoneg failed\n");
+                        e_dbg("SERDES: Link down - autoneg failed\n");
                 }
         }
 
@@ -2312,7 +2311,7 @@ s32 e1000_check_for_link(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_check_for_link");
+        e_dbg("e1000_check_for_link");
 
         ctrl = er32(CTRL);
         status = er32(STATUS);
@@ -2407,7 +2406,7 @@ s32 e1000_check_for_link(struct e1000_hw *hw)
                 else {
                         ret_val = e1000_config_mac_to_phy(hw);
                         if (ret_val) {
-                                DEBUGOUT
+                                e_dbg
                                     ("Error configuring MAC to PHY settings\n");
                                 return ret_val;
                         }
@@ -2419,7 +2418,7 @@ s32 e1000_check_for_link(struct e1000_hw *hw)
                  */
                 ret_val = e1000_config_fc_after_link_up(hw);
                 if (ret_val) {
-                        DEBUGOUT("Error configuring flow control\n");
+                        e_dbg("Error configuring flow control\n");
                         return ret_val;
                 }
 
@@ -2435,7 +2434,7 @@ s32 e1000_check_for_link(struct e1000_hw *hw)
                         ret_val =
                             e1000_get_speed_and_duplex(hw, &speed, &duplex);
                         if (ret_val) {
-                                DEBUGOUT
+                                e_dbg
                                     ("Error getting link speed and duplex\n");
                                 return ret_val;
                         }
@@ -2487,30 +2486,30 @@ s32 e1000_get_speed_and_duplex(struct e1000_hw *hw, u16 *speed, u16 *duplex)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_get_speed_and_duplex");
+        e_dbg("e1000_get_speed_and_duplex");
 
         if (hw->mac_type >= e1000_82543) {
                 status = er32(STATUS);
                 if (status & E1000_STATUS_SPEED_1000) {
                         *speed = SPEED_1000;
-                        DEBUGOUT("1000 Mbs, ");
+                        e_dbg("1000 Mbs, ");
                 } else if (status & E1000_STATUS_SPEED_100) {
                         *speed = SPEED_100;
-                        DEBUGOUT("100 Mbs, ");
+                        e_dbg("100 Mbs, ");
                 } else {
                         *speed = SPEED_10;
-                        DEBUGOUT("10 Mbs, ");
+                        e_dbg("10 Mbs, ");
                 }
 
                 if (status & E1000_STATUS_FD) {
                         *duplex = FULL_DUPLEX;
-                        DEBUGOUT("Full Duplex\n");
+                        e_dbg("Full Duplex\n");
                 } else {
                         *duplex = HALF_DUPLEX;
-                        DEBUGOUT(" Half Duplex\n");
+                        e_dbg(" Half Duplex\n");
                 }
         } else {
-                DEBUGOUT("1000 Mbs, Full Duplex\n");
+                e_dbg("1000 Mbs, Full Duplex\n");
                 *speed = SPEED_1000;
                 *duplex = FULL_DUPLEX;
         }
@@ -2554,8 +2553,8 @@ static s32 e1000_wait_autoneg(struct e1000_hw *hw)
         u16 i;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_wait_autoneg");
-        DEBUGOUT("Waiting for Auto-Neg to complete.\n");
+        e_dbg("e1000_wait_autoneg");
+        e_dbg("Waiting for Auto-Neg to complete.\n");
 
         /* We will wait for autoneg to complete or 4.5 seconds to expire. */
         for (i = PHY_AUTO_NEG_TIME; i > 0; i--) {
@@ -2718,7 +2717,7 @@ s32 e1000_read_phy_reg(struct e1000_hw *hw, u32 reg_addr, u16 *phy_data)
 {
         u32 ret_val;
 
-        DEBUGFUNC("e1000_read_phy_reg");
+        e_dbg("e1000_read_phy_reg");
 
         if ((hw->phy_type == e1000_phy_igp) &&
             (reg_addr > MAX_PHY_MULTI_PAGE_REG)) {
@@ -2741,10 +2740,10 @@ static s32 e1000_read_phy_reg_ex(struct e1000_hw *hw, u32 reg_addr,
         u32 mdic = 0;
         const u32 phy_addr = 1;
 
-        DEBUGFUNC("e1000_read_phy_reg_ex");
+        e_dbg("e1000_read_phy_reg_ex");
 
         if (reg_addr > MAX_PHY_REG_ADDRESS) {
-                DEBUGOUT1("PHY Address %d is out of range\n", reg_addr);
+                e_dbg("PHY Address %d is out of range\n", reg_addr);
                 return -E1000_ERR_PARAM;
         }
 
@@ -2767,11 +2766,11 @@ static s32 e1000_read_phy_reg_ex(struct e1000_hw *hw, u32 reg_addr,
                                 break;
                 }
                 if (!(mdic & E1000_MDIC_READY)) {
-                        DEBUGOUT("MDI Read did not complete\n");
+                        e_dbg("MDI Read did not complete\n");
                         return -E1000_ERR_PHY;
                 }
                 if (mdic & E1000_MDIC_ERROR) {
-                        DEBUGOUT("MDI Error\n");
+                        e_dbg("MDI Error\n");
                         return -E1000_ERR_PHY;
                 }
                 *phy_data = (u16) mdic;
@@ -2820,7 +2819,7 @@ s32 e1000_write_phy_reg(struct e1000_hw *hw, u32 reg_addr, u16 phy_data)
 {
         u32 ret_val;
 
-        DEBUGFUNC("e1000_write_phy_reg");
+        e_dbg("e1000_write_phy_reg");
 
         if ((hw->phy_type == e1000_phy_igp) &&
             (reg_addr > MAX_PHY_MULTI_PAGE_REG)) {
@@ -2843,10 +2842,10 @@ static s32 e1000_write_phy_reg_ex(struct e1000_hw *hw, u32 reg_addr,
         u32 mdic = 0;
         const u32 phy_addr = 1;
 
-        DEBUGFUNC("e1000_write_phy_reg_ex");
+        e_dbg("e1000_write_phy_reg_ex");
 
         if (reg_addr > MAX_PHY_REG_ADDRESS) {
-                DEBUGOUT1("PHY Address %d is out of range\n", reg_addr);
+                e_dbg("PHY Address %d is out of range\n", reg_addr);
                 return -E1000_ERR_PARAM;
         }
 
@@ -2870,7 +2869,7 @@ static s32 e1000_write_phy_reg_ex(struct e1000_hw *hw, u32 reg_addr,
                                 break;
                 }
                 if (!(mdic & E1000_MDIC_READY)) {
-                        DEBUGOUT("MDI Write did not complete\n");
+                        e_dbg("MDI Write did not complete\n");
                         return -E1000_ERR_PHY;
                 }
         } else {
@@ -2910,9 +2909,9 @@ s32 e1000_phy_hw_reset(struct e1000_hw *hw)
         u32 led_ctrl;
         s32 ret_val;
 
-        DEBUGFUNC("e1000_phy_hw_reset");
+        e_dbg("e1000_phy_hw_reset");
 
-        DEBUGOUT("Resetting Phy...\n");
+        e_dbg("Resetting Phy...\n");
 
         if (hw->mac_type > e1000_82543) {
                 /* Read the device control register and assert the E1000_CTRL_PHY_RST
@@ -2973,7 +2972,7 @@ s32 e1000_phy_reset(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_phy_reset");
+        e_dbg("e1000_phy_reset");
 
         switch (hw->phy_type) {
         case e1000_phy_igp:
@@ -3013,7 +3012,7 @@ static s32 e1000_detect_gig_phy(struct e1000_hw *hw)
         u16 phy_id_high, phy_id_low;
         bool match = false;
 
-        DEBUGFUNC("e1000_detect_gig_phy");
+        e_dbg("e1000_detect_gig_phy");
 
         if (hw->phy_id != 0)
                 return E1000_SUCCESS;
@@ -3057,16 +3056,16 @@ static s32 e1000_detect_gig_phy(struct e1000_hw *hw)
                         match = true;
                 break;
         default:
-                DEBUGOUT1("Invalid MAC type %d\n", hw->mac_type);
+                e_dbg("Invalid MAC type %d\n", hw->mac_type);
                 return -E1000_ERR_CONFIG;
         }
         phy_init_status = e1000_set_phy_type(hw);
 
         if ((match) && (phy_init_status == E1000_SUCCESS)) {
-                DEBUGOUT1("PHY ID 0x%X detected\n", hw->phy_id);
+                e_dbg("PHY ID 0x%X detected\n", hw->phy_id);
                 return E1000_SUCCESS;
         }
-        DEBUGOUT1("Invalid PHY ID 0x%X\n", hw->phy_id);
+        e_dbg("Invalid PHY ID 0x%X\n", hw->phy_id);
         return -E1000_ERR_PHY;
 }
 
@@ -3079,7 +3078,7 @@ static s32 e1000_detect_gig_phy(struct e1000_hw *hw)
 static s32 e1000_phy_reset_dsp(struct e1000_hw *hw)
 {
         s32 ret_val;
-        DEBUGFUNC("e1000_phy_reset_dsp");
+        e_dbg("e1000_phy_reset_dsp");
 
         do {
                 ret_val = e1000_write_phy_reg(hw, 29, 0x001d);
@@ -3111,7 +3110,7 @@ static s32 e1000_phy_igp_get_info(struct e1000_hw *hw,
         u16 phy_data, min_length, max_length, average;
         e1000_rev_polarity polarity;
 
-        DEBUGFUNC("e1000_phy_igp_get_info");
+        e_dbg("e1000_phy_igp_get_info");
 
         /* The downshift status is checked only once, after link is established,
          * and it stored in the hw->speed_downgraded parameter. */
@@ -3189,7 +3188,7 @@ static s32 e1000_phy_m88_get_info(struct e1000_hw *hw,
         u16 phy_data;
         e1000_rev_polarity polarity;
 
-        DEBUGFUNC("e1000_phy_m88_get_info");
+        e_dbg("e1000_phy_m88_get_info");
 
         /* The downshift status is checked only once, after link is established,
          * and it stored in the hw->speed_downgraded parameter. */
@@ -3261,7 +3260,7 @@ s32 e1000_phy_get_info(struct e1000_hw *hw, struct e1000_phy_info *phy_info)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_phy_get_info");
+        e_dbg("e1000_phy_get_info");
 
         phy_info->cable_length = e1000_cable_length_undefined;
         phy_info->extended_10bt_distance = e1000_10bt_ext_dist_enable_undefined;
@@ -3273,7 +3272,7 @@ s32 e1000_phy_get_info(struct e1000_hw *hw, struct e1000_phy_info *phy_info)
         phy_info->remote_rx = e1000_1000t_rx_status_undefined;
 
         if (hw->media_type != e1000_media_type_copper) {
-                DEBUGOUT("PHY info is only valid for copper media\n");
+                e_dbg("PHY info is only valid for copper media\n");
                 return -E1000_ERR_CONFIG;
         }
 
@@ -3286,7 +3285,7 @@ s32 e1000_phy_get_info(struct e1000_hw *hw, struct e1000_phy_info *phy_info)
                 return ret_val;
 
         if ((phy_data & MII_SR_LINK_STATUS) != MII_SR_LINK_STATUS) {
-                DEBUGOUT("PHY info is only valid if link is up\n");
+                e_dbg("PHY info is only valid if link is up\n");
                 return -E1000_ERR_CONFIG;
         }
 
@@ -3298,10 +3297,10 @@ s32 e1000_phy_get_info(struct e1000_hw *hw, struct e1000_phy_info *phy_info)
 
 s32 e1000_validate_mdi_setting(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_validate_mdi_settings");
+        e_dbg("e1000_validate_mdi_settings");
 
         if (!hw->autoneg && (hw->mdix == 0 || hw->mdix == 3)) {
-                DEBUGOUT("Invalid MDI setting detected\n");
+                e_dbg("Invalid MDI setting detected\n");
                 hw->mdix = 1;
                 return -E1000_ERR_CONFIG;
         }
@@ -3322,7 +3321,7 @@ s32 e1000_init_eeprom_params(struct e1000_hw *hw)
         s32 ret_val = E1000_SUCCESS;
         u16 eeprom_size;
 
-        DEBUGFUNC("e1000_init_eeprom_params");
+        e_dbg("e1000_init_eeprom_params");
 
         switch (hw->mac_type) {
         case e1000_82542_rev2_0:
@@ -3539,7 +3538,7 @@ static s32 e1000_acquire_eeprom(struct e1000_hw *hw)
         struct e1000_eeprom_info *eeprom = &hw->eeprom;
         u32 eecd, i = 0;
 
-        DEBUGFUNC("e1000_acquire_eeprom");
+        e_dbg("e1000_acquire_eeprom");
 
         eecd = er32(EECD);
 
@@ -3557,7 +3556,7 @@ static s32 e1000_acquire_eeprom(struct e1000_hw *hw)
                 if (!(eecd & E1000_EECD_GNT)) {
                         eecd &= ~E1000_EECD_REQ;
                         ew32(EECD, eecd);
-                        DEBUGOUT("Could not acquire EEPROM grant\n");
+                        e_dbg("Could not acquire EEPROM grant\n");
                         return -E1000_ERR_EEPROM;
                 }
         }
@@ -3639,7 +3638,7 @@ static void e1000_release_eeprom(struct e1000_hw *hw)
 {
         u32 eecd;
 
-        DEBUGFUNC("e1000_release_eeprom");
+        e_dbg("e1000_release_eeprom");
 
         eecd = er32(EECD);
 
@@ -3687,7 +3686,7 @@ static s32 e1000_spi_eeprom_ready(struct e1000_hw *hw)
         u16 retry_count = 0;
         u8 spi_stat_reg;
 
-        DEBUGFUNC("e1000_spi_eeprom_ready");
+        e_dbg("e1000_spi_eeprom_ready");
 
         /* Read "Status Register" repeatedly until the LSB is cleared.  The
          * EEPROM will signal that the command has been completed by clearing
@@ -3712,7 +3711,7 @@ static s32 e1000_spi_eeprom_ready(struct e1000_hw *hw)
          * only 0-5mSec on 5V devices)
          */
         if (retry_count >= EEPROM_MAX_RETRY_SPI) {
-                DEBUGOUT("SPI EEPROM Status error\n");
+                e_dbg("SPI EEPROM Status error\n");
                 return -E1000_ERR_EEPROM;
         }
 
@@ -3741,7 +3740,7 @@ static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words,
         struct e1000_eeprom_info *eeprom = &hw->eeprom;
         u32 i = 0;
 
-        DEBUGFUNC("e1000_read_eeprom");
+        e_dbg("e1000_read_eeprom");
 
         /* If eeprom is not yet detected, do so now */
         if (eeprom->word_size == 0)
@@ -3752,9 +3751,8 @@ static s32 e1000_do_read_eeprom(struct e1000_hw *hw, u16 offset, u16 words,
          */
         if ((offset >= eeprom->word_size)
             || (words > eeprom->word_size - offset) || (words == 0)) {
-                DEBUGOUT2
-                    ("\"words\" parameter out of bounds. Words = %d, size = %d\n",
-                     offset, eeprom->word_size);
+                e_dbg("\"words\" parameter out of bounds. Words = %d,"
+                      "size = %d\n", offset, eeprom->word_size);
                 return -E1000_ERR_EEPROM;
         }
 
@@ -3832,11 +3830,11 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
         u16 checksum = 0;
         u16 i, eeprom_data;
 
-        DEBUGFUNC("e1000_validate_eeprom_checksum");
+        e_dbg("e1000_validate_eeprom_checksum");
 
         for (i = 0; i < (EEPROM_CHECKSUM_REG + 1); i++) {
                 if (e1000_read_eeprom(hw, i, 1, &eeprom_data) < 0) {
-                        DEBUGOUT("EEPROM Read Error\n");
+                        e_dbg("EEPROM Read Error\n");
                         return -E1000_ERR_EEPROM;
                 }
                 checksum += eeprom_data;
@@ -3845,7 +3843,7 @@ s32 e1000_validate_eeprom_checksum(struct e1000_hw *hw)
         if (checksum == (u16) EEPROM_SUM)
                 return E1000_SUCCESS;
         else {
-                DEBUGOUT("EEPROM Checksum Invalid\n");
+                e_dbg("EEPROM Checksum Invalid\n");
                 return -E1000_ERR_EEPROM;
         }
 }
@@ -3862,18 +3860,18 @@ s32 e1000_update_eeprom_checksum(struct e1000_hw *hw)
         u16 checksum = 0;
         u16 i, eeprom_data;
 
-        DEBUGFUNC("e1000_update_eeprom_checksum");
+        e_dbg("e1000_update_eeprom_checksum");
 
         for (i = 0; i < EEPROM_CHECKSUM_REG; i++) {
                 if (e1000_read_eeprom(hw, i, 1, &eeprom_data) < 0) {
-                        DEBUGOUT("EEPROM Read Error\n");
+                        e_dbg("EEPROM Read Error\n");
                         return -E1000_ERR_EEPROM;
                 }
                 checksum += eeprom_data;
         }
         checksum = (u16) EEPROM_SUM - checksum;
         if (e1000_write_eeprom(hw, EEPROM_CHECKSUM_REG, 1, &checksum) < 0) {
-                DEBUGOUT("EEPROM Write Error\n");
+                e_dbg("EEPROM Write Error\n");
                 return -E1000_ERR_EEPROM;
         }
         return E1000_SUCCESS;
@@ -3904,7 +3902,7 @@ static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words,
         struct e1000_eeprom_info *eeprom = &hw->eeprom;
         s32 status = 0;
 
-        DEBUGFUNC("e1000_write_eeprom");
+        e_dbg("e1000_write_eeprom");
 
         /* If eeprom is not yet detected, do so now */
         if (eeprom->word_size == 0)
@@ -3915,7 +3913,7 @@ static s32 e1000_do_write_eeprom(struct e1000_hw *hw, u16 offset, u16 words,
          */
         if ((offset >= eeprom->word_size)
             || (words > eeprom->word_size - offset) || (words == 0)) {
-                DEBUGOUT("\"words\" parameter out of bounds\n");
+                e_dbg("\"words\" parameter out of bounds\n");
                 return -E1000_ERR_EEPROM;
         }
 
@@ -3949,7 +3947,7 @@ static s32 e1000_write_eeprom_spi(struct e1000_hw *hw, u16 offset, u16 words,
         struct e1000_eeprom_info *eeprom = &hw->eeprom;
         u16 widx = 0;
 
-        DEBUGFUNC("e1000_write_eeprom_spi");
+        e_dbg("e1000_write_eeprom_spi");
 
         while (widx < words) {
                 u8 write_opcode = EEPROM_WRITE_OPCODE_SPI;
@@ -4013,7 +4011,7 @@ static s32 e1000_write_eeprom_microwire(struct e1000_hw *hw, u16 offset,
         u16 words_written = 0;
         u16 i = 0;
 
-        DEBUGFUNC("e1000_write_eeprom_microwire");
+        e_dbg("e1000_write_eeprom_microwire");
 
         /* Send the write enable command to the EEPROM (3-bit opcode plus
          * 6/8-bit dummy address beginning with 11).  It's less work to include
@@ -4056,7 +4054,7 @@ static s32 e1000_write_eeprom_microwire(struct e1000_hw *hw, u16 offset,
                         udelay(50);
                 }
                 if (i == 200) {
-                        DEBUGOUT("EEPROM Write did not complete\n");
+                        e_dbg("EEPROM Write did not complete\n");
                         return -E1000_ERR_EEPROM;
                 }
 
@@ -4092,12 +4090,12 @@ s32 e1000_read_mac_addr(struct e1000_hw *hw)
         u16 offset;
         u16 eeprom_data, i;
 
-        DEBUGFUNC("e1000_read_mac_addr");
+        e_dbg("e1000_read_mac_addr");
 
         for (i = 0; i < NODE_ADDRESS_SIZE; i += 2) {
                 offset = i >> 1;
                 if (e1000_read_eeprom(hw, offset, 1, &eeprom_data) < 0) {
-                        DEBUGOUT("EEPROM Read Error\n");
+                        e_dbg("EEPROM Read Error\n");
                         return -E1000_ERR_EEPROM;
                 }
                 hw->perm_mac_addr[i] = (u8) (eeprom_data & 0x00FF);
@@ -4132,17 +4130,17 @@ static void e1000_init_rx_addrs(struct e1000_hw *hw)
         u32 i;
         u32 rar_num;
 
-        DEBUGFUNC("e1000_init_rx_addrs");
+        e_dbg("e1000_init_rx_addrs");
 
         /* Setup the receive address. */
-        DEBUGOUT("Programming MAC Address into RAR[0]\n");
+        e_dbg("Programming MAC Address into RAR[0]\n");
 
         e1000_rar_set(hw, hw->mac_addr, 0);
 
         rar_num = E1000_RAR_ENTRIES;
 
         /* Zero out the other 15 receive addresses. */
-        DEBUGOUT("Clearing RAR[1-15]\n");
+        e_dbg("Clearing RAR[1-15]\n");
         for (i = 1; i < rar_num; i++) {
                 E1000_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
                 E1000_WRITE_FLUSH();
@@ -4290,7 +4288,7 @@ static s32 e1000_id_led_init(struct e1000_hw *hw)
         u16 eeprom_data, i, temp;
         const u16 led_mask = 0x0F;
 
-        DEBUGFUNC("e1000_id_led_init");
+        e_dbg("e1000_id_led_init");
 
         if (hw->mac_type < e1000_82540) {
                 /* Nothing to do */
@@ -4303,7 +4301,7 @@ static s32 e1000_id_led_init(struct e1000_hw *hw)
         hw->ledctl_mode2 = hw->ledctl_default;
 
         if (e1000_read_eeprom(hw, EEPROM_ID_LED_SETTINGS, 1, &eeprom_data) < 0) {
-                DEBUGOUT("EEPROM Read Error\n");
+                e_dbg("EEPROM Read Error\n");
                 return -E1000_ERR_EEPROM;
         }
 
@@ -4363,7 +4361,7 @@ s32 e1000_setup_led(struct e1000_hw *hw)
         u32 ledctl;
         s32 ret_val = E1000_SUCCESS;
 
-        DEBUGFUNC("e1000_setup_led");
+        e_dbg("e1000_setup_led");
 
         switch (hw->mac_type) {
         case e1000_82542_rev2_0:
@@ -4415,7 +4413,7 @@ s32 e1000_cleanup_led(struct e1000_hw *hw)
 {
         s32 ret_val = E1000_SUCCESS;
 
-        DEBUGFUNC("e1000_cleanup_led");
+        e_dbg("e1000_cleanup_led");
 
         switch (hw->mac_type) {
         case e1000_82542_rev2_0:
@@ -4451,7 +4449,7 @@ s32 e1000_led_on(struct e1000_hw *hw)
 {
         u32 ctrl = er32(CTRL);
 
-        DEBUGFUNC("e1000_led_on");
+        e_dbg("e1000_led_on");
 
         switch (hw->mac_type) {
         case e1000_82542_rev2_0:
@@ -4497,7 +4495,7 @@ s32 e1000_led_off(struct e1000_hw *hw)
 {
         u32 ctrl = er32(CTRL);
 
-        DEBUGFUNC("e1000_led_off");
+        e_dbg("e1000_led_off");
 
         switch (hw->mac_type) {
         case e1000_82542_rev2_0:
@@ -4626,7 +4624,7 @@ static void e1000_clear_hw_cntrs(struct e1000_hw *hw)
  */
 void e1000_reset_adaptive(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_reset_adaptive");
+        e_dbg("e1000_reset_adaptive");
 
         if (hw->adaptive_ifs) {
                 if (!hw->ifs_params_forced) {
@@ -4639,7 +4637,7 @@ void e1000_reset_adaptive(struct e1000_hw *hw)
                 hw->in_ifs_mode = false;
                 ew32(AIT, 0);
         } else {
-                DEBUGOUT("Not in Adaptive IFS mode!\n");
+                e_dbg("Not in Adaptive IFS mode!\n");
         }
 }
 
@@ -4654,7 +4652,7 @@ void e1000_reset_adaptive(struct e1000_hw *hw)
  */
 void e1000_update_adaptive(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_update_adaptive");
+        e_dbg("e1000_update_adaptive");
 
         if (hw->adaptive_ifs) {
                 if ((hw->collision_delta *hw->ifs_ratio) > hw->tx_packet_delta) {
@@ -4679,7 +4677,7 @@ void e1000_update_adaptive(struct e1000_hw *hw)
                         }
                 }
         } else {
-                DEBUGOUT("Not in Adaptive IFS mode!\n");
+                e_dbg("Not in Adaptive IFS mode!\n");
         }
 }
 
@@ -4851,7 +4849,7 @@ static s32 e1000_get_cable_length(struct e1000_hw *hw, u16 *min_length,
         u16 i, phy_data;
         u16 cable_length;
 
-        DEBUGFUNC("e1000_get_cable_length");
+        e_dbg("e1000_get_cable_length");
 
         *min_length = *max_length = 0;
 
@@ -4968,7 +4966,7 @@ static s32 e1000_check_polarity(struct e1000_hw *hw,
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_check_polarity");
+        e_dbg("e1000_check_polarity");
 
         if (hw->phy_type == e1000_phy_m88) {
                 /* return the Polarity bit in the Status register. */
@@ -5034,7 +5032,7 @@ static s32 e1000_check_downshift(struct e1000_hw *hw)
         s32 ret_val;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_check_downshift");
+        e_dbg("e1000_check_downshift");
 
         if (hw->phy_type == e1000_phy_igp) {
                 ret_val = e1000_read_phy_reg(hw, IGP01E1000_PHY_LINK_HEALTH,
@@ -5081,7 +5079,7 @@ static s32 e1000_config_dsp_after_link_change(struct e1000_hw *hw, bool link_up)
         };
         u16 min_length, max_length;
 
-        DEBUGFUNC("e1000_config_dsp_after_link_change");
+        e_dbg("e1000_config_dsp_after_link_change");
 
         if (hw->phy_type != e1000_phy_igp)
                 return E1000_SUCCESS;
@@ -5089,7 +5087,7 @@ static s32 e1000_config_dsp_after_link_change(struct e1000_hw *hw, bool link_up)
         if (link_up) {
                 ret_val = e1000_get_speed_and_duplex(hw, &speed, &duplex);
                 if (ret_val) {
-                        DEBUGOUT("Error getting link speed and duplex\n");
+                        e_dbg("Error getting link speed and duplex\n");
                         return ret_val;
                 }
 
@@ -5289,7 +5287,7 @@ static s32 e1000_set_phy_mode(struct e1000_hw *hw)
         s32 ret_val;
         u16 eeprom_data;
 
-        DEBUGFUNC("e1000_set_phy_mode");
+        e_dbg("e1000_set_phy_mode");
 
         if ((hw->mac_type == e1000_82545_rev_3) &&
             (hw->media_type == e1000_media_type_copper)) {
@@ -5337,7 +5335,7 @@ static s32 e1000_set_d3_lplu_state(struct e1000_hw *hw, bool active)
 {
         s32 ret_val;
         u16 phy_data;
-        DEBUGFUNC("e1000_set_d3_lplu_state");
+        e_dbg("e1000_set_d3_lplu_state");
 
         if (hw->phy_type != e1000_phy_igp)
                 return E1000_SUCCESS;
@@ -5440,7 +5438,7 @@ static s32 e1000_set_vco_speed(struct e1000_hw *hw)
         u16 default_page = 0;
         u16 phy_data;
 
-        DEBUGFUNC("e1000_set_vco_speed");
+        e_dbg("e1000_set_vco_speed");
 
         switch (hw->mac_type) {
         case e1000_82545_rev_3:
@@ -5613,7 +5611,7 @@ static s32 e1000_polarity_reversal_workaround(struct e1000_hw *hw)
  */
 static s32 e1000_get_auto_rd_done(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_get_auto_rd_done");
+        e_dbg("e1000_get_auto_rd_done");
         msleep(5);
         return E1000_SUCCESS;
 }
@@ -5628,7 +5626,7 @@ static s32 e1000_get_auto_rd_done(struct e1000_hw *hw)
  */
 static s32 e1000_get_phy_cfg_done(struct e1000_hw *hw)
 {
-        DEBUGFUNC("e1000_get_phy_cfg_done");
+        e_dbg("e1000_get_phy_cfg_done");
         mdelay(10);
         return E1000_SUCCESS;
 }
diff --git a/drivers/net/e1000/e1000_hw.h b/drivers/net/e1000/e1000_hw.h
index 9acfddb0dafb..ecd9f6c6bcd5 100644
--- a/drivers/net/e1000/e1000_hw.h
+++ b/drivers/net/e1000/e1000_hw.h
@@ -35,6 +35,7 @@
 
 #include "e1000_osdep.h"
 
+
 /* Forward declarations of structures used by the shared code */
 struct e1000_hw;
 struct e1000_hw_stats;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 974a02d81823..4dd2c23775cb 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.21-k5-NAPI"
+#define DRV_VERSION "7.3.21-k6-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -214,6 +214,17 @@ module_param(debug, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 
 /**
+ * e1000_get_hw_dev - return device
+ * used by hardware layer to print debugging information
+ *
+ **/
+struct net_device *e1000_get_hw_dev(struct e1000_hw *hw)
+{
+        struct e1000_adapter *adapter = hw->back;
+        return adapter->netdev;
+}
+
+/**
  * e1000_init_module - Driver Registration Routine
  *
  * e1000_init_module is the first routine called when the driver is
@@ -223,18 +234,17 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 static int __init e1000_init_module(void)
 {
         int ret;
-        printk(KERN_INFO "%s - version %s\n",
-               e1000_driver_string, e1000_driver_version);
+        pr_info("%s - version %s\n", e1000_driver_string, e1000_driver_version);
 
-        printk(KERN_INFO "%s\n", e1000_copyright);
+        pr_info("%s\n", e1000_copyright);
 
         ret = pci_register_driver(&e1000_driver);
         if (copybreak != COPYBREAK_DEFAULT) {
                 if (copybreak == 0)
-                        printk(KERN_INFO "e1000: copybreak disabled\n");
+                        pr_info("copybreak disabled\n");
                 else
-                        printk(KERN_INFO "e1000: copybreak enabled for "
-                               "packets <= %u bytes\n", copybreak);
+                        pr_info("copybreak enabled for "
+                                   "packets <= %u bytes\n", copybreak);
         }
         return ret;
 }
@@ -265,8 +275,7 @@ static int e1000_request_irq(struct e1000_adapter *adapter)
         err = request_irq(adapter->pdev->irq, handler, irq_flags, netdev->name,
                           netdev);
         if (err) {
-                DPRINTK(PROBE, ERR,
-                        "Unable to allocate interrupt Error: %d\n", err);
+                e_err("Unable to allocate interrupt Error: %d\n", err);
         }
 
         return err;
@@ -648,7 +657,7 @@ void e1000_reset(struct e1000_adapter *adapter)
                 ew32(WUC, 0);
 
         if (e1000_init_hw(hw))
-                DPRINTK(PROBE, ERR, "Hardware Error\n");
+                e_err("Hardware Error\n");
         e1000_update_mng_vlan(adapter);
 
         /* if (adapter->hwflags & HWFLAGS_PHY_PWR_BIT) { */
@@ -689,8 +698,7 @@ static void e1000_dump_eeprom(struct e1000_adapter *adapter)
 
         data = kmalloc(eeprom.len, GFP_KERNEL);
         if (!data) {
-                printk(KERN_ERR "Unable to allocate memory to dump EEPROM"
-                       " data\n");
+                pr_err("Unable to allocate memory to dump EEPROM data\n");
                 return;
         }
 
@@ -702,30 +710,25 @@ static void e1000_dump_eeprom(struct e1000_adapter *adapter)
                 csum_new += data[i] + (data[i + 1] << 8);
         csum_new = EEPROM_SUM - csum_new;
 
-        printk(KERN_ERR "/*********************/\n");
-        printk(KERN_ERR "Current EEPROM Checksum : 0x%04x\n", csum_old);
-        printk(KERN_ERR "Calculated              : 0x%04x\n", csum_new);
+        pr_err("/*********************/\n");
+        pr_err("Current EEPROM Checksum : 0x%04x\n", csum_old);
+        pr_err("Calculated              : 0x%04x\n", csum_new);
 
-        printk(KERN_ERR "Offset    Values\n");
-        printk(KERN_ERR "========  ======\n");
+        pr_err("Offset    Values\n");
+        pr_err("========  ======\n");
         print_hex_dump(KERN_ERR, "", DUMP_PREFIX_OFFSET, 16, 1, data, 128, 0);
 
-        printk(KERN_ERR "Include this output when contacting your support "
-               "provider.\n");
-        printk(KERN_ERR "This is not a software error! Something bad "
-               "happened to your hardware or\n");
-        printk(KERN_ERR "EEPROM image. Ignoring this "
-               "problem could result in further problems,\n");
-        printk(KERN_ERR "possibly loss of data, corruption or system hangs!\n");
-        printk(KERN_ERR "The MAC Address will be reset to 00:00:00:00:00:00, "
-               "which is invalid\n");
-        printk(KERN_ERR "and requires you to set the proper MAC "
-               "address manually before continuing\n");
-        printk(KERN_ERR "to enable this network device.\n");
-        printk(KERN_ERR "Please inspect the EEPROM dump and report the issue "
-               "to your hardware vendor\n");
-        printk(KERN_ERR "or Intel Customer Support.\n");
-        printk(KERN_ERR "/*********************/\n");
+        pr_err("Include this output when contacting your support provider.\n");
+        pr_err("This is not a software error! Something bad happened to\n");
+        pr_err("your hardware or EEPROM image. Ignoring this problem could\n");
+        pr_err("result in further problems, possibly loss of data,\n");
+        pr_err("corruption or system hangs!\n");
+        pr_err("The MAC Address will be reset to 00:00:00:00:00:00,\n");
+        pr_err("which is invalid and requires you to set the proper MAC\n");
+        pr_err("address manually before continuing to enable this network\n");
+        pr_err("device. Please inspect the EEPROM dump and report the\n");
+        pr_err("issue to your hardware vendor or Intel Customer Support.\n");
+        pr_err("/*********************/\n");
 
         kfree(data);
 }
@@ -823,16 +826,16 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         if (err)
                 return err;
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
-            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                 pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
                         if (err) {
-                                E1000_ERR("No usable DMA configuration, "
-                                          "aborting\n");
+                                pr_err("No usable DMA config, aborting\n");
                                 goto err_dma;
                         }
                 }
@@ -922,7 +925,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* initialize eeprom parameters */
         if (e1000_init_eeprom_params(hw)) {
-                E1000_ERR("EEPROM initialization failed\n");
+                e_err("EEPROM initialization failed\n");
                 goto err_eeprom;
         }
 
@@ -933,7 +936,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         /* make sure the EEPROM is good */
         if (e1000_validate_eeprom_checksum(hw) < 0) {
-                DPRINTK(PROBE, ERR, "The EEPROM Checksum Is Not Valid\n");
+                e_err("The EEPROM Checksum Is Not Valid\n");
                 e1000_dump_eeprom(adapter);
                 /*
                  * set MAC address to all zeroes to invalidate and temporary
@@ -947,14 +950,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         } else {
                 /* copy the MAC address out of the EEPROM */
                 if (e1000_read_mac_addr(hw))
-                        DPRINTK(PROBE, ERR, "EEPROM Read Error\n");
+                        e_err("EEPROM Read Error\n");
         }
         /* don't block initalization here due to bad MAC address */
         memcpy(netdev->dev_addr, hw->mac_addr, netdev->addr_len);
         memcpy(netdev->perm_addr, hw->mac_addr, netdev->addr_len);
 
         if (!is_valid_ether_addr(netdev->perm_addr))
-                DPRINTK(PROBE, ERR, "Invalid MAC Address\n");
+                e_err("Invalid MAC Address\n");
 
         e1000_get_bus_info(hw);
 
@@ -1035,8 +1038,16 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         adapter->wol = adapter->eeprom_wol;
         device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
 
+        /* reset the hardware with the new settings */
+        e1000_reset(adapter);
+
+        strcpy(netdev->name, "eth%d");
+        err = register_netdev(netdev);
+        if (err)
+                goto err_register;
+
         /* print bus type/speed/width info */
-        DPRINTK(PROBE, INFO, "(PCI%s:%s:%s) ",
+        e_info("(PCI%s:%s:%s) ",
                 ((hw->bus_type == e1000_bus_type_pcix) ? "-X" : ""),
                 ((hw->bus_speed == e1000_bus_speed_133) ? "133MHz" :
                  (hw->bus_speed == e1000_bus_speed_120) ? "120MHz" :
@@ -1044,20 +1055,12 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                  (hw->bus_speed == e1000_bus_speed_66) ? "66MHz" : "33MHz"),
                 ((hw->bus_width == e1000_bus_width_64) ? "64-bit" : "32-bit"));
 
-        printk("%pM\n", netdev->dev_addr);
-
-        /* reset the hardware with the new settings */
-        e1000_reset(adapter);
-
-        strcpy(netdev->name, "eth%d");
-        err = register_netdev(netdev);
-        if (err)
-                goto err_register;
+        e_info("%pM\n", netdev->dev_addr);
 
         /* carrier off reporting is important to ethtool even BEFORE open */
         netif_carrier_off(netdev);
 
-        DPRINTK(PROBE, INFO, "Intel(R) PRO/1000 Network Connection\n");
+        e_info("Intel(R) PRO/1000 Network Connection\n");
 
         cards_found++;
         return 0;
@@ -1157,7 +1160,7 @@ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
         /* identify the MAC */
 
         if (e1000_set_mac_type(hw)) {
-                DPRINTK(PROBE, ERR, "Unknown MAC Type\n");
+                e_err("Unknown MAC Type\n");
                 return -EIO;
         }
 
@@ -1190,7 +1193,7 @@ static int __devinit e1000_sw_init(struct e1000_adapter *adapter)
         adapter->num_rx_queues = 1;
 
         if (e1000_alloc_queues(adapter)) {
-                DPRINTK(PROBE, ERR, "Unable to allocate memory for queues\n");
+                e_err("Unable to allocate memory for queues\n");
                 return -ENOMEM;
         }
 
@@ -1384,8 +1387,7 @@ static int e1000_setup_tx_resources(struct e1000_adapter *adapter,
         size = sizeof(struct e1000_buffer) * txdr->count;
         txdr->buffer_info = vmalloc(size);
         if (!txdr->buffer_info) {
-                DPRINTK(PROBE, ERR,
-                "Unable to allocate memory for the transmit descriptor ring\n");
+                e_err("Unable to allocate memory for the Tx descriptor ring\n");
                 return -ENOMEM;
         }
         memset(txdr->buffer_info, 0, size);
@@ -1395,12 +1397,12 @@ static int e1000_setup_tx_resources(struct e1000_adapter *adapter,
         txdr->size = txdr->count * sizeof(struct e1000_tx_desc);
         txdr->size = ALIGN(txdr->size, 4096);
 
-        txdr->desc = pci_alloc_consistent(pdev, txdr->size, &txdr->dma);
+        txdr->desc = dma_alloc_coherent(&pdev->dev, txdr->size, &txdr->dma,
+                                        GFP_KERNEL);
         if (!txdr->desc) {
 setup_tx_desc_die:
                 vfree(txdr->buffer_info);
-                DPRINTK(PROBE, ERR,
-                "Unable to allocate memory for the transmit descriptor ring\n");
+                e_err("Unable to allocate memory for the Tx descriptor ring\n");
                 return -ENOMEM;
         }
 
@@ -1408,29 +1410,32 @@ setup_tx_desc_die:
         if (!e1000_check_64k_bound(adapter, txdr->desc, txdr->size)) {
                 void *olddesc = txdr->desc;
                 dma_addr_t olddma = txdr->dma;
-                DPRINTK(TX_ERR, ERR, "txdr align check failed: %u bytes "
-                                     "at %p\n", txdr->size, txdr->desc);
+                e_err("txdr align check failed: %u bytes at %p\n",
+                      txdr->size, txdr->desc);
                 /* Try again, without freeing the previous */
-                txdr->desc = pci_alloc_consistent(pdev, txdr->size, &txdr->dma);
+                txdr->desc = dma_alloc_coherent(&pdev->dev, txdr->size,
+                                                &txdr->dma, GFP_KERNEL);
                 /* Failed allocation, critical failure */
                 if (!txdr->desc) {
-                        pci_free_consistent(pdev, txdr->size, olddesc, olddma);
+                        dma_free_coherent(&pdev->dev, txdr->size, olddesc,
+                                          olddma);
                         goto setup_tx_desc_die;
                 }
 
                 if (!e1000_check_64k_bound(adapter, txdr->desc, txdr->size)) {
                         /* give up */
-                        pci_free_consistent(pdev, txdr->size, txdr->desc,
-                                            txdr->dma);
-                        pci_free_consistent(pdev, txdr->size, olddesc, olddma);
-                        DPRINTK(PROBE, ERR,
-                                "Unable to allocate aligned memory "
-                                "for the transmit descriptor ring\n");
+                        dma_free_coherent(&pdev->dev, txdr->size, txdr->desc,
+                                          txdr->dma);
+                        dma_free_coherent(&pdev->dev, txdr->size, olddesc,
+                                          olddma);
+                        e_err("Unable to allocate aligned memory "
+                              "for the transmit descriptor ring\n");
                         vfree(txdr->buffer_info);
                         return -ENOMEM;
                 } else {
                         /* Free old allocation, new allocation was successful */
-                        pci_free_consistent(pdev, txdr->size, olddesc, olddma);
+                        dma_free_coherent(&pdev->dev, txdr->size, olddesc,
+                                          olddma);
                 }
         }
         memset(txdr->desc, 0, txdr->size);
@@ -1456,8 +1461,7 @@ int e1000_setup_all_tx_resources(struct e1000_adapter *adapter)
         for (i = 0; i < adapter->num_tx_queues; i++) {
                 err = e1000_setup_tx_resources(adapter, &adapter->tx_ring[i]);
                 if (err) {
-                        DPRINTK(PROBE, ERR,
-                                "Allocation for Tx Queue %u failed\n", i);
+                        e_err("Allocation for Tx Queue %u failed\n", i);
                         for (i-- ; i >= 0; i--)
                                 e1000_free_tx_resources(adapter,
                                                         &adapter->tx_ring[i]);
@@ -1577,8 +1581,7 @@ static int e1000_setup_rx_resources(struct e1000_adapter *adapter,
         size = sizeof(struct e1000_buffer) * rxdr->count;
         rxdr->buffer_info = vmalloc(size);
         if (!rxdr->buffer_info) {
-                DPRINTK(PROBE, ERR,
-                "Unable to allocate memory for the receive descriptor ring\n");
+                e_err("Unable to allocate memory for the Rx descriptor ring\n");
                 return -ENOMEM;
         }
         memset(rxdr->buffer_info, 0, size);
@@ -1590,11 +1593,11 @@ static int e1000_setup_rx_resources(struct e1000_adapter *adapter,
         rxdr->size = rxdr->count * desc_len;
         rxdr->size = ALIGN(rxdr->size, 4096);
 
-        rxdr->desc = pci_alloc_consistent(pdev, rxdr->size, &rxdr->dma);
+        rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
+                                        GFP_KERNEL);
 
         if (!rxdr->desc) {
-                DPRINTK(PROBE, ERR,
-                "Unable to allocate memory for the receive descriptor ring\n");
+                e_err("Unable to allocate memory for the Rx descriptor ring\n");
 setup_rx_desc_die:
                 vfree(rxdr->buffer_info);
                 return -ENOMEM;
@@ -1604,31 +1607,33 @@ setup_rx_desc_die:
         if (!e1000_check_64k_bound(adapter, rxdr->desc, rxdr->size)) {
                 void *olddesc = rxdr->desc;
                 dma_addr_t olddma = rxdr->dma;
-                DPRINTK(RX_ERR, ERR, "rxdr align check failed: %u bytes "
-                                     "at %p\n", rxdr->size, rxdr->desc);
+                e_err("rxdr align check failed: %u bytes at %p\n",
+                      rxdr->size, rxdr->desc);
                 /* Try again, without freeing the previous */
-                rxdr->desc = pci_alloc_consistent(pdev, rxdr->size, &rxdr->dma);
+                rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size,
+                                                &rxdr->dma, GFP_KERNEL);
                 /* Failed allocation, critical failure */
                 if (!rxdr->desc) {
-                        pci_free_consistent(pdev, rxdr->size, olddesc, olddma);
-                        DPRINTK(PROBE, ERR,
-                                "Unable to allocate memory "
-                                "for the receive descriptor ring\n");
+                        dma_free_coherent(&pdev->dev, rxdr->size, olddesc,
+                                          olddma);
+                        e_err("Unable to allocate memory for the Rx descriptor "
+                              "ring\n");
                         goto setup_rx_desc_die;
                 }
 
                 if (!e1000_check_64k_bound(adapter, rxdr->desc, rxdr->size)) {
                         /* give up */
-                        pci_free_consistent(pdev, rxdr->size, rxdr->desc,
-                                            rxdr->dma);
-                        pci_free_consistent(pdev, rxdr->size, olddesc, olddma);
-                        DPRINTK(PROBE, ERR,
-                                "Unable to allocate aligned memory "
-                                "for the receive descriptor ring\n");
+                        dma_free_coherent(&pdev->dev, rxdr->size, rxdr->desc,
+                                          rxdr->dma);
+                        dma_free_coherent(&pdev->dev, rxdr->size, olddesc,
+                                          olddma);
+                        e_err("Unable to allocate aligned memory for the Rx "
+                              "descriptor ring\n");
                         goto setup_rx_desc_die;
                 } else {
                         /* Free old allocation, new allocation was successful */
-                        pci_free_consistent(pdev, rxdr->size, olddesc, olddma);
+                        dma_free_coherent(&pdev->dev, rxdr->size, olddesc,
+                                          olddma);
                 }
         }
         memset(rxdr->desc, 0, rxdr->size);
@@ -1655,8 +1660,7 @@ int e1000_setup_all_rx_resources(struct e1000_adapter *adapter)
         for (i = 0; i < adapter->num_rx_queues; i++) {
                 err = e1000_setup_rx_resources(adapter, &adapter->rx_ring[i]);
                 if (err) {
-                        DPRINTK(PROBE, ERR,
-                                "Allocation for Rx Queue %u failed\n", i);
+                        e_err("Allocation for Rx Queue %u failed\n", i);
                         for (i-- ; i >= 0; i--)
                                 e1000_free_rx_resources(adapter,
                                                         &adapter->rx_ring[i]);
@@ -1804,7 +1808,8 @@ static void e1000_free_tx_resources(struct e1000_adapter *adapter,
         vfree(tx_ring->buffer_info);
         tx_ring->buffer_info = NULL;
 
-        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
+                          tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -1829,12 +1834,12 @@ static void e1000_unmap_and_free_tx_resource(struct e1000_adapter *adapter,
 {
         if (buffer_info->dma) {
                 if (buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev, buffer_info->dma,
-                                       buffer_info->length, PCI_DMA_TODEVICE);
+                        dma_unmap_page(&adapter->pdev->dev, buffer_info->dma,
+                                       buffer_info->length, DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev, buffer_info->dma,
+                        dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
                                          buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                                         DMA_TO_DEVICE);
                 buffer_info->dma = 0;
         }
         if (buffer_info->skb) {
@@ -1912,7 +1917,8 @@ static void e1000_free_rx_resources(struct e1000_adapter *adapter,
         vfree(rx_ring->buffer_info);
         rx_ring->buffer_info = NULL;
 
-        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
+                          rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -1952,14 +1958,14 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter,
                 buffer_info = &rx_ring->buffer_info[i];
                 if (buffer_info->dma &&
                     adapter->clean_rx == e1000_clean_rx_irq) {
-                        pci_unmap_single(pdev, buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, buffer_info->dma,
                                          buffer_info->length,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                 } else if (buffer_info->dma &&
                            adapter->clean_rx == e1000_clean_jumbo_rx_irq) {
-                        pci_unmap_page(pdev, buffer_info->dma,
-                                       buffer_info->length,
-                                       PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, buffer_info->dma,
+                                       buffer_info->length,
+                                       DMA_FROM_DEVICE);
                 }
 
                 buffer_info->dma = 0;
@@ -2105,7 +2111,7 @@ static void e1000_set_rx_mode(struct net_device *netdev)
         u32 *mcarray = kcalloc(mta_reg_count, sizeof(u32), GFP_ATOMIC);
 
         if (!mcarray) {
-                DPRINTK(PROBE, ERR, "memory allocation failed\n");
+                e_err("memory allocation failed\n");
                 return;
         }
 
@@ -2301,16 +2307,16 @@ static void e1000_watchdog(unsigned long data)
                                                    &adapter->link_duplex);
 
                         ctrl = er32(CTRL);
-                        printk(KERN_INFO "e1000: %s NIC Link is Up %d Mbps %s, "
-                               "Flow Control: %s\n",
-                               netdev->name,
-                               adapter->link_speed,
-                               adapter->link_duplex == FULL_DUPLEX ?
-                                "Full Duplex" : "Half Duplex",
-                                ((ctrl & E1000_CTRL_TFCE) && (ctrl &
-                                E1000_CTRL_RFCE)) ? "RX/TX" : ((ctrl &
-                                E1000_CTRL_RFCE) ? "RX" : ((ctrl &
-                                E1000_CTRL_TFCE) ? "TX" : "None" )));
+                        pr_info("%s NIC Link is Up %d Mbps %s, "
+                                "Flow Control: %s\n",
+                                netdev->name,
+                                adapter->link_speed,
+                                adapter->link_duplex == FULL_DUPLEX ?
+                                "Full Duplex" : "Half Duplex",
+                                ((ctrl & E1000_CTRL_TFCE) && (ctrl &
+                                E1000_CTRL_RFCE)) ? "RX/TX" : ((ctrl &
+                                E1000_CTRL_RFCE) ? "RX" : ((ctrl &
+                                E1000_CTRL_TFCE) ? "TX" : "None")));
 
                         /* adjust timeout factor according to speed/duplex */
                         adapter->tx_timeout_factor = 1;
@@ -2340,8 +2346,8 @@ static void e1000_watchdog(unsigned long data)
                 if (netif_carrier_ok(netdev)) {
                         adapter->link_speed = 0;
                         adapter->link_duplex = 0;
-                        printk(KERN_INFO "e1000: %s NIC Link is Down\n",
-                               netdev->name);
+                        pr_info("%s NIC Link is Down\n",
+                                netdev->name);
                         netif_carrier_off(netdev);
 
                         if (!test_bit(__E1000_DOWN, &adapter->flags))
@@ -2380,6 +2386,22 @@ link_up:
                 }
         }
 
+        /* Simple mode for Interrupt Throttle Rate (ITR) */
+        if (hw->mac_type >= e1000_82540 && adapter->itr_setting == 4) {
+                /*
+                 * Symmetric Tx/Rx gets a reduced ITR=2000;
+                 * Total asymmetrical Tx or Rx gets ITR=8000;
+                 * everyone else is between 2000-8000.
+                 */
+                u32 goc = (adapter->gotcl + adapter->gorcl) / 10000;
+                u32 dif = (adapter->gotcl > adapter->gorcl ?
+                            adapter->gotcl - adapter->gorcl :
+                            adapter->gorcl - adapter->gotcl) / 10000;
+                u32 itr = goc > 0 ? (dif * 6000 / goc + 2000) : 8000;
+
+                ew32(ITR, 1000000000 / (itr * 256));
+        }
+
         /* Cause software interrupt to ensure rx ring is cleaned */
         ew32(ICS, E1000_ICS_RXDMT0);
 
@@ -2631,8 +2653,7 @@ static bool e1000_tx_csum(struct e1000_adapter *adapter,
                 break;
         default:
                 if (unlikely(net_ratelimit()))
-                        DPRINTK(DRV, WARNING,
-                                "checksum_partial proto=%x!\n", skb->protocol);
+                        e_warn("checksum_partial proto=%x!\n", skb->protocol);
                 break;
         }
 
@@ -2714,9 +2735,10 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                 /* set time_stamp *before* dma to help avoid a possible race */
                 buffer_info->time_stamp = jiffies;
                 buffer_info->mapped_as_page = false;
-                buffer_info->dma = pci_map_single(pdev, skb->data + offset,
-                                                  size, PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                buffer_info->dma = dma_map_single(&pdev->dev,
+                                                  skb->data + offset,
+                                                  size, DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                         goto dma_error;
                 buffer_info->next_to_watch = i;
 
@@ -2760,10 +2782,10 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                         buffer_info->length = size;
                         buffer_info->time_stamp = jiffies;
                         buffer_info->mapped_as_page = true;
-                        buffer_info->dma = pci_map_page(pdev, frag->page,
+                        buffer_info->dma = dma_map_page(&pdev->dev, frag->page,
                                                         offset, size,
-                                                        PCI_DMA_TODEVICE);
-                        if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                                                        DMA_TO_DEVICE);
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                                 goto dma_error;
                         buffer_info->next_to_watch = i;
 
@@ -2975,8 +2997,7 @@ static netdev_tx_t e1000_xmit_frame(struct sk_buff *skb,
                                 /* fall through */
                                 pull_size = min((unsigned int)4, skb->data_len);
                                 if (!__pskb_pull_tail(skb, pull_size)) {
-                                        DPRINTK(DRV, ERR,
-                                                "__pskb_pull_tail failed.\n");
+                                        e_err("__pskb_pull_tail failed.\n");
                                         dev_kfree_skb_any(skb);
                                         return NETDEV_TX_OK;
                                 }
@@ -3124,7 +3145,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
 
         if ((max_frame < MINIMUM_ETHERNET_FRAME_SIZE) ||
             (max_frame > MAX_JUMBO_FRAME_SIZE)) {
-                DPRINTK(PROBE, ERR, "Invalid MTU setting\n");
+                e_err("Invalid MTU setting\n");
                 return -EINVAL;
         }
 
@@ -3132,7 +3153,7 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
         switch (hw->mac_type) {
         case e1000_undefined ... e1000_82542_rev2_1:
                 if (max_frame > (ETH_FRAME_LEN + ETH_FCS_LEN)) {
-                        DPRINTK(PROBE, ERR, "Jumbo Frames not supported.\n");
+                        e_err("Jumbo Frames not supported.\n");
                         return -EINVAL;
                 }
                 break;
@@ -3170,8 +3191,8 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
              (max_frame == MAXIMUM_ETHERNET_VLAN_SIZE)))
                 adapter->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
 
-        printk(KERN_INFO "e1000: %s changing MTU from %d to %d\n",
-               netdev->name, netdev->mtu, new_mtu);
+        pr_info("%s changing MTU from %d to %d\n",
+                netdev->name, netdev->mtu, new_mtu);
         netdev->mtu = new_mtu;
 
         if (netif_running(netdev))
@@ -3484,17 +3505,17 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter,
                     !(er32(STATUS) & E1000_STATUS_TXOFF)) {
 
                         /* detected Tx unit hang */
-                        DPRINTK(DRV, ERR, "Detected Tx Unit Hang\n"
-                                        "  Tx Queue             <%lu>\n"
-                                        "  TDH                  <%x>\n"
-                                        "  TDT                  <%x>\n"
-                                        "  next_to_use          <%x>\n"
-                                        "  next_to_clean        <%x>\n"
-                                        "buffer_info[next_to_clean]\n"
-                                        "  time_stamp           <%lx>\n"
-                                        "  next_to_watch        <%x>\n"
-                                        "  jiffies              <%lx>\n"
-                                        "  next_to_watch.status <%x>\n",
+                        e_err("Detected Tx Unit Hang\n"
+                              "  Tx Queue             <%lu>\n"
+                              "  TDH                  <%x>\n"
+                              "  TDT                  <%x>\n"
+                              "  next_to_use          <%x>\n"
+                              "  next_to_clean        <%x>\n"
+                              "buffer_info[next_to_clean]\n"
+                              "  time_stamp           <%lx>\n"
+                              "  next_to_watch        <%x>\n"
+                              "  jiffies              <%lx>\n"
+                              "  next_to_watch.status <%x>\n",
                                 (unsigned long)((tx_ring - adapter->tx_ring) /
                                         sizeof(struct e1000_tx_ring)),
                                 readl(hw->hw_addr + tx_ring->tdh),
@@ -3634,8 +3655,8 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
 
                 cleaned = true;
                 cleaned_count++;
-                pci_unmap_page(pdev, buffer_info->dma, buffer_info->length,
-                               PCI_DMA_FROMDEVICE);
+                dma_unmap_page(&pdev->dev, buffer_info->dma,
+                               buffer_info->length, DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 length = le16_to_cpu(rx_desc->length);
@@ -3733,7 +3754,7 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
 
                 /* eth type trans needs skb->data to point to something */
                 if (!pskb_may_pull(skb, ETH_HLEN)) {
-                        DPRINTK(DRV, ERR, "pskb_may_pull failed.\n");
+                        e_err("pskb_may_pull failed.\n");
                         dev_kfree_skb(skb);
                         goto next_desc;
                 }
@@ -3817,8 +3838,8 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 cleaned = true;
                 cleaned_count++;
-                pci_unmap_single(pdev, buffer_info->dma, buffer_info->length,
-                                 PCI_DMA_FROMDEVICE);
+                dma_unmap_single(&pdev->dev, buffer_info->dma,
+                                 buffer_info->length, DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 length = le16_to_cpu(rx_desc->length);
@@ -3833,8 +3854,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 if (adapter->discarding) {
                         /* All receives must fit into a single buffer */
-                        E1000_DBG("%s: Receive packet consumed multiple"
-                                  " buffers\n", netdev->name);
+                        e_info("Receive packet consumed multiple buffers\n");
                         /* recycle */
                         buffer_info->skb = skb;
                         if (status & E1000_RXD_STAT_EOP)
@@ -3964,8 +3984,8 @@ e1000_alloc_jumbo_rx_buffers(struct e1000_adapter *adapter,
                 /* Fix for errata 23, can't cross 64kB boundary */
                 if (!e1000_check_64k_bound(adapter, skb->data, bufsz)) {
                         struct sk_buff *oldskb = skb;
-                        DPRINTK(PROBE, ERR, "skb align check failed: %u bytes "
-                                             "at %p\n", bufsz, skb->data);
+                        e_err("skb align check failed: %u bytes at %p\n",
+                              bufsz, skb->data);
                         /* Try again, without freeing the previous */
                         skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                         /* Failed allocation, critical failure */
@@ -3998,11 +4018,11 @@ check_page:
                 }
 
                 if (!buffer_info->dma) {
-                        buffer_info->dma = pci_map_page(pdev,
+                        buffer_info->dma = dma_map_page(&pdev->dev,
                                                         buffer_info->page, 0,
-                                                        buffer_info->length,
-                                                        PCI_DMA_FROMDEVICE);
-                        if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                                        buffer_info->length,
+                                                        DMA_FROM_DEVICE);
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
                                 put_page(buffer_info->page);
                                 dev_kfree_skb(skb);
                                 buffer_info->page = NULL;
@@ -4073,8 +4093,8 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                 /* Fix for errata 23, can't cross 64kB boundary */
                 if (!e1000_check_64k_bound(adapter, skb->data, bufsz)) {
                         struct sk_buff *oldskb = skb;
-                        DPRINTK(RX_ERR, ERR, "skb align check failed: %u bytes "
-                                             "at %p\n", bufsz, skb->data);
+                        e_err("skb align check failed: %u bytes at %p\n",
+                              bufsz, skb->data);
                         /* Try again, without freeing the previous */
                         skb = netdev_alloc_skb_ip_align(netdev, bufsz);
                         /* Failed allocation, critical failure */
@@ -4098,11 +4118,11 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
                 buffer_info->skb = skb;
                 buffer_info->length = adapter->rx_buffer_len;
 map_skb:
-                buffer_info->dma = pci_map_single(pdev,
+                buffer_info->dma = dma_map_single(&pdev->dev,
                                                   skb->data,
                                                   buffer_info->length,
-                                                  PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                                  DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
                         dev_kfree_skb(skb);
                         buffer_info->skb = NULL;
                         buffer_info->dma = 0;
@@ -4119,16 +4139,15 @@ map_skb:
                 if (!e1000_check_64k_bound(adapter,
                                         (void *)(unsigned long)buffer_info->dma,
                                         adapter->rx_buffer_len)) {
-                        DPRINTK(RX_ERR, ERR,
-                                "dma align check failed: %u bytes at %p\n",
-                                adapter->rx_buffer_len,
-                                (void *)(unsigned long)buffer_info->dma);
+                        e_err("dma align check failed: %u bytes at %p\n",
+                              adapter->rx_buffer_len,
+                              (void *)(unsigned long)buffer_info->dma);
                         dev_kfree_skb(skb);
                         buffer_info->skb = NULL;
 
-                        pci_unmap_single(pdev, buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, buffer_info->dma,
                                          adapter->rx_buffer_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
 
                         adapter->alloc_rx_buff_failed++;
@@ -4334,7 +4353,7 @@ void e1000_pci_set_mwi(struct e1000_hw *hw)
         int ret_val = pci_set_mwi(adapter->pdev);
 
         if (ret_val)
-                DPRINTK(PROBE, ERR, "Error in setting MWI\n");
+                e_err("Error in setting MWI\n");
 }
 
 void e1000_pci_clear_mwi(struct e1000_hw *hw)
@@ -4465,7 +4484,7 @@ int e1000_set_spd_dplx(struct e1000_adapter *adapter, u16 spddplx)
         /* Fiber NICs only allow 1000 gbps Full duplex */
         if ((hw->media_type == e1000_media_type_fiber) &&
                 spddplx != (SPEED_1000 + DUPLEX_FULL)) {
-                DPRINTK(PROBE, ERR, "Unsupported Speed/Duplex configuration\n");
+                e_err("Unsupported Speed/Duplex configuration\n");
                 return -EINVAL;
         }
 
@@ -4488,7 +4507,7 @@ int e1000_set_spd_dplx(struct e1000_adapter *adapter, u16 spddplx)
                 break;
         case SPEED_1000 + DUPLEX_HALF: /* not supported */
         default:
-                DPRINTK(PROBE, ERR, "Unsupported Speed/Duplex configuration\n");
+                e_err("Unsupported Speed/Duplex configuration\n");
                 return -EINVAL;
         }
         return 0;
@@ -4611,7 +4630,7 @@ static int e1000_resume(struct pci_dev *pdev)
         else
                 err = pci_enable_device_mem(pdev);
         if (err) {
-                printk(KERN_ERR "e1000: Cannot enable PCI device from suspend\n");
+                pr_err("Cannot enable PCI device from suspend\n");
                 return err;
         }
         pci_set_master(pdev);
@@ -4714,7 +4733,7 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         else
                 err = pci_enable_device_mem(pdev);
         if (err) {
-                printk(KERN_ERR "e1000: Cannot re-enable PCI device after reset.\n");
+                pr_err("Cannot re-enable PCI device after reset.\n");
                 return PCI_ERS_RESULT_DISCONNECT;
         }
         pci_set_master(pdev);
@@ -4745,7 +4764,7 @@ static void e1000_io_resume(struct pci_dev *pdev)
 
         if (netif_running(netdev)) {
                 if (e1000_up(adapter)) {
-                        printk("e1000: can't bring device back up after reset\n");
+                        pr_info("can't bring device back up after reset\n");
                         return;
                 }
         }
diff --git a/drivers/net/e1000/e1000_osdep.h b/drivers/net/e1000/e1000_osdep.h
index d9298522f5ae..edd1c75aa895 100644
--- a/drivers/net/e1000/e1000_osdep.h
+++ b/drivers/net/e1000/e1000_osdep.h
@@ -41,20 +41,6 @@
 #include <linux/interrupt.h>
 #include <linux/sched.h>
 
-#ifdef DBG
-#define DEBUGOUT(S)             printk(KERN_DEBUG S "\n")
-#define DEBUGOUT1(S, A...)      printk(KERN_DEBUG S "\n", A)
-#else
-#define DEBUGOUT(S)
-#define DEBUGOUT1(S, A...)
-#endif
-
-#define DEBUGFUNC(F) DEBUGOUT(F "\n")
-#define DEBUGOUT2 DEBUGOUT1
-#define DEBUGOUT3 DEBUGOUT2
-#define DEBUGOUT7 DEBUGOUT3
-
-
 #define er32(reg)                                                       \
         (readl(hw->hw_addr + ((hw->mac_type >= e1000_82543)             \
                                ? E1000_##reg : E1000_82542_##reg)))
diff --git a/drivers/net/e1000/e1000_param.c b/drivers/net/e1000/e1000_param.c
index 38d2741ccae9..9fbb562dc964 100644
--- a/drivers/net/e1000/e1000_param.c
+++ b/drivers/net/e1000/e1000_param.c
@@ -226,17 +226,16 @@ static int __devinit e1000_validate_option(unsigned int *value,
         case enable_option:
                 switch (*value) {
                 case OPTION_ENABLED:
-                        DPRINTK(PROBE, INFO, "%s Enabled\n", opt->name);
+                        e_dev_info("%s Enabled\n", opt->name);
                         return 0;
                 case OPTION_DISABLED:
-                        DPRINTK(PROBE, INFO, "%s Disabled\n", opt->name);
+                        e_dev_info("%s Disabled\n", opt->name);
                         return 0;
                 }
                 break;
         case range_option:
                 if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
-                        DPRINTK(PROBE, INFO,
-                                        "%s set to %i\n", opt->name, *value);
+                        e_dev_info("%s set to %i\n", opt->name, *value);
                         return 0;
                 }
                 break;
@@ -248,7 +247,7 @@ static int __devinit e1000_validate_option(unsigned int *value,
                         ent = &opt->arg.l.p[i];
                         if (*value == ent->i) {
                                 if (ent->str[0] != '\0')
-                                        DPRINTK(PROBE, INFO, "%s\n", ent->str);
+                                        e_dev_info("%s\n", ent->str);
                                 return 0;
                         }
                 }
@@ -258,7 +257,7 @@ static int __devinit e1000_validate_option(unsigned int *value,
                 BUG();
         }
 
-        DPRINTK(PROBE, INFO, "Invalid %s value specified (%i) %s\n",
+        e_dev_info("Invalid %s value specified (%i) %s\n",
                opt->name, *value, opt->err);
         *value = opt->def;
         return -1;
@@ -283,9 +282,8 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
         int bd = adapter->bd_number;
 
         if (bd >= E1000_MAX_NIC) {
-                DPRINTK(PROBE, NOTICE,
-                       "Warning: no configuration for board #%i\n", bd);
-                DPRINTK(PROBE, NOTICE, "Using defaults for all values\n");
+                e_dev_warn("Warning: no configuration for board #%i "
+                           "using defaults for all values\n", bd);
         }
 
         { /* Transmit Descriptor Count */
@@ -472,27 +470,31 @@ void __devinit e1000_check_options(struct e1000_adapter *adapter)
                         adapter->itr = InterruptThrottleRate[bd];
                         switch (adapter->itr) {
                         case 0:
-                                DPRINTK(PROBE, INFO, "%s turned off\n",
-                                        opt.name);
+                                e_dev_info("%s turned off\n", opt.name);
                                 break;
                         case 1:
-                                DPRINTK(PROBE, INFO, "%s set to dynamic mode\n",
-                                        opt.name);
+                                e_dev_info("%s set to dynamic mode\n",
+                                           opt.name);
                                 adapter->itr_setting = adapter->itr;
                                 adapter->itr = 20000;
                                 break;
                         case 3:
-                                DPRINTK(PROBE, INFO,
-                                        "%s set to dynamic conservative mode\n",
-                                        opt.name);
+                                e_dev_info("%s set to dynamic conservative "
+                                           "mode\n", opt.name);
                                 adapter->itr_setting = adapter->itr;
                                 adapter->itr = 20000;
                                 break;
+                        case 4:
+                                e_dev_info("%s set to simplified "
+                                           "(2000-8000) ints mode\n", opt.name);
+                                adapter->itr_setting = adapter->itr;
+                                break;
                         default:
                                 e1000_validate_option(&adapter->itr, &opt,
                                         adapter);
-                                /* save the setting, because the dynamic bits change itr */
-                                /* clear the lower two bits because they are
+                                /* save the setting, because the dynamic bits
+                                 * change itr.
+                                 * clear the lower two bits because they are
                                  * used as control */
                                 adapter->itr_setting = adapter->itr & ~3;
                                 break;
@@ -543,19 +545,18 @@ static void __devinit e1000_check_fiber_options(struct e1000_adapter *adapter)
 {
         int bd = adapter->bd_number;
         if (num_Speed > bd) {
-                DPRINTK(PROBE, INFO, "Speed not valid for fiber adapters, "
-                       "parameter ignored\n");
+                e_dev_info("Speed not valid for fiber adapters, parameter "
+                           "ignored\n");
         }
 
         if (num_Duplex > bd) {
-                DPRINTK(PROBE, INFO, "Duplex not valid for fiber adapters, "
-                       "parameter ignored\n");
+                e_dev_info("Duplex not valid for fiber adapters, parameter "
+                           "ignored\n");
         }
 
         if ((num_AutoNeg > bd) && (AutoNeg[bd] != 0x20)) {
-                DPRINTK(PROBE, INFO, "AutoNeg other than 1000/Full is "
-                                 "not valid for fiber adapters, "
-                                 "parameter ignored\n");
+                e_dev_info("AutoNeg other than 1000/Full is not valid for fiber"
+                           "adapters, parameter ignored\n");
         }
 }
 
@@ -619,9 +620,8 @@ static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
         }
 
         if ((num_AutoNeg > bd) && (speed != 0 || dplx != 0)) {
-                DPRINTK(PROBE, INFO,
-                       "AutoNeg specified along with Speed or Duplex, "
-                       "parameter ignored\n");
+                e_dev_info("AutoNeg specified along with Speed or Duplex, "
+                           "parameter ignored\n");
                 adapter->hw.autoneg_advertised = AUTONEG_ADV_DEFAULT;
         } else { /* Autoneg */
                 static const struct e1000_opt_list an_list[] =
@@ -680,79 +680,72 @@ static void __devinit e1000_check_copper_options(struct e1000_adapter *adapter)
         case 0:
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 if ((num_Speed > bd) && (speed != 0 || dplx != 0))
-                        DPRINTK(PROBE, INFO,
-                               "Speed and duplex autonegotiation enabled\n");
+                        e_dev_info("Speed and duplex autonegotiation "
+                                   "enabled\n");
                 break;
         case HALF_DUPLEX:
-                DPRINTK(PROBE, INFO, "Half Duplex specified without Speed\n");
-                DPRINTK(PROBE, INFO, "Using Autonegotiation at "
-                        "Half Duplex only\n");
+                e_dev_info("Half Duplex specified without Speed\n");
+                e_dev_info("Using Autonegotiation at Half Duplex only\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 adapter->hw.autoneg_advertised = ADVERTISE_10_HALF |
                                                  ADVERTISE_100_HALF;
                 break;
         case FULL_DUPLEX:
-                DPRINTK(PROBE, INFO, "Full Duplex specified without Speed\n");
-                DPRINTK(PROBE, INFO, "Using Autonegotiation at "
-                        "Full Duplex only\n");
+                e_dev_info("Full Duplex specified without Speed\n");
+                e_dev_info("Using Autonegotiation at Full Duplex only\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 adapter->hw.autoneg_advertised = ADVERTISE_10_FULL |
                                                  ADVERTISE_100_FULL |
                                                  ADVERTISE_1000_FULL;
                 break;
         case SPEED_10:
-                DPRINTK(PROBE, INFO, "10 Mbps Speed specified "
-                        "without Duplex\n");
-                DPRINTK(PROBE, INFO, "Using Autonegotiation at 10 Mbps only\n");
+                e_dev_info("10 Mbps Speed specified without Duplex\n");
+                e_dev_info("Using Autonegotiation at 10 Mbps only\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 adapter->hw.autoneg_advertised = ADVERTISE_10_HALF |
                                                  ADVERTISE_10_FULL;
                 break;
         case SPEED_10 + HALF_DUPLEX:
-                DPRINTK(PROBE, INFO, "Forcing to 10 Mbps Half Duplex\n");
+                e_dev_info("Forcing to 10 Mbps Half Duplex\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 0;
                 adapter->hw.forced_speed_duplex = e1000_10_half;
                 adapter->hw.autoneg_advertised = 0;
                 break;
         case SPEED_10 + FULL_DUPLEX:
-                DPRINTK(PROBE, INFO, "Forcing to 10 Mbps Full Duplex\n");
+                e_dev_info("Forcing to 10 Mbps Full Duplex\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 0;
                 adapter->hw.forced_speed_duplex = e1000_10_full;
                 adapter->hw.autoneg_advertised = 0;
                 break;
         case SPEED_100:
-                DPRINTK(PROBE, INFO, "100 Mbps Speed specified "
-                        "without Duplex\n");
-                DPRINTK(PROBE, INFO, "Using Autonegotiation at "
-                        "100 Mbps only\n");
+                e_dev_info("100 Mbps Speed specified without Duplex\n");
+                e_dev_info("Using Autonegotiation at 100 Mbps only\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 adapter->hw.autoneg_advertised = ADVERTISE_100_HALF |
                                                  ADVERTISE_100_FULL;
                 break;
         case SPEED_100 + HALF_DUPLEX:
-                DPRINTK(PROBE, INFO, "Forcing to 100 Mbps Half Duplex\n");
+                e_dev_info("Forcing to 100 Mbps Half Duplex\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 0;
                 adapter->hw.forced_speed_duplex = e1000_100_half;
                 adapter->hw.autoneg_advertised = 0;
                 break;
         case SPEED_100 + FULL_DUPLEX:
-                DPRINTK(PROBE, INFO, "Forcing to 100 Mbps Full Duplex\n");
+                e_dev_info("Forcing to 100 Mbps Full Duplex\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 0;
                 adapter->hw.forced_speed_duplex = e1000_100_full;
                 adapter->hw.autoneg_advertised = 0;
                 break;
         case SPEED_1000:
-                DPRINTK(PROBE, INFO, "1000 Mbps Speed specified without "
-                        "Duplex\n");
+                e_dev_info("1000 Mbps Speed specified without Duplex\n");
                 goto full_duplex_only;
         case SPEED_1000 + HALF_DUPLEX:
-                DPRINTK(PROBE, INFO,
-                        "Half Duplex is not supported at 1000 Mbps\n");
+                e_dev_info("Half Duplex is not supported at 1000 Mbps\n");
                 /* fall through */
         case SPEED_1000 + FULL_DUPLEX:
 full_duplex_only:
-                DPRINTK(PROBE, INFO,
-                       "Using Autonegotiation at 1000 Mbps Full Duplex only\n");
+                e_dev_info("Using Autonegotiation at 1000 Mbps Full Duplex "
+                           "only\n");
                 adapter->hw.autoneg = adapter->fc_autoneg = 1;
                 adapter->hw.autoneg_advertised = ADVERTISE_1000_FULL;
                 break;
@@ -762,9 +755,8 @@ full_duplex_only:
 
         /* Speed, AutoNeg and MDI/MDI-X must all play nice */
         if (e1000_validate_mdi_setting(&(adapter->hw)) < 0) {
-                DPRINTK(PROBE, INFO,
-                        "Speed, AutoNeg and MDI-X specifications are "
-                        "incompatible. Setting MDI-X to a compatible value.\n");
+                e_dev_info("Speed, AutoNeg and MDI-X specs are incompatible. "
+                           "Setting MDI-X to a compatible value.\n");
         }
 }
 
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 4b0016d69530..1e73eddee24a 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -336,7 +336,6 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         static int global_quad_port_a; /* global port a indication */
         struct pci_dev *pdev = adapter->pdev;
-        u16 eeprom_data = 0;
         int is_port_b = er32(STATUS) & E1000_STATUS_FUNC_1;
         s32 rc;
 
@@ -387,16 +386,15 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
                 if (pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)
                         adapter->flags &= ~FLAG_HAS_WOL;
                 break;
-
         case e1000_82573:
+        case e1000_82574:
+        case e1000_82583:
+                /* Disable ASPM L0s due to hardware errata */
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L0S);
+
                 if (pdev->device == E1000_DEV_ID_82573L) {
-                        if (e1000_read_nvm(&adapter->hw, NVM_INIT_3GIO_3, 1,
-                                       &eeprom_data) < 0)
-                                break;
-                        if (!(eeprom_data & NVM_WORD1A_ASPM_MASK)) {
-                                adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                        }
+                        adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
+                        adapter->max_hw_frame_size = DEFAULT_JUMBO;
                 }
                 break;
         default:
@@ -1792,6 +1790,7 @@ struct e1000_info e1000_82571_info = {
                                   | FLAG_RESET_OVERWRITES_LAA /* errata */
                                   | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                   | FLAG_APME_CHECK_PORT_B,
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1809,6 +1808,7 @@ struct e1000_info e1000_82572_info = {
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_CTRLEXT_ON_LOAD
                                   | FLAG_TARC_SPEED_MODE_BIT, /* errata */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
         .pba                    = 38,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
@@ -1820,13 +1820,11 @@ struct e1000_info e1000_82572_info = {
 struct e1000_info e1000_82573_info = {
         .mac                    = e1000_82573,
         .flags                  = FLAG_HAS_HW_VLAN_FILTER
-                                  | FLAG_HAS_JUMBO_FRAMES
                                   | FLAG_HAS_WOL
                                   | FLAG_APME_IN_CTRL3
                                   | FLAG_RX_CSUM_ENABLED
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
-                                  | FLAG_HAS_ERT
                                   | FLAG_HAS_SWSM_ON_LOAD,
         .pba                    = 20,
         .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
@@ -1847,7 +1845,7 @@ struct e1000_info e1000_82574_info = {
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
-        .pba                    = 20,
+        .pba                    = 36,
         .max_hw_frame_size      = DEFAULT_JUMBO,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
@@ -1864,7 +1862,7 @@ struct e1000_info e1000_82583_info = {
                                   | FLAG_HAS_SMART_POWER_DOWN
                                   | FLAG_HAS_AMT
                                   | FLAG_HAS_CTRLEXT_ON_LOAD,
-        .pba                    = 20,
+        .pba                    = 36,
         .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
         .get_variants           = e1000_get_variants_82571,
         .mac_ops                = &e82571_mac_ops,
diff --git a/drivers/net/e1000e/defines.h b/drivers/net/e1000e/defines.h
index e301e26d6897..7f760aa9efe5 100644
--- a/drivers/net/e1000e/defines.h
+++ b/drivers/net/e1000e/defines.h
@@ -214,6 +214,8 @@
 #define E1000_CTRL_SPD_1000 0x00000200  /* Force 1Gb */
 #define E1000_CTRL_FRCSPD   0x00000800  /* Force Speed */
 #define E1000_CTRL_FRCDPX   0x00001000  /* Force Duplex */
+#define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */
+#define E1000_CTRL_LANPHYPC_VALUE    0x00020000 /* SW value of LANPHYPC */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
 #define E1000_CTRL_SWDPIO0  0x00400000  /* SWDPIN 0 Input or output */
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 12648a1cdb78..c0b3db40bd73 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -37,6 +37,7 @@
 #include <linux/io.h>
 #include <linux/netdevice.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 
 #include "hw.h"
 
@@ -188,6 +189,8 @@ struct e1000_buffer {
                         unsigned long time_stamp;
                         u16 length;
                         u16 next_to_watch;
+                        unsigned int segs;
+                        unsigned int bytecount;
                         u16 mapped_as_page;
                 };
                 /* Rx */
@@ -370,7 +373,7 @@ struct e1000_adapter {
 struct e1000_info {
         enum e1000_mac_type     mac;
         unsigned int            flags;
-        unsigned int            flags2;
+        unsigned int            flags2;
         u32                     pba;
         u32                     max_hw_frame_size;
         s32                     (*get_variants)(struct e1000_adapter *);
@@ -417,6 +420,7 @@ struct e1000_info {
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
 #define FLAG2_IS_DISCARDING               (1 << 2)
+#define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 
 #define E1000_RX_DESC_PS(R, i)      \
         (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -457,6 +461,7 @@ extern void e1000e_update_stats(struct e1000_adapter *adapter);
 extern bool e1000e_has_link(struct e1000_adapter *adapter);
 extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
 extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+extern void e1000e_disable_aspm(struct pci_dev *pdev, u16 state);
 
 extern unsigned int copybreak;
 
diff --git a/drivers/net/e1000e/ethtool.c b/drivers/net/e1000e/ethtool.c
index 983493f2330c..6ff376cfe139 100644
--- a/drivers/net/e1000e/ethtool.c
+++ b/drivers/net/e1000e/ethtool.c
@@ -412,7 +412,6 @@ static int e1000_set_tso(struct net_device *netdev, u32 data)
                 netdev->features &= ~NETIF_F_TSO6;
         }
 
-        e_info("TSO is %s\n", data ? "Enabled" : "Disabled");
         adapter->flags |= FLAG_TSO_FORCE;
         return 0;
 }
@@ -1069,10 +1068,10 @@ static void e1000_free_desc_rings(struct e1000_adapter *adapter)
         if (tx_ring->desc && tx_ring->buffer_info) {
                 for (i = 0; i < tx_ring->count; i++) {
                         if (tx_ring->buffer_info[i].dma)
-                                pci_unmap_single(pdev,
+                                dma_unmap_single(&pdev->dev,
                                         tx_ring->buffer_info[i].dma,
                                         tx_ring->buffer_info[i].length,
-                                        PCI_DMA_TODEVICE);
+                                        DMA_TO_DEVICE);
                         if (tx_ring->buffer_info[i].skb)
                                 dev_kfree_skb(tx_ring->buffer_info[i].skb);
                 }
@@ -1081,9 +1080,9 @@ static void e1000_free_desc_rings(struct e1000_adapter *adapter)
         if (rx_ring->desc && rx_ring->buffer_info) {
                 for (i = 0; i < rx_ring->count; i++) {
                         if (rx_ring->buffer_info[i].dma)
-                                pci_unmap_single(pdev,
+                                dma_unmap_single(&pdev->dev,
                                         rx_ring->buffer_info[i].dma,
-                                        2048, PCI_DMA_FROMDEVICE);
+                                        2048, DMA_FROM_DEVICE);
                         if (rx_ring->buffer_info[i].skb)
                                 dev_kfree_skb(rx_ring->buffer_info[i].skb);
                 }
@@ -1163,9 +1162,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 tx_ring->buffer_info[i].skb = skb;
                 tx_ring->buffer_info[i].length = skb->len;
                 tx_ring->buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, skb->len,
-                                       PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, tx_ring->buffer_info[i].dma)) {
+                        dma_map_single(&pdev->dev, skb->data, skb->len,
+                                       DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev,
+                                      tx_ring->buffer_info[i].dma)) {
                         ret_val = 4;
                         goto err_nomem;
                 }
@@ -1226,9 +1226,10 @@ static int e1000_setup_desc_rings(struct e1000_adapter *adapter)
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_ring->buffer_info[i].skb = skb;
                 rx_ring->buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, 2048,
-                                       PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(pdev, rx_ring->buffer_info[i].dma)) {
+                        dma_map_single(&pdev->dev, skb->data, 2048,
+                                       DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev,
+                                      rx_ring->buffer_info[i].dma)) {
                         ret_val = 8;
                         goto err_nomem;
                 }
@@ -1556,10 +1557,10 @@ static int e1000_run_loopback_test(struct e1000_adapter *adapter)
                 for (i = 0; i < 64; i++) { /* send the packets */
                         e1000_create_lbtest_frame(tx_ring->buffer_info[k].skb,
                                                   1024);
-                        pci_dma_sync_single_for_device(pdev,
+                        dma_sync_single_for_device(&pdev->dev,
                                         tx_ring->buffer_info[k].dma,
                                         tx_ring->buffer_info[k].length,
-                                        PCI_DMA_TODEVICE);
+                                        DMA_TO_DEVICE);
                         k++;
                         if (k == tx_ring->count)
                                 k = 0;
@@ -1569,9 +1570,9 @@ static int e1000_run_loopback_test(struct e1000_adapter *adapter)
                 time = jiffies; /* set the start time for the receive */
                 good_cnt = 0;
                 do { /* receive the sent packets */
-                        pci_dma_sync_single_for_cpu(pdev,
+                        dma_sync_single_for_cpu(&pdev->dev,
                                         rx_ring->buffer_info[l].dma, 2048,
-                                        PCI_DMA_FROMDEVICE);
+                                        DMA_FROM_DEVICE);
 
                         ret_val = e1000_check_lbtest_frame(
                                         rx_ring->buffer_info[l].skb, 1024);
@@ -1889,7 +1890,7 @@ static int e1000_get_coalesce(struct net_device *netdev,
 {
         struct e1000_adapter *adapter = netdev_priv(netdev);
 
-        if (adapter->itr_setting <= 3)
+        if (adapter->itr_setting <= 4)
                 ec->rx_coalesce_usecs = adapter->itr_setting;
         else
                 ec->rx_coalesce_usecs = 1000000 / adapter->itr_setting;
@@ -1904,12 +1905,14 @@ static int e1000_set_coalesce(struct net_device *netdev,
         struct e1000_hw *hw = &adapter->hw;
 
         if ((ec->rx_coalesce_usecs > E1000_MAX_ITR_USECS) ||
-            ((ec->rx_coalesce_usecs > 3) &&
+            ((ec->rx_coalesce_usecs > 4) &&
              (ec->rx_coalesce_usecs < E1000_MIN_ITR_USECS)) ||
             (ec->rx_coalesce_usecs == 2))
                 return -EINVAL;
 
-        if (ec->rx_coalesce_usecs <= 3) {
+        if (ec->rx_coalesce_usecs == 4) {
+                adapter->itr = adapter->itr_setting = 4;
+        } else if (ec->rx_coalesce_usecs <= 3) {
                 adapter->itr = 20000;
                 adapter->itr_setting = ec->rx_coalesce_usecs;
         } else {
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 5059c22155d9..b8c4dce01a04 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -83,6 +83,8 @@
 
 
 #define E1000_ICH_FWSM_RSPCIPHY 0x00000040 /* Reset PHY on PCI Reset */
+/* FW established a valid mode */
+#define E1000_ICH_FWSM_FW_VALID         0x00008000
 
 #define E1000_ICH_MNG_IAMT_MODE         0x2
 
@@ -259,6 +261,7 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 {
         struct e1000_phy_info *phy = &hw->phy;
+        u32 ctrl;
         s32 ret_val = 0;
 
         phy->addr                     = 1;
@@ -274,6 +277,33 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
         phy->ops.power_down           = e1000_power_down_phy_copper_ich8lan;
         phy->autoneg_mask             = AUTONEG_ADVERTISE_SPEED_DEFAULT;
 
+        if (!(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+                /*
+                 * The MAC-PHY interconnect may still be in SMBus mode
+                 * after Sx->S0.  Toggle the LANPHYPC Value bit to force
+                 * the interconnect to PCIe mode, but only if there is no
+                 * firmware present otherwise firmware will have done it.
+                 */
+                ctrl = er32(CTRL);
+                ctrl |=  E1000_CTRL_LANPHYPC_OVERRIDE;
+                ctrl &= ~E1000_CTRL_LANPHYPC_VALUE;
+                ew32(CTRL, ctrl);
+                udelay(10);
+                ctrl &= ~E1000_CTRL_LANPHYPC_OVERRIDE;
+                ew32(CTRL, ctrl);
+                msleep(50);
+        }
+
+        /*
+         * Reset the PHY before any acccess to it.  Doing so, ensures that
+         * the PHY is in a known good state before we read/write PHY registers.
+         * The generic reset is sufficient here, because we haven't determined
+         * the PHY type yet.
+         */
+        ret_val = e1000e_phy_hw_reset_generic(hw);
+        if (ret_val)
+                goto out;
+
         phy->id = e1000_phy_unknown;
         ret_val = e1000e_get_phy_id(hw);
         if (ret_val)
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 5f70c437fa41..c5f65a29865a 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -52,7 +52,7 @@
 
 #include "e1000.h"
 
-#define DRV_VERSION "1.0.2-k2"
+#define DRV_VERSION "1.0.2-k4"
 char e1000e_driver_name[] = "e1000e";
 const char e1000e_driver_version[] = DRV_VERSION;
 
@@ -69,6 +69,361 @@ static const struct e1000_info *e1000_info_tbl[] = {
         [board_pchlan]          = &e1000_pch_info,
 };
 
+struct e1000_reg_info {
+        u32 ofs;
+        char *name;
+};
+
+#define E1000_RDFH      0x02410 /* Rx Data FIFO Head - RW */
+#define E1000_RDFT      0x02418 /* Rx Data FIFO Tail - RW */
+#define E1000_RDFHS     0x02420 /* Rx Data FIFO Head Saved - RW */
+#define E1000_RDFTS     0x02428 /* Rx Data FIFO Tail Saved - RW */
+#define E1000_RDFPC     0x02430 /* Rx Data FIFO Packet Count - RW */
+
+#define E1000_TDFH      0x03410 /* Tx Data FIFO Head - RW */
+#define E1000_TDFT      0x03418 /* Tx Data FIFO Tail - RW */
+#define E1000_TDFHS     0x03420 /* Tx Data FIFO Head Saved - RW */
+#define E1000_TDFTS     0x03428 /* Tx Data FIFO Tail Saved - RW */
+#define E1000_TDFPC     0x03430 /* Tx Data FIFO Packet Count - RW */
+
+static const struct e1000_reg_info e1000_reg_info_tbl[] = {
+
+        /* General Registers */
+        {E1000_CTRL, "CTRL"},
+        {E1000_STATUS, "STATUS"},
+        {E1000_CTRL_EXT, "CTRL_EXT"},
+
+        /* Interrupt Registers */
+        {E1000_ICR, "ICR"},
+
+        /* RX Registers */
+        {E1000_RCTL, "RCTL"},
+        {E1000_RDLEN, "RDLEN"},
+        {E1000_RDH, "RDH"},
+        {E1000_RDT, "RDT"},
+        {E1000_RDTR, "RDTR"},
+        {E1000_RXDCTL(0), "RXDCTL"},
+        {E1000_ERT, "ERT"},
+        {E1000_RDBAL, "RDBAL"},
+        {E1000_RDBAH, "RDBAH"},
+        {E1000_RDFH, "RDFH"},
+        {E1000_RDFT, "RDFT"},
+        {E1000_RDFHS, "RDFHS"},
+        {E1000_RDFTS, "RDFTS"},
+        {E1000_RDFPC, "RDFPC"},
+
+        /* TX Registers */
+        {E1000_TCTL, "TCTL"},
+        {E1000_TDBAL, "TDBAL"},
+        {E1000_TDBAH, "TDBAH"},
+        {E1000_TDLEN, "TDLEN"},
+        {E1000_TDH, "TDH"},
+        {E1000_TDT, "TDT"},
+        {E1000_TIDV, "TIDV"},
+        {E1000_TXDCTL(0), "TXDCTL"},
+        {E1000_TADV, "TADV"},
+        {E1000_TARC(0), "TARC"},
+        {E1000_TDFH, "TDFH"},
+        {E1000_TDFT, "TDFT"},
+        {E1000_TDFHS, "TDFHS"},
+        {E1000_TDFTS, "TDFTS"},
+        {E1000_TDFPC, "TDFPC"},
+
+        /* List Terminator */
+        {}
+};
+
+/*
+ * e1000_regdump - register printout routine
+ */
+static void e1000_regdump(struct e1000_hw *hw, struct e1000_reg_info *reginfo)
+{
+        int n = 0;
+        char rname[16];
+        u32 regs[8];
+
+        switch (reginfo->ofs) {
+        case E1000_RXDCTL(0):
+                for (n = 0; n < 2; n++)
+                        regs[n] = __er32(hw, E1000_RXDCTL(n));
+                break;
+        case E1000_TXDCTL(0):
+                for (n = 0; n < 2; n++)
+                        regs[n] = __er32(hw, E1000_TXDCTL(n));
+                break;
+        case E1000_TARC(0):
+                for (n = 0; n < 2; n++)
+                        regs[n] = __er32(hw, E1000_TARC(n));
+                break;
+        default:
+                printk(KERN_INFO "%-15s %08x\n",
+                        reginfo->name, __er32(hw, reginfo->ofs));
+                return;
+        }
+
+        snprintf(rname, 16, "%s%s", reginfo->name, "[0-1]");
+        printk(KERN_INFO "%-15s ", rname);
+        for (n = 0; n < 2; n++)
+                printk(KERN_CONT "%08x ", regs[n]);
+        printk(KERN_CONT "\n");
+}
+
+
+/*
+ * e1000e_dump - Print registers, tx-ring and rx-ring
+ */
+static void e1000e_dump(struct e1000_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct e1000_hw *hw = &adapter->hw;
+        struct e1000_reg_info *reginfo;
+        struct e1000_ring *tx_ring = adapter->tx_ring;
+        struct e1000_tx_desc *tx_desc;
+        struct my_u0 { u64 a; u64 b; } *u0;
+        struct e1000_buffer *buffer_info;
+        struct e1000_ring *rx_ring = adapter->rx_ring;
+        union e1000_rx_desc_packet_split *rx_desc_ps;
+        struct e1000_rx_desc *rx_desc;
+        struct my_u1 { u64 a; u64 b; u64 c; u64 d; } *u1;
+        u32 staterr;
+        int i = 0;
+
+        if (!netif_msg_hw(adapter))
+                return;
+
+        /* Print netdevice Info */
+        if (netdev) {
+                dev_info(&adapter->pdev->dev, "Net device Info\n");
+                printk(KERN_INFO "Device Name     state            "
+                        "trans_start      last_rx\n");
+                printk(KERN_INFO "%-15s %016lX %016lX %016lX\n",
+                        netdev->name,
+                        netdev->state,
+                        netdev->trans_start,
+                        netdev->last_rx);
+        }
+
+        /* Print Registers */
+        dev_info(&adapter->pdev->dev, "Register Dump\n");
+        printk(KERN_INFO " Register Name   Value\n");
+        for (reginfo = (struct e1000_reg_info *)e1000_reg_info_tbl;
+             reginfo->name; reginfo++) {
+                e1000_regdump(hw, reginfo);
+        }
+
+        /* Print TX Ring Summary */
+        if (!netdev || !netif_running(netdev))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC] [bi(ntc)->dma  ]"
+                " leng ntw timestamp\n");
+        buffer_info = &tx_ring->buffer_info[tx_ring->next_to_clean];
+        printk(KERN_INFO " %5d %5X %5X %016llX %04X %3X %016llX\n",
+                0, tx_ring->next_to_use, tx_ring->next_to_clean,
+                (u64)buffer_info->dma,
+                buffer_info->length,
+                buffer_info->next_to_watch,
+                (u64)buffer_info->time_stamp);
+
+        /* Print TX Rings */
+        if (!netif_msg_tx_done(adapter))
+                goto rx_ring_summary;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Dump\n");
+
+        /* Transmit Descriptor Formats - DEXT[29] is 0 (Legacy) or 1 (Extended)
+         *
+         * Legacy Transmit Descriptor
+         *   +--------------------------------------------------------------+
+         * 0 |         Buffer Address [63:0] (Reserved on Write Back)       |
+         *   +--------------------------------------------------------------+
+         * 8 | Special  |    CSS     | Status |  CMD    |  CSO   |  Length  |
+         *   +--------------------------------------------------------------+
+         *   63       48 47        36 35    32 31     24 23    16 15        0
+         *
+         * Extended Context Descriptor (DTYP=0x0) for TSO or checksum offload
+         *   63      48 47    40 39       32 31             16 15    8 7      0
+         *   +----------------------------------------------------------------+
+         * 0 |  TUCSE  | TUCS0  |   TUCSS   |     IPCSE       | IPCS0 | IPCSS |
+         *   +----------------------------------------------------------------+
+         * 8 |   MSS   | HDRLEN | RSV | STA | TUCMD | DTYP |      PAYLEN      |
+         *   +----------------------------------------------------------------+
+         *   63      48 47    40 39 36 35 32 31   24 23  20 19                0
+         *
+         * Extended Data Descriptor (DTYP=0x1)
+         *   +----------------------------------------------------------------+
+         * 0 |                     Buffer Address [63:0]                      |
+         *   +----------------------------------------------------------------+
+         * 8 | VLAN tag |  POPTS  | Rsvd | Status | Command | DTYP |  DTALEN  |
+         *   +----------------------------------------------------------------+
+         *   63       48 47     40 39  36 35    32 31     24 23  20 19        0
+         */
+        printk(KERN_INFO "Tl[desc]     [address 63:0  ] [SpeCssSCmCsLen]"
+                " [bi->dma       ] leng  ntw timestamp        bi->skb "
+                "<-- Legacy format\n");
+        printk(KERN_INFO "Tc[desc]     [Ce CoCsIpceCoS] [MssHlRSCm0Plen]"
+                " [bi->dma       ] leng  ntw timestamp        bi->skb "
+                "<-- Ext Context format\n");
+        printk(KERN_INFO "Td[desc]     [address 63:0  ] [VlaPoRSCm1Dlen]"
+                " [bi->dma       ] leng  ntw timestamp        bi->skb "
+                "<-- Ext Data format\n");
+        for (i = 0; tx_ring->desc && (i < tx_ring->count); i++) {
+                tx_desc = E1000_TX_DESC(*tx_ring, i);
+                buffer_info = &tx_ring->buffer_info[i];
+                u0 = (struct my_u0 *)tx_desc;
+                printk(KERN_INFO "T%c[0x%03X]    %016llX %016llX %016llX "
+                        "%04X  %3X %016llX %p",
+                       (!(le64_to_cpu(u0->b) & (1<<29)) ? 'l' :
+                        ((le64_to_cpu(u0->b) & (1<<20)) ? 'd' : 'c')), i,
+                       le64_to_cpu(u0->a), le64_to_cpu(u0->b),
+                       (u64)buffer_info->dma, buffer_info->length,
+                       buffer_info->next_to_watch, (u64)buffer_info->time_stamp,
+                       buffer_info->skb);
+                if (i == tx_ring->next_to_use && i == tx_ring->next_to_clean)
+                        printk(KERN_CONT " NTC/U\n");
+                else if (i == tx_ring->next_to_use)
+                        printk(KERN_CONT " NTU\n");
+                else if (i == tx_ring->next_to_clean)
+                        printk(KERN_CONT " NTC\n");
+                else
+                        printk(KERN_CONT "\n");
+
+                if (netif_msg_pktdata(adapter) && buffer_info->dma != 0)
+                        print_hex_dump(KERN_INFO, "", DUMP_PREFIX_ADDRESS,
+                                        16, 1, phys_to_virt(buffer_info->dma),
+                                        buffer_info->length, true);
+        }
+
+        /* Print RX Rings Summary */
+rx_ring_summary:
+        dev_info(&adapter->pdev->dev, "RX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC]\n");
+        printk(KERN_INFO " %5d %5X %5X\n", 0,
+                rx_ring->next_to_use, rx_ring->next_to_clean);
+
+        /* Print RX Rings */
+        if (!netif_msg_rx_status(adapter))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "RX Rings Dump\n");
+        switch (adapter->rx_ps_pages) {
+        case 1:
+        case 2:
+        case 3:
+                /* [Extended] Packet Split Receive Descriptor Format
+                 *
+                 *    +-----------------------------------------------------+
+                 *  0 |                Buffer Address 0 [63:0]              |
+                 *    +-----------------------------------------------------+
+                 *  8 |                Buffer Address 1 [63:0]              |
+                 *    +-----------------------------------------------------+
+                 * 16 |                Buffer Address 2 [63:0]              |
+                 *    +-----------------------------------------------------+
+                 * 24 |                Buffer Address 3 [63:0]              |
+                 *    +-----------------------------------------------------+
+                 */
+                printk(KERN_INFO "R  [desc]      [buffer 0 63:0 ] "
+                        "[buffer 1 63:0 ] "
+                       "[buffer 2 63:0 ] [buffer 3 63:0 ] [bi->dma       ] "
+                       "[bi->skb] <-- Ext Pkt Split format\n");
+                /* [Extended] Receive Descriptor (Write-Back) Format
+                 *
+                 *   63       48 47    32 31     13 12    8 7    4 3        0
+                 *   +------------------------------------------------------+
+                 * 0 | Packet   | IP     |  Rsvd   | MRQ   | Rsvd | MRQ RSS |
+                 *   | Checksum | Ident  |         | Queue |      |  Type   |
+                 *   +------------------------------------------------------+
+                 * 8 | VLAN Tag | Length | Extended Error | Extended Status |
+                 *   +------------------------------------------------------+
+                 *   63       48 47    32 31            20 19               0
+                 */
+                printk(KERN_INFO "RWB[desc]      [ck ipid mrqhsh] "
+                        "[vl   l0 ee  es] "
+                       "[ l3  l2  l1 hs] [reserved      ] ---------------- "
+                       "[bi->skb] <-- Ext Rx Write-Back format\n");
+                for (i = 0; i < rx_ring->count; i++) {
+                        buffer_info = &rx_ring->buffer_info[i];
+                        rx_desc_ps = E1000_RX_DESC_PS(*rx_ring, i);
+                        u1 = (struct my_u1 *)rx_desc_ps;
+                        staterr =
+                                le32_to_cpu(rx_desc_ps->wb.middle.status_error);
+                        if (staterr & E1000_RXD_STAT_DD) {
+                                /* Descriptor Done */
+                                printk(KERN_INFO "RWB[0x%03X]     %016llX "
+                                        "%016llX %016llX %016llX "
+                                        "---------------- %p", i,
+                                        le64_to_cpu(u1->a),
+                                        le64_to_cpu(u1->b),
+                                        le64_to_cpu(u1->c),
+                                        le64_to_cpu(u1->d),
+                                        buffer_info->skb);
+                        } else {
+                                printk(KERN_INFO "R  [0x%03X]     %016llX "
+                                        "%016llX %016llX %016llX %016llX %p", i,
+                                        le64_to_cpu(u1->a),
+                                        le64_to_cpu(u1->b),
+                                        le64_to_cpu(u1->c),
+                                        le64_to_cpu(u1->d),
+                                        (u64)buffer_info->dma,
+                                        buffer_info->skb);
+
+                                if (netif_msg_pktdata(adapter))
+                                        print_hex_dump(KERN_INFO, "",
+                                                DUMP_PREFIX_ADDRESS, 16, 1,
+                                                phys_to_virt(buffer_info->dma),
+                                                adapter->rx_ps_bsize0, true);
+                        }
+
+                        if (i == rx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == rx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+                }
+                break;
+        default:
+        case 0:
+                /* Legacy Receive Descriptor Format
+                 *
+                 * +-----------------------------------------------------+
+                 * |                Buffer Address [63:0]                |
+                 * +-----------------------------------------------------+
+                 * | VLAN Tag | Errors | Status 0 | Packet csum | Length |
+                 * +-----------------------------------------------------+
+                 * 63       48 47    40 39      32 31         16 15      0
+                 */
+                printk(KERN_INFO "Rl[desc]     [address 63:0  ] "
+                        "[vl er S cks ln] [bi->dma       ] [bi->skb] "
+                        "<-- Legacy format\n");
+                for (i = 0; rx_ring->desc && (i < rx_ring->count); i++) {
+                        rx_desc = E1000_RX_DESC(*rx_ring, i);
+                        buffer_info = &rx_ring->buffer_info[i];
+                        u0 = (struct my_u0 *)rx_desc;
+                        printk(KERN_INFO "Rl[0x%03X]    %016llX %016llX "
+                                "%016llX %p",
+                                i, le64_to_cpu(u0->a), le64_to_cpu(u0->b),
+                                (u64)buffer_info->dma, buffer_info->skb);
+                        if (i == rx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == rx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+
+                        if (netif_msg_pktdata(adapter))
+                                print_hex_dump(KERN_INFO, "",
+                                        DUMP_PREFIX_ADDRESS,
+                                        16, 1, phys_to_virt(buffer_info->dma),
+                                        adapter->rx_buffer_len, true);
+                }
+        }
+
+exit:
+        return;
+}
+
 /**
  * e1000_desc_unused - calculate if we have unused descriptors
  **/
@@ -181,10 +536,10 @@ static void e1000_alloc_rx_buffers(struct e1000_adapter *adapter,
 
                 buffer_info->skb = skb;
 map_skb:
-                buffer_info->dma = pci_map_single(pdev, skb->data,
+                buffer_info->dma = dma_map_single(&pdev->dev, skb->data,
                                                   adapter->rx_buffer_len,
-                                                  PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                                  DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
                         dev_err(&pdev->dev, "RX DMA map failed\n");
                         adapter->rx_dma_failed++;
                         break;
@@ -193,26 +548,23 @@ map_skb:
                 rx_desc = E1000_RX_DESC(*rx_ring, i);
                 rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
 
+                if (unlikely(!(i & (E1000_RX_BUFFER_WRITE - 1)))) {
+                        /*
+                         * Force memory writes to complete before letting h/w
+                         * know there are new descriptors to fetch.  (Only
+                         * applicable for weak-ordered memory model archs,
+                         * such as IA-64).
+                         */
+                        wmb();
+                        writel(i, adapter->hw.hw_addr + rx_ring->tail);
+                }
                 i++;
                 if (i == rx_ring->count)
                         i = 0;
                 buffer_info = &rx_ring->buffer_info[i];
         }
 
-        if (rx_ring->next_to_use != i) {
-                rx_ring->next_to_use = i;
-                if (i-- == 0)
-                        i = (rx_ring->count - 1);
-
-                /*
-                 * Force memory writes to complete before letting h/w
-                 * know there are new descriptors to fetch.  (Only
-                 * applicable for weak-ordered memory model archs,
-                 * such as IA-64).
-                 */
-                wmb();
-                writel(i, adapter->hw.hw_addr + rx_ring->tail);
-        }
+        rx_ring->next_to_use = i;
 }
 
 /**
@@ -250,11 +602,12 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                                         adapter->alloc_rx_buff_failed++;
                                         goto no_buffers;
                                 }
-                                ps_page->dma = pci_map_page(pdev,
-                                                   ps_page->page,
-                                                   0, PAGE_SIZE,
-                                                   PCI_DMA_FROMDEVICE);
-                                if (pci_dma_mapping_error(pdev, ps_page->dma)) {
+                                ps_page->dma = dma_map_page(&pdev->dev,
+                                                            ps_page->page,
+                                                            0, PAGE_SIZE,
+                                                            DMA_FROM_DEVICE);
+                                if (dma_mapping_error(&pdev->dev,
+                                                      ps_page->dma)) {
                                         dev_err(&adapter->pdev->dev,
                                           "RX DMA page map failed\n");
                                         adapter->rx_dma_failed++;
@@ -279,10 +632,10 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
                 }
 
                 buffer_info->skb = skb;
-                buffer_info->dma = pci_map_single(pdev, skb->data,
+                buffer_info->dma = dma_map_single(&pdev->dev, skb->data,
                                                   adapter->rx_ps_bsize0,
-                                                  PCI_DMA_FROMDEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                                  DMA_FROM_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma)) {
                         dev_err(&pdev->dev, "RX DMA map failed\n");
                         adapter->rx_dma_failed++;
                         /* cleanup skb */
@@ -293,6 +646,17 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
 
                 rx_desc->read.buffer_addr[0] = cpu_to_le64(buffer_info->dma);
 
+                if (unlikely(!(i & (E1000_RX_BUFFER_WRITE - 1)))) {
+                        /*
+                         * Force memory writes to complete before letting h/w
+                         * know there are new descriptors to fetch.  (Only
+                         * applicable for weak-ordered memory model archs,
+                         * such as IA-64).
+                         */
+                        wmb();
+                        writel(i<<1, adapter->hw.hw_addr + rx_ring->tail);
+                }
+
                 i++;
                 if (i == rx_ring->count)
                         i = 0;
@@ -300,26 +664,7 @@ static void e1000_alloc_rx_buffers_ps(struct e1000_adapter *adapter,
         }
 
 no_buffers:
-        if (rx_ring->next_to_use != i) {
-                rx_ring->next_to_use = i;
-
-                if (!(i--))
-                        i = (rx_ring->count - 1);
-
-                /*
-                 * Force memory writes to complete before letting h/w
-                 * know there are new descriptors to fetch.  (Only
-                 * applicable for weak-ordered memory model archs,
-                 * such as IA-64).
-                 */
-                wmb();
-                /*
-                 * Hardware increments by 16 bytes, but packet split
-                 * descriptors are 32 bytes...so we increment tail
-                 * twice as much.
-                 */
-                writel(i<<1, adapter->hw.hw_addr + rx_ring->tail);
-        }
+        rx_ring->next_to_use = i;
 }
 
 /**
@@ -369,10 +714,10 @@ check_page:
                 }
 
                 if (!buffer_info->dma)
-                        buffer_info->dma = pci_map_page(pdev,
+                        buffer_info->dma = dma_map_page(&pdev->dev,
                                                         buffer_info->page, 0,
                                                         PAGE_SIZE,
-                                                        PCI_DMA_FROMDEVICE);
+                                                        DMA_FROM_DEVICE);
 
                 rx_desc = E1000_RX_DESC(*rx_ring, i);
                 rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -446,10 +791,10 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
 
                 cleaned = 1;
                 cleaned_count++;
-                pci_unmap_single(pdev,
+                dma_unmap_single(&pdev->dev,
                                  buffer_info->dma,
                                  adapter->rx_buffer_len,
-                                 PCI_DMA_FROMDEVICE);
+                                 DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 length = le16_to_cpu(rx_desc->length);
@@ -550,12 +895,11 @@ static void e1000_put_txbuf(struct e1000_adapter *adapter,
 {
         if (buffer_info->dma) {
                 if (buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev, buffer_info->dma,
-                                       buffer_info->length, PCI_DMA_TODEVICE);
+                        dma_unmap_page(&adapter->pdev->dev, buffer_info->dma,
+                                       buffer_info->length, DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev, buffer_info->dma,
-                                         buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                        dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                         buffer_info->length, DMA_TO_DEVICE);
                 buffer_info->dma = 0;
         }
         if (buffer_info->skb) {
@@ -646,14 +990,8 @@ static bool e1000_clean_tx_irq(struct e1000_adapter *adapter)
                         cleaned = (i == eop);
 
                         if (cleaned) {
-                                struct sk_buff *skb = buffer_info->skb;
-                                unsigned int segs, bytecount;
-                                segs = skb_shinfo(skb)->gso_segs ?: 1;
-                                /* multiply data chunks by size of headers */
-                                bytecount = ((segs - 1) * skb_headlen(skb)) +
-                                            skb->len;
-                                total_tx_packets += segs;
-                                total_tx_bytes += bytecount;
+                                total_tx_packets += buffer_info->segs;
+                                total_tx_bytes += buffer_info->bytecount;
                         }
 
                         e1000_put_txbuf(adapter, buffer_info);
@@ -756,9 +1094,9 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
 
                 cleaned = 1;
                 cleaned_count++;
-                pci_unmap_single(pdev, buffer_info->dma,
+                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                  adapter->rx_ps_bsize0,
-                                 PCI_DMA_FROMDEVICE);
+                                 DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 /* see !EOP comment in other rx routine */
@@ -814,13 +1152,13 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                          * kmap_atomic, so we can't hold the mapping
                          * very long
                          */
-                        pci_dma_sync_single_for_cpu(pdev, ps_page->dma,
-                                PAGE_SIZE, PCI_DMA_FROMDEVICE);
+                        dma_sync_single_for_cpu(&pdev->dev, ps_page->dma,
+                                                PAGE_SIZE, DMA_FROM_DEVICE);
                         vaddr = kmap_atomic(ps_page->page, KM_SKB_DATA_SOFTIRQ);
                         memcpy(skb_tail_pointer(skb), vaddr, l1);
                         kunmap_atomic(vaddr, KM_SKB_DATA_SOFTIRQ);
-                        pci_dma_sync_single_for_device(pdev, ps_page->dma,
-                                PAGE_SIZE, PCI_DMA_FROMDEVICE);
+                        dma_sync_single_for_device(&pdev->dev, ps_page->dma,
+                                                   PAGE_SIZE, DMA_FROM_DEVICE);
 
                         /* remove the CRC */
                         if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
@@ -837,8 +1175,8 @@ static bool e1000_clean_rx_irq_ps(struct e1000_adapter *adapter,
                                 break;
 
                         ps_page = &buffer_info->ps_pages[j];
-                        pci_unmap_page(pdev, ps_page->dma, PAGE_SIZE,
-                                       PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, ps_page->dma, PAGE_SIZE,
+                                       DMA_FROM_DEVICE);
                         ps_page->dma = 0;
                         skb_fill_page_desc(skb, j, ps_page->page, 0, length);
                         ps_page->page = NULL;
@@ -956,8 +1294,8 @@ static bool e1000_clean_jumbo_rx_irq(struct e1000_adapter *adapter,
 
                 cleaned = true;
                 cleaned_count++;
-                pci_unmap_page(pdev, buffer_info->dma, PAGE_SIZE,
-                               PCI_DMA_FROMDEVICE);
+                dma_unmap_page(&pdev->dev, buffer_info->dma, PAGE_SIZE,
+                               DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 length = le16_to_cpu(rx_desc->length);
@@ -1093,17 +1431,17 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
                 buffer_info = &rx_ring->buffer_info[i];
                 if (buffer_info->dma) {
                         if (adapter->clean_rx == e1000_clean_rx_irq)
-                                pci_unmap_single(pdev, buffer_info->dma,
+                                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                                  adapter->rx_buffer_len,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         else if (adapter->clean_rx == e1000_clean_jumbo_rx_irq)
-                                pci_unmap_page(pdev, buffer_info->dma,
+                                dma_unmap_page(&pdev->dev, buffer_info->dma,
                                                PAGE_SIZE,
-                                               PCI_DMA_FROMDEVICE);
+                                               DMA_FROM_DEVICE);
                         else if (adapter->clean_rx == e1000_clean_rx_irq_ps)
-                                pci_unmap_single(pdev, buffer_info->dma,
+                                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                                  adapter->rx_ps_bsize0,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
                 }
 
@@ -1121,8 +1459,8 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter)
                         ps_page = &buffer_info->ps_pages[j];
                         if (!ps_page->page)
                                 break;
-                        pci_unmap_page(pdev, ps_page->dma, PAGE_SIZE,
-                                       PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, ps_page->dma, PAGE_SIZE,
+                                       DMA_FROM_DEVICE);
                         ps_page->dma = 0;
                         put_page(ps_page->page);
                         ps_page->page = NULL;
@@ -3732,6 +4070,22 @@ link_up:
                 }
         }
 
+        /* Simple mode for Interrupt Throttle Rate (ITR) */
+        if (adapter->itr_setting == 4) {
+                /*
+                 * Symmetric Tx/Rx gets a reduced ITR=2000;
+                 * Total asymmetrical Tx or Rx gets ITR=8000;
+                 * everyone else is between 2000-8000.
+                 */
+                u32 goc = (adapter->gotc + adapter->gorc) / 10000;
+                u32 dif = (adapter->gotc > adapter->gorc ?
+                            adapter->gotc - adapter->gorc :
+                            adapter->gorc - adapter->gotc) / 10000;
+                u32 itr = goc > 0 ? (dif * 6000 / goc + 2000) : 8000;
+
+                ew32(ITR, 1000000000 / (itr * 256));
+        }
+
         /* Cause software interrupt to ensure Rx ring is cleaned */
         if (adapter->msix_entries)
                 ew32(ICS, adapter->rx_ring->ims_val);
@@ -3906,7 +4260,7 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
         struct e1000_buffer *buffer_info;
         unsigned int len = skb_headlen(skb);
         unsigned int offset = 0, size, count = 0, i;
-        unsigned int f;
+        unsigned int f, bytecount, segs;
 
         i = tx_ring->next_to_use;
 
@@ -3917,10 +4271,11 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                 buffer_info->length = size;
                 buffer_info->time_stamp = jiffies;
                 buffer_info->next_to_watch = i;
-                buffer_info->dma = pci_map_single(pdev, skb->data + offset,
-                                                  size, PCI_DMA_TODEVICE);
+                buffer_info->dma = dma_map_single(&pdev->dev,
+                                                  skb->data + offset,
+                                                  size, DMA_TO_DEVICE);
                 buffer_info->mapped_as_page = false;
-                if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                         goto dma_error;
 
                 len -= size;
@@ -3952,11 +4307,11 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                         buffer_info->length = size;
                         buffer_info->time_stamp = jiffies;
                         buffer_info->next_to_watch = i;
-                        buffer_info->dma = pci_map_page(pdev, frag->page,
+                        buffer_info->dma = dma_map_page(&pdev->dev, frag->page,
                                                         offset, size,
-                                                        PCI_DMA_TODEVICE);
+                                                        DMA_TO_DEVICE);
                         buffer_info->mapped_as_page = true;
-                        if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                                 goto dma_error;
 
                         len -= size;
@@ -3965,7 +4320,13 @@ static int e1000_tx_map(struct e1000_adapter *adapter,
                 }
         }
 
+        segs = skb_shinfo(skb)->gso_segs ?: 1;
+        /* multiply data chunks by size of headers */
+        bytecount = ((segs - 1) * skb_headlen(skb)) + skb->len;
+
         tx_ring->buffer_info[i].skb = skb;
+        tx_ring->buffer_info[i].segs = segs;
+        tx_ring->buffer_info[i].bytecount = bytecount;
         tx_ring->buffer_info[first].next_to_watch = i;
 
         return count;
@@ -4268,6 +4629,8 @@ static void e1000_reset_task(struct work_struct *work)
         struct e1000_adapter *adapter;
         adapter = container_of(work, struct e1000_adapter, reset_task);
 
+        e1000e_dump(adapter);
+        e_err("Reset adapter\n");
         e1000e_reinit_locked(adapter);
 }
 
@@ -4310,6 +4673,14 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                 return -EINVAL;
         }
 
+        /* 82573 Errata 17 */
+        if (((adapter->hw.mac.type == e1000_82573) ||
+             (adapter->hw.mac.type == e1000_82574)) &&
+            (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+                adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+        }
+
         while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
                 msleep(1);
         /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
@@ -4634,29 +5005,42 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
         }
 }
 
-static void e1000e_disable_l1aspm(struct pci_dev *pdev)
+#ifdef CONFIG_PCIEASPM
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        pci_disable_link_state(pdev, state);
+}
+#else
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
 {
         int pos;
-        u16 val;
+        u16 reg16;
 
         /*
-         * 82573 workaround - disable L1 ASPM on mobile chipsets
-         *
-         * L1 ASPM on various mobile (ich7) chipsets do not behave properly
-         * resulting in lost data or garbage information on the pci-e link
-         * level. This could result in (false) bad EEPROM checksum errors,
-         * long ping times (up to 2s) or even a system freeze/hang.
-         *
-         * Unfortunately this feature saves about 1W power consumption when
-         * active.
+         * Both device and parent should have the same ASPM setting.
+         * Disable ASPM in downstream component first and then upstream.
          */
-        pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
-        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
-        if (val & 0x2) {
-                dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
-                val &= ~0x2;
-                pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, val);
-        }
+        pos = pci_pcie_cap(pdev);
+        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
+
+        if (!pdev->bus->self)
+                return;
+
+        pos = pci_pcie_cap(pdev->bus->self);
+        pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, reg16);
+}
+#endif
+void e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        dev_info(&pdev->dev, "Disabling ASPM %s %s\n",
+                 (state & PCIE_LINK_STATE_L0S) ? "L0s" : "",
+                 (state & PCIE_LINK_STATE_L1) ? "L1" : "");
+
+        __e1000e_disable_aspm(pdev, state);
 }
 
 #ifdef CONFIG_PM_OPS
@@ -4672,7 +5056,11 @@ static int __e1000_resume(struct pci_dev *pdev)
         struct e1000_hw *hw = &adapter->hw;
         u32 err;
 
-        e1000e_disable_l1aspm(pdev);
+        pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
+        pci_save_state(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         e1000e_set_interrupt_capability(adapter);
         if (netif_running(netdev)) {
@@ -4877,7 +5265,8 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
         int err;
         pci_ers_result_t result;
 
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
         err = pci_enable_device_mem(pdev);
         if (err) {
                 dev_err(&pdev->dev,
@@ -4971,13 +5360,6 @@ static void e1000_eeprom_checks(struct e1000_adapter *adapter)
                 dev_warn(&adapter->pdev->dev,
                          "Warning: detected DSPD enabled in EEPROM\n");
         }
-
-        ret_val = e1000_read_nvm(hw, NVM_INIT_3GIO_3, 1, &buf);
-        if (!ret_val && (le16_to_cpu(buf) & (3 << 2))) {
-                /* ASPM enable */
-                dev_warn(&adapter->pdev->dev,
-                         "Warning: detected ASPM enabled in EEPROM\n");
-        }
 }
 
 static const struct net_device_ops e1000e_netdev_ops = {
@@ -5026,23 +5408,24 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
         u16 eeprom_data = 0;
         u16 eeprom_apme_mask = E1000_EEPROM_APME;
 
-        e1000e_disable_l1aspm(pdev);
+        if (ei->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
 
         err = pci_enable_device_mem(pdev);
         if (err)
                 return err;
 
         pci_using_dac = 0;
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+        err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         if (!err) {
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
                 if (!err)
                         pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev,
-                                                          DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
                         if (err) {
                                 dev_err(&pdev->dev, "No usable DMA "
                                         "configuration, aborting\n");
@@ -5073,6 +5456,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
 
         SET_NETDEV_DEV(netdev, &pdev->dev);
 
+        netdev->irq = pdev->irq;
+
         pci_set_drvdata(pdev, netdev);
         adapter = netdev_priv(netdev);
         hw = &adapter->hw;
diff --git a/drivers/net/e1000e/param.c b/drivers/net/e1000e/param.c
index f775a481063d..0f4077c3d538 100644
--- a/drivers/net/e1000e/param.c
+++ b/drivers/net/e1000e/param.c
@@ -351,6 +351,11 @@ void __devinit e1000e_check_options(struct e1000_adapter *adapter)
                                 adapter->itr_setting = adapter->itr;
                                 adapter->itr = 20000;
                                 break;
+                        case 4:
+                                e_info("%s set to simplified (2000-8000 ints) "
+                                       "mode\n", opt.name);
+                                adapter->itr_setting = 4;
+                                break;
                         default:
                                 /*
                                  * Save the setting, because the dynamic bits
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index fa311a950996..0630980a2722 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0102"
+#define DRV_VERSION     "EHEA_0103"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 3f445efa9482..39774817c3eb 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -791,11 +791,17 @@ static struct ehea_cqe *ehea_proc_cqes(struct ehea_port_res *pr, int my_quota)
                 cqe_counter++;
                 rmb();
                 if (cqe->status & EHEA_CQE_STAT_ERR_MASK) {
-                        ehea_error("Send Completion Error: Resetting port");
+                        ehea_error("Bad send completion status=0x%04X",
+                                   cqe->status);
+
                         if (netif_msg_tx_err(pr->port))
                                 ehea_dump(cqe, sizeof(*cqe), "Send CQE");
-                        ehea_schedule_port_reset(pr->port);
-                        break;
+
+                        if (cqe->status & EHEA_CQE_STAT_RESET_MASK) {
+                                ehea_error("Resetting port");
+                                ehea_schedule_port_reset(pr->port);
+                                break;
+                        }
                 }
 
                 if (netif_msg_tx_done(pr->port))
@@ -901,6 +907,8 @@ static irqreturn_t ehea_qp_aff_irq_handler(int irq, void *param)
         struct ehea_eqe *eqe;
         struct ehea_qp *qp;
         u32 qp_token;
+        u64 resource_type, aer, aerr;
+        int reset_port = 0;
 
         eqe = ehea_poll_eq(port->qp_eq);
 
@@ -910,11 +918,24 @@ static irqreturn_t ehea_qp_aff_irq_handler(int irq, void *param)
                            eqe->entry, qp_token);
 
                 qp = port->port_res[qp_token].qp;
-                ehea_error_data(port->adapter, qp->fw_handle);
+
+                resource_type = ehea_error_data(port->adapter, qp->fw_handle,
+                                                &aer, &aerr);
+
+                if (resource_type == EHEA_AER_RESTYPE_QP) {
+                        if ((aer & EHEA_AER_RESET_MASK) ||
+                            (aerr & EHEA_AERR_RESET_MASK))
+                                 reset_port = 1;
+                } else
+                        reset_port = 1;   /* Reset in case of CQ or EQ error */
+
                 eqe = ehea_poll_eq(port->qp_eq);
         }
 
-        ehea_schedule_port_reset(port);
+        if (reset_port) {
+                ehea_error("Resetting port");
+                ehea_schedule_port_reset(port);
+        }
 
         return IRQ_HANDLED;
 }
@@ -2868,7 +2889,6 @@ static void ehea_rereg_mrs(struct work_struct *work)
         int ret, i;
         struct ehea_adapter *adapter;
 
-        mutex_lock(&dlpar_mem_lock);
         ehea_info("LPAR memory changed - re-initializing driver");
 
         list_for_each_entry(adapter, &adapter_list, list)
@@ -2938,7 +2958,6 @@ static void ehea_rereg_mrs(struct work_struct *work)
                 }
         ehea_info("re-initializing driver complete");
 out:
-        mutex_unlock(&dlpar_mem_lock);
         return;
 }
 
@@ -3521,7 +3540,14 @@ void ehea_crash_handler(void)
 static int ehea_mem_notifier(struct notifier_block *nb,
                              unsigned long action, void *data)
 {
+        int ret = NOTIFY_BAD;
         struct memory_notify *arg = data;
+
+        if (!mutex_trylock(&dlpar_mem_lock)) {
+                ehea_info("ehea_mem_notifier must not be called parallelized");
+                goto out;
+        }
+
         switch (action) {
         case MEM_CANCEL_OFFLINE:
                 ehea_info("memory offlining canceled");
@@ -3530,14 +3556,14 @@ static int ehea_mem_notifier(struct notifier_block *nb,
                 ehea_info("memory is going online");
                 set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
                 if (ehea_add_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        return NOTIFY_BAD;
+                        goto out_unlock;
                 ehea_rereg_mrs(NULL);
                 break;
         case MEM_GOING_OFFLINE:
                 ehea_info("memory is going offline");
                 set_bit(__EHEA_STOP_XFER, &ehea_driver_flags);
                 if (ehea_rem_sect_bmap(arg->start_pfn, arg->nr_pages))
-                        return NOTIFY_BAD;
+                        goto out_unlock;
                 ehea_rereg_mrs(NULL);
                 break;
         default:
@@ -3545,8 +3571,12 @@ static int ehea_mem_notifier(struct notifier_block *nb,
         }
 
         ehea_update_firmware_handles();
+        ret = NOTIFY_OK;
 
-        return NOTIFY_OK;
+out_unlock:
+        mutex_unlock(&dlpar_mem_lock);
+out:
+        return ret;
 }
 
 static struct notifier_block ehea_mem_nb = {
diff --git a/drivers/net/ehea/ehea_qmr.c b/drivers/net/ehea/ehea_qmr.c
index a1b4c7e56367..89128b6373e3 100644
--- a/drivers/net/ehea/ehea_qmr.c
+++ b/drivers/net/ehea/ehea_qmr.c
@@ -229,14 +229,14 @@ u64 ehea_destroy_cq_res(struct ehea_cq *cq, u64 force)
 
 int ehea_destroy_cq(struct ehea_cq *cq)
 {
-        u64 hret;
+        u64 hret, aer, aerr;
         if (!cq)
                 return 0;
 
         hcp_epas_dtor(&cq->epas);
         hret = ehea_destroy_cq_res(cq, NORMAL_FREE);
         if (hret == H_R_STATE) {
-                ehea_error_data(cq->adapter, cq->fw_handle);
+                ehea_error_data(cq->adapter, cq->fw_handle, &aer, &aerr);
                 hret = ehea_destroy_cq_res(cq, FORCE_FREE);
         }
 
@@ -357,7 +357,7 @@ u64 ehea_destroy_eq_res(struct ehea_eq *eq, u64 force)
 
 int ehea_destroy_eq(struct ehea_eq *eq)
 {
-        u64 hret;
+        u64 hret, aer, aerr;
         if (!eq)
                 return 0;
 
@@ -365,7 +365,7 @@ int ehea_destroy_eq(struct ehea_eq *eq)
 
         hret = ehea_destroy_eq_res(eq, NORMAL_FREE);
         if (hret == H_R_STATE) {
-                ehea_error_data(eq->adapter, eq->fw_handle);
+                ehea_error_data(eq->adapter, eq->fw_handle, &aer, &aerr);
                 hret = ehea_destroy_eq_res(eq, FORCE_FREE);
         }
 
@@ -540,7 +540,7 @@ u64 ehea_destroy_qp_res(struct ehea_qp *qp, u64 force)
 
 int ehea_destroy_qp(struct ehea_qp *qp)
 {
-        u64 hret;
+        u64 hret, aer, aerr;
         if (!qp)
                 return 0;
 
@@ -548,7 +548,7 @@ int ehea_destroy_qp(struct ehea_qp *qp)
 
         hret = ehea_destroy_qp_res(qp, NORMAL_FREE);
         if (hret == H_R_STATE) {
-                ehea_error_data(qp->adapter, qp->fw_handle);
+                ehea_error_data(qp->adapter, qp->fw_handle, &aer, &aerr);
                 hret = ehea_destroy_qp_res(qp, FORCE_FREE);
         }
 
@@ -986,42 +986,45 @@ void print_error_data(u64 *data)
         if (length > EHEA_PAGESIZE)
                 length = EHEA_PAGESIZE;
 
-        if (type == 0x8) /* Queue Pair */
+        if (type == EHEA_AER_RESTYPE_QP)
                 ehea_error("QP (resource=%llX) state: AER=0x%llX, AERR=0x%llX, "
                            "port=%llX", resource, data[6], data[12], data[22]);
-
-        if (type == 0x4) /* Completion Queue */
+        else if (type == EHEA_AER_RESTYPE_CQ)
                 ehea_error("CQ (resource=%llX) state: AER=0x%llX", resource,
                            data[6]);
-
-        if (type == 0x3) /* Event Queue */
+        else if (type == EHEA_AER_RESTYPE_EQ)
                 ehea_error("EQ (resource=%llX) state: AER=0x%llX", resource,
                            data[6]);
 
         ehea_dump(data, length, "error data");
 }
 
-void ehea_error_data(struct ehea_adapter *adapter, u64 res_handle)
+u64 ehea_error_data(struct ehea_adapter *adapter, u64 res_handle,
+                    u64 *aer, u64 *aerr)
 {
         unsigned long ret;
         u64 *rblock;
+        u64 type = 0;
 
         rblock = (void *)get_zeroed_page(GFP_KERNEL);
         if (!rblock) {
                 ehea_error("Cannot allocate rblock memory.");
-                return;
+                goto out;
         }
 
-        ret = ehea_h_error_data(adapter->handle,
-                                res_handle,
-                                rblock);
+        ret = ehea_h_error_data(adapter->handle, res_handle, rblock);
 
-        if (ret == H_R_STATE)
-                ehea_error("No error data is available: %llX.", res_handle);
-        else if (ret == H_SUCCESS)
+        if (ret == H_SUCCESS) {
+                type = EHEA_BMASK_GET(ERROR_DATA_TYPE, rblock[2]);
+                *aer = rblock[6];
+                *aerr = rblock[12];
                 print_error_data(rblock);
-        else
+        } else if (ret == H_R_STATE) {
+                ehea_error("No error data available: %llX.", res_handle);
+        } else
                 ehea_error("Error data could not be fetched: %llX", res_handle);
 
         free_page((unsigned long)rblock);
+out:
+        return type;
 }
diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
index 0817c1e74a19..882c50c9c34f 100644
--- a/drivers/net/ehea/ehea_qmr.h
+++ b/drivers/net/ehea/ehea_qmr.h
@@ -154,6 +154,9 @@ struct ehea_rwqe {
 #define EHEA_CQE_STAT_ERR_IP       0x2000
 #define EHEA_CQE_STAT_ERR_CRC      0x1000
 
+/* Defines which bad send cqe stati lead to a port reset */
+#define EHEA_CQE_STAT_RESET_MASK   0x0002
+
 struct ehea_cqe {
         u64 wr_id;              /* work request ID from WQE */
         u8 type;
@@ -187,6 +190,14 @@ struct ehea_cqe {
 #define EHEA_EQE_SM_MECH_NUMBER  EHEA_BMASK_IBM(48, 55)
 #define EHEA_EQE_SM_PORT_NUMBER  EHEA_BMASK_IBM(56, 63)
 
+#define EHEA_AER_RESTYPE_QP  0x8
+#define EHEA_AER_RESTYPE_CQ  0x4
+#define EHEA_AER_RESTYPE_EQ  0x3
+
+/* Defines which affiliated errors lead to a port reset */
+#define EHEA_AER_RESET_MASK   0xFFFFFFFFFEFFFFFFULL
+#define EHEA_AERR_RESET_MASK  0xFFFFFFFFFFFFFFFFULL
+
 struct ehea_eqe {
         u64 entry;
 };
@@ -379,7 +390,8 @@ int ehea_gen_smr(struct ehea_adapter *adapter, struct ehea_mr *old_mr,
 
 int ehea_rem_mr(struct ehea_mr *mr);
 
-void ehea_error_data(struct ehea_adapter *adapter, u64 res_handle);
+u64 ehea_error_data(struct ehea_adapter *adapter, u64 res_handle,
+                    u64 *aer, u64 *aerr);
 
 int ehea_add_sect_bmap(unsigned long pfn, unsigned long nr_pages);
 int ehea_rem_sect_bmap(unsigned long pfn, unsigned long nr_pages);
diff --git a/drivers/net/ethoc.c b/drivers/net/ethoc.c
index 6bd03c8b8886..ad1bc7317df6 100644
--- a/drivers/net/ethoc.c
+++ b/drivers/net/ethoc.c
@@ -1040,7 +1040,6 @@ static int ethoc_probe(struct platform_device *pdev)
         netdev->features |= 0;
 
         /* setup NAPI */
-        memset(&priv->napi, 0, sizeof(priv->napi));
         netif_napi_add(netdev, &priv->napi, ethoc_poll, 64);
 
         spin_lock_init(&priv->rx_lock);
diff --git a/drivers/net/forcedeth.c b/drivers/net/forcedeth.c
index a1c0e7bb70e8..e282d0ae6a3d 100644
--- a/drivers/net/forcedeth.c
+++ b/drivers/net/forcedeth.c
@@ -1104,20 +1104,16 @@ static void nv_disable_hw_interrupts(struct net_device *dev, u32 mask)
 
 static void nv_napi_enable(struct net_device *dev)
 {
-#ifdef CONFIG_FORCEDETH_NAPI
         struct fe_priv *np = get_nvpriv(dev);
 
         napi_enable(&np->napi);
-#endif
 }
 
 static void nv_napi_disable(struct net_device *dev)
 {
-#ifdef CONFIG_FORCEDETH_NAPI
         struct fe_priv *np = get_nvpriv(dev);
 
         napi_disable(&np->napi);
-#endif
 }
 
 #define MII_READ        (-1)
@@ -1810,7 +1806,6 @@ static int nv_alloc_rx_optimized(struct net_device *dev)
 }
 
 /* If rx bufs are exhausted called after 50ms to attempt to refresh */
-#ifdef CONFIG_FORCEDETH_NAPI
 static void nv_do_rx_refill(unsigned long data)
 {
         struct net_device *dev = (struct net_device *) data;
@@ -1819,41 +1814,6 @@ static void nv_do_rx_refill(unsigned long data)
         /* Just reschedule NAPI rx processing */
         napi_schedule(&np->napi);
 }
-#else
-static void nv_do_rx_refill(unsigned long data)
-{
-        struct net_device *dev = (struct net_device *) data;
-        struct fe_priv *np = netdev_priv(dev);
-        int retcode;
-
-        if (!using_multi_irqs(dev)) {
-                if (np->msi_flags & NV_MSI_X_ENABLED)
-                        disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
-                else
-                        disable_irq(np->pci_dev->irq);
-        } else {
-                disable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-        }
-        if (!nv_optimized(np))
-                retcode = nv_alloc_rx(dev);
-        else
-                retcode = nv_alloc_rx_optimized(dev);
-        if (retcode) {
-                spin_lock_irq(&np->lock);
-                if (!np->in_shutdown)
-                        mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                spin_unlock_irq(&np->lock);
-        }
-        if (!using_multi_irqs(dev)) {
-                if (np->msi_flags & NV_MSI_X_ENABLED)
-                        enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_ALL].vector);
-                else
-                        enable_irq(np->pci_dev->irq);
-        } else {
-                enable_irq(np->msi_x_entry[NV_MSI_X_VECTOR_RX].vector);
-        }
-}
-#endif
 
 static void nv_init_rx(struct net_device *dev)
 {
@@ -2816,11 +2776,7 @@ static int nv_rx_process(struct net_device *dev, int limit)
                 skb->protocol = eth_type_trans(skb, dev);
                 dprintk(KERN_DEBUG "%s: nv_rx_process: %d bytes, proto %d accepted.\n",
                                         dev->name, len, skb->protocol);
-#ifdef CONFIG_FORCEDETH_NAPI
-                netif_receive_skb(skb);
-#else
-                netif_rx(skb);
-#endif
+                napi_gro_receive(&np->napi, skb);
                 dev->stats.rx_packets++;
                 dev->stats.rx_bytes += len;
 next_pkt:
@@ -2909,27 +2865,14 @@ static int nv_rx_process_optimized(struct net_device *dev, int limit)
                                 dev->name, len, skb->protocol);
 
                         if (likely(!np->vlangrp)) {
-#ifdef CONFIG_FORCEDETH_NAPI
-                                netif_receive_skb(skb);
-#else
-                                netif_rx(skb);
-#endif
+                                napi_gro_receive(&np->napi, skb);
                         } else {
                                 vlanflags = le32_to_cpu(np->get_rx.ex->buflow);
                                 if (vlanflags & NV_RX3_VLAN_TAG_PRESENT) {
-#ifdef CONFIG_FORCEDETH_NAPI
-                                        vlan_hwaccel_receive_skb(skb, np->vlangrp,
-                                                                 vlanflags & NV_RX3_VLAN_TAG_MASK);
-#else
-                                        vlan_hwaccel_rx(skb, np->vlangrp,
-                                                        vlanflags & NV_RX3_VLAN_TAG_MASK);
-#endif
+                                        vlan_gro_receive(&np->napi, np->vlangrp,
+                                                         vlanflags & NV_RX3_VLAN_TAG_MASK, skb);
                                 } else {
-#ifdef CONFIG_FORCEDETH_NAPI
-                                        netif_receive_skb(skb);
-#else
-                                        netif_rx(skb);
-#endif
+                                        napi_gro_receive(&np->napi, skb);
                                 }
                         }
 
@@ -3496,10 +3439,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
-#ifndef CONFIG_FORCEDETH_NAPI
-        int total_work = 0;
-        int loop_count = 0;
-#endif
 
         dprintk(KERN_DEBUG "%s: nv_nic_irq\n", dev->name);
 
@@ -3516,7 +3455,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
 
         nv_msi_workaround(np);
 
-#ifdef CONFIG_FORCEDETH_NAPI
         if (napi_schedule_prep(&np->napi)) {
                 /*
                  * Disable further irq's (msix not enabled with napi)
@@ -3525,65 +3463,6 @@ static irqreturn_t nv_nic_irq(int foo, void *data)
                 __napi_schedule(&np->napi);
         }
 
-#else
-        do
-        {
-                int work = 0;
-                if ((work = nv_rx_process(dev, RX_WORK_PER_LOOP))) {
-                        if (unlikely(nv_alloc_rx(dev))) {
-                                spin_lock(&np->lock);
-                                if (!np->in_shutdown)
-                                        mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                                spin_unlock(&np->lock);
-                        }
-                }
-
-                spin_lock(&np->lock);
-                work += nv_tx_done(dev, TX_WORK_PER_LOOP);
-                spin_unlock(&np->lock);
-
-                if (!work)
-                        break;
-
-                total_work += work;
-
-                loop_count++;
-        }
-        while (loop_count < max_interrupt_work);
-
-        if (nv_change_interrupt_mode(dev, total_work)) {
-                /* setup new irq mask */
-                writel(np->irqmask, base + NvRegIrqMask);
-        }
-
-        if (unlikely(np->events & NVREG_IRQ_LINK)) {
-                spin_lock(&np->lock);
-                nv_link_irq(dev);
-                spin_unlock(&np->lock);
-        }
-        if (unlikely(np->need_linktimer && time_after(jiffies, np->link_timeout))) {
-                spin_lock(&np->lock);
-                nv_linkchange(dev);
-                spin_unlock(&np->lock);
-                np->link_timeout = jiffies + LINK_TIMEOUT;
-        }
-        if (unlikely(np->events & NVREG_IRQ_RECOVER_ERROR)) {
-                spin_lock(&np->lock);
-                /* disable interrupts on the nic */
-                if (!(np->msi_flags & NV_MSI_X_ENABLED))
-                        writel(0, base + NvRegIrqMask);
-                else
-                        writel(np->irqmask, base + NvRegIrqMask);
-                pci_push(base);
-
-                if (!np->in_shutdown) {
-                        np->nic_poll_irq = np->irqmask;
-                        np->recover_error = 1;
-                        mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
-                }
-                spin_unlock(&np->lock);
-        }
-#endif
         dprintk(KERN_DEBUG "%s: nv_nic_irq completed\n", dev->name);
 
         return IRQ_HANDLED;
@@ -3599,10 +3478,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
         struct net_device *dev = (struct net_device *) data;
         struct fe_priv *np = netdev_priv(dev);
         u8 __iomem *base = get_hwbase(dev);
-#ifndef CONFIG_FORCEDETH_NAPI
-        int total_work = 0;
-        int loop_count = 0;
-#endif
 
         dprintk(KERN_DEBUG "%s: nv_nic_irq_optimized\n", dev->name);
 
@@ -3619,7 +3494,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
 
         nv_msi_workaround(np);
 
-#ifdef CONFIG_FORCEDETH_NAPI
         if (napi_schedule_prep(&np->napi)) {
                 /*
                  * Disable further irq's (msix not enabled with napi)
@@ -3627,66 +3501,6 @@ static irqreturn_t nv_nic_irq_optimized(int foo, void *data)
                 writel(0, base + NvRegIrqMask);
                 __napi_schedule(&np->napi);
         }
-#else
-        do
-        {
-                int work = 0;
-                if ((work = nv_rx_process_optimized(dev, RX_WORK_PER_LOOP))) {
-                        if (unlikely(nv_alloc_rx_optimized(dev))) {
-                                spin_lock(&np->lock);
-                                if (!np->in_shutdown)
-                                        mod_timer(&np->oom_kick, jiffies + OOM_REFILL);
-                                spin_unlock(&np->lock);
-                        }
-                }
-
-                spin_lock(&np->lock);
-                work += nv_tx_done_optimized(dev, TX_WORK_PER_LOOP);
-                spin_unlock(&np->lock);
-
-                if (!work)
-                        break;
-
-                total_work += work;
-
-                loop_count++;
-        }
-        while (loop_count < max_interrupt_work);
-
-        if (nv_change_interrupt_mode(dev, total_work)) {
-                /* setup new irq mask */
-                writel(np->irqmask, base + NvRegIrqMask);
-        }
-
-        if (unlikely(np->events & NVREG_IRQ_LINK)) {
-                spin_lock(&np->lock);
-                nv_link_irq(dev);
-                spin_unlock(&np->lock);
-        }
-        if (unlikely(np->need_linktimer && time_after(jiffies, np->link_timeout))) {
-                spin_lock(&np->lock);
-                nv_linkchange(dev);
-                spin_unlock(&np->lock);
-                np->link_timeout = jiffies + LINK_TIMEOUT;
-        }
-        if (unlikely(np->events & NVREG_IRQ_RECOVER_ERROR)) {
-                spin_lock(&np->lock);
-                /* disable interrupts on the nic */
-                if (!(np->msi_flags & NV_MSI_X_ENABLED))
-                        writel(0, base + NvRegIrqMask);
-                else
-                        writel(np->irqmask, base + NvRegIrqMask);
-                pci_push(base);
-
-                if (!np->in_shutdown) {
-                        np->nic_poll_irq = np->irqmask;
-                        np->recover_error = 1;
-                        mod_timer(&np->nic_poll, jiffies + POLL_WAIT);
-                }
-                spin_unlock(&np->lock);
-        }
-
-#endif
         dprintk(KERN_DEBUG "%s: nv_nic_irq_optimized completed\n", dev->name);
 
         return IRQ_HANDLED;
@@ -3735,7 +3549,6 @@ static irqreturn_t nv_nic_irq_tx(int foo, void *data)
         return IRQ_RETVAL(i);
 }
 
-#ifdef CONFIG_FORCEDETH_NAPI
 static int nv_napi_poll(struct napi_struct *napi, int budget)
 {
         struct fe_priv *np = container_of(napi, struct fe_priv, napi);
@@ -3743,23 +3556,27 @@ static int nv_napi_poll(struct napi_struct *napi, int budget)
         u8 __iomem *base = get_hwbase(dev);
         unsigned long flags;
         int retcode;
-        int tx_work, rx_work;
+        int rx_count, tx_work=0, rx_work=0;
 
-        if (!nv_optimized(np)) {
-                spin_lock_irqsave(&np->lock, flags);
-                tx_work = nv_tx_done(dev, np->tx_ring_size);
-                spin_unlock_irqrestore(&np->lock, flags);
+        do {
+                if (!nv_optimized(np)) {
+                        spin_lock_irqsave(&np->lock, flags);
+                        tx_work += nv_tx_done(dev, np->tx_ring_size);
+                        spin_unlock_irqrestore(&np->lock, flags);
 
-                rx_work = nv_rx_process(dev, budget);
-                retcode = nv_alloc_rx(dev);
-        } else {
-                spin_lock_irqsave(&np->lock, flags);
-                tx_work = nv_tx_done_optimized(dev, np->tx_ring_size);
-                spin_unlock_irqrestore(&np->lock, flags);
+                        rx_count = nv_rx_process(dev, budget - rx_work);
+                        retcode = nv_alloc_rx(dev);
+                } else {
+                        spin_lock_irqsave(&np->lock, flags);
+                        tx_work += nv_tx_done_optimized(dev, np->tx_ring_size);
+                        spin_unlock_irqrestore(&np->lock, flags);
 
-                rx_work = nv_rx_process_optimized(dev, budget);
-                retcode = nv_alloc_rx_optimized(dev);
-        }
+                        rx_count = nv_rx_process_optimized(dev,
+                            budget - rx_work);
+                        retcode = nv_alloc_rx_optimized(dev);
+                }
+        } while (retcode == 0 &&
+                 rx_count > 0 && (rx_work += rx_count) < budget);
 
         if (retcode) {
                 spin_lock_irqsave(&np->lock, flags);
@@ -3802,7 +3619,6 @@ static int nv_napi_poll(struct napi_struct *napi, int budget)
         }
         return rx_work;
 }
-#endif
 
 static irqreturn_t nv_nic_irq_rx(int foo, void *data)
 {
@@ -5708,6 +5524,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 np->txrxctl_bits |= NVREG_TXRXCTL_RXCHECK;
                 dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
                 dev->features |= NETIF_F_TSO;
+                dev->features |= NETIF_F_GRO;
         }
 
         np->vlanctl_bits = 0;
@@ -5760,9 +5577,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
         else
                 dev->netdev_ops = &nv_netdev_ops_optimized;
 
-#ifdef CONFIG_FORCEDETH_NAPI
         netif_napi_add(dev, &np->napi, nv_napi_poll, RX_WORK_PER_LOOP);
-#endif
         SET_ETHTOOL_OPS(dev, &ops);
         dev->watchdog_timeo = NV_WATCHDOG_TIMEO;
 
@@ -5865,7 +5680,7 @@ static int __devinit nv_probe(struct pci_dev *pci_dev, const struct pci_device_i
                 /* msix has had reported issues when modifying irqmask
                    as in the case of napi, therefore, disable for now
                 */
-#ifndef CONFIG_FORCEDETH_NAPI
+#if 0
                 np->msi_flags |= NV_MSI_X_CAPABLE;
 #endif
         }
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
         struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
 
         /*
          * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                 return &enet_regs->tbipa;
         } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                         of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
+                return of_iomap(np, 1);
         } else
                 return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         u32 __iomem *tbipa;
         struct mii_bus *new_bus;
         int tbiaddr = -1;
+        const u32 *addrp;
         u64 addr = 0, size = 0;
         int err = 0;
 
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
         new_bus->priv = priv;
         fsl_pq_mdio_bus_name(new_bus->id, np);
 
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
+
         map = ioremap(addr, size);
         if (!map) {
                 err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 032073d1e3d2..5267c27e3174 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -558,12 +558,8 @@ static int gfar_parse_group(struct device_node *np,
                 struct gfar_private *priv, const char *model)
 {
         u32 *queue_mask;
-        u64 addr, size;
-
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
 
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
         if (!priv->gfargrp[priv->num_grps].regs)
                 return -ENOMEM;
 
@@ -1571,9 +1567,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                 tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                 gfar_write(&regs->dmactrl, tempval);
 
-                while (!(gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
-                        cpu_relax();
+                spin_event_timeout(((gfar_read(&regs->ievent) &
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
         }
 }
 
diff --git a/drivers/net/igb/e1000_defines.h b/drivers/net/igb/e1000_defines.h
index 31d24e0e76de..24d9be64342f 100644
--- a/drivers/net/igb/e1000_defines.h
+++ b/drivers/net/igb/e1000_defines.h
@@ -610,11 +610,7 @@
 #define IGP_LED3_MODE           0x07000000
 
 /* PCI/PCI-X/PCI-EX Config space */
-#define PCIE_LINK_STATUS             0x12
 #define PCIE_DEVICE_CONTROL2         0x28
-
-#define PCIE_LINK_WIDTH_MASK         0x3F0
-#define PCIE_LINK_WIDTH_SHIFT        4
 #define PCIE_DEVICE_CONTROL2_16ms    0x0005
 
 #define PHY_REVISION_MASK      0xFFFFFFF0
diff --git a/drivers/net/igb/e1000_mac.c b/drivers/net/igb/e1000_mac.c
index be8d010e4021..90c5e01e9235 100644
--- a/drivers/net/igb/e1000_mac.c
+++ b/drivers/net/igb/e1000_mac.c
@@ -53,17 +53,30 @@ s32 igb_get_bus_info_pcie(struct e1000_hw *hw)
         u16 pcie_link_status;
 
         bus->type = e1000_bus_type_pci_express;
-        bus->speed = e1000_bus_speed_2500;
 
         ret_val = igb_read_pcie_cap_reg(hw,
-                                          PCIE_LINK_STATUS,
-                                          &pcie_link_status);
-        if (ret_val)
+                                        PCI_EXP_LNKSTA,
+                                        &pcie_link_status);
+        if (ret_val) {
                 bus->width = e1000_bus_width_unknown;
-        else
+                bus->speed = e1000_bus_speed_unknown;
+        } else {
+                switch (pcie_link_status & PCI_EXP_LNKSTA_CLS) {
+                case PCI_EXP_LNKSTA_CLS_2_5GB:
+                        bus->speed = e1000_bus_speed_2500;
+                        break;
+                case PCI_EXP_LNKSTA_CLS_5_0GB:
+                        bus->speed = e1000_bus_speed_5000;
+                        break;
+                default:
+                        bus->speed = e1000_bus_speed_unknown;
+                        break;
+                }
+
                 bus->width = (enum e1000_bus_width)((pcie_link_status &
-                                                     PCIE_LINK_WIDTH_MASK) >>
-                                                     PCIE_LINK_WIDTH_SHIFT);
+                                                     PCI_EXP_LNKSTA_NLW) >>
+                                                     PCI_EXP_LNKSTA_NLW_SHIFT);
+        }
 
         reg = rd32(E1000_STATUS);
         bus->func = (reg & E1000_STATUS_FUNC_MASK) >> E1000_STATUS_FUNC_SHIFT;
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 7d288ccca1ca..6e63d9a7fc75 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -141,8 +141,10 @@ struct igb_buffer {
                         unsigned long time_stamp;
                         u16 length;
                         u16 next_to_watch;
-                        u16 mapped_as_page;
+                        unsigned int bytecount;
                         u16 gso_segs;
+                        union skb_shared_tx shtx;
+                        u8 mapped_as_page;
                 };
                 /* RX */
                 struct {
@@ -186,7 +188,7 @@ struct igb_q_vector {
 struct igb_ring {
         struct igb_q_vector *q_vector; /* backlink to q_vector */
         struct net_device *netdev;     /* back pointer to net_device */
-        struct pci_dev *pdev;          /* pci device for dma mapping */
+        struct device *dev;            /* device pointer for dma mapping */
         dma_addr_t dma;                /* phys address of the ring */
         void *desc;                    /* descriptor ring memory */
         unsigned int size;             /* length of desc. ring in bytes */
@@ -338,7 +340,6 @@ enum igb_boards {
 extern char igb_driver_name[];
 extern char igb_driver_version[];
 
-extern char *igb_get_hw_dev_name(struct e1000_hw *hw);
 extern int igb_up(struct igb_adapter *);
 extern void igb_down(struct igb_adapter *);
 extern void igb_reinit_locked(struct igb_adapter *);
diff --git a/drivers/net/igb/igb_ethtool.c b/drivers/net/igb/igb_ethtool.c
index 1b8fd7f4064d..f2ebf927e4bc 100644
--- a/drivers/net/igb/igb_ethtool.c
+++ b/drivers/net/igb/igb_ethtool.c
@@ -1394,7 +1394,7 @@ static int igb_setup_desc_rings(struct igb_adapter *adapter)
 
         /* Setup Tx descriptor ring and Tx buffers */
         tx_ring->count = IGB_DEFAULT_TXD;
-        tx_ring->pdev = adapter->pdev;
+        tx_ring->dev = &adapter->pdev->dev;
         tx_ring->netdev = adapter->netdev;
         tx_ring->reg_idx = adapter->vfs_allocated_count;
 
@@ -1408,7 +1408,7 @@ static int igb_setup_desc_rings(struct igb_adapter *adapter)
 
         /* Setup Rx descriptor ring and Rx buffers */
         rx_ring->count = IGB_DEFAULT_RXD;
-        rx_ring->pdev = adapter->pdev;
+        rx_ring->dev = &adapter->pdev->dev;
         rx_ring->netdev = adapter->netdev;
         rx_ring->rx_buffer_len = IGB_RXBUFFER_2048;
         rx_ring->reg_idx = adapter->vfs_allocated_count;
@@ -1604,10 +1604,10 @@ static int igb_clean_test_rings(struct igb_ring *rx_ring,
                 buffer_info = &rx_ring->buffer_info[rx_ntc];
 
                 /* unmap rx buffer, will be remapped by alloc_rx_buffers */
-                pci_unmap_single(rx_ring->pdev,
+                dma_unmap_single(rx_ring->dev,
                                  buffer_info->dma,
                                  rx_ring->rx_buffer_len,
-                                 PCI_DMA_FROMDEVICE);
+                                 DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 /* verify contents of skb */
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index c19b1e0caecd..589cf4a6427a 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -201,6 +201,336 @@ MODULE_DESCRIPTION("Intel(R) Gigabit Ethernet Network Driver");
 MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
+struct igb_reg_info {
+        u32 ofs;
+        char *name;
+};
+
+static const struct igb_reg_info igb_reg_info_tbl[] = {
+
+        /* General Registers */
+        {E1000_CTRL, "CTRL"},
+        {E1000_STATUS, "STATUS"},
+        {E1000_CTRL_EXT, "CTRL_EXT"},
+
+        /* Interrupt Registers */
+        {E1000_ICR, "ICR"},
+
+        /* RX Registers */
+        {E1000_RCTL, "RCTL"},
+        {E1000_RDLEN(0), "RDLEN"},
+        {E1000_RDH(0), "RDH"},
+        {E1000_RDT(0), "RDT"},
+        {E1000_RXDCTL(0), "RXDCTL"},
+        {E1000_RDBAL(0), "RDBAL"},
+        {E1000_RDBAH(0), "RDBAH"},
+
+        /* TX Registers */
+        {E1000_TCTL, "TCTL"},
+        {E1000_TDBAL(0), "TDBAL"},
+        {E1000_TDBAH(0), "TDBAH"},
+        {E1000_TDLEN(0), "TDLEN"},
+        {E1000_TDH(0), "TDH"},
+        {E1000_TDT(0), "TDT"},
+        {E1000_TXDCTL(0), "TXDCTL"},
+        {E1000_TDFH, "TDFH"},
+        {E1000_TDFT, "TDFT"},
+        {E1000_TDFHS, "TDFHS"},
+        {E1000_TDFPC, "TDFPC"},
+
+        /* List Terminator */
+        {}
+};
+
+/*
+ * igb_regdump - register printout routine
+ */
+static void igb_regdump(struct e1000_hw *hw, struct igb_reg_info *reginfo)
+{
+        int n = 0;
+        char rname[16];
+        u32 regs[8];
+
+        switch (reginfo->ofs) {
+        case E1000_RDLEN(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDLEN(n));
+                break;
+        case E1000_RDH(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDH(n));
+                break;
+        case E1000_RDT(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDT(n));
+                break;
+        case E1000_RXDCTL(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RXDCTL(n));
+                break;
+        case E1000_RDBAL(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDBAL(n));
+                break;
+        case E1000_RDBAH(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDBAH(n));
+                break;
+        case E1000_TDBAL(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_RDBAL(n));
+                break;
+        case E1000_TDBAH(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_TDBAH(n));
+                break;
+        case E1000_TDLEN(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_TDLEN(n));
+                break;
+        case E1000_TDH(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_TDH(n));
+                break;
+        case E1000_TDT(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_TDT(n));
+                break;
+        case E1000_TXDCTL(0):
+                for (n = 0; n < 4; n++)
+                        regs[n] = rd32(E1000_TXDCTL(n));
+                break;
+        default:
+                printk(KERN_INFO "%-15s %08x\n",
+                        reginfo->name, rd32(reginfo->ofs));
+                return;
+        }
+
+        snprintf(rname, 16, "%s%s", reginfo->name, "[0-3]");
+        printk(KERN_INFO "%-15s ", rname);
+        for (n = 0; n < 4; n++)
+                printk(KERN_CONT "%08x ", regs[n]);
+        printk(KERN_CONT "\n");
+}
+
+/*
+ * igb_dump - Print registers, tx-rings and rx-rings
+ */
+static void igb_dump(struct igb_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct e1000_hw *hw = &adapter->hw;
+        struct igb_reg_info *reginfo;
+        int n = 0;
+        struct igb_ring *tx_ring;
+        union e1000_adv_tx_desc *tx_desc;
+        struct my_u0 { u64 a; u64 b; } *u0;
+        struct igb_buffer *buffer_info;
+        struct igb_ring *rx_ring;
+        union e1000_adv_rx_desc *rx_desc;
+        u32 staterr;
+        int i = 0;
+
+        if (!netif_msg_hw(adapter))
+                return;
+
+        /* Print netdevice Info */
+        if (netdev) {
+                dev_info(&adapter->pdev->dev, "Net device Info\n");
+                printk(KERN_INFO "Device Name     state            "
+                        "trans_start      last_rx\n");
+                printk(KERN_INFO "%-15s %016lX %016lX %016lX\n",
+                netdev->name,
+                netdev->state,
+                netdev->trans_start,
+                netdev->last_rx);
+        }
+
+        /* Print Registers */
+        dev_info(&adapter->pdev->dev, "Register Dump\n");
+        printk(KERN_INFO " Register Name   Value\n");
+        for (reginfo = (struct igb_reg_info *)igb_reg_info_tbl;
+             reginfo->name; reginfo++) {
+                igb_regdump(hw, reginfo);
+        }
+
+        /* Print TX Ring Summary */
+        if (!netdev || !netif_running(netdev))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC] [bi(ntc)->dma  ]"
+                " leng ntw timestamp\n");
+        for (n = 0; n < adapter->num_tx_queues; n++) {
+                tx_ring = adapter->tx_ring[n];
+                buffer_info = &tx_ring->buffer_info[tx_ring->next_to_clean];
+                printk(KERN_INFO " %5d %5X %5X %016llX %04X %3X %016llX\n",
+                           n, tx_ring->next_to_use, tx_ring->next_to_clean,
+                           (u64)buffer_info->dma,
+                           buffer_info->length,
+                           buffer_info->next_to_watch,
+                           (u64)buffer_info->time_stamp);
+        }
+
+        /* Print TX Rings */
+        if (!netif_msg_tx_done(adapter))
+                goto rx_ring_summary;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Dump\n");
+
+        /* Transmit Descriptor Formats
+         *
+         * Advanced Transmit Descriptor
+         *   +--------------------------------------------------------------+
+         * 0 |         Buffer Address [63:0]                                |
+         *   +--------------------------------------------------------------+
+         * 8 | PAYLEN  | PORTS  |CC|IDX | STA | DCMD  |DTYP|MAC|RSV| DTALEN |
+         *   +--------------------------------------------------------------+
+         *   63      46 45    40 39 38 36 35 32 31   24             15       0
+         */
+
+        for (n = 0; n < adapter->num_tx_queues; n++) {
+                tx_ring = adapter->tx_ring[n];
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "TX QUEUE INDEX = %d\n", tx_ring->queue_index);
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "T [desc]     [address 63:0  ] "
+                        "[PlPOCIStDDM Ln] [bi->dma       ] "
+                        "leng  ntw timestamp        bi->skb\n");
+
+                for (i = 0; tx_ring->desc && (i < tx_ring->count); i++) {
+                        tx_desc = E1000_TX_DESC_ADV(*tx_ring, i);
+                        buffer_info = &tx_ring->buffer_info[i];
+                        u0 = (struct my_u0 *)tx_desc;
+                        printk(KERN_INFO "T [0x%03X]    %016llX %016llX %016llX"
+                                " %04X  %3X %016llX %p", i,
+                                le64_to_cpu(u0->a),
+                                le64_to_cpu(u0->b),
+                                (u64)buffer_info->dma,
+                                buffer_info->length,
+                                buffer_info->next_to_watch,
+                                (u64)buffer_info->time_stamp,
+                                buffer_info->skb);
+                        if (i == tx_ring->next_to_use &&
+                                i == tx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC/U\n");
+                        else if (i == tx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == tx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+
+                        if (netif_msg_pktdata(adapter) && buffer_info->dma != 0)
+                                print_hex_dump(KERN_INFO, "",
+                                        DUMP_PREFIX_ADDRESS,
+                                        16, 1, phys_to_virt(buffer_info->dma),
+                                        buffer_info->length, true);
+                }
+        }
+
+        /* Print RX Rings Summary */
+rx_ring_summary:
+        dev_info(&adapter->pdev->dev, "RX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC]\n");
+        for (n = 0; n < adapter->num_rx_queues; n++) {
+                rx_ring = adapter->rx_ring[n];
+                printk(KERN_INFO " %5d %5X %5X\n", n,
+                           rx_ring->next_to_use, rx_ring->next_to_clean);
+        }
+
+        /* Print RX Rings */
+        if (!netif_msg_rx_status(adapter))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "RX Rings Dump\n");
+
+        /* Advanced Receive Descriptor (Read) Format
+         *    63                                           1        0
+         *    +-----------------------------------------------------+
+         *  0 |       Packet Buffer Address [63:1]           |A0/NSE|
+         *    +----------------------------------------------+------+
+         *  8 |       Header Buffer Address [63:1]           |  DD  |
+         *    +-----------------------------------------------------+
+         *
+         *
+         * Advanced Receive Descriptor (Write-Back) Format
+         *
+         *   63       48 47    32 31  30      21 20 17 16   4 3     0
+         *   +------------------------------------------------------+
+         * 0 | Packet     IP     |SPH| HDR_LEN   | RSV|Packet|  RSS |
+         *   | Checksum   Ident  |   |           |    | Type | Type |
+         *   +------------------------------------------------------+
+         * 8 | VLAN Tag | Length | Extended Error | Extended Status |
+         *   +------------------------------------------------------+
+         *   63       48 47    32 31            20 19               0
+         */
+
+        for (n = 0; n < adapter->num_rx_queues; n++) {
+                rx_ring = adapter->rx_ring[n];
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "RX QUEUE INDEX = %d\n", rx_ring->queue_index);
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "R  [desc]      [ PktBuf     A0] "
+                        "[  HeadBuf   DD] [bi->dma       ] [bi->skb] "
+                        "<-- Adv Rx Read format\n");
+                printk(KERN_INFO "RWB[desc]      [PcsmIpSHl PtRs] "
+                        "[vl er S cks ln] ---------------- [bi->skb] "
+                        "<-- Adv Rx Write-Back format\n");
+
+                for (i = 0; i < rx_ring->count; i++) {
+                        buffer_info = &rx_ring->buffer_info[i];
+                        rx_desc = E1000_RX_DESC_ADV(*rx_ring, i);
+                        u0 = (struct my_u0 *)rx_desc;
+                        staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
+                        if (staterr & E1000_RXD_STAT_DD) {
+                                /* Descriptor Done */
+                                printk(KERN_INFO "RWB[0x%03X]     %016llX "
+                                        "%016llX ---------------- %p", i,
+                                        le64_to_cpu(u0->a),
+                                        le64_to_cpu(u0->b),
+                                        buffer_info->skb);
+                        } else {
+                                printk(KERN_INFO "R  [0x%03X]     %016llX "
+                                        "%016llX %016llX %p", i,
+                                        le64_to_cpu(u0->a),
+                                        le64_to_cpu(u0->b),
+                                        (u64)buffer_info->dma,
+                                        buffer_info->skb);
+
+                                if (netif_msg_pktdata(adapter)) {
+                                        print_hex_dump(KERN_INFO, "",
+                                                DUMP_PREFIX_ADDRESS,
+                                                16, 1,
+                                                phys_to_virt(buffer_info->dma),
+                                                rx_ring->rx_buffer_len, true);
+                                        if (rx_ring->rx_buffer_len
+                                                < IGB_RXBUFFER_1024)
+                                                print_hex_dump(KERN_INFO, "",
+                                                  DUMP_PREFIX_ADDRESS,
+                                                  16, 1,
+                                                  phys_to_virt(
+                                                    buffer_info->page_dma +
+                                                    buffer_info->page_offset),
+                                                  PAGE_SIZE/2, true);
+                                }
+                        }
+
+                        if (i == rx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == rx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+
+                }
+        }
+
+exit:
+        return;
+}
+
+
 /**
  * igb_read_clock - read raw cycle counter (to be used by time counter)
  */
@@ -350,7 +680,7 @@ static int igb_alloc_queues(struct igb_adapter *adapter)
                         goto err;
                 ring->count = adapter->tx_ring_count;
                 ring->queue_index = i;
-                ring->pdev = adapter->pdev;
+                ring->dev = &adapter->pdev->dev;
                 ring->netdev = adapter->netdev;
                 /* For 82575, context index must be unique per ring. */
                 if (adapter->hw.mac.type == e1000_82575)
@@ -364,7 +694,7 @@ static int igb_alloc_queues(struct igb_adapter *adapter)
                         goto err;
                 ring->count = adapter->rx_ring_count;
                 ring->queue_index = i;
-                ring->pdev = adapter->pdev;
+                ring->dev = &adapter->pdev->dev;
                 ring->netdev = adapter->netdev;
                 ring->rx_buffer_len = MAXIMUM_ETHERNET_VLAN_SIZE;
                 ring->flags = IGB_RING_FLAG_RX_CSUM; /* enable rx checksum */
@@ -1398,15 +1728,15 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                 return err;
 
         pci_using_dac = 0;
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+        err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         if (!err) {
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
                 if (!err)
                         pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(32));
                         if (err) {
                                 dev_err(&pdev->dev, "No usable DMA "
                                         "configuration, aborting\n");
@@ -1638,6 +1968,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
         dev_info(&pdev->dev, "%s: (PCIe:%s:%s) %pM\n",
                  netdev->name,
                  ((hw->bus.speed == e1000_bus_speed_2500) ? "2.5Gb/s" :
+                  (hw->bus.speed == e1000_bus_speed_5000) ? "5.0Gb/s" :
                                                             "unknown"),
                  ((hw->bus.width == e1000_bus_width_pcie_x4) ? "Width x4" :
                   (hw->bus.width == e1000_bus_width_pcie_x2) ? "Width x2" :
@@ -2079,7 +2410,7 @@ static int igb_close(struct net_device *netdev)
  **/
 int igb_setup_tx_resources(struct igb_ring *tx_ring)
 {
-        struct pci_dev *pdev = tx_ring->pdev;
+        struct device *dev = tx_ring->dev;
         int size;
 
         size = sizeof(struct igb_buffer) * tx_ring->count;
@@ -2092,9 +2423,10 @@ int igb_setup_tx_resources(struct igb_ring *tx_ring)
         tx_ring->size = tx_ring->count * sizeof(union e1000_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
 
-        tx_ring->desc = pci_alloc_consistent(pdev,
-                                             tx_ring->size,
-                                             &tx_ring->dma);
+        tx_ring->desc = dma_alloc_coherent(dev,
+                                           tx_ring->size,
+                                           &tx_ring->dma,
+                                           GFP_KERNEL);
 
         if (!tx_ring->desc)
                 goto err;
@@ -2105,7 +2437,7 @@ int igb_setup_tx_resources(struct igb_ring *tx_ring)
 
 err:
         vfree(tx_ring->buffer_info);
-        dev_err(&pdev->dev,
+        dev_err(dev,
                 "Unable to allocate memory for the transmit descriptor ring\n");
         return -ENOMEM;
 }
@@ -2229,7 +2561,7 @@ static void igb_configure_tx(struct igb_adapter *adapter)
  **/
 int igb_setup_rx_resources(struct igb_ring *rx_ring)
 {
-        struct pci_dev *pdev = rx_ring->pdev;
+        struct device *dev = rx_ring->dev;
         int size, desc_len;
 
         size = sizeof(struct igb_buffer) * rx_ring->count;
@@ -2244,8 +2576,10 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
         rx_ring->size = rx_ring->count * desc_len;
         rx_ring->size = ALIGN(rx_ring->size, 4096);
 
-        rx_ring->desc = pci_alloc_consistent(pdev, rx_ring->size,
-                                             &rx_ring->dma);
+        rx_ring->desc = dma_alloc_coherent(dev,
+                                           rx_ring->size,
+                                           &rx_ring->dma,
+                                           GFP_KERNEL);
 
         if (!rx_ring->desc)
                 goto err;
@@ -2258,8 +2592,8 @@ int igb_setup_rx_resources(struct igb_ring *rx_ring)
 err:
         vfree(rx_ring->buffer_info);
         rx_ring->buffer_info = NULL;
-        dev_err(&pdev->dev, "Unable to allocate memory for "
-                "the receive descriptor ring\n");
+        dev_err(dev, "Unable to allocate memory for the receive descriptor"
+                " ring\n");
         return -ENOMEM;
 }
 
@@ -2635,8 +2969,8 @@ void igb_free_tx_resources(struct igb_ring *tx_ring)
         if (!tx_ring->desc)
                 return;
 
-        pci_free_consistent(tx_ring->pdev, tx_ring->size,
-                            tx_ring->desc, tx_ring->dma);
+        dma_free_coherent(tx_ring->dev, tx_ring->size,
+                          tx_ring->desc, tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -2660,15 +2994,15 @@ void igb_unmap_and_free_tx_resource(struct igb_ring *tx_ring,
 {
         if (buffer_info->dma) {
                 if (buffer_info->mapped_as_page)
-                        pci_unmap_page(tx_ring->pdev,
+                        dma_unmap_page(tx_ring->dev,
                                         buffer_info->dma,
                                         buffer_info->length,
-                                        PCI_DMA_TODEVICE);
+                                        DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(tx_ring->pdev,
+                        dma_unmap_single(tx_ring->dev,
                                         buffer_info->dma,
                                         buffer_info->length,
-                                        PCI_DMA_TODEVICE);
+                                        DMA_TO_DEVICE);
                 buffer_info->dma = 0;
         }
         if (buffer_info->skb) {
@@ -2739,8 +3073,8 @@ void igb_free_rx_resources(struct igb_ring *rx_ring)
         if (!rx_ring->desc)
                 return;
 
-        pci_free_consistent(rx_ring->pdev, rx_ring->size,
-                            rx_ring->desc, rx_ring->dma);
+        dma_free_coherent(rx_ring->dev, rx_ring->size,
+                          rx_ring->desc, rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -2776,10 +3110,10 @@ static void igb_clean_rx_ring(struct igb_ring *rx_ring)
         for (i = 0; i < rx_ring->count; i++) {
                 buffer_info = &rx_ring->buffer_info[i];
                 if (buffer_info->dma) {
-                        pci_unmap_single(rx_ring->pdev,
+                        dma_unmap_single(rx_ring->dev,
                                          buffer_info->dma,
                                          rx_ring->rx_buffer_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
                 }
 
@@ -2788,10 +3122,10 @@ static void igb_clean_rx_ring(struct igb_ring *rx_ring)
                         buffer_info->skb = NULL;
                 }
                 if (buffer_info->page_dma) {
-                        pci_unmap_page(rx_ring->pdev,
+                        dma_unmap_page(rx_ring->dev,
                                        buffer_info->page_dma,
                                        PAGE_SIZE / 2,
-                                       PCI_DMA_FROMDEVICE);
+                                       DMA_FROM_DEVICE);
                         buffer_info->page_dma = 0;
                 }
                 if (buffer_info->page) {
@@ -3479,7 +3813,7 @@ static inline bool igb_tx_csum_adv(struct igb_ring *tx_ring,
                                    struct sk_buff *skb, u32 tx_flags)
 {
         struct e1000_adv_tx_context_desc *context_desc;
-        struct pci_dev *pdev = tx_ring->pdev;
+        struct device *dev = tx_ring->dev;
         struct igb_buffer *buffer_info;
         u32 info = 0, tu_cmd = 0;
         unsigned int i;
@@ -3530,7 +3864,7 @@ static inline bool igb_tx_csum_adv(struct igb_ring *tx_ring,
                                 break;
                         default:
                                 if (unlikely(net_ratelimit()))
-                                        dev_warn(&pdev->dev,
+                                        dev_warn(dev,
                                             "partial checksum but proto=%x!\n",
                                             skb->protocol);
                                 break;
@@ -3564,59 +3898,61 @@ static inline int igb_tx_map_adv(struct igb_ring *tx_ring, struct sk_buff *skb,
                                  unsigned int first)
 {
         struct igb_buffer *buffer_info;
-        struct pci_dev *pdev = tx_ring->pdev;
-        unsigned int len = skb_headlen(skb);
+        struct device *dev = tx_ring->dev;
+        unsigned int hlen = skb_headlen(skb);
         unsigned int count = 0, i;
         unsigned int f;
+        u16 gso_segs = skb_shinfo(skb)->gso_segs ?: 1;
 
         i = tx_ring->next_to_use;
 
         buffer_info = &tx_ring->buffer_info[i];
-        BUG_ON(len >= IGB_MAX_DATA_PER_TXD);
-        buffer_info->length = len;
+        BUG_ON(hlen >= IGB_MAX_DATA_PER_TXD);
+        buffer_info->length = hlen;
         /* set time_stamp *before* dma to help avoid a possible race */
         buffer_info->time_stamp = jiffies;
         buffer_info->next_to_watch = i;
-        buffer_info->dma = pci_map_single(pdev, skb->data, len,
-                                          PCI_DMA_TODEVICE);
-        if (pci_dma_mapping_error(pdev, buffer_info->dma))
+        buffer_info->dma = dma_map_single(dev, skb->data, hlen,
+                                          DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, buffer_info->dma))
                 goto dma_error;
 
         for (f = 0; f < skb_shinfo(skb)->nr_frags; f++) {
-                struct skb_frag_struct *frag;
+                struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[f];
+                unsigned int len = frag->size;
 
                 count++;
                 i++;
                 if (i == tx_ring->count)
                         i = 0;
 
-                frag = &skb_shinfo(skb)->frags[f];
-                len = frag->size;
-
                 buffer_info = &tx_ring->buffer_info[i];
                 BUG_ON(len >= IGB_MAX_DATA_PER_TXD);
                 buffer_info->length = len;
                 buffer_info->time_stamp = jiffies;
                 buffer_info->next_to_watch = i;
                 buffer_info->mapped_as_page = true;
-                buffer_info->dma = pci_map_page(pdev,
+                buffer_info->dma = dma_map_page(dev,
                                                 frag->page,
                                                 frag->page_offset,
                                                 len,
-                                                PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                                                DMA_TO_DEVICE);
+                if (dma_mapping_error(dev, buffer_info->dma))
                         goto dma_error;
 
         }
 
         tx_ring->buffer_info[i].skb = skb;
-        tx_ring->buffer_info[i].gso_segs = skb_shinfo(skb)->gso_segs ?: 1;
+        tx_ring->buffer_info[i].shtx = skb_shinfo(skb)->tx_flags;
+        /* multiply data chunks by size of headers */
+        tx_ring->buffer_info[i].bytecount = ((gso_segs - 1) * hlen) + skb->len;
+        tx_ring->buffer_info[i].gso_segs = gso_segs;
         tx_ring->buffer_info[first].next_to_watch = i;
 
         return ++count;
 
 dma_error:
-        dev_err(&pdev->dev, "TX DMA map failed\n");
+        dev_err(dev, "TX DMA map failed\n");
 
         /* clear timestamp and dma mappings for failed buffer_info mapping */
         buffer_info->dma = 0;
@@ -3854,6 +4190,8 @@ static void igb_reset_task(struct work_struct *work)
         struct igb_adapter *adapter;
         adapter = container_of(work, struct igb_adapter, reset_task);
 
+        igb_dump(adapter);
+        netdev_err(adapter->netdev, "Reset adapter\n");
         igb_reinit_locked(adapter);
 }
 
@@ -4952,22 +5290,21 @@ static void igb_systim_to_hwtstamp(struct igb_adapter *adapter,
 /**
  * igb_tx_hwtstamp - utility function which checks for TX time stamp
  * @q_vector: pointer to q_vector containing needed info
- * @skb: packet that was just sent
+ * @buffer: pointer to igb_buffer structure
  *
  * If we were asked to do hardware stamping and such a time stamp is
  * available, then it must have been for this skb here because we only
  * allow only one such packet into the queue.
  */
-static void igb_tx_hwtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb)
+static void igb_tx_hwtstamp(struct igb_q_vector *q_vector, struct igb_buffer *buffer_info)
 {
         struct igb_adapter *adapter = q_vector->adapter;
-        union skb_shared_tx *shtx = skb_tx(skb);
         struct e1000_hw *hw = &adapter->hw;
         struct skb_shared_hwtstamps shhwtstamps;
         u64 regval;
 
         /* if skb does not support hw timestamp or TX stamp not valid exit */
-        if (likely(!shtx->hardware) ||
+        if (likely(!buffer_info->shtx.hardware) ||
             !(rd32(E1000_TSYNCTXCTL) & E1000_TSYNCTXCTL_VALID))
                 return;
 
@@ -4975,7 +5312,7 @@ static void igb_tx_hwtstamp(struct igb_q_vector *q_vector, struct sk_buff *skb)
         regval |= (u64)rd32(E1000_TXSTMPH) << 32;
 
         igb_systim_to_hwtstamp(adapter, &shhwtstamps, regval);
-        skb_tstamp_tx(skb, &shhwtstamps);
+        skb_tstamp_tx(buffer_info->skb, &shhwtstamps);
 }
 
 /**
@@ -4990,7 +5327,6 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
         struct net_device *netdev = tx_ring->netdev;
         struct e1000_hw *hw = &adapter->hw;
         struct igb_buffer *buffer_info;
-        struct sk_buff *skb;
         union e1000_adv_tx_desc *tx_desc, *eop_desc;
         unsigned int total_bytes = 0, total_packets = 0;
         unsigned int i, eop, count = 0;
@@ -5006,19 +5342,12 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
                         tx_desc = E1000_TX_DESC_ADV(*tx_ring, i);
                         buffer_info = &tx_ring->buffer_info[i];
                         cleaned = (i == eop);
-                        skb = buffer_info->skb;
 
-                        if (skb) {
-                                unsigned int segs, bytecount;
+                        if (buffer_info->skb) {
+                                total_bytes += buffer_info->bytecount;
                                 /* gso_segs is currently only valid for tcp */
-                                segs = buffer_info->gso_segs;
-                                /* multiply data chunks by size of headers */
-                                bytecount = ((segs - 1) * skb_headlen(skb)) +
-                                            skb->len;
-                                total_packets += segs;
-                                total_bytes += bytecount;
-
-                                igb_tx_hwtstamp(q_vector, skb);
+                                total_packets += buffer_info->gso_segs;
+                                igb_tx_hwtstamp(q_vector, buffer_info);
                         }
 
                         igb_unmap_and_free_tx_resource(tx_ring, buffer_info);
@@ -5058,7 +5387,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector)
                     !(rd32(E1000_STATUS) & E1000_STATUS_TXOFF)) {
 
                         /* detected Tx unit hang */
-                        dev_err(&tx_ring->pdev->dev,
+                        dev_err(tx_ring->dev,
                                 "Detected Tx Unit Hang\n"
                                 "  Tx Queue             <%d>\n"
                                 "  TDH                  <%x>\n"
@@ -5137,7 +5466,7 @@ static inline void igb_rx_checksum_adv(struct igb_ring *ring,
         if (status_err & (E1000_RXD_STAT_TCPCS | E1000_RXD_STAT_UDPCS))
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 
-        dev_dbg(&ring->pdev->dev, "cksum success: bits %08X\n", status_err);
+        dev_dbg(ring->dev, "cksum success: bits %08X\n", status_err);
 }
 
 static void igb_rx_hwtstamp(struct igb_q_vector *q_vector, u32 staterr,
@@ -5192,7 +5521,7 @@ static bool igb_clean_rx_irq_adv(struct igb_q_vector *q_vector,
 {
         struct igb_ring *rx_ring = q_vector->rx_ring;
         struct net_device *netdev = rx_ring->netdev;
-        struct pci_dev *pdev = rx_ring->pdev;
+        struct device *dev = rx_ring->dev;
         union e1000_adv_rx_desc *rx_desc , *next_rxd;
         struct igb_buffer *buffer_info , *next_buffer;
         struct sk_buff *skb;
@@ -5232,9 +5561,9 @@ static bool igb_clean_rx_irq_adv(struct igb_q_vector *q_vector,
                 cleaned_count++;
 
                 if (buffer_info->dma) {
-                        pci_unmap_single(pdev, buffer_info->dma,
+                        dma_unmap_single(dev, buffer_info->dma,
                                          rx_ring->rx_buffer_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
                         if (rx_ring->rx_buffer_len >= IGB_RXBUFFER_1024) {
                                 skb_put(skb, length);
@@ -5244,11 +5573,11 @@ static bool igb_clean_rx_irq_adv(struct igb_q_vector *q_vector,
                 }
 
                 if (length) {
-                        pci_unmap_page(pdev, buffer_info->page_dma,
-                                       PAGE_SIZE / 2, PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(dev, buffer_info->page_dma,
+                                       PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         buffer_info->page_dma = 0;
 
-                        skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags++,
+                        skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
                                                 buffer_info->page,
                                                 buffer_info->page_offset,
                                                 length);
@@ -5353,12 +5682,12 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                                 buffer_info->page_offset ^= PAGE_SIZE / 2;
                         }
                         buffer_info->page_dma =
-                                pci_map_page(rx_ring->pdev, buffer_info->page,
+                                dma_map_page(rx_ring->dev, buffer_info->page,
                                              buffer_info->page_offset,
                                              PAGE_SIZE / 2,
-                                             PCI_DMA_FROMDEVICE);
-                        if (pci_dma_mapping_error(rx_ring->pdev,
-                                                  buffer_info->page_dma)) {
+                                             DMA_FROM_DEVICE);
+                        if (dma_mapping_error(rx_ring->dev,
+                                              buffer_info->page_dma)) {
                                 buffer_info->page_dma = 0;
                                 rx_ring->rx_stats.alloc_failed++;
                                 goto no_buffers;
@@ -5376,12 +5705,12 @@ void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring, int cleaned_count)
                         buffer_info->skb = skb;
                 }
                 if (!buffer_info->dma) {
-                        buffer_info->dma = pci_map_single(rx_ring->pdev,
+                        buffer_info->dma = dma_map_single(rx_ring->dev,
                                                           skb->data,
                                                           bufsz,
-                                                          PCI_DMA_FROMDEVICE);
-                        if (pci_dma_mapping_error(rx_ring->pdev,
-                                                  buffer_info->dma)) {
+                                                          DMA_FROM_DEVICE);
+                        if (dma_mapping_error(rx_ring->dev,
+                                              buffer_info->dma)) {
                                 buffer_info->dma = 0;
                                 rx_ring->rx_stats.alloc_failed++;
                                 goto no_buffers;
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index cc2309027e6a..7012e3da3bdf 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -164,10 +164,10 @@ static void igbvf_alloc_rx_buffers(struct igbvf_ring *rx_ring,
                                 buffer_info->page_offset ^= PAGE_SIZE / 2;
                         }
                         buffer_info->page_dma =
-                                pci_map_page(pdev, buffer_info->page,
+                                dma_map_page(&pdev->dev, buffer_info->page,
                                              buffer_info->page_offset,
                                              PAGE_SIZE / 2,
-                                             PCI_DMA_FROMDEVICE);
+                                             DMA_FROM_DEVICE);
                 }
 
                 if (!buffer_info->skb) {
@@ -178,9 +178,9 @@ static void igbvf_alloc_rx_buffers(struct igbvf_ring *rx_ring,
                         }
 
                         buffer_info->skb = skb;
-                        buffer_info->dma = pci_map_single(pdev, skb->data,
+                        buffer_info->dma = dma_map_single(&pdev->dev, skb->data,
                                                           bufsz,
-                                                          PCI_DMA_FROMDEVICE);
+                                                          DMA_FROM_DEVICE);
                 }
                 /* Refresh the desc even if buffer_addrs didn't change because
                  * each write-back erases this info. */
@@ -268,28 +268,28 @@ static bool igbvf_clean_rx_irq(struct igbvf_adapter *adapter,
                 prefetch(skb->data - NET_IP_ALIGN);
                 buffer_info->skb = NULL;
                 if (!adapter->rx_ps_hdr_size) {
-                        pci_unmap_single(pdev, buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, buffer_info->dma,
                                          adapter->rx_buffer_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
                         skb_put(skb, length);
                         goto send_up;
                 }
 
                 if (!skb_shinfo(skb)->nr_frags) {
-                        pci_unmap_single(pdev, buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, buffer_info->dma,
                                          adapter->rx_ps_hdr_size,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         skb_put(skb, hlen);
                 }
 
                 if (length) {
-                        pci_unmap_page(pdev, buffer_info->page_dma,
+                        dma_unmap_page(&pdev->dev, buffer_info->page_dma,
                                        PAGE_SIZE / 2,
-                                       PCI_DMA_FROMDEVICE);
+                                       DMA_FROM_DEVICE);
                         buffer_info->page_dma = 0;
 
-                        skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags++,
+                        skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
                                            buffer_info->page,
                                            buffer_info->page_offset,
                                            length);
@@ -369,15 +369,15 @@ static void igbvf_put_txbuf(struct igbvf_adapter *adapter,
 {
         if (buffer_info->dma) {
                 if (buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev,
+                        dma_unmap_page(&adapter->pdev->dev,
                                        buffer_info->dma,
                                        buffer_info->length,
-                                       PCI_DMA_TODEVICE);
+                                       DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev,
+                        dma_unmap_single(&adapter->pdev->dev,
                                          buffer_info->dma,
                                          buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                                         DMA_TO_DEVICE);
                 buffer_info->dma = 0;
         }
         if (buffer_info->skb) {
@@ -438,8 +438,8 @@ int igbvf_setup_tx_resources(struct igbvf_adapter *adapter,
         tx_ring->size = tx_ring->count * sizeof(union e1000_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
 
-        tx_ring->desc = pci_alloc_consistent(pdev, tx_ring->size,
-                                             &tx_ring->dma);
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
 
         if (!tx_ring->desc)
                 goto err;
@@ -480,8 +480,8 @@ int igbvf_setup_rx_resources(struct igbvf_adapter *adapter,
         rx_ring->size = rx_ring->count * desc_len;
         rx_ring->size = ALIGN(rx_ring->size, 4096);
 
-        rx_ring->desc = pci_alloc_consistent(pdev, rx_ring->size,
-                                             &rx_ring->dma);
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
 
         if (!rx_ring->desc)
                 goto err;
@@ -549,7 +549,8 @@ void igbvf_free_tx_resources(struct igbvf_ring *tx_ring)
         vfree(tx_ring->buffer_info);
         tx_ring->buffer_info = NULL;
 
-        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
+                          tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -574,13 +575,13 @@ static void igbvf_clean_rx_ring(struct igbvf_ring *rx_ring)
                 buffer_info = &rx_ring->buffer_info[i];
                 if (buffer_info->dma) {
                         if (adapter->rx_ps_hdr_size){
-                                pci_unmap_single(pdev, buffer_info->dma,
+                                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                                  adapter->rx_ps_hdr_size,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         } else {
-                                pci_unmap_single(pdev, buffer_info->dma,
+                                dma_unmap_single(&pdev->dev, buffer_info->dma,
                                                  adapter->rx_buffer_len,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         }
                         buffer_info->dma = 0;
                 }
@@ -592,9 +593,10 @@ static void igbvf_clean_rx_ring(struct igbvf_ring *rx_ring)
 
                 if (buffer_info->page) {
                         if (buffer_info->page_dma)
-                                pci_unmap_page(pdev, buffer_info->page_dma,
+                                dma_unmap_page(&pdev->dev,
+                                               buffer_info->page_dma,
                                                PAGE_SIZE / 2,
-                                               PCI_DMA_FROMDEVICE);
+                                               DMA_FROM_DEVICE);
                         put_page(buffer_info->page);
                         buffer_info->page = NULL;
                         buffer_info->page_dma = 0;
@@ -2104,9 +2106,9 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
         buffer_info->time_stamp = jiffies;
         buffer_info->next_to_watch = i;
         buffer_info->mapped_as_page = false;
-        buffer_info->dma = pci_map_single(pdev, skb->data, len,
-                                          PCI_DMA_TODEVICE);
-        if (pci_dma_mapping_error(pdev, buffer_info->dma))
+        buffer_info->dma = dma_map_single(&pdev->dev, skb->data, len,
+                                          DMA_TO_DEVICE);
+        if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                 goto dma_error;
 
 
@@ -2127,12 +2129,12 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
                 buffer_info->time_stamp = jiffies;
                 buffer_info->next_to_watch = i;
                 buffer_info->mapped_as_page = true;
-                buffer_info->dma = pci_map_page(pdev,
+                buffer_info->dma = dma_map_page(&pdev->dev,
                                                 frag->page,
                                                 frag->page_offset,
                                                 len,
-                                                PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                                                DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                         goto dma_error;
         }
 
@@ -2644,16 +2646,16 @@ static int __devinit igbvf_probe(struct pci_dev *pdev,
                 return err;
 
         pci_using_dac = 0;
-        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
+        err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
         if (!err) {
-                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
+                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
                 if (!err)
                         pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev,
-                                                          DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
                         if (err) {
                                 dev_err(&pdev->dev, "No usable DMA "
                                         "configuration, aborting\n");
diff --git a/drivers/net/ixgb/ixgb.h b/drivers/net/ixgb/ixgb.h
index 92d2e71d0c8b..521c0c732998 100644
--- a/drivers/net/ixgb/ixgb.h
+++ b/drivers/net/ixgb/ixgb.h
@@ -78,9 +78,13 @@ struct ixgb_adapter;
 #define PFX "ixgb: "
 
 #ifdef _DEBUG_DRIVER_
-#define IXGB_DBG(args...) printk(KERN_DEBUG PFX args)
+#define IXGB_DBG(fmt, args...) printk(KERN_DEBUG PFX fmt, ##args)
 #else
-#define IXGB_DBG(args...)
+#define IXGB_DBG(fmt, args...)                          \
+do {                                                    \
+        if (0)                                          \
+                printk(KERN_DEBUG PFX fmt, ##args);     \
+} while (0)
 #endif
 
 /* TX/RX descriptor defines */
diff --git a/drivers/net/ixgb/ixgb_ee.c b/drivers/net/ixgb/ixgb_ee.c
index 89ffa7264a12..06303a36aaf7 100644
--- a/drivers/net/ixgb/ixgb_ee.c
+++ b/drivers/net/ixgb/ixgb_ee.c
@@ -26,6 +26,8 @@
 
 *******************************************************************************/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include "ixgb_hw.h"
 #include "ixgb_ee.h"
 /* Local prototypes */
@@ -467,11 +469,11 @@ ixgb_get_eeprom_data(struct ixgb_hw *hw)
         u16 checksum = 0;
         struct ixgb_ee_map_type *ee_map;
 
-        DEBUGFUNC("ixgb_get_eeprom_data");
+        ENTER();
 
         ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
 
-        DEBUGOUT("ixgb_ee: Reading eeprom data\n");
+        pr_debug("Reading eeprom data\n");
         for (i = 0; i < IXGB_EEPROM_SIZE ; i++) {
                 u16 ee_data;
                 ee_data = ixgb_read_eeprom(hw, i);
@@ -480,7 +482,7 @@ ixgb_get_eeprom_data(struct ixgb_hw *hw)
         }
 
         if (checksum != (u16) EEPROM_SUM) {
-                DEBUGOUT("ixgb_ee: Checksum invalid.\n");
+                pr_debug("Checksum invalid\n");
                 /* clear the init_ctrl_reg_1 to signify that the cache is
                  * invalidated */
                 ee_map->init_ctrl_reg_1 = cpu_to_le16(EEPROM_ICW1_SIGNATURE_CLEAR);
@@ -489,7 +491,7 @@ ixgb_get_eeprom_data(struct ixgb_hw *hw)
 
         if ((ee_map->init_ctrl_reg_1 & cpu_to_le16(EEPROM_ICW1_SIGNATURE_MASK))
                  != cpu_to_le16(EEPROM_ICW1_SIGNATURE_VALID)) {
-                DEBUGOUT("ixgb_ee: Signature invalid.\n");
+                pr_debug("Signature invalid\n");
                 return(false);
         }
 
@@ -555,13 +557,13 @@ ixgb_get_ee_mac_addr(struct ixgb_hw *hw,
         int i;
         struct ixgb_ee_map_type *ee_map = (struct ixgb_ee_map_type *)hw->eeprom;
 
-        DEBUGFUNC("ixgb_get_ee_mac_addr");
+        ENTER();
 
         if (ixgb_check_and_get_eeprom_data(hw) == true) {
                 for (i = 0; i < IXGB_ETH_LENGTH_OF_ADDRESS; i++) {
                         mac_addr[i] = ee_map->mac_addr[i];
-                        DEBUGOUT2("mac(%d) = %.2X\n", i, mac_addr[i]);
                 }
+                pr_debug("eeprom mac address = %pM\n", mac_addr);
         }
 }
 
diff --git a/drivers/net/ixgb/ixgb_hw.c b/drivers/net/ixgb/ixgb_hw.c
index ff67a84e6802..cd247b8d2b73 100644
--- a/drivers/net/ixgb/ixgb_hw.c
+++ b/drivers/net/ixgb/ixgb_hw.c
@@ -30,9 +30,13 @@
  * Shared functions for accessing and configuring the adapter
  */
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include "ixgb_hw.h"
 #include "ixgb_ids.h"
 
+#include <linux/etherdevice.h>
+
 /*  Local function prototypes */
 
 static u32 ixgb_hash_mc_addr(struct ixgb_hw *hw, u8 * mc_addr);
@@ -120,13 +124,13 @@ ixgb_adapter_stop(struct ixgb_hw *hw)
         u32 ctrl_reg;
         u32 icr_reg;
 
-        DEBUGFUNC("ixgb_adapter_stop");
+        ENTER();
 
         /* If we are stopped or resetting exit gracefully and wait to be
          * started again before accessing the hardware.
          */
         if (hw->adapter_stopped) {
-                DEBUGOUT("Exiting because the adapter is already stopped!!!\n");
+                pr_debug("Exiting because the adapter is already stopped!!!\n");
                 return false;
         }
 
@@ -136,7 +140,7 @@ ixgb_adapter_stop(struct ixgb_hw *hw)
         hw->adapter_stopped = true;
 
         /* Clear interrupt mask to stop board from generating interrupts */
-        DEBUGOUT("Masking off all interrupts\n");
+        pr_debug("Masking off all interrupts\n");
         IXGB_WRITE_REG(hw, IMC, 0xFFFFFFFF);
 
         /* Disable the Transmit and Receive units.  Then delay to allow
@@ -152,12 +156,12 @@ ixgb_adapter_stop(struct ixgb_hw *hw)
          * the current PCI configuration.  The global reset bit is self-
          * clearing, and should clear within a microsecond.
          */
-        DEBUGOUT("Issuing a global reset to MAC\n");
+        pr_debug("Issuing a global reset to MAC\n");
 
         ctrl_reg = ixgb_mac_reset(hw);
 
         /* Clear interrupt mask to stop board from generating interrupts */
-        DEBUGOUT("Masking off all interrupts\n");
+        pr_debug("Masking off all interrupts\n");
         IXGB_WRITE_REG(hw, IMC, 0xffffffff);
 
         /* Clear any pending interrupt events. */
@@ -183,7 +187,7 @@ ixgb_identify_xpak_vendor(struct ixgb_hw *hw)
         u16 vendor_name[5];
         ixgb_xpak_vendor xpak_vendor;
 
-        DEBUGFUNC("ixgb_identify_xpak_vendor");
+        ENTER();
 
         /* Read the first few bytes of the vendor string from the XPAK NVR
          * registers.  These are standard XENPAK/XPAK registers, so all XPAK
@@ -222,12 +226,12 @@ ixgb_identify_phy(struct ixgb_hw *hw)
         ixgb_phy_type phy_type;
         ixgb_xpak_vendor xpak_vendor;
 
-        DEBUGFUNC("ixgb_identify_phy");
+        ENTER();
 
         /* Infer the transceiver/phy type from the device id */
         switch (hw->device_id) {
         case IXGB_DEVICE_ID_82597EX:
-                DEBUGOUT("Identified TXN17401 optics\n");
+                pr_debug("Identified TXN17401 optics\n");
                 phy_type = ixgb_phy_type_txn17401;
                 break;
 
@@ -237,30 +241,30 @@ ixgb_identify_phy(struct ixgb_hw *hw)
                  * type of optics. */
                 xpak_vendor = ixgb_identify_xpak_vendor(hw);
                 if (xpak_vendor == ixgb_xpak_vendor_intel) {
-                        DEBUGOUT("Identified TXN17201 optics\n");
+                        pr_debug("Identified TXN17201 optics\n");
                         phy_type = ixgb_phy_type_txn17201;
                 } else {
-                        DEBUGOUT("Identified G6005 optics\n");
+                        pr_debug("Identified G6005 optics\n");
                         phy_type = ixgb_phy_type_g6005;
                 }
                 break;
         case IXGB_DEVICE_ID_82597EX_LR:
-                DEBUGOUT("Identified G6104 optics\n");
+                pr_debug("Identified G6104 optics\n");
                 phy_type = ixgb_phy_type_g6104;
                 break;
         case IXGB_DEVICE_ID_82597EX_CX4:
-                DEBUGOUT("Identified CX4\n");
+                pr_debug("Identified CX4\n");
                 xpak_vendor = ixgb_identify_xpak_vendor(hw);
                 if (xpak_vendor == ixgb_xpak_vendor_intel) {
-                        DEBUGOUT("Identified TXN17201 optics\n");
+                        pr_debug("Identified TXN17201 optics\n");
                         phy_type = ixgb_phy_type_txn17201;
                 } else {
-                        DEBUGOUT("Identified G6005 optics\n");
+                        pr_debug("Identified G6005 optics\n");
                         phy_type = ixgb_phy_type_g6005;
                 }
                 break;
         default:
-                DEBUGOUT("Unknown physical layer module\n");
+                pr_debug("Unknown physical layer module\n");
                 phy_type = ixgb_phy_type_unknown;
                 break;
         }
@@ -296,18 +300,18 @@ ixgb_init_hw(struct ixgb_hw *hw)
         u32 ctrl_reg;
         bool status;
 
-        DEBUGFUNC("ixgb_init_hw");
+        ENTER();
 
         /* Issue a global reset to the MAC.  This will reset the chip's
          * transmit, receive, DMA, and link units.  It will not effect
          * the current PCI configuration.  The global reset bit is self-
          * clearing, and should clear within a microsecond.
          */
-        DEBUGOUT("Issuing a global reset to MAC\n");
+        pr_debug("Issuing a global reset to MAC\n");
 
         ctrl_reg = ixgb_mac_reset(hw);
 
-        DEBUGOUT("Issuing an EE reset to MAC\n");
+        pr_debug("Issuing an EE reset to MAC\n");
 #ifdef HP_ZX1
         /* Workaround for 82597EX reset errata */
         IXGB_WRITE_REG_IO(hw, CTRL1, IXGB_CTRL1_EE_RST);
@@ -335,7 +339,7 @@ ixgb_init_hw(struct ixgb_hw *hw)
          * If it is not valid, we fail hardware init.
          */
         if (!mac_addr_valid(hw->curr_mac_addr)) {
-                DEBUGOUT("MAC address invalid after ixgb_init_rx_addrs\n");
+                pr_debug("MAC address invalid after ixgb_init_rx_addrs\n");
                 return(false);
         }
 
@@ -346,7 +350,7 @@ ixgb_init_hw(struct ixgb_hw *hw)
         ixgb_get_bus_info(hw);
 
         /* Zero out the Multicast HASH table */
-        DEBUGOUT("Zeroing the MTA\n");
+        pr_debug("Zeroing the MTA\n");
         for (i = 0; i < IXGB_MC_TBL_SIZE; i++)
                 IXGB_WRITE_REG_ARRAY(hw, MTA, i, 0);
 
@@ -379,7 +383,7 @@ ixgb_init_rx_addrs(struct ixgb_hw *hw)
 {
         u32 i;
 
-        DEBUGFUNC("ixgb_init_rx_addrs");
+        ENTER();
 
         /*
          * If the current mac address is valid, assume it is a software override
@@ -391,28 +395,19 @@ ixgb_init_rx_addrs(struct ixgb_hw *hw)
                 /* Get the MAC address from the eeprom for later reference */
                 ixgb_get_ee_mac_addr(hw, hw->curr_mac_addr);
 
-                DEBUGOUT3(" Keeping Permanent MAC Addr =%.2X %.2X %.2X ",
-                          hw->curr_mac_addr[0],
-                          hw->curr_mac_addr[1], hw->curr_mac_addr[2]);
-                DEBUGOUT3("%.2X %.2X %.2X\n",
-                          hw->curr_mac_addr[3],
-                          hw->curr_mac_addr[4], hw->curr_mac_addr[5]);
+                pr_debug("Keeping Permanent MAC Addr = %pM\n",
+                         hw->curr_mac_addr);
         } else {
 
                 /* Setup the receive address. */
-                DEBUGOUT("Overriding MAC Address in RAR[0]\n");
-                DEBUGOUT3(" New MAC Addr =%.2X %.2X %.2X ",
-                          hw->curr_mac_addr[0],
-                          hw->curr_mac_addr[1], hw->curr_mac_addr[2]);
-                DEBUGOUT3("%.2X %.2X %.2X\n",
-                          hw->curr_mac_addr[3],
-                          hw->curr_mac_addr[4], hw->curr_mac_addr[5]);
+                pr_debug("Overriding MAC Address in RAR[0]\n");
+                pr_debug("New MAC Addr = %pM\n", hw->curr_mac_addr);
 
                 ixgb_rar_set(hw, hw->curr_mac_addr, 0);
         }
 
         /* Zero out the other 15 receive addresses. */
-        DEBUGOUT("Clearing RAR[1-15]\n");
+        pr_debug("Clearing RAR[1-15]\n");
         for (i = 1; i < IXGB_RAR_ENTRIES; i++) {
                 /* Write high reg first to disable the AV bit first */
                 IXGB_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
@@ -444,64 +439,50 @@ ixgb_mc_addr_list_update(struct ixgb_hw *hw,
         u32 hash_value;
         u32 i;
         u32 rar_used_count = 1;         /* RAR[0] is used for our MAC address */
+        u8 *mca;
 
-        DEBUGFUNC("ixgb_mc_addr_list_update");
+        ENTER();
 
         /* Set the new number of MC addresses that we are being requested to use. */
         hw->num_mc_addrs = mc_addr_count;
 
         /* Clear RAR[1-15] */
-        DEBUGOUT(" Clearing RAR[1-15]\n");
+        pr_debug("Clearing RAR[1-15]\n");
         for (i = rar_used_count; i < IXGB_RAR_ENTRIES; i++) {
                 IXGB_WRITE_REG_ARRAY(hw, RA, (i << 1), 0);
                 IXGB_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0);
         }
 
         /* Clear the MTA */
-        DEBUGOUT(" Clearing MTA\n");
+        pr_debug("Clearing MTA\n");
         for (i = 0; i < IXGB_MC_TBL_SIZE; i++)
                 IXGB_WRITE_REG_ARRAY(hw, MTA, i, 0);
 
         /* Add the new addresses */
+        mca = mc_addr_list;
         for (i = 0; i < mc_addr_count; i++) {
-                DEBUGOUT(" Adding the multicast addresses:\n");
-                DEBUGOUT7(" MC Addr #%d =%.2X %.2X %.2X %.2X %.2X %.2X\n", i,
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad)],
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad) +
-                                       1],
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad) +
-                                       2],
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad) +
-                                       3],
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad) +
-                                       4],
-                          mc_addr_list[i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad) +
-                                       5]);
+                pr_debug("Adding the multicast addresses:\n");
+                pr_debug("MC Addr #%d = %pM\n", i, mca);
 
                 /* Place this multicast address in the RAR if there is room, *
                  * else put it in the MTA
                  */
                 if (rar_used_count < IXGB_RAR_ENTRIES) {
-                        ixgb_rar_set(hw,
-                                     mc_addr_list +
-                                     (i * (IXGB_ETH_LENGTH_OF_ADDRESS + pad)),
-                                     rar_used_count);
-                        DEBUGOUT1("Added a multicast address to RAR[%d]\n", i);
+                        ixgb_rar_set(hw, mca, rar_used_count);
+                        pr_debug("Added a multicast address to RAR[%d]\n", i);
                         rar_used_count++;
                 } else {
-                        hash_value = ixgb_hash_mc_addr(hw,
-                                                       mc_addr_list +
-                                                       (i *
-                                                        (IXGB_ETH_LENGTH_OF_ADDRESS
-                                                         + pad)));
+                        hash_value = ixgb_hash_mc_addr(hw, mca);
 
-                        DEBUGOUT1(" Hash value = 0x%03X\n", hash_value);
+                        pr_debug("Hash value = 0x%03X\n", hash_value);
 
                         ixgb_mta_set(hw, hash_value);
                 }
+
+                mca += IXGB_ETH_LENGTH_OF_ADDRESS + pad;
         }
 
-        DEBUGOUT("MC Update Complete\n");
+        pr_debug("MC Update Complete\n");
         return;
 }
 
@@ -520,7 +501,7 @@ ixgb_hash_mc_addr(struct ixgb_hw *hw,
 {
         u32 hash_value = 0;
 
-        DEBUGFUNC("ixgb_hash_mc_addr");
+        ENTER();
 
         /* The portion of the address that is used for the hash table is
          * determined by the mc_filter_type setting.
@@ -547,7 +528,7 @@ ixgb_hash_mc_addr(struct ixgb_hw *hw,
                 break;
         default:
                 /* Invalid mc_filter_type, what should we do? */
-                DEBUGOUT("MC filter type param set incorrectly\n");
+                pr_debug("MC filter type param set incorrectly\n");
                 ASSERT(0);
                 break;
         }
@@ -603,7 +584,7 @@ ixgb_rar_set(struct ixgb_hw *hw,
 {
         u32 rar_low, rar_high;
 
-        DEBUGFUNC("ixgb_rar_set");
+        ENTER();
 
         /* HW expects these in little endian so we reverse the byte order
          * from network order (big endian) to little endian
@@ -666,7 +647,7 @@ ixgb_setup_fc(struct ixgb_hw *hw)
         u32 pap_reg = 0;   /* by default, assume no pause time */
         bool status = true;
 
-        DEBUGFUNC("ixgb_setup_fc");
+        ENTER();
 
         /* Get the current control reg 0 settings */
         ctrl_reg = IXGB_READ_REG(hw, CTRL0);
@@ -710,7 +691,7 @@ ixgb_setup_fc(struct ixgb_hw *hw)
                 break;
         default:
                 /* We should never get here.  The value should be 0-3. */
-                DEBUGOUT("Flow control param set incorrectly\n");
+                pr_debug("Flow control param set incorrectly\n");
                 ASSERT(0);
                 break;
         }
@@ -940,7 +921,7 @@ ixgb_check_for_link(struct ixgb_hw *hw)
         u32 status_reg;
         u32 xpcss_reg;
 
-        DEBUGFUNC("ixgb_check_for_link");
+        ENTER();
 
         xpcss_reg = IXGB_READ_REG(hw, XPCSS);
         status_reg = IXGB_READ_REG(hw, STATUS);
@@ -950,7 +931,7 @@ ixgb_check_for_link(struct ixgb_hw *hw)
                 hw->link_up = true;
         } else if (!(xpcss_reg & IXGB_XPCSS_ALIGN_STATUS) &&
                    (status_reg & IXGB_STATUS_LU)) {
-                DEBUGOUT("XPCSS Not Aligned while Status:LU is set.\n");
+                pr_debug("XPCSS Not Aligned while Status:LU is set\n");
                 hw->link_up = ixgb_link_reset(hw);
         } else {
                 /*
@@ -981,8 +962,7 @@ bool ixgb_check_for_bad_link(struct ixgb_hw *hw)
                 newRFC = IXGB_READ_REG(hw, RFC);
                 if ((hw->lastLFC + 250 < newLFC)
                     || (hw->lastRFC + 250 < newRFC)) {
-                        DEBUGOUT
-                            ("BAD LINK! too many LFC/RFC since last check\n");
+                        pr_debug("BAD LINK! too many LFC/RFC since last check\n");
                         bad_link_returncode = true;
                 }
                 hw->lastLFC = newLFC;
@@ -1002,11 +982,11 @@ ixgb_clear_hw_cntrs(struct ixgb_hw *hw)
 {
         volatile u32 temp_reg;
 
-        DEBUGFUNC("ixgb_clear_hw_cntrs");
+        ENTER();
 
         /* if we are stopped or resetting exit gracefully */
         if (hw->adapter_stopped) {
-                DEBUGOUT("Exiting because the adapter is stopped!!!\n");
+                pr_debug("Exiting because the adapter is stopped!!!\n");
                 return;
         }
 
@@ -1156,26 +1136,21 @@ static bool
 mac_addr_valid(u8 *mac_addr)
 {
         bool is_valid = true;
-        DEBUGFUNC("mac_addr_valid");
+        ENTER();
 
         /* Make sure it is not a multicast address */
-        if (IS_MULTICAST(mac_addr)) {
-                DEBUGOUT("MAC address is multicast\n");
+        if (is_multicast_ether_addr(mac_addr)) {
+                pr_debug("MAC address is multicast\n");
                 is_valid = false;
         }
         /* Not a broadcast address */
-        else if (IS_BROADCAST(mac_addr)) {
-                DEBUGOUT("MAC address is broadcast\n");
+        else if (is_broadcast_ether_addr(mac_addr)) {
+                pr_debug("MAC address is broadcast\n");
                 is_valid = false;
         }
         /* Reject the zero address */
-        else if (mac_addr[0] == 0 &&
-                         mac_addr[1] == 0 &&
-                         mac_addr[2] == 0 &&
-                         mac_addr[3] == 0 &&
-                         mac_addr[4] == 0 &&
-                         mac_addr[5] == 0) {
-                DEBUGOUT("MAC address is all zeros\n");
+        else if (is_zero_ether_addr(mac_addr)) {
+                pr_debug("MAC address is all zeros\n");
                 is_valid = false;
         }
         return (is_valid);
diff --git a/drivers/net/ixgb/ixgb_hw.h b/drivers/net/ixgb/ixgb_hw.h
index af6ca3aab5ad..873d32b89fba 100644
--- a/drivers/net/ixgb/ixgb_hw.h
+++ b/drivers/net/ixgb/ixgb_hw.h
@@ -636,18 +636,6 @@ struct ixgb_flash_buffer {
         u8 filler3[0xAAAA];
 };
 
-/*
- * This is a little-endian specific check.
- */
-#define IS_MULTICAST(Address) \
-    (bool)(((u8 *)(Address))[0] & ((u8)0x01))
-
-/*
- * Check whether an address is broadcast.
- */
-#define IS_BROADCAST(Address)               \
-    ((((u8 *)(Address))[0] == ((u8)0xff)) && (((u8 *)(Address))[1] == ((u8)0xff)))
-
 /* Flow control parameters */
 struct ixgb_fc {
         u32 high_water; /* Flow Control High-water          */
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index 912dd1d5772c..d58ca6b578cc 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -26,6 +26,8 @@
 
 *******************************************************************************/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include "ixgb.h"
 
 char ixgb_driver_name[] = "ixgb";
@@ -146,10 +148,8 @@ MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
 static int __init
 ixgb_init_module(void)
 {
-        printk(KERN_INFO "%s - version %s\n",
-               ixgb_driver_string, ixgb_driver_version);
-
-        printk(KERN_INFO "%s\n", ixgb_copyright);
+        pr_info("%s - version %s\n", ixgb_driver_string, ixgb_driver_version);
+        pr_info("%s\n", ixgb_copyright);
 
         return pci_register_driver(&ixgb_driver);
 }
@@ -368,17 +368,22 @@ ixgb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (err)
                 return err;
 
-        if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) &&
-            !(err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)))) {
-                pci_using_dac = 1;
+        pci_using_dac = 0;
+        err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(64));
+        if (!err) {
+                err = dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64));
+                if (!err)
+                        pci_using_dac = 1;
         } else {
-                if ((err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32))) ||
-                    (err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32)))) {
-                        printk(KERN_ERR
-                         "ixgb: No usable DMA configuration, aborting\n");
-                        goto err_dma_mask;
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                if (err) {
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
+                        if (err) {
+                                pr_err("No usable DMA configuration, aborting\n");
+                                goto err_dma_mask;
+                        }
                 }
-                pci_using_dac = 0;
         }
 
         err = pci_request_regions(pdev, ixgb_driver_name);
@@ -674,7 +679,8 @@ ixgb_setup_tx_resources(struct ixgb_adapter *adapter)
         txdr->size = txdr->count * sizeof(struct ixgb_tx_desc);
         txdr->size = ALIGN(txdr->size, 4096);
 
-        txdr->desc = pci_alloc_consistent(pdev, txdr->size, &txdr->dma);
+        txdr->desc = dma_alloc_coherent(&pdev->dev, txdr->size, &txdr->dma,
+                                        GFP_KERNEL);
         if (!txdr->desc) {
                 vfree(txdr->buffer_info);
                 netif_err(adapter, probe, adapter->netdev,
@@ -763,7 +769,8 @@ ixgb_setup_rx_resources(struct ixgb_adapter *adapter)
         rxdr->size = rxdr->count * sizeof(struct ixgb_rx_desc);
         rxdr->size = ALIGN(rxdr->size, 4096);
 
-        rxdr->desc = pci_alloc_consistent(pdev, rxdr->size, &rxdr->dma);
+        rxdr->desc = dma_alloc_coherent(&pdev->dev, rxdr->size, &rxdr->dma,
+                                        GFP_KERNEL);
 
         if (!rxdr->desc) {
                 vfree(rxdr->buffer_info);
@@ -884,8 +891,8 @@ ixgb_free_tx_resources(struct ixgb_adapter *adapter)
         vfree(adapter->tx_ring.buffer_info);
         adapter->tx_ring.buffer_info = NULL;
 
-        pci_free_consistent(pdev, adapter->tx_ring.size,
-                            adapter->tx_ring.desc, adapter->tx_ring.dma);
+        dma_free_coherent(&pdev->dev, adapter->tx_ring.size,
+                          adapter->tx_ring.desc, adapter->tx_ring.dma);
 
         adapter->tx_ring.desc = NULL;
 }
@@ -896,12 +903,11 @@ ixgb_unmap_and_free_tx_resource(struct ixgb_adapter *adapter,
 {
         if (buffer_info->dma) {
                 if (buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev, buffer_info->dma,
-                                       buffer_info->length, PCI_DMA_TODEVICE);
+                        dma_unmap_page(&adapter->pdev->dev, buffer_info->dma,
+                                       buffer_info->length, DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev, buffer_info->dma,
-                                         buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                        dma_unmap_single(&adapter->pdev->dev, buffer_info->dma,
+                                         buffer_info->length, DMA_TO_DEVICE);
                 buffer_info->dma = 0;
         }
 
@@ -967,7 +973,8 @@ ixgb_free_rx_resources(struct ixgb_adapter *adapter)
         vfree(rx_ring->buffer_info);
         rx_ring->buffer_info = NULL;
 
-        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
+                          rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -991,10 +998,10 @@ ixgb_clean_rx_ring(struct ixgb_adapter *adapter)
         for (i = 0; i < rx_ring->count; i++) {
                 buffer_info = &rx_ring->buffer_info[i];
                 if (buffer_info->dma) {
-                        pci_unmap_single(pdev,
+                        dma_unmap_single(&pdev->dev,
                                          buffer_info->dma,
                                          buffer_info->length,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         buffer_info->dma = 0;
                         buffer_info->length = 0;
                 }
@@ -1118,15 +1125,14 @@ ixgb_watchdog(unsigned long data)
 
         if (adapter->hw.link_up) {
                 if (!netif_carrier_ok(netdev)) {
-                        printk(KERN_INFO "ixgb: %s NIC Link is Up 10 Gbps "
-                               "Full Duplex, Flow Control: %s\n",
-                               netdev->name,
-                               (adapter->hw.fc.type == ixgb_fc_full) ?
-                                "RX/TX" :
-                                ((adapter->hw.fc.type == ixgb_fc_rx_pause) ?
-                                 "RX" :
-                                 ((adapter->hw.fc.type == ixgb_fc_tx_pause) ?
-                                  "TX" : "None")));
+                        netdev_info(netdev,
+                                    "NIC Link is Up 10 Gbps Full Duplex, Flow Control: %s\n",
+                                    (adapter->hw.fc.type == ixgb_fc_full) ?
+                                    "RX/TX" :
+                                    (adapter->hw.fc.type == ixgb_fc_rx_pause) ?
+                                     "RX" :
+                                    (adapter->hw.fc.type == ixgb_fc_tx_pause) ?
+                                    "TX" : "None");
                         adapter->link_speed = 10000;
                         adapter->link_duplex = FULL_DUPLEX;
                         netif_carrier_on(netdev);
@@ -1135,8 +1141,7 @@ ixgb_watchdog(unsigned long data)
                 if (netif_carrier_ok(netdev)) {
                         adapter->link_speed = 0;
                         adapter->link_duplex = 0;
-                        printk(KERN_INFO "ixgb: %s NIC Link is Down\n",
-                               netdev->name);
+                        netdev_info(netdev, "NIC Link is Down\n");
                         netif_carrier_off(netdev);
                 }
         }
@@ -1303,9 +1308,10 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
                 WARN_ON(buffer_info->dma != 0);
                 buffer_info->time_stamp = jiffies;
                 buffer_info->mapped_as_page = false;
-                buffer_info->dma = pci_map_single(pdev, skb->data + offset,
-                                                  size, PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                buffer_info->dma = dma_map_single(&pdev->dev,
+                                                  skb->data + offset,
+                                                  size, DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                         goto dma_error;
                 buffer_info->next_to_watch = 0;
 
@@ -1344,10 +1350,9 @@ ixgb_tx_map(struct ixgb_adapter *adapter, struct sk_buff *skb,
                         buffer_info->time_stamp = jiffies;
                         buffer_info->mapped_as_page = true;
                         buffer_info->dma =
-                                pci_map_page(pdev, frag->page,
-                                             offset, size,
-                                             PCI_DMA_TODEVICE);
-                        if (pci_dma_mapping_error(pdev, buffer_info->dma))
+                                dma_map_page(&pdev->dev, frag->page,
+                                             offset, size, DMA_TO_DEVICE);
+                        if (dma_mapping_error(&pdev->dev, buffer_info->dma))
                                 goto dma_error;
                         buffer_info->next_to_watch = 0;
 
@@ -1965,10 +1970,10 @@ ixgb_clean_rx_irq(struct ixgb_adapter *adapter, int *work_done, int work_to_do)
                 cleaned = true;
                 cleaned_count++;
 
-                pci_unmap_single(pdev,
+                dma_unmap_single(&pdev->dev,
                                  buffer_info->dma,
                                  buffer_info->length,
-                                 PCI_DMA_FROMDEVICE);
+                                 DMA_FROM_DEVICE);
                 buffer_info->dma = 0;
 
                 length = le16_to_cpu(rx_desc->length);
@@ -2091,10 +2096,10 @@ ixgb_alloc_rx_buffers(struct ixgb_adapter *adapter, int cleaned_count)
                 buffer_info->skb = skb;
                 buffer_info->length = adapter->rx_buffer_len;
 map_skb:
-                buffer_info->dma = pci_map_single(pdev,
+                buffer_info->dma = dma_map_single(&pdev->dev,
                                                   skb->data,
                                                   adapter->rx_buffer_len,
-                                                  PCI_DMA_FROMDEVICE);
+                                                  DMA_FROM_DEVICE);
 
                 rx_desc = IXGB_RX_DESC(*rx_ring, i);
                 rx_desc->buff_addr = cpu_to_le64(buffer_info->dma);
@@ -2322,7 +2327,7 @@ static void ixgb_io_resume(struct pci_dev *pdev)
 
         if (netif_running(netdev)) {
                 if (ixgb_up(adapter)) {
-                        printk ("ixgb: can't bring device back up after reset\n");
+                        pr_err("can't bring device back up after reset\n");
                         return;
                 }
         }
diff --git a/drivers/net/ixgb/ixgb_osdep.h b/drivers/net/ixgb/ixgb_osdep.h
index 371a6be4d965..e361185920ef 100644
--- a/drivers/net/ixgb/ixgb_osdep.h
+++ b/drivers/net/ixgb/ixgb_osdep.h
@@ -41,20 +41,8 @@
 
 #undef ASSERT
 #define ASSERT(x)       BUG_ON(!(x))
-#define MSGOUT(S, A, B) printk(KERN_DEBUG S "\n", A, B)
-
-#ifdef DBG
-#define DEBUGOUT(S)             printk(KERN_DEBUG S "\n")
-#define DEBUGOUT1(S, A...)      printk(KERN_DEBUG S "\n", A)
-#else
-#define DEBUGOUT(S)
-#define DEBUGOUT1(S, A...)
-#endif
-
-#define DEBUGFUNC(F) DEBUGOUT(F)
-#define DEBUGOUT2 DEBUGOUT1
-#define DEBUGOUT3 DEBUGOUT2
-#define DEBUGOUT7 DEBUGOUT3
+
+#define ENTER() pr_debug("%s\n", __func__);
 
 #define IXGB_WRITE_REG(a, reg, value) ( \
         writel((value), ((a)->hw_addr + IXGB_##reg)))
diff --git a/drivers/net/ixgb/ixgb_param.c b/drivers/net/ixgb/ixgb_param.c
index af35e1ddadd6..88a08f056241 100644
--- a/drivers/net/ixgb/ixgb_param.c
+++ b/drivers/net/ixgb/ixgb_param.c
@@ -26,6 +26,8 @@
 
 *******************************************************************************/
 
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include "ixgb.h"
 
 /* This is the only thing that needs to be changed to adjust the
@@ -209,16 +211,16 @@ ixgb_validate_option(unsigned int *value, const struct ixgb_option *opt)
         case enable_option:
                 switch (*value) {
                 case OPTION_ENABLED:
-                        printk(KERN_INFO "%s Enabled\n", opt->name);
+                        pr_info("%s Enabled\n", opt->name);
                         return 0;
                 case OPTION_DISABLED:
-                        printk(KERN_INFO "%s Disabled\n", opt->name);
+                        pr_info("%s Disabled\n", opt->name);
                         return 0;
                 }
                 break;
         case range_option:
                 if (*value >= opt->arg.r.min && *value <= opt->arg.r.max) {
-                        printk(KERN_INFO "%s set to %i\n", opt->name, *value);
+                        pr_info("%s set to %i\n", opt->name, *value);
                         return 0;
                 }
                 break;
@@ -230,7 +232,7 @@ ixgb_validate_option(unsigned int *value, const struct ixgb_option *opt)
                         ent = &opt->arg.l.p[i];
                         if (*value == ent->i) {
                                 if (ent->str[0] != '\0')
-                                        printk(KERN_INFO "%s\n", ent->str);
+                                        pr_info("%s\n", ent->str);
                                 return 0;
                         }
                 }
@@ -240,8 +242,7 @@ ixgb_validate_option(unsigned int *value, const struct ixgb_option *opt)
                 BUG();
         }
 
-        printk(KERN_INFO "Invalid %s specified (%i) %s\n",
-                   opt->name, *value, opt->err);
+        pr_info("Invalid %s specified (%i) %s\n", opt->name, *value, opt->err);
         *value = opt->def;
         return -1;
 }
@@ -261,9 +262,8 @@ ixgb_check_options(struct ixgb_adapter *adapter)
 {
         int bd = adapter->bd_number;
         if (bd >= IXGB_MAX_NIC) {
-                printk(KERN_NOTICE
-                           "Warning: no configuration for board #%i\n", bd);
-                printk(KERN_NOTICE "Using defaults for all values\n");
+                pr_notice("Warning: no configuration for board #%i\n", bd);
+                pr_notice("Using defaults for all values\n");
         }
 
         { /* Transmit Descriptor Count */
@@ -363,8 +363,7 @@ ixgb_check_options(struct ixgb_adapter *adapter)
                         adapter->hw.fc.high_water = opt.def;
                 }
                 if (!(adapter->hw.fc.type & ixgb_fc_tx_pause) )
-                        printk(KERN_INFO
-                                "Ignoring RxFCHighThresh when no RxFC\n");
+                        pr_info("Ignoring RxFCHighThresh when no RxFC\n");
         }
         { /* Receive Flow Control Low Threshold */
                 const struct ixgb_option opt = {
@@ -383,8 +382,7 @@ ixgb_check_options(struct ixgb_adapter *adapter)
                         adapter->hw.fc.low_water = opt.def;
                 }
                 if (!(adapter->hw.fc.type & ixgb_fc_tx_pause) )
-                        printk(KERN_INFO
-                                "Ignoring RxFCLowThresh when no RxFC\n");
+                        pr_info("Ignoring RxFCLowThresh when no RxFC\n");
         }
         { /* Flow Control Pause Time Request*/
                 const struct ixgb_option opt = {
@@ -404,17 +402,14 @@ ixgb_check_options(struct ixgb_adapter *adapter)
                         adapter->hw.fc.pause_time = opt.def;
                 }
                 if (!(adapter->hw.fc.type & ixgb_fc_tx_pause) )
-                        printk(KERN_INFO
-                                "Ignoring FCReqTimeout when no RxFC\n");
+                        pr_info("Ignoring FCReqTimeout when no RxFC\n");
         }
         /* high low and spacing check for rx flow control thresholds */
         if (adapter->hw.fc.type & ixgb_fc_tx_pause) {
                 /* high must be greater than low */
                 if (adapter->hw.fc.high_water < (adapter->hw.fc.low_water + 8)) {
                         /* set defaults */
-                        printk(KERN_INFO
-                                "RxFCHighThresh must be >= (RxFCLowThresh + 8), "
-                                "Using Defaults\n");
+                        pr_info("RxFCHighThresh must be >= (RxFCLowThresh + 8), Using Defaults\n");
                         adapter->hw.fc.high_water = DEFAULT_FCRTH;
                         adapter->hw.fc.low_water  = DEFAULT_FCRTL;
                 }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index 79c35ae3718c..d0ea3d6dea95 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -111,7 +111,10 @@ struct vf_data_storage {
         u16 default_vf_vlan_id;
         u16 vlans_enabled;
         bool clear_to_send;
+        bool pf_set_mac;
         int rar;
+        u16 pf_vlan; /* When set, guest VLAN config not allowed. */
+        u16 pf_qos;
 };
 
 /* wrapper around a pointer to a socket buffer,
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index f894bb633040..38c384031c4c 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,8 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
 
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                           ixgbe_link_speed speed,
@@ -69,8 +71,14 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
         if (hw->phy.multispeed_fiber) {
                 /* Set up dual speed SFP+ support */
                 mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.disable_tx_laser =
+                                       &ixgbe_disable_tx_laser_multispeed_fiber;
+                mac->ops.enable_tx_laser =
+                                        &ixgbe_enable_tx_laser_multispeed_fiber;
                 mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
         } else {
+                mac->ops.disable_tx_laser = NULL;
+                mac->ops.enable_tx_laser = NULL;
                 mac->ops.flap_tx_laser = NULL;
                 if ((mac->ops.get_media_type(hw) ==
                      ixgbe_media_type_backplane) &&
@@ -415,6 +423,44 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
         return status;
 }
 
+ /**
+  *  ixgbe_disable_tx_laser_multispeed_fiber - Disable Tx laser
+  *  @hw: pointer to hardware structure
+  *
+  *  The base drivers may require better control over SFP+ module
+  *  PHY states.  This includes selectively shutting down the Tx
+  *  laser on the PHY, effectively halting physical link.
+  **/
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Disable tx laser; allow 100us to go dark per spec */
+        esdp_reg |= IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        udelay(100);
+}
+
+/**
+ *  ixgbe_enable_tx_laser_multispeed_fiber - Enable Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  The base drivers may require better control over SFP+ module
+ *  PHY states.  This includes selectively turning on the Tx
+ *  laser on the PHY, effectively starting physical link.
+ **/
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+
+        /* Enable tx laser; allow 100ms to light up */
+        esdp_reg &= ~IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        msleep(100);
+}
+
 /**
  *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
  *  @hw: pointer to hardware structure
@@ -429,23 +475,11 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
  **/
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
-        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
-
         hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
 
         if (hw->mac.autotry_restart) {
-                /* Disable tx laser; allow 100us to go dark per spec */
-                esdp_reg |= IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                udelay(100);
-
-                /* Enable tx laser; allow 100ms to light up */
-                esdp_reg &= ~IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                msleep(100);
-
+                ixgbe_disable_tx_laser_multispeed_fiber(hw);
+                ixgbe_enable_tx_laser_multispeed_fiber(hw);
                 hw->mac.autotry_restart = false;
         }
 }
@@ -608,6 +642,7 @@ static s32 ixgbe_setup_mac_link_smartspeed(struct ixgbe_hw *hw,
         s32 i, j;
         bool link_up = false;
         u32 autoc_reg = IXGBE_READ_REG(hw, IXGBE_AUTOC);
+        struct ixgbe_adapter *adapter = hw->back;
 
         hw_dbg(hw, "ixgbe_setup_mac_link_smartspeed.\n");
 
@@ -692,6 +727,10 @@ static s32 ixgbe_setup_mac_link_smartspeed(struct ixgbe_hw *hw,
                                             autoneg_wait_to_complete);
 
 out:
+        if (link_up && (link_speed == IXGBE_LINK_SPEED_1GB_FULL))
+                netif_info(adapter, hw, adapter->netdev, "Smartspeed has"
+                        " downgraded the link speed from the maximum"
+                        " advertised\n");
         return status;
 }
 
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 8f461d5cee77..dc7fd5b70bc3 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -365,7 +365,7 @@ static int ixgbe_set_pauseparam(struct net_device *netdev,
         else
                 fc.disable_fc_autoneg = false;
 
-        if (pause->rx_pause && pause->tx_pause)
+        if ((pause->rx_pause && pause->tx_pause) || pause->autoneg)
                 fc.requested_mode = ixgbe_fc_full;
         else if (pause->rx_pause && !pause->tx_pause)
                 fc.requested_mode = ixgbe_fc_rx_pause;
@@ -1458,8 +1458,8 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
                         struct ixgbe_tx_buffer *buf =
                                         &(tx_ring->tx_buffer_info[i]);
                         if (buf->dma)
-                                pci_unmap_single(pdev, buf->dma, buf->length,
-                                                 PCI_DMA_TODEVICE);
+                                dma_unmap_single(&pdev->dev, buf->dma,
+                                                 buf->length, DMA_TO_DEVICE);
                         if (buf->skb)
                                 dev_kfree_skb(buf->skb);
                 }
@@ -1470,22 +1470,22 @@ static void ixgbe_free_desc_rings(struct ixgbe_adapter *adapter)
                         struct ixgbe_rx_buffer *buf =
                                         &(rx_ring->rx_buffer_info[i]);
                         if (buf->dma)
-                                pci_unmap_single(pdev, buf->dma,
+                                dma_unmap_single(&pdev->dev, buf->dma,
                                                  IXGBE_RXBUFFER_2048,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         if (buf->skb)
                                 dev_kfree_skb(buf->skb);
                 }
         }
 
         if (tx_ring->desc) {
-                pci_free_consistent(pdev, tx_ring->size, tx_ring->desc,
-                                    tx_ring->dma);
+                dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
+                                  tx_ring->dma);
                 tx_ring->desc = NULL;
         }
         if (rx_ring->desc) {
-                pci_free_consistent(pdev, rx_ring->size, rx_ring->desc,
-                                    rx_ring->dma);
+                dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
+                                  rx_ring->dma);
                 rx_ring->desc = NULL;
         }
 
@@ -1520,8 +1520,9 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
 
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
-        if (!(tx_ring->desc = pci_alloc_consistent(pdev, tx_ring->size,
-                                                   &tx_ring->dma))) {
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
+        if (!(tx_ring->desc)) {
                 ret_val = 2;
                 goto err_nomem;
         }
@@ -1563,8 +1564,8 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
                 tx_ring->tx_buffer_info[i].skb = skb;
                 tx_ring->tx_buffer_info[i].length = skb->len;
                 tx_ring->tx_buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, skb->len,
-                                       PCI_DMA_TODEVICE);
+                        dma_map_single(&pdev->dev, skb->data, skb->len,
+                                       DMA_TO_DEVICE);
                 desc->read.buffer_addr =
                                     cpu_to_le64(tx_ring->tx_buffer_info[i].dma);
                 desc->read.cmd_type_len = cpu_to_le32(skb->len);
@@ -1593,8 +1594,9 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
 
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
         rx_ring->size = ALIGN(rx_ring->size, 4096);
-        if (!(rx_ring->desc = pci_alloc_consistent(pdev, rx_ring->size,
-                                                   &rx_ring->dma))) {
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
+        if (!(rx_ring->desc)) {
                 ret_val = 5;
                 goto err_nomem;
         }
@@ -1661,8 +1663,8 @@ static int ixgbe_setup_desc_rings(struct ixgbe_adapter *adapter)
                 skb_reserve(skb, NET_IP_ALIGN);
                 rx_ring->rx_buffer_info[i].skb = skb;
                 rx_ring->rx_buffer_info[i].dma =
-                        pci_map_single(pdev, skb->data, IXGBE_RXBUFFER_2048,
-                                       PCI_DMA_FROMDEVICE);
+                        dma_map_single(&pdev->dev, skb->data,
+                                       IXGBE_RXBUFFER_2048, DMA_FROM_DEVICE);
                 rx_desc->read.pkt_addr =
                                 cpu_to_le64(rx_ring->rx_buffer_info[i].dma);
                 memset(skb->data, 0x00, skb->len);
@@ -1775,10 +1777,10 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
                         ixgbe_create_lbtest_frame(
                                         tx_ring->tx_buffer_info[k].skb,
                                         1024);
-                        pci_dma_sync_single_for_device(pdev,
+                        dma_sync_single_for_device(&pdev->dev,
                                 tx_ring->tx_buffer_info[k].dma,
                                 tx_ring->tx_buffer_info[k].length,
-                                PCI_DMA_TODEVICE);
+                                DMA_TO_DEVICE);
                         if (unlikely(++k == tx_ring->count))
                                 k = 0;
                 }
@@ -1789,10 +1791,10 @@ static int ixgbe_run_loopback_test(struct ixgbe_adapter *adapter)
                 good_cnt = 0;
                 do {
                         /* receive the sent packets */
-                        pci_dma_sync_single_for_cpu(pdev,
+                        dma_sync_single_for_cpu(&pdev->dev,
                                         rx_ring->rx_buffer_info[l].dma,
                                         IXGBE_RXBUFFER_2048,
-                                        PCI_DMA_FROMDEVICE);
+                                        DMA_FROM_DEVICE);
                         ret_val = ixgbe_check_lbtest_frame(
                                         rx_ring->rx_buffer_info[l].skb, 1024);
                         if (!ret_val)
@@ -2079,12 +2081,32 @@ static int ixgbe_get_coalesce(struct net_device *netdev,
         return 0;
 }
 
+/*
+ * this function must be called before setting the new value of
+ * rx_itr_setting
+ */
+static bool ixgbe_reenable_rsc(struct ixgbe_adapter *adapter,
+                               struct ethtool_coalesce *ec)
+{
+        /* check the old value and enable RSC if necessary */
+        if ((adapter->rx_itr_setting == 0) &&
+            (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE)) {
+                adapter->flags2 |= IXGBE_FLAG2_RSC_ENABLED;
+                adapter->netdev->features |= NETIF_F_LRO;
+                DPRINTK(PROBE, INFO, "rx-usecs set to %d, re-enabling RSC\n",
+                        ec->rx_coalesce_usecs);
+                return true;
+        }
+        return false;
+}
+
 static int ixgbe_set_coalesce(struct net_device *netdev,
                               struct ethtool_coalesce *ec)
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         struct ixgbe_q_vector *q_vector;
         int i;
+        bool need_reset = false;
 
         /* don't accept tx specific changes if we've got mixed RxTx vectors */
         if (adapter->q_vector[0]->txr_count && adapter->q_vector[0]->rxr_count
@@ -2095,11 +2117,20 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 adapter->tx_ring[0]->work_limit = ec->tx_max_coalesced_frames_irq;
 
         if (ec->rx_coalesce_usecs > 1) {
+                u32 max_int;
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
+                        max_int = IXGBE_MAX_RSC_INT_RATE;
+                else
+                        max_int = IXGBE_MAX_INT_RATE;
+
                 /* check the limits */
-                if ((1000000/ec->rx_coalesce_usecs > IXGBE_MAX_INT_RATE) ||
+                if ((1000000/ec->rx_coalesce_usecs > max_int) ||
                     (1000000/ec->rx_coalesce_usecs < IXGBE_MIN_INT_RATE))
                         return -EINVAL;
 
+                /* check the old value and enable RSC if necessary */
+                need_reset = ixgbe_reenable_rsc(adapter, ec);
+
                 /* store the value in ints/second */
                 adapter->rx_eitr_param = 1000000/ec->rx_coalesce_usecs;
 
@@ -2108,6 +2139,9 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 /* clear the lower bit as its used for dynamic state */
                 adapter->rx_itr_setting &= ~1;
         } else if (ec->rx_coalesce_usecs == 1) {
+                /* check the old value and enable RSC if necessary */
+                need_reset = ixgbe_reenable_rsc(adapter, ec);
+
                 /* 1 means dynamic mode */
                 adapter->rx_eitr_param = 20000;
                 adapter->rx_itr_setting = 1;
@@ -2116,14 +2150,30 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                  * any other value means disable eitr, which is best
                  * served by setting the interrupt rate very high
                  */
-                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED)
-                        adapter->rx_eitr_param = IXGBE_MAX_RSC_INT_RATE;
-                else
-                        adapter->rx_eitr_param = IXGBE_MAX_INT_RATE;
+                adapter->rx_eitr_param = IXGBE_MAX_INT_RATE;
                 adapter->rx_itr_setting = 0;
+
+                /*
+                 * if hardware RSC is enabled, disable it when
+                 * setting low latency mode, to avoid errata, assuming
+                 * that when the user set low latency mode they want
+                 * it at the cost of anything else
+                 */
+                if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
+                        adapter->flags2 &= ~IXGBE_FLAG2_RSC_ENABLED;
+                        netdev->features &= ~NETIF_F_LRO;
+                        DPRINTK(PROBE, INFO,
+                                "rx-usecs set to 0, disabling RSC\n");
+
+                        need_reset = true;
+                }
         }
 
         if (ec->tx_coalesce_usecs > 1) {
+                /*
+                 * don't have to worry about max_int as above because
+                 * tx vectors don't do hardware RSC (an rx function)
+                 */
                 /* check the limits */
                 if ((1000000/ec->tx_coalesce_usecs > IXGBE_MAX_INT_RATE) ||
                     (1000000/ec->tx_coalesce_usecs < IXGBE_MIN_INT_RATE))
@@ -2167,6 +2217,18 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                 ixgbe_write_eitr(q_vector);
         }
 
+        /*
+         * do reset here at the end to make sure EITR==0 case is handled
+         * correctly w.r.t stopping tx, and changing TXDCTL.WTHRESH settings
+         * also locks in RSC enable/disable which requires reset
+         */
+        if (need_reset) {
+                if (netif_running(netdev))
+                        ixgbe_reinit_locked(adapter);
+                else
+                        ixgbe_reset(adapter);
+        }
+
         return 0;
 }
 
@@ -2178,10 +2240,26 @@ static int ixgbe_set_flags(struct net_device *netdev, u32 data)
         ethtool_op_set_flags(netdev, data);
 
         /* if state changes we need to update adapter->flags and reset */
-        if ((!!(data & ETH_FLAG_LRO)) != 
-            (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) {
-                adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
-                need_reset = true;
+        if (adapter->flags2 & IXGBE_FLAG2_RSC_CAPABLE) {
+                /*
+                 * cast both to bool and verify if they are set the same
+                 * but only enable RSC if itr is non-zero, as
+                 * itr=0 and RSC are mutually exclusive
+                 */
+                if (((!!(data & ETH_FLAG_LRO)) !=
+                     (!!(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))) &&
+                    adapter->rx_itr_setting) {
+                        adapter->flags2 ^= IXGBE_FLAG2_RSC_ENABLED;
+                        switch (adapter->hw.mac.type) {
+                        case ixgbe_mac_82599EB:
+                                need_reset = true;
+                                break;
+                        default:
+                                break;
+                        }
+                } else if (!adapter->rx_itr_setting) {
+                        netdev->features &= ~ETH_FLAG_LRO;
+                }
         }
 
         /*
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index a98ff0e76e86..d1a1868df817 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -175,6 +175,345 @@ static inline void ixgbe_disable_sriov(struct ixgbe_adapter *adapter)
         adapter->flags &= ~IXGBE_FLAG_SRIOV_ENABLED;
 }
 
+struct ixgbe_reg_info {
+        u32 ofs;
+        char *name;
+};
+
+static const struct ixgbe_reg_info ixgbe_reg_info_tbl[] = {
+
+        /* General Registers */
+        {IXGBE_CTRL, "CTRL"},
+        {IXGBE_STATUS, "STATUS"},
+        {IXGBE_CTRL_EXT, "CTRL_EXT"},
+
+        /* Interrupt Registers */
+        {IXGBE_EICR, "EICR"},
+
+        /* RX Registers */
+        {IXGBE_SRRCTL(0), "SRRCTL"},
+        {IXGBE_DCA_RXCTRL(0), "DRXCTL"},
+        {IXGBE_RDLEN(0), "RDLEN"},
+        {IXGBE_RDH(0), "RDH"},
+        {IXGBE_RDT(0), "RDT"},
+        {IXGBE_RXDCTL(0), "RXDCTL"},
+        {IXGBE_RDBAL(0), "RDBAL"},
+        {IXGBE_RDBAH(0), "RDBAH"},
+
+        /* TX Registers */
+        {IXGBE_TDBAL(0), "TDBAL"},
+        {IXGBE_TDBAH(0), "TDBAH"},
+        {IXGBE_TDLEN(0), "TDLEN"},
+        {IXGBE_TDH(0), "TDH"},
+        {IXGBE_TDT(0), "TDT"},
+        {IXGBE_TXDCTL(0), "TXDCTL"},
+
+        /* List Terminator */
+        {}
+};
+
+
+/*
+ * ixgbe_regdump - register printout routine
+ */
+static void ixgbe_regdump(struct ixgbe_hw *hw, struct ixgbe_reg_info *reginfo)
+{
+        int i = 0, j = 0;
+        char rname[16];
+        u32 regs[64];
+
+        switch (reginfo->ofs) {
+        case IXGBE_SRRCTL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_SRRCTL(i));
+                break;
+        case IXGBE_DCA_RXCTRL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
+                break;
+        case IXGBE_RDLEN(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RDLEN(i));
+                break;
+        case IXGBE_RDH(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RDH(i));
+                break;
+        case IXGBE_RDT(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RDT(i));
+                break;
+        case IXGBE_RXDCTL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RXDCTL(i));
+                break;
+        case IXGBE_RDBAL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RDBAL(i));
+                break;
+        case IXGBE_RDBAH(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_RDBAH(i));
+                break;
+        case IXGBE_TDBAL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TDBAL(i));
+                break;
+        case IXGBE_TDBAH(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TDBAH(i));
+                break;
+        case IXGBE_TDLEN(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TDLEN(i));
+                break;
+        case IXGBE_TDH(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TDH(i));
+                break;
+        case IXGBE_TDT(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TDT(i));
+                break;
+        case IXGBE_TXDCTL(0):
+                for (i = 0; i < 64; i++)
+                        regs[i] = IXGBE_READ_REG(hw, IXGBE_TXDCTL(i));
+                break;
+        default:
+                printk(KERN_INFO "%-15s %08x\n", reginfo->name,
+                        IXGBE_READ_REG(hw, reginfo->ofs));
+                return;
+        }
+
+        for (i = 0; i < 8; i++) {
+                snprintf(rname, 16, "%s[%d-%d]", reginfo->name, i*8, i*8+7);
+                printk(KERN_ERR "%-15s ", rname);
+                for (j = 0; j < 8; j++)
+                        printk(KERN_CONT "%08x ", regs[i*8+j]);
+                printk(KERN_CONT "\n");
+        }
+
+}
+
+/*
+ * ixgbe_dump - Print registers, tx-rings and rx-rings
+ */
+static void ixgbe_dump(struct ixgbe_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_reg_info *reginfo;
+        int n = 0;
+        struct ixgbe_ring *tx_ring;
+        struct ixgbe_tx_buffer *tx_buffer_info;
+        union ixgbe_adv_tx_desc *tx_desc;
+        struct my_u0 { u64 a; u64 b; } *u0;
+        struct ixgbe_ring *rx_ring;
+        union ixgbe_adv_rx_desc *rx_desc;
+        struct ixgbe_rx_buffer *rx_buffer_info;
+        u32 staterr;
+        int i = 0;
+
+        if (!netif_msg_hw(adapter))
+                return;
+
+        /* Print netdevice Info */
+        if (netdev) {
+                dev_info(&adapter->pdev->dev, "Net device Info\n");
+                printk(KERN_INFO "Device Name     state            "
+                        "trans_start      last_rx\n");
+                printk(KERN_INFO "%-15s %016lX %016lX %016lX\n",
+                netdev->name,
+                netdev->state,
+                netdev->trans_start,
+                netdev->last_rx);
+        }
+
+        /* Print Registers */
+        dev_info(&adapter->pdev->dev, "Register Dump\n");
+        printk(KERN_INFO " Register Name   Value\n");
+        for (reginfo = (struct ixgbe_reg_info *)ixgbe_reg_info_tbl;
+             reginfo->name; reginfo++) {
+                ixgbe_regdump(hw, reginfo);
+        }
+
+        /* Print TX Ring Summary */
+        if (!netdev || !netif_running(netdev))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC] [bi(ntc)->dma  ] "
+                "leng ntw timestamp\n");
+        for (n = 0; n < adapter->num_tx_queues; n++) {
+                tx_ring = adapter->tx_ring[n];
+                tx_buffer_info =
+                        &tx_ring->tx_buffer_info[tx_ring->next_to_clean];
+                printk(KERN_INFO " %5d %5X %5X %016llX %04X %3X %016llX\n",
+                           n, tx_ring->next_to_use, tx_ring->next_to_clean,
+                           (u64)tx_buffer_info->dma,
+                           tx_buffer_info->length,
+                           tx_buffer_info->next_to_watch,
+                           (u64)tx_buffer_info->time_stamp);
+        }
+
+        /* Print TX Rings */
+        if (!netif_msg_tx_done(adapter))
+                goto rx_ring_summary;
+
+        dev_info(&adapter->pdev->dev, "TX Rings Dump\n");
+
+        /* Transmit Descriptor Formats
+         *
+         * Advanced Transmit Descriptor
+         *   +--------------------------------------------------------------+
+         * 0 |         Buffer Address [63:0]                                |
+         *   +--------------------------------------------------------------+
+         * 8 |  PAYLEN  | PORTS  | IDX | STA | DCMD  |DTYP |  RSV |  DTALEN |
+         *   +--------------------------------------------------------------+
+         *   63       46 45    40 39 36 35 32 31   24 23 20 19              0
+         */
+
+        for (n = 0; n < adapter->num_tx_queues; n++) {
+                tx_ring = adapter->tx_ring[n];
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "TX QUEUE INDEX = %d\n", tx_ring->queue_index);
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "T [desc]     [address 63:0  ] "
+                        "[PlPOIdStDDt Ln] [bi->dma       ] "
+                        "leng  ntw timestamp        bi->skb\n");
+
+                for (i = 0; tx_ring->desc && (i < tx_ring->count); i++) {
+                        tx_desc = IXGBE_TX_DESC_ADV(*tx_ring, i);
+                        tx_buffer_info = &tx_ring->tx_buffer_info[i];
+                        u0 = (struct my_u0 *)tx_desc;
+                        printk(KERN_INFO "T [0x%03X]    %016llX %016llX %016llX"
+                                " %04X  %3X %016llX %p", i,
+                                le64_to_cpu(u0->a),
+                                le64_to_cpu(u0->b),
+                                (u64)tx_buffer_info->dma,
+                                tx_buffer_info->length,
+                                tx_buffer_info->next_to_watch,
+                                (u64)tx_buffer_info->time_stamp,
+                                tx_buffer_info->skb);
+                        if (i == tx_ring->next_to_use &&
+                                i == tx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC/U\n");
+                        else if (i == tx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == tx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+
+                        if (netif_msg_pktdata(adapter) &&
+                                tx_buffer_info->dma != 0)
+                                print_hex_dump(KERN_INFO, "",
+                                        DUMP_PREFIX_ADDRESS, 16, 1,
+                                        phys_to_virt(tx_buffer_info->dma),
+                                        tx_buffer_info->length, true);
+                }
+        }
+
+        /* Print RX Rings Summary */
+rx_ring_summary:
+        dev_info(&adapter->pdev->dev, "RX Rings Summary\n");
+        printk(KERN_INFO "Queue [NTU] [NTC]\n");
+        for (n = 0; n < adapter->num_rx_queues; n++) {
+                rx_ring = adapter->rx_ring[n];
+                printk(KERN_INFO "%5d %5X %5X\n", n,
+                           rx_ring->next_to_use, rx_ring->next_to_clean);
+        }
+
+        /* Print RX Rings */
+        if (!netif_msg_rx_status(adapter))
+                goto exit;
+
+        dev_info(&adapter->pdev->dev, "RX Rings Dump\n");
+
+        /* Advanced Receive Descriptor (Read) Format
+         *    63                                           1        0
+         *    +-----------------------------------------------------+
+         *  0 |       Packet Buffer Address [63:1]           |A0/NSE|
+         *    +----------------------------------------------+------+
+         *  8 |       Header Buffer Address [63:1]           |  DD  |
+         *    +-----------------------------------------------------+
+         *
+         *
+         * Advanced Receive Descriptor (Write-Back) Format
+         *
+         *   63       48 47    32 31  30      21 20 16 15   4 3     0
+         *   +------------------------------------------------------+
+         * 0 | Packet     IP     |SPH| HDR_LEN   | RSV|Packet|  RSS |
+         *   | Checksum   Ident  |   |           |    | Type | Type |
+         *   +------------------------------------------------------+
+         * 8 | VLAN Tag | Length | Extended Error | Extended Status |
+         *   +------------------------------------------------------+
+         *   63       48 47    32 31            20 19               0
+         */
+        for (n = 0; n < adapter->num_rx_queues; n++) {
+                rx_ring = adapter->rx_ring[n];
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "RX QUEUE INDEX = %d\n", rx_ring->queue_index);
+                printk(KERN_INFO "------------------------------------\n");
+                printk(KERN_INFO "R  [desc]      [ PktBuf     A0] "
+                        "[  HeadBuf   DD] [bi->dma       ] [bi->skb] "
+                        "<-- Adv Rx Read format\n");
+                printk(KERN_INFO "RWB[desc]      [PcsmIpSHl PtRs] "
+                        "[vl er S cks ln] ---------------- [bi->skb] "
+                        "<-- Adv Rx Write-Back format\n");
+
+                for (i = 0; i < rx_ring->count; i++) {
+                        rx_buffer_info = &rx_ring->rx_buffer_info[i];
+                        rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
+                        u0 = (struct my_u0 *)rx_desc;
+                        staterr = le32_to_cpu(rx_desc->wb.upper.status_error);
+                        if (staterr & IXGBE_RXD_STAT_DD) {
+                                /* Descriptor Done */
+                                printk(KERN_INFO "RWB[0x%03X]     %016llX "
+                                        "%016llX ---------------- %p", i,
+                                        le64_to_cpu(u0->a),
+                                        le64_to_cpu(u0->b),
+                                        rx_buffer_info->skb);
+                        } else {
+                                printk(KERN_INFO "R  [0x%03X]     %016llX "
+                                        "%016llX %016llX %p", i,
+                                        le64_to_cpu(u0->a),
+                                        le64_to_cpu(u0->b),
+                                        (u64)rx_buffer_info->dma,
+                                        rx_buffer_info->skb);
+
+                                if (netif_msg_pktdata(adapter)) {
+                                        print_hex_dump(KERN_INFO, "",
+                                           DUMP_PREFIX_ADDRESS, 16, 1,
+                                           phys_to_virt(rx_buffer_info->dma),
+                                           rx_ring->rx_buf_len, true);
+
+                                        if (rx_ring->rx_buf_len
+                                                < IXGBE_RXBUFFER_2048)
+                                                print_hex_dump(KERN_INFO, "",
+                                                  DUMP_PREFIX_ADDRESS, 16, 1,
+                                                  phys_to_virt(
+                                                    rx_buffer_info->page_dma +
+                                                    rx_buffer_info->page_offset
+                                                  ),
+                                                  PAGE_SIZE/2, true);
+                                }
+                        }
+
+                        if (i == rx_ring->next_to_use)
+                                printk(KERN_CONT " NTU\n");
+                        else if (i == rx_ring->next_to_clean)
+                                printk(KERN_CONT " NTC\n");
+                        else
+                                printk(KERN_CONT "\n");
+
+                }
+        }
+
+exit:
+        return;
+}
+
 static void ixgbe_release_hw_control(struct ixgbe_adapter *adapter)
 {
         u32 ctrl_ext;
@@ -266,15 +605,15 @@ static void ixgbe_unmap_and_free_tx_resource(struct ixgbe_adapter *adapter,
 {
         if (tx_buffer_info->dma) {
                 if (tx_buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev,
+                        dma_unmap_page(&adapter->pdev->dev,
                                        tx_buffer_info->dma,
                                        tx_buffer_info->length,
-                                       PCI_DMA_TODEVICE);
+                                       DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev,
+                        dma_unmap_single(&adapter->pdev->dev,
                                          tx_buffer_info->dma,
                                          tx_buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                                         DMA_TO_DEVICE);
                 tx_buffer_info->dma = 0;
         }
         if (tx_buffer_info->skb) {
@@ -721,10 +1060,10 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                                 bi->page_offset ^= (PAGE_SIZE / 2);
                         }
 
-                        bi->page_dma = pci_map_page(pdev, bi->page,
+                        bi->page_dma = dma_map_page(&pdev->dev, bi->page,
                                                     bi->page_offset,
                                                     (PAGE_SIZE / 2),
-                                                    PCI_DMA_FROMDEVICE);
+                                                    DMA_FROM_DEVICE);
                 }
 
                 if (!bi->skb) {
@@ -743,9 +1082,9 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                                           - skb->data));
 
                         bi->skb = skb;
-                        bi->dma = pci_map_single(pdev, skb->data,
+                        bi->dma = dma_map_single(&pdev->dev, skb->data,
                                                  rx_ring->rx_buf_len,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                 }
                 /* Refresh the desc even if buffer_addrs didn't change because
                  * each write-back erases this info. */
@@ -886,16 +1225,17 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                  */
                                 IXGBE_RSC_CB(skb)->dma = rx_buffer_info->dma;
                         else
-                                pci_unmap_single(pdev, rx_buffer_info->dma,
+                                dma_unmap_single(&pdev->dev,
+                                                 rx_buffer_info->dma,
                                                  rx_ring->rx_buf_len,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
                         skb_put(skb, len);
                 }
 
                 if (upper_len) {
-                        pci_unmap_page(pdev, rx_buffer_info->page_dma,
-                                       PAGE_SIZE / 2, PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
+                                       PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                         skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
                                            rx_buffer_info->page,
@@ -937,9 +1277,10 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                                 skb = ixgbe_transform_rsc_queue(skb, &(rx_ring->rsc_count));
                         if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                                 if (IXGBE_RSC_CB(skb)->dma) {
-                                        pci_unmap_single(pdev, IXGBE_RSC_CB(skb)->dma,
+                                        dma_unmap_single(&pdev->dev,
+                                                         IXGBE_RSC_CB(skb)->dma,
                                                          rx_ring->rx_buf_len,
-                                                         PCI_DMA_FROMDEVICE);
+                                                         DMA_FROM_DEVICE);
                                         IXGBE_RSC_CB(skb)->dma = 0;
                                 }
                                 if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)
@@ -1190,6 +1531,15 @@ void ixgbe_write_eitr(struct ixgbe_q_vector *q_vector)
                 itr_reg |= (itr_reg << 16);
         } else if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
                 /*
+                 * 82599 can support a value of zero, so allow it for
+                 * max interrupt rate, but there is an errata where it can
+                 * not be zero with RSC
+                 */
+                if (itr_reg == 8 &&
+                    !(adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED))
+                        itr_reg = 0;
+
+                /*
                  * set the WDIS bit to not clear the timer bits and cause an
                  * immediate assertion of the interrupt
                  */
@@ -2372,7 +2722,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                 IXGBE_WRITE_REG(hw, IXGBE_VFRE(reg_offset), (1 << vf_shift));
                 IXGBE_WRITE_REG(hw, IXGBE_VFTE(reg_offset), (1 << vf_shift));
                 IXGBE_WRITE_REG(hw, IXGBE_PFDTXGSWC, IXGBE_PFDTXGSWC_VT_LBEN);
-                ixgbe_set_vmolr(hw, adapter->num_vfs);
+                ixgbe_set_vmolr(hw, adapter->num_vfs, true);
         }
 
         /* Program MRQC for the distribution of queues */
@@ -2936,8 +3286,13 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         for (i = 0; i < adapter->num_tx_queues; i++) {
                 j = adapter->tx_ring[i]->reg_idx;
                 txdctl = IXGBE_READ_REG(hw, IXGBE_TXDCTL(j));
-                /* enable WTHRESH=8 descriptors, to encourage burst writeback */
-                txdctl |= (8 << 16);
+                if (adapter->rx_itr_setting == 0) {
+                        /* cannot set wthresh when itr==0 */
+                        txdctl &= ~0x007F0000;
+                } else {
+                        /* enable WTHRESH=8 descriptors, to encourage burst writeback */
+                        txdctl |= (8 << 16);
+                }
                 IXGBE_WRITE_REG(hw, IXGBE_TXDCTL(j), txdctl);
         }
 
@@ -2991,6 +3346,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         else
                 ixgbe_configure_msi_and_legacy(adapter);
 
+        /* enable the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.enable_tx_laser(hw);
+
         clear_bit(__IXGBE_DOWN, &adapter->state);
         ixgbe_napi_enable_all(adapter);
 
@@ -3136,9 +3495,9 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
 
                 rx_buffer_info = &rx_ring->rx_buffer_info[i];
                 if (rx_buffer_info->dma) {
-                        pci_unmap_single(pdev, rx_buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, rx_buffer_info->dma,
                                          rx_ring->rx_buf_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
                 }
                 if (rx_buffer_info->skb) {
@@ -3147,9 +3506,10 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                         do {
                                 struct sk_buff *this = skb;
                                 if (IXGBE_RSC_CB(this)->dma) {
-                                        pci_unmap_single(pdev, IXGBE_RSC_CB(this)->dma,
+                                        dma_unmap_single(&pdev->dev,
+                                                         IXGBE_RSC_CB(this)->dma,
                                                          rx_ring->rx_buf_len,
-                                                         PCI_DMA_FROMDEVICE);
+                                                         DMA_FROM_DEVICE);
                                         IXGBE_RSC_CB(this)->dma = 0;
                                 }
                                 skb = skb->prev;
@@ -3159,8 +3519,8 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                 if (!rx_buffer_info->page)
                         continue;
                 if (rx_buffer_info->page_dma) {
-                        pci_unmap_page(pdev, rx_buffer_info->page_dma,
-                                       PAGE_SIZE / 2, PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
+                                       PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                 }
                 put_page(rx_buffer_info->page);
@@ -3252,6 +3612,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         /* signal that we are down to the interrupt handler */
         set_bit(__IXGBE_DOWN, &adapter->state);
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         /* disable receive for all VFs and wait one second */
         if (adapter->num_vfs) {
                 /* ping all the active vfs to let them know we are going down */
@@ -3269,22 +3633,23 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
         rxctrl = IXGBE_READ_REG(hw, IXGBE_RXCTRL);
         IXGBE_WRITE_REG(hw, IXGBE_RXCTRL, rxctrl & ~IXGBE_RXCTRL_RXEN);
 
-        netif_tx_disable(netdev);
-
         IXGBE_WRITE_FLUSH(hw);
         msleep(10);
 
         netif_tx_stop_all_queues(netdev);
 
-        ixgbe_irq_disable(adapter);
-
-        ixgbe_napi_disable_all(adapter);
-
         clear_bit(__IXGBE_SFP_MODULE_NOT_FOUND, &adapter->state);
         del_timer_sync(&adapter->sfp_timer);
         del_timer_sync(&adapter->watchdog_timer);
         cancel_work_sync(&adapter->watchdog_task);
 
+        netif_carrier_off(netdev);
+        netif_tx_disable(netdev);
+
+        ixgbe_irq_disable(adapter);
+
+        ixgbe_napi_disable_all(adapter);
+
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
             adapter->flags & IXGBE_FLAG_FDIR_PERFECT_CAPABLE)
                 cancel_work_sync(&adapter->fdir_reinit_task);
@@ -3302,8 +3667,6 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
                                 (IXGBE_READ_REG(hw, IXGBE_DMATXCTL) &
                                  ~IXGBE_DMATXCTL_TE));
 
-        netif_carrier_off(netdev);
-
         /* clear n-tuple filters that are cached */
         ethtool_ntuple_flush(netdev);
 
@@ -3380,6 +3743,8 @@ static void ixgbe_reset_task(struct work_struct *work)
 
         adapter->tx_timeout_count++;
 
+        ixgbe_dump(adapter);
+        netdev_err(adapter->netdev, "Reset adapter\n");
         ixgbe_reinit_locked(adapter);
 }
 
@@ -4382,8 +4747,8 @@ int ixgbe_setup_tx_resources(struct ixgbe_adapter *adapter,
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
 
-        tx_ring->desc = pci_alloc_consistent(pdev, tx_ring->size,
-                                             &tx_ring->dma);
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
         if (!tx_ring->desc)
                 goto err;
 
@@ -4453,7 +4818,8 @@ int ixgbe_setup_rx_resources(struct ixgbe_adapter *adapter,
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
         rx_ring->size = ALIGN(rx_ring->size, 4096);
 
-        rx_ring->desc = pci_alloc_consistent(pdev, rx_ring->size, &rx_ring->dma);
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
 
         if (!rx_ring->desc) {
                 DPRINTK(PROBE, ERR,
@@ -4514,7 +4880,8 @@ void ixgbe_free_tx_resources(struct ixgbe_adapter *adapter,
         vfree(tx_ring->tx_buffer_info);
         tx_ring->tx_buffer_info = NULL;
 
-        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
+                          tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -4551,7 +4918,8 @@ void ixgbe_free_rx_resources(struct ixgbe_adapter *adapter,
         vfree(rx_ring->rx_buffer_info);
         rx_ring->rx_buffer_info = NULL;
 
-        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
+                          rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -5421,10 +5789,10 @@ static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
 
                 tx_buffer_info->length = size;
                 tx_buffer_info->mapped_as_page = false;
-                tx_buffer_info->dma = pci_map_single(pdev,
+                tx_buffer_info->dma = dma_map_single(&pdev->dev,
                                                      skb->data + offset,
-                                                     size, PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, tx_buffer_info->dma))
+                                                     size, DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
                         goto dma_error;
                 tx_buffer_info->time_stamp = jiffies;
                 tx_buffer_info->next_to_watch = i;
@@ -5457,12 +5825,12 @@ static int ixgbe_tx_map(struct ixgbe_adapter *adapter,
                         size = min(len, (uint)IXGBE_MAX_DATA_PER_TXD);
 
                         tx_buffer_info->length = size;
-                        tx_buffer_info->dma = pci_map_page(adapter->pdev,
+                        tx_buffer_info->dma = dma_map_page(&adapter->pdev->dev,
                                                            frag->page,
                                                            offset, size,
-                                                           PCI_DMA_TODEVICE);
+                                                           DMA_TO_DEVICE);
                         tx_buffer_info->mapped_as_page = true;
-                        if (pci_dma_mapping_error(pdev, tx_buffer_info->dma))
+                        if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
                                 goto dma_error;
                         tx_buffer_info->time_stamp = jiffies;
                         tx_buffer_info->next_to_watch = i;
@@ -5943,6 +6311,10 @@ static const struct net_device_ops ixgbe_netdev_ops = {
         .ndo_vlan_rx_add_vid    = ixgbe_vlan_rx_add_vid,
         .ndo_vlan_rx_kill_vid   = ixgbe_vlan_rx_kill_vid,
         .ndo_do_ioctl           = ixgbe_ioctl,
+        .ndo_set_vf_mac         = ixgbe_ndo_set_vf_mac,
+        .ndo_set_vf_vlan        = ixgbe_ndo_set_vf_vlan,
+        .ndo_set_vf_tx_rate     = ixgbe_ndo_set_vf_bw,
+        .ndo_get_vf_config      = ixgbe_ndo_get_vf_config,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ixgbe_netpoll,
 #endif
@@ -6040,13 +6412,14 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (err)
                 return err;
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
-            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                 pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
                         if (err) {
                                 dev_err(&pdev->dev, "No usable DMA "
                                         "configuration, aborting\n");
@@ -6262,6 +6635,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                 goto err_eeprom;
         }
 
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
+
         init_timer(&adapter->watchdog_timer);
         adapter->watchdog_timer.function = &ixgbe_watchdog;
         adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -6409,16 +6786,6 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
         del_timer_sync(&adapter->sfp_timer);
         cancel_work_sync(&adapter->watchdog_task);
         cancel_work_sync(&adapter->sfp_task);
-        if (adapter->hw.phy.multispeed_fiber) {
-                struct ixgbe_hw *hw = &adapter->hw;
-                /*
-                 * Restart clause 37 autoneg, disable and re-enable
-                 * the tx laser, to clear & alert the link partner
-                 * that it needs to restart autotry
-                 */
-                hw->mac.autotry_restart = true;
-                hw->mac.ops.flap_tx_laser(hw);
-        }
         cancel_work_sync(&adapter->multispeed_fiber_task);
         cancel_work_sync(&adapter->sfp_config_module_task);
         if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_sriov.c b/drivers/net/ixgbe/ixgbe_sriov.c
index d4cd20f30199..f6cee94ec8e8 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ixgbe/ixgbe_sriov.c
@@ -48,7 +48,11 @@ int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
                             int entries, u16 *hash_list, u32 vf)
 {
         struct vf_data_storage *vfinfo = &adapter->vfinfo[vf];
+        struct ixgbe_hw *hw = &adapter->hw;
         int i;
+        u32 vector_bit;
+        u32 vector_reg;
+        u32 mta_reg;
 
         /* only so many hash values supported */
         entries = min(entries, IXGBE_MAX_VF_MC_ENTRIES);
@@ -68,8 +72,13 @@ int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
                 vfinfo->vf_mc_hashes[i] = hash_list[i];;
         }
 
-        /* Flush and reset the mta with the new values */
-        ixgbe_set_rx_mode(adapter->netdev);
+        for (i = 0; i < vfinfo->num_vf_mc_hashes; i++) {
+                vector_reg = (vfinfo->vf_mc_hashes[i] >> 5) & 0x7F;
+                vector_bit = vfinfo->vf_mc_hashes[i] & 0x1F;
+                mta_reg = IXGBE_READ_REG(hw, IXGBE_MTA(vector_reg));
+                mta_reg |= (1 << vector_bit);
+                IXGBE_WRITE_REG(hw, IXGBE_MTA(vector_reg), mta_reg);
+        }
 
         return 0;
 }
@@ -98,38 +107,51 @@ void ixgbe_restore_vf_multicasts(struct ixgbe_adapter *adapter)
 
 int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid, u32 vf)
 {
-        u32 ctrl;
-
-        /* Check if global VLAN already set, if not set it */
-        ctrl = IXGBE_READ_REG(&adapter->hw, IXGBE_VLNCTRL);
-        if (!(ctrl & IXGBE_VLNCTRL_VFE)) {
-                /* enable VLAN tag insert/strip */
-                ctrl |= IXGBE_VLNCTRL_VFE;
-                ctrl &= ~IXGBE_VLNCTRL_CFIEN;
-                IXGBE_WRITE_REG(&adapter->hw, IXGBE_VLNCTRL, ctrl);
-        }
-
         return adapter->hw.mac.ops.set_vfta(&adapter->hw, vid, vf, (bool)add);
 }
 
 
-void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf)
+void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe)
 {
         u32 vmolr = IXGBE_READ_REG(hw, IXGBE_VMOLR(vf));
-        vmolr |= (IXGBE_VMOLR_AUPE |
-                  IXGBE_VMOLR_ROMPE |
+        vmolr |= (IXGBE_VMOLR_ROMPE |
                   IXGBE_VMOLR_ROPE |
                   IXGBE_VMOLR_BAM);
+        if (aupe)
+                vmolr |= IXGBE_VMOLR_AUPE;
+        else
+                vmolr &= ~IXGBE_VMOLR_AUPE;
         IXGBE_WRITE_REG(hw, IXGBE_VMOLR(vf), vmolr);
 }
 
+static void ixgbe_set_vmvir(struct ixgbe_adapter *adapter, u32 vid, u32 vf)
+{
+        struct ixgbe_hw *hw = &adapter->hw;
+
+        if (vid)
+                IXGBE_WRITE_REG(hw, IXGBE_VMVIR(vf),
+                                (vid | IXGBE_VMVIR_VLANA_DEFAULT));
+        else
+                IXGBE_WRITE_REG(hw, IXGBE_VMVIR(vf), 0);
+}
+
 inline void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf)
 {
         struct ixgbe_hw *hw = &adapter->hw;
 
         /* reset offloads to defaults */
-        ixgbe_set_vmolr(hw, vf);
-
+        if (adapter->vfinfo[vf].pf_vlan) {
+                ixgbe_set_vf_vlan(adapter, true,
+                                  adapter->vfinfo[vf].pf_vlan, vf);
+                ixgbe_set_vmvir(adapter,
+                                (adapter->vfinfo[vf].pf_vlan |
+                                 (adapter->vfinfo[vf].pf_qos <<
+                                  VLAN_PRIO_SHIFT)), vf);
+                ixgbe_set_vmolr(hw, vf, false);
+        } else {
+                ixgbe_set_vmvir(adapter, 0, vf);
+                ixgbe_set_vmolr(hw, vf, true);
+        }
 
         /* reset multicast table array for vf */
         adapter->vfinfo[vf].num_vf_mc_hashes = 0;
@@ -263,10 +285,12 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf)
         case IXGBE_VF_SET_MAC_ADDR:
                 {
                         u8 *new_mac = ((u8 *)(&msgbuf[1]));
-                        if (is_valid_ether_addr(new_mac))
+                        if (is_valid_ether_addr(new_mac) &&
+                            !adapter->vfinfo[vf].pf_set_mac)
                                 ixgbe_set_vf_mac(adapter, vf, new_mac);
                         else
-                                retval = -1;
+                                ixgbe_set_vf_mac(adapter,
+                                  vf, adapter->vfinfo[vf].vf_mac_addresses);
                 }
                 break;
         case IXGBE_VF_SET_MULTICAST:
@@ -360,3 +384,76 @@ void ixgbe_ping_all_vfs(struct ixgbe_adapter *adapter)
         }
 }
 
+int ixgbe_ndo_set_vf_mac(struct net_device *netdev, int vf, u8 *mac)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        if (!is_valid_ether_addr(mac) || (vf >= adapter->num_vfs))
+                return -EINVAL;
+        adapter->vfinfo[vf].pf_set_mac = true;
+        dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", mac, vf);
+        dev_info(&adapter->pdev->dev, "Reload the VF driver to make this"
+                                      " change effective.");
+        if (test_bit(__IXGBE_DOWN, &adapter->state)) {
+                dev_warn(&adapter->pdev->dev, "The VF MAC address has been set,"
+                         " but the PF device is not up.\n");
+                dev_warn(&adapter->pdev->dev, "Bring the PF device up before"
+                         " attempting to use the VF device.\n");
+        }
+        return ixgbe_set_vf_mac(adapter, vf, mac);
+}
+
+int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos)
+{
+        int err = 0;
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+
+        if ((vf >= adapter->num_vfs) || (vlan > 4095) || (qos > 7))
+                return -EINVAL;
+        if (vlan || qos) {
+                err = ixgbe_set_vf_vlan(adapter, true, vlan, vf);
+                if (err)
+                        goto out;
+                ixgbe_set_vmvir(adapter, vlan | (qos << VLAN_PRIO_SHIFT), vf);
+                ixgbe_set_vmolr(&adapter->hw, vf, false);
+                adapter->vfinfo[vf].pf_vlan = vlan;
+                adapter->vfinfo[vf].pf_qos = qos;
+                dev_info(&adapter->pdev->dev,
+                         "Setting VLAN %d, QOS 0x%x on VF %d\n", vlan, qos, vf);
+                if (test_bit(__IXGBE_DOWN, &adapter->state)) {
+                        dev_warn(&adapter->pdev->dev,
+                                 "The VF VLAN has been set,"
+                                 " but the PF device is not up.\n");
+                        dev_warn(&adapter->pdev->dev,
+                                 "Bring the PF device up before"
+                                 " attempting to use the VF device.\n");
+                }
+        } else {
+                err = ixgbe_set_vf_vlan(adapter, false,
+                                        adapter->vfinfo[vf].pf_vlan, vf);
+                ixgbe_set_vmvir(adapter, vlan, vf);
+                ixgbe_set_vmolr(&adapter->hw, vf, true);
+                adapter->vfinfo[vf].pf_vlan = 0;
+                adapter->vfinfo[vf].pf_qos = 0;
+       }
+out:
+       return err;
+}
+
+int ixgbe_ndo_set_vf_bw(struct net_device *netdev, int vf, int tx_rate)
+{
+        return -EOPNOTSUPP;
+}
+
+int ixgbe_ndo_get_vf_config(struct net_device *netdev,
+                            int vf, struct ifla_vf_info *ivi)
+{
+        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        if (vf >= adapter->num_vfs)
+                return -EINVAL;
+        ivi->vf = vf;
+        memcpy(&ivi->mac, adapter->vfinfo[vf].vf_mac_addresses, ETH_ALEN);
+        ivi->tx_rate = 0;
+        ivi->vlan = adapter->vfinfo[vf].pf_vlan;
+        ivi->qos = adapter->vfinfo[vf].pf_qos;
+        return 0;
+}
diff --git a/drivers/net/ixgbe/ixgbe_sriov.h b/drivers/net/ixgbe/ixgbe_sriov.h
index 51d1106c45a1..184730ecdfb6 100644
--- a/drivers/net/ixgbe/ixgbe_sriov.h
+++ b/drivers/net/ixgbe/ixgbe_sriov.h
@@ -32,7 +32,7 @@ int ixgbe_set_vf_multicasts(struct ixgbe_adapter *adapter,
                             int entries, u16 *hash_list, u32 vf);
 void ixgbe_restore_vf_multicasts(struct ixgbe_adapter *adapter);
 int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid, u32 vf);
-void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf);
+void ixgbe_set_vmolr(struct ixgbe_hw *hw, u32 vf, bool aupe);
 void ixgbe_vf_reset_event(struct ixgbe_adapter *adapter, u32 vf);
 void ixgbe_vf_reset_msg(struct ixgbe_adapter *adapter, u32 vf);
 void ixgbe_msg_task(struct ixgbe_adapter *adapter);
@@ -42,6 +42,12 @@ int ixgbe_vf_configuration(struct pci_dev *pdev, unsigned int event_mask);
 void ixgbe_disable_tx_rx(struct ixgbe_adapter *adapter);
 void ixgbe_ping_all_vfs(struct ixgbe_adapter *adapter);
 void ixgbe_dump_registers(struct ixgbe_adapter *adapter);
+int ixgbe_ndo_set_vf_mac(struct net_device *netdev, int queue, u8 *mac);
+int ixgbe_ndo_set_vf_vlan(struct net_device *netdev, int queue, u16 vlan,
+                           u8 qos);
+int ixgbe_ndo_set_vf_bw(struct net_device *netdev, int vf, int tx_rate);
+int ixgbe_ndo_get_vf_config(struct net_device *netdev,
+                            int vf, struct ifla_vf_info *ivi);
 
 #endif /* _IXGBE_SRIOV_H_ */
 
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index aed4ed665648..4277cbbb8126 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -219,6 +219,7 @@
 #define IXGBE_MTQC      0x08120
 #define IXGBE_VLVF(_i)  (0x0F100 + ((_i) * 4))  /* 64 of these (0-63) */
 #define IXGBE_VLVFB(_i) (0x0F200 + ((_i) * 4))  /* 128 of these (0-127) */
+#define IXGBE_VMVIR(_i) (0x08000 + ((_i) * 4))  /* 64 of these (0-63) */
 #define IXGBE_VT_CTL    0x051B0
 #define IXGBE_VFRE(_i)  (0x051E0 + ((_i) * 4))
 #define IXGBE_VFTE(_i)  (0x08110 + ((_i) * 4))
@@ -1311,6 +1312,10 @@
 #define IXGBE_VLVF_ENTRIES      64
 #define IXGBE_VLVF_VLANID_MASK  0x00000FFF
 
+/* Per VF Port VLAN insertion rules */
+#define IXGBE_VMVIR_VLANA_DEFAULT 0x40000000 /* Always use default VLAN */
+#define IXGBE_VMVIR_VLANA_NEVER   0x80000000 /* Never insert VLAN tag */
+
 #define IXGBE_ETHERNET_IEEE_VLAN_TYPE 0x8100  /* 802.1q protocol */
 
 /* STATUS Bit Masks */
@@ -2398,6 +2403,8 @@ struct ixgbe_mac_operations {
         s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
 
         /* Link */
+        void (*disable_tx_laser)(struct ixgbe_hw *);
+        void (*enable_tx_laser)(struct ixgbe_hw *);
         void (*flap_tx_laser)(struct ixgbe_hw *);
         s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
         s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
diff --git a/drivers/net/ixgbevf/defines.h b/drivers/net/ixgbevf/defines.h
index c44fdb05447a..ca2c81f49a05 100644
--- a/drivers/net/ixgbevf/defines.h
+++ b/drivers/net/ixgbevf/defines.h
@@ -41,11 +41,13 @@ typedef u32 ixgbe_link_speed;
 #define IXGBE_LINK_SPEED_1GB_FULL       0x0020
 #define IXGBE_LINK_SPEED_10GB_FULL      0x0080
 
-#define IXGBE_CTRL_RST          0x04000000 /* Reset (SW) */
-#define IXGBE_RXDCTL_ENABLE     0x02000000 /* Enable specific Rx Queue */
-#define IXGBE_TXDCTL_ENABLE     0x02000000 /* Enable specific Tx Queue */
-#define IXGBE_LINKS_UP          0x40000000
-#define IXGBE_LINKS_SPEED       0x20000000
+#define IXGBE_CTRL_RST              0x04000000 /* Reset (SW) */
+#define IXGBE_RXDCTL_ENABLE         0x02000000 /* Enable specific Rx Queue */
+#define IXGBE_TXDCTL_ENABLE         0x02000000 /* Enable specific Tx Queue */
+#define IXGBE_LINKS_UP              0x40000000
+#define IXGBE_LINKS_SPEED_82599     0x30000000
+#define IXGBE_LINKS_SPEED_10G_82599 0x30000000
+#define IXGBE_LINKS_SPEED_1G_82599  0x20000000
 
 /* Number of Transmit and Receive Descriptors must be a multiple of 8 */
 #define IXGBE_REQ_TX_DESCRIPTOR_MULTIPLE  8
diff --git a/drivers/net/ixgbevf/ixgbevf_main.c b/drivers/net/ixgbevf/ixgbevf_main.c
index f484161418b6..460c37fee965 100644
--- a/drivers/net/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ixgbevf/ixgbevf_main.c
@@ -139,15 +139,15 @@ static void ixgbevf_unmap_and_free_tx_resource(struct ixgbevf_adapter *adapter,
 {
         if (tx_buffer_info->dma) {
                 if (tx_buffer_info->mapped_as_page)
-                        pci_unmap_page(adapter->pdev,
+                        dma_unmap_page(&adapter->pdev->dev,
                                        tx_buffer_info->dma,
                                        tx_buffer_info->length,
-                                       PCI_DMA_TODEVICE);
+                                       DMA_TO_DEVICE);
                 else
-                        pci_unmap_single(adapter->pdev,
+                        dma_unmap_single(&adapter->pdev->dev,
                                          tx_buffer_info->dma,
                                          tx_buffer_info->length,
-                                         PCI_DMA_TODEVICE);
+                                         DMA_TO_DEVICE);
                 tx_buffer_info->dma = 0;
         }
         if (tx_buffer_info->skb) {
@@ -416,10 +416,10 @@ static void ixgbevf_alloc_rx_buffers(struct ixgbevf_adapter *adapter,
                                 bi->page_offset ^= (PAGE_SIZE / 2);
                         }
 
-                        bi->page_dma = pci_map_page(pdev, bi->page,
+                        bi->page_dma = dma_map_page(&pdev->dev, bi->page,
                                                     bi->page_offset,
                                                     (PAGE_SIZE / 2),
-                                                    PCI_DMA_FROMDEVICE);
+                                                    DMA_FROM_DEVICE);
                 }
 
                 skb = bi->skb;
@@ -442,9 +442,9 @@ static void ixgbevf_alloc_rx_buffers(struct ixgbevf_adapter *adapter,
                         bi->skb = skb;
                 }
                 if (!bi->dma) {
-                        bi->dma = pci_map_single(pdev, skb->data,
+                        bi->dma = dma_map_single(&pdev->dev, skb->data,
                                                  rx_ring->rx_buf_len,
-                                                 PCI_DMA_FROMDEVICE);
+                                                 DMA_FROM_DEVICE);
                 }
                 /* Refresh the desc even if buffer_addrs didn't change because
                  * each write-back erases this info. */
@@ -536,16 +536,16 @@ static bool ixgbevf_clean_rx_irq(struct ixgbevf_q_vector *q_vector,
                 rx_buffer_info->skb = NULL;
 
                 if (rx_buffer_info->dma) {
-                        pci_unmap_single(pdev, rx_buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, rx_buffer_info->dma,
                                          rx_ring->rx_buf_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
                         skb_put(skb, len);
                 }
 
                 if (upper_len) {
-                        pci_unmap_page(pdev, rx_buffer_info->page_dma,
-                                       PAGE_SIZE / 2, PCI_DMA_FROMDEVICE);
+                        dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
+                                       PAGE_SIZE / 2, DMA_FROM_DEVICE);
                         rx_buffer_info->page_dma = 0;
                         skb_fill_page_desc(skb, skb_shinfo(skb)->nr_frags,
                                            rx_buffer_info->page,
@@ -961,12 +961,28 @@ static irqreturn_t ixgbevf_msix_mbx(int irq, void *data)
         eicr = IXGBE_READ_REG(hw, IXGBE_VTEICS);
         IXGBE_WRITE_REG(hw, IXGBE_VTEICR, eicr);
 
+        if (!hw->mbx.ops.check_for_ack(hw)) {
+                /*
+                 * checking for the ack clears the PFACK bit.  Place
+                 * it back in the v2p_mailbox cache so that anyone
+                 * polling for an ack will not miss it.  Also
+                 * avoid the read below because the code to read
+                 * the mailbox will also clear the ack bit.  This was
+                 * causing lost acks.  Just cache the bit and exit
+                 * the IRQ handler.
+                 */
+                hw->mbx.v2p_mailbox |= IXGBE_VFMAILBOX_PFACK;
+                goto out;
+        }
+
+        /* Not an ack interrupt, go ahead and read the message */
         hw->mbx.ops.read(hw, &msg, 1);
 
         if ((msg & IXGBE_MBVFICR_VFREQ_MASK) == IXGBE_PF_CONTROL_MSG)
                 mod_timer(&adapter->watchdog_timer,
                           round_jiffies(jiffies + 1));
 
+out:
         return IRQ_HANDLED;
 }
 
@@ -1721,9 +1737,9 @@ static void ixgbevf_clean_rx_ring(struct ixgbevf_adapter *adapter,
 
                 rx_buffer_info = &rx_ring->rx_buffer_info[i];
                 if (rx_buffer_info->dma) {
-                        pci_unmap_single(pdev, rx_buffer_info->dma,
+                        dma_unmap_single(&pdev->dev, rx_buffer_info->dma,
                                          rx_ring->rx_buf_len,
-                                         PCI_DMA_FROMDEVICE);
+                                         DMA_FROM_DEVICE);
                         rx_buffer_info->dma = 0;
                 }
                 if (rx_buffer_info->skb) {
@@ -1737,8 +1753,8 @@ static void ixgbevf_clean_rx_ring(struct ixgbevf_adapter *adapter,
                 }
                 if (!rx_buffer_info->page)
                         continue;
-                pci_unmap_page(pdev, rx_buffer_info->page_dma, PAGE_SIZE / 2,
-                               PCI_DMA_FROMDEVICE);
+                dma_unmap_page(&pdev->dev, rx_buffer_info->page_dma,
+                               PAGE_SIZE / 2, DMA_FROM_DEVICE);
                 rx_buffer_info->page_dma = 0;
                 put_page(rx_buffer_info->page);
                 rx_buffer_info->page = NULL;
@@ -2445,7 +2461,8 @@ void ixgbevf_free_tx_resources(struct ixgbevf_adapter *adapter,
         vfree(tx_ring->tx_buffer_info);
         tx_ring->tx_buffer_info = NULL;
 
-        pci_free_consistent(pdev, tx_ring->size, tx_ring->desc, tx_ring->dma);
+        dma_free_coherent(&pdev->dev, tx_ring->size, tx_ring->desc,
+                          tx_ring->dma);
 
         tx_ring->desc = NULL;
 }
@@ -2490,8 +2507,8 @@ int ixgbevf_setup_tx_resources(struct ixgbevf_adapter *adapter,
         tx_ring->size = tx_ring->count * sizeof(union ixgbe_adv_tx_desc);
         tx_ring->size = ALIGN(tx_ring->size, 4096);
 
-        tx_ring->desc = pci_alloc_consistent(pdev, tx_ring->size,
-                                             &tx_ring->dma);
+        tx_ring->desc = dma_alloc_coherent(&pdev->dev, tx_ring->size,
+                                           &tx_ring->dma, GFP_KERNEL);
         if (!tx_ring->desc)
                 goto err;
 
@@ -2561,8 +2578,8 @@ int ixgbevf_setup_rx_resources(struct ixgbevf_adapter *adapter,
         rx_ring->size = rx_ring->count * sizeof(union ixgbe_adv_rx_desc);
         rx_ring->size = ALIGN(rx_ring->size, 4096);
 
-        rx_ring->desc = pci_alloc_consistent(pdev, rx_ring->size,
-                                             &rx_ring->dma);
+        rx_ring->desc = dma_alloc_coherent(&pdev->dev, rx_ring->size,
+                                           &rx_ring->dma, GFP_KERNEL);
 
         if (!rx_ring->desc) {
                 hw_dbg(&adapter->hw,
@@ -2623,7 +2640,8 @@ void ixgbevf_free_rx_resources(struct ixgbevf_adapter *adapter,
         vfree(rx_ring->rx_buffer_info);
         rx_ring->rx_buffer_info = NULL;
 
-        pci_free_consistent(pdev, rx_ring->size, rx_ring->desc, rx_ring->dma);
+        dma_free_coherent(&pdev->dev, rx_ring->size, rx_ring->desc,
+                          rx_ring->dma);
 
         rx_ring->desc = NULL;
 }
@@ -2935,10 +2953,10 @@ static int ixgbevf_tx_map(struct ixgbevf_adapter *adapter,
 
                 tx_buffer_info->length = size;
                 tx_buffer_info->mapped_as_page = false;
-                tx_buffer_info->dma = pci_map_single(adapter->pdev,
+                tx_buffer_info->dma = dma_map_single(&adapter->pdev->dev,
                                                      skb->data + offset,
-                                                     size, PCI_DMA_TODEVICE);
-                if (pci_dma_mapping_error(pdev, tx_buffer_info->dma))
+                                                     size, DMA_TO_DEVICE);
+                if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
                         goto dma_error;
                 tx_buffer_info->time_stamp = jiffies;
                 tx_buffer_info->next_to_watch = i;
@@ -2964,13 +2982,13 @@ static int ixgbevf_tx_map(struct ixgbevf_adapter *adapter,
                         size = min(len, (unsigned int)IXGBE_MAX_DATA_PER_TXD);
 
                         tx_buffer_info->length = size;
-                        tx_buffer_info->dma = pci_map_page(adapter->pdev,
+                        tx_buffer_info->dma = dma_map_page(&adapter->pdev->dev,
                                                            frag->page,
                                                            offset,
                                                            size,
-                                                           PCI_DMA_TODEVICE);
+                                                           DMA_TO_DEVICE);
                         tx_buffer_info->mapped_as_page = true;
-                        if (pci_dma_mapping_error(pdev, tx_buffer_info->dma))
+                        if (dma_mapping_error(&pdev->dev, tx_buffer_info->dma))
                                 goto dma_error;
                         tx_buffer_info->time_stamp = jiffies;
                         tx_buffer_info->next_to_watch = i;
@@ -3311,14 +3329,14 @@ static int __devinit ixgbevf_probe(struct pci_dev *pdev,
         if (err)
                 return err;
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) &&
-            !pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) &&
+            !dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
                 pci_using_dac = 1;
         } else {
-                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
                 if (err) {
-                        err = pci_set_consistent_dma_mask(pdev,
-                                                          DMA_BIT_MASK(32));
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
                         if (err) {
                                 dev_err(&pdev->dev, "No usable DMA "
                                         "configuration, aborting\n");
diff --git a/drivers/net/ixgbevf/vf.c b/drivers/net/ixgbevf/vf.c
index 852e9c4fd934..f6f929958ba0 100644
--- a/drivers/net/ixgbevf/vf.c
+++ b/drivers/net/ixgbevf/vf.c
@@ -359,7 +359,8 @@ static s32 ixgbevf_check_mac_link_vf(struct ixgbe_hw *hw,
         else
                 *link_up = false;
 
-        if (links_reg & IXGBE_LINKS_SPEED)
+        if ((links_reg & IXGBE_LINKS_SPEED_82599) ==
+            IXGBE_LINKS_SPEED_10G_82599)
                 *speed = IXGBE_LINK_SPEED_10GB_FULL;
         else
                 *speed = IXGBE_LINK_SPEED_1GB_FULL;
diff --git a/drivers/net/ks8842.c b/drivers/net/ks8842.c
index b91492f4e48a..f852ab3ae9cf 100644
--- a/drivers/net/ks8842.c
+++ b/drivers/net/ks8842.c
@@ -1,5 +1,5 @@
 /*
- * ks8842_main.c timberdale KS8842 ethernet driver
+ * ks8842.c timberdale KS8842 ethernet driver
  * Copyright (c) 2009 Intel Corporation
  *
  * This program is free software; you can redistribute it and/or modify
@@ -28,6 +28,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
+#include <linux/ks8842.h>
 
 #define DRV_NAME "ks8842"
 
@@ -304,6 +305,20 @@ static void ks8842_read_mac_addr(struct ks8842_adapter *adapter, u8 *dest)
         ks8842_write16(adapter, 39, mac, REG_MACAR3);
 }
 
+static void ks8842_write_mac_addr(struct ks8842_adapter *adapter, u8 *mac)
+{
+        unsigned long flags;
+        unsigned i;
+
+        spin_lock_irqsave(&adapter->lock, flags);
+        for (i = 0; i < ETH_ALEN; i++) {
+                ks8842_write8(adapter, 2, mac[ETH_ALEN - i - 1], REG_MARL + i);
+                ks8842_write8(adapter, 39, mac[ETH_ALEN - i - 1],
+                        REG_MACAR1 + i);
+        }
+        spin_unlock_irqrestore(&adapter->lock, flags);
+}
+
 static inline u16 ks8842_tx_fifo_space(struct ks8842_adapter *adapter)
 {
         return ks8842_read16(adapter, 16, REG_TXMIR) & 0x1fff;
@@ -522,6 +537,8 @@ static int ks8842_open(struct net_device *netdev)
         /* reset the HW */
         ks8842_reset_hw(adapter);
 
+        ks8842_write_mac_addr(adapter, netdev->dev_addr);
+
         ks8842_update_link_status(netdev, adapter);
 
         err = request_irq(adapter->irq, ks8842_irq, IRQF_SHARED, DRV_NAME,
@@ -568,10 +585,8 @@ static netdev_tx_t ks8842_xmit_frame(struct sk_buff *skb,
 static int ks8842_set_mac(struct net_device *netdev, void *p)
 {
         struct ks8842_adapter *adapter = netdev_priv(netdev);
-        unsigned long flags;
         struct sockaddr *addr = p;
         char *mac = (u8 *)addr->sa_data;
-        int i;
 
         dev_dbg(&adapter->pdev->dev, "%s: entry\n", __func__);
 
@@ -580,13 +595,7 @@ static int ks8842_set_mac(struct net_device *netdev, void *p)
 
         memcpy(netdev->dev_addr, mac, netdev->addr_len);
 
-        spin_lock_irqsave(&adapter->lock, flags);
-        for (i = 0; i < ETH_ALEN; i++) {
-                ks8842_write8(adapter, 2, mac[ETH_ALEN - i - 1], REG_MARL + i);
-                ks8842_write8(adapter, 39, mac[ETH_ALEN - i - 1],
-                        REG_MACAR1 + i);
-        }
-        spin_unlock_irqrestore(&adapter->lock, flags);
+        ks8842_write_mac_addr(adapter, mac);
         return 0;
 }
 
@@ -605,6 +614,8 @@ static void ks8842_tx_timeout(struct net_device *netdev)
 
         ks8842_reset_hw(adapter);
 
+        ks8842_write_mac_addr(adapter, netdev->dev_addr);
+
         ks8842_update_link_status(netdev, adapter);
 }
 
@@ -627,7 +638,9 @@ static int __devinit ks8842_probe(struct platform_device *pdev)
         struct resource *iomem;
         struct net_device *netdev;
         struct ks8842_adapter *adapter;
+        struct ks8842_platform_data *pdata = pdev->dev.platform_data;
         u16 id;
+        unsigned i;
 
         iomem = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!request_mem_region(iomem->start, resource_size(iomem), DRV_NAME))
@@ -658,7 +671,25 @@ static int __devinit ks8842_probe(struct platform_device *pdev)
         netdev->netdev_ops = &ks8842_netdev_ops;
         netdev->ethtool_ops = &ks8842_ethtool_ops;
 
-        ks8842_read_mac_addr(adapter, netdev->dev_addr);
+        /* Check if a mac address was given */
+        i = netdev->addr_len;
+        if (pdata) {
+                for (i = 0; i < netdev->addr_len; i++)
+                        if (pdata->macaddr[i] != 0)
+                                break;
+
+                if (i < netdev->addr_len)
+                        /* an address was passed, use it */
+                        memcpy(netdev->dev_addr, pdata->macaddr,
+                                netdev->addr_len);
+        }
+
+        if (i == netdev->addr_len) {
+                ks8842_read_mac_addr(adapter, netdev->dev_addr);
+
+                if (!is_valid_ether_addr(netdev->dev_addr))
+                        random_ether_addr(netdev->dev_addr);
+        }
 
         id = ks8842_read16(adapter, 32, REG_SW_ID_AND_ENABLE);
 
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 4dcd61f81ec2..b4fb07a6f13f 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -78,7 +78,9 @@ union ks8851_tx_hdr {
  * @msg_enable: The message flags controlling driver output (see ethtool).
  * @fid: Incrementing frame id tag.
  * @rc_ier: Cached copy of KS_IER.
+ * @rc_ccr: Cached copy of KS_CCR.
  * @rc_rxqcr: Cached copy of KS_RXQCR.
+ * @eeprom_size: Companion eeprom size in Bytes, 0 if no eeprom
  *
  * The @lock ensures that the chip is protected when certain operations are
  * in progress. When the read or write packet transfer is in progress, most
@@ -109,6 +111,8 @@ struct ks8851_net {
 
         u16                     rc_ier;
         u16                     rc_rxqcr;
+        u16                     rc_ccr;
+        u16                     eeprom_size;
 
         struct mii_if_info      mii;
         struct ks8851_rxctrl    rxctrl;
@@ -717,12 +721,14 @@ static void ks8851_tx_work(struct work_struct *work)
                 txb = skb_dequeue(&ks->txq);
                 last = skb_queue_empty(&ks->txq);
 
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                if (txb != NULL) {
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                        ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
 
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
         }
 
         mutex_unlock(&ks->lock);
@@ -1028,6 +1034,234 @@ static const struct net_device_ops ks8851_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
+/* Companion eeprom access */
+
+enum {  /* EEPROM programming states */
+        EEPROM_CONTROL,
+        EEPROM_ADDRESS,
+        EEPROM_DATA,
+        EEPROM_COMPLETE
+};
+
+/**
+ * ks8851_eeprom_read - read a 16bits word in ks8851 companion EEPROM
+ * @dev: The network device the PHY is on.
+ * @addr: EEPROM address to read
+ *
+ * eeprom_size: used to define the data coding length. Can be changed
+ * through debug-fs.
+ *
+ * Programs a read on the EEPROM using ks8851 EEPROM SW access feature.
+ * Warning: The READ feature is not supported on ks8851 revision 0.
+ *
+ * Rough programming model:
+ *  - on period start: set clock high and read value on bus
+ *  - on period / 2: set clock low and program value on bus
+ *  - start on period / 2
+ */
+unsigned int ks8851_eeprom_read(struct net_device *dev, unsigned int addr)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int eepcr;
+        int ctrl = EEPROM_OP_READ;
+        int state = EEPROM_CONTROL;
+        int bit_count = EEPROM_OP_LEN - 1;
+        unsigned int data = 0;
+        int dummy;
+        unsigned int addr_len;
+
+        addr_len = (ks->eeprom_size == 128) ? 6 : 8;
+
+        /* start transaction: chip select high, authorize write */
+        mutex_lock(&ks->lock);
+        eepcr = EEPCR_EESA | EEPCR_EESRWA;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        eepcr |= EEPCR_EECS;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        mutex_unlock(&ks->lock);
+
+        while (state != EEPROM_COMPLETE) {
+                /* falling clock period starts... */
+                /* set EED_IO pin for control and address */
+                eepcr &= ~EEPCR_EEDO;
+                switch (state) {
+                case EEPROM_CONTROL:
+                        eepcr |= ((ctrl >> bit_count) & 1) << 2;
+                        if (bit_count-- <= 0) {
+                                bit_count = addr_len - 1;
+                                state = EEPROM_ADDRESS;
+                        }
+                        break;
+                case EEPROM_ADDRESS:
+                        eepcr |= ((addr >> bit_count) & 1) << 2;
+                        bit_count--;
+                        break;
+                case EEPROM_DATA:
+                        /* Change to receive mode */
+                        eepcr &= ~EEPCR_EESRWA;
+                        break;
+                }
+
+                /* lower clock  */
+                eepcr &= ~EEPCR_EESCK;
+
+                mutex_lock(&ks->lock);
+                ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+                mutex_unlock(&ks->lock);
+
+                /* waitread period / 2 */
+                udelay(EEPROM_SK_PERIOD / 2);
+
+                /* rising clock period starts... */
+
+                /* raise clock */
+                mutex_lock(&ks->lock);
+                eepcr |= EEPCR_EESCK;
+                ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+                mutex_unlock(&ks->lock);
+
+                /* Manage read */
+                switch (state) {
+                case EEPROM_ADDRESS:
+                        if (bit_count < 0) {
+                                bit_count = EEPROM_DATA_LEN - 1;
+                                state = EEPROM_DATA;
+                        }
+                        break;
+                case EEPROM_DATA:
+                        mutex_lock(&ks->lock);
+                        dummy = ks8851_rdreg16(ks, KS_EEPCR);
+                        mutex_unlock(&ks->lock);
+                        data |= ((dummy >> EEPCR_EESB_OFFSET) & 1) << bit_count;
+                        if (bit_count-- <= 0)
+                                state = EEPROM_COMPLETE;
+                        break;
+                }
+
+                /* wait period / 2 */
+                udelay(EEPROM_SK_PERIOD / 2);
+        }
+
+        /* close transaction */
+        mutex_lock(&ks->lock);
+        eepcr &= ~EEPCR_EECS;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        eepcr = 0;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        mutex_unlock(&ks->lock);
+
+        return data;
+}
+
+/**
+ * ks8851_eeprom_write - write a 16bits word in ks8851 companion EEPROM
+ * @dev: The network device the PHY is on.
+ * @op: operand (can be WRITE, EWEN, EWDS)
+ * @addr: EEPROM address to write
+ * @data: data to write
+ *
+ * eeprom_size: used to define the data coding length. Can be changed
+ * through debug-fs.
+ *
+ * Programs a write on the EEPROM using ks8851 EEPROM SW access feature.
+ *
+ * Note that a write enable is required before writing data.
+ *
+ * Rough programming model:
+ *  - on period start: set clock high
+ *  - on period / 2: set clock low and program value on bus
+ *  - start on period / 2
+ */
+void ks8851_eeprom_write(struct net_device *dev, unsigned int op,
+                                        unsigned int addr, unsigned int data)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        int eepcr;
+        int state = EEPROM_CONTROL;
+        int bit_count = EEPROM_OP_LEN - 1;
+        unsigned int addr_len;
+
+        addr_len = (ks->eeprom_size == 128) ? 6 : 8;
+
+        switch (op) {
+        case EEPROM_OP_EWEN:
+                addr = 0x30;
+        break;
+        case EEPROM_OP_EWDS:
+                addr = 0;
+                break;
+        }
+
+        /* start transaction: chip select high, authorize write */
+        mutex_lock(&ks->lock);
+        eepcr = EEPCR_EESA | EEPCR_EESRWA;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        eepcr |= EEPCR_EECS;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        mutex_unlock(&ks->lock);
+
+        while (state != EEPROM_COMPLETE) {
+                /* falling clock period starts... */
+                /* set EED_IO pin for control and address */
+                eepcr &= ~EEPCR_EEDO;
+                switch (state) {
+                case EEPROM_CONTROL:
+                        eepcr |= ((op >> bit_count) & 1) << 2;
+                        if (bit_count-- <= 0) {
+                                bit_count = addr_len - 1;
+                                state = EEPROM_ADDRESS;
+                        }
+                        break;
+                case EEPROM_ADDRESS:
+                        eepcr |= ((addr >> bit_count) & 1) << 2;
+                        if (bit_count-- <= 0) {
+                                if (op == EEPROM_OP_WRITE) {
+                                        bit_count = EEPROM_DATA_LEN - 1;
+                                        state = EEPROM_DATA;
+                                } else {
+                                        state = EEPROM_COMPLETE;
+                                }
+                        }
+                        break;
+                case EEPROM_DATA:
+                        eepcr |= ((data >> bit_count) & 1) << 2;
+                        if (bit_count-- <= 0)
+                                state = EEPROM_COMPLETE;
+                        break;
+                }
+
+                /* lower clock  */
+                eepcr &= ~EEPCR_EESCK;
+
+                mutex_lock(&ks->lock);
+                ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+                mutex_unlock(&ks->lock);
+
+                /* wait period / 2 */
+                udelay(EEPROM_SK_PERIOD / 2);
+
+                /* rising clock period starts... */
+
+                /* raise clock */
+                eepcr |= EEPCR_EESCK;
+                mutex_lock(&ks->lock);
+                ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+                mutex_unlock(&ks->lock);
+
+                /* wait period / 2 */
+                udelay(EEPROM_SK_PERIOD / 2);
+        }
+
+        /* close transaction */
+        mutex_lock(&ks->lock);
+        eepcr &= ~EEPCR_EECS;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        eepcr = 0;
+        ks8851_wrreg16(ks, KS_EEPCR, eepcr);
+        mutex_unlock(&ks->lock);
+
+}
+
 /* ethtool support */
 
 static void ks8851_get_drvinfo(struct net_device *dev,
@@ -1074,6 +1308,117 @@ static int ks8851_nway_reset(struct net_device *dev)
         return mii_nway_restart(&ks->mii);
 }
 
+static int ks8851_get_eeprom_len(struct net_device *dev)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        return ks->eeprom_size;
+}
+
+static int ks8851_get_eeprom(struct net_device *dev,
+                            struct ethtool_eeprom *eeprom, u8 *bytes)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        u16 *eeprom_buff;
+        int first_word;
+        int last_word;
+        int ret_val = 0;
+        u16 i;
+
+        if (eeprom->len == 0)
+                return -EINVAL;
+
+        if (eeprom->len > ks->eeprom_size)
+                return -EINVAL;
+
+        eeprom->magic = ks8851_rdreg16(ks, KS_CIDER);
+
+        first_word = eeprom->offset >> 1;
+        last_word = (eeprom->offset + eeprom->len - 1) >> 1;
+
+        eeprom_buff = kmalloc(sizeof(u16) *
+                        (last_word - first_word + 1), GFP_KERNEL);
+        if (!eeprom_buff)
+                return -ENOMEM;
+
+        for (i = 0; i < last_word - first_word + 1; i++)
+                eeprom_buff[i] = ks8851_eeprom_read(dev, first_word + 1);
+
+        /* Device's eeprom is little-endian, word addressable */
+        for (i = 0; i < last_word - first_word + 1; i++)
+                le16_to_cpus(&eeprom_buff[i]);
+
+        memcpy(bytes, (u8 *)eeprom_buff + (eeprom->offset & 1), eeprom->len);
+        kfree(eeprom_buff);
+
+        return ret_val;
+}
+
+static int ks8851_set_eeprom(struct net_device *dev,
+                            struct ethtool_eeprom *eeprom, u8 *bytes)
+{
+        struct ks8851_net *ks = netdev_priv(dev);
+        u16 *eeprom_buff;
+        void *ptr;
+        int max_len;
+        int first_word;
+        int last_word;
+        int ret_val = 0;
+        u16 i;
+
+        if (eeprom->len == 0)
+                return -EOPNOTSUPP;
+
+        if (eeprom->len > ks->eeprom_size)
+                return -EINVAL;
+
+        if (eeprom->magic != ks8851_rdreg16(ks, KS_CIDER))
+                return -EFAULT;
+
+        first_word = eeprom->offset >> 1;
+        last_word = (eeprom->offset + eeprom->len - 1) >> 1;
+        max_len = (last_word - first_word + 1) * 2;
+        eeprom_buff = kmalloc(max_len, GFP_KERNEL);
+        if (!eeprom_buff)
+                return -ENOMEM;
+
+        ptr = (void *)eeprom_buff;
+
+        if (eeprom->offset & 1) {
+                /* need read/modify/write of first changed EEPROM word */
+                /* only the second byte of the word is being modified */
+                eeprom_buff[0] = ks8851_eeprom_read(dev, first_word);
+                ptr++;
+        }
+        if ((eeprom->offset + eeprom->len) & 1)
+                /* need read/modify/write of last changed EEPROM word */
+                /* only the first byte of the word is being modified */
+                eeprom_buff[last_word - first_word] =
+                                        ks8851_eeprom_read(dev, last_word);
+
+
+        /* Device's eeprom is little-endian, word addressable */
+        le16_to_cpus(&eeprom_buff[0]);
+        le16_to_cpus(&eeprom_buff[last_word - first_word]);
+
+        memcpy(ptr, bytes, eeprom->len);
+
+        for (i = 0; i < last_word - first_word + 1; i++)
+                eeprom_buff[i] = cpu_to_le16(eeprom_buff[i]);
+
+        ks8851_eeprom_write(dev, EEPROM_OP_EWEN, 0, 0);
+
+        for (i = 0; i < last_word - first_word + 1; i++) {
+                ks8851_eeprom_write(dev, EEPROM_OP_WRITE, first_word + i,
+                                                        eeprom_buff[i]);
+                mdelay(EEPROM_WRITE_TIME);
+        }
+
+        ks8851_eeprom_write(dev, EEPROM_OP_EWDS, 0, 0);
+
+        kfree(eeprom_buff);
+        return ret_val;
+}
+
 static const struct ethtool_ops ks8851_ethtool_ops = {
         .get_drvinfo    = ks8851_get_drvinfo,
         .get_msglevel   = ks8851_get_msglevel,
@@ -1082,6 +1427,9 @@ static const struct ethtool_ops ks8851_ethtool_ops = {
         .set_settings   = ks8851_set_settings,
         .get_link       = ks8851_get_link,
         .nway_reset     = ks8851_nway_reset,
+        .get_eeprom_len = ks8851_get_eeprom_len,
+        .get_eeprom     = ks8851_get_eeprom,
+        .set_eeprom     = ks8851_set_eeprom,
 };
 
 /* MII interface controls */
@@ -1267,6 +1615,14 @@ static int __devinit ks8851_probe(struct spi_device *spi)
                 goto err_id;
         }
 
+        /* cache the contents of the CCR register for EEPROM, etc. */
+        ks->rc_ccr = ks8851_rdreg16(ks, KS_CCR);
+
+        if (ks->rc_ccr & CCR_EEPROM)
+                ks->eeprom_size = 128;
+        else
+                ks->eeprom_size = 0;
+
         ks8851_read_selftest(ks);
         ks8851_init_mac(ks);
 
diff --git a/drivers/net/ks8851.h b/drivers/net/ks8851.h
index f52c312cc356..537fb06e5932 100644
--- a/drivers/net/ks8851.h
+++ b/drivers/net/ks8851.h
@@ -25,12 +25,24 @@
 #define OBCR_ODS_16mA                           (1 << 6)
 
 #define KS_EEPCR                                0x22
+#define EEPCR_EESRWA                            (1 << 5)
 #define EEPCR_EESA                              (1 << 4)
-#define EEPCR_EESB                              (1 << 3)
+#define EEPCR_EESB_OFFSET                       3
+#define EEPCR_EESB                              (1 << EEPCR_EESB_OFFSET)
 #define EEPCR_EEDO                              (1 << 2)
 #define EEPCR_EESCK                             (1 << 1)
 #define EEPCR_EECS                              (1 << 0)
 
+#define EEPROM_OP_LEN                           3       /* bits:*/
+#define EEPROM_OP_READ                          0x06
+#define EEPROM_OP_EWEN                          0x04
+#define EEPROM_OP_WRITE                         0x05
+#define EEPROM_OP_EWDS                          0x14
+
+#define EEPROM_DATA_LEN                         16      /* 16 bits EEPROM */
+#define EEPROM_WRITE_TIME                       4       /* wrt ack time in ms */
+#define EEPROM_SK_PERIOD                        400     /* in us */
+
 #define KS_MBIR                                 0x24
 #define MBIR_TXMBF                              (1 << 12)
 #define MBIR_TXMBFA                             (1 << 11)
diff --git a/drivers/net/lib8390.c b/drivers/net/lib8390.c
index 526dc9cbc3c6..770b606a9e3a 100644
--- a/drivers/net/lib8390.c
+++ b/drivers/net/lib8390.c
@@ -445,14 +445,14 @@ static irqreturn_t __ei_interrupt(int irq, void *dev_id)
 
         if (ei_local->irqlock)
         {
-#if 1 /* This might just be an interrupt for a PCI device sharing this line */
-                /* The "irqlock" check is only for testing. */
-                printk(ei_local->irqlock
-                           ? "%s: Interrupted while interrupts are masked! isr=%#2x imr=%#2x.\n"
-                           : "%s: Reentering the interrupt handler! isr=%#2x imr=%#2x.\n",
+                /*
+                 * This might just be an interrupt for a PCI device sharing
+                 * this line
+                 */
+                printk("%s: Interrupted while interrupts are masked!"
+                           " isr=%#2x imr=%#2x.\n",
                            dev->name, ei_inb_p(e8390_base + EN0_ISR),
                            ei_inb_p(e8390_base + EN0_IMR));
-#endif
                 spin_unlock(&ei_local->page_lock);
                 return IRQ_NONE;
         }
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index abba3cc81f12..a8a94e2f6ddc 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -37,6 +37,8 @@
 struct macvtap_queue {
         struct sock sk;
         struct socket sock;
+        struct socket_wq wq;
+        int vnet_hdr_sz;
         struct macvlan_dev *vlan;
         struct file *file;
         unsigned int flags;
@@ -181,7 +183,7 @@ static int macvtap_forward(struct net_device *dev, struct sk_buff *skb)
                 return -ENOLINK;
 
         skb_queue_tail(&q->sk.sk_receive_queue, skb);
-        wake_up_interruptible_poll(q->sk.sk_sleep, POLLIN | POLLRDNORM | POLLRDBAND);
+        wake_up_interruptible_poll(sk_sleep(&q->sk), POLLIN | POLLRDNORM | POLLRDBAND);
         return 0;
 }
 
@@ -242,12 +244,15 @@ static struct rtnl_link_ops macvtap_link_ops __read_mostly = {
 
 static void macvtap_sock_write_space(struct sock *sk)
 {
+        wait_queue_head_t *wqueue;
+
         if (!sock_writeable(sk) ||
             !test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
                 return;
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible_poll(sk->sk_sleep, POLLOUT | POLLWRNORM | POLLWRBAND);
+        wqueue = sk_sleep(sk);
+        if (wqueue && waitqueue_active(wqueue))
+                wake_up_interruptible_poll(wqueue, POLLOUT | POLLWRNORM | POLLWRBAND);
 }
 
 static int macvtap_open(struct inode *inode, struct file *file)
@@ -272,7 +277,8 @@ static int macvtap_open(struct inode *inode, struct file *file)
         if (!q)
                 goto out;
 
-        init_waitqueue_head(&q->sock.wait);
+        q->sock.wq = &q->wq;
+        init_waitqueue_head(&q->wq.wait);
         q->sock.type = SOCK_RAW;
         q->sock.state = SS_CONNECTED;
         q->sock.file = file;
@@ -280,6 +286,7 @@ static int macvtap_open(struct inode *inode, struct file *file)
         sock_init_data(&q->sock, &q->sk);
         q->sk.sk_write_space = macvtap_sock_write_space;
         q->flags = IFF_VNET_HDR | IFF_NO_PI | IFF_TAP;
+        q->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
         err = macvtap_set_queue(dev, file, q);
         if (err)
@@ -308,7 +315,7 @@ static unsigned int macvtap_poll(struct file *file, poll_table * wait)
                 goto out;
 
         mask = 0;
-        poll_wait(file, &q->sock.wait, wait);
+        poll_wait(file, &q->wq.wait, wait);
 
         if (!skb_queue_empty(&q->sk.sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
@@ -440,14 +447,14 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q,
         int vnet_hdr_len = 0;
 
         if (q->flags & IFF_VNET_HDR) {
-                vnet_hdr_len = sizeof(vnet_hdr);
+                vnet_hdr_len = q->vnet_hdr_sz;
 
                 err = -EINVAL;
                 if ((len -= vnet_hdr_len) < 0)
                         goto err;
 
                 err = memcpy_fromiovecend((void *)&vnet_hdr, iv, 0,
-                                           vnet_hdr_len);
+                                           sizeof(vnet_hdr));
                 if (err < 0)
                         goto err;
                 if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
@@ -529,7 +536,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
 
         if (q->flags & IFF_VNET_HDR) {
                 struct virtio_net_hdr vnet_hdr;
-                vnet_hdr_len = sizeof (vnet_hdr);
+                vnet_hdr_len = q->vnet_hdr_sz;
                 if ((len -= vnet_hdr_len) < 0)
                         return -EINVAL;
 
@@ -537,7 +544,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q,
                 if (ret)
                         return ret;
 
-                if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, vnet_hdr_len))
+                if (memcpy_toiovecend(iv, (void *)&vnet_hdr, 0, sizeof(vnet_hdr)))
                         return -EFAULT;
         }
 
@@ -562,7 +569,7 @@ static ssize_t macvtap_do_read(struct macvtap_queue *q, struct kiocb *iocb,
         struct sk_buff *skb;
         ssize_t ret = 0;
 
-        add_wait_queue(q->sk.sk_sleep, &wait);
+        add_wait_queue(sk_sleep(&q->sk), &wait);
         while (len) {
                 current->state = TASK_INTERRUPTIBLE;
 
@@ -587,7 +594,7 @@ static ssize_t macvtap_do_read(struct macvtap_queue *q, struct kiocb *iocb,
         }
 
         current->state = TASK_RUNNING;
-        remove_wait_queue(q->sk.sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(&q->sk), &wait);
         return ret;
 }
 
@@ -622,6 +629,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
         struct ifreq __user *ifr = argp;
         unsigned int __user *up = argp;
         unsigned int u;
+        int __user *sp = argp;
+        int s;
         int ret;
 
         switch (cmd) {
@@ -667,6 +676,21 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
                 q->sk.sk_sndbuf = u;
                 return 0;
 
+        case TUNGETVNETHDRSZ:
+                s = q->vnet_hdr_sz;
+                if (put_user(s, sp))
+                        return -EFAULT;
+                return 0;
+
+        case TUNSETVNETHDRSZ:
+                if (get_user(s, sp))
+                        return -EFAULT;
+                if (s < (int)sizeof(struct virtio_net_hdr))
+                        return -EINVAL;
+
+                q->vnet_hdr_sz = s;
+                return 0;
+
         case TUNSETOFFLOAD:
                 /* let the user check for future flags */
                 if (arg & ~(TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 |
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index a361dea35574..ca142c47b2e4 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -665,7 +665,8 @@ static int netconsole_netdev_event(struct notifier_block *this,
         struct netconsole_target *nt;
         struct net_device *dev = ptr;
 
-        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER ||
+              event == NETDEV_BONDING_DESLAVE || event == NETDEV_GOING_DOWN))
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
@@ -677,19 +678,21 @@ static int netconsole_netdev_event(struct notifier_block *this,
                                 strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                 break;
                         case NETDEV_UNREGISTER:
-                                if (!nt->enabled)
-                                        break;
                                 netpoll_cleanup(&nt->np);
+                                /* Fall through */
+                        case NETDEV_GOING_DOWN:
+                        case NETDEV_BONDING_DESLAVE:
                                 nt->enabled = 0;
-                                printk(KERN_INFO "netconsole: network logging stopped"
-                                        ", interface %s unregistered\n",
-                                        dev->name);
                                 break;
                         }
                 }
                 netconsole_target_put(nt);
         }
         spin_unlock_irqrestore(&target_list_lock, flags);
+        if (event == NETDEV_UNREGISTER || event == NETDEV_BONDING_DESLAVE)
+                printk(KERN_INFO "netconsole: network logging stopped, "
+                        "interface %s %s\n",  dev->name,
+                        event == NETDEV_UNREGISTER ? "unregistered" : "released slaves");
 
 done:
         return NOTIFY_DONE;
diff --git a/drivers/net/niu.c b/drivers/net/niu.c
index ef940226ee22..30abb4e436f1 100644
--- a/drivers/net/niu.c
+++ b/drivers/net/niu.c
@@ -36,8 +36,8 @@
 #include "niu.h"
 
 #define DRV_MODULE_NAME         "niu"
-#define DRV_MODULE_VERSION      "1.0"
-#define DRV_MODULE_RELDATE      "Nov 14, 2008"
+#define DRV_MODULE_VERSION      "1.1"
+#define DRV_MODULE_RELDATE      "Apr 22, 2010"
 
 static char version[] __devinitdata =
         DRV_MODULE_NAME ".c:v" DRV_MODULE_VERSION " (" DRV_MODULE_RELDATE ")\n";
@@ -3444,6 +3444,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                               struct rx_ring_info *rp)
 {
         unsigned int index = rp->rcr_index;
+        struct rx_pkt_hdr1 *rh;
         struct sk_buff *skb;
         int len, num_rcr;
 
@@ -3477,9 +3478,6 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                 if (num_rcr == 1) {
                         int ptype;
 
-                        off += 2;
-                        append_size -= 2;
-
                         ptype = (val >> RCR_ENTRY_PKT_TYPE_SHIFT);
                         if ((ptype == RCR_PKT_TYPE_TCP ||
                              ptype == RCR_PKT_TYPE_UDP) &&
@@ -3488,8 +3486,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
                                 skb->ip_summed = CHECKSUM_UNNECESSARY;
                         else
                                 skb->ip_summed = CHECKSUM_NONE;
-                }
-                if (!(val & RCR_ENTRY_MULTI))
+                } else if (!(val & RCR_ENTRY_MULTI))
                         append_size = len - skb->len;
 
                 niu_rx_skb_append(skb, page, off, append_size);
@@ -3510,8 +3507,17 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
         }
         rp->rcr_index = index;
 
-        skb_reserve(skb, NET_IP_ALIGN);
-        __pskb_pull_tail(skb, min(len, VLAN_ETH_HLEN));
+        len += sizeof(*rh);
+        len = min_t(int, len, sizeof(*rh) + VLAN_ETH_HLEN);
+        __pskb_pull_tail(skb, len);
+
+        rh = (struct rx_pkt_hdr1 *) skb->data;
+        if (np->dev->features & NETIF_F_RXHASH)
+                skb->rxhash = ((u32)rh->hashval2_0 << 24 |
+                               (u32)rh->hashval2_1 << 16 |
+                               (u32)rh->hashval1_1 << 8 |
+                               (u32)rh->hashval1_2 << 0);
+        skb_pull(skb, sizeof(*rh));
 
         rp->rx_packets++;
         rp->rx_bytes += skb->len;
@@ -4946,7 +4952,9 @@ static int niu_init_one_rx_channel(struct niu *np, struct rx_ring_info *rp)
               RX_DMA_CTL_STAT_RCRTO |
               RX_DMA_CTL_STAT_RBR_EMPTY));
         nw64(RXDMA_CFIG1(channel), rp->mbox_dma >> 32);
-        nw64(RXDMA_CFIG2(channel), (rp->mbox_dma & 0x00000000ffffffc0));
+        nw64(RXDMA_CFIG2(channel),
+             ((rp->mbox_dma & RXDMA_CFIG2_MBADDR_L) |
+              RXDMA_CFIG2_FULL_HDR));
         nw64(RBR_CFIG_A(channel),
              ((u64)rp->rbr_table_size << RBR_CFIG_A_LEN_SHIFT) |
              (rp->rbr_dma & (RBR_CFIG_A_STADDR_BASE | RBR_CFIG_A_STADDR)));
@@ -7910,6 +7918,18 @@ static int niu_phys_id(struct net_device *dev, u32 data)
         return 0;
 }
 
+static int niu_set_flags(struct net_device *dev, u32 data)
+{
+        if (data & (ETH_FLAG_LRO | ETH_FLAG_NTUPLE))
+                return -EOPNOTSUPP;
+
+        if (data & ETH_FLAG_RXHASH)
+                dev->features |= NETIF_F_RXHASH;
+        else
+                dev->features &= ~NETIF_F_RXHASH;
+        return 0;
+}
+
 static const struct ethtool_ops niu_ethtool_ops = {
         .get_drvinfo            = niu_get_drvinfo,
         .get_link               = ethtool_op_get_link,
@@ -7926,6 +7946,8 @@ static const struct ethtool_ops niu_ethtool_ops = {
         .phys_id                = niu_phys_id,
         .get_rxnfc              = niu_get_nfc,
         .set_rxnfc              = niu_set_nfc,
+        .set_flags              = niu_set_flags,
+        .get_flags              = ethtool_op_get_flags,
 };
 
 static int niu_ldg_assign_ldn(struct niu *np, struct niu_parent *parent,
@@ -9754,6 +9776,12 @@ static void __devinit niu_device_announce(struct niu *np)
         }
 }
 
+static void __devinit niu_set_basic_features(struct net_device *dev)
+{
+        dev->features |= (NETIF_F_SG | NETIF_F_HW_CSUM |
+                          NETIF_F_GRO | NETIF_F_RXHASH);
+}
+
 static int __devinit niu_pci_init_one(struct pci_dev *pdev,
                                       const struct pci_device_id *ent)
 {
@@ -9838,7 +9866,7 @@ static int __devinit niu_pci_init_one(struct pci_dev *pdev,
                 }
         }
 
-        dev->features |= (NETIF_F_SG | NETIF_F_HW_CSUM);
+        niu_set_basic_features(dev);
 
         np->regs = pci_ioremap_bar(pdev, 0);
         if (!np->regs) {
@@ -10080,7 +10108,7 @@ static int __devinit niu_of_probe(struct of_device *op,
                 goto err_out_free_dev;
         }
 
-        dev->features |= (NETIF_F_SG | NETIF_F_HW_CSUM);
+        niu_set_basic_features(dev);
 
         np->regs = of_ioremap(&op->resource[1], 0,
                               resource_size(&op->resource[1]),
diff --git a/drivers/net/niu.h b/drivers/net/niu.h
index 3bd0b5933d59..d6715465f35d 100644
--- a/drivers/net/niu.h
+++ b/drivers/net/niu.h
@@ -2706,7 +2706,7 @@ struct rx_pkt_hdr0 {
 #if defined(__LITTLE_ENDIAN_BITFIELD)
         u8      inputport:2,
                 maccheck:1,
-                class:4;
+                class:5;
         u8      vlan:1,
                 llcsnap:1,
                 noport:1,
@@ -2715,7 +2715,7 @@ struct rx_pkt_hdr0 {
                 tres:2,
                 tzfvld:1;
 #elif defined(__BIG_ENDIAN_BITFIELD)
-        u8      class:4,
+        u8      class:5,
                 maccheck:1,
                 inputport:2;
         u8      tzfvld:1,
@@ -2775,6 +2775,9 @@ struct rx_pkt_hdr1 {
         /* Bits 7:0 of hash value, H1.  */
         u8      hashval1_2;
 
+        u8      hwrsvd5;
+        u8      hwrsvd6;
+
         u8      usrdata_0;      /* Bits 39:32 of user data.  */
         u8      usrdata_1;      /* Bits 31:24 of user data.  */
         u8      usrdata_2;      /* Bits 23:16 of user data.  */
diff --git a/drivers/net/octeon/octeon_mgmt.c b/drivers/net/octeon/octeon_mgmt.c
index 6b1d443f2ce5..392470333174 100644
--- a/drivers/net/octeon/octeon_mgmt.c
+++ b/drivers/net/octeon/octeon_mgmt.c
@@ -189,12 +189,19 @@ static void octeon_mgmt_clean_tx_buffers(struct octeon_mgmt *p)
 
         mix_orcnt.u64 = cvmx_read_csr(CVMX_MIXX_ORCNT(port));
         while (mix_orcnt.s.orcnt) {
+                spin_lock_irqsave(&p->tx_list.lock, flags);
+
+                mix_orcnt.u64 = cvmx_read_csr(CVMX_MIXX_ORCNT(port));
+
+                if (mix_orcnt.s.orcnt == 0) {
+                        spin_unlock_irqrestore(&p->tx_list.lock, flags);
+                        break;
+                }
+
                 dma_sync_single_for_cpu(p->dev, p->tx_ring_handle,
                                         ring_size_to_bytes(OCTEON_MGMT_TX_RING_SIZE),
                                         DMA_BIDIRECTIONAL);
 
-                spin_lock_irqsave(&p->tx_list.lock, flags);
-
                 re.d64 = p->tx_ring[p->tx_next_clean];
                 p->tx_next_clean =
                         (p->tx_next_clean + 1) % OCTEON_MGMT_TX_RING_SIZE;
@@ -373,7 +380,6 @@ done:
         mix_ircnt.s.ircnt = 1;
         cvmx_write_csr(CVMX_MIXX_IRCNT(port), mix_ircnt.u64);
         return rc;
-
 }
 
 static int octeon_mgmt_receive_packets(struct octeon_mgmt *p, int budget)
@@ -383,7 +389,6 @@ static int octeon_mgmt_receive_packets(struct octeon_mgmt *p, int budget)
         union cvmx_mixx_ircnt mix_ircnt;
         int rc;
 
-
         mix_ircnt.u64 = cvmx_read_csr(CVMX_MIXX_IRCNT(port));
         while (work_done < budget && mix_ircnt.s.ircnt) {
 
@@ -475,12 +480,11 @@ static void octeon_mgmt_set_rx_filtering(struct net_device *netdev)
         unsigned int multicast_mode = 1; /* 1 - Reject all multicast.  */
         struct octeon_mgmt_cam_state cam_state;
         struct netdev_hw_addr *ha;
-        struct list_head *pos;
         int available_cam_entries;
 
         memset(&cam_state, 0, sizeof(cam_state));
 
-        if ((netdev->flags & IFF_PROMISC) || netdev->dev_addrs.count > 7) {
+        if ((netdev->flags & IFF_PROMISC) || netdev->uc.count > 7) {
                 cam_mode = 0;
                 available_cam_entries = 8;
         } else {
@@ -488,13 +492,13 @@ static void octeon_mgmt_set_rx_filtering(struct net_device *netdev)
                  * One CAM entry for the primary address, leaves seven
                  * for the secondary addresses.
                  */
-                available_cam_entries = 7 - netdev->dev_addrs.count;
+                available_cam_entries = 7 - netdev->uc.count;
         }
 
         if (netdev->flags & IFF_MULTICAST) {
                 if (cam_mode == 0 || (netdev->flags & IFF_ALLMULTI) ||
                     netdev_mc_count(netdev) > available_cam_entries)
-                        multicast_mode = 2; /* 1 - Accept all multicast.  */
+                        multicast_mode = 2; /* 2 - Accept all multicast.  */
                 else
                         multicast_mode = 0; /* 0 - Use CAM.  */
         }
@@ -502,19 +506,14 @@ static void octeon_mgmt_set_rx_filtering(struct net_device *netdev)
         if (cam_mode == 1) {
                 /* Add primary address. */
                 octeon_mgmt_cam_state_add(&cam_state, netdev->dev_addr);
-                list_for_each(pos, &netdev->dev_addrs.list) {
-                        struct netdev_hw_addr *hw_addr;
-                        hw_addr = list_entry(pos, struct netdev_hw_addr, list);
-                        octeon_mgmt_cam_state_add(&cam_state, hw_addr->addr);
-                        list = list->next;
-                }
+                netdev_for_each_uc_addr(ha, netdev)
+                        octeon_mgmt_cam_state_add(&cam_state, ha->addr);
         }
         if (multicast_mode == 0) {
                 netdev_for_each_mc_addr(ha, netdev)
                         octeon_mgmt_cam_state_add(&cam_state, ha->addr);
         }
 
-
         spin_lock_irqsave(&p->lock, flags);
 
         /* Disable packet I/O. */
@@ -523,7 +522,6 @@ static void octeon_mgmt_set_rx_filtering(struct net_device *netdev)
         agl_gmx_prtx.s.en = 0;
         cvmx_write_csr(CVMX_AGL_GMX_PRTX_CFG(port), agl_gmx_prtx.u64);
 
-
         adr_ctl.u64 = 0;
         adr_ctl.s.cam_mode = cam_mode;
         adr_ctl.s.mcst = multicast_mode;
@@ -596,8 +594,7 @@ static irqreturn_t octeon_mgmt_interrupt(int cpl, void *dev_id)
         mixx_isr.u64 = cvmx_read_csr(CVMX_MIXX_ISR(port));
 
         /* Clear any pending interrupts */
-        cvmx_write_csr(CVMX_MIXX_ISR(port),
-                       cvmx_read_csr(CVMX_MIXX_ISR(port)));
+        cvmx_write_csr(CVMX_MIXX_ISR(port), mixx_isr.u64);
         cvmx_read_csr(CVMX_MIXX_ISR(port));
 
         if (mixx_isr.s.irthresh) {
@@ -831,9 +828,9 @@ static int octeon_mgmt_open(struct net_device *netdev)
         mix_irhwm.s.irhwm = 0;
         cvmx_write_csr(CVMX_MIXX_IRHWM(port), mix_irhwm.u64);
 
-        /* Interrupt when we have 5 or more packets to clean.  */
+        /* Interrupt when we have 1 or more packets to clean.  */
         mix_orhwm.u64 = 0;
-        mix_orhwm.s.orhwm = 5;
+        mix_orhwm.s.orhwm = 1;
         cvmx_write_csr(CVMX_MIXX_ORHWM(port), mix_orhwm.u64);
 
         /* Enable receive and transmit interrupts */
@@ -927,7 +924,6 @@ static int octeon_mgmt_stop(struct net_device *netdev)
 
         octeon_mgmt_reset_hw(p);
 
-
         free_irq(p->irq, netdev);
 
         /* dma_unmap is a nop on Octeon, so just free everything.  */
@@ -944,7 +940,6 @@ static int octeon_mgmt_stop(struct net_device *netdev)
                          DMA_BIDIRECTIONAL);
         kfree(p->tx_ring);
 
-
         return 0;
 }
 
@@ -954,6 +949,7 @@ static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
         int port = p->port;
         union mgmt_port_ring_entry re;
         unsigned long flags;
+        int rv = NETDEV_TX_BUSY;
 
         re.d64 = 0;
         re.s.len = skb->len;
@@ -963,15 +959,18 @@ static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
 
         spin_lock_irqsave(&p->tx_list.lock, flags);
 
+        if (unlikely(p->tx_current_fill >= ring_max_fill(OCTEON_MGMT_TX_RING_SIZE) - 1)) {
+                spin_unlock_irqrestore(&p->tx_list.lock, flags);
+                netif_stop_queue(netdev);
+                spin_lock_irqsave(&p->tx_list.lock, flags);
+        }
+
         if (unlikely(p->tx_current_fill >=
                      ring_max_fill(OCTEON_MGMT_TX_RING_SIZE))) {
                 spin_unlock_irqrestore(&p->tx_list.lock, flags);
-
                 dma_unmap_single(p->dev, re.s.addr, re.s.len,
                                  DMA_TO_DEVICE);
-
-                netif_stop_queue(netdev);
-                return NETDEV_TX_BUSY;
+                goto out;
         }
 
         __skb_queue_tail(&p->tx_list, skb);
@@ -994,9 +993,10 @@ static int octeon_mgmt_xmit(struct sk_buff *skb, struct net_device *netdev)
         cvmx_write_csr(CVMX_MIXX_ORING2(port), 1);
 
         netdev->trans_start = jiffies;
-        octeon_mgmt_clean_tx_buffers(p);
+        rv = NETDEV_TX_OK;
+out:
         octeon_mgmt_update_tx_stats(netdev);
-        return NETDEV_TX_OK;
+        return rv;
 }
 
 #ifdef CONFIG_NET_POLL_CONTROLLER
@@ -1106,7 +1106,6 @@ static int __init octeon_mgmt_probe(struct platform_device *pdev)
         netdev->netdev_ops = &octeon_mgmt_ops;
         netdev->ethtool_ops = &octeon_mgmt_ethtool_ops;
 
-
         /* The mgmt ports get the first N MACs.  */
         for (i = 0; i < 6; i++)
                 netdev->dev_addr[i] = octeon_bootinfo->mac_addr_base[i];
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..757f87bb1db3 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -781,8 +781,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                   inw(ioaddr + EL3_STATUS));
 
         spin_lock_irqsave(&lp->window_lock, flags);
+
+        dev->stats.tx_bytes += skb->len;
+
+        /* Put out the doubleword header... */
         outw(skb->len, ioaddr + TX_FIFO);
         outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
         outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
 
         dev->trans_start = jiffies;
@@ -1021,8 +1026,6 @@ static void update_stats(struct net_device *dev)
         /* BadSSD */                               inb(ioaddr + 12);
         up                                       = inb(ioaddr + 13);
 
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
-
         EL3WINDOW(1);
 }
 
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index 408f3d7b1545..949ac1a12537 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1804,23 +1804,30 @@ static void media_check(u_long arg)
     SMC_SELECT_BANK(1);
     media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
 
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
+
     /* Check for pending interrupt with watchdog flag set: with
        this, we can limp along even if the interrupt is blocked */
     if (smc->watchdog++ && ((i>>8) & i)) {
         if (!smc->fast_poll)
             printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
         smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
         smc->fast_poll = HZ;
     }
     if (smc->fast_poll) {
         smc->fast_poll--;
         smc->media.expires = jiffies + HZ/100;
         add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
         return;
     }
 
+    spin_lock_irqsave(&smc->lock, flags);
+
+    saved_bank = inw(ioaddr + BANK_SELECT);
+
     if (smc->cfg & CFG_MII_SELECT) {
         if (smc->mii_if.phy_id < 0)
             goto reschedule;
@@ -1978,15 +1985,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_gset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_get_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -1996,15 +2004,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         int ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         if (smc->cfg & CFG_MII_SELECT)
                 ret = mii_ethtool_sset(&smc->mii_if, ecmd);
         else
                 ret = smc_netdev_set_ecmd(dev, ecmd);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2014,12 +2023,13 @@ static u32 smc_get_link(struct net_device *dev)
         unsigned int ioaddr = dev->base_addr;
         u16 saved_bank = inw(ioaddr + BANK_SELECT);
         u32 ret;
+        unsigned long flags;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         SMC_SELECT_BANK(3);
         ret = smc_link_ok(dev);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return ret;
 }
 
@@ -2056,16 +2066,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
         int rc = 0;
         u16 saved_bank;
         unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
 
         if (!netif_running(dev))
                 return -EINVAL;
 
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
         saved_bank = inw(ioaddr + BANK_SELECT);
         SMC_SELECT_BANK(3);
         rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
         SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
         return rc;
 }
 
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d78..a527e37728cd 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
         ---help---
           Supports the LSI ET1011C PHY.
 
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
+
 config FIXED_PHY
         bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
         depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af381..13bebab65d02 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 000000000000..68dd107bad24
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,113 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+
+
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+
+
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+
+static int __init ksphy_init(void)
+{
+        int ret;
+
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
+
+static struct mdio_device_id micrel_tbl[] = {
+        { PHY_ID_KSZ9021, 0x000fff10 },
+        { PHY_ID_VSC8201, 0x00fffff0 },
+        { PHY_ID_KS8001, 0x00fffff0 },
+        { }
+};
+
+MODULE_DEVICE_TABLE(mdio, micrel_tbl);
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 35f195329fdd..5441688daba7 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         DECLARE_WAITQUEUE(wait, current);
         ssize_t ret;
         struct sk_buff *skb = NULL;
+        struct iovec iov;
 
         ret = count;
 
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
         if (skb->len > count)
                 goto outf;
         ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                 goto outf;
         ret = skb->len;
 
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         struct channel *pch = chan->ppp;
         int proto;
 
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                 kfree_skb(skb);
                 return;
         }
 
-        proto = PPP_PROTO(skb);
         read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+
+        proto = PPP_PROTO(skb);
         if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                 /* put it on the channel queue */
                 skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
         } else {
                 ppp_do_recv(pch->ppp, skb, pch);
         }
+
+done:
         read_unlock_bh(&pch->upl);
 }
 
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                 /* XXX do channel-level decompression here */
                 if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                 else
 #endif /* CONFIG_PPP_MULTILINK */
                         ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
         }
-
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 
 static void
diff --git a/drivers/net/pppoe.c b/drivers/net/pppoe.c
index cdd11ba100ea..99f031a08a01 100644
--- a/drivers/net/pppoe.c
+++ b/drivers/net/pppoe.c
@@ -258,7 +258,7 @@ static inline struct pppox_sock *get_item_by_addr(struct net *net,
         dev = dev_get_by_name_rcu(net, sp->sa_addr.pppoe.dev);
         if (dev) {
                 ifindex = dev->ifindex;
-                pn = net_generic(net, pppoe_net_id);
+                pn = pppoe_pernet(net);
                 pppox_sock = get_item(pn, sp->sa_addr.pppoe.sid,
                                 sp->sa_addr.pppoe.remote, ifindex);
         }
@@ -290,12 +290,6 @@ static void pppoe_flush_dev(struct net_device *dev)
         struct pppoe_net *pn;
         int i;
 
-        BUG_ON(dev == NULL);
-
-        pn = pppoe_pernet(dev_net(dev));
-        if (!pn) /* already freed */
-                return;
-
         write_lock_bh(&pn->hash_lock);
         for (i = 0; i < PPPOE_HASH_SIZE; i++) {
                 struct pppox_sock *po = pn->hash_table[i];
diff --git a/drivers/net/qlcnic/qlcnic.h b/drivers/net/qlcnic/qlcnic.h
index 28c148cbe37b..2fba9cd5946f 100644
--- a/drivers/net/qlcnic/qlcnic.h
+++ b/drivers/net/qlcnic/qlcnic.h
@@ -51,8 +51,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 1
-#define QLCNIC_LINUX_VERSIONID  "5.0.1"
+#define _QLCNIC_LINUX_SUBVERSION 2
+#define QLCNIC_LINUX_VERSIONID  "5.0.2"
 
 #define QLCNIC_VERSION_CODE(a, b, c)    (((a) << 24) + ((b) << 16) + (c))
 #define _major(v)       (((v) >> 24) & 0xff)
@@ -428,6 +428,10 @@ struct qlcnic_adapter_stats {
         u64  xmit_on;
         u64  xmit_off;
         u64  skb_alloc_failure;
+        u64  null_skb;
+        u64  null_rxbuf;
+        u64  rx_dma_map_error;
+        u64  tx_dma_map_error;
 };
 
 /*
diff --git a/drivers/net/qlcnic/qlcnic_ethtool.c b/drivers/net/qlcnic/qlcnic_ethtool.c
index 08d6f105371f..6cdc5ebb7411 100644
--- a/drivers/net/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/qlcnic/qlcnic_ethtool.c
@@ -69,6 +69,14 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
                 QLC_SIZEOF(stats.xmit_off), QLC_OFF(stats.xmit_off)},
         {"skb_alloc_failure", QLC_SIZEOF(stats.skb_alloc_failure),
                 QLC_OFF(stats.skb_alloc_failure)},
+        {"null skb",
+                QLC_SIZEOF(stats.null_skb), QLC_OFF(stats.null_skb)},
+        {"null rxbuf",
+                QLC_SIZEOF(stats.null_rxbuf), QLC_OFF(stats.null_rxbuf)},
+        {"rx dma map error", QLC_SIZEOF(stats.rx_dma_map_error),
+                                         QLC_OFF(stats.rx_dma_map_error)},
+        {"tx dma map error", QLC_SIZEOF(stats.tx_dma_map_error),
+                                         QLC_OFF(stats.tx_dma_map_error)},
 
 };
 
diff --git a/drivers/net/qlcnic/qlcnic_hdr.h b/drivers/net/qlcnic/qlcnic_hdr.h
index 51fa3fbcf58a..a984cd227582 100644
--- a/drivers/net/qlcnic/qlcnic_hdr.h
+++ b/drivers/net/qlcnic/qlcnic_hdr.h
@@ -694,17 +694,24 @@ enum {
 #define QLCNIC_CRB_DRV_STATE               (QLCNIC_CAM_RAM(0x144))
 #define QLCNIC_CRB_DRV_SCRATCH             (QLCNIC_CAM_RAM(0x148))
 #define QLCNIC_CRB_DEV_PARTITION_INFO      (QLCNIC_CAM_RAM(0x14c))
-#define QLCNIC_CRB_DRV_IDC_VER             (QLCNIC_CAM_RAM(0x14c))
+#define QLCNIC_CRB_DRV_IDC_VER          (QLCNIC_CAM_RAM(0x174))
 #define QLCNIC_ROM_DEV_INIT_TIMEOUT     (0x3e885c)
 #define QLCNIC_ROM_DRV_RESET_TIMEOUT    (0x3e8860)
 
-                 /* Device State */
-#define QLCNIC_DEV_COLD                 1
-#define QLCNIC_DEV_INITALIZING          2
-#define QLCNIC_DEV_READY                3
-#define QLCNIC_DEV_NEED_RESET           4
-#define QLCNIC_DEV_NEED_QUISCENT        5
-#define QLCNIC_DEV_FAILED               6
+/* Device State */
+#define QLCNIC_DEV_COLD                 0x1
+#define QLCNIC_DEV_INITIALIZING         0x2
+#define QLCNIC_DEV_READY                0x3
+#define QLCNIC_DEV_NEED_RESET           0x4
+#define QLCNIC_DEV_NEED_QUISCENT        0x5
+#define QLCNIC_DEV_FAILED               0x6
+#define QLCNIC_DEV_QUISCENT             0x7
+
+#define QLC_DEV_SET_REF_CNT(VAL, FN)            ((VAL) |= (1 << (FN * 4)))
+#define QLC_DEV_CLR_REF_CNT(VAL, FN)            ((VAL) &= ~(1 << (FN * 4)))
+#define QLC_DEV_SET_RST_RDY(VAL, FN)            ((VAL) |= (1 << (FN * 4)))
+#define QLC_DEV_SET_QSCNT_RDY(VAL, FN)          ((VAL) |= (2 << (FN * 4)))
+#define QLC_DEV_CLR_RST_QSCNT(VAL, FN)          ((VAL) &= ~(3 << (FN * 4)))
 
 #define QLCNIC_RCODE_DRIVER_INFO                0x20000000
 #define QLCNIC_RCODE_DRIVER_CAN_RELOAD          0x40000000
@@ -712,9 +719,8 @@ enum {
 #define QLCNIC_FWERROR_PEGNUM(code)             ((code) & 0xff)
 #define QLCNIC_FWERROR_CODE(code)               ((code >> 8) & 0xfffff)
 
-#define FW_POLL_DELAY                   (2 * HZ)
-#define FW_FAIL_THRESH                  3
-#define FW_POLL_THRESH                  10
+#define FW_POLL_DELAY           (1 * HZ)
+#define FW_FAIL_THRESH          2
 
 #define ISR_MSI_INT_TRIGGER(FUNC) (QLCNIC_PCIX_PS_REG(PCIX_MSI_F(FUNC)))
 #define ISR_LEGACY_INT_TRIGGERED(VAL)   (((VAL) & 0x300) == 0x200)
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 01ce74ee99f9..1b621ca13e25 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -1287,6 +1287,7 @@ qlcnic_alloc_rx_skb(struct qlcnic_adapter *adapter,
                         rds_ring->dma_size, PCI_DMA_FROMDEVICE);
 
         if (pci_dma_mapping_error(pdev, dma)) {
+                adapter->stats.rx_dma_map_error++;
                 dev_kfree_skb_any(skb);
                 buffer->skb = NULL;
                 return -ENOMEM;
@@ -1311,8 +1312,10 @@ static struct sk_buff *qlcnic_process_rxbuf(struct qlcnic_adapter *adapter,
                         PCI_DMA_FROMDEVICE);
 
         skb = buffer->skb;
-        if (!skb)
+        if (!skb) {
+                adapter->stats.null_skb++;
                 goto no_skb;
+        }
 
         if (likely(adapter->rx_csum && cksum == STATUS_CKSUM_OK)) {
                 adapter->stats.csummed++;
@@ -1502,6 +1505,8 @@ qlcnic_process_rcv_ring(struct qlcnic_host_sds_ring *sds_ring, int max)
 
                 if (rxbuf)
                         list_add_tail(&rxbuf->list, &sds_ring->free_list[ring]);
+                else
+                        adapter->stats.null_rxbuf++;
 
 skip:
                 for (; desc_cnt > 0; desc_cnt--) {
@@ -1549,9 +1554,10 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
         int producer, count = 0;
         struct list_head *head;
 
+        spin_lock(&rds_ring->lock);
+
         producer = rds_ring->producer;
 
-        spin_lock(&rds_ring->lock);
         head = &rds_ring->free_list;
         while (!list_empty(head)) {
 
@@ -1573,13 +1579,13 @@ qlcnic_post_rx_buffers(struct qlcnic_adapter *adapter, u32 ringid,
 
                 producer = get_next_index(producer, rds_ring->num_desc);
         }
-        spin_unlock(&rds_ring->lock);
 
         if (count) {
                 rds_ring->producer = producer;
                 writel((producer-1) & (rds_ring->num_desc-1),
                                 rds_ring->crb_rcv_producer);
         }
+        spin_unlock(&rds_ring->lock);
 }
 
 static void
@@ -1591,10 +1597,11 @@ qlcnic_post_rx_buffers_nodb(struct qlcnic_adapter *adapter,
         int producer, count = 0;
         struct list_head *head;
 
-        producer = rds_ring->producer;
         if (!spin_trylock(&rds_ring->lock))
                 return;
 
+        producer = rds_ring->producer;
+
         head = &rds_ring->free_list;
         while (!list_empty(head)) {
 
diff --git a/drivers/net/qlcnic/qlcnic_main.c b/drivers/net/qlcnic/qlcnic_main.c
index e4fd5dcdfb4c..ee573fe52a8e 100644
--- a/drivers/net/qlcnic/qlcnic_main.c
+++ b/drivers/net/qlcnic/qlcnic_main.c
@@ -208,6 +208,9 @@ qlcnic_napi_enable(struct qlcnic_adapter *adapter)
         struct qlcnic_host_sds_ring *sds_ring;
         struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
 
+        if (adapter->is_up != QLCNIC_ADAPTER_UP_MAGIC)
+                return;
+
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &recv_ctx->sds_rings[ring];
                 napi_enable(&sds_ring->napi);
@@ -222,6 +225,9 @@ qlcnic_napi_disable(struct qlcnic_adapter *adapter)
         struct qlcnic_host_sds_ring *sds_ring;
         struct qlcnic_recv_context *recv_ctx = &adapter->recv_ctx;
 
+        if (adapter->is_up != QLCNIC_ADAPTER_UP_MAGIC)
+                return;
+
         for (ring = 0; ring < adapter->max_sds_rings; ring++) {
                 sds_ring = &recv_ctx->sds_rings[ring];
                 qlcnic_disable_int(sds_ring);
@@ -1573,6 +1579,11 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
         int frag_count, no_of_desc;
         u32 num_txd = tx_ring->num_desc;
 
+        if (!test_bit(__QLCNIC_DEV_UP, &adapter->state)) {
+                netif_stop_queue(netdev);
+                return NETDEV_TX_BUSY;
+        }
+
         frag_count = skb_shinfo(skb)->nr_frags + 1;
 
         /* 4 fragments per cmd des */
@@ -1589,8 +1600,10 @@ qlcnic_xmit_frame(struct sk_buff *skb, struct net_device *netdev)
 
         pdev = adapter->pdev;
 
-        if (qlcnic_map_tx_skb(pdev, skb, pbuf))
+        if (qlcnic_map_tx_skb(pdev, skb, pbuf)) {
+                adapter->stats.tx_dma_map_error++;
                 goto drop_packet;
+        }
 
         pbuf->skb = skb;
         pbuf->frag_count = frag_count;
@@ -1947,8 +1960,8 @@ static void qlcnic_poll_controller(struct net_device *netdev)
 }
 #endif
 
-static void
-qlcnic_set_drv_state(struct qlcnic_adapter *adapter, int state)
+static int
+qlcnic_set_drv_state(struct qlcnic_adapter *adapter, u8 state)
 {
         u32  val;
 
@@ -1956,18 +1969,20 @@ qlcnic_set_drv_state(struct qlcnic_adapter *adapter, int state)
                         state != QLCNIC_DEV_NEED_QUISCENT);
 
         if (qlcnic_api_lock(adapter))
-                return ;
+                return -EIO;
 
         val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
 
         if (state == QLCNIC_DEV_NEED_RESET)
-                val |= ((u32)0x1 << (adapter->portnum * 4));
+                QLC_DEV_SET_RST_RDY(val, adapter->portnum);
         else if (state == QLCNIC_DEV_NEED_QUISCENT)
-                val |= ((u32)0x1 << ((adapter->portnum * 4) + 1));
+                QLC_DEV_SET_QSCNT_RDY(val, adapter->portnum);
 
         QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
 
         qlcnic_api_unlock(adapter);
+
+        return 0;
 }
 
 static int
@@ -1979,7 +1994,7 @@ qlcnic_clr_drv_state(struct qlcnic_adapter *adapter)
                 return -EBUSY;
 
         val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-        val &= ~((u32)0x3 << (adapter->portnum * 4));
+        QLC_DEV_CLR_RST_QSCNT(val, adapter->portnum);
         QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
 
         qlcnic_api_unlock(adapter);
@@ -1996,14 +2011,14 @@ qlcnic_clr_all_drv_state(struct qlcnic_adapter *adapter)
                 goto err;
 
         val = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
-        val &= ~((u32)0x1 << (adapter->portnum * 4));
+        QLC_DEV_CLR_REF_CNT(val, adapter->portnum);
         QLCWR32(adapter, QLCNIC_CRB_DEV_REF_COUNT, val);
 
         if (!(val & 0x11111111))
                 QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_COLD);
 
         val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-        val &= ~((u32)0x3 << (adapter->portnum * 4));
+        QLC_DEV_CLR_RST_QSCNT(val, adapter->portnum);
         QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
 
         qlcnic_api_unlock(adapter);
@@ -2013,6 +2028,7 @@ err:
         clear_bit(__QLCNIC_RESETTING, &adapter->state);
 }
 
+/* Grab api lock, before checking state */
 static int
 qlcnic_check_drv_state(struct qlcnic_adapter *adapter)
 {
@@ -2033,17 +2049,18 @@ qlcnic_can_start_firmware(struct qlcnic_adapter *adapter)
 {
         u32 val, prev_state;
         u8 dev_init_timeo = adapter->dev_init_timeo;
-        int portnum = adapter->portnum;
+        u8 portnum = adapter->portnum;
+
+        if (test_and_clear_bit(__QLCNIC_START_FW, &adapter->state))
+                return 1;
 
         if (qlcnic_api_lock(adapter))
                 return -1;
 
         val = QLCRD32(adapter, QLCNIC_CRB_DEV_REF_COUNT);
-        if (!(val & ((int)0x1 << (portnum * 4)))) {
-                val |= ((u32)0x1 << (portnum * 4));
+        if (!(val & (1 << (portnum * 4)))) {
+                QLC_DEV_SET_REF_CNT(val, portnum);
                 QLCWR32(adapter, QLCNIC_CRB_DEV_REF_COUNT, val);
-        } else if (test_and_clear_bit(__QLCNIC_START_FW, &adapter->state)) {
-                goto start_fw;
         }
 
         prev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
@@ -2051,8 +2068,7 @@ qlcnic_can_start_firmware(struct qlcnic_adapter *adapter)
 
         switch (prev_state) {
         case QLCNIC_DEV_COLD:
-start_fw:
-                QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_INITALIZING);
+                QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_INITIALIZING);
                 qlcnic_api_unlock(adapter);
                 return 1;
 
@@ -2062,19 +2078,23 @@ start_fw:
 
         case QLCNIC_DEV_NEED_RESET:
                 val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-                val |= ((u32)0x1 << (portnum * 4));
+                QLC_DEV_SET_RST_RDY(val, portnum);
                 QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
                 break;
 
         case QLCNIC_DEV_NEED_QUISCENT:
                 val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-                val |= ((u32)0x1 << ((portnum * 4) + 1));
+                QLC_DEV_SET_QSCNT_RDY(val, portnum);
                 QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
                 break;
 
         case QLCNIC_DEV_FAILED:
                 qlcnic_api_unlock(adapter);
                 return -1;
+
+        case QLCNIC_DEV_INITIALIZING:
+        case QLCNIC_DEV_QUISCENT:
+                break;
         }
 
         qlcnic_api_unlock(adapter);
@@ -2094,7 +2114,7 @@ start_fw:
                 return -1;
 
         val = QLCRD32(adapter, QLCNIC_CRB_DRV_STATE);
-        val &= ~((u32)0x3 << (portnum * 4));
+        QLC_DEV_CLR_RST_QSCNT(val, portnum);
         QLCWR32(adapter, QLCNIC_CRB_DRV_STATE, val);
 
         qlcnic_api_unlock(adapter);
@@ -2107,51 +2127,59 @@ qlcnic_fwinit_work(struct work_struct *work)
 {
         struct qlcnic_adapter *adapter = container_of(work,
                         struct qlcnic_adapter, fw_work.work);
-        int dev_state;
+        u32 dev_state = 0xf;
 
-        if (test_bit(__QLCNIC_START_FW, &adapter->state)) {
+        if (qlcnic_api_lock(adapter))
+                goto err_ret;
 
-                if (qlcnic_check_drv_state(adapter) &&
-                        (adapter->fw_wait_cnt++ < adapter->reset_ack_timeo)) {
-                        qlcnic_schedule_work(adapter,
-                                        qlcnic_fwinit_work, FW_POLL_DELAY);
-                        return;
+        if (adapter->fw_wait_cnt++ > adapter->reset_ack_timeo) {
+                dev_err(&adapter->pdev->dev, "Reset:Failed to get ack %d sec\n",
+                                        adapter->reset_ack_timeo);
+                goto skip_ack_check;
+        }
+
+        if (!qlcnic_check_drv_state(adapter)) {
+skip_ack_check:
+                dev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
+                if (dev_state == QLCNIC_DEV_NEED_RESET) {
+                        QLCWR32(adapter, QLCNIC_CRB_DEV_STATE,
+                                                QLCNIC_DEV_INITIALIZING);
+                        set_bit(__QLCNIC_START_FW, &adapter->state);
+                        QLCDB(adapter, DRV, "Restarting fw\n");
                 }
 
-                QLCDB(adapter, DRV, "Resetting FW\n");
+                qlcnic_api_unlock(adapter);
+
                 if (!qlcnic_start_firmware(adapter)) {
                         qlcnic_schedule_work(adapter, qlcnic_attach_work, 0);
                         return;
                 }
-
                 goto err_ret;
         }
 
-        if (adapter->fw_wait_cnt++ > (adapter->dev_init_timeo / 2)) {
-                dev_err(&adapter->pdev->dev,
-                                "Waiting for device to reset timeout\n");
-                goto err_ret;
-        }
+        qlcnic_api_unlock(adapter);
 
         dev_state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
-        QLCDB(adapter, HW, "Func waiting: Device state=%d\n", dev_state);
+        QLCDB(adapter, HW, "Func waiting: Device state=%u\n", dev_state);
 
         switch (dev_state) {
-        case QLCNIC_DEV_READY:
-                if (!qlcnic_start_firmware(adapter)) {
-                        qlcnic_schedule_work(adapter, qlcnic_attach_work, 0);
-                        return;
-                }
+        case QLCNIC_DEV_NEED_RESET:
+                qlcnic_schedule_work(adapter,
+                        qlcnic_fwinit_work, FW_POLL_DELAY);
+                return;
         case QLCNIC_DEV_FAILED:
                 break;
 
         default:
-                qlcnic_schedule_work(adapter,
-                        qlcnic_fwinit_work, 2 * FW_POLL_DELAY);
-                return;
+                if (!qlcnic_start_firmware(adapter)) {
+                        qlcnic_schedule_work(adapter, qlcnic_attach_work, 0);
+                        return;
+                }
         }
 
 err_ret:
+        dev_err(&adapter->pdev->dev, "Fwinit work failed state=%u "
+                "fw_wait_cnt=%u\n", dev_state, adapter->fw_wait_cnt);
         netif_device_attach(adapter->netdev);
         qlcnic_clr_all_drv_state(adapter);
 }
@@ -2180,7 +2208,8 @@ qlcnic_detach_work(struct work_struct *work)
         if (adapter->temp == QLCNIC_TEMP_PANIC)
                 goto err_ret;
 
-        qlcnic_set_drv_state(adapter, adapter->dev_state);
+        if (qlcnic_set_drv_state(adapter, adapter->dev_state))
+                goto err_ret;
 
         adapter->fw_wait_cnt = 0;
 
@@ -2196,6 +2225,7 @@ err_ret:
 
 }
 
+/*Transit to RESET state from READY state only */
 static void
 qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
 {
@@ -2206,9 +2236,8 @@ qlcnic_dev_request_reset(struct qlcnic_adapter *adapter)
 
         state = QLCRD32(adapter, QLCNIC_CRB_DEV_STATE);
 
-        if (state != QLCNIC_DEV_INITALIZING && state != QLCNIC_DEV_NEED_RESET) {
+        if (state == QLCNIC_DEV_READY) {
                 QLCWR32(adapter, QLCNIC_CRB_DEV_STATE, QLCNIC_DEV_NEED_RESET);
-                set_bit(__QLCNIC_START_FW, &adapter->state);
                 QLCDB(adapter, DRV, "NEED_RESET state set\n");
         }
 
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 340da3915b96..217e709bda3e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2775,6 +2775,7 @@ static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
 {
         iounmap(ioaddr);
         pci_release_regions(pdev);
+        pci_clear_mwi(pdev);
         pci_disable_device(pdev);
         free_netdev(dev);
 }
@@ -2841,8 +2842,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
         spin_lock_irq(&tp->lock);
 
         RTL_W8(Cfg9346, Cfg9346_Unlock);
+
         RTL_W32(MAC4, high);
+        RTL_R32(MAC4);
+
         RTL_W32(MAC0, low);
+        RTL_R32(MAC0);
+
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
         spin_unlock_irq(&tp->lock);
@@ -3030,9 +3036,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 goto err_out_free_dev_1;
         }
 
-        rc = pci_set_mwi(pdev);
-        if (rc < 0)
-                goto err_out_disable_2;
+        if (pci_set_mwi(pdev) < 0)
+                netif_info(tp, probe, dev, "Mem-Wr-Inval unavailable\n");
 
         /* make sure PCI base addr 1 is MMIO */
         if (!(pci_resource_flags(pdev, region) & IORESOURCE_MEM)) {
@@ -3040,7 +3045,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                           "region #%d not an MMIO resource, aborting\n",
                           region);
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         /* check for weird/broken PCI region reporting */
@@ -3048,13 +3053,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 netif_err(tp, probe, dev,
                           "Invalid PCI region size(s), aborting\n");
                 rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         rc = pci_request_regions(pdev, MODULENAME);
         if (rc < 0) {
                 netif_err(tp, probe, dev, "could not request regions\n");
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
         }
 
         tp->cp_cmd = PCIMulRW | RxChkSum;
@@ -3067,7 +3072,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                 if (rc < 0) {
                         netif_err(tp, probe, dev, "DMA configuration failed\n");
-                        goto err_out_free_res_4;
+                        goto err_out_free_res_3;
                 }
         }
 
@@ -3076,7 +3081,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (!ioaddr) {
                 netif_err(tp, probe, dev, "cannot remap MMIO, aborting\n");
                 rc = -EIO;
-                goto err_out_free_res_4;
+                goto err_out_free_res_3;
         }
 
         tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
@@ -3118,7 +3123,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (i == ARRAY_SIZE(rtl_chip_info)) {
                 dev_err(&pdev->dev,
                         "driver bug, MAC version not found in rtl_chip_info\n");
-                goto err_out_msi_5;
+                goto err_out_msi_4;
         }
         tp->chipset = i;
 
@@ -3183,7 +3188,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 
         rc = register_netdev(dev);
         if (rc < 0)
-                goto err_out_msi_5;
+                goto err_out_msi_4;
 
         pci_set_drvdata(pdev, dev);
 
@@ -3212,14 +3217,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 out:
         return rc;
 
-err_out_msi_5:
+err_out_msi_4:
         rtl_disable_msi(pdev, tp);
         iounmap(ioaddr);
-err_out_free_res_4:
+err_out_free_res_3:
         pci_release_regions(pdev);
-err_out_mwi_3:
+err_out_mwi_2:
         pci_clear_mwi(pdev);
-err_out_disable_2:
         pci_disable_device(pdev);
 err_out_free_dev_1:
         free_netdev(dev);
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 332031747a23..fec3c29b2ea8 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -48,23 +48,6 @@
 #include <asm/io.h>
 #include <asm/processor.h>      /* Processor type for cache alignment. */
 
-/* This is only here until the firmware is ready.  In that case,
-   the firmware leaves the ethernet address in the register for us. */
-#ifdef CONFIG_SIBYTE_STANDALONE
-#define SBMAC_ETH0_HWADDR "40:00:00:00:01:00"
-#define SBMAC_ETH1_HWADDR "40:00:00:00:01:01"
-#define SBMAC_ETH2_HWADDR "40:00:00:00:01:02"
-#define SBMAC_ETH3_HWADDR "40:00:00:00:01:03"
-#endif
-
-
-/* These identify the driver base version and may not be removed. */
-#if 0
-static char version1[] __initdata =
-"sb1250-mac.c:1.00 1/11/2001 Written by Mitch Lichtenberg\n";
-#endif
-
-
 /* Operational parameters that usually are not changed. */
 
 #define CONFIG_SBMAC_COALESCE
@@ -349,7 +332,6 @@ static int sbmac_mii_write(struct mii_bus *bus, int phyaddr, int regidx,
  ********************************************************************* */
 
 static char sbmac_string[] = "sb1250-mac";
-static char sbmac_pretty[] = "SB1250 MAC";
 
 static char sbmac_mdio_string[] = "sb1250-mac-mdio";
 
@@ -2182,85 +2164,6 @@ static void sbmac_setmulti(struct sbmac_softc *sc)
         }
 }
 
-#if defined(SBMAC_ETH0_HWADDR) || defined(SBMAC_ETH1_HWADDR) || defined(SBMAC_ETH2_HWADDR) || defined(SBMAC_ETH3_HWADDR)
-/**********************************************************************
- *  SBMAC_PARSE_XDIGIT(str)
- *
- *  Parse a hex digit, returning its value
- *
- *  Input parameters:
- *         str - character
- *
- *  Return value:
- *         hex value, or -1 if invalid
- ********************************************************************* */
-
-static int sbmac_parse_xdigit(char str)
-{
-        int digit;
-
-        if ((str >= '0') && (str <= '9'))
-                digit = str - '0';
-        else if ((str >= 'a') && (str <= 'f'))
-                digit = str - 'a' + 10;
-        else if ((str >= 'A') && (str <= 'F'))
-                digit = str - 'A' + 10;
-        else
-                return -1;
-
-        return digit;
-}
-
-/**********************************************************************
- *  SBMAC_PARSE_HWADDR(str,hwaddr)
- *
- *  Convert a string in the form xx:xx:xx:xx:xx:xx into a 6-byte
- *  Ethernet address.
- *
- *  Input parameters:
- *         str - string
- *         hwaddr - pointer to hardware address
- *
- *  Return value:
- *         0 if ok, else -1
- ********************************************************************* */
-
-static int sbmac_parse_hwaddr(char *str, unsigned char *hwaddr)
-{
-        int digit1,digit2;
-        int idx = 6;
-
-        while (*str && (idx > 0)) {
-                digit1 = sbmac_parse_xdigit(*str);
-                if (digit1 < 0)
-                        return -1;
-                str++;
-                if (!*str)
-                        return -1;
-
-                if ((*str == ':') || (*str == '-')) {
-                        digit2 = digit1;
-                        digit1 = 0;
-                }
-                else {
-                        digit2 = sbmac_parse_xdigit(*str);
-                        if (digit2 < 0)
-                                return -1;
-                        str++;
-                }
-
-                *hwaddr++ = (digit1 << 4) | digit2;
-                idx--;
-
-                if (*str == '-')
-                        str++;
-                if (*str == ':')
-                        str++;
-        }
-        return 0;
-}
-#endif
-
 static int sb1250_change_mtu(struct net_device *_dev, int new_mtu)
 {
         if (new_mtu >  ENET_PACKET_SIZE)
@@ -2353,17 +2256,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
 
         sc->mii_bus = mdiobus_alloc();
         if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
-                return -ENOMEM;
+                err = -ENOMEM;
+                goto uninit_ctx;
+        }
+
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
         }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
 
         err = register_netdev(dev);
         if (err) {
                 printk(KERN_ERR "%s.%d: unable to register netdev\n",
                        sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
-                sbmac_uninitctx(sc);
-                return err;
+                goto unreg_mdio;
         }
 
         pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2301,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
         pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
                dev->name, base, eaddr);
 
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
-
         return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
 
 
@@ -2417,16 +2335,6 @@ static int sbmac_open(struct net_device *dev)
                 goto out_err;
         }
 
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
-
         sc->sbm_speed = sbmac_speed_none;
         sc->sbm_duplex = sbmac_duplex_none;
         sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2365,7 @@ static int sbmac_open(struct net_device *dev)
         return 0;
 
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-
-out_unirq:
         free_irq(dev->irq, dev);
-
 out_err:
         return err;
 }
@@ -2650,9 +2554,6 @@ static int sbmac_close(struct net_device *dev)
 
         phy_disconnect(sc->phy_dev);
         sc->phy_dev = NULL;
-
-        mdiobus_unregister(sc->mii_bus);
-
         free_irq(dev->irq, dev);
 
         sbdma_emptyring(&(sc->sbm_txdma));
@@ -2759,6 +2660,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
 
         unregister_netdev(dev);
         sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
         mdiobus_free(sc->mii_bus);
         iounmap(sc->sbm_base);
         free_netdev(dev);
@@ -2766,162 +2668,6 @@ static int __exit sbmac_remove(struct platform_device *pldev)
         return 0;
 }
 
-
-static struct platform_device **sbmac_pldev;
-static int sbmac_max_units;
-
-#if defined(SBMAC_ETH0_HWADDR) || defined(SBMAC_ETH1_HWADDR) || defined(SBMAC_ETH2_HWADDR) || defined(SBMAC_ETH3_HWADDR)
-static void __init sbmac_setup_hwaddr(int idx, char *addr)
-{
-        void __iomem *sbm_base;
-        unsigned long start, end;
-        uint8_t eaddr[6];
-        uint64_t val;
-
-        if (idx >= sbmac_max_units)
-                return;
-
-        start = A_MAC_CHANNEL_BASE(idx);
-        end = A_MAC_CHANNEL_BASE(idx + 1) - 1;
-
-        sbm_base = ioremap_nocache(start, end - start + 1);
-        if (!sbm_base) {
-                printk(KERN_ERR "%s: unable to map device registers\n",
-                       sbmac_string);
-                return;
-        }
-
-        sbmac_parse_hwaddr(addr, eaddr);
-        val = sbmac_addr2reg(eaddr);
-        __raw_writeq(val, sbm_base + R_MAC_ETHERNET_ADDR);
-        val = __raw_readq(sbm_base + R_MAC_ETHERNET_ADDR);
-
-        iounmap(sbm_base);
-}
-#endif
-
-static int __init sbmac_platform_probe_one(int idx)
-{
-        struct platform_device *pldev;
-        struct {
-                struct resource r;
-                char name[strlen(sbmac_pretty) + 4];
-        } *res;
-        int err;
-
-        res = kzalloc(sizeof(*res), GFP_KERNEL);
-        if (!res) {
-                printk(KERN_ERR "%s.%d: unable to allocate memory\n",
-                       sbmac_string, idx);
-                err = -ENOMEM;
-                goto out_err;
-        }
-
-        /*
-         * This is the base address of the MAC.
-         */
-        snprintf(res->name, sizeof(res->name), "%s %d", sbmac_pretty, idx);
-        res->r.name = res->name;
-        res->r.flags = IORESOURCE_MEM;
-        res->r.start = A_MAC_CHANNEL_BASE(idx);
-        res->r.end = A_MAC_CHANNEL_BASE(idx + 1) - 1;
-
-        pldev = platform_device_register_simple(sbmac_string, idx, &res->r, 1);
-        if (IS_ERR(pldev)) {
-                printk(KERN_ERR "%s.%d: unable to register platform device\n",
-                       sbmac_string, idx);
-                err = PTR_ERR(pldev);
-                goto out_kfree;
-        }
-
-        if (!pldev->dev.driver) {
-                err = 0;                /* No hardware at this address. */
-                goto out_unregister;
-        }
-
-        sbmac_pldev[idx] = pldev;
-        return 0;
-
-out_unregister:
-        platform_device_unregister(pldev);
-
-out_kfree:
-        kfree(res);
-
-out_err:
-        return err;
-}
-
-static void __init sbmac_platform_probe(void)
-{
-        int i;
-
-        /* Set the number of available units based on the SOC type.  */
-        switch (soc_type) {
-        case K_SYS_SOC_TYPE_BCM1250:
-        case K_SYS_SOC_TYPE_BCM1250_ALT:
-                sbmac_max_units = 3;
-                break;
-        case K_SYS_SOC_TYPE_BCM1120:
-        case K_SYS_SOC_TYPE_BCM1125:
-        case K_SYS_SOC_TYPE_BCM1125H:
-        case K_SYS_SOC_TYPE_BCM1250_ALT2:       /* Hybrid */
-                sbmac_max_units = 2;
-                break;
-        case K_SYS_SOC_TYPE_BCM1x55:
-        case K_SYS_SOC_TYPE_BCM1x80:
-                sbmac_max_units = 4;
-                break;
-        default:
-                return;                         /* none */
-        }
-
-        /*
-         * For bringup when not using the firmware, we can pre-fill
-         * the MAC addresses using the environment variables
-         * specified in this file (or maybe from the config file?)
-         */
-#ifdef SBMAC_ETH0_HWADDR
-        sbmac_setup_hwaddr(0, SBMAC_ETH0_HWADDR);
-#endif
-#ifdef SBMAC_ETH1_HWADDR
-        sbmac_setup_hwaddr(1, SBMAC_ETH1_HWADDR);
-#endif
-#ifdef SBMAC_ETH2_HWADDR
-        sbmac_setup_hwaddr(2, SBMAC_ETH2_HWADDR);
-#endif
-#ifdef SBMAC_ETH3_HWADDR
-        sbmac_setup_hwaddr(3, SBMAC_ETH3_HWADDR);
-#endif
-
-        sbmac_pldev = kcalloc(sbmac_max_units, sizeof(*sbmac_pldev),
-                              GFP_KERNEL);
-        if (!sbmac_pldev) {
-                printk(KERN_ERR "%s: unable to allocate memory\n",
-                       sbmac_string);
-                return;
-        }
-
-        /*
-         * Walk through the Ethernet controllers and find
-         * those who have their MAC addresses set.
-         */
-        for (i = 0; i < sbmac_max_units; i++)
-                if (sbmac_platform_probe_one(i))
-                        break;
-}
-
-
-static void __exit sbmac_platform_cleanup(void)
-{
-        int i;
-
-        for (i = 0; i < sbmac_max_units; i++)
-                platform_device_unregister(sbmac_pldev[i]);
-        kfree(sbmac_pldev);
-}
-
-
 static struct platform_driver sbmac_driver = {
         .probe = sbmac_probe,
         .remove = __exit_p(sbmac_remove),
@@ -2932,20 +2678,11 @@ static struct platform_driver sbmac_driver = {
 
 static int __init sbmac_init_module(void)
 {
-        int err;
-
-        err = platform_driver_register(&sbmac_driver);
-        if (err)
-                return err;
-
-        sbmac_platform_probe();
-
-        return err;
+        return platform_driver_register(&sbmac_driver);
 }
 
 static void __exit sbmac_cleanup_module(void)
 {
-        sbmac_platform_cleanup();
         platform_driver_unregister(&sbmac_driver);
 }
 
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 1ad61b7bba40..156460527231 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -225,17 +225,17 @@ static void efx_fini_channels(struct efx_nic *efx);
  * never be concurrently called more than once on the same channel,
  * though different channels may be being processed concurrently.
  */
-static int efx_process_channel(struct efx_channel *channel, int rx_quota)
+static int efx_process_channel(struct efx_channel *channel, int budget)
 {
         struct efx_nic *efx = channel->efx;
-        int rx_packets;
+        int spent;
 
         if (unlikely(efx->reset_pending != RESET_TYPE_NONE ||
                      !channel->enabled))
                 return 0;
 
-        rx_packets = efx_nic_process_eventq(channel, rx_quota);
-        if (rx_packets == 0)
+        spent = efx_nic_process_eventq(channel, budget);
+        if (spent == 0)
                 return 0;
 
         /* Deliver last RX packet. */
@@ -249,7 +249,7 @@ static int efx_process_channel(struct efx_channel *channel, int rx_quota)
 
         efx_fast_push_rx_descriptors(&efx->rx_queue[channel->channel]);
 
-        return rx_packets;
+        return spent;
 }
 
 /* Mark channel as finished processing
@@ -278,17 +278,17 @@ static int efx_poll(struct napi_struct *napi, int budget)
 {
         struct efx_channel *channel =
                 container_of(napi, struct efx_channel, napi_str);
-        int rx_packets;
+        int spent;
 
         EFX_TRACE(channel->efx, "channel %d NAPI poll executing on CPU %d\n",
                   channel->channel, raw_smp_processor_id());
 
-        rx_packets = efx_process_channel(channel, budget);
+        spent = efx_process_channel(channel, budget);
 
-        if (rx_packets < budget) {
+        if (spent < budget) {
                 struct efx_nic *efx = channel->efx;
 
-                if (channel->used_flags & EFX_USED_BY_RX &&
+                if (channel->channel < efx->n_rx_channels &&
                     efx->irq_rx_adaptive &&
                     unlikely(++channel->irq_count == 1000)) {
                         if (unlikely(channel->irq_mod_score <
@@ -318,7 +318,7 @@ static int efx_poll(struct napi_struct *napi, int budget)
                 efx_channel_processed(channel);
         }
 
-        return rx_packets;
+        return spent;
 }
 
 /* Process the eventq of the specified channel immediately on this CPU
@@ -333,7 +333,6 @@ void efx_process_channel_now(struct efx_channel *channel)
 {
         struct efx_nic *efx = channel->efx;
 
-        BUG_ON(!channel->used_flags);
         BUG_ON(!channel->enabled);
 
         /* Disable interrupts and wait for ISRs to complete */
@@ -446,12 +445,12 @@ static void efx_set_channel_names(struct efx_nic *efx)
 
         efx_for_each_channel(channel, efx) {
                 number = channel->channel;
-                if (efx->n_channels > efx->n_rx_queues) {
-                        if (channel->channel < efx->n_rx_queues) {
+                if (efx->n_channels > efx->n_rx_channels) {
+                        if (channel->channel < efx->n_rx_channels) {
                                 type = "-rx";
                         } else {
                                 type = "-tx";
-                                number -= efx->n_rx_queues;
+                                number -= efx->n_rx_channels;
                         }
                 }
                 snprintf(channel->name, sizeof(channel->name),
@@ -585,8 +584,6 @@ static void efx_remove_channel(struct efx_channel *channel)
         efx_for_each_channel_tx_queue(tx_queue, channel)
                 efx_remove_tx_queue(tx_queue);
         efx_remove_eventq(channel);
-
-        channel->used_flags = 0;
 }
 
 void efx_schedule_slow_fill(struct efx_rx_queue *rx_queue, int delay)
@@ -956,10 +953,9 @@ static void efx_fini_io(struct efx_nic *efx)
         pci_disable_device(efx->pci_dev);
 }
 
-/* Get number of RX queues wanted.  Return number of online CPU
- * packages in the expectation that an IRQ balancer will spread
- * interrupts across them. */
-static int efx_wanted_rx_queues(void)
+/* Get number of channels wanted.  Each channel will have its own IRQ,
+ * 1 RX queue and/or 2 TX queues. */
+static int efx_wanted_channels(void)
 {
         cpumask_var_t core_mask;
         int count;
@@ -995,34 +991,39 @@ static void efx_probe_interrupts(struct efx_nic *efx)
 
         if (efx->interrupt_mode == EFX_INT_MODE_MSIX) {
                 struct msix_entry xentries[EFX_MAX_CHANNELS];
-                int wanted_ints;
-                int rx_queues;
+                int n_channels;
 
-                /* We want one RX queue and interrupt per CPU package
-                 * (or as specified by the rss_cpus module parameter).
-                 * We will need one channel per interrupt.
-                 */
-                rx_queues = rss_cpus ? rss_cpus : efx_wanted_rx_queues();
-                wanted_ints = rx_queues + (separate_tx_channels ? 1 : 0);
-                wanted_ints = min(wanted_ints, max_channels);
+                n_channels = efx_wanted_channels();
+                if (separate_tx_channels)
+                        n_channels *= 2;
+                n_channels = min(n_channels, max_channels);
 
-                for (i = 0; i < wanted_ints; i++)
+                for (i = 0; i < n_channels; i++)
                         xentries[i].entry = i;
-                rc = pci_enable_msix(efx->pci_dev, xentries, wanted_ints);
+                rc = pci_enable_msix(efx->pci_dev, xentries, n_channels);
                 if (rc > 0) {
                         EFX_ERR(efx, "WARNING: Insufficient MSI-X vectors"
-                                " available (%d < %d).\n", rc, wanted_ints);
+                                " available (%d < %d).\n", rc, n_channels);
                         EFX_ERR(efx, "WARNING: Performance may be reduced.\n");
-                        EFX_BUG_ON_PARANOID(rc >= wanted_ints);
-                        wanted_ints = rc;
+                        EFX_BUG_ON_PARANOID(rc >= n_channels);
+                        n_channels = rc;
                         rc = pci_enable_msix(efx->pci_dev, xentries,
-                                             wanted_ints);
+                                             n_channels);
                 }
 
                 if (rc == 0) {
-                        efx->n_rx_queues = min(rx_queues, wanted_ints);
-                        efx->n_channels = wanted_ints;
-                        for (i = 0; i < wanted_ints; i++)
+                        efx->n_channels = n_channels;
+                        if (separate_tx_channels) {
+                                efx->n_tx_channels =
+                                        max(efx->n_channels / 2, 1U);
+                                efx->n_rx_channels =
+                                        max(efx->n_channels -
+                                            efx->n_tx_channels, 1U);
+                        } else {
+                                efx->n_tx_channels = efx->n_channels;
+                                efx->n_rx_channels = efx->n_channels;
+                        }
+                        for (i = 0; i < n_channels; i++)
                                 efx->channel[i].irq = xentries[i].vector;
                 } else {
                         /* Fall back to single channel MSI */
@@ -1033,8 +1034,9 @@ static void efx_probe_interrupts(struct efx_nic *efx)
 
         /* Try single interrupt MSI */
         if (efx->interrupt_mode == EFX_INT_MODE_MSI) {
-                efx->n_rx_queues = 1;
                 efx->n_channels = 1;
+                efx->n_rx_channels = 1;
+                efx->n_tx_channels = 1;
                 rc = pci_enable_msi(efx->pci_dev);
                 if (rc == 0) {
                         efx->channel[0].irq = efx->pci_dev->irq;
@@ -1046,8 +1048,9 @@ static void efx_probe_interrupts(struct efx_nic *efx)
 
         /* Assume legacy interrupts */
         if (efx->interrupt_mode == EFX_INT_MODE_LEGACY) {
-                efx->n_rx_queues = 1;
                 efx->n_channels = 1 + (separate_tx_channels ? 1 : 0);
+                efx->n_rx_channels = 1;
+                efx->n_tx_channels = 1;
                 efx->legacy_irq = efx->pci_dev->irq;
         }
 }
@@ -1068,21 +1071,24 @@ static void efx_remove_interrupts(struct efx_nic *efx)
 
 static void efx_set_channels(struct efx_nic *efx)
 {
+        struct efx_channel *channel;
         struct efx_tx_queue *tx_queue;
         struct efx_rx_queue *rx_queue;
+        unsigned tx_channel_offset =
+                separate_tx_channels ? efx->n_channels - efx->n_tx_channels : 0;
 
-        efx_for_each_tx_queue(tx_queue, efx) {
-                if (separate_tx_channels)
-                        tx_queue->channel = &efx->channel[efx->n_channels-1];
-                else
-                        tx_queue->channel = &efx->channel[0];
-                tx_queue->channel->used_flags |= EFX_USED_BY_TX;
+        efx_for_each_channel(channel, efx) {
+                if (channel->channel - tx_channel_offset < efx->n_tx_channels) {
+                        channel->tx_queue = &efx->tx_queue[
+                                (channel->channel - tx_channel_offset) *
+                                EFX_TXQ_TYPES];
+                        efx_for_each_channel_tx_queue(tx_queue, channel)
+                                tx_queue->channel = channel;
+                }
         }
 
-        efx_for_each_rx_queue(rx_queue, efx) {
+        efx_for_each_rx_queue(rx_queue, efx)
                 rx_queue->channel = &efx->channel[rx_queue->queue];
-                rx_queue->channel->used_flags |= EFX_USED_BY_RX;
-        }
 }
 
 static int efx_probe_nic(struct efx_nic *efx)
@@ -1096,11 +1102,12 @@ static int efx_probe_nic(struct efx_nic *efx)
         if (rc)
                 return rc;
 
-        /* Determine the number of channels and RX queues by trying to hook
+        /* Determine the number of channels and queues by trying to hook
          * in MSI-X interrupts. */
         efx_probe_interrupts(efx);
 
         efx_set_channels(efx);
+        efx->net_dev->real_num_tx_queues = efx->n_tx_channels;
 
         /* Initialise the interrupt moderation settings */
         efx_init_irq_moderation(efx, tx_irq_mod_usec, rx_irq_mod_usec, true);
@@ -1187,11 +1194,12 @@ static void efx_start_all(struct efx_nic *efx)
         /* Mark the port as enabled so port reconfigurations can start, then
          * restart the transmit interface early so the watchdog timer stops */
         efx_start_port(efx);
-        if (efx_dev_registered(efx))
-                efx_wake_queue(efx);
 
-        efx_for_each_channel(channel, efx)
+        efx_for_each_channel(channel, efx) {
+                if (efx_dev_registered(efx))
+                        efx_wake_queue(channel);
                 efx_start_channel(channel);
+        }
 
         efx_nic_enable_interrupts(efx);
 
@@ -1282,7 +1290,9 @@ static void efx_stop_all(struct efx_nic *efx)
         /* Stop the kernel transmit interface late, so the watchdog
          * timer isn't ticking over the flush */
         if (efx_dev_registered(efx)) {
-                efx_stop_queue(efx);
+                struct efx_channel *channel;
+                efx_for_each_channel(channel, efx)
+                        efx_stop_queue(channel);
                 netif_tx_lock_bh(efx->net_dev);
                 netif_tx_unlock_bh(efx->net_dev);
         }
@@ -1537,9 +1547,8 @@ static void efx_watchdog(struct net_device *net_dev)
 {
         struct efx_nic *efx = netdev_priv(net_dev);
 
-        EFX_ERR(efx, "TX stuck with stop_count=%d port_enabled=%d:"
-                " resetting channels\n",
-                atomic_read(&efx->netif_stop_count), efx->port_enabled);
+        EFX_ERR(efx, "TX stuck with port_enabled=%d: resetting channels\n",
+                efx->port_enabled);
 
         efx_schedule_reset(efx, RESET_TYPE_TX_WATCHDOG);
 }
@@ -1861,6 +1870,7 @@ out:
         }
 
         if (disabled) {
+                dev_close(efx->net_dev);
                 EFX_ERR(efx, "has been disabled\n");
                 efx->state = STATE_DISABLED;
         } else {
@@ -1884,8 +1894,7 @@ static void efx_reset_work(struct work_struct *data)
         }
 
         rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
-                dev_close(efx->net_dev);
+        (void)efx_reset(efx, efx->reset_pending);
         rtnl_unlock();
 }
 
@@ -2014,22 +2023,22 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
 
         efx->net_dev = net_dev;
         efx->rx_checksum_enabled = true;
-        spin_lock_init(&efx->netif_stop_lock);
         spin_lock_init(&efx->stats_lock);
         mutex_init(&efx->mac_lock);
         efx->mac_op = type->default_mac_ops;
         efx->phy_op = &efx_dummy_phy_operations;
         efx->mdio.dev = net_dev;
         INIT_WORK(&efx->mac_work, efx_mac_work);
-        atomic_set(&efx->netif_stop_count, 1);
 
         for (i = 0; i < EFX_MAX_CHANNELS; i++) {
                 channel = &efx->channel[i];
                 channel->efx = efx;
                 channel->channel = i;
                 channel->work_pending = false;
+                spin_lock_init(&channel->tx_stop_lock);
+                atomic_set(&channel->tx_stop_count, 1);
         }
-        for (i = 0; i < EFX_TX_QUEUE_COUNT; i++) {
+        for (i = 0; i < EFX_MAX_TX_QUEUES; i++) {
                 tx_queue = &efx->tx_queue[i];
                 tx_queue->efx = efx;
                 tx_queue->queue = i;
@@ -2201,7 +2210,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
         int i, rc;
 
         /* Allocate and initialise a struct net_device and struct efx_nic */
-        net_dev = alloc_etherdev(sizeof(*efx));
+        net_dev = alloc_etherdev_mq(sizeof(*efx), EFX_MAX_CORE_TX_QUEUES);
         if (!net_dev)
                 return -ENOMEM;
         net_dev->features |= (type->offload_features | NETIF_F_SG |
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index 7eff0a615cb3..ffd708c5304a 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -35,8 +35,8 @@ efx_hard_start_xmit(struct sk_buff *skb, struct net_device *net_dev);
 extern netdev_tx_t
 efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb);
 extern void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index);
-extern void efx_stop_queue(struct efx_nic *efx);
-extern void efx_wake_queue(struct efx_nic *efx);
+extern void efx_stop_queue(struct efx_channel *channel);
+extern void efx_wake_queue(struct efx_channel *channel);
 #define EFX_TXQ_SIZE 1024
 #define EFX_TXQ_MASK (EFX_TXQ_SIZE - 1)
 
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index d9f9c02a928e..22026bfbc4c1 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -304,7 +304,7 @@ static int efx_fill_loopback_test(struct efx_nic *efx,
 {
         struct efx_tx_queue *tx_queue;
 
-        efx_for_each_tx_queue(tx_queue, efx) {
+        efx_for_each_channel_tx_queue(tx_queue, &efx->channel[0]) {
                 efx_fill_test(test_index++, strings, data,
                               &lb_tests->tx_sent[tx_queue->queue],
                               EFX_TX_QUEUE_NAME(tx_queue),
@@ -647,7 +647,7 @@ static int efx_ethtool_get_coalesce(struct net_device *net_dev,
         efx_for_each_tx_queue(tx_queue, efx) {
                 channel = tx_queue->channel;
                 if (channel->irq_moderation < coalesce->tx_coalesce_usecs_irq) {
-                        if (channel->used_flags != EFX_USED_BY_RX_TX)
+                        if (channel->channel < efx->n_rx_channels)
                                 coalesce->tx_coalesce_usecs_irq =
                                         channel->irq_moderation;
                         else
@@ -690,7 +690,7 @@ static int efx_ethtool_set_coalesce(struct net_device *net_dev,
 
         /* If the channel is shared only allow RX parameters to be set */
         efx_for_each_tx_queue(tx_queue, efx) {
-                if ((tx_queue->channel->used_flags == EFX_USED_BY_RX_TX) &&
+                if ((tx_queue->channel->channel < efx->n_rx_channels) &&
                     tx_usecs) {
                         EFX_ERR(efx, "Channel is shared. "
                                 "Only RX coalescing may be set\n");
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d294d66fd600..655b697b45b2 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -175,16 +175,19 @@ irqreturn_t falcon_legacy_interrupt_a1(int irq, void *dev_id)
         EFX_TRACE(efx, "IRQ %d on CPU %d status " EFX_OWORD_FMT "\n",
                   irq, raw_smp_processor_id(), EFX_OWORD_VAL(*int_ker));
 
-        /* Check to see if we have a serious error condition */
-        syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
-        if (unlikely(syserr))
-                return efx_nic_fatal_interrupt(efx);
-
         /* Determine interrupting queues, clear interrupt status
          * register and acknowledge the device interrupt.
          */
         BUILD_BUG_ON(FSF_AZ_NET_IVEC_INT_Q_WIDTH > EFX_MAX_CHANNELS);
         queues = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_INT_Q);
+
+        /* Check to see if we have a serious error condition */
+        if (queues & (1U << efx->fatal_irq_level)) {
+                syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
+                if (unlikely(syserr))
+                        return efx_nic_fatal_interrupt(efx);
+        }
+
         EFX_ZERO_OWORD(*int_ker);
         wmb(); /* Ensure the vector is cleared before interrupt ack */
         falcon_irq_ack_a1(efx);
@@ -504,6 +507,9 @@ static void falcon_reset_macs(struct efx_nic *efx)
         /* Ensure the correct MAC is selected before statistics
          * are re-enabled by the caller */
         efx_writeo(efx, &mac_ctrl, FR_AB_MAC_CTRL);
+
+        /* This can run even when the GMAC is selected */
+        falcon_setup_xaui(efx);
 }
 
 void falcon_drain_tx_fifo(struct efx_nic *efx)
@@ -1320,7 +1326,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
 
         EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
 
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
 
         kfree(nvconfig);
         return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
         },
 };
 
-static const struct falcon_board_type falcon_dummy_board = {
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
         struct falcon_board *board = falcon_board(efx);
         u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                          (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                          ? board->type->ref_model : board->type->gen_type,
                          'A' + board->major, board->minor);
+                return 0;
         } else {
                 EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
         }
 }
diff --git a/drivers/net/sfc/falcon_xmac.c b/drivers/net/sfc/falcon_xmac.c
index 8ccab2c67a20..c84a2ce2ccbb 100644
--- a/drivers/net/sfc/falcon_xmac.c
+++ b/drivers/net/sfc/falcon_xmac.c
@@ -26,7 +26,7 @@
  *************************************************************************/
 
 /* Configure the XAUI driver that is an output from Falcon */
-static void falcon_setup_xaui(struct efx_nic *efx)
+void falcon_setup_xaui(struct efx_nic *efx)
 {
         efx_oword_t sdctl, txdrv;
 
@@ -85,14 +85,14 @@ int falcon_reset_xaui(struct efx_nic *efx)
         return -ETIMEDOUT;
 }
 
-static void falcon_mask_status_intr(struct efx_nic *efx, bool enable)
+static void falcon_ack_status_intr(struct efx_nic *efx)
 {
         efx_oword_t reg;
 
         if ((efx_nic_rev(efx) != EFX_REV_FALCON_B0) || LOOPBACK_INTERNAL(efx))
                 return;
 
-        /* We expect xgmii faults if the wireside link is up */
+        /* We expect xgmii faults if the wireside link is down */
         if (!EFX_WORKAROUND_5147(efx) || !efx->link_state.up)
                 return;
 
@@ -101,14 +101,7 @@ static void falcon_mask_status_intr(struct efx_nic *efx, bool enable)
         if (efx->xmac_poll_required)
                 return;
 
-        /* Flush the ISR */
-        if (enable)
-                efx_reado(efx, &reg, FR_AB_XM_MGT_INT_MSK);
-
-        EFX_POPULATE_OWORD_2(reg,
-                             FRF_AB_XM_MSK_RMTFLT, !enable,
-                             FRF_AB_XM_MSK_LCLFLT, !enable);
-        efx_writeo(efx, &reg, FR_AB_XM_MGT_INT_MASK);
+        efx_reado(efx, &reg, FR_AB_XM_MGT_INT_MSK);
 }
 
 static bool falcon_xgxs_link_ok(struct efx_nic *efx)
@@ -283,15 +276,13 @@ static bool falcon_xmac_check_fault(struct efx_nic *efx)
 
 static int falcon_reconfigure_xmac(struct efx_nic *efx)
 {
-        falcon_mask_status_intr(efx, false);
-
         falcon_reconfigure_xgxs_core(efx);
         falcon_reconfigure_xmac_core(efx);
 
         falcon_reconfigure_mac_wrapper(efx);
 
         efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 5);
-        falcon_mask_status_intr(efx, true);
+        falcon_ack_status_intr(efx);
 
         return 0;
 }
@@ -362,9 +353,8 @@ void falcon_poll_xmac(struct efx_nic *efx)
             !efx->xmac_poll_required)
                 return;
 
-        falcon_mask_status_intr(efx, false);
         efx->xmac_poll_required = !falcon_xmac_link_ok_retry(efx, 1);
-        falcon_mask_status_intr(efx, true);
+        falcon_ack_status_intr(efx);
 }
 
 struct efx_mac_operations falcon_xmac_operations = {
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index c48669c77414..93cc3c1b9450 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -613,7 +613,7 @@ int efx_mcdi_fwver(struct efx_nic *efx, u64 *version, u32 *build)
         }
 
         if (outlength < MC_CMD_GET_VERSION_V1_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
@@ -647,8 +647,10 @@ int efx_mcdi_drv_attach(struct efx_nic *efx, bool driver_operating,
                           outbuf, sizeof(outbuf), &outlen);
         if (rc)
                 goto fail;
-        if (outlen < MC_CMD_DRV_ATTACH_OUT_LEN)
+        if (outlen < MC_CMD_DRV_ATTACH_OUT_LEN) {
+                rc = -EIO;
                 goto fail;
+        }
 
         if (was_attached != NULL)
                 *was_attached = MCDI_DWORD(outbuf, DRV_ATTACH_OUT_OLD_STATE);
@@ -676,7 +678,7 @@ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
                 goto fail;
 
         if (outlen < MC_CMD_GET_BOARD_CFG_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
@@ -738,8 +740,10 @@ int efx_mcdi_nvram_types(struct efx_nic *efx, u32 *nvram_types_out)
                           outbuf, sizeof(outbuf), &outlen);
         if (rc)
                 goto fail;
-        if (outlen < MC_CMD_NVRAM_TYPES_OUT_LEN)
+        if (outlen < MC_CMD_NVRAM_TYPES_OUT_LEN) {
+                rc = -EIO;
                 goto fail;
+        }
 
         *nvram_types_out = MCDI_DWORD(outbuf, NVRAM_TYPES_OUT_TYPES);
         return 0;
@@ -765,8 +769,10 @@ int efx_mcdi_nvram_info(struct efx_nic *efx, unsigned int type,
                           outbuf, sizeof(outbuf), &outlen);
         if (rc)
                 goto fail;
-        if (outlen < MC_CMD_NVRAM_INFO_OUT_LEN)
+        if (outlen < MC_CMD_NVRAM_INFO_OUT_LEN) {
+                rc = -EIO;
                 goto fail;
+        }
 
         *size_out = MCDI_DWORD(outbuf, NVRAM_INFO_OUT_SIZE);
         *erase_size_out = MCDI_DWORD(outbuf, NVRAM_INFO_OUT_ERASESIZE);
@@ -926,20 +932,26 @@ int efx_mcdi_nvram_test_all(struct efx_nic *efx)
 
         rc = efx_mcdi_nvram_types(efx, &nvram_types);
         if (rc)
-                return rc;
+                goto fail1;
 
         type = 0;
         while (nvram_types != 0) {
                 if (nvram_types & 1) {
                         rc = efx_mcdi_nvram_test(efx, type);
                         if (rc)
-                                return rc;
+                                goto fail2;
                 }
                 type++;
                 nvram_types >>= 1;
         }
 
         return 0;
+
+fail2:
+        EFX_ERR(efx, "%s: failed type=%u\n", __func__, type);
+fail1:
+        EFX_ERR(efx, "%s: failed rc=%d\n", __func__, rc);
+        return rc;
 }
 
 static int efx_mcdi_read_assertion(struct efx_nic *efx)
@@ -968,7 +980,7 @@ static int efx_mcdi_read_assertion(struct efx_nic *efx)
         if (rc)
                 return rc;
         if (outlen < MC_CMD_GET_ASSERTS_OUT_LEN)
-                return -EINVAL;
+                return -EIO;
 
         /* Print out any recorded assertion state */
         flags = MCDI_DWORD(outbuf, GET_ASSERTS_OUT_GLOBAL_FLAGS);
@@ -1086,7 +1098,7 @@ int efx_mcdi_wol_filter_set(struct efx_nic *efx, u32 type,
                 goto fail;
 
         if (outlen < MC_CMD_WOL_FILTER_SET_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
@@ -1121,7 +1133,7 @@ int efx_mcdi_wol_filter_get_magic(struct efx_nic *efx, int *id_out)
                 goto fail;
 
         if (outlen < MC_CMD_WOL_FILTER_GET_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
diff --git a/drivers/net/sfc/mcdi_mac.c b/drivers/net/sfc/mcdi_mac.c
index 06d24a1e412a..39182631ac92 100644
--- a/drivers/net/sfc/mcdi_mac.c
+++ b/drivers/net/sfc/mcdi_mac.c
@@ -80,7 +80,7 @@ int efx_mcdi_mac_stats(struct efx_nic *efx, dma_addr_t dma_addr,
         u8 inbuf[MC_CMD_MAC_STATS_IN_LEN];
         int rc;
         efx_dword_t *cmd_ptr;
-        int period = 1000;
+        int period = enable ? 1000 : 0;
         u32 addr_hi;
         u32 addr_lo;
 
@@ -92,21 +92,14 @@ int efx_mcdi_mac_stats(struct efx_nic *efx, dma_addr_t dma_addr,
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_ADDR_LO, addr_lo);
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_ADDR_HI, addr_hi);
         cmd_ptr = (efx_dword_t *)MCDI_PTR(inbuf, MAC_STATS_IN_CMD);
-        if (enable)
-                EFX_POPULATE_DWORD_6(*cmd_ptr,
-                                     MC_CMD_MAC_STATS_CMD_DMA, 1,
-                                     MC_CMD_MAC_STATS_CMD_CLEAR, clear,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_CHANGE, 1,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_ENABLE, 1,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_CLEAR, 0,
-                                     MC_CMD_MAC_STATS_CMD_PERIOD_MS, period);
-        else
-                EFX_POPULATE_DWORD_5(*cmd_ptr,
-                                     MC_CMD_MAC_STATS_CMD_DMA, 0,
-                                     MC_CMD_MAC_STATS_CMD_CLEAR, clear,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_CHANGE, 1,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_ENABLE, 0,
-                                     MC_CMD_MAC_STATS_CMD_PERIODIC_CLEAR, 0);
+        EFX_POPULATE_DWORD_7(*cmd_ptr,
+                             MC_CMD_MAC_STATS_CMD_DMA, !!enable,
+                             MC_CMD_MAC_STATS_CMD_CLEAR, clear,
+                             MC_CMD_MAC_STATS_CMD_PERIODIC_CHANGE, 1,
+                             MC_CMD_MAC_STATS_CMD_PERIODIC_ENABLE, !!enable,
+                             MC_CMD_MAC_STATS_CMD_PERIODIC_CLEAR, 0,
+                             MC_CMD_MAC_STATS_CMD_PERIODIC_NOEVENT, 1,
+                             MC_CMD_MAC_STATS_CMD_PERIOD_MS, period);
         MCDI_SET_DWORD(inbuf, MAC_STATS_IN_DMA_LEN, dma_len);
 
         rc = efx_mcdi_rpc(efx, MC_CMD_MAC_STATS, inbuf, sizeof(inbuf),
diff --git a/drivers/net/sfc/mcdi_pcol.h b/drivers/net/sfc/mcdi_pcol.h
index bd59302695b3..90359e644006 100644
--- a/drivers/net/sfc/mcdi_pcol.h
+++ b/drivers/net/sfc/mcdi_pcol.h
@@ -863,7 +863,7 @@
  * bist output. The driver should only consume the BIST output
  * after validating OUTLEN and PHY_CFG.PHY_TYPE.
  *
- * If a driver can't succesfully parse the BIST output, it should
+ * If a driver can't successfully parse the BIST output, it should
  * still respect the pass/Fail in OUT.RESULT
  *
  * Locks required: PHY_LOCK if doing a  PHY BIST
@@ -872,7 +872,7 @@
 #define MC_CMD_POLL_BIST 0x26
 #define MC_CMD_POLL_BIST_IN_LEN 0
 #define MC_CMD_POLL_BIST_OUT_LEN UNKNOWN
-#define MC_CMD_POLL_BIST_OUT_SFT9001_LEN 40
+#define MC_CMD_POLL_BIST_OUT_SFT9001_LEN 36
 #define MC_CMD_POLL_BIST_OUT_MRSFP_LEN 8
 #define MC_CMD_POLL_BIST_OUT_RESULT_OFST 0
 #define MC_CMD_POLL_BIST_RUNNING 1
@@ -882,15 +882,14 @@
 /* Generic: */
 #define MC_CMD_POLL_BIST_OUT_PRIVATE_OFST 4
 /* SFT9001-specific: */
-/* (offset 4 unused?) */
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_A_OFST 8
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_B_OFST 12
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_C_OFST 16
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_D_OFST 20
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_A_OFST 24
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_B_OFST 28
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_C_OFST 32
-#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_D_OFST 36
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_A_OFST 4
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_B_OFST 8
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_C_OFST 12
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_LENGTH_D_OFST 16
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_A_OFST 20
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_B_OFST 24
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_C_OFST 28
+#define MC_CMD_POLL_BIST_OUT_SFT9001_CABLE_STATUS_D_OFST 32
 #define MC_CMD_POLL_BIST_SFT9001_PAIR_OK 1
 #define MC_CMD_POLL_BIST_SFT9001_PAIR_OPEN 2
 #define MC_CMD_POLL_BIST_SFT9001_INTRA_PAIR_SHORT 3
@@ -1054,9 +1053,13 @@
 /* MC_CMD_PHY_STATS:
  * Get generic PHY statistics
  *
- * This call returns the statistics for a generic PHY, by direct DMA
- * into host memory, in a sparse array (indexed by the enumerate).
- * Each value is represented by a 32bit number.
+ * This call returns the statistics for a generic PHY in a sparse
+ * array (indexed by the enumerate). Each value is represented by
+ * a 32bit number.
+ *
+ * If the DMA_ADDR is 0, then no DMA is performed, and the statistics
+ * may be read directly out of shared memory. If DMA_ADDR != 0, then
+ * the statistics are dmad to that (page-aligned location)
  *
  * Locks required: None
  * Returns: 0, ETIME
@@ -1066,7 +1069,8 @@
 #define MC_CMD_PHY_STATS_IN_LEN 8
 #define MC_CMD_PHY_STATS_IN_DMA_ADDR_LO_OFST 0
 #define MC_CMD_PHY_STATS_IN_DMA_ADDR_HI_OFST 4
-#define MC_CMD_PHY_STATS_OUT_LEN 0
+#define MC_CMD_PHY_STATS_OUT_DMA_LEN 0
+#define MC_CMD_PHY_STATS_OUT_NO_DMA_LEN (MC_CMD_PHY_NSTATS * 4)
 
 /* Unified MAC statistics enumeration */
 #define MC_CMD_MAC_GENERATION_START 0
@@ -1158,11 +1162,13 @@
 #define MC_CMD_MAC_STATS_CMD_CLEAR_WIDTH 1
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_CHANGE_LBN 2
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_CHANGE_WIDTH 1
-/* Fields only relevent when PERIODIC_CHANGE is set */
+/* Remaining PERIOD* fields only relevent when PERIODIC_CHANGE is set */
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_ENABLE_LBN 3
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_ENABLE_WIDTH 1
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_CLEAR_LBN 4
 #define MC_CMD_MAC_STATS_CMD_PERIODIC_CLEAR_WIDTH 1
+#define MC_CMD_MAC_STATS_CMD_PERIODIC_NOEVENT_LBN 5
+#define MC_CMD_MAC_STATS_CMD_PERIODIC_NOEVENT_WIDTH 1
 #define MC_CMD_MAC_STATS_CMD_PERIOD_MS_LBN 16
 #define MC_CMD_MAC_STATS_CMD_PERIOD_MS_WIDTH 16
 #define MC_CMD_MAC_STATS_IN_DMA_LEN_OFST 12
@@ -1729,6 +1735,39 @@
 #define MC_CMD_MRSFP_TWEAK_OUT_IOEXP_OUTPUTS_OFST 4    /* output bits */
 #define MC_CMD_MRSFP_TWEAK_OUT_IOEXP_DIRECTION_OFST 8  /* dirs: 0=out, 1=in */
 
+/* MC_CMD_TEST_HACK: (debug (unsurprisingly))
+  * Change bits of network port state for test purposes in ways that would never be
+  * useful in normal operation and so need a special command to change. */
+#define MC_CMD_TEST_HACK 0x2f
+#define MC_CMD_TEST_HACK_IN_LEN 8
+#define MC_CMD_TEST_HACK_IN_TXPAD_OFST 0
+#define   MC_CMD_TEST_HACK_IN_TXPAD_AUTO  0 /* Let the MC manage things */
+#define   MC_CMD_TEST_HACK_IN_TXPAD_ON    1 /* Force on */
+#define   MC_CMD_TEST_HACK_IN_TXPAD_OFF   2 /* Force on */
+#define MC_CMD_TEST_HACK_IN_IPG_OFST   4 /* Takes a value in bits */
+#define   MC_CMD_TEST_HACK_IN_IPG_AUTO    0 /* The MC picks the value */
+#define MC_CMD_TEST_HACK_OUT_LEN 0
+
+/* MC_CMD_SENSOR_SET_LIMS: (debug) (mostly) adjust the sensor limits. This
+ * is a warranty-voiding operation.
+  *
+ * IN: sensor identifier (one of the enumeration starting with MC_CMD_SENSOR_CONTROLLER_TEMP
+ * followed by 4 32-bit values: min(warning) max(warning), min(fatal), max(fatal). Which
+ * of these limits are meaningful and what their interpretation is is sensor-specific.
+ *
+ * OUT: nothing
+ *
+ * Returns: ENOENT if the sensor specified does not exist, EINVAL if the limits are
+  * out of range.
+ */
+#define MC_CMD_SENSOR_SET_LIMS 0x4e
+#define MC_CMD_SENSOR_SET_LIMS_IN_LEN 20
+#define MC_CMD_SENSOR_SET_LIMS_IN_SENSOR_OFST 0
+#define MC_CMD_SENSOR_SET_LIMS_IN_LOW0_OFST 4
+#define MC_CMD_SENSOR_SET_LIMS_IN_HI0_OFST  8
+#define MC_CMD_SENSOR_SET_LIMS_IN_LOW1_OFST 12
+#define MC_CMD_SENSOR_SET_LIMS_IN_HI1_OFST  16
+
 /* Do NOT add new commands beyond 0x4f as part of 3.0 : 0x50 - 0x7f will be
  * used for post-3.0 extensions. If you run out of space, look for gaps or
  * commands that are unused in the existing range. */
diff --git a/drivers/net/sfc/mcdi_phy.c b/drivers/net/sfc/mcdi_phy.c
index 2f2354696663..6032c0e1f1f8 100644
--- a/drivers/net/sfc/mcdi_phy.c
+++ b/drivers/net/sfc/mcdi_phy.c
@@ -17,6 +17,8 @@
 #include "mcdi.h"
 #include "mcdi_pcol.h"
 #include "mdio_10g.h"
+#include "nic.h"
+#include "selftest.h"
 
 struct efx_mcdi_phy_cfg {
         u32 flags;
@@ -48,7 +50,7 @@ efx_mcdi_get_phy_cfg(struct efx_nic *efx, struct efx_mcdi_phy_cfg *cfg)
                 goto fail;
 
         if (outlen < MC_CMD_GET_PHY_CFG_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
@@ -111,7 +113,7 @@ static int efx_mcdi_loopback_modes(struct efx_nic *efx, u64 *loopback_modes)
                 goto fail;
 
         if (outlen < MC_CMD_GET_LOOPBACK_MODES_OUT_LEN) {
-                rc = -EMSGSIZE;
+                rc = -EIO;
                 goto fail;
         }
 
@@ -587,13 +589,153 @@ static int efx_mcdi_phy_test_alive(struct efx_nic *efx)
                 return rc;
 
         if (outlen < MC_CMD_GET_PHY_STATE_OUT_LEN)
-                return -EMSGSIZE;
+                return -EIO;
         if (MCDI_DWORD(outbuf, GET_PHY_STATE_STATE) != MC_CMD_PHY_STATE_OK)
                 return -EINVAL;
 
         return 0;
 }
 
+static const char *const mcdi_sft9001_cable_diag_names[] = {
+        "cable.pairA.length",
+        "cable.pairB.length",
+        "cable.pairC.length",
+        "cable.pairD.length",
+        "cable.pairA.status",
+        "cable.pairB.status",
+        "cable.pairC.status",
+        "cable.pairD.status",
+};
+
+static int efx_mcdi_bist(struct efx_nic *efx, unsigned int bist_mode,
+                         int *results)
+{
+        unsigned int retry, i, count = 0;
+        size_t outlen;
+        u32 status;
+        u8 *buf, *ptr;
+        int rc;
+
+        buf = kzalloc(0x100, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        BUILD_BUG_ON(MC_CMD_START_BIST_OUT_LEN != 0);
+        MCDI_SET_DWORD(buf, START_BIST_IN_TYPE, bist_mode);
+        rc = efx_mcdi_rpc(efx, MC_CMD_START_BIST, buf, MC_CMD_START_BIST_IN_LEN,
+                          NULL, 0, NULL);
+        if (rc)
+                goto out;
+
+        /* Wait up to 10s for BIST to finish */
+        for (retry = 0; retry < 100; ++retry) {
+                BUILD_BUG_ON(MC_CMD_POLL_BIST_IN_LEN != 0);
+                rc = efx_mcdi_rpc(efx, MC_CMD_POLL_BIST, NULL, 0,
+                                  buf, 0x100, &outlen);
+                if (rc)
+                        goto out;
+
+                status = MCDI_DWORD(buf, POLL_BIST_OUT_RESULT);
+                if (status != MC_CMD_POLL_BIST_RUNNING)
+                        goto finished;
+
+                msleep(100);
+        }
+
+        rc = -ETIMEDOUT;
+        goto out;
+
+finished:
+        results[count++] = (status == MC_CMD_POLL_BIST_PASSED) ? 1 : -1;
+
+        /* SFT9001 specific cable diagnostics output */
+        if (efx->phy_type == PHY_TYPE_SFT9001B &&
+            (bist_mode == MC_CMD_PHY_BIST_CABLE_SHORT ||
+             bist_mode == MC_CMD_PHY_BIST_CABLE_LONG)) {
+                ptr = MCDI_PTR(buf, POLL_BIST_OUT_SFT9001_CABLE_LENGTH_A);
+                if (status == MC_CMD_POLL_BIST_PASSED &&
+                    outlen >= MC_CMD_POLL_BIST_OUT_SFT9001_LEN) {
+                        for (i = 0; i < 8; i++) {
+                                results[count + i] =
+                                        EFX_DWORD_FIELD(((efx_dword_t *)ptr)[i],
+                                                        EFX_DWORD_0);
+                        }
+                }
+                count += 8;
+        }
+        rc = count;
+
+out:
+        kfree(buf);
+
+        return rc;
+}
+
+static int efx_mcdi_phy_run_tests(struct efx_nic *efx, int *results,
+                                  unsigned flags)
+{
+        struct efx_mcdi_phy_cfg *phy_cfg = efx->phy_data;
+        u32 mode;
+        int rc;
+
+        if (phy_cfg->flags & (1 << MC_CMD_GET_PHY_CFG_BIST_LBN)) {
+                rc = efx_mcdi_bist(efx, MC_CMD_PHY_BIST, results);
+                if (rc < 0)
+                        return rc;
+
+                results += rc;
+        }
+
+        /* If we support both LONG and SHORT, then run each in response to
+         * break or not. Otherwise, run the one we support */
+        mode = 0;
+        if (phy_cfg->flags & (1 << MC_CMD_GET_PHY_CFG_BIST_CABLE_SHORT_LBN)) {
+                if ((flags & ETH_TEST_FL_OFFLINE) &&
+                    (phy_cfg->flags &
+                     (1 << MC_CMD_GET_PHY_CFG_BIST_CABLE_LONG_LBN)))
+                        mode = MC_CMD_PHY_BIST_CABLE_LONG;
+                else
+                        mode = MC_CMD_PHY_BIST_CABLE_SHORT;
+        } else if (phy_cfg->flags &
+                   (1 << MC_CMD_GET_PHY_CFG_BIST_CABLE_LONG_LBN))
+                mode = MC_CMD_PHY_BIST_CABLE_LONG;
+
+        if (mode != 0) {
+                rc = efx_mcdi_bist(efx, mode, results);
+                if (rc < 0)
+                        return rc;
+                results += rc;
+        }
+
+        return 0;
+}
+
+const char *efx_mcdi_phy_test_name(struct efx_nic *efx, unsigned int index)
+{
+        struct efx_mcdi_phy_cfg *phy_cfg = efx->phy_data;
+
+        if (phy_cfg->flags & (1 << MC_CMD_GET_PHY_CFG_BIST_LBN)) {
+                if (index == 0)
+                        return "bist";
+                --index;
+        }
+
+        if (phy_cfg->flags & ((1 << MC_CMD_GET_PHY_CFG_BIST_CABLE_SHORT_LBN) |
+                              (1 << MC_CMD_GET_PHY_CFG_BIST_CABLE_LONG_LBN))) {
+                if (index == 0)
+                        return "cable";
+                --index;
+
+                if (efx->phy_type == PHY_TYPE_SFT9001B) {
+                        if (index < ARRAY_SIZE(mcdi_sft9001_cable_diag_names))
+                                return mcdi_sft9001_cable_diag_names[index];
+                        index -= ARRAY_SIZE(mcdi_sft9001_cable_diag_names);
+                }
+        }
+
+        return NULL;
+}
+
 struct efx_phy_operations efx_mcdi_phy_ops = {
         .probe          = efx_mcdi_phy_probe,
         .init           = efx_port_dummy_op_int,
@@ -604,6 +746,6 @@ struct efx_phy_operations efx_mcdi_phy_ops = {
         .get_settings   = efx_mcdi_phy_get_settings,
         .set_settings   = efx_mcdi_phy_set_settings,
         .test_alive     = efx_mcdi_phy_test_alive,
-        .run_tests      = NULL,
-        .test_name      = NULL,
+        .run_tests      = efx_mcdi_phy_run_tests,
+        .test_name      = efx_mcdi_phy_test_name,
 };
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index cb018e272097..2e6fd89f2a72 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -85,9 +85,13 @@ do {if (net_ratelimit()) EFX_LOG(efx, fmt, ##args); } while (0)
 #define EFX_MAX_CHANNELS 32
 #define EFX_MAX_RX_QUEUES EFX_MAX_CHANNELS
 
-#define EFX_TX_QUEUE_OFFLOAD_CSUM       0
-#define EFX_TX_QUEUE_NO_CSUM            1
-#define EFX_TX_QUEUE_COUNT              2
+/* Checksum generation is a per-queue option in hardware, so each
+ * queue visible to the networking core is backed by two hardware TX
+ * queues. */
+#define EFX_MAX_CORE_TX_QUEUES  EFX_MAX_CHANNELS
+#define EFX_TXQ_TYPE_OFFLOAD    1
+#define EFX_TXQ_TYPES           2
+#define EFX_MAX_TX_QUEUES       (EFX_TXQ_TYPES * EFX_MAX_CORE_TX_QUEUES)
 
 /**
  * struct efx_special_buffer - An Efx special buffer
@@ -187,7 +191,7 @@ struct efx_tx_buffer {
 struct efx_tx_queue {
         /* Members which don't change on the fast path */
         struct efx_nic *efx ____cacheline_aligned_in_smp;
-        int queue;
+        unsigned queue;
         struct efx_channel *channel;
         struct efx_nic *nic;
         struct efx_tx_buffer *buffer;
@@ -306,11 +310,6 @@ struct efx_buffer {
 };
 
 
-/* Flags for channel->used_flags */
-#define EFX_USED_BY_RX 1
-#define EFX_USED_BY_TX 2
-#define EFX_USED_BY_RX_TX (EFX_USED_BY_RX | EFX_USED_BY_TX)
-
 enum efx_rx_alloc_method {
         RX_ALLOC_METHOD_AUTO = 0,
         RX_ALLOC_METHOD_SKB = 1,
@@ -327,7 +326,6 @@ enum efx_rx_alloc_method {
  * @efx: Associated Efx NIC
  * @channel: Channel instance number
  * @name: Name for channel and IRQ
- * @used_flags: Channel is used by net driver
  * @enabled: Channel enabled indicator
  * @irq: IRQ number (MSI and MSI-X only)
  * @irq_moderation: IRQ moderation value (in hardware ticks)
@@ -352,12 +350,14 @@ enum efx_rx_alloc_method {
  * @n_rx_frm_trunc: Count of RX_FRM_TRUNC errors
  * @n_rx_overlength: Count of RX_OVERLENGTH errors
  * @n_skbuff_leaks: Count of skbuffs leaked due to RX overrun
+ * @tx_queue: Pointer to first TX queue, or %NULL if not used for TX
+ * @tx_stop_count: Core TX queue stop count
+ * @tx_stop_lock: Core TX queue stop lock
  */
 struct efx_channel {
         struct efx_nic *efx;
         int channel;
         char name[IFNAMSIZ + 6];
-        int used_flags;
         bool enabled;
         int irq;
         unsigned int irq_moderation;
@@ -389,6 +389,9 @@ struct efx_channel {
         struct efx_rx_buffer *rx_pkt;
         bool rx_pkt_csummed;
 
+        struct efx_tx_queue *tx_queue;
+        atomic_t tx_stop_count;
+        spinlock_t tx_stop_lock;
 };
 
 enum efx_led_mode {
@@ -661,8 +664,9 @@ union efx_multicast_hash {
  * @rx_queue: RX DMA queues
  * @channel: Channels
  * @next_buffer_table: First available buffer table id
- * @n_rx_queues: Number of RX queues
  * @n_channels: Number of channels in use
+ * @n_rx_channels: Number of channels used for RX (= number of RX queues)
+ * @n_tx_channels: Number of channels used for TX
  * @rx_buffer_len: RX buffer length
  * @rx_buffer_order: Order (log2) of number of pages for each RX buffer
  * @int_error_count: Number of internal errors seen recently
@@ -672,6 +676,8 @@ union efx_multicast_hash {
  *      This register is written with the SMP processor ID whenever an
  *      interrupt is handled.  It is used by efx_nic_test_interrupt()
  *      to verify that an interrupt has occurred.
+ * @irq_zero_count: Number of legacy IRQs seen with queue flags == 0
+ * @fatal_irq_level: IRQ level (bit number) used for serious errors
  * @spi_flash: SPI flash device
  *      This field will be %NULL if no flash device is present (or for Siena).
  * @spi_eeprom: SPI EEPROM device
@@ -691,8 +697,6 @@ union efx_multicast_hash {
  * @port_initialized: Port initialized?
  * @net_dev: Operating system network device. Consider holding the rtnl lock
  * @rx_checksum_enabled: RX checksumming enabled
- * @netif_stop_count: Port stop count
- * @netif_stop_lock: Port stop lock
  * @mac_stats: MAC statistics. These include all statistics the MACs
  *      can provide.  Generic code converts these into a standard
  *      &struct net_device_stats.
@@ -740,13 +744,14 @@ struct efx_nic {
         enum nic_state state;
         enum reset_type reset_pending;
 
-        struct efx_tx_queue tx_queue[EFX_TX_QUEUE_COUNT];
+        struct efx_tx_queue tx_queue[EFX_MAX_TX_QUEUES];
         struct efx_rx_queue rx_queue[EFX_MAX_RX_QUEUES];
         struct efx_channel channel[EFX_MAX_CHANNELS];
 
         unsigned next_buffer_table;
-        int n_rx_queues;
-        int n_channels;
+        unsigned n_channels;
+        unsigned n_rx_channels;
+        unsigned n_tx_channels;
         unsigned int rx_buffer_len;
         unsigned int rx_buffer_order;
 
@@ -755,7 +760,8 @@ struct efx_nic {
 
         struct efx_buffer irq_status;
         volatile signed int last_irq_cpu;
-        unsigned long irq_zero_count;
+        unsigned irq_zero_count;
+        unsigned fatal_irq_level;
 
         struct efx_spi_device *spi_flash;
         struct efx_spi_device *spi_eeprom;
@@ -777,9 +783,6 @@ struct efx_nic {
         struct net_device *net_dev;
         bool rx_checksum_enabled;
 
-        atomic_t netif_stop_count;
-        spinlock_t netif_stop_lock;
-
         struct efx_mac_stats mac_stats;
         struct efx_buffer stats_buffer;
         spinlock_t stats_lock;
@@ -924,40 +927,35 @@ struct efx_nic_type {
 
 /* Iterate over all used channels */
 #define efx_for_each_channel(_channel, _efx)                            \
-        for (_channel = &_efx->channel[0];                              \
-             _channel < &_efx->channel[EFX_MAX_CHANNELS];               \
-             _channel++)                                                \
-                if (!_channel->used_flags)                              \
-                        continue;                                       \
-                else
+        for (_channel = &((_efx)->channel[0]);                          \
+             _channel < &((_efx)->channel[(efx)->n_channels]);          \
+             _channel++)
 
 /* Iterate over all used TX queues */
 #define efx_for_each_tx_queue(_tx_queue, _efx)                          \
-        for (_tx_queue = &_efx->tx_queue[0];                            \
-             _tx_queue < &_efx->tx_queue[EFX_TX_QUEUE_COUNT];           \
+        for (_tx_queue = &((_efx)->tx_queue[0]);                        \
+             _tx_queue < &((_efx)->tx_queue[EFX_TXQ_TYPES *             \
+                                            (_efx)->n_tx_channels]);    \
              _tx_queue++)
 
 /* Iterate over all TX queues belonging to a channel */
 #define efx_for_each_channel_tx_queue(_tx_queue, _channel)              \
-        for (_tx_queue = &_channel->efx->tx_queue[0];                   \
-             _tx_queue < &_channel->efx->tx_queue[EFX_TX_QUEUE_COUNT];  \
-             _tx_queue++)                                               \
-                if (_tx_queue->channel != _channel)                     \
-                        continue;                                       \
-                else
+        for (_tx_queue = (_channel)->tx_queue;                          \
+             _tx_queue && _tx_queue < (_channel)->tx_queue + EFX_TXQ_TYPES; \
+             _tx_queue++)
 
 /* Iterate over all used RX queues */
 #define efx_for_each_rx_queue(_rx_queue, _efx)                          \
-        for (_rx_queue = &_efx->rx_queue[0];                            \
-             _rx_queue < &_efx->rx_queue[_efx->n_rx_queues];            \
+        for (_rx_queue = &((_efx)->rx_queue[0]);                        \
+             _rx_queue < &((_efx)->rx_queue[(_efx)->n_rx_channels]);    \
              _rx_queue++)
 
 /* Iterate over all RX queues belonging to a channel */
 #define efx_for_each_channel_rx_queue(_rx_queue, _channel)              \
-        for (_rx_queue = &_channel->efx->rx_queue[_channel->channel];   \
+        for (_rx_queue = &((_channel)->efx->rx_queue[(_channel)->channel]); \
              _rx_queue;                                                 \
              _rx_queue = NULL)                                          \
-                if (_rx_queue->channel != _channel)                     \
+                if (_rx_queue->channel != (_channel))                   \
                         continue;                                       \
                 else
 
diff --git a/drivers/net/sfc/nic.c b/drivers/net/sfc/nic.c
index b06f8e348307..5d3aaec58556 100644
--- a/drivers/net/sfc/nic.c
+++ b/drivers/net/sfc/nic.c
@@ -418,7 +418,7 @@ void efx_nic_init_tx(struct efx_tx_queue *tx_queue)
                               FRF_BZ_TX_NON_IP_DROP_DIS, 1);
 
         if (efx_nic_rev(efx) >= EFX_REV_FALCON_B0) {
-                int csum = tx_queue->queue == EFX_TX_QUEUE_OFFLOAD_CSUM;
+                int csum = tx_queue->queue & EFX_TXQ_TYPE_OFFLOAD;
                 EFX_SET_OWORD_FIELD(tx_desc_ptr, FRF_BZ_TX_IP_CHKSM_DIS, !csum);
                 EFX_SET_OWORD_FIELD(tx_desc_ptr, FRF_BZ_TX_TCP_CHKSM_DIS,
                                     !csum);
@@ -431,10 +431,10 @@ void efx_nic_init_tx(struct efx_tx_queue *tx_queue)
                 efx_oword_t reg;
 
                 /* Only 128 bits in this register */
-                BUILD_BUG_ON(EFX_TX_QUEUE_COUNT >= 128);
+                BUILD_BUG_ON(EFX_MAX_TX_QUEUES > 128);
 
                 efx_reado(efx, &reg, FR_AA_TX_CHKSM_CFG);
-                if (tx_queue->queue == EFX_TX_QUEUE_OFFLOAD_CSUM)
+                if (tx_queue->queue & EFX_TXQ_TYPE_OFFLOAD)
                         clear_bit_le(tx_queue->queue, (void *)&reg);
                 else
                         set_bit_le(tx_queue->queue, (void *)&reg);
@@ -654,22 +654,23 @@ void efx_generate_event(struct efx_channel *channel, efx_qword_t *event)
  * The NIC batches TX completion events; the message we receive is of
  * the form "complete all TX events up to this index".
  */
-static void
+static int
 efx_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)
 {
         unsigned int tx_ev_desc_ptr;
         unsigned int tx_ev_q_label;
         struct efx_tx_queue *tx_queue;
         struct efx_nic *efx = channel->efx;
+        int tx_packets = 0;
 
         if (likely(EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_COMP))) {
                 /* Transmit completion */
                 tx_ev_desc_ptr = EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_DESC_PTR);
                 tx_ev_q_label = EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_Q_LABEL);
                 tx_queue = &efx->tx_queue[tx_ev_q_label];
-                channel->irq_mod_score +=
-                        (tx_ev_desc_ptr - tx_queue->read_count) &
-                        EFX_TXQ_MASK;
+                tx_packets = ((tx_ev_desc_ptr - tx_queue->read_count) &
+                              EFX_TXQ_MASK);
+                channel->irq_mod_score += tx_packets;
                 efx_xmit_done(tx_queue, tx_ev_desc_ptr);
         } else if (EFX_QWORD_FIELD(*event, FSF_AZ_TX_EV_WQ_FF_FULL)) {
                 /* Rewrite the FIFO write pointer */
@@ -689,6 +690,8 @@ efx_handle_tx_event(struct efx_channel *channel, efx_qword_t *event)
                         EFX_QWORD_FMT"\n", channel->channel,
                         EFX_QWORD_VAL(*event));
         }
+
+        return tx_packets;
 }
 
 /* Detect errors included in the rx_evt_pkt_ok bit. */
@@ -947,16 +950,17 @@ efx_handle_driver_event(struct efx_channel *channel, efx_qword_t *event)
         }
 }
 
-int efx_nic_process_eventq(struct efx_channel *channel, int rx_quota)
+int efx_nic_process_eventq(struct efx_channel *channel, int budget)
 {
         unsigned int read_ptr;
         efx_qword_t event, *p_event;
         int ev_code;
-        int rx_packets = 0;
+        int tx_packets = 0;
+        int spent = 0;
 
         read_ptr = channel->eventq_read_ptr;
 
-        do {
+        for (;;) {
                 p_event = efx_event(channel, read_ptr);
                 event = *p_event;
 
@@ -970,15 +974,23 @@ int efx_nic_process_eventq(struct efx_channel *channel, int rx_quota)
                 /* Clear this event by marking it all ones */
                 EFX_SET_QWORD(*p_event);
 
+                /* Increment read pointer */
+                read_ptr = (read_ptr + 1) & EFX_EVQ_MASK;
+
                 ev_code = EFX_QWORD_FIELD(event, FSF_AZ_EV_CODE);
 
                 switch (ev_code) {
                 case FSE_AZ_EV_CODE_RX_EV:
                         efx_handle_rx_event(channel, &event);
-                        ++rx_packets;
+                        if (++spent == budget)
+                                goto out;
                         break;
                 case FSE_AZ_EV_CODE_TX_EV:
-                        efx_handle_tx_event(channel, &event);
+                        tx_packets += efx_handle_tx_event(channel, &event);
+                        if (tx_packets >= EFX_TXQ_SIZE) {
+                                spent = budget;
+                                goto out;
+                        }
                         break;
                 case FSE_AZ_EV_CODE_DRV_GEN_EV:
                         channel->eventq_magic = EFX_QWORD_FIELD(
@@ -1001,14 +1013,11 @@ int efx_nic_process_eventq(struct efx_channel *channel, int rx_quota)
                                 " (data " EFX_QWORD_FMT ")\n", channel->channel,
                                 ev_code, EFX_QWORD_VAL(event));
                 }
+        }
 
-                /* Increment read pointer */
-                read_ptr = (read_ptr + 1) & EFX_EVQ_MASK;
-
-        } while (rx_packets < rx_quota);
-
+out:
         channel->eventq_read_ptr = read_ptr;
-        return rx_packets;
+        return spent;
 }
 
 
@@ -1123,7 +1132,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                     ev_sub_code == FSE_AZ_TX_DESCQ_FLS_DONE_EV) {
                         ev_queue = EFX_QWORD_FIELD(*event,
                                                    FSF_AZ_DRIVER_EV_SUBDATA);
-                        if (ev_queue < EFX_TX_QUEUE_COUNT) {
+                        if (ev_queue < EFX_TXQ_TYPES * efx->n_tx_channels) {
                                 tx_queue = efx->tx_queue + ev_queue;
                                 tx_queue->flushed = FLUSH_DONE;
                         }
@@ -1133,7 +1142,7 @@ static void efx_poll_flush_events(struct efx_nic *efx)
                                 *event, FSF_AZ_DRIVER_EV_RX_DESCQ_ID);
                         ev_failed = EFX_QWORD_FIELD(
                                 *event, FSF_AZ_DRIVER_EV_RX_FLUSH_FAIL);
-                        if (ev_queue < efx->n_rx_queues) {
+                        if (ev_queue < efx->n_rx_channels) {
                                 rx_queue = efx->rx_queue + ev_queue;
                                 rx_queue->flushed =
                                         ev_failed ? FLUSH_FAILED : FLUSH_DONE;
@@ -1229,15 +1238,9 @@ static inline void efx_nic_interrupts(struct efx_nic *efx,
                                       bool enabled, bool force)
 {
         efx_oword_t int_en_reg_ker;
-        unsigned int level = 0;
-
-        if (EFX_WORKAROUND_17213(efx) && !EFX_INT_MODE_USE_MSI(efx))
-                /* Set the level always even if we're generating a test
-                 * interrupt, because our legacy interrupt handler is safe */
-                level = 0x1f;
 
         EFX_POPULATE_OWORD_3(int_en_reg_ker,
-                             FRF_AZ_KER_INT_LEVE_SEL, level,
+                             FRF_AZ_KER_INT_LEVE_SEL, efx->fatal_irq_level,
                              FRF_AZ_KER_INT_KER, force,
                              FRF_AZ_DRV_INT_EN_KER, enabled);
         efx_writeo(efx, &int_en_reg_ker, FR_AZ_INT_EN_KER);
@@ -1291,11 +1294,10 @@ irqreturn_t efx_nic_fatal_interrupt(struct efx_nic *efx)
                 EFX_OWORD_FMT ": %s\n", EFX_OWORD_VAL(*int_ker),
                 EFX_OWORD_VAL(fatal_intr),
                 error ? "disabling bus mastering" : "no recognised error");
-        if (error == 0)
-                goto out;
 
         /* If this is a memory parity error dump which blocks are offending */
-        mem_perr = EFX_OWORD_FIELD(fatal_intr, FRF_AZ_MEM_PERR_INT_KER);
+        mem_perr = (EFX_OWORD_FIELD(fatal_intr, FRF_AZ_MEM_PERR_INT_KER) ||
+                    EFX_OWORD_FIELD(fatal_intr, FRF_AZ_SRM_PERR_INT_KER));
         if (mem_perr) {
                 efx_oword_t reg;
                 efx_reado(efx, &reg, FR_AZ_MEM_STAT);
@@ -1324,7 +1326,7 @@ irqreturn_t efx_nic_fatal_interrupt(struct efx_nic *efx)
                         "NIC will be disabled\n");
                 efx_schedule_reset(efx, RESET_TYPE_DISABLE);
         }
-out:
+
         return IRQ_HANDLED;
 }
 
@@ -1346,9 +1348,11 @@ static irqreturn_t efx_legacy_interrupt(int irq, void *dev_id)
         queues = EFX_EXTRACT_DWORD(reg, 0, 31);
 
         /* Check to see if we have a serious error condition */
-        syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
-        if (unlikely(syserr))
-                return efx_nic_fatal_interrupt(efx);
+        if (queues & (1U << efx->fatal_irq_level)) {
+                syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
+                if (unlikely(syserr))
+                        return efx_nic_fatal_interrupt(efx);
+        }
 
         if (queues != 0) {
                 if (EFX_WORKAROUND_15783(efx))
@@ -1362,33 +1366,28 @@ static irqreturn_t efx_legacy_interrupt(int irq, void *dev_id)
                 }
                 result = IRQ_HANDLED;
 
-        } else if (EFX_WORKAROUND_15783(efx) &&
-                   efx->irq_zero_count++ == 0) {
+        } else if (EFX_WORKAROUND_15783(efx)) {
                 efx_qword_t *event;
 
-                /* Ensure we rearm all event queues */
+                /* We can't return IRQ_HANDLED more than once on seeing ISR=0
+                 * because this might be a shared interrupt. */
+                if (efx->irq_zero_count++ == 0)
+                        result = IRQ_HANDLED;
+
+                /* Ensure we schedule or rearm all event queues */
                 efx_for_each_channel(channel, efx) {
                         event = efx_event(channel, channel->eventq_read_ptr);
                         if (efx_event_present(event))
                                 efx_schedule_channel(channel);
+                        else
+                                efx_nic_eventq_read_ack(channel);
                 }
-
-                result = IRQ_HANDLED;
         }
 
         if (result == IRQ_HANDLED) {
                 efx->last_irq_cpu = raw_smp_processor_id();
                 EFX_TRACE(efx, "IRQ %d on CPU %d status " EFX_DWORD_FMT "\n",
                           irq, raw_smp_processor_id(), EFX_DWORD_VAL(reg));
-        } else if (EFX_WORKAROUND_15783(efx)) {
-                /* We can't return IRQ_HANDLED more than once on seeing ISR0=0
-                 * because this might be a shared interrupt, but we do need to
-                 * check the channel every time and preemptively rearm it if
-                 * it's idle. */
-                efx_for_each_channel(channel, efx) {
-                        if (!channel->work_pending)
-                                efx_nic_eventq_read_ack(channel);
-                }
         }
 
         return result;
@@ -1413,9 +1412,11 @@ static irqreturn_t efx_msi_interrupt(int irq, void *dev_id)
                   irq, raw_smp_processor_id(), EFX_OWORD_VAL(*int_ker));
 
         /* Check to see if we have a serious error condition */
-        syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
-        if (unlikely(syserr))
-                return efx_nic_fatal_interrupt(efx);
+        if (channel->channel == efx->fatal_irq_level) {
+                syserr = EFX_OWORD_FIELD(*int_ker, FSF_AZ_NET_IVEC_FATAL_INT);
+                if (unlikely(syserr))
+                        return efx_nic_fatal_interrupt(efx);
+        }
 
         /* Schedule processing of the channel */
         efx_schedule_channel(channel);
@@ -1440,7 +1441,7 @@ static void efx_setup_rss_indir_table(struct efx_nic *efx)
              offset < FR_BZ_RX_INDIRECTION_TBL + 0x800;
              offset += 0x10) {
                 EFX_POPULATE_DWORD_1(dword, FRF_BZ_IT_QUEUE,
-                                     i % efx->n_rx_queues);
+                                     i % efx->n_rx_channels);
                 efx_writed(efx, &dword, offset);
                 i++;
         }
@@ -1553,6 +1554,13 @@ void efx_nic_init_common(struct efx_nic *efx)
                              FRF_AZ_INT_ADR_KER, efx->irq_status.dma_addr);
         efx_writeo(efx, &temp, FR_AZ_INT_ADR_KER);
 
+        if (EFX_WORKAROUND_17213(efx) && !EFX_INT_MODE_USE_MSI(efx))
+                /* Use an interrupt level unused by event queues */
+                efx->fatal_irq_level = 0x1f;
+        else
+                /* Use a valid MSI-X vector */
+                efx->fatal_irq_level = 0;
+
         /* Enable all the genuinely fatal interrupts.  (They are still
          * masked by the overall interrupt mask, controlled by
          * falcon_interrupts()).
@@ -1563,6 +1571,8 @@ void efx_nic_init_common(struct efx_nic *efx)
                              FRF_AZ_ILL_ADR_INT_KER_EN, 1,
                              FRF_AZ_RBUF_OWN_INT_KER_EN, 1,
                              FRF_AZ_TBUF_OWN_INT_KER_EN, 1);
+        if (efx_nic_rev(efx) >= EFX_REV_SIENA_A0)
+                EFX_SET_OWORD_FIELD(temp, FRF_CZ_SRAM_PERR_INT_P_KER_EN, 1);
         EFX_INVERT_OWORD(temp);
         efx_writeo(efx, &temp, FR_AZ_FATAL_INTR_KER);
 
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 9351c0331a47..bbc2c0c2f843 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -135,12 +135,14 @@ static inline struct falcon_board *falcon_board(struct efx_nic *efx)
  * @fw_build: Firmware build number
  * @mcdi: Management-Controller-to-Driver Interface
  * @wol_filter_id: Wake-on-LAN packet filter id
+ * @ipv6_rss_key: Toeplitz hash key for IPv6 RSS
  */
 struct siena_nic_data {
         u64 fw_version;
         u32 fw_build;
         struct efx_mcdi_iface mcdi;
         int wol_filter_id;
+        u8 ipv6_rss_key[40];
 };
 
 extern void siena_print_fwver(struct efx_nic *efx, char *buf, size_t len);
@@ -156,7 +158,7 @@ extern struct efx_nic_type siena_a0_nic_type;
  **************************************************************************
  */
 
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
@@ -203,6 +205,7 @@ extern void falcon_irq_ack_a1(struct efx_nic *efx);
 extern int efx_nic_flush_queues(struct efx_nic *efx);
 extern void falcon_start_nic_stats(struct efx_nic *efx);
 extern void falcon_stop_nic_stats(struct efx_nic *efx);
+extern void falcon_setup_xaui(struct efx_nic *efx);
 extern int falcon_reset_xaui(struct efx_nic *efx);
 extern void efx_nic_init_common(struct efx_nic *efx);
 
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index 0106b1d9aae2..371e86cc090f 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -616,10 +616,10 @@ static int efx_test_loopbacks(struct efx_nic *efx, struct efx_self_tests *tests,
                         goto out;
                 }
 
-                /* Test every TX queue */
-                efx_for_each_tx_queue(tx_queue, efx) {
-                        state->offload_csum = (tx_queue->queue ==
-                                               EFX_TX_QUEUE_OFFLOAD_CSUM);
+                /* Test both types of TX queue */
+                efx_for_each_channel_tx_queue(tx_queue, &efx->channel[0]) {
+                        state->offload_csum = (tx_queue->queue &
+                                               EFX_TXQ_TYPE_OFFLOAD);
                         rc = efx_test_loopback(tx_queue,
                                                &tests->loopback[mode]);
                         if (rc)
diff --git a/drivers/net/sfc/selftest.h b/drivers/net/sfc/selftest.h
index 643bef72b99d..aed495a4dad7 100644
--- a/drivers/net/sfc/selftest.h
+++ b/drivers/net/sfc/selftest.h
@@ -18,8 +18,8 @@
  */
 
 struct efx_loopback_self_tests {
-        int tx_sent[EFX_TX_QUEUE_COUNT];
-        int tx_done[EFX_TX_QUEUE_COUNT];
+        int tx_sent[EFX_TXQ_TYPES];
+        int tx_done[EFX_TXQ_TYPES];
         int rx_good;
         int rx_bad;
 };
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 38dcc42c4f79..727b4228e081 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -13,6 +13,7 @@
 #include <linux/pci.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/random.h>
 #include "net_driver.h"
 #include "bitfield.h"
 #include "efx.h"
@@ -274,6 +275,9 @@ static int siena_probe_nic(struct efx_nic *efx)
                 goto fail5;
         }
 
+        get_random_bytes(&nic_data->ipv6_rss_key,
+                         sizeof(nic_data->ipv6_rss_key));
+
         return 0;
 
 fail5:
@@ -293,6 +297,7 @@ fail1:
  */
 static int siena_init_nic(struct efx_nic *efx)
 {
+        struct siena_nic_data *nic_data = efx->nic_data;
         efx_oword_t temp;
         int rc;
 
@@ -319,6 +324,20 @@ static int siena_init_nic(struct efx_nic *efx)
         EFX_SET_OWORD_FIELD(temp, FRF_BZ_RX_INGR_EN, 1);
         efx_writeo(efx, &temp, FR_AZ_RX_CFG);
 
+        /* Enable IPv6 RSS */
+        BUILD_BUG_ON(sizeof(nic_data->ipv6_rss_key) !=
+                     2 * sizeof(temp) + FRF_CZ_RX_RSS_IPV6_TKEY_HI_WIDTH / 8 ||
+                     FRF_CZ_RX_RSS_IPV6_TKEY_HI_LBN != 0);
+        memcpy(&temp, nic_data->ipv6_rss_key, sizeof(temp));
+        efx_writeo(efx, &temp, FR_CZ_RX_RSS_IPV6_REG1);
+        memcpy(&temp, nic_data->ipv6_rss_key + sizeof(temp), sizeof(temp));
+        efx_writeo(efx, &temp, FR_CZ_RX_RSS_IPV6_REG2);
+        EFX_POPULATE_OWORD_2(temp, FRF_CZ_RX_RSS_IPV6_THASH_ENABLE, 1,
+                             FRF_CZ_RX_RSS_IPV6_IP_THASH_ENABLE, 1);
+        memcpy(&temp, nic_data->ipv6_rss_key + 2 * sizeof(temp),
+               FRF_CZ_RX_RSS_IPV6_TKEY_HI_WIDTH / 8);
+        efx_writeo(efx, &temp, FR_CZ_RX_RSS_IPV6_REG3);
+
         if (efx_nic_rx_xoff_thresh >= 0 || efx_nic_rx_xon_thresh >= 0)
                 /* No MCDI operation has been defined to set thresholds */
                 EFX_ERR(efx, "ignoring RX flow control thresholds\n");
@@ -456,8 +475,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
-                cpu_relax();
+        int retry;
+
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+
+        /* Use the old values instead */
 }
 
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/sfc/tx.c b/drivers/net/sfc/tx.c
index be0e110a1f73..6bb12a87ef2d 100644
--- a/drivers/net/sfc/tx.c
+++ b/drivers/net/sfc/tx.c
@@ -30,32 +30,46 @@
  */
 #define EFX_TXQ_THRESHOLD (EFX_TXQ_MASK / 2u)
 
-/* We want to be able to nest calls to netif_stop_queue(), since each
- * channel can have an individual stop on the queue.
- */
-void efx_stop_queue(struct efx_nic *efx)
+/* We need to be able to nest calls to netif_tx_stop_queue(), partly
+ * because of the 2 hardware queues associated with each core queue,
+ * but also so that we can inhibit TX for reasons other than a full
+ * hardware queue. */
+void efx_stop_queue(struct efx_channel *channel)
 {
-        spin_lock_bh(&efx->netif_stop_lock);
+        struct efx_nic *efx = channel->efx;
+
+        if (!channel->tx_queue)
+                return;
+
+        spin_lock_bh(&channel->tx_stop_lock);
         EFX_TRACE(efx, "stop TX queue\n");
 
-        atomic_inc(&efx->netif_stop_count);
-        netif_stop_queue(efx->net_dev);
+        atomic_inc(&channel->tx_stop_count);
+        netif_tx_stop_queue(
+                netdev_get_tx_queue(
+                        efx->net_dev,
+                        channel->tx_queue->queue / EFX_TXQ_TYPES));
 
-        spin_unlock_bh(&efx->netif_stop_lock);
+        spin_unlock_bh(&channel->tx_stop_lock);
 }
 
-/* Wake netif's TX queue
- * We want to be able to nest calls to netif_stop_queue(), since each
- * channel can have an individual stop on the queue.
- */
-void efx_wake_queue(struct efx_nic *efx)
+/* Decrement core TX queue stop count and wake it if the count is 0 */
+void efx_wake_queue(struct efx_channel *channel)
 {
+        struct efx_nic *efx = channel->efx;
+
+        if (!channel->tx_queue)
+                return;
+
         local_bh_disable();
-        if (atomic_dec_and_lock(&efx->netif_stop_count,
-                                &efx->netif_stop_lock)) {
+        if (atomic_dec_and_lock(&channel->tx_stop_count,
+                                &channel->tx_stop_lock)) {
                 EFX_TRACE(efx, "waking TX queue\n");
-                netif_wake_queue(efx->net_dev);
-                spin_unlock(&efx->netif_stop_lock);
+                netif_tx_wake_queue(
+                        netdev_get_tx_queue(
+                                efx->net_dev,
+                                channel->tx_queue->queue / EFX_TXQ_TYPES));
+                spin_unlock(&channel->tx_stop_lock);
         }
         local_bh_enable();
 }
@@ -298,7 +312,7 @@ netdev_tx_t efx_enqueue_skb(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
         rc = NETDEV_TX_BUSY;
 
         if (tx_queue->stopped == 1)
-                efx_stop_queue(efx);
+                efx_stop_queue(tx_queue->channel);
 
  unwind:
         /* Work backwards until we hit the original insert pointer value */
@@ -374,10 +388,9 @@ netdev_tx_t efx_hard_start_xmit(struct sk_buff *skb,
         if (unlikely(efx->port_inhibited))
                 return NETDEV_TX_BUSY;
 
+        tx_queue = &efx->tx_queue[EFX_TXQ_TYPES * skb_get_queue_mapping(skb)];
         if (likely(skb->ip_summed == CHECKSUM_PARTIAL))
-                tx_queue = &efx->tx_queue[EFX_TX_QUEUE_OFFLOAD_CSUM];
-        else
-                tx_queue = &efx->tx_queue[EFX_TX_QUEUE_NO_CSUM];
+                tx_queue += EFX_TXQ_TYPE_OFFLOAD;
 
         return efx_enqueue_skb(tx_queue, skb);
 }
@@ -405,7 +418,7 @@ void efx_xmit_done(struct efx_tx_queue *tx_queue, unsigned int index)
                         netif_tx_lock(efx->net_dev);
                         if (tx_queue->stopped) {
                                 tx_queue->stopped = 0;
-                                efx_wake_queue(efx);
+                                efx_wake_queue(tx_queue->channel);
                         }
                         netif_tx_unlock(efx->net_dev);
                 }
@@ -488,7 +501,7 @@ void efx_fini_tx_queue(struct efx_tx_queue *tx_queue)
         /* Release queue's stop on port, if any */
         if (tx_queue->stopped) {
                 tx_queue->stopped = 0;
-                efx_wake_queue(tx_queue->efx);
+                efx_wake_queue(tx_queue->channel);
         }
 }
 
@@ -1120,7 +1133,7 @@ static int efx_enqueue_skb_tso(struct efx_tx_queue *tx_queue,
 
         /* Stop the queue if it wasn't stopped before. */
         if (tx_queue->stopped == 1)
-                efx_stop_queue(efx);
+                efx_stop_queue(tx_queue->channel);
 
  unwind:
         /* Free the DMA mapping we were in the process of writing out */
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index acd9c734e483..518f7fc91473 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -37,7 +37,7 @@
 /* Truncated IPv4 packets can confuse the TX packet parser */
 #define EFX_WORKAROUND_15592 EFX_WORKAROUND_FALCON_AB
 /* Legacy ISR read can return zero once */
-#define EFX_WORKAROUND_15783 EFX_WORKAROUND_SIENA
+#define EFX_WORKAROUND_15783 EFX_WORKAROUND_ALWAYS
 /* Legacy interrupt storm when interrupt fifo fills */
 #define EFX_WORKAROUND_17213 EFX_WORKAROUND_SIENA
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3a086d3a7cbf..bf9c05be347b 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -70,18 +70,15 @@
    VLAN:GSO + CKSUM + Data + skb_frags * DMA */
 #define MAX_SKB_TX_LE   (2 + (sizeof(dma_addr_t)/sizeof(u32))*(MAX_SKB_FRAGS+1))
 #define TX_MIN_PENDING          (MAX_SKB_TX_LE+1)
-#define TX_MAX_PENDING          4096
+#define TX_MAX_PENDING          1024
 #define TX_DEF_PENDING          127
 
-#define STATUS_RING_SIZE        2048    /* 2 ports * (TX + 2*RX) */
-#define STATUS_LE_BYTES         (STATUS_RING_SIZE*sizeof(struct sky2_status_le))
 #define TX_WATCHDOG             (5 * HZ)
 #define NAPI_WEIGHT             64
 #define PHY_RETRIES             1000
 
 #define SKY2_EEPROM_MAGIC       0x9955aabb
 
-
 #define RING_NEXT(x,s)  (((x)+1) & ((s)-1))
 
 static const u32 default_msg =
@@ -1132,7 +1129,7 @@ static int sky2_rx_map_skb(struct pci_dev *pdev, struct rx_ring_info *re,
         if (pci_dma_mapping_error(pdev, re->data_addr))
                 goto mapping_error;
 
-        pci_unmap_len_set(re, data_size, size);
+        dma_unmap_len_set(re, data_size, size);
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
                 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
@@ -1154,7 +1151,7 @@ map_page_error:
                                PCI_DMA_FROMDEVICE);
         }
 
-        pci_unmap_single(pdev, re->data_addr, pci_unmap_len(re, data_size),
+        pci_unmap_single(pdev, re->data_addr, dma_unmap_len(re, data_size),
                          PCI_DMA_FROMDEVICE);
 
 mapping_error:
@@ -1169,7 +1166,7 @@ static void sky2_rx_unmap_skb(struct pci_dev *pdev, struct rx_ring_info *re)
         struct sk_buff *skb = re->skb;
         int i;
 
-        pci_unmap_single(pdev, re->data_addr, pci_unmap_len(re, data_size),
+        pci_unmap_single(pdev, re->data_addr, dma_unmap_len(re, data_size),
                          PCI_DMA_FROMDEVICE);
 
         for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
@@ -1196,6 +1193,39 @@ static void rx_set_checksum(struct sky2_port *sky2)
                      ? BMU_ENA_RX_CHKSUM : BMU_DIS_RX_CHKSUM);
 }
 
+/* Enable/disable receive hash calculation (RSS) */
+static void rx_set_rss(struct net_device *dev)
+{
+        struct sky2_port *sky2 = netdev_priv(dev);
+        struct sky2_hw *hw = sky2->hw;
+        int i, nkeys = 4;
+
+        /* Supports IPv6 and other modes */
+        if (hw->flags & SKY2_HW_NEW_LE) {
+                nkeys = 10;
+                sky2_write32(hw, SK_REG(sky2->port, RSS_CFG), HASH_ALL);
+        }
+
+        /* Program RSS initial values */
+        if (dev->features & NETIF_F_RXHASH) {
+                u32 key[nkeys];
+
+                get_random_bytes(key, nkeys * sizeof(u32));
+                for (i = 0; i < nkeys; i++)
+                        sky2_write32(hw, SK_REG(sky2->port, RSS_KEY + i * 4),
+                                     key[i]);
+
+                /* Need to turn on (undocumented) flag to make hashing work  */
+                sky2_write32(hw, SK_REG(sky2->port, RX_GMF_CTRL_T),
+                             RX_STFW_ENA);
+
+                sky2_write32(hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+                             BMU_ENA_RX_RSS_HASH);
+        } else
+                sky2_write32(hw, Q_ADDR(rxqaddr[sky2->port], Q_CSR),
+                             BMU_DIS_RX_RSS_HASH);
+}
+
 /*
  * The RX Stop command will not work for Yukon-2 if the BMU does not
  * reach the end of packet and since we can't make sure that we have
@@ -1428,6 +1458,9 @@ static void sky2_rx_start(struct sky2_port *sky2)
         if (!(hw->flags & SKY2_HW_NEW_LE))
                 rx_set_checksum(sky2);
 
+        if (!(hw->flags & SKY2_HW_RSS_BROKEN))
+                rx_set_rss(sky2->netdev);
+
         /* submit Rx ring */
         for (i = 0; i < sky2->rx_pending; i++) {
                 re = sky2->rx_ring + i;
@@ -1662,12 +1695,12 @@ static unsigned tx_le_req(const struct sk_buff *skb)
 static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
 {
         if (re->flags & TX_MAP_SINGLE)
-                pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
-                                 pci_unmap_len(re, maplen),
+                pci_unmap_single(pdev, dma_unmap_addr(re, mapaddr),
+                                 dma_unmap_len(re, maplen),
                                  PCI_DMA_TODEVICE);
         else if (re->flags & TX_MAP_PAGE)
-                pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
-                               pci_unmap_len(re, maplen),
+                pci_unmap_page(pdev, dma_unmap_addr(re, mapaddr),
+                               dma_unmap_len(re, maplen),
                                PCI_DMA_TODEVICE);
         re->flags = 0;
 }
@@ -1778,8 +1811,8 @@ static netdev_tx_t sky2_xmit_frame(struct sk_buff *skb,
 
         re = sky2->tx_ring + slot;
         re->flags = TX_MAP_SINGLE;
-        pci_unmap_addr_set(re, mapaddr, mapping);
-        pci_unmap_len_set(re, maplen, len);
+        dma_unmap_addr_set(re, mapaddr, mapping);
+        dma_unmap_len_set(re, maplen, len);
 
         le = get_tx_le(sky2, &slot);
         le->addr = cpu_to_le32(lower_32_bits(mapping));
@@ -1807,8 +1840,8 @@ static netdev_tx_t sky2_xmit_frame(struct sk_buff *skb,
 
                 re = sky2->tx_ring + slot;
                 re->flags = TX_MAP_PAGE;
-                pci_unmap_addr_set(re, mapaddr, mapping);
-                pci_unmap_len_set(re, maplen, frag->size);
+                dma_unmap_addr_set(re, mapaddr, mapping);
+                dma_unmap_len_set(re, maplen, frag->size);
 
                 le = get_tx_le(sky2, &slot);
                 le->addr = cpu_to_le32(lower_32_bits(mapping));
@@ -2537,6 +2570,14 @@ static void sky2_rx_checksum(struct sky2_port *sky2, u32 status)
         }
 }
 
+static void sky2_rx_hash(struct sky2_port *sky2, u32 status)
+{
+        struct sk_buff *skb;
+
+        skb = sky2->rx_ring[sky2->rx_next].skb;
+        skb->rxhash = le32_to_cpu(status);
+}
+
 /* Process status response ring */
 static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
 {
@@ -2558,7 +2599,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                 if (!(opcode & HW_OWNER))
                         break;
 
-                hw->st_idx = RING_NEXT(hw->st_idx, STATUS_RING_SIZE);
+                hw->st_idx = RING_NEXT(hw->st_idx, hw->st_size);
 
                 port = le->css & CSS_LINK_BIT;
                 dev = hw->dev[port];
@@ -2609,6 +2650,10 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                                 sky2_rx_checksum(sky2, status);
                         break;
 
+                case OP_RSS_HASH:
+                        sky2_rx_hash(sky2, status);
+                        break;
+
                 case OP_TXINDEXLE:
                         /* TX index reports status for both ports */
                         sky2_tx_done(hw->dev[0], status & 0xfff);
@@ -2963,6 +3008,8 @@ static int __devinit sky2_init(struct sky2_hw *hw)
         switch(hw->chip_id) {
         case CHIP_ID_YUKON_XL:
                 hw->flags = SKY2_HW_GIGABIT | SKY2_HW_NEWER_PHY;
+                if (hw->chip_rev < CHIP_REV_YU_XL_A2)
+                        hw->flags |= SKY2_HW_RSS_BROKEN;
                 break;
 
         case CHIP_ID_YUKON_EC_U:
@@ -2988,10 +3035,11 @@ static int __devinit sky2_init(struct sky2_hw *hw)
                         dev_err(&hw->pdev->dev, "unsupported revision Yukon-EC rev A1\n");
                         return -EOPNOTSUPP;
                 }
-                hw->flags = SKY2_HW_GIGABIT;
+                hw->flags = SKY2_HW_GIGABIT | SKY2_HW_RSS_BROKEN;
                 break;
 
         case CHIP_ID_YUKON_FE:
+                hw->flags = SKY2_HW_RSS_BROKEN;
                 break;
 
         case CHIP_ID_YUKON_FE_P:
@@ -3198,7 +3246,7 @@ static void sky2_reset(struct sky2_hw *hw)
         for (i = 0; i < hw->ports; i++)
                 sky2_gmac_reset(hw, i);
 
-        memset(hw->st_le, 0, STATUS_LE_BYTES);
+        memset(hw->st_le, 0, hw->st_size * sizeof(struct sky2_status_le));
         hw->st_idx = 0;
 
         sky2_write32(hw, STAT_CTRL, SC_STAT_RST_SET);
@@ -3208,7 +3256,7 @@ static void sky2_reset(struct sky2_hw *hw)
         sky2_write32(hw, STAT_LIST_ADDR_HI, (u64) hw->st_dma >> 32);
 
         /* Set the list last index */
-        sky2_write16(hw, STAT_LAST_IDX, STATUS_RING_SIZE - 1);
+        sky2_write16(hw, STAT_LAST_IDX, hw->st_size - 1);
 
         sky2_write16(hw, STAT_TX_IDX_TH, 10);
         sky2_write8(hw, STAT_FIFO_WM, 16);
@@ -4115,6 +4163,25 @@ static int sky2_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom
         return sky2_vpd_write(sky2->hw, cap, data, eeprom->offset, eeprom->len);
 }
 
+static int sky2_set_flags(struct net_device *dev, u32 data)
+{
+        struct sky2_port *sky2 = netdev_priv(dev);
+
+        if (data & ~ETH_FLAG_RXHASH)
+                return -EOPNOTSUPP;
+
+        if (data & ETH_FLAG_RXHASH) {
+                if (sky2->hw->flags & SKY2_HW_RSS_BROKEN)
+                        return -EINVAL;
+
+                dev->features |= NETIF_F_RXHASH;
+        } else
+                dev->features &= ~NETIF_F_RXHASH;
+
+        rx_set_rss(dev);
+
+        return 0;
+}
 
 static const struct ethtool_ops sky2_ethtool_ops = {
         .get_settings   = sky2_get_settings,
@@ -4146,6 +4213,7 @@ static const struct ethtool_ops sky2_ethtool_ops = {
         .phys_id        = sky2_phys_id,
         .get_sset_count = sky2_get_sset_count,
         .get_ethtool_stats = sky2_get_ethtool_stats,
+        .set_flags      = sky2_set_flags,
 };
 
 #ifdef CONFIG_SKY2_DEBUG
@@ -4256,12 +4324,13 @@ static int sky2_debug_show(struct seq_file *seq, void *v)
         napi_disable(&hw->napi);
         last = sky2_read16(hw, STAT_PUT_IDX);
 
+        seq_printf(seq, "Status ring %u\n", hw->st_size);
         if (hw->st_idx == last)
                 seq_puts(seq, "Status ring (empty)\n");
         else {
                 seq_puts(seq, "Status ring\n");
-                for (idx = hw->st_idx; idx != last && idx < STATUS_RING_SIZE;
-                     idx = RING_NEXT(idx, STATUS_RING_SIZE)) {
+                for (idx = hw->st_idx; idx != last && idx < hw->st_size;
+                     idx = RING_NEXT(idx, hw->st_size)) {
                         const struct sky2_status_le *le = hw->st_le + idx;
                         seq_printf(seq, "[%d] %#x %d %#x\n",
                                    idx, le->opcode, le->length, le->status);
@@ -4498,6 +4567,10 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
         if (highmem)
                 dev->features |= NETIF_F_HIGHDMA;
 
+        /* Enable receive hashing unless hardware is known broken */
+        if (!(hw->flags & SKY2_HW_RSS_BROKEN))
+                dev->features |= NETIF_F_RXHASH;
+
 #ifdef SKY2_VLAN_TAG_USED
         /* The workaround for FE+ status conflicts with VLAN tag detection. */
         if (!(sky2->hw->chip_id == CHIP_ID_YUKON_FE_P &&
@@ -4689,15 +4762,17 @@ static int __devinit sky2_probe(struct pci_dev *pdev,
                 goto err_out_free_hw;
         }
 
-        /* ring for status responses */
-        hw->st_le = pci_alloc_consistent(pdev, STATUS_LE_BYTES, &hw->st_dma);
-        if (!hw->st_le)
-                goto err_out_iounmap;
-
         err = sky2_init(hw);
         if (err)
                 goto err_out_iounmap;
 
+        /* ring for status responses */
+        hw->st_size = hw->ports * roundup_pow_of_two(3*RX_MAX_PENDING + TX_MAX_PENDING);
+        hw->st_le = pci_alloc_consistent(pdev, hw->st_size * sizeof(struct sky2_status_le),
+                                         &hw->st_dma);
+        if (!hw->st_le)
+                goto err_out_reset;
+
         dev_info(&pdev->dev, "Yukon-2 %s chip revision %d\n",
                  sky2_name(hw->chip_id, buf1, sizeof(buf1)), hw->chip_rev);
 
@@ -4771,8 +4846,10 @@ err_out_unregister:
 err_out_free_netdev:
         free_netdev(dev);
 err_out_free_pci:
+        pci_free_consistent(pdev, hw->st_size * sizeof(struct sky2_status_le),
+                            hw->st_le, hw->st_dma);
+err_out_reset:
         sky2_write8(hw, B0_CTST, CS_RST_SET);
-        pci_free_consistent(pdev, STATUS_LE_BYTES, hw->st_le, hw->st_dma);
 err_out_iounmap:
         iounmap(hw->regs);
 err_out_free_hw:
@@ -4810,7 +4887,8 @@ static void __devexit sky2_remove(struct pci_dev *pdev)
         free_irq(pdev->irq, hw);
         if (hw->flags & SKY2_HW_USE_MSI)
                 pci_disable_msi(pdev);
-        pci_free_consistent(pdev, STATUS_LE_BYTES, hw->st_le, hw->st_dma);
+        pci_free_consistent(pdev, hw->st_size * sizeof(struct sky2_status_le),
+                            hw->st_le, hw->st_dma);
         pci_release_regions(pdev);
         pci_disable_device(pdev);
 
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 0bebfb3638f6..084eff21b67a 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -694,8 +694,21 @@ enum {
         TXA_CTRL        = 0x0210,/*  8 bit      Tx Arbiter Control Register */
         TXA_TEST        = 0x0211,/*  8 bit      Tx Arbiter Test Register */
         TXA_STAT        = 0x0212,/*  8 bit      Tx Arbiter Status Register */
+
+        RSS_KEY         = 0x0220, /* RSS Key setup */
+        RSS_CFG         = 0x0248, /* RSS Configuration */
 };
 
+enum {
+        HASH_TCP_IPV6_EX_CTRL   = 1<<5,
+        HASH_IPV6_EX_CTRL       = 1<<4,
+        HASH_TCP_IPV6_CTRL      = 1<<3,
+        HASH_IPV6_CTRL          = 1<<2,
+        HASH_TCP_IPV4_CTRL      = 1<<1,
+        HASH_IPV4_CTRL          = 1<<0,
+
+        HASH_ALL                = 0x3f,
+};
 
 enum {
         B6_EXT_REG      = 0x0300,/* External registers (GENESIS only) */
@@ -2169,14 +2182,14 @@ struct tx_ring_info {
         unsigned long flags;
 #define TX_MAP_SINGLE   0x0001
 #define TX_MAP_PAGE     0x0002
-        DECLARE_PCI_UNMAP_ADDR(mapaddr);
-        DECLARE_PCI_UNMAP_LEN(maplen);
+        DEFINE_DMA_UNMAP_ADDR(mapaddr);
+        DEFINE_DMA_UNMAP_LEN(maplen);
 };
 
 struct rx_ring_info {
         struct sk_buff  *skb;
         dma_addr_t      data_addr;
-        DECLARE_PCI_UNMAP_LEN(data_size);
+        DEFINE_DMA_UNMAP_LEN(data_size);
         dma_addr_t      frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
 };
 
@@ -2261,6 +2274,7 @@ struct sky2_hw {
 #define SKY2_HW_NEW_LE          0x00000020      /* new LSOv2 format */
 #define SKY2_HW_AUTO_TX_SUM     0x00000040      /* new IP decode for Tx */
 #define SKY2_HW_ADV_POWER_CTL   0x00000080      /* additional PHY power regs */
+#define SKY2_HW_RSS_BROKEN      0x00000100
 
         u8                   chip_id;
         u8                   chip_rev;
@@ -2268,6 +2282,7 @@ struct sky2_hw {
         u8                   ports;
 
         struct sky2_status_le *st_le;
+        u32                  st_size;
         u32                  st_idx;
         dma_addr_t           st_dma;
 
diff --git a/drivers/net/smc9194.c b/drivers/net/smc9194.c
index e94521cf70a1..d76c8154f52b 100644
--- a/drivers/net/smc9194.c
+++ b/drivers/net/smc9194.c
@@ -1042,9 +1042,6 @@ static int __init smc_probe(struct net_device *dev, int ioaddr)
         */
         printk("ADDR: %pM\n", dev->dev_addr);
 
-        /* set the private data to zero by default */
-        memset(netdev_priv(dev), 0, sizeof(struct smc_local));
-
         /* Grab the IRQ */
         retval = request_irq(dev->irq, smc_interrupt, 0, DRV_NAME, dev);
         if (retval) {
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 20deb14e98ff..982ff12764a3 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -3004,7 +3004,6 @@ static int __devinit happy_meal_pci_probe(struct pci_dev *pdev,
         dev->base_addr = (long) pdev;
 
         hp = netdev_priv(dev);
-        memset(hp, 0, sizeof(*hp));
 
         hp->happy_dev = pdev;
         hp->dma_dev = &pdev->dev;
diff --git a/drivers/net/tehuti.c b/drivers/net/tehuti.c
index e29f495c6a2b..20ab16192325 100644
--- a/drivers/net/tehuti.c
+++ b/drivers/net/tehuti.c
@@ -2033,7 +2033,6 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         /************** priv ****************/
                 priv = nic->priv[port] = netdev_priv(ndev);
 
-                memset(priv, 0, sizeof(struct bdx_priv));
                 priv->pBdxRegs = nic->regs + port * 0x8000;
                 priv->port = port;
                 priv->pdev = pdev;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 0fea6854c4aa..573054ae7b58 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8700,6 +8700,7 @@ static int tg3_test_msi(struct tg3 *tp)
         pci_disable_msi(tp->pdev);
 
         tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
+        tp->napi[0].irq_vec = tp->pdev->irq;
 
         err = tg3_request_irq(tp, 0);
         if (err)
@@ -12993,6 +12994,7 @@ static int __devinit tg3_get_invariants(struct tg3 *tp)
                 tp->dev->features |= NETIF_F_IP_CSUM | NETIF_F_SG;
                 if (tp->tg3_flags3 & TG3_FLG3_5755_PLUS)
                         tp->dev->features |= NETIF_F_IPV6_CSUM;
+                tp->dev->features |= NETIF_F_GRO;
         }
 
         /* Determine TSO capabilities */
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 43265207d463..6b150c072a41 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -109,6 +109,9 @@ struct tun_struct {
 
         struct tap_filter       txflt;
         struct socket           socket;
+        struct socket_wq        wq;
+
+        int                     vnet_hdr_sz;
 
 #ifdef TUN_DEBUG
         int debug;
@@ -323,7 +326,7 @@ static void tun_net_uninit(struct net_device *dev)
         /* Inform the methods they need to stop using the dev.
          */
         if (tfile) {
-                wake_up_all(&tun->socket.wait);
+                wake_up_all(&tun->wq.wait);
                 if (atomic_dec_and_test(&tfile->count))
                         __tun_detach(tun);
         }
@@ -398,7 +401,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Notify and wake up reader process */
         if (tun->flags & TUN_FASYNC)
                 kill_fasync(&tun->fasync, SIGIO, POLL_IN);
-        wake_up_interruptible_poll(&tun->socket.wait, POLLIN |
+        wake_up_interruptible_poll(&tun->wq.wait, POLLIN |
                                    POLLRDNORM | POLLRDBAND);
         return NETDEV_TX_OK;
 
@@ -498,7 +501,7 @@ static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
 
         DBG(KERN_INFO "%s: tun_chr_poll\n", tun->dev->name);
 
-        poll_wait(file, &tun->socket.wait, wait);
+        poll_wait(file, &tun->wq.wait, wait);
 
         if (!skb_queue_empty(&sk->sk_receive_queue))
                 mask |= POLLIN | POLLRDNORM;
@@ -563,7 +566,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
         }
 
         if (tun->flags & TUN_VNET_HDR) {
-                if ((len -= sizeof(gso)) > count)
+                if ((len -= tun->vnet_hdr_sz) > count)
                         return -EINVAL;
 
                 if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
@@ -575,7 +578,7 @@ static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
 
                 if (gso.hdr_len > len)
                         return -EINVAL;
-                offset += sizeof(gso);
+                offset += tun->vnet_hdr_sz;
         }
 
         if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
@@ -718,7 +721,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
 
         if (tun->flags & TUN_VNET_HDR) {
                 struct virtio_net_hdr gso = { 0 }; /* no info leak */
-                if ((len -= sizeof(gso)) < 0)
+                if ((len -= tun->vnet_hdr_sz) < 0)
                         return -EINVAL;
 
                 if (skb_is_gso(skb)) {
@@ -749,7 +752,7 @@ static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
                 if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
                                                sizeof(gso))))
                         return -EFAULT;
-                total += sizeof(gso);
+                total += tun->vnet_hdr_sz;
         }
 
         len = min_t(int, skb->len, len);
@@ -773,7 +776,7 @@ static ssize_t tun_do_read(struct tun_struct *tun,
 
         DBG(KERN_INFO "%s: tun_chr_read\n", tun->dev->name);
 
-        add_wait_queue(&tun->socket.wait, &wait);
+        add_wait_queue(&tun->wq.wait, &wait);
         while (len) {
                 current->state = TASK_INTERRUPTIBLE;
 
@@ -804,7 +807,7 @@ static ssize_t tun_do_read(struct tun_struct *tun,
         }
 
         current->state = TASK_RUNNING;
-        remove_wait_queue(&tun->socket.wait, &wait);
+        remove_wait_queue(&tun->wq.wait, &wait);
 
         return ret;
 }
@@ -861,6 +864,7 @@ static struct rtnl_link_ops tun_link_ops __read_mostly = {
 static void tun_sock_write_space(struct sock *sk)
 {
         struct tun_struct *tun;
+        wait_queue_head_t *wqueue;
 
         if (!sock_writeable(sk))
                 return;
@@ -868,8 +872,9 @@ static void tun_sock_write_space(struct sock *sk)
         if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
                 return;
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT |
+        wqueue = sk_sleep(sk);
+        if (wqueue && waitqueue_active(wqueue))
+                wake_up_interruptible_sync_poll(wqueue, POLLOUT |
                                                 POLLWRNORM | POLLWRBAND);
 
         tun = tun_sk(sk)->tun;
@@ -1033,13 +1038,15 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                 tun->dev = dev;
                 tun->flags = flags;
                 tun->txflt.count = 0;
+                tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
 
                 err = -ENOMEM;
                 sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
                 if (!sk)
                         goto err_free_dev;
 
-                init_waitqueue_head(&tun->socket.wait);
+                tun->socket.wq = &tun->wq;
+                init_waitqueue_head(&tun->wq.wait);
                 tun->socket.ops = &tun_socket_ops;
                 sock_init_data(&tun->socket, sk);
                 sk->sk_write_space = tun_sock_write_space;
@@ -1174,6 +1181,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
         struct sock_fprog fprog;
         struct ifreq ifr;
         int sndbuf;
+        int vnet_hdr_sz;
         int ret;
 
         if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
@@ -1319,6 +1327,25 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 tun->socket.sk->sk_sndbuf = sndbuf;
                 break;
 
+        case TUNGETVNETHDRSZ:
+                vnet_hdr_sz = tun->vnet_hdr_sz;
+                if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
+                        ret = -EFAULT;
+                break;
+
+        case TUNSETVNETHDRSZ:
+                if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
+                        ret = -EFAULT;
+                        break;
+                }
+                if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
+                tun->vnet_hdr_sz = vnet_hdr_sz;
+                break;
+
         case TUNATTACHFILTER:
                 /* Can be set only for TAPs */
                 ret = -EINVAL;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,25 @@ config USB_CDC_PHONET
           cellular modem, as found on most Nokia handsets with the
           "PC suite" USB profile.
 
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
+
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,6 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c8cdb7f30adc..b3fe0de40469 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -64,6 +64,11 @@ static int is_wireless_rndis(struct usb_interface_descriptor *desc)
 
 #endif
 
+static const u8 mbm_guid[16] = {
+        0xa3, 0x17, 0xa8, 0x8b, 0x04, 0x5e, 0x4f, 0x01,
+        0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
+};
+
 /*
  * probes control interface, claims data interface, collects the bulk
  * endpoints, activates data interface (if needed), maybe sets MTU.
@@ -79,6 +84,8 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
         int                             status;
         int                             rndis;
         struct usb_driver               *driver = driver_of(intf);
+        struct usb_cdc_mdlm_desc        *desc = NULL;
+        struct usb_cdc_mdlm_detail_desc *detail = NULL;
 
         if (sizeof dev->data < sizeof *info)
                 return -EDOM;
@@ -229,6 +236,34 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
                          * side link address we were given.
                          */
                         break;
+                case USB_CDC_MDLM_TYPE:
+                        if (desc) {
+                                dev_dbg(&intf->dev, "extra MDLM descriptor\n");
+                                goto bad_desc;
+                        }
+
+                        desc = (void *)buf;
+
+                        if (desc->bLength != sizeof(*desc))
+                                goto bad_desc;
+
+                        if (memcmp(&desc->bGUID, mbm_guid, 16))
+                                goto bad_desc;
+                        break;
+                case USB_CDC_MDLM_DETAIL_TYPE:
+                        if (detail) {
+                                dev_dbg(&intf->dev, "extra MDLM detail descriptor\n");
+                                goto bad_desc;
+                        }
+
+                        detail = (void *)buf;
+
+                        if (detail->bGuidDescriptorType == 0) {
+                                if (detail->bLength < (sizeof(*detail) + 1))
+                                        goto bad_desc;
+                        } else
+                                goto bad_desc;
+                        break;
                 }
 next_desc:
                 len -= buf [0]; /* bLength */
@@ -431,6 +466,7 @@ static const struct driver_info mbm_info = {
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
         .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 
 /*-------------------------------------------------------------------------*/
@@ -542,80 +578,10 @@ static const struct usb_device_id	products [] = {
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
 }, {
-        /* Ericsson F3507g */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1900, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3507g ver. 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1902, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3607gw */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1904, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3607gw ver 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1905, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3607gw ver 3 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1906, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3307 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190a, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson F3307 ver 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1909, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson C3607w */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x1049, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Ericsson C3607w ver 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190b, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Toshiba F3507g */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Toshiba F3607gw */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130c, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Toshiba F3607gw ver 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x1311, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Dell F3507g */
-        USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8147, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Dell F3607gw */
-        USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8183, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
-}, {
-        /* Dell F3607gw ver 2 */
-        USB_DEVICE_AND_INTERFACE_INFO(0x413c, 0x8184, USB_CLASS_COMM,
-                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
-        .driver_info = (unsigned long) &mbm_info,
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
+                        USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&mbm_info,
+
 },
         { },            // END
 };
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 291add255246..47634b617107 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                 goto out;
 
         dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
 
         for (i = 0; i < DM_TIMEOUT; i++) {
                 u8 tmp;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..418825d26f90
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,569 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error_nomem;
+
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto free_tx_urb;
+
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto free_rx_urb;
+
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto free_tx_buf;
+
+
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+
+free_tx_buf:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+free_rx_urb:
+        usb_free_urb(rx_urb);
+free_tx_urb:
+        usb_free_urb(tx_urb);
+error_nomem:
+        return -ENOMEM;
+}
+
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+
+        return retval;
+}
+
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+
+        return NETDEV_TX_OK;
+}
+
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+
+        usb_set_intfdata(intf, dev);
+
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+
+static int __init ipheth_init(void)
+{
+        int retval;
+
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
         { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
         { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
         { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
         { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
         { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
         { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..f1942d69a0d5
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1004 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+
+/* Private data structure */
+struct sierra_net_data {
+
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+
+        u8 ifnum;       /* interface number */
+
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+
+        return 1;
+}
+
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+
+        return 0;
+}
+
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+
+        return status;
+}
+
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+
+        return status;
+}
+
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+
+        /* Set link_sense true */
+        return 1;
+}
+
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        if (urb->actual_length < sizeof *event)
+                return;
+
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+
+        return usbnet_change_mtu(net, new_mtu);
+}
+
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+
+        *datap = *attrdata;
+
+        kfree(attrdata);
+        return result;
+}
+
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+
+        sierra_net_set_private(dev, priv);
+
+        priv->kevent_flags = 0;
+
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+
+        return 0;
+}
+
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+
+        flush_scheduled_work();
+
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+
+        sierra_net_set_private(dev, NULL);
+
+        kfree(priv);
+}
+
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+
+        return new_skb;
+}
+
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+
+                skb_pull(skb, hh.hdrlen);
+
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+
+        } /* while */
+
+        return 0;
+}
+
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+
+        /* tx_dropped incremented by usbnet */
+
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+
+        return usb_register(&sierra_net_driver);
+}
+
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wan/cycx_x25.c b/drivers/net/wan/cycx_x25.c
index cd8cb95c5bd7..cf9e15fd8d91 100644
--- a/drivers/net/wan/cycx_x25.c
+++ b/drivers/net/wan/cycx_x25.c
@@ -634,11 +634,12 @@ static netdev_tx_t cycx_netdevice_hard_start_xmit(struct sk_buff *skb,
         }
         } else { /* chan->protocol == ETH_P_X25 */
                 switch (skb->data[0]) {
-                case 0: break;
-                case 1: /* Connect request */
+                case X25_IFACE_DATA:
+                        break;
+                case X25_IFACE_CONNECT:
                         cycx_x25_chan_connect(dev);
                         goto free_packet;
-                case 2: /* Disconnect request */
+                case X25_IFACE_DISCONNECT:
                         cycx_x25_chan_disconnect(dev);
                         goto free_packet;
                 default:
@@ -1406,7 +1407,8 @@ static void cycx_x25_set_chan_state(struct net_device *dev, u8 state)
                         reset_timer(dev);
 
                         if (chan->protocol == ETH_P_X25)
-                                cycx_x25_chan_send_event(dev, 1);
+                                cycx_x25_chan_send_event(dev,
+                                        X25_IFACE_CONNECT);
 
                         break;
                 case WAN_CONNECTING:
@@ -1424,7 +1426,8 @@ static void cycx_x25_set_chan_state(struct net_device *dev, u8 state)
                         }
 
                         if (chan->protocol == ETH_P_X25)
-                                cycx_x25_chan_send_event(dev, 2);
+                                cycx_x25_chan_send_event(dev,
+                                        X25_IFACE_DISCONNECT);
 
                         netif_wake_queue(dev);
                         break;
diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
index b9b9d6b01c0b..941f053e650e 100644
--- a/drivers/net/wan/hdlc_ppp.c
+++ b/drivers/net/wan/hdlc_ppp.c
@@ -628,9 +628,15 @@ static void ppp_stop(struct net_device *dev)
         ppp_cp_event(dev, PID_LCP, STOP, 0, 0, 0, NULL);
 }
 
+static void ppp_close(struct net_device *dev)
+{
+        ppp_tx_flush();
+}
+
 static struct hdlc_proto proto = {
         .start          = ppp_start,
         .stop           = ppp_stop,
+        .close          = ppp_close,
         .type_trans     = ppp_type_trans,
         .ioctl          = ppp_ioctl,
         .netif_rx       = ppp_rx,
diff --git a/drivers/net/wan/hdlc_x25.c b/drivers/net/wan/hdlc_x25.c
index c7adbb79f7cc..70527e5a54a2 100644
--- a/drivers/net/wan/hdlc_x25.c
+++ b/drivers/net/wan/hdlc_x25.c
@@ -49,14 +49,14 @@ static void x25_connect_disconnect(struct net_device *dev, int reason, int code)
 
 static void x25_connected(struct net_device *dev, int reason)
 {
-        x25_connect_disconnect(dev, reason, 1);
+        x25_connect_disconnect(dev, reason, X25_IFACE_CONNECT);
 }
 
 
 
 static void x25_disconnected(struct net_device *dev, int reason)
 {
-        x25_connect_disconnect(dev, reason, 2);
+        x25_connect_disconnect(dev, reason, X25_IFACE_DISCONNECT);
 }
 
 
@@ -71,7 +71,7 @@ static int x25_data_indication(struct net_device *dev, struct sk_buff *skb)
                 return NET_RX_DROP;
 
         ptr  = skb->data;
-        *ptr = 0;
+        *ptr = X25_IFACE_DATA;
 
         skb->protocol = x25_type_trans(skb, dev);
         return netif_rx(skb);
@@ -94,13 +94,13 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
 
         /* X.25 to LAPB */
         switch (skb->data[0]) {
-        case 0:         /* Data to be transmitted */
+        case X25_IFACE_DATA:    /* Data to be transmitted */
                 skb_pull(skb, 1);
                 if ((result = lapb_data_request(dev, skb)) != LAPB_OK)
                         dev_kfree_skb(skb);
                 return NETDEV_TX_OK;
 
-        case 1:
+        case X25_IFACE_CONNECT:
                 if ((result = lapb_connect_request(dev))!= LAPB_OK) {
                         if (result == LAPB_CONNECTED)
                                 /* Send connect confirm. msg to level 3 */
@@ -112,7 +112,7 @@ static netdev_tx_t x25_xmit(struct sk_buff *skb, struct net_device *dev)
                 }
                 break;
 
-        case 2:
+        case X25_IFACE_DISCONNECT:
                 if ((result = lapb_disconnect_request(dev)) != LAPB_OK) {
                         if (result == LAPB_NOTCONNECTED)
                                 /* Send disconnect confirm. msg to level 3 */
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index 98e2f99903d7..4d4dc38c7290 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -139,7 +139,7 @@ static int lapbeth_data_indication(struct net_device *dev, struct sk_buff *skb)
                 return NET_RX_DROP;
 
         ptr  = skb->data;
-        *ptr = 0x00;
+        *ptr = X25_IFACE_DATA;
 
         skb->protocol = x25_type_trans(skb, dev);
         return netif_rx(skb);
@@ -161,14 +161,14 @@ static netdev_tx_t lapbeth_xmit(struct sk_buff *skb,
                 goto drop;
 
         switch (skb->data[0]) {
-        case 0x00:
+        case X25_IFACE_DATA:
                 break;
-        case 0x01:
+        case X25_IFACE_CONNECT:
                 if ((err = lapb_connect_request(dev)) != LAPB_OK)
                         printk(KERN_ERR "lapbeth: lapb_connect_request "
                                "error: %d\n", err);
                 goto drop;
-        case 0x02:
+        case X25_IFACE_DISCONNECT:
                 if ((err = lapb_disconnect_request(dev)) != LAPB_OK)
                         printk(KERN_ERR "lapbeth: lapb_disconnect_request "
                                "err: %d\n", err);
@@ -225,7 +225,7 @@ static void lapbeth_connected(struct net_device *dev, int reason)
         }
 
         ptr  = skb_put(skb, 1);
-        *ptr = 0x01;
+        *ptr = X25_IFACE_CONNECT;
 
         skb->protocol = x25_type_trans(skb, dev);
         netif_rx(skb);
@@ -242,7 +242,7 @@ static void lapbeth_disconnected(struct net_device *dev, int reason)
         }
 
         ptr  = skb_put(skb, 1);
-        *ptr = 0x02;
+        *ptr = X25_IFACE_DISCONNECT;
 
         skb->protocol = x25_type_trans(skb, dev);
         netif_rx(skb);
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index 80d5c5834a0b..166e77dfffda 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -29,12 +29,12 @@
 #include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/if_arp.h>
-#include <linux/x25.h>
 #include <linux/lapb.h>
 #include <linux/init.h>
 #include <linux/rtnetlink.h>
 #include <linux/compat.h>
 #include <linux/slab.h>
+#include <net/x25device.h>
 #include "x25_asy.h"
 
 #include <net/x25device.h>
@@ -315,15 +315,15 @@ static netdev_tx_t x25_asy_xmit(struct sk_buff *skb,
         }
 
         switch (skb->data[0]) {
-        case 0x00:
+        case X25_IFACE_DATA:
                 break;
-        case 0x01: /* Connection request .. do nothing */
+        case X25_IFACE_CONNECT: /* Connection request .. do nothing */
                 err = lapb_connect_request(dev);
                 if (err != LAPB_OK)
                         printk(KERN_ERR "x25_asy: lapb_connect_request error - %d\n", err);
                 kfree_skb(skb);
                 return NETDEV_TX_OK;
-        case 0x02: /* Disconnect request .. do nothing - hang up ?? */
+        case X25_IFACE_DISCONNECT: /* do nothing - hang up ?? */
                 err = lapb_disconnect_request(dev);
                 if (err != LAPB_OK)
                         printk(KERN_ERR "x25_asy: lapb_disconnect_request error - %d\n", err);
@@ -411,7 +411,7 @@ static void x25_asy_connected(struct net_device *dev, int reason)
         }
 
         ptr  = skb_put(skb, 1);
-        *ptr = 0x01;
+        *ptr = X25_IFACE_CONNECT;
 
         skb->protocol = x25_type_trans(skb, sl->dev);
         netif_rx(skb);
@@ -430,7 +430,7 @@ static void x25_asy_disconnected(struct net_device *dev, int reason)
         }
 
         ptr  = skb_put(skb, 1);
-        *ptr = 0x02;
+        *ptr = X25_IFACE_DISCONNECT;
 
         skb->protocol = x25_type_trans(skb, sl->dev);
         netif_rx(skb);
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 588943660755..2fbe9b4506c0 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -38,6 +38,12 @@ config LIBERTAS_THINFIRM
         ---help---
           A library for Marvell Libertas 8xxx devices using thinfirm.
 
+config LIBERTAS_THINFIRM_DEBUG
+        bool "Enable full debugging output in the Libertas thin firmware module."
+        depends on LIBERTAS_THINFIRM
+        ---help---
+          Debugging support.
+
 config LIBERTAS_THINFIRM_USB
         tristate "Marvell Libertas 8388 USB 802.11b/g cards with thin firmware"
         depends on LIBERTAS_THINFIRM && USB
@@ -210,90 +216,7 @@ config USB_NET_RNDIS_WLAN
 
           If you choose to build a module, it'll be called rndis_wlan.
 
-config RTL8180
-        tristate "Realtek 8180/8185 PCI support"
-        depends on MAC80211 && PCI && EXPERIMENTAL
-        select EEPROM_93CX6
-        ---help---
-          This is a driver for RTL8180 and RTL8185 based cards.
-          These are PCI based chips found in cards such as:
-
-          (RTL8185 802.11g)
-          A-Link WL54PC
-
-          (RTL8180 802.11b)
-          Belkin F5D6020 v3
-          Belkin F5D6020 v3
-          Dlink DWL-610
-          Dlink DWL-510
-          Netgear MA521
-          Level-One WPC-0101
-          Acer Aspire 1357 LMi
-          VCTnet PC-11B1
-          Ovislink AirLive WL-1120PCM
-          Mentor WL-PCI
-          Linksys WPC11 v4
-          TrendNET TEW-288PI
-          D-Link DWL-520 Rev D
-          Repotec RP-WP7126
-          TP-Link TL-WN250/251
-          Zonet ZEW1000
-          Longshine LCS-8031-R
-          HomeLine HLW-PCC200
-          GigaFast WF721-AEX
-          Planet WL-3553
-          Encore ENLWI-PCI1-NT
-          TrendNET TEW-266PC
-          Gigabyte GN-WLMR101
-          Siemens-fujitsu Amilo D1840W
-          Edimax EW-7126
-          PheeNet WL-11PCIR
-          Tonze PC-2100T
-          Planet WL-8303
-          Dlink DWL-650 v M1
-          Edimax EW-7106
-          Q-Tec 770WC
-          Topcom Skyr@cer 4011b
-          Roper FreeLan 802.11b (edition 2004)
-          Wistron Neweb Corp CB-200B
-          Pentagram HorNET
-          QTec 775WC
-          TwinMOS Booming B Series
-          Micronet SP906BB
-          Sweex LC700010
-          Surecom EP-9428
-          Safecom SWLCR-1100
-
-          Thanks to Realtek for their support!
-
-config RTL8187
-        tristate "Realtek 8187 and 8187B USB support"
-        depends on MAC80211 && USB
-        select EEPROM_93CX6
-        ---help---
-          This is a driver for RTL8187 and RTL8187B based cards.
-          These are USB based chips found in devices such as:
-
-          Netgear WG111v2
-          Level 1 WNC-0301USB
-          Micronet SP907GK V5
-          Encore ENUWI-G2
-          Trendnet TEW-424UB
-          ASUS P5B Deluxe/P5K Premium motherboards
-          Toshiba Satellite Pro series of laptops
-          Asus Wireless Link
-          Linksys WUSB54GC-EU v2
-            (v1 = rt73usb; v3 is rt2070-based,
-             use staging/rt3070 or try rt2800usb)
-
-          Thanks to Realtek for their support!
-
-# If possible, automatically enable LEDs for RTL8187.
-
-config RTL8187_LEDS
-        bool
-        depends on RTL8187 && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = RTL8187)
-        default y
+source "drivers/net/wireless/rtl818x/Kconfig"
 
 config ADM8211
         tristate "ADMtek ADM8211 support"
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 0fb419936dff..7a626d4e100f 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1889,6 +1889,7 @@ static void at76_dwork_hw_scan(struct work_struct *work)
 }
 
 static int at76_hw_scan(struct ieee80211_hw *hw,
+                        struct ieee80211_vif *vif,
                         struct cfg80211_scan_request *req)
 {
         struct at76_priv *priv = hw->priv;
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 0312cee39570..2e9b330f6413 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -927,7 +927,6 @@ static void ar9170_rx_phy_status(struct ar9170 *ar,
 
         /* TODO: we could do something with phy_errors */
         status->signal = ar->noise[0] + phy->rssi_combined;
-        status->noise = ar->noise[0];
 }
 
 static struct sk_buff *ar9170_rx_copy_data(u8 *buf, int len)
@@ -2548,8 +2547,7 @@ void *ar9170_alloc(size_t priv_size)
                                          BIT(NL80211_IFTYPE_ADHOC);
         ar->hw->flags |= IEEE80211_HW_RX_INCLUDES_FCS |
                          IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-                         IEEE80211_HW_SIGNAL_DBM |
-                         IEEE80211_HW_NOISE_DBM;
+                         IEEE80211_HW_SIGNAL_DBM;
 
         if (modparam_ht) {
                 ar->hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index 1fbf6b1f9a7e..d32f2828b098 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -71,9 +71,21 @@ struct ath_regulatory {
         struct reg_dmn_pair_mapping *regpair;
 };
 
+/**
+ * struct ath_ops - Register read/write operations
+ *
+ * @read: Register read
+ * @write: Register write
+ * @enable_write_buffer: Enable multiple register writes
+ * @disable_write_buffer: Disable multiple register writes
+ * @write_flush: Flush buffered register writes
+ */
 struct ath_ops {
         unsigned int (*read)(void *, u32 reg_offset);
-        void (*write)(void *, u32 val, u32 reg_offset);
+        void (*write)(void *, u32 val, u32 reg_offset);
+        void (*enable_write_buffer)(void *);
+        void (*disable_write_buffer)(void *);
+        void (*write_flush) (void *);
 };
 
 struct ath_common;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 93005f1d326d..7f5953fac434 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -242,6 +242,8 @@ static int ath5k_set_key(struct ieee80211_hw *hw,
                 struct ieee80211_key_conf *key);
 static int ath5k_get_stats(struct ieee80211_hw *hw,
                 struct ieee80211_low_level_stats *stats);
+static int ath5k_get_survey(struct ieee80211_hw *hw,
+                int idx, struct survey_info *survey);
 static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
 static void ath5k_set_tsf(struct ieee80211_hw *hw, u64 tsf);
 static void ath5k_reset_tsf(struct ieee80211_hw *hw);
@@ -267,6 +269,7 @@ static const struct ieee80211_ops ath5k_hw_ops = {
         .configure_filter = ath5k_configure_filter,
         .set_key        = ath5k_set_key,
         .get_stats      = ath5k_get_stats,
+        .get_survey     = ath5k_get_survey,
         .conf_tx        = NULL,
         .get_tsf        = ath5k_get_tsf,
         .set_tsf        = ath5k_set_tsf,
@@ -545,8 +548,7 @@ ath5k_pci_probe(struct pci_dev *pdev,
         SET_IEEE80211_DEV(hw, &pdev->dev);
         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
                     IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
-                    IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM;
+                    IEEE80211_HW_SIGNAL_DBM;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_AP) |
@@ -2027,8 +2029,7 @@ accept:
                 rxs->freq = sc->curchan->center_freq;
                 rxs->band = sc->curband->band;
 
-                rxs->noise = sc->ah->ah_noise_floor;
-                rxs->signal = rxs->noise + rs.rs_rssi;
+                rxs->signal = sc->ah->ah_noise_floor + rs.rs_rssi;
 
                 rxs->antenna = rs.rs_antenna;
 
@@ -3292,6 +3293,22 @@ ath5k_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
+static int ath5k_get_survey(struct ieee80211_hw *hw, int idx,
+                struct survey_info *survey)
+{
+        struct ath5k_softc *sc = hw->priv;
+        struct ieee80211_conf *conf = &hw->conf;
+
+         if (idx != 0)
+                return -ENOENT;
+
+        survey->channel = conf->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = sc->ah->ah_noise_floor;
+
+        return 0;
+}
+
 static u64
 ath5k_get_tsf(struct ieee80211_hw *hw)
 {
diff --git a/drivers/net/wireless/ath/ath5k/pcu.c b/drivers/net/wireless/ath/ath5k/pcu.c
index 174412fc81f8..5212e275f1c7 100644
--- a/drivers/net/wireless/ath/ath5k/pcu.c
+++ b/drivers/net/wireless/ath/ath5k/pcu.c
@@ -496,6 +496,8 @@ void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter)
 * Beacon control *
 \****************/
 
+#define ATH5K_MAX_TSF_READ 10
+
 /**
  * ath5k_hw_get_tsf64 - Get the full 64bit TSF
  *
@@ -505,10 +507,35 @@ void ath5k_hw_set_rx_filter(struct ath5k_hw *ah, u32 filter)
  */
 u64 ath5k_hw_get_tsf64(struct ath5k_hw *ah)
 {
-        u64 tsf = ath5k_hw_reg_read(ah, AR5K_TSF_U32);
+        u32 tsf_lower, tsf_upper1, tsf_upper2;
+        int i;
+
+        /*
+         * While reading TSF upper and then lower part, the clock is still
+         * counting (or jumping in case of IBSS merge) so we might get
+         * inconsistent values. To avoid this, we read the upper part again
+         * and check it has not been changed. We make the hypothesis that a
+         * maximum of 3 changes can happens in a row (we use 10 as a safe
+         * value).
+         *
+         * Impact on performance is pretty small, since in most cases, only
+         * 3 register reads are needed.
+         */
+
+        tsf_upper1 = ath5k_hw_reg_read(ah, AR5K_TSF_U32);
+        for (i = 0; i < ATH5K_MAX_TSF_READ; i++) {
+                tsf_lower = ath5k_hw_reg_read(ah, AR5K_TSF_L32);
+                tsf_upper2 = ath5k_hw_reg_read(ah, AR5K_TSF_U32);
+                if (tsf_upper2 == tsf_upper1)
+                        break;
+                tsf_upper1 = tsf_upper2;
+        }
+
+        WARN_ON( i == ATH5K_MAX_TSF_READ );
+
         ATH5K_TRACE(ah->ah_sc);
 
-        return ath5k_hw_reg_read(ah, AR5K_TSF_L32) | (tsf << 32);
+        return (((u64)tsf_upper1 << 32) | tsf_lower);
 }
 
 /**
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 97133beda269..dd112be218ab 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -13,16 +13,26 @@ ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
 
 obj-$(CONFIG_ATH9K) += ath9k.o
 
-ath9k_hw-y:=    hw.o \
+ath9k_hw-y:=    \
+                ar9002_hw.o \
+                ar9003_hw.o \
+                hw.o \
+                ar9003_phy.o \
+                ar9002_phy.o \
+                ar5008_phy.o \
+                ar9002_calib.o \
+                ar9003_calib.o \
+                calib.o \
                 eeprom.o \
                 eeprom_def.o \
                 eeprom_4k.o \
                 eeprom_9287.o \
-                calib.o \
                 ani.o \
-                phy.o \
                 btcoex.o \
                 mac.o \
+                ar9002_mac.o \
+                ar9003_mac.o \
+                ar9003_eeprom.o
 
 obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
 
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 2a0cd64c2bfb..ba8b20f01594 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "hw-ops.h"
 
 static int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
                                         struct ath9k_channel *chan)
@@ -37,190 +38,6 @@ static int ath9k_hw_get_ani_channel_idx(struct ath_hw *ah,
         return 0;
 }
 
-static bool ath9k_hw_ani_control(struct ath_hw *ah,
-                                 enum ath9k_ani_cmd cmd, int param)
-{
-        struct ar5416AniState *aniState = ah->curani;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        switch (cmd & ah->ani_function) {
-        case ATH9K_ANI_NOISE_IMMUNITY_LEVEL:{
-                u32 level = param;
-
-                if (level >= ARRAY_SIZE(ah->totalSizeDesired)) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
-                                  level,
-                                  (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
-                        return false;
-                }
-
-                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
-                              AR_PHY_DESIRED_SZ_TOT_DES,
-                              ah->totalSizeDesired[level]);
-                REG_RMW_FIELD(ah, AR_PHY_AGC_CTL1,
-                              AR_PHY_AGC_CTL1_COARSE_LOW,
-                              ah->coarse_low[level]);
-                REG_RMW_FIELD(ah, AR_PHY_AGC_CTL1,
-                              AR_PHY_AGC_CTL1_COARSE_HIGH,
-                              ah->coarse_high[level]);
-                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
-                              AR_PHY_FIND_SIG_FIRPWR,
-                              ah->firpwr[level]);
-
-                if (level > aniState->noiseImmunityLevel)
-                        ah->stats.ast_ani_niup++;
-                else if (level < aniState->noiseImmunityLevel)
-                        ah->stats.ast_ani_nidown++;
-                aniState->noiseImmunityLevel = level;
-                break;
-        }
-        case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
-                const int m1ThreshLow[] = { 127, 50 };
-                const int m2ThreshLow[] = { 127, 40 };
-                const int m1Thresh[] = { 127, 0x4d };
-                const int m2Thresh[] = { 127, 0x40 };
-                const int m2CountThr[] = { 31, 16 };
-                const int m2CountThrLow[] = { 63, 48 };
-                u32 on = param ? 1 : 0;
-
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
-                              AR_PHY_SFCORR_LOW_M1_THRESH_LOW,
-                              m1ThreshLow[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
-                              AR_PHY_SFCORR_LOW_M2_THRESH_LOW,
-                              m2ThreshLow[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M1_THRESH,
-                              m1Thresh[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M2_THRESH,
-                              m2Thresh[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
-                              AR_PHY_SFCORR_M2COUNT_THR,
-                              m2CountThr[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
-                              AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW,
-                              m2CountThrLow[on]);
-
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW,
-                              m1ThreshLow[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW,
-                              m2ThreshLow[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M1_THRESH,
-                              m1Thresh[on]);
-                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
-                              AR_PHY_SFCORR_EXT_M2_THRESH,
-                              m2Thresh[on]);
-
-                if (on)
-                        REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
-                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
-                else
-                        REG_CLR_BIT(ah, AR_PHY_SFCORR_LOW,
-                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
-
-                if (!on != aniState->ofdmWeakSigDetectOff) {
-                        if (on)
-                                ah->stats.ast_ani_ofdmon++;
-                        else
-                                ah->stats.ast_ani_ofdmoff++;
-                        aniState->ofdmWeakSigDetectOff = !on;
-                }
-                break;
-        }
-        case ATH9K_ANI_CCK_WEAK_SIGNAL_THR:{
-                const int weakSigThrCck[] = { 8, 6 };
-                u32 high = param ? 1 : 0;
-
-                REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT,
-                              AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK,
-                              weakSigThrCck[high]);
-                if (high != aniState->cckWeakSigThreshold) {
-                        if (high)
-                                ah->stats.ast_ani_cckhigh++;
-                        else
-                                ah->stats.ast_ani_ccklow++;
-                        aniState->cckWeakSigThreshold = high;
-                }
-                break;
-        }
-        case ATH9K_ANI_FIRSTEP_LEVEL:{
-                const int firstep[] = { 0, 4, 8 };
-                u32 level = param;
-
-                if (level >= ARRAY_SIZE(firstep)) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
-                                  level,
-                                  (unsigned) ARRAY_SIZE(firstep));
-                        return false;
-                }
-                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
-                              AR_PHY_FIND_SIG_FIRSTEP,
-                              firstep[level]);
-                if (level > aniState->firstepLevel)
-                        ah->stats.ast_ani_stepup++;
-                else if (level < aniState->firstepLevel)
-                        ah->stats.ast_ani_stepdown++;
-                aniState->firstepLevel = level;
-                break;
-        }
-        case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
-                const int cycpwrThr1[] =
-                        { 2, 4, 6, 8, 10, 12, 14, 16 };
-                u32 level = param;
-
-                if (level >= ARRAY_SIZE(cycpwrThr1)) {
-                        ath_print(common, ATH_DBG_ANI,
-                                  "level out of range (%u > %u)\n",
-                                  level,
-                                  (unsigned) ARRAY_SIZE(cycpwrThr1));
-                        return false;
-                }
-                REG_RMW_FIELD(ah, AR_PHY_TIMING5,
-                              AR_PHY_TIMING5_CYCPWR_THR1,
-                              cycpwrThr1[level]);
-                if (level > aniState->spurImmunityLevel)
-                        ah->stats.ast_ani_spurup++;
-                else if (level < aniState->spurImmunityLevel)
-                        ah->stats.ast_ani_spurdown++;
-                aniState->spurImmunityLevel = level;
-                break;
-        }
-        case ATH9K_ANI_PRESENT:
-                break;
-        default:
-                ath_print(common, ATH_DBG_ANI,
-                          "invalid cmd %u\n", cmd);
-                return false;
-        }
-
-        ath_print(common, ATH_DBG_ANI, "ANI parameters:\n");
-        ath_print(common, ATH_DBG_ANI,
-                  "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
-                  "ofdmWeakSigDetectOff=%d\n",
-                  aniState->noiseImmunityLevel,
-                  aniState->spurImmunityLevel,
-                  !aniState->ofdmWeakSigDetectOff);
-        ath_print(common, ATH_DBG_ANI,
-                  "cckWeakSigThreshold=%d, "
-                  "firstepLevel=%d, listenTime=%d\n",
-                  aniState->cckWeakSigThreshold,
-                  aniState->firstepLevel,
-                  aniState->listenTime);
-        ath_print(common, ATH_DBG_ANI,
-                "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
-                aniState->cycleCount,
-                aniState->ofdmPhyErrCount,
-                aniState->cckPhyErrCount);
-
-        return true;
-}
-
 static void ath9k_hw_update_mibstats(struct ath_hw *ah,
                                      struct ath9k_mib_stats *stats)
 {
@@ -262,11 +79,17 @@ static void ath9k_ani_restart(struct ath_hw *ah)
                   "Writing ofdmbase=%u   cckbase=%u\n",
                   aniState->ofdmPhyErrBase,
                   aniState->cckPhyErrBase);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_PHY_ERR_1, aniState->ofdmPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_2, aniState->cckPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
         aniState->ofdmPhyErrCount = 0;
@@ -540,8 +363,14 @@ void ath9k_ani_reset(struct ath_hw *ah)
         ath9k_hw_setrxfilter(ah, ath9k_hw_getrxfilter(ah) &
                              ~ATH9K_RX_FILTER_PHYERR);
         ath9k_ani_restart(ah);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 void ath9k_hw_ani_monitor(struct ath_hw *ah,
@@ -639,6 +468,8 @@ void ath9k_enable_mib_counters(struct ath_hw *ah)
 
         ath9k_hw_update_mibstats(ah, &ah->ah_mibStats);
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_FILT_OFDM, 0);
         REG_WRITE(ah, AR_FILT_CCK, 0);
         REG_WRITE(ah, AR_MIBC,
@@ -646,6 +477,9 @@ void ath9k_enable_mib_counters(struct ath_hw *ah)
                   & 0x0f);
         REG_WRITE(ah, AR_PHY_ERR_MASK_1, AR_PHY_ERR_OFDM_TIMING);
         REG_WRITE(ah, AR_PHY_ERR_MASK_2, AR_PHY_ERR_CCK_TIMING);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 /* Freeze the MIB counters, get the stats and then clear them */
@@ -809,20 +643,17 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
         ath_print(common, ATH_DBG_ANI, "Setting cckErrBase = 0x%08x\n",
                   ah->ani[0].cckPhyErrBase);
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_PHY_ERR_1, ah->ani[0].ofdmPhyErrBase);
         REG_WRITE(ah, AR_PHY_ERR_2, ah->ani[0].cckPhyErrBase);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         ath9k_enable_mib_counters(ah);
 
         ah->aniperiod = ATH9K_ANI_PERIOD;
         if (ah->config.enable_ani)
                 ah->proc_phyerr |= HAL_PROCESS_ANI;
 }
-
-void ath9k_hw_ani_disable(struct ath_hw *ah)
-{
-        ath_print(ath9k_hw_common(ah), ATH_DBG_ANI, "Disabling ANI\n");
-
-        ath9k_hw_disable_mib_counters(ah);
-        REG_WRITE(ah, AR_PHY_ERR_1, 0);
-        REG_WRITE(ah, AR_PHY_ERR_2, 0);
-}
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index 4e1ab94a5153..3356762ea384 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -118,6 +118,5 @@ u32 ath9k_hw_GetMibCycleCountsPct(struct ath_hw *ah, u32 *rxc_pcnt,
 void ath9k_hw_procmibevent(struct ath_hw *ah);
 void ath9k_hw_ani_setup(struct ath_hw *ah);
 void ath9k_hw_ani_init(struct ath_hw *ah);
-void ath9k_hw_ani_disable(struct ath_hw *ah);
 
 #endif /* ANI_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_initvals.h b/drivers/net/wireless/ath/ath9k/ar5008_initvals.h
new file mode 100644
index 000000000000..025c31ac6146
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar5008_initvals.h
@@ -0,0 +1,742 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_AR5008_H
+#define INITVALS_AR5008_H
+
+static const u32 ar5416Modes[][6] = {
+    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
+    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
+    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
+    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
+    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
+    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
+    { 0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810, 0x08f04810 },
+    { 0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a, 0x0000320a },
+    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
+    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
+    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
+    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
+    { 0x00009844, 0x1372161e, 0x1372161e, 0x137216a0, 0x137216a0, 0x137216a0 },
+    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x00009850, 0x6c48b4e0, 0x6d48b4e0, 0x6d48b0de, 0x6c48b0de, 0x6c48b0de },
+    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e },
+    { 0x0000985c, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e, 0x31395d5e },
+    { 0x00009860, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18 },
+    { 0x00009864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
+    { 0x00009868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190 },
+    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
+    { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
+    { 0x00009918, 0x000001b8, 0x00000370, 0x00000268, 0x00000134, 0x00000134 },
+    { 0x00009924, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b },
+    { 0x00009944, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020 },
+    { 0x00009960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
+    { 0x0000a960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
+    { 0x0000b960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
+    { 0x00009964, 0x00000000, 0x00000000, 0x00001120, 0x00001120, 0x00001120 },
+    { 0x000099bc, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00 },
+    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
+    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
+    { 0x000099c8, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c },
+    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
+    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
+    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
+    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
+    { 0x0000a20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000b20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000c20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
+    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
+    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
+    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
+    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
+    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
+    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
+    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
+    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
+    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
+    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
+    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
+    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
+    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+};
+
+static const u32 ar5416Common[][2] = {
+    { 0x0000000c, 0x00000000 },
+    { 0x00000030, 0x00020015 },
+    { 0x00000034, 0x00000005 },
+    { 0x00000040, 0x00000000 },
+    { 0x00000044, 0x00000008 },
+    { 0x00000048, 0x00000008 },
+    { 0x0000004c, 0x00000010 },
+    { 0x00000050, 0x00000000 },
+    { 0x00000054, 0x0000001f },
+    { 0x00000800, 0x00000000 },
+    { 0x00000804, 0x00000000 },
+    { 0x00000808, 0x00000000 },
+    { 0x0000080c, 0x00000000 },
+    { 0x00000810, 0x00000000 },
+    { 0x00000814, 0x00000000 },
+    { 0x00000818, 0x00000000 },
+    { 0x0000081c, 0x00000000 },
+    { 0x00000820, 0x00000000 },
+    { 0x00000824, 0x00000000 },
+    { 0x00001040, 0x002ffc0f },
+    { 0x00001044, 0x002ffc0f },
+    { 0x00001048, 0x002ffc0f },
+    { 0x0000104c, 0x002ffc0f },
+    { 0x00001050, 0x002ffc0f },
+    { 0x00001054, 0x002ffc0f },
+    { 0x00001058, 0x002ffc0f },
+    { 0x0000105c, 0x002ffc0f },
+    { 0x00001060, 0x002ffc0f },
+    { 0x00001064, 0x002ffc0f },
+    { 0x00001230, 0x00000000 },
+    { 0x00001270, 0x00000000 },
+    { 0x00001038, 0x00000000 },
+    { 0x00001078, 0x00000000 },
+    { 0x000010b8, 0x00000000 },
+    { 0x000010f8, 0x00000000 },
+    { 0x00001138, 0x00000000 },
+    { 0x00001178, 0x00000000 },
+    { 0x000011b8, 0x00000000 },
+    { 0x000011f8, 0x00000000 },
+    { 0x00001238, 0x00000000 },
+    { 0x00001278, 0x00000000 },
+    { 0x000012b8, 0x00000000 },
+    { 0x000012f8, 0x00000000 },
+    { 0x00001338, 0x00000000 },
+    { 0x00001378, 0x00000000 },
+    { 0x000013b8, 0x00000000 },
+    { 0x000013f8, 0x00000000 },
+    { 0x00001438, 0x00000000 },
+    { 0x00001478, 0x00000000 },
+    { 0x000014b8, 0x00000000 },
+    { 0x000014f8, 0x00000000 },
+    { 0x00001538, 0x00000000 },
+    { 0x00001578, 0x00000000 },
+    { 0x000015b8, 0x00000000 },
+    { 0x000015f8, 0x00000000 },
+    { 0x00001638, 0x00000000 },
+    { 0x00001678, 0x00000000 },
+    { 0x000016b8, 0x00000000 },
+    { 0x000016f8, 0x00000000 },
+    { 0x00001738, 0x00000000 },
+    { 0x00001778, 0x00000000 },
+    { 0x000017b8, 0x00000000 },
+    { 0x000017f8, 0x00000000 },
+    { 0x0000103c, 0x00000000 },
+    { 0x0000107c, 0x00000000 },
+    { 0x000010bc, 0x00000000 },
+    { 0x000010fc, 0x00000000 },
+    { 0x0000113c, 0x00000000 },
+    { 0x0000117c, 0x00000000 },
+    { 0x000011bc, 0x00000000 },
+    { 0x000011fc, 0x00000000 },
+    { 0x0000123c, 0x00000000 },
+    { 0x0000127c, 0x00000000 },
+    { 0x000012bc, 0x00000000 },
+    { 0x000012fc, 0x00000000 },
+    { 0x0000133c, 0x00000000 },
+    { 0x0000137c, 0x00000000 },
+    { 0x000013bc, 0x00000000 },
+    { 0x000013fc, 0x00000000 },
+    { 0x0000143c, 0x00000000 },
+    { 0x0000147c, 0x00000000 },
+    { 0x00004030, 0x00000002 },
+    { 0x0000403c, 0x00000002 },
+    { 0x00007010, 0x00000000 },
+    { 0x00007038, 0x000004c2 },
+    { 0x00008004, 0x00000000 },
+    { 0x00008008, 0x00000000 },
+    { 0x0000800c, 0x00000000 },
+    { 0x00008018, 0x00000700 },
+    { 0x00008020, 0x00000000 },
+    { 0x00008038, 0x00000000 },
+    { 0x0000803c, 0x00000000 },
+    { 0x00008048, 0x40000000 },
+    { 0x00008054, 0x00000000 },
+    { 0x00008058, 0x00000000 },
+    { 0x0000805c, 0x000fc78f },
+    { 0x00008060, 0x0000000f },
+    { 0x00008064, 0x00000000 },
+    { 0x000080c0, 0x2a82301a },
+    { 0x000080c4, 0x05dc01e0 },
+    { 0x000080c8, 0x1f402710 },
+    { 0x000080cc, 0x01f40000 },
+    { 0x000080d0, 0x00001e00 },
+    { 0x000080d4, 0x00000000 },
+    { 0x000080d8, 0x00400000 },
+    { 0x000080e0, 0xffffffff },
+    { 0x000080e4, 0x0000ffff },
+    { 0x000080e8, 0x003f3f3f },
+    { 0x000080ec, 0x00000000 },
+    { 0x000080f0, 0x00000000 },
+    { 0x000080f4, 0x00000000 },
+    { 0x000080f8, 0x00000000 },
+    { 0x000080fc, 0x00020000 },
+    { 0x00008100, 0x00020000 },
+    { 0x00008104, 0x00000001 },
+    { 0x00008108, 0x00000052 },
+    { 0x0000810c, 0x00000000 },
+    { 0x00008110, 0x00000168 },
+    { 0x00008118, 0x000100aa },
+    { 0x0000811c, 0x00003210 },
+    { 0x00008124, 0x00000000 },
+    { 0x00008128, 0x00000000 },
+    { 0x0000812c, 0x00000000 },
+    { 0x00008130, 0x00000000 },
+    { 0x00008134, 0x00000000 },
+    { 0x00008138, 0x00000000 },
+    { 0x0000813c, 0x00000000 },
+    { 0x00008144, 0xffffffff },
+    { 0x00008168, 0x00000000 },
+    { 0x0000816c, 0x00000000 },
+    { 0x00008170, 0x32143320 },
+    { 0x00008174, 0xfaa4fa50 },
+    { 0x00008178, 0x00000100 },
+    { 0x0000817c, 0x00000000 },
+    { 0x000081c4, 0x00000000 },
+    { 0x000081ec, 0x00000000 },
+    { 0x000081f0, 0x00000000 },
+    { 0x000081f4, 0x00000000 },
+    { 0x000081f8, 0x00000000 },
+    { 0x000081fc, 0x00000000 },
+    { 0x00008200, 0x00000000 },
+    { 0x00008204, 0x00000000 },
+    { 0x00008208, 0x00000000 },
+    { 0x0000820c, 0x00000000 },
+    { 0x00008210, 0x00000000 },
+    { 0x00008214, 0x00000000 },
+    { 0x00008218, 0x00000000 },
+    { 0x0000821c, 0x00000000 },
+    { 0x00008220, 0x00000000 },
+    { 0x00008224, 0x00000000 },
+    { 0x00008228, 0x00000000 },
+    { 0x0000822c, 0x00000000 },
+    { 0x00008230, 0x00000000 },
+    { 0x00008234, 0x00000000 },
+    { 0x00008238, 0x00000000 },
+    { 0x0000823c, 0x00000000 },
+    { 0x00008240, 0x00100000 },
+    { 0x00008244, 0x0010f400 },
+    { 0x00008248, 0x00000100 },
+    { 0x0000824c, 0x0001e800 },
+    { 0x00008250, 0x00000000 },
+    { 0x00008254, 0x00000000 },
+    { 0x00008258, 0x00000000 },
+    { 0x0000825c, 0x400000ff },
+    { 0x00008260, 0x00080922 },
+    { 0x00008264, 0x88000010 },
+    { 0x00008270, 0x00000000 },
+    { 0x00008274, 0x40000000 },
+    { 0x00008278, 0x003e4180 },
+    { 0x0000827c, 0x00000000 },
+    { 0x00008284, 0x0000002c },
+    { 0x00008288, 0x0000002c },
+    { 0x0000828c, 0x00000000 },
+    { 0x00008294, 0x00000000 },
+    { 0x00008298, 0x00000000 },
+    { 0x00008300, 0x00000000 },
+    { 0x00008304, 0x00000000 },
+    { 0x00008308, 0x00000000 },
+    { 0x0000830c, 0x00000000 },
+    { 0x00008310, 0x00000000 },
+    { 0x00008314, 0x00000000 },
+    { 0x00008318, 0x00000000 },
+    { 0x00008328, 0x00000000 },
+    { 0x0000832c, 0x00000007 },
+    { 0x00008330, 0x00000302 },
+    { 0x00008334, 0x00000e00 },
+    { 0x00008338, 0x00070000 },
+    { 0x0000833c, 0x00000000 },
+    { 0x00008340, 0x000107ff },
+    { 0x00009808, 0x00000000 },
+    { 0x0000980c, 0xad848e19 },
+    { 0x00009810, 0x7d14e000 },
+    { 0x00009814, 0x9c0a9f6b },
+    { 0x0000981c, 0x00000000 },
+    { 0x0000982c, 0x0000a000 },
+    { 0x00009830, 0x00000000 },
+    { 0x0000983c, 0x00200400 },
+    { 0x00009840, 0x206a002e },
+    { 0x0000984c, 0x1284233c },
+    { 0x00009854, 0x00000859 },
+    { 0x00009900, 0x00000000 },
+    { 0x00009904, 0x00000000 },
+    { 0x00009908, 0x00000000 },
+    { 0x0000990c, 0x00000000 },
+    { 0x0000991c, 0x10000fff },
+    { 0x00009920, 0x05100000 },
+    { 0x0000a920, 0x05100000 },
+    { 0x0000b920, 0x05100000 },
+    { 0x00009928, 0x00000001 },
+    { 0x0000992c, 0x00000004 },
+    { 0x00009934, 0x1e1f2022 },
+    { 0x00009938, 0x0a0b0c0d },
+    { 0x0000993c, 0x00000000 },
+    { 0x00009948, 0x9280b212 },
+    { 0x0000994c, 0x00020028 },
+    { 0x00009954, 0x5d50e188 },
+    { 0x00009958, 0x00081fff },
+    { 0x0000c95c, 0x004b6a8e },
+    { 0x0000c968, 0x000003ce },
+    { 0x00009970, 0x190fb515 },
+    { 0x00009974, 0x00000000 },
+    { 0x00009978, 0x00000001 },
+    { 0x0000997c, 0x00000000 },
+    { 0x00009980, 0x00000000 },
+    { 0x00009984, 0x00000000 },
+    { 0x00009988, 0x00000000 },
+    { 0x0000998c, 0x00000000 },
+    { 0x00009990, 0x00000000 },
+    { 0x00009994, 0x00000000 },
+    { 0x00009998, 0x00000000 },
+    { 0x0000999c, 0x00000000 },
+    { 0x000099a0, 0x00000000 },
+    { 0x000099a4, 0x00000001 },
+    { 0x000099a8, 0x001fff00 },
+    { 0x000099ac, 0x00000000 },
+    { 0x000099b0, 0x03051000 },
+    { 0x000099dc, 0x00000000 },
+    { 0x000099e0, 0x00000200 },
+    { 0x000099e4, 0xaaaaaaaa },
+    { 0x000099e8, 0x3c466478 },
+    { 0x000099ec, 0x000000aa },
+    { 0x000099fc, 0x00001042 },
+    { 0x00009b00, 0x00000000 },
+    { 0x00009b04, 0x00000001 },
+    { 0x00009b08, 0x00000002 },
+    { 0x00009b0c, 0x00000003 },
+    { 0x00009b10, 0x00000004 },
+    { 0x00009b14, 0x00000005 },
+    { 0x00009b18, 0x00000008 },
+    { 0x00009b1c, 0x00000009 },
+    { 0x00009b20, 0x0000000a },
+    { 0x00009b24, 0x0000000b },
+    { 0x00009b28, 0x0000000c },
+    { 0x00009b2c, 0x0000000d },
+    { 0x00009b30, 0x00000010 },
+    { 0x00009b34, 0x00000011 },
+    { 0x00009b38, 0x00000012 },
+    { 0x00009b3c, 0x00000013 },
+    { 0x00009b40, 0x00000014 },
+    { 0x00009b44, 0x00000015 },
+    { 0x00009b48, 0x00000018 },
+    { 0x00009b4c, 0x00000019 },
+    { 0x00009b50, 0x0000001a },
+    { 0x00009b54, 0x0000001b },
+    { 0x00009b58, 0x0000001c },
+    { 0x00009b5c, 0x0000001d },
+    { 0x00009b60, 0x00000020 },
+    { 0x00009b64, 0x00000021 },
+    { 0x00009b68, 0x00000022 },
+    { 0x00009b6c, 0x00000023 },
+    { 0x00009b70, 0x00000024 },
+    { 0x00009b74, 0x00000025 },
+    { 0x00009b78, 0x00000028 },
+    { 0x00009b7c, 0x00000029 },
+    { 0x00009b80, 0x0000002a },
+    { 0x00009b84, 0x0000002b },
+    { 0x00009b88, 0x0000002c },
+    { 0x00009b8c, 0x0000002d },
+    { 0x00009b90, 0x00000030 },
+    { 0x00009b94, 0x00000031 },
+    { 0x00009b98, 0x00000032 },
+    { 0x00009b9c, 0x00000033 },
+    { 0x00009ba0, 0x00000034 },
+    { 0x00009ba4, 0x00000035 },
+    { 0x00009ba8, 0x00000035 },
+    { 0x00009bac, 0x00000035 },
+    { 0x00009bb0, 0x00000035 },
+    { 0x00009bb4, 0x00000035 },
+    { 0x00009bb8, 0x00000035 },
+    { 0x00009bbc, 0x00000035 },
+    { 0x00009bc0, 0x00000035 },
+    { 0x00009bc4, 0x00000035 },
+    { 0x00009bc8, 0x00000035 },
+    { 0x00009bcc, 0x00000035 },
+    { 0x00009bd0, 0x00000035 },
+    { 0x00009bd4, 0x00000035 },
+    { 0x00009bd8, 0x00000035 },
+    { 0x00009bdc, 0x00000035 },
+    { 0x00009be0, 0x00000035 },
+    { 0x00009be4, 0x00000035 },
+    { 0x00009be8, 0x00000035 },
+    { 0x00009bec, 0x00000035 },
+    { 0x00009bf0, 0x00000035 },
+    { 0x00009bf4, 0x00000035 },
+    { 0x00009bf8, 0x00000010 },
+    { 0x00009bfc, 0x0000001a },
+    { 0x0000a210, 0x40806333 },
+    { 0x0000a214, 0x00106c10 },
+    { 0x0000a218, 0x009c4060 },
+    { 0x0000a220, 0x018830c6 },
+    { 0x0000a224, 0x00000400 },
+    { 0x0000a228, 0x00000bb5 },
+    { 0x0000a22c, 0x00000011 },
+    { 0x0000a234, 0x20202020 },
+    { 0x0000a238, 0x20202020 },
+    { 0x0000a23c, 0x13c889af },
+    { 0x0000a240, 0x38490a20 },
+    { 0x0000a244, 0x00007bb6 },
+    { 0x0000a248, 0x0fff3ffc },
+    { 0x0000a24c, 0x00000001 },
+    { 0x0000a250, 0x0000a000 },
+    { 0x0000a254, 0x00000000 },
+    { 0x0000a258, 0x0cc75380 },
+    { 0x0000a25c, 0x0f0f0f01 },
+    { 0x0000a260, 0xdfa91f01 },
+    { 0x0000a268, 0x00000000 },
+    { 0x0000a26c, 0x0e79e5c6 },
+    { 0x0000b26c, 0x0e79e5c6 },
+    { 0x0000c26c, 0x0e79e5c6 },
+    { 0x0000d270, 0x00820820 },
+    { 0x0000a278, 0x1ce739ce },
+    { 0x0000a27c, 0x051701ce },
+    { 0x0000a338, 0x00000000 },
+    { 0x0000a33c, 0x00000000 },
+    { 0x0000a340, 0x00000000 },
+    { 0x0000a344, 0x00000000 },
+    { 0x0000a348, 0x3fffffff },
+    { 0x0000a34c, 0x3fffffff },
+    { 0x0000a350, 0x3fffffff },
+    { 0x0000a354, 0x0003ffff },
+    { 0x0000a358, 0x79a8aa1f },
+    { 0x0000d35c, 0x07ffffef },
+    { 0x0000d360, 0x0fffffe7 },
+    { 0x0000d364, 0x17ffffe5 },
+    { 0x0000d368, 0x1fffffe4 },
+    { 0x0000d36c, 0x37ffffe3 },
+    { 0x0000d370, 0x3fffffe3 },
+    { 0x0000d374, 0x57ffffe3 },
+    { 0x0000d378, 0x5fffffe2 },
+    { 0x0000d37c, 0x7fffffe2 },
+    { 0x0000d380, 0x7f3c7bba },
+    { 0x0000d384, 0xf3307ff0 },
+    { 0x0000a388, 0x08000000 },
+    { 0x0000a38c, 0x20202020 },
+    { 0x0000a390, 0x20202020 },
+    { 0x0000a394, 0x1ce739ce },
+    { 0x0000a398, 0x000001ce },
+    { 0x0000a39c, 0x00000001 },
+    { 0x0000a3a0, 0x00000000 },
+    { 0x0000a3a4, 0x00000000 },
+    { 0x0000a3a8, 0x00000000 },
+    { 0x0000a3ac, 0x00000000 },
+    { 0x0000a3b0, 0x00000000 },
+    { 0x0000a3b4, 0x00000000 },
+    { 0x0000a3b8, 0x00000000 },
+    { 0x0000a3bc, 0x00000000 },
+    { 0x0000a3c0, 0x00000000 },
+    { 0x0000a3c4, 0x00000000 },
+    { 0x0000a3c8, 0x00000246 },
+    { 0x0000a3cc, 0x20202020 },
+    { 0x0000a3d0, 0x20202020 },
+    { 0x0000a3d4, 0x20202020 },
+    { 0x0000a3dc, 0x1ce739ce },
+    { 0x0000a3e0, 0x000001ce },
+};
+
+static const u32 ar5416Bank0[][2] = {
+    { 0x000098b0, 0x1e5795e5 },
+    { 0x000098e0, 0x02008020 },
+};
+
+static const u32 ar5416BB_RfGain[][3] = {
+    { 0x00009a00, 0x00000000, 0x00000000 },
+    { 0x00009a04, 0x00000040, 0x00000040 },
+    { 0x00009a08, 0x00000080, 0x00000080 },
+    { 0x00009a0c, 0x000001a1, 0x00000141 },
+    { 0x00009a10, 0x000001e1, 0x00000181 },
+    { 0x00009a14, 0x00000021, 0x000001c1 },
+    { 0x00009a18, 0x00000061, 0x00000001 },
+    { 0x00009a1c, 0x00000168, 0x00000041 },
+    { 0x00009a20, 0x000001a8, 0x000001a8 },
+    { 0x00009a24, 0x000001e8, 0x000001e8 },
+    { 0x00009a28, 0x00000028, 0x00000028 },
+    { 0x00009a2c, 0x00000068, 0x00000068 },
+    { 0x00009a30, 0x00000189, 0x000000a8 },
+    { 0x00009a34, 0x000001c9, 0x00000169 },
+    { 0x00009a38, 0x00000009, 0x000001a9 },
+    { 0x00009a3c, 0x00000049, 0x000001e9 },
+    { 0x00009a40, 0x00000089, 0x00000029 },
+    { 0x00009a44, 0x00000170, 0x00000069 },
+    { 0x00009a48, 0x000001b0, 0x00000190 },
+    { 0x00009a4c, 0x000001f0, 0x000001d0 },
+    { 0x00009a50, 0x00000030, 0x00000010 },
+    { 0x00009a54, 0x00000070, 0x00000050 },
+    { 0x00009a58, 0x00000191, 0x00000090 },
+    { 0x00009a5c, 0x000001d1, 0x00000151 },
+    { 0x00009a60, 0x00000011, 0x00000191 },
+    { 0x00009a64, 0x00000051, 0x000001d1 },
+    { 0x00009a68, 0x00000091, 0x00000011 },
+    { 0x00009a6c, 0x000001b8, 0x00000051 },
+    { 0x00009a70, 0x000001f8, 0x00000198 },
+    { 0x00009a74, 0x00000038, 0x000001d8 },
+    { 0x00009a78, 0x00000078, 0x00000018 },
+    { 0x00009a7c, 0x00000199, 0x00000058 },
+    { 0x00009a80, 0x000001d9, 0x00000098 },
+    { 0x00009a84, 0x00000019, 0x00000159 },
+    { 0x00009a88, 0x00000059, 0x00000199 },
+    { 0x00009a8c, 0x00000099, 0x000001d9 },
+    { 0x00009a90, 0x000000d9, 0x00000019 },
+    { 0x00009a94, 0x000000f9, 0x00000059 },
+    { 0x00009a98, 0x000000f9, 0x00000099 },
+    { 0x00009a9c, 0x000000f9, 0x000000d9 },
+    { 0x00009aa0, 0x000000f9, 0x000000f9 },
+    { 0x00009aa4, 0x000000f9, 0x000000f9 },
+    { 0x00009aa8, 0x000000f9, 0x000000f9 },
+    { 0x00009aac, 0x000000f9, 0x000000f9 },
+    { 0x00009ab0, 0x000000f9, 0x000000f9 },
+    { 0x00009ab4, 0x000000f9, 0x000000f9 },
+    { 0x00009ab8, 0x000000f9, 0x000000f9 },
+    { 0x00009abc, 0x000000f9, 0x000000f9 },
+    { 0x00009ac0, 0x000000f9, 0x000000f9 },
+    { 0x00009ac4, 0x000000f9, 0x000000f9 },
+    { 0x00009ac8, 0x000000f9, 0x000000f9 },
+    { 0x00009acc, 0x000000f9, 0x000000f9 },
+    { 0x00009ad0, 0x000000f9, 0x000000f9 },
+    { 0x00009ad4, 0x000000f9, 0x000000f9 },
+    { 0x00009ad8, 0x000000f9, 0x000000f9 },
+    { 0x00009adc, 0x000000f9, 0x000000f9 },
+    { 0x00009ae0, 0x000000f9, 0x000000f9 },
+    { 0x00009ae4, 0x000000f9, 0x000000f9 },
+    { 0x00009ae8, 0x000000f9, 0x000000f9 },
+    { 0x00009aec, 0x000000f9, 0x000000f9 },
+    { 0x00009af0, 0x000000f9, 0x000000f9 },
+    { 0x00009af4, 0x000000f9, 0x000000f9 },
+    { 0x00009af8, 0x000000f9, 0x000000f9 },
+    { 0x00009afc, 0x000000f9, 0x000000f9 },
+};
+
+static const u32 ar5416Bank1[][2] = {
+    { 0x000098b0, 0x02108421 },
+    { 0x000098ec, 0x00000008 },
+};
+
+static const u32 ar5416Bank2[][2] = {
+    { 0x000098b0, 0x0e73ff17 },
+    { 0x000098e0, 0x00000420 },
+};
+
+static const u32 ar5416Bank3[][3] = {
+    { 0x000098f0, 0x01400018, 0x01c00018 },
+};
+
+static const u32 ar5416Bank6[][3] = {
+
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x004210a2, 0x004210a2 },
+    { 0x0000989c, 0x0014008f, 0x0014008f },
+    { 0x0000989c, 0x00c40003, 0x00c40003 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x0001805e, 0x0001805e },
+    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
+    { 0x0000989c, 0x000000f1, 0x000000f1 },
+    { 0x0000989c, 0x00002081, 0x00002081 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+static const u32 ar5416Bank6TPC[][3] = {
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x00423022, 0x00423022 },
+    { 0x0000989c, 0x201400df, 0x201400df },
+    { 0x0000989c, 0x00c40002, 0x00c40002 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x0001805e, 0x0001805e },
+    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
+    { 0x0000989c, 0x000000e1, 0x000000e1 },
+    { 0x0000989c, 0x00007081, 0x00007081 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+static const u32 ar5416Bank7[][2] = {
+    { 0x0000989c, 0x00000500 },
+    { 0x0000989c, 0x00000800 },
+    { 0x000098cc, 0x0000000e },
+};
+
+static const u32 ar5416Addac[][2] = {
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000003 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x0000000c },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000030 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000060 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000058 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x000098cc,  0x00000000 },
+};
+
+static const u32 ar5416Modes_9100[][6] = {
+    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
+    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
+    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
+    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
+    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
+    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
+    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
+    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
+    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
+    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
+    { 0x00009844, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0, 0x037216a0 },
+    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x00009850, 0x6d48b4e2, 0x6d48b4e2, 0x6d48b0e2, 0x6d48b0e2, 0x6d48b0e2 },
+    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec86d2e, 0x7ec84d2e, 0x7ec82d2e },
+    { 0x0000985c, 0x3139605e, 0x3139605e, 0x3139605e, 0x3139605e, 0x3139605e },
+    { 0x00009860, 0x00048d18, 0x00048d18, 0x00048d20, 0x00048d20, 0x00048d18 },
+    { 0x0000c864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
+    { 0x00009868, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0 },
+    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
+    { 0x00009914, 0x000007d0, 0x000007d0, 0x00000898, 0x00000898, 0x000007d0 },
+    { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
+    { 0x00009924, 0xd00a8a07, 0xd00a8a07, 0xd00a8a11, 0xd00a8a0d, 0xd00a8a0d },
+    { 0x00009940, 0x00754604, 0x00754604, 0xfff81204, 0xfff81204, 0xfff81204 },
+    { 0x00009944, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020 },
+    { 0x00009954, 0x5f3ca3de, 0x5f3ca3de, 0xe250a51e, 0xe250a51e, 0xe250a51e },
+    { 0x00009958, 0x2108ecff, 0x2108ecff, 0x3388ffff, 0x3388ffff, 0x3388ffff },
+#ifdef TB243
+    { 0x00009960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
+    { 0x0000a960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
+    { 0x0000b960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
+    { 0x00009964, 0x00000000, 0x00000000, 0x00002210, 0x00002210, 0x00001120 },
+#else
+    { 0x00009960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
+    { 0x0000a960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
+    { 0x0000b960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
+    { 0x00009964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, 0x00001120 },
+#endif
+    { 0x0000c9bc, 0x001a0600, 0x001a0600, 0x001a1000, 0x001a0c00, 0x001a0c00 },
+    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
+    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
+    { 0x000099c8, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329 },
+    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
+    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
+    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
+    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
+    { 0x0000a20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000b20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000c20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
+    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
+    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
+    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
+    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
+    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
+    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
+    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
+    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
+    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
+    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
+    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
+    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
+    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+};
+
+#endif /* INITVALS_AR5008_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
new file mode 100644
index 000000000000..b2c17c98bb38
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -0,0 +1,1374 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "hw-ops.h"
+#include "../regd.h"
+#include "ar9002_phy.h"
+
+/* All code below is for non single-chip solutions */
+
+/**
+ * ar5008_hw_phy_modify_rx_buffer() - perform analog swizzling of parameters
+ * @rfbuf:
+ * @reg32:
+ * @numBits:
+ * @firstBit:
+ * @column:
+ *
+ * Performs analog "swizzling" of parameters into their location.
+ * Used on external AR2133/AR5133 radios.
+ */
+static void ar5008_hw_phy_modify_rx_buffer(u32 *rfBuf, u32 reg32,
+                                           u32 numBits, u32 firstBit,
+                                           u32 column)
+{
+        u32 tmp32, mask, arrayEntry, lastBit;
+        int32_t bitPosition, bitsLeft;
+
+        tmp32 = ath9k_hw_reverse_bits(reg32, numBits);
+        arrayEntry = (firstBit - 1) / 8;
+        bitPosition = (firstBit - 1) % 8;
+        bitsLeft = numBits;
+        while (bitsLeft > 0) {
+                lastBit = (bitPosition + bitsLeft > 8) ?
+                    8 : bitPosition + bitsLeft;
+                mask = (((1 << lastBit) - 1) ^ ((1 << bitPosition) - 1)) <<
+                    (column * 8);
+                rfBuf[arrayEntry] &= ~mask;
+                rfBuf[arrayEntry] |= ((tmp32 << bitPosition) <<
+                                      (column * 8)) & mask;
+                bitsLeft -= 8 - bitPosition;
+                tmp32 = tmp32 >> (8 - bitPosition);
+                bitPosition = 0;
+                arrayEntry++;
+        }
+}
+
+/*
+ * Fix on 2.4 GHz band for orientation sensitivity issue by increasing
+ * rf_pwd_icsyndiv.
+ *
+ * Theoretical Rules:
+ *   if 2 GHz band
+ *      if forceBiasAuto
+ *         if synth_freq < 2412
+ *            bias = 0
+ *         else if 2412 <= synth_freq <= 2422
+ *            bias = 1
+ *         else // synth_freq > 2422
+ *            bias = 2
+ *      else if forceBias > 0
+ *         bias = forceBias & 7
+ *      else
+ *         no change, use value from ini file
+ *   else
+ *      no change, invalid band
+ *
+ *  1st Mod:
+ *    2422 also uses value of 2
+ *    <approved>
+ *
+ *  2nd Mod:
+ *    Less than 2412 uses value of 0, 2412 and above uses value of 2
+ */
+static void ar5008_hw_force_bias(struct ath_hw *ah, u16 synth_freq)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 tmp_reg;
+        int reg_writes = 0;
+        u32 new_bias = 0;
+
+        if (!AR_SREV_5416(ah) || synth_freq >= 3000)
+                return;
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        if (synth_freq < 2412)
+                new_bias = 0;
+        else if (synth_freq < 2422)
+                new_bias = 1;
+        else
+                new_bias = 2;
+
+        /* pre-reverse this field */
+        tmp_reg = ath9k_hw_reverse_bits(new_bias, 3);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "Force rf_pwd_icsyndiv to %1d on %4d\n",
+                  new_bias, synth_freq);
+
+        /* swizzle rf_pwd_icsyndiv */
+        ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data, tmp_reg, 3, 181, 3);
+
+        /* write Bank 6 with new params */
+        REG_WRITE_RF_ARRAY(&ah->iniBank6, ah->analogBank6Data, reg_writes);
+}
+
+/**
+ * ar5008_hw_set_channel - tune to a channel on the external AR2133/AR5133 radios
+ * @ah: atheros hardware stucture
+ * @chan:
+ *
+ * For the external AR2133/AR5133 radios, takes the MHz channel value and set
+ * the channel value. Assumes writes enabled to analog bus and bank6 register
+ * cache in ah->analogBank6Data.
+ */
+static int ar5008_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 channelSel = 0;
+        u32 bModeSynth = 0;
+        u32 aModeRefSel = 0;
+        u32 reg32 = 0;
+        u16 freq;
+        struct chan_centers centers;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        if (freq < 4800) {
+                u32 txctl;
+
+                if (((freq - 2192) % 5) == 0) {
+                        channelSel = ((freq - 672) * 2 - 3040) / 10;
+                        bModeSynth = 0;
+                } else if (((freq - 2224) % 5) == 0) {
+                        channelSel = ((freq - 704) * 2 - 3040) / 10;
+                        bModeSynth = 1;
+                } else {
+                        ath_print(common, ATH_DBG_FATAL,
+                                  "Invalid channel %u MHz\n", freq);
+                        return -EINVAL;
+                }
+
+                channelSel = (channelSel << 2) & 0xff;
+                channelSel = ath9k_hw_reverse_bits(channelSel, 8);
+
+                txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
+                if (freq == 2484) {
+
+                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                  txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
+                } else {
+                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                  txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
+                }
+
+        } else if ((freq % 20) == 0 && freq >= 5120) {
+                channelSel =
+                    ath9k_hw_reverse_bits(((freq - 4800) / 20 << 2), 8);
+                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else if ((freq % 10) == 0) {
+                channelSel =
+                    ath9k_hw_reverse_bits(((freq - 4800) / 10 << 1), 8);
+                if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah))
+                        aModeRefSel = ath9k_hw_reverse_bits(2, 2);
+                else
+                        aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else if ((freq % 5) == 0) {
+                channelSel = ath9k_hw_reverse_bits((freq - 4800) / 5, 8);
+                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
+        } else {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Invalid channel %u MHz\n", freq);
+                return -EINVAL;
+        }
+
+        ar5008_hw_force_bias(ah, freq);
+
+        reg32 =
+            (channelSel << 8) | (aModeRefSel << 2) | (bModeSynth << 1) |
+            (1 << 5) | 0x1;
+
+        REG_WRITE(ah, AR_PHY(0x37), reg32);
+
+        ah->curchan = chan;
+        ah->curchan_rad_index = -1;
+
+        return 0;
+}
+
+/**
+ * ar5008_hw_spur_mitigate - convert baseband spur frequency for external radios
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * For non single-chip solutions. Converts to baseband spur frequency given the
+ * input channel frequency and compute register settings below.
+ */
+static void ar5008_hw_spur_mitigate(struct ath_hw *ah,
+                                    struct ath9k_channel *chan)
+{
+        int bb_spur = AR_NO_SPUR;
+        int bin, cur_bin;
+        int spur_freq_sd;
+        int spur_delta_phase;
+        int denominator;
+        int upper, lower, cur_vit_mask;
+        int tmp, new;
+        int i;
+        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
+                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        };
+        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
+                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        };
+        int inc[4] = { 0, 100, 0, 0 };
+
+        int8_t mask_m[123];
+        int8_t mask_p[123];
+        int8_t mask_amt;
+        int tmp_mask;
+        int cur_bb_spur;
+        bool is2GHz = IS_CHAN_2GHZ(chan);
+
+        memset(&mask_m, 0, sizeof(int8_t) * 123);
+        memset(&mask_p, 0, sizeof(int8_t) * 123);
+
+        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
+                if (AR_NO_SPUR == cur_bb_spur)
+                        break;
+                cur_bb_spur = cur_bb_spur - (chan->channel * 10);
+                if ((cur_bb_spur > -95) && (cur_bb_spur < 95)) {
+                        bb_spur = cur_bb_spur;
+                        break;
+                }
+        }
+
+        if (AR_NO_SPUR == bb_spur)
+                return;
+
+        bin = bb_spur * 32;
+
+        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
+        new = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
+                     AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
+                     AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
+                     AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
+
+        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), new);
+
+        new = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
+               AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
+               AR_PHY_SPUR_REG_MASK_RATE_SELECT |
+               AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
+               SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
+        REG_WRITE(ah, AR_PHY_SPUR_REG, new);
+
+        spur_delta_phase = ((bb_spur * 524288) / 100) &
+                AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+
+        denominator = IS_CHAN_2GHZ(chan) ? 440 : 400;
+        spur_freq_sd = ((bb_spur * 2048) / denominator) & 0x3ff;
+
+        new = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
+               SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
+               SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
+        REG_WRITE(ah, AR_PHY_TIMING11, new);
+
+        cur_bin = -6000;
+        upper = bin + 100;
+        lower = bin - 100;
+
+        for (i = 0; i < 4; i++) {
+                int pilot_mask = 0;
+                int chan_mask = 0;
+                int bp = 0;
+                for (bp = 0; bp < 30; bp++) {
+                        if ((cur_bin > lower) && (cur_bin < upper)) {
+                                pilot_mask = pilot_mask | 0x1 << bp;
+                                chan_mask = chan_mask | 0x1 << bp;
+                        }
+                        cur_bin += 100;
+                }
+                cur_bin += inc[i];
+                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
+                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
+        }
+
+        cur_vit_mask = 6100;
+        upper = bin + 120;
+        lower = bin - 120;
+
+        for (i = 0; i < 123; i++) {
+                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
+
+                        /* workaround for gcc bug #37014 */
+                        volatile int tmp_v = abs(cur_vit_mask - bin);
+
+                        if (tmp_v < 75)
+                                mask_amt = 1;
+                        else
+                                mask_amt = 0;
+                        if (cur_vit_mask < 0)
+                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
+                        else
+                                mask_p[cur_vit_mask / 100] = mask_amt;
+                }
+                cur_vit_mask -= 100;
+        }
+
+        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
+                | (mask_m[48] << 26) | (mask_m[49] << 24)
+                | (mask_m[50] << 22) | (mask_m[51] << 20)
+                | (mask_m[52] << 18) | (mask_m[53] << 16)
+                | (mask_m[54] << 14) | (mask_m[55] << 12)
+                | (mask_m[56] << 10) | (mask_m[57] << 8)
+                | (mask_m[58] << 6) | (mask_m[59] << 4)
+                | (mask_m[60] << 2) | (mask_m[61] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
+
+        tmp_mask = (mask_m[31] << 28)
+                | (mask_m[32] << 26) | (mask_m[33] << 24)
+                | (mask_m[34] << 22) | (mask_m[35] << 20)
+                | (mask_m[36] << 18) | (mask_m[37] << 16)
+                | (mask_m[48] << 14) | (mask_m[39] << 12)
+                | (mask_m[40] << 10) | (mask_m[41] << 8)
+                | (mask_m[42] << 6) | (mask_m[43] << 4)
+                | (mask_m[44] << 2) | (mask_m[45] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
+
+        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
+                | (mask_m[18] << 26) | (mask_m[18] << 24)
+                | (mask_m[20] << 22) | (mask_m[20] << 20)
+                | (mask_m[22] << 18) | (mask_m[22] << 16)
+                | (mask_m[24] << 14) | (mask_m[24] << 12)
+                | (mask_m[25] << 10) | (mask_m[26] << 8)
+                | (mask_m[27] << 6) | (mask_m[28] << 4)
+                | (mask_m[29] << 2) | (mask_m[30] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
+
+        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
+                | (mask_m[2] << 26) | (mask_m[3] << 24)
+                | (mask_m[4] << 22) | (mask_m[5] << 20)
+                | (mask_m[6] << 18) | (mask_m[7] << 16)
+                | (mask_m[8] << 14) | (mask_m[9] << 12)
+                | (mask_m[10] << 10) | (mask_m[11] << 8)
+                | (mask_m[12] << 6) | (mask_m[13] << 4)
+                | (mask_m[14] << 2) | (mask_m[15] << 0);
+        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
+
+        tmp_mask = (mask_p[15] << 28)
+                | (mask_p[14] << 26) | (mask_p[13] << 24)
+                | (mask_p[12] << 22) | (mask_p[11] << 20)
+                | (mask_p[10] << 18) | (mask_p[9] << 16)
+                | (mask_p[8] << 14) | (mask_p[7] << 12)
+                | (mask_p[6] << 10) | (mask_p[5] << 8)
+                | (mask_p[4] << 6) | (mask_p[3] << 4)
+                | (mask_p[2] << 2) | (mask_p[1] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
+
+        tmp_mask = (mask_p[30] << 28)
+                | (mask_p[29] << 26) | (mask_p[28] << 24)
+                | (mask_p[27] << 22) | (mask_p[26] << 20)
+                | (mask_p[25] << 18) | (mask_p[24] << 16)
+                | (mask_p[23] << 14) | (mask_p[22] << 12)
+                | (mask_p[21] << 10) | (mask_p[20] << 8)
+                | (mask_p[19] << 6) | (mask_p[18] << 4)
+                | (mask_p[17] << 2) | (mask_p[16] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
+
+        tmp_mask = (mask_p[45] << 28)
+                | (mask_p[44] << 26) | (mask_p[43] << 24)
+                | (mask_p[42] << 22) | (mask_p[41] << 20)
+                | (mask_p[40] << 18) | (mask_p[39] << 16)
+                | (mask_p[38] << 14) | (mask_p[37] << 12)
+                | (mask_p[36] << 10) | (mask_p[35] << 8)
+                | (mask_p[34] << 6) | (mask_p[33] << 4)
+                | (mask_p[32] << 2) | (mask_p[31] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
+
+        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
+                | (mask_p[59] << 26) | (mask_p[58] << 24)
+                | (mask_p[57] << 22) | (mask_p[56] << 20)
+                | (mask_p[55] << 18) | (mask_p[54] << 16)
+                | (mask_p[53] << 14) | (mask_p[52] << 12)
+                | (mask_p[51] << 10) | (mask_p[50] << 8)
+                | (mask_p[49] << 6) | (mask_p[48] << 4)
+                | (mask_p[47] << 2) | (mask_p[46] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
+}
+
+/**
+ * ar5008_hw_rf_alloc_ext_banks - allocates banks for external radio programming
+ * @ah: atheros hardware structure
+ *
+ * Only required for older devices with external AR2133/AR5133 radios.
+ */
+static int ar5008_hw_rf_alloc_ext_banks(struct ath_hw *ah)
+{
+#define ATH_ALLOC_BANK(bank, size) do { \
+                bank = kzalloc((sizeof(u32) * size), GFP_KERNEL); \
+                if (!bank) { \
+                        ath_print(common, ATH_DBG_FATAL, \
+                                  "Cannot allocate RF banks\n"); \
+                        return -ENOMEM; \
+                } \
+        } while (0);
+
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank2Data, ah->iniBank2.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank3Data, ah->iniBank3.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
+        ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
+        ATH_ALLOC_BANK(ah->addac5416_21,
+                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
+        ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
+
+        return 0;
+#undef ATH_ALLOC_BANK
+}
+
+
+/**
+ * ar5008_hw_rf_free_ext_banks - Free memory for analog bank scratch buffers
+ * @ah: atheros hardware struture
+ * For the external AR2133/AR5133 radios banks.
+ */
+static void ar5008_hw_rf_free_ext_banks(struct ath_hw *ah)
+{
+#define ATH_FREE_BANK(bank) do { \
+                kfree(bank); \
+                bank = NULL; \
+        } while (0);
+
+        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
+
+        ATH_FREE_BANK(ah->analogBank0Data);
+        ATH_FREE_BANK(ah->analogBank1Data);
+        ATH_FREE_BANK(ah->analogBank2Data);
+        ATH_FREE_BANK(ah->analogBank3Data);
+        ATH_FREE_BANK(ah->analogBank6Data);
+        ATH_FREE_BANK(ah->analogBank6TPCData);
+        ATH_FREE_BANK(ah->analogBank7Data);
+        ATH_FREE_BANK(ah->addac5416_21);
+        ATH_FREE_BANK(ah->bank6Temp);
+
+#undef ATH_FREE_BANK
+}
+
+/* *
+ * ar5008_hw_set_rf_regs - programs rf registers based on EEPROM
+ * @ah: atheros hardware structure
+ * @chan:
+ * @modesIndex:
+ *
+ * Used for the external AR2133/AR5133 radios.
+ *
+ * Reads the EEPROM header info from the device structure and programs
+ * all rf registers. This routine requires access to the analog
+ * rf device. This is not required for single-chip devices.
+ */
+static bool ar5008_hw_set_rf_regs(struct ath_hw *ah,
+                                  struct ath9k_channel *chan,
+                                  u16 modesIndex)
+{
+        u32 eepMinorRev;
+        u32 ob5GHz = 0, db5GHz = 0;
+        u32 ob2GHz = 0, db2GHz = 0;
+        int regWrites = 0;
+
+        /*
+         * Software does not need to program bank data
+         * for single chip devices, that is AR9280 or anything
+         * after that.
+         */
+        if (AR_SREV_9280_10_OR_LATER(ah))
+                return true;
+
+        /* Setup rf parameters */
+        eepMinorRev = ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV);
+
+        /* Setup Bank 0 Write */
+        RF_BANK_SETUP(ah->analogBank0Data, &ah->iniBank0, 1);
+
+        /* Setup Bank 1 Write */
+        RF_BANK_SETUP(ah->analogBank1Data, &ah->iniBank1, 1);
+
+        /* Setup Bank 2 Write */
+        RF_BANK_SETUP(ah->analogBank2Data, &ah->iniBank2, 1);
+
+        /* Setup Bank 6 Write */
+        RF_BANK_SETUP(ah->analogBank3Data, &ah->iniBank3,
+                      modesIndex);
+        {
+                int i;
+                for (i = 0; i < ah->iniBank6TPC.ia_rows; i++) {
+                        ah->analogBank6Data[i] =
+                            INI_RA(&ah->iniBank6TPC, i, modesIndex);
+                }
+        }
+
+        /* Only the 5 or 2 GHz OB/DB need to be set for a mode */
+        if (eepMinorRev >= 2) {
+                if (IS_CHAN_2GHZ(chan)) {
+                        ob2GHz = ah->eep_ops->get_eeprom(ah, EEP_OB_2);
+                        db2GHz = ah->eep_ops->get_eeprom(ah, EEP_DB_2);
+                        ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data,
+                                                       ob2GHz, 3, 197, 0);
+                        ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data,
+                                                       db2GHz, 3, 194, 0);
+                } else {
+                        ob5GHz = ah->eep_ops->get_eeprom(ah, EEP_OB_5);
+                        db5GHz = ah->eep_ops->get_eeprom(ah, EEP_DB_5);
+                        ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data,
+                                                       ob5GHz, 3, 203, 0);
+                        ar5008_hw_phy_modify_rx_buffer(ah->analogBank6Data,
+                                                       db5GHz, 3, 200, 0);
+                }
+        }
+
+        /* Setup Bank 7 Setup */
+        RF_BANK_SETUP(ah->analogBank7Data, &ah->iniBank7, 1);
+
+        /* Write Analog registers */
+        REG_WRITE_RF_ARRAY(&ah->iniBank0, ah->analogBank0Data,
+                           regWrites);
+        REG_WRITE_RF_ARRAY(&ah->iniBank1, ah->analogBank1Data,
+                           regWrites);
+        REG_WRITE_RF_ARRAY(&ah->iniBank2, ah->analogBank2Data,
+                           regWrites);
+        REG_WRITE_RF_ARRAY(&ah->iniBank3, ah->analogBank3Data,
+                           regWrites);
+        REG_WRITE_RF_ARRAY(&ah->iniBank6TPC, ah->analogBank6Data,
+                           regWrites);
+        REG_WRITE_RF_ARRAY(&ah->iniBank7, ah->analogBank7Data,
+                           regWrites);
+
+        return true;
+}
+
+static void ar5008_hw_init_bb(struct ath_hw *ah,
+                              struct ath9k_channel *chan)
+{
+        u32 synthDelay;
+
+        synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
+        if (IS_CHAN_B(chan))
+                synthDelay = (4 * synthDelay) / 22;
+        else
+                synthDelay /= 10;
+
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+        udelay(synthDelay + BASE_ACTIVATE_DELAY);
+}
+
+static void ar5008_hw_init_chain_masks(struct ath_hw *ah)
+{
+        int rx_chainmask, tx_chainmask;
+
+        rx_chainmask = ah->rxchainmask;
+        tx_chainmask = ah->txchainmask;
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        switch (rx_chainmask) {
+        case 0x5:
+                DISABLE_REGWRITE_BUFFER(ah);
+                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
+                            AR_PHY_SWAP_ALT_CHAIN);
+                ENABLE_REGWRITE_BUFFER(ah);
+        case 0x3:
+                if (ah->hw_version.macVersion == AR_SREV_REVISION_5416_10) {
+                        REG_WRITE(ah, AR_PHY_RX_CHAINMASK, 0x7);
+                        REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, 0x7);
+                        break;
+                }
+        case 0x1:
+        case 0x2:
+        case 0x7:
+                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx_chainmask);
+                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx_chainmask);
+                break;
+        default:
+                break;
+        }
+
+        REG_WRITE(ah, AR_SELFGEN_MASK, tx_chainmask);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (tx_chainmask == 0x5) {
+                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
+                            AR_PHY_SWAP_ALT_CHAIN);
+        }
+        if (AR_SREV_9100(ah))
+                REG_WRITE(ah, AR_PHY_ANALOG_SWAP,
+                          REG_READ(ah, AR_PHY_ANALOG_SWAP) | 0x00000001);
+}
+
+static void ar5008_hw_override_ini(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+        u32 val;
+
+        /*
+         * Set the RX_ABORT and RX_DIS and clear if off only after
+         * RXE is set for MAC. This prevents frames with corrupted
+         * descriptor status.
+         */
+        REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                val = REG_READ(ah, AR_PCU_MISC_MODE2);
+
+                if (!AR_SREV_9271(ah))
+                        val &= ~AR_PCU_MISC_MODE2_HWWAR1;
+
+                if (AR_SREV_9287_10_OR_LATER(ah))
+                        val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
+
+                REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
+        }
+
+        if (!AR_SREV_5416_20_OR_LATER(ah) ||
+            AR_SREV_9280_10_OR_LATER(ah))
+                return;
+        /*
+         * Disable BB clock gating
+         * Necessary to avoid issues on AR5416 2.0
+         */
+        REG_WRITE(ah, 0x9800 + (651 << 2), 0x11);
+
+        /*
+         * Disable RIFS search on some chips to avoid baseband
+         * hang issues.
+         */
+        if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
+                val = REG_READ(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS);
+                val &= ~AR_PHY_RIFS_INIT_DELAY;
+                REG_WRITE(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS, val);
+        }
+}
+
+static void ar5008_hw_set_channel_regs(struct ath_hw *ah,
+                                       struct ath9k_channel *chan)
+{
+        u32 phymode;
+        u32 enableDacFifo = 0;
+
+        if (AR_SREV_9285_10_OR_LATER(ah))
+                enableDacFifo = (REG_READ(ah, AR_PHY_TURBO) &
+                                         AR_PHY_FC_ENABLE_DAC_FIFO);
+
+        phymode = AR_PHY_FC_HT_EN | AR_PHY_FC_SHORT_GI_40
+                | AR_PHY_FC_SINGLE_HT_LTF1 | AR_PHY_FC_WALSH | enableDacFifo;
+
+        if (IS_CHAN_HT40(chan)) {
+                phymode |= AR_PHY_FC_DYN2040_EN;
+
+                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
+                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                        phymode |= AR_PHY_FC_DYN2040_PRI_CH;
+
+        }
+        REG_WRITE(ah, AR_PHY_TURBO, phymode);
+
+        ath9k_hw_set11nmac2040(ah);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
+        REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+}
+
+
+static int ar5008_hw_process_ini(struct ath_hw *ah,
+                                 struct ath9k_channel *chan)
+{
+        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+        int i, regWrites = 0;
+        struct ieee80211_channel *channel = chan->chan;
+        u32 modesIndex, freqIndex;
+
+        switch (chan->chanmode) {
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+                modesIndex = 1;
+                freqIndex = 1;
+                break;
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                modesIndex = 2;
+                freqIndex = 1;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_B:
+                modesIndex = 4;
+                freqIndex = 2;
+                break;
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                modesIndex = 3;
+                freqIndex = 2;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        if (AR_SREV_9287_12_OR_LATER(ah)) {
+                /* Enable ASYNC FIFO */
+                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_DATAPATH_SEL);
+                REG_SET_BIT(ah, AR_PHY_MODE, AR_PHY_MODE_ASYNCFIFO);
+                REG_CLR_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
+                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
+                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
+        }
+
+        /*
+         * Set correct baseband to analog shift setting to
+         * access analog chips.
+         */
+        REG_WRITE(ah, AR_PHY(0), 0x00000007);
+
+        /* Write ADDAC shifts */
+        REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_EXTERNAL_RADIO);
+        ah->eep_ops->set_addac(ah, chan);
+
+        if (AR_SREV_5416_22_OR_LATER(ah)) {
+                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
+        } else {
+                struct ar5416IniArray temp;
+                u32 addacSize =
+                        sizeof(u32) * ah->iniAddac.ia_rows *
+                        ah->iniAddac.ia_columns;
+
+                /* For AR5416 2.0/2.1 */
+                memcpy(ah->addac5416_21,
+                       ah->iniAddac.ia_array, addacSize);
+
+                /* override CLKDRV value at [row, column] = [31, 1] */
+                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
+
+                temp.ia_array = ah->addac5416_21;
+                temp.ia_columns = ah->iniAddac.ia_columns;
+                temp.ia_rows = ah->iniAddac.ia_rows;
+                REG_WRITE_ARRAY(&temp, 1, regWrites);
+        }
+
+        REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        for (i = 0; i < ah->iniModes.ia_rows; i++) {
+                u32 reg = INI_RA(&ah->iniModes, i, 0);
+                u32 val = INI_RA(&ah->iniModes, i, modesIndex);
+
+                if (reg == AR_AN_TOP2 && ah->need_an_top2_fixup)
+                        val &= ~AR_AN_TOP2_PWDCLKIND;
+
+                REG_WRITE(ah, reg, val);
+
+                if (reg >= 0x7800 && reg < 0x78a0
+                    && ah->config.analog_shiftreg) {
+                        udelay(100);
+                }
+
+                DO_DELAY(regWrites);
+        }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (AR_SREV_9280(ah) || AR_SREV_9287_10_OR_LATER(ah))
+                REG_WRITE_ARRAY(&ah->iniModesRxGain, modesIndex, regWrites);
+
+        if (AR_SREV_9280(ah) || AR_SREV_9285_12_OR_LATER(ah) ||
+            AR_SREV_9287_10_OR_LATER(ah))
+                REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
+
+        if (AR_SREV_9271_10(ah))
+                REG_WRITE_ARRAY(&ah->iniModes_9271_1_0_only,
+                                modesIndex, regWrites);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        /* Write common array parameters */
+        for (i = 0; i < ah->iniCommon.ia_rows; i++) {
+                u32 reg = INI_RA(&ah->iniCommon, i, 0);
+                u32 val = INI_RA(&ah->iniCommon, i, 1);
+
+                REG_WRITE(ah, reg, val);
+
+                if (reg >= 0x7800 && reg < 0x78a0
+                    && ah->config.analog_shiftreg) {
+                        udelay(100);
+                }
+
+                DO_DELAY(regWrites);
+        }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (AR_SREV_9271(ah)) {
+                if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) == 1)
+                        REG_WRITE_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
+                                        modesIndex, regWrites);
+                else
+                        REG_WRITE_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
+                                        modesIndex, regWrites);
+        }
+
+        REG_WRITE_ARRAY(&ah->iniBB_RfGain, freqIndex, regWrites);
+
+        if (IS_CHAN_A_FAST_CLOCK(ah, chan)) {
+                REG_WRITE_ARRAY(&ah->iniModesAdditional, modesIndex,
+                                regWrites);
+        }
+
+        ar5008_hw_override_ini(ah, chan);
+        ar5008_hw_set_channel_regs(ah, chan);
+        ar5008_hw_init_chain_masks(ah);
+        ath9k_olc_init(ah);
+
+        /* Set TX power */
+        ah->eep_ops->set_txpower(ah, chan,
+                                 ath9k_regd_get_ctl(regulatory, chan),
+                                 channel->max_antenna_gain * 2,
+                                 channel->max_power * 2,
+                                 min((u32) MAX_RATE_POWER,
+                                 (u32) regulatory->power_limit));
+
+        /* Write analog registers */
+        if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "ar5416SetRfRegs failed\n");
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static void ar5008_hw_set_rfmode(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        u32 rfMode = 0;
+
+        if (chan == NULL)
+                return;
+
+        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
+                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+
+        if (!AR_SREV_9280_10_OR_LATER(ah))
+                rfMode |= (IS_CHAN_5GHZ(chan)) ?
+                        AR_PHY_MODE_RF5GHZ : AR_PHY_MODE_RF2GHZ;
+
+        if (IS_CHAN_A_FAST_CLOCK(ah, chan))
+                rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
+
+        REG_WRITE(ah, AR_PHY_MODE, rfMode);
+}
+
+static void ar5008_hw_mark_phy_inactive(struct ath_hw *ah)
+{
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+}
+
+static void ar5008_hw_set_delta_slope(struct ath_hw *ah,
+                                      struct ath9k_channel *chan)
+{
+        u32 coef_scaled, ds_coef_exp, ds_coef_man;
+        u32 clockMhzScaled = 0x64000000;
+        struct chan_centers centers;
+
+        if (IS_CHAN_HALF_RATE(chan))
+                clockMhzScaled = clockMhzScaled >> 1;
+        else if (IS_CHAN_QUARTER_RATE(chan))
+                clockMhzScaled = clockMhzScaled >> 2;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        coef_scaled = clockMhzScaled / centers.synth_center;
+
+        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
+                                      &ds_coef_exp);
+
+        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
+                      AR_PHY_TIMING3_DSC_MAN, ds_coef_man);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
+                      AR_PHY_TIMING3_DSC_EXP, ds_coef_exp);
+
+        coef_scaled = (9 * coef_scaled) / 10;
+
+        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
+                                      &ds_coef_exp);
+
+        REG_RMW_FIELD(ah, AR_PHY_HALFGI,
+                      AR_PHY_HALFGI_DSC_MAN, ds_coef_man);
+        REG_RMW_FIELD(ah, AR_PHY_HALFGI,
+                      AR_PHY_HALFGI_DSC_EXP, ds_coef_exp);
+}
+
+static bool ar5008_hw_rfbus_req(struct ath_hw *ah)
+{
+        REG_WRITE(ah, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
+        return ath9k_hw_wait(ah, AR_PHY_RFBUS_GRANT, AR_PHY_RFBUS_GRANT_EN,
+                           AR_PHY_RFBUS_GRANT_EN, AH_WAIT_TIMEOUT);
+}
+
+static void ar5008_hw_rfbus_done(struct ath_hw *ah)
+{
+        u32 synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
+        if (IS_CHAN_B(ah->curchan))
+                synthDelay = (4 * synthDelay) / 22;
+        else
+                synthDelay /= 10;
+
+        udelay(synthDelay + BASE_ACTIVATE_DELAY);
+
+        REG_WRITE(ah, AR_PHY_RFBUS_REQ, 0);
+}
+
+static void ar5008_hw_enable_rfkill(struct ath_hw *ah)
+{
+        REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
+                    AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
+
+        REG_CLR_BIT(ah, AR_GPIO_INPUT_MUX2,
+                    AR_GPIO_INPUT_MUX2_RFSILENT);
+
+        ath9k_hw_cfg_gpio_input(ah, ah->rfkill_gpio);
+        REG_SET_BIT(ah, AR_PHY_TEST, RFSILENT_BB);
+}
+
+static void ar5008_restore_chainmask(struct ath_hw *ah)
+{
+        int rx_chainmask = ah->rxchainmask;
+
+        if ((rx_chainmask == 0x5) || (rx_chainmask == 0x3)) {
+                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx_chainmask);
+                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx_chainmask);
+        }
+}
+
+static void ar5008_set_diversity(struct ath_hw *ah, bool value)
+{
+        u32 v = REG_READ(ah, AR_PHY_CCK_DETECT);
+        if (value)
+                v |= AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
+        else
+                v &= ~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
+        REG_WRITE(ah, AR_PHY_CCK_DETECT, v);
+}
+
+static u32 ar9100_hw_compute_pll_control(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        if (chan && IS_CHAN_5GHZ(chan))
+                return 0x1450;
+        return 0x1458;
+}
+
+static u32 ar9160_hw_compute_pll_control(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        u32 pll;
+
+        pll = SM(0x5, AR_RTC_9160_PLL_REFDIV);
+
+        if (chan && IS_CHAN_HALF_RATE(chan))
+                pll |= SM(0x1, AR_RTC_9160_PLL_CLKSEL);
+        else if (chan && IS_CHAN_QUARTER_RATE(chan))
+                pll |= SM(0x2, AR_RTC_9160_PLL_CLKSEL);
+
+        if (chan && IS_CHAN_5GHZ(chan))
+                pll |= SM(0x50, AR_RTC_9160_PLL_DIV);
+        else
+                pll |= SM(0x58, AR_RTC_9160_PLL_DIV);
+
+        return pll;
+}
+
+static u32 ar5008_hw_compute_pll_control(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        u32 pll;
+
+        pll = AR_RTC_PLL_REFDIV_5 | AR_RTC_PLL_DIV2;
+
+        if (chan && IS_CHAN_HALF_RATE(chan))
+                pll |= SM(0x1, AR_RTC_PLL_CLKSEL);
+        else if (chan && IS_CHAN_QUARTER_RATE(chan))
+                pll |= SM(0x2, AR_RTC_PLL_CLKSEL);
+
+        if (chan && IS_CHAN_5GHZ(chan))
+                pll |= SM(0xa, AR_RTC_PLL_DIV);
+        else
+                pll |= SM(0xb, AR_RTC_PLL_DIV);
+
+        return pll;
+}
+
+static bool ar5008_hw_ani_control(struct ath_hw *ah,
+                                  enum ath9k_ani_cmd cmd, int param)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        switch (cmd & ah->ani_function) {
+        case ATH9K_ANI_NOISE_IMMUNITY_LEVEL:{
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(ah->totalSizeDesired)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
+                        return false;
+                }
+
+                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
+                              AR_PHY_DESIRED_SZ_TOT_DES,
+                              ah->totalSizeDesired[level]);
+                REG_RMW_FIELD(ah, AR_PHY_AGC_CTL1,
+                              AR_PHY_AGC_CTL1_COARSE_LOW,
+                              ah->coarse_low[level]);
+                REG_RMW_FIELD(ah, AR_PHY_AGC_CTL1,
+                              AR_PHY_AGC_CTL1_COARSE_HIGH,
+                              ah->coarse_high[level]);
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                              AR_PHY_FIND_SIG_FIRPWR,
+                              ah->firpwr[level]);
+
+                if (level > aniState->noiseImmunityLevel)
+                        ah->stats.ast_ani_niup++;
+                else if (level < aniState->noiseImmunityLevel)
+                        ah->stats.ast_ani_nidown++;
+                aniState->noiseImmunityLevel = level;
+                break;
+        }
+        case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
+                const int m1ThreshLow[] = { 127, 50 };
+                const int m2ThreshLow[] = { 127, 40 };
+                const int m1Thresh[] = { 127, 0x4d };
+                const int m2Thresh[] = { 127, 0x40 };
+                const int m2CountThr[] = { 31, 16 };
+                const int m2CountThrLow[] = { 63, 48 };
+                u32 on = param ? 1 : 0;
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M1_THRESH_LOW,
+                              m1ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2_THRESH_LOW,
+                              m2ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M1_THRESH,
+                              m1Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2_THRESH,
+                              m2Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2COUNT_THR,
+                              m2CountThr[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW,
+                              m2CountThrLow[on]);
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW,
+                              m1ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW,
+                              m2ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH,
+                              m1Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH,
+                              m2Thresh[on]);
+
+                if (on)
+                        REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+                else
+                        REG_CLR_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+
+                if (!on != aniState->ofdmWeakSigDetectOff) {
+                        if (on)
+                                ah->stats.ast_ani_ofdmon++;
+                        else
+                                ah->stats.ast_ani_ofdmoff++;
+                        aniState->ofdmWeakSigDetectOff = !on;
+                }
+                break;
+        }
+        case ATH9K_ANI_CCK_WEAK_SIGNAL_THR:{
+                const int weakSigThrCck[] = { 8, 6 };
+                u32 high = param ? 1 : 0;
+
+                REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT,
+                              AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK,
+                              weakSigThrCck[high]);
+                if (high != aniState->cckWeakSigThreshold) {
+                        if (high)
+                                ah->stats.ast_ani_cckhigh++;
+                        else
+                                ah->stats.ast_ani_ccklow++;
+                        aniState->cckWeakSigThreshold = high;
+                }
+                break;
+        }
+        case ATH9K_ANI_FIRSTEP_LEVEL:{
+                const int firstep[] = { 0, 4, 8 };
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(firstep)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(firstep));
+                        return false;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                              AR_PHY_FIND_SIG_FIRSTEP,
+                              firstep[level]);
+                if (level > aniState->firstepLevel)
+                        ah->stats.ast_ani_stepup++;
+                else if (level < aniState->firstepLevel)
+                        ah->stats.ast_ani_stepdown++;
+                aniState->firstepLevel = level;
+                break;
+        }
+        case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
+                const int cycpwrThr1[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(cycpwrThr1)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(cycpwrThr1));
+                        return false;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_TIMING5,
+                              AR_PHY_TIMING5_CYCPWR_THR1,
+                              cycpwrThr1[level]);
+                if (level > aniState->spurImmunityLevel)
+                        ah->stats.ast_ani_spurup++;
+                else if (level < aniState->spurImmunityLevel)
+                        ah->stats.ast_ani_spurdown++;
+                aniState->spurImmunityLevel = level;
+                break;
+        }
+        case ATH9K_ANI_PRESENT:
+                break;
+        default:
+                ath_print(common, ATH_DBG_ANI,
+                          "invalid cmd %u\n", cmd);
+                return false;
+        }
+
+        ath_print(common, ATH_DBG_ANI, "ANI parameters:\n");
+        ath_print(common, ATH_DBG_ANI,
+                  "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
+                  "ofdmWeakSigDetectOff=%d\n",
+                  aniState->noiseImmunityLevel,
+                  aniState->spurImmunityLevel,
+                  !aniState->ofdmWeakSigDetectOff);
+        ath_print(common, ATH_DBG_ANI,
+                  "cckWeakSigThreshold=%d, "
+                  "firstepLevel=%d, listenTime=%d\n",
+                  aniState->cckWeakSigThreshold,
+                  aniState->firstepLevel,
+                  aniState->listenTime);
+        ath_print(common, ATH_DBG_ANI,
+                "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
+                aniState->cycleCount,
+                aniState->ofdmPhyErrCount,
+                aniState->cckPhyErrCount);
+
+        return true;
+}
+
+static void ar5008_hw_do_getnf(struct ath_hw *ah,
+                              int16_t nfarray[NUM_NF_READINGS])
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int16_t nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CCA), AR_PHY_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 0] is %d\n", nf);
+        nfarray[0] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CH1_CCA), AR_PHY_CH1_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 1] is %d\n", nf);
+        nfarray[1] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CH2_CCA), AR_PHY_CH2_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 2] is %d\n", nf);
+        nfarray[2] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR_PHY_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 0] is %d\n", nf);
+        nfarray[3] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA), AR_PHY_CH1_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 1] is %d\n", nf);
+        nfarray[4] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CH2_EXT_CCA), AR_PHY_CH2_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 2] is %d\n", nf);
+        nfarray[5] = nf;
+}
+
+static void ar5008_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath9k_nfcal_hist *h;
+        int i, j;
+        int32_t val;
+        const u32 ar5416_cca_regs[6] = {
+                AR_PHY_CCA,
+                AR_PHY_CH1_CCA,
+                AR_PHY_CH2_CCA,
+                AR_PHY_EXT_CCA,
+                AR_PHY_CH1_EXT_CCA,
+                AR_PHY_CH2_EXT_CCA
+        };
+        u8 chainmask, rx_chain_status;
+
+        rx_chain_status = REG_READ(ah, AR_PHY_RX_CHAINMASK);
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                chainmask = 0x9;
+        else if (AR_SREV_9280(ah) || AR_SREV_9287(ah)) {
+                if ((rx_chain_status & 0x2) || (rx_chain_status & 0x4))
+                        chainmask = 0x1B;
+                else
+                        chainmask = 0x09;
+        } else {
+                if (rx_chain_status & 0x4)
+                        chainmask = 0x3F;
+                else if (rx_chain_status & 0x2)
+                        chainmask = 0x1B;
+                else
+                        chainmask = 0x09;
+        }
+
+        h = ah->nfCalHist;
+
+        for (i = 0; i < NUM_NF_READINGS; i++) {
+                if (chainmask & (1 << i)) {
+                        val = REG_READ(ah, ar5416_cca_regs[i]);
+                        val &= 0xFFFFFE00;
+                        val |= (((u32) (h[i].privNF) << 1) & 0x1ff);
+                        REG_WRITE(ah, ar5416_cca_regs[i], val);
+                }
+        }
+
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_ENABLE_NF);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+
+        for (j = 0; j < 5; j++) {
+                if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
+                     AR_PHY_AGC_CONTROL_NF) == 0)
+                        break;
+                udelay(50);
+        }
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        for (i = 0; i < NUM_NF_READINGS; i++) {
+                if (chainmask & (1 << i)) {
+                        val = REG_READ(ah, ar5416_cca_regs[i]);
+                        val &= 0xFFFFFE00;
+                        val |= (((u32) (-50) << 1) & 0x1ff);
+                        REG_WRITE(ah, ar5416_cca_regs[i], val);
+                }
+        }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+}
+
+void ar5008_hw_attach_phy_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+
+        priv_ops->rf_set_freq = ar5008_hw_set_channel;
+        priv_ops->spur_mitigate_freq = ar5008_hw_spur_mitigate;
+
+        priv_ops->rf_alloc_ext_banks = ar5008_hw_rf_alloc_ext_banks;
+        priv_ops->rf_free_ext_banks = ar5008_hw_rf_free_ext_banks;
+        priv_ops->set_rf_regs = ar5008_hw_set_rf_regs;
+        priv_ops->set_channel_regs = ar5008_hw_set_channel_regs;
+        priv_ops->init_bb = ar5008_hw_init_bb;
+        priv_ops->process_ini = ar5008_hw_process_ini;
+        priv_ops->set_rfmode = ar5008_hw_set_rfmode;
+        priv_ops->mark_phy_inactive = ar5008_hw_mark_phy_inactive;
+        priv_ops->set_delta_slope = ar5008_hw_set_delta_slope;
+        priv_ops->rfbus_req = ar5008_hw_rfbus_req;
+        priv_ops->rfbus_done = ar5008_hw_rfbus_done;
+        priv_ops->enable_rfkill = ar5008_hw_enable_rfkill;
+        priv_ops->restore_chainmask = ar5008_restore_chainmask;
+        priv_ops->set_diversity = ar5008_set_diversity;
+        priv_ops->ani_control = ar5008_hw_ani_control;
+        priv_ops->do_getnf = ar5008_hw_do_getnf;
+        priv_ops->loadnf = ar5008_hw_loadnf;
+
+        if (AR_SREV_9100(ah))
+                priv_ops->compute_pll_control = ar9100_hw_compute_pll_control;
+        else if (AR_SREV_9160_10_OR_LATER(ah))
+                priv_ops->compute_pll_control = ar9160_hw_compute_pll_control;
+        else
+                priv_ops->compute_pll_control = ar5008_hw_compute_pll_control;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9001_initvals.h b/drivers/net/wireless/ath/ath9k/ar9001_initvals.h
new file mode 100644
index 000000000000..0b94bd385b0a
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9001_initvals.h
@@ -0,0 +1,1254 @@
+
+static const u32 ar5416Common_9100[][2] = {
+    { 0x0000000c, 0x00000000 },
+    { 0x00000030, 0x00020015 },
+    { 0x00000034, 0x00000005 },
+    { 0x00000040, 0x00000000 },
+    { 0x00000044, 0x00000008 },
+    { 0x00000048, 0x00000008 },
+    { 0x0000004c, 0x00000010 },
+    { 0x00000050, 0x00000000 },
+    { 0x00000054, 0x0000001f },
+    { 0x00000800, 0x00000000 },
+    { 0x00000804, 0x00000000 },
+    { 0x00000808, 0x00000000 },
+    { 0x0000080c, 0x00000000 },
+    { 0x00000810, 0x00000000 },
+    { 0x00000814, 0x00000000 },
+    { 0x00000818, 0x00000000 },
+    { 0x0000081c, 0x00000000 },
+    { 0x00000820, 0x00000000 },
+    { 0x00000824, 0x00000000 },
+    { 0x00001040, 0x002ffc0f },
+    { 0x00001044, 0x002ffc0f },
+    { 0x00001048, 0x002ffc0f },
+    { 0x0000104c, 0x002ffc0f },
+    { 0x00001050, 0x002ffc0f },
+    { 0x00001054, 0x002ffc0f },
+    { 0x00001058, 0x002ffc0f },
+    { 0x0000105c, 0x002ffc0f },
+    { 0x00001060, 0x002ffc0f },
+    { 0x00001064, 0x002ffc0f },
+    { 0x00001230, 0x00000000 },
+    { 0x00001270, 0x00000000 },
+    { 0x00001038, 0x00000000 },
+    { 0x00001078, 0x00000000 },
+    { 0x000010b8, 0x00000000 },
+    { 0x000010f8, 0x00000000 },
+    { 0x00001138, 0x00000000 },
+    { 0x00001178, 0x00000000 },
+    { 0x000011b8, 0x00000000 },
+    { 0x000011f8, 0x00000000 },
+    { 0x00001238, 0x00000000 },
+    { 0x00001278, 0x00000000 },
+    { 0x000012b8, 0x00000000 },
+    { 0x000012f8, 0x00000000 },
+    { 0x00001338, 0x00000000 },
+    { 0x00001378, 0x00000000 },
+    { 0x000013b8, 0x00000000 },
+    { 0x000013f8, 0x00000000 },
+    { 0x00001438, 0x00000000 },
+    { 0x00001478, 0x00000000 },
+    { 0x000014b8, 0x00000000 },
+    { 0x000014f8, 0x00000000 },
+    { 0x00001538, 0x00000000 },
+    { 0x00001578, 0x00000000 },
+    { 0x000015b8, 0x00000000 },
+    { 0x000015f8, 0x00000000 },
+    { 0x00001638, 0x00000000 },
+    { 0x00001678, 0x00000000 },
+    { 0x000016b8, 0x00000000 },
+    { 0x000016f8, 0x00000000 },
+    { 0x00001738, 0x00000000 },
+    { 0x00001778, 0x00000000 },
+    { 0x000017b8, 0x00000000 },
+    { 0x000017f8, 0x00000000 },
+    { 0x0000103c, 0x00000000 },
+    { 0x0000107c, 0x00000000 },
+    { 0x000010bc, 0x00000000 },
+    { 0x000010fc, 0x00000000 },
+    { 0x0000113c, 0x00000000 },
+    { 0x0000117c, 0x00000000 },
+    { 0x000011bc, 0x00000000 },
+    { 0x000011fc, 0x00000000 },
+    { 0x0000123c, 0x00000000 },
+    { 0x0000127c, 0x00000000 },
+    { 0x000012bc, 0x00000000 },
+    { 0x000012fc, 0x00000000 },
+    { 0x0000133c, 0x00000000 },
+    { 0x0000137c, 0x00000000 },
+    { 0x000013bc, 0x00000000 },
+    { 0x000013fc, 0x00000000 },
+    { 0x0000143c, 0x00000000 },
+    { 0x0000147c, 0x00000000 },
+    { 0x00020010, 0x00000003 },
+    { 0x00020038, 0x000004c2 },
+    { 0x00008004, 0x00000000 },
+    { 0x00008008, 0x00000000 },
+    { 0x0000800c, 0x00000000 },
+    { 0x00008018, 0x00000700 },
+    { 0x00008020, 0x00000000 },
+    { 0x00008038, 0x00000000 },
+    { 0x0000803c, 0x00000000 },
+    { 0x00008048, 0x40000000 },
+    { 0x00008054, 0x00004000 },
+    { 0x00008058, 0x00000000 },
+    { 0x0000805c, 0x000fc78f },
+    { 0x00008060, 0x0000000f },
+    { 0x00008064, 0x00000000 },
+    { 0x000080c0, 0x2a82301a },
+    { 0x000080c4, 0x05dc01e0 },
+    { 0x000080c8, 0x1f402710 },
+    { 0x000080cc, 0x01f40000 },
+    { 0x000080d0, 0x00001e00 },
+    { 0x000080d4, 0x00000000 },
+    { 0x000080d8, 0x00400000 },
+    { 0x000080e0, 0xffffffff },
+    { 0x000080e4, 0x0000ffff },
+    { 0x000080e8, 0x003f3f3f },
+    { 0x000080ec, 0x00000000 },
+    { 0x000080f0, 0x00000000 },
+    { 0x000080f4, 0x00000000 },
+    { 0x000080f8, 0x00000000 },
+    { 0x000080fc, 0x00020000 },
+    { 0x00008100, 0x00020000 },
+    { 0x00008104, 0x00000001 },
+    { 0x00008108, 0x00000052 },
+    { 0x0000810c, 0x00000000 },
+    { 0x00008110, 0x00000168 },
+    { 0x00008118, 0x000100aa },
+    { 0x0000811c, 0x00003210 },
+    { 0x00008120, 0x08f04800 },
+    { 0x00008124, 0x00000000 },
+    { 0x00008128, 0x00000000 },
+    { 0x0000812c, 0x00000000 },
+    { 0x00008130, 0x00000000 },
+    { 0x00008134, 0x00000000 },
+    { 0x00008138, 0x00000000 },
+    { 0x0000813c, 0x00000000 },
+    { 0x00008144, 0x00000000 },
+    { 0x00008168, 0x00000000 },
+    { 0x0000816c, 0x00000000 },
+    { 0x00008170, 0x32143320 },
+    { 0x00008174, 0xfaa4fa50 },
+    { 0x00008178, 0x00000100 },
+    { 0x0000817c, 0x00000000 },
+    { 0x000081c4, 0x00000000 },
+    { 0x000081d0, 0x00003210 },
+    { 0x000081ec, 0x00000000 },
+    { 0x000081f0, 0x00000000 },
+    { 0x000081f4, 0x00000000 },
+    { 0x000081f8, 0x00000000 },
+    { 0x000081fc, 0x00000000 },
+    { 0x00008200, 0x00000000 },
+    { 0x00008204, 0x00000000 },
+    { 0x00008208, 0x00000000 },
+    { 0x0000820c, 0x00000000 },
+    { 0x00008210, 0x00000000 },
+    { 0x00008214, 0x00000000 },
+    { 0x00008218, 0x00000000 },
+    { 0x0000821c, 0x00000000 },
+    { 0x00008220, 0x00000000 },
+    { 0x00008224, 0x00000000 },
+    { 0x00008228, 0x00000000 },
+    { 0x0000822c, 0x00000000 },
+    { 0x00008230, 0x00000000 },
+    { 0x00008234, 0x00000000 },
+    { 0x00008238, 0x00000000 },
+    { 0x0000823c, 0x00000000 },
+    { 0x00008240, 0x00100000 },
+    { 0x00008244, 0x0010f400 },
+    { 0x00008248, 0x00000100 },
+    { 0x0000824c, 0x0001e800 },
+    { 0x00008250, 0x00000000 },
+    { 0x00008254, 0x00000000 },
+    { 0x00008258, 0x00000000 },
+    { 0x0000825c, 0x400000ff },
+    { 0x00008260, 0x00080922 },
+    { 0x00008270, 0x00000000 },
+    { 0x00008274, 0x40000000 },
+    { 0x00008278, 0x003e4180 },
+    { 0x0000827c, 0x00000000 },
+    { 0x00008284, 0x0000002c },
+    { 0x00008288, 0x0000002c },
+    { 0x0000828c, 0x00000000 },
+    { 0x00008294, 0x00000000 },
+    { 0x00008298, 0x00000000 },
+    { 0x00008300, 0x00000000 },
+    { 0x00008304, 0x00000000 },
+    { 0x00008308, 0x00000000 },
+    { 0x0000830c, 0x00000000 },
+    { 0x00008310, 0x00000000 },
+    { 0x00008314, 0x00000000 },
+    { 0x00008318, 0x00000000 },
+    { 0x00008328, 0x00000000 },
+    { 0x0000832c, 0x00000007 },
+    { 0x00008330, 0x00000302 },
+    { 0x00008334, 0x00000e00 },
+    { 0x00008338, 0x00000000 },
+    { 0x0000833c, 0x00000000 },
+    { 0x00008340, 0x000107ff },
+    { 0x00009808, 0x00000000 },
+    { 0x0000980c, 0xad848e19 },
+    { 0x00009810, 0x7d14e000 },
+    { 0x00009814, 0x9c0a9f6b },
+    { 0x0000981c, 0x00000000 },
+    { 0x0000982c, 0x0000a000 },
+    { 0x00009830, 0x00000000 },
+    { 0x0000983c, 0x00200400 },
+    { 0x00009840, 0x206a01ae },
+    { 0x0000984c, 0x1284233c },
+    { 0x00009854, 0x00000859 },
+    { 0x00009900, 0x00000000 },
+    { 0x00009904, 0x00000000 },
+    { 0x00009908, 0x00000000 },
+    { 0x0000990c, 0x00000000 },
+    { 0x0000991c, 0x10000fff },
+    { 0x00009920, 0x05100000 },
+    { 0x0000a920, 0x05100000 },
+    { 0x0000b920, 0x05100000 },
+    { 0x00009928, 0x00000001 },
+    { 0x0000992c, 0x00000004 },
+    { 0x00009934, 0x1e1f2022 },
+    { 0x00009938, 0x0a0b0c0d },
+    { 0x0000993c, 0x00000000 },
+    { 0x00009948, 0x9280b212 },
+    { 0x0000994c, 0x00020028 },
+    { 0x0000c95c, 0x004b6a8e },
+    { 0x0000c968, 0x000003ce },
+    { 0x00009970, 0x190fb515 },
+    { 0x00009974, 0x00000000 },
+    { 0x00009978, 0x00000001 },
+    { 0x0000997c, 0x00000000 },
+    { 0x00009980, 0x00000000 },
+    { 0x00009984, 0x00000000 },
+    { 0x00009988, 0x00000000 },
+    { 0x0000998c, 0x00000000 },
+    { 0x00009990, 0x00000000 },
+    { 0x00009994, 0x00000000 },
+    { 0x00009998, 0x00000000 },
+    { 0x0000999c, 0x00000000 },
+    { 0x000099a0, 0x00000000 },
+    { 0x000099a4, 0x00000001 },
+    { 0x000099a8, 0x201fff00 },
+    { 0x000099ac, 0x006f0000 },
+    { 0x000099b0, 0x03051000 },
+    { 0x000099dc, 0x00000000 },
+    { 0x000099e0, 0x00000200 },
+    { 0x000099e4, 0xaaaaaaaa },
+    { 0x000099e8, 0x3c466478 },
+    { 0x000099ec, 0x0cc80caa },
+    { 0x000099fc, 0x00001042 },
+    { 0x00009b00, 0x00000000 },
+    { 0x00009b04, 0x00000001 },
+    { 0x00009b08, 0x00000002 },
+    { 0x00009b0c, 0x00000003 },
+    { 0x00009b10, 0x00000004 },
+    { 0x00009b14, 0x00000005 },
+    { 0x00009b18, 0x00000008 },
+    { 0x00009b1c, 0x00000009 },
+    { 0x00009b20, 0x0000000a },
+    { 0x00009b24, 0x0000000b },
+    { 0x00009b28, 0x0000000c },
+    { 0x00009b2c, 0x0000000d },
+    { 0x00009b30, 0x00000010 },
+    { 0x00009b34, 0x00000011 },
+    { 0x00009b38, 0x00000012 },
+    { 0x00009b3c, 0x00000013 },
+    { 0x00009b40, 0x00000014 },
+    { 0x00009b44, 0x00000015 },
+    { 0x00009b48, 0x00000018 },
+    { 0x00009b4c, 0x00000019 },
+    { 0x00009b50, 0x0000001a },
+    { 0x00009b54, 0x0000001b },
+    { 0x00009b58, 0x0000001c },
+    { 0x00009b5c, 0x0000001d },
+    { 0x00009b60, 0x00000020 },
+    { 0x00009b64, 0x00000021 },
+    { 0x00009b68, 0x00000022 },
+    { 0x00009b6c, 0x00000023 },
+    { 0x00009b70, 0x00000024 },
+    { 0x00009b74, 0x00000025 },
+    { 0x00009b78, 0x00000028 },
+    { 0x00009b7c, 0x00000029 },
+    { 0x00009b80, 0x0000002a },
+    { 0x00009b84, 0x0000002b },
+    { 0x00009b88, 0x0000002c },
+    { 0x00009b8c, 0x0000002d },
+    { 0x00009b90, 0x00000030 },
+    { 0x00009b94, 0x00000031 },
+    { 0x00009b98, 0x00000032 },
+    { 0x00009b9c, 0x00000033 },
+    { 0x00009ba0, 0x00000034 },
+    { 0x00009ba4, 0x00000035 },
+    { 0x00009ba8, 0x00000035 },
+    { 0x00009bac, 0x00000035 },
+    { 0x00009bb0, 0x00000035 },
+    { 0x00009bb4, 0x00000035 },
+    { 0x00009bb8, 0x00000035 },
+    { 0x00009bbc, 0x00000035 },
+    { 0x00009bc0, 0x00000035 },
+    { 0x00009bc4, 0x00000035 },
+    { 0x00009bc8, 0x00000035 },
+    { 0x00009bcc, 0x00000035 },
+    { 0x00009bd0, 0x00000035 },
+    { 0x00009bd4, 0x00000035 },
+    { 0x00009bd8, 0x00000035 },
+    { 0x00009bdc, 0x00000035 },
+    { 0x00009be0, 0x00000035 },
+    { 0x00009be4, 0x00000035 },
+    { 0x00009be8, 0x00000035 },
+    { 0x00009bec, 0x00000035 },
+    { 0x00009bf0, 0x00000035 },
+    { 0x00009bf4, 0x00000035 },
+    { 0x00009bf8, 0x00000010 },
+    { 0x00009bfc, 0x0000001a },
+    { 0x0000a210, 0x40806333 },
+    { 0x0000a214, 0x00106c10 },
+    { 0x0000a218, 0x009c4060 },
+    { 0x0000a220, 0x018830c6 },
+    { 0x0000a224, 0x00000400 },
+    { 0x0000a228, 0x001a0bb5 },
+    { 0x0000a22c, 0x00000000 },
+    { 0x0000a234, 0x20202020 },
+    { 0x0000a238, 0x20202020 },
+    { 0x0000a23c, 0x13c889ae },
+    { 0x0000a240, 0x38490a20 },
+    { 0x0000a244, 0x00007bb6 },
+    { 0x0000a248, 0x0fff3ffc },
+    { 0x0000a24c, 0x00000001 },
+    { 0x0000a250, 0x0000a000 },
+    { 0x0000a254, 0x00000000 },
+    { 0x0000a258, 0x0cc75380 },
+    { 0x0000a25c, 0x0f0f0f01 },
+    { 0x0000a260, 0xdfa91f01 },
+    { 0x0000a268, 0x00000001 },
+    { 0x0000a26c, 0x0ebae9c6 },
+    { 0x0000b26c, 0x0ebae9c6 },
+    { 0x0000c26c, 0x0ebae9c6 },
+    { 0x0000d270, 0x00820820 },
+    { 0x0000a278, 0x1ce739ce },
+    { 0x0000a27c, 0x050701ce },
+    { 0x0000a338, 0x00000000 },
+    { 0x0000a33c, 0x00000000 },
+    { 0x0000a340, 0x00000000 },
+    { 0x0000a344, 0x00000000 },
+    { 0x0000a348, 0x3fffffff },
+    { 0x0000a34c, 0x3fffffff },
+    { 0x0000a350, 0x3fffffff },
+    { 0x0000a354, 0x0003ffff },
+    { 0x0000a358, 0x79a8aa33 },
+    { 0x0000d35c, 0x07ffffef },
+    { 0x0000d360, 0x0fffffe7 },
+    { 0x0000d364, 0x17ffffe5 },
+    { 0x0000d368, 0x1fffffe4 },
+    { 0x0000d36c, 0x37ffffe3 },
+    { 0x0000d370, 0x3fffffe3 },
+    { 0x0000d374, 0x57ffffe3 },
+    { 0x0000d378, 0x5fffffe2 },
+    { 0x0000d37c, 0x7fffffe2 },
+    { 0x0000d380, 0x7f3c7bba },
+    { 0x0000d384, 0xf3307ff0 },
+    { 0x0000a388, 0x0c000000 },
+    { 0x0000a38c, 0x20202020 },
+    { 0x0000a390, 0x20202020 },
+    { 0x0000a394, 0x1ce739ce },
+    { 0x0000a398, 0x000001ce },
+    { 0x0000a39c, 0x00000001 },
+    { 0x0000a3a0, 0x00000000 },
+    { 0x0000a3a4, 0x00000000 },
+    { 0x0000a3a8, 0x00000000 },
+    { 0x0000a3ac, 0x00000000 },
+    { 0x0000a3b0, 0x00000000 },
+    { 0x0000a3b4, 0x00000000 },
+    { 0x0000a3b8, 0x00000000 },
+    { 0x0000a3bc, 0x00000000 },
+    { 0x0000a3c0, 0x00000000 },
+    { 0x0000a3c4, 0x00000000 },
+    { 0x0000a3c8, 0x00000246 },
+    { 0x0000a3cc, 0x20202020 },
+    { 0x0000a3d0, 0x20202020 },
+    { 0x0000a3d4, 0x20202020 },
+    { 0x0000a3dc, 0x1ce739ce },
+    { 0x0000a3e0, 0x000001ce },
+};
+
+static const u32 ar5416Bank0_9100[][2] = {
+    { 0x000098b0, 0x1e5795e5 },
+    { 0x000098e0, 0x02008020 },
+};
+
+static const u32 ar5416BB_RfGain_9100[][3] = {
+    { 0x00009a00, 0x00000000, 0x00000000 },
+    { 0x00009a04, 0x00000040, 0x00000040 },
+    { 0x00009a08, 0x00000080, 0x00000080 },
+    { 0x00009a0c, 0x000001a1, 0x00000141 },
+    { 0x00009a10, 0x000001e1, 0x00000181 },
+    { 0x00009a14, 0x00000021, 0x000001c1 },
+    { 0x00009a18, 0x00000061, 0x00000001 },
+    { 0x00009a1c, 0x00000168, 0x00000041 },
+    { 0x00009a20, 0x000001a8, 0x000001a8 },
+    { 0x00009a24, 0x000001e8, 0x000001e8 },
+    { 0x00009a28, 0x00000028, 0x00000028 },
+    { 0x00009a2c, 0x00000068, 0x00000068 },
+    { 0x00009a30, 0x00000189, 0x000000a8 },
+    { 0x00009a34, 0x000001c9, 0x00000169 },
+    { 0x00009a38, 0x00000009, 0x000001a9 },
+    { 0x00009a3c, 0x00000049, 0x000001e9 },
+    { 0x00009a40, 0x00000089, 0x00000029 },
+    { 0x00009a44, 0x00000170, 0x00000069 },
+    { 0x00009a48, 0x000001b0, 0x00000190 },
+    { 0x00009a4c, 0x000001f0, 0x000001d0 },
+    { 0x00009a50, 0x00000030, 0x00000010 },
+    { 0x00009a54, 0x00000070, 0x00000050 },
+    { 0x00009a58, 0x00000191, 0x00000090 },
+    { 0x00009a5c, 0x000001d1, 0x00000151 },
+    { 0x00009a60, 0x00000011, 0x00000191 },
+    { 0x00009a64, 0x00000051, 0x000001d1 },
+    { 0x00009a68, 0x00000091, 0x00000011 },
+    { 0x00009a6c, 0x000001b8, 0x00000051 },
+    { 0x00009a70, 0x000001f8, 0x00000198 },
+    { 0x00009a74, 0x00000038, 0x000001d8 },
+    { 0x00009a78, 0x00000078, 0x00000018 },
+    { 0x00009a7c, 0x00000199, 0x00000058 },
+    { 0x00009a80, 0x000001d9, 0x00000098 },
+    { 0x00009a84, 0x00000019, 0x00000159 },
+    { 0x00009a88, 0x00000059, 0x00000199 },
+    { 0x00009a8c, 0x00000099, 0x000001d9 },
+    { 0x00009a90, 0x000000d9, 0x00000019 },
+    { 0x00009a94, 0x000000f9, 0x00000059 },
+    { 0x00009a98, 0x000000f9, 0x00000099 },
+    { 0x00009a9c, 0x000000f9, 0x000000d9 },
+    { 0x00009aa0, 0x000000f9, 0x000000f9 },
+    { 0x00009aa4, 0x000000f9, 0x000000f9 },
+    { 0x00009aa8, 0x000000f9, 0x000000f9 },
+    { 0x00009aac, 0x000000f9, 0x000000f9 },
+    { 0x00009ab0, 0x000000f9, 0x000000f9 },
+    { 0x00009ab4, 0x000000f9, 0x000000f9 },
+    { 0x00009ab8, 0x000000f9, 0x000000f9 },
+    { 0x00009abc, 0x000000f9, 0x000000f9 },
+    { 0x00009ac0, 0x000000f9, 0x000000f9 },
+    { 0x00009ac4, 0x000000f9, 0x000000f9 },
+    { 0x00009ac8, 0x000000f9, 0x000000f9 },
+    { 0x00009acc, 0x000000f9, 0x000000f9 },
+    { 0x00009ad0, 0x000000f9, 0x000000f9 },
+    { 0x00009ad4, 0x000000f9, 0x000000f9 },
+    { 0x00009ad8, 0x000000f9, 0x000000f9 },
+    { 0x00009adc, 0x000000f9, 0x000000f9 },
+    { 0x00009ae0, 0x000000f9, 0x000000f9 },
+    { 0x00009ae4, 0x000000f9, 0x000000f9 },
+    { 0x00009ae8, 0x000000f9, 0x000000f9 },
+    { 0x00009aec, 0x000000f9, 0x000000f9 },
+    { 0x00009af0, 0x000000f9, 0x000000f9 },
+    { 0x00009af4, 0x000000f9, 0x000000f9 },
+    { 0x00009af8, 0x000000f9, 0x000000f9 },
+    { 0x00009afc, 0x000000f9, 0x000000f9 },
+};
+
+static const u32 ar5416Bank1_9100[][2] = {
+    { 0x000098b0, 0x02108421},
+    { 0x000098ec, 0x00000008},
+};
+
+static const u32 ar5416Bank2_9100[][2] = {
+    { 0x000098b0, 0x0e73ff17},
+    { 0x000098e0, 0x00000420},
+};
+
+static const u32 ar5416Bank3_9100[][3] = {
+    { 0x000098f0, 0x01400018, 0x01c00018 },
+};
+
+static const u32 ar5416Bank6_9100[][3] = {
+
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x004210a2, 0x004210a2 },
+    { 0x0000989c, 0x0014000f, 0x0014000f },
+    { 0x0000989c, 0x00c40002, 0x00c40002 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x000180d6, 0x000180d6 },
+    { 0x0000989c, 0x0000c0aa, 0x0000c0aa },
+    { 0x0000989c, 0x000000b1, 0x000000b1 },
+    { 0x0000989c, 0x00002000, 0x00002000 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+
+static const u32 ar5416Bank6TPC_9100[][3] = {
+
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x00423022, 0x00423022 },
+    { 0x0000989c, 0x2014008f, 0x2014008f },
+    { 0x0000989c, 0x00c40002, 0x00c40002 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x0001805e, 0x0001805e },
+    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
+    { 0x0000989c, 0x000000e1, 0x000000e1 },
+    { 0x0000989c, 0x00007080, 0x00007080 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+static const u32 ar5416Bank7_9100[][2] = {
+    { 0x0000989c, 0x00000500 },
+    { 0x0000989c, 0x00000800 },
+    { 0x000098cc, 0x0000000e },
+};
+
+static const u32 ar5416Addac_9100[][2] = {
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000010 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x000000c0 },
+    {0x0000989c, 0x00000015 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x0000989c, 0x00000000 },
+    {0x000098cc, 0x00000000 },
+};
+
+static const u32 ar5416Modes_9160[][6] = {
+    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
+    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
+    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
+    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
+    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
+    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
+    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
+    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
+    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
+    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
+    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
+    { 0x00009844, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0, 0x037216a0 },
+    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
+    { 0x00009850, 0x6c48b4e2, 0x6c48b4e2, 0x6c48b0e2, 0x6c48b0e2, 0x6c48b0e2 },
+    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e },
+    { 0x0000985c, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e },
+    { 0x00009860, 0x00048d18, 0x00048d18, 0x00048d20, 0x00048d20, 0x00048d18 },
+    { 0x0000c864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
+    { 0x00009868, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0 },
+    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
+    { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
+    { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
+    { 0x00009924, 0xd00a8a07, 0xd00a8a07, 0xd00a8a0d, 0xd00a8a0d, 0xd00a8a0d },
+    { 0x00009944, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020 },
+    { 0x00009960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
+    { 0x0000a960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
+    { 0x0000b960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
+    { 0x00009964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, 0x00001120 },
+    { 0x0000c968, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce, 0x000003ce },
+    { 0x0000c9bc, 0x001a0600, 0x001a0600, 0x001a0c00, 0x001a0c00, 0x001a0c00 },
+    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
+    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
+    { 0x000099c8, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329 },
+    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
+    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
+    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
+    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
+    { 0x0000a20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000b20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000c20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
+    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
+    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
+    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
+    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
+    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
+    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
+    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
+    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
+    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
+    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
+    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
+    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
+    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
+    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
+};
+
+static const u32 ar5416Common_9160[][2] = {
+    { 0x0000000c, 0x00000000 },
+    { 0x00000030, 0x00020015 },
+    { 0x00000034, 0x00000005 },
+    { 0x00000040, 0x00000000 },
+    { 0x00000044, 0x00000008 },
+    { 0x00000048, 0x00000008 },
+    { 0x0000004c, 0x00000010 },
+    { 0x00000050, 0x00000000 },
+    { 0x00000054, 0x0000001f },
+    { 0x00000800, 0x00000000 },
+    { 0x00000804, 0x00000000 },
+    { 0x00000808, 0x00000000 },
+    { 0x0000080c, 0x00000000 },
+    { 0x00000810, 0x00000000 },
+    { 0x00000814, 0x00000000 },
+    { 0x00000818, 0x00000000 },
+    { 0x0000081c, 0x00000000 },
+    { 0x00000820, 0x00000000 },
+    { 0x00000824, 0x00000000 },
+    { 0x00001040, 0x002ffc0f },
+    { 0x00001044, 0x002ffc0f },
+    { 0x00001048, 0x002ffc0f },
+    { 0x0000104c, 0x002ffc0f },
+    { 0x00001050, 0x002ffc0f },
+    { 0x00001054, 0x002ffc0f },
+    { 0x00001058, 0x002ffc0f },
+    { 0x0000105c, 0x002ffc0f },
+    { 0x00001060, 0x002ffc0f },
+    { 0x00001064, 0x002ffc0f },
+    { 0x00001230, 0x00000000 },
+    { 0x00001270, 0x00000000 },
+    { 0x00001038, 0x00000000 },
+    { 0x00001078, 0x00000000 },
+    { 0x000010b8, 0x00000000 },
+    { 0x000010f8, 0x00000000 },
+    { 0x00001138, 0x00000000 },
+    { 0x00001178, 0x00000000 },
+    { 0x000011b8, 0x00000000 },
+    { 0x000011f8, 0x00000000 },
+    { 0x00001238, 0x00000000 },
+    { 0x00001278, 0x00000000 },
+    { 0x000012b8, 0x00000000 },
+    { 0x000012f8, 0x00000000 },
+    { 0x00001338, 0x00000000 },
+    { 0x00001378, 0x00000000 },
+    { 0x000013b8, 0x00000000 },
+    { 0x000013f8, 0x00000000 },
+    { 0x00001438, 0x00000000 },
+    { 0x00001478, 0x00000000 },
+    { 0x000014b8, 0x00000000 },
+    { 0x000014f8, 0x00000000 },
+    { 0x00001538, 0x00000000 },
+    { 0x00001578, 0x00000000 },
+    { 0x000015b8, 0x00000000 },
+    { 0x000015f8, 0x00000000 },
+    { 0x00001638, 0x00000000 },
+    { 0x00001678, 0x00000000 },
+    { 0x000016b8, 0x00000000 },
+    { 0x000016f8, 0x00000000 },
+    { 0x00001738, 0x00000000 },
+    { 0x00001778, 0x00000000 },
+    { 0x000017b8, 0x00000000 },
+    { 0x000017f8, 0x00000000 },
+    { 0x0000103c, 0x00000000 },
+    { 0x0000107c, 0x00000000 },
+    { 0x000010bc, 0x00000000 },
+    { 0x000010fc, 0x00000000 },
+    { 0x0000113c, 0x00000000 },
+    { 0x0000117c, 0x00000000 },
+    { 0x000011bc, 0x00000000 },
+    { 0x000011fc, 0x00000000 },
+    { 0x0000123c, 0x00000000 },
+    { 0x0000127c, 0x00000000 },
+    { 0x000012bc, 0x00000000 },
+    { 0x000012fc, 0x00000000 },
+    { 0x0000133c, 0x00000000 },
+    { 0x0000137c, 0x00000000 },
+    { 0x000013bc, 0x00000000 },
+    { 0x000013fc, 0x00000000 },
+    { 0x0000143c, 0x00000000 },
+    { 0x0000147c, 0x00000000 },
+    { 0x00004030, 0x00000002 },
+    { 0x0000403c, 0x00000002 },
+    { 0x00007010, 0x00000020 },
+    { 0x00007038, 0x000004c2 },
+    { 0x00008004, 0x00000000 },
+    { 0x00008008, 0x00000000 },
+    { 0x0000800c, 0x00000000 },
+    { 0x00008018, 0x00000700 },
+    { 0x00008020, 0x00000000 },
+    { 0x00008038, 0x00000000 },
+    { 0x0000803c, 0x00000000 },
+    { 0x00008048, 0x40000000 },
+    { 0x00008054, 0x00000000 },
+    { 0x00008058, 0x00000000 },
+    { 0x0000805c, 0x000fc78f },
+    { 0x00008060, 0x0000000f },
+    { 0x00008064, 0x00000000 },
+    { 0x000080c0, 0x2a82301a },
+    { 0x000080c4, 0x05dc01e0 },
+    { 0x000080c8, 0x1f402710 },
+    { 0x000080cc, 0x01f40000 },
+    { 0x000080d0, 0x00001e00 },
+    { 0x000080d4, 0x00000000 },
+    { 0x000080d8, 0x00400000 },
+    { 0x000080e0, 0xffffffff },
+    { 0x000080e4, 0x0000ffff },
+    { 0x000080e8, 0x003f3f3f },
+    { 0x000080ec, 0x00000000 },
+    { 0x000080f0, 0x00000000 },
+    { 0x000080f4, 0x00000000 },
+    { 0x000080f8, 0x00000000 },
+    { 0x000080fc, 0x00020000 },
+    { 0x00008100, 0x00020000 },
+    { 0x00008104, 0x00000001 },
+    { 0x00008108, 0x00000052 },
+    { 0x0000810c, 0x00000000 },
+    { 0x00008110, 0x00000168 },
+    { 0x00008118, 0x000100aa },
+    { 0x0000811c, 0x00003210 },
+    { 0x00008120, 0x08f04800 },
+    { 0x00008124, 0x00000000 },
+    { 0x00008128, 0x00000000 },
+    { 0x0000812c, 0x00000000 },
+    { 0x00008130, 0x00000000 },
+    { 0x00008134, 0x00000000 },
+    { 0x00008138, 0x00000000 },
+    { 0x0000813c, 0x00000000 },
+    { 0x00008144, 0xffffffff },
+    { 0x00008168, 0x00000000 },
+    { 0x0000816c, 0x00000000 },
+    { 0x00008170, 0x32143320 },
+    { 0x00008174, 0xfaa4fa50 },
+    { 0x00008178, 0x00000100 },
+    { 0x0000817c, 0x00000000 },
+    { 0x000081c4, 0x00000000 },
+    { 0x000081d0, 0x00003210 },
+    { 0x000081ec, 0x00000000 },
+    { 0x000081f0, 0x00000000 },
+    { 0x000081f4, 0x00000000 },
+    { 0x000081f8, 0x00000000 },
+    { 0x000081fc, 0x00000000 },
+    { 0x00008200, 0x00000000 },
+    { 0x00008204, 0x00000000 },
+    { 0x00008208, 0x00000000 },
+    { 0x0000820c, 0x00000000 },
+    { 0x00008210, 0x00000000 },
+    { 0x00008214, 0x00000000 },
+    { 0x00008218, 0x00000000 },
+    { 0x0000821c, 0x00000000 },
+    { 0x00008220, 0x00000000 },
+    { 0x00008224, 0x00000000 },
+    { 0x00008228, 0x00000000 },
+    { 0x0000822c, 0x00000000 },
+    { 0x00008230, 0x00000000 },
+    { 0x00008234, 0x00000000 },
+    { 0x00008238, 0x00000000 },
+    { 0x0000823c, 0x00000000 },
+    { 0x00008240, 0x00100000 },
+    { 0x00008244, 0x0010f400 },
+    { 0x00008248, 0x00000100 },
+    { 0x0000824c, 0x0001e800 },
+    { 0x00008250, 0x00000000 },
+    { 0x00008254, 0x00000000 },
+    { 0x00008258, 0x00000000 },
+    { 0x0000825c, 0x400000ff },
+    { 0x00008260, 0x00080922 },
+    { 0x00008270, 0x00000000 },
+    { 0x00008274, 0x40000000 },
+    { 0x00008278, 0x003e4180 },
+    { 0x0000827c, 0x00000000 },
+    { 0x00008284, 0x0000002c },
+    { 0x00008288, 0x0000002c },
+    { 0x0000828c, 0x00000000 },
+    { 0x00008294, 0x00000000 },
+    { 0x00008298, 0x00000000 },
+    { 0x00008300, 0x00000000 },
+    { 0x00008304, 0x00000000 },
+    { 0x00008308, 0x00000000 },
+    { 0x0000830c, 0x00000000 },
+    { 0x00008310, 0x00000000 },
+    { 0x00008314, 0x00000000 },
+    { 0x00008318, 0x00000000 },
+    { 0x00008328, 0x00000000 },
+    { 0x0000832c, 0x00000007 },
+    { 0x00008330, 0x00000302 },
+    { 0x00008334, 0x00000e00 },
+    { 0x00008338, 0x00ff0000 },
+    { 0x0000833c, 0x00000000 },
+    { 0x00008340, 0x000107ff },
+    { 0x00009808, 0x00000000 },
+    { 0x0000980c, 0xad848e19 },
+    { 0x00009810, 0x7d14e000 },
+    { 0x00009814, 0x9c0a9f6b },
+    { 0x0000981c, 0x00000000 },
+    { 0x0000982c, 0x0000a000 },
+    { 0x00009830, 0x00000000 },
+    { 0x0000983c, 0x00200400 },
+    { 0x00009840, 0x206a01ae },
+    { 0x0000984c, 0x1284233c },
+    { 0x00009854, 0x00000859 },
+    { 0x00009900, 0x00000000 },
+    { 0x00009904, 0x00000000 },
+    { 0x00009908, 0x00000000 },
+    { 0x0000990c, 0x00000000 },
+    { 0x0000991c, 0x10000fff },
+    { 0x00009920, 0x05100000 },
+    { 0x0000a920, 0x05100000 },
+    { 0x0000b920, 0x05100000 },
+    { 0x00009928, 0x00000001 },
+    { 0x0000992c, 0x00000004 },
+    { 0x00009934, 0x1e1f2022 },
+    { 0x00009938, 0x0a0b0c0d },
+    { 0x0000993c, 0x00000000 },
+    { 0x00009948, 0x9280b212 },
+    { 0x0000994c, 0x00020028 },
+    { 0x00009954, 0x5f3ca3de },
+    { 0x00009958, 0x2108ecff },
+    { 0x00009940, 0x00750604 },
+    { 0x0000c95c, 0x004b6a8e },
+    { 0x00009970, 0x190fb515 },
+    { 0x00009974, 0x00000000 },
+    { 0x00009978, 0x00000001 },
+    { 0x0000997c, 0x00000000 },
+    { 0x00009980, 0x00000000 },
+    { 0x00009984, 0x00000000 },
+    { 0x00009988, 0x00000000 },
+    { 0x0000998c, 0x00000000 },
+    { 0x00009990, 0x00000000 },
+    { 0x00009994, 0x00000000 },
+    { 0x00009998, 0x00000000 },
+    { 0x0000999c, 0x00000000 },
+    { 0x000099a0, 0x00000000 },
+    { 0x000099a4, 0x00000001 },
+    { 0x000099a8, 0x201fff00 },
+    { 0x000099ac, 0x006f0000 },
+    { 0x000099b0, 0x03051000 },
+    { 0x000099dc, 0x00000000 },
+    { 0x000099e0, 0x00000200 },
+    { 0x000099e4, 0xaaaaaaaa },
+    { 0x000099e8, 0x3c466478 },
+    { 0x000099ec, 0x0cc80caa },
+    { 0x000099fc, 0x00001042 },
+    { 0x00009b00, 0x00000000 },
+    { 0x00009b04, 0x00000001 },
+    { 0x00009b08, 0x00000002 },
+    { 0x00009b0c, 0x00000003 },
+    { 0x00009b10, 0x00000004 },
+    { 0x00009b14, 0x00000005 },
+    { 0x00009b18, 0x00000008 },
+    { 0x00009b1c, 0x00000009 },
+    { 0x00009b20, 0x0000000a },
+    { 0x00009b24, 0x0000000b },
+    { 0x00009b28, 0x0000000c },
+    { 0x00009b2c, 0x0000000d },
+    { 0x00009b30, 0x00000010 },
+    { 0x00009b34, 0x00000011 },
+    { 0x00009b38, 0x00000012 },
+    { 0x00009b3c, 0x00000013 },
+    { 0x00009b40, 0x00000014 },
+    { 0x00009b44, 0x00000015 },
+    { 0x00009b48, 0x00000018 },
+    { 0x00009b4c, 0x00000019 },
+    { 0x00009b50, 0x0000001a },
+    { 0x00009b54, 0x0000001b },
+    { 0x00009b58, 0x0000001c },
+    { 0x00009b5c, 0x0000001d },
+    { 0x00009b60, 0x00000020 },
+    { 0x00009b64, 0x00000021 },
+    { 0x00009b68, 0x00000022 },
+    { 0x00009b6c, 0x00000023 },
+    { 0x00009b70, 0x00000024 },
+    { 0x00009b74, 0x00000025 },
+    { 0x00009b78, 0x00000028 },
+    { 0x00009b7c, 0x00000029 },
+    { 0x00009b80, 0x0000002a },
+    { 0x00009b84, 0x0000002b },
+    { 0x00009b88, 0x0000002c },
+    { 0x00009b8c, 0x0000002d },
+    { 0x00009b90, 0x00000030 },
+    { 0x00009b94, 0x00000031 },
+    { 0x00009b98, 0x00000032 },
+    { 0x00009b9c, 0x00000033 },
+    { 0x00009ba0, 0x00000034 },
+    { 0x00009ba4, 0x00000035 },
+    { 0x00009ba8, 0x00000035 },
+    { 0x00009bac, 0x00000035 },
+    { 0x00009bb0, 0x00000035 },
+    { 0x00009bb4, 0x00000035 },
+    { 0x00009bb8, 0x00000035 },
+    { 0x00009bbc, 0x00000035 },
+    { 0x00009bc0, 0x00000035 },
+    { 0x00009bc4, 0x00000035 },
+    { 0x00009bc8, 0x00000035 },
+    { 0x00009bcc, 0x00000035 },
+    { 0x00009bd0, 0x00000035 },
+    { 0x00009bd4, 0x00000035 },
+    { 0x00009bd8, 0x00000035 },
+    { 0x00009bdc, 0x00000035 },
+    { 0x00009be0, 0x00000035 },
+    { 0x00009be4, 0x00000035 },
+    { 0x00009be8, 0x00000035 },
+    { 0x00009bec, 0x00000035 },
+    { 0x00009bf0, 0x00000035 },
+    { 0x00009bf4, 0x00000035 },
+    { 0x00009bf8, 0x00000010 },
+    { 0x00009bfc, 0x0000001a },
+    { 0x0000a210, 0x40806333 },
+    { 0x0000a214, 0x00106c10 },
+    { 0x0000a218, 0x009c4060 },
+    { 0x0000a220, 0x018830c6 },
+    { 0x0000a224, 0x00000400 },
+    { 0x0000a228, 0x001a0bb5 },
+    { 0x0000a22c, 0x00000000 },
+    { 0x0000a234, 0x20202020 },
+    { 0x0000a238, 0x20202020 },
+    { 0x0000a23c, 0x13c889af },
+    { 0x0000a240, 0x38490a20 },
+    { 0x0000a244, 0x00007bb6 },
+    { 0x0000a248, 0x0fff3ffc },
+    { 0x0000a24c, 0x00000001 },
+    { 0x0000a250, 0x0000e000 },
+    { 0x0000a254, 0x00000000 },
+    { 0x0000a258, 0x0cc75380 },
+    { 0x0000a25c, 0x0f0f0f01 },
+    { 0x0000a260, 0xdfa91f01 },
+    { 0x0000a268, 0x00000001 },
+    { 0x0000a26c, 0x0ebae9c6 },
+    { 0x0000b26c, 0x0ebae9c6 },
+    { 0x0000c26c, 0x0ebae9c6 },
+    { 0x0000d270, 0x00820820 },
+    { 0x0000a278, 0x1ce739ce },
+    { 0x0000a27c, 0x050701ce },
+    { 0x0000a338, 0x00000000 },
+    { 0x0000a33c, 0x00000000 },
+    { 0x0000a340, 0x00000000 },
+    { 0x0000a344, 0x00000000 },
+    { 0x0000a348, 0x3fffffff },
+    { 0x0000a34c, 0x3fffffff },
+    { 0x0000a350, 0x3fffffff },
+    { 0x0000a354, 0x0003ffff },
+    { 0x0000a358, 0x79bfaa03 },
+    { 0x0000d35c, 0x07ffffef },
+    { 0x0000d360, 0x0fffffe7 },
+    { 0x0000d364, 0x17ffffe5 },
+    { 0x0000d368, 0x1fffffe4 },
+    { 0x0000d36c, 0x37ffffe3 },
+    { 0x0000d370, 0x3fffffe3 },
+    { 0x0000d374, 0x57ffffe3 },
+    { 0x0000d378, 0x5fffffe2 },
+    { 0x0000d37c, 0x7fffffe2 },
+    { 0x0000d380, 0x7f3c7bba },
+    { 0x0000d384, 0xf3307ff0 },
+    { 0x0000a388, 0x0c000000 },
+    { 0x0000a38c, 0x20202020 },
+    { 0x0000a390, 0x20202020 },
+    { 0x0000a394, 0x1ce739ce },
+    { 0x0000a398, 0x000001ce },
+    { 0x0000a39c, 0x00000001 },
+    { 0x0000a3a0, 0x00000000 },
+    { 0x0000a3a4, 0x00000000 },
+    { 0x0000a3a8, 0x00000000 },
+    { 0x0000a3ac, 0x00000000 },
+    { 0x0000a3b0, 0x00000000 },
+    { 0x0000a3b4, 0x00000000 },
+    { 0x0000a3b8, 0x00000000 },
+    { 0x0000a3bc, 0x00000000 },
+    { 0x0000a3c0, 0x00000000 },
+    { 0x0000a3c4, 0x00000000 },
+    { 0x0000a3c8, 0x00000246 },
+    { 0x0000a3cc, 0x20202020 },
+    { 0x0000a3d0, 0x20202020 },
+    { 0x0000a3d4, 0x20202020 },
+    { 0x0000a3dc, 0x1ce739ce },
+    { 0x0000a3e0, 0x000001ce },
+};
+
+static const u32 ar5416Bank0_9160[][2] = {
+    { 0x000098b0, 0x1e5795e5 },
+    { 0x000098e0, 0x02008020 },
+};
+
+static const u32 ar5416BB_RfGain_9160[][3] = {
+    { 0x00009a00, 0x00000000, 0x00000000 },
+    { 0x00009a04, 0x00000040, 0x00000040 },
+    { 0x00009a08, 0x00000080, 0x00000080 },
+    { 0x00009a0c, 0x000001a1, 0x00000141 },
+    { 0x00009a10, 0x000001e1, 0x00000181 },
+    { 0x00009a14, 0x00000021, 0x000001c1 },
+    { 0x00009a18, 0x00000061, 0x00000001 },
+    { 0x00009a1c, 0x00000168, 0x00000041 },
+    { 0x00009a20, 0x000001a8, 0x000001a8 },
+    { 0x00009a24, 0x000001e8, 0x000001e8 },
+    { 0x00009a28, 0x00000028, 0x00000028 },
+    { 0x00009a2c, 0x00000068, 0x00000068 },
+    { 0x00009a30, 0x00000189, 0x000000a8 },
+    { 0x00009a34, 0x000001c9, 0x00000169 },
+    { 0x00009a38, 0x00000009, 0x000001a9 },
+    { 0x00009a3c, 0x00000049, 0x000001e9 },
+    { 0x00009a40, 0x00000089, 0x00000029 },
+    { 0x00009a44, 0x00000170, 0x00000069 },
+    { 0x00009a48, 0x000001b0, 0x00000190 },
+    { 0x00009a4c, 0x000001f0, 0x000001d0 },
+    { 0x00009a50, 0x00000030, 0x00000010 },
+    { 0x00009a54, 0x00000070, 0x00000050 },
+    { 0x00009a58, 0x00000191, 0x00000090 },
+    { 0x00009a5c, 0x000001d1, 0x00000151 },
+    { 0x00009a60, 0x00000011, 0x00000191 },
+    { 0x00009a64, 0x00000051, 0x000001d1 },
+    { 0x00009a68, 0x00000091, 0x00000011 },
+    { 0x00009a6c, 0x000001b8, 0x00000051 },
+    { 0x00009a70, 0x000001f8, 0x00000198 },
+    { 0x00009a74, 0x00000038, 0x000001d8 },
+    { 0x00009a78, 0x00000078, 0x00000018 },
+    { 0x00009a7c, 0x00000199, 0x00000058 },
+    { 0x00009a80, 0x000001d9, 0x00000098 },
+    { 0x00009a84, 0x00000019, 0x00000159 },
+    { 0x00009a88, 0x00000059, 0x00000199 },
+    { 0x00009a8c, 0x00000099, 0x000001d9 },
+    { 0x00009a90, 0x000000d9, 0x00000019 },
+    { 0x00009a94, 0x000000f9, 0x00000059 },
+    { 0x00009a98, 0x000000f9, 0x00000099 },
+    { 0x00009a9c, 0x000000f9, 0x000000d9 },
+    { 0x00009aa0, 0x000000f9, 0x000000f9 },
+    { 0x00009aa4, 0x000000f9, 0x000000f9 },
+    { 0x00009aa8, 0x000000f9, 0x000000f9 },
+    { 0x00009aac, 0x000000f9, 0x000000f9 },
+    { 0x00009ab0, 0x000000f9, 0x000000f9 },
+    { 0x00009ab4, 0x000000f9, 0x000000f9 },
+    { 0x00009ab8, 0x000000f9, 0x000000f9 },
+    { 0x00009abc, 0x000000f9, 0x000000f9 },
+    { 0x00009ac0, 0x000000f9, 0x000000f9 },
+    { 0x00009ac4, 0x000000f9, 0x000000f9 },
+    { 0x00009ac8, 0x000000f9, 0x000000f9 },
+    { 0x00009acc, 0x000000f9, 0x000000f9 },
+    { 0x00009ad0, 0x000000f9, 0x000000f9 },
+    { 0x00009ad4, 0x000000f9, 0x000000f9 },
+    { 0x00009ad8, 0x000000f9, 0x000000f9 },
+    { 0x00009adc, 0x000000f9, 0x000000f9 },
+    { 0x00009ae0, 0x000000f9, 0x000000f9 },
+    { 0x00009ae4, 0x000000f9, 0x000000f9 },
+    { 0x00009ae8, 0x000000f9, 0x000000f9 },
+    { 0x00009aec, 0x000000f9, 0x000000f9 },
+    { 0x00009af0, 0x000000f9, 0x000000f9 },
+    { 0x00009af4, 0x000000f9, 0x000000f9 },
+    { 0x00009af8, 0x000000f9, 0x000000f9 },
+    { 0x00009afc, 0x000000f9, 0x000000f9 },
+};
+
+static const u32 ar5416Bank1_9160[][2] = {
+    { 0x000098b0, 0x02108421 },
+    { 0x000098ec, 0x00000008 },
+};
+
+static const u32 ar5416Bank2_9160[][2] = {
+    { 0x000098b0, 0x0e73ff17 },
+    { 0x000098e0, 0x00000420 },
+};
+
+static const u32 ar5416Bank3_9160[][3] = {
+    { 0x000098f0, 0x01400018, 0x01c00018 },
+};
+
+static const u32 ar5416Bank6_9160[][3] = {
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x004210a2, 0x004210a2 },
+    { 0x0000989c, 0x0014008f, 0x0014008f },
+    { 0x0000989c, 0x00c40003, 0x00c40003 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x0001805e, 0x0001805e },
+    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
+    { 0x0000989c, 0x000000f1, 0x000000f1 },
+    { 0x0000989c, 0x00002081, 0x00002081 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+static const u32 ar5416Bank6TPC_9160[][3] = {
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00000000, 0x00000000 },
+    { 0x0000989c, 0x00e00000, 0x00e00000 },
+    { 0x0000989c, 0x005e0000, 0x005e0000 },
+    { 0x0000989c, 0x00120000, 0x00120000 },
+    { 0x0000989c, 0x00620000, 0x00620000 },
+    { 0x0000989c, 0x00020000, 0x00020000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
+    { 0x0000989c, 0x005f0000, 0x005f0000 },
+    { 0x0000989c, 0x00870000, 0x00870000 },
+    { 0x0000989c, 0x00f90000, 0x00f90000 },
+    { 0x0000989c, 0x007b0000, 0x007b0000 },
+    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
+    { 0x0000989c, 0x00f50000, 0x00f50000 },
+    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
+    { 0x0000989c, 0x00110000, 0x00110000 },
+    { 0x0000989c, 0x006100a8, 0x006100a8 },
+    { 0x0000989c, 0x00423022, 0x00423022 },
+    { 0x0000989c, 0x2014008f, 0x2014008f },
+    { 0x0000989c, 0x00c40002, 0x00c40002 },
+    { 0x0000989c, 0x003000f2, 0x003000f2 },
+    { 0x0000989c, 0x00440016, 0x00440016 },
+    { 0x0000989c, 0x00410040, 0x00410040 },
+    { 0x0000989c, 0x0001805e, 0x0001805e },
+    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
+    { 0x0000989c, 0x000000e1, 0x000000e1 },
+    { 0x0000989c, 0x00007080, 0x00007080 },
+    { 0x0000989c, 0x000000d4, 0x000000d4 },
+    { 0x000098d0, 0x0000000f, 0x0010000f },
+};
+
+static const u32 ar5416Bank7_9160[][2] = {
+    { 0x0000989c, 0x00000500 },
+    { 0x0000989c, 0x00000800 },
+    { 0x000098cc, 0x0000000e },
+};
+
+static const u32 ar5416Addac_9160[][2] = {
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x000000c0 },
+    {0x0000989c,  0x00000018 },
+    {0x0000989c,  0x00000004 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x000000c0 },
+    {0x0000989c,  0x00000019 },
+    {0x0000989c,  0x00000004 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000004 },
+    {0x0000989c,  0x00000003 },
+    {0x0000989c,  0x00000008 },
+    {0x0000989c,  0x00000000 },
+    {0x000098cc,  0x00000000 },
+};
+
+static const u32 ar5416Addac_91601_1[][2] = {
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x000000c0 },
+    {0x0000989c,  0x00000018 },
+    {0x0000989c,  0x00000004 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x000000c0 },
+    {0x0000989c,  0x00000019 },
+    {0x0000989c,  0x00000004 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x0000989c,  0x00000000 },
+    {0x000098cc,  0x00000000 },
+};
+
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_calib.c b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
new file mode 100644
index 000000000000..5fdbb53b47e0
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9002_calib.c
@@ -0,0 +1,1000 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "hw-ops.h"
+#include "ar9002_phy.h"
+
+#define AR9285_CLCAL_REDO_THRESH    1
+
+static void ar9002_hw_setup_calibration(struct ath_hw *ah,
+                                        struct ath9k_cal_list *currCal)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(0),
+                      AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX,
+                      currCal->calData->calCountMax);
+
+        switch (currCal->calData->calType) {
+        case IQ_MISMATCH_CAL:
+                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting IQ Mismatch Calibration\n");
+                break;
+        case ADC_GAIN_CAL:
+                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_GAIN);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting ADC Gain Calibration\n");
+                break;
+        case ADC_DC_CAL:
+                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_PER);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting ADC DC Calibration\n");
+                break;
+        case ADC_DC_INIT_CAL:
+                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_INIT);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting Init ADC DC Calibration\n");
+                break;
+        case TEMP_COMP_CAL:
+                break; /* Not supported */
+        }
+
+        REG_SET_BIT(ah, AR_PHY_TIMING_CTRL4(0),
+                    AR_PHY_TIMING_CTRL4_DO_CAL);
+}
+
+static bool ar9002_hw_per_calibration(struct ath_hw *ah,
+                                      struct ath9k_channel *ichan,
+                                      u8 rxchainmask,
+                                      struct ath9k_cal_list *currCal)
+{
+        bool iscaldone = false;
+
+        if (currCal->calState == CAL_RUNNING) {
+                if (!(REG_READ(ah, AR_PHY_TIMING_CTRL4(0)) &
+                      AR_PHY_TIMING_CTRL4_DO_CAL)) {
+
+                        currCal->calData->calCollect(ah);
+                        ah->cal_samples++;
+
+                        if (ah->cal_samples >=
+                            currCal->calData->calNumSamples) {
+                                int i, numChains = 0;
+                                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                                        if (rxchainmask & (1 << i))
+                                                numChains++;
+                                }
+
+                                currCal->calData->calPostProc(ah, numChains);
+                                ichan->CalValid |= currCal->calData->calType;
+                                currCal->calState = CAL_DONE;
+                                iscaldone = true;
+                        } else {
+                                ar9002_hw_setup_calibration(ah, currCal);
+                        }
+                }
+        } else if (!(ichan->CalValid & currCal->calData->calType)) {
+                ath9k_hw_reset_calibration(ah, currCal);
+        }
+
+        return iscaldone;
+}
+
+/* Assumes you are talking about the currently configured channel */
+static bool ar9002_hw_iscal_supported(struct ath_hw *ah,
+                                      enum ath9k_cal_types calType)
+{
+        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
+
+        switch (calType & ah->supp_cals) {
+        case IQ_MISMATCH_CAL: /* Both 2 GHz and 5 GHz support OFDM */
+                return true;
+        case ADC_GAIN_CAL:
+        case ADC_DC_CAL:
+                if (!(conf->channel->band == IEEE80211_BAND_2GHZ &&
+                      conf_is_ht20(conf)))
+                        return true;
+                break;
+        }
+        return false;
+}
+
+static void ar9002_hw_iqcal_collect(struct ath_hw *ah)
+{
+        int i;
+
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                ah->totalPowerMeasI[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
+                ah->totalPowerMeasQ[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
+                ah->totalIqCorrMeas[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d pmi=0x%08x;pmq=0x%08x;iqcm=0x%08x;\n",
+                          ah->cal_samples, i, ah->totalPowerMeasI[i],
+                          ah->totalPowerMeasQ[i],
+                          ah->totalIqCorrMeas[i]);
+        }
+}
+
+static void ar9002_hw_adc_gaincal_collect(struct ath_hw *ah)
+{
+        int i;
+
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                ah->totalAdcIOddPhase[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
+                ah->totalAdcIEvenPhase[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
+                ah->totalAdcQOddPhase[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
+                ah->totalAdcQEvenPhase[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
+
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
+                          "oddq=0x%08x; evenq=0x%08x;\n",
+                          ah->cal_samples, i,
+                          ah->totalAdcIOddPhase[i],
+                          ah->totalAdcIEvenPhase[i],
+                          ah->totalAdcQOddPhase[i],
+                          ah->totalAdcQEvenPhase[i]);
+        }
+}
+
+static void ar9002_hw_adc_dccal_collect(struct ath_hw *ah)
+{
+        int i;
+
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                ah->totalAdcDcOffsetIOddPhase[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
+                ah->totalAdcDcOffsetIEvenPhase[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
+                ah->totalAdcDcOffsetQOddPhase[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
+                ah->totalAdcDcOffsetQEvenPhase[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
+
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
+                          "oddq=0x%08x; evenq=0x%08x;\n",
+                          ah->cal_samples, i,
+                          ah->totalAdcDcOffsetIOddPhase[i],
+                          ah->totalAdcDcOffsetIEvenPhase[i],
+                          ah->totalAdcDcOffsetQOddPhase[i],
+                          ah->totalAdcDcOffsetQEvenPhase[i]);
+        }
+}
+
+static void ar9002_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 powerMeasQ, powerMeasI, iqCorrMeas;
+        u32 qCoffDenom, iCoffDenom;
+        int32_t qCoff, iCoff;
+        int iqCorrNeg, i;
+
+        for (i = 0; i < numChains; i++) {
+                powerMeasI = ah->totalPowerMeasI[i];
+                powerMeasQ = ah->totalPowerMeasQ[i];
+                iqCorrMeas = ah->totalIqCorrMeas[i];
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Starting IQ Cal and Correction for Chain %d\n",
+                          i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Orignal: Chn %diq_corr_meas = 0x%08x\n",
+                          i, ah->totalIqCorrMeas[i]);
+
+                iqCorrNeg = 0;
+
+                if (iqCorrMeas > 0x80000000) {
+                        iqCorrMeas = (0xffffffff - iqCorrMeas) + 1;
+                        iqCorrNeg = 1;
+                }
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_i = 0x%08x\n", i, powerMeasI);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_q = 0x%08x\n", i, powerMeasQ);
+                ath_print(common, ATH_DBG_CALIBRATE, "iqCorrNeg is 0x%08x\n",
+                          iqCorrNeg);
+
+                iCoffDenom = (powerMeasI / 2 + powerMeasQ / 2) / 128;
+                qCoffDenom = powerMeasQ / 64;
+
+                if ((powerMeasQ != 0) && (iCoffDenom != 0) &&
+                    (qCoffDenom != 0)) {
+                        iCoff = iqCorrMeas / iCoffDenom;
+                        qCoff = powerMeasI / qCoffDenom - 64;
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d iCoff = 0x%08x\n", i, iCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d qCoff = 0x%08x\n", i, qCoff);
+
+                        iCoff = iCoff & 0x3f;
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "New: Chn %d iCoff = 0x%08x\n", i, iCoff);
+                        if (iqCorrNeg == 0x0)
+                                iCoff = 0x40 - iCoff;
+
+                        if (qCoff > 15)
+                                qCoff = 15;
+                        else if (qCoff <= -16)
+                                qCoff = 16;
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
+                                  i, iCoff, qCoff);
+
+                        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
+                                      AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF,
+                                      iCoff);
+                        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
+                                      AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF,
+                                      qCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "IQ Cal and Correction done for Chain %d\n",
+                                  i);
+                }
+        }
+
+        REG_SET_BIT(ah, AR_PHY_TIMING_CTRL4(0),
+                    AR_PHY_TIMING_CTRL4_IQCORR_ENABLE);
+}
+
+static void ar9002_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 iOddMeasOffset, iEvenMeasOffset, qOddMeasOffset, qEvenMeasOffset;
+        u32 qGainMismatch, iGainMismatch, val, i;
+
+        for (i = 0; i < numChains; i++) {
+                iOddMeasOffset = ah->totalAdcIOddPhase[i];
+                iEvenMeasOffset = ah->totalAdcIEvenPhase[i];
+                qOddMeasOffset = ah->totalAdcQOddPhase[i];
+                qEvenMeasOffset = ah->totalAdcQEvenPhase[i];
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Starting ADC Gain Cal for Chain %d\n", i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_i = 0x%08x\n", i,
+                          iOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_i = 0x%08x\n", i,
+                          iEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_q = 0x%08x\n", i,
+                          qOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_q = 0x%08x\n", i,
+                          qEvenMeasOffset);
+
+                if (iOddMeasOffset != 0 && qEvenMeasOffset != 0) {
+                        iGainMismatch =
+                                ((iEvenMeasOffset * 32) /
+                                 iOddMeasOffset) & 0x3f;
+                        qGainMismatch =
+                                ((qOddMeasOffset * 32) /
+                                 qEvenMeasOffset) & 0x3f;
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d gain_mismatch_i = 0x%08x\n", i,
+                                  iGainMismatch);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d gain_mismatch_q = 0x%08x\n", i,
+                                  qGainMismatch);
+
+                        val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
+                        val &= 0xfffff000;
+                        val |= (qGainMismatch) | (iGainMismatch << 6);
+                        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "ADC Gain Cal done for Chain %d\n", i);
+                }
+        }
+
+        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0),
+                  REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0)) |
+                  AR_PHY_NEW_ADC_GAIN_CORR_ENABLE);
+}
+
+static void ar9002_hw_adc_dccal_calibrate(struct ath_hw *ah, u8 numChains)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 iOddMeasOffset, iEvenMeasOffset, val, i;
+        int32_t qOddMeasOffset, qEvenMeasOffset, qDcMismatch, iDcMismatch;
+        const struct ath9k_percal_data *calData =
+                ah->cal_list_curr->calData;
+        u32 numSamples =
+                (1 << (calData->calCountMax + 5)) * calData->calNumSamples;
+
+        for (i = 0; i < numChains; i++) {
+                iOddMeasOffset = ah->totalAdcDcOffsetIOddPhase[i];
+                iEvenMeasOffset = ah->totalAdcDcOffsetIEvenPhase[i];
+                qOddMeasOffset = ah->totalAdcDcOffsetQOddPhase[i];
+                qEvenMeasOffset = ah->totalAdcDcOffsetQEvenPhase[i];
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                           "Starting ADC DC Offset Cal for Chain %d\n", i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_i = %d\n", i,
+                          iOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_i = %d\n", i,
+                          iEvenMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_odd_q = %d\n", i,
+                          qOddMeasOffset);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_even_q = %d\n", i,
+                          qEvenMeasOffset);
+
+                iDcMismatch = (((iEvenMeasOffset - iOddMeasOffset) * 2) /
+                               numSamples) & 0x1ff;
+                qDcMismatch = (((qOddMeasOffset - qEvenMeasOffset) * 2) /
+                               numSamples) & 0x1ff;
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d dc_offset_mismatch_i = 0x%08x\n", i,
+                          iDcMismatch);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d dc_offset_mismatch_q = 0x%08x\n", i,
+                          qDcMismatch);
+
+                val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
+                val &= 0xc0000fff;
+                val |= (qDcMismatch << 12) | (iDcMismatch << 21);
+                REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "ADC DC Offset Cal done for Chain %d\n", i);
+        }
+
+        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0),
+                  REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0)) |
+                  AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE);
+}
+
+static void ar9287_hw_olc_temp_compensation(struct ath_hw *ah)
+{
+        u32 rddata;
+        int32_t delta, currPDADC, slope;
+
+        rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
+        currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
+
+        if (ah->initPDADC == 0 || currPDADC == 0) {
+                /*
+                 * Zero value indicates that no frames have been transmitted
+                 * yet, can't do temperature compensation until frames are
+                 * transmitted.
+                 */
+                return;
+        } else {
+                slope = ah->eep_ops->get_eeprom(ah, EEP_TEMPSENSE_SLOPE);
+
+                if (slope == 0) { /* to avoid divide by zero case */
+                        delta = 0;
+                } else {
+                        delta = ((currPDADC - ah->initPDADC)*4) / slope;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_CH0_TX_PWRCTRL11,
+                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
+                REG_RMW_FIELD(ah, AR_PHY_CH1_TX_PWRCTRL11,
+                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
+        }
+}
+
+static void ar9280_hw_olc_temp_compensation(struct ath_hw *ah)
+{
+        u32 rddata, i;
+        int delta, currPDADC, regval;
+
+        rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
+        currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
+
+        if (ah->initPDADC == 0 || currPDADC == 0)
+                return;
+
+        if (ah->eep_ops->get_eeprom(ah, EEP_DAC_HPWR_5G))
+                delta = (currPDADC - ah->initPDADC + 4) / 8;
+        else
+                delta = (currPDADC - ah->initPDADC + 5) / 10;
+
+        if (delta != ah->PDADCdelta) {
+                ah->PDADCdelta = delta;
+                for (i = 1; i < AR9280_TX_GAIN_TABLE_SIZE; i++) {
+                        regval = ah->originalGain[i] - delta;
+                        if (regval < 0)
+                                regval = 0;
+
+                        REG_RMW_FIELD(ah,
+                                      AR_PHY_TX_GAIN_TBL1 + i * 4,
+                                      AR_PHY_TX_GAIN, regval);
+                }
+        }
+}
+
+static void ar9271_hw_pa_cal(struct ath_hw *ah, bool is_reset)
+{
+        u32 regVal;
+        unsigned int i;
+        u32 regList[][2] = {
+                { 0x786c, 0 },
+                { 0x7854, 0 },
+                { 0x7820, 0 },
+                { 0x7824, 0 },
+                { 0x7868, 0 },
+                { 0x783c, 0 },
+                { 0x7838, 0 } ,
+                { 0x7828, 0 } ,
+        };
+
+        for (i = 0; i < ARRAY_SIZE(regList); i++)
+                regList[i][1] = REG_READ(ah, regList[i][0]);
+
+        regVal = REG_READ(ah, 0x7834);
+        regVal &= (~(0x1));
+        REG_WRITE(ah, 0x7834, regVal);
+        regVal = REG_READ(ah, 0x9808);
+        regVal |= (0x1 << 27);
+        REG_WRITE(ah, 0x9808, regVal);
+
+        /* 786c,b23,1, pwddac=1 */
+        REG_RMW_FIELD(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC, 1);
+        /* 7854, b5,1, pdrxtxbb=1 */
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1, 1);
+        /* 7854, b7,1, pdv2i=1 */
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I, 1);
+        /* 7854, b8,1, pddacinterface=1 */
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF, 1);
+        /* 7824,b12,0, offcal=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL, 0);
+        /* 7838, b1,0, pwddb=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB, 0);
+        /* 7820,b11,0, enpacal=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL, 0);
+        /* 7820,b25,1, pdpadrv1=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1, 0);
+        /* 7820,b24,0, pdpadrv2=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV2, 0);
+        /* 7820,b23,0, pdpaout=0 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT, 0);
+        /* 783c,b14-16,7, padrvgn2tab_0=7 */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G8, AR9285_AN_RF2G8_PADRVGN2TAB0, 7);
+        /*
+         * 7838,b29-31,0, padrvgn1tab_0=0
+         * does not matter since we turn it off
+         */
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
+
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
+
+        /* Set:
+         * localmode=1,bmode=1,bmoderxtx=1,synthon=1,
+         * txon=1,paon=1,oscon=1,synthon_force=1
+         */
+        REG_WRITE(ah, AR9285_AN_TOP2, 0xca0358a0);
+        udelay(30);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9271_AN_RF2G6_OFFS, 0);
+
+        /* find off_6_1; */
+        for (i = 6; i > 0; i--) {
+                regVal = REG_READ(ah, 0x7834);
+                regVal |= (1 << (20 + i));
+                REG_WRITE(ah, 0x7834, regVal);
+                udelay(1);
+                /* regVal = REG_READ(ah, 0x7834); */
+                regVal &= (~(0x1 << (20 + i)));
+                regVal |= (MS(REG_READ(ah, 0x7840), AR9285_AN_RXTXBB1_SPARE9)
+                            << (20 + i));
+                REG_WRITE(ah, 0x7834, regVal);
+        }
+
+        regVal = (regVal >> 20) & 0x7f;
+
+        /* Update PA cal info */
+        if ((!is_reset) && (ah->pacal_info.prev_offset == regVal)) {
+                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
+                        ah->pacal_info.max_skipcount =
+                                2 * ah->pacal_info.max_skipcount;
+                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
+        } else {
+                ah->pacal_info.max_skipcount = 1;
+                ah->pacal_info.skipcount = 0;
+                ah->pacal_info.prev_offset = regVal;
+        }
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        regVal = REG_READ(ah, 0x7834);
+        regVal |= 0x1;
+        REG_WRITE(ah, 0x7834, regVal);
+        regVal = REG_READ(ah, 0x9808);
+        regVal &= (~(0x1 << 27));
+        REG_WRITE(ah, 0x9808, regVal);
+
+        for (i = 0; i < ARRAY_SIZE(regList); i++)
+                REG_WRITE(ah, regList[i][0], regList[i][1]);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+}
+
+static inline void ar9285_hw_pa_cal(struct ath_hw *ah, bool is_reset)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 regVal;
+        int i, offset, offs_6_1, offs_0;
+        u32 ccomp_org, reg_field;
+        u32 regList[][2] = {
+                { 0x786c, 0 },
+                { 0x7854, 0 },
+                { 0x7820, 0 },
+                { 0x7824, 0 },
+                { 0x7868, 0 },
+                { 0x783c, 0 },
+                { 0x7838, 0 },
+        };
+
+        ath_print(common, ATH_DBG_CALIBRATE, "Running PA Calibration\n");
+
+        /* PA CAL is not needed for high power solution */
+        if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) ==
+            AR5416_EEP_TXGAIN_HIGH_POWER)
+                return;
+
+        if (AR_SREV_9285_11(ah)) {
+                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
+                udelay(10);
+        }
+
+        for (i = 0; i < ARRAY_SIZE(regList); i++)
+                regList[i][1] = REG_READ(ah, regList[i][0]);
+
+        regVal = REG_READ(ah, 0x7834);
+        regVal &= (~(0x1));
+        REG_WRITE(ah, 0x7834, regVal);
+        regVal = REG_READ(ah, 0x9808);
+        regVal |= (0x1 << 27);
+        REG_WRITE(ah, 0x9808, regVal);
+
+        REG_RMW_FIELD(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC, 1);
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1, 1);
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I, 1);
+        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF, 1);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV2, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G8, AR9285_AN_RF2G8_PADRVGN2TAB0, 7);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
+        ccomp_org = MS(REG_READ(ah, AR9285_AN_RF2G6), AR9285_AN_RF2G6_CCOMP);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_CCOMP, 0xf);
+
+        REG_WRITE(ah, AR9285_AN_TOP2, 0xca0358a0);
+        udelay(30);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_OFFS, 0);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, 0);
+
+        for (i = 6; i > 0; i--) {
+                regVal = REG_READ(ah, 0x7834);
+                regVal |= (1 << (19 + i));
+                REG_WRITE(ah, 0x7834, regVal);
+                udelay(1);
+                regVal = REG_READ(ah, 0x7834);
+                regVal &= (~(0x1 << (19 + i)));
+                reg_field = MS(REG_READ(ah, 0x7840), AR9285_AN_RXTXBB1_SPARE9);
+                regVal |= (reg_field << (19 + i));
+                REG_WRITE(ah, 0x7834, regVal);
+        }
+
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, 1);
+        udelay(1);
+        reg_field = MS(REG_READ(ah, AR9285_AN_RF2G9), AR9285_AN_RXTXBB1_SPARE9);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, reg_field);
+        offs_6_1 = MS(REG_READ(ah, AR9285_AN_RF2G6), AR9285_AN_RF2G6_OFFS);
+        offs_0   = MS(REG_READ(ah, AR9285_AN_RF2G3), AR9285_AN_RF2G3_PDVCCOMP);
+
+        offset = (offs_6_1<<1) | offs_0;
+        offset = offset - 0;
+        offs_6_1 = offset>>1;
+        offs_0 = offset & 1;
+
+        if ((!is_reset) && (ah->pacal_info.prev_offset == offset)) {
+                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
+                        ah->pacal_info.max_skipcount =
+                                2 * ah->pacal_info.max_skipcount;
+                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
+        } else {
+                ah->pacal_info.max_skipcount = 1;
+                ah->pacal_info.skipcount = 0;
+                ah->pacal_info.prev_offset = offset;
+        }
+
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_OFFS, offs_6_1);
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, offs_0);
+
+        regVal = REG_READ(ah, 0x7834);
+        regVal |= 0x1;
+        REG_WRITE(ah, 0x7834, regVal);
+        regVal = REG_READ(ah, 0x9808);
+        regVal &= (~(0x1 << 27));
+        REG_WRITE(ah, 0x9808, regVal);
+
+        for (i = 0; i < ARRAY_SIZE(regList); i++)
+                REG_WRITE(ah, regList[i][0], regList[i][1]);
+
+        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_CCOMP, ccomp_org);
+
+        if (AR_SREV_9285_11(ah))
+                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
+
+}
+
+static void ar9002_hw_pa_cal(struct ath_hw *ah, bool is_reset)
+{
+        if (AR_SREV_9271(ah)) {
+                if (is_reset || !ah->pacal_info.skipcount)
+                        ar9271_hw_pa_cal(ah, is_reset);
+                else
+                        ah->pacal_info.skipcount--;
+        } else if (AR_SREV_9285_11_OR_LATER(ah)) {
+                if (is_reset || !ah->pacal_info.skipcount)
+                        ar9285_hw_pa_cal(ah, is_reset);
+                else
+                        ah->pacal_info.skipcount--;
+        }
+}
+
+static void ar9002_hw_olc_temp_compensation(struct ath_hw *ah)
+{
+        if (OLC_FOR_AR9287_10_LATER)
+                ar9287_hw_olc_temp_compensation(ah);
+        else if (OLC_FOR_AR9280_20_LATER)
+                ar9280_hw_olc_temp_compensation(ah);
+}
+
+static bool ar9002_hw_calibrate(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                u8 rxchainmask,
+                                bool longcal)
+{
+        bool iscaldone = true;
+        struct ath9k_cal_list *currCal = ah->cal_list_curr;
+
+        if (currCal &&
+            (currCal->calState == CAL_RUNNING ||
+             currCal->calState == CAL_WAITING)) {
+                iscaldone = ar9002_hw_per_calibration(ah, chan,
+                                                      rxchainmask, currCal);
+                if (iscaldone) {
+                        ah->cal_list_curr = currCal = currCal->calNext;
+
+                        if (currCal->calState == CAL_WAITING) {
+                                iscaldone = false;
+                                ath9k_hw_reset_calibration(ah, currCal);
+                        }
+                }
+        }
+
+        /* Do NF cal only at longer intervals */
+        if (longcal) {
+                /* Do periodic PAOffset Cal */
+                ar9002_hw_pa_cal(ah, false);
+                ar9002_hw_olc_temp_compensation(ah);
+
+                /*
+                 * Get the value from the previous NF cal and update
+                 * history buffer.
+                 */
+                ath9k_hw_getnf(ah, chan);
+
+                /*
+                 * Load the NF from history buffer of the current channel.
+                 * NF is slow time-variant, so it is OK to use a historical
+                 * value.
+                 */
+                ath9k_hw_loadnf(ah, ah->curchan);
+
+                ath9k_hw_start_nfcal(ah);
+        }
+
+        return iscaldone;
+}
+
+/* Carrier leakage Calibration fix */
+static bool ar9285_hw_cl_cal(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+        if (IS_CHAN_HT20(chan)) {
+                REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
+                REG_SET_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
+                REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                            AR_PHY_AGC_CONTROL_FLTR_CAL);
+                REG_CLR_BIT(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_CAL_ENABLE);
+                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
+                if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                  AR_PHY_AGC_CONTROL_CAL, 0, AH_WAIT_TIMEOUT)) {
+                        ath_print(common, ATH_DBG_CALIBRATE, "offset "
+                                  "calibration failed to complete in "
+                                  "1ms; noisy ??\n");
+                        return false;
+                }
+                REG_CLR_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
+                REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
+                REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+        }
+        REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+        REG_SET_BIT(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_CAL_ENABLE);
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
+        if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
+                          0, AH_WAIT_TIMEOUT)) {
+                ath_print(common, ATH_DBG_CALIBRATE, "offset calibration "
+                          "failed to complete in 1ms; noisy ??\n");
+                return false;
+        }
+
+        REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
+        REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
+
+        return true;
+}
+
+static bool ar9285_hw_clc(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        int i;
+        u_int32_t txgain_max;
+        u_int32_t clc_gain, gain_mask = 0, clc_num = 0;
+        u_int32_t reg_clc_I0, reg_clc_Q0;
+        u_int32_t i0_num = 0;
+        u_int32_t q0_num = 0;
+        u_int32_t total_num = 0;
+        u_int32_t reg_rf2g5_org;
+        bool retv = true;
+
+        if (!(ar9285_hw_cl_cal(ah, chan)))
+                return false;
+
+        txgain_max = MS(REG_READ(ah, AR_PHY_TX_PWRCTRL7),
+                        AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX);
+
+        for (i = 0; i < (txgain_max+1); i++) {
+                clc_gain = (REG_READ(ah, (AR_PHY_TX_GAIN_TBL1+(i<<2))) &
+                           AR_PHY_TX_GAIN_CLC) >> AR_PHY_TX_GAIN_CLC_S;
+                if (!(gain_mask & (1 << clc_gain))) {
+                        gain_mask |= (1 << clc_gain);
+                        clc_num++;
+                }
+        }
+
+        for (i = 0; i < clc_num; i++) {
+                reg_clc_I0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
+                              & AR_PHY_CLC_I0) >> AR_PHY_CLC_I0_S;
+                reg_clc_Q0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
+                              & AR_PHY_CLC_Q0) >> AR_PHY_CLC_Q0_S;
+                if (reg_clc_I0 == 0)
+                        i0_num++;
+
+                if (reg_clc_Q0 == 0)
+                        q0_num++;
+        }
+        total_num = i0_num + q0_num;
+        if (total_num > AR9285_CLCAL_REDO_THRESH) {
+                reg_rf2g5_org = REG_READ(ah, AR9285_RF2G5);
+                if (AR_SREV_9285E_20(ah)) {
+                        REG_WRITE(ah, AR9285_RF2G5,
+                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
+                                  AR9285_RF2G5_IC50TX_XE_SET);
+                } else {
+                        REG_WRITE(ah, AR9285_RF2G5,
+                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
+                                  AR9285_RF2G5_IC50TX_SET);
+                }
+                retv = ar9285_hw_cl_cal(ah, chan);
+                REG_WRITE(ah, AR9285_RF2G5, reg_rf2g5_org);
+        }
+        return retv;
+}
+
+static bool ar9002_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (AR_SREV_9271(ah) || AR_SREV_9285_12_OR_LATER(ah)) {
+                if (!ar9285_hw_clc(ah, chan))
+                        return false;
+        } else {
+                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                        if (!AR_SREV_9287_10_OR_LATER(ah))
+                                REG_CLR_BIT(ah, AR_PHY_ADC_CTL,
+                                            AR_PHY_ADC_CTL_OFF_PWDADC);
+                        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+                                    AR_PHY_AGC_CONTROL_FLTR_CAL);
+                }
+
+                /* Calibrate the AGC */
+                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                          REG_READ(ah, AR_PHY_AGC_CONTROL) |
+                          AR_PHY_AGC_CONTROL_CAL);
+
+                /* Poll for offset calibration complete */
+                if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                   AR_PHY_AGC_CONTROL_CAL,
+                                   0, AH_WAIT_TIMEOUT)) {
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "offset calibration failed to "
+                                  "complete in 1ms; noisy environment?\n");
+                        return false;
+                }
+
+                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                        if (!AR_SREV_9287_10_OR_LATER(ah))
+                                REG_SET_BIT(ah, AR_PHY_ADC_CTL,
+                                            AR_PHY_ADC_CTL_OFF_PWDADC);
+                        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                                    AR_PHY_AGC_CONTROL_FLTR_CAL);
+                }
+        }
+
+        /* Do PA Calibration */
+        ar9002_hw_pa_cal(ah, true);
+
+        /* Do NF Calibration after DC offset and other calibrations */
+        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF);
+
+        ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+
+        /* Enable IQ, ADC Gain and ADC DC offset CALs */
+        if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah)) {
+                if (ar9002_hw_iscal_supported(ah, ADC_GAIN_CAL)) {
+                        INIT_CAL(&ah->adcgain_caldata);
+                        INSERT_CAL(ah, &ah->adcgain_caldata);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling ADC Gain Calibration.\n");
+                }
+                if (ar9002_hw_iscal_supported(ah, ADC_DC_CAL)) {
+                        INIT_CAL(&ah->adcdc_caldata);
+                        INSERT_CAL(ah, &ah->adcdc_caldata);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling ADC DC Calibration.\n");
+                }
+                if (ar9002_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
+                        INIT_CAL(&ah->iq_caldata);
+                        INSERT_CAL(ah, &ah->iq_caldata);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "enabling IQ Calibration.\n");
+                }
+
+                ah->cal_list_curr = ah->cal_list;
+
+                if (ah->cal_list_curr)
+                        ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
+        }
+
+        chan->CalValid = 0;
+
+        return true;
+}
+
+static const struct ath9k_percal_data iq_cal_multi_sample = {
+        IQ_MISMATCH_CAL,
+        MAX_CAL_SAMPLES,
+        PER_MIN_LOG_COUNT,
+        ar9002_hw_iqcal_collect,
+        ar9002_hw_iqcalibrate
+};
+static const struct ath9k_percal_data iq_cal_single_sample = {
+        IQ_MISMATCH_CAL,
+        MIN_CAL_SAMPLES,
+        PER_MAX_LOG_COUNT,
+        ar9002_hw_iqcal_collect,
+        ar9002_hw_iqcalibrate
+};
+static const struct ath9k_percal_data adc_gain_cal_multi_sample = {
+        ADC_GAIN_CAL,
+        MAX_CAL_SAMPLES,
+        PER_MIN_LOG_COUNT,
+        ar9002_hw_adc_gaincal_collect,
+        ar9002_hw_adc_gaincal_calibrate
+};
+static const struct ath9k_percal_data adc_gain_cal_single_sample = {
+        ADC_GAIN_CAL,
+        MIN_CAL_SAMPLES,
+        PER_MAX_LOG_COUNT,
+        ar9002_hw_adc_gaincal_collect,
+        ar9002_hw_adc_gaincal_calibrate
+};
+static const struct ath9k_percal_data adc_dc_cal_multi_sample = {
+        ADC_DC_CAL,
+        MAX_CAL_SAMPLES,
+        PER_MIN_LOG_COUNT,
+        ar9002_hw_adc_dccal_collect,
+        ar9002_hw_adc_dccal_calibrate
+};
+static const struct ath9k_percal_data adc_dc_cal_single_sample = {
+        ADC_DC_CAL,
+        MIN_CAL_SAMPLES,
+        PER_MAX_LOG_COUNT,
+        ar9002_hw_adc_dccal_collect,
+        ar9002_hw_adc_dccal_calibrate
+};
+static const struct ath9k_percal_data adc_init_dc_cal = {
+        ADC_DC_INIT_CAL,
+        MIN_CAL_SAMPLES,
+        INIT_LOG_COUNT,
+        ar9002_hw_adc_dccal_collect,
+        ar9002_hw_adc_dccal_calibrate
+};
+
+static void ar9002_hw_init_cal_settings(struct ath_hw *ah)
+{
+        if (AR_SREV_9100(ah)) {
+                ah->iq_caldata.calData = &iq_cal_multi_sample;
+                ah->supp_cals = IQ_MISMATCH_CAL;
+                return;
+        }
+
+        if (AR_SREV_9160_10_OR_LATER(ah)) {
+                if (AR_SREV_9280_10_OR_LATER(ah)) {
+                        ah->iq_caldata.calData = &iq_cal_single_sample;
+                        ah->adcgain_caldata.calData =
+                                &adc_gain_cal_single_sample;
+                        ah->adcdc_caldata.calData =
+                                &adc_dc_cal_single_sample;
+                        ah->adcdc_calinitdata.calData =
+                                &adc_init_dc_cal;
+                } else {
+                        ah->iq_caldata.calData = &iq_cal_multi_sample;
+                        ah->adcgain_caldata.calData =
+                                &adc_gain_cal_multi_sample;
+                        ah->adcdc_caldata.calData =
+                                &adc_dc_cal_multi_sample;
+                        ah->adcdc_calinitdata.calData =
+                                &adc_init_dc_cal;
+                }
+                ah->supp_cals = ADC_GAIN_CAL | ADC_DC_CAL | IQ_MISMATCH_CAL;
+        }
+}
+
+void ar9002_hw_attach_calib_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->init_cal_settings = ar9002_hw_init_cal_settings;
+        priv_ops->init_cal = ar9002_hw_init_cal;
+        priv_ops->setup_calibration = ar9002_hw_setup_calibration;
+        priv_ops->iscal_supported = ar9002_hw_iscal_supported;
+
+        ops->calibrate = ar9002_hw_calibrate;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
new file mode 100644
index 000000000000..a8a8cdc04afa
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -0,0 +1,598 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ar5008_initvals.h"
+#include "ar9001_initvals.h"
+#include "ar9002_initvals.h"
+
+/* General hardware code for the A5008/AR9001/AR9002 hadware families */
+
+static bool ar9002_hw_macversion_supported(u32 macversion)
+{
+        switch (macversion) {
+        case AR_SREV_VERSION_5416_PCI:
+        case AR_SREV_VERSION_5416_PCIE:
+        case AR_SREV_VERSION_9160:
+        case AR_SREV_VERSION_9100:
+        case AR_SREV_VERSION_9280:
+        case AR_SREV_VERSION_9285:
+        case AR_SREV_VERSION_9287:
+        case AR_SREV_VERSION_9271:
+                return true;
+        default:
+                break;
+        }
+        return false;
+}
+
+static void ar9002_hw_init_mode_regs(struct ath_hw *ah)
+{
+        if (AR_SREV_9271(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9271Modes_9271,
+                               ARRAY_SIZE(ar9271Modes_9271), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271,
+                               ARRAY_SIZE(ar9271Common_9271), 2);
+                INIT_INI_ARRAY(&ah->iniCommon_normal_cck_fir_coeff_9271,
+                               ar9271Common_normal_cck_fir_coeff_9271,
+                               ARRAY_SIZE(ar9271Common_normal_cck_fir_coeff_9271), 2);
+                INIT_INI_ARRAY(&ah->iniCommon_japan_2484_cck_fir_coeff_9271,
+                               ar9271Common_japan_2484_cck_fir_coeff_9271,
+                               ARRAY_SIZE(ar9271Common_japan_2484_cck_fir_coeff_9271), 2);
+                INIT_INI_ARRAY(&ah->iniModes_9271_1_0_only,
+                               ar9271Modes_9271_1_0_only,
+                               ARRAY_SIZE(ar9271Modes_9271_1_0_only), 6);
+                INIT_INI_ARRAY(&ah->iniModes_9271_ANI_reg, ar9271Modes_9271_ANI_reg,
+                               ARRAY_SIZE(ar9271Modes_9271_ANI_reg), 6);
+                INIT_INI_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
+                               ar9271Modes_high_power_tx_gain_9271,
+                               ARRAY_SIZE(ar9271Modes_high_power_tx_gain_9271), 6);
+                INIT_INI_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
+                               ar9271Modes_normal_power_tx_gain_9271,
+                               ARRAY_SIZE(ar9271Modes_normal_power_tx_gain_9271), 6);
+                return;
+        }
+
+        if (AR_SREV_9287_11_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_1,
+                                ARRAY_SIZE(ar9287Modes_9287_1_1), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9287Common_9287_1_1,
+                                ARRAY_SIZE(ar9287Common_9287_1_1), 2);
+                if (ah->config.pcie_clock_req)
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9287PciePhy_clkreq_off_L1_9287_1_1,
+                        ARRAY_SIZE(ar9287PciePhy_clkreq_off_L1_9287_1_1), 2);
+                else
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9287PciePhy_clkreq_always_on_L1_9287_1_1,
+                        ARRAY_SIZE(ar9287PciePhy_clkreq_always_on_L1_9287_1_1),
+                                        2);
+        } else if (AR_SREV_9287_10_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_0,
+                                ARRAY_SIZE(ar9287Modes_9287_1_0), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9287Common_9287_1_0,
+                                ARRAY_SIZE(ar9287Common_9287_1_0), 2);
+
+                if (ah->config.pcie_clock_req)
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9287PciePhy_clkreq_off_L1_9287_1_0,
+                        ARRAY_SIZE(ar9287PciePhy_clkreq_off_L1_9287_1_0), 2);
+                else
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9287PciePhy_clkreq_always_on_L1_9287_1_0,
+                        ARRAY_SIZE(ar9287PciePhy_clkreq_always_on_L1_9287_1_0),
+                                  2);
+        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
+
+
+                INIT_INI_ARRAY(&ah->iniModes, ar9285Modes_9285_1_2,
+                               ARRAY_SIZE(ar9285Modes_9285_1_2), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9285Common_9285_1_2,
+                               ARRAY_SIZE(ar9285Common_9285_1_2), 2);
+
+                if (ah->config.pcie_clock_req) {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9285PciePhy_clkreq_off_L1_9285_1_2,
+                        ARRAY_SIZE(ar9285PciePhy_clkreq_off_L1_9285_1_2), 2);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9285PciePhy_clkreq_always_on_L1_9285_1_2,
+                        ARRAY_SIZE(ar9285PciePhy_clkreq_always_on_L1_9285_1_2),
+                                  2);
+                }
+        } else if (AR_SREV_9285_10_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9285Modes_9285,
+                               ARRAY_SIZE(ar9285Modes_9285), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9285Common_9285,
+                               ARRAY_SIZE(ar9285Common_9285), 2);
+
+                if (ah->config.pcie_clock_req) {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9285PciePhy_clkreq_off_L1_9285,
+                        ARRAY_SIZE(ar9285PciePhy_clkreq_off_L1_9285), 2);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                        ar9285PciePhy_clkreq_always_on_L1_9285,
+                        ARRAY_SIZE(ar9285PciePhy_clkreq_always_on_L1_9285), 2);
+                }
+        } else if (AR_SREV_9280_20_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9280Modes_9280_2,
+                               ARRAY_SIZE(ar9280Modes_9280_2), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9280Common_9280_2,
+                               ARRAY_SIZE(ar9280Common_9280_2), 2);
+
+                if (ah->config.pcie_clock_req) {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                               ar9280PciePhy_clkreq_off_L1_9280,
+                               ARRAY_SIZE(ar9280PciePhy_clkreq_off_L1_9280), 2);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                               ar9280PciePhy_clkreq_always_on_L1_9280,
+                               ARRAY_SIZE(ar9280PciePhy_clkreq_always_on_L1_9280), 2);
+                }
+                INIT_INI_ARRAY(&ah->iniModesAdditional,
+                               ar9280Modes_fast_clock_9280_2,
+                               ARRAY_SIZE(ar9280Modes_fast_clock_9280_2), 3);
+        } else if (AR_SREV_9280_10_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar9280Modes_9280,
+                               ARRAY_SIZE(ar9280Modes_9280), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar9280Common_9280,
+                               ARRAY_SIZE(ar9280Common_9280), 2);
+        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes_9160,
+                               ARRAY_SIZE(ar5416Modes_9160), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common_9160,
+                               ARRAY_SIZE(ar5416Common_9160), 2);
+                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0_9160,
+                               ARRAY_SIZE(ar5416Bank0_9160), 2);
+                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain_9160,
+                               ARRAY_SIZE(ar5416BB_RfGain_9160), 3);
+                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1_9160,
+                               ARRAY_SIZE(ar5416Bank1_9160), 2);
+                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2_9160,
+                               ARRAY_SIZE(ar5416Bank2_9160), 2);
+                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3_9160,
+                               ARRAY_SIZE(ar5416Bank3_9160), 3);
+                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6_9160,
+                               ARRAY_SIZE(ar5416Bank6_9160), 3);
+                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC_9160,
+                               ARRAY_SIZE(ar5416Bank6TPC_9160), 3);
+                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7_9160,
+                               ARRAY_SIZE(ar5416Bank7_9160), 2);
+                if (AR_SREV_9160_11(ah)) {
+                        INIT_INI_ARRAY(&ah->iniAddac,
+                                       ar5416Addac_91601_1,
+                                       ARRAY_SIZE(ar5416Addac_91601_1), 2);
+                } else {
+                        INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac_9160,
+                                       ARRAY_SIZE(ar5416Addac_9160), 2);
+                }
+        } else if (AR_SREV_9100_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes_9100,
+                               ARRAY_SIZE(ar5416Modes_9100), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common_9100,
+                               ARRAY_SIZE(ar5416Common_9100), 2);
+                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0_9100,
+                               ARRAY_SIZE(ar5416Bank0_9100), 2);
+                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain_9100,
+                               ARRAY_SIZE(ar5416BB_RfGain_9100), 3);
+                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1_9100,
+                               ARRAY_SIZE(ar5416Bank1_9100), 2);
+                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2_9100,
+                               ARRAY_SIZE(ar5416Bank2_9100), 2);
+                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3_9100,
+                               ARRAY_SIZE(ar5416Bank3_9100), 3);
+                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6_9100,
+                               ARRAY_SIZE(ar5416Bank6_9100), 3);
+                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC_9100,
+                               ARRAY_SIZE(ar5416Bank6TPC_9100), 3);
+                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7_9100,
+                               ARRAY_SIZE(ar5416Bank7_9100), 2);
+                INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac_9100,
+                               ARRAY_SIZE(ar5416Addac_9100), 2);
+        } else {
+                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes,
+                               ARRAY_SIZE(ar5416Modes), 6);
+                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common,
+                               ARRAY_SIZE(ar5416Common), 2);
+                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0,
+                               ARRAY_SIZE(ar5416Bank0), 2);
+                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain,
+                               ARRAY_SIZE(ar5416BB_RfGain), 3);
+                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1,
+                               ARRAY_SIZE(ar5416Bank1), 2);
+                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2,
+                               ARRAY_SIZE(ar5416Bank2), 2);
+                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3,
+                               ARRAY_SIZE(ar5416Bank3), 3);
+                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6,
+                               ARRAY_SIZE(ar5416Bank6), 3);
+                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC,
+                               ARRAY_SIZE(ar5416Bank6TPC), 3);
+                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7,
+                               ARRAY_SIZE(ar5416Bank7), 2);
+                INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
+                               ARRAY_SIZE(ar5416Addac), 2);
+        }
+}
+
+/* Support for Japan ch.14 (2484) spread */
+void ar9002_hw_cck_chan14_spread(struct ath_hw *ah)
+{
+        if (AR_SREV_9287_11_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniCckfirNormal,
+                       ar9287Common_normal_cck_fir_coeff_92871_1,
+                       ARRAY_SIZE(ar9287Common_normal_cck_fir_coeff_92871_1),
+                       2);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                       ar9287Common_japan_2484_cck_fir_coeff_92871_1,
+                       ARRAY_SIZE(ar9287Common_japan_2484_cck_fir_coeff_92871_1),
+                       2);
+        }
+}
+
+static void ar9280_20_hw_init_rxgain_ini(struct ath_hw *ah)
+{
+        u32 rxgain_type;
+
+        if (ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV) >=
+            AR5416_EEP_MINOR_VER_17) {
+                rxgain_type = ah->eep_ops->get_eeprom(ah, EEP_RXGAIN_TYPE);
+
+                if (rxgain_type == AR5416_EEP_RXGAIN_13DB_BACKOFF)
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar9280Modes_backoff_13db_rxgain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_backoff_13db_rxgain_9280_2), 6);
+                else if (rxgain_type == AR5416_EEP_RXGAIN_23DB_BACKOFF)
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar9280Modes_backoff_23db_rxgain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_backoff_23db_rxgain_9280_2), 6);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar9280Modes_original_rxgain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_original_rxgain_9280_2), 6);
+        } else {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                        ar9280Modes_original_rxgain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_original_rxgain_9280_2), 6);
+        }
+}
+
+static void ar9280_20_hw_init_txgain_ini(struct ath_hw *ah)
+{
+        u32 txgain_type;
+
+        if (ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV) >=
+            AR5416_EEP_MINOR_VER_19) {
+                txgain_type = ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE);
+
+                if (txgain_type == AR5416_EEP_TXGAIN_HIGH_POWER)
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9280Modes_high_power_tx_gain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_high_power_tx_gain_9280_2), 6);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        ar9280Modes_original_tx_gain_9280_2,
+                        ARRAY_SIZE(ar9280Modes_original_tx_gain_9280_2), 6);
+        } else {
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                ar9280Modes_original_tx_gain_9280_2,
+                ARRAY_SIZE(ar9280Modes_original_tx_gain_9280_2), 6);
+        }
+}
+
+static void ar9002_hw_init_mode_gain_regs(struct ath_hw *ah)
+{
+        if (AR_SREV_9287_11_OR_LATER(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                ar9287Modes_rx_gain_9287_1_1,
+                ARRAY_SIZE(ar9287Modes_rx_gain_9287_1_1), 6);
+        else if (AR_SREV_9287_10(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                ar9287Modes_rx_gain_9287_1_0,
+                ARRAY_SIZE(ar9287Modes_rx_gain_9287_1_0), 6);
+        else if (AR_SREV_9280_20(ah))
+                ar9280_20_hw_init_rxgain_ini(ah);
+
+        if (AR_SREV_9287_11_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                ar9287Modes_tx_gain_9287_1_1,
+                ARRAY_SIZE(ar9287Modes_tx_gain_9287_1_1), 6);
+        } else if (AR_SREV_9287_10(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                ar9287Modes_tx_gain_9287_1_0,
+                ARRAY_SIZE(ar9287Modes_tx_gain_9287_1_0), 6);
+        } else if (AR_SREV_9280_20(ah)) {
+                ar9280_20_hw_init_txgain_ini(ah);
+        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
+                u32 txgain_type = ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE);
+
+                /* txgain table */
+                if (txgain_type == AR5416_EEP_TXGAIN_HIGH_POWER) {
+                        if (AR_SREV_9285E_20(ah)) {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_XE2_0_high_power,
+                                ARRAY_SIZE(
+                                  ar9285Modes_XE2_0_high_power), 6);
+                        } else {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_high_power_tx_gain_9285_1_2,
+                                ARRAY_SIZE(
+                                  ar9285Modes_high_power_tx_gain_9285_1_2), 6);
+                        }
+                } else {
+                        if (AR_SREV_9285E_20(ah)) {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_XE2_0_normal_power,
+                                ARRAY_SIZE(
+                                  ar9285Modes_XE2_0_normal_power), 6);
+                        } else {
+                                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                ar9285Modes_original_tx_gain_9285_1_2,
+                                ARRAY_SIZE(
+                                  ar9285Modes_original_tx_gain_9285_1_2), 6);
+                        }
+                }
+        }
+}
+
+/*
+ * Helper for ASPM support.
+ *
+ * Disable PLL when in L0s as well as receiver clock when in L1.
+ * This power saving option must be enabled through the SerDes.
+ *
+ * Programming the SerDes must go through the same 288 bit serial shift
+ * register as the other analog registers.  Hence the 9 writes.
+ */
+static void ar9002_hw_configpcipowersave(struct ath_hw *ah,
+                                         int restore,
+                                         int power_off)
+{
+        u8 i;
+        u32 val;
+
+        if (ah->is_pciexpress != true)
+                return;
+
+        /* Do not touch SerDes registers */
+        if (ah->config.pcie_powersave_enable == 2)
+                return;
+
+        /* Nothing to do on restore for 11N */
+        if (!restore) {
+                if (AR_SREV_9280_20_OR_LATER(ah)) {
+                        /*
+                         * AR9280 2.0 or later chips use SerDes values from the
+                         * initvals.h initialized depending on chipset during
+                         * __ath9k_hw_init()
+                         */
+                        for (i = 0; i < ah->iniPcieSerdes.ia_rows; i++) {
+                                REG_WRITE(ah, INI_RA(&ah->iniPcieSerdes, i, 0),
+                                          INI_RA(&ah->iniPcieSerdes, i, 1));
+                        }
+                } else if (AR_SREV_9280(ah) &&
+                           (ah->hw_version.macRev == AR_SREV_REVISION_9280_10)) {
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x9248fd00);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x24924924);
+
+                        /* RX shut off when elecidle is asserted */
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0xa8000019);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x13160820);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0xe5980560);
+
+                        /* Shut off CLKREQ active in L1 */
+                        if (ah->config.pcie_clock_req)
+                                REG_WRITE(ah, AR_PCIE_SERDES, 0x401deffc);
+                        else
+                                REG_WRITE(ah, AR_PCIE_SERDES, 0x401deffd);
+
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x1aaabe40);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0xbe105554);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x00043007);
+
+                        /* Load the new settings */
+                        REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
+
+                } else {
+                        ENABLE_REGWRITE_BUFFER(ah);
+
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x9248fc00);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x24924924);
+
+                        /* RX shut off when elecidle is asserted */
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x28000039);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x53160824);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0xe5980579);
+
+                        /*
+                         * Ignore ah->ah_config.pcie_clock_req setting for
+                         * pre-AR9280 11n
+                         */
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x001defff);
+
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x1aaabe40);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0xbe105554);
+                        REG_WRITE(ah, AR_PCIE_SERDES, 0x000e3007);
+
+                        /* Load the new settings */
+                        REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
+
+                        REGWRITE_BUFFER_FLUSH(ah);
+                        DISABLE_REGWRITE_BUFFER(ah);
+                }
+
+                udelay(1000);
+
+                /* set bit 19 to allow forcing of pcie core into L1 state */
+                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
+
+                /* Several PCIe massages to ensure proper behaviour */
+                if (ah->config.pcie_waen) {
+                        val = ah->config.pcie_waen;
+                        if (!power_off)
+                                val &= (~AR_WA_D3_L1_DISABLE);
+                } else {
+                        if (AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
+                            AR_SREV_9287(ah)) {
+                                val = AR9285_WA_DEFAULT;
+                                if (!power_off)
+                                        val &= (~AR_WA_D3_L1_DISABLE);
+                        } else if (AR_SREV_9280(ah)) {
+                                /*
+                                 * On AR9280 chips bit 22 of 0x4004 needs to be
+                                 * set otherwise card may disappear.
+                                 */
+                                val = AR9280_WA_DEFAULT;
+                                if (!power_off)
+                                        val &= (~AR_WA_D3_L1_DISABLE);
+                        } else
+                                val = AR_WA_DEFAULT;
+                }
+
+                REG_WRITE(ah, AR_WA, val);
+        }
+
+        if (power_off) {
+                /*
+                 * Set PCIe workaround bits
+                 * bit 14 in WA register (disable L1) should only
+                 * be set when device enters D3 and be cleared
+                 * when device comes back to D0.
+                 */
+                if (ah->config.pcie_waen) {
+                        if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
+                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
+                } else {
+                        if (((AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
+                              AR_SREV_9287(ah)) &&
+                             (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
+                            (AR_SREV_9280(ah) &&
+                             (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
+                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
+                        }
+                }
+        }
+}
+
+static int ar9002_hw_get_radiorev(struct ath_hw *ah)
+{
+        u32 val;
+        int i;
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_PHY(0x36), 0x00007058);
+        for (i = 0; i < 8; i++)
+                REG_WRITE(ah, AR_PHY(0x20), 0x00010000);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        val = (REG_READ(ah, AR_PHY(256)) >> 24) & 0xff;
+        val = ((val & 0xf0) >> 4) | ((val & 0x0f) << 4);
+
+        return ath9k_hw_reverse_bits(val, 8);
+}
+
+int ar9002_hw_rf_claim(struct ath_hw *ah)
+{
+        u32 val;
+
+        REG_WRITE(ah, AR_PHY(0), 0x00000007);
+
+        val = ar9002_hw_get_radiorev(ah);
+        switch (val & AR_RADIO_SREV_MAJOR) {
+        case 0:
+                val = AR_RAD5133_SREV_MAJOR;
+                break;
+        case AR_RAD5133_SREV_MAJOR:
+        case AR_RAD5122_SREV_MAJOR:
+        case AR_RAD2133_SREV_MAJOR:
+        case AR_RAD2122_SREV_MAJOR:
+                break;
+        default:
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Radio Chip Rev 0x%02X not supported\n",
+                          val & AR_RADIO_SREV_MAJOR);
+                return -EOPNOTSUPP;
+        }
+
+        ah->hw_version.analog5GhzRev = val;
+
+        return 0;
+}
+
+/*
+ * Enable ASYNC FIFO
+ *
+ * If Async FIFO is enabled, the following counters change as MAC now runs
+ * at 117 Mhz instead of 88/44MHz when async FIFO is disabled.
+ *
+ * The values below tested for ht40 2 chain.
+ * Overwrite the delay/timeouts initialized in process ini.
+ */
+void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
+{
+        if (AR_SREV_9287_12_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_D_GBL_IFS_SIFS,
+                          AR_D_GBL_IFS_SIFS_ASYNC_FIFO_DUR);
+                REG_WRITE(ah, AR_D_GBL_IFS_SLOT,
+                          AR_D_GBL_IFS_SLOT_ASYNC_FIFO_DUR);
+                REG_WRITE(ah, AR_D_GBL_IFS_EIFS,
+                          AR_D_GBL_IFS_EIFS_ASYNC_FIFO_DUR);
+
+                REG_WRITE(ah, AR_TIME_OUT, AR_TIME_OUT_ACK_CTS_ASYNC_FIFO_DUR);
+                REG_WRITE(ah, AR_USEC, AR_USEC_ASYNC_FIFO_DUR);
+
+                REG_SET_BIT(ah, AR_MAC_PCU_LOGIC_ANALYZER,
+                            AR_MAC_PCU_LOGIC_ANALYZER_DISBUG20768);
+                REG_RMW_FIELD(ah, AR_AHB_MODE, AR_AHB_CUSTOM_BURST_EN,
+                              AR_AHB_CUSTOM_BURST_ASYNC_FIFO_VAL);
+        }
+}
+
+/*
+ * We don't enable WEP aggregation on mac80211 but we keep this
+ * around for HAL unification purposes.
+ */
+void ar9002_hw_enable_wep_aggregation(struct ath_hw *ah)
+{
+        if (AR_SREV_9287_12_OR_LATER(ah)) {
+                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
+                                AR_PCU_MISC_MODE2_ENABLE_AGGWEP);
+        }
+}
+
+/* Sets up the AR5008/AR9001/AR9002 hardware familiy callbacks */
+void ar9002_hw_attach_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->init_mode_regs = ar9002_hw_init_mode_regs;
+        priv_ops->init_mode_gain_regs = ar9002_hw_init_mode_gain_regs;
+        priv_ops->macversion_supported = ar9002_hw_macversion_supported;
+
+        ops->config_pci_powersave = ar9002_hw_configpcipowersave;
+
+        ar5008_hw_attach_phy_ops(ah);
+        if (AR_SREV_9280_10_OR_LATER(ah))
+                ar9002_hw_attach_phy_ops(ah);
+
+        ar9002_hw_attach_calib_ops(ah);
+        ar9002_hw_attach_mac_ops(ah);
+}
diff --git a/drivers/net/wireless/ath/ath9k/initvals.h b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
index 455e9d3b3f13..dae7f3304eb8 100644
--- a/drivers/net/wireless/ath/ath9k/initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 Atheros Communications Inc.
+ * Copyright (c) 2010 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,1982 +14,9 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-static const u32 ar5416Modes[][6] = {
-    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
-    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
-    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
-    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
-    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
-    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
-    { 0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810, 0x08f04810 },
-    { 0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a, 0x0000320a },
-    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
-    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
-    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
-    { 0x00009844, 0x1372161e, 0x1372161e, 0x137216a0, 0x137216a0, 0x137216a0 },
-    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x00009850, 0x6c48b4e0, 0x6d48b4e0, 0x6d48b0de, 0x6c48b0de, 0x6c48b0de },
-    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e },
-    { 0x0000985c, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e, 0x31395d5e },
-    { 0x00009860, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18, 0x00049d18 },
-    { 0x00009864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
-    { 0x00009868, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190, 0x409a4190 },
-    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
-    { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
-    { 0x00009918, 0x000001b8, 0x00000370, 0x00000268, 0x00000134, 0x00000134 },
-    { 0x00009924, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b, 0xd0058a0b },
-    { 0x00009944, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020 },
-    { 0x00009960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
-    { 0x0000a960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
-    { 0x0000b960, 0x00000900, 0x00000900, 0x00012d80, 0x00012d80, 0x00012d80 },
-    { 0x00009964, 0x00000000, 0x00000000, 0x00001120, 0x00001120, 0x00001120 },
-    { 0x000099bc, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00, 0x001a0a00 },
-    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
-    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
-    { 0x000099c8, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c, 0x6af6532c },
-    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
-    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
-    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
-    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
-    { 0x0000a20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000b20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000c20c, 0x002ec1e0, 0x002ec1e0, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
-    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
-    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
-    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
-    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
-    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
-    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
-    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
-    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
-    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
-    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
-    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
-    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
-    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-};
-
-static const u32 ar5416Common[][2] = {
-    { 0x0000000c, 0x00000000 },
-    { 0x00000030, 0x00020015 },
-    { 0x00000034, 0x00000005 },
-    { 0x00000040, 0x00000000 },
-    { 0x00000044, 0x00000008 },
-    { 0x00000048, 0x00000008 },
-    { 0x0000004c, 0x00000010 },
-    { 0x00000050, 0x00000000 },
-    { 0x00000054, 0x0000001f },
-    { 0x00000800, 0x00000000 },
-    { 0x00000804, 0x00000000 },
-    { 0x00000808, 0x00000000 },
-    { 0x0000080c, 0x00000000 },
-    { 0x00000810, 0x00000000 },
-    { 0x00000814, 0x00000000 },
-    { 0x00000818, 0x00000000 },
-    { 0x0000081c, 0x00000000 },
-    { 0x00000820, 0x00000000 },
-    { 0x00000824, 0x00000000 },
-    { 0x00001040, 0x002ffc0f },
-    { 0x00001044, 0x002ffc0f },
-    { 0x00001048, 0x002ffc0f },
-    { 0x0000104c, 0x002ffc0f },
-    { 0x00001050, 0x002ffc0f },
-    { 0x00001054, 0x002ffc0f },
-    { 0x00001058, 0x002ffc0f },
-    { 0x0000105c, 0x002ffc0f },
-    { 0x00001060, 0x002ffc0f },
-    { 0x00001064, 0x002ffc0f },
-    { 0x00001230, 0x00000000 },
-    { 0x00001270, 0x00000000 },
-    { 0x00001038, 0x00000000 },
-    { 0x00001078, 0x00000000 },
-    { 0x000010b8, 0x00000000 },
-    { 0x000010f8, 0x00000000 },
-    { 0x00001138, 0x00000000 },
-    { 0x00001178, 0x00000000 },
-    { 0x000011b8, 0x00000000 },
-    { 0x000011f8, 0x00000000 },
-    { 0x00001238, 0x00000000 },
-    { 0x00001278, 0x00000000 },
-    { 0x000012b8, 0x00000000 },
-    { 0x000012f8, 0x00000000 },
-    { 0x00001338, 0x00000000 },
-    { 0x00001378, 0x00000000 },
-    { 0x000013b8, 0x00000000 },
-    { 0x000013f8, 0x00000000 },
-    { 0x00001438, 0x00000000 },
-    { 0x00001478, 0x00000000 },
-    { 0x000014b8, 0x00000000 },
-    { 0x000014f8, 0x00000000 },
-    { 0x00001538, 0x00000000 },
-    { 0x00001578, 0x00000000 },
-    { 0x000015b8, 0x00000000 },
-    { 0x000015f8, 0x00000000 },
-    { 0x00001638, 0x00000000 },
-    { 0x00001678, 0x00000000 },
-    { 0x000016b8, 0x00000000 },
-    { 0x000016f8, 0x00000000 },
-    { 0x00001738, 0x00000000 },
-    { 0x00001778, 0x00000000 },
-    { 0x000017b8, 0x00000000 },
-    { 0x000017f8, 0x00000000 },
-    { 0x0000103c, 0x00000000 },
-    { 0x0000107c, 0x00000000 },
-    { 0x000010bc, 0x00000000 },
-    { 0x000010fc, 0x00000000 },
-    { 0x0000113c, 0x00000000 },
-    { 0x0000117c, 0x00000000 },
-    { 0x000011bc, 0x00000000 },
-    { 0x000011fc, 0x00000000 },
-    { 0x0000123c, 0x00000000 },
-    { 0x0000127c, 0x00000000 },
-    { 0x000012bc, 0x00000000 },
-    { 0x000012fc, 0x00000000 },
-    { 0x0000133c, 0x00000000 },
-    { 0x0000137c, 0x00000000 },
-    { 0x000013bc, 0x00000000 },
-    { 0x000013fc, 0x00000000 },
-    { 0x0000143c, 0x00000000 },
-    { 0x0000147c, 0x00000000 },
-    { 0x00004030, 0x00000002 },
-    { 0x0000403c, 0x00000002 },
-    { 0x00007010, 0x00000000 },
-    { 0x00007038, 0x000004c2 },
-    { 0x00008004, 0x00000000 },
-    { 0x00008008, 0x00000000 },
-    { 0x0000800c, 0x00000000 },
-    { 0x00008018, 0x00000700 },
-    { 0x00008020, 0x00000000 },
-    { 0x00008038, 0x00000000 },
-    { 0x0000803c, 0x00000000 },
-    { 0x00008048, 0x40000000 },
-    { 0x00008054, 0x00000000 },
-    { 0x00008058, 0x00000000 },
-    { 0x0000805c, 0x000fc78f },
-    { 0x00008060, 0x0000000f },
-    { 0x00008064, 0x00000000 },
-    { 0x000080c0, 0x2a82301a },
-    { 0x000080c4, 0x05dc01e0 },
-    { 0x000080c8, 0x1f402710 },
-    { 0x000080cc, 0x01f40000 },
-    { 0x000080d0, 0x00001e00 },
-    { 0x000080d4, 0x00000000 },
-    { 0x000080d8, 0x00400000 },
-    { 0x000080e0, 0xffffffff },
-    { 0x000080e4, 0x0000ffff },
-    { 0x000080e8, 0x003f3f3f },
-    { 0x000080ec, 0x00000000 },
-    { 0x000080f0, 0x00000000 },
-    { 0x000080f4, 0x00000000 },
-    { 0x000080f8, 0x00000000 },
-    { 0x000080fc, 0x00020000 },
-    { 0x00008100, 0x00020000 },
-    { 0x00008104, 0x00000001 },
-    { 0x00008108, 0x00000052 },
-    { 0x0000810c, 0x00000000 },
-    { 0x00008110, 0x00000168 },
-    { 0x00008118, 0x000100aa },
-    { 0x0000811c, 0x00003210 },
-    { 0x00008124, 0x00000000 },
-    { 0x00008128, 0x00000000 },
-    { 0x0000812c, 0x00000000 },
-    { 0x00008130, 0x00000000 },
-    { 0x00008134, 0x00000000 },
-    { 0x00008138, 0x00000000 },
-    { 0x0000813c, 0x00000000 },
-    { 0x00008144, 0xffffffff },
-    { 0x00008168, 0x00000000 },
-    { 0x0000816c, 0x00000000 },
-    { 0x00008170, 0x32143320 },
-    { 0x00008174, 0xfaa4fa50 },
-    { 0x00008178, 0x00000100 },
-    { 0x0000817c, 0x00000000 },
-    { 0x000081c4, 0x00000000 },
-    { 0x000081ec, 0x00000000 },
-    { 0x000081f0, 0x00000000 },
-    { 0x000081f4, 0x00000000 },
-    { 0x000081f8, 0x00000000 },
-    { 0x000081fc, 0x00000000 },
-    { 0x00008200, 0x00000000 },
-    { 0x00008204, 0x00000000 },
-    { 0x00008208, 0x00000000 },
-    { 0x0000820c, 0x00000000 },
-    { 0x00008210, 0x00000000 },
-    { 0x00008214, 0x00000000 },
-    { 0x00008218, 0x00000000 },
-    { 0x0000821c, 0x00000000 },
-    { 0x00008220, 0x00000000 },
-    { 0x00008224, 0x00000000 },
-    { 0x00008228, 0x00000000 },
-    { 0x0000822c, 0x00000000 },
-    { 0x00008230, 0x00000000 },
-    { 0x00008234, 0x00000000 },
-    { 0x00008238, 0x00000000 },
-    { 0x0000823c, 0x00000000 },
-    { 0x00008240, 0x00100000 },
-    { 0x00008244, 0x0010f400 },
-    { 0x00008248, 0x00000100 },
-    { 0x0000824c, 0x0001e800 },
-    { 0x00008250, 0x00000000 },
-    { 0x00008254, 0x00000000 },
-    { 0x00008258, 0x00000000 },
-    { 0x0000825c, 0x400000ff },
-    { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8000010 },
-    { 0x00008270, 0x00000000 },
-    { 0x00008274, 0x40000000 },
-    { 0x00008278, 0x003e4180 },
-    { 0x0000827c, 0x00000000 },
-    { 0x00008284, 0x0000002c },
-    { 0x00008288, 0x0000002c },
-    { 0x0000828c, 0x00000000 },
-    { 0x00008294, 0x00000000 },
-    { 0x00008298, 0x00000000 },
-    { 0x00008300, 0x00000000 },
-    { 0x00008304, 0x00000000 },
-    { 0x00008308, 0x00000000 },
-    { 0x0000830c, 0x00000000 },
-    { 0x00008310, 0x00000000 },
-    { 0x00008314, 0x00000000 },
-    { 0x00008318, 0x00000000 },
-    { 0x00008328, 0x00000000 },
-    { 0x0000832c, 0x00000007 },
-    { 0x00008330, 0x00000302 },
-    { 0x00008334, 0x00000e00 },
-    { 0x00008338, 0x00070000 },
-    { 0x0000833c, 0x00000000 },
-    { 0x00008340, 0x000107ff },
-    { 0x00009808, 0x00000000 },
-    { 0x0000980c, 0xad848e19 },
-    { 0x00009810, 0x7d14e000 },
-    { 0x00009814, 0x9c0a9f6b },
-    { 0x0000981c, 0x00000000 },
-    { 0x0000982c, 0x0000a000 },
-    { 0x00009830, 0x00000000 },
-    { 0x0000983c, 0x00200400 },
-    { 0x00009840, 0x206a002e },
-    { 0x0000984c, 0x1284233c },
-    { 0x00009854, 0x00000859 },
-    { 0x00009900, 0x00000000 },
-    { 0x00009904, 0x00000000 },
-    { 0x00009908, 0x00000000 },
-    { 0x0000990c, 0x00000000 },
-    { 0x0000991c, 0x10000fff },
-    { 0x00009920, 0x05100000 },
-    { 0x0000a920, 0x05100000 },
-    { 0x0000b920, 0x05100000 },
-    { 0x00009928, 0x00000001 },
-    { 0x0000992c, 0x00000004 },
-    { 0x00009934, 0x1e1f2022 },
-    { 0x00009938, 0x0a0b0c0d },
-    { 0x0000993c, 0x00000000 },
-    { 0x00009948, 0x9280b212 },
-    { 0x0000994c, 0x00020028 },
-    { 0x00009954, 0x5d50e188 },
-    { 0x00009958, 0x00081fff },
-    { 0x0000c95c, 0x004b6a8e },
-    { 0x0000c968, 0x000003ce },
-    { 0x00009970, 0x190fb515 },
-    { 0x00009974, 0x00000000 },
-    { 0x00009978, 0x00000001 },
-    { 0x0000997c, 0x00000000 },
-    { 0x00009980, 0x00000000 },
-    { 0x00009984, 0x00000000 },
-    { 0x00009988, 0x00000000 },
-    { 0x0000998c, 0x00000000 },
-    { 0x00009990, 0x00000000 },
-    { 0x00009994, 0x00000000 },
-    { 0x00009998, 0x00000000 },
-    { 0x0000999c, 0x00000000 },
-    { 0x000099a0, 0x00000000 },
-    { 0x000099a4, 0x00000001 },
-    { 0x000099a8, 0x001fff00 },
-    { 0x000099ac, 0x00000000 },
-    { 0x000099b0, 0x03051000 },
-    { 0x000099dc, 0x00000000 },
-    { 0x000099e0, 0x00000200 },
-    { 0x000099e4, 0xaaaaaaaa },
-    { 0x000099e8, 0x3c466478 },
-    { 0x000099ec, 0x000000aa },
-    { 0x000099fc, 0x00001042 },
-    { 0x00009b00, 0x00000000 },
-    { 0x00009b04, 0x00000001 },
-    { 0x00009b08, 0x00000002 },
-    { 0x00009b0c, 0x00000003 },
-    { 0x00009b10, 0x00000004 },
-    { 0x00009b14, 0x00000005 },
-    { 0x00009b18, 0x00000008 },
-    { 0x00009b1c, 0x00000009 },
-    { 0x00009b20, 0x0000000a },
-    { 0x00009b24, 0x0000000b },
-    { 0x00009b28, 0x0000000c },
-    { 0x00009b2c, 0x0000000d },
-    { 0x00009b30, 0x00000010 },
-    { 0x00009b34, 0x00000011 },
-    { 0x00009b38, 0x00000012 },
-    { 0x00009b3c, 0x00000013 },
-    { 0x00009b40, 0x00000014 },
-    { 0x00009b44, 0x00000015 },
-    { 0x00009b48, 0x00000018 },
-    { 0x00009b4c, 0x00000019 },
-    { 0x00009b50, 0x0000001a },
-    { 0x00009b54, 0x0000001b },
-    { 0x00009b58, 0x0000001c },
-    { 0x00009b5c, 0x0000001d },
-    { 0x00009b60, 0x00000020 },
-    { 0x00009b64, 0x00000021 },
-    { 0x00009b68, 0x00000022 },
-    { 0x00009b6c, 0x00000023 },
-    { 0x00009b70, 0x00000024 },
-    { 0x00009b74, 0x00000025 },
-    { 0x00009b78, 0x00000028 },
-    { 0x00009b7c, 0x00000029 },
-    { 0x00009b80, 0x0000002a },
-    { 0x00009b84, 0x0000002b },
-    { 0x00009b88, 0x0000002c },
-    { 0x00009b8c, 0x0000002d },
-    { 0x00009b90, 0x00000030 },
-    { 0x00009b94, 0x00000031 },
-    { 0x00009b98, 0x00000032 },
-    { 0x00009b9c, 0x00000033 },
-    { 0x00009ba0, 0x00000034 },
-    { 0x00009ba4, 0x00000035 },
-    { 0x00009ba8, 0x00000035 },
-    { 0x00009bac, 0x00000035 },
-    { 0x00009bb0, 0x00000035 },
-    { 0x00009bb4, 0x00000035 },
-    { 0x00009bb8, 0x00000035 },
-    { 0x00009bbc, 0x00000035 },
-    { 0x00009bc0, 0x00000035 },
-    { 0x00009bc4, 0x00000035 },
-    { 0x00009bc8, 0x00000035 },
-    { 0x00009bcc, 0x00000035 },
-    { 0x00009bd0, 0x00000035 },
-    { 0x00009bd4, 0x00000035 },
-    { 0x00009bd8, 0x00000035 },
-    { 0x00009bdc, 0x00000035 },
-    { 0x00009be0, 0x00000035 },
-    { 0x00009be4, 0x00000035 },
-    { 0x00009be8, 0x00000035 },
-    { 0x00009bec, 0x00000035 },
-    { 0x00009bf0, 0x00000035 },
-    { 0x00009bf4, 0x00000035 },
-    { 0x00009bf8, 0x00000010 },
-    { 0x00009bfc, 0x0000001a },
-    { 0x0000a210, 0x40806333 },
-    { 0x0000a214, 0x00106c10 },
-    { 0x0000a218, 0x009c4060 },
-    { 0x0000a220, 0x018830c6 },
-    { 0x0000a224, 0x00000400 },
-    { 0x0000a228, 0x00000bb5 },
-    { 0x0000a22c, 0x00000011 },
-    { 0x0000a234, 0x20202020 },
-    { 0x0000a238, 0x20202020 },
-    { 0x0000a23c, 0x13c889af },
-    { 0x0000a240, 0x38490a20 },
-    { 0x0000a244, 0x00007bb6 },
-    { 0x0000a248, 0x0fff3ffc },
-    { 0x0000a24c, 0x00000001 },
-    { 0x0000a250, 0x0000a000 },
-    { 0x0000a254, 0x00000000 },
-    { 0x0000a258, 0x0cc75380 },
-    { 0x0000a25c, 0x0f0f0f01 },
-    { 0x0000a260, 0xdfa91f01 },
-    { 0x0000a268, 0x00000000 },
-    { 0x0000a26c, 0x0e79e5c6 },
-    { 0x0000b26c, 0x0e79e5c6 },
-    { 0x0000c26c, 0x0e79e5c6 },
-    { 0x0000d270, 0x00820820 },
-    { 0x0000a278, 0x1ce739ce },
-    { 0x0000a27c, 0x051701ce },
-    { 0x0000a338, 0x00000000 },
-    { 0x0000a33c, 0x00000000 },
-    { 0x0000a340, 0x00000000 },
-    { 0x0000a344, 0x00000000 },
-    { 0x0000a348, 0x3fffffff },
-    { 0x0000a34c, 0x3fffffff },
-    { 0x0000a350, 0x3fffffff },
-    { 0x0000a354, 0x0003ffff },
-    { 0x0000a358, 0x79a8aa1f },
-    { 0x0000d35c, 0x07ffffef },
-    { 0x0000d360, 0x0fffffe7 },
-    { 0x0000d364, 0x17ffffe5 },
-    { 0x0000d368, 0x1fffffe4 },
-    { 0x0000d36c, 0x37ffffe3 },
-    { 0x0000d370, 0x3fffffe3 },
-    { 0x0000d374, 0x57ffffe3 },
-    { 0x0000d378, 0x5fffffe2 },
-    { 0x0000d37c, 0x7fffffe2 },
-    { 0x0000d380, 0x7f3c7bba },
-    { 0x0000d384, 0xf3307ff0 },
-    { 0x0000a388, 0x08000000 },
-    { 0x0000a38c, 0x20202020 },
-    { 0x0000a390, 0x20202020 },
-    { 0x0000a394, 0x1ce739ce },
-    { 0x0000a398, 0x000001ce },
-    { 0x0000a39c, 0x00000001 },
-    { 0x0000a3a0, 0x00000000 },
-    { 0x0000a3a4, 0x00000000 },
-    { 0x0000a3a8, 0x00000000 },
-    { 0x0000a3ac, 0x00000000 },
-    { 0x0000a3b0, 0x00000000 },
-    { 0x0000a3b4, 0x00000000 },
-    { 0x0000a3b8, 0x00000000 },
-    { 0x0000a3bc, 0x00000000 },
-    { 0x0000a3c0, 0x00000000 },
-    { 0x0000a3c4, 0x00000000 },
-    { 0x0000a3c8, 0x00000246 },
-    { 0x0000a3cc, 0x20202020 },
-    { 0x0000a3d0, 0x20202020 },
-    { 0x0000a3d4, 0x20202020 },
-    { 0x0000a3dc, 0x1ce739ce },
-    { 0x0000a3e0, 0x000001ce },
-};
-
-static const u32 ar5416Bank0[][2] = {
-    { 0x000098b0, 0x1e5795e5 },
-    { 0x000098e0, 0x02008020 },
-};
-
-static const u32 ar5416BB_RfGain[][3] = {
-    { 0x00009a00, 0x00000000, 0x00000000 },
-    { 0x00009a04, 0x00000040, 0x00000040 },
-    { 0x00009a08, 0x00000080, 0x00000080 },
-    { 0x00009a0c, 0x000001a1, 0x00000141 },
-    { 0x00009a10, 0x000001e1, 0x00000181 },
-    { 0x00009a14, 0x00000021, 0x000001c1 },
-    { 0x00009a18, 0x00000061, 0x00000001 },
-    { 0x00009a1c, 0x00000168, 0x00000041 },
-    { 0x00009a20, 0x000001a8, 0x000001a8 },
-    { 0x00009a24, 0x000001e8, 0x000001e8 },
-    { 0x00009a28, 0x00000028, 0x00000028 },
-    { 0x00009a2c, 0x00000068, 0x00000068 },
-    { 0x00009a30, 0x00000189, 0x000000a8 },
-    { 0x00009a34, 0x000001c9, 0x00000169 },
-    { 0x00009a38, 0x00000009, 0x000001a9 },
-    { 0x00009a3c, 0x00000049, 0x000001e9 },
-    { 0x00009a40, 0x00000089, 0x00000029 },
-    { 0x00009a44, 0x00000170, 0x00000069 },
-    { 0x00009a48, 0x000001b0, 0x00000190 },
-    { 0x00009a4c, 0x000001f0, 0x000001d0 },
-    { 0x00009a50, 0x00000030, 0x00000010 },
-    { 0x00009a54, 0x00000070, 0x00000050 },
-    { 0x00009a58, 0x00000191, 0x00000090 },
-    { 0x00009a5c, 0x000001d1, 0x00000151 },
-    { 0x00009a60, 0x00000011, 0x00000191 },
-    { 0x00009a64, 0x00000051, 0x000001d1 },
-    { 0x00009a68, 0x00000091, 0x00000011 },
-    { 0x00009a6c, 0x000001b8, 0x00000051 },
-    { 0x00009a70, 0x000001f8, 0x00000198 },
-    { 0x00009a74, 0x00000038, 0x000001d8 },
-    { 0x00009a78, 0x00000078, 0x00000018 },
-    { 0x00009a7c, 0x00000199, 0x00000058 },
-    { 0x00009a80, 0x000001d9, 0x00000098 },
-    { 0x00009a84, 0x00000019, 0x00000159 },
-    { 0x00009a88, 0x00000059, 0x00000199 },
-    { 0x00009a8c, 0x00000099, 0x000001d9 },
-    { 0x00009a90, 0x000000d9, 0x00000019 },
-    { 0x00009a94, 0x000000f9, 0x00000059 },
-    { 0x00009a98, 0x000000f9, 0x00000099 },
-    { 0x00009a9c, 0x000000f9, 0x000000d9 },
-    { 0x00009aa0, 0x000000f9, 0x000000f9 },
-    { 0x00009aa4, 0x000000f9, 0x000000f9 },
-    { 0x00009aa8, 0x000000f9, 0x000000f9 },
-    { 0x00009aac, 0x000000f9, 0x000000f9 },
-    { 0x00009ab0, 0x000000f9, 0x000000f9 },
-    { 0x00009ab4, 0x000000f9, 0x000000f9 },
-    { 0x00009ab8, 0x000000f9, 0x000000f9 },
-    { 0x00009abc, 0x000000f9, 0x000000f9 },
-    { 0x00009ac0, 0x000000f9, 0x000000f9 },
-    { 0x00009ac4, 0x000000f9, 0x000000f9 },
-    { 0x00009ac8, 0x000000f9, 0x000000f9 },
-    { 0x00009acc, 0x000000f9, 0x000000f9 },
-    { 0x00009ad0, 0x000000f9, 0x000000f9 },
-    { 0x00009ad4, 0x000000f9, 0x000000f9 },
-    { 0x00009ad8, 0x000000f9, 0x000000f9 },
-    { 0x00009adc, 0x000000f9, 0x000000f9 },
-    { 0x00009ae0, 0x000000f9, 0x000000f9 },
-    { 0x00009ae4, 0x000000f9, 0x000000f9 },
-    { 0x00009ae8, 0x000000f9, 0x000000f9 },
-    { 0x00009aec, 0x000000f9, 0x000000f9 },
-    { 0x00009af0, 0x000000f9, 0x000000f9 },
-    { 0x00009af4, 0x000000f9, 0x000000f9 },
-    { 0x00009af8, 0x000000f9, 0x000000f9 },
-    { 0x00009afc, 0x000000f9, 0x000000f9 },
-};
-
-static const u32 ar5416Bank1[][2] = {
-    { 0x000098b0, 0x02108421 },
-    { 0x000098ec, 0x00000008 },
-};
-
-static const u32 ar5416Bank2[][2] = {
-    { 0x000098b0, 0x0e73ff17 },
-    { 0x000098e0, 0x00000420 },
-};
-
-static const u32 ar5416Bank3[][3] = {
-    { 0x000098f0, 0x01400018, 0x01c00018 },
-};
-
-static const u32 ar5416Bank6[][3] = {
-
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x004210a2, 0x004210a2 },
-    { 0x0000989c, 0x0014008f, 0x0014008f },
-    { 0x0000989c, 0x00c40003, 0x00c40003 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x0001805e, 0x0001805e },
-    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
-    { 0x0000989c, 0x000000f1, 0x000000f1 },
-    { 0x0000989c, 0x00002081, 0x00002081 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-static const u32 ar5416Bank6TPC[][3] = {
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x00423022, 0x00423022 },
-    { 0x0000989c, 0x201400df, 0x201400df },
-    { 0x0000989c, 0x00c40002, 0x00c40002 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x0001805e, 0x0001805e },
-    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
-    { 0x0000989c, 0x000000e1, 0x000000e1 },
-    { 0x0000989c, 0x00007081, 0x00007081 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-static const u32 ar5416Bank7[][2] = {
-    { 0x0000989c, 0x00000500 },
-    { 0x0000989c, 0x00000800 },
-    { 0x000098cc, 0x0000000e },
-};
-
-static const u32 ar5416Addac[][2] = {
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000003 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x0000000c },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000030 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000060 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000058 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x000098cc,  0x00000000 },
-};
-
-static const u32 ar5416Modes_9100[][6] = {
-    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
-    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
-    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
-    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
-    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
-    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
-    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
-    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
-    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
-    { 0x00009844, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0, 0x037216a0 },
-    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x00009850, 0x6d48b4e2, 0x6d48b4e2, 0x6d48b0e2, 0x6d48b0e2, 0x6d48b0e2 },
-    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec86d2e, 0x7ec84d2e, 0x7ec82d2e },
-    { 0x0000985c, 0x3139605e, 0x3139605e, 0x3139605e, 0x3139605e, 0x3139605e },
-    { 0x00009860, 0x00048d18, 0x00048d18, 0x00048d20, 0x00048d20, 0x00048d18 },
-    { 0x0000c864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
-    { 0x00009868, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0 },
-    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
-    { 0x00009914, 0x000007d0, 0x000007d0, 0x00000898, 0x00000898, 0x000007d0 },
-    { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
-    { 0x00009924, 0xd00a8a07, 0xd00a8a07, 0xd00a8a11, 0xd00a8a0d, 0xd00a8a0d },
-    { 0x00009940, 0x00754604, 0x00754604, 0xfff81204, 0xfff81204, 0xfff81204 },
-    { 0x00009944, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020, 0xdfb81020 },
-    { 0x00009954, 0x5f3ca3de, 0x5f3ca3de, 0xe250a51e, 0xe250a51e, 0xe250a51e },
-    { 0x00009958, 0x2108ecff, 0x2108ecff, 0x3388ffff, 0x3388ffff, 0x3388ffff },
-#ifdef TB243
-    { 0x00009960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
-    { 0x0000a960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
-    { 0x0000b960, 0x00000900, 0x00000900, 0x00009b40, 0x00009b40, 0x00012d80 },
-    { 0x00009964, 0x00000000, 0x00000000, 0x00002210, 0x00002210, 0x00001120 },
-#else
-    { 0x00009960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
-    { 0x0000a960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
-    { 0x0000b960, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0, 0x0001bfc0 },
-    { 0x00009964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, 0x00001120 },
-#endif
-    { 0x0000c9bc, 0x001a0600, 0x001a0600, 0x001a1000, 0x001a0c00, 0x001a0c00 },
-    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
-    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
-    { 0x000099c8, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329 },
-    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
-    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
-    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
-    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
-    { 0x0000a20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000b20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000c20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
-    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
-    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
-    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
-    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
-    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
-    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
-    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
-    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
-    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
-    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
-    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
-    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
-    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-};
-
-static const u32 ar5416Common_9100[][2] = {
-    { 0x0000000c, 0x00000000 },
-    { 0x00000030, 0x00020015 },
-    { 0x00000034, 0x00000005 },
-    { 0x00000040, 0x00000000 },
-    { 0x00000044, 0x00000008 },
-    { 0x00000048, 0x00000008 },
-    { 0x0000004c, 0x00000010 },
-    { 0x00000050, 0x00000000 },
-    { 0x00000054, 0x0000001f },
-    { 0x00000800, 0x00000000 },
-    { 0x00000804, 0x00000000 },
-    { 0x00000808, 0x00000000 },
-    { 0x0000080c, 0x00000000 },
-    { 0x00000810, 0x00000000 },
-    { 0x00000814, 0x00000000 },
-    { 0x00000818, 0x00000000 },
-    { 0x0000081c, 0x00000000 },
-    { 0x00000820, 0x00000000 },
-    { 0x00000824, 0x00000000 },
-    { 0x00001040, 0x002ffc0f },
-    { 0x00001044, 0x002ffc0f },
-    { 0x00001048, 0x002ffc0f },
-    { 0x0000104c, 0x002ffc0f },
-    { 0x00001050, 0x002ffc0f },
-    { 0x00001054, 0x002ffc0f },
-    { 0x00001058, 0x002ffc0f },
-    { 0x0000105c, 0x002ffc0f },
-    { 0x00001060, 0x002ffc0f },
-    { 0x00001064, 0x002ffc0f },
-    { 0x00001230, 0x00000000 },
-    { 0x00001270, 0x00000000 },
-    { 0x00001038, 0x00000000 },
-    { 0x00001078, 0x00000000 },
-    { 0x000010b8, 0x00000000 },
-    { 0x000010f8, 0x00000000 },
-    { 0x00001138, 0x00000000 },
-    { 0x00001178, 0x00000000 },
-    { 0x000011b8, 0x00000000 },
-    { 0x000011f8, 0x00000000 },
-    { 0x00001238, 0x00000000 },
-    { 0x00001278, 0x00000000 },
-    { 0x000012b8, 0x00000000 },
-    { 0x000012f8, 0x00000000 },
-    { 0x00001338, 0x00000000 },
-    { 0x00001378, 0x00000000 },
-    { 0x000013b8, 0x00000000 },
-    { 0x000013f8, 0x00000000 },
-    { 0x00001438, 0x00000000 },
-    { 0x00001478, 0x00000000 },
-    { 0x000014b8, 0x00000000 },
-    { 0x000014f8, 0x00000000 },
-    { 0x00001538, 0x00000000 },
-    { 0x00001578, 0x00000000 },
-    { 0x000015b8, 0x00000000 },
-    { 0x000015f8, 0x00000000 },
-    { 0x00001638, 0x00000000 },
-    { 0x00001678, 0x00000000 },
-    { 0x000016b8, 0x00000000 },
-    { 0x000016f8, 0x00000000 },
-    { 0x00001738, 0x00000000 },
-    { 0x00001778, 0x00000000 },
-    { 0x000017b8, 0x00000000 },
-    { 0x000017f8, 0x00000000 },
-    { 0x0000103c, 0x00000000 },
-    { 0x0000107c, 0x00000000 },
-    { 0x000010bc, 0x00000000 },
-    { 0x000010fc, 0x00000000 },
-    { 0x0000113c, 0x00000000 },
-    { 0x0000117c, 0x00000000 },
-    { 0x000011bc, 0x00000000 },
-    { 0x000011fc, 0x00000000 },
-    { 0x0000123c, 0x00000000 },
-    { 0x0000127c, 0x00000000 },
-    { 0x000012bc, 0x00000000 },
-    { 0x000012fc, 0x00000000 },
-    { 0x0000133c, 0x00000000 },
-    { 0x0000137c, 0x00000000 },
-    { 0x000013bc, 0x00000000 },
-    { 0x000013fc, 0x00000000 },
-    { 0x0000143c, 0x00000000 },
-    { 0x0000147c, 0x00000000 },
-    { 0x00020010, 0x00000003 },
-    { 0x00020038, 0x000004c2 },
-    { 0x00008004, 0x00000000 },
-    { 0x00008008, 0x00000000 },
-    { 0x0000800c, 0x00000000 },
-    { 0x00008018, 0x00000700 },
-    { 0x00008020, 0x00000000 },
-    { 0x00008038, 0x00000000 },
-    { 0x0000803c, 0x00000000 },
-    { 0x00008048, 0x40000000 },
-    { 0x00008054, 0x00004000 },
-    { 0x00008058, 0x00000000 },
-    { 0x0000805c, 0x000fc78f },
-    { 0x00008060, 0x0000000f },
-    { 0x00008064, 0x00000000 },
-    { 0x000080c0, 0x2a82301a },
-    { 0x000080c4, 0x05dc01e0 },
-    { 0x000080c8, 0x1f402710 },
-    { 0x000080cc, 0x01f40000 },
-    { 0x000080d0, 0x00001e00 },
-    { 0x000080d4, 0x00000000 },
-    { 0x000080d8, 0x00400000 },
-    { 0x000080e0, 0xffffffff },
-    { 0x000080e4, 0x0000ffff },
-    { 0x000080e8, 0x003f3f3f },
-    { 0x000080ec, 0x00000000 },
-    { 0x000080f0, 0x00000000 },
-    { 0x000080f4, 0x00000000 },
-    { 0x000080f8, 0x00000000 },
-    { 0x000080fc, 0x00020000 },
-    { 0x00008100, 0x00020000 },
-    { 0x00008104, 0x00000001 },
-    { 0x00008108, 0x00000052 },
-    { 0x0000810c, 0x00000000 },
-    { 0x00008110, 0x00000168 },
-    { 0x00008118, 0x000100aa },
-    { 0x0000811c, 0x00003210 },
-    { 0x00008120, 0x08f04800 },
-    { 0x00008124, 0x00000000 },
-    { 0x00008128, 0x00000000 },
-    { 0x0000812c, 0x00000000 },
-    { 0x00008130, 0x00000000 },
-    { 0x00008134, 0x00000000 },
-    { 0x00008138, 0x00000000 },
-    { 0x0000813c, 0x00000000 },
-    { 0x00008144, 0x00000000 },
-    { 0x00008168, 0x00000000 },
-    { 0x0000816c, 0x00000000 },
-    { 0x00008170, 0x32143320 },
-    { 0x00008174, 0xfaa4fa50 },
-    { 0x00008178, 0x00000100 },
-    { 0x0000817c, 0x00000000 },
-    { 0x000081c4, 0x00000000 },
-    { 0x000081d0, 0x00003210 },
-    { 0x000081ec, 0x00000000 },
-    { 0x000081f0, 0x00000000 },
-    { 0x000081f4, 0x00000000 },
-    { 0x000081f8, 0x00000000 },
-    { 0x000081fc, 0x00000000 },
-    { 0x00008200, 0x00000000 },
-    { 0x00008204, 0x00000000 },
-    { 0x00008208, 0x00000000 },
-    { 0x0000820c, 0x00000000 },
-    { 0x00008210, 0x00000000 },
-    { 0x00008214, 0x00000000 },
-    { 0x00008218, 0x00000000 },
-    { 0x0000821c, 0x00000000 },
-    { 0x00008220, 0x00000000 },
-    { 0x00008224, 0x00000000 },
-    { 0x00008228, 0x00000000 },
-    { 0x0000822c, 0x00000000 },
-    { 0x00008230, 0x00000000 },
-    { 0x00008234, 0x00000000 },
-    { 0x00008238, 0x00000000 },
-    { 0x0000823c, 0x00000000 },
-    { 0x00008240, 0x00100000 },
-    { 0x00008244, 0x0010f400 },
-    { 0x00008248, 0x00000100 },
-    { 0x0000824c, 0x0001e800 },
-    { 0x00008250, 0x00000000 },
-    { 0x00008254, 0x00000000 },
-    { 0x00008258, 0x00000000 },
-    { 0x0000825c, 0x400000ff },
-    { 0x00008260, 0x00080922 },
-    { 0x00008270, 0x00000000 },
-    { 0x00008274, 0x40000000 },
-    { 0x00008278, 0x003e4180 },
-    { 0x0000827c, 0x00000000 },
-    { 0x00008284, 0x0000002c },
-    { 0x00008288, 0x0000002c },
-    { 0x0000828c, 0x00000000 },
-    { 0x00008294, 0x00000000 },
-    { 0x00008298, 0x00000000 },
-    { 0x00008300, 0x00000000 },
-    { 0x00008304, 0x00000000 },
-    { 0x00008308, 0x00000000 },
-    { 0x0000830c, 0x00000000 },
-    { 0x00008310, 0x00000000 },
-    { 0x00008314, 0x00000000 },
-    { 0x00008318, 0x00000000 },
-    { 0x00008328, 0x00000000 },
-    { 0x0000832c, 0x00000007 },
-    { 0x00008330, 0x00000302 },
-    { 0x00008334, 0x00000e00 },
-    { 0x00008338, 0x00000000 },
-    { 0x0000833c, 0x00000000 },
-    { 0x00008340, 0x000107ff },
-    { 0x00009808, 0x00000000 },
-    { 0x0000980c, 0xad848e19 },
-    { 0x00009810, 0x7d14e000 },
-    { 0x00009814, 0x9c0a9f6b },
-    { 0x0000981c, 0x00000000 },
-    { 0x0000982c, 0x0000a000 },
-    { 0x00009830, 0x00000000 },
-    { 0x0000983c, 0x00200400 },
-    { 0x00009840, 0x206a01ae },
-    { 0x0000984c, 0x1284233c },
-    { 0x00009854, 0x00000859 },
-    { 0x00009900, 0x00000000 },
-    { 0x00009904, 0x00000000 },
-    { 0x00009908, 0x00000000 },
-    { 0x0000990c, 0x00000000 },
-    { 0x0000991c, 0x10000fff },
-    { 0x00009920, 0x05100000 },
-    { 0x0000a920, 0x05100000 },
-    { 0x0000b920, 0x05100000 },
-    { 0x00009928, 0x00000001 },
-    { 0x0000992c, 0x00000004 },
-    { 0x00009934, 0x1e1f2022 },
-    { 0x00009938, 0x0a0b0c0d },
-    { 0x0000993c, 0x00000000 },
-    { 0x00009948, 0x9280b212 },
-    { 0x0000994c, 0x00020028 },
-    { 0x0000c95c, 0x004b6a8e },
-    { 0x0000c968, 0x000003ce },
-    { 0x00009970, 0x190fb515 },
-    { 0x00009974, 0x00000000 },
-    { 0x00009978, 0x00000001 },
-    { 0x0000997c, 0x00000000 },
-    { 0x00009980, 0x00000000 },
-    { 0x00009984, 0x00000000 },
-    { 0x00009988, 0x00000000 },
-    { 0x0000998c, 0x00000000 },
-    { 0x00009990, 0x00000000 },
-    { 0x00009994, 0x00000000 },
-    { 0x00009998, 0x00000000 },
-    { 0x0000999c, 0x00000000 },
-    { 0x000099a0, 0x00000000 },
-    { 0x000099a4, 0x00000001 },
-    { 0x000099a8, 0x201fff00 },
-    { 0x000099ac, 0x006f0000 },
-    { 0x000099b0, 0x03051000 },
-    { 0x000099dc, 0x00000000 },
-    { 0x000099e0, 0x00000200 },
-    { 0x000099e4, 0xaaaaaaaa },
-    { 0x000099e8, 0x3c466478 },
-    { 0x000099ec, 0x0cc80caa },
-    { 0x000099fc, 0x00001042 },
-    { 0x00009b00, 0x00000000 },
-    { 0x00009b04, 0x00000001 },
-    { 0x00009b08, 0x00000002 },
-    { 0x00009b0c, 0x00000003 },
-    { 0x00009b10, 0x00000004 },
-    { 0x00009b14, 0x00000005 },
-    { 0x00009b18, 0x00000008 },
-    { 0x00009b1c, 0x00000009 },
-    { 0x00009b20, 0x0000000a },
-    { 0x00009b24, 0x0000000b },
-    { 0x00009b28, 0x0000000c },
-    { 0x00009b2c, 0x0000000d },
-    { 0x00009b30, 0x00000010 },
-    { 0x00009b34, 0x00000011 },
-    { 0x00009b38, 0x00000012 },
-    { 0x00009b3c, 0x00000013 },
-    { 0x00009b40, 0x00000014 },
-    { 0x00009b44, 0x00000015 },
-    { 0x00009b48, 0x00000018 },
-    { 0x00009b4c, 0x00000019 },
-    { 0x00009b50, 0x0000001a },
-    { 0x00009b54, 0x0000001b },
-    { 0x00009b58, 0x0000001c },
-    { 0x00009b5c, 0x0000001d },
-    { 0x00009b60, 0x00000020 },
-    { 0x00009b64, 0x00000021 },
-    { 0x00009b68, 0x00000022 },
-    { 0x00009b6c, 0x00000023 },
-    { 0x00009b70, 0x00000024 },
-    { 0x00009b74, 0x00000025 },
-    { 0x00009b78, 0x00000028 },
-    { 0x00009b7c, 0x00000029 },
-    { 0x00009b80, 0x0000002a },
-    { 0x00009b84, 0x0000002b },
-    { 0x00009b88, 0x0000002c },
-    { 0x00009b8c, 0x0000002d },
-    { 0x00009b90, 0x00000030 },
-    { 0x00009b94, 0x00000031 },
-    { 0x00009b98, 0x00000032 },
-    { 0x00009b9c, 0x00000033 },
-    { 0x00009ba0, 0x00000034 },
-    { 0x00009ba4, 0x00000035 },
-    { 0x00009ba8, 0x00000035 },
-    { 0x00009bac, 0x00000035 },
-    { 0x00009bb0, 0x00000035 },
-    { 0x00009bb4, 0x00000035 },
-    { 0x00009bb8, 0x00000035 },
-    { 0x00009bbc, 0x00000035 },
-    { 0x00009bc0, 0x00000035 },
-    { 0x00009bc4, 0x00000035 },
-    { 0x00009bc8, 0x00000035 },
-    { 0x00009bcc, 0x00000035 },
-    { 0x00009bd0, 0x00000035 },
-    { 0x00009bd4, 0x00000035 },
-    { 0x00009bd8, 0x00000035 },
-    { 0x00009bdc, 0x00000035 },
-    { 0x00009be0, 0x00000035 },
-    { 0x00009be4, 0x00000035 },
-    { 0x00009be8, 0x00000035 },
-    { 0x00009bec, 0x00000035 },
-    { 0x00009bf0, 0x00000035 },
-    { 0x00009bf4, 0x00000035 },
-    { 0x00009bf8, 0x00000010 },
-    { 0x00009bfc, 0x0000001a },
-    { 0x0000a210, 0x40806333 },
-    { 0x0000a214, 0x00106c10 },
-    { 0x0000a218, 0x009c4060 },
-    { 0x0000a220, 0x018830c6 },
-    { 0x0000a224, 0x00000400 },
-    { 0x0000a228, 0x001a0bb5 },
-    { 0x0000a22c, 0x00000000 },
-    { 0x0000a234, 0x20202020 },
-    { 0x0000a238, 0x20202020 },
-    { 0x0000a23c, 0x13c889ae },
-    { 0x0000a240, 0x38490a20 },
-    { 0x0000a244, 0x00007bb6 },
-    { 0x0000a248, 0x0fff3ffc },
-    { 0x0000a24c, 0x00000001 },
-    { 0x0000a250, 0x0000a000 },
-    { 0x0000a254, 0x00000000 },
-    { 0x0000a258, 0x0cc75380 },
-    { 0x0000a25c, 0x0f0f0f01 },
-    { 0x0000a260, 0xdfa91f01 },
-    { 0x0000a268, 0x00000001 },
-    { 0x0000a26c, 0x0ebae9c6 },
-    { 0x0000b26c, 0x0ebae9c6 },
-    { 0x0000c26c, 0x0ebae9c6 },
-    { 0x0000d270, 0x00820820 },
-    { 0x0000a278, 0x1ce739ce },
-    { 0x0000a27c, 0x050701ce },
-    { 0x0000a338, 0x00000000 },
-    { 0x0000a33c, 0x00000000 },
-    { 0x0000a340, 0x00000000 },
-    { 0x0000a344, 0x00000000 },
-    { 0x0000a348, 0x3fffffff },
-    { 0x0000a34c, 0x3fffffff },
-    { 0x0000a350, 0x3fffffff },
-    { 0x0000a354, 0x0003ffff },
-    { 0x0000a358, 0x79a8aa33 },
-    { 0x0000d35c, 0x07ffffef },
-    { 0x0000d360, 0x0fffffe7 },
-    { 0x0000d364, 0x17ffffe5 },
-    { 0x0000d368, 0x1fffffe4 },
-    { 0x0000d36c, 0x37ffffe3 },
-    { 0x0000d370, 0x3fffffe3 },
-    { 0x0000d374, 0x57ffffe3 },
-    { 0x0000d378, 0x5fffffe2 },
-    { 0x0000d37c, 0x7fffffe2 },
-    { 0x0000d380, 0x7f3c7bba },
-    { 0x0000d384, 0xf3307ff0 },
-    { 0x0000a388, 0x0c000000 },
-    { 0x0000a38c, 0x20202020 },
-    { 0x0000a390, 0x20202020 },
-    { 0x0000a394, 0x1ce739ce },
-    { 0x0000a398, 0x000001ce },
-    { 0x0000a39c, 0x00000001 },
-    { 0x0000a3a0, 0x00000000 },
-    { 0x0000a3a4, 0x00000000 },
-    { 0x0000a3a8, 0x00000000 },
-    { 0x0000a3ac, 0x00000000 },
-    { 0x0000a3b0, 0x00000000 },
-    { 0x0000a3b4, 0x00000000 },
-    { 0x0000a3b8, 0x00000000 },
-    { 0x0000a3bc, 0x00000000 },
-    { 0x0000a3c0, 0x00000000 },
-    { 0x0000a3c4, 0x00000000 },
-    { 0x0000a3c8, 0x00000246 },
-    { 0x0000a3cc, 0x20202020 },
-    { 0x0000a3d0, 0x20202020 },
-    { 0x0000a3d4, 0x20202020 },
-    { 0x0000a3dc, 0x1ce739ce },
-    { 0x0000a3e0, 0x000001ce },
-};
-
-static const u32 ar5416Bank0_9100[][2] = {
-    { 0x000098b0, 0x1e5795e5 },
-    { 0x000098e0, 0x02008020 },
-};
-
-static const u32 ar5416BB_RfGain_9100[][3] = {
-    { 0x00009a00, 0x00000000, 0x00000000 },
-    { 0x00009a04, 0x00000040, 0x00000040 },
-    { 0x00009a08, 0x00000080, 0x00000080 },
-    { 0x00009a0c, 0x000001a1, 0x00000141 },
-    { 0x00009a10, 0x000001e1, 0x00000181 },
-    { 0x00009a14, 0x00000021, 0x000001c1 },
-    { 0x00009a18, 0x00000061, 0x00000001 },
-    { 0x00009a1c, 0x00000168, 0x00000041 },
-    { 0x00009a20, 0x000001a8, 0x000001a8 },
-    { 0x00009a24, 0x000001e8, 0x000001e8 },
-    { 0x00009a28, 0x00000028, 0x00000028 },
-    { 0x00009a2c, 0x00000068, 0x00000068 },
-    { 0x00009a30, 0x00000189, 0x000000a8 },
-    { 0x00009a34, 0x000001c9, 0x00000169 },
-    { 0x00009a38, 0x00000009, 0x000001a9 },
-    { 0x00009a3c, 0x00000049, 0x000001e9 },
-    { 0x00009a40, 0x00000089, 0x00000029 },
-    { 0x00009a44, 0x00000170, 0x00000069 },
-    { 0x00009a48, 0x000001b0, 0x00000190 },
-    { 0x00009a4c, 0x000001f0, 0x000001d0 },
-    { 0x00009a50, 0x00000030, 0x00000010 },
-    { 0x00009a54, 0x00000070, 0x00000050 },
-    { 0x00009a58, 0x00000191, 0x00000090 },
-    { 0x00009a5c, 0x000001d1, 0x00000151 },
-    { 0x00009a60, 0x00000011, 0x00000191 },
-    { 0x00009a64, 0x00000051, 0x000001d1 },
-    { 0x00009a68, 0x00000091, 0x00000011 },
-    { 0x00009a6c, 0x000001b8, 0x00000051 },
-    { 0x00009a70, 0x000001f8, 0x00000198 },
-    { 0x00009a74, 0x00000038, 0x000001d8 },
-    { 0x00009a78, 0x00000078, 0x00000018 },
-    { 0x00009a7c, 0x00000199, 0x00000058 },
-    { 0x00009a80, 0x000001d9, 0x00000098 },
-    { 0x00009a84, 0x00000019, 0x00000159 },
-    { 0x00009a88, 0x00000059, 0x00000199 },
-    { 0x00009a8c, 0x00000099, 0x000001d9 },
-    { 0x00009a90, 0x000000d9, 0x00000019 },
-    { 0x00009a94, 0x000000f9, 0x00000059 },
-    { 0x00009a98, 0x000000f9, 0x00000099 },
-    { 0x00009a9c, 0x000000f9, 0x000000d9 },
-    { 0x00009aa0, 0x000000f9, 0x000000f9 },
-    { 0x00009aa4, 0x000000f9, 0x000000f9 },
-    { 0x00009aa8, 0x000000f9, 0x000000f9 },
-    { 0x00009aac, 0x000000f9, 0x000000f9 },
-    { 0x00009ab0, 0x000000f9, 0x000000f9 },
-    { 0x00009ab4, 0x000000f9, 0x000000f9 },
-    { 0x00009ab8, 0x000000f9, 0x000000f9 },
-    { 0x00009abc, 0x000000f9, 0x000000f9 },
-    { 0x00009ac0, 0x000000f9, 0x000000f9 },
-    { 0x00009ac4, 0x000000f9, 0x000000f9 },
-    { 0x00009ac8, 0x000000f9, 0x000000f9 },
-    { 0x00009acc, 0x000000f9, 0x000000f9 },
-    { 0x00009ad0, 0x000000f9, 0x000000f9 },
-    { 0x00009ad4, 0x000000f9, 0x000000f9 },
-    { 0x00009ad8, 0x000000f9, 0x000000f9 },
-    { 0x00009adc, 0x000000f9, 0x000000f9 },
-    { 0x00009ae0, 0x000000f9, 0x000000f9 },
-    { 0x00009ae4, 0x000000f9, 0x000000f9 },
-    { 0x00009ae8, 0x000000f9, 0x000000f9 },
-    { 0x00009aec, 0x000000f9, 0x000000f9 },
-    { 0x00009af0, 0x000000f9, 0x000000f9 },
-    { 0x00009af4, 0x000000f9, 0x000000f9 },
-    { 0x00009af8, 0x000000f9, 0x000000f9 },
-    { 0x00009afc, 0x000000f9, 0x000000f9 },
-};
-
-static const u32 ar5416Bank1_9100[][2] = {
-    { 0x000098b0, 0x02108421},
-    { 0x000098ec, 0x00000008},
-};
-
-static const u32 ar5416Bank2_9100[][2] = {
-    { 0x000098b0, 0x0e73ff17},
-    { 0x000098e0, 0x00000420},
-};
-
-static const u32 ar5416Bank3_9100[][3] = {
-    { 0x000098f0, 0x01400018, 0x01c00018 },
-};
-
-static const u32 ar5416Bank6_9100[][3] = {
-
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x004210a2, 0x004210a2 },
-    { 0x0000989c, 0x0014000f, 0x0014000f },
-    { 0x0000989c, 0x00c40002, 0x00c40002 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x000180d6, 0x000180d6 },
-    { 0x0000989c, 0x0000c0aa, 0x0000c0aa },
-    { 0x0000989c, 0x000000b1, 0x000000b1 },
-    { 0x0000989c, 0x00002000, 0x00002000 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-
-static const u32 ar5416Bank6TPC_9100[][3] = {
-
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x00423022, 0x00423022 },
-    { 0x0000989c, 0x2014008f, 0x2014008f },
-    { 0x0000989c, 0x00c40002, 0x00c40002 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x0001805e, 0x0001805e },
-    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
-    { 0x0000989c, 0x000000e1, 0x000000e1 },
-    { 0x0000989c, 0x00007080, 0x00007080 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-static const u32 ar5416Bank7_9100[][2] = {
-    { 0x0000989c, 0x00000500 },
-    { 0x0000989c, 0x00000800 },
-    { 0x000098cc, 0x0000000e },
-};
-
-static const u32 ar5416Addac_9100[][2] = {
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000010 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x000000c0 },
-    {0x0000989c, 0x00000015 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x0000989c, 0x00000000 },
-    {0x000098cc, 0x00000000 },
-};
-
-static const u32 ar5416Modes_9160[][6] = {
-    { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
-    { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
-    { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
-    { 0x000010f0, 0x0000a000, 0x00014000, 0x00016000, 0x0000b000, 0x00014008 },
-    { 0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00, 0x06e006e0 },
-    { 0x0000801c, 0x128d93a7, 0x128d93cf, 0x12e013d7, 0x12e013ab, 0x098813cf },
-    { 0x00009804, 0x00000300, 0x000003c4, 0x000003c4, 0x00000300, 0x00000303 },
-    { 0x00009820, 0x02020200, 0x02020200, 0x02020200, 0x02020200, 0x02020200 },
-    { 0x00009824, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
-    { 0x00009834, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e },
-    { 0x00009838, 0x00000007, 0x00000007, 0x00000007, 0x00000007, 0x00000007 },
-    { 0x00009844, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0, 0x037216a0 },
-    { 0x00009848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000a848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x0000b848, 0x001a6a65, 0x001a6a65, 0x00197a68, 0x00197a68, 0x00197a68 },
-    { 0x00009850, 0x6c48b4e2, 0x6c48b4e2, 0x6c48b0e2, 0x6c48b0e2, 0x6c48b0e2 },
-    { 0x00009858, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e, 0x7ec82d2e },
-    { 0x0000985c, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e, 0x31395d5e },
-    { 0x00009860, 0x00048d18, 0x00048d18, 0x00048d20, 0x00048d20, 0x00048d18 },
-    { 0x0000c864, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00, 0x0001ce00 },
-    { 0x00009868, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0, 0x409a40d0 },
-    { 0x0000986c, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081, 0x050cb081 },
-    { 0x00009914, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898, 0x000007d0 },
-    { 0x00009918, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b, 0x00000016 },
-    { 0x00009924, 0xd00a8a07, 0xd00a8a07, 0xd00a8a0d, 0xd00a8a0d, 0xd00a8a0d },
-    { 0x00009944, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020, 0xffb81020 },
-    { 0x00009960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
-    { 0x0000a960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
-    { 0x0000b960, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40, 0x00009b40 },
-    { 0x00009964, 0x00001120, 0x00001120, 0x00001120, 0x00001120, 0x00001120 },
-    { 0x0000c968, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce, 0x000003ce },
-    { 0x0000c9bc, 0x001a0600, 0x001a0600, 0x001a0c00, 0x001a0c00, 0x001a0c00 },
-    { 0x000099c0, 0x038919be, 0x038919be, 0x038919be, 0x038919be, 0x038919be },
-    { 0x000099c4, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77, 0x06336f77 },
-    { 0x000099c8, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329, 0x60f65329 },
-    { 0x000099cc, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8, 0x08f186c8 },
-    { 0x000099d0, 0x00046384, 0x00046384, 0x00046384, 0x00046384, 0x00046384 },
-    { 0x000099d4, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x000099d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a204, 0x00000880, 0x00000880, 0x00000880, 0x00000880, 0x00000880 },
-    { 0x0000a208, 0xd6be4788, 0xd6be4788, 0xd03e4788, 0xd03e4788, 0xd03e4788 },
-    { 0x0000a20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000b20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000c20c, 0x002fc160, 0x002fc160, 0x002ac120, 0x002ac120, 0x002ac120 },
-    { 0x0000a21c, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a, 0x1883800a },
-    { 0x0000a230, 0x00000000, 0x00000000, 0x00000210, 0x00000108, 0x00000000 },
-    { 0x0000a274, 0x0a1a9caa, 0x0a1a9caa, 0x0a1a7caa, 0x0a1a7caa, 0x0a1a7caa },
-    { 0x0000a300, 0x18010000, 0x18010000, 0x18010000, 0x18010000, 0x18010000 },
-    { 0x0000a304, 0x30032602, 0x30032602, 0x2e032402, 0x2e032402, 0x2e032402 },
-    { 0x0000a308, 0x48073e06, 0x48073e06, 0x4a0a3c06, 0x4a0a3c06, 0x4a0a3c06 },
-    { 0x0000a30c, 0x560b4c0a, 0x560b4c0a, 0x621a540b, 0x621a540b, 0x621a540b },
-    { 0x0000a310, 0x641a600f, 0x641a600f, 0x764f6c1b, 0x764f6c1b, 0x764f6c1b },
-    { 0x0000a314, 0x7a4f6e1b, 0x7a4f6e1b, 0x845b7a5a, 0x845b7a5a, 0x845b7a5a },
-    { 0x0000a318, 0x8c5b7e5a, 0x8c5b7e5a, 0x950f8ccf, 0x950f8ccf, 0x950f8ccf },
-    { 0x0000a31c, 0x9d0f96cf, 0x9d0f96cf, 0xa5cf9b4f, 0xa5cf9b4f, 0xa5cf9b4f },
-    { 0x0000a320, 0xb51fa69f, 0xb51fa69f, 0xbddfaf1f, 0xbddfaf1f, 0xbddfaf1f },
-    { 0x0000a324, 0xcb3fbd07, 0xcb3fbcbf, 0xd1ffc93f, 0xd1ffc93f, 0xd1ffc93f },
-    { 0x0000a328, 0x0000d7bf, 0x0000d7bf, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a32c, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a330, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-    { 0x0000a334, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
-};
+#ifndef INITVALS_9002_10_H
+#define INITVALS_9002_10_H
 
-static const u32 ar5416Common_9160[][2] = {
-    { 0x0000000c, 0x00000000 },
-    { 0x00000030, 0x00020015 },
-    { 0x00000034, 0x00000005 },
-    { 0x00000040, 0x00000000 },
-    { 0x00000044, 0x00000008 },
-    { 0x00000048, 0x00000008 },
-    { 0x0000004c, 0x00000010 },
-    { 0x00000050, 0x00000000 },
-    { 0x00000054, 0x0000001f },
-    { 0x00000800, 0x00000000 },
-    { 0x00000804, 0x00000000 },
-    { 0x00000808, 0x00000000 },
-    { 0x0000080c, 0x00000000 },
-    { 0x00000810, 0x00000000 },
-    { 0x00000814, 0x00000000 },
-    { 0x00000818, 0x00000000 },
-    { 0x0000081c, 0x00000000 },
-    { 0x00000820, 0x00000000 },
-    { 0x00000824, 0x00000000 },
-    { 0x00001040, 0x002ffc0f },
-    { 0x00001044, 0x002ffc0f },
-    { 0x00001048, 0x002ffc0f },
-    { 0x0000104c, 0x002ffc0f },
-    { 0x00001050, 0x002ffc0f },
-    { 0x00001054, 0x002ffc0f },
-    { 0x00001058, 0x002ffc0f },
-    { 0x0000105c, 0x002ffc0f },
-    { 0x00001060, 0x002ffc0f },
-    { 0x00001064, 0x002ffc0f },
-    { 0x00001230, 0x00000000 },
-    { 0x00001270, 0x00000000 },
-    { 0x00001038, 0x00000000 },
-    { 0x00001078, 0x00000000 },
-    { 0x000010b8, 0x00000000 },
-    { 0x000010f8, 0x00000000 },
-    { 0x00001138, 0x00000000 },
-    { 0x00001178, 0x00000000 },
-    { 0x000011b8, 0x00000000 },
-    { 0x000011f8, 0x00000000 },
-    { 0x00001238, 0x00000000 },
-    { 0x00001278, 0x00000000 },
-    { 0x000012b8, 0x00000000 },
-    { 0x000012f8, 0x00000000 },
-    { 0x00001338, 0x00000000 },
-    { 0x00001378, 0x00000000 },
-    { 0x000013b8, 0x00000000 },
-    { 0x000013f8, 0x00000000 },
-    { 0x00001438, 0x00000000 },
-    { 0x00001478, 0x00000000 },
-    { 0x000014b8, 0x00000000 },
-    { 0x000014f8, 0x00000000 },
-    { 0x00001538, 0x00000000 },
-    { 0x00001578, 0x00000000 },
-    { 0x000015b8, 0x00000000 },
-    { 0x000015f8, 0x00000000 },
-    { 0x00001638, 0x00000000 },
-    { 0x00001678, 0x00000000 },
-    { 0x000016b8, 0x00000000 },
-    { 0x000016f8, 0x00000000 },
-    { 0x00001738, 0x00000000 },
-    { 0x00001778, 0x00000000 },
-    { 0x000017b8, 0x00000000 },
-    { 0x000017f8, 0x00000000 },
-    { 0x0000103c, 0x00000000 },
-    { 0x0000107c, 0x00000000 },
-    { 0x000010bc, 0x00000000 },
-    { 0x000010fc, 0x00000000 },
-    { 0x0000113c, 0x00000000 },
-    { 0x0000117c, 0x00000000 },
-    { 0x000011bc, 0x00000000 },
-    { 0x000011fc, 0x00000000 },
-    { 0x0000123c, 0x00000000 },
-    { 0x0000127c, 0x00000000 },
-    { 0x000012bc, 0x00000000 },
-    { 0x000012fc, 0x00000000 },
-    { 0x0000133c, 0x00000000 },
-    { 0x0000137c, 0x00000000 },
-    { 0x000013bc, 0x00000000 },
-    { 0x000013fc, 0x00000000 },
-    { 0x0000143c, 0x00000000 },
-    { 0x0000147c, 0x00000000 },
-    { 0x00004030, 0x00000002 },
-    { 0x0000403c, 0x00000002 },
-    { 0x00007010, 0x00000020 },
-    { 0x00007038, 0x000004c2 },
-    { 0x00008004, 0x00000000 },
-    { 0x00008008, 0x00000000 },
-    { 0x0000800c, 0x00000000 },
-    { 0x00008018, 0x00000700 },
-    { 0x00008020, 0x00000000 },
-    { 0x00008038, 0x00000000 },
-    { 0x0000803c, 0x00000000 },
-    { 0x00008048, 0x40000000 },
-    { 0x00008054, 0x00000000 },
-    { 0x00008058, 0x00000000 },
-    { 0x0000805c, 0x000fc78f },
-    { 0x00008060, 0x0000000f },
-    { 0x00008064, 0x00000000 },
-    { 0x000080c0, 0x2a82301a },
-    { 0x000080c4, 0x05dc01e0 },
-    { 0x000080c8, 0x1f402710 },
-    { 0x000080cc, 0x01f40000 },
-    { 0x000080d0, 0x00001e00 },
-    { 0x000080d4, 0x00000000 },
-    { 0x000080d8, 0x00400000 },
-    { 0x000080e0, 0xffffffff },
-    { 0x000080e4, 0x0000ffff },
-    { 0x000080e8, 0x003f3f3f },
-    { 0x000080ec, 0x00000000 },
-    { 0x000080f0, 0x00000000 },
-    { 0x000080f4, 0x00000000 },
-    { 0x000080f8, 0x00000000 },
-    { 0x000080fc, 0x00020000 },
-    { 0x00008100, 0x00020000 },
-    { 0x00008104, 0x00000001 },
-    { 0x00008108, 0x00000052 },
-    { 0x0000810c, 0x00000000 },
-    { 0x00008110, 0x00000168 },
-    { 0x00008118, 0x000100aa },
-    { 0x0000811c, 0x00003210 },
-    { 0x00008120, 0x08f04800 },
-    { 0x00008124, 0x00000000 },
-    { 0x00008128, 0x00000000 },
-    { 0x0000812c, 0x00000000 },
-    { 0x00008130, 0x00000000 },
-    { 0x00008134, 0x00000000 },
-    { 0x00008138, 0x00000000 },
-    { 0x0000813c, 0x00000000 },
-    { 0x00008144, 0xffffffff },
-    { 0x00008168, 0x00000000 },
-    { 0x0000816c, 0x00000000 },
-    { 0x00008170, 0x32143320 },
-    { 0x00008174, 0xfaa4fa50 },
-    { 0x00008178, 0x00000100 },
-    { 0x0000817c, 0x00000000 },
-    { 0x000081c4, 0x00000000 },
-    { 0x000081d0, 0x00003210 },
-    { 0x000081ec, 0x00000000 },
-    { 0x000081f0, 0x00000000 },
-    { 0x000081f4, 0x00000000 },
-    { 0x000081f8, 0x00000000 },
-    { 0x000081fc, 0x00000000 },
-    { 0x00008200, 0x00000000 },
-    { 0x00008204, 0x00000000 },
-    { 0x00008208, 0x00000000 },
-    { 0x0000820c, 0x00000000 },
-    { 0x00008210, 0x00000000 },
-    { 0x00008214, 0x00000000 },
-    { 0x00008218, 0x00000000 },
-    { 0x0000821c, 0x00000000 },
-    { 0x00008220, 0x00000000 },
-    { 0x00008224, 0x00000000 },
-    { 0x00008228, 0x00000000 },
-    { 0x0000822c, 0x00000000 },
-    { 0x00008230, 0x00000000 },
-    { 0x00008234, 0x00000000 },
-    { 0x00008238, 0x00000000 },
-    { 0x0000823c, 0x00000000 },
-    { 0x00008240, 0x00100000 },
-    { 0x00008244, 0x0010f400 },
-    { 0x00008248, 0x00000100 },
-    { 0x0000824c, 0x0001e800 },
-    { 0x00008250, 0x00000000 },
-    { 0x00008254, 0x00000000 },
-    { 0x00008258, 0x00000000 },
-    { 0x0000825c, 0x400000ff },
-    { 0x00008260, 0x00080922 },
-    { 0x00008270, 0x00000000 },
-    { 0x00008274, 0x40000000 },
-    { 0x00008278, 0x003e4180 },
-    { 0x0000827c, 0x00000000 },
-    { 0x00008284, 0x0000002c },
-    { 0x00008288, 0x0000002c },
-    { 0x0000828c, 0x00000000 },
-    { 0x00008294, 0x00000000 },
-    { 0x00008298, 0x00000000 },
-    { 0x00008300, 0x00000000 },
-    { 0x00008304, 0x00000000 },
-    { 0x00008308, 0x00000000 },
-    { 0x0000830c, 0x00000000 },
-    { 0x00008310, 0x00000000 },
-    { 0x00008314, 0x00000000 },
-    { 0x00008318, 0x00000000 },
-    { 0x00008328, 0x00000000 },
-    { 0x0000832c, 0x00000007 },
-    { 0x00008330, 0x00000302 },
-    { 0x00008334, 0x00000e00 },
-    { 0x00008338, 0x00ff0000 },
-    { 0x0000833c, 0x00000000 },
-    { 0x00008340, 0x000107ff },
-    { 0x00009808, 0x00000000 },
-    { 0x0000980c, 0xad848e19 },
-    { 0x00009810, 0x7d14e000 },
-    { 0x00009814, 0x9c0a9f6b },
-    { 0x0000981c, 0x00000000 },
-    { 0x0000982c, 0x0000a000 },
-    { 0x00009830, 0x00000000 },
-    { 0x0000983c, 0x00200400 },
-    { 0x00009840, 0x206a01ae },
-    { 0x0000984c, 0x1284233c },
-    { 0x00009854, 0x00000859 },
-    { 0x00009900, 0x00000000 },
-    { 0x00009904, 0x00000000 },
-    { 0x00009908, 0x00000000 },
-    { 0x0000990c, 0x00000000 },
-    { 0x0000991c, 0x10000fff },
-    { 0x00009920, 0x05100000 },
-    { 0x0000a920, 0x05100000 },
-    { 0x0000b920, 0x05100000 },
-    { 0x00009928, 0x00000001 },
-    { 0x0000992c, 0x00000004 },
-    { 0x00009934, 0x1e1f2022 },
-    { 0x00009938, 0x0a0b0c0d },
-    { 0x0000993c, 0x00000000 },
-    { 0x00009948, 0x9280b212 },
-    { 0x0000994c, 0x00020028 },
-    { 0x00009954, 0x5f3ca3de },
-    { 0x00009958, 0x2108ecff },
-    { 0x00009940, 0x00750604 },
-    { 0x0000c95c, 0x004b6a8e },
-    { 0x00009970, 0x190fb515 },
-    { 0x00009974, 0x00000000 },
-    { 0x00009978, 0x00000001 },
-    { 0x0000997c, 0x00000000 },
-    { 0x00009980, 0x00000000 },
-    { 0x00009984, 0x00000000 },
-    { 0x00009988, 0x00000000 },
-    { 0x0000998c, 0x00000000 },
-    { 0x00009990, 0x00000000 },
-    { 0x00009994, 0x00000000 },
-    { 0x00009998, 0x00000000 },
-    { 0x0000999c, 0x00000000 },
-    { 0x000099a0, 0x00000000 },
-    { 0x000099a4, 0x00000001 },
-    { 0x000099a8, 0x201fff00 },
-    { 0x000099ac, 0x006f0000 },
-    { 0x000099b0, 0x03051000 },
-    { 0x000099dc, 0x00000000 },
-    { 0x000099e0, 0x00000200 },
-    { 0x000099e4, 0xaaaaaaaa },
-    { 0x000099e8, 0x3c466478 },
-    { 0x000099ec, 0x0cc80caa },
-    { 0x000099fc, 0x00001042 },
-    { 0x00009b00, 0x00000000 },
-    { 0x00009b04, 0x00000001 },
-    { 0x00009b08, 0x00000002 },
-    { 0x00009b0c, 0x00000003 },
-    { 0x00009b10, 0x00000004 },
-    { 0x00009b14, 0x00000005 },
-    { 0x00009b18, 0x00000008 },
-    { 0x00009b1c, 0x00000009 },
-    { 0x00009b20, 0x0000000a },
-    { 0x00009b24, 0x0000000b },
-    { 0x00009b28, 0x0000000c },
-    { 0x00009b2c, 0x0000000d },
-    { 0x00009b30, 0x00000010 },
-    { 0x00009b34, 0x00000011 },
-    { 0x00009b38, 0x00000012 },
-    { 0x00009b3c, 0x00000013 },
-    { 0x00009b40, 0x00000014 },
-    { 0x00009b44, 0x00000015 },
-    { 0x00009b48, 0x00000018 },
-    { 0x00009b4c, 0x00000019 },
-    { 0x00009b50, 0x0000001a },
-    { 0x00009b54, 0x0000001b },
-    { 0x00009b58, 0x0000001c },
-    { 0x00009b5c, 0x0000001d },
-    { 0x00009b60, 0x00000020 },
-    { 0x00009b64, 0x00000021 },
-    { 0x00009b68, 0x00000022 },
-    { 0x00009b6c, 0x00000023 },
-    { 0x00009b70, 0x00000024 },
-    { 0x00009b74, 0x00000025 },
-    { 0x00009b78, 0x00000028 },
-    { 0x00009b7c, 0x00000029 },
-    { 0x00009b80, 0x0000002a },
-    { 0x00009b84, 0x0000002b },
-    { 0x00009b88, 0x0000002c },
-    { 0x00009b8c, 0x0000002d },
-    { 0x00009b90, 0x00000030 },
-    { 0x00009b94, 0x00000031 },
-    { 0x00009b98, 0x00000032 },
-    { 0x00009b9c, 0x00000033 },
-    { 0x00009ba0, 0x00000034 },
-    { 0x00009ba4, 0x00000035 },
-    { 0x00009ba8, 0x00000035 },
-    { 0x00009bac, 0x00000035 },
-    { 0x00009bb0, 0x00000035 },
-    { 0x00009bb4, 0x00000035 },
-    { 0x00009bb8, 0x00000035 },
-    { 0x00009bbc, 0x00000035 },
-    { 0x00009bc0, 0x00000035 },
-    { 0x00009bc4, 0x00000035 },
-    { 0x00009bc8, 0x00000035 },
-    { 0x00009bcc, 0x00000035 },
-    { 0x00009bd0, 0x00000035 },
-    { 0x00009bd4, 0x00000035 },
-    { 0x00009bd8, 0x00000035 },
-    { 0x00009bdc, 0x00000035 },
-    { 0x00009be0, 0x00000035 },
-    { 0x00009be4, 0x00000035 },
-    { 0x00009be8, 0x00000035 },
-    { 0x00009bec, 0x00000035 },
-    { 0x00009bf0, 0x00000035 },
-    { 0x00009bf4, 0x00000035 },
-    { 0x00009bf8, 0x00000010 },
-    { 0x00009bfc, 0x0000001a },
-    { 0x0000a210, 0x40806333 },
-    { 0x0000a214, 0x00106c10 },
-    { 0x0000a218, 0x009c4060 },
-    { 0x0000a220, 0x018830c6 },
-    { 0x0000a224, 0x00000400 },
-    { 0x0000a228, 0x001a0bb5 },
-    { 0x0000a22c, 0x00000000 },
-    { 0x0000a234, 0x20202020 },
-    { 0x0000a238, 0x20202020 },
-    { 0x0000a23c, 0x13c889af },
-    { 0x0000a240, 0x38490a20 },
-    { 0x0000a244, 0x00007bb6 },
-    { 0x0000a248, 0x0fff3ffc },
-    { 0x0000a24c, 0x00000001 },
-    { 0x0000a250, 0x0000e000 },
-    { 0x0000a254, 0x00000000 },
-    { 0x0000a258, 0x0cc75380 },
-    { 0x0000a25c, 0x0f0f0f01 },
-    { 0x0000a260, 0xdfa91f01 },
-    { 0x0000a268, 0x00000001 },
-    { 0x0000a26c, 0x0ebae9c6 },
-    { 0x0000b26c, 0x0ebae9c6 },
-    { 0x0000c26c, 0x0ebae9c6 },
-    { 0x0000d270, 0x00820820 },
-    { 0x0000a278, 0x1ce739ce },
-    { 0x0000a27c, 0x050701ce },
-    { 0x0000a338, 0x00000000 },
-    { 0x0000a33c, 0x00000000 },
-    { 0x0000a340, 0x00000000 },
-    { 0x0000a344, 0x00000000 },
-    { 0x0000a348, 0x3fffffff },
-    { 0x0000a34c, 0x3fffffff },
-    { 0x0000a350, 0x3fffffff },
-    { 0x0000a354, 0x0003ffff },
-    { 0x0000a358, 0x79bfaa03 },
-    { 0x0000d35c, 0x07ffffef },
-    { 0x0000d360, 0x0fffffe7 },
-    { 0x0000d364, 0x17ffffe5 },
-    { 0x0000d368, 0x1fffffe4 },
-    { 0x0000d36c, 0x37ffffe3 },
-    { 0x0000d370, 0x3fffffe3 },
-    { 0x0000d374, 0x57ffffe3 },
-    { 0x0000d378, 0x5fffffe2 },
-    { 0x0000d37c, 0x7fffffe2 },
-    { 0x0000d380, 0x7f3c7bba },
-    { 0x0000d384, 0xf3307ff0 },
-    { 0x0000a388, 0x0c000000 },
-    { 0x0000a38c, 0x20202020 },
-    { 0x0000a390, 0x20202020 },
-    { 0x0000a394, 0x1ce739ce },
-    { 0x0000a398, 0x000001ce },
-    { 0x0000a39c, 0x00000001 },
-    { 0x0000a3a0, 0x00000000 },
-    { 0x0000a3a4, 0x00000000 },
-    { 0x0000a3a8, 0x00000000 },
-    { 0x0000a3ac, 0x00000000 },
-    { 0x0000a3b0, 0x00000000 },
-    { 0x0000a3b4, 0x00000000 },
-    { 0x0000a3b8, 0x00000000 },
-    { 0x0000a3bc, 0x00000000 },
-    { 0x0000a3c0, 0x00000000 },
-    { 0x0000a3c4, 0x00000000 },
-    { 0x0000a3c8, 0x00000246 },
-    { 0x0000a3cc, 0x20202020 },
-    { 0x0000a3d0, 0x20202020 },
-    { 0x0000a3d4, 0x20202020 },
-    { 0x0000a3dc, 0x1ce739ce },
-    { 0x0000a3e0, 0x000001ce },
-};
-
-static const u32 ar5416Bank0_9160[][2] = {
-    { 0x000098b0, 0x1e5795e5 },
-    { 0x000098e0, 0x02008020 },
-};
-
-static const u32 ar5416BB_RfGain_9160[][3] = {
-    { 0x00009a00, 0x00000000, 0x00000000 },
-    { 0x00009a04, 0x00000040, 0x00000040 },
-    { 0x00009a08, 0x00000080, 0x00000080 },
-    { 0x00009a0c, 0x000001a1, 0x00000141 },
-    { 0x00009a10, 0x000001e1, 0x00000181 },
-    { 0x00009a14, 0x00000021, 0x000001c1 },
-    { 0x00009a18, 0x00000061, 0x00000001 },
-    { 0x00009a1c, 0x00000168, 0x00000041 },
-    { 0x00009a20, 0x000001a8, 0x000001a8 },
-    { 0x00009a24, 0x000001e8, 0x000001e8 },
-    { 0x00009a28, 0x00000028, 0x00000028 },
-    { 0x00009a2c, 0x00000068, 0x00000068 },
-    { 0x00009a30, 0x00000189, 0x000000a8 },
-    { 0x00009a34, 0x000001c9, 0x00000169 },
-    { 0x00009a38, 0x00000009, 0x000001a9 },
-    { 0x00009a3c, 0x00000049, 0x000001e9 },
-    { 0x00009a40, 0x00000089, 0x00000029 },
-    { 0x00009a44, 0x00000170, 0x00000069 },
-    { 0x00009a48, 0x000001b0, 0x00000190 },
-    { 0x00009a4c, 0x000001f0, 0x000001d0 },
-    { 0x00009a50, 0x00000030, 0x00000010 },
-    { 0x00009a54, 0x00000070, 0x00000050 },
-    { 0x00009a58, 0x00000191, 0x00000090 },
-    { 0x00009a5c, 0x000001d1, 0x00000151 },
-    { 0x00009a60, 0x00000011, 0x00000191 },
-    { 0x00009a64, 0x00000051, 0x000001d1 },
-    { 0x00009a68, 0x00000091, 0x00000011 },
-    { 0x00009a6c, 0x000001b8, 0x00000051 },
-    { 0x00009a70, 0x000001f8, 0x00000198 },
-    { 0x00009a74, 0x00000038, 0x000001d8 },
-    { 0x00009a78, 0x00000078, 0x00000018 },
-    { 0x00009a7c, 0x00000199, 0x00000058 },
-    { 0x00009a80, 0x000001d9, 0x00000098 },
-    { 0x00009a84, 0x00000019, 0x00000159 },
-    { 0x00009a88, 0x00000059, 0x00000199 },
-    { 0x00009a8c, 0x00000099, 0x000001d9 },
-    { 0x00009a90, 0x000000d9, 0x00000019 },
-    { 0x00009a94, 0x000000f9, 0x00000059 },
-    { 0x00009a98, 0x000000f9, 0x00000099 },
-    { 0x00009a9c, 0x000000f9, 0x000000d9 },
-    { 0x00009aa0, 0x000000f9, 0x000000f9 },
-    { 0x00009aa4, 0x000000f9, 0x000000f9 },
-    { 0x00009aa8, 0x000000f9, 0x000000f9 },
-    { 0x00009aac, 0x000000f9, 0x000000f9 },
-    { 0x00009ab0, 0x000000f9, 0x000000f9 },
-    { 0x00009ab4, 0x000000f9, 0x000000f9 },
-    { 0x00009ab8, 0x000000f9, 0x000000f9 },
-    { 0x00009abc, 0x000000f9, 0x000000f9 },
-    { 0x00009ac0, 0x000000f9, 0x000000f9 },
-    { 0x00009ac4, 0x000000f9, 0x000000f9 },
-    { 0x00009ac8, 0x000000f9, 0x000000f9 },
-    { 0x00009acc, 0x000000f9, 0x000000f9 },
-    { 0x00009ad0, 0x000000f9, 0x000000f9 },
-    { 0x00009ad4, 0x000000f9, 0x000000f9 },
-    { 0x00009ad8, 0x000000f9, 0x000000f9 },
-    { 0x00009adc, 0x000000f9, 0x000000f9 },
-    { 0x00009ae0, 0x000000f9, 0x000000f9 },
-    { 0x00009ae4, 0x000000f9, 0x000000f9 },
-    { 0x00009ae8, 0x000000f9, 0x000000f9 },
-    { 0x00009aec, 0x000000f9, 0x000000f9 },
-    { 0x00009af0, 0x000000f9, 0x000000f9 },
-    { 0x00009af4, 0x000000f9, 0x000000f9 },
-    { 0x00009af8, 0x000000f9, 0x000000f9 },
-    { 0x00009afc, 0x000000f9, 0x000000f9 },
-};
-
-static const u32 ar5416Bank1_9160[][2] = {
-    { 0x000098b0, 0x02108421 },
-    { 0x000098ec, 0x00000008 },
-};
-
-static const u32 ar5416Bank2_9160[][2] = {
-    { 0x000098b0, 0x0e73ff17 },
-    { 0x000098e0, 0x00000420 },
-};
-
-static const u32 ar5416Bank3_9160[][3] = {
-    { 0x000098f0, 0x01400018, 0x01c00018 },
-};
-
-static const u32 ar5416Bank6_9160[][3] = {
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x004210a2, 0x004210a2 },
-    { 0x0000989c, 0x0014008f, 0x0014008f },
-    { 0x0000989c, 0x00c40003, 0x00c40003 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x0001805e, 0x0001805e },
-    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
-    { 0x0000989c, 0x000000f1, 0x000000f1 },
-    { 0x0000989c, 0x00002081, 0x00002081 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-static const u32 ar5416Bank6TPC_9160[][3] = {
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00000000, 0x00000000 },
-    { 0x0000989c, 0x00e00000, 0x00e00000 },
-    { 0x0000989c, 0x005e0000, 0x005e0000 },
-    { 0x0000989c, 0x00120000, 0x00120000 },
-    { 0x0000989c, 0x00620000, 0x00620000 },
-    { 0x0000989c, 0x00020000, 0x00020000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x40ff0000, 0x40ff0000 },
-    { 0x0000989c, 0x005f0000, 0x005f0000 },
-    { 0x0000989c, 0x00870000, 0x00870000 },
-    { 0x0000989c, 0x00f90000, 0x00f90000 },
-    { 0x0000989c, 0x007b0000, 0x007b0000 },
-    { 0x0000989c, 0x00ff0000, 0x00ff0000 },
-    { 0x0000989c, 0x00f50000, 0x00f50000 },
-    { 0x0000989c, 0x00dc0000, 0x00dc0000 },
-    { 0x0000989c, 0x00110000, 0x00110000 },
-    { 0x0000989c, 0x006100a8, 0x006100a8 },
-    { 0x0000989c, 0x00423022, 0x00423022 },
-    { 0x0000989c, 0x2014008f, 0x2014008f },
-    { 0x0000989c, 0x00c40002, 0x00c40002 },
-    { 0x0000989c, 0x003000f2, 0x003000f2 },
-    { 0x0000989c, 0x00440016, 0x00440016 },
-    { 0x0000989c, 0x00410040, 0x00410040 },
-    { 0x0000989c, 0x0001805e, 0x0001805e },
-    { 0x0000989c, 0x0000c0ab, 0x0000c0ab },
-    { 0x0000989c, 0x000000e1, 0x000000e1 },
-    { 0x0000989c, 0x00007080, 0x00007080 },
-    { 0x0000989c, 0x000000d4, 0x000000d4 },
-    { 0x000098d0, 0x0000000f, 0x0010000f },
-};
-
-static const u32 ar5416Bank7_9160[][2] = {
-    { 0x0000989c, 0x00000500 },
-    { 0x0000989c, 0x00000800 },
-    { 0x000098cc, 0x0000000e },
-};
-
-static u32 ar5416Addac_9160[][2] = {
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x000000c0 },
-    {0x0000989c,  0x00000018 },
-    {0x0000989c,  0x00000004 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x000000c0 },
-    {0x0000989c,  0x00000019 },
-    {0x0000989c,  0x00000004 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000004 },
-    {0x0000989c,  0x00000003 },
-    {0x0000989c,  0x00000008 },
-    {0x0000989c,  0x00000000 },
-    {0x000098cc,  0x00000000 },
-};
-
-static u32 ar5416Addac_91601_1[][2] = {
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x000000c0 },
-    {0x0000989c,  0x00000018 },
-    {0x0000989c,  0x00000004 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x000000c0 },
-    {0x0000989c,  0x00000019 },
-    {0x0000989c,  0x00000004 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x0000989c,  0x00000000 },
-    {0x000098cc,  0x00000000 },
-};
-
-/* XXX 9280 1 */
 static const u32 ar9280Modes_9280[][6] = {
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
@@ -2766,7 +793,7 @@ static const u32 ar9280Common_9280_2[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8a00010 },
+    { 0x00008264, 0x88a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -3441,7 +1468,7 @@ static const u32 ar9280PciePhy_clkreq_always_on_L1_9280[][2] = {
 };
 
 /* AR9285 Revsion 10*/
-static const u_int32_t ar9285Modes_9285[][6] = {
+static const u32 ar9285Modes_9285[][6] = {
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
     { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
@@ -3763,7 +1790,7 @@ static const u_int32_t ar9285Modes_9285[][6] = {
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
 };
 
-static const u_int32_t ar9285Common_9285[][2] = {
+static const u32 ar9285Common_9285[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020045 },
     { 0x00000034, 0x00000005 },
@@ -3936,7 +1963,7 @@ static const u_int32_t ar9285Common_9285[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8a00010 },
+    { 0x00008264, 0x88a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -4096,7 +2123,7 @@ static const u_int32_t ar9285Common_9285[][2] = {
     { 0x00007870, 0x10142c00 },
 };
 
-static const u_int32_t ar9285PciePhy_clkreq_always_on_L1_9285[][2] = {
+static const u32 ar9285PciePhy_clkreq_always_on_L1_9285[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -4109,7 +2136,7 @@ static const u_int32_t ar9285PciePhy_clkreq_always_on_L1_9285[][2] = {
     {0x00004044,  0x00000000 },
 };
 
-static const u_int32_t ar9285PciePhy_clkreq_off_L1_9285[][2] = {
+static const u32 ar9285PciePhy_clkreq_off_L1_9285[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -4123,7 +2150,7 @@ static const u_int32_t ar9285PciePhy_clkreq_off_L1_9285[][2] = {
 };
 
 /* AR9285 v1_2 PCI Register Writes.  Created: 04/13/09 */
-static const u_int32_t ar9285Modes_9285_1_2[][6] = {
+static const u32 ar9285Modes_9285_1_2[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
@@ -4429,7 +2456,7 @@ static const u_int32_t ar9285Modes_9285_1_2[][6] = {
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
 };
 
-static const u_int32_t ar9285Common_9285_1_2[][2] = {
+static const u32 ar9285Common_9285_1_2[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020045 },
     { 0x00000034, 0x00000005 },
@@ -4748,7 +2775,7 @@ static const u_int32_t ar9285Common_9285_1_2[][2] = {
     { 0x00007870, 0x10142c00 },
 };
 
-static const u_int32_t ar9285Modes_high_power_tx_gain_9285_1_2[][6] = {
+static const u32 ar9285Modes_high_power_tx_gain_9285_1_2[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00006200, 0x00006200, 0x00000000 },
@@ -4789,7 +2816,7 @@ static const u_int32_t ar9285Modes_high_power_tx_gain_9285_1_2[][6] = {
     { 0x0000a3e0, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7 },
 };
 
-static const u_int32_t ar9285Modes_original_tx_gain_9285_1_2[][6] = {
+static const u32 ar9285Modes_original_tx_gain_9285_1_2[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
@@ -4830,7 +2857,7 @@ static const u_int32_t ar9285Modes_original_tx_gain_9285_1_2[][6] = {
     { 0x0000a3e0, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c },
 };
 
-static const u_int32_t ar9285Modes_XE2_0_normal_power[][6] = {
+static const u32 ar9285Modes_XE2_0_normal_power[][6] = {
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
     { 0x0000a308, 0x00000000, 0x00000000, 0x00010208, 0x00010208, 0x00000000 },
@@ -4870,7 +2897,7 @@ static const u_int32_t ar9285Modes_XE2_0_normal_power[][6] = {
     { 0x0000a3e0, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c, 0x0000039c },
 };
 
-static const u_int32_t ar9285Modes_XE2_0_high_power[][6] = {
+static const u32 ar9285Modes_XE2_0_high_power[][6] = {
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00006200, 0x00006200, 0x00000000 },
     { 0x0000a308, 0x00000000, 0x00000000, 0x00008201, 0x00008201, 0x00000000 },
@@ -4910,7 +2937,7 @@ static const u_int32_t ar9285Modes_XE2_0_high_power[][6] = {
     { 0x0000a3e0, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7, 0x000000e7 },
 };
 
-static const u_int32_t ar9285PciePhy_clkreq_always_on_L1_9285_1_2[][2] = {
+static const u32 ar9285PciePhy_clkreq_always_on_L1_9285_1_2[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -4923,7 +2950,7 @@ static const u_int32_t ar9285PciePhy_clkreq_always_on_L1_9285_1_2[][2] = {
     {0x00004044,  0x00000000 },
 };
 
-static const u_int32_t ar9285PciePhy_clkreq_off_L1_9285_1_2[][2] = {
+static const u32 ar9285PciePhy_clkreq_off_L1_9285_1_2[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -4937,7 +2964,7 @@ static const u_int32_t ar9285PciePhy_clkreq_off_L1_9285_1_2[][2] = {
 };
 
 /* AR9287 Revision 10 */
-static const u_int32_t ar9287Modes_9287_1_0[][6] = {
+static const u32 ar9287Modes_9287_1_0[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x00001030, 0x00000000, 0x00000000, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000000, 0x00000000, 0x00000318, 0x0000018c, 0x000001e0 },
@@ -4984,7 +3011,7 @@ static const u_int32_t ar9287Modes_9287_1_0[][6] = {
     { 0x0000a3d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
 };
 
-static const u_int32_t ar9287Common_9287_1_0[][2] = {
+static const u32 ar9287Common_9287_1_0[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020015 },
     { 0x00000034, 0x00000005 },
@@ -5158,7 +3185,7 @@ static const u_int32_t ar9287Common_9287_1_0[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8a00010 },
+    { 0x00008264, 0x88a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -5355,7 +3382,7 @@ static const u_int32_t ar9287Common_9287_1_0[][2] = {
     { 0x000078b8, 0x2a850160 },
 };
 
-static const u_int32_t ar9287Modes_tx_gain_9287_1_0[][6] = {
+static const u32 ar9287Modes_tx_gain_9287_1_0[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00004002, 0x00004002, 0x00004002 },
@@ -5405,7 +3432,7 @@ static const u_int32_t ar9287Modes_tx_gain_9287_1_0[][6] = {
 };
 
 
-static const u_int32_t ar9287Modes_rx_gain_9287_1_0[][6] = {
+static const u32 ar9287Modes_rx_gain_9287_1_0[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x00009a00, 0x00000000, 0x00000000, 0x0000a120, 0x0000a120, 0x0000a120 },
     { 0x00009a04, 0x00000000, 0x00000000, 0x0000a124, 0x0000a124, 0x0000a124 },
@@ -5667,7 +3694,7 @@ static const u_int32_t ar9287Modes_rx_gain_9287_1_0[][6] = {
     { 0x0000a848, 0x00000000, 0x00000000, 0x00001067, 0x00001067, 0x00001067 },
 };
 
-static const u_int32_t ar9287PciePhy_clkreq_always_on_L1_9287_1_0[][2] = {
+static const u32 ar9287PciePhy_clkreq_always_on_L1_9287_1_0[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -5680,7 +3707,7 @@ static const u_int32_t ar9287PciePhy_clkreq_always_on_L1_9287_1_0[][2] = {
     {0x00004044,  0x00000000 },
 };
 
-static const u_int32_t ar9287PciePhy_clkreq_off_L1_9287_1_0[][2] = {
+static const u32 ar9287PciePhy_clkreq_off_L1_9287_1_0[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -5695,7 +3722,7 @@ static const u_int32_t ar9287PciePhy_clkreq_off_L1_9287_1_0[][2] = {
 
 /* AR9287 Revision 11 */
 
-static const u_int32_t ar9287Modes_9287_1_1[][6] = {
+static const u32 ar9287Modes_9287_1_1[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x00001030, 0x00000000, 0x00000000, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000000, 0x00000000, 0x00000318, 0x0000018c, 0x000001e0 },
@@ -5742,7 +3769,7 @@ static const u_int32_t ar9287Modes_9287_1_1[][6] = {
     { 0x0000a3d8, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
 };
 
-static const u_int32_t ar9287Common_9287_1_1[][2] = {
+static const u32 ar9287Common_9287_1_1[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020015 },
     { 0x00000034, 0x00000005 },
@@ -6112,21 +4139,22 @@ static const u_int32_t ar9287Common_9287_1_1[][2] = {
 
 /*
  * For Japanese regulatory requirements, 2484 MHz requires the following three
- * registers be programmed differently from the channel between 2412 and 2472 MHz.
+ * registers be programmed differently from the channel between 2412 and
+ * 2472 MHz.
  */
-static const u_int32_t ar9287Common_normal_cck_fir_coeff_92871_1[][2] = {
+static const u32 ar9287Common_normal_cck_fir_coeff_92871_1[][2] = {
     { 0x0000a1f4, 0x00fffeff },
     { 0x0000a1f8, 0x00f5f9ff },
     { 0x0000a1fc, 0xb79f6427 },
 };
 
-static const u_int32_t ar9287Common_japan_2484_cck_fir_coeff_92871_1[][2] = {
+static const u32 ar9287Common_japan_2484_cck_fir_coeff_92871_1[][2] = {
     { 0x0000a1f4, 0x00000000 },
     { 0x0000a1f8, 0xefff0301 },
     { 0x0000a1fc, 0xca9228ee },
 };
 
-static const u_int32_t ar9287Modes_tx_gain_9287_1_1[][6] = {
+static const u32 ar9287Modes_tx_gain_9287_1_1[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00004002, 0x00004002, 0x00004002 },
@@ -6175,7 +4203,7 @@ static const u_int32_t ar9287Modes_tx_gain_9287_1_1[][6] = {
     { 0x0000a274, 0x0a180000, 0x0a180000, 0x0a1aa000, 0x0a1aa000, 0x0a1aa000 },
 };
 
-static const u_int32_t ar9287Modes_rx_gain_9287_1_1[][6] = {
+static const u32 ar9287Modes_rx_gain_9287_1_1[][6] = {
     /* Address      5G-HT20     5G-HT40     2G-HT40     2G-HT20     Turbo   */
     { 0x00009a00, 0x00000000, 0x00000000, 0x0000a120, 0x0000a120, 0x0000a120 },
     { 0x00009a04, 0x00000000, 0x00000000, 0x0000a124, 0x0000a124, 0x0000a124 },
@@ -6437,7 +4465,7 @@ static const u_int32_t ar9287Modes_rx_gain_9287_1_1[][6] = {
     { 0x0000a848, 0x00000000, 0x00000000, 0x00001067, 0x00001067, 0x00001067 },
 };
 
-static const u_int32_t ar9287PciePhy_clkreq_always_on_L1_9287_1_1[][2] = {
+static const u32 ar9287PciePhy_clkreq_always_on_L1_9287_1_1[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -6450,7 +4478,7 @@ static const u_int32_t ar9287PciePhy_clkreq_always_on_L1_9287_1_1[][2] = {
     {0x00004044,  0x00000000 },
 };
 
-static const u_int32_t ar9287PciePhy_clkreq_off_L1_9287_1_1[][2] = {
+static const u32 ar9287PciePhy_clkreq_off_L1_9287_1_1[][2] = {
     {0x00004040,  0x9248fd00 },
     {0x00004040,  0x24924924 },
     {0x00004040,  0xa8000019 },
@@ -6465,7 +4493,7 @@ static const u_int32_t ar9287PciePhy_clkreq_off_L1_9287_1_1[][2] = {
 
 
 /* AR9271 initialization values automaticaly created: 06/04/09 */
-static const u_int32_t ar9271Modes_9271[][6] = {
+static const u32 ar9271Modes_9271[][6] = {
     { 0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160, 0x000001e0 },
     { 0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c, 0x000001e0 },
     { 0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38, 0x00001180 },
@@ -6771,7 +4799,7 @@ static const u_int32_t ar9271Modes_9271[][6] = {
     { 0x0000a358, 0x7999aa02, 0x7999aa02, 0x7999aa0e, 0x7999aa0e, 0x7999aa0e },
 };
 
-static const u_int32_t ar9271Common_9271[][2] = {
+static const u32 ar9271Common_9271[][2] = {
     { 0x0000000c, 0x00000000 },
     { 0x00000030, 0x00020045 },
     { 0x00000034, 0x00000005 },
@@ -6945,7 +4973,7 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x00008258, 0x00000000 },
     { 0x0000825c, 0x400000ff },
     { 0x00008260, 0x00080922 },
-    { 0x00008264, 0xa8a00010 },
+    { 0x00008264, 0x88a00010 },
     { 0x00008270, 0x00000000 },
     { 0x00008274, 0x40000000 },
     { 0x00008278, 0x003e4180 },
@@ -7099,24 +5127,24 @@ static const u_int32_t ar9271Common_9271[][2] = {
     { 0x0000d384, 0xf3307ff0 },
 };
 
-static const u_int32_t ar9271Common_normal_cck_fir_coeff_9271[][2] = {
+static const u32 ar9271Common_normal_cck_fir_coeff_9271[][2] = {
     { 0x0000a1f4, 0x00fffeff },
     { 0x0000a1f8, 0x00f5f9ff },
     { 0x0000a1fc, 0xb79f6427 },
 };
 
-static const u_int32_t ar9271Common_japan_2484_cck_fir_coeff_9271[][2] = {
+static const u32 ar9271Common_japan_2484_cck_fir_coeff_9271[][2] = {
     { 0x0000a1f4, 0x00000000 },
     { 0x0000a1f8, 0xefff0301 },
     { 0x0000a1fc, 0xca9228ee },
 };
 
-static const u_int32_t ar9271Modes_9271_1_0_only[][6] = {
+static const u32 ar9271Modes_9271_1_0_only[][6] = {
     { 0x00009910, 0x30002311, 0x30002311, 0x30002311, 0x30002311, 0x30002311 },
     { 0x00009828, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001, 0x0a020001 },
 };
 
-static const u_int32_t ar9271Modes_9271_ANI_reg[][6] = {
+static const u32 ar9271Modes_9271_ANI_reg[][6] = {
     { 0x00009850, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2, 0x6d4000e2 },
     { 0x0000985c, 0x3139605e, 0x3139605e, 0x3137605e, 0x3137605e, 0x3139605e },
     { 0x00009858, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e, 0x7ec84d2e },
@@ -7127,7 +5155,7 @@ static const u_int32_t ar9271Modes_9271_ANI_reg[][6] = {
     { 0x000099c0, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4 },
 };
 
-static const u_int32_t ar9271Modes_normal_power_tx_gain_9271[][6] = {
+static const u32 ar9271Modes_normal_power_tx_gain_9271[][6] = {
     { 0x0000a300, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00009200, 0x00009200, 0x00000000 },
     { 0x0000a308, 0x00000000, 0x00000000, 0x00010208, 0x00010208, 0x00000000 },
@@ -7163,7 +5191,7 @@ static const u_int32_t ar9271Modes_normal_power_tx_gain_9271[][6] = {
     { 0x0000a3e0, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd, 0x000003bd },
 };
 
-static const u_int32_t ar9271Modes_high_power_tx_gain_9271[][6] = {
+static const u32 ar9271Modes_high_power_tx_gain_9271[][6] = {
     { 0x0000a300, 0x00000000, 0x00000000, 0x00010000, 0x00010000, 0x00000000 },
     { 0x0000a304, 0x00000000, 0x00000000, 0x00016200, 0x00016200, 0x00000000 },
     { 0x0000a308, 0x00000000, 0x00000000, 0x00018201, 0x00018201, 0x00000000 },
@@ -7198,3 +5226,5 @@ static const u_int32_t ar9271Modes_high_power_tx_gain_9271[][6] = {
     { 0x0000a3dc, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63, 0x06318c63 },
     { 0x0000a3e0, 0x00000063, 0x00000063, 0x00000063, 0x00000063, 0x00000063 },
 };
+
+#endif /* INITVALS_9002_10_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
new file mode 100644
index 000000000000..2be20d2070c4
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -0,0 +1,480 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+
+#define AR_BufLen           0x00000fff
+
+static void ar9002_hw_rx_enable(struct ath_hw *ah)
+{
+        REG_WRITE(ah, AR_CR, AR_CR_RXE);
+}
+
+static void ar9002_hw_set_desc_link(void *ds, u32 ds_link)
+{
+        ((struct ath_desc*) ds)->ds_link = ds_link;
+}
+
+static void ar9002_hw_get_desc_link(void *ds, u32 **ds_link)
+{
+        *ds_link = &((struct ath_desc *)ds)->ds_link;
+}
+
+static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+{
+        u32 isr = 0;
+        u32 mask2 = 0;
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
+        u32 sync_cause = 0;
+        bool fatal_int = false;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (!AR_SREV_9100(ah)) {
+                if (REG_READ(ah, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) {
+                        if ((REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M)
+                            == AR_RTC_STATUS_ON) {
+                                isr = REG_READ(ah, AR_ISR);
+                        }
+                }
+
+                sync_cause = REG_READ(ah, AR_INTR_SYNC_CAUSE) &
+                        AR_INTR_SYNC_DEFAULT;
+
+                *masked = 0;
+
+                if (!isr && !sync_cause)
+                        return false;
+        } else {
+                *masked = 0;
+                isr = REG_READ(ah, AR_ISR);
+        }
+
+        if (isr) {
+                if (isr & AR_ISR_BCNMISC) {
+                        u32 isr2;
+                        isr2 = REG_READ(ah, AR_ISR_S2);
+                        if (isr2 & AR_ISR_S2_TIM)
+                                mask2 |= ATH9K_INT_TIM;
+                        if (isr2 & AR_ISR_S2_DTIM)
+                                mask2 |= ATH9K_INT_DTIM;
+                        if (isr2 & AR_ISR_S2_DTIMSYNC)
+                                mask2 |= ATH9K_INT_DTIMSYNC;
+                        if (isr2 & (AR_ISR_S2_CABEND))
+                                mask2 |= ATH9K_INT_CABEND;
+                        if (isr2 & AR_ISR_S2_GTT)
+                                mask2 |= ATH9K_INT_GTT;
+                        if (isr2 & AR_ISR_S2_CST)
+                                mask2 |= ATH9K_INT_CST;
+                        if (isr2 & AR_ISR_S2_TSFOOR)
+                                mask2 |= ATH9K_INT_TSFOOR;
+                }
+
+                isr = REG_READ(ah, AR_ISR_RAC);
+                if (isr == 0xffffffff) {
+                        *masked = 0;
+                        return false;
+                }
+
+                *masked = isr & ATH9K_INT_COMMON;
+
+                if (ah->config.rx_intr_mitigation) {
+                        if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
+                                *masked |= ATH9K_INT_RX;
+                }
+
+                if (isr & (AR_ISR_RXOK | AR_ISR_RXERR))
+                        *masked |= ATH9K_INT_RX;
+                if (isr &
+                    (AR_ISR_TXOK | AR_ISR_TXDESC | AR_ISR_TXERR |
+                     AR_ISR_TXEOL)) {
+                        u32 s0_s, s1_s;
+
+                        *masked |= ATH9K_INT_TX;
+
+                        s0_s = REG_READ(ah, AR_ISR_S0_S);
+                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
+                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
+
+                        s1_s = REG_READ(ah, AR_ISR_S1_S);
+                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
+                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
+                }
+
+                if (isr & AR_ISR_RXORN) {
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "receive FIFO overrun interrupt\n");
+                }
+
+                if (!AR_SREV_9100(ah)) {
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                                u32 isr5 = REG_READ(ah, AR_ISR_S5_S);
+                                if (isr5 & AR_ISR_S5_TIM_TIMER)
+                                        *masked |= ATH9K_INT_TIM_TIMER;
+                        }
+                }
+
+                *masked |= mask2;
+        }
+
+        if (AR_SREV_9100(ah))
+                return true;
+
+        if (isr & AR_ISR_GENTMR) {
+                u32 s5_s;
+
+                s5_s = REG_READ(ah, AR_ISR_S5_S);
+                if (isr & AR_ISR_GENTMR) {
+                        ah->intr_gen_timer_trigger =
+                                MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
+
+                        ah->intr_gen_timer_thresh =
+                                MS(s5_s, AR_ISR_S5_GENTIMER_THRESH);
+
+                        if (ah->intr_gen_timer_trigger)
+                                *masked |= ATH9K_INT_GENTIMER;
+
+                }
+        }
+
+        if (sync_cause) {
+                fatal_int =
+                        (sync_cause &
+                         (AR_INTR_SYNC_HOST1_FATAL | AR_INTR_SYNC_HOST1_PERR))
+                        ? true : false;
+
+                if (fatal_int) {
+                        if (sync_cause & AR_INTR_SYNC_HOST1_FATAL) {
+                                ath_print(common, ATH_DBG_ANY,
+                                          "received PCI FATAL interrupt\n");
+                        }
+                        if (sync_cause & AR_INTR_SYNC_HOST1_PERR) {
+                                ath_print(common, ATH_DBG_ANY,
+                                          "received PCI PERR interrupt\n");
+                        }
+                        *masked |= ATH9K_INT_FATAL;
+                }
+                if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "AR_INTR_SYNC_RADM_CPL_TIMEOUT\n");
+                        REG_WRITE(ah, AR_RC, AR_RC_HOSTIF);
+                        REG_WRITE(ah, AR_RC, 0);
+                        *masked |= ATH9K_INT_FATAL;
+                }
+                if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT) {
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
+                }
+
+                REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
+                (void) REG_READ(ah, AR_INTR_SYNC_CAUSE_CLR);
+        }
+
+        return true;
+}
+
+static void ar9002_hw_fill_txdesc(struct ath_hw *ah, void *ds, u32 seglen,
+                                  bool is_firstseg, bool is_lastseg,
+                                  const void *ds0, dma_addr_t buf_addr,
+                                  unsigned int qcu)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_data = buf_addr;
+
+        if (is_firstseg) {
+                ads->ds_ctl1 |= seglen | (is_lastseg ? 0 : AR_TxMore);
+        } else if (is_lastseg) {
+                ads->ds_ctl0 = 0;
+                ads->ds_ctl1 = seglen;
+                ads->ds_ctl2 = AR5416DESC_CONST(ds0)->ds_ctl2;
+                ads->ds_ctl3 = AR5416DESC_CONST(ds0)->ds_ctl3;
+        } else {
+                ads->ds_ctl0 = 0;
+                ads->ds_ctl1 = seglen | AR_TxMore;
+                ads->ds_ctl2 = 0;
+                ads->ds_ctl3 = 0;
+        }
+        ads->ds_txstatus0 = ads->ds_txstatus1 = 0;
+        ads->ds_txstatus2 = ads->ds_txstatus3 = 0;
+        ads->ds_txstatus4 = ads->ds_txstatus5 = 0;
+        ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
+        ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
+}
+
+static int ar9002_hw_proc_txdesc(struct ath_hw *ah, void *ds,
+                                 struct ath_tx_status *ts)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        if ((ads->ds_txstatus9 & AR_TxDone) == 0)
+                return -EINPROGRESS;
+
+        ts->ts_seqnum = MS(ads->ds_txstatus9, AR_SeqNum);
+        ts->ts_tstamp = ads->AR_SendTimestamp;
+        ts->ts_status = 0;
+        ts->ts_flags = 0;
+
+        if (ads->ds_txstatus1 & AR_FrmXmitOK)
+                ts->ts_status |= ATH9K_TX_ACKED;
+        if (ads->ds_txstatus1 & AR_ExcessiveRetries)
+                ts->ts_status |= ATH9K_TXERR_XRETRY;
+        if (ads->ds_txstatus1 & AR_Filtered)
+                ts->ts_status |= ATH9K_TXERR_FILT;
+        if (ads->ds_txstatus1 & AR_FIFOUnderrun) {
+                ts->ts_status |= ATH9K_TXERR_FIFO;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->ds_txstatus9 & AR_TxOpExceeded)
+                ts->ts_status |= ATH9K_TXERR_XTXOP;
+        if (ads->ds_txstatus1 & AR_TxTimerExpired)
+                ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
+
+        if (ads->ds_txstatus1 & AR_DescCfgErr)
+                ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
+        if (ads->ds_txstatus1 & AR_TxDataUnderrun) {
+                ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->ds_txstatus1 & AR_TxDelimUnderrun) {
+                ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->ds_txstatus0 & AR_TxBaStatus) {
+                ts->ts_flags |= ATH9K_TX_BA;
+                ts->ba_low = ads->AR_BaBitmapLow;
+                ts->ba_high = ads->AR_BaBitmapHigh;
+        }
+
+        ts->ts_rateindex = MS(ads->ds_txstatus9, AR_FinalTxIdx);
+        switch (ts->ts_rateindex) {
+        case 0:
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate0);
+                break;
+        case 1:
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate1);
+                break;
+        case 2:
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate2);
+                break;
+        case 3:
+                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate3);
+                break;
+        }
+
+        ts->ts_rssi = MS(ads->ds_txstatus5, AR_TxRSSICombined);
+        ts->ts_rssi_ctl0 = MS(ads->ds_txstatus0, AR_TxRSSIAnt00);
+        ts->ts_rssi_ctl1 = MS(ads->ds_txstatus0, AR_TxRSSIAnt01);
+        ts->ts_rssi_ctl2 = MS(ads->ds_txstatus0, AR_TxRSSIAnt02);
+        ts->ts_rssi_ext0 = MS(ads->ds_txstatus5, AR_TxRSSIAnt10);
+        ts->ts_rssi_ext1 = MS(ads->ds_txstatus5, AR_TxRSSIAnt11);
+        ts->ts_rssi_ext2 = MS(ads->ds_txstatus5, AR_TxRSSIAnt12);
+        ts->evm0 = ads->AR_TxEVM0;
+        ts->evm1 = ads->AR_TxEVM1;
+        ts->evm2 = ads->AR_TxEVM2;
+        ts->ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
+        ts->ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
+        ts->ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
+        ts->ts_antenna = 0;
+
+        return 0;
+}
+
+static void ar9002_hw_set11n_txdesc(struct ath_hw *ah, void *ds,
+                                    u32 pktLen, enum ath9k_pkt_type type,
+                                    u32 txPower, u32 keyIx,
+                                    enum ath9k_key_type keyType, u32 flags)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        txPower += ah->txpower_indexoffset;
+        if (txPower > 63)
+                txPower = 63;
+
+        ads->ds_ctl0 = (pktLen & AR_FrameLen)
+                | (flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
+                | SM(txPower, AR_XmitPower)
+                | (flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
+                | (flags & ATH9K_TXDESC_CLRDMASK ? AR_ClrDestMask : 0)
+                | (flags & ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)
+                | (keyIx != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0);
+
+        ads->ds_ctl1 =
+                (keyIx != ATH9K_TXKEYIX_INVALID ? SM(keyIx, AR_DestIdx) : 0)
+                | SM(type, AR_FrameType)
+                | (flags & ATH9K_TXDESC_NOACK ? AR_NoAck : 0)
+                | (flags & ATH9K_TXDESC_EXT_ONLY ? AR_ExtOnly : 0)
+                | (flags & ATH9K_TXDESC_EXT_AND_CTL ? AR_ExtAndCtl : 0);
+
+        ads->ds_ctl6 = SM(keyType, AR_EncrType);
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) {
+                ads->ds_ctl8 = 0;
+                ads->ds_ctl9 = 0;
+                ads->ds_ctl10 = 0;
+                ads->ds_ctl11 = 0;
+        }
+}
+
+static void ar9002_hw_set11n_ratescenario(struct ath_hw *ah, void *ds,
+                                          void *lastds,
+                                          u32 durUpdateEn, u32 rtsctsRate,
+                                          u32 rtsctsDuration,
+                                          struct ath9k_11n_rate_series series[],
+                                          u32 nseries, u32 flags)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+        struct ar5416_desc *last_ads = AR5416DESC(lastds);
+        u32 ds_ctl0;
+
+        if (flags & (ATH9K_TXDESC_RTSENA | ATH9K_TXDESC_CTSENA)) {
+                ds_ctl0 = ads->ds_ctl0;
+
+                if (flags & ATH9K_TXDESC_RTSENA) {
+                        ds_ctl0 &= ~AR_CTSEnable;
+                        ds_ctl0 |= AR_RTSEnable;
+                } else {
+                        ds_ctl0 &= ~AR_RTSEnable;
+                        ds_ctl0 |= AR_CTSEnable;
+                }
+
+                ads->ds_ctl0 = ds_ctl0;
+        } else {
+                ads->ds_ctl0 =
+                        (ads->ds_ctl0 & ~(AR_RTSEnable | AR_CTSEnable));
+        }
+
+        ads->ds_ctl2 = set11nTries(series, 0)
+                | set11nTries(series, 1)
+                | set11nTries(series, 2)
+                | set11nTries(series, 3)
+                | (durUpdateEn ? AR_DurUpdateEna : 0)
+                | SM(0, AR_BurstDur);
+
+        ads->ds_ctl3 = set11nRate(series, 0)
+                | set11nRate(series, 1)
+                | set11nRate(series, 2)
+                | set11nRate(series, 3);
+
+        ads->ds_ctl4 = set11nPktDurRTSCTS(series, 0)
+                | set11nPktDurRTSCTS(series, 1);
+
+        ads->ds_ctl5 = set11nPktDurRTSCTS(series, 2)
+                | set11nPktDurRTSCTS(series, 3);
+
+        ads->ds_ctl7 = set11nRateFlags(series, 0)
+                | set11nRateFlags(series, 1)
+                | set11nRateFlags(series, 2)
+                | set11nRateFlags(series, 3)
+                | SM(rtsctsRate, AR_RTSCTSRate);
+        last_ads->ds_ctl2 = ads->ds_ctl2;
+        last_ads->ds_ctl3 = ads->ds_ctl3;
+}
+
+static void ar9002_hw_set11n_aggr_first(struct ath_hw *ah, void *ds,
+                                        u32 aggrLen)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_ctl1 |= (AR_IsAggr | AR_MoreAggr);
+        ads->ds_ctl6 &= ~AR_AggrLen;
+        ads->ds_ctl6 |= SM(aggrLen, AR_AggrLen);
+}
+
+static void ar9002_hw_set11n_aggr_middle(struct ath_hw *ah, void *ds,
+                                         u32 numDelims)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+        unsigned int ctl6;
+
+        ads->ds_ctl1 |= (AR_IsAggr | AR_MoreAggr);
+
+        ctl6 = ads->ds_ctl6;
+        ctl6 &= ~AR_PadDelim;
+        ctl6 |= SM(numDelims, AR_PadDelim);
+        ads->ds_ctl6 = ctl6;
+}
+
+static void ar9002_hw_set11n_aggr_last(struct ath_hw *ah, void *ds)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_ctl1 |= AR_IsAggr;
+        ads->ds_ctl1 &= ~AR_MoreAggr;
+        ads->ds_ctl6 &= ~AR_PadDelim;
+}
+
+static void ar9002_hw_clr11n_aggr(struct ath_hw *ah, void *ds)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_ctl1 &= (~AR_IsAggr & ~AR_MoreAggr);
+}
+
+static void ar9002_hw_set11n_burstduration(struct ath_hw *ah, void *ds,
+                                           u32 burstDuration)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_ctl2 &= ~AR_BurstDur;
+        ads->ds_ctl2 |= SM(burstDuration, AR_BurstDur);
+}
+
+static void ar9002_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
+                                            u32 vmf)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        if (vmf)
+                ads->ds_ctl0 |= AR_VirtMoreFrag;
+        else
+                ads->ds_ctl0 &= ~AR_VirtMoreFrag;
+}
+
+void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
+                          u32 size, u32 flags)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
+
+        ads->ds_ctl1 = size & AR_BufLen;
+        if (flags & ATH9K_RXDESC_INTREQ)
+                ads->ds_ctl1 |= AR_RxIntrReq;
+
+        ads->ds_rxstatus8 &= ~AR_RxDone;
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+                memset(&(ads->u), 0, sizeof(ads->u));
+}
+EXPORT_SYMBOL(ath9k_hw_setuprxdesc);
+
+void ar9002_hw_attach_mac_ops(struct ath_hw *ah)
+{
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        ops->rx_enable = ar9002_hw_rx_enable;
+        ops->set_desc_link = ar9002_hw_set_desc_link;
+        ops->get_desc_link = ar9002_hw_get_desc_link;
+        ops->get_isr = ar9002_hw_get_isr;
+        ops->fill_txdesc = ar9002_hw_fill_txdesc;
+        ops->proc_txdesc = ar9002_hw_proc_txdesc;
+        ops->set11n_txdesc = ar9002_hw_set11n_txdesc;
+        ops->set11n_ratescenario = ar9002_hw_set11n_ratescenario;
+        ops->set11n_aggr_first = ar9002_hw_set11n_aggr_first;
+        ops->set11n_aggr_middle = ar9002_hw_set11n_aggr_middle;
+        ops->set11n_aggr_last = ar9002_hw_set11n_aggr_last;
+        ops->clr11n_aggr = ar9002_hw_clr11n_aggr;
+        ops->set11n_burstduration = ar9002_hw_set11n_burstduration;
+        ops->set11n_virtualmorefrag = ar9002_hw_set11n_virtualmorefrag;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
new file mode 100644
index 000000000000..ed314e89bfe1
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -0,0 +1,535 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/**
+ * DOC: Programming Atheros 802.11n analog front end radios
+ *
+ * AR5416 MAC based PCI devices and AR518 MAC based PCI-Express
+ * devices have either an external AR2133 analog front end radio for single
+ * band 2.4 GHz communication or an AR5133 analog front end radio for dual
+ * band 2.4 GHz / 5 GHz communication.
+ *
+ * All devices after the AR5416 and AR5418 family starting with the AR9280
+ * have their analog front radios, MAC/BB and host PCIe/USB interface embedded
+ * into a single-chip and require less programming.
+ *
+ * The following single-chips exist with a respective embedded radio:
+ *
+ * AR9280 - 11n dual-band 2x2 MIMO for PCIe
+ * AR9281 - 11n single-band 1x2 MIMO for PCIe
+ * AR9285 - 11n single-band 1x1 for PCIe
+ * AR9287 - 11n single-band 2x2 MIMO for PCIe
+ *
+ * AR9220 - 11n dual-band 2x2 MIMO for PCI
+ * AR9223 - 11n single-band 2x2 MIMO for PCI
+ *
+ * AR9287 - 11n single-band 1x1 MIMO for USB
+ */
+
+#include "hw.h"
+#include "ar9002_phy.h"
+
+/**
+ * ar9002_hw_set_channel - set channel on single-chip device
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * This is the function to change channel on single-chip devices, that is
+ * all devices after ar9280.
+ *
+ * This function takes the channel value in MHz and sets
+ * hardware channel value. Assumes writes have been enabled to analog bus.
+ *
+ * Actual Expression,
+ *
+ * For 2GHz channel,
+ * Channel Frequency = (3/4) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^17)
+ * (freq_ref = 40MHz)
+ *
+ * For 5GHz channel,
+ * Channel Frequency = (3/2) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^10)
+ * (freq_ref = 40MHz/(24>>amodeRefSel))
+ */
+static int ar9002_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        u16 bMode, fracMode, aModeRefSel = 0;
+        u32 freq, ndiv, channelSel = 0, channelFrac = 0, reg32 = 0;
+        struct chan_centers centers;
+        u32 refDivA = 24;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        reg32 = REG_READ(ah, AR_PHY_SYNTH_CONTROL);
+        reg32 &= 0xc0000000;
+
+        if (freq < 4800) { /* 2 GHz, fractional mode */
+                u32 txctl;
+                int regWrites = 0;
+
+                bMode = 1;
+                fracMode = 1;
+                aModeRefSel = 0;
+                channelSel = CHANSEL_2G(freq);
+
+                if (AR_SREV_9287_11_OR_LATER(ah)) {
+                        if (freq == 2484) {
+                                /* Enable channel spreading for channel 14 */
+                                REG_WRITE_ARRAY(&ah->iniCckfirJapan2484,
+                                                1, regWrites);
+                        } else {
+                                REG_WRITE_ARRAY(&ah->iniCckfirNormal,
+                                                1, regWrites);
+                        }
+                } else {
+                        txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
+                        if (freq == 2484) {
+                                /* Enable channel spreading for channel 14 */
+                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                          txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
+                        } else {
+                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
+                                          txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
+                        }
+                }
+        } else {
+                bMode = 0;
+                fracMode = 0;
+
+                switch (ah->eep_ops->get_eeprom(ah, EEP_FRAC_N_5G)) {
+                case 0:
+                        if ((freq % 20) == 0)
+                                aModeRefSel = 3;
+                        else if ((freq % 10) == 0)
+                                aModeRefSel = 2;
+                        if (aModeRefSel)
+                                break;
+                case 1:
+                default:
+                        aModeRefSel = 0;
+                        /*
+                         * Enable 2G (fractional) mode for channels
+                         * which are 5MHz spaced.
+                         */
+                        fracMode = 1;
+                        refDivA = 1;
+                        channelSel = CHANSEL_5G(freq);
+
+                        /* RefDivA setting */
+                        REG_RMW_FIELD(ah, AR_AN_SYNTH9,
+                                      AR_AN_SYNTH9_REFDIVA, refDivA);
+
+                }
+
+                if (!fracMode) {
+                        ndiv = (freq * (refDivA >> aModeRefSel)) / 60;
+                        channelSel = ndiv & 0x1ff;
+                        channelFrac = (ndiv & 0xfffffe00) * 2;
+                        channelSel = (channelSel << 17) | channelFrac;
+                }
+        }
+
+        reg32 = reg32 |
+            (bMode << 29) |
+            (fracMode << 28) | (aModeRefSel << 26) | (channelSel);
+
+        REG_WRITE(ah, AR_PHY_SYNTH_CONTROL, reg32);
+
+        ah->curchan = chan;
+        ah->curchan_rad_index = -1;
+
+        return 0;
+}
+
+/**
+ * ar9002_hw_spur_mitigate - convert baseband spur frequency
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * For single-chip solutions. Converts to baseband spur frequency given the
+ * input channel frequency and compute register settings below.
+ */
+static void ar9002_hw_spur_mitigate(struct ath_hw *ah,
+                                    struct ath9k_channel *chan)
+{
+        int bb_spur = AR_NO_SPUR;
+        int freq;
+        int bin, cur_bin;
+        int bb_spur_off, spur_subchannel_sd;
+        int spur_freq_sd;
+        int spur_delta_phase;
+        int denominator;
+        int upper, lower, cur_vit_mask;
+        int tmp, newVal;
+        int i;
+        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
+                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
+        };
+        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
+                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
+        };
+        int inc[4] = { 0, 100, 0, 0 };
+        struct chan_centers centers;
+
+        int8_t mask_m[123];
+        int8_t mask_p[123];
+        int8_t mask_amt;
+        int tmp_mask;
+        int cur_bb_spur;
+        bool is2GHz = IS_CHAN_2GHZ(chan);
+
+        memset(&mask_m, 0, sizeof(int8_t) * 123);
+        memset(&mask_p, 0, sizeof(int8_t) * 123);
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        ah->config.spurmode = SPUR_ENABLE_EEPROM;
+        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
+                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
+
+                if (is2GHz)
+                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_2GHZ;
+                else
+                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_5GHZ;
+
+                if (AR_NO_SPUR == cur_bb_spur)
+                        break;
+                cur_bb_spur = cur_bb_spur - freq;
+
+                if (IS_CHAN_HT40(chan)) {
+                        if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT40) &&
+                            (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT40)) {
+                                bb_spur = cur_bb_spur;
+                                break;
+                        }
+                } else if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT20) &&
+                           (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT20)) {
+                        bb_spur = cur_bb_spur;
+                        break;
+                }
+        }
+
+        if (AR_NO_SPUR == bb_spur) {
+                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
+                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
+                return;
+        } else {
+                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
+                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
+        }
+
+        bin = bb_spur * 320;
+
+        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        newVal = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
+                        AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
+                        AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
+                        AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
+        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), newVal);
+
+        newVal = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
+                  AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
+                  AR_PHY_SPUR_REG_MASK_RATE_SELECT |
+                  AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
+                  SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
+        REG_WRITE(ah, AR_PHY_SPUR_REG, newVal);
+
+        if (IS_CHAN_HT40(chan)) {
+                if (bb_spur < 0) {
+                        spur_subchannel_sd = 1;
+                        bb_spur_off = bb_spur + 10;
+                } else {
+                        spur_subchannel_sd = 0;
+                        bb_spur_off = bb_spur - 10;
+                }
+        } else {
+                spur_subchannel_sd = 0;
+                bb_spur_off = bb_spur;
+        }
+
+        if (IS_CHAN_HT40(chan))
+                spur_delta_phase =
+                        ((bb_spur * 262144) /
+                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+        else
+                spur_delta_phase =
+                        ((bb_spur * 524288) /
+                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
+
+        denominator = IS_CHAN_2GHZ(chan) ? 44 : 40;
+        spur_freq_sd = ((bb_spur_off * 2048) / denominator) & 0x3ff;
+
+        newVal = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
+                  SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
+                  SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
+        REG_WRITE(ah, AR_PHY_TIMING11, newVal);
+
+        newVal = spur_subchannel_sd << AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S;
+        REG_WRITE(ah, AR_PHY_SFCORR_EXT, newVal);
+
+        cur_bin = -6000;
+        upper = bin + 100;
+        lower = bin - 100;
+
+        for (i = 0; i < 4; i++) {
+                int pilot_mask = 0;
+                int chan_mask = 0;
+                int bp = 0;
+                for (bp = 0; bp < 30; bp++) {
+                        if ((cur_bin > lower) && (cur_bin < upper)) {
+                                pilot_mask = pilot_mask | 0x1 << bp;
+                                chan_mask = chan_mask | 0x1 << bp;
+                        }
+                        cur_bin += 100;
+                }
+                cur_bin += inc[i];
+                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
+                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
+        }
+
+        cur_vit_mask = 6100;
+        upper = bin + 120;
+        lower = bin - 120;
+
+        for (i = 0; i < 123; i++) {
+                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
+
+                        /* workaround for gcc bug #37014 */
+                        volatile int tmp_v = abs(cur_vit_mask - bin);
+
+                        if (tmp_v < 75)
+                                mask_amt = 1;
+                        else
+                                mask_amt = 0;
+                        if (cur_vit_mask < 0)
+                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
+                        else
+                                mask_p[cur_vit_mask / 100] = mask_amt;
+                }
+                cur_vit_mask -= 100;
+        }
+
+        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
+                | (mask_m[48] << 26) | (mask_m[49] << 24)
+                | (mask_m[50] << 22) | (mask_m[51] << 20)
+                | (mask_m[52] << 18) | (mask_m[53] << 16)
+                | (mask_m[54] << 14) | (mask_m[55] << 12)
+                | (mask_m[56] << 10) | (mask_m[57] << 8)
+                | (mask_m[58] << 6) | (mask_m[59] << 4)
+                | (mask_m[60] << 2) | (mask_m[61] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
+
+        tmp_mask = (mask_m[31] << 28)
+                | (mask_m[32] << 26) | (mask_m[33] << 24)
+                | (mask_m[34] << 22) | (mask_m[35] << 20)
+                | (mask_m[36] << 18) | (mask_m[37] << 16)
+                | (mask_m[48] << 14) | (mask_m[39] << 12)
+                | (mask_m[40] << 10) | (mask_m[41] << 8)
+                | (mask_m[42] << 6) | (mask_m[43] << 4)
+                | (mask_m[44] << 2) | (mask_m[45] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
+
+        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
+                | (mask_m[18] << 26) | (mask_m[18] << 24)
+                | (mask_m[20] << 22) | (mask_m[20] << 20)
+                | (mask_m[22] << 18) | (mask_m[22] << 16)
+                | (mask_m[24] << 14) | (mask_m[24] << 12)
+                | (mask_m[25] << 10) | (mask_m[26] << 8)
+                | (mask_m[27] << 6) | (mask_m[28] << 4)
+                | (mask_m[29] << 2) | (mask_m[30] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
+
+        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
+                | (mask_m[2] << 26) | (mask_m[3] << 24)
+                | (mask_m[4] << 22) | (mask_m[5] << 20)
+                | (mask_m[6] << 18) | (mask_m[7] << 16)
+                | (mask_m[8] << 14) | (mask_m[9] << 12)
+                | (mask_m[10] << 10) | (mask_m[11] << 8)
+                | (mask_m[12] << 6) | (mask_m[13] << 4)
+                | (mask_m[14] << 2) | (mask_m[15] << 0);
+        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
+
+        tmp_mask = (mask_p[15] << 28)
+                | (mask_p[14] << 26) | (mask_p[13] << 24)
+                | (mask_p[12] << 22) | (mask_p[11] << 20)
+                | (mask_p[10] << 18) | (mask_p[9] << 16)
+                | (mask_p[8] << 14) | (mask_p[7] << 12)
+                | (mask_p[6] << 10) | (mask_p[5] << 8)
+                | (mask_p[4] << 6) | (mask_p[3] << 4)
+                | (mask_p[2] << 2) | (mask_p[1] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
+
+        tmp_mask = (mask_p[30] << 28)
+                | (mask_p[29] << 26) | (mask_p[28] << 24)
+                | (mask_p[27] << 22) | (mask_p[26] << 20)
+                | (mask_p[25] << 18) | (mask_p[24] << 16)
+                | (mask_p[23] << 14) | (mask_p[22] << 12)
+                | (mask_p[21] << 10) | (mask_p[20] << 8)
+                | (mask_p[19] << 6) | (mask_p[18] << 4)
+                | (mask_p[17] << 2) | (mask_p[16] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
+
+        tmp_mask = (mask_p[45] << 28)
+                | (mask_p[44] << 26) | (mask_p[43] << 24)
+                | (mask_p[42] << 22) | (mask_p[41] << 20)
+                | (mask_p[40] << 18) | (mask_p[39] << 16)
+                | (mask_p[38] << 14) | (mask_p[37] << 12)
+                | (mask_p[36] << 10) | (mask_p[35] << 8)
+                | (mask_p[34] << 6) | (mask_p[33] << 4)
+                | (mask_p[32] << 2) | (mask_p[31] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
+
+        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
+                | (mask_p[59] << 26) | (mask_p[58] << 24)
+                | (mask_p[57] << 22) | (mask_p[56] << 20)
+                | (mask_p[55] << 18) | (mask_p[54] << 16)
+                | (mask_p[53] << 14) | (mask_p[52] << 12)
+                | (mask_p[51] << 10) | (mask_p[50] << 8)
+                | (mask_p[49] << 6) | (mask_p[48] << 4)
+                | (mask_p[47] << 2) | (mask_p[46] << 0);
+        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
+        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+}
+
+static void ar9002_olc_init(struct ath_hw *ah)
+{
+        u32 i;
+
+        if (!OLC_FOR_AR9280_20_LATER)
+                return;
+
+        if (OLC_FOR_AR9287_10_LATER) {
+                REG_SET_BIT(ah, AR_PHY_TX_PWRCTRL9,
+                                AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL);
+                ath9k_hw_analog_shift_rmw(ah, AR9287_AN_TXPC0,
+                                AR9287_AN_TXPC0_TXPCMODE,
+                                AR9287_AN_TXPC0_TXPCMODE_S,
+                                AR9287_AN_TXPC0_TXPCMODE_TEMPSENSE);
+                udelay(100);
+        } else {
+                for (i = 0; i < AR9280_TX_GAIN_TABLE_SIZE; i++)
+                        ah->originalGain[i] =
+                                MS(REG_READ(ah, AR_PHY_TX_GAIN_TBL1 + i * 4),
+                                                AR_PHY_TX_GAIN);
+                ah->PDADCdelta = 0;
+        }
+}
+
+static u32 ar9002_hw_compute_pll_control(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        u32 pll;
+
+        pll = SM(0x5, AR_RTC_9160_PLL_REFDIV);
+
+        if (chan && IS_CHAN_HALF_RATE(chan))
+                pll |= SM(0x1, AR_RTC_9160_PLL_CLKSEL);
+        else if (chan && IS_CHAN_QUARTER_RATE(chan))
+                pll |= SM(0x2, AR_RTC_9160_PLL_CLKSEL);
+
+        if (chan && IS_CHAN_5GHZ(chan)) {
+                if (IS_CHAN_A_FAST_CLOCK(ah, chan))
+                        pll = 0x142c;
+                else if (AR_SREV_9280_20(ah))
+                        pll = 0x2850;
+                else
+                        pll |= SM(0x28, AR_RTC_9160_PLL_DIV);
+        } else {
+                pll |= SM(0x2c, AR_RTC_9160_PLL_DIV);
+        }
+
+        return pll;
+}
+
+static void ar9002_hw_do_getnf(struct ath_hw *ah,
+                              int16_t nfarray[NUM_NF_READINGS])
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int16_t nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CCA), AR9280_PHY_MINCCA_PWR);
+
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 0] is %d\n", nf);
+
+        if (AR_SREV_9271(ah) && (nf >= -114))
+                nf = -116;
+
+        nfarray[0] = nf;
+
+        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
+                nf = MS(REG_READ(ah, AR_PHY_CH1_CCA),
+                                AR9280_PHY_CH1_MINCCA_PWR);
+
+                if (nf & 0x100)
+                        nf = 0 - ((nf ^ 0x1ff) + 1);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "NF calibrated [ctl] [chain 1] is %d\n", nf);
+                nfarray[1] = nf;
+        }
+
+        nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR9280_PHY_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 0] is %d\n", nf);
+
+        if (AR_SREV_9271(ah) && (nf >= -114))
+                nf = -116;
+
+        nfarray[3] = nf;
+
+        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
+                nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA),
+                                AR9280_PHY_CH1_EXT_MINCCA_PWR);
+
+                if (nf & 0x100)
+                        nf = 0 - ((nf ^ 0x1ff) + 1);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "NF calibrated [ext] [chain 1] is %d\n", nf);
+                nfarray[4] = nf;
+        }
+}
+
+void ar9002_hw_attach_phy_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+
+        priv_ops->set_rf_regs = NULL;
+        priv_ops->rf_alloc_ext_banks = NULL;
+        priv_ops->rf_free_ext_banks = NULL;
+        priv_ops->rf_set_freq = ar9002_hw_set_channel;
+        priv_ops->spur_mitigate_freq = ar9002_hw_spur_mitigate;
+        priv_ops->olc_init = ar9002_olc_init;
+        priv_ops->compute_pll_control = ar9002_hw_compute_pll_control;
+        priv_ops->do_getnf = ar9002_hw_do_getnf;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.h b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
new file mode 100644
index 000000000000..81bf6e5840e1
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.h
@@ -0,0 +1,572 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef AR9002_PHY_H
+#define AR9002_PHY_H
+
+#define AR_PHY_TEST             0x9800
+#define PHY_AGC_CLR             0x10000000
+#define RFSILENT_BB             0x00002000
+
+#define AR_PHY_TURBO                0x9804
+#define AR_PHY_FC_TURBO_MODE        0x00000001
+#define AR_PHY_FC_TURBO_SHORT       0x00000002
+#define AR_PHY_FC_DYN2040_EN        0x00000004
+#define AR_PHY_FC_DYN2040_PRI_ONLY  0x00000008
+#define AR_PHY_FC_DYN2040_PRI_CH    0x00000010
+/* For 25 MHz channel spacing -- not used but supported by hw */
+#define AR_PHY_FC_DYN2040_EXT_CH    0x00000020
+#define AR_PHY_FC_HT_EN             0x00000040
+#define AR_PHY_FC_SHORT_GI_40       0x00000080
+#define AR_PHY_FC_WALSH             0x00000100
+#define AR_PHY_FC_SINGLE_HT_LTF1    0x00000200
+#define AR_PHY_FC_ENABLE_DAC_FIFO   0x00000800
+
+#define AR_PHY_TEST2                    0x9808
+
+#define AR_PHY_TIMING2           0x9810
+#define AR_PHY_TIMING3           0x9814
+#define AR_PHY_TIMING3_DSC_MAN   0xFFFE0000
+#define AR_PHY_TIMING3_DSC_MAN_S 17
+#define AR_PHY_TIMING3_DSC_EXP   0x0001E000
+#define AR_PHY_TIMING3_DSC_EXP_S 13
+
+#define AR_PHY_CHIP_ID_REV_0      0x80
+#define AR_PHY_CHIP_ID_REV_1      0x81
+#define AR_PHY_CHIP_ID_9160_REV_0 0xb0
+
+#define AR_PHY_ACTIVE       0x981C
+#define AR_PHY_ACTIVE_EN    0x00000001
+#define AR_PHY_ACTIVE_DIS   0x00000000
+
+#define AR_PHY_RF_CTL2             0x9824
+#define AR_PHY_TX_END_DATA_START   0x000000FF
+#define AR_PHY_TX_END_DATA_START_S 0
+#define AR_PHY_TX_END_PA_ON        0x0000FF00
+#define AR_PHY_TX_END_PA_ON_S      8
+
+#define AR_PHY_RF_CTL3                  0x9828
+#define AR_PHY_TX_END_TO_A2_RX_ON       0x00FF0000
+#define AR_PHY_TX_END_TO_A2_RX_ON_S     16
+
+#define AR_PHY_ADC_CTL                  0x982C
+#define AR_PHY_ADC_CTL_OFF_INBUFGAIN    0x00000003
+#define AR_PHY_ADC_CTL_OFF_INBUFGAIN_S  0
+#define AR_PHY_ADC_CTL_OFF_PWDDAC       0x00002000
+#define AR_PHY_ADC_CTL_OFF_PWDBANDGAP   0x00004000
+#define AR_PHY_ADC_CTL_OFF_PWDADC       0x00008000
+#define AR_PHY_ADC_CTL_ON_INBUFGAIN     0x00030000
+#define AR_PHY_ADC_CTL_ON_INBUFGAIN_S   16
+
+#define AR_PHY_ADC_SERIAL_CTL       0x9830
+#define AR_PHY_SEL_INTERNAL_ADDAC   0x00000000
+#define AR_PHY_SEL_EXTERNAL_RADIO   0x00000001
+
+#define AR_PHY_RF_CTL4                    0x9834
+#define AR_PHY_RF_CTL4_TX_END_XPAB_OFF    0xFF000000
+#define AR_PHY_RF_CTL4_TX_END_XPAB_OFF_S  24
+#define AR_PHY_RF_CTL4_TX_END_XPAA_OFF    0x00FF0000
+#define AR_PHY_RF_CTL4_TX_END_XPAA_OFF_S  16
+#define AR_PHY_RF_CTL4_FRAME_XPAB_ON      0x0000FF00
+#define AR_PHY_RF_CTL4_FRAME_XPAB_ON_S    8
+#define AR_PHY_RF_CTL4_FRAME_XPAA_ON      0x000000FF
+#define AR_PHY_RF_CTL4_FRAME_XPAA_ON_S    0
+
+#define AR_PHY_TSTDAC_CONST               0x983c
+
+#define AR_PHY_SETTLING          0x9844
+#define AR_PHY_SETTLING_SWITCH   0x00003F80
+#define AR_PHY_SETTLING_SWITCH_S 7
+
+#define AR_PHY_RXGAIN                   0x9848
+#define AR_PHY_RXGAIN_TXRX_ATTEN        0x0003F000
+#define AR_PHY_RXGAIN_TXRX_ATTEN_S      12
+#define AR_PHY_RXGAIN_TXRX_RF_MAX       0x007C0000
+#define AR_PHY_RXGAIN_TXRX_RF_MAX_S     18
+#define AR9280_PHY_RXGAIN_TXRX_ATTEN    0x00003F80
+#define AR9280_PHY_RXGAIN_TXRX_ATTEN_S  7
+#define AR9280_PHY_RXGAIN_TXRX_MARGIN   0x001FC000
+#define AR9280_PHY_RXGAIN_TXRX_MARGIN_S 14
+
+#define AR_PHY_DESIRED_SZ           0x9850
+#define AR_PHY_DESIRED_SZ_ADC       0x000000FF
+#define AR_PHY_DESIRED_SZ_ADC_S     0
+#define AR_PHY_DESIRED_SZ_PGA       0x0000FF00
+#define AR_PHY_DESIRED_SZ_PGA_S     8
+#define AR_PHY_DESIRED_SZ_TOT_DES   0x0FF00000
+#define AR_PHY_DESIRED_SZ_TOT_DES_S 20
+
+#define AR_PHY_FIND_SIG           0x9858
+#define AR_PHY_FIND_SIG_FIRSTEP   0x0003F000
+#define AR_PHY_FIND_SIG_FIRSTEP_S 12
+#define AR_PHY_FIND_SIG_FIRPWR    0x03FC0000
+#define AR_PHY_FIND_SIG_FIRPWR_S  18
+
+#define AR_PHY_AGC_CTL1                  0x985C
+#define AR_PHY_AGC_CTL1_COARSE_LOW       0x00007F80
+#define AR_PHY_AGC_CTL1_COARSE_LOW_S     7
+#define AR_PHY_AGC_CTL1_COARSE_HIGH      0x003F8000
+#define AR_PHY_AGC_CTL1_COARSE_HIGH_S    15
+
+#define AR_PHY_CCA                  0x9864
+#define AR_PHY_MINCCA_PWR           0x0FF80000
+#define AR_PHY_MINCCA_PWR_S         19
+#define AR_PHY_CCA_THRESH62         0x0007F000
+#define AR_PHY_CCA_THRESH62_S       12
+#define AR9280_PHY_MINCCA_PWR       0x1FF00000
+#define AR9280_PHY_MINCCA_PWR_S     20
+#define AR9280_PHY_CCA_THRESH62     0x000FF000
+#define AR9280_PHY_CCA_THRESH62_S   12
+
+#define AR_PHY_SFCORR_LOW                    0x986C
+#define AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW  0x00000001
+#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW    0x00003F00
+#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW_S  8
+#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW      0x001FC000
+#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW_S    14
+#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW      0x0FE00000
+#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW_S    21
+
+#define AR_PHY_SFCORR                0x9868
+#define AR_PHY_SFCORR_M2COUNT_THR    0x0000001F
+#define AR_PHY_SFCORR_M2COUNT_THR_S  0
+#define AR_PHY_SFCORR_M1_THRESH      0x00FE0000
+#define AR_PHY_SFCORR_M1_THRESH_S    17
+#define AR_PHY_SFCORR_M2_THRESH      0x7F000000
+#define AR_PHY_SFCORR_M2_THRESH_S    24
+
+#define AR_PHY_SLEEP_CTR_CONTROL    0x9870
+#define AR_PHY_SLEEP_CTR_LIMIT      0x9874
+#define AR_PHY_SYNTH_CONTROL        0x9874
+#define AR_PHY_SLEEP_SCAL           0x9878
+
+#define AR_PHY_PLL_CTL          0x987c
+#define AR_PHY_PLL_CTL_40       0xaa
+#define AR_PHY_PLL_CTL_40_5413  0x04
+#define AR_PHY_PLL_CTL_44       0xab
+#define AR_PHY_PLL_CTL_44_2133  0xeb
+#define AR_PHY_PLL_CTL_40_2133  0xea
+
+#define AR_PHY_SPECTRAL_SCAN                    0x9910  /* AR9280 spectral scan configuration register */
+#define AR_PHY_SPECTRAL_SCAN_ENABLE             0x1
+#define AR_PHY_SPECTRAL_SCAN_ENA                0x00000001  /* Enable spectral scan, reg 68, bit 0 */
+#define AR_PHY_SPECTRAL_SCAN_ENA_S              0  /* Enable spectral scan, reg 68, bit 0 */
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE             0x00000002  /* Activate spectral scan reg 68, bit 1*/
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S           1  /* Activate spectral scan reg 68, bit 1*/
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD         0x000000F0  /* Interval for FFT reports, reg 68, bits 4-7*/
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S       4
+#define AR_PHY_SPECTRAL_SCAN_PERIOD             0x0000FF00  /* Interval for FFT reports, reg 68, bits 8-15*/
+#define AR_PHY_SPECTRAL_SCAN_PERIOD_S           8
+#define AR_PHY_SPECTRAL_SCAN_COUNT              0x00FF0000  /* Number of reports, reg 68, bits 16-23*/
+#define AR_PHY_SPECTRAL_SCAN_COUNT_S            16
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT       0x01000000  /* Short repeat, reg 68, bit 24*/
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S     24  /* Short repeat, reg 68, bit 24*/
+
+#define AR_PHY_RX_DELAY           0x9914
+#define AR_PHY_SEARCH_START_DELAY 0x9918
+#define AR_PHY_RX_DELAY_DELAY     0x00003FFF
+
+#define AR_PHY_TIMING_CTRL4(_i)     (0x9920 + ((_i) << 12))
+#define AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF 0x01F
+#define AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF_S   0
+#define AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF 0x7E0
+#define AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF_S   5
+#define AR_PHY_TIMING_CTRL4_IQCORR_ENABLE   0x800
+#define AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX 0xF000
+#define AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX_S   12
+#define AR_PHY_TIMING_CTRL4_DO_CAL    0x10000
+
+#define AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI    0x80000000
+#define AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER  0x40000000
+#define AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK    0x20000000
+#define AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK   0x10000000
+
+#define AR_PHY_TIMING5               0x9924
+#define AR_PHY_TIMING5_CYCPWR_THR1   0x000000FE
+#define AR_PHY_TIMING5_CYCPWR_THR1_S 1
+
+#define AR_PHY_POWER_TX_RATE1               0x9934
+#define AR_PHY_POWER_TX_RATE2               0x9938
+#define AR_PHY_POWER_TX_RATE_MAX            0x993c
+#define AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE 0x00000040
+
+#define AR_PHY_FRAME_CTL            0x9944
+#define AR_PHY_FRAME_CTL_TX_CLIP    0x00000038
+#define AR_PHY_FRAME_CTL_TX_CLIP_S  3
+
+#define AR_PHY_TXPWRADJ                   0x994C
+#define AR_PHY_TXPWRADJ_CCK_GAIN_DELTA    0x00000FC0
+#define AR_PHY_TXPWRADJ_CCK_GAIN_DELTA_S  6
+#define AR_PHY_TXPWRADJ_CCK_PCDAC_INDEX   0x00FC0000
+#define AR_PHY_TXPWRADJ_CCK_PCDAC_INDEX_S 18
+
+#define AR_PHY_RADAR_EXT      0x9940
+#define AR_PHY_RADAR_EXT_ENA  0x00004000
+
+#define AR_PHY_RADAR_0          0x9954
+#define AR_PHY_RADAR_0_ENA      0x00000001
+#define AR_PHY_RADAR_0_FFT_ENA  0x80000000
+#define AR_PHY_RADAR_0_INBAND   0x0000003e
+#define AR_PHY_RADAR_0_INBAND_S 1
+#define AR_PHY_RADAR_0_PRSSI    0x00000FC0
+#define AR_PHY_RADAR_0_PRSSI_S  6
+#define AR_PHY_RADAR_0_HEIGHT   0x0003F000
+#define AR_PHY_RADAR_0_HEIGHT_S 12
+#define AR_PHY_RADAR_0_RRSSI    0x00FC0000
+#define AR_PHY_RADAR_0_RRSSI_S  18
+#define AR_PHY_RADAR_0_FIRPWR   0x7F000000
+#define AR_PHY_RADAR_0_FIRPWR_S 24
+
+#define AR_PHY_RADAR_1                  0x9958
+#define AR_PHY_RADAR_1_RELPWR_ENA       0x00800000
+#define AR_PHY_RADAR_1_USE_FIR128       0x00400000
+#define AR_PHY_RADAR_1_RELPWR_THRESH    0x003F0000
+#define AR_PHY_RADAR_1_RELPWR_THRESH_S  16
+#define AR_PHY_RADAR_1_BLOCK_CHECK      0x00008000
+#define AR_PHY_RADAR_1_MAX_RRSSI        0x00004000
+#define AR_PHY_RADAR_1_RELSTEP_CHECK    0x00002000
+#define AR_PHY_RADAR_1_RELSTEP_THRESH   0x00001F00
+#define AR_PHY_RADAR_1_RELSTEP_THRESH_S 8
+#define AR_PHY_RADAR_1_MAXLEN           0x000000FF
+#define AR_PHY_RADAR_1_MAXLEN_S         0
+
+#define AR_PHY_SWITCH_CHAIN_0     0x9960
+#define AR_PHY_SWITCH_COM         0x9964
+
+#define AR_PHY_SIGMA_DELTA            0x996C
+#define AR_PHY_SIGMA_DELTA_ADC_SEL    0x00000003
+#define AR_PHY_SIGMA_DELTA_ADC_SEL_S  0
+#define AR_PHY_SIGMA_DELTA_FILT2      0x000000F8
+#define AR_PHY_SIGMA_DELTA_FILT2_S    3
+#define AR_PHY_SIGMA_DELTA_FILT1      0x00001F00
+#define AR_PHY_SIGMA_DELTA_FILT1_S    8
+#define AR_PHY_SIGMA_DELTA_ADC_CLIP   0x01FFE000
+#define AR_PHY_SIGMA_DELTA_ADC_CLIP_S 13
+
+#define AR_PHY_RESTART          0x9970
+#define AR_PHY_RESTART_DIV_GC   0x001C0000
+#define AR_PHY_RESTART_DIV_GC_S 18
+
+#define AR_PHY_RFBUS_REQ        0x997C
+#define AR_PHY_RFBUS_REQ_EN     0x00000001
+
+#define AR_PHY_TIMING7                  0x9980
+#define AR_PHY_TIMING8                  0x9984
+#define AR_PHY_TIMING8_PILOT_MASK_2     0x000FFFFF
+#define AR_PHY_TIMING8_PILOT_MASK_2_S   0
+
+#define AR_PHY_BIN_MASK2_1      0x9988
+#define AR_PHY_BIN_MASK2_2      0x998c
+#define AR_PHY_BIN_MASK2_3      0x9990
+#define AR_PHY_BIN_MASK2_4      0x9994
+
+#define AR_PHY_BIN_MASK_1       0x9900
+#define AR_PHY_BIN_MASK_2       0x9904
+#define AR_PHY_BIN_MASK_3       0x9908
+
+#define AR_PHY_MASK_CTL         0x990c
+
+#define AR_PHY_BIN_MASK2_4_MASK_4       0x00003FFF
+#define AR_PHY_BIN_MASK2_4_MASK_4_S     0
+
+#define AR_PHY_TIMING9                  0x9998
+#define AR_PHY_TIMING10                 0x999c
+#define AR_PHY_TIMING10_PILOT_MASK_2    0x000FFFFF
+#define AR_PHY_TIMING10_PILOT_MASK_2_S  0
+
+#define AR_PHY_TIMING11                         0x99a0
+#define AR_PHY_TIMING11_SPUR_DELTA_PHASE        0x000FFFFF
+#define AR_PHY_TIMING11_SPUR_DELTA_PHASE_S      0
+#define AR_PHY_TIMING11_USE_SPUR_IN_AGC         0x40000000
+#define AR_PHY_TIMING11_USE_SPUR_IN_SELFCOR     0x80000000
+
+#define AR_PHY_RX_CHAINMASK     0x99a4
+#define AR_PHY_NEW_ADC_DC_GAIN_CORR(_i) (0x99b4 + ((_i) << 12))
+#define AR_PHY_NEW_ADC_GAIN_CORR_ENABLE 0x40000000
+#define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
+
+#define AR_PHY_MULTICHAIN_GAIN_CTL          0x99ac
+#define AR_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
+#define AR_PHY_9285_ANT_DIV_CTL             0x01000000
+#define AR_PHY_9285_ANT_DIV_CTL_S           24
+#define AR_PHY_9285_ANT_DIV_ALT_LNACONF     0x06000000
+#define AR_PHY_9285_ANT_DIV_ALT_LNACONF_S   25
+#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF    0x18000000
+#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S  27
+#define AR_PHY_9285_ANT_DIV_ALT_GAINTB      0x20000000
+#define AR_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
+#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
+#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
+#define AR_PHY_9285_ANT_DIV_LNA1            2
+#define AR_PHY_9285_ANT_DIV_LNA2            1
+#define AR_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
+#define AR_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
+#define AR_PHY_9285_ANT_DIV_GAINTB_0        0
+#define AR_PHY_9285_ANT_DIV_GAINTB_1        1
+
+#define AR_PHY_EXT_CCA0             0x99b8
+#define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
+#define AR_PHY_EXT_CCA0_THRESH62_S  0
+
+#define AR_PHY_EXT_CCA                  0x99bc
+#define AR_PHY_EXT_CCA_CYCPWR_THR1      0x0000FE00
+#define AR_PHY_EXT_CCA_CYCPWR_THR1_S    9
+#define AR_PHY_EXT_CCA_THRESH62         0x007F0000
+#define AR_PHY_EXT_CCA_THRESH62_S       16
+#define AR_PHY_EXT_MINCCA_PWR           0xFF800000
+#define AR_PHY_EXT_MINCCA_PWR_S         23
+#define AR9280_PHY_EXT_MINCCA_PWR       0x01FF0000
+#define AR9280_PHY_EXT_MINCCA_PWR_S     16
+
+#define AR_PHY_SFCORR_EXT                 0x99c0
+#define AR_PHY_SFCORR_EXT_M1_THRESH       0x0000007F
+#define AR_PHY_SFCORR_EXT_M1_THRESH_S     0
+#define AR_PHY_SFCORR_EXT_M2_THRESH       0x00003F80
+#define AR_PHY_SFCORR_EXT_M2_THRESH_S     7
+#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW   0x001FC000
+#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW_S 14
+#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW   0x0FE00000
+#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW_S 21
+#define AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S   28
+
+#define AR_PHY_HALFGI           0x99D0
+#define AR_PHY_HALFGI_DSC_MAN   0x0007FFF0
+#define AR_PHY_HALFGI_DSC_MAN_S 4
+#define AR_PHY_HALFGI_DSC_EXP   0x0000000F
+#define AR_PHY_HALFGI_DSC_EXP_S 0
+
+#define AR_PHY_CHAN_INFO_MEMORY               0x99DC
+#define AR_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK  0x0001
+
+#define AR_PHY_HEAVY_CLIP_ENABLE         0x99E0
+
+#define AR_PHY_HEAVY_CLIP_FACTOR_RIFS    0x99EC
+#define AR_PHY_RIFS_INIT_DELAY         0x03ff0000
+
+#define AR_PHY_M_SLEEP      0x99f0
+#define AR_PHY_REFCLKDLY    0x99f4
+#define AR_PHY_REFCLKPD     0x99f8
+
+#define AR_PHY_CALMODE      0x99f0
+
+#define AR_PHY_CALMODE_IQ           0x00000000
+#define AR_PHY_CALMODE_ADC_GAIN     0x00000001
+#define AR_PHY_CALMODE_ADC_DC_PER   0x00000002
+#define AR_PHY_CALMODE_ADC_DC_INIT  0x00000003
+
+#define AR_PHY_CAL_MEAS_0(_i)     (0x9c10 + ((_i) << 12))
+#define AR_PHY_CAL_MEAS_1(_i)     (0x9c14 + ((_i) << 12))
+#define AR_PHY_CAL_MEAS_2(_i)     (0x9c18 + ((_i) << 12))
+#define AR_PHY_CAL_MEAS_3(_i)     (0x9c1c + ((_i) << 12))
+
+#define AR_PHY_CURRENT_RSSI 0x9c1c
+#define AR9280_PHY_CURRENT_RSSI 0x9c3c
+
+#define AR_PHY_RFBUS_GRANT       0x9C20
+#define AR_PHY_RFBUS_GRANT_EN    0x00000001
+
+#define AR_PHY_CHAN_INFO_GAIN_DIFF             0x9CF4
+#define AR_PHY_CHAN_INFO_GAIN_DIFF_UPPER_LIMIT 320
+
+#define AR_PHY_CHAN_INFO_GAIN          0x9CFC
+
+#define AR_PHY_MODE         0xA200
+#define AR_PHY_MODE_ASYNCFIFO 0x80
+#define AR_PHY_MODE_AR2133  0x08
+#define AR_PHY_MODE_AR5111  0x00
+#define AR_PHY_MODE_AR5112  0x08
+#define AR_PHY_MODE_DYNAMIC 0x04
+#define AR_PHY_MODE_RF2GHZ  0x02
+#define AR_PHY_MODE_RF5GHZ  0x00
+#define AR_PHY_MODE_CCK     0x01
+#define AR_PHY_MODE_OFDM    0x00
+#define AR_PHY_MODE_DYN_CCK_DISABLE 0x100
+
+#define AR_PHY_CCK_TX_CTRL       0xA204
+#define AR_PHY_CCK_TX_CTRL_JAPAN 0x00000010
+#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK         0x0000000C
+#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK_S       2
+
+#define AR_PHY_CCK_DETECT                           0xA208
+#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003F
+#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
+/* [12:6] settling time for antenna switch */
+#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001FC0
+#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
+#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
+#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV_S  13
+
+#define AR_PHY_GAIN_2GHZ                0xA20C
+#define AR_PHY_GAIN_2GHZ_RXTX_MARGIN    0x00FC0000
+#define AR_PHY_GAIN_2GHZ_RXTX_MARGIN_S  18
+#define AR_PHY_GAIN_2GHZ_BSW_MARGIN     0x00003C00
+#define AR_PHY_GAIN_2GHZ_BSW_MARGIN_S   10
+#define AR_PHY_GAIN_2GHZ_BSW_ATTEN      0x0000001F
+#define AR_PHY_GAIN_2GHZ_BSW_ATTEN_S    0
+
+#define AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN     0x003E0000
+#define AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN_S   17
+#define AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN     0x0001F000
+#define AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN_S   12
+#define AR_PHY_GAIN_2GHZ_XATTEN2_DB         0x00000FC0
+#define AR_PHY_GAIN_2GHZ_XATTEN2_DB_S       6
+#define AR_PHY_GAIN_2GHZ_XATTEN1_DB         0x0000003F
+#define AR_PHY_GAIN_2GHZ_XATTEN1_DB_S       0
+
+#define AR_PHY_CCK_RXCTRL4  0xA21C
+#define AR_PHY_CCK_RXCTRL4_FREQ_EST_SHORT   0x01F80000
+#define AR_PHY_CCK_RXCTRL4_FREQ_EST_SHORT_S 19
+
+#define AR_PHY_DAG_CTRLCCK  0xA228
+#define AR_PHY_DAG_CTRLCCK_EN_RSSI_THR  0x00000200
+#define AR_PHY_DAG_CTRLCCK_RSSI_THR     0x0001FC00
+#define AR_PHY_DAG_CTRLCCK_RSSI_THR_S   10
+
+#define AR_PHY_FORCE_CLKEN_CCK              0xA22C
+#define AR_PHY_FORCE_CLKEN_CCK_MRC_MUX      0x00000040
+
+#define AR_PHY_POWER_TX_RATE3   0xA234
+#define AR_PHY_POWER_TX_RATE4   0xA238
+
+#define AR_PHY_SCRM_SEQ_XR       0xA23C
+#define AR_PHY_HEADER_DETECT_XR  0xA240
+#define AR_PHY_CHIRP_DETECTED_XR 0xA244
+#define AR_PHY_BLUETOOTH         0xA254
+
+#define AR_PHY_TPCRG1   0xA258
+#define AR_PHY_TPCRG1_NUM_PD_GAIN   0x0000c000
+#define AR_PHY_TPCRG1_NUM_PD_GAIN_S 14
+
+#define AR_PHY_TPCRG1_PD_GAIN_1    0x00030000
+#define AR_PHY_TPCRG1_PD_GAIN_1_S  16
+#define AR_PHY_TPCRG1_PD_GAIN_2    0x000C0000
+#define AR_PHY_TPCRG1_PD_GAIN_2_S  18
+#define AR_PHY_TPCRG1_PD_GAIN_3    0x00300000
+#define AR_PHY_TPCRG1_PD_GAIN_3_S  20
+
+#define AR_PHY_TPCRG1_PD_CAL_ENABLE   0x00400000
+#define AR_PHY_TPCRG1_PD_CAL_ENABLE_S 22
+
+#define AR_PHY_TX_PWRCTRL4       0xa264
+#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID     0x00000001
+#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID_S   0
+#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT       0x000001FE
+#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT_S     1
+
+#define AR_PHY_TX_PWRCTRL6_0     0xa270
+#define AR_PHY_TX_PWRCTRL6_1     0xb270
+#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE     0x03000000
+#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE_S   24
+
+#define AR_PHY_TX_PWRCTRL7       0xa274
+#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN     0x01F80000
+#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN_S   19
+
+#define AR_PHY_TX_PWRCTRL9       0xa27C
+#define AR_PHY_TX_DESIRED_SCALE_CCK        0x00007C00
+#define AR_PHY_TX_DESIRED_SCALE_CCK_S      10
+#define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL  0x80000000
+#define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL_S 31
+
+#define AR_PHY_TX_GAIN_TBL1      0xa300
+#define AR_PHY_TX_GAIN                     0x0007F000
+#define AR_PHY_TX_GAIN_S                   12
+
+#define AR_PHY_CH0_TX_PWRCTRL11  0xa398
+#define AR_PHY_CH1_TX_PWRCTRL11  0xb398
+#define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP   0x0000FC00
+#define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP_S 10
+
+#define AR_PHY_VIT_MASK2_M_46_61 0xa3a0
+#define AR_PHY_MASK2_M_31_45     0xa3a4
+#define AR_PHY_MASK2_M_16_30     0xa3a8
+#define AR_PHY_MASK2_M_00_15     0xa3ac
+#define AR_PHY_MASK2_P_15_01     0xa3b8
+#define AR_PHY_MASK2_P_30_16     0xa3bc
+#define AR_PHY_MASK2_P_45_31     0xa3c0
+#define AR_PHY_MASK2_P_61_45     0xa3c4
+#define AR_PHY_SPUR_REG          0x994c
+
+#define AR_PHY_SPUR_REG_MASK_RATE_CNTL       (0xFF << 18)
+#define AR_PHY_SPUR_REG_MASK_RATE_CNTL_S     18
+
+#define AR_PHY_SPUR_REG_ENABLE_MASK_PPM      0x20000
+#define AR_PHY_SPUR_REG_MASK_RATE_SELECT     (0xFF << 9)
+#define AR_PHY_SPUR_REG_MASK_RATE_SELECT_S   9
+#define AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI 0x100
+#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH     0x7F
+#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH_S   0
+
+#define AR_PHY_PILOT_MASK_01_30   0xa3b0
+#define AR_PHY_PILOT_MASK_31_60   0xa3b4
+
+#define AR_PHY_CHANNEL_MASK_01_30 0x99d4
+#define AR_PHY_CHANNEL_MASK_31_60 0x99d8
+
+#define AR_PHY_ANALOG_SWAP      0xa268
+#define AR_PHY_SWAP_ALT_CHAIN   0x00000040
+
+#define AR_PHY_TPCRG5   0xA26C
+#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP       0x0000000F
+#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP_S     0
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1    0x000003F0
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1_S  4
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2    0x0000FC00
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2_S  10
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3    0x003F0000
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3_S  16
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0FC00000
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
+
+/* Carrier leak calibration control, do it after AGC calibration */
+#define AR_PHY_CL_CAL_CTL       0xA358
+#define AR_PHY_CL_CAL_ENABLE    0x00000002
+#define AR_PHY_PARALLEL_CAL_ENABLE    0x00000001
+
+#define AR_PHY_POWER_TX_RATE5   0xA38C
+#define AR_PHY_POWER_TX_RATE6   0xA390
+
+#define AR_PHY_CAL_CHAINMASK    0xA39C
+
+#define AR_PHY_POWER_TX_SUB     0xA3C8
+#define AR_PHY_POWER_TX_RATE7   0xA3CC
+#define AR_PHY_POWER_TX_RATE8   0xA3D0
+#define AR_PHY_POWER_TX_RATE9   0xA3D4
+
+#define AR_PHY_XPA_CFG          0xA3D8
+#define AR_PHY_FORCE_XPA_CFG    0x000000001
+#define AR_PHY_FORCE_XPA_CFG_S  0
+
+#define AR_PHY_CH1_CCA          0xa864
+#define AR_PHY_CH1_MINCCA_PWR   0x0FF80000
+#define AR_PHY_CH1_MINCCA_PWR_S 19
+#define AR9280_PHY_CH1_MINCCA_PWR   0x1FF00000
+#define AR9280_PHY_CH1_MINCCA_PWR_S 20
+
+#define AR_PHY_CH2_CCA          0xb864
+#define AR_PHY_CH2_MINCCA_PWR   0x0FF80000
+#define AR_PHY_CH2_MINCCA_PWR_S 19
+
+#define AR_PHY_CH1_EXT_CCA          0xa9bc
+#define AR_PHY_CH1_EXT_MINCCA_PWR   0xFF800000
+#define AR_PHY_CH1_EXT_MINCCA_PWR_S 23
+#define AR9280_PHY_CH1_EXT_MINCCA_PWR   0x01FF0000
+#define AR9280_PHY_CH1_EXT_MINCCA_PWR_S 16
+
+#define AR_PHY_CH2_EXT_CCA          0xb9bc
+#define AR_PHY_CH2_EXT_MINCCA_PWR   0xFF800000
+#define AR_PHY_CH2_EXT_MINCCA_PWR_S 23
+
+#endif
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
new file mode 100644
index 000000000000..5fcafb460877
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -0,0 +1,803 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "hw-ops.h"
+#include "ar9003_phy.h"
+
+static void ar9003_hw_setup_calibration(struct ath_hw *ah,
+                                        struct ath9k_cal_list *currCal)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        /* Select calibration to run */
+        switch (currCal->calData->calType) {
+        case IQ_MISMATCH_CAL:
+                /*
+                 * Start calibration with
+                 * 2^(INIT_IQCAL_LOG_COUNT_MAX+1) samples
+                 */
+                REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                              AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX,
+                currCal->calData->calCountMax);
+                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting IQ Mismatch Calibration\n");
+
+                /* Kick-off cal */
+                REG_SET_BIT(ah, AR_PHY_TIMING4, AR_PHY_TIMING4_DO_CAL);
+                break;
+        case TEMP_COMP_CAL:
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_THERM,
+                              AR_PHY_65NM_CH0_THERM_LOCAL, 1);
+                REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_THERM,
+                              AR_PHY_65NM_CH0_THERM_START, 1);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "starting Temperature Compensation Calibration\n");
+                break;
+        case ADC_DC_INIT_CAL:
+        case ADC_GAIN_CAL:
+        case ADC_DC_CAL:
+                /* Not yet */
+                break;
+        }
+}
+
+/*
+ * Generic calibration routine.
+ * Recalibrate the lower PHY chips to account for temperature/environment
+ * changes.
+ */
+static bool ar9003_hw_per_calibration(struct ath_hw *ah,
+                                      struct ath9k_channel *ichan,
+                                      u8 rxchainmask,
+                                      struct ath9k_cal_list *currCal)
+{
+        /* Cal is assumed not done until explicitly set below */
+        bool iscaldone = false;
+
+        /* Calibration in progress. */
+        if (currCal->calState == CAL_RUNNING) {
+                /* Check to see if it has finished. */
+                if (!(REG_READ(ah, AR_PHY_TIMING4) & AR_PHY_TIMING4_DO_CAL)) {
+                        /*
+                        * Accumulate cal measures for active chains
+                        */
+                        currCal->calData->calCollect(ah);
+                        ah->cal_samples++;
+
+                        if (ah->cal_samples >=
+                            currCal->calData->calNumSamples) {
+                                unsigned int i, numChains = 0;
+                                for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                                        if (rxchainmask & (1 << i))
+                                                numChains++;
+                                }
+
+                                /*
+                                * Process accumulated data
+                                */
+                                currCal->calData->calPostProc(ah, numChains);
+
+                                /* Calibration has finished. */
+                                ichan->CalValid |= currCal->calData->calType;
+                                currCal->calState = CAL_DONE;
+                                iscaldone = true;
+                        } else {
+                        /*
+                         * Set-up collection of another sub-sample until we
+                         * get desired number
+                         */
+                        ar9003_hw_setup_calibration(ah, currCal);
+                        }
+                }
+        } else if (!(ichan->CalValid & currCal->calData->calType)) {
+                /* If current cal is marked invalid in channel, kick it off */
+                ath9k_hw_reset_calibration(ah, currCal);
+        }
+
+        return iscaldone;
+}
+
+static bool ar9003_hw_calibrate(struct ath_hw *ah,
+                                struct ath9k_channel *chan,
+                                u8 rxchainmask,
+                                bool longcal)
+{
+        bool iscaldone = true;
+        struct ath9k_cal_list *currCal = ah->cal_list_curr;
+
+        /*
+         * For given calibration:
+         * 1. Call generic cal routine
+         * 2. When this cal is done (isCalDone) if we have more cals waiting
+         *    (eg after reset), mask this to upper layers by not propagating
+         *    isCalDone if it is set to TRUE.
+         *    Instead, change isCalDone to FALSE and setup the waiting cal(s)
+         *    to be run.
+         */
+        if (currCal &&
+            (currCal->calState == CAL_RUNNING ||
+             currCal->calState == CAL_WAITING)) {
+                iscaldone = ar9003_hw_per_calibration(ah, chan,
+                                                      rxchainmask, currCal);
+                if (iscaldone) {
+                        ah->cal_list_curr = currCal = currCal->calNext;
+
+                        if (currCal->calState == CAL_WAITING) {
+                                iscaldone = false;
+                                ath9k_hw_reset_calibration(ah, currCal);
+                        }
+                }
+        }
+
+        /* Do NF cal only at longer intervals */
+        if (longcal) {
+                /*
+                 * Load the NF from history buffer of the current channel.
+                 * NF is slow time-variant, so it is OK to use a historical
+                 * value.
+                 */
+                ath9k_hw_loadnf(ah, ah->curchan);
+
+                /* start NF calibration, without updating BB NF register */
+                ath9k_hw_start_nfcal(ah);
+        }
+
+        return iscaldone;
+}
+
+static void ar9003_hw_iqcal_collect(struct ath_hw *ah)
+{
+        int i;
+
+        /* Accumulate IQ cal measures for active chains */
+        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
+                ah->totalPowerMeasI[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
+                ah->totalPowerMeasQ[i] +=
+                        REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
+                ah->totalIqCorrMeas[i] +=
+                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
+                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
+                          "%d: Chn %d pmi=0x%08x;pmq=0x%08x;iqcm=0x%08x;\n",
+                          ah->cal_samples, i, ah->totalPowerMeasI[i],
+                          ah->totalPowerMeasQ[i],
+                          ah->totalIqCorrMeas[i]);
+        }
+}
+
+static void ar9003_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 powerMeasQ, powerMeasI, iqCorrMeas;
+        u32 qCoffDenom, iCoffDenom;
+        int32_t qCoff, iCoff;
+        int iqCorrNeg, i;
+        const u_int32_t offset_array[3] = {
+                AR_PHY_RX_IQCAL_CORR_B0,
+                AR_PHY_RX_IQCAL_CORR_B1,
+                AR_PHY_RX_IQCAL_CORR_B2,
+        };
+
+        for (i = 0; i < numChains; i++) {
+                powerMeasI = ah->totalPowerMeasI[i];
+                powerMeasQ = ah->totalPowerMeasQ[i];
+                iqCorrMeas = ah->totalIqCorrMeas[i];
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Starting IQ Cal and Correction for Chain %d\n",
+                          i);
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Orignal: Chn %diq_corr_meas = 0x%08x\n",
+                          i, ah->totalIqCorrMeas[i]);
+
+                iqCorrNeg = 0;
+
+                if (iqCorrMeas > 0x80000000) {
+                        iqCorrMeas = (0xffffffff - iqCorrMeas) + 1;
+                        iqCorrNeg = 1;
+                }
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_i = 0x%08x\n", i, powerMeasI);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Chn %d pwr_meas_q = 0x%08x\n", i, powerMeasQ);
+                ath_print(common, ATH_DBG_CALIBRATE, "iqCorrNeg is 0x%08x\n",
+                          iqCorrNeg);
+
+                iCoffDenom = (powerMeasI / 2 + powerMeasQ / 2) / 256;
+                qCoffDenom = powerMeasQ / 64;
+
+                if ((iCoffDenom != 0) && (qCoffDenom != 0)) {
+                        iCoff = iqCorrMeas / iCoffDenom;
+                        qCoff = powerMeasI / qCoffDenom - 64;
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d iCoff = 0x%08x\n", i, iCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d qCoff = 0x%08x\n", i, qCoff);
+
+                        /* Force bounds on iCoff */
+                        if (iCoff >= 63)
+                                iCoff = 63;
+                        else if (iCoff <= -63)
+                                iCoff = -63;
+
+                        /* Negate iCoff if iqCorrNeg == 0 */
+                        if (iqCorrNeg == 0x0)
+                                iCoff = -iCoff;
+
+                        /* Force bounds on qCoff */
+                        if (qCoff >= 63)
+                                qCoff = 63;
+                        else if (qCoff <= -63)
+                                qCoff = -63;
+
+                        iCoff = iCoff & 0x7f;
+                        qCoff = qCoff & 0x7f;
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
+                                  i, iCoff, qCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Register offset (0x%04x) "
+                                  "before update = 0x%x\n",
+                                  offset_array[i],
+                                  REG_READ(ah, offset_array[i]));
+
+                        REG_RMW_FIELD(ah, offset_array[i],
+                                      AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF,
+                                      iCoff);
+                        REG_RMW_FIELD(ah, offset_array[i],
+                                      AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF,
+                                      qCoff);
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Register offset (0x%04x) QI COFF "
+                                  "(bitfields 0x%08x) after update = 0x%x\n",
+                                  offset_array[i],
+                                  AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF,
+                                  REG_READ(ah, offset_array[i]));
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Register offset (0x%04x) QQ COFF "
+                                  "(bitfields 0x%08x) after update = 0x%x\n",
+                                  offset_array[i],
+                                  AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF,
+                                  REG_READ(ah, offset_array[i]));
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "IQ Cal and Correction done for Chain %d\n",
+                                  i);
+                }
+        }
+
+        REG_SET_BIT(ah, AR_PHY_RX_IQCAL_CORR_B0,
+                    AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "IQ Cal and Correction (offset 0x%04x) enabled "
+                  "(bit position 0x%08x). New Value 0x%08x\n",
+                  (unsigned) (AR_PHY_RX_IQCAL_CORR_B0),
+                  AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE,
+                  REG_READ(ah, AR_PHY_RX_IQCAL_CORR_B0));
+}
+
+static const struct ath9k_percal_data iq_cal_single_sample = {
+        IQ_MISMATCH_CAL,
+        MIN_CAL_SAMPLES,
+        PER_MAX_LOG_COUNT,
+        ar9003_hw_iqcal_collect,
+        ar9003_hw_iqcalibrate
+};
+
+static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
+{
+        ah->iq_caldata.calData = &iq_cal_single_sample;
+        ah->supp_cals = IQ_MISMATCH_CAL;
+}
+
+static bool ar9003_hw_iscal_supported(struct ath_hw *ah,
+                                      enum ath9k_cal_types calType)
+{
+        switch (calType & ah->supp_cals) {
+        case IQ_MISMATCH_CAL:
+                /*
+                 * XXX: Run IQ Mismatch for non-CCK only
+                 * Note that CHANNEL_B is never set though.
+                 */
+                return true;
+        case ADC_GAIN_CAL:
+        case ADC_DC_CAL:
+                return false;
+        case TEMP_COMP_CAL:
+                return true;
+        }
+
+        return false;
+}
+
+/*
+ * solve 4x4 linear equation used in loopback iq cal.
+ */
+static bool ar9003_hw_solve_iq_cal(struct ath_hw *ah,
+                                   s32 sin_2phi_1,
+                                   s32 cos_2phi_1,
+                                   s32 sin_2phi_2,
+                                   s32 cos_2phi_2,
+                                   s32 mag_a0_d0,
+                                   s32 phs_a0_d0,
+                                   s32 mag_a1_d0,
+                                   s32 phs_a1_d0,
+                                   s32 solved_eq[])
+{
+        s32 f1 = cos_2phi_1 - cos_2phi_2,
+            f3 = sin_2phi_1 - sin_2phi_2,
+            f2;
+        s32 mag_tx, phs_tx, mag_rx, phs_rx;
+        const s32 result_shift = 1 << 15;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        f2 = (f1 * f1 + f3 * f3) / result_shift;
+
+        if (!f2) {
+                ath_print(common, ATH_DBG_CALIBRATE, "Divide by 0\n");
+                return false;
+        }
+
+        /* mag mismatch, tx */
+        mag_tx = f1 * (mag_a0_d0  - mag_a1_d0) + f3 * (phs_a0_d0 - phs_a1_d0);
+        /* phs mismatch, tx */
+        phs_tx = f3 * (-mag_a0_d0 + mag_a1_d0) + f1 * (phs_a0_d0 - phs_a1_d0);
+
+        mag_tx = (mag_tx / f2);
+        phs_tx = (phs_tx / f2);
+
+        /* mag mismatch, rx */
+        mag_rx = mag_a0_d0 - (cos_2phi_1 * mag_tx + sin_2phi_1 * phs_tx) /
+                 result_shift;
+        /* phs mismatch, rx */
+        phs_rx = phs_a0_d0 + (sin_2phi_1 * mag_tx - cos_2phi_1 * phs_tx) /
+                 result_shift;
+
+        solved_eq[0] = mag_tx;
+        solved_eq[1] = phs_tx;
+        solved_eq[2] = mag_rx;
+        solved_eq[3] = phs_rx;
+
+        return true;
+}
+
+static s32 ar9003_hw_find_mag_approx(struct ath_hw *ah, s32 in_re, s32 in_im)
+{
+        s32 abs_i = abs(in_re),
+            abs_q = abs(in_im),
+            max_abs, min_abs;
+
+        if (abs_i > abs_q) {
+                max_abs = abs_i;
+                min_abs = abs_q;
+        } else {
+                max_abs = abs_q;
+                min_abs = abs_i;
+        }
+
+        return max_abs - (max_abs / 32) + (min_abs / 8) + (min_abs / 4);
+}
+
+#define DELPT 32
+
+static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
+                                   s32 chain_idx,
+                                   const s32 iq_res[],
+                                   s32 iqc_coeff[])
+{
+        s32 i2_m_q2_a0_d0, i2_p_q2_a0_d0, iq_corr_a0_d0,
+            i2_m_q2_a0_d1, i2_p_q2_a0_d1, iq_corr_a0_d1,
+            i2_m_q2_a1_d0, i2_p_q2_a1_d0, iq_corr_a1_d0,
+            i2_m_q2_a1_d1, i2_p_q2_a1_d1, iq_corr_a1_d1;
+        s32 mag_a0_d0, mag_a1_d0, mag_a0_d1, mag_a1_d1,
+            phs_a0_d0, phs_a1_d0, phs_a0_d1, phs_a1_d1,
+            sin_2phi_1, cos_2phi_1,
+            sin_2phi_2, cos_2phi_2;
+        s32 mag_tx, phs_tx, mag_rx, phs_rx;
+        s32 solved_eq[4], mag_corr_tx, phs_corr_tx, mag_corr_rx, phs_corr_rx,
+            q_q_coff, q_i_coff;
+        const s32 res_scale = 1 << 15;
+        const s32 delpt_shift = 1 << 8;
+        s32 mag1, mag2;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        i2_m_q2_a0_d0 = iq_res[0] & 0xfff;
+        i2_p_q2_a0_d0 = (iq_res[0] >> 12) & 0xfff;
+        iq_corr_a0_d0 = ((iq_res[0] >> 24) & 0xff) + ((iq_res[1] & 0xf) << 8);
+
+        if (i2_m_q2_a0_d0 > 0x800)
+                i2_m_q2_a0_d0 = -((0xfff - i2_m_q2_a0_d0) + 1);
+
+        if (i2_p_q2_a0_d0 > 0x800)
+                i2_p_q2_a0_d0 = -((0xfff - i2_p_q2_a0_d0) + 1);
+
+        if (iq_corr_a0_d0 > 0x800)
+                iq_corr_a0_d0 = -((0xfff - iq_corr_a0_d0) + 1);
+
+        i2_m_q2_a0_d1 = (iq_res[1] >> 4) & 0xfff;
+        i2_p_q2_a0_d1 = (iq_res[2] & 0xfff);
+        iq_corr_a0_d1 = (iq_res[2] >> 12) & 0xfff;
+
+        if (i2_m_q2_a0_d1 > 0x800)
+                i2_m_q2_a0_d1 = -((0xfff - i2_m_q2_a0_d1) + 1);
+
+        if (i2_p_q2_a0_d1 > 0x800)
+                i2_p_q2_a0_d1 = -((0xfff - i2_p_q2_a0_d1) + 1);
+
+        if (iq_corr_a0_d1 > 0x800)
+                iq_corr_a0_d1 = -((0xfff - iq_corr_a0_d1) + 1);
+
+        i2_m_q2_a1_d0 = ((iq_res[2] >> 24) & 0xff) + ((iq_res[3] & 0xf) << 8);
+        i2_p_q2_a1_d0 = (iq_res[3] >> 4) & 0xfff;
+        iq_corr_a1_d0 = iq_res[4] & 0xfff;
+
+        if (i2_m_q2_a1_d0 > 0x800)
+                i2_m_q2_a1_d0 = -((0xfff - i2_m_q2_a1_d0) + 1);
+
+        if (i2_p_q2_a1_d0 > 0x800)
+                i2_p_q2_a1_d0 = -((0xfff - i2_p_q2_a1_d0) + 1);
+
+        if (iq_corr_a1_d0 > 0x800)
+                iq_corr_a1_d0 = -((0xfff - iq_corr_a1_d0) + 1);
+
+        i2_m_q2_a1_d1 = (iq_res[4] >> 12) & 0xfff;
+        i2_p_q2_a1_d1 = ((iq_res[4] >> 24) & 0xff) + ((iq_res[5] & 0xf) << 8);
+        iq_corr_a1_d1 = (iq_res[5] >> 4) & 0xfff;
+
+        if (i2_m_q2_a1_d1 > 0x800)
+                i2_m_q2_a1_d1 = -((0xfff - i2_m_q2_a1_d1) + 1);
+
+        if (i2_p_q2_a1_d1 > 0x800)
+                i2_p_q2_a1_d1 = -((0xfff - i2_p_q2_a1_d1) + 1);
+
+        if (iq_corr_a1_d1 > 0x800)
+                iq_corr_a1_d1 = -((0xfff - iq_corr_a1_d1) + 1);
+
+        if ((i2_p_q2_a0_d0 == 0) || (i2_p_q2_a0_d1 == 0) ||
+            (i2_p_q2_a1_d0 == 0) || (i2_p_q2_a1_d1 == 0)) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Divide by 0:\na0_d0=%d\n"
+                          "a0_d1=%d\na2_d0=%d\na1_d1=%d\n",
+                          i2_p_q2_a0_d0, i2_p_q2_a0_d1,
+                          i2_p_q2_a1_d0, i2_p_q2_a1_d1);
+                return false;
+        }
+
+        mag_a0_d0 = (i2_m_q2_a0_d0 * res_scale) / i2_p_q2_a0_d0;
+        phs_a0_d0 = (iq_corr_a0_d0 * res_scale) / i2_p_q2_a0_d0;
+
+        mag_a0_d1 = (i2_m_q2_a0_d1 * res_scale) / i2_p_q2_a0_d1;
+        phs_a0_d1 = (iq_corr_a0_d1 * res_scale) / i2_p_q2_a0_d1;
+
+        mag_a1_d0 = (i2_m_q2_a1_d0 * res_scale) / i2_p_q2_a1_d0;
+        phs_a1_d0 = (iq_corr_a1_d0 * res_scale) / i2_p_q2_a1_d0;
+
+        mag_a1_d1 = (i2_m_q2_a1_d1 * res_scale) / i2_p_q2_a1_d1;
+        phs_a1_d1 = (iq_corr_a1_d1 * res_scale) / i2_p_q2_a1_d1;
+
+        /* w/o analog phase shift */
+        sin_2phi_1 = (((mag_a0_d0 - mag_a0_d1) * delpt_shift) / DELPT);
+        /* w/o analog phase shift */
+        cos_2phi_1 = (((phs_a0_d1 - phs_a0_d0) * delpt_shift) / DELPT);
+        /* w/  analog phase shift */
+        sin_2phi_2 = (((mag_a1_d0 - mag_a1_d1) * delpt_shift) / DELPT);
+        /* w/  analog phase shift */
+        cos_2phi_2 = (((phs_a1_d1 - phs_a1_d0) * delpt_shift) / DELPT);
+
+        /*
+         * force sin^2 + cos^2 = 1;
+         * find magnitude by approximation
+         */
+        mag1 = ar9003_hw_find_mag_approx(ah, cos_2phi_1, sin_2phi_1);
+        mag2 = ar9003_hw_find_mag_approx(ah, cos_2phi_2, sin_2phi_2);
+
+        if ((mag1 == 0) || (mag2 == 0)) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Divide by 0: mag1=%d, mag2=%d\n",
+                          mag1, mag2);
+                return false;
+        }
+
+        /* normalization sin and cos by mag */
+        sin_2phi_1 = (sin_2phi_1 * res_scale / mag1);
+        cos_2phi_1 = (cos_2phi_1 * res_scale / mag1);
+        sin_2phi_2 = (sin_2phi_2 * res_scale / mag2);
+        cos_2phi_2 = (cos_2phi_2 * res_scale / mag2);
+
+        /* calculate IQ mismatch */
+        if (!ar9003_hw_solve_iq_cal(ah,
+                             sin_2phi_1, cos_2phi_1,
+                             sin_2phi_2, cos_2phi_2,
+                             mag_a0_d0, phs_a0_d0,
+                             mag_a1_d0,
+                             phs_a1_d0, solved_eq)) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Call to ar9003_hw_solve_iq_cal() failed.\n");
+                return false;
+        }
+
+        mag_tx = solved_eq[0];
+        phs_tx = solved_eq[1];
+        mag_rx = solved_eq[2];
+        phs_rx = solved_eq[3];
+
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "chain %d: mag mismatch=%d phase mismatch=%d\n",
+                  chain_idx, mag_tx/res_scale, phs_tx/res_scale);
+
+        if (res_scale == mag_tx) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Divide by 0: mag_tx=%d, res_scale=%d\n",
+                          mag_tx, res_scale);
+                return false;
+        }
+
+        /* calculate and quantize Tx IQ correction factor */
+        mag_corr_tx = (mag_tx * res_scale) / (res_scale - mag_tx);
+        phs_corr_tx = -phs_tx;
+
+        q_q_coff = (mag_corr_tx * 128 / res_scale);
+        q_i_coff = (phs_corr_tx * 256 / res_scale);
+
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "tx chain %d: mag corr=%d  phase corr=%d\n",
+                  chain_idx, q_q_coff, q_i_coff);
+
+        if (q_i_coff < -63)
+                q_i_coff = -63;
+        if (q_i_coff > 63)
+                q_i_coff = 63;
+        if (q_q_coff < -63)
+                q_q_coff = -63;
+        if (q_q_coff > 63)
+                q_q_coff = 63;
+
+        iqc_coeff[0] = (q_q_coff * 128) + q_i_coff;
+
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "tx chain %d: iq corr coeff=%x\n",
+                  chain_idx, iqc_coeff[0]);
+
+        if (-mag_rx == res_scale) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Divide by 0: mag_rx=%d, res_scale=%d\n",
+                          mag_rx, res_scale);
+                return false;
+        }
+
+        /* calculate and quantize Rx IQ correction factors */
+        mag_corr_rx = (-mag_rx * res_scale) / (res_scale + mag_rx);
+        phs_corr_rx = -phs_rx;
+
+        q_q_coff = (mag_corr_rx * 128 / res_scale);
+        q_i_coff = (phs_corr_rx * 256 / res_scale);
+
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "rx chain %d: mag corr=%d  phase corr=%d\n",
+                  chain_idx, q_q_coff, q_i_coff);
+
+        if (q_i_coff < -63)
+                q_i_coff = -63;
+        if (q_i_coff > 63)
+                q_i_coff = 63;
+        if (q_q_coff < -63)
+                q_q_coff = -63;
+        if (q_q_coff > 63)
+                q_q_coff = 63;
+
+        iqc_coeff[1] = (q_q_coff * 128) + q_i_coff;
+
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "rx chain %d: iq corr coeff=%x\n",
+                  chain_idx, iqc_coeff[1]);
+
+        return true;
+}
+
+static void ar9003_hw_tx_iq_cal(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        const u32 txiqcal_status[AR9300_MAX_CHAINS] = {
+                AR_PHY_TX_IQCAL_STATUS_B0,
+                AR_PHY_TX_IQCAL_STATUS_B1,
+                AR_PHY_TX_IQCAL_STATUS_B2,
+        };
+        const u32 tx_corr_coeff[AR9300_MAX_CHAINS] = {
+                AR_PHY_TX_IQCAL_CORR_COEFF_01_B0,
+                AR_PHY_TX_IQCAL_CORR_COEFF_01_B1,
+                AR_PHY_TX_IQCAL_CORR_COEFF_01_B2,
+        };
+        const u32 rx_corr[AR9300_MAX_CHAINS] = {
+                AR_PHY_RX_IQCAL_CORR_B0,
+                AR_PHY_RX_IQCAL_CORR_B1,
+                AR_PHY_RX_IQCAL_CORR_B2,
+        };
+        const u_int32_t chan_info_tab[] = {
+                AR_PHY_CHAN_INFO_TAB_0,
+                AR_PHY_CHAN_INFO_TAB_1,
+                AR_PHY_CHAN_INFO_TAB_2,
+        };
+        s32 iq_res[6];
+        s32 iqc_coeff[2];
+        s32 i, j;
+        u32 num_chains = 0;
+
+        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                if (ah->txchainmask & (1 << i))
+                        num_chains++;
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
+                      AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
+                      DELPT);
+        REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_START,
+                      AR_PHY_TX_IQCAL_START_DO_CAL,
+                      AR_PHY_TX_IQCAL_START_DO_CAL);
+
+        if (!ath9k_hw_wait(ah, AR_PHY_TX_IQCAL_START,
+                           AR_PHY_TX_IQCAL_START_DO_CAL,
+                           0, AH_WAIT_TIMEOUT)) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Tx IQ Cal not complete.\n");
+                goto TX_IQ_CAL_FAILED;
+        }
+
+        for (i = 0; i < num_chains; i++) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "Doing Tx IQ Cal for chain %d.\n", i);
+
+                if (REG_READ(ah, txiqcal_status[i]) &
+                             AR_PHY_TX_IQCAL_STATUS_FAILED) {
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Tx IQ Cal failed for chain %d.\n", i);
+                        goto TX_IQ_CAL_FAILED;
+                }
+
+                for (j = 0; j < 3; j++) {
+                        u_int8_t idx = 2 * j,
+                        offset = 4 * j;
+
+                        REG_RMW_FIELD(ah, AR_PHY_CHAN_INFO_MEMORY,
+                                      AR_PHY_CHAN_INFO_TAB_S2_READ, 0);
+
+                        /* 32 bits */
+                        iq_res[idx] = REG_READ(ah, chan_info_tab[i] + offset);
+
+                        REG_RMW_FIELD(ah, AR_PHY_CHAN_INFO_MEMORY,
+                                      AR_PHY_CHAN_INFO_TAB_S2_READ, 1);
+
+                        /* 16 bits */
+                        iq_res[idx+1] = 0xffff & REG_READ(ah,
+                                                          chan_info_tab[i] +
+                                                          offset);
+
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "IQ RES[%d]=0x%x IQ_RES[%d]=0x%x\n",
+                                  idx, iq_res[idx], idx+1, iq_res[idx+1]);
+                }
+
+                if (!ar9003_hw_calc_iq_corr(ah, i, iq_res, iqc_coeff)) {
+                        ath_print(common, ATH_DBG_CALIBRATE,
+                                  "Failed in calculation of IQ correction.\n");
+                        goto TX_IQ_CAL_FAILED;
+                }
+
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "IQ_COEFF[0] = 0x%x IQ_COEFF[1] = 0x%x\n",
+                          iqc_coeff[0], iqc_coeff[1]);
+
+                REG_RMW_FIELD(ah, tx_corr_coeff[i],
+                              AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE,
+                              iqc_coeff[0]);
+                REG_RMW_FIELD(ah, rx_corr[i],
+                              AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF,
+                              iqc_coeff[1] >> 7);
+                REG_RMW_FIELD(ah, rx_corr[i],
+                              AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF,
+                              iqc_coeff[1]);
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_3,
+                      AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_RX_IQCAL_CORR_B0,
+                      AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN, 0x1);
+
+        return;
+
+TX_IQ_CAL_FAILED:
+        ath_print(common, ATH_DBG_CALIBRATE, "Tx IQ Cal failed\n");
+        return;
+}
+
+static bool ar9003_hw_init_cal(struct ath_hw *ah,
+                               struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        /*
+         * 0x7 = 0b111 , AR9003 needs to be configured for 3-chain mode before
+         * running AGC/TxIQ cals
+         */
+        ar9003_hw_set_chain_masks(ah, 0x7, 0x7);
+
+        /* Calibrate the AGC */
+        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                  REG_READ(ah, AR_PHY_AGC_CONTROL) |
+                  AR_PHY_AGC_CONTROL_CAL);
+
+        /* Poll for offset calibration complete */
+        if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
+                           0, AH_WAIT_TIMEOUT)) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "offset calibration failed to "
+                          "complete in 1ms; noisy environment?\n");
+                return false;
+        }
+
+        /* Do Tx IQ Calibration */
+        if (ah->config.tx_iq_calibration)
+                ar9003_hw_tx_iq_cal(ah);
+
+        /* Revert chainmasks to their original values before NF cal */
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
+        /* Initialize list pointers */
+        ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+
+        if (ar9003_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
+                INIT_CAL(&ah->iq_caldata);
+                INSERT_CAL(ah, &ah->iq_caldata);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "enabling IQ Calibration.\n");
+        }
+
+        if (ar9003_hw_iscal_supported(ah, TEMP_COMP_CAL)) {
+                INIT_CAL(&ah->tempCompCalData);
+                INSERT_CAL(ah, &ah->tempCompCalData);
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "enabling Temperature Compensation Calibration.\n");
+        }
+
+        /* Initialize current pointer to first element in list */
+        ah->cal_list_curr = ah->cal_list;
+
+        if (ah->cal_list_curr)
+                ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
+
+        chan->CalValid = 0;
+
+        return true;
+}
+
+void ar9003_hw_attach_calib_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->init_cal_settings = ar9003_hw_init_cal_settings;
+        priv_ops->init_cal = ar9003_hw_init_cal;
+        priv_ops->setup_calibration = ar9003_hw_setup_calibration;
+        priv_ops->iscal_supported = ar9003_hw_iscal_supported;
+
+        ops->calibrate = ar9003_hw_calibrate;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
new file mode 100644
index 000000000000..8a79550dff71
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -0,0 +1,1860 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ar9003_phy.h"
+#include "ar9003_eeprom.h"
+
+#define COMP_HDR_LEN 4
+#define COMP_CKSUM_LEN 2
+
+#define AR_CH0_TOP (0x00016288)
+#define AR_CH0_TOP_XPABIASLVL (0x3)
+#define AR_CH0_TOP_XPABIASLVL_S (8)
+
+#define AR_CH0_THERM (0x00016290)
+#define AR_CH0_THERM_SPARE (0x3f)
+#define AR_CH0_THERM_SPARE_S (0)
+
+#define AR_SWITCH_TABLE_COM_ALL (0xffff)
+#define AR_SWITCH_TABLE_COM_ALL_S (0)
+
+#define AR_SWITCH_TABLE_COM2_ALL (0xffffff)
+#define AR_SWITCH_TABLE_COM2_ALL_S (0)
+
+#define AR_SWITCH_TABLE_ALL (0xfff)
+#define AR_SWITCH_TABLE_ALL_S (0)
+
+static const struct ar9300_eeprom ar9300_default = {
+        .eepromVersion = 2,
+        .templateVersion = 2,
+        .macAddr = {1, 2, 3, 4, 5, 6},
+        .custData = {0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                     0, 0, 0, 0, 0, 0, 0, 0, 0, 0},
+        .baseEepHeader = {
+                .regDmn = {0, 0x1f},
+                .txrxMask =  0x77, /* 4 bits tx and 4 bits rx */
+                .opCapFlags = {
+                        .opFlags = AR9300_OPFLAGS_11G | AR9300_OPFLAGS_11A,
+                        .eepMisc = 0,
+                },
+                .rfSilent = 0,
+                .blueToothOptions = 0,
+                .deviceCap = 0,
+                .deviceType = 5, /* takes lower byte in eeprom location */
+                .pwrTableOffset = AR9300_PWR_TABLE_OFFSET,
+                .params_for_tuning_caps = {0, 0},
+                .featureEnable = 0x0c,
+                 /*
+                  * bit0 - enable tx temp comp - disabled
+                  * bit1 - enable tx volt comp - disabled
+                  * bit2 - enable fastClock - enabled
+                  * bit3 - enable doubling - enabled
+                  * bit4 - enable internal regulator - disabled
+                  */
+                .miscConfiguration = 0, /* bit0 - turn down drivestrength */
+                .eepromWriteEnableGpio = 3,
+                .wlanDisableGpio = 0,
+                .wlanLedGpio = 8,
+                .rxBandSelectGpio = 0xff,
+                .txrxgain = 0,
+                .swreg = 0,
+         },
+        .modalHeader2G = {
+        /* ar9300_modal_eep_header  2g */
+                /* 4 idle,t1,t2,b(4 bits per setting) */
+                .antCtrlCommon = 0x110,
+                /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+                .antCtrlCommon2 = 0x22222,
+
+                /*
+                 * antCtrlChain[AR9300_MAX_CHAINS]; 6 idle, t, r,
+                 * rx1, rx12, b (2 bits each)
+                 */
+                .antCtrlChain = {0x150, 0x150, 0x150},
+
+                /*
+                 * xatten1DB[AR9300_MAX_CHAINS];  3 xatten1_db
+                 * for ar9280 (0xa20c/b20c 5:0)
+                 */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for ar9280 (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 36,
+                .voltSlope = 0,
+
+                /*
+                 * spurChans[OSPREY_EEPROM_MODAL_SPURS]; spur
+                 * channels in usual fbin coding format
+                 */
+                .spurChans = {0, 0, 0, 0, 0},
+
+                /*
+                 * noiseFloorThreshCh[AR9300_MAX_CHAINS]; 3 Check
+                 * if the register is per chain
+                 */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {1, 1, 1},/* 3 chain */
+                .db_stage2 = {1, 1, 1}, /* 3 chain  */
+                .db_stage3 = {0, 0, 0},
+                .db_stage4 = {0, 0, 0},
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2c,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .futureModal = { /* [32] */
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+                },
+         },
+        .calFreqPier2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1),
+         },
+        /* ar9300_cal_data_per_freq_op_loop 2g */
+        .calPierData2G = {
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+                { {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0}, {0, 0, 0, 0, 0, 0} },
+         },
+        .calTarget_freqbin_Cck = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2484, 1),
+         },
+        .calTarget_freqbin_2G = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT20 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTarget_freqbin_2GHT40 = {
+                FREQ2FBIN(2412, 1),
+                FREQ2FBIN(2437, 1),
+                FREQ2FBIN(2472, 1)
+         },
+        .calTargetPowerCck = {
+                 /* 1L-5L,5S,11L,11S */
+                 { {36, 36, 36, 36} },
+                 { {36, 36, 36, 36} },
+        },
+        .calTargetPower2G = {
+                 /* 6-24,36,48,54 */
+                 { {32, 32, 28, 24} },
+                 { {32, 32, 28, 24} },
+                 { {32, 32, 28, 24} },
+        },
+        .calTargetPower2GHT20 = {
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+        },
+        .calTargetPower2GHT40 = {
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+                { {32, 32, 32, 32, 28, 20, 32, 32, 28, 20, 32, 32, 28, 20} },
+        },
+        .ctlIndex_2G =  {
+                0x11, 0x12, 0x15, 0x17, 0x41, 0x42,
+                0x45, 0x47, 0x31, 0x32, 0x35, 0x37,
+        },
+        .ctl_freqbin_2G = {
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2457, 1),
+                        FREQ2FBIN(2462, 1)
+                },
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+
+                {
+                        FREQ2FBIN(2412, 1),
+                        FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2462, 1),
+                        0xFF,
+                },
+                {
+                        FREQ2FBIN(2422, 1),
+                        FREQ2FBIN(2427, 1),
+                        FREQ2FBIN(2447, 1),
+                        FREQ2FBIN(2452, 1)
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(2484, 1),
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        FREQ2FBIN(2472, 1),
+                        0,
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(2462, 1),
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                },
+
+                {
+                        /* Data[9].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[9].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[9].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[10].ctlEdges[0].bChannel */ FREQ2FBIN(2412, 1),
+                        /* Data[10].ctlEdges[1].bChannel */ FREQ2FBIN(2417, 1),
+                        /* Data[10].ctlEdges[2].bChannel */ FREQ2FBIN(2472, 1),
+                        0
+                },
+
+                {
+                        /* Data[11].ctlEdges[0].bChannel */ FREQ2FBIN(2422, 1),
+                        /* Data[11].ctlEdges[1].bChannel */ FREQ2FBIN(2427, 1),
+                        /* Data[11].ctlEdges[2].bChannel */ FREQ2FBIN(2447, 1),
+                        /* Data[11].ctlEdges[3].bChannel */
+                        FREQ2FBIN(2462, 1),
+                }
+         },
+        .ctlPowerData_2G = {
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { {60, 1}, {60, 0}, {60, 0}, {60, 1} } },
+
+                 { { {60, 1}, {60, 0}, {0, 0}, {0, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+
+                 { { {60, 0}, {60, 1}, {60, 1}, {60, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+
+                 { { {60, 0}, {60, 1}, {60, 0}, {60, 0} } },
+                 { { {60, 0}, {60, 1}, {60, 1}, {60, 1} } },
+         },
+        .modalHeader5G = {
+                /* 4 idle,t1,t2,b (4 bits per setting) */
+                .antCtrlCommon = 0x110,
+                /* 4 ra1l1, ra2l1, ra1l2,ra2l2,ra12 */
+                .antCtrlCommon2 = 0x22222,
+                 /* antCtrlChain 6 idle, t,r,rx1,rx12,b (2 bits each) */
+                .antCtrlChain = {
+                        0x000, 0x000, 0x000,
+                },
+                 /* xatten1DB 3 xatten1_db for AR9280 (0xa20c/b20c 5:0) */
+                .xatten1DB = {0, 0, 0},
+
+                /*
+                 * xatten1Margin[AR9300_MAX_CHAINS]; 3 xatten1_margin
+                 * for merlin (0xa20c/b20c 16:12
+                 */
+                .xatten1Margin = {0, 0, 0},
+                .tempSlope = 68,
+                .voltSlope = 0,
+                /* spurChans spur channels in usual fbin coding format */
+                .spurChans = {0, 0, 0, 0, 0},
+                /* noiseFloorThreshCh Check if the register is per chain */
+                .noiseFloorThreshCh = {-1, 0, 0},
+                .ob = {3, 3, 3}, /* 3 chain */
+                .db_stage2 = {3, 3, 3}, /* 3 chain */
+                .db_stage3 = {3, 3, 3}, /* doesn't exist for 2G */
+                .db_stage4 = {3, 3, 3},  /* don't exist for 2G */
+                .xpaBiasLvl = 0,
+                .txFrameToDataStart = 0x0e,
+                .txFrameToPaOn = 0x0e,
+                .txClip = 3, /* 4 bits tx_clip, 4 bits dac_scale_cck */
+                .antennaGain = 0,
+                .switchSettling = 0x2d,
+                .adcDesiredSize = -30,
+                .txEndToXpaOff = 0,
+                .txEndToRxOn = 0x2,
+                .txFrameToXpaOn = 0xe,
+                .thresh62 = 28,
+                .futureModal = {
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+                        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+                },
+         },
+        .calFreqPier5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calPierData5G = {
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+                        {
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                                {0, 0, 0, 0, 0},
+                        },
+
+        },
+        .calTarget_freqbin_5G = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5220, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5400, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5600, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT20 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+        },
+        .calTarget_freqbin_5GHT40 = {
+                FREQ2FBIN(5180, 0),
+                FREQ2FBIN(5240, 0),
+                FREQ2FBIN(5320, 0),
+                FREQ2FBIN(5500, 0),
+                FREQ2FBIN(5700, 0),
+                FREQ2FBIN(5745, 0),
+                FREQ2FBIN(5725, 0),
+                FREQ2FBIN(5825, 0)
+         },
+        .calTargetPower5G = {
+                /* 6-24,36,48,54 */
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+                { {20, 20, 20, 10} },
+         },
+        .calTargetPower5GHT20 = {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+         },
+        .calTargetPower5GHT40 =  {
+                /*
+                 * 0_8_16,1-3_9-11_17-19,
+                 * 4,5,6,7,12,13,14,15,20,21,22,23
+                 */
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+                { {20, 20, 10, 10, 0, 0, 10, 10, 0, 0, 10, 10, 0, 0} },
+         },
+        .ctlIndex_5G =  {
+                0x10, 0x16, 0x18, 0x40, 0x46,
+                0x48, 0x30, 0x36, 0x38
+        },
+        .ctl_freqbin_5G =  {
+                {
+                        /* Data[0].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[0].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[0].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[0].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[0].ctlEdges[4].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[0].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[0].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[0].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+                {
+                        /* Data[1].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[1].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[1].ctlEdges[2].bChannel */ FREQ2FBIN(5280, 0),
+                        /* Data[1].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[1].ctlEdges[4].bChannel */ FREQ2FBIN(5520, 0),
+                        /* Data[1].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[1].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[1].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[2].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[2].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[2].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[2].ctlEdges[3].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[2].ctlEdges[4].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[2].ctlEdges[5].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[2].ctlEdges[6].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[2].ctlEdges[7].bChannel */ FREQ2FBIN(5755, 0)
+                },
+
+                {
+                        /* Data[3].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[3].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[3].ctlEdges[2].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[3].ctlEdges[3].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[3].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[3].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[3].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[3].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[4].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[4].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[4].ctlEdges[2].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[4].ctlEdges[3].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[4].ctlEdges[4].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[5].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[4].ctlEdges[7].bChannel */ 0xFF,
+                },
+
+                {
+                        /* Data[5].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[5].ctlEdges[1].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[5].ctlEdges[2].bChannel */ FREQ2FBIN(5310, 0),
+                        /* Data[5].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[5].ctlEdges[4].bChannel */ FREQ2FBIN(5590, 0),
+                        /* Data[5].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[5].ctlEdges[6].bChannel */ 0xFF,
+                        /* Data[5].ctlEdges[7].bChannel */ 0xFF
+                },
+
+                {
+                        /* Data[6].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[6].ctlEdges[1].bChannel */ FREQ2FBIN(5200, 0),
+                        /* Data[6].ctlEdges[2].bChannel */ FREQ2FBIN(5220, 0),
+                        /* Data[6].ctlEdges[3].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[6].ctlEdges[4].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[6].ctlEdges[5].bChannel */ FREQ2FBIN(5600, 0),
+                        /* Data[6].ctlEdges[6].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[6].ctlEdges[7].bChannel */ FREQ2FBIN(5745, 0)
+                },
+
+                {
+                        /* Data[7].ctlEdges[0].bChannel */ FREQ2FBIN(5180, 0),
+                        /* Data[7].ctlEdges[1].bChannel */ FREQ2FBIN(5260, 0),
+                        /* Data[7].ctlEdges[2].bChannel */ FREQ2FBIN(5320, 0),
+                        /* Data[7].ctlEdges[3].bChannel */ FREQ2FBIN(5500, 0),
+                        /* Data[7].ctlEdges[4].bChannel */ FREQ2FBIN(5560, 0),
+                        /* Data[7].ctlEdges[5].bChannel */ FREQ2FBIN(5700, 0),
+                        /* Data[7].ctlEdges[6].bChannel */ FREQ2FBIN(5745, 0),
+                        /* Data[7].ctlEdges[7].bChannel */ FREQ2FBIN(5825, 0)
+                },
+
+                {
+                        /* Data[8].ctlEdges[0].bChannel */ FREQ2FBIN(5190, 0),
+                        /* Data[8].ctlEdges[1].bChannel */ FREQ2FBIN(5230, 0),
+                        /* Data[8].ctlEdges[2].bChannel */ FREQ2FBIN(5270, 0),
+                        /* Data[8].ctlEdges[3].bChannel */ FREQ2FBIN(5510, 0),
+                        /* Data[8].ctlEdges[4].bChannel */ FREQ2FBIN(5550, 0),
+                        /* Data[8].ctlEdges[5].bChannel */ FREQ2FBIN(5670, 0),
+                        /* Data[8].ctlEdges[6].bChannel */ FREQ2FBIN(5755, 0),
+                        /* Data[8].ctlEdges[7].bChannel */ FREQ2FBIN(5795, 0)
+                }
+         },
+        .ctlPowerData_5G = {
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 0}, {60, 1}, {60, 0}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                        }
+                },
+                {
+                        {
+                                {60, 0}, {60, 1}, {60, 1}, {60, 0},
+                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                                {60, 0}, {60, 0}, {60, 0}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                {60, 1}, {60, 0}, {60, 0}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 1}, {60, 1},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 1}, {60, 0},
+                        }
+                },
+                {
+                        {
+                                {60, 1}, {60, 0}, {60, 1}, {60, 1},
+                                {60, 1}, {60, 1}, {60, 0}, {60, 1},
+                        }
+                },
+         }
+};
+
+static int ath9k_hw_ar9300_check_eeprom(struct ath_hw *ah)
+{
+        return 0;
+}
+
+static u32 ath9k_hw_ar9300_get_eeprom(struct ath_hw *ah,
+                                      enum eeprom_param param)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct ar9300_base_eep_hdr *pBase = &eep->baseEepHeader;
+
+        switch (param) {
+        case EEP_MAC_LSW:
+                return eep->macAddr[0] << 8 | eep->macAddr[1];
+        case EEP_MAC_MID:
+                return eep->macAddr[2] << 8 | eep->macAddr[3];
+        case EEP_MAC_MSW:
+                return eep->macAddr[4] << 8 | eep->macAddr[5];
+        case EEP_REG_0:
+                return pBase->regDmn[0];
+        case EEP_REG_1:
+                return pBase->regDmn[1];
+        case EEP_OP_CAP:
+                return pBase->deviceCap;
+        case EEP_OP_MODE:
+                return pBase->opCapFlags.opFlags;
+        case EEP_RF_SILENT:
+                return pBase->rfSilent;
+        case EEP_TX_MASK:
+                return (pBase->txrxMask >> 4) & 0xf;
+        case EEP_RX_MASK:
+                return pBase->txrxMask & 0xf;
+        case EEP_DRIVE_STRENGTH:
+#define AR9300_EEP_BASE_DRIV_STRENGTH   0x1
+                return pBase->miscConfiguration & AR9300_EEP_BASE_DRIV_STRENGTH;
+        case EEP_INTERNAL_REGULATOR:
+                /* Bit 4 is internal regulator flag */
+                return (pBase->featureEnable & 0x10) >> 4;
+        case EEP_SWREG:
+                return pBase->swreg;
+        default:
+                return 0;
+        }
+}
+
+#ifdef __BIG_ENDIAN
+static void ar9300_swap_eeprom(struct ar9300_eeprom *eep)
+{
+        u32 dword;
+        u16 word;
+        int i;
+
+        word = swab16(eep->baseEepHeader.regDmn[0]);
+        eep->baseEepHeader.regDmn[0] = word;
+
+        word = swab16(eep->baseEepHeader.regDmn[1]);
+        eep->baseEepHeader.regDmn[1] = word;
+
+        dword = swab32(eep->baseEepHeader.swreg);
+        eep->baseEepHeader.swreg = dword;
+
+        dword = swab32(eep->modalHeader2G.antCtrlCommon);
+        eep->modalHeader2G.antCtrlCommon = dword;
+
+        dword = swab32(eep->modalHeader2G.antCtrlCommon2);
+        eep->modalHeader2G.antCtrlCommon2 = dword;
+
+        dword = swab32(eep->modalHeader5G.antCtrlCommon);
+        eep->modalHeader5G.antCtrlCommon = dword;
+
+        dword = swab32(eep->modalHeader5G.antCtrlCommon2);
+        eep->modalHeader5G.antCtrlCommon2 = dword;
+
+        for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+                word = swab16(eep->modalHeader2G.antCtrlChain[i]);
+                eep->modalHeader2G.antCtrlChain[i] = word;
+
+                word = swab16(eep->modalHeader5G.antCtrlChain[i]);
+                eep->modalHeader5G.antCtrlChain[i] = word;
+        }
+}
+#endif
+
+static bool ar9300_hw_read_eeprom(struct ath_hw *ah,
+                                  long address, u8 *buffer, int many)
+{
+        int i;
+        u8 value[2];
+        unsigned long eepAddr;
+        unsigned long byteAddr;
+        u16 *svalue;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if ((address < 0) || ((address + many) > AR9300_EEPROM_SIZE - 1)) {
+                ath_print(common, ATH_DBG_EEPROM,
+                          "eeprom address not in range\n");
+                return false;
+        }
+
+        for (i = 0; i < many; i++) {
+                eepAddr = (u16) (address + i) / 2;
+                byteAddr = (u16) (address + i) % 2;
+                svalue = (u16 *) value;
+                if (!ath9k_hw_nvram_read(common, eepAddr, svalue)) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "unable to read eeprom region\n");
+                        return false;
+                }
+                *svalue = le16_to_cpu(*svalue);
+                buffer[i] = value[byteAddr];
+        }
+
+        return true;
+}
+
+static bool ar9300_read_eeprom(struct ath_hw *ah,
+                               int address, u8 *buffer, int many)
+{
+        int it;
+
+        for (it = 0; it < many; it++)
+                if (!ar9300_hw_read_eeprom(ah,
+                                           (address - it),
+                                           (buffer + it), 1))
+                        return false;
+        return true;
+}
+
+static void ar9300_comp_hdr_unpack(u8 *best, int *code, int *reference,
+                                   int *length, int *major, int *minor)
+{
+        unsigned long value[4];
+
+        value[0] = best[0];
+        value[1] = best[1];
+        value[2] = best[2];
+        value[3] = best[3];
+        *code = ((value[0] >> 5) & 0x0007);
+        *reference = (value[0] & 0x001f) | ((value[1] >> 2) & 0x0020);
+        *length = ((value[1] << 4) & 0x07f0) | ((value[2] >> 4) & 0x000f);
+        *major = (value[2] & 0x000f);
+        *minor = (value[3] & 0x00ff);
+}
+
+static u16 ar9300_comp_cksum(u8 *data, int dsize)
+{
+        int it, checksum = 0;
+
+        for (it = 0; it < dsize; it++) {
+                checksum += data[it];
+                checksum &= 0xffff;
+        }
+
+        return checksum;
+}
+
+static bool ar9300_uncompress_block(struct ath_hw *ah,
+                                    u8 *mptr,
+                                    int mdataSize,
+                                    u8 *block,
+                                    int size)
+{
+        int it;
+        int spot;
+        int offset;
+        int length;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        spot = 0;
+
+        for (it = 0; it < size; it += (length+2)) {
+                offset = block[it];
+                offset &= 0xff;
+                spot += offset;
+                length = block[it+1];
+                length &= 0xff;
+
+                if (length > 0 && spot >= 0 && spot+length < mdataSize) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Restore at %d: spot=%d "
+                                  "offset=%d length=%d\n",
+                                   it, spot, offset, length);
+                        memcpy(&mptr[spot], &block[it+2], length);
+                        spot += length;
+                } else if (length > 0) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Bad restore at %d: spot=%d "
+                                  "offset=%d length=%d\n",
+                                  it, spot, offset, length);
+                        return false;
+                }
+        }
+        return true;
+}
+
+static int ar9300_compress_decision(struct ath_hw *ah,
+                                    int it,
+                                    int code,
+                                    int reference,
+                                    u8 *mptr,
+                                    u8 *word, int length, int mdata_size)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u8 *dptr;
+
+        switch (code) {
+        case _CompressNone:
+                if (length != mdata_size) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "EEPROM structure size mismatch"
+                                  "memory=%d eeprom=%d\n", mdata_size, length);
+                        return -1;
+                }
+                memcpy(mptr, (u8 *) (word + COMP_HDR_LEN), length);
+                ath_print(common, ATH_DBG_EEPROM, "restored eeprom %d:"
+                          " uncompressed, length %d\n", it, length);
+                break;
+        case _CompressBlock:
+                if (reference == 0) {
+                        dptr = mptr;
+                } else {
+                        if (reference != 2) {
+                                ath_print(common, ATH_DBG_EEPROM,
+                                          "cant find reference eeprom"
+                                          "struct %d\n", reference);
+                                return -1;
+                        }
+                        memcpy(mptr, &ar9300_default, mdata_size);
+                }
+                ath_print(common, ATH_DBG_EEPROM,
+                          "restore eeprom %d: block, reference %d,"
+                          " length %d\n", it, reference, length);
+                ar9300_uncompress_block(ah, mptr, mdata_size,
+                                        (u8 *) (word + COMP_HDR_LEN), length);
+                break;
+        default:
+                ath_print(common, ATH_DBG_EEPROM, "unknown compression"
+                          " code %d\n", code);
+                return -1;
+        }
+        return 0;
+}
+
+/*
+ * Read the configuration data from the eeprom.
+ * The data can be put in any specified memory buffer.
+ *
+ * Returns -1 on error.
+ * Returns address of next memory location on success.
+ */
+static int ar9300_eeprom_restore_internal(struct ath_hw *ah,
+                                          u8 *mptr, int mdata_size)
+{
+#define MDEFAULT 15
+#define MSTATE 100
+        int cptr;
+        u8 *word;
+        int code;
+        int reference, length, major, minor;
+        int osize;
+        int it;
+        u16 checksum, mchecksum;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        word = kzalloc(2048, GFP_KERNEL);
+        if (!word)
+                return -1;
+
+        memcpy(mptr, &ar9300_default, mdata_size);
+
+        cptr = AR9300_BASE_ADDR;
+        for (it = 0; it < MSTATE; it++) {
+                if (!ar9300_read_eeprom(ah, cptr, word, COMP_HDR_LEN))
+                        goto fail;
+
+                if ((word[0] == 0 && word[1] == 0 && word[2] == 0 &&
+                     word[3] == 0) || (word[0] == 0xff && word[1] == 0xff
+                                       && word[2] == 0xff && word[3] == 0xff))
+                        break;
+
+                ar9300_comp_hdr_unpack(word, &code, &reference,
+                                       &length, &major, &minor);
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Found block at %x: code=%d ref=%d"
+                          "length=%d major=%d minor=%d\n", cptr, code,
+                          reference, length, major, minor);
+                if (length >= 1024) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Skipping bad header\n");
+                        cptr -= COMP_HDR_LEN;
+                        continue;
+                }
+
+                osize = length;
+                ar9300_read_eeprom(ah, cptr, word,
+                                   COMP_HDR_LEN + osize + COMP_CKSUM_LEN);
+                checksum = ar9300_comp_cksum(&word[COMP_HDR_LEN], length);
+                mchecksum = word[COMP_HDR_LEN + osize] |
+                    (word[COMP_HDR_LEN + osize + 1] << 8);
+                ath_print(common, ATH_DBG_EEPROM,
+                          "checksum %x %x\n", checksum, mchecksum);
+                if (checksum == mchecksum) {
+                        ar9300_compress_decision(ah, it, code, reference, mptr,
+                                                 word, length, mdata_size);
+                } else {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "skipping block with bad checksum\n");
+                }
+                cptr -= (COMP_HDR_LEN + osize + COMP_CKSUM_LEN);
+        }
+
+        kfree(word);
+        return cptr;
+
+fail:
+        kfree(word);
+        return -1;
+}
+
+/*
+ * Restore the configuration structure by reading the eeprom.
+ * This function destroys any existing in-memory structure
+ * content.
+ */
+static bool ath9k_hw_ar9300_fill_eeprom(struct ath_hw *ah)
+{
+        u8 *mptr = NULL;
+        int mdata_size;
+
+        mptr = (u8 *) &ah->eeprom.ar9300_eep;
+        mdata_size = sizeof(struct ar9300_eeprom);
+
+        if (mptr && mdata_size > 0) {
+                /* At this point, mptr points to the eeprom data structure
+                 * in it's "default" state. If this is big endian, swap the
+                 * data structures back to "little endian"
+                 */
+                /* First swap, default to Little Endian */
+#ifdef __BIG_ENDIAN
+                ar9300_swap_eeprom((struct ar9300_eeprom *)mptr);
+#endif
+                if (ar9300_eeprom_restore_internal(ah, mptr, mdata_size) >= 0)
+                        return true;
+
+                /* Second Swap, back to Big Endian */
+#ifdef __BIG_ENDIAN
+                ar9300_swap_eeprom((struct ar9300_eeprom *)mptr);
+#endif
+        }
+        return false;
+}
+
+/* XXX: review hardware docs */
+static int ath9k_hw_ar9300_get_eeprom_ver(struct ath_hw *ah)
+{
+        return ah->eeprom.ar9300_eep.eepromVersion;
+}
+
+/* XXX: could be read from the eepromVersion, not sure yet */
+static int ath9k_hw_ar9300_get_eeprom_rev(struct ath_hw *ah)
+{
+        return 0;
+}
+
+static u8 ath9k_hw_ar9300_get_num_ant_config(struct ath_hw *ah,
+                                             enum ieee80211_band freq_band)
+{
+        return 1;
+}
+
+static u16 ath9k_hw_ar9300_get_eeprom_antenna_cfg(struct ath_hw *ah,
+                                                  struct ath9k_channel *chan)
+{
+        return -EINVAL;
+}
+
+static s32 ar9003_hw_xpa_bias_level_get(struct ath_hw *ah, bool is2ghz)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (is2ghz)
+                return eep->modalHeader2G.xpaBiasLvl;
+        else
+                return eep->modalHeader5G.xpaBiasLvl;
+}
+
+static void ar9003_hw_xpa_bias_level_apply(struct ath_hw *ah, bool is2ghz)
+{
+        int bias = ar9003_hw_xpa_bias_level_get(ah, is2ghz);
+        REG_RMW_FIELD(ah, AR_CH0_TOP, AR_CH0_TOP_XPABIASLVL, (bias & 0x3));
+        REG_RMW_FIELD(ah, AR_CH0_THERM, AR_CH0_THERM_SPARE,
+                      ((bias >> 2) & 0x3));
+}
+
+static u32 ar9003_hw_ant_ctrl_common_get(struct ath_hw *ah, bool is2ghz)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (is2ghz)
+                return eep->modalHeader2G.antCtrlCommon;
+        else
+                return eep->modalHeader5G.antCtrlCommon;
+}
+
+static u32 ar9003_hw_ant_ctrl_common_2_get(struct ath_hw *ah, bool is2ghz)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (is2ghz)
+                return eep->modalHeader2G.antCtrlCommon2;
+        else
+                return eep->modalHeader5G.antCtrlCommon2;
+}
+
+static u16 ar9003_hw_ant_ctrl_chain_get(struct ath_hw *ah,
+                                        int chain,
+                                        bool is2ghz)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (chain >= 0 && chain < AR9300_MAX_CHAINS) {
+                if (is2ghz)
+                        return eep->modalHeader2G.antCtrlChain[chain];
+                else
+                        return eep->modalHeader5G.antCtrlChain[chain];
+        }
+
+        return 0;
+}
+
+static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
+{
+        u32 value = ar9003_hw_ant_ctrl_common_get(ah, is2ghz);
+        REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM, AR_SWITCH_TABLE_COM_ALL, value);
+
+        value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
+        REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
+
+        value = ar9003_hw_ant_ctrl_chain_get(ah, 0, is2ghz);
+        REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_0, AR_SWITCH_TABLE_ALL, value);
+
+        value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
+        REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_1, AR_SWITCH_TABLE_ALL, value);
+
+        value = ar9003_hw_ant_ctrl_chain_get(ah, 2, is2ghz);
+        REG_RMW_FIELD(ah, AR_PHY_SWITCH_CHAIN_2, AR_SWITCH_TABLE_ALL, value);
+}
+
+static void ar9003_hw_drive_strength_apply(struct ath_hw *ah)
+{
+        int drive_strength;
+        unsigned long reg;
+
+        drive_strength = ath9k_hw_ar9300_get_eeprom(ah, EEP_DRIVE_STRENGTH);
+
+        if (!drive_strength)
+                return;
+
+        reg = REG_READ(ah, AR_PHY_65NM_CH0_BIAS1);
+        reg &= ~0x00ffffc0;
+        reg |= 0x5 << 21;
+        reg |= 0x5 << 18;
+        reg |= 0x5 << 15;
+        reg |= 0x5 << 12;
+        reg |= 0x5 << 9;
+        reg |= 0x5 << 6;
+        REG_WRITE(ah, AR_PHY_65NM_CH0_BIAS1, reg);
+
+        reg = REG_READ(ah, AR_PHY_65NM_CH0_BIAS2);
+        reg &= ~0xffffffe0;
+        reg |= 0x5 << 29;
+        reg |= 0x5 << 26;
+        reg |= 0x5 << 23;
+        reg |= 0x5 << 20;
+        reg |= 0x5 << 17;
+        reg |= 0x5 << 14;
+        reg |= 0x5 << 11;
+        reg |= 0x5 << 8;
+        reg |= 0x5 << 5;
+        REG_WRITE(ah, AR_PHY_65NM_CH0_BIAS2, reg);
+
+        reg = REG_READ(ah, AR_PHY_65NM_CH0_BIAS4);
+        reg &= ~0xff800000;
+        reg |= 0x5 << 29;
+        reg |= 0x5 << 26;
+        reg |= 0x5 << 23;
+        REG_WRITE(ah, AR_PHY_65NM_CH0_BIAS4, reg);
+}
+
+static void ar9003_hw_internal_regulator_apply(struct ath_hw *ah)
+{
+        int internal_regulator =
+                ath9k_hw_ar9300_get_eeprom(ah, EEP_INTERNAL_REGULATOR);
+
+        if (internal_regulator) {
+                /* Internal regulator is ON. Write swreg register. */
+                int swreg = ath9k_hw_ar9300_get_eeprom(ah, EEP_SWREG);
+                REG_WRITE(ah, AR_RTC_REG_CONTROL1,
+                REG_READ(ah, AR_RTC_REG_CONTROL1) &
+                         (~AR_RTC_REG_CONTROL1_SWREG_PROGRAM));
+                REG_WRITE(ah, AR_RTC_REG_CONTROL0, swreg);
+                /* Set REG_CONTROL1.SWREG_PROGRAM */
+                REG_WRITE(ah, AR_RTC_REG_CONTROL1,
+                          REG_READ(ah,
+                                   AR_RTC_REG_CONTROL1) |
+                                   AR_RTC_REG_CONTROL1_SWREG_PROGRAM);
+        } else {
+                REG_WRITE(ah, AR_RTC_SLEEP_CLK,
+                          (REG_READ(ah,
+                                    AR_RTC_SLEEP_CLK) |
+                                    AR_RTC_FORCE_SWREG_PRD));
+        }
+}
+
+static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
+                                             struct ath9k_channel *chan)
+{
+        ar9003_hw_xpa_bias_level_apply(ah, IS_CHAN_2GHZ(chan));
+        ar9003_hw_ant_ctrl_apply(ah, IS_CHAN_2GHZ(chan));
+        ar9003_hw_drive_strength_apply(ah);
+        ar9003_hw_internal_regulator_apply(ah);
+}
+
+static void ath9k_hw_ar9300_set_addac(struct ath_hw *ah,
+                                      struct ath9k_channel *chan)
+{
+}
+
+/*
+ * Returns the interpolated y value corresponding to the specified x value
+ * from the np ordered pairs of data (px,py).
+ * The pairs do not have to be in any order.
+ * If the specified x value is less than any of the px,
+ * the returned y value is equal to the py for the lowest px.
+ * If the specified x value is greater than any of the px,
+ * the returned y value is equal to the py for the highest px.
+ */
+static int ar9003_hw_power_interpolate(int32_t x,
+                                       int32_t *px, int32_t *py, u_int16_t np)
+{
+        int ip = 0;
+        int lx = 0, ly = 0, lhave = 0;
+        int hx = 0, hy = 0, hhave = 0;
+        int dx = 0;
+        int y = 0;
+
+        lhave = 0;
+        hhave = 0;
+
+        /* identify best lower and higher x calibration measurement */
+        for (ip = 0; ip < np; ip++) {
+                dx = x - px[ip];
+
+                /* this measurement is higher than our desired x */
+                if (dx <= 0) {
+                        if (!hhave || dx > (x - hx)) {
+                                /* new best higher x measurement */
+                                hx = px[ip];
+                                hy = py[ip];
+                                hhave = 1;
+                        }
+                }
+                /* this measurement is lower than our desired x */
+                if (dx >= 0) {
+                        if (!lhave || dx < (x - lx)) {
+                                /* new best lower x measurement */
+                                lx = px[ip];
+                                ly = py[ip];
+                                lhave = 1;
+                        }
+                }
+        }
+
+        /* the low x is good */
+        if (lhave) {
+                /* so is the high x */
+                if (hhave) {
+                        /* they're the same, so just pick one */
+                        if (hx == lx)
+                                y = ly;
+                        else    /* interpolate  */
+                                y = ly + (((x - lx) * (hy - ly)) / (hx - lx));
+                } else          /* only low is good, use it */
+                        y = ly;
+        } else if (hhave)       /* only high is good, use it */
+                y = hy;
+        else /* nothing is good,this should never happen unless np=0, ???? */
+                y = -(1 << 30);
+        return y;
+}
+
+static u8 ar9003_hw_eeprom_get_tgt_pwr(struct ath_hw *ah,
+                                       u16 rateIndex, u16 freq, bool is2GHz)
+{
+        u16 numPiers, i;
+        s32 targetPowerArray[AR9300_NUM_5G_20_TARGET_POWERS];
+        s32 freqArray[AR9300_NUM_5G_20_TARGET_POWERS];
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct cal_tgt_pow_legacy *pEepromTargetPwr;
+        u8 *pFreqBin;
+
+        if (is2GHz) {
+                numPiers = AR9300_NUM_2G_20_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower2G;
+                pFreqBin = eep->calTarget_freqbin_2G;
+        } else {
+                numPiers = AR9300_NUM_5G_20_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower5G;
+                pFreqBin = eep->calTarget_freqbin_5G;
+        }
+
+        /*
+         * create array of channels and targetpower from
+         * targetpower piers stored on eeprom
+         */
+        for (i = 0; i < numPiers; i++) {
+                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
+        }
+
+        /* interpolate to get target power for given frequency */
+        return (u8) ar9003_hw_power_interpolate((s32) freq,
+                                                 freqArray,
+                                                 targetPowerArray, numPiers);
+}
+
+static u8 ar9003_hw_eeprom_get_ht20_tgt_pwr(struct ath_hw *ah,
+                                            u16 rateIndex,
+                                            u16 freq, bool is2GHz)
+{
+        u16 numPiers, i;
+        s32 targetPowerArray[AR9300_NUM_5G_20_TARGET_POWERS];
+        s32 freqArray[AR9300_NUM_5G_20_TARGET_POWERS];
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct cal_tgt_pow_ht *pEepromTargetPwr;
+        u8 *pFreqBin;
+
+        if (is2GHz) {
+                numPiers = AR9300_NUM_2G_20_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower2GHT20;
+                pFreqBin = eep->calTarget_freqbin_2GHT20;
+        } else {
+                numPiers = AR9300_NUM_5G_20_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower5GHT20;
+                pFreqBin = eep->calTarget_freqbin_5GHT20;
+        }
+
+        /*
+         * create array of channels and targetpower
+         * from targetpower piers stored on eeprom
+         */
+        for (i = 0; i < numPiers; i++) {
+                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
+        }
+
+        /* interpolate to get target power for given frequency */
+        return (u8) ar9003_hw_power_interpolate((s32) freq,
+                                                 freqArray,
+                                                 targetPowerArray, numPiers);
+}
+
+static u8 ar9003_hw_eeprom_get_ht40_tgt_pwr(struct ath_hw *ah,
+                                            u16 rateIndex,
+                                            u16 freq, bool is2GHz)
+{
+        u16 numPiers, i;
+        s32 targetPowerArray[AR9300_NUM_5G_40_TARGET_POWERS];
+        s32 freqArray[AR9300_NUM_5G_40_TARGET_POWERS];
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct cal_tgt_pow_ht *pEepromTargetPwr;
+        u8 *pFreqBin;
+
+        if (is2GHz) {
+                numPiers = AR9300_NUM_2G_40_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower2GHT40;
+                pFreqBin = eep->calTarget_freqbin_2GHT40;
+        } else {
+                numPiers = AR9300_NUM_5G_40_TARGET_POWERS;
+                pEepromTargetPwr = eep->calTargetPower5GHT40;
+                pFreqBin = eep->calTarget_freqbin_5GHT40;
+        }
+
+        /*
+         * create array of channels and targetpower from
+         * targetpower piers stored on eeprom
+         */
+        for (i = 0; i < numPiers; i++) {
+                freqArray[i] = FBIN2FREQ(pFreqBin[i], is2GHz);
+                targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
+        }
+
+        /* interpolate to get target power for given frequency */
+        return (u8) ar9003_hw_power_interpolate((s32) freq,
+                                                 freqArray,
+                                                 targetPowerArray, numPiers);
+}
+
+static u8 ar9003_hw_eeprom_get_cck_tgt_pwr(struct ath_hw *ah,
+                                           u16 rateIndex, u16 freq)
+{
+        u16 numPiers = AR9300_NUM_2G_CCK_TARGET_POWERS, i;
+        s32 targetPowerArray[AR9300_NUM_2G_CCK_TARGET_POWERS];
+        s32 freqArray[AR9300_NUM_2G_CCK_TARGET_POWERS];
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct cal_tgt_pow_legacy *pEepromTargetPwr = eep->calTargetPowerCck;
+        u8 *pFreqBin = eep->calTarget_freqbin_Cck;
+
+        /*
+         * create array of channels and targetpower from
+         * targetpower piers stored on eeprom
+         */
+        for (i = 0; i < numPiers; i++) {
+                freqArray[i] = FBIN2FREQ(pFreqBin[i], 1);
+                targetPowerArray[i] = pEepromTargetPwr[i].tPow2x[rateIndex];
+        }
+
+        /* interpolate to get target power for given frequency */
+        return (u8) ar9003_hw_power_interpolate((s32) freq,
+                                                 freqArray,
+                                                 targetPowerArray, numPiers);
+}
+
+/* Set tx power registers to array of values passed in */
+static int ar9003_hw_tx_power_regwrite(struct ath_hw *ah, u8 * pPwrArray)
+{
+#define POW_SM(_r, _s)     (((_r) & 0x3f) << (_s))
+        /* make sure forced gain is not set */
+        REG_WRITE(ah, 0xa458, 0);
+
+        /* Write the OFDM power per rate set */
+
+        /* 6 (LSB), 9, 12, 18 (MSB) */
+        REG_WRITE(ah, 0xa3c0,
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 0));
+
+        /* 24 (LSB), 36, 48, 54 (MSB) */
+        REG_WRITE(ah, 0xa3c4,
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_54], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_48], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_36], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_6_24], 0));
+
+        /* Write the CCK power per rate set */
+
+        /* 1L (LSB), reserved, 2L, 2S (MSB) */
+        REG_WRITE(ah, 0xa3c8,
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 16) |
+                  /* POW_SM(txPowerTimes2,  8) | this is reserved for AR9003 */
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 0));
+
+        /* 5.5L (LSB), 5.5S, 11L, 11S (MSB) */
+        REG_WRITE(ah, 0xa3cc,
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_11S], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_11L], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_5S], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_LEGACY_1L_5L], 0)
+            );
+
+        /* Write the HT20 power per rate set */
+
+        /* 0/8/16 (LSB), 1-3/9-11/17-19, 4, 5 (MSB) */
+        REG_WRITE(ah, 0xa3d0,
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_5], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_4], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_1_3_9_11_17_19], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_0_8_16], 0)
+            );
+
+        /* 6 (LSB), 7, 12, 13 (MSB) */
+        REG_WRITE(ah, 0xa3d4,
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_13], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_12], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_7], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_6], 0)
+            );
+
+        /* 14 (LSB), 15, 20, 21 */
+        REG_WRITE(ah, 0xa3e4,
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_21], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_20], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_15], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_14], 0)
+            );
+
+        /* Mixed HT20 and HT40 rates */
+
+        /* HT20 22 (LSB), HT20 23, HT40 22, HT40 23 (MSB) */
+        REG_WRITE(ah, 0xa3e8,
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_23], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_22], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_23], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT20_22], 0)
+            );
+
+        /*
+         * Write the HT40 power per rate set
+         * correct PAR difference between HT40 and HT20/LEGACY
+         * 0/8/16 (LSB), 1-3/9-11/17-19, 4, 5 (MSB)
+         */
+        REG_WRITE(ah, 0xa3d8,
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_5], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_4], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_1_3_9_11_17_19], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_0_8_16], 0)
+            );
+
+        /* 6 (LSB), 7, 12, 13 (MSB) */
+        REG_WRITE(ah, 0xa3dc,
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_13], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_12], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_7], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_6], 0)
+            );
+
+        /* 14 (LSB), 15, 20, 21 */
+        REG_WRITE(ah, 0xa3ec,
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_21], 24) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_20], 16) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_15], 8) |
+                  POW_SM(pPwrArray[ALL_TARGET_HT40_14], 0)
+            );
+
+        return 0;
+#undef POW_SM
+}
+
+static void ar9003_hw_set_target_power_eeprom(struct ath_hw *ah, u16 freq)
+{
+        u8 targetPowerValT2[ar9300RateSize];
+        /* XXX: hard code for now, need to get from eeprom struct */
+        u8 ht40PowerIncForPdadc = 0;
+        bool is2GHz = false;
+        unsigned int i = 0;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (freq < 4000)
+                is2GHz = true;
+
+        targetPowerValT2[ALL_TARGET_LEGACY_6_24] =
+            ar9003_hw_eeprom_get_tgt_pwr(ah, LEGACY_TARGET_RATE_6_24, freq,
+                                         is2GHz);
+        targetPowerValT2[ALL_TARGET_LEGACY_36] =
+            ar9003_hw_eeprom_get_tgt_pwr(ah, LEGACY_TARGET_RATE_36, freq,
+                                         is2GHz);
+        targetPowerValT2[ALL_TARGET_LEGACY_48] =
+            ar9003_hw_eeprom_get_tgt_pwr(ah, LEGACY_TARGET_RATE_48, freq,
+                                         is2GHz);
+        targetPowerValT2[ALL_TARGET_LEGACY_54] =
+            ar9003_hw_eeprom_get_tgt_pwr(ah, LEGACY_TARGET_RATE_54, freq,
+                                         is2GHz);
+        targetPowerValT2[ALL_TARGET_LEGACY_1L_5L] =
+            ar9003_hw_eeprom_get_cck_tgt_pwr(ah, LEGACY_TARGET_RATE_1L_5L,
+                                             freq);
+        targetPowerValT2[ALL_TARGET_LEGACY_5S] =
+            ar9003_hw_eeprom_get_cck_tgt_pwr(ah, LEGACY_TARGET_RATE_5S, freq);
+        targetPowerValT2[ALL_TARGET_LEGACY_11L] =
+            ar9003_hw_eeprom_get_cck_tgt_pwr(ah, LEGACY_TARGET_RATE_11L, freq);
+        targetPowerValT2[ALL_TARGET_LEGACY_11S] =
+            ar9003_hw_eeprom_get_cck_tgt_pwr(ah, LEGACY_TARGET_RATE_11S, freq);
+        targetPowerValT2[ALL_TARGET_HT20_0_8_16] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_0_8_16, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_1_3_9_11_17_19] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_1_3_9_11_17_19,
+                                              freq, is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_4] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_4, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_5] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_5, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_6] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_6, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_7] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_7, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_12] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_12, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_13] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_13, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_14] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_14, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_15] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_15, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_20] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_20, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_21] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_21, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_22] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_22, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT20_23] =
+            ar9003_hw_eeprom_get_ht20_tgt_pwr(ah, HT_TARGET_RATE_23, freq,
+                                              is2GHz);
+        targetPowerValT2[ALL_TARGET_HT40_0_8_16] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_0_8_16, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_1_3_9_11_17_19] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_1_3_9_11_17_19,
+                                              freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_4] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_4, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_5] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_5, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_6] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_6, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_7] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_7, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_12] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_12, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_13] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_13, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_14] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_14, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_15] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_15, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_20] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_20, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_21] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_21, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_22] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_22, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+        targetPowerValT2[ALL_TARGET_HT40_23] =
+            ar9003_hw_eeprom_get_ht40_tgt_pwr(ah, HT_TARGET_RATE_23, freq,
+                                              is2GHz) + ht40PowerIncForPdadc;
+
+        while (i < ar9300RateSize) {
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x ", i, targetPowerValT2[i]);
+                i++;
+
+                ath_print(common, ATH_DBG_EEPROM,
+                          "TPC[%02d] 0x%08x\n", i, targetPowerValT2[i]);
+                i++;
+        }
+
+        /* Write target power array to registers */
+        ar9003_hw_tx_power_regwrite(ah, targetPowerValT2);
+}
+
+static int ar9003_hw_cal_pier_get(struct ath_hw *ah,
+                                  int mode,
+                                  int ipier,
+                                  int ichain,
+                                  int *pfrequency,
+                                  int *pcorrection,
+                                  int *ptemperature, int *pvoltage)
+{
+        u8 *pCalPier;
+        struct ar9300_cal_data_per_freq_op_loop *pCalPierStruct;
+        int is2GHz;
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (ichain >= AR9300_MAX_CHAINS) {
+                ath_print(common, ATH_DBG_EEPROM,
+                          "Invalid chain index, must be less than %d\n",
+                          AR9300_MAX_CHAINS);
+                return -1;
+        }
+
+        if (mode) {             /* 5GHz */
+                if (ipier >= AR9300_NUM_5G_CAL_PIERS) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Invalid 5GHz cal pier index, must "
+                                  "be less than %d\n",
+                                  AR9300_NUM_5G_CAL_PIERS);
+                        return -1;
+                }
+                pCalPier = &(eep->calFreqPier5G[ipier]);
+                pCalPierStruct = &(eep->calPierData5G[ichain][ipier]);
+                is2GHz = 0;
+        } else {
+                if (ipier >= AR9300_NUM_2G_CAL_PIERS) {
+                        ath_print(common, ATH_DBG_EEPROM,
+                                  "Invalid 2GHz cal pier index, must "
+                                  "be less than %d\n", AR9300_NUM_2G_CAL_PIERS);
+                        return -1;
+                }
+
+                pCalPier = &(eep->calFreqPier2G[ipier]);
+                pCalPierStruct = &(eep->calPierData2G[ichain][ipier]);
+                is2GHz = 1;
+        }
+
+        *pfrequency = FBIN2FREQ(*pCalPier, is2GHz);
+        *pcorrection = pCalPierStruct->refPower;
+        *ptemperature = pCalPierStruct->tempMeas;
+        *pvoltage = pCalPierStruct->voltMeas;
+
+        return 0;
+}
+
+static int ar9003_hw_power_control_override(struct ath_hw *ah,
+                                            int frequency,
+                                            int *correction,
+                                            int *voltage, int *temperature)
+{
+        int tempSlope = 0;
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        REG_RMW(ah, AR_PHY_TPC_11_B0,
+                (correction[0] << AR_PHY_TPC_OLPC_GAIN_DELTA_S),
+                AR_PHY_TPC_OLPC_GAIN_DELTA);
+        REG_RMW(ah, AR_PHY_TPC_11_B1,
+                (correction[1] << AR_PHY_TPC_OLPC_GAIN_DELTA_S),
+                AR_PHY_TPC_OLPC_GAIN_DELTA);
+        REG_RMW(ah, AR_PHY_TPC_11_B2,
+                (correction[2] << AR_PHY_TPC_OLPC_GAIN_DELTA_S),
+                AR_PHY_TPC_OLPC_GAIN_DELTA);
+
+        /* enable open loop power control on chip */
+        REG_RMW(ah, AR_PHY_TPC_6_B0,
+                (3 << AR_PHY_TPC_6_ERROR_EST_MODE_S),
+                AR_PHY_TPC_6_ERROR_EST_MODE);
+        REG_RMW(ah, AR_PHY_TPC_6_B1,
+                (3 << AR_PHY_TPC_6_ERROR_EST_MODE_S),
+                AR_PHY_TPC_6_ERROR_EST_MODE);
+        REG_RMW(ah, AR_PHY_TPC_6_B2,
+                (3 << AR_PHY_TPC_6_ERROR_EST_MODE_S),
+                AR_PHY_TPC_6_ERROR_EST_MODE);
+
+        /*
+         * enable temperature compensation
+         * Need to use register names
+         */
+        if (frequency < 4000)
+                tempSlope = eep->modalHeader2G.tempSlope;
+        else
+                tempSlope = eep->modalHeader5G.tempSlope;
+
+        REG_RMW_FIELD(ah, AR_PHY_TPC_19, AR_PHY_TPC_19_ALPHA_THERM, tempSlope);
+        REG_RMW_FIELD(ah, AR_PHY_TPC_18, AR_PHY_TPC_18_THERM_CAL_VALUE,
+                      temperature[0]);
+
+        return 0;
+}
+
+/* Apply the recorded correction values. */
+static int ar9003_hw_calibration_apply(struct ath_hw *ah, int frequency)
+{
+        int ichain, ipier, npier;
+        int mode;
+        int lfrequency[AR9300_MAX_CHAINS],
+            lcorrection[AR9300_MAX_CHAINS],
+            ltemperature[AR9300_MAX_CHAINS], lvoltage[AR9300_MAX_CHAINS];
+        int hfrequency[AR9300_MAX_CHAINS],
+            hcorrection[AR9300_MAX_CHAINS],
+            htemperature[AR9300_MAX_CHAINS], hvoltage[AR9300_MAX_CHAINS];
+        int fdiff;
+        int correction[AR9300_MAX_CHAINS],
+            voltage[AR9300_MAX_CHAINS], temperature[AR9300_MAX_CHAINS];
+        int pfrequency, pcorrection, ptemperature, pvoltage;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        mode = (frequency >= 4000);
+        if (mode)
+                npier = AR9300_NUM_5G_CAL_PIERS;
+        else
+                npier = AR9300_NUM_2G_CAL_PIERS;
+
+        for (ichain = 0; ichain < AR9300_MAX_CHAINS; ichain++) {
+                lfrequency[ichain] = 0;
+                hfrequency[ichain] = 100000;
+        }
+        /* identify best lower and higher frequency calibration measurement */
+        for (ichain = 0; ichain < AR9300_MAX_CHAINS; ichain++) {
+                for (ipier = 0; ipier < npier; ipier++) {
+                        if (!ar9003_hw_cal_pier_get(ah, mode, ipier, ichain,
+                                                    &pfrequency, &pcorrection,
+                                                    &ptemperature, &pvoltage)) {
+                                fdiff = frequency - pfrequency;
+
+                                /*
+                                 * this measurement is higher than
+                                 * our desired frequency
+                                 */
+                                if (fdiff <= 0) {
+                                        if (hfrequency[ichain] <= 0 ||
+                                            hfrequency[ichain] >= 100000 ||
+                                            fdiff >
+                                            (frequency - hfrequency[ichain])) {
+                                                /*
+                                                 * new best higher
+                                                 * frequency measurement
+                                                 */
+                                                hfrequency[ichain] = pfrequency;
+                                                hcorrection[ichain] =
+                                                    pcorrection;
+                                                htemperature[ichain] =
+                                                    ptemperature;
+                                                hvoltage[ichain] = pvoltage;
+                                        }
+                                }
+                                if (fdiff >= 0) {
+                                        if (lfrequency[ichain] <= 0
+                                            || fdiff <
+                                            (frequency - lfrequency[ichain])) {
+                                                /*
+                                                 * new best lower
+                                                 * frequency measurement
+                                                 */
+                                                lfrequency[ichain] = pfrequency;
+                                                lcorrection[ichain] =
+                                                    pcorrection;
+                                                ltemperature[ichain] =
+                                                    ptemperature;
+                                                lvoltage[ichain] = pvoltage;
+                                        }
+                                }
+                        }
+                }
+        }
+
+        /* interpolate  */
+        for (ichain = 0; ichain < AR9300_MAX_CHAINS; ichain++) {
+                ath_print(common, ATH_DBG_EEPROM,
+                          "ch=%d f=%d low=%d %d h=%d %d\n",
+                          ichain, frequency, lfrequency[ichain],
+                          lcorrection[ichain], hfrequency[ichain],
+                          hcorrection[ichain]);
+                /* they're the same, so just pick one */
+                if (hfrequency[ichain] == lfrequency[ichain]) {
+                        correction[ichain] = lcorrection[ichain];
+                        voltage[ichain] = lvoltage[ichain];
+                        temperature[ichain] = ltemperature[ichain];
+                }
+                /* the low frequency is good */
+                else if (frequency - lfrequency[ichain] < 1000) {
+                        /* so is the high frequency, interpolate */
+                        if (hfrequency[ichain] - frequency < 1000) {
+
+                                correction[ichain] = lcorrection[ichain] +
+                                    (((frequency - lfrequency[ichain]) *
+                                      (hcorrection[ichain] -
+                                       lcorrection[ichain])) /
+                                     (hfrequency[ichain] - lfrequency[ichain]));
+
+                                temperature[ichain] = ltemperature[ichain] +
+                                    (((frequency - lfrequency[ichain]) *
+                                      (htemperature[ichain] -
+                                       ltemperature[ichain])) /
+                                     (hfrequency[ichain] - lfrequency[ichain]));
+
+                                voltage[ichain] =
+                                    lvoltage[ichain] +
+                                    (((frequency -
+                                       lfrequency[ichain]) * (hvoltage[ichain] -
+                                                              lvoltage[ichain]))
+                                     / (hfrequency[ichain] -
+                                        lfrequency[ichain]));
+                        }
+                        /* only low is good, use it */
+                        else {
+                                correction[ichain] = lcorrection[ichain];
+                                temperature[ichain] = ltemperature[ichain];
+                                voltage[ichain] = lvoltage[ichain];
+                        }
+                }
+                /* only high is good, use it */
+                else if (hfrequency[ichain] - frequency < 1000) {
+                        correction[ichain] = hcorrection[ichain];
+                        temperature[ichain] = htemperature[ichain];
+                        voltage[ichain] = hvoltage[ichain];
+                } else {        /* nothing is good, presume 0???? */
+                        correction[ichain] = 0;
+                        temperature[ichain] = 0;
+                        voltage[ichain] = 0;
+                }
+        }
+
+        ar9003_hw_power_control_override(ah, frequency, correction, voltage,
+                                         temperature);
+
+        ath_print(common, ATH_DBG_EEPROM,
+                  "for frequency=%d, calibration correction = %d %d %d\n",
+                  frequency, correction[0], correction[1], correction[2]);
+
+        return 0;
+}
+
+static void ath9k_hw_ar9300_set_txpower(struct ath_hw *ah,
+                                        struct ath9k_channel *chan, u16 cfgCtl,
+                                        u8 twiceAntennaReduction,
+                                        u8 twiceMaxRegulatoryPower,
+                                        u8 powerLimit)
+{
+        ah->txpower_limit = powerLimit;
+        ar9003_hw_set_target_power_eeprom(ah, chan->channel);
+        ar9003_hw_calibration_apply(ah, chan->channel);
+}
+
+static u16 ath9k_hw_ar9300_get_spur_channel(struct ath_hw *ah,
+                                            u16 i, bool is2GHz)
+{
+        return AR_NO_SPUR;
+}
+
+s32 ar9003_hw_get_tx_gain_idx(struct ath_hw *ah)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        return (eep->baseEepHeader.txrxgain >> 4) & 0xf; /* bits 7:4 */
+}
+
+s32 ar9003_hw_get_rx_gain_idx(struct ath_hw *ah)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        return (eep->baseEepHeader.txrxgain) & 0xf; /* bits 3:0 */
+}
+
+const struct eeprom_ops eep_ar9300_ops = {
+        .check_eeprom = ath9k_hw_ar9300_check_eeprom,
+        .get_eeprom = ath9k_hw_ar9300_get_eeprom,
+        .fill_eeprom = ath9k_hw_ar9300_fill_eeprom,
+        .get_eeprom_ver = ath9k_hw_ar9300_get_eeprom_ver,
+        .get_eeprom_rev = ath9k_hw_ar9300_get_eeprom_rev,
+        .get_num_ant_config = ath9k_hw_ar9300_get_num_ant_config,
+        .get_eeprom_antenna_cfg = ath9k_hw_ar9300_get_eeprom_antenna_cfg,
+        .set_board_values = ath9k_hw_ar9300_set_board_values,
+        .set_addac = ath9k_hw_ar9300_set_addac,
+        .set_txpower = ath9k_hw_ar9300_set_txpower,
+        .get_spur_channel = ath9k_hw_ar9300_get_spur_channel
+};
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
new file mode 100644
index 000000000000..d8c0318f416f
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -0,0 +1,323 @@
+#ifndef AR9003_EEPROM_H
+#define AR9003_EEPROM_H
+
+#include <linux/types.h>
+
+#define AR9300_EEP_VER               0xD000
+#define AR9300_EEP_VER_MINOR_MASK    0xFFF
+#define AR9300_EEP_MINOR_VER_1       0x1
+#define AR9300_EEP_MINOR_VER         AR9300_EEP_MINOR_VER_1
+
+/* 16-bit offset location start of calibration struct */
+#define AR9300_EEP_START_LOC         256
+#define AR9300_NUM_5G_CAL_PIERS      8
+#define AR9300_NUM_2G_CAL_PIERS      3
+#define AR9300_NUM_5G_20_TARGET_POWERS  8
+#define AR9300_NUM_5G_40_TARGET_POWERS  8
+#define AR9300_NUM_2G_CCK_TARGET_POWERS 2
+#define AR9300_NUM_2G_20_TARGET_POWERS  3
+#define AR9300_NUM_2G_40_TARGET_POWERS  3
+/* #define AR9300_NUM_CTLS              21 */
+#define AR9300_NUM_CTLS_5G           9
+#define AR9300_NUM_CTLS_2G           12
+#define AR9300_CTL_MODE_M            0xF
+#define AR9300_NUM_BAND_EDGES_5G     8
+#define AR9300_NUM_BAND_EDGES_2G     4
+#define AR9300_NUM_PD_GAINS          4
+#define AR9300_PD_GAINS_IN_MASK      4
+#define AR9300_PD_GAIN_ICEPTS        5
+#define AR9300_EEPROM_MODAL_SPURS    5
+#define AR9300_MAX_RATE_POWER        63
+#define AR9300_NUM_PDADC_VALUES      128
+#define AR9300_NUM_RATES             16
+#define AR9300_BCHAN_UNUSED          0xFF
+#define AR9300_MAX_PWR_RANGE_IN_HALF_DB 64
+#define AR9300_OPFLAGS_11A           0x01
+#define AR9300_OPFLAGS_11G           0x02
+#define AR9300_OPFLAGS_5G_HT40       0x04
+#define AR9300_OPFLAGS_2G_HT40       0x08
+#define AR9300_OPFLAGS_5G_HT20       0x10
+#define AR9300_OPFLAGS_2G_HT20       0x20
+#define AR9300_EEPMISC_BIG_ENDIAN    0x01
+#define AR9300_EEPMISC_WOW           0x02
+#define AR9300_CUSTOMER_DATA_SIZE    20
+
+#define FREQ2FBIN(x, y) ((y) ? ((x) - 2300) : (((x) - 4800) / 5))
+#define FBIN2FREQ(x, y) ((y) ? (2300 + x) : (4800 + 5 * x))
+#define AR9300_MAX_CHAINS            3
+#define AR9300_ANT_16S               25
+#define AR9300_FUTURE_MODAL_SZ       6
+
+#define AR9300_NUM_ANT_CHAIN_FIELDS     7
+#define AR9300_NUM_ANT_COMMON_FIELDS    4
+#define AR9300_SIZE_ANT_CHAIN_FIELD     3
+#define AR9300_SIZE_ANT_COMMON_FIELD    4
+#define AR9300_ANT_CHAIN_MASK           0x7
+#define AR9300_ANT_COMMON_MASK          0xf
+#define AR9300_CHAIN_0_IDX              0
+#define AR9300_CHAIN_1_IDX              1
+#define AR9300_CHAIN_2_IDX              2
+
+#define AR928X_NUM_ANT_CHAIN_FIELDS     6
+#define AR928X_SIZE_ANT_CHAIN_FIELD     2
+#define AR928X_ANT_CHAIN_MASK           0x3
+
+/* Delta from which to start power to pdadc table */
+/* This offset is used in both open loop and closed loop power control
+ * schemes. In open loop power control, it is not really needed, but for
+ * the "sake of consistency" it was kept. For certain AP designs, this
+ * value is overwritten by the value in the flag "pwrTableOffset" just
+ * before writing the pdadc vs pwr into the chip registers.
+ */
+#define AR9300_PWR_TABLE_OFFSET  0
+
+/* enable flags for voltage and temp compensation */
+#define ENABLE_TEMP_COMPENSATION 0x01
+#define ENABLE_VOLT_COMPENSATION 0x02
+/* byte addressable */
+#define AR9300_EEPROM_SIZE (16*1024)
+#define FIXED_CCA_THRESHOLD 15
+
+#define AR9300_BASE_ADDR 0x3ff
+
+enum targetPowerHTRates {
+        HT_TARGET_RATE_0_8_16,
+        HT_TARGET_RATE_1_3_9_11_17_19,
+        HT_TARGET_RATE_4,
+        HT_TARGET_RATE_5,
+        HT_TARGET_RATE_6,
+        HT_TARGET_RATE_7,
+        HT_TARGET_RATE_12,
+        HT_TARGET_RATE_13,
+        HT_TARGET_RATE_14,
+        HT_TARGET_RATE_15,
+        HT_TARGET_RATE_20,
+        HT_TARGET_RATE_21,
+        HT_TARGET_RATE_22,
+        HT_TARGET_RATE_23
+};
+
+enum targetPowerLegacyRates {
+        LEGACY_TARGET_RATE_6_24,
+        LEGACY_TARGET_RATE_36,
+        LEGACY_TARGET_RATE_48,
+        LEGACY_TARGET_RATE_54
+};
+
+enum targetPowerCckRates {
+        LEGACY_TARGET_RATE_1L_5L,
+        LEGACY_TARGET_RATE_5S,
+        LEGACY_TARGET_RATE_11L,
+        LEGACY_TARGET_RATE_11S
+};
+
+enum ar9300_Rates {
+        ALL_TARGET_LEGACY_6_24,
+        ALL_TARGET_LEGACY_36,
+        ALL_TARGET_LEGACY_48,
+        ALL_TARGET_LEGACY_54,
+        ALL_TARGET_LEGACY_1L_5L,
+        ALL_TARGET_LEGACY_5S,
+        ALL_TARGET_LEGACY_11L,
+        ALL_TARGET_LEGACY_11S,
+        ALL_TARGET_HT20_0_8_16,
+        ALL_TARGET_HT20_1_3_9_11_17_19,
+        ALL_TARGET_HT20_4,
+        ALL_TARGET_HT20_5,
+        ALL_TARGET_HT20_6,
+        ALL_TARGET_HT20_7,
+        ALL_TARGET_HT20_12,
+        ALL_TARGET_HT20_13,
+        ALL_TARGET_HT20_14,
+        ALL_TARGET_HT20_15,
+        ALL_TARGET_HT20_20,
+        ALL_TARGET_HT20_21,
+        ALL_TARGET_HT20_22,
+        ALL_TARGET_HT20_23,
+        ALL_TARGET_HT40_0_8_16,
+        ALL_TARGET_HT40_1_3_9_11_17_19,
+        ALL_TARGET_HT40_4,
+        ALL_TARGET_HT40_5,
+        ALL_TARGET_HT40_6,
+        ALL_TARGET_HT40_7,
+        ALL_TARGET_HT40_12,
+        ALL_TARGET_HT40_13,
+        ALL_TARGET_HT40_14,
+        ALL_TARGET_HT40_15,
+        ALL_TARGET_HT40_20,
+        ALL_TARGET_HT40_21,
+        ALL_TARGET_HT40_22,
+        ALL_TARGET_HT40_23,
+        ar9300RateSize,
+};
+
+
+struct eepFlags {
+        u8 opFlags;
+        u8 eepMisc;
+} __packed;
+
+enum CompressAlgorithm {
+        _CompressNone = 0,
+        _CompressLzma,
+        _CompressPairs,
+        _CompressBlock,
+        _Compress4,
+        _Compress5,
+        _Compress6,
+        _Compress7,
+};
+
+struct ar9300_base_eep_hdr {
+        u16 regDmn[2];
+        /* 4 bits tx and 4 bits rx */
+        u8 txrxMask;
+        struct eepFlags opCapFlags;
+        u8 rfSilent;
+        u8 blueToothOptions;
+        u8 deviceCap;
+        /* takes lower byte in eeprom location */
+        u8 deviceType;
+        /* offset in dB to be added to beginning
+         * of pdadc table in calibration
+         */
+        int8_t pwrTableOffset;
+        u8 params_for_tuning_caps[2];
+        /*
+         * bit0 - enable tx temp comp
+         * bit1 - enable tx volt comp
+         * bit2 - enable fastClock - default to 1
+         * bit3 - enable doubling - default to 1
+         * bit4 - enable internal regulator - default to 1
+         */
+        u8 featureEnable;
+        /* misc flags: bit0 - turn down drivestrength */
+        u8 miscConfiguration;
+        u8 eepromWriteEnableGpio;
+        u8 wlanDisableGpio;
+        u8 wlanLedGpio;
+        u8 rxBandSelectGpio;
+        u8 txrxgain;
+        /* SW controlled internal regulator fields */
+        u32 swreg;
+} __packed;
+
+struct ar9300_modal_eep_header {
+        /* 4 idle, t1, t2, b (4 bits per setting) */
+        u32 antCtrlCommon;
+        /* 4 ra1l1, ra2l1, ra1l2, ra2l2, ra12 */
+        u32 antCtrlCommon2;
+        /* 6 idle, t, r, rx1, rx12, b (2 bits each) */
+        u16 antCtrlChain[AR9300_MAX_CHAINS];
+        /* 3 xatten1_db for AR9280 (0xa20c/b20c 5:0) */
+        u8 xatten1DB[AR9300_MAX_CHAINS];
+        /* 3  xatten1_margin for merlin (0xa20c/b20c 16:12 */
+        u8 xatten1Margin[AR9300_MAX_CHAINS];
+        int8_t tempSlope;
+        int8_t voltSlope;
+        /* spur channels in usual fbin coding format */
+        u8 spurChans[AR9300_EEPROM_MODAL_SPURS];
+        /* 3  Check if the register is per chain */
+        int8_t noiseFloorThreshCh[AR9300_MAX_CHAINS];
+        u8 ob[AR9300_MAX_CHAINS];
+        u8 db_stage2[AR9300_MAX_CHAINS];
+        u8 db_stage3[AR9300_MAX_CHAINS];
+        u8 db_stage4[AR9300_MAX_CHAINS];
+        u8 xpaBiasLvl;
+        u8 txFrameToDataStart;
+        u8 txFrameToPaOn;
+        u8 txClip;
+        int8_t antennaGain;
+        u8 switchSettling;
+        int8_t adcDesiredSize;
+        u8 txEndToXpaOff;
+        u8 txEndToRxOn;
+        u8 txFrameToXpaOn;
+        u8 thresh62;
+        u8 futureModal[32];
+} __packed;
+
+struct ar9300_cal_data_per_freq_op_loop {
+        int8_t refPower;
+        /* pdadc voltage at power measurement */
+        u8 voltMeas;
+        /* pcdac used for power measurement   */
+        u8 tempMeas;
+        /* range is -60 to -127 create a mapping equation 1db resolution */
+        int8_t rxNoisefloorCal;
+        /*range is same as noisefloor */
+        int8_t rxNoisefloorPower;
+        /* temp measured when noisefloor cal was performed */
+        u8 rxTempMeas;
+} __packed;
+
+struct cal_tgt_pow_legacy {
+        u8 tPow2x[4];
+} __packed;
+
+struct cal_tgt_pow_ht {
+        u8 tPow2x[14];
+} __packed;
+
+struct cal_ctl_edge_pwr {
+        u8 tPower:6,
+           flag:2;
+} __packed;
+
+struct cal_ctl_data_2g {
+        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_2G];
+} __packed;
+
+struct cal_ctl_data_5g {
+        struct cal_ctl_edge_pwr ctlEdges[AR9300_NUM_BAND_EDGES_5G];
+} __packed;
+
+struct ar9300_eeprom {
+        u8 eepromVersion;
+        u8 templateVersion;
+        u8 macAddr[6];
+        u8 custData[AR9300_CUSTOMER_DATA_SIZE];
+
+        struct ar9300_base_eep_hdr baseEepHeader;
+
+        struct ar9300_modal_eep_header modalHeader2G;
+        u8 calFreqPier2G[AR9300_NUM_2G_CAL_PIERS];
+        struct ar9300_cal_data_per_freq_op_loop
+         calPierData2G[AR9300_MAX_CHAINS][AR9300_NUM_2G_CAL_PIERS];
+        u8 calTarget_freqbin_Cck[AR9300_NUM_2G_CCK_TARGET_POWERS];
+        u8 calTarget_freqbin_2G[AR9300_NUM_2G_20_TARGET_POWERS];
+        u8 calTarget_freqbin_2GHT20[AR9300_NUM_2G_20_TARGET_POWERS];
+        u8 calTarget_freqbin_2GHT40[AR9300_NUM_2G_40_TARGET_POWERS];
+        struct cal_tgt_pow_legacy
+         calTargetPowerCck[AR9300_NUM_2G_CCK_TARGET_POWERS];
+        struct cal_tgt_pow_legacy
+         calTargetPower2G[AR9300_NUM_2G_20_TARGET_POWERS];
+        struct cal_tgt_pow_ht
+         calTargetPower2GHT20[AR9300_NUM_2G_20_TARGET_POWERS];
+        struct cal_tgt_pow_ht
+         calTargetPower2GHT40[AR9300_NUM_2G_40_TARGET_POWERS];
+        u8 ctlIndex_2G[AR9300_NUM_CTLS_2G];
+        u8 ctl_freqbin_2G[AR9300_NUM_CTLS_2G][AR9300_NUM_BAND_EDGES_2G];
+        struct cal_ctl_data_2g ctlPowerData_2G[AR9300_NUM_CTLS_2G];
+        struct ar9300_modal_eep_header modalHeader5G;
+        u8 calFreqPier5G[AR9300_NUM_5G_CAL_PIERS];
+        struct ar9300_cal_data_per_freq_op_loop
+         calPierData5G[AR9300_MAX_CHAINS][AR9300_NUM_5G_CAL_PIERS];
+        u8 calTarget_freqbin_5G[AR9300_NUM_5G_20_TARGET_POWERS];
+        u8 calTarget_freqbin_5GHT20[AR9300_NUM_5G_20_TARGET_POWERS];
+        u8 calTarget_freqbin_5GHT40[AR9300_NUM_5G_40_TARGET_POWERS];
+        struct cal_tgt_pow_legacy
+         calTargetPower5G[AR9300_NUM_5G_20_TARGET_POWERS];
+        struct cal_tgt_pow_ht
+         calTargetPower5GHT20[AR9300_NUM_5G_20_TARGET_POWERS];
+        struct cal_tgt_pow_ht
+         calTargetPower5GHT40[AR9300_NUM_5G_40_TARGET_POWERS];
+        u8 ctlIndex_5G[AR9300_NUM_CTLS_5G];
+        u8 ctl_freqbin_5G[AR9300_NUM_CTLS_5G][AR9300_NUM_BAND_EDGES_5G];
+        struct cal_ctl_data_5g ctlPowerData_5G[AR9300_NUM_CTLS_5G];
+} __packed;
+
+s32 ar9003_hw_get_tx_gain_idx(struct ath_hw *ah);
+s32 ar9003_hw_get_rx_gain_idx(struct ath_hw *ah);
+
+#endif
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
new file mode 100644
index 000000000000..b15309caf1da
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -0,0 +1,205 @@
+/*
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ar9003_mac.h"
+#include "ar9003_initvals.h"
+
+/* General hardware code for the AR9003 hadware family */
+
+static bool ar9003_hw_macversion_supported(u32 macversion)
+{
+        switch (macversion) {
+        case AR_SREV_VERSION_9300:
+                return true;
+        default:
+                break;
+        }
+        return false;
+}
+
+/* AR9003 2.0 - new INI format (pre, core, post arrays per subsystem) */
+/*
+ * XXX: move TX/RX gain INI to its own init_mode_gain_regs after
+ * ensuring it does not affect hardware bring up
+ */
+static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
+{
+        /* mac */
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                       ar9300_2p0_mac_core,
+                       ARRAY_SIZE(ar9300_2p0_mac_core), 2);
+        INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                       ar9300_2p0_mac_postamble,
+                       ARRAY_SIZE(ar9300_2p0_mac_postamble), 5);
+
+        /* bb */
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                       ar9300_2p0_baseband_core,
+                       ARRAY_SIZE(ar9300_2p0_baseband_core), 2);
+        INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                       ar9300_2p0_baseband_postamble,
+                       ARRAY_SIZE(ar9300_2p0_baseband_postamble), 5);
+
+        /* radio */
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_PRE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                       ar9300_2p0_radio_core,
+                       ARRAY_SIZE(ar9300_2p0_radio_core), 2);
+        INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                       ar9300_2p0_radio_postamble,
+                       ARRAY_SIZE(ar9300_2p0_radio_postamble), 5);
+
+        /* soc */
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                       ar9300_2p0_soc_preamble,
+                       ARRAY_SIZE(ar9300_2p0_soc_preamble), 2);
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_CORE], NULL, 0, 0);
+        INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                       ar9300_2p0_soc_postamble,
+                       ARRAY_SIZE(ar9300_2p0_soc_postamble), 5);
+
+        /* rx/tx gain */
+        INIT_INI_ARRAY(&ah->iniModesRxGain,
+                       ar9300Common_rx_gain_table_2p0,
+                       ARRAY_SIZE(ar9300Common_rx_gain_table_2p0), 2);
+        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                       ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
+                       ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
+                       5);
+
+        /* Load PCIE SERDES settings from INI */
+
+        /* Awake Setting */
+
+        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                       ar9300PciePhy_pll_on_clkreq_disable_L1_2p0,
+                       ARRAY_SIZE(ar9300PciePhy_pll_on_clkreq_disable_L1_2p0),
+                       2);
+
+        /* Sleep Setting */
+
+        INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                       ar9300PciePhy_clkreq_enable_L1_2p0,
+                       ARRAY_SIZE(ar9300PciePhy_clkreq_enable_L1_2p0),
+                       2);
+
+        /* Fast clock modal settings */
+        INIT_INI_ARRAY(&ah->iniModesAdditional,
+                       ar9300Modes_fast_clock_2p0,
+                       ARRAY_SIZE(ar9300Modes_fast_clock_2p0),
+                       3);
+}
+
+static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
+{
+        switch (ar9003_hw_get_tx_gain_idx(ah)) {
+        case 0:
+        default:
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_lowest_ob_db_tx_gain_table_2p0,
+                               ARRAY_SIZE(ar9300Modes_lowest_ob_db_tx_gain_table_2p0),
+                               5);
+                break;
+        case 1:
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_high_ob_db_tx_gain_table_2p0,
+                               ARRAY_SIZE(ar9300Modes_high_ob_db_tx_gain_table_2p0),
+                               5);
+                break;
+        case 2:
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9300Modes_low_ob_db_tx_gain_table_2p0,
+                               ARRAY_SIZE(ar9300Modes_low_ob_db_tx_gain_table_2p0),
+                               5);
+                break;
+        }
+}
+
+static void ar9003_rx_gain_table_apply(struct ath_hw *ah)
+{
+        switch (ar9003_hw_get_rx_gain_idx(ah)) {
+        case 0:
+        default:
+                INIT_INI_ARRAY(&ah->iniModesRxGain, ar9300Common_rx_gain_table_2p0,
+                               ARRAY_SIZE(ar9300Common_rx_gain_table_2p0),
+                               2);
+                break;
+        case 1:
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9300Common_wo_xlna_rx_gain_table_2p0,
+                               ARRAY_SIZE(ar9300Common_wo_xlna_rx_gain_table_2p0),
+                               2);
+                break;
+        }
+}
+
+/* set gain table pointers according to values read from the eeprom */
+static void ar9003_hw_init_mode_gain_regs(struct ath_hw *ah)
+{
+        ar9003_tx_gain_table_apply(ah);
+        ar9003_rx_gain_table_apply(ah);
+}
+
+/*
+ * Helper for ASPM support.
+ *
+ * Disable PLL when in L0s as well as receiver clock when in L1.
+ * This power saving option must be enabled through the SerDes.
+ *
+ * Programming the SerDes must go through the same 288 bit serial shift
+ * register as the other analog registers.  Hence the 9 writes.
+ */
+static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
+                                         int restore,
+                                         int power_off)
+{
+        if (ah->is_pciexpress != true)
+                return;
+
+        /* Do not touch SerDes registers */
+        if (ah->config.pcie_powersave_enable == 2)
+                return;
+
+        /* Nothing to do on restore for 11N */
+        if (!restore) {
+                /* set bit 19 to allow forcing of pcie core into L1 state */
+                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
+
+                /* Several PCIe massages to ensure proper behaviour */
+                if (ah->config.pcie_waen)
+                        REG_WRITE(ah, AR_WA, ah->config.pcie_waen);
+        }
+}
+
+/* Sets up the AR9003 hardware familiy callbacks */
+void ar9003_hw_attach_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+        struct ath_hw_ops *ops = ath9k_hw_ops(ah);
+
+        priv_ops->init_mode_regs = ar9003_hw_init_mode_regs;
+        priv_ops->init_mode_gain_regs = ar9003_hw_init_mode_gain_regs;
+        priv_ops->macversion_supported = ar9003_hw_macversion_supported;
+
+        ops->config_pci_powersave = ar9003_hw_configpcipowersave;
+
+        ar9003_hw_attach_phy_ops(ah);
+        ar9003_hw_attach_calib_ops(ah);
+        ar9003_hw_attach_mac_ops(ah);
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
new file mode 100644
index 000000000000..a131cd10ef29
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_initvals.h
@@ -0,0 +1,1784 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_9003_H
+#define INITVALS_9003_H
+
+/* AR9003 2.0 */
+
+static const u32 ar9300_2p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0001609c, 0x0dd08f29, 0x0dd08f29, 0x0b283f31, 0x0b283f31},
+        {0x000160ac, 0xa4653c00, 0xa4653c00, 0x24652800, 0x24652800},
+        {0x000160b0, 0x03284f3e, 0x03284f3e, 0x05d08f20, 0x05d08f20},
+        {0x0001610c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0001650c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0001690c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+};
+
+static const u32 ar9300Modes_lowest_ob_db_tx_gain_table_2p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
+        {0x0000a598, 0x21820220, 0x21820220, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x27820223, 0x27820223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x60001a61, 0x60001a61, 0x60001a61, 0x60001a61},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x60001a61, 0x60001a61, 0x60001a61, 0x60001a61},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x60001a61, 0x60001a61, 0x60001a61, 0x60001a61},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300Modes_fast_clock_2p0[][3] = {
+        /* Addr      5G_HT20     5G_HT40   */
+        {0x00001030, 0x00000268, 0x000004d0},
+        {0x00001070, 0x0000018c, 0x00000318},
+        {0x000010b0, 0x00000fd0, 0x00001fa0},
+        {0x00008014, 0x044c044c, 0x08980898},
+        {0x0000801c, 0x148ec02b, 0x148ec057},
+        {0x00008318, 0x000044c0, 0x00008980},
+        {0x00009e00, 0x03721821, 0x03721821},
+        {0x0000a230, 0x0000000b, 0x00000016},
+        {0x0000a254, 0x00000898, 0x00001130},
+};
+
+static const u32 ar9300_2p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x7f80fff8},
+        {0x0001604c, 0x76d005b5},
+        {0x00016050, 0x556cf031},
+        {0x00016054, 0x43449440},
+        {0x00016058, 0x0c51c92c},
+        {0x0001605c, 0x3db7fffc},
+        {0x00016060, 0xfffffffc},
+        {0x00016064, 0x000f0278},
+        {0x0001606c, 0x6db60000},
+        {0x00016080, 0x00000000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x54214514},
+        {0x0001608c, 0x119f481e},
+        {0x00016090, 0x24926490},
+        {0x00016098, 0xd2888888},
+        {0x000160a0, 0x0a108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x00adb6d0},
+        {0x000160c4, 0x6db6db60},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x01e6c000},
+        {0x00016100, 0x3fffbe01},
+        {0x00016104, 0xfff80000},
+        {0x00016108, 0x00080010},
+        {0x00016140, 0x10804008},
+        {0x00016144, 0x02084080},
+        {0x00016148, 0x00000000},
+        {0x00016280, 0x058a0001},
+        {0x00016284, 0x3d840208},
+        {0x00016288, 0x01a20408},
+        {0x0001628c, 0x00038c07},
+        {0x00016290, 0x40000004},
+        {0x00016294, 0x458aa14f},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x7f80fff8},
+        {0x0001644c, 0x76d005b5},
+        {0x00016450, 0x556cf031},
+        {0x00016454, 0x43449440},
+        {0x00016458, 0x0c51c92c},
+        {0x0001645c, 0x3db7fffc},
+        {0x00016460, 0xfffffffc},
+        {0x00016464, 0x000f0278},
+        {0x0001646c, 0x6db60000},
+        {0x00016500, 0x3fffbe01},
+        {0x00016504, 0xfff80000},
+        {0x00016508, 0x00080010},
+        {0x00016540, 0x10804008},
+        {0x00016544, 0x02084080},
+        {0x00016548, 0x00000000},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+        {0x00016800, 0x36db6db6},
+        {0x00016804, 0x6db6db40},
+        {0x00016808, 0x73f00000},
+        {0x0001680c, 0x00000000},
+        {0x00016840, 0x7f80fff8},
+        {0x0001684c, 0x76d005b5},
+        {0x00016850, 0x556cf031},
+        {0x00016854, 0x43449440},
+        {0x00016858, 0x0c51c92c},
+        {0x0001685c, 0x3db7fffc},
+        {0x00016860, 0xfffffffc},
+        {0x00016864, 0x000f0278},
+        {0x0001686c, 0x6db60000},
+        {0x00016900, 0x3fffbe01},
+        {0x00016904, 0xfff80000},
+        {0x00016908, 0x00080010},
+        {0x00016940, 0x10804008},
+        {0x00016944, 0x02084080},
+        {0x00016948, 0x00000000},
+        {0x00016b80, 0x00000000},
+        {0x00016b84, 0x00000000},
+        {0x00016b88, 0x00800700},
+        {0x00016b8c, 0x00800700},
+        {0x00016b90, 0x00800700},
+        {0x00016b94, 0x00000000},
+        {0x00016b98, 0x00000000},
+        {0x00016b9c, 0x00000000},
+        {0x00016ba0, 0x00000001},
+        {0x00016ba4, 0x00000001},
+        {0x00016ba8, 0x00000000},
+        {0x00016bac, 0x00000000},
+        {0x00016bb0, 0x00000000},
+        {0x00016bb4, 0x00000000},
+        {0x00016bb8, 0x00000000},
+        {0x00016bbc, 0x00000000},
+        {0x00016bc0, 0x000000a0},
+        {0x00016bc4, 0x000c0000},
+        {0x00016bc8, 0x14021402},
+        {0x00016bcc, 0x00001402},
+        {0x00016bd0, 0x00000000},
+        {0x00016bd4, 0x00000000},
+};
+
+static const u32 ar9300Common_rx_gain_table_merlin_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x02000101},
+        {0x0000a004, 0x02000102},
+        {0x0000a008, 0x02000103},
+        {0x0000a00c, 0x02000104},
+        {0x0000a010, 0x02000200},
+        {0x0000a014, 0x02000201},
+        {0x0000a018, 0x02000202},
+        {0x0000a01c, 0x02000203},
+        {0x0000a020, 0x02000204},
+        {0x0000a024, 0x02000205},
+        {0x0000a028, 0x02000208},
+        {0x0000a02c, 0x02000302},
+        {0x0000a030, 0x02000303},
+        {0x0000a034, 0x02000304},
+        {0x0000a038, 0x02000400},
+        {0x0000a03c, 0x02010300},
+        {0x0000a040, 0x02010301},
+        {0x0000a044, 0x02010302},
+        {0x0000a048, 0x02000500},
+        {0x0000a04c, 0x02010400},
+        {0x0000a050, 0x02020300},
+        {0x0000a054, 0x02020301},
+        {0x0000a058, 0x02020302},
+        {0x0000a05c, 0x02020303},
+        {0x0000a060, 0x02020400},
+        {0x0000a064, 0x02030300},
+        {0x0000a068, 0x02030301},
+        {0x0000a06c, 0x02030302},
+        {0x0000a070, 0x02030303},
+        {0x0000a074, 0x02030400},
+        {0x0000a078, 0x02040300},
+        {0x0000a07c, 0x02040301},
+        {0x0000a080, 0x02040302},
+        {0x0000a084, 0x02040303},
+        {0x0000a088, 0x02030500},
+        {0x0000a08c, 0x02040400},
+        {0x0000a090, 0x02050203},
+        {0x0000a094, 0x02050204},
+        {0x0000a098, 0x02050205},
+        {0x0000a09c, 0x02040500},
+        {0x0000a0a0, 0x02050301},
+        {0x0000a0a4, 0x02050302},
+        {0x0000a0a8, 0x02050303},
+        {0x0000a0ac, 0x02050400},
+        {0x0000a0b0, 0x02050401},
+        {0x0000a0b4, 0x02050402},
+        {0x0000a0b8, 0x02050403},
+        {0x0000a0bc, 0x02050500},
+        {0x0000a0c0, 0x02050501},
+        {0x0000a0c4, 0x02050502},
+        {0x0000a0c8, 0x02050503},
+        {0x0000a0cc, 0x02050504},
+        {0x0000a0d0, 0x02050600},
+        {0x0000a0d4, 0x02050601},
+        {0x0000a0d8, 0x02050602},
+        {0x0000a0dc, 0x02050603},
+        {0x0000a0e0, 0x02050604},
+        {0x0000a0e4, 0x02050700},
+        {0x0000a0e8, 0x02050701},
+        {0x0000a0ec, 0x02050702},
+        {0x0000a0f0, 0x02050703},
+        {0x0000a0f4, 0x02050704},
+        {0x0000a0f8, 0x02050705},
+        {0x0000a0fc, 0x02050708},
+        {0x0000a100, 0x02050709},
+        {0x0000a104, 0x0205070a},
+        {0x0000a108, 0x0205070b},
+        {0x0000a10c, 0x0205070c},
+        {0x0000a110, 0x0205070d},
+        {0x0000a114, 0x02050710},
+        {0x0000a118, 0x02050711},
+        {0x0000a11c, 0x02050712},
+        {0x0000a120, 0x02050713},
+        {0x0000a124, 0x02050714},
+        {0x0000a128, 0x02050715},
+        {0x0000a12c, 0x02050730},
+        {0x0000a130, 0x02050731},
+        {0x0000a134, 0x02050732},
+        {0x0000a138, 0x02050733},
+        {0x0000a13c, 0x02050734},
+        {0x0000a140, 0x02050735},
+        {0x0000a144, 0x02050750},
+        {0x0000a148, 0x02050751},
+        {0x0000a14c, 0x02050752},
+        {0x0000a150, 0x02050753},
+        {0x0000a154, 0x02050754},
+        {0x0000a158, 0x02050755},
+        {0x0000a15c, 0x02050770},
+        {0x0000a160, 0x02050771},
+        {0x0000a164, 0x02050772},
+        {0x0000a168, 0x02050773},
+        {0x0000a16c, 0x02050774},
+        {0x0000a170, 0x02050775},
+        {0x0000a174, 0x00000776},
+        {0x0000a178, 0x00000776},
+        {0x0000a17c, 0x00000776},
+        {0x0000a180, 0x00000776},
+        {0x0000a184, 0x00000776},
+        {0x0000a188, 0x00000776},
+        {0x0000a18c, 0x00000776},
+        {0x0000a190, 0x00000776},
+        {0x0000a194, 0x00000776},
+        {0x0000a198, 0x00000776},
+        {0x0000a19c, 0x00000776},
+        {0x0000a1a0, 0x00000776},
+        {0x0000a1a4, 0x00000776},
+        {0x0000a1a8, 0x00000776},
+        {0x0000a1ac, 0x00000776},
+        {0x0000a1b0, 0x00000776},
+        {0x0000a1b4, 0x00000776},
+        {0x0000a1b8, 0x00000776},
+        {0x0000a1bc, 0x00000776},
+        {0x0000a1c0, 0x00000776},
+        {0x0000a1c4, 0x00000776},
+        {0x0000a1c8, 0x00000776},
+        {0x0000a1cc, 0x00000776},
+        {0x0000a1d0, 0x00000776},
+        {0x0000a1d4, 0x00000776},
+        {0x0000a1d8, 0x00000776},
+        {0x0000a1dc, 0x00000776},
+        {0x0000a1e0, 0x00000776},
+        {0x0000a1e4, 0x00000776},
+        {0x0000a1e8, 0x00000776},
+        {0x0000a1ec, 0x00000776},
+        {0x0000a1f0, 0x00000776},
+        {0x0000a1f4, 0x00000776},
+        {0x0000a1f8, 0x00000776},
+        {0x0000a1fc, 0x00000776},
+        {0x0000b000, 0x02000101},
+        {0x0000b004, 0x02000102},
+        {0x0000b008, 0x02000103},
+        {0x0000b00c, 0x02000104},
+        {0x0000b010, 0x02000200},
+        {0x0000b014, 0x02000201},
+        {0x0000b018, 0x02000202},
+        {0x0000b01c, 0x02000203},
+        {0x0000b020, 0x02000204},
+        {0x0000b024, 0x02000205},
+        {0x0000b028, 0x02000208},
+        {0x0000b02c, 0x02000302},
+        {0x0000b030, 0x02000303},
+        {0x0000b034, 0x02000304},
+        {0x0000b038, 0x02000400},
+        {0x0000b03c, 0x02010300},
+        {0x0000b040, 0x02010301},
+        {0x0000b044, 0x02010302},
+        {0x0000b048, 0x02000500},
+        {0x0000b04c, 0x02010400},
+        {0x0000b050, 0x02020300},
+        {0x0000b054, 0x02020301},
+        {0x0000b058, 0x02020302},
+        {0x0000b05c, 0x02020303},
+        {0x0000b060, 0x02020400},
+        {0x0000b064, 0x02030300},
+        {0x0000b068, 0x02030301},
+        {0x0000b06c, 0x02030302},
+        {0x0000b070, 0x02030303},
+        {0x0000b074, 0x02030400},
+        {0x0000b078, 0x02040300},
+        {0x0000b07c, 0x02040301},
+        {0x0000b080, 0x02040302},
+        {0x0000b084, 0x02040303},
+        {0x0000b088, 0x02030500},
+        {0x0000b08c, 0x02040400},
+        {0x0000b090, 0x02050203},
+        {0x0000b094, 0x02050204},
+        {0x0000b098, 0x02050205},
+        {0x0000b09c, 0x02040500},
+        {0x0000b0a0, 0x02050301},
+        {0x0000b0a4, 0x02050302},
+        {0x0000b0a8, 0x02050303},
+        {0x0000b0ac, 0x02050400},
+        {0x0000b0b0, 0x02050401},
+        {0x0000b0b4, 0x02050402},
+        {0x0000b0b8, 0x02050403},
+        {0x0000b0bc, 0x02050500},
+        {0x0000b0c0, 0x02050501},
+        {0x0000b0c4, 0x02050502},
+        {0x0000b0c8, 0x02050503},
+        {0x0000b0cc, 0x02050504},
+        {0x0000b0d0, 0x02050600},
+        {0x0000b0d4, 0x02050601},
+        {0x0000b0d8, 0x02050602},
+        {0x0000b0dc, 0x02050603},
+        {0x0000b0e0, 0x02050604},
+        {0x0000b0e4, 0x02050700},
+        {0x0000b0e8, 0x02050701},
+        {0x0000b0ec, 0x02050702},
+        {0x0000b0f0, 0x02050703},
+        {0x0000b0f4, 0x02050704},
+        {0x0000b0f8, 0x02050705},
+        {0x0000b0fc, 0x02050708},
+        {0x0000b100, 0x02050709},
+        {0x0000b104, 0x0205070a},
+        {0x0000b108, 0x0205070b},
+        {0x0000b10c, 0x0205070c},
+        {0x0000b110, 0x0205070d},
+        {0x0000b114, 0x02050710},
+        {0x0000b118, 0x02050711},
+        {0x0000b11c, 0x02050712},
+        {0x0000b120, 0x02050713},
+        {0x0000b124, 0x02050714},
+        {0x0000b128, 0x02050715},
+        {0x0000b12c, 0x02050730},
+        {0x0000b130, 0x02050731},
+        {0x0000b134, 0x02050732},
+        {0x0000b138, 0x02050733},
+        {0x0000b13c, 0x02050734},
+        {0x0000b140, 0x02050735},
+        {0x0000b144, 0x02050750},
+        {0x0000b148, 0x02050751},
+        {0x0000b14c, 0x02050752},
+        {0x0000b150, 0x02050753},
+        {0x0000b154, 0x02050754},
+        {0x0000b158, 0x02050755},
+        {0x0000b15c, 0x02050770},
+        {0x0000b160, 0x02050771},
+        {0x0000b164, 0x02050772},
+        {0x0000b168, 0x02050773},
+        {0x0000b16c, 0x02050774},
+        {0x0000b170, 0x02050775},
+        {0x0000b174, 0x00000776},
+        {0x0000b178, 0x00000776},
+        {0x0000b17c, 0x00000776},
+        {0x0000b180, 0x00000776},
+        {0x0000b184, 0x00000776},
+        {0x0000b188, 0x00000776},
+        {0x0000b18c, 0x00000776},
+        {0x0000b190, 0x00000776},
+        {0x0000b194, 0x00000776},
+        {0x0000b198, 0x00000776},
+        {0x0000b19c, 0x00000776},
+        {0x0000b1a0, 0x00000776},
+        {0x0000b1a4, 0x00000776},
+        {0x0000b1a8, 0x00000776},
+        {0x0000b1ac, 0x00000776},
+        {0x0000b1b0, 0x00000776},
+        {0x0000b1b4, 0x00000776},
+        {0x0000b1b8, 0x00000776},
+        {0x0000b1bc, 0x00000776},
+        {0x0000b1c0, 0x00000776},
+        {0x0000b1c4, 0x00000776},
+        {0x0000b1c8, 0x00000776},
+        {0x0000b1cc, 0x00000776},
+        {0x0000b1d0, 0x00000776},
+        {0x0000b1d4, 0x00000776},
+        {0x0000b1d8, 0x00000776},
+        {0x0000b1dc, 0x00000776},
+        {0x0000b1e0, 0x00000776},
+        {0x0000b1e4, 0x00000776},
+        {0x0000b1e8, 0x00000776},
+        {0x0000b1ec, 0x00000776},
+        {0x0000b1f0, 0x00000776},
+        {0x0000b1f4, 0x00000776},
+        {0x0000b1f8, 0x00000776},
+        {0x0000b1fc, 0x00000776},
+};
+
+static const u32 ar9300_2p0_mac_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
+};
+
+static const u32 ar9300_2p0_soc_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00007010, 0x00000023, 0x00000023, 0x00000022, 0x00000022},
+};
+
+static const u32 ar9200_merlin_2p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00007800, 0x00040000},
+        {0x00007804, 0xdb005012},
+        {0x00007808, 0x04924914},
+        {0x0000780c, 0x21084210},
+        {0x00007810, 0x6d801300},
+        {0x00007814, 0x0019beff},
+        {0x00007818, 0x07e41000},
+        {0x0000781c, 0x00392000},
+        {0x00007820, 0x92592480},
+        {0x00007824, 0x00040000},
+        {0x00007828, 0xdb005012},
+        {0x0000782c, 0x04924914},
+        {0x00007830, 0x21084210},
+        {0x00007834, 0x6d801300},
+        {0x00007838, 0x0019beff},
+        {0x0000783c, 0x07e40000},
+        {0x00007840, 0x00392000},
+        {0x00007844, 0x92592480},
+        {0x00007848, 0x00100000},
+        {0x0000784c, 0x773f0567},
+        {0x00007850, 0x54214514},
+        {0x00007854, 0x12035828},
+        {0x00007858, 0x92592692},
+        {0x0000785c, 0x00000000},
+        {0x00007860, 0x56400000},
+        {0x00007864, 0x0a8e370e},
+        {0x00007868, 0xc0102850},
+        {0x0000786c, 0x812d4000},
+        {0x00007870, 0x807ec400},
+        {0x00007874, 0x001b6db0},
+        {0x00007878, 0x00376b63},
+        {0x0000787c, 0x06db6db6},
+        {0x00007880, 0x006d8000},
+        {0x00007884, 0xffeffffe},
+        {0x00007888, 0xffeffffe},
+        {0x0000788c, 0x00010000},
+        {0x00007890, 0x02060aeb},
+        {0x00007894, 0x5a108000},
+};
+
+static const u32 ar9300_2p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8005},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x0000059c},
+        {0x00009c00, 0x00000044, 0x000000c4, 0x000000c4, 0x00000044},
+        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e44, 0x02321e27, 0x02321e27, 0x02282324, 0x02282324},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302010, 0x50302010},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x000037c0, 0x000037c4, 0x000037c4, 0x000037c0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071982},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+        {0x0000b830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be04, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000be18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000be1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000be20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000c284, 0x00000000, 0x00000000, 0x00000150, 0x00000150},
+};
+
+static const u32 ar9300_2p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x9280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x5f3ca3de},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14750600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x52440bbe},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038233c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e3c, 0xcf946222},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009e54, 0x00000000},
+        {0x00009fc0, 0x803e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x01193b93},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a22c, 0x01036a1e},
+        {0x0000a234, 0x10000fff},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a2a0, 0x00000001},
+        {0x0000a2c0, 0x00000001},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2cc, 0x18c43433},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2dc, 0x00000000},
+        {0x0000a2e0, 0x00000000},
+        {0x0000a2e4, 0x00000000},
+        {0x0000a2e8, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
+        {0x0000a3a4, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa},
+        {0x0000a3ac, 0x3c466478},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000246},
+        {0x0000a3f8, 0x0cdbd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x7d001dce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00000000},
+        {0x0000a440, 0x00000000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x07000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00000000},
+        {0x0000a610, 0x00000000},
+        {0x0000a614, 0x00000000},
+        {0x0000a618, 0x00000000},
+        {0x0000a61c, 0x00000000},
+        {0x0000a620, 0x00000000},
+        {0x0000a624, 0x00000000},
+        {0x0000a628, 0x00000000},
+        {0x0000a62c, 0x00000000},
+        {0x0000a630, 0x00000000},
+        {0x0000a634, 0x00000000},
+        {0x0000a638, 0x00000000},
+        {0x0000a63c, 0x00000000},
+        {0x0000a640, 0x00000000},
+        {0x0000a644, 0x3ffd9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00000637},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x00000838},
+        {0x0000a7c0, 0x00000000},
+        {0x0000a7c4, 0xfffffffc},
+        {0x0000a7c8, 0x00000000},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000001},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2dc, 0x00000000},
+        {0x0000b2e0, 0x00000000},
+        {0x0000b2e4, 0x00000000},
+        {0x0000b2e8, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+        {0x0000b8d0, 0x004b6a8e},
+        {0x0000b8d4, 0x00000820},
+        {0x0000b8dc, 0x00000000},
+        {0x0000b8f0, 0x00000000},
+        {0x0000b8f4, 0x00000000},
+        {0x0000c2d0, 0x00000080},
+        {0x0000c2d4, 0x00000000},
+        {0x0000c2dc, 0x00000000},
+        {0x0000c2e0, 0x00000000},
+        {0x0000c2e4, 0x00000000},
+        {0x0000c2e8, 0x00000000},
+        {0x0000c2ec, 0x00000000},
+        {0x0000c2f0, 0x00000000},
+        {0x0000c2f4, 0x00000000},
+        {0x0000c2f8, 0x00000000},
+        {0x0000c408, 0x0e79e5c0},
+        {0x0000c40c, 0x00820820},
+        {0x0000c420, 0x00000000},
+};
+
+static const u32 ar9300Modes_high_power_tx_gain_table_2p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050db, 0x000050db, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00020220, 0x00020220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06020223, 0x06020223, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
+        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x34043643, 0x34043643, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x38043a44, 0x38043a44, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x3b043e45, 0x3b043e45, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x40063e46, 0x40063e46, 0x34001640, 0x34001640},
+        {0x0000a540, 0x44083e46, 0x44083e46, 0x38001660, 0x38001660},
+        {0x0000a544, 0x46083e66, 0x46083e66, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x4b0a3e69, 0x4b0a3e69, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x4f0a5e66, 0x4f0a5e66, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x540a7e66, 0x540a7e66, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x570a7e89, 0x570a7e89, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x5c0e7e8a, 0x5c0e7e8a, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x60127e8b, 0x60127e8b, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x65127ecc, 0x65127ecc, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6b169ecd, 0x6b169ecd, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x70169f0e, 0x70169f0e, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00820220, 0x00820220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06820223, 0x06820223, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x18822622, 0x18822622, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1b822822, 0x1b822822, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x20822842, 0x20822842, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x22822c41, 0x22822c41, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x34843643, 0x34843643, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x38843a44, 0x38843a44, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x3b843e45, 0x3b843e45, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x40863e46, 0x40863e46, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x4c8a3065, 0x44883e46, 0x44883e46, 0x38801660},
+        {0x0000a5c4, 0x46883e66, 0x46883e66, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x4b8a3e69, 0x4b8a3e69, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x4f8a5e66, 0x4f8a5e66, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x548a7e66, 0x548a7e66, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x578a7e89, 0x578a7e89, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x5c8e7e8a, 0x5c8e7e8a, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x60927e8b, 0x60927e8b, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x65927ecc, 0x65927ecc, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6b969ecd, 0x6b969ecd, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x70969f0e, 0x70969f0e, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x00016044, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016048, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016068, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+        {0x00016444, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016448, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016468, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+        {0x00016844, 0x056db2e6, 0x056db2e6, 0x056db2e6, 0x056db2e6},
+        {0x00016848, 0xad241a61, 0xad241a61, 0xad241a61, 0xad241a61},
+        {0x00016868, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c, 0x6eb6db6c},
+};
+
+static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050db, 0x000050db, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00020220, 0x00020220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06020223, 0x06020223, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
+        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x34043643, 0x34043643, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x38043a44, 0x38043a44, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x3b043e45, 0x3b043e45, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x40063e46, 0x40063e46, 0x34001640, 0x34001640},
+        {0x0000a540, 0x44083e46, 0x44083e46, 0x38001660, 0x38001660},
+        {0x0000a544, 0x46083e66, 0x46083e66, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x4b0a3e69, 0x4b0a3e69, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x4f0a5e66, 0x4f0a5e66, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x540a7e66, 0x540a7e66, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x570a7e89, 0x570a7e89, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x5c0e7e8a, 0x5c0e7e8a, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x60127e8b, 0x60127e8b, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x65127ecc, 0x65127ecc, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6b169ecd, 0x6b169ecd, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x70169f0e, 0x70169f0e, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x75169f4f, 0x75169f4f, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00820220, 0x00820220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06820223, 0x06820223, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a822220, 0x0a822220, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0f822223, 0x0f822223, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x14822620, 0x14822620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x18822622, 0x18822622, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1b822822, 0x1b822822, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x20822842, 0x20822842, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x22822c41, 0x22822c41, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x28823042, 0x28823042, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2c823044, 0x2c823044, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x2f823644, 0x2f823644, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x34843643, 0x34843643, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x38843a44, 0x38843a44, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x3b843e45, 0x3b843e45, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x40863e46, 0x40863e46, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x44883e46, 0x44883e46, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x46883e66, 0x46883e66, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x4b8a3e69, 0x4b8a3e69, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x4f8a5e66, 0x4f8a5e66, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x548a7e66, 0x548a7e66, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x578a7e89, 0x578a7e89, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x5c8e7e8a, 0x5c8e7e8a, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x60927e8b, 0x60927e8b, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x65927ecc, 0x65927ecc, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6b969ecd, 0x6b969ecd, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x70969f0e, 0x70969f0e, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x75969f4f, 0x75969f4f, 0x56801eec, 0x56801eec},
+        {0x00016044, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016048, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016448, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x056db2e4, 0x056db2e4, 0x056db2e4, 0x056db2e4},
+        {0x00016848, 0x8c001a61, 0x8c001a61, 0x8c001a61, 0x8c001a61},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300Common_rx_gain_table_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x01800082},
+        {0x0000a014, 0x01820181},
+        {0x0000a018, 0x01840183},
+        {0x0000a01c, 0x01880185},
+        {0x0000a020, 0x018a0189},
+        {0x0000a024, 0x02850284},
+        {0x0000a028, 0x02890288},
+        {0x0000a02c, 0x028b028a},
+        {0x0000a030, 0x028d028c},
+        {0x0000a034, 0x02910290},
+        {0x0000a038, 0x02930292},
+        {0x0000a03c, 0x03910390},
+        {0x0000a040, 0x03930392},
+        {0x0000a044, 0x03950394},
+        {0x0000a048, 0x00000396},
+        {0x0000a04c, 0x00000000},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x28282828},
+        {0x0000a084, 0x21212128},
+        {0x0000a088, 0x21212121},
+        {0x0000a08c, 0x1c1c1c21},
+        {0x0000a090, 0x1c1c1c1c},
+        {0x0000a094, 0x17171c1c},
+        {0x0000a098, 0x02020212},
+        {0x0000a09c, 0x02020202},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x011f0100},
+        {0x0000a0c8, 0x011d011e},
+        {0x0000a0cc, 0x011b011c},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x021d021e},
+        {0x0000a0e0, 0x03010302},
+        {0x0000a0e4, 0x031f0300},
+        {0x0000a0e8, 0x0402031e},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x05010502},
+        {0x0000a0f8, 0x051f0500},
+        {0x0000a0fc, 0x0602051e},
+        {0x0000a100, 0x06000601},
+        {0x0000a104, 0x061e061f},
+        {0x0000a108, 0x0703061d},
+        {0x0000a10c, 0x07010702},
+        {0x0000a110, 0x00000700},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x011f0100},
+        {0x0000a148, 0x011d011e},
+        {0x0000a14c, 0x011b011c},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x021d021e},
+        {0x0000a160, 0x03010302},
+        {0x0000a164, 0x031f0300},
+        {0x0000a168, 0x0402031e},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x05010502},
+        {0x0000a178, 0x051f0500},
+        {0x0000a17c, 0x0602051e},
+        {0x0000a180, 0x06000601},
+        {0x0000a184, 0x061e061f},
+        {0x0000a188, 0x0703061d},
+        {0x0000a18c, 0x07010702},
+        {0x0000a190, 0x00000700},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9300Modes_low_ob_db_tx_gain_table_2p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
+        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400},
+        {0x0000a598, 0x21820220, 0x21820220, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x27820223, 0x27820223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x5d801eec, 0x5d801eec},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x64001a61, 0x64001a61, 0x64001a61, 0x64001a61},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x64001a61, 0x64001a61, 0x64001a61, 0x64001a61},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x64001a61, 0x64001a61, 0x64001a61, 0x64001a61},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+static const u32 ar9300_2p0_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x00020085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00000000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c20},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00a00000},
+        {0x000080d8, 0x00400000},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x00008170, 0x18486200},
+        {0x00008174, 0x33332210},
+        {0x00008178, 0x00000000},
+        {0x0000817c, 0x00020000},
+        {0x000081c0, 0x00000000},
+        {0x000081c4, 0x33332210},
+        {0x000081c8, 0x00000000},
+        {0x000081cc, 0x00000000},
+        {0x000081d4, 0x00000000},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f424},
+        {0x00008248, 0x00000800},
+        {0x0000824c, 0x0001e848},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x98a00010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00000140},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x00000007},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0x00ff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48105b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a0, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x000301ff},
+};
+
+static const u32 ar9300Common_wo_xlna_rx_gain_table_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x01800082},
+        {0x0000a014, 0x01820181},
+        {0x0000a018, 0x01840183},
+        {0x0000a01c, 0x01880185},
+        {0x0000a020, 0x018a0189},
+        {0x0000a024, 0x02850284},
+        {0x0000a028, 0x02890288},
+        {0x0000a02c, 0x03850384},
+        {0x0000a030, 0x03890388},
+        {0x0000a034, 0x038b038a},
+        {0x0000a038, 0x038d038c},
+        {0x0000a03c, 0x03910390},
+        {0x0000a040, 0x03930392},
+        {0x0000a044, 0x03950394},
+        {0x0000a048, 0x00000396},
+        {0x0000a04c, 0x00000000},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x28282828},
+        {0x0000a084, 0x28282828},
+        {0x0000a088, 0x28282828},
+        {0x0000a08c, 0x28282828},
+        {0x0000a090, 0x28282828},
+        {0x0000a094, 0x21212128},
+        {0x0000a098, 0x171c1c1c},
+        {0x0000a09c, 0x02020212},
+        {0x0000a0a0, 0x00000202},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x011f0100},
+        {0x0000a0c8, 0x011d011e},
+        {0x0000a0cc, 0x011b011c},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x021d021e},
+        {0x0000a0e0, 0x03010302},
+        {0x0000a0e4, 0x031f0300},
+        {0x0000a0e8, 0x0402031e},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x05010502},
+        {0x0000a0f8, 0x051f0500},
+        {0x0000a0fc, 0x0602051e},
+        {0x0000a100, 0x06000601},
+        {0x0000a104, 0x061e061f},
+        {0x0000a108, 0x0703061d},
+        {0x0000a10c, 0x07010702},
+        {0x0000a110, 0x00000700},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x011f0100},
+        {0x0000a148, 0x011d011e},
+        {0x0000a14c, 0x011b011c},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x021d021e},
+        {0x0000a160, 0x03010302},
+        {0x0000a164, 0x031f0300},
+        {0x0000a168, 0x0402031e},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x05010502},
+        {0x0000a178, 0x051f0500},
+        {0x0000a17c, 0x0602051e},
+        {0x0000a180, 0x06000601},
+        {0x0000a184, 0x061e061f},
+        {0x0000a188, 0x0703061d},
+        {0x0000a18c, 0x07010702},
+        {0x0000a190, 0x00000700},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000296},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x32323232},
+        {0x0000b084, 0x2f2f3232},
+        {0x0000b088, 0x23282a2d},
+        {0x0000b08c, 0x1c1e2123},
+        {0x0000b090, 0x14171919},
+        {0x0000b094, 0x0e0e1214},
+        {0x0000b098, 0x03050707},
+        {0x0000b09c, 0x00030303},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
+};
+
+static const u32 ar9300_2p0_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x000040a4, 0x00a0c1c9},
+        {0x00007008, 0x00000000},
+        {0x00007020, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+};
+
+static const u32 ar9300PciePhy_pll_on_clkreq_disable_L1_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08212e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+static const u32 ar9300PciePhy_clkreq_enable_L1_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08253e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+static const u32 ar9300PciePhy_clkreq_disable_L1_2p0[][2] = {
+        /* Addr      allmodes  */
+        {0x00004040, 0x08213e5e},
+        {0x00004040, 0x0008003b},
+        {0x00004044, 0x00000000},
+};
+
+#endif /* INITVALS_9003_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
new file mode 100644
index 000000000000..37ba37481a47
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -0,0 +1,614 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include "hw.h"
+#include "ar9003_mac.h"
+
+static void ar9003_hw_rx_enable(struct ath_hw *hw)
+{
+        REG_WRITE(hw, AR_CR, 0);
+}
+
+static u16 ar9003_calc_ptr_chksum(struct ar9003_txc *ads)
+{
+        int checksum;
+
+        checksum = ads->info + ads->link
+                + ads->data0 + ads->ctl3
+                + ads->data1 + ads->ctl5
+                + ads->data2 + ads->ctl7
+                + ads->data3 + ads->ctl9;
+
+        return ((checksum & 0xffff) + (checksum >> 16)) & AR_TxPtrChkSum;
+}
+
+static void ar9003_hw_set_desc_link(void *ds, u32 ds_link)
+{
+        struct ar9003_txc *ads = ds;
+
+        ads->link = ds_link;
+        ads->ctl10 &= ~AR_TxPtrChkSum;
+        ads->ctl10 |= ar9003_calc_ptr_chksum(ads);
+}
+
+static void ar9003_hw_get_desc_link(void *ds, u32 **ds_link)
+{
+        struct ar9003_txc *ads = ds;
+
+        *ds_link = &ads->link;
+}
+
+static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+{
+        u32 isr = 0;
+        u32 mask2 = 0;
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
+        u32 sync_cause = 0;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (REG_READ(ah, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) {
+                if ((REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M)
+                                == AR_RTC_STATUS_ON)
+                        isr = REG_READ(ah, AR_ISR);
+        }
+
+        sync_cause = REG_READ(ah, AR_INTR_SYNC_CAUSE) & AR_INTR_SYNC_DEFAULT;
+
+        *masked = 0;
+
+        if (!isr && !sync_cause)
+                return false;
+
+        if (isr) {
+                if (isr & AR_ISR_BCNMISC) {
+                        u32 isr2;
+                        isr2 = REG_READ(ah, AR_ISR_S2);
+
+                        mask2 |= ((isr2 & AR_ISR_S2_TIM) >>
+                                  MAP_ISR_S2_TIM);
+                        mask2 |= ((isr2 & AR_ISR_S2_DTIM) >>
+                                  MAP_ISR_S2_DTIM);
+                        mask2 |= ((isr2 & AR_ISR_S2_DTIMSYNC) >>
+                                  MAP_ISR_S2_DTIMSYNC);
+                        mask2 |= ((isr2 & AR_ISR_S2_CABEND) >>
+                                  MAP_ISR_S2_CABEND);
+                        mask2 |= ((isr2 & AR_ISR_S2_GTT) <<
+                                  MAP_ISR_S2_GTT);
+                        mask2 |= ((isr2 & AR_ISR_S2_CST) <<
+                                  MAP_ISR_S2_CST);
+                        mask2 |= ((isr2 & AR_ISR_S2_TSFOOR) >>
+                                  MAP_ISR_S2_TSFOOR);
+
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S2, isr2);
+                                isr &= ~AR_ISR_BCNMISC;
+                        }
+                }
+
+                if ((pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED))
+                        isr = REG_READ(ah, AR_ISR_RAC);
+
+                if (isr == 0xffffffff) {
+                        *masked = 0;
+                        return false;
+                }
+
+                *masked = isr & ATH9K_INT_COMMON;
+
+                if (ah->config.rx_intr_mitigation)
+                        if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
+                                *masked |= ATH9K_INT_RXLP;
+
+                if (ah->config.tx_intr_mitigation)
+                        if (isr & (AR_ISR_TXMINTR | AR_ISR_TXINTM))
+                                *masked |= ATH9K_INT_TX;
+
+                if (isr & (AR_ISR_LP_RXOK | AR_ISR_RXERR))
+                        *masked |= ATH9K_INT_RXLP;
+
+                if (isr & AR_ISR_HP_RXOK)
+                        *masked |= ATH9K_INT_RXHP;
+
+                if (isr & (AR_ISR_TXOK | AR_ISR_TXERR | AR_ISR_TXEOL)) {
+                        *masked |= ATH9K_INT_TX;
+
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                u32 s0, s1;
+                                s0 = REG_READ(ah, AR_ISR_S0);
+                                REG_WRITE(ah, AR_ISR_S0, s0);
+                                s1 = REG_READ(ah, AR_ISR_S1);
+                                REG_WRITE(ah, AR_ISR_S1, s1);
+
+                                isr &= ~(AR_ISR_TXOK | AR_ISR_TXERR |
+                                         AR_ISR_TXEOL);
+                        }
+                }
+
+                if (isr & AR_ISR_GENTMR) {
+                        u32 s5;
+
+                        if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
+                                s5 = REG_READ(ah, AR_ISR_S5_S);
+                        else
+                                s5 = REG_READ(ah, AR_ISR_S5);
+
+                        ah->intr_gen_timer_trigger =
+                                MS(s5, AR_ISR_S5_GENTIMER_TRIG);
+
+                        ah->intr_gen_timer_thresh =
+                                MS(s5, AR_ISR_S5_GENTIMER_THRESH);
+
+                        if (ah->intr_gen_timer_trigger)
+                                *masked |= ATH9K_INT_GENTIMER;
+
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S5, s5);
+                                isr &= ~AR_ISR_GENTMR;
+                        }
+
+                }
+
+                *masked |= mask2;
+
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                        REG_WRITE(ah, AR_ISR, isr);
+
+                        (void) REG_READ(ah, AR_ISR);
+                }
+        }
+
+        if (sync_cause) {
+                if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
+                        REG_WRITE(ah, AR_RC, AR_RC_HOSTIF);
+                        REG_WRITE(ah, AR_RC, 0);
+                        *masked |= ATH9K_INT_FATAL;
+                }
+
+                if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT)
+                        ath_print(common, ATH_DBG_INTERRUPT,
+                                  "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
+
+                        REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
+                (void) REG_READ(ah, AR_INTR_SYNC_CAUSE_CLR);
+
+        }
+        return true;
+}
+
+static void ar9003_hw_fill_txdesc(struct ath_hw *ah, void *ds, u32 seglen,
+                                  bool is_firstseg, bool is_lastseg,
+                                  const void *ds0, dma_addr_t buf_addr,
+                                  unsigned int qcu)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+        unsigned int descid = 0;
+
+        ads->info = (ATHEROS_VENDOR_ID << AR_DescId_S) |
+                                     (1 << AR_TxRxDesc_S) |
+                                     (1 << AR_CtrlStat_S) |
+                                     (qcu << AR_TxQcuNum_S) | 0x17;
+
+        ads->data0 = buf_addr;
+        ads->data1 = 0;
+        ads->data2 = 0;
+        ads->data3 = 0;
+
+        ads->ctl3 = (seglen << AR_BufLen_S);
+        ads->ctl3 &= AR_BufLen;
+
+        /* Fill in pointer checksum and descriptor id */
+        ads->ctl10 = ar9003_calc_ptr_chksum(ads);
+        ads->ctl10 |= (descid << AR_TxDescId_S);
+
+        if (is_firstseg) {
+                ads->ctl12 |= (is_lastseg ? 0 : AR_TxMore);
+        } else if (is_lastseg) {
+                ads->ctl11 = 0;
+                ads->ctl12 = 0;
+                ads->ctl13 = AR9003TXC_CONST(ds0)->ctl13;
+                ads->ctl14 = AR9003TXC_CONST(ds0)->ctl14;
+        } else {
+                /* XXX Intermediate descriptor in a multi-descriptor frame.*/
+                ads->ctl11 = 0;
+                ads->ctl12 = AR_TxMore;
+                ads->ctl13 = 0;
+                ads->ctl14 = 0;
+        }
+}
+
+static int ar9003_hw_proc_txdesc(struct ath_hw *ah, void *ds,
+                                 struct ath_tx_status *ts)
+{
+        struct ar9003_txs *ads;
+
+        ads = &ah->ts_ring[ah->ts_tail];
+
+        if ((ads->status8 & AR_TxDone) == 0)
+                return -EINPROGRESS;
+
+        ah->ts_tail = (ah->ts_tail + 1) % ah->ts_size;
+
+        if ((MS(ads->ds_info, AR_DescId) != ATHEROS_VENDOR_ID) ||
+            (MS(ads->ds_info, AR_TxRxDesc) != 1)) {
+                ath_print(ath9k_hw_common(ah), ATH_DBG_XMIT,
+                          "Tx Descriptor error %x\n", ads->ds_info);
+                memset(ads, 0, sizeof(*ads));
+                return -EIO;
+        }
+
+        ts->qid = MS(ads->ds_info, AR_TxQcuNum);
+        ts->desc_id = MS(ads->status1, AR_TxDescId);
+        ts->ts_seqnum = MS(ads->status8, AR_SeqNum);
+        ts->ts_tstamp = ads->status4;
+        ts->ts_status = 0;
+        ts->ts_flags  = 0;
+
+        if (ads->status3 & AR_ExcessiveRetries)
+                ts->ts_status |= ATH9K_TXERR_XRETRY;
+        if (ads->status3 & AR_Filtered)
+                ts->ts_status |= ATH9K_TXERR_FILT;
+        if (ads->status3 & AR_FIFOUnderrun) {
+                ts->ts_status |= ATH9K_TXERR_FIFO;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->status8 & AR_TxOpExceeded)
+                ts->ts_status |= ATH9K_TXERR_XTXOP;
+        if (ads->status3 & AR_TxTimerExpired)
+                ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
+
+        if (ads->status3 & AR_DescCfgErr)
+                ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
+        if (ads->status3 & AR_TxDataUnderrun) {
+                ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->status3 & AR_TxDelimUnderrun) {
+                ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
+                ath9k_hw_updatetxtriglevel(ah, true);
+        }
+        if (ads->status2 & AR_TxBaStatus) {
+                ts->ts_flags |= ATH9K_TX_BA;
+                ts->ba_low = ads->status5;
+                ts->ba_high = ads->status6;
+        }
+
+        ts->ts_rateindex = MS(ads->status8, AR_FinalTxIdx);
+
+        ts->ts_rssi = MS(ads->status7, AR_TxRSSICombined);
+        ts->ts_rssi_ctl0 = MS(ads->status2, AR_TxRSSIAnt00);
+        ts->ts_rssi_ctl1 = MS(ads->status2, AR_TxRSSIAnt01);
+        ts->ts_rssi_ctl2 = MS(ads->status2, AR_TxRSSIAnt02);
+        ts->ts_rssi_ext0 = MS(ads->status7, AR_TxRSSIAnt10);
+        ts->ts_rssi_ext1 = MS(ads->status7, AR_TxRSSIAnt11);
+        ts->ts_rssi_ext2 = MS(ads->status7, AR_TxRSSIAnt12);
+        ts->ts_shortretry = MS(ads->status3, AR_RTSFailCnt);
+        ts->ts_longretry = MS(ads->status3, AR_DataFailCnt);
+        ts->ts_virtcol = MS(ads->status3, AR_VirtRetryCnt);
+        ts->ts_antenna = 0;
+
+        ts->tid = MS(ads->status8, AR_TxTid);
+
+        memset(ads, 0, sizeof(*ads));
+
+        return 0;
+}
+
+static void ar9003_hw_set11n_txdesc(struct ath_hw *ah, void *ds,
+                u32 pktlen, enum ath9k_pkt_type type, u32 txpower,
+                u32 keyIx, enum ath9k_key_type keyType, u32 flags)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        if (txpower > ah->txpower_limit)
+                txpower = ah->txpower_limit;
+
+        txpower += ah->txpower_indexoffset;
+        if (txpower > 63)
+                txpower = 63;
+
+        ads->ctl11 = (pktlen & AR_FrameLen)
+                | (flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
+                | SM(txpower, AR_XmitPower)
+                | (flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
+                | (flags & ATH9K_TXDESC_CLRDMASK ? AR_ClrDestMask : 0)
+                | (keyIx != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0)
+                | (flags & ATH9K_TXDESC_LOWRXCHAIN ? AR_LowRxChain : 0);
+
+        ads->ctl12 =
+                (keyIx != ATH9K_TXKEYIX_INVALID ? SM(keyIx, AR_DestIdx) : 0)
+                | SM(type, AR_FrameType)
+                | (flags & ATH9K_TXDESC_NOACK ? AR_NoAck : 0)
+                | (flags & ATH9K_TXDESC_EXT_ONLY ? AR_ExtOnly : 0)
+                | (flags & ATH9K_TXDESC_EXT_AND_CTL ? AR_ExtAndCtl : 0);
+
+        ads->ctl17 = SM(keyType, AR_EncrType) |
+                     (flags & ATH9K_TXDESC_LDPC ? AR_LDPC : 0);
+        ads->ctl18 = 0;
+        ads->ctl19 = AR_Not_Sounding;
+
+        ads->ctl20 = 0;
+        ads->ctl21 = 0;
+        ads->ctl22 = 0;
+}
+
+static void ar9003_hw_set11n_ratescenario(struct ath_hw *ah, void *ds,
+                                          void *lastds,
+                                          u32 durUpdateEn, u32 rtsctsRate,
+                                          u32 rtsctsDuration,
+                                          struct ath9k_11n_rate_series series[],
+                                          u32 nseries, u32 flags)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+        struct ar9003_txc *last_ads = (struct ar9003_txc *) lastds;
+        u_int32_t ctl11;
+
+        if (flags & (ATH9K_TXDESC_RTSENA | ATH9K_TXDESC_CTSENA)) {
+                ctl11 = ads->ctl11;
+
+                if (flags & ATH9K_TXDESC_RTSENA) {
+                        ctl11 &= ~AR_CTSEnable;
+                        ctl11 |= AR_RTSEnable;
+                } else {
+                        ctl11 &= ~AR_RTSEnable;
+                        ctl11 |= AR_CTSEnable;
+                }
+
+                ads->ctl11 = ctl11;
+        } else {
+                ads->ctl11 = (ads->ctl11 & ~(AR_RTSEnable | AR_CTSEnable));
+        }
+
+        ads->ctl13 = set11nTries(series, 0)
+                |  set11nTries(series, 1)
+                |  set11nTries(series, 2)
+                |  set11nTries(series, 3)
+                |  (durUpdateEn ? AR_DurUpdateEna : 0)
+                |  SM(0, AR_BurstDur);
+
+        ads->ctl14 = set11nRate(series, 0)
+                |  set11nRate(series, 1)
+                |  set11nRate(series, 2)
+                |  set11nRate(series, 3);
+
+        ads->ctl15 = set11nPktDurRTSCTS(series, 0)
+                |  set11nPktDurRTSCTS(series, 1);
+
+        ads->ctl16 = set11nPktDurRTSCTS(series, 2)
+                |  set11nPktDurRTSCTS(series, 3);
+
+        ads->ctl18 = set11nRateFlags(series, 0)
+                |  set11nRateFlags(series, 1)
+                |  set11nRateFlags(series, 2)
+                |  set11nRateFlags(series, 3)
+                | SM(rtsctsRate, AR_RTSCTSRate);
+        ads->ctl19 = AR_Not_Sounding;
+
+        last_ads->ctl13 = ads->ctl13;
+        last_ads->ctl14 = ads->ctl14;
+}
+
+static void ar9003_hw_set11n_aggr_first(struct ath_hw *ah, void *ds,
+                                        u32 aggrLen)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        ads->ctl12 |= (AR_IsAggr | AR_MoreAggr);
+
+        ads->ctl17 &= ~AR_AggrLen;
+        ads->ctl17 |= SM(aggrLen, AR_AggrLen);
+}
+
+static void ar9003_hw_set11n_aggr_middle(struct ath_hw *ah, void *ds,
+                                         u32 numDelims)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+        unsigned int ctl17;
+
+        ads->ctl12 |= (AR_IsAggr | AR_MoreAggr);
+
+        /*
+         * We use a stack variable to manipulate ctl6 to reduce uncached
+         * read modify, modfiy, write.
+         */
+        ctl17 = ads->ctl17;
+        ctl17 &= ~AR_PadDelim;
+        ctl17 |= SM(numDelims, AR_PadDelim);
+        ads->ctl17 = ctl17;
+}
+
+static void ar9003_hw_set11n_aggr_last(struct ath_hw *ah, void *ds)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        ads->ctl12 |= AR_IsAggr;
+        ads->ctl12 &= ~AR_MoreAggr;
+        ads->ctl17 &= ~AR_PadDelim;
+}
+
+static void ar9003_hw_clr11n_aggr(struct ath_hw *ah, void *ds)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        ads->ctl12 &= (~AR_IsAggr & ~AR_MoreAggr);
+}
+
+static void ar9003_hw_set11n_burstduration(struct ath_hw *ah, void *ds,
+                                           u32 burstDuration)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        ads->ctl13 &= ~AR_BurstDur;
+        ads->ctl13 |= SM(burstDuration, AR_BurstDur);
+
+}
+
+static void ar9003_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
+                                             u32 vmf)
+{
+        struct ar9003_txc *ads = (struct ar9003_txc *) ds;
+
+        if (vmf)
+                ads->ctl11 |=  AR_VirtMoreFrag;
+        else
+                ads->ctl11 &= ~AR_VirtMoreFrag;
+}
+
+void ar9003_hw_attach_mac_ops(struct ath_hw *hw)
+{
+        struct ath_hw_ops *ops = ath9k_hw_ops(hw);
+
+        ops->rx_enable = ar9003_hw_rx_enable;
+        ops->set_desc_link = ar9003_hw_set_desc_link;
+        ops->get_desc_link = ar9003_hw_get_desc_link;
+        ops->get_isr = ar9003_hw_get_isr;
+        ops->fill_txdesc = ar9003_hw_fill_txdesc;
+        ops->proc_txdesc = ar9003_hw_proc_txdesc;
+        ops->set11n_txdesc = ar9003_hw_set11n_txdesc;
+        ops->set11n_ratescenario = ar9003_hw_set11n_ratescenario;
+        ops->set11n_aggr_first = ar9003_hw_set11n_aggr_first;
+        ops->set11n_aggr_middle = ar9003_hw_set11n_aggr_middle;
+        ops->set11n_aggr_last = ar9003_hw_set11n_aggr_last;
+        ops->clr11n_aggr = ar9003_hw_clr11n_aggr;
+        ops->set11n_burstduration = ar9003_hw_set11n_burstduration;
+        ops->set11n_virtualmorefrag = ar9003_hw_set11n_virtualmorefrag;
+}
+
+void ath9k_hw_set_rx_bufsize(struct ath_hw *ah, u16 buf_size)
+{
+        REG_WRITE(ah, AR_DATABUF_SIZE, buf_size & AR_DATABUF_SIZE_MASK);
+}
+EXPORT_SYMBOL(ath9k_hw_set_rx_bufsize);
+
+void ath9k_hw_addrxbuf_edma(struct ath_hw *ah, u32 rxdp,
+                            enum ath9k_rx_qtype qtype)
+{
+        if (qtype == ATH9K_RX_QUEUE_HP)
+                REG_WRITE(ah, AR_HP_RXDP, rxdp);
+        else
+                REG_WRITE(ah, AR_LP_RXDP, rxdp);
+}
+EXPORT_SYMBOL(ath9k_hw_addrxbuf_edma);
+
+int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
+                                 void *buf_addr)
+{
+        struct ar9003_rxs *rxsp = (struct ar9003_rxs *) buf_addr;
+        unsigned int phyerr;
+
+        /* TODO: byte swap on big endian for ar9300_10 */
+
+        if ((rxsp->status11 & AR_RxDone) == 0)
+                return -EINPROGRESS;
+
+        if (MS(rxsp->ds_info, AR_DescId) != 0x168c)
+                return -EINVAL;
+
+        if ((rxsp->ds_info & (AR_TxRxDesc | AR_CtrlStat)) != 0)
+                return -EINPROGRESS;
+
+        if (!rxs)
+                return 0;
+
+        rxs->rs_status = 0;
+        rxs->rs_flags =  0;
+
+        rxs->rs_datalen = rxsp->status2 & AR_DataLen;
+        rxs->rs_tstamp =  rxsp->status3;
+
+        /* XXX: Keycache */
+        rxs->rs_rssi = MS(rxsp->status5, AR_RxRSSICombined);
+        rxs->rs_rssi_ctl0 = MS(rxsp->status1, AR_RxRSSIAnt00);
+        rxs->rs_rssi_ctl1 = MS(rxsp->status1, AR_RxRSSIAnt01);
+        rxs->rs_rssi_ctl2 = MS(rxsp->status1, AR_RxRSSIAnt02);
+        rxs->rs_rssi_ext0 = MS(rxsp->status5, AR_RxRSSIAnt10);
+        rxs->rs_rssi_ext1 = MS(rxsp->status5, AR_RxRSSIAnt11);
+        rxs->rs_rssi_ext2 = MS(rxsp->status5, AR_RxRSSIAnt12);
+
+        if (rxsp->status11 & AR_RxKeyIdxValid)
+                rxs->rs_keyix = MS(rxsp->status11, AR_KeyIdx);
+        else
+                rxs->rs_keyix = ATH9K_RXKEYIX_INVALID;
+
+        rxs->rs_rate = MS(rxsp->status1, AR_RxRate);
+        rxs->rs_more = (rxsp->status2 & AR_RxMore) ? 1 : 0;
+
+        rxs->rs_isaggr = (rxsp->status11 & AR_RxAggr) ? 1 : 0;
+        rxs->rs_moreaggr = (rxsp->status11 & AR_RxMoreAggr) ? 1 : 0;
+        rxs->rs_antenna = (MS(rxsp->status4, AR_RxAntenna) & 0x7);
+        rxs->rs_flags  = (rxsp->status4 & AR_GI) ? ATH9K_RX_GI : 0;
+        rxs->rs_flags  |= (rxsp->status4 & AR_2040) ? ATH9K_RX_2040 : 0;
+
+        rxs->evm0 = rxsp->status6;
+        rxs->evm1 = rxsp->status7;
+        rxs->evm2 = rxsp->status8;
+        rxs->evm3 = rxsp->status9;
+        rxs->evm4 = (rxsp->status10 & 0xffff);
+
+        if (rxsp->status11 & AR_PreDelimCRCErr)
+                rxs->rs_flags |= ATH9K_RX_DELIM_CRC_PRE;
+
+        if (rxsp->status11 & AR_PostDelimCRCErr)
+                rxs->rs_flags |= ATH9K_RX_DELIM_CRC_POST;
+
+        if (rxsp->status11 & AR_DecryptBusyErr)
+                rxs->rs_flags |= ATH9K_RX_DECRYPT_BUSY;
+
+        if ((rxsp->status11 & AR_RxFrameOK) == 0) {
+                if (rxsp->status11 & AR_CRCErr) {
+                        rxs->rs_status |= ATH9K_RXERR_CRC;
+                } else if (rxsp->status11 & AR_PHYErr) {
+                        rxs->rs_status |= ATH9K_RXERR_PHY;
+                        phyerr = MS(rxsp->status11, AR_PHYErrCode);
+                        rxs->rs_phyerr = phyerr;
+                } else if (rxsp->status11 & AR_DecryptCRCErr) {
+                        rxs->rs_status |= ATH9K_RXERR_DECRYPT;
+                } else if (rxsp->status11 & AR_MichaelErr) {
+                        rxs->rs_status |= ATH9K_RXERR_MIC;
+                }
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(ath9k_hw_process_rxdesc_edma);
+
+void ath9k_hw_reset_txstatus_ring(struct ath_hw *ah)
+{
+        ah->ts_tail = 0;
+
+        memset((void *) ah->ts_ring, 0,
+                ah->ts_size * sizeof(struct ar9003_txs));
+
+        ath_print(ath9k_hw_common(ah), ATH_DBG_XMIT,
+                  "TS Start 0x%x End 0x%x Virt %p, Size %d\n",
+                   ah->ts_paddr_start, ah->ts_paddr_end,
+                   ah->ts_ring, ah->ts_size);
+
+        REG_WRITE(ah, AR_Q_STATUS_RING_START, ah->ts_paddr_start);
+        REG_WRITE(ah, AR_Q_STATUS_RING_END, ah->ts_paddr_end);
+}
+
+void ath9k_hw_setup_statusring(struct ath_hw *ah, void *ts_start,
+                               u32 ts_paddr_start,
+                               u8 size)
+{
+
+        ah->ts_paddr_start = ts_paddr_start;
+        ah->ts_paddr_end = ts_paddr_start + (size * sizeof(struct ar9003_txs));
+        ah->ts_size = size;
+        ah->ts_ring = (struct ar9003_txs *) ts_start;
+
+        ath9k_hw_reset_txstatus_ring(ah);
+}
+EXPORT_SYMBOL(ath9k_hw_setup_statusring);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.h b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
new file mode 100644
index 000000000000..f17558b14539
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.h
@@ -0,0 +1,120 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef AR9003_MAC_H
+#define AR9003_MAC_H
+
+#define AR_DescId       0xffff0000
+#define AR_DescId_S     16
+#define AR_CtrlStat     0x00004000
+#define AR_CtrlStat_S   14
+#define AR_TxRxDesc     0x00008000
+#define AR_TxRxDesc_S   15
+#define AR_TxQcuNum     0x00000f00
+#define AR_TxQcuNum_S   8
+
+#define AR_BufLen       0x0fff0000
+#define AR_BufLen_S     16
+
+#define AR_TxDescId     0xffff0000
+#define AR_TxDescId_S   16
+#define AR_TxPtrChkSum  0x0000ffff
+
+#define AR_TxTid        0xf0000000
+#define AR_TxTid_S      28
+
+#define AR_LowRxChain   0x00004000
+
+#define AR_Not_Sounding 0x20000000
+
+#define MAP_ISR_S2_CST          6
+#define MAP_ISR_S2_GTT          6
+#define MAP_ISR_S2_TIM          3
+#define MAP_ISR_S2_CABEND       0
+#define MAP_ISR_S2_DTIMSYNC     7
+#define MAP_ISR_S2_DTIM         7
+#define MAP_ISR_S2_TSFOOR       4
+
+#define AR9003TXC_CONST(_ds) ((const struct ar9003_txc *) _ds)
+
+struct ar9003_rxs {
+        u32 ds_info;
+        u32 status1;
+        u32 status2;
+        u32 status3;
+        u32 status4;
+        u32 status5;
+        u32 status6;
+        u32 status7;
+        u32 status8;
+        u32 status9;
+        u32 status10;
+        u32 status11;
+} __packed;
+
+/* Transmit Control Descriptor */
+struct ar9003_txc {
+        u32 info;   /* descriptor information */
+        u32 link;   /* link pointer */
+        u32 data0;  /* data pointer to 1st buffer */
+        u32 ctl3;   /* DMA control 3  */
+        u32 data1;  /* data pointer to 2nd buffer */
+        u32 ctl5;   /* DMA control 5  */
+        u32 data2;  /* data pointer to 3rd buffer */
+        u32 ctl7;   /* DMA control 7  */
+        u32 data3;  /* data pointer to 4th buffer */
+        u32 ctl9;   /* DMA control 9  */
+        u32 ctl10;  /* DMA control 10 */
+        u32 ctl11;  /* DMA control 11 */
+        u32 ctl12;  /* DMA control 12 */
+        u32 ctl13;  /* DMA control 13 */
+        u32 ctl14;  /* DMA control 14 */
+        u32 ctl15;  /* DMA control 15 */
+        u32 ctl16;  /* DMA control 16 */
+        u32 ctl17;  /* DMA control 17 */
+        u32 ctl18;  /* DMA control 18 */
+        u32 ctl19;  /* DMA control 19 */
+        u32 ctl20;  /* DMA control 20 */
+        u32 ctl21;  /* DMA control 21 */
+        u32 ctl22;  /* DMA control 22 */
+        u32 pad[9]; /* pad to cache line (128 bytes/32 dwords) */
+} __packed;
+
+struct ar9003_txs {
+        u32 ds_info;
+        u32 status1;
+        u32 status2;
+        u32 status3;
+        u32 status4;
+        u32 status5;
+        u32 status6;
+        u32 status7;
+        u32 status8;
+} __packed;
+
+void ar9003_hw_attach_mac_ops(struct ath_hw *hw);
+void ath9k_hw_set_rx_bufsize(struct ath_hw *ah, u16 buf_size);
+void ath9k_hw_addrxbuf_edma(struct ath_hw *ah, u32 rxdp,
+                            enum ath9k_rx_qtype qtype);
+
+int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah,
+                                 struct ath_rx_status *rxs,
+                                 void *buf_addr);
+void ath9k_hw_reset_txstatus_ring(struct ath_hw *ah);
+void ath9k_hw_setup_statusring(struct ath_hw *ah, void *ts_start,
+                               u32 ts_paddr_start,
+                               u8 size);
+#endif
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
new file mode 100644
index 000000000000..80431a2f6dc1
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -0,0 +1,1134 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "hw.h"
+#include "ar9003_phy.h"
+
+/**
+ * ar9003_hw_set_channel - set channel on single-chip device
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * This is the function to change channel on single-chip devices, that is
+ * all devices after ar9280.
+ *
+ * This function takes the channel value in MHz and sets
+ * hardware channel value. Assumes writes have been enabled to analog bus.
+ *
+ * Actual Expression,
+ *
+ * For 2GHz channel,
+ * Channel Frequency = (3/4) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^17)
+ * (freq_ref = 40MHz)
+ *
+ * For 5GHz channel,
+ * Channel Frequency = (3/2) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^10)
+ * (freq_ref = 40MHz/(24>>amodeRefSel))
+ *
+ * For 5GHz channels which are 5MHz spaced,
+ * Channel Frequency = (3/2) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^17)
+ * (freq_ref = 40MHz)
+ */
+static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        u16 bMode, fracMode = 0, aModeRefSel = 0;
+        u32 freq, channelSel = 0, reg32 = 0;
+        struct chan_centers centers;
+        int loadSynthChannel;
+
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        freq = centers.synth_center;
+
+        if (freq < 4800) {     /* 2 GHz, fractional mode */
+                channelSel = CHANSEL_2G(freq);
+                /* Set to 2G mode */
+                bMode = 1;
+        } else {
+                channelSel = CHANSEL_5G(freq);
+                /* Doubler is ON, so, divide channelSel by 2. */
+                channelSel >>= 1;
+                /* Set to 5G mode */
+                bMode = 0;
+        }
+
+        /* Enable fractional mode for all channels */
+        fracMode = 1;
+        aModeRefSel = 0;
+        loadSynthChannel = 0;
+
+        reg32 = (bMode << 29);
+        REG_WRITE(ah, AR_PHY_SYNTH_CONTROL, reg32);
+
+        /* Enable Long shift Select for Synthesizer */
+        REG_RMW_FIELD(ah, AR_PHY_65NM_CH0_SYNTH4,
+                      AR_PHY_SYNTH4_LONG_SHIFT_SELECT, 1);
+
+        /* Program Synth. setting */
+        reg32 = (channelSel << 2) | (fracMode << 30) |
+                (aModeRefSel << 28) | (loadSynthChannel << 31);
+        REG_WRITE(ah, AR_PHY_65NM_CH0_SYNTH7, reg32);
+
+        /* Toggle Load Synth channel bit */
+        loadSynthChannel = 1;
+        reg32 = (channelSel << 2) | (fracMode << 30) |
+                (aModeRefSel << 28) | (loadSynthChannel << 31);
+        REG_WRITE(ah, AR_PHY_65NM_CH0_SYNTH7, reg32);
+
+        ah->curchan = chan;
+        ah->curchan_rad_index = -1;
+
+        return 0;
+}
+
+/**
+ * ar9003_hw_spur_mitigate - convert baseband spur frequency
+ * @ah: atheros hardware structure
+ * @chan:
+ *
+ * For single-chip solutions. Converts to baseband spur frequency given the
+ * input channel frequency and compute register settings below.
+ *
+ * Spur mitigation for MRC CCK
+ */
+static void ar9003_hw_spur_mitigate_mrc_cck(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        u32 spur_freq[4] = { 2420, 2440, 2464, 2480 };
+        int cur_bb_spur, negative = 0, cck_spur_freq;
+        int i;
+
+        /*
+         * Need to verify range +/- 10 MHz in control channel, otherwise spur
+         * is out-of-band and can be ignored.
+         */
+
+        for (i = 0; i < 4; i++) {
+                negative = 0;
+                cur_bb_spur = spur_freq[i] - chan->channel;
+
+                if (cur_bb_spur < 0) {
+                        negative = 1;
+                        cur_bb_spur = -cur_bb_spur;
+                }
+                if (cur_bb_spur < 10) {
+                        cck_spur_freq = (int)((cur_bb_spur << 19) / 11);
+
+                        if (negative == 1)
+                                cck_spur_freq = -cck_spur_freq;
+
+                        cck_spur_freq = cck_spur_freq & 0xfffff;
+
+                        REG_RMW_FIELD(ah, AR_PHY_AGC_CONTROL,
+                                      AR_PHY_AGC_CONTROL_YCOK_MAX, 0x7);
+                        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                                      AR_PHY_CCK_SPUR_MIT_SPUR_RSSI_THR, 0x7f);
+                        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                                      AR_PHY_CCK_SPUR_MIT_SPUR_FILTER_TYPE,
+                                      0x2);
+                        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                                      AR_PHY_CCK_SPUR_MIT_USE_CCK_SPUR_MIT,
+                                      0x1);
+                        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                                      AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ,
+                                      cck_spur_freq);
+
+                        return;
+                }
+        }
+
+        REG_RMW_FIELD(ah, AR_PHY_AGC_CONTROL,
+                      AR_PHY_AGC_CONTROL_YCOK_MAX, 0x5);
+        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                      AR_PHY_CCK_SPUR_MIT_USE_CCK_SPUR_MIT, 0x0);
+        REG_RMW_FIELD(ah, AR_PHY_CCK_SPUR_MIT,
+                      AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ, 0x0);
+}
+
+/* Clean all spur register fields */
+static void ar9003_hw_spur_ofdm_clear(struct ath_hw *ah)
+{
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_SPUR_FILTER, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_SPUR_FREQ_SD, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_SPUR_DELTA_PHASE, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                      AR_PHY_SFCORR_EXT_SPUR_SUBCHANNEL_SD, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_USE_SPUR_FILTER_IN_AGC, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_USE_SPUR_FILTER_IN_SELFCOR, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_SPUR_RSSI, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT, 0);
+
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_ENABLE_MASK_PPM, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_PILOT_MASK, 0);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_CHAN_MASK, 0);
+        REG_RMW_FIELD(ah, AR_PHY_PILOT_SPUR_MASK,
+                      AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_IDX_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_MASK_A,
+                      AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_IDX_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_CHAN_SPUR_MASK,
+                      AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_IDX_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_PILOT_SPUR_MASK,
+                      AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_CHAN_SPUR_MASK,
+                      AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_MASK_A,
+                      AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_A, 0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_MASK_RATE_CNTL, 0);
+}
+
+static void ar9003_hw_spur_ofdm(struct ath_hw *ah,
+                                int freq_offset,
+                                int spur_freq_sd,
+                                int spur_delta_phase,
+                                int spur_subchannel_sd)
+{
+        int mask_index = 0;
+
+        /* OFDM Spur mitigation */
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                 AR_PHY_TIMING4_ENABLE_SPUR_FILTER, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_SPUR_FREQ_SD, spur_freq_sd);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_SPUR_DELTA_PHASE, spur_delta_phase);
+        REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                      AR_PHY_SFCORR_EXT_SPUR_SUBCHANNEL_SD, spur_subchannel_sd);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_USE_SPUR_FILTER_IN_AGC, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING11,
+                      AR_PHY_TIMING11_USE_SPUR_FILTER_IN_SELFCOR, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_SPUR_RSSI, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_SPUR_RSSI_THRESH, 34);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI, 1);
+
+        if (REG_READ_FIELD(ah, AR_PHY_MODE,
+                           AR_PHY_MODE_DYNAMIC) == 0x1)
+                REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                              AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT, 1);
+
+        mask_index = (freq_offset << 4) / 5;
+        if (mask_index < 0)
+                mask_index = mask_index - 1;
+
+        mask_index = mask_index & 0x7f;
+
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_ENABLE_MASK_PPM, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_PILOT_MASK, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING4,
+                      AR_PHY_TIMING4_ENABLE_CHAN_MASK, 0x1);
+        REG_RMW_FIELD(ah, AR_PHY_PILOT_SPUR_MASK,
+                      AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_IDX_A, mask_index);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_MASK_A,
+                      AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_IDX_A, mask_index);
+        REG_RMW_FIELD(ah, AR_PHY_CHAN_SPUR_MASK,
+                      AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_IDX_A, mask_index);
+        REG_RMW_FIELD(ah, AR_PHY_PILOT_SPUR_MASK,
+                      AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_A, 0xc);
+        REG_RMW_FIELD(ah, AR_PHY_CHAN_SPUR_MASK,
+                      AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_A, 0xc);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_MASK_A,
+                      AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_A, 0xa0);
+        REG_RMW_FIELD(ah, AR_PHY_SPUR_REG,
+                      AR_PHY_SPUR_REG_MASK_RATE_CNTL, 0xff);
+}
+
+static void ar9003_hw_spur_ofdm_work(struct ath_hw *ah,
+                                     struct ath9k_channel *chan,
+                                     int freq_offset)
+{
+        int spur_freq_sd = 0;
+        int spur_subchannel_sd = 0;
+        int spur_delta_phase = 0;
+
+        if (IS_CHAN_HT40(chan)) {
+                if (freq_offset < 0) {
+                        if (REG_READ_FIELD(ah, AR_PHY_GEN_CTRL,
+                                           AR_PHY_GC_DYN2040_PRI_CH) == 0x0)
+                                spur_subchannel_sd = 1;
+                        else
+                                spur_subchannel_sd = 0;
+
+                        spur_freq_sd = ((freq_offset + 10) << 9) / 11;
+
+                } else {
+                        if (REG_READ_FIELD(ah, AR_PHY_GEN_CTRL,
+                            AR_PHY_GC_DYN2040_PRI_CH) == 0x0)
+                                spur_subchannel_sd = 0;
+                        else
+                                spur_subchannel_sd = 1;
+
+                        spur_freq_sd = ((freq_offset - 10) << 9) / 11;
+
+                }
+
+                spur_delta_phase = (freq_offset << 17) / 5;
+
+        } else {
+                spur_subchannel_sd = 0;
+                spur_freq_sd = (freq_offset << 9) /11;
+                spur_delta_phase = (freq_offset << 18) / 5;
+        }
+
+        spur_freq_sd = spur_freq_sd & 0x3ff;
+        spur_delta_phase = spur_delta_phase & 0xfffff;
+
+        ar9003_hw_spur_ofdm(ah,
+                            freq_offset,
+                            spur_freq_sd,
+                            spur_delta_phase,
+                            spur_subchannel_sd);
+}
+
+/* Spur mitigation for OFDM */
+static void ar9003_hw_spur_mitigate_ofdm(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        int synth_freq;
+        int range = 10;
+        int freq_offset = 0;
+        int mode;
+        u8* spurChansPtr;
+        unsigned int i;
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+
+        if (IS_CHAN_5GHZ(chan)) {
+                spurChansPtr = &(eep->modalHeader5G.spurChans[0]);
+                mode = 0;
+        }
+        else {
+                spurChansPtr = &(eep->modalHeader2G.spurChans[0]);
+                mode = 1;
+        }
+
+        if (spurChansPtr[0] == 0)
+                return; /* No spur in the mode */
+
+        if (IS_CHAN_HT40(chan)) {
+                range = 19;
+                if (REG_READ_FIELD(ah, AR_PHY_GEN_CTRL,
+                                   AR_PHY_GC_DYN2040_PRI_CH) == 0x0)
+                        synth_freq = chan->channel - 10;
+                else
+                        synth_freq = chan->channel + 10;
+        } else {
+                range = 10;
+                synth_freq = chan->channel;
+        }
+
+        ar9003_hw_spur_ofdm_clear(ah);
+
+        for (i = 0; spurChansPtr[i] && i < 5; i++) {
+                freq_offset = FBIN2FREQ(spurChansPtr[i], mode) - synth_freq;
+                if (abs(freq_offset) < range) {
+                        ar9003_hw_spur_ofdm_work(ah, chan, freq_offset);
+                        break;
+                }
+        }
+}
+
+static void ar9003_hw_spur_mitigate(struct ath_hw *ah,
+                                    struct ath9k_channel *chan)
+{
+        ar9003_hw_spur_mitigate_mrc_cck(ah, chan);
+        ar9003_hw_spur_mitigate_ofdm(ah, chan);
+}
+
+static u32 ar9003_hw_compute_pll_control(struct ath_hw *ah,
+                                         struct ath9k_channel *chan)
+{
+        u32 pll;
+
+        pll = SM(0x5, AR_RTC_9300_PLL_REFDIV);
+
+        if (chan && IS_CHAN_HALF_RATE(chan))
+                pll |= SM(0x1, AR_RTC_9300_PLL_CLKSEL);
+        else if (chan && IS_CHAN_QUARTER_RATE(chan))
+                pll |= SM(0x2, AR_RTC_9300_PLL_CLKSEL);
+
+        pll |= SM(0x2c, AR_RTC_9300_PLL_DIV);
+
+        return pll;
+}
+
+static void ar9003_hw_set_channel_regs(struct ath_hw *ah,
+                                       struct ath9k_channel *chan)
+{
+        u32 phymode;
+        u32 enableDacFifo = 0;
+
+        enableDacFifo =
+                (REG_READ(ah, AR_PHY_GEN_CTRL) & AR_PHY_GC_ENABLE_DAC_FIFO);
+
+        /* Enable 11n HT, 20 MHz */
+        phymode = AR_PHY_GC_HT_EN | AR_PHY_GC_SINGLE_HT_LTF1 | AR_PHY_GC_WALSH |
+                  AR_PHY_GC_SHORT_GI_40 | enableDacFifo;
+
+        /* Configure baseband for dynamic 20/40 operation */
+        if (IS_CHAN_HT40(chan)) {
+                phymode |= AR_PHY_GC_DYN2040_EN;
+                /* Configure control (primary) channel at +-10MHz */
+                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
+                    (chan->chanmode == CHANNEL_G_HT40PLUS))
+                        phymode |= AR_PHY_GC_DYN2040_PRI_CH;
+
+        }
+
+        /* make sure we preserve INI settings */
+        phymode |= REG_READ(ah, AR_PHY_GEN_CTRL);
+        /* turn off Green Field detection for STA for now */
+        phymode &= ~AR_PHY_GC_GF_DETECT_EN;
+
+        REG_WRITE(ah, AR_PHY_GEN_CTRL, phymode);
+
+        /* Configure MAC for 20/40 operation */
+        ath9k_hw_set11nmac2040(ah);
+
+        /* global transmit timeout (25 TUs default)*/
+        REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
+        /* carrier sense timeout */
+        REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
+}
+
+static void ar9003_hw_init_bb(struct ath_hw *ah,
+                              struct ath9k_channel *chan)
+{
+        u32 synthDelay;
+
+        /*
+         * Wait for the frequency synth to settle (synth goes on
+         * via AR_PHY_ACTIVE_EN).  Read the phy active delay register.
+         * Value is in 100ns increments.
+         */
+        synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
+        if (IS_CHAN_B(chan))
+                synthDelay = (4 * synthDelay) / 22;
+        else
+                synthDelay /= 10;
+
+        /* Activate the PHY (includes baseband activate + synthesizer on) */
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+        /*
+         * There is an issue if the AP starts the calibration before
+         * the base band timeout completes.  This could result in the
+         * rx_clear false triggering.  As a workaround we add delay an
+         * extra BASE_ACTIVATE_DELAY usecs to ensure this condition
+         * does not happen.
+         */
+        udelay(synthDelay + BASE_ACTIVATE_DELAY);
+}
+
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+{
+        switch (rx) {
+        case 0x5:
+                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
+                            AR_PHY_SWAP_ALT_CHAIN);
+        case 0x3:
+        case 0x1:
+        case 0x2:
+        case 0x7:
+                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
+                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
+                break;
+        default:
+                break;
+        }
+
+        REG_WRITE(ah, AR_SELFGEN_MASK, tx);
+        if (tx == 0x5) {
+                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
+                            AR_PHY_SWAP_ALT_CHAIN);
+        }
+}
+
+/*
+ * Override INI values with chip specific configuration.
+ */
+static void ar9003_hw_override_ini(struct ath_hw *ah)
+{
+        u32 val;
+
+        /*
+         * Set the RX_ABORT and RX_DIS and clear it only after
+         * RXE is set for MAC. This prevents frames with
+         * corrupted descriptor status.
+         */
+        REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
+
+        /*
+         * For AR9280 and above, there is a new feature that allows
+         * Multicast search based on both MAC Address and Key ID. By default,
+         * this feature is enabled. But since the driver is not using this
+         * feature, we switch it off; otherwise multicast search based on
+         * MAC addr only will fail.
+         */
+        val = REG_READ(ah, AR_PCU_MISC_MODE2) & (~AR_ADHOC_MCAST_KEYID_ENABLE);
+        REG_WRITE(ah, AR_PCU_MISC_MODE2,
+                  val | AR_AGG_WEP_ENABLE_FIX | AR_AGG_WEP_ENABLE);
+}
+
+static void ar9003_hw_prog_ini(struct ath_hw *ah,
+                               struct ar5416IniArray *iniArr,
+                               int column)
+{
+        unsigned int i, regWrites = 0;
+
+        /* New INI format: Array may be undefined (pre, core, post arrays) */
+        if (!iniArr->ia_array)
+                return;
+
+        /*
+         * New INI format: Pre, core, and post arrays for a given subsystem
+         * may be modal (> 2 columns) or non-modal (2 columns). Determine if
+         * the array is non-modal and force the column to 1.
+         */
+        if (column >= iniArr->ia_columns)
+                column = 1;
+
+        for (i = 0; i < iniArr->ia_rows; i++) {
+                u32 reg = INI_RA(iniArr, i, 0);
+                u32 val = INI_RA(iniArr, i, column);
+
+                REG_WRITE(ah, reg, val);
+
+                /*
+                 * Determine if this is a shift register value, and insert the
+                 * configured delay if so.
+                 */
+                if (reg >= 0x16000 && reg < 0x17000
+                    && ah->config.analog_shiftreg)
+                        udelay(100);
+
+                DO_DELAY(regWrites);
+        }
+}
+
+static int ar9003_hw_process_ini(struct ath_hw *ah,
+                                 struct ath9k_channel *chan)
+{
+        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
+        unsigned int regWrites = 0, i;
+        struct ieee80211_channel *channel = chan->chan;
+        u32 modesIndex, freqIndex;
+
+        switch (chan->chanmode) {
+        case CHANNEL_A:
+        case CHANNEL_A_HT20:
+                modesIndex = 1;
+                freqIndex = 1;
+                break;
+        case CHANNEL_A_HT40PLUS:
+        case CHANNEL_A_HT40MINUS:
+                modesIndex = 2;
+                freqIndex = 1;
+                break;
+        case CHANNEL_G:
+        case CHANNEL_G_HT20:
+        case CHANNEL_B:
+                modesIndex = 4;
+                freqIndex = 2;
+                break;
+        case CHANNEL_G_HT40PLUS:
+        case CHANNEL_G_HT40MINUS:
+                modesIndex = 3;
+                freqIndex = 2;
+                break;
+
+        default:
+                return -EINVAL;
+        }
+
+        for (i = 0; i < ATH_INI_NUM_SPLIT; i++) {
+                ar9003_hw_prog_ini(ah, &ah->iniSOC[i], modesIndex);
+                ar9003_hw_prog_ini(ah, &ah->iniMac[i], modesIndex);
+                ar9003_hw_prog_ini(ah, &ah->iniBB[i], modesIndex);
+                ar9003_hw_prog_ini(ah, &ah->iniRadio[i], modesIndex);
+        }
+
+        REG_WRITE_ARRAY(&ah->iniModesRxGain, 1, regWrites);
+        REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
+
+        /*
+         * For 5GHz channels requiring Fast Clock, apply
+         * different modal values.
+         */
+        if (IS_CHAN_A_FAST_CLOCK(ah, chan))
+                REG_WRITE_ARRAY(&ah->iniModesAdditional,
+                                modesIndex, regWrites);
+
+        ar9003_hw_override_ini(ah);
+        ar9003_hw_set_channel_regs(ah, chan);
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
+        /* Set TX power */
+        ah->eep_ops->set_txpower(ah, chan,
+                                 ath9k_regd_get_ctl(regulatory, chan),
+                                 channel->max_antenna_gain * 2,
+                                 channel->max_power * 2,
+                                 min((u32) MAX_RATE_POWER,
+                                 (u32) regulatory->power_limit));
+
+        return 0;
+}
+
+static void ar9003_hw_set_rfmode(struct ath_hw *ah,
+                                 struct ath9k_channel *chan)
+{
+        u32 rfMode = 0;
+
+        if (chan == NULL)
+                return;
+
+        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
+                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
+
+        if (IS_CHAN_A_FAST_CLOCK(ah, chan))
+                rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
+
+        REG_WRITE(ah, AR_PHY_MODE, rfMode);
+}
+
+static void ar9003_hw_mark_phy_inactive(struct ath_hw *ah)
+{
+        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+}
+
+static void ar9003_hw_set_delta_slope(struct ath_hw *ah,
+                                      struct ath9k_channel *chan)
+{
+        u32 coef_scaled, ds_coef_exp, ds_coef_man;
+        u32 clockMhzScaled = 0x64000000;
+        struct chan_centers centers;
+
+        /*
+         * half and quarter rate can divide the scaled clock by 2 or 4
+         * scale for selected channel bandwidth
+         */
+        if (IS_CHAN_HALF_RATE(chan))
+                clockMhzScaled = clockMhzScaled >> 1;
+        else if (IS_CHAN_QUARTER_RATE(chan))
+                clockMhzScaled = clockMhzScaled >> 2;
+
+        /*
+         * ALGO -> coef = 1e8/fcarrier*fclock/40;
+         * scaled coef to provide precision for this floating calculation
+         */
+        ath9k_hw_get_channel_centers(ah, chan, &centers);
+        coef_scaled = clockMhzScaled / centers.synth_center;
+
+        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
+                                      &ds_coef_exp);
+
+        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
+                      AR_PHY_TIMING3_DSC_MAN, ds_coef_man);
+        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
+                      AR_PHY_TIMING3_DSC_EXP, ds_coef_exp);
+
+        /*
+         * For Short GI,
+         * scaled coeff is 9/10 that of normal coeff
+         */
+        coef_scaled = (9 * coef_scaled) / 10;
+
+        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
+                                      &ds_coef_exp);
+
+        /* for short gi */
+        REG_RMW_FIELD(ah, AR_PHY_SGI_DELTA,
+                      AR_PHY_SGI_DSC_MAN, ds_coef_man);
+        REG_RMW_FIELD(ah, AR_PHY_SGI_DELTA,
+                      AR_PHY_SGI_DSC_EXP, ds_coef_exp);
+}
+
+static bool ar9003_hw_rfbus_req(struct ath_hw *ah)
+{
+        REG_WRITE(ah, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
+        return ath9k_hw_wait(ah, AR_PHY_RFBUS_GRANT, AR_PHY_RFBUS_GRANT_EN,
+                             AR_PHY_RFBUS_GRANT_EN, AH_WAIT_TIMEOUT);
+}
+
+/*
+ * Wait for the frequency synth to settle (synth goes on via PHY_ACTIVE_EN).
+ * Read the phy active delay register. Value is in 100ns increments.
+ */
+static void ar9003_hw_rfbus_done(struct ath_hw *ah)
+{
+        u32 synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
+        if (IS_CHAN_B(ah->curchan))
+                synthDelay = (4 * synthDelay) / 22;
+        else
+                synthDelay /= 10;
+
+        udelay(synthDelay + BASE_ACTIVATE_DELAY);
+
+        REG_WRITE(ah, AR_PHY_RFBUS_REQ, 0);
+}
+
+/*
+ * Set the interrupt and GPIO values so the ISR can disable RF
+ * on a switch signal.  Assumes GPIO port and interrupt polarity
+ * are set prior to call.
+ */
+static void ar9003_hw_enable_rfkill(struct ath_hw *ah)
+{
+        /* Connect rfsilent_bb_l to baseband */
+        REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
+                    AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
+        /* Set input mux for rfsilent_bb_l to GPIO #0 */
+        REG_CLR_BIT(ah, AR_GPIO_INPUT_MUX2,
+                    AR_GPIO_INPUT_MUX2_RFSILENT);
+
+        /*
+         * Configure the desired GPIO port for input and
+         * enable baseband rf silence.
+         */
+        ath9k_hw_cfg_gpio_input(ah, ah->rfkill_gpio);
+        REG_SET_BIT(ah, AR_PHY_TEST, RFSILENT_BB);
+}
+
+static void ar9003_hw_set_diversity(struct ath_hw *ah, bool value)
+{
+        u32 v = REG_READ(ah, AR_PHY_CCK_DETECT);
+        if (value)
+                v |= AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
+        else
+                v &= ~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
+        REG_WRITE(ah, AR_PHY_CCK_DETECT, v);
+}
+
+static bool ar9003_hw_ani_control(struct ath_hw *ah,
+                                  enum ath9k_ani_cmd cmd, int param)
+{
+        struct ar5416AniState *aniState = ah->curani;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        switch (cmd & ah->ani_function) {
+        case ATH9K_ANI_NOISE_IMMUNITY_LEVEL:{
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(ah->totalSizeDesired)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned)ARRAY_SIZE(ah->totalSizeDesired));
+                        return false;
+                }
+
+                REG_RMW_FIELD(ah, AR_PHY_DESIRED_SZ,
+                              AR_PHY_DESIRED_SZ_TOT_DES,
+                              ah->totalSizeDesired[level]);
+                REG_RMW_FIELD(ah, AR_PHY_AGC,
+                              AR_PHY_AGC_COARSE_LOW,
+                              ah->coarse_low[level]);
+                REG_RMW_FIELD(ah, AR_PHY_AGC,
+                              AR_PHY_AGC_COARSE_HIGH,
+                              ah->coarse_high[level]);
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                              AR_PHY_FIND_SIG_FIRPWR, ah->firpwr[level]);
+
+                if (level > aniState->noiseImmunityLevel)
+                        ah->stats.ast_ani_niup++;
+                else if (level < aniState->noiseImmunityLevel)
+                        ah->stats.ast_ani_nidown++;
+                aniState->noiseImmunityLevel = level;
+                break;
+        }
+        case ATH9K_ANI_OFDM_WEAK_SIGNAL_DETECTION:{
+                const int m1ThreshLow[] = { 127, 50 };
+                const int m2ThreshLow[] = { 127, 40 };
+                const int m1Thresh[] = { 127, 0x4d };
+                const int m2Thresh[] = { 127, 0x40 };
+                const int m2CountThr[] = { 31, 16 };
+                const int m2CountThrLow[] = { 63, 48 };
+                u32 on = param ? 1 : 0;
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M1_THRESH_LOW,
+                              m1ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2_THRESH_LOW,
+                              m2ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M1_THRESH, m1Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2_THRESH, m2Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR,
+                              AR_PHY_SFCORR_M2COUNT_THR, m2CountThr[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_LOW,
+                              AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW,
+                              m2CountThrLow[on]);
+
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH_LOW, m1ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH_LOW, m2ThreshLow[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M1_THRESH, m1Thresh[on]);
+                REG_RMW_FIELD(ah, AR_PHY_SFCORR_EXT,
+                              AR_PHY_SFCORR_EXT_M2_THRESH, m2Thresh[on]);
+
+                if (on)
+                        REG_SET_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+                else
+                        REG_CLR_BIT(ah, AR_PHY_SFCORR_LOW,
+                                    AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW);
+
+                if (!on != aniState->ofdmWeakSigDetectOff) {
+                        if (on)
+                                ah->stats.ast_ani_ofdmon++;
+                        else
+                                ah->stats.ast_ani_ofdmoff++;
+                        aniState->ofdmWeakSigDetectOff = !on;
+                }
+                break;
+        }
+        case ATH9K_ANI_CCK_WEAK_SIGNAL_THR:{
+                const int weakSigThrCck[] = { 8, 6 };
+                u32 high = param ? 1 : 0;
+
+                REG_RMW_FIELD(ah, AR_PHY_CCK_DETECT,
+                              AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK,
+                              weakSigThrCck[high]);
+                if (high != aniState->cckWeakSigThreshold) {
+                        if (high)
+                                ah->stats.ast_ani_cckhigh++;
+                        else
+                                ah->stats.ast_ani_ccklow++;
+                        aniState->cckWeakSigThreshold = high;
+                }
+                break;
+        }
+        case ATH9K_ANI_FIRSTEP_LEVEL:{
+                const int firstep[] = { 0, 4, 8 };
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(firstep)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(firstep));
+                        return false;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_FIND_SIG,
+                              AR_PHY_FIND_SIG_FIRSTEP,
+                              firstep[level]);
+                if (level > aniState->firstepLevel)
+                        ah->stats.ast_ani_stepup++;
+                else if (level < aniState->firstepLevel)
+                        ah->stats.ast_ani_stepdown++;
+                aniState->firstepLevel = level;
+                break;
+        }
+        case ATH9K_ANI_SPUR_IMMUNITY_LEVEL:{
+                const int cycpwrThr1[] = { 2, 4, 6, 8, 10, 12, 14, 16 };
+                u32 level = param;
+
+                if (level >= ARRAY_SIZE(cycpwrThr1)) {
+                        ath_print(common, ATH_DBG_ANI,
+                                  "level out of range (%u > %u)\n",
+                                  level,
+                                  (unsigned) ARRAY_SIZE(cycpwrThr1));
+                        return false;
+                }
+                REG_RMW_FIELD(ah, AR_PHY_TIMING5,
+                              AR_PHY_TIMING5_CYCPWR_THR1,
+                              cycpwrThr1[level]);
+                if (level > aniState->spurImmunityLevel)
+                        ah->stats.ast_ani_spurup++;
+                else if (level < aniState->spurImmunityLevel)
+                        ah->stats.ast_ani_spurdown++;
+                aniState->spurImmunityLevel = level;
+                break;
+        }
+        case ATH9K_ANI_PRESENT:
+                break;
+        default:
+                ath_print(common, ATH_DBG_ANI,
+                          "invalid cmd %u\n", cmd);
+                return false;
+        }
+
+        ath_print(common, ATH_DBG_ANI, "ANI parameters:\n");
+        ath_print(common, ATH_DBG_ANI,
+                  "noiseImmunityLevel=%d, spurImmunityLevel=%d, "
+                  "ofdmWeakSigDetectOff=%d\n",
+                  aniState->noiseImmunityLevel,
+                  aniState->spurImmunityLevel,
+                  !aniState->ofdmWeakSigDetectOff);
+        ath_print(common, ATH_DBG_ANI,
+                  "cckWeakSigThreshold=%d, "
+                  "firstepLevel=%d, listenTime=%d\n",
+                  aniState->cckWeakSigThreshold,
+                  aniState->firstepLevel,
+                  aniState->listenTime);
+        ath_print(common, ATH_DBG_ANI,
+                "cycleCount=%d, ofdmPhyErrCount=%d, cckPhyErrCount=%d\n\n",
+                aniState->cycleCount,
+                aniState->ofdmPhyErrCount,
+                aniState->cckPhyErrCount);
+
+        return true;
+}
+
+static void ar9003_hw_nf_sanitize_2g(struct ath_hw *ah, s16 *nf)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (*nf > ah->nf_2g_max) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "2 GHz NF (%d) > MAX (%d), "
+                          "correcting to MAX",
+                          *nf, ah->nf_2g_max);
+                *nf = ah->nf_2g_max;
+        } else if (*nf < ah->nf_2g_min) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "2 GHz NF (%d) < MIN (%d), "
+                          "correcting to MIN",
+                          *nf, ah->nf_2g_min);
+                *nf = ah->nf_2g_min;
+        }
+}
+
+static void ar9003_hw_nf_sanitize_5g(struct ath_hw *ah, s16 *nf)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (*nf > ah->nf_5g_max) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "5 GHz NF (%d) > MAX (%d), "
+                          "correcting to MAX",
+                          *nf, ah->nf_5g_max);
+                *nf = ah->nf_5g_max;
+        } else if (*nf < ah->nf_5g_min) {
+                ath_print(common, ATH_DBG_CALIBRATE,
+                          "5 GHz NF (%d) < MIN (%d), "
+                          "correcting to MIN",
+                          *nf, ah->nf_5g_min);
+                *nf = ah->nf_5g_min;
+        }
+}
+
+static void ar9003_hw_nf_sanitize(struct ath_hw *ah, s16 *nf)
+{
+        if (IS_CHAN_2GHZ(ah->curchan))
+                ar9003_hw_nf_sanitize_2g(ah, nf);
+        else
+                ar9003_hw_nf_sanitize_5g(ah, nf);
+}
+
+static void ar9003_hw_do_getnf(struct ath_hw *ah,
+                              int16_t nfarray[NUM_NF_READINGS])
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int16_t nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CCA_0), AR_PHY_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 0] is %d\n", nf);
+        nfarray[0] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CCA_1), AR_PHY_CH1_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 1] is %d\n", nf);
+        nfarray[1] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_CCA_2), AR_PHY_CH2_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ctl] [chain 2] is %d\n", nf);
+        nfarray[2] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_EXT_CCA), AR_PHY_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 0] is %d\n", nf);
+        nfarray[3] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_EXT_CCA_1), AR_PHY_CH1_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 1] is %d\n", nf);
+        nfarray[4] = nf;
+
+        nf = MS(REG_READ(ah, AR_PHY_EXT_CCA_2), AR_PHY_CH2_EXT_MINCCA_PWR);
+        if (nf & 0x100)
+                nf = 0 - ((nf ^ 0x1ff) + 1);
+        ar9003_hw_nf_sanitize(ah, &nf);
+        ath_print(common, ATH_DBG_CALIBRATE,
+                  "NF calibrated [ext] [chain 2] is %d\n", nf);
+        nfarray[5] = nf;
+}
+
+void ar9003_hw_set_nf_limits(struct ath_hw *ah)
+{
+        ah->nf_2g_max = AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ;
+        ah->nf_2g_min = AR_PHY_CCA_MIN_GOOD_VAL_9300_2GHZ;
+        ah->nf_5g_max = AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ;
+        ah->nf_5g_min = AR_PHY_CCA_MIN_GOOD_VAL_9300_5GHZ;
+}
+
+/*
+ * Find out which of the RX chains are enabled
+ */
+static u32 ar9003_hw_get_rx_chainmask(struct ath_hw *ah)
+{
+        u32 chain = REG_READ(ah, AR_PHY_RX_CHAINMASK);
+        /*
+         * The bits [2:0] indicate the rx chain mask and are to be
+         * interpreted as follows:
+         * 00x => Only chain 0 is enabled
+         * 01x => Chain 1 and 0 enabled
+         * 1xx => Chain 2,1 and 0 enabled
+         */
+        return chain & 0x7;
+}
+
+static void ar9003_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
+{
+        struct ath9k_nfcal_hist *h;
+        unsigned i, j;
+        int32_t val;
+        const u32 ar9300_cca_regs[6] = {
+                AR_PHY_CCA_0,
+                AR_PHY_CCA_1,
+                AR_PHY_CCA_2,
+                AR_PHY_EXT_CCA,
+                AR_PHY_EXT_CCA_1,
+                AR_PHY_EXT_CCA_2,
+        };
+        u8 chainmask, rx_chain_status;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        rx_chain_status = ar9003_hw_get_rx_chainmask(ah);
+
+        chainmask = 0x3F;
+        h = ah->nfCalHist;
+
+        for (i = 0; i < NUM_NF_READINGS; i++) {
+                if (chainmask & (1 << i)) {
+                        val = REG_READ(ah, ar9300_cca_regs[i]);
+                        val &= 0xFFFFFE00;
+                        val |= (((u32) (h[i].privNF) << 1) & 0x1ff);
+                        REG_WRITE(ah, ar9300_cca_regs[i], val);
+                }
+        }
+
+        /*
+         * Load software filtered NF value into baseband internal minCCApwr
+         * variable.
+         */
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_ENABLE_NF);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
+
+        /*
+         * Wait for load to complete, should be fast, a few 10s of us.
+         * The max delay was changed from an original 250us to 10000us
+         * since 250us often results in NF load timeout and causes deaf
+         * condition during stress testing 12/12/2009
+         */
+        for (j = 0; j < 1000; j++) {
+                if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
+                     AR_PHY_AGC_CONTROL_NF) == 0)
+                        break;
+                udelay(10);
+        }
+
+        /*
+         * We timed out waiting for the noisefloor to load, probably due to an
+         * in-progress rx. Simply return here and allow the load plenty of time
+         * to complete before the next calibration interval.  We need to avoid
+         * trying to load -50 (which happens below) while the previous load is
+         * still in progress as this can cause rx deafness. Instead by returning
+         * here, the baseband nf cal will just be capped by our present
+         * noisefloor until the next calibration timer.
+         */
+        if (j == 1000) {
+                ath_print(common, ATH_DBG_ANY, "Timeout while waiting for nf "
+                          "to load: AR_PHY_AGC_CONTROL=0x%x\n",
+                          REG_READ(ah, AR_PHY_AGC_CONTROL));
+                return;
+        }
+
+        /*
+         * Restore maxCCAPower register parameter again so that we're not capped
+         * by the median we just loaded.  This will be initial (and max) value
+         * of next noise floor calibration the baseband does.
+         */
+        for (i = 0; i < NUM_NF_READINGS; i++) {
+                if (chainmask & (1 << i)) {
+                        val = REG_READ(ah, ar9300_cca_regs[i]);
+                        val &= 0xFFFFFE00;
+                        val |= (((u32) (-50) << 1) & 0x1ff);
+                        REG_WRITE(ah, ar9300_cca_regs[i], val);
+                }
+        }
+}
+
+void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+
+        priv_ops->rf_set_freq = ar9003_hw_set_channel;
+        priv_ops->spur_mitigate_freq = ar9003_hw_spur_mitigate;
+        priv_ops->compute_pll_control = ar9003_hw_compute_pll_control;
+        priv_ops->set_channel_regs = ar9003_hw_set_channel_regs;
+        priv_ops->init_bb = ar9003_hw_init_bb;
+        priv_ops->process_ini = ar9003_hw_process_ini;
+        priv_ops->set_rfmode = ar9003_hw_set_rfmode;
+        priv_ops->mark_phy_inactive = ar9003_hw_mark_phy_inactive;
+        priv_ops->set_delta_slope = ar9003_hw_set_delta_slope;
+        priv_ops->rfbus_req = ar9003_hw_rfbus_req;
+        priv_ops->rfbus_done = ar9003_hw_rfbus_done;
+        priv_ops->enable_rfkill = ar9003_hw_enable_rfkill;
+        priv_ops->set_diversity = ar9003_hw_set_diversity;
+        priv_ops->ani_control = ar9003_hw_ani_control;
+        priv_ops->do_getnf = ar9003_hw_do_getnf;
+        priv_ops->loadnf = ar9003_hw_loadnf;
+}
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
new file mode 100644
index 000000000000..f08cc8bda005
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -0,0 +1,847 @@
+/*
+ * Copyright (c) 2002-2010 Atheros Communications, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef AR9003_PHY_H
+#define AR9003_PHY_H
+
+/*
+ * Channel Register Map
+ */
+#define AR_CHAN_BASE    0x9800
+
+#define AR_PHY_TIMING1      (AR_CHAN_BASE + 0x0)
+#define AR_PHY_TIMING2      (AR_CHAN_BASE + 0x4)
+#define AR_PHY_TIMING3      (AR_CHAN_BASE + 0x8)
+#define AR_PHY_TIMING4      (AR_CHAN_BASE + 0xc)
+#define AR_PHY_TIMING5      (AR_CHAN_BASE + 0x10)
+#define AR_PHY_TIMING6      (AR_CHAN_BASE + 0x14)
+#define AR_PHY_TIMING11     (AR_CHAN_BASE + 0x18)
+#define AR_PHY_SPUR_REG     (AR_CHAN_BASE + 0x1c)
+#define AR_PHY_RX_IQCAL_CORR_B0    (AR_CHAN_BASE + 0xdc)
+#define AR_PHY_TX_IQCAL_CONTROL_3  (AR_CHAN_BASE + 0xb0)
+
+#define AR_PHY_TIMING11_SPUR_FREQ_SD    0x3FF00000
+#define AR_PHY_TIMING11_SPUR_FREQ_SD_S  20
+
+#define AR_PHY_TIMING11_SPUR_DELTA_PHASE 0x000FFFFF
+#define AR_PHY_TIMING11_SPUR_DELTA_PHASE_S 0
+
+#define AR_PHY_TIMING11_USE_SPUR_FILTER_IN_AGC 0x40000000
+#define AR_PHY_TIMING11_USE_SPUR_FILTER_IN_AGC_S 30
+
+#define AR_PHY_TIMING11_USE_SPUR_FILTER_IN_SELFCOR 0x80000000
+#define AR_PHY_TIMING11_USE_SPUR_FILTER_IN_SELFCOR_S 31
+
+#define AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT         0x4000000
+#define AR_PHY_SPUR_REG_ENABLE_NF_RSSI_SPUR_MIT_S       26
+
+#define AR_PHY_SPUR_REG_ENABLE_MASK_PPM                         0x20000     /* bins move with freq offset */
+#define AR_PHY_SPUR_REG_ENABLE_MASK_PPM_S                       17
+#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH            0x000000FF
+#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH_S          0
+#define AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI                        0x00000100
+#define AR_PHY_SPUR_REG_EN_VIT_SPUR_RSSI_S                      8
+#define AR_PHY_SPUR_REG_MASK_RATE_CNTL                          0x03FC0000
+#define AR_PHY_SPUR_REG_MASK_RATE_CNTL_S                        18
+
+#define AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN   0x20000000
+#define AR_PHY_RX_IQCAL_CORR_B0_LOOPBACK_IQCORR_EN_S         29
+
+#define AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN   0x80000000
+#define AR_PHY_TX_IQCAL_CONTROL_3_IQCORR_EN_S         31
+
+#define AR_PHY_FIND_SIG_LOW  (AR_CHAN_BASE + 0x20)
+
+#define AR_PHY_SFCORR           (AR_CHAN_BASE + 0x24)
+#define AR_PHY_SFCORR_LOW       (AR_CHAN_BASE + 0x28)
+#define AR_PHY_SFCORR_EXT       (AR_CHAN_BASE + 0x2c)
+
+#define AR_PHY_EXT_CCA              (AR_CHAN_BASE + 0x30)
+#define AR_PHY_RADAR_0              (AR_CHAN_BASE + 0x34)
+#define AR_PHY_RADAR_1              (AR_CHAN_BASE + 0x38)
+#define AR_PHY_RADAR_EXT            (AR_CHAN_BASE + 0x3c)
+#define AR_PHY_MULTICHAIN_CTRL      (AR_CHAN_BASE + 0x80)
+#define AR_PHY_PERCHAIN_CSD         (AR_CHAN_BASE + 0x84)
+
+#define AR_PHY_TX_PHASE_RAMP_0      (AR_CHAN_BASE + 0xd0)
+#define AR_PHY_ADC_GAIN_DC_CORR_0   (AR_CHAN_BASE + 0xd4)
+#define AR_PHY_IQ_ADC_MEAS_0_B0     (AR_CHAN_BASE + 0xc0)
+#define AR_PHY_IQ_ADC_MEAS_1_B0     (AR_CHAN_BASE + 0xc4)
+#define AR_PHY_IQ_ADC_MEAS_2_B0     (AR_CHAN_BASE + 0xc8)
+#define AR_PHY_IQ_ADC_MEAS_3_B0     (AR_CHAN_BASE + 0xcc)
+
+/* The following registers changed position from AR9300 1.0 to AR9300 2.0 */
+#define AR_PHY_TX_PHASE_RAMP_0_9300_10      (AR_CHAN_BASE + 0xd0 - 0x10)
+#define AR_PHY_ADC_GAIN_DC_CORR_0_9300_10   (AR_CHAN_BASE + 0xd4 - 0x10)
+#define AR_PHY_IQ_ADC_MEAS_0_B0_9300_10     (AR_CHAN_BASE + 0xc0 + 0x8)
+#define AR_PHY_IQ_ADC_MEAS_1_B0_9300_10     (AR_CHAN_BASE + 0xc4 + 0x8)
+#define AR_PHY_IQ_ADC_MEAS_2_B0_9300_10     (AR_CHAN_BASE + 0xc8 + 0x8)
+#define AR_PHY_IQ_ADC_MEAS_3_B0_9300_10     (AR_CHAN_BASE + 0xcc + 0x8)
+
+#define AR_PHY_TX_CRC               (AR_CHAN_BASE + 0xa0)
+#define AR_PHY_TST_DAC_CONST        (AR_CHAN_BASE + 0xa4)
+#define AR_PHY_SPUR_REPORT_0        (AR_CHAN_BASE + 0xa8)
+#define AR_PHY_CHAN_INFO_TAB_0      (AR_CHAN_BASE + 0x300)
+
+/*
+ * Channel Field Definitions
+ */
+#define AR_PHY_TIMING2_USE_FORCE_PPM    0x00001000
+#define AR_PHY_TIMING2_FORCE_PPM_VAL    0x00000fff
+#define AR_PHY_TIMING3_DSC_MAN      0xFFFE0000
+#define AR_PHY_TIMING3_DSC_MAN_S    17
+#define AR_PHY_TIMING3_DSC_EXP      0x0001E000
+#define AR_PHY_TIMING3_DSC_EXP_S    13
+#define AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX 0xF000
+#define AR_PHY_TIMING4_IQCAL_LOG_COUNT_MAX_S   12
+#define AR_PHY_TIMING4_DO_CAL    0x10000
+
+#define AR_PHY_TIMING4_ENABLE_PILOT_MASK        0x10000000
+#define AR_PHY_TIMING4_ENABLE_PILOT_MASK_S      28
+#define AR_PHY_TIMING4_ENABLE_CHAN_MASK         0x20000000
+#define AR_PHY_TIMING4_ENABLE_CHAN_MASK_S       29
+
+#define AR_PHY_TIMING4_ENABLE_SPUR_FILTER 0x40000000
+#define AR_PHY_TIMING4_ENABLE_SPUR_FILTER_S 30
+#define AR_PHY_TIMING4_ENABLE_SPUR_RSSI 0x80000000
+#define AR_PHY_TIMING4_ENABLE_SPUR_RSSI_S 31
+
+#define AR_PHY_NEW_ADC_GAIN_CORR_ENABLE 0x40000000
+#define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
+#define AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW  0x00000001
+#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW    0x00003F00
+#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW_S  8
+#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW      0x001FC000
+#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW_S    14
+#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW      0x0FE00000
+#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW_S    21
+#define AR_PHY_SFCORR_M2COUNT_THR    0x0000001F
+#define AR_PHY_SFCORR_M2COUNT_THR_S  0
+#define AR_PHY_SFCORR_M1_THRESH      0x00FE0000
+#define AR_PHY_SFCORR_M1_THRESH_S    17
+#define AR_PHY_SFCORR_M2_THRESH      0x7F000000
+#define AR_PHY_SFCORR_M2_THRESH_S    24
+#define AR_PHY_SFCORR_EXT_M1_THRESH       0x0000007F
+#define AR_PHY_SFCORR_EXT_M1_THRESH_S     0
+#define AR_PHY_SFCORR_EXT_M2_THRESH       0x00003F80
+#define AR_PHY_SFCORR_EXT_M2_THRESH_S     7
+#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW   0x001FC000
+#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW_S 14
+#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW   0x0FE00000
+#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW_S 21
+#define AR_PHY_SFCORR_EXT_SPUR_SUBCHANNEL_SD 0x10000000
+#define AR_PHY_SFCORR_EXT_SPUR_SUBCHANNEL_SD_S 28
+#define AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S   28
+#define AR_PHY_EXT_CCA_THRESH62 0x007F0000
+#define AR_PHY_EXT_CCA_THRESH62_S       16
+#define AR_PHY_EXT_MINCCA_PWR   0x01FF0000
+#define AR_PHY_EXT_MINCCA_PWR_S 16
+#define AR_PHY_TIMING5_CYCPWR_THR1  0x000000FE
+#define AR_PHY_TIMING5_CYCPWR_THR1_S    1
+#define AR_PHY_TIMING5_CYCPWR_THR1_ENABLE  0x00000001
+#define AR_PHY_TIMING5_CYCPWR_THR1_ENABLE_S    0
+#define AR_PHY_TIMING5_CYCPWR_THR1A  0x007F0000
+#define AR_PHY_TIMING5_CYCPWR_THR1A_S    16
+#define AR_PHY_TIMING5_RSSI_THR1A     (0x7F << 16)
+#define AR_PHY_TIMING5_RSSI_THR1A_S   16
+#define AR_PHY_TIMING5_RSSI_THR1A_ENA (0x1 << 15)
+#define AR_PHY_RADAR_0_ENA  0x00000001
+#define AR_PHY_RADAR_0_FFT_ENA  0x80000000
+#define AR_PHY_RADAR_0_INBAND   0x0000003e
+#define AR_PHY_RADAR_0_INBAND_S 1
+#define AR_PHY_RADAR_0_PRSSI    0x00000FC0
+#define AR_PHY_RADAR_0_PRSSI_S  6
+#define AR_PHY_RADAR_0_HEIGHT   0x0003F000
+#define AR_PHY_RADAR_0_HEIGHT_S 12
+#define AR_PHY_RADAR_0_RRSSI    0x00FC0000
+#define AR_PHY_RADAR_0_RRSSI_S  18
+#define AR_PHY_RADAR_0_FIRPWR   0x7F000000
+#define AR_PHY_RADAR_0_FIRPWR_S 24
+#define AR_PHY_RADAR_1_RELPWR_ENA       0x00800000
+#define AR_PHY_RADAR_1_USE_FIR128       0x00400000
+#define AR_PHY_RADAR_1_RELPWR_THRESH    0x003F0000
+#define AR_PHY_RADAR_1_RELPWR_THRESH_S  16
+#define AR_PHY_RADAR_1_BLOCK_CHECK      0x00008000
+#define AR_PHY_RADAR_1_MAX_RRSSI        0x00004000
+#define AR_PHY_RADAR_1_RELSTEP_CHECK    0x00002000
+#define AR_PHY_RADAR_1_RELSTEP_THRESH   0x00001F00
+#define AR_PHY_RADAR_1_RELSTEP_THRESH_S 8
+#define AR_PHY_RADAR_1_MAXLEN           0x000000FF
+#define AR_PHY_RADAR_1_MAXLEN_S         0
+#define AR_PHY_RADAR_EXT_ENA            0x00004000
+#define AR_PHY_RADAR_DC_PWR_THRESH      0x007f8000
+#define AR_PHY_RADAR_DC_PWR_THRESH_S    15
+#define AR_PHY_RADAR_LB_DC_CAP          0x7f800000
+#define AR_PHY_RADAR_LB_DC_CAP_S        23
+#define AR_PHY_FIND_SIG_LOW_FIRSTEP_LOW (0x3f << 6)
+#define AR_PHY_FIND_SIG_LOW_FIRSTEP_LOW_S   6
+#define AR_PHY_FIND_SIG_LOW_FIRPWR      (0x7f << 12)
+#define AR_PHY_FIND_SIG_LOW_FIRPWR_S    12
+#define AR_PHY_FIND_SIG_LOW_FIRPWR_SIGN_BIT 19
+#define AR_PHY_FIND_SIG_LOW_RELSTEP     0x1f
+#define AR_PHY_FIND_SIG_LOW_RELSTEP_S   0
+#define AR_PHY_FIND_SIG_LOW_RELSTEP_SIGN_BIT 5
+#define AR_PHY_CHAN_INFO_TAB_S2_READ    0x00000008
+#define AR_PHY_CHAN_INFO_TAB_S2_READ_S           3
+#define AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF 0x0000007F
+#define AR_PHY_RX_IQCAL_CORR_IQCORR_Q_Q_COFF_S   0
+#define AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF 0x00003F80
+#define AR_PHY_RX_IQCAL_CORR_IQCORR_Q_I_COFF_S   7
+#define AR_PHY_RX_IQCAL_CORR_IQCORR_ENABLE   0x00004000
+#define AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF   0x003f8000
+#define AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_Q_COFF_S 15
+#define AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF   0x1fc00000
+#define AR_PHY_RX_IQCAL_CORR_LOOPBACK_IQCORR_Q_I_COFF_S 22
+
+/*
+ * MRC Register Map
+ */
+#define AR_MRC_BASE     0x9c00
+
+#define AR_PHY_TIMING_3A       (AR_MRC_BASE + 0x0)
+#define AR_PHY_LDPC_CNTL1      (AR_MRC_BASE + 0x4)
+#define AR_PHY_LDPC_CNTL2      (AR_MRC_BASE + 0x8)
+#define AR_PHY_PILOT_SPUR_MASK (AR_MRC_BASE + 0xc)
+#define AR_PHY_CHAN_SPUR_MASK  (AR_MRC_BASE + 0x10)
+#define AR_PHY_SGI_DELTA       (AR_MRC_BASE + 0x14)
+#define AR_PHY_ML_CNTL_1       (AR_MRC_BASE + 0x18)
+#define AR_PHY_ML_CNTL_2       (AR_MRC_BASE + 0x1c)
+#define AR_PHY_TST_ADC         (AR_MRC_BASE + 0x20)
+
+#define AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_IDX_A              0x00000FE0
+#define AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_IDX_A_S    5
+#define AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_A                  0x1F
+#define AR_PHY_PILOT_SPUR_MASK_CF_PILOT_MASK_A_S                0
+
+#define AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_IDX_A        0x00000FE0
+#define AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_IDX_A_S      5
+#define AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_A            0x1F
+#define AR_PHY_CHAN_SPUR_MASK_CF_CHAN_MASK_A_S          0
+
+/*
+ * MRC Feild Definitions
+ */
+#define AR_PHY_SGI_DSC_MAN   0x0007FFF0
+#define AR_PHY_SGI_DSC_MAN_S 4
+#define AR_PHY_SGI_DSC_EXP   0x0000000F
+#define AR_PHY_SGI_DSC_EXP_S 0
+/*
+ * BBB Register Map
+ */
+#define AR_BBB_BASE     0x9d00
+
+/*
+ * AGC Register Map
+ */
+#define AR_AGC_BASE     0x9e00
+
+#define AR_PHY_SETTLING         (AR_AGC_BASE + 0x0)
+#define AR_PHY_FORCEMAX_GAINS_0 (AR_AGC_BASE + 0x4)
+#define AR_PHY_GAINS_MINOFF0    (AR_AGC_BASE + 0x8)
+#define AR_PHY_DESIRED_SZ       (AR_AGC_BASE + 0xc)
+#define AR_PHY_FIND_SIG         (AR_AGC_BASE + 0x10)
+#define AR_PHY_AGC              (AR_AGC_BASE + 0x14)
+#define AR_PHY_EXT_ATTEN_CTL_0  (AR_AGC_BASE + 0x18)
+#define AR_PHY_CCA_0            (AR_AGC_BASE + 0x1c)
+#define AR_PHY_EXT_CCA0         (AR_AGC_BASE + 0x20)
+#define AR_PHY_RESTART          (AR_AGC_BASE + 0x24)
+#define AR_PHY_MC_GAIN_CTRL     (AR_AGC_BASE + 0x28)
+#define AR_PHY_EXTCHN_PWRTHR1   (AR_AGC_BASE + 0x2c)
+#define AR_PHY_EXT_CHN_WIN      (AR_AGC_BASE + 0x30)
+#define AR_PHY_20_40_DET_THR    (AR_AGC_BASE + 0x34)
+#define AR_PHY_RIFS_SRCH        (AR_AGC_BASE + 0x38)
+#define AR_PHY_PEAK_DET_CTRL_1  (AR_AGC_BASE + 0x3c)
+#define AR_PHY_PEAK_DET_CTRL_2  (AR_AGC_BASE + 0x40)
+#define AR_PHY_RX_GAIN_BOUNDS_1 (AR_AGC_BASE + 0x44)
+#define AR_PHY_RX_GAIN_BOUNDS_2 (AR_AGC_BASE + 0x48)
+#define AR_PHY_RSSI_0           (AR_AGC_BASE + 0x180)
+#define AR_PHY_SPUR_CCK_REP0    (AR_AGC_BASE + 0x184)
+#define AR_PHY_CCK_DETECT       (AR_AGC_BASE + 0x1c0)
+#define AR_PHY_DAG_CTRLCCK      (AR_AGC_BASE + 0x1c4)
+#define AR_PHY_IQCORR_CTRL_CCK  (AR_AGC_BASE + 0x1c8)
+
+#define AR_PHY_CCK_SPUR_MIT     (AR_AGC_BASE + 0x1cc)
+#define AR_PHY_CCK_SPUR_MIT_SPUR_RSSI_THR                           0x000001fe
+#define AR_PHY_CCK_SPUR_MIT_SPUR_RSSI_THR_S                                  1
+#define AR_PHY_CCK_SPUR_MIT_SPUR_FILTER_TYPE                        0x60000000
+#define AR_PHY_CCK_SPUR_MIT_SPUR_FILTER_TYPE_S                              29
+#define AR_PHY_CCK_SPUR_MIT_USE_CCK_SPUR_MIT                        0x00000001
+#define AR_PHY_CCK_SPUR_MIT_USE_CCK_SPUR_MIT_S                               0
+#define AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ                           0x1ffffe00
+#define AR_PHY_CCK_SPUR_MIT_CCK_SPUR_FREQ_S                                  9
+
+#define AR_PHY_RX_OCGAIN        (AR_AGC_BASE + 0x200)
+
+#define AR_PHY_CCA_NOM_VAL_9300_2GHZ          -110
+#define AR_PHY_CCA_NOM_VAL_9300_5GHZ          -115
+#define AR_PHY_CCA_MIN_GOOD_VAL_9300_2GHZ     -125
+#define AR_PHY_CCA_MIN_GOOD_VAL_9300_5GHZ     -125
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ     -95
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ     -100
+
+/*
+ * AGC Field Definitions
+ */
+#define AR_PHY_EXT_ATTEN_CTL_RXTX_MARGIN    0x00FC0000
+#define AR_PHY_EXT_ATTEN_CTL_RXTX_MARGIN_S  18
+#define AR_PHY_EXT_ATTEN_CTL_BSW_MARGIN     0x00003C00
+#define AR_PHY_EXT_ATTEN_CTL_BSW_MARGIN_S   10
+#define AR_PHY_EXT_ATTEN_CTL_BSW_ATTEN      0x0000001F
+#define AR_PHY_EXT_ATTEN_CTL_BSW_ATTEN_S    0
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN2_MARGIN     0x003E0000
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN2_MARGIN_S   17
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN     0x0001F000
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN_S   12
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN2_DB         0x00000FC0
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN2_DB_S       6
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB         0x0000003F
+#define AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB_S       0
+#define AR_PHY_RXGAIN_TXRX_ATTEN    0x0003F000
+#define AR_PHY_RXGAIN_TXRX_ATTEN_S  12
+#define AR_PHY_RXGAIN_TXRX_RF_MAX   0x007C0000
+#define AR_PHY_RXGAIN_TXRX_RF_MAX_S 18
+#define AR9280_PHY_RXGAIN_TXRX_ATTEN    0x00003F80
+#define AR9280_PHY_RXGAIN_TXRX_ATTEN_S  7
+#define AR9280_PHY_RXGAIN_TXRX_MARGIN   0x001FC000
+#define AR9280_PHY_RXGAIN_TXRX_MARGIN_S 14
+#define AR_PHY_SETTLING_SWITCH  0x00003F80
+#define AR_PHY_SETTLING_SWITCH_S    7
+#define AR_PHY_DESIRED_SZ_ADC       0x000000FF
+#define AR_PHY_DESIRED_SZ_ADC_S     0
+#define AR_PHY_DESIRED_SZ_PGA       0x0000FF00
+#define AR_PHY_DESIRED_SZ_PGA_S     8
+#define AR_PHY_DESIRED_SZ_TOT_DES   0x0FF00000
+#define AR_PHY_DESIRED_SZ_TOT_DES_S 20
+#define AR_PHY_MINCCA_PWR       0x1FF00000
+#define AR_PHY_MINCCA_PWR_S     20
+#define AR_PHY_CCA_THRESH62     0x0007F000
+#define AR_PHY_CCA_THRESH62_S   12
+#define AR9280_PHY_MINCCA_PWR       0x1FF00000
+#define AR9280_PHY_MINCCA_PWR_S     20
+#define AR9280_PHY_CCA_THRESH62     0x000FF000
+#define AR9280_PHY_CCA_THRESH62_S   12
+#define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
+#define AR_PHY_EXT_CCA0_THRESH62_S  0
+#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003F
+#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
+#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001FC0
+#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
+#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
+
+#define AR_PHY_DAG_CTRLCCK_EN_RSSI_THR  0x00000200
+#define AR_PHY_DAG_CTRLCCK_EN_RSSI_THR_S  9
+#define AR_PHY_DAG_CTRLCCK_RSSI_THR 0x0001FC00
+#define AR_PHY_DAG_CTRLCCK_RSSI_THR_S   10
+
+#define AR_PHY_RIFS_INIT_DELAY         0x3ff0000
+#define AR_PHY_AGC_COARSE_LOW       0x00007F80
+#define AR_PHY_AGC_COARSE_LOW_S     7
+#define AR_PHY_AGC_COARSE_HIGH      0x003F8000
+#define AR_PHY_AGC_COARSE_HIGH_S    15
+#define AR_PHY_AGC_COARSE_PWR_CONST 0x0000007F
+#define AR_PHY_AGC_COARSE_PWR_CONST_S   0
+#define AR_PHY_FIND_SIG_FIRSTEP  0x0003F000
+#define AR_PHY_FIND_SIG_FIRSTEP_S        12
+#define AR_PHY_FIND_SIG_FIRPWR   0x03FC0000
+#define AR_PHY_FIND_SIG_FIRPWR_S         18
+#define AR_PHY_FIND_SIG_FIRPWR_SIGN_BIT  25
+#define AR_PHY_FIND_SIG_RELPWR   (0x1f << 6)
+#define AR_PHY_FIND_SIG_RELPWR_S          6
+#define AR_PHY_FIND_SIG_RELPWR_SIGN_BIT  11
+#define AR_PHY_FIND_SIG_RELSTEP        0x1f
+#define AR_PHY_FIND_SIG_RELSTEP_S         0
+#define AR_PHY_FIND_SIG_RELSTEP_SIGN_BIT  5
+#define AR_PHY_RESTART_DIV_GC   0x001C0000
+#define AR_PHY_RESTART_DIV_GC_S 18
+#define AR_PHY_RESTART_ENA      0x01
+#define AR_PHY_DC_RESTART_DIS   0x40000000
+
+#define AR_PHY_TPC_OLPC_GAIN_DELTA_PAL_ON       0xFF000000
+#define AR_PHY_TPC_OLPC_GAIN_DELTA_PAL_ON_S     24
+#define AR_PHY_TPC_OLPC_GAIN_DELTA              0x00FF0000
+#define AR_PHY_TPC_OLPC_GAIN_DELTA_S            16
+
+#define AR_PHY_TPC_6_ERROR_EST_MODE             0x03000000
+#define AR_PHY_TPC_6_ERROR_EST_MODE_S           24
+
+/*
+ * SM Register Map
+ */
+#define AR_SM_BASE      0xa200
+
+#define AR_PHY_D2_CHIP_ID        (AR_SM_BASE + 0x0)
+#define AR_PHY_GEN_CTRL          (AR_SM_BASE + 0x4)
+#define AR_PHY_MODE              (AR_SM_BASE + 0x8)
+#define AR_PHY_ACTIVE            (AR_SM_BASE + 0xc)
+#define AR_PHY_SPUR_MASK_A       (AR_SM_BASE + 0x20)
+#define AR_PHY_SPUR_MASK_B       (AR_SM_BASE + 0x24)
+#define AR_PHY_SPECTRAL_SCAN     (AR_SM_BASE + 0x28)
+#define AR_PHY_RADAR_BW_FILTER   (AR_SM_BASE + 0x2c)
+#define AR_PHY_SEARCH_START_DELAY (AR_SM_BASE + 0x30)
+#define AR_PHY_MAX_RX_LEN        (AR_SM_BASE + 0x34)
+#define AR_PHY_FRAME_CTL         (AR_SM_BASE + 0x38)
+#define AR_PHY_RFBUS_REQ         (AR_SM_BASE + 0x3c)
+#define AR_PHY_RFBUS_GRANT       (AR_SM_BASE + 0x40)
+#define AR_PHY_RIFS              (AR_SM_BASE + 0x44)
+#define AR_PHY_RX_CLR_DELAY      (AR_SM_BASE + 0x50)
+#define AR_PHY_RX_DELAY          (AR_SM_BASE + 0x54)
+
+#define AR_PHY_XPA_TIMING_CTL    (AR_SM_BASE + 0x64)
+#define AR_PHY_MISC_PA_CTL       (AR_SM_BASE + 0x80)
+#define AR_PHY_SWITCH_CHAIN_0    (AR_SM_BASE + 0x84)
+#define AR_PHY_SWITCH_COM        (AR_SM_BASE + 0x88)
+#define AR_PHY_SWITCH_COM_2      (AR_SM_BASE + 0x8c)
+#define AR_PHY_RX_CHAINMASK      (AR_SM_BASE + 0xa0)
+#define AR_PHY_CAL_CHAINMASK     (AR_SM_BASE + 0xc0)
+#define AR_PHY_CALMODE           (AR_SM_BASE + 0xc8)
+#define AR_PHY_FCAL_1            (AR_SM_BASE + 0xcc)
+#define AR_PHY_FCAL_2_0          (AR_SM_BASE + 0xd0)
+#define AR_PHY_DFT_TONE_CTL_0    (AR_SM_BASE + 0xd4)
+#define AR_PHY_CL_CAL_CTL        (AR_SM_BASE + 0xd8)
+#define AR_PHY_CL_TAB_0          (AR_SM_BASE + 0x100)
+#define AR_PHY_SYNTH_CONTROL     (AR_SM_BASE + 0x140)
+#define AR_PHY_ADDAC_CLK_SEL     (AR_SM_BASE + 0x144)
+#define AR_PHY_PLL_CTL           (AR_SM_BASE + 0x148)
+#define AR_PHY_ANALOG_SWAP       (AR_SM_BASE + 0x14c)
+#define AR_PHY_ADDAC_PARA_CTL    (AR_SM_BASE + 0x150)
+#define AR_PHY_XPA_CFG           (AR_SM_BASE + 0x158)
+
+#define AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_IDX_A           0x0001FC00
+#define AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_IDX_A_S         10
+#define AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_A                       0x3FF
+#define AR_PHY_SPUR_MASK_A_CF_PUNC_MASK_A_S                     0
+
+#define AR_PHY_TEST              (AR_SM_BASE + 0x160)
+
+#define AR_PHY_TEST_BBB_OBS_SEL       0x780000
+#define AR_PHY_TEST_BBB_OBS_SEL_S     19
+
+#define AR_PHY_TEST_RX_OBS_SEL_BIT5_S 23
+#define AR_PHY_TEST_RX_OBS_SEL_BIT5   (1 << AR_PHY_TEST_RX_OBS_SEL_BIT5_S)
+
+#define AR_PHY_TEST_CHAIN_SEL      0xC0000000
+#define AR_PHY_TEST_CHAIN_SEL_S    30
+
+#define AR_PHY_TEST_CTL_STATUS   (AR_SM_BASE + 0x164)
+#define AR_PHY_TEST_CTL_TSTDAC_EN         0x1
+#define AR_PHY_TEST_CTL_TSTDAC_EN_S       0
+#define AR_PHY_TEST_CTL_TX_OBS_SEL        0x1C
+#define AR_PHY_TEST_CTL_TX_OBS_SEL_S      2
+#define AR_PHY_TEST_CTL_TX_OBS_MUX_SEL    0x60
+#define AR_PHY_TEST_CTL_TX_OBS_MUX_SEL_S  5
+#define AR_PHY_TEST_CTL_TSTADC_EN         0x100
+#define AR_PHY_TEST_CTL_TSTADC_EN_S       8
+#define AR_PHY_TEST_CTL_RX_OBS_SEL        0x3C00
+#define AR_PHY_TEST_CTL_RX_OBS_SEL_S      10
+
+
+#define AR_PHY_TSTDAC            (AR_SM_BASE + 0x168)
+
+#define AR_PHY_CHAN_STATUS       (AR_SM_BASE + 0x16c)
+#define AR_PHY_CHAN_INFO_MEMORY  (AR_SM_BASE + 0x170)
+#define AR_PHY_CHNINFO_NOISEPWR  (AR_SM_BASE + 0x174)
+#define AR_PHY_CHNINFO_GAINDIFF  (AR_SM_BASE + 0x178)
+#define AR_PHY_CHNINFO_FINETIM   (AR_SM_BASE + 0x17c)
+#define AR_PHY_CHAN_INFO_GAIN_0  (AR_SM_BASE + 0x180)
+#define AR_PHY_SCRAMBLER_SEED    (AR_SM_BASE + 0x190)
+#define AR_PHY_CCK_TX_CTRL       (AR_SM_BASE + 0x194)
+
+#define AR_PHY_HEAVYCLIP_CTL     (AR_SM_BASE + 0x1a4)
+#define AR_PHY_HEAVYCLIP_20      (AR_SM_BASE + 0x1a8)
+#define AR_PHY_HEAVYCLIP_40      (AR_SM_BASE + 0x1ac)
+#define AR_PHY_ILLEGAL_TXRATE    (AR_SM_BASE + 0x1b0)
+
+#define AR_PHY_PWRTX_MAX         (AR_SM_BASE + 0x1f0)
+#define AR_PHY_POWER_TX_SUB      (AR_SM_BASE + 0x1f4)
+
+#define AR_PHY_TPC_4_B0          (AR_SM_BASE + 0x204)
+#define AR_PHY_TPC_5_B0          (AR_SM_BASE + 0x208)
+#define AR_PHY_TPC_6_B0          (AR_SM_BASE + 0x20c)
+#define AR_PHY_TPC_11_B0         (AR_SM_BASE + 0x220)
+#define AR_PHY_TPC_18            (AR_SM_BASE + 0x23c)
+#define AR_PHY_TPC_19            (AR_SM_BASE + 0x240)
+
+#define AR_PHY_TX_FORCED_GAIN    (AR_SM_BASE + 0x258)
+
+#define AR_PHY_PDADC_TAB_0       (AR_SM_BASE + 0x280)
+
+#define AR_PHY_TX_IQCAL_CONTROL_1   (AR_SM_BASE + 0x448)
+#define AR_PHY_TX_IQCAL_START       (AR_SM_BASE + 0x440)
+#define AR_PHY_TX_IQCAL_STATUS_B0   (AR_SM_BASE + 0x48c)
+#define AR_PHY_TX_IQCAL_CORR_COEFF_01_B0    (AR_SM_BASE + 0x450)
+
+#define AR_PHY_PANIC_WD_STATUS      (AR_SM_BASE + 0x5c0)
+#define AR_PHY_PANIC_WD_CTL_1       (AR_SM_BASE + 0x5c4)
+#define AR_PHY_PANIC_WD_CTL_2       (AR_SM_BASE + 0x5c8)
+#define AR_PHY_BT_CTL               (AR_SM_BASE + 0x5cc)
+#define AR_PHY_ONLY_WARMRESET       (AR_SM_BASE + 0x5d0)
+#define AR_PHY_ONLY_CTL             (AR_SM_BASE + 0x5d4)
+#define AR_PHY_ECO_CTRL             (AR_SM_BASE + 0x5dc)
+#define AR_PHY_BB_THERM_ADC_1       (AR_SM_BASE + 0x248)
+
+#define AR_PHY_65NM_CH0_SYNTH4      0x1608c
+#define AR_PHY_SYNTH4_LONG_SHIFT_SELECT   0x00000002
+#define AR_PHY_SYNTH4_LONG_SHIFT_SELECT_S 1
+#define AR_PHY_65NM_CH0_SYNTH7      0x16098
+#define AR_PHY_65NM_CH0_BIAS1       0x160c0
+#define AR_PHY_65NM_CH0_BIAS2       0x160c4
+#define AR_PHY_65NM_CH0_BIAS4       0x160cc
+#define AR_PHY_65NM_CH0_RXTX4       0x1610c
+#define AR_PHY_65NM_CH0_THERM       0x16290
+
+#define AR_PHY_65NM_CH0_THERM_LOCAL   0x80000000
+#define AR_PHY_65NM_CH0_THERM_LOCAL_S 31
+#define AR_PHY_65NM_CH0_THERM_START   0x20000000
+#define AR_PHY_65NM_CH0_THERM_START_S 29
+#define AR_PHY_65NM_CH0_THERM_SAR_ADC_OUT   0x0000ff00
+#define AR_PHY_65NM_CH0_THERM_SAR_ADC_OUT_S 8
+
+#define AR_PHY_65NM_CH0_RXTX1       0x16100
+#define AR_PHY_65NM_CH0_RXTX2       0x16104
+#define AR_PHY_65NM_CH1_RXTX1       0x16500
+#define AR_PHY_65NM_CH1_RXTX2       0x16504
+#define AR_PHY_65NM_CH2_RXTX1       0x16900
+#define AR_PHY_65NM_CH2_RXTX2       0x16904
+
+#define AR_PHY_RX1DB_BIQUAD_LONG_SHIFT          0x00380000
+#define AR_PHY_RX1DB_BIQUAD_LONG_SHIFT_S        19
+#define AR_PHY_RX6DB_BIQUAD_LONG_SHIFT          0x00c00000
+#define AR_PHY_RX6DB_BIQUAD_LONG_SHIFT_S        22
+#define AR_PHY_LNAGAIN_LONG_SHIFT               0xe0000000
+#define AR_PHY_LNAGAIN_LONG_SHIFT_S             29
+#define AR_PHY_MXRGAIN_LONG_SHIFT               0x03000000
+#define AR_PHY_MXRGAIN_LONG_SHIFT_S             24
+#define AR_PHY_VGAGAIN_LONG_SHIFT               0x1c000000
+#define AR_PHY_VGAGAIN_LONG_SHIFT_S             26
+#define AR_PHY_SCFIR_GAIN_LONG_SHIFT            0x00000001
+#define AR_PHY_SCFIR_GAIN_LONG_SHIFT_S          0
+#define AR_PHY_MANRXGAIN_LONG_SHIFT             0x00000002
+#define AR_PHY_MANRXGAIN_LONG_SHIFT_S           1
+
+/*
+ * SM Field Definitions
+ */
+#define AR_PHY_CL_CAL_ENABLE          0x00000002
+#define AR_PHY_PARALLEL_CAL_ENABLE    0x00000001
+#define AR_PHY_TPCRG1_PD_CAL_ENABLE   0x00400000
+#define AR_PHY_TPCRG1_PD_CAL_ENABLE_S 22
+
+#define AR_PHY_ADDAC_PARACTL_OFF_PWDADC 0x00008000
+
+#define AR_PHY_FCAL20_CAP_STATUS_0    0x01f00000
+#define AR_PHY_FCAL20_CAP_STATUS_0_S  20
+
+#define AR_PHY_RFBUS_REQ_EN     0x00000001  /* request for RF bus */
+#define AR_PHY_RFBUS_GRANT_EN   0x00000001  /* RF bus granted */
+#define AR_PHY_GC_TURBO_MODE       0x00000001  /* set turbo mode bits */
+#define AR_PHY_GC_TURBO_SHORT      0x00000002  /* set short symbols to turbo mode setting */
+#define AR_PHY_GC_DYN2040_EN       0x00000004  /* enable dyn 20/40 mode */
+#define AR_PHY_GC_DYN2040_PRI_ONLY 0x00000008  /* dyn 20/40 - primary only */
+#define AR_PHY_GC_DYN2040_PRI_CH   0x00000010  /* dyn 20/40 - primary ch offset (0=+10MHz, 1=-10MHz)*/
+#define AR_PHY_GC_DYN2040_PRI_CH_S 4
+#define AR_PHY_GC_DYN2040_EXT_CH   0x00000020  /* dyn 20/40 - ext ch spacing (0=20MHz/ 1=25MHz) */
+#define AR_PHY_GC_HT_EN            0x00000040  /* ht enable */
+#define AR_PHY_GC_SHORT_GI_40      0x00000080  /* allow short GI for HT 40 */
+#define AR_PHY_GC_WALSH            0x00000100  /* walsh spatial spreading for 2 chains,2 streams TX */
+#define AR_PHY_GC_SINGLE_HT_LTF1   0x00000200  /* single length (4us) 1st HT long training symbol */
+#define AR_PHY_GC_GF_DETECT_EN     0x00000400  /* enable Green Field detection. Only affects rx, not tx */
+#define AR_PHY_GC_ENABLE_DAC_FIFO  0x00000800  /* fifo between bb and dac */
+#define AR_PHY_RX_DELAY_DELAY      0x00003FFF  /* delay from wakeup to rx ena */
+
+#define AR_PHY_CALMODE_IQ           0x00000000
+#define AR_PHY_CALMODE_ADC_GAIN     0x00000001
+#define AR_PHY_CALMODE_ADC_DC_PER   0x00000002
+#define AR_PHY_CALMODE_ADC_DC_INIT  0x00000003
+#define AR_PHY_SWAP_ALT_CHAIN       0x00000040
+#define AR_PHY_MODE_OFDM            0x00000000
+#define AR_PHY_MODE_CCK             0x00000001
+#define AR_PHY_MODE_DYNAMIC         0x00000004
+#define AR_PHY_MODE_DYNAMIC_S       2
+#define AR_PHY_MODE_HALF            0x00000020
+#define AR_PHY_MODE_QUARTER         0x00000040
+#define AR_PHY_MAC_CLK_MODE         0x00000080
+#define AR_PHY_MODE_DYN_CCK_DISABLE 0x00000100
+#define AR_PHY_MODE_SVD_HALF        0x00000200
+#define AR_PHY_ACTIVE_EN    0x00000001
+#define AR_PHY_ACTIVE_DIS   0x00000000
+#define AR_PHY_FORCE_XPA_CFG    0x000000001
+#define AR_PHY_FORCE_XPA_CFG_S  0
+#define AR_PHY_XPA_TIMING_CTL_TX_END_XPAB_OFF    0xFF000000
+#define AR_PHY_XPA_TIMING_CTL_TX_END_XPAB_OFF_S  24
+#define AR_PHY_XPA_TIMING_CTL_TX_END_XPAA_OFF    0x00FF0000
+#define AR_PHY_XPA_TIMING_CTL_TX_END_XPAA_OFF_S  16
+#define AR_PHY_XPA_TIMING_CTL_FRAME_XPAB_ON      0x0000FF00
+#define AR_PHY_XPA_TIMING_CTL_FRAME_XPAB_ON_S    8
+#define AR_PHY_XPA_TIMING_CTL_FRAME_XPAA_ON      0x000000FF
+#define AR_PHY_XPA_TIMING_CTL_FRAME_XPAA_ON_S    0
+#define AR_PHY_TX_END_TO_A2_RX_ON       0x00FF0000
+#define AR_PHY_TX_END_TO_A2_RX_ON_S     16
+#define AR_PHY_TX_END_DATA_START  0x000000FF
+#define AR_PHY_TX_END_DATA_START_S  0
+#define AR_PHY_TX_END_PA_ON       0x0000FF00
+#define AR_PHY_TX_END_PA_ON_S       8
+#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP   0x0000000F
+#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP_S     0
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1    0x000003F0
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1_S  4
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2    0x0000FC00
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2_S  10
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3    0x003F0000
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3_S  16
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0FC00000
+#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
+#define AR_PHY_TPCRG1_NUM_PD_GAIN   0x0000c000
+#define AR_PHY_TPCRG1_NUM_PD_GAIN_S 14
+#define AR_PHY_TPCRG1_PD_GAIN_1    0x00030000
+#define AR_PHY_TPCRG1_PD_GAIN_1_S  16
+#define AR_PHY_TPCRG1_PD_GAIN_2    0x000C0000
+#define AR_PHY_TPCRG1_PD_GAIN_2_S  18
+#define AR_PHY_TPCRG1_PD_GAIN_3    0x00300000
+#define AR_PHY_TPCRG1_PD_GAIN_3_S  20
+#define AR_PHY_TPCGR1_FORCED_DAC_GAIN   0x0000003e
+#define AR_PHY_TPCGR1_FORCED_DAC_GAIN_S 1
+#define AR_PHY_TPCGR1_FORCE_DAC_GAIN    0x00000001
+#define AR_PHY_TXGAIN_FORCE               0x00000001
+#define AR_PHY_TXGAIN_FORCED_PADVGNRA     0x00003c00
+#define AR_PHY_TXGAIN_FORCED_PADVGNRA_S   10
+#define AR_PHY_TXGAIN_FORCED_PADVGNRB     0x0003c000
+#define AR_PHY_TXGAIN_FORCED_PADVGNRB_S   14
+#define AR_PHY_TXGAIN_FORCED_PADVGNRD     0x00c00000
+#define AR_PHY_TXGAIN_FORCED_PADVGNRD_S   22
+#define AR_PHY_TXGAIN_FORCED_TXMXRGAIN    0x000003c0
+#define AR_PHY_TXGAIN_FORCED_TXMXRGAIN_S  6
+#define AR_PHY_TXGAIN_FORCED_TXBB1DBGAIN  0x0000000e
+#define AR_PHY_TXGAIN_FORCED_TXBB1DBGAIN_S 1
+
+#define AR_PHY_POWER_TX_RATE1   0x9934
+#define AR_PHY_POWER_TX_RATE2   0x9938
+#define AR_PHY_POWER_TX_RATE_MAX    0x993c
+#define AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE 0x00000040
+#define PHY_AGC_CLR             0x10000000
+#define RFSILENT_BB             0x00002000
+#define AR_PHY_CHAN_INFO_GAIN_DIFF_PPM_MASK          0xFFF
+#define AR_PHY_CHAN_INFO_GAIN_DIFF_PPM_SIGNED_BIT    0x800
+#define AR_PHY_CHAN_INFO_GAIN_DIFF_UPPER_LIMIT         320
+#define AR_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK         0x0001
+#define AR_PHY_RX_DELAY_DELAY   0x00003FFF
+#define AR_PHY_CCK_TX_CTRL_JAPAN    0x00000010
+#define AR_PHY_SPECTRAL_SCAN_ENABLE         0x00000001
+#define AR_PHY_SPECTRAL_SCAN_ENABLE_S       0
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE         0x00000002
+#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S       1
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD     0x000000F0
+#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S   4
+#define AR_PHY_SPECTRAL_SCAN_PERIOD         0x0000FF00
+#define AR_PHY_SPECTRAL_SCAN_PERIOD_S       8
+#define AR_PHY_SPECTRAL_SCAN_COUNT          0x00FF0000
+#define AR_PHY_SPECTRAL_SCAN_COUNT_S        16
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT   0x01000000
+#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S 24
+#define AR_PHY_CHANNEL_STATUS_RX_CLEAR      0x00000004
+#define AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT             0x01fc0000
+#define AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT_S                   18
+#define AR_PHY_TX_IQCAL_START_DO_CAL        0x00000001
+#define AR_PHY_TX_IQCAL_START_DO_CAL_S      0
+
+#define AR_PHY_TX_IQCAL_STATUS_FAILED    0x00000001
+#define AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE      0x00003fff
+#define AR_PHY_TX_IQCAL_CORR_COEFF_01_COEFF_TABLE_S    0
+
+#define AR_PHY_TPC_18_THERM_CAL_VALUE           0xff
+#define AR_PHY_TPC_18_THERM_CAL_VALUE_S         0
+#define AR_PHY_TPC_19_ALPHA_THERM               0xff
+#define AR_PHY_TPC_19_ALPHA_THERM_S             0
+
+#define AR_PHY_65NM_CH0_RXTX4_THERM_ON          0x10000000
+#define AR_PHY_65NM_CH0_RXTX4_THERM_ON_S        28
+
+#define AR_PHY_BB_THERM_ADC_1_INIT_THERM        0x000000ff
+#define AR_PHY_BB_THERM_ADC_1_INIT_THERM_S      0
+
+/*
+ * Channel 1 Register Map
+ */
+#define AR_CHAN1_BASE   0xa800
+
+#define AR_PHY_EXT_CCA_1            (AR_CHAN1_BASE + 0x30)
+#define AR_PHY_TX_PHASE_RAMP_1      (AR_CHAN1_BASE + 0xd0)
+#define AR_PHY_ADC_GAIN_DC_CORR_1   (AR_CHAN1_BASE + 0xd4)
+
+#define AR_PHY_SPUR_REPORT_1        (AR_CHAN1_BASE + 0xa8)
+#define AR_PHY_CHAN_INFO_TAB_1      (AR_CHAN1_BASE + 0x300)
+#define AR_PHY_RX_IQCAL_CORR_B1     (AR_CHAN1_BASE + 0xdc)
+
+/*
+ * Channel 1 Field Definitions
+ */
+#define AR_PHY_CH1_EXT_MINCCA_PWR   0x01FF0000
+#define AR_PHY_CH1_EXT_MINCCA_PWR_S 16
+
+/*
+ * AGC 1 Register Map
+ */
+#define AR_AGC1_BASE    0xae00
+
+#define AR_PHY_FORCEMAX_GAINS_1      (AR_AGC1_BASE + 0x4)
+#define AR_PHY_EXT_ATTEN_CTL_1       (AR_AGC1_BASE + 0x18)
+#define AR_PHY_CCA_1                 (AR_AGC1_BASE + 0x1c)
+#define AR_PHY_CCA_CTRL_1            (AR_AGC1_BASE + 0x20)
+#define AR_PHY_RSSI_1                (AR_AGC1_BASE + 0x180)
+#define AR_PHY_SPUR_CCK_REP_1        (AR_AGC1_BASE + 0x184)
+#define AR_PHY_RX_OCGAIN_2           (AR_AGC1_BASE + 0x200)
+
+/*
+ * AGC 1 Field Definitions
+ */
+#define AR_PHY_CH1_MINCCA_PWR   0x1FF00000
+#define AR_PHY_CH1_MINCCA_PWR_S 20
+
+/*
+ * SM 1 Register Map
+ */
+#define AR_SM1_BASE     0xb200
+
+#define AR_PHY_SWITCH_CHAIN_1    (AR_SM1_BASE + 0x84)
+#define AR_PHY_FCAL_2_1          (AR_SM1_BASE + 0xd0)
+#define AR_PHY_DFT_TONE_CTL_1    (AR_SM1_BASE + 0xd4)
+#define AR_PHY_CL_TAB_1          (AR_SM1_BASE + 0x100)
+#define AR_PHY_CHAN_INFO_GAIN_1  (AR_SM1_BASE + 0x180)
+#define AR_PHY_TPC_4_B1          (AR_SM1_BASE + 0x204)
+#define AR_PHY_TPC_5_B1          (AR_SM1_BASE + 0x208)
+#define AR_PHY_TPC_6_B1          (AR_SM1_BASE + 0x20c)
+#define AR_PHY_TPC_11_B1         (AR_SM1_BASE + 0x220)
+#define AR_PHY_PDADC_TAB_1       (AR_SM1_BASE + 0x240)
+#define AR_PHY_TX_IQCAL_STATUS_B1   (AR_SM1_BASE + 0x48c)
+#define AR_PHY_TX_IQCAL_CORR_COEFF_01_B1    (AR_SM1_BASE + 0x450)
+
+/*
+ * Channel 2 Register Map
+ */
+#define AR_CHAN2_BASE   0xb800
+
+#define AR_PHY_EXT_CCA_2            (AR_CHAN2_BASE + 0x30)
+#define AR_PHY_TX_PHASE_RAMP_2      (AR_CHAN2_BASE + 0xd0)
+#define AR_PHY_ADC_GAIN_DC_CORR_2   (AR_CHAN2_BASE + 0xd4)
+
+#define AR_PHY_SPUR_REPORT_2        (AR_CHAN2_BASE + 0xa8)
+#define AR_PHY_CHAN_INFO_TAB_2      (AR_CHAN2_BASE + 0x300)
+#define AR_PHY_RX_IQCAL_CORR_B2     (AR_CHAN2_BASE + 0xdc)
+
+/*
+ * Channel 2 Field Definitions
+ */
+#define AR_PHY_CH2_EXT_MINCCA_PWR   0x01FF0000
+#define AR_PHY_CH2_EXT_MINCCA_PWR_S 16
+/*
+ * AGC 2 Register Map
+ */
+#define AR_AGC2_BASE    0xbe00
+
+#define AR_PHY_FORCEMAX_GAINS_2      (AR_AGC2_BASE + 0x4)
+#define AR_PHY_EXT_ATTEN_CTL_2       (AR_AGC2_BASE + 0x18)
+#define AR_PHY_CCA_2                 (AR_AGC2_BASE + 0x1c)
+#define AR_PHY_CCA_CTRL_2            (AR_AGC2_BASE + 0x20)
+#define AR_PHY_RSSI_2                (AR_AGC2_BASE + 0x180)
+
+/*
+ * AGC 2 Field Definitions
+ */
+#define AR_PHY_CH2_MINCCA_PWR   0x1FF00000
+#define AR_PHY_CH2_MINCCA_PWR_S 20
+
+/*
+ * SM 2 Register Map
+ */
+#define AR_SM2_BASE     0xc200
+
+#define AR_PHY_SWITCH_CHAIN_2    (AR_SM2_BASE + 0x84)
+#define AR_PHY_FCAL_2_2          (AR_SM2_BASE + 0xd0)
+#define AR_PHY_DFT_TONE_CTL_2    (AR_SM2_BASE + 0xd4)
+#define AR_PHY_CL_TAB_2          (AR_SM2_BASE + 0x100)
+#define AR_PHY_CHAN_INFO_GAIN_2  (AR_SM2_BASE + 0x180)
+#define AR_PHY_TPC_4_B2          (AR_SM2_BASE + 0x204)
+#define AR_PHY_TPC_5_B2          (AR_SM2_BASE + 0x208)
+#define AR_PHY_TPC_6_B2          (AR_SM2_BASE + 0x20c)
+#define AR_PHY_TPC_11_B2         (AR_SM2_BASE + 0x220)
+#define AR_PHY_PDADC_TAB_2       (AR_SM2_BASE + 0x240)
+#define AR_PHY_TX_IQCAL_STATUS_B2   (AR_SM2_BASE + 0x48c)
+#define AR_PHY_TX_IQCAL_CORR_COEFF_01_B2    (AR_SM2_BASE + 0x450)
+
+#define AR_PHY_TX_IQCAL_STATUS_B2_FAILED    0x00000001
+
+/*
+ * AGC 3 Register Map
+ */
+#define AR_AGC3_BASE    0xce00
+
+#define AR_PHY_RSSI_3            (AR_AGC3_BASE + 0x180)
+
+/*
+ * Misc helper defines
+ */
+#define AR_PHY_CHAIN_OFFSET     (AR_CHAN1_BASE - AR_CHAN_BASE)
+
+#define AR_PHY_NEW_ADC_DC_GAIN_CORR(_i) (AR_PHY_ADC_GAIN_DC_CORR_0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_NEW_ADC_DC_GAIN_CORR_9300_10(_i) (AR_PHY_ADC_GAIN_DC_CORR_0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_SWITCH_CHAIN(_i)     (AR_PHY_SWITCH_CHAIN_0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_EXT_ATTEN_CTL(_i)    (AR_PHY_EXT_ATTEN_CTL_0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+
+#define AR_PHY_RXGAIN(_i)           (AR_PHY_FORCEMAX_GAINS_0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_TPCRG5(_i)           (AR_PHY_TPC_5_B0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_PDADC_TAB(_i)        (AR_PHY_PDADC_TAB_0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+
+#define AR_PHY_CAL_MEAS_0(_i)       (AR_PHY_IQ_ADC_MEAS_0_B0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_1(_i)       (AR_PHY_IQ_ADC_MEAS_1_B0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_2(_i)       (AR_PHY_IQ_ADC_MEAS_2_B0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_3(_i)       (AR_PHY_IQ_ADC_MEAS_3_B0 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_0_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_0_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_1_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_1_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_2_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_2_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
+#define AR_PHY_CAL_MEAS_3_9300_10(_i) (AR_PHY_IQ_ADC_MEAS_3_B0_9300_10 + (AR_PHY_CHAIN_OFFSET * (_i)))
+
+#define AR_PHY_BB_PANIC_NON_IDLE_ENABLE 0x00000001
+#define AR_PHY_BB_PANIC_IDLE_ENABLE     0x00000002
+#define AR_PHY_BB_PANIC_IDLE_MASK       0xFFFF0000
+#define AR_PHY_BB_PANIC_NON_IDLE_MASK   0x0000FFFC
+
+#define AR_PHY_BB_PANIC_RST_ENABLE      0x00000002
+#define AR_PHY_BB_PANIC_IRQ_ENABLE      0x00000004
+#define AR_PHY_BB_PANIC_CNTL2_MASK      0xFFFFFFF9
+
+#define AR_PHY_BB_WD_STATUS             0x00000007
+#define AR_PHY_BB_WD_STATUS_S           0
+#define AR_PHY_BB_WD_DET_HANG           0x00000008
+#define AR_PHY_BB_WD_DET_HANG_S         3
+#define AR_PHY_BB_WD_RADAR_SM           0x000000F0
+#define AR_PHY_BB_WD_RADAR_SM_S         4
+#define AR_PHY_BB_WD_RX_OFDM_SM         0x00000F00
+#define AR_PHY_BB_WD_RX_OFDM_SM_S       8
+#define AR_PHY_BB_WD_RX_CCK_SM          0x0000F000
+#define AR_PHY_BB_WD_RX_CCK_SM_S        12
+#define AR_PHY_BB_WD_TX_OFDM_SM         0x000F0000
+#define AR_PHY_BB_WD_TX_OFDM_SM_S       16
+#define AR_PHY_BB_WD_TX_CCK_SM          0x00F00000
+#define AR_PHY_BB_WD_TX_CCK_SM_S        20
+#define AR_PHY_BB_WD_AGC_SM             0x0F000000
+#define AR_PHY_BB_WD_AGC_SM_S           24
+#define AR_PHY_BB_WD_SRCH_SM            0xF0000000
+#define AR_PHY_BB_WD_SRCH_SM_S          28
+
+#define AR_PHY_BB_WD_STATUS_CLR         0x00000008
+
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
+
+#endif  /* AR9003_PHY_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index bdcd257ca7a4..fbb7dec6ddeb 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -114,8 +114,10 @@ enum buffer_type {
 #define bf_isretried(bf)        (bf->bf_state.bf_type & BUF_RETRY)
 #define bf_isxretried(bf)       (bf->bf_state.bf_type & BUF_XRETRY)
 
+#define ATH_TXSTATUS_RING_SIZE 64
+
 struct ath_descdma {
-        struct ath_desc *dd_desc;
+        void *dd_desc;
         dma_addr_t dd_desc_paddr;
         u32 dd_desc_len;
         struct ath_buf *dd_bufptr;
@@ -123,7 +125,7 @@ struct ath_descdma {
 
 int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                       struct list_head *head, const char *name,
-                      int nbuf, int ndesc);
+                      int nbuf, int ndesc, bool is_tx);
 void ath_descdma_cleanup(struct ath_softc *sc, struct ath_descdma *dd,
                          struct list_head *head);
 
@@ -188,6 +190,7 @@ enum ATH_AGGR_STATUS {
         ATH_AGGR_LIMITED,
 };
 
+#define ATH_TXFIFO_DEPTH 8
 struct ath_txq {
         u32 axq_qnum;
         u32 *axq_link;
@@ -197,6 +200,10 @@ struct ath_txq {
         bool stopped;
         bool axq_tx_inprogress;
         struct list_head axq_acq;
+        struct list_head txq_fifo[ATH_TXFIFO_DEPTH];
+        struct list_head txq_fifo_pending;
+        u8 txq_headidx;
+        u8 txq_tailidx;
 };
 
 #define AGGR_CLEANUP         BIT(1)
@@ -223,6 +230,12 @@ struct ath_tx {
         struct ath_descdma txdma;
 };
 
+struct ath_rx_edma {
+        struct sk_buff_head rx_fifo;
+        struct sk_buff_head rx_buffers;
+        u32 rx_fifo_hwsize;
+};
+
 struct ath_rx {
         u8 defant;
         u8 rxotherant;
@@ -232,6 +245,8 @@ struct ath_rx {
         spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
+        struct ath_buf *rx_bufptr;
+        struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
 };
 
 int ath_startrecv(struct ath_softc *sc);
@@ -240,7 +255,7 @@ void ath_flushrecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
 int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
-int ath_rx_tasklet(struct ath_softc *sc, int flush);
+int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp);
 struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype);
 void ath_tx_cleanupq(struct ath_softc *sc, struct ath_txq *txq);
 int ath_tx_setup(struct ath_softc *sc, int haltype);
@@ -258,6 +273,7 @@ int ath_txq_update(struct ath_softc *sc, int qnum,
 int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                  struct ath_tx_control *txctl);
 void ath_tx_tasklet(struct ath_softc *sc);
+void ath_tx_edma_tasklet(struct ath_softc *sc);
 void ath_tx_cabq(struct ieee80211_hw *hw, struct sk_buff *skb);
 bool ath_tx_aggr_check(struct ath_softc *sc, struct ath_node *an, u8 tidno);
 void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
@@ -507,6 +523,8 @@ struct ath_softc {
         struct ath_beacon_config cur_beacon_conf;
         struct delayed_work tx_complete_work;
         struct ath_btcoex btcoex;
+
+        struct ath_descdma txsdma;
 };
 
 struct ath_wiphy {
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 22375a754718..c8a4558f79ba 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -93,8 +93,6 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
                 antenna = ((sc->beacon.ast_be_xmit / sc->nbcnvifs) & 1 ? 2 : 1);
         }
 
-        ds->ds_data = bf->bf_buf_addr;
-
         sband = &sc->sbands[common->hw->conf.channel->band];
         rate = sband->bitrates[rateidx].hw_value;
         if (sc->sc_flags & SC_OP_PREAMBLE_SHORT)
@@ -109,7 +107,8 @@ static void ath_beacon_setup(struct ath_softc *sc, struct ath_vif *avp,
 
         /* NB: beacon's BufLen must be a multiple of 4 bytes */
         ath9k_hw_filltxdesc(ah, ds, roundup(skb->len, 4),
-                            true, true, ds);
+                            true, true, ds, bf->bf_buf_addr,
+                            sc->beacon.beaconq);
 
         memset(series, 0, sizeof(struct ath9k_11n_rate_series) * 4);
         series[0].Tries = 1;
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 064f5b51dfcd..6982577043b8 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -15,10 +15,12 @@
  */
 
 #include "hw.h"
+#include "hw-ops.h"
+
+/* Common calibration code */
 
 /* We can tune this as we go by monitoring really low values */
 #define ATH9K_NF_TOO_LOW        -60
-#define AR9285_CLCAL_REDO_THRESH    1
 
 /* AR5416 may return very high value (like -31 dBm), in those cases the nf
  * is incorrect and we should use the static NF value. Later we can try to
@@ -87,98 +89,9 @@ static void ath9k_hw_update_nfcal_hist_buffer(struct ath9k_nfcal_hist *h,
         return;
 }
 
-static void ath9k_hw_do_getnf(struct ath_hw *ah,
-                              int16_t nfarray[NUM_NF_READINGS])
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        int16_t nf;
-
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                nf = MS(REG_READ(ah, AR_PHY_CCA), AR9280_PHY_MINCCA_PWR);
-        else
-                nf = MS(REG_READ(ah, AR_PHY_CCA), AR_PHY_MINCCA_PWR);
-
-        if (nf & 0x100)
-                nf = 0 - ((nf ^ 0x1ff) + 1);
-        ath_print(common, ATH_DBG_CALIBRATE,
-                  "NF calibrated [ctl] [chain 0] is %d\n", nf);
-
-        if (AR_SREV_9271(ah) && (nf >= -114))
-                nf = -116;
-
-        nfarray[0] = nf;
-
-        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
-                if (AR_SREV_9280_10_OR_LATER(ah))
-                        nf = MS(REG_READ(ah, AR_PHY_CH1_CCA),
-                                        AR9280_PHY_CH1_MINCCA_PWR);
-                else
-                        nf = MS(REG_READ(ah, AR_PHY_CH1_CCA),
-                                        AR_PHY_CH1_MINCCA_PWR);
-
-                if (nf & 0x100)
-                        nf = 0 - ((nf ^ 0x1ff) + 1);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "NF calibrated [ctl] [chain 1] is %d\n", nf);
-                nfarray[1] = nf;
-
-                if (!AR_SREV_9280(ah) && !AR_SREV_9287(ah)) {
-                        nf = MS(REG_READ(ah, AR_PHY_CH2_CCA),
-                                        AR_PHY_CH2_MINCCA_PWR);
-                        if (nf & 0x100)
-                                nf = 0 - ((nf ^ 0x1ff) + 1);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "NF calibrated [ctl] [chain 2] is %d\n", nf);
-                        nfarray[2] = nf;
-                }
-        }
-
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                nf = MS(REG_READ(ah, AR_PHY_EXT_CCA),
-                        AR9280_PHY_EXT_MINCCA_PWR);
-        else
-                nf = MS(REG_READ(ah, AR_PHY_EXT_CCA),
-                        AR_PHY_EXT_MINCCA_PWR);
-
-        if (nf & 0x100)
-                nf = 0 - ((nf ^ 0x1ff) + 1);
-        ath_print(common, ATH_DBG_CALIBRATE,
-                  "NF calibrated [ext] [chain 0] is %d\n", nf);
-
-        if (AR_SREV_9271(ah) && (nf >= -114))
-                nf = -116;
-
-        nfarray[3] = nf;
-
-        if (!AR_SREV_9285(ah) && !AR_SREV_9271(ah)) {
-                if (AR_SREV_9280_10_OR_LATER(ah))
-                        nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA),
-                                        AR9280_PHY_CH1_EXT_MINCCA_PWR);
-                else
-                        nf = MS(REG_READ(ah, AR_PHY_CH1_EXT_CCA),
-                                        AR_PHY_CH1_EXT_MINCCA_PWR);
-
-                if (nf & 0x100)
-                        nf = 0 - ((nf ^ 0x1ff) + 1);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "NF calibrated [ext] [chain 1] is %d\n", nf);
-                nfarray[4] = nf;
-
-                if (!AR_SREV_9280(ah) && !AR_SREV_9287(ah)) {
-                        nf = MS(REG_READ(ah, AR_PHY_CH2_EXT_CCA),
-                                        AR_PHY_CH2_EXT_MINCCA_PWR);
-                        if (nf & 0x100)
-                                nf = 0 - ((nf ^ 0x1ff) + 1);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "NF calibrated [ext] [chain 2] is %d\n", nf);
-                        nfarray[5] = nf;
-                }
-        }
-}
-
-static bool getNoiseFloorThresh(struct ath_hw *ah,
-                                enum ieee80211_band band,
-                                int16_t *nft)
+static bool ath9k_hw_get_nf_thresh(struct ath_hw *ah,
+                                   enum ieee80211_band band,
+                                   int16_t *nft)
 {
         switch (band) {
         case IEEE80211_BAND_5GHZ:
@@ -195,44 +108,8 @@ static bool getNoiseFloorThresh(struct ath_hw *ah,
         return true;
 }
 
-static void ath9k_hw_setup_calibration(struct ath_hw *ah,
-                                       struct ath9k_cal_list *currCal)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(0),
-                      AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX,
-                      currCal->calData->calCountMax);
-
-        switch (currCal->calData->calType) {
-        case IQ_MISMATCH_CAL:
-                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_IQ);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "starting IQ Mismatch Calibration\n");
-                break;
-        case ADC_GAIN_CAL:
-                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_GAIN);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "starting ADC Gain Calibration\n");
-                break;
-        case ADC_DC_CAL:
-                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_PER);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "starting ADC DC Calibration\n");
-                break;
-        case ADC_DC_INIT_CAL:
-                REG_WRITE(ah, AR_PHY_CALMODE, AR_PHY_CALMODE_ADC_DC_INIT);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "starting Init ADC DC Calibration\n");
-                break;
-        }
-
-        REG_SET_BIT(ah, AR_PHY_TIMING_CTRL4(0),
-                    AR_PHY_TIMING_CTRL4_DO_CAL);
-}
-
-static void ath9k_hw_reset_calibration(struct ath_hw *ah,
-                                       struct ath9k_cal_list *currCal)
+void ath9k_hw_reset_calibration(struct ath_hw *ah,
+                                struct ath9k_cal_list *currCal)
 {
         int i;
 
@@ -250,324 +127,6 @@ static void ath9k_hw_reset_calibration(struct ath_hw *ah,
         ah->cal_samples = 0;
 }
 
-static bool ath9k_hw_per_calibration(struct ath_hw *ah,
-                                     struct ath9k_channel *ichan,
-                                     u8 rxchainmask,
-                                     struct ath9k_cal_list *currCal)
-{
-        bool iscaldone = false;
-
-        if (currCal->calState == CAL_RUNNING) {
-                if (!(REG_READ(ah, AR_PHY_TIMING_CTRL4(0)) &
-                      AR_PHY_TIMING_CTRL4_DO_CAL)) {
-
-                        currCal->calData->calCollect(ah);
-                        ah->cal_samples++;
-
-                        if (ah->cal_samples >= currCal->calData->calNumSamples) {
-                                int i, numChains = 0;
-                                for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                                        if (rxchainmask & (1 << i))
-                                                numChains++;
-                                }
-
-                                currCal->calData->calPostProc(ah, numChains);
-                                ichan->CalValid |= currCal->calData->calType;
-                                currCal->calState = CAL_DONE;
-                                iscaldone = true;
-                        } else {
-                                ath9k_hw_setup_calibration(ah, currCal);
-                        }
-                }
-        } else if (!(ichan->CalValid & currCal->calData->calType)) {
-                ath9k_hw_reset_calibration(ah, currCal);
-        }
-
-        return iscaldone;
-}
-
-/* Assumes you are talking about the currently configured channel */
-static bool ath9k_hw_iscal_supported(struct ath_hw *ah,
-                                     enum ath9k_cal_types calType)
-{
-        struct ieee80211_conf *conf = &ath9k_hw_common(ah)->hw->conf;
-
-        switch (calType & ah->supp_cals) {
-        case IQ_MISMATCH_CAL: /* Both 2 GHz and 5 GHz support OFDM */
-                return true;
-        case ADC_GAIN_CAL:
-        case ADC_DC_CAL:
-                if (!(conf->channel->band == IEEE80211_BAND_2GHZ &&
-                      conf_is_ht20(conf)))
-                        return true;
-                break;
-        }
-        return false;
-}
-
-static void ath9k_hw_iqcal_collect(struct ath_hw *ah)
-{
-        int i;
-
-        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                ah->totalPowerMeasI[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
-                ah->totalPowerMeasQ[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
-                ah->totalIqCorrMeas[i] +=
-                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
-                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
-                          "%d: Chn %d pmi=0x%08x;pmq=0x%08x;iqcm=0x%08x;\n",
-                          ah->cal_samples, i, ah->totalPowerMeasI[i],
-                          ah->totalPowerMeasQ[i],
-                          ah->totalIqCorrMeas[i]);
-        }
-}
-
-static void ath9k_hw_adc_gaincal_collect(struct ath_hw *ah)
-{
-        int i;
-
-        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                ah->totalAdcIOddPhase[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
-                ah->totalAdcIEvenPhase[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
-                ah->totalAdcQOddPhase[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
-                ah->totalAdcQEvenPhase[i] +=
-                        REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
-
-                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
-                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
-                          "oddq=0x%08x; evenq=0x%08x;\n",
-                          ah->cal_samples, i,
-                          ah->totalAdcIOddPhase[i],
-                          ah->totalAdcIEvenPhase[i],
-                          ah->totalAdcQOddPhase[i],
-                          ah->totalAdcQEvenPhase[i]);
-        }
-}
-
-static void ath9k_hw_adc_dccal_collect(struct ath_hw *ah)
-{
-        int i;
-
-        for (i = 0; i < AR5416_MAX_CHAINS; i++) {
-                ah->totalAdcDcOffsetIOddPhase[i] +=
-                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_0(i));
-                ah->totalAdcDcOffsetIEvenPhase[i] +=
-                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_1(i));
-                ah->totalAdcDcOffsetQOddPhase[i] +=
-                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_2(i));
-                ah->totalAdcDcOffsetQEvenPhase[i] +=
-                        (int32_t) REG_READ(ah, AR_PHY_CAL_MEAS_3(i));
-
-                ath_print(ath9k_hw_common(ah), ATH_DBG_CALIBRATE,
-                          "%d: Chn %d oddi=0x%08x; eveni=0x%08x; "
-                          "oddq=0x%08x; evenq=0x%08x;\n",
-                          ah->cal_samples, i,
-                          ah->totalAdcDcOffsetIOddPhase[i],
-                          ah->totalAdcDcOffsetIEvenPhase[i],
-                          ah->totalAdcDcOffsetQOddPhase[i],
-                          ah->totalAdcDcOffsetQEvenPhase[i]);
-        }
-}
-
-static void ath9k_hw_iqcalibrate(struct ath_hw *ah, u8 numChains)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 powerMeasQ, powerMeasI, iqCorrMeas;
-        u32 qCoffDenom, iCoffDenom;
-        int32_t qCoff, iCoff;
-        int iqCorrNeg, i;
-
-        for (i = 0; i < numChains; i++) {
-                powerMeasI = ah->totalPowerMeasI[i];
-                powerMeasQ = ah->totalPowerMeasQ[i];
-                iqCorrMeas = ah->totalIqCorrMeas[i];
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Starting IQ Cal and Correction for Chain %d\n",
-                          i);
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Orignal: Chn %diq_corr_meas = 0x%08x\n",
-                          i, ah->totalIqCorrMeas[i]);
-
-                iqCorrNeg = 0;
-
-                if (iqCorrMeas > 0x80000000) {
-                        iqCorrMeas = (0xffffffff - iqCorrMeas) + 1;
-                        iqCorrNeg = 1;
-                }
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_i = 0x%08x\n", i, powerMeasI);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_q = 0x%08x\n", i, powerMeasQ);
-                ath_print(common, ATH_DBG_CALIBRATE, "iqCorrNeg is 0x%08x\n",
-                          iqCorrNeg);
-
-                iCoffDenom = (powerMeasI / 2 + powerMeasQ / 2) / 128;
-                qCoffDenom = powerMeasQ / 64;
-
-                if ((powerMeasQ != 0) && (iCoffDenom != 0) &&
-                    (qCoffDenom != 0)) {
-                        iCoff = iqCorrMeas / iCoffDenom;
-                        qCoff = powerMeasI / qCoffDenom - 64;
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "Chn %d iCoff = 0x%08x\n", i, iCoff);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "Chn %d qCoff = 0x%08x\n", i, qCoff);
-
-                        iCoff = iCoff & 0x3f;
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "New: Chn %d iCoff = 0x%08x\n", i, iCoff);
-                        if (iqCorrNeg == 0x0)
-                                iCoff = 0x40 - iCoff;
-
-                        if (qCoff > 15)
-                                qCoff = 15;
-                        else if (qCoff <= -16)
-                                qCoff = 16;
-
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "Chn %d : iCoff = 0x%x  qCoff = 0x%x\n",
-                                  i, iCoff, qCoff);
-
-                        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
-                                      AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF,
-                                      iCoff);
-                        REG_RMW_FIELD(ah, AR_PHY_TIMING_CTRL4(i),
-                                      AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF,
-                                      qCoff);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "IQ Cal and Correction done for Chain %d\n",
-                                  i);
-                }
-        }
-
-        REG_SET_BIT(ah, AR_PHY_TIMING_CTRL4(0),
-                    AR_PHY_TIMING_CTRL4_IQCORR_ENABLE);
-}
-
-static void ath9k_hw_adc_gaincal_calibrate(struct ath_hw *ah, u8 numChains)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 iOddMeasOffset, iEvenMeasOffset, qOddMeasOffset, qEvenMeasOffset;
-        u32 qGainMismatch, iGainMismatch, val, i;
-
-        for (i = 0; i < numChains; i++) {
-                iOddMeasOffset = ah->totalAdcIOddPhase[i];
-                iEvenMeasOffset = ah->totalAdcIEvenPhase[i];
-                qOddMeasOffset = ah->totalAdcQOddPhase[i];
-                qEvenMeasOffset = ah->totalAdcQEvenPhase[i];
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Starting ADC Gain Cal for Chain %d\n", i);
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_odd_i = 0x%08x\n", i,
-                          iOddMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_even_i = 0x%08x\n", i,
-                          iEvenMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_odd_q = 0x%08x\n", i,
-                          qOddMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_even_q = 0x%08x\n", i,
-                          qEvenMeasOffset);
-
-                if (iOddMeasOffset != 0 && qEvenMeasOffset != 0) {
-                        iGainMismatch =
-                                ((iEvenMeasOffset * 32) /
-                                 iOddMeasOffset) & 0x3f;
-                        qGainMismatch =
-                                ((qOddMeasOffset * 32) /
-                                 qEvenMeasOffset) & 0x3f;
-
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "Chn %d gain_mismatch_i = 0x%08x\n", i,
-                                  iGainMismatch);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "Chn %d gain_mismatch_q = 0x%08x\n", i,
-                                  qGainMismatch);
-
-                        val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
-                        val &= 0xfffff000;
-                        val |= (qGainMismatch) | (iGainMismatch << 6);
-                        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
-
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "ADC Gain Cal done for Chain %d\n", i);
-                }
-        }
-
-        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0),
-                  REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0)) |
-                  AR_PHY_NEW_ADC_GAIN_CORR_ENABLE);
-}
-
-static void ath9k_hw_adc_dccal_calibrate(struct ath_hw *ah, u8 numChains)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 iOddMeasOffset, iEvenMeasOffset, val, i;
-        int32_t qOddMeasOffset, qEvenMeasOffset, qDcMismatch, iDcMismatch;
-        const struct ath9k_percal_data *calData =
-                ah->cal_list_curr->calData;
-        u32 numSamples =
-                (1 << (calData->calCountMax + 5)) * calData->calNumSamples;
-
-        for (i = 0; i < numChains; i++) {
-                iOddMeasOffset = ah->totalAdcDcOffsetIOddPhase[i];
-                iEvenMeasOffset = ah->totalAdcDcOffsetIEvenPhase[i];
-                qOddMeasOffset = ah->totalAdcDcOffsetQOddPhase[i];
-                qEvenMeasOffset = ah->totalAdcDcOffsetQEvenPhase[i];
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                           "Starting ADC DC Offset Cal for Chain %d\n", i);
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_odd_i = %d\n", i,
-                          iOddMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_even_i = %d\n", i,
-                          iEvenMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_odd_q = %d\n", i,
-                          qOddMeasOffset);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d pwr_meas_even_q = %d\n", i,
-                          qEvenMeasOffset);
-
-                iDcMismatch = (((iEvenMeasOffset - iOddMeasOffset) * 2) /
-                               numSamples) & 0x1ff;
-                qDcMismatch = (((qOddMeasOffset - qEvenMeasOffset) * 2) /
-                               numSamples) & 0x1ff;
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d dc_offset_mismatch_i = 0x%08x\n", i,
-                          iDcMismatch);
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "Chn %d dc_offset_mismatch_q = 0x%08x\n", i,
-                          qDcMismatch);
-
-                val = REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i));
-                val &= 0xc0000fff;
-                val |= (qDcMismatch << 12) | (iDcMismatch << 21);
-                REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(i), val);
-
-                ath_print(common, ATH_DBG_CALIBRATE,
-                          "ADC DC Offset Cal done for Chain %d\n", i);
-        }
-
-        REG_WRITE(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0),
-                  REG_READ(ah, AR_PHY_NEW_ADC_DC_GAIN_CORR(0)) |
-                  AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE);
-}
-
 /* This is done for the currently configured channel */
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah)
 {
@@ -614,72 +173,6 @@ void ath9k_hw_start_nfcal(struct ath_hw *ah)
         REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
 }
 
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        struct ath9k_nfcal_hist *h;
-        int i, j;
-        int32_t val;
-        const u32 ar5416_cca_regs[6] = {
-                AR_PHY_CCA,
-                AR_PHY_CH1_CCA,
-                AR_PHY_CH2_CCA,
-                AR_PHY_EXT_CCA,
-                AR_PHY_CH1_EXT_CCA,
-                AR_PHY_CH2_EXT_CCA
-        };
-        u8 chainmask, rx_chain_status;
-
-        rx_chain_status = REG_READ(ah, AR_PHY_RX_CHAINMASK);
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
-                chainmask = 0x9;
-        else if (AR_SREV_9280(ah) || AR_SREV_9287(ah)) {
-                if ((rx_chain_status & 0x2) || (rx_chain_status & 0x4))
-                        chainmask = 0x1B;
-                else
-                        chainmask = 0x09;
-        } else {
-                if (rx_chain_status & 0x4)
-                        chainmask = 0x3F;
-                else if (rx_chain_status & 0x2)
-                        chainmask = 0x1B;
-                else
-                        chainmask = 0x09;
-        }
-
-        h = ah->nfCalHist;
-
-        for (i = 0; i < NUM_NF_READINGS; i++) {
-                if (chainmask & (1 << i)) {
-                        val = REG_READ(ah, ar5416_cca_regs[i]);
-                        val &= 0xFFFFFE00;
-                        val |= (((u32) (h[i].privNF) << 1) & 0x1ff);
-                        REG_WRITE(ah, ar5416_cca_regs[i], val);
-                }
-        }
-
-        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-                    AR_PHY_AGC_CONTROL_ENABLE_NF);
-        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-                    AR_PHY_AGC_CONTROL_NO_UPDATE_NF);
-        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_NF);
-
-        for (j = 0; j < 5; j++) {
-                if ((REG_READ(ah, AR_PHY_AGC_CONTROL) &
-                     AR_PHY_AGC_CONTROL_NF) == 0)
-                        break;
-                udelay(50);
-        }
-
-        for (i = 0; i < NUM_NF_READINGS; i++) {
-                if (chainmask & (1 << i)) {
-                        val = REG_READ(ah, ar5416_cca_regs[i]);
-                        val &= 0xFFFFFE00;
-                        val |= (((u32) (-50) << 1) & 0x1ff);
-                        REG_WRITE(ah, ar5416_cca_regs[i], val);
-                }
-        }
-}
-
 int16_t ath9k_hw_getnf(struct ath_hw *ah,
                        struct ath9k_channel *chan)
 {
@@ -699,7 +192,7 @@ int16_t ath9k_hw_getnf(struct ath_hw *ah,
         } else {
                 ath9k_hw_do_getnf(ah, nfarray);
                 nf = nfarray[0];
-                if (getNoiseFloorThresh(ah, c->band, &nfThresh)
+                if (ath9k_hw_get_nf_thresh(ah, c->band, &nfThresh)
                     && nf > nfThresh) {
                         ath_print(common, ATH_DBG_CALIBRATE,
                                   "noise floor failed detected; "
@@ -757,567 +250,3 @@ s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan)
         return nf;
 }
 EXPORT_SYMBOL(ath9k_hw_getchan_noise);
-
-static void ath9k_olc_temp_compensation_9287(struct ath_hw *ah)
-{
-        u32 rddata;
-        int32_t delta, currPDADC, slope;
-
-        rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
-        currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
-
-        if (ah->initPDADC == 0 || currPDADC == 0) {
-                /*
-                 * Zero value indicates that no frames have been transmitted yet,
-                 * can't do temperature compensation until frames are transmitted.
-                 */
-                return;
-        } else {
-                slope = ah->eep_ops->get_eeprom(ah, EEP_TEMPSENSE_SLOPE);
-
-                if (slope == 0) { /* to avoid divide by zero case */
-                        delta = 0;
-                } else {
-                        delta = ((currPDADC - ah->initPDADC)*4) / slope;
-                }
-                REG_RMW_FIELD(ah, AR_PHY_CH0_TX_PWRCTRL11,
-                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
-                REG_RMW_FIELD(ah, AR_PHY_CH1_TX_PWRCTRL11,
-                              AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP, delta);
-        }
-}
-
-static void ath9k_olc_temp_compensation(struct ath_hw *ah)
-{
-        u32 rddata, i;
-        int delta, currPDADC, regval;
-
-        if (OLC_FOR_AR9287_10_LATER) {
-                ath9k_olc_temp_compensation_9287(ah);
-        } else {
-                rddata = REG_READ(ah, AR_PHY_TX_PWRCTRL4);
-                currPDADC = MS(rddata, AR_PHY_TX_PWRCTRL_PD_AVG_OUT);
-
-                if (ah->initPDADC == 0 || currPDADC == 0) {
-                        return;
-                } else {
-                        if (ah->eep_ops->get_eeprom(ah, EEP_DAC_HPWR_5G))
-                                delta = (currPDADC - ah->initPDADC + 4) / 8;
-                        else
-                                delta = (currPDADC - ah->initPDADC + 5) / 10;
-
-                        if (delta != ah->PDADCdelta) {
-                                ah->PDADCdelta = delta;
-                                for (i = 1; i < AR9280_TX_GAIN_TABLE_SIZE; i++) {
-                                        regval = ah->originalGain[i] - delta;
-                                        if (regval < 0)
-                                                regval = 0;
-
-                                        REG_RMW_FIELD(ah,
-                                                      AR_PHY_TX_GAIN_TBL1 + i * 4,
-                                                      AR_PHY_TX_GAIN, regval);
-                                }
-                        }
-                }
-        }
-}
-
-static void ath9k_hw_9271_pa_cal(struct ath_hw *ah, bool is_reset)
-{
-        u32 regVal;
-        unsigned int i;
-        u32 regList [][2] = {
-                { 0x786c, 0 },
-                { 0x7854, 0 },
-                { 0x7820, 0 },
-                { 0x7824, 0 },
-                { 0x7868, 0 },
-                { 0x783c, 0 },
-                { 0x7838, 0 } ,
-                { 0x7828, 0 } ,
-        };
-
-        for (i = 0; i < ARRAY_SIZE(regList); i++)
-                regList[i][1] = REG_READ(ah, regList[i][0]);
-
-        regVal = REG_READ(ah, 0x7834);
-        regVal &= (~(0x1));
-        REG_WRITE(ah, 0x7834, regVal);
-        regVal = REG_READ(ah, 0x9808);
-        regVal |= (0x1 << 27);
-        REG_WRITE(ah, 0x9808, regVal);
-
-        /* 786c,b23,1, pwddac=1 */
-        REG_RMW_FIELD(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC, 1);
-        /* 7854, b5,1, pdrxtxbb=1 */
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1, 1);
-        /* 7854, b7,1, pdv2i=1 */
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I, 1);
-        /* 7854, b8,1, pddacinterface=1 */
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF, 1);
-        /* 7824,b12,0, offcal=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL, 0);
-        /* 7838, b1,0, pwddb=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB, 0);
-        /* 7820,b11,0, enpacal=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL, 0);
-        /* 7820,b25,1, pdpadrv1=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1, 0);
-        /* 7820,b24,0, pdpadrv2=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1,AR9285_AN_RF2G1_PDPADRV2,0);
-        /* 7820,b23,0, pdpaout=0 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT, 0);
-        /* 783c,b14-16,7, padrvgn2tab_0=7 */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G8,AR9285_AN_RF2G8_PADRVGN2TAB0, 7);
-        /*
-         * 7838,b29-31,0, padrvgn1tab_0=0
-         * does not matter since we turn it off
-         */
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G7,AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
-
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9271_AN_RF2G3_CCOMP, 0xfff);
-
-        /* Set:
-         * localmode=1,bmode=1,bmoderxtx=1,synthon=1,
-         * txon=1,paon=1,oscon=1,synthon_force=1
-         */
-        REG_WRITE(ah, AR9285_AN_TOP2, 0xca0358a0);
-        udelay(30);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9271_AN_RF2G6_OFFS, 0);
-
-        /* find off_6_1; */
-        for (i = 6; i > 0; i--) {
-                regVal = REG_READ(ah, 0x7834);
-                regVal |= (1 << (20 + i));
-                REG_WRITE(ah, 0x7834, regVal);
-                udelay(1);
-                //regVal = REG_READ(ah, 0x7834);
-                regVal &= (~(0x1 << (20 + i)));
-                regVal |= (MS(REG_READ(ah, 0x7840), AR9285_AN_RXTXBB1_SPARE9)
-                            << (20 + i));
-                REG_WRITE(ah, 0x7834, regVal);
-        }
-
-        regVal = (regVal >>20) & 0x7f;
-
-        /* Update PA cal info */
-        if ((!is_reset) && (ah->pacal_info.prev_offset == regVal)) {
-                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
-                        ah->pacal_info.max_skipcount =
-                                2 * ah->pacal_info.max_skipcount;
-                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
-        } else {
-                ah->pacal_info.max_skipcount = 1;
-                ah->pacal_info.skipcount = 0;
-                ah->pacal_info.prev_offset = regVal;
-        }
-
-        regVal = REG_READ(ah, 0x7834);
-        regVal |= 0x1;
-        REG_WRITE(ah, 0x7834, regVal);
-        regVal = REG_READ(ah, 0x9808);
-        regVal &= (~(0x1 << 27));
-        REG_WRITE(ah, 0x9808, regVal);
-
-        for (i = 0; i < ARRAY_SIZE(regList); i++)
-                REG_WRITE(ah, regList[i][0], regList[i][1]);
-}
-
-static inline void ath9k_hw_9285_pa_cal(struct ath_hw *ah, bool is_reset)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 regVal;
-        int i, offset, offs_6_1, offs_0;
-        u32 ccomp_org, reg_field;
-        u32 regList[][2] = {
-                { 0x786c, 0 },
-                { 0x7854, 0 },
-                { 0x7820, 0 },
-                { 0x7824, 0 },
-                { 0x7868, 0 },
-                { 0x783c, 0 },
-                { 0x7838, 0 },
-        };
-
-        ath_print(common, ATH_DBG_CALIBRATE, "Running PA Calibration\n");
-
-        /* PA CAL is not needed for high power solution */
-        if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) ==
-            AR5416_EEP_TXGAIN_HIGH_POWER)
-                return;
-
-        if (AR_SREV_9285_11(ah)) {
-                REG_WRITE(ah, AR9285_AN_TOP4, (AR9285_AN_TOP4_DEFAULT | 0x14));
-                udelay(10);
-        }
-
-        for (i = 0; i < ARRAY_SIZE(regList); i++)
-                regList[i][1] = REG_READ(ah, regList[i][0]);
-
-        regVal = REG_READ(ah, 0x7834);
-        regVal &= (~(0x1));
-        REG_WRITE(ah, 0x7834, regVal);
-        regVal = REG_READ(ah, 0x9808);
-        regVal |= (0x1 << 27);
-        REG_WRITE(ah, 0x9808, regVal);
-
-        REG_RMW_FIELD(ah, AR9285_AN_TOP3, AR9285_AN_TOP3_PWDDAC, 1);
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDRXTXBB1, 1);
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDV2I, 1);
-        REG_RMW_FIELD(ah, AR9285_AN_RXTXBB1, AR9285_AN_RXTXBB1_PDDACIF, 1);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G2, AR9285_AN_RF2G2_OFFCAL, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PWDDB, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_ENPACAL, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV1, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPADRV2, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G1, AR9285_AN_RF2G1_PDPAOUT, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G8, AR9285_AN_RF2G8_PADRVGN2TAB0, 7);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G7, AR9285_AN_RF2G7_PADRVGN2TAB0, 0);
-        ccomp_org = MS(REG_READ(ah, AR9285_AN_RF2G6), AR9285_AN_RF2G6_CCOMP);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_CCOMP, 0xf);
-
-        REG_WRITE(ah, AR9285_AN_TOP2, 0xca0358a0);
-        udelay(30);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_OFFS, 0);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, 0);
-
-        for (i = 6; i > 0; i--) {
-                regVal = REG_READ(ah, 0x7834);
-                regVal |= (1 << (19 + i));
-                REG_WRITE(ah, 0x7834, regVal);
-                udelay(1);
-                regVal = REG_READ(ah, 0x7834);
-                regVal &= (~(0x1 << (19 + i)));
-                reg_field = MS(REG_READ(ah, 0x7840), AR9285_AN_RXTXBB1_SPARE9);
-                regVal |= (reg_field << (19 + i));
-                REG_WRITE(ah, 0x7834, regVal);
-        }
-
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, 1);
-        udelay(1);
-        reg_field = MS(REG_READ(ah, AR9285_AN_RF2G9), AR9285_AN_RXTXBB1_SPARE9);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, reg_field);
-        offs_6_1 = MS(REG_READ(ah, AR9285_AN_RF2G6), AR9285_AN_RF2G6_OFFS);
-        offs_0   = MS(REG_READ(ah, AR9285_AN_RF2G3), AR9285_AN_RF2G3_PDVCCOMP);
-
-        offset = (offs_6_1<<1) | offs_0;
-        offset = offset - 0;
-        offs_6_1 = offset>>1;
-        offs_0 = offset & 1;
-
-        if ((!is_reset) && (ah->pacal_info.prev_offset == offset)) {
-                if (ah->pacal_info.max_skipcount < MAX_PACAL_SKIPCOUNT)
-                        ah->pacal_info.max_skipcount =
-                                2 * ah->pacal_info.max_skipcount;
-                ah->pacal_info.skipcount = ah->pacal_info.max_skipcount;
-        } else {
-                ah->pacal_info.max_skipcount = 1;
-                ah->pacal_info.skipcount = 0;
-                ah->pacal_info.prev_offset = offset;
-        }
-
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_OFFS, offs_6_1);
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G3, AR9285_AN_RF2G3_PDVCCOMP, offs_0);
-
-        regVal = REG_READ(ah, 0x7834);
-        regVal |= 0x1;
-        REG_WRITE(ah, 0x7834, regVal);
-        regVal = REG_READ(ah, 0x9808);
-        regVal &= (~(0x1 << 27));
-        REG_WRITE(ah, 0x9808, regVal);
-
-        for (i = 0; i < ARRAY_SIZE(regList); i++)
-                REG_WRITE(ah, regList[i][0], regList[i][1]);
-
-        REG_RMW_FIELD(ah, AR9285_AN_RF2G6, AR9285_AN_RF2G6_CCOMP, ccomp_org);
-
-        if (AR_SREV_9285_11(ah))
-                REG_WRITE(ah, AR9285_AN_TOP4, AR9285_AN_TOP4_DEFAULT);
-
-}
-
-bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
-                        u8 rxchainmask, bool longcal)
-{
-        bool iscaldone = true;
-        struct ath9k_cal_list *currCal = ah->cal_list_curr;
-
-        if (currCal &&
-            (currCal->calState == CAL_RUNNING ||
-             currCal->calState == CAL_WAITING)) {
-                iscaldone = ath9k_hw_per_calibration(ah, chan,
-                                                     rxchainmask, currCal);
-                if (iscaldone) {
-                        ah->cal_list_curr = currCal = currCal->calNext;
-
-                        if (currCal->calState == CAL_WAITING) {
-                                iscaldone = false;
-                                ath9k_hw_reset_calibration(ah, currCal);
-                        }
-                }
-        }
-
-        /* Do NF cal only at longer intervals */
-        if (longcal) {
-                /* Do periodic PAOffset Cal */
-                if (AR_SREV_9271(ah)) {
-                        if (!ah->pacal_info.skipcount)
-                                ath9k_hw_9271_pa_cal(ah, false);
-                        else
-                                ah->pacal_info.skipcount--;
-                } else if (AR_SREV_9285_11_OR_LATER(ah)) {
-                        if (!ah->pacal_info.skipcount)
-                                ath9k_hw_9285_pa_cal(ah, false);
-                        else
-                                ah->pacal_info.skipcount--;
-                }
-
-                if (OLC_FOR_AR9280_20_LATER || OLC_FOR_AR9287_10_LATER)
-                        ath9k_olc_temp_compensation(ah);
-
-                /* Get the value from the previous NF cal and update history buffer */
-                ath9k_hw_getnf(ah, chan);
-
-                /*
-                 * Load the NF from history buffer of the current channel.
-                 * NF is slow time-variant, so it is OK to use a historical value.
-                 */
-                ath9k_hw_loadnf(ah, ah->curchan);
-
-                ath9k_hw_start_nfcal(ah);
-        }
-
-        return iscaldone;
-}
-EXPORT_SYMBOL(ath9k_hw_calibrate);
-
-/* Carrier leakage Calibration fix */
-static bool ar9285_cl_cal(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
-        if (IS_CHAN_HT20(chan)) {
-                REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
-                REG_SET_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
-                REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-                            AR_PHY_AGC_CONTROL_FLTR_CAL);
-                REG_CLR_BIT(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_CAL_ENABLE);
-                REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
-                if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
-                                  AR_PHY_AGC_CONTROL_CAL, 0, AH_WAIT_TIMEOUT)) {
-                        ath_print(common, ATH_DBG_CALIBRATE, "offset "
-                                  "calibration failed to complete in "
-                                  "1ms; noisy ??\n");
-                        return false;
-                }
-                REG_CLR_BIT(ah, AR_PHY_TURBO, AR_PHY_FC_DYN2040_EN);
-                REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_PARALLEL_CAL_ENABLE);
-                REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
-        }
-        REG_CLR_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
-        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
-        REG_SET_BIT(ah, AR_PHY_TPCRG1, AR_PHY_TPCRG1_PD_CAL_ENABLE);
-        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL);
-        if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
-                          0, AH_WAIT_TIMEOUT)) {
-                ath_print(common, ATH_DBG_CALIBRATE, "offset calibration "
-                          "failed to complete in 1ms; noisy ??\n");
-                return false;
-        }
-
-        REG_SET_BIT(ah, AR_PHY_ADC_CTL, AR_PHY_ADC_CTL_OFF_PWDADC);
-        REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
-        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_FLTR_CAL);
-
-        return true;
-}
-
-static bool ar9285_clc(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int i;
-        u_int32_t txgain_max;
-        u_int32_t clc_gain, gain_mask = 0, clc_num = 0;
-        u_int32_t reg_clc_I0, reg_clc_Q0;
-        u_int32_t i0_num = 0;
-        u_int32_t q0_num = 0;
-        u_int32_t total_num = 0;
-        u_int32_t reg_rf2g5_org;
-        bool retv = true;
-
-        if (!(ar9285_cl_cal(ah, chan)))
-                return false;
-
-        txgain_max = MS(REG_READ(ah, AR_PHY_TX_PWRCTRL7),
-                        AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX);
-
-        for (i = 0; i < (txgain_max+1); i++) {
-                clc_gain = (REG_READ(ah, (AR_PHY_TX_GAIN_TBL1+(i<<2))) &
-                           AR_PHY_TX_GAIN_CLC) >> AR_PHY_TX_GAIN_CLC_S;
-                if (!(gain_mask & (1 << clc_gain))) {
-                        gain_mask |= (1 << clc_gain);
-                        clc_num++;
-                }
-        }
-
-        for (i = 0; i < clc_num; i++) {
-                reg_clc_I0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
-                              & AR_PHY_CLC_I0) >> AR_PHY_CLC_I0_S;
-                reg_clc_Q0 = (REG_READ(ah, (AR_PHY_CLC_TBL1 + (i << 2)))
-                              & AR_PHY_CLC_Q0) >> AR_PHY_CLC_Q0_S;
-                if (reg_clc_I0 == 0)
-                        i0_num++;
-
-                if (reg_clc_Q0 == 0)
-                        q0_num++;
-        }
-        total_num = i0_num + q0_num;
-        if (total_num > AR9285_CLCAL_REDO_THRESH) {
-                reg_rf2g5_org = REG_READ(ah, AR9285_RF2G5);
-                if (AR_SREV_9285E_20(ah)) {
-                        REG_WRITE(ah, AR9285_RF2G5,
-                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
-                                  AR9285_RF2G5_IC50TX_XE_SET);
-                } else {
-                        REG_WRITE(ah, AR9285_RF2G5,
-                                  (reg_rf2g5_org & AR9285_RF2G5_IC50TX) |
-                                  AR9285_RF2G5_IC50TX_SET);
-                }
-                retv = ar9285_cl_cal(ah, chan);
-                REG_WRITE(ah, AR9285_RF2G5, reg_rf2g5_org);
-        }
-        return retv;
-}
-
-bool ath9k_hw_init_cal(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (AR_SREV_9271(ah) || AR_SREV_9285_12_OR_LATER(ah)) {
-                if (!ar9285_clc(ah, chan))
-                        return false;
-        } else {
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        if (!AR_SREV_9287_10_OR_LATER(ah))
-                                REG_CLR_BIT(ah, AR_PHY_ADC_CTL,
-                                            AR_PHY_ADC_CTL_OFF_PWDADC);
-                        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
-                                    AR_PHY_AGC_CONTROL_FLTR_CAL);
-                }
-
-                /* Calibrate the AGC */
-                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
-                          REG_READ(ah, AR_PHY_AGC_CONTROL) |
-                          AR_PHY_AGC_CONTROL_CAL);
-
-                /* Poll for offset calibration complete */
-                if (!ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL, AR_PHY_AGC_CONTROL_CAL,
-                                   0, AH_WAIT_TIMEOUT)) {
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "offset calibration failed to "
-                                  "complete in 1ms; noisy environment?\n");
-                        return false;
-                }
-
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        if (!AR_SREV_9287_10_OR_LATER(ah))
-                                REG_SET_BIT(ah, AR_PHY_ADC_CTL,
-                                            AR_PHY_ADC_CTL_OFF_PWDADC);
-                        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
-                                    AR_PHY_AGC_CONTROL_FLTR_CAL);
-                }
-        }
-
-        /* Do PA Calibration */
-        if (AR_SREV_9271(ah))
-                ath9k_hw_9271_pa_cal(ah, true);
-        else if (AR_SREV_9285_11_OR_LATER(ah))
-                ath9k_hw_9285_pa_cal(ah, true);
-
-        /* Do NF Calibration after DC offset and other calibrations */
-        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
-                  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_NF);
-
-        ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
-
-        /* Enable IQ, ADC Gain and ADC DC offset CALs */
-        if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah)) {
-                if (ath9k_hw_iscal_supported(ah, ADC_GAIN_CAL)) {
-                        INIT_CAL(&ah->adcgain_caldata);
-                        INSERT_CAL(ah, &ah->adcgain_caldata);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "enabling ADC Gain Calibration.\n");
-                }
-                if (ath9k_hw_iscal_supported(ah, ADC_DC_CAL)) {
-                        INIT_CAL(&ah->adcdc_caldata);
-                        INSERT_CAL(ah, &ah->adcdc_caldata);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "enabling ADC DC Calibration.\n");
-                }
-                if (ath9k_hw_iscal_supported(ah, IQ_MISMATCH_CAL)) {
-                        INIT_CAL(&ah->iq_caldata);
-                        INSERT_CAL(ah, &ah->iq_caldata);
-                        ath_print(common, ATH_DBG_CALIBRATE,
-                                  "enabling IQ Calibration.\n");
-                }
-
-                ah->cal_list_curr = ah->cal_list;
-
-                if (ah->cal_list_curr)
-                        ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
-        }
-
-        chan->CalValid = 0;
-
-        return true;
-}
-
-const struct ath9k_percal_data iq_cal_multi_sample = {
-        IQ_MISMATCH_CAL,
-        MAX_CAL_SAMPLES,
-        PER_MIN_LOG_COUNT,
-        ath9k_hw_iqcal_collect,
-        ath9k_hw_iqcalibrate
-};
-const struct ath9k_percal_data iq_cal_single_sample = {
-        IQ_MISMATCH_CAL,
-        MIN_CAL_SAMPLES,
-        PER_MAX_LOG_COUNT,
-        ath9k_hw_iqcal_collect,
-        ath9k_hw_iqcalibrate
-};
-const struct ath9k_percal_data adc_gain_cal_multi_sample = {
-        ADC_GAIN_CAL,
-        MAX_CAL_SAMPLES,
-        PER_MIN_LOG_COUNT,
-        ath9k_hw_adc_gaincal_collect,
-        ath9k_hw_adc_gaincal_calibrate
-};
-const struct ath9k_percal_data adc_gain_cal_single_sample = {
-        ADC_GAIN_CAL,
-        MIN_CAL_SAMPLES,
-        PER_MAX_LOG_COUNT,
-        ath9k_hw_adc_gaincal_collect,
-        ath9k_hw_adc_gaincal_calibrate
-};
-const struct ath9k_percal_data adc_dc_cal_multi_sample = {
-        ADC_DC_CAL,
-        MAX_CAL_SAMPLES,
-        PER_MIN_LOG_COUNT,
-        ath9k_hw_adc_dccal_collect,
-        ath9k_hw_adc_dccal_calibrate
-};
-const struct ath9k_percal_data adc_dc_cal_single_sample = {
-        ADC_DC_CAL,
-        MIN_CAL_SAMPLES,
-        PER_MAX_LOG_COUNT,
-        ath9k_hw_adc_dccal_collect,
-        ath9k_hw_adc_dccal_calibrate
-};
-const struct ath9k_percal_data adc_init_dc_cal = {
-        ADC_DC_INIT_CAL,
-        MIN_CAL_SAMPLES,
-        INIT_LOG_COUNT,
-        ath9k_hw_adc_dccal_collect,
-        ath9k_hw_adc_dccal_calibrate
-};
diff --git a/drivers/net/wireless/ath/ath9k/calib.h b/drivers/net/wireless/ath/ath9k/calib.h
index b2c873e97485..24538bdb9126 100644
--- a/drivers/net/wireless/ath/ath9k/calib.h
+++ b/drivers/net/wireless/ath/ath9k/calib.h
@@ -19,14 +19,6 @@
 
 #include "hw.h"
 
-extern const struct ath9k_percal_data iq_cal_multi_sample;
-extern const struct ath9k_percal_data iq_cal_single_sample;
-extern const struct ath9k_percal_data adc_gain_cal_multi_sample;
-extern const struct ath9k_percal_data adc_gain_cal_single_sample;
-extern const struct ath9k_percal_data adc_dc_cal_multi_sample;
-extern const struct ath9k_percal_data adc_dc_cal_single_sample;
-extern const struct ath9k_percal_data adc_init_dc_cal;
-
 #define AR_PHY_CCA_MAX_AR5416_GOOD_VALUE        -85
 #define AR_PHY_CCA_MAX_AR9280_GOOD_VALUE        -112
 #define AR_PHY_CCA_MAX_AR9285_GOOD_VALUE        -118
@@ -76,7 +68,8 @@ enum ath9k_cal_types {
         ADC_DC_INIT_CAL = 0x1,
         ADC_GAIN_CAL = 0x2,
         ADC_DC_CAL = 0x4,
-        IQ_MISMATCH_CAL = 0x8
+        IQ_MISMATCH_CAL = 0x8,
+        TEMP_COMP_CAL = 0x10,
 };
 
 enum ath9k_cal_state {
@@ -122,14 +115,12 @@ struct ath9k_pacal_info{
 
 bool ath9k_hw_reset_calvalid(struct ath_hw *ah);
 void ath9k_hw_start_nfcal(struct ath_hw *ah);
-void ath9k_hw_loadnf(struct ath_hw *ah, struct ath9k_channel *chan);
 int16_t ath9k_hw_getnf(struct ath_hw *ah,
                        struct ath9k_channel *chan);
 void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah);
 s16 ath9k_hw_getchan_noise(struct ath_hw *ah, struct ath9k_channel *chan);
-bool ath9k_hw_calibrate(struct ath_hw *ah, struct ath9k_channel *chan,
-                        u8 rxchainmask, bool longcal);
-bool ath9k_hw_init_cal(struct ath_hw *ah,
-                       struct ath9k_channel *chan);
+void ath9k_hw_reset_calibration(struct ath_hw *ah,
+                                struct ath9k_cal_list *currCal);
+
 
 #endif /* CALIB_H */
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index 09effdedc8c0..b4424a623cf5 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -212,7 +212,6 @@ int ath9k_cmn_rx_skb_preprocess(struct ath_common *common,
         rx_status->mactime = ath9k_hw_extend_tsf(ah, rx_stats->rs_tstamp);
         rx_status->band = hw->conf.channel->band;
         rx_status->freq = hw->conf.channel->center_freq;
-        rx_status->noise = common->ani.noise_floor;
         rx_status->signal = ATH_DEFAULT_NOISE_FLOOR + rx_stats->rs_rssi;
         rx_status->antenna = rx_stats->rs_antenna;
         rx_status->flag |= RX_FLAG_TSFT;
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 72a835d9e97f..e08f7e5a26e0 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -20,6 +20,7 @@
 #include "../debug.h"
 
 #include "hw.h"
+#include "hw-ops.h"
 
 /* Common header for Atheros 802.11n base driver cores */
 
@@ -76,11 +77,12 @@ struct ath_buf {
                                            an aggregate) */
         struct ath_buf *bf_next;        /* next subframe in the aggregate */
         struct sk_buff *bf_mpdu;        /* enclosing frame structure */
-        struct ath_desc *bf_desc;       /* virtual addr of desc */
+        void *bf_desc;                  /* virtual addr of desc */
         dma_addr_t bf_daddr;            /* physical addr of desc */
         dma_addr_t bf_buf_addr;         /* physical addr of data buffer */
         bool bf_stale;
         bool bf_isnullfunc;
+        bool bf_tx_aborted;
         u16 bf_flags;
         struct ath_buf_state bf_state;
         dma_addr_t bf_dmacontext;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 9a8e419398f9..64e30cd45d05 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -180,8 +180,15 @@ void ath_debug_stat_interrupt(struct ath_softc *sc, enum ath9k_int status)
 {
         if (status)
                 sc->debug.stats.istats.total++;
-        if (status & ATH9K_INT_RX)
-                sc->debug.stats.istats.rxok++;
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                if (status & ATH9K_INT_RXLP)
+                        sc->debug.stats.istats.rxlp++;
+                if (status & ATH9K_INT_RXHP)
+                        sc->debug.stats.istats.rxhp++;
+        } else {
+                if (status & ATH9K_INT_RX)
+                        sc->debug.stats.istats.rxok++;
+        }
         if (status & ATH9K_INT_RXEOL)
                 sc->debug.stats.istats.rxeol++;
         if (status & ATH9K_INT_RXORN)
@@ -223,8 +230,15 @@ static ssize_t read_file_interrupt(struct file *file, char __user *user_buf,
         char buf[512];
         unsigned int len = 0;
 
-        len += snprintf(buf + len, sizeof(buf) - len,
-                "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                len += snprintf(buf + len, sizeof(buf) - len,
+                        "%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
+                len += snprintf(buf + len, sizeof(buf) - len,
+                        "%8s: %10u\n", "RXHP", sc->debug.stats.istats.rxhp);
+        } else {
+                len += snprintf(buf + len, sizeof(buf) - len,
+                        "%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
+        }
         len += snprintf(buf + len, sizeof(buf) - len,
                 "%8s: %10u\n", "RXEOL", sc->debug.stats.istats.rxeol);
         len += snprintf(buf + len, sizeof(buf) - len,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index b2af9de755e6..c545960e7ec5 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -35,6 +35,8 @@ struct ath_buf;
  * struct ath_interrupt_stats - Contains statistics about interrupts
  * @total: Total no. of interrupts generated so far
  * @rxok: RX with no errors
+ * @rxlp: RX with low priority RX
+ * @rxhp: RX with high priority, uapsd only
  * @rxeol: RX with no more RXDESC available
  * @rxorn: RX FIFO overrun
  * @txok: TX completed at the requested rate
@@ -55,6 +57,8 @@ struct ath_buf;
 struct ath_interrupt_stats {
         u32 total;
         u32 rxok;
+        u32 rxlp;
+        u32 rxhp;
         u32 rxeol;
         u32 rxorn;
         u32 txok;
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
index dacaae934148..bd9dff3293dc 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom.c
@@ -256,14 +256,13 @@ int ath9k_hw_eeprom_init(struct ath_hw *ah)
 {
         int status;
 
-        if (AR_SREV_9287(ah)) {
-                ah->eep_map = EEP_MAP_AR9287;
-                ah->eep_ops = &eep_AR9287_ops;
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ah->eep_ops = &eep_ar9300_ops;
+        else if (AR_SREV_9287(ah)) {
+                ah->eep_ops = &eep_ar9287_ops;
         } else if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) {
-                ah->eep_map = EEP_MAP_4KBITS;
                 ah->eep_ops = &eep_4k_ops;
         } else {
-                ah->eep_map = EEP_MAP_DEFAULT;
                 ah->eep_ops = &eep_def_ops;
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/eeprom.h b/drivers/net/wireless/ath/ath9k/eeprom.h
index 2f2993b50e2f..21354c15a9a9 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/eeprom.h
@@ -19,6 +19,7 @@
 
 #include "../ath.h"
 #include <net/cfg80211.h>
+#include "ar9003_eeprom.h"
 
 #define AH_USE_EEPROM   0x1
 
@@ -93,7 +94,6 @@
  */
 #define AR9285_RDEXT_DEFAULT    0x1F
 
-#define AR_EEPROM_MAC(i)        (0x1d+(i))
 #define ATH9K_POW_SM(_r, _s)    (((_r) & 0x3f) << (_s))
 #define FREQ2FBIN(x, y)         ((y) ? ((x) - 2300) : (((x) - 4800) / 5))
 #define ath9k_hw_use_flash(_ah) (!(_ah->ah_flags & AH_USE_EEPROM))
@@ -155,6 +155,7 @@
 #define AR5416_BCHAN_UNUSED             0xFF
 #define AR5416_MAX_PWR_RANGE_IN_HALF_DB 64
 #define AR5416_MAX_CHAINS               3
+#define AR9300_MAX_CHAINS               3
 #define AR5416_PWR_TABLE_OFFSET_DB     -5
 
 /* Rx gain type values */
@@ -249,16 +250,20 @@ enum eeprom_param {
         EEP_MINOR_REV,
         EEP_TX_MASK,
         EEP_RX_MASK,
+        EEP_FSTCLK_5G,
         EEP_RXGAIN_TYPE,
-        EEP_TXGAIN_TYPE,
         EEP_OL_PWRCTRL,
+        EEP_TXGAIN_TYPE,
         EEP_RC_CHAIN_MASK,
         EEP_DAC_HPWR_5G,
         EEP_FRAC_N_5G,
         EEP_DEV_TYPE,
         EEP_TEMPSENSE_SLOPE,
         EEP_TEMPSENSE_SLOPE_PAL_ON,
-        EEP_PWR_TABLE_OFFSET
+        EEP_PWR_TABLE_OFFSET,
+        EEP_DRIVE_STRENGTH,
+        EEP_INTERNAL_REGULATOR,
+        EEP_SWREG
 };
 
 enum ar5416_rates {
@@ -295,7 +300,8 @@ struct base_eep_header {
         u32 binBuildNumber;
         u8 deviceType;
         u8 pwdclkind;
-        u8 futureBase_1[2];
+        u8 fastClk5g;
+        u8 divChain;
         u8 rxGainType;
         u8 dacHiPwrMode_5G;
         u8 openLoopPwrCntl;
@@ -656,13 +662,6 @@ struct ath9k_country_entry {
         u8 iso[3];
 };
 
-enum ath9k_eep_map {
-        EEP_MAP_DEFAULT = 0x0,
-        EEP_MAP_4KBITS,
-        EEP_MAP_AR9287,
-        EEP_MAP_MAX
-};
-
 struct eeprom_ops {
         int (*check_eeprom)(struct ath_hw *hw);
         u32 (*get_eeprom)(struct ath_hw *hw, enum eeprom_param param);
@@ -713,6 +712,8 @@ int ath9k_hw_eeprom_init(struct ath_hw *ah);
 
 extern const struct eeprom_ops eep_def_ops;
 extern const struct eeprom_ops eep_4k_ops;
-extern const struct eeprom_ops eep_AR9287_ops;
+extern const struct eeprom_ops eep_ar9287_ops;
+extern const struct eeprom_ops eep_ar9287_ops;
+extern const struct eeprom_ops eep_ar9300_ops;
 
 #endif /* EEPROM_H */
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index 0354fe50f8e0..41a77d1bd439 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "ar9002_phy.h"
 
 static int ath9k_hw_4k_get_eeprom_ver(struct ath_hw *ah)
 {
@@ -182,11 +183,11 @@ static u32 ath9k_hw_4k_get_eeprom(struct ath_hw *ah,
         switch (param) {
         case EEP_NFTHRESH_2:
                 return pModal->noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
+        case EEP_MAC_LSW:
                 return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
+        case EEP_MAC_MID:
                 return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
+        case EEP_MAC_MSW:
                 return pBase->macAddr[4] << 8 | pBase->macAddr[5];
         case EEP_REG_0:
                 return pBase->regDmn[0];
@@ -453,6 +454,8 @@ static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
                                             &tMinCalPower, gainBoundaries,
                                             pdadcValues, numXpdGain);
 
+                        ENABLE_REGWRITE_BUFFER(ah);
+
                         if ((i == 0) || AR_SREV_5416_20_OR_LATER(ah)) {
                                 REG_WRITE(ah, AR_PHY_TPCRG5 + regChainOffset,
                                           SM(pdGainOverlap_t2,
@@ -493,6 +496,9 @@ static void ath9k_hw_set_4k_power_cal_table(struct ath_hw *ah,
 
                                 regOffset += 4;
                         }
+
+                        REGWRITE_BUFFER_FLUSH(ah);
+                        DISABLE_REGWRITE_BUFFER(ah);
                 }
         }
 
@@ -758,6 +764,8 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                         ratesArray[i] -= AR5416_PWR_TABLE_OFFSET_DB * 2;
         }
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         /* OFDM power per rate */
         REG_WRITE(ah, AR_PHY_POWER_TX_RATE1,
                   ATH9K_POW_SM(ratesArray[rate18mb], 24)
@@ -820,6 +828,9 @@ static void ath9k_hw_4k_set_txpower(struct ath_hw *ah,
                           | ATH9K_POW_SM(ratesArray[rateDupOfdm], 8)
                           | ATH9K_POW_SM(ratesArray[rateDupCck], 0));
         }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static void ath9k_hw_4k_set_addac(struct ath_hw *ah,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index d8ca94c3fa0c..b471db5fb82d 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "ar9002_phy.h"
 
 static int ath9k_hw_AR9287_get_eeprom_ver(struct ath_hw *ah)
 {
@@ -172,11 +173,11 @@ static u32 ath9k_hw_AR9287_get_eeprom(struct ath_hw *ah,
         switch (param) {
         case EEP_NFTHRESH_2:
                 return pModal->noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
+        case EEP_MAC_LSW:
                 return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
+        case EEP_MAC_MID:
                 return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
+        case EEP_MAC_MSW:
                 return pBase->macAddr[4] << 8 | pBase->macAddr[5];
         case EEP_REG_0:
                 return pBase->regDmn[0];
@@ -1169,7 +1170,7 @@ static u16 ath9k_hw_AR9287_get_spur_channel(struct ath_hw *ah,
 #undef EEP_MAP9287_SPURCHAN
 }
 
-const struct eeprom_ops eep_AR9287_ops = {
+const struct eeprom_ops eep_ar9287_ops = {
         .check_eeprom           = ath9k_hw_AR9287_check_eeprom,
         .get_eeprom             = ath9k_hw_AR9287_get_eeprom,
         .fill_eeprom            = ath9k_hw_AR9287_fill_eeprom,
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 404a0341242c..e591ad6016e5 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -15,6 +15,7 @@
  */
 
 #include "hw.h"
+#include "ar9002_phy.h"
 
 static void ath9k_get_txgain_index(struct ath_hw *ah,
                 struct ath9k_channel *chan,
@@ -222,6 +223,12 @@ static int ath9k_hw_def_check_eeprom(struct ath_hw *ah)
                 return -EINVAL;
         }
 
+        /* Enable fixup for AR_AN_TOP2 if necessary */
+        if (AR_SREV_9280_10_OR_LATER(ah) &&
+            (eep->baseEepHeader.version & 0xff) > 0x0a &&
+            eep->baseEepHeader.pwdclkind == 0)
+                ah->need_an_top2_fixup = 1;
+
         return 0;
 }
 
@@ -237,11 +244,11 @@ static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
                 return pModal[0].noiseFloorThreshCh[0];
         case EEP_NFTHRESH_2:
                 return pModal[1].noiseFloorThreshCh[0];
-        case AR_EEPROM_MAC(0):
+        case EEP_MAC_LSW:
                 return pBase->macAddr[0] << 8 | pBase->macAddr[1];
-        case AR_EEPROM_MAC(1):
+        case EEP_MAC_MID:
                 return pBase->macAddr[2] << 8 | pBase->macAddr[3];
-        case AR_EEPROM_MAC(2):
+        case EEP_MAC_MSW:
                 return pBase->macAddr[4] << 8 | pBase->macAddr[5];
         case EEP_REG_0:
                 return pBase->regDmn[0];
@@ -267,6 +274,8 @@ static u32 ath9k_hw_def_get_eeprom(struct ath_hw *ah,
                 return pBase->txMask;
         case EEP_RX_MASK:
                 return pBase->rxMask;
+        case EEP_FSTCLK_5G:
+                return pBase->fastClk5g;
         case EEP_RXGAIN_TYPE:
                 return pBase->rxGainType;
         case EEP_TXGAIN_TYPE:
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index fe994e229898..74872ca76f9a 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -93,14 +93,24 @@ static int hif_usb_send_regout(struct hif_device_usb *hif_dev,
         return ret;
 }
 
+static inline void ath9k_skb_queue_purge(struct hif_device_usb *hif_dev,
+                                         struct sk_buff_head *list)
+{
+        struct sk_buff *skb;
+
+        while ((skb = __skb_dequeue(list)) != NULL) {
+                dev_kfree_skb_any(skb);
+                TX_STAT_INC(skb_dropped);
+        }
+}
+
 static void hif_usb_tx_cb(struct urb *urb)
 {
         struct tx_buf *tx_buf = (struct tx_buf *) urb->context;
         struct hif_device_usb *hif_dev = tx_buf->hif_dev;
         struct sk_buff *skb;
-        bool drop, flush;
 
-        if (!hif_dev)
+        if (!hif_dev || !tx_buf)
                 return;
 
         switch (urb->status) {
@@ -108,52 +118,47 @@ static void hif_usb_tx_cb(struct urb *urb)
                 break;
         case -ENOENT:
         case -ECONNRESET:
-                break;
         case -ENODEV:
         case -ESHUTDOWN:
+                /*
+                 * The URB has been killed, free the SKBs
+                 * and return.
+                 */
+                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
                 return;
         default:
                 break;
         }
 
-        if (tx_buf) {
-                spin_lock(&hif_dev->tx.tx_lock);
-                drop = !!(hif_dev->tx.flags & HIF_USB_TX_STOP);
-                flush = !!(hif_dev->tx.flags & HIF_USB_TX_FLUSH);
-                spin_unlock(&hif_dev->tx.tx_lock);
-
-                while ((skb = __skb_dequeue(&tx_buf->skb_queue)) != NULL) {
-                        if (!drop && !flush) {
-                                ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
-                                                          skb, 1);
-                                TX_STAT_INC(skb_completed);
-                        } else {
-                                dev_kfree_skb_any(skb);
-                        }
-                }
-
-                if (flush)
-                        return;
-
-                tx_buf->len = tx_buf->offset = 0;
-                __skb_queue_head_init(&tx_buf->skb_queue);
-
-                spin_lock(&hif_dev->tx.tx_lock);
-                list_del(&tx_buf->list);
-                list_add_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
-                hif_dev->tx.tx_buf_cnt++;
-                if (!drop)
-                        __hif_usb_tx(hif_dev); /* Check for pending SKBs */
-                TX_STAT_INC(buf_completed);
+        /* Check if TX has been stopped */
+        spin_lock(&hif_dev->tx.tx_lock);
+        if (hif_dev->tx.flags & HIF_USB_TX_STOP) {
                 spin_unlock(&hif_dev->tx.tx_lock);
-        }
-}
-
-static inline void ath9k_skb_queue_purge(struct sk_buff_head *list)
-{
-        struct sk_buff *skb;
-        while ((skb = __skb_dequeue(list)) != NULL)
-                dev_kfree_skb_any(skb);
+                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
+                goto add_free;
+        }
+        spin_unlock(&hif_dev->tx.tx_lock);
+
+        /* Complete the queued SKBs. */
+        while ((skb = __skb_dequeue(&tx_buf->skb_queue)) != NULL) {
+                ath9k_htc_txcompletion_cb(hif_dev->htc_handle,
+                                          skb, 1);
+                TX_STAT_INC(skb_completed);
+        }
+
+add_free:
+        /* Re-initialize the SKB queue */
+        tx_buf->len = tx_buf->offset = 0;
+        __skb_queue_head_init(&tx_buf->skb_queue);
+
+        /* Add this TX buffer to the free list */
+        spin_lock(&hif_dev->tx.tx_lock);
+        list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
+        hif_dev->tx.tx_buf_cnt++;
+        if (!(hif_dev->tx.flags & HIF_USB_TX_STOP))
+                __hif_usb_tx(hif_dev); /* Check for pending SKBs */
+        TX_STAT_INC(buf_completed);
+        spin_unlock(&hif_dev->tx.tx_lock);
 }
 
 /* TX lock has to be taken */
@@ -173,8 +178,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
                 return 0;
 
         tx_buf = list_first_entry(&hif_dev->tx.tx_buf, struct tx_buf, list);
-        list_del(&tx_buf->list);
-        list_add_tail(&tx_buf->list, &hif_dev->tx.tx_pending);
+        list_move_tail(&tx_buf->list, &hif_dev->tx.tx_pending);
         hif_dev->tx.tx_buf_cnt--;
 
         tx_skb_cnt = min_t(u16, hif_dev->tx.tx_skb_cnt, MAX_TX_AGGR_NUM);
@@ -214,7 +218,7 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
         ret = usb_submit_urb(tx_buf->urb, GFP_ATOMIC);
         if (ret) {
                 tx_buf->len = tx_buf->offset = 0;
-                ath9k_skb_queue_purge(&tx_buf->skb_queue);
+                ath9k_skb_queue_purge(hif_dev, &tx_buf->skb_queue);
                 __skb_queue_head_init(&tx_buf->skb_queue);
                 list_move_tail(&tx_buf->list, &hif_dev->tx.tx_buf);
                 hif_dev->tx.tx_buf_cnt++;
@@ -281,7 +285,7 @@ static void hif_usb_stop(void *hif_handle, u8 pipe_id)
         unsigned long flags;
 
         spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
-        ath9k_skb_queue_purge(&hif_dev->tx.tx_skb_queue);
+        ath9k_skb_queue_purge(hif_dev, &hif_dev->tx.tx_skb_queue);
         hif_dev->tx.tx_skb_cnt = 0;
         hif_dev->tx.flags |= HIF_USB_TX_STOP;
         spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
@@ -506,9 +510,18 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
         if (likely(urb->actual_length != 0)) {
                 skb_put(skb, urb->actual_length);
 
+                /* Process the command first */
+                ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
+                                 skb->len, USB_REG_IN_PIPE);
+
+
                 nskb = alloc_skb(MAX_REG_IN_BUF_SIZE, GFP_ATOMIC);
-                if (!nskb)
-                        goto resubmit;
+                if (!nskb) {
+                        dev_err(&hif_dev->udev->dev,
+                                "ath9k_htc: REG_IN memory allocation failure\n");
+                        urb->context = NULL;
+                        return;
+                }
 
                 usb_fill_int_urb(urb, hif_dev->udev,
                                  usb_rcvintpipe(hif_dev->udev, USB_REG_IN_PIPE),
@@ -518,12 +531,9 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)
                 ret = usb_submit_urb(urb, GFP_ATOMIC);
                 if (ret) {
                         kfree_skb(nskb);
-                        goto free;
+                        urb->context = NULL;
                 }
 
-                ath9k_htc_rx_msg(hif_dev->htc_handle, skb,
-                                 skb->len, USB_REG_IN_PIPE);
-
                 return;
         }
 
@@ -543,20 +553,17 @@ free:
 
 static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
 {
-        unsigned long flags;
         struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
 
-        list_for_each_entry_safe(tx_buf, tx_buf_tmp, &hif_dev->tx.tx_buf, list) {
+        list_for_each_entry_safe(tx_buf, tx_buf_tmp,
+                                 &hif_dev->tx.tx_buf, list) {
+                usb_kill_urb(tx_buf->urb);
                 list_del(&tx_buf->list);
                 usb_free_urb(tx_buf->urb);
                 kfree(tx_buf->buf);
                 kfree(tx_buf);
         }
 
-        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
-        hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
-        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
-
         list_for_each_entry_safe(tx_buf, tx_buf_tmp,
                                  &hif_dev->tx.tx_pending, list) {
                 usb_kill_urb(tx_buf->urb);
@@ -565,10 +572,6 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
                 kfree(tx_buf->buf);
                 kfree(tx_buf);
         }
-
-        spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
-        hif_dev->tx.flags &= ~HIF_USB_TX_FLUSH;
-        spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
 }
 
 static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
@@ -892,6 +895,26 @@ err_alloc:
         return ret;
 }
 
+static void ath9k_hif_usb_reboot(struct usb_device *udev)
+{
+        u32 reboot_cmd = 0xffffffff;
+        void *buf;
+        int ret;
+
+        buf = kmalloc(4, GFP_KERNEL);
+        if (!buf)
+                return;
+
+        memcpy(buf, &reboot_cmd, 4);
+
+        ret = usb_bulk_msg(udev, usb_sndbulkpipe(udev, USB_REG_OUT_PIPE),
+                           buf, 4, NULL, HZ);
+        if (ret)
+                dev_err(&udev->dev, "ath9k_htc: USB reboot failed\n");
+
+        kfree(buf);
+}
+
 static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
 {
         struct usb_device *udev = interface_to_usbdev(interface);
@@ -899,14 +922,15 @@ static void ath9k_hif_usb_disconnect(struct usb_interface *interface)
                 (struct hif_device_usb *) usb_get_intfdata(interface);
 
         if (hif_dev) {
-                ath9k_htc_hw_deinit(hif_dev->htc_handle, true);
+                ath9k_htc_hw_deinit(hif_dev->htc_handle,
+                    (udev->state == USB_STATE_NOTATTACHED) ? true : false);
                 ath9k_htc_hw_free(hif_dev->htc_handle);
                 ath9k_hif_usb_dev_deinit(hif_dev);
                 usb_set_intfdata(interface, NULL);
         }
 
         if (hif_dev->flags & HIF_USB_START)
-                usb_reset_device(udev);
+                ath9k_hif_usb_reboot(udev);
 
         kfree(hif_dev);
         dev_info(&udev->dev, "ath9k_htc: USB layer deinitialized\n");
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.h b/drivers/net/wireless/ath/ath9k/hif_usb.h
index 7d49a8af420e..0aca49b6fcb6 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.h
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.h
@@ -61,7 +61,6 @@ struct tx_buf {
 };
 
 #define HIF_USB_TX_STOP  BIT(0)
-#define HIF_USB_TX_FLUSH BIT(1)
 
 struct hif_usb_tx {
         u8 flags;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 78213fc71b09..1ae18bbc4d9e 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -124,13 +124,13 @@ struct ath9k_htc_cap_target {
 struct ath9k_htc_target_vif {
         u8 index;
         u8 des_bssid[ETH_ALEN];
-        enum htc_opmode opmode;
+        __be32 opmode;
         u8 myaddr[ETH_ALEN];
         u8 bssid[ETH_ALEN];
         u32 flags;
         u32 flags_ext;
         u16 ps_sta;
-        u16 rtsthreshold;
+        __be16 rtsthreshold;
         u8 ath_cap;
         u8 node;
         s8 mcast_rate;
@@ -151,7 +151,7 @@ struct ath9k_htc_target_sta {
         u8 sta_index;
         u8 vif_index;
         u8 vif_sta;
-        u16 flags; /* ATH_HTC_STA_* */
+        __be16 flags; /* ATH_HTC_STA_* */
         u16 htcap;
         u8 valid;
         u16 capinfo;
@@ -191,16 +191,16 @@ struct ath9k_htc_rate {
 struct ath9k_htc_target_rate {
         u8 sta_index;
         u8 isnew;
-        u32 capflags;
+        __be32 capflags;
         struct ath9k_htc_rate rates;
 };
 
 struct ath9k_htc_target_stats {
-        u32 tx_shortretry;
-        u32 tx_longretry;
-        u32 tx_xretries;
-        u32 ht_txunaggr_xretry;
-        u32 ht_tx_xretries;
+        __be32 tx_shortretry;
+        __be32 tx_longretry;
+        __be32 tx_xretries;
+        __be32 ht_txunaggr_xretry;
+        __be32 ht_tx_xretries;
 } __packed;
 
 struct ath9k_htc_vif {
@@ -261,6 +261,7 @@ struct ath_tx_stats {
         u32 buf_completed;
         u32 skb_queued;
         u32 skb_completed;
+        u32 skb_dropped;
 };
 
 struct ath_rx_stats {
@@ -328,6 +329,7 @@ struct htc_beacon_config {
 #define OP_ASSOCIATED     BIT(8)
 #define OP_ENABLE_BEACON  BIT(9)
 #define OP_LED_DEINIT     BIT(10)
+#define OP_UNPLUGGED      BIT(11)
 
 struct ath9k_htc_priv {
         struct device *dev;
@@ -377,6 +379,7 @@ struct ath9k_htc_priv {
         struct mutex htc_pm_lock;
         unsigned long ps_usecount;
         bool ps_enabled;
+        bool ps_idle;
 
         struct ath_led radio_led;
         struct ath_led assoc_led;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index 5e21f4d92ff5..7cb55f5b071c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -26,7 +26,8 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
         enum ath9k_int imask = 0;
         int dtimperiod, dtimcount, sleepduration;
         int cfpperiod, cfpcount, bmiss_timeout;
-        u32 nexttbtt = 0, intval, tsftu, htc_imask = 0;
+        u32 nexttbtt = 0, intval, tsftu;
+        __be32 htc_imask = 0;
         u64 tsf;
         int num_beacons, offset, dtim_dec_count, cfp_dec_count;
         int ret;
@@ -142,7 +143,8 @@ static void ath9k_htc_beacon_config_adhoc(struct ath9k_htc_priv *priv,
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
         enum ath9k_int imask = 0;
-        u32 nexttbtt, intval, htc_imask = 0;
+        u32 nexttbtt, intval;
+        __be32 htc_imask = 0;
         int ret;
         u8 cmd_rsp;
 
@@ -244,25 +246,20 @@ void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
                              struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(priv->ah);
-        enum nl80211_iftype iftype;
         struct htc_beacon_config *cur_conf = &priv->cur_beacon_conf;
+        struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
-        if (vif) {
-                struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
-                iftype = vif->type;
-                cur_conf->beacon_interval = bss_conf->beacon_int;
-                cur_conf->dtim_period = bss_conf->dtim_period;
-                cur_conf->listen_interval = 1;
-                cur_conf->dtim_count = 1;
-                cur_conf->bmiss_timeout =
-                        ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
-        } else
-                iftype = priv->ah->opmode;
-
+        cur_conf->beacon_interval = bss_conf->beacon_int;
         if (cur_conf->beacon_interval == 0)
                 cur_conf->beacon_interval = 100;
 
-        switch (iftype) {
+        cur_conf->dtim_period = bss_conf->dtim_period;
+        cur_conf->listen_interval = 1;
+        cur_conf->dtim_count = 1;
+        cur_conf->bmiss_timeout =
+                ATH_DEFAULT_BMISS_LIMIT * cur_conf->beacon_interval;
+
+        switch (vif->type) {
         case NL80211_IFTYPE_STATION:
                 ath9k_htc_beacon_config_sta(priv, cur_conf);
                 break;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index aed53573c547..701f2ef5a440 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -213,7 +213,7 @@ static int ath9k_reg_notifier(struct wiphy *wiphy,
                                       ath9k_hw_regulatory(priv->ah));
 }
 
-static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset)
+static unsigned int ath9k_regread(void *hw_priv, u32 reg_offset)
 {
         struct ath_hw *ah = (struct ath_hw *) hw_priv;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -235,7 +235,7 @@ static unsigned int ath9k_ioread32(void *hw_priv, u32 reg_offset)
         return be32_to_cpu(val);
 }
 
-static void ath9k_iowrite32(void *hw_priv, u32 val, u32 reg_offset)
+static void ath9k_regwrite_single(void *hw_priv, u32 val, u32 reg_offset)
 {
         struct ath_hw *ah = (struct ath_hw *) hw_priv;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -257,9 +257,105 @@ static void ath9k_iowrite32(void *hw_priv, u32 val, u32 reg_offset)
         }
 }
 
+static void ath9k_regwrite_buffer(void *hw_priv, u32 val, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+        u32 rsp_status;
+        int r;
+
+        mutex_lock(&priv->wmi->multi_write_mutex);
+
+        /* Store the register/value */
+        priv->wmi->multi_write[priv->wmi->multi_write_idx].reg =
+                cpu_to_be32(reg_offset);
+        priv->wmi->multi_write[priv->wmi->multi_write_idx].val =
+                cpu_to_be32(val);
+
+        priv->wmi->multi_write_idx++;
+
+        /* If the buffer is full, send it out. */
+        if (priv->wmi->multi_write_idx == MAX_CMD_NUMBER) {
+                r = ath9k_wmi_cmd(priv->wmi, WMI_REG_WRITE_CMDID,
+                          (u8 *) &priv->wmi->multi_write,
+                          sizeof(struct register_write) * priv->wmi->multi_write_idx,
+                          (u8 *) &rsp_status, sizeof(rsp_status),
+                          100);
+                if (unlikely(r)) {
+                        ath_print(common, ATH_DBG_WMI,
+                                  "REGISTER WRITE FAILED, multi len: %d\n",
+                                  priv->wmi->multi_write_idx);
+                }
+                priv->wmi->multi_write_idx = 0;
+        }
+
+        mutex_unlock(&priv->wmi->multi_write_mutex);
+}
+
+static void ath9k_regwrite(void *hw_priv, u32 val, u32 reg_offset)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        if (atomic_read(&priv->wmi->mwrite_cnt))
+                ath9k_regwrite_buffer(hw_priv, val, reg_offset);
+        else
+                ath9k_regwrite_single(hw_priv, val, reg_offset);
+}
+
+static void ath9k_enable_regwrite_buffer(void *hw_priv)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        atomic_inc(&priv->wmi->mwrite_cnt);
+}
+
+static void ath9k_disable_regwrite_buffer(void *hw_priv)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+
+        atomic_dec(&priv->wmi->mwrite_cnt);
+}
+
+static void ath9k_regwrite_flush(void *hw_priv)
+{
+        struct ath_hw *ah = (struct ath_hw *) hw_priv;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) common->priv;
+        u32 rsp_status;
+        int r;
+
+        mutex_lock(&priv->wmi->multi_write_mutex);
+
+        if (priv->wmi->multi_write_idx) {
+                r = ath9k_wmi_cmd(priv->wmi, WMI_REG_WRITE_CMDID,
+                          (u8 *) &priv->wmi->multi_write,
+                          sizeof(struct register_write) * priv->wmi->multi_write_idx,
+                          (u8 *) &rsp_status, sizeof(rsp_status),
+                          100);
+                if (unlikely(r)) {
+                        ath_print(common, ATH_DBG_WMI,
+                                  "REGISTER WRITE FAILED, multi len: %d\n",
+                                  priv->wmi->multi_write_idx);
+                }
+                priv->wmi->multi_write_idx = 0;
+        }
+
+        mutex_unlock(&priv->wmi->multi_write_mutex);
+}
+
 static const struct ath_ops ath9k_common_ops = {
-        .read = ath9k_ioread32,
-        .write = ath9k_iowrite32,
+        .read = ath9k_regread,
+        .write = ath9k_regwrite,
+        .enable_write_buffer = ath9k_enable_regwrite_buffer,
+        .disable_write_buffer = ath9k_disable_regwrite_buffer,
+        .write_flush = ath9k_regwrite_flush,
 };
 
 static void ath_usb_read_cachesize(struct ath_common *common, int *csz)
@@ -648,6 +744,9 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,
         if (ret)
                 goto err_init;
 
+        /* The device may have been unplugged earlier. */
+        priv->op_flags &= ~OP_UNPLUGGED;
+
         ret = ath9k_init_device(priv, devid);
         if (ret)
                 goto err_init;
@@ -664,6 +763,11 @@ err_free:
 void ath9k_htc_disconnect_device(struct htc_target *htc_handle, bool hotunplug)
 {
         if (htc_handle->drv_priv) {
+
+                /* Check if the device has been yanked out. */
+                if (hotunplug)
+                        htc_handle->drv_priv->op_flags |= OP_UNPLUGGED;
+
                 ath9k_deinit_device(htc_handle->drv_priv);
                 ath9k_deinit_wmi(htc_handle->drv_priv);
                 ieee80211_free_hw(htc_handle->drv_priv->hw);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index eb7722b2cfcc..ca7f3a78eb11 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -94,8 +94,11 @@ void ath9k_htc_ps_restore(struct ath9k_htc_priv *priv)
         if (--priv->ps_usecount != 0)
                 goto unlock;
 
-        if (priv->ps_enabled)
+        if (priv->ps_idle)
+                ath9k_hw_setpower(priv->ah, ATH9K_PM_FULL_SLEEP);
+        else if (priv->ps_enabled)
                 ath9k_hw_setpower(priv->ah, ATH9K_PM_NETWORK_SLEEP);
+
 unlock:
         mutex_unlock(&priv->htc_pm_lock);
 }
@@ -125,7 +128,7 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
         bool fastcc = true;
         struct ieee80211_channel *channel = hw->conf.channel;
         enum htc_phymode mode;
-        u16 htc_mode;
+        __be16 htc_mode;
         u8 cmd_rsp;
         int ret;
 
@@ -153,7 +156,6 @@ static int ath9k_htc_set_channel(struct ath9k_htc_priv *priv,
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset channel (%u Mhz) "
                           "reset status %d\n", channel->center_freq, ret);
-                ath9k_htc_ps_restore(priv);
                 goto err;
         }
 
@@ -378,7 +380,7 @@ static int ath9k_htc_init_rate(struct ath9k_htc_priv *priv,
         priv->tgt_rate.sta_index = ista->index;
         priv->tgt_rate.isnew = 1;
         trate = priv->tgt_rate;
-        priv->tgt_rate.capflags = caps;
+        priv->tgt_rate.capflags = cpu_to_be32(caps);
         trate.capflags = cpu_to_be32(caps);
 
         WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
@@ -426,6 +428,7 @@ static void ath9k_htc_rc_update(struct ath9k_htc_priv *priv, bool is_cw40)
         struct ath9k_htc_target_rate trate;
         struct ath_common *common = ath9k_hw_common(priv->ah);
         int ret;
+        u32 caps = be32_to_cpu(priv->tgt_rate.capflags);
         u8 cmd_rsp;
 
         memset(&trate, 0, sizeof(trate));
@@ -433,11 +436,12 @@ static void ath9k_htc_rc_update(struct ath9k_htc_priv *priv, bool is_cw40)
         trate = priv->tgt_rate;
 
         if (is_cw40)
-                priv->tgt_rate.capflags |= WLAN_RC_40_FLAG;
+                caps |= WLAN_RC_40_FLAG;
         else
-                priv->tgt_rate.capflags &= ~WLAN_RC_40_FLAG;
+                caps &= ~WLAN_RC_40_FLAG;
 
-        trate.capflags = cpu_to_be32(priv->tgt_rate.capflags);
+        priv->tgt_rate.capflags = cpu_to_be32(caps);
+        trate.capflags = cpu_to_be32(caps);
 
         WMI_CMD_BUF(WMI_RC_RATE_UPDATE_CMDID, &trate);
         if (ret) {
@@ -609,6 +613,9 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         len += snprintf(buf + len, sizeof(buf) - len,
                         "%20s : %10u\n", "SKBs completed",
                         priv->debug.tx_stats.skb_completed);
+        len += snprintf(buf + len, sizeof(buf) - len,
+                        "%20s : %10u\n", "SKBs dropped",
+                        priv->debug.tx_stats.skb_dropped);
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
@@ -960,7 +967,6 @@ void ath9k_deinit_leds(struct ath9k_htc_priv *priv)
         ath9k_unregister_led(&priv->tx_led);
         ath9k_unregister_led(&priv->rx_led);
         ath9k_unregister_led(&priv->radio_led);
-        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 1);
 }
 
 void ath9k_init_leds(struct ath9k_htc_priv *priv)
@@ -1093,7 +1099,7 @@ fail_tx:
         return 0;
 }
 
-static int ath9k_htc_start(struct ieee80211_hw *hw)
+static int ath9k_htc_radio_enable(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1102,15 +1108,13 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         struct ath9k_channel *init_channel;
         int ret = 0;
         enum htc_phymode mode;
-        u16 htc_mode;
+        __be16 htc_mode;
         u8 cmd_rsp;
 
         ath_print(common, ATH_DBG_CONFIG,
                   "Starting driver with initial channel: %d MHz\n",
                   curchan->center_freq);
 
-        mutex_lock(&priv->mutex);
-
         /* setup initial channel */
         init_channel = ath9k_cmn_get_curchannel(hw, ah);
 
@@ -1123,7 +1127,7 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
                 ath_print(common, ATH_DBG_FATAL,
                           "Unable to reset hardware; reset status %d "
                           "(freq %u MHz)\n", ret, curchan->center_freq);
-                goto mutex_unlock;
+                return ret;
         }
 
         ath_update_txpow(priv);
@@ -1131,16 +1135,8 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
         mode = ath9k_htc_get_curmode(priv, init_channel);
         htc_mode = cpu_to_be16(mode);
         WMI_CMD_BUF(WMI_SET_MODE_CMDID, &htc_mode);
-        if (ret)
-                goto mutex_unlock;
-
         WMI_CMD(WMI_ATH_INIT_CMDID);
-        if (ret)
-                goto mutex_unlock;
-
         WMI_CMD(WMI_START_RECV_CMDID);
-        if (ret)
-                goto mutex_unlock;
 
         ath9k_host_rx_init(priv);
 
@@ -1153,12 +1149,22 @@ static int ath9k_htc_start(struct ieee80211_hw *hw)
 
         ieee80211_wake_queues(hw);
 
-mutex_unlock:
+        return ret;
+}
+
+static int ath9k_htc_start(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+        int ret = 0;
+
+        mutex_lock(&priv->mutex);
+        ret = ath9k_htc_radio_enable(hw);
         mutex_unlock(&priv->mutex);
+
         return ret;
 }
 
-static void ath9k_htc_stop(struct ieee80211_hw *hw)
+static void ath9k_htc_radio_disable(struct ieee80211_hw *hw)
 {
         struct ath9k_htc_priv *priv = hw->priv;
         struct ath_hw *ah = priv->ah;
@@ -1166,14 +1172,18 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         int ret = 0;
         u8 cmd_rsp;
 
-        mutex_lock(&priv->mutex);
-
         if (priv->op_flags & OP_INVALID) {
                 ath_print(common, ATH_DBG_ANY, "Device not present\n");
-                mutex_unlock(&priv->mutex);
                 return;
         }
 
+        /* Cancel all the running timers/work .. */
+        cancel_work_sync(&priv->ps_work);
+        cancel_delayed_work_sync(&priv->ath9k_ani_work);
+        cancel_delayed_work_sync(&priv->ath9k_aggr_work);
+        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
+        ath9k_led_stop_brightness(priv);
+
         ath9k_htc_ps_wakeup(priv);
         htc_stop(priv->htc);
         WMI_CMD(WMI_DISABLE_INTR_CMDID);
@@ -1185,11 +1195,6 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         ath9k_htc_ps_restore(priv);
         ath9k_htc_setpower(priv, ATH9K_PM_FULL_SLEEP);
 
-        cancel_work_sync(&priv->ps_work);
-        cancel_delayed_work_sync(&priv->ath9k_ani_work);
-        cancel_delayed_work_sync(&priv->ath9k_aggr_work);
-        cancel_delayed_work_sync(&priv->ath9k_led_blink_work);
-        ath9k_led_stop_brightness(priv);
         skb_queue_purge(&priv->tx_queue);
 
         /* Remove monitor interface here */
@@ -1203,11 +1208,20 @@ static void ath9k_htc_stop(struct ieee80211_hw *hw)
         }
 
         priv->op_flags |= OP_INVALID;
-        mutex_unlock(&priv->mutex);
 
         ath_print(common, ATH_DBG_CONFIG, "Driver halt\n");
 }
 
+static void ath9k_htc_stop(struct ieee80211_hw *hw)
+{
+        struct ath9k_htc_priv *priv = hw->priv;
+
+        mutex_lock(&priv->mutex);
+        ath9k_htc_radio_disable(hw);
+        mutex_unlock(&priv->mutex);
+}
+
+
 static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                                    struct ieee80211_vif *vif)
 {
@@ -1321,6 +1335,23 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&priv->mutex);
 
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                bool enable_radio = false;
+                bool idle = !!(conf->flags & IEEE80211_CONF_IDLE);
+
+                if (!idle && priv->ps_idle)
+                        enable_radio = true;
+
+                priv->ps_idle = idle;
+
+                if (enable_radio) {
+                        ath9k_htc_setpower(priv, ATH9K_PM_AWAKE);
+                        ath9k_htc_radio_enable(hw);
+                        ath_print(common, ATH_DBG_CONFIG,
+                                  "not-idle: enabling radio\n");
+                }
+        }
+
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
                 struct ieee80211_channel *curchan = hw->conf.channel;
                 int pos = curchan->hw_value;
@@ -1364,6 +1395,13 @@ static int ath9k_htc_config(struct ieee80211_hw *hw, u32 changed)
                 }
         }
 
+        if (priv->ps_idle) {
+                ath_print(common, ATH_DBG_CONFIG,
+                          "idle: disabling radio\n");
+                ath9k_htc_radio_disable(hw);
+        }
+
+
         mutex_unlock(&priv->mutex);
 
         return 0;
@@ -1687,7 +1725,7 @@ static void ath9k_htc_sw_scan_complete(struct ieee80211_hw *hw)
         spin_unlock_bh(&priv->beacon_lock);
         priv->op_flags |= OP_FULL_RESET;
         if (priv->op_flags & OP_ASSOCIATED)
-                ath9k_htc_beacon_config(priv, NULL);
+                ath9k_htc_beacon_config(priv, priv->vif);
         ath_start_ani(priv);
         mutex_unlock(&priv->mutex);
         ath9k_htc_ps_restore(priv);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 0a7cb30af5b4..28abc7d5e909 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -244,16 +244,25 @@ void ath9k_htc_txep(void *drv_priv, struct sk_buff *skb,
                     enum htc_endpoint_id ep_id, bool txok)
 {
         struct ath9k_htc_priv *priv = (struct ath9k_htc_priv *) drv_priv;
+        struct ath_common *common = ath9k_hw_common(priv->ah);
         struct ieee80211_tx_info *tx_info;
 
         if (!skb)
                 return;
 
-        if (ep_id == priv->mgmt_ep)
+        if (ep_id == priv->mgmt_ep) {
                 skb_pull(skb, sizeof(struct tx_mgmt_hdr));
-        else
-                /* TODO: Check for cab/uapsd/data */
+        } else if ((ep_id == priv->data_bk_ep) ||
+                   (ep_id == priv->data_be_ep) ||
+                   (ep_id == priv->data_vi_ep) ||
+                   (ep_id == priv->data_vo_ep)) {
                 skb_pull(skb, sizeof(struct tx_frame_hdr));
+        } else {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unsupported TX EPID: %d\n", ep_id);
+                dev_kfree_skb_any(skb);
+                return;
+        }
 
         tx_info = IEEE80211_SKB_CB(skb);
 
@@ -439,10 +448,32 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
         struct ieee80211_hw *hw = priv->hw;
         struct sk_buff *skb = rxbuf->skb;
         struct ath_common *common = ath9k_hw_common(priv->ah);
+        struct ath_htc_rx_status *rxstatus;
         int hdrlen, padpos, padsize;
         int last_rssi = ATH_RSSI_DUMMY_MARKER;
         __le16 fc;
 
+        if (skb->len <= HTC_RX_FRAME_HEADER_SIZE) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Corrupted RX frame, dropping\n");
+                goto rx_next;
+        }
+
+        rxstatus = (struct ath_htc_rx_status *)skb->data;
+
+        if (be16_to_cpu(rxstatus->rs_datalen) -
+            (skb->len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Corrupted RX data len, dropping "
+                          "(dlen: %d, skblen: %d)\n",
+                          rxstatus->rs_datalen, skb->len);
+                goto rx_next;
+        }
+
+        /* Get the RX status information */
+        memcpy(&rxbuf->rxstatus, rxstatus, HTC_RX_FRAME_HEADER_SIZE);
+        skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
+
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = hdr->frame_control;
         hdrlen = ieee80211_get_hdrlen_from_skb(skb);
@@ -530,7 +561,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
                         priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
         }
 
-        rx_status->mactime = rxbuf->rxstatus.rs_tstamp;
+        rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
         rx_status->band = hw->conf.channel->band;
         rx_status->freq = hw->conf.channel->center_freq;
         rx_status->signal =  rxbuf->rxstatus.rs_rssi + ATH_DEFAULT_NOISE_FLOOR;
@@ -607,8 +638,6 @@ void ath9k_htc_rxep(void *drv_priv, struct sk_buff *skb,
         struct ath_hw *ah = priv->ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_htc_rxbuf *rxbuf = NULL, *tmp_buf = NULL;
-        struct ath_htc_rx_status *rxstatus;
-        u32 len = 0;
 
         spin_lock(&priv->rx.rxbuflock);
         list_for_each_entry(tmp_buf, &priv->rx.rxbuf, list) {
@@ -625,32 +654,7 @@ void ath9k_htc_rxep(void *drv_priv, struct sk_buff *skb,
                 goto err;
         }
 
-        len = skb->len;
-        if (len <= HTC_RX_FRAME_HEADER_SIZE) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Corrupted RX frame, dropping\n");
-                goto err;
-        }
-
-        rxstatus = (struct ath_htc_rx_status *)skb->data;
-
-        rxstatus->rs_tstamp = be64_to_cpu(rxstatus->rs_tstamp);
-        rxstatus->rs_datalen = be16_to_cpu(rxstatus->rs_datalen);
-        rxstatus->evm0 = be32_to_cpu(rxstatus->evm0);
-        rxstatus->evm1 = be32_to_cpu(rxstatus->evm1);
-        rxstatus->evm2 = be32_to_cpu(rxstatus->evm2);
-
-        if (rxstatus->rs_datalen - (len - HTC_RX_FRAME_HEADER_SIZE) != 0) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Corrupted RX data len, dropping "
-                          "(epid: %d, dlen: %d, skblen: %d)\n",
-                          ep_id, rxstatus->rs_datalen, len);
-                goto err;
-        }
-
         spin_lock(&priv->rx.rxbuflock);
-        memcpy(&rxbuf->rxstatus, rxstatus, HTC_RX_FRAME_HEADER_SIZE);
-        skb_pull(skb, HTC_RX_FRAME_HEADER_SIZE);
         rxbuf->skb = skb;
         rxbuf->in_process = true;
         spin_unlock(&priv->rx.rxbuflock);
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 587d98ed0989..7bf6ce1e7e2e 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -341,8 +341,9 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
                 skb_pull(skb, sizeof(struct htc_frame_hdr));
 
                 if (endpoint->ep_callbacks.tx) {
-                        endpoint->ep_callbacks.tx(htc_handle->drv_priv, skb,
-                                                  htc_hdr->endpoint_id, txok);
+                        endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
+                                                  skb, htc_hdr->endpoint_id,
+                                                  txok);
                 }
         }
 
@@ -368,7 +369,7 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
         struct htc_frame_hdr *htc_hdr;
         enum htc_endpoint_id epid;
         struct htc_endpoint *endpoint;
-        u16 *msg_id;
+        __be16 *msg_id;
 
         if (!htc_handle || !skb)
                 return;
@@ -388,14 +389,14 @@ void ath9k_htc_rx_msg(struct htc_target *htc_handle,
 
                 /* Handle trailer */
                 if (htc_hdr->flags & HTC_FLAGS_RECV_TRAILER) {
-                        if (be32_to_cpu(*(u32 *) skb->data) == 0x00C60000)
+                        if (be32_to_cpu(*(__be32 *) skb->data) == 0x00C60000)
                                 /* Move past the Watchdog pattern */
                                 htc_hdr = (struct htc_frame_hdr *)(skb->data + 4);
                 }
 
                 /* Get the message ID */
-                msg_id = (u16 *) ((void *) htc_hdr +
-                                           sizeof(struct htc_frame_hdr));
+                msg_id = (__be16 *) ((void *) htc_hdr +
+                                     sizeof(struct htc_frame_hdr));
 
                 /* Now process HTC messages */
                 switch (be16_to_cpu(*msg_id)) {
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.h b/drivers/net/wireless/ath/ath9k/htc_hst.h
index cd7048ffd239..ea50ab032d20 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.h
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.h
@@ -59,20 +59,20 @@ enum htc_endpoint_id {
 struct htc_frame_hdr {
         u8 endpoint_id;
         u8 flags;
-        u16 payload_len;
+        __be16 payload_len;
         u8 control[4];
 } __packed;
 
 struct htc_ready_msg {
-        u16 message_id;
-        u16 credits;
-        u16 credit_size;
+        __be16 message_id;
+        __be16 credits;
+        __be16 credit_size;
         u8 max_endpoints;
         u8 pad;
 } __packed;
 
 struct htc_config_pipe_msg {
-        u16 message_id;
+        __be16 message_id;
         u8 pipe_id;
         u8 credits;
 } __packed;
@@ -192,9 +192,9 @@ enum htc_service_group_ids{
 #define WMI_DATA_BK_SVC   MAKE_SERVICE_ID(WMI_SERVICE_GROUP, 8)
 
 struct htc_conn_svc_msg {
-        u16 msg_id;
-        u16 service_id;
-        u16 con_flags;
+        __be16 msg_id;
+        __be16 service_id;
+        __be16 con_flags;
         u8 dl_pipeid;
         u8 ul_pipeid;
         u8 svc_meta_len;
@@ -209,17 +209,17 @@ struct htc_conn_svc_msg {
 #define HTC_SERVICE_NO_MORE_EP   4
 
 struct htc_conn_svc_rspmsg {
-        u16 msg_id;
-        u16 service_id;
+        __be16 msg_id;
+        __be16 service_id;
         u8 status;
         u8 endpoint_id;
-        u16 max_msg_len;
+        __be16 max_msg_len;
         u8 svc_meta_len;
         u8 pad;
 } __packed;
 
 struct htc_comp_msg {
-        u16 msg_id;
+        __be16 msg_id;
 } __packed;
 
 int htc_init(struct htc_target *target);
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
new file mode 100644
index 000000000000..624422a8169e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -0,0 +1,280 @@
+/*
+ * Copyright (c) 2010 Atheros Communications Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef ATH9K_HW_OPS_H
+#define ATH9K_HW_OPS_H
+
+#include "hw.h"
+
+/* Hardware core and driver accessible callbacks */
+
+static inline void ath9k_hw_configpcipowersave(struct ath_hw *ah,
+                                               int restore,
+                                               int power_off)
+{
+        ath9k_hw_ops(ah)->config_pci_powersave(ah, restore, power_off);
+}
+
+static inline void ath9k_hw_rxena(struct ath_hw *ah)
+{
+        ath9k_hw_ops(ah)->rx_enable(ah);
+}
+
+static inline void ath9k_hw_set_desc_link(struct ath_hw *ah, void *ds,
+                                          u32 link)
+{
+        ath9k_hw_ops(ah)->set_desc_link(ds, link);
+}
+
+static inline void ath9k_hw_get_desc_link(struct ath_hw *ah, void *ds,
+                                          u32 **link)
+{
+        ath9k_hw_ops(ah)->get_desc_link(ds, link);
+}
+static inline bool ath9k_hw_calibrate(struct ath_hw *ah,
+                                      struct ath9k_channel *chan,
+                                      u8 rxchainmask,
+                                      bool longcal)
+{
+        return ath9k_hw_ops(ah)->calibrate(ah, chan, rxchainmask, longcal);
+}
+
+static inline bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
+{
+        return ath9k_hw_ops(ah)->get_isr(ah, masked);
+}
+
+static inline void ath9k_hw_filltxdesc(struct ath_hw *ah, void *ds, u32 seglen,
+                                  bool is_firstseg, bool is_lastseg,
+                                  const void *ds0, dma_addr_t buf_addr,
+                                  unsigned int qcu)
+{
+        ath9k_hw_ops(ah)->fill_txdesc(ah, ds, seglen, is_firstseg, is_lastseg,
+                                      ds0, buf_addr, qcu);
+}
+
+static inline int ath9k_hw_txprocdesc(struct ath_hw *ah, void *ds,
+                                      struct ath_tx_status *ts)
+{
+        return ath9k_hw_ops(ah)->proc_txdesc(ah, ds, ts);
+}
+
+static inline void ath9k_hw_set11n_txdesc(struct ath_hw *ah, void *ds,
+                                          u32 pktLen, enum ath9k_pkt_type type,
+                                          u32 txPower, u32 keyIx,
+                                          enum ath9k_key_type keyType,
+                                          u32 flags)
+{
+        ath9k_hw_ops(ah)->set11n_txdesc(ah, ds, pktLen, type, txPower, keyIx,
+                                      keyType, flags);
+}
+
+static inline void ath9k_hw_set11n_ratescenario(struct ath_hw *ah, void *ds,
+                                        void *lastds,
+                                        u32 durUpdateEn, u32 rtsctsRate,
+                                        u32 rtsctsDuration,
+                                        struct ath9k_11n_rate_series series[],
+                                        u32 nseries, u32 flags)
+{
+        ath9k_hw_ops(ah)->set11n_ratescenario(ah, ds, lastds, durUpdateEn,
+                                            rtsctsRate, rtsctsDuration, series,
+                                            nseries, flags);
+}
+
+static inline void ath9k_hw_set11n_aggr_first(struct ath_hw *ah, void *ds,
+                                        u32 aggrLen)
+{
+        ath9k_hw_ops(ah)->set11n_aggr_first(ah, ds, aggrLen);
+}
+
+static inline void ath9k_hw_set11n_aggr_middle(struct ath_hw *ah, void *ds,
+                                               u32 numDelims)
+{
+        ath9k_hw_ops(ah)->set11n_aggr_middle(ah, ds, numDelims);
+}
+
+static inline void ath9k_hw_set11n_aggr_last(struct ath_hw *ah, void *ds)
+{
+        ath9k_hw_ops(ah)->set11n_aggr_last(ah, ds);
+}
+
+static inline void ath9k_hw_clr11n_aggr(struct ath_hw *ah, void *ds)
+{
+        ath9k_hw_ops(ah)->clr11n_aggr(ah, ds);
+}
+
+static inline void ath9k_hw_set11n_burstduration(struct ath_hw *ah, void *ds,
+                                                 u32 burstDuration)
+{
+        ath9k_hw_ops(ah)->set11n_burstduration(ah, ds, burstDuration);
+}
+
+static inline void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, void *ds,
+                                                   u32 vmf)
+{
+        ath9k_hw_ops(ah)->set11n_virtualmorefrag(ah, ds, vmf);
+}
+
+/* Private hardware call ops */
+
+/* PHY ops */
+
+static inline int ath9k_hw_rf_set_freq(struct ath_hw *ah,
+                                       struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->rf_set_freq(ah, chan);
+}
+
+static inline void ath9k_hw_spur_mitigate_freq(struct ath_hw *ah,
+                                               struct ath9k_channel *chan)
+{
+        ath9k_hw_private_ops(ah)->spur_mitigate_freq(ah, chan);
+}
+
+static inline int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->rf_alloc_ext_banks)
+                return 0;
+
+        return ath9k_hw_private_ops(ah)->rf_alloc_ext_banks(ah);
+}
+
+static inline void ath9k_hw_rf_free_ext_banks(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->rf_free_ext_banks)
+                return;
+
+        ath9k_hw_private_ops(ah)->rf_free_ext_banks(ah);
+}
+
+static inline bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
+                                        struct ath9k_channel *chan,
+                                        u16 modesIndex)
+{
+        if (!ath9k_hw_private_ops(ah)->set_rf_regs)
+                return true;
+
+        return ath9k_hw_private_ops(ah)->set_rf_regs(ah, chan, modesIndex);
+}
+
+static inline void ath9k_hw_init_bb(struct ath_hw *ah,
+                                    struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->init_bb(ah, chan);
+}
+
+static inline void ath9k_hw_set_channel_regs(struct ath_hw *ah,
+                                             struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->set_channel_regs(ah, chan);
+}
+
+static inline int ath9k_hw_process_ini(struct ath_hw *ah,
+                                        struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->process_ini(ah, chan);
+}
+
+static inline void ath9k_olc_init(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->olc_init)
+                return;
+
+        return ath9k_hw_private_ops(ah)->olc_init(ah);
+}
+
+static inline void ath9k_hw_set_rfmode(struct ath_hw *ah,
+                                       struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->set_rfmode(ah, chan);
+}
+
+static inline void ath9k_hw_mark_phy_inactive(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->mark_phy_inactive(ah);
+}
+
+static inline void ath9k_hw_set_delta_slope(struct ath_hw *ah,
+                                            struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->set_delta_slope(ah, chan);
+}
+
+static inline bool ath9k_hw_rfbus_req(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->rfbus_req(ah);
+}
+
+static inline void ath9k_hw_rfbus_done(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->rfbus_done(ah);
+}
+
+static inline void ath9k_enable_rfkill(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->enable_rfkill(ah);
+}
+
+static inline void ath9k_hw_restore_chainmask(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->restore_chainmask)
+                return;
+
+        return ath9k_hw_private_ops(ah)->restore_chainmask(ah);
+}
+
+static inline void ath9k_hw_set_diversity(struct ath_hw *ah, bool value)
+{
+        return ath9k_hw_private_ops(ah)->set_diversity(ah, value);
+}
+
+static inline bool ath9k_hw_ani_control(struct ath_hw *ah,
+                                        enum ath9k_ani_cmd cmd, int param)
+{
+        return ath9k_hw_private_ops(ah)->ani_control(ah, cmd, param);
+}
+
+static inline void ath9k_hw_do_getnf(struct ath_hw *ah,
+                                     int16_t nfarray[NUM_NF_READINGS])
+{
+        ath9k_hw_private_ops(ah)->do_getnf(ah, nfarray);
+}
+
+static inline void ath9k_hw_loadnf(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+        ath9k_hw_private_ops(ah)->loadnf(ah, chan);
+}
+
+static inline bool ath9k_hw_init_cal(struct ath_hw *ah,
+                                     struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->init_cal(ah, chan);
+}
+
+static inline void ath9k_hw_setup_calibration(struct ath_hw *ah,
+                                              struct ath9k_cal_list *currCal)
+{
+        ath9k_hw_private_ops(ah)->setup_calibration(ah, currCal);
+}
+
+static inline bool ath9k_hw_iscal_supported(struct ath_hw *ah,
+                                            enum ath9k_cal_types calType)
+{
+        return ath9k_hw_private_ops(ah)->iscal_supported(ah, calType);
+}
+
+#endif /* ATH9K_HW_OPS_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index af730c7d50e6..559019262d30 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 Atheros Communications Inc.
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -19,15 +19,16 @@
 #include <asm/unaligned.h>
 
 #include "hw.h"
+#include "hw-ops.h"
 #include "rc.h"
-#include "initvals.h"
+#include "ar9003_mac.h"
 
 #define ATH9K_CLOCK_RATE_CCK            22
 #define ATH9K_CLOCK_RATE_5GHZ_OFDM      40
 #define ATH9K_CLOCK_RATE_2GHZ_OFDM      44
+#define ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM 44
 
 static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type);
-static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan);
 
 MODULE_AUTHOR("Atheros Communications");
 MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
@@ -46,6 +47,39 @@ static void __exit ath9k_exit(void)
 }
 module_exit(ath9k_exit);
 
+/* Private hardware callbacks */
+
+static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_cal_settings(ah);
+}
+
+static void ath9k_hw_init_mode_regs(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_mode_regs(ah);
+}
+
+static bool ath9k_hw_macversion_supported(struct ath_hw *ah)
+{
+        struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
+
+        return priv_ops->macversion_supported(ah->hw_version.macVersion);
+}
+
+static u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
+                                        struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->compute_pll_control(ah, chan);
+}
+
+static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->init_mode_gain_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
+}
+
 /********************/
 /* Helper Functions */
 /********************/
@@ -58,7 +92,11 @@ static u32 ath9k_hw_mac_clks(struct ath_hw *ah, u32 usecs)
                 return usecs *ATH9K_CLOCK_RATE_CCK;
         if (conf->channel->band == IEEE80211_BAND_2GHZ)
                 return usecs *ATH9K_CLOCK_RATE_2GHZ_OFDM;
-        return usecs *ATH9K_CLOCK_RATE_5GHZ_OFDM;
+
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK)
+                return usecs * ATH9K_CLOCK_FAST_RATE_5GHZ_OFDM;
+        else
+                return usecs * ATH9K_CLOCK_RATE_5GHZ_OFDM;
 }
 
 static u32 ath9k_hw_mac_to_clks(struct ath_hw *ah, u32 usecs)
@@ -233,21 +271,6 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         }
 }
 
-static int ath9k_hw_get_radiorev(struct ath_hw *ah)
-{
-        u32 val;
-        int i;
-
-        REG_WRITE(ah, AR_PHY(0x36), 0x00007058);
-
-        for (i = 0; i < 8; i++)
-                REG_WRITE(ah, AR_PHY(0x20), 0x00010000);
-        val = (REG_READ(ah, AR_PHY(256)) >> 24) & 0xff;
-        val = ((val & 0xf0) >> 4) | ((val & 0x0f) << 4);
-
-        return ath9k_hw_reverse_bits(val, 8);
-}
-
 /************************************/
 /* HW Attach, Detach, Init Routines */
 /************************************/
@@ -257,6 +280,8 @@ static void ath9k_hw_disablepcie(struct ath_hw *ah)
         if (AR_SREV_9100(ah))
                 return;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_PCIE_SERDES, 0x9248fc00);
         REG_WRITE(ah, AR_PCIE_SERDES, 0x24924924);
         REG_WRITE(ah, AR_PCIE_SERDES, 0x28000029);
@@ -268,20 +293,30 @@ static void ath9k_hw_disablepcie(struct ath_hw *ah)
         REG_WRITE(ah, AR_PCIE_SERDES, 0x000e1007);
 
         REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
+/* This should work for all families including legacy */
 static bool ath9k_hw_chip_test(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        u32 regAddr[2] = { AR_STA_ID0, AR_PHY_BASE + (8 << 2) };
+        u32 regAddr[2] = { AR_STA_ID0 };
         u32 regHold[2];
         u32 patternData[4] = { 0x55555555,
                                0xaaaaaaaa,
                                0x66666666,
                                0x99999999 };
-        int i, j;
+        int i, j, loop_max;
 
-        for (i = 0; i < 2; i++) {
+        if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                loop_max = 2;
+                regAddr[1] = AR_PHY_BASE + (8 << 2);
+        } else
+                loop_max = 1;
+
+        for (i = 0; i < loop_max; i++) {
                 u32 addr = regAddr[i];
                 u32 wrData, rdData;
 
@@ -336,7 +371,13 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.ofdm_trig_high = 500;
         ah->config.cck_trig_high = 200;
         ah->config.cck_trig_low = 100;
-        ah->config.enable_ani = 1;
+
+        /*
+         * For now ANI is disabled for AR9003, it is still
+         * being tested.
+         */
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ah->config.enable_ani = 1;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
                 ah->config.spurchans[i][0] = AR_NO_SPUR;
@@ -351,6 +392,12 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.rx_intr_mitigation = true;
 
         /*
+         * Tx IQ Calibration (ah->config.tx_iq_calibration) is only
+         * used by AR9003, but it is showing reliability issues.
+         * It will take a while to fix so this is currently disabled.
+         */
+
+        /*
          * We need this for PCI devices only (Cardbus, PCI, miniPCI)
          * _and_ if on non-uniprocessor systems (Multiprocessor/HT).
          * This means we use it for all AR5416 devices, and the few
@@ -369,7 +416,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         if (num_possible_cpus() > 1)
                 ah->config.serialize_regmode = SER_REG_MODE_AUTO;
 }
-EXPORT_SYMBOL(ath9k_hw_init);
 
 static void ath9k_hw_init_defaults(struct ath_hw *ah)
 {
@@ -383,8 +429,6 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->hw_version.subvendorid = 0;
 
         ah->ah_flags = 0;
-        if (ah->hw_version.devid == AR5416_AR9100_DEVID)
-                ah->hw_version.macVersion = AR_SREV_VERSION_9100;
         if (!AR_SREV_9100(ah))
                 ah->ah_flags = AH_USE_EEPROM;
 
@@ -397,44 +441,17 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->power_mode = ATH9K_PM_UNDEFINED;
 }
 
-static int ath9k_hw_rf_claim(struct ath_hw *ah)
-{
-        u32 val;
-
-        REG_WRITE(ah, AR_PHY(0), 0x00000007);
-
-        val = ath9k_hw_get_radiorev(ah);
-        switch (val & AR_RADIO_SREV_MAJOR) {
-        case 0:
-                val = AR_RAD5133_SREV_MAJOR;
-                break;
-        case AR_RAD5133_SREV_MAJOR:
-        case AR_RAD5122_SREV_MAJOR:
-        case AR_RAD2133_SREV_MAJOR:
-        case AR_RAD2122_SREV_MAJOR:
-                break;
-        default:
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "Radio Chip Rev 0x%02X not supported\n",
-                          val & AR_RADIO_SREV_MAJOR);
-                return -EOPNOTSUPP;
-        }
-
-        ah->hw_version.analog5GhzRev = val;
-
-        return 0;
-}
-
 static int ath9k_hw_init_macaddr(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         u32 sum;
         int i;
         u16 eeval;
+        u32 EEP_MAC[] = { EEP_MAC_LSW, EEP_MAC_MID, EEP_MAC_MSW };
 
         sum = 0;
         for (i = 0; i < 3; i++) {
-                eeval = ah->eep_ops->get_eeprom(ah, AR_EEPROM_MAC(i));
+                eeval = ah->eep_ops->get_eeprom(ah, EEP_MAC[i]);
                 sum += eeval;
                 common->macaddr[2 * i] = eeval >> 8;
                 common->macaddr[2 * i + 1] = eeval & 0xff;
@@ -445,54 +462,6 @@ static int ath9k_hw_init_macaddr(struct ath_hw *ah)
         return 0;
 }
 
-static void ath9k_hw_init_rxgain_ini(struct ath_hw *ah)
-{
-        u32 rxgain_type;
-
-        if (ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV) >= AR5416_EEP_MINOR_VER_17) {
-                rxgain_type = ah->eep_ops->get_eeprom(ah, EEP_RXGAIN_TYPE);
-
-                if (rxgain_type == AR5416_EEP_RXGAIN_13DB_BACKOFF)
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                        ar9280Modes_backoff_13db_rxgain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_backoff_13db_rxgain_9280_2), 6);
-                else if (rxgain_type == AR5416_EEP_RXGAIN_23DB_BACKOFF)
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                        ar9280Modes_backoff_23db_rxgain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_backoff_23db_rxgain_9280_2), 6);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesRxGain,
-                        ar9280Modes_original_rxgain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_original_rxgain_9280_2), 6);
-        } else {
-                INIT_INI_ARRAY(&ah->iniModesRxGain,
-                        ar9280Modes_original_rxgain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_original_rxgain_9280_2), 6);
-        }
-}
-
-static void ath9k_hw_init_txgain_ini(struct ath_hw *ah)
-{
-        u32 txgain_type;
-
-        if (ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV) >= AR5416_EEP_MINOR_VER_19) {
-                txgain_type = ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE);
-
-                if (txgain_type == AR5416_EEP_TXGAIN_HIGH_POWER)
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9280Modes_high_power_tx_gain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_high_power_tx_gain_9280_2), 6);
-                else
-                        INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9280Modes_original_tx_gain_9280_2,
-                        ARRAY_SIZE(ar9280Modes_original_tx_gain_9280_2), 6);
-        } else {
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                ar9280Modes_original_tx_gain_9280_2,
-                ARRAY_SIZE(ar9280Modes_original_tx_gain_9280_2), 6);
-        }
-}
-
 static int ath9k_hw_post_init(struct ath_hw *ah)
 {
         int ecode;
@@ -502,9 +471,11 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                         return -ENODEV;
         }
 
-        ecode = ath9k_hw_rf_claim(ah);
-        if (ecode != 0)
-                return ecode;
+        if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                ecode = ar9002_hw_rf_claim(ah);
+                if (ecode != 0)
+                        return ecode;
+        }
 
         ecode = ath9k_hw_eeprom_init(ah);
         if (ecode != 0)
@@ -515,14 +486,12 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                   ah->eep_ops->get_eeprom_ver(ah),
                   ah->eep_ops->get_eeprom_rev(ah));
 
-        if (!AR_SREV_9280_10_OR_LATER(ah)) {
-                ecode = ath9k_hw_rf_alloc_ext_banks(ah);
-                if (ecode) {
-                        ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                                  "Failed allocating banks for "
-                                  "external radio\n");
-                        return ecode;
-                }
+        ecode = ath9k_hw_rf_alloc_ext_banks(ah);
+        if (ecode) {
+                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
+                          "Failed allocating banks for "
+                          "external radio\n");
+                return ecode;
         }
 
         if (!AR_SREV_9100(ah)) {
@@ -533,344 +502,22 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
         return 0;
 }
 
-static bool ath9k_hw_devid_supported(u16 devid)
-{
-        switch (devid) {
-        case AR5416_DEVID_PCI:
-        case AR5416_DEVID_PCIE:
-        case AR5416_AR9100_DEVID:
-        case AR9160_DEVID_PCI:
-        case AR9280_DEVID_PCI:
-        case AR9280_DEVID_PCIE:
-        case AR9285_DEVID_PCIE:
-        case AR5416_DEVID_AR9287_PCI:
-        case AR5416_DEVID_AR9287_PCIE:
-        case AR2427_DEVID_PCIE:
-                return true;
-        default:
-                break;
-        }
-        return false;
-}
-
-static bool ath9k_hw_macversion_supported(u32 macversion)
+static void ath9k_hw_attach_ops(struct ath_hw *ah)
 {
-        switch (macversion) {
-        case AR_SREV_VERSION_5416_PCI:
-        case AR_SREV_VERSION_5416_PCIE:
-        case AR_SREV_VERSION_9160:
-        case AR_SREV_VERSION_9100:
-        case AR_SREV_VERSION_9280:
-        case AR_SREV_VERSION_9285:
-        case AR_SREV_VERSION_9287:
-        case AR_SREV_VERSION_9271:
-                return true;
-        default:
-                break;
-        }
-        return false;
-}
-
-static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
-{
-        if (AR_SREV_9160_10_OR_LATER(ah)) {
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        ah->iq_caldata.calData = &iq_cal_single_sample;
-                        ah->adcgain_caldata.calData =
-                                &adc_gain_cal_single_sample;
-                        ah->adcdc_caldata.calData =
-                                &adc_dc_cal_single_sample;
-                        ah->adcdc_calinitdata.calData =
-                                &adc_init_dc_cal;
-                } else {
-                        ah->iq_caldata.calData = &iq_cal_multi_sample;
-                        ah->adcgain_caldata.calData =
-                                &adc_gain_cal_multi_sample;
-                        ah->adcdc_caldata.calData =
-                                &adc_dc_cal_multi_sample;
-                        ah->adcdc_calinitdata.calData =
-                                &adc_init_dc_cal;
-                }
-                ah->supp_cals = ADC_GAIN_CAL | ADC_DC_CAL | IQ_MISMATCH_CAL;
-        }
-}
-
-static void ath9k_hw_init_mode_regs(struct ath_hw *ah)
-{
-        if (AR_SREV_9271(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9271Modes_9271,
-                               ARRAY_SIZE(ar9271Modes_9271), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9271Common_9271,
-                               ARRAY_SIZE(ar9271Common_9271), 2);
-                INIT_INI_ARRAY(&ah->iniCommon_normal_cck_fir_coeff_9271,
-                               ar9271Common_normal_cck_fir_coeff_9271,
-                               ARRAY_SIZE(ar9271Common_normal_cck_fir_coeff_9271), 2);
-                INIT_INI_ARRAY(&ah->iniCommon_japan_2484_cck_fir_coeff_9271,
-                               ar9271Common_japan_2484_cck_fir_coeff_9271,
-                               ARRAY_SIZE(ar9271Common_japan_2484_cck_fir_coeff_9271), 2);
-                INIT_INI_ARRAY(&ah->iniModes_9271_1_0_only,
-                               ar9271Modes_9271_1_0_only,
-                               ARRAY_SIZE(ar9271Modes_9271_1_0_only), 6);
-                INIT_INI_ARRAY(&ah->iniModes_9271_ANI_reg, ar9271Modes_9271_ANI_reg,
-                               ARRAY_SIZE(ar9271Modes_9271_ANI_reg), 6);
-                INIT_INI_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
-                               ar9271Modes_high_power_tx_gain_9271,
-                               ARRAY_SIZE(ar9271Modes_high_power_tx_gain_9271), 6);
-                INIT_INI_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
-                               ar9271Modes_normal_power_tx_gain_9271,
-                               ARRAY_SIZE(ar9271Modes_normal_power_tx_gain_9271), 6);
-                return;
-        }
-
-        if (AR_SREV_9287_11_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_1,
-                                ARRAY_SIZE(ar9287Modes_9287_1_1), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9287Common_9287_1_1,
-                                ARRAY_SIZE(ar9287Common_9287_1_1), 2);
-                if (ah->config.pcie_clock_req)
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9287PciePhy_clkreq_off_L1_9287_1_1,
-                        ARRAY_SIZE(ar9287PciePhy_clkreq_off_L1_9287_1_1), 2);
-                else
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9287PciePhy_clkreq_always_on_L1_9287_1_1,
-                        ARRAY_SIZE(ar9287PciePhy_clkreq_always_on_L1_9287_1_1),
-                                        2);
-        } else if (AR_SREV_9287_10_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_0,
-                                ARRAY_SIZE(ar9287Modes_9287_1_0), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9287Common_9287_1_0,
-                                ARRAY_SIZE(ar9287Common_9287_1_0), 2);
-
-                if (ah->config.pcie_clock_req)
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9287PciePhy_clkreq_off_L1_9287_1_0,
-                        ARRAY_SIZE(ar9287PciePhy_clkreq_off_L1_9287_1_0), 2);
-                else
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9287PciePhy_clkreq_always_on_L1_9287_1_0,
-                        ARRAY_SIZE(ar9287PciePhy_clkreq_always_on_L1_9287_1_0),
-                                  2);
-        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
-
-
-                INIT_INI_ARRAY(&ah->iniModes, ar9285Modes_9285_1_2,
-                               ARRAY_SIZE(ar9285Modes_9285_1_2), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9285Common_9285_1_2,
-                               ARRAY_SIZE(ar9285Common_9285_1_2), 2);
-
-                if (ah->config.pcie_clock_req) {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9285PciePhy_clkreq_off_L1_9285_1_2,
-                        ARRAY_SIZE(ar9285PciePhy_clkreq_off_L1_9285_1_2), 2);
-                } else {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9285PciePhy_clkreq_always_on_L1_9285_1_2,
-                        ARRAY_SIZE(ar9285PciePhy_clkreq_always_on_L1_9285_1_2),
-                                  2);
-                }
-        } else if (AR_SREV_9285_10_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9285Modes_9285,
-                               ARRAY_SIZE(ar9285Modes_9285), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9285Common_9285,
-                               ARRAY_SIZE(ar9285Common_9285), 2);
-
-                if (ah->config.pcie_clock_req) {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9285PciePhy_clkreq_off_L1_9285,
-                        ARRAY_SIZE(ar9285PciePhy_clkreq_off_L1_9285), 2);
-                } else {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                        ar9285PciePhy_clkreq_always_on_L1_9285,
-                        ARRAY_SIZE(ar9285PciePhy_clkreq_always_on_L1_9285), 2);
-                }
-        } else if (AR_SREV_9280_20_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9280Modes_9280_2,
-                               ARRAY_SIZE(ar9280Modes_9280_2), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9280Common_9280_2,
-                               ARRAY_SIZE(ar9280Common_9280_2), 2);
-
-                if (ah->config.pcie_clock_req) {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                               ar9280PciePhy_clkreq_off_L1_9280,
-                               ARRAY_SIZE(ar9280PciePhy_clkreq_off_L1_9280),2);
-                } else {
-                        INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                               ar9280PciePhy_clkreq_always_on_L1_9280,
-                               ARRAY_SIZE(ar9280PciePhy_clkreq_always_on_L1_9280), 2);
-                }
-                INIT_INI_ARRAY(&ah->iniModesAdditional,
-                               ar9280Modes_fast_clock_9280_2,
-                               ARRAY_SIZE(ar9280Modes_fast_clock_9280_2), 3);
-        } else if (AR_SREV_9280_10_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar9280Modes_9280,
-                               ARRAY_SIZE(ar9280Modes_9280), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar9280Common_9280,
-                               ARRAY_SIZE(ar9280Common_9280), 2);
-        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes_9160,
-                               ARRAY_SIZE(ar5416Modes_9160), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common_9160,
-                               ARRAY_SIZE(ar5416Common_9160), 2);
-                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0_9160,
-                               ARRAY_SIZE(ar5416Bank0_9160), 2);
-                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain_9160,
-                               ARRAY_SIZE(ar5416BB_RfGain_9160), 3);
-                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1_9160,
-                               ARRAY_SIZE(ar5416Bank1_9160), 2);
-                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2_9160,
-                               ARRAY_SIZE(ar5416Bank2_9160), 2);
-                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3_9160,
-                               ARRAY_SIZE(ar5416Bank3_9160), 3);
-                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6_9160,
-                               ARRAY_SIZE(ar5416Bank6_9160), 3);
-                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC_9160,
-                               ARRAY_SIZE(ar5416Bank6TPC_9160), 3);
-                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7_9160,
-                               ARRAY_SIZE(ar5416Bank7_9160), 2);
-                if (AR_SREV_9160_11(ah)) {
-                        INIT_INI_ARRAY(&ah->iniAddac,
-                                       ar5416Addac_91601_1,
-                                       ARRAY_SIZE(ar5416Addac_91601_1), 2);
-                } else {
-                        INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac_9160,
-                                       ARRAY_SIZE(ar5416Addac_9160), 2);
-                }
-        } else if (AR_SREV_9100_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes_9100,
-                               ARRAY_SIZE(ar5416Modes_9100), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common_9100,
-                               ARRAY_SIZE(ar5416Common_9100), 2);
-                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0_9100,
-                               ARRAY_SIZE(ar5416Bank0_9100), 2);
-                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain_9100,
-                               ARRAY_SIZE(ar5416BB_RfGain_9100), 3);
-                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1_9100,
-                               ARRAY_SIZE(ar5416Bank1_9100), 2);
-                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2_9100,
-                               ARRAY_SIZE(ar5416Bank2_9100), 2);
-                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3_9100,
-                               ARRAY_SIZE(ar5416Bank3_9100), 3);
-                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6_9100,
-                               ARRAY_SIZE(ar5416Bank6_9100), 3);
-                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC_9100,
-                               ARRAY_SIZE(ar5416Bank6TPC_9100), 3);
-                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7_9100,
-                               ARRAY_SIZE(ar5416Bank7_9100), 2);
-                INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac_9100,
-                               ARRAY_SIZE(ar5416Addac_9100), 2);
-        } else {
-                INIT_INI_ARRAY(&ah->iniModes, ar5416Modes,
-                               ARRAY_SIZE(ar5416Modes), 6);
-                INIT_INI_ARRAY(&ah->iniCommon, ar5416Common,
-                               ARRAY_SIZE(ar5416Common), 2);
-                INIT_INI_ARRAY(&ah->iniBank0, ar5416Bank0,
-                               ARRAY_SIZE(ar5416Bank0), 2);
-                INIT_INI_ARRAY(&ah->iniBB_RfGain, ar5416BB_RfGain,
-                               ARRAY_SIZE(ar5416BB_RfGain), 3);
-                INIT_INI_ARRAY(&ah->iniBank1, ar5416Bank1,
-                               ARRAY_SIZE(ar5416Bank1), 2);
-                INIT_INI_ARRAY(&ah->iniBank2, ar5416Bank2,
-                               ARRAY_SIZE(ar5416Bank2), 2);
-                INIT_INI_ARRAY(&ah->iniBank3, ar5416Bank3,
-                               ARRAY_SIZE(ar5416Bank3), 3);
-                INIT_INI_ARRAY(&ah->iniBank6, ar5416Bank6,
-                               ARRAY_SIZE(ar5416Bank6), 3);
-                INIT_INI_ARRAY(&ah->iniBank6TPC, ar5416Bank6TPC,
-                               ARRAY_SIZE(ar5416Bank6TPC), 3);
-                INIT_INI_ARRAY(&ah->iniBank7, ar5416Bank7,
-                               ARRAY_SIZE(ar5416Bank7), 2);
-                INIT_INI_ARRAY(&ah->iniAddac, ar5416Addac,
-                               ARRAY_SIZE(ar5416Addac), 2);
-        }
-}
-
-static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
-{
-        if (AR_SREV_9287_11_OR_LATER(ah))
-                INIT_INI_ARRAY(&ah->iniModesRxGain,
-                ar9287Modes_rx_gain_9287_1_1,
-                ARRAY_SIZE(ar9287Modes_rx_gain_9287_1_1), 6);
-        else if (AR_SREV_9287_10(ah))
-                INIT_INI_ARRAY(&ah->iniModesRxGain,
-                ar9287Modes_rx_gain_9287_1_0,
-                ARRAY_SIZE(ar9287Modes_rx_gain_9287_1_0), 6);
-        else if (AR_SREV_9280_20(ah))
-                ath9k_hw_init_rxgain_ini(ah);
-
-        if (AR_SREV_9287_11_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                ar9287Modes_tx_gain_9287_1_1,
-                ARRAY_SIZE(ar9287Modes_tx_gain_9287_1_1), 6);
-        } else if (AR_SREV_9287_10(ah)) {
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                ar9287Modes_tx_gain_9287_1_0,
-                ARRAY_SIZE(ar9287Modes_tx_gain_9287_1_0), 6);
-        } else if (AR_SREV_9280_20(ah)) {
-                ath9k_hw_init_txgain_ini(ah);
-        } else if (AR_SREV_9285_12_OR_LATER(ah)) {
-                u32 txgain_type = ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE);
-
-                /* txgain table */
-                if (txgain_type == AR5416_EEP_TXGAIN_HIGH_POWER) {
-                        if (AR_SREV_9285E_20(ah)) {
-                                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                ar9285Modes_XE2_0_high_power,
-                                ARRAY_SIZE(
-                                  ar9285Modes_XE2_0_high_power), 6);
-                        } else {
-                                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                ar9285Modes_high_power_tx_gain_9285_1_2,
-                                ARRAY_SIZE(
-                                  ar9285Modes_high_power_tx_gain_9285_1_2), 6);
-                        }
-                } else {
-                        if (AR_SREV_9285E_20(ah)) {
-                                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                ar9285Modes_XE2_0_normal_power,
-                                ARRAY_SIZE(
-                                  ar9285Modes_XE2_0_normal_power), 6);
-                        } else {
-                                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                                ar9285Modes_original_tx_gain_9285_1_2,
-                                ARRAY_SIZE(
-                                  ar9285Modes_original_tx_gain_9285_1_2), 6);
-                        }
-                }
-        }
-}
-
-static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
-{
-        struct base_eep_header *pBase = &(ah->eeprom.def.baseEepHeader);
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        ah->need_an_top2_fixup = (ah->hw_version.devid == AR9280_DEVID_PCI) &&
-                                 (ah->eep_map != EEP_MAP_4KBITS) &&
-                                 ((pBase->version & 0xff) > 0x0a) &&
-                                 (pBase->pwdclkind == 0);
-
-        if (ah->need_an_top2_fixup)
-                ath_print(common, ATH_DBG_EEPROM,
-                          "needs fixup for AR_AN_TOP2 register\n");
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ar9003_hw_attach_ops(ah);
+        else
+                ar9002_hw_attach_ops(ah);
 }
 
-int ath9k_hw_init(struct ath_hw *ah)
+/* Called for all hardware families */
+static int __ath9k_hw_init(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         int r = 0;
 
-        if (common->bus_ops->ath_bus_type != ATH_USB) {
-                if (!ath9k_hw_devid_supported(ah->hw_version.devid)) {
-                        ath_print(common, ATH_DBG_FATAL,
-                                  "Unsupported device ID: 0x%0x\n",
-                                  ah->hw_version.devid);
-                        return -EOPNOTSUPP;
-                }
-        }
-
-        ath9k_hw_init_defaults(ah);
-        ath9k_hw_init_config(ah);
+        if (ah->hw_version.devid == AR5416_AR9100_DEVID)
+                ah->hw_version.macVersion = AR_SREV_VERSION_9100;
 
         if (!ath9k_hw_set_reset_reg(ah, ATH9K_RESET_POWER_ON)) {
                 ath_print(common, ATH_DBG_FATAL,
@@ -878,6 +525,11 @@ int ath9k_hw_init(struct ath_hw *ah)
                 return -EIO;
         }
 
+        ath9k_hw_init_defaults(ah);
+        ath9k_hw_init_config(ah);
+
+        ath9k_hw_attach_ops(ah);
+
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE)) {
                 ath_print(common, ATH_DBG_FATAL, "Couldn't wakeup chip\n");
                 return -EIO;
@@ -902,7 +554,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         else
                 ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
 
-        if (!ath9k_hw_macversion_supported(ah->hw_version.macVersion)) {
+        if (!ath9k_hw_macversion_supported(ah)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Mac Chip Rev 0x%02x.%x is not supported by "
                           "this driver\n", ah->hw_version.macVersion,
@@ -910,28 +562,15 @@ int ath9k_hw_init(struct ath_hw *ah)
                 return -EOPNOTSUPP;
         }
 
-        if (AR_SREV_9100(ah)) {
-                ah->iq_caldata.calData = &iq_cal_multi_sample;
-                ah->supp_cals = IQ_MISMATCH_CAL;
-                ah->is_pciexpress = false;
-        }
-
-        if (AR_SREV_9271(ah))
+        if (AR_SREV_9271(ah) || AR_SREV_9100(ah))
                 ah->is_pciexpress = false;
 
         ah->hw_version.phyRev = REG_READ(ah, AR_PHY_CHIP_ID);
-
         ath9k_hw_init_cal_settings(ah);
 
         ah->ani_function = ATH9K_ANI_ALL;
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
+        if (AR_SREV_9280_10_OR_LATER(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 ah->ani_function &= ~ATH9K_ANI_NOISE_IMMUNITY_LEVEL;
-                ah->ath9k_hw_rf_set_freq = &ath9k_hw_ar9280_set_channel;
-                ah->ath9k_hw_spur_mitigate_freq = &ath9k_hw_9280_spur_mitigate;
-        } else {
-                ah->ath9k_hw_rf_set_freq = &ath9k_hw_set_channel;
-                ah->ath9k_hw_spur_mitigate_freq = &ath9k_hw_spur_mitigate;
-        }
 
         ath9k_hw_init_mode_regs(ah);
 
@@ -940,15 +579,8 @@ int ath9k_hw_init(struct ath_hw *ah)
         else
                 ath9k_hw_disablepcie(ah);
 
-        /* Support for Japan ch.14 (2484) spread */
-        if (AR_SREV_9287_11_OR_LATER(ah)) {
-                INIT_INI_ARRAY(&ah->iniCckfirNormal,
-                       ar9287Common_normal_cck_fir_coeff_92871_1,
-                       ARRAY_SIZE(ar9287Common_normal_cck_fir_coeff_92871_1), 2);
-                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
-                       ar9287Common_japan_2484_cck_fir_coeff_92871_1,
-                       ARRAY_SIZE(ar9287Common_japan_2484_cck_fir_coeff_92871_1), 2);
-        }
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ar9002_hw_cck_chan14_spread(ah);
 
         r = ath9k_hw_post_init(ah);
         if (r)
@@ -959,8 +591,6 @@ int ath9k_hw_init(struct ath_hw *ah)
         if (r)
                 return r;
 
-        ath9k_hw_init_eeprom_fix(ah);
-
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
@@ -973,6 +603,9 @@ int ath9k_hw_init(struct ath_hw *ah)
         else
                 ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
 
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ar9003_hw_set_nf_limits(ah);
+
         ath9k_init_nfcal_hist_buffer(ah);
 
         common->state = ATH_HW_INITIALIZED;
@@ -980,24 +613,50 @@ int ath9k_hw_init(struct ath_hw *ah)
         return 0;
 }
 
-static void ath9k_hw_init_bb(struct ath_hw *ah,
-                             struct ath9k_channel *chan)
+int ath9k_hw_init(struct ath_hw *ah)
 {
-        u32 synthDelay;
+        int ret;
+        struct ath_common *common = ath9k_hw_common(ah);
 
-        synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
-        if (IS_CHAN_B(chan))
-                synthDelay = (4 * synthDelay) / 22;
-        else
-                synthDelay /= 10;
+        /* These are all the AR5008/AR9001/AR9002 hardware family of chipsets */
+        switch (ah->hw_version.devid) {
+        case AR5416_DEVID_PCI:
+        case AR5416_DEVID_PCIE:
+        case AR5416_AR9100_DEVID:
+        case AR9160_DEVID_PCI:
+        case AR9280_DEVID_PCI:
+        case AR9280_DEVID_PCIE:
+        case AR9285_DEVID_PCIE:
+        case AR9287_DEVID_PCI:
+        case AR9287_DEVID_PCIE:
+        case AR2427_DEVID_PCIE:
+        case AR9300_DEVID_PCIE:
+                break;
+        default:
+                if (common->bus_ops->ath_bus_type == ATH_USB)
+                        break;
+                ath_print(common, ATH_DBG_FATAL,
+                          "Hardware device ID 0x%04x not supported\n",
+                          ah->hw_version.devid);
+                return -EOPNOTSUPP;
+        }
 
-        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+        ret = __ath9k_hw_init(ah);
+        if (ret) {
+                ath_print(common, ATH_DBG_FATAL,
+                          "Unable to initialize hardware; "
+                          "initialization status: %d\n", ret);
+                return ret;
+        }
 
-        udelay(synthDelay + BASE_ACTIVATE_DELAY);
+        return 0;
 }
+EXPORT_SYMBOL(ath9k_hw_init);
 
 static void ath9k_hw_init_qos(struct ath_hw *ah)
 {
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_MIC_QOS_CONTROL, 0x100aa);
         REG_WRITE(ah, AR_MIC_QOS_SELECT, 0x3210);
 
@@ -1011,69 +670,16 @@ static void ath9k_hw_init_qos(struct ath_hw *ah)
         REG_WRITE(ah, AR_TXOP_4_7, 0xFFFFFFFF);
         REG_WRITE(ah, AR_TXOP_8_11, 0xFFFFFFFF);
         REG_WRITE(ah, AR_TXOP_12_15, 0xFFFFFFFF);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 static void ath9k_hw_init_pll(struct ath_hw *ah,
                               struct ath9k_channel *chan)
 {
-        u32 pll;
-
-        if (AR_SREV_9100(ah)) {
-                if (chan && IS_CHAN_5GHZ(chan))
-                        pll = 0x1450;
-                else
-                        pll = 0x1458;
-        } else {
-                if (AR_SREV_9280_10_OR_LATER(ah)) {
-                        pll = SM(0x5, AR_RTC_9160_PLL_REFDIV);
-
-                        if (chan && IS_CHAN_HALF_RATE(chan))
-                                pll |= SM(0x1, AR_RTC_9160_PLL_CLKSEL);
-                        else if (chan && IS_CHAN_QUARTER_RATE(chan))
-                                pll |= SM(0x2, AR_RTC_9160_PLL_CLKSEL);
-
-                        if (chan && IS_CHAN_5GHZ(chan)) {
-                                pll |= SM(0x28, AR_RTC_9160_PLL_DIV);
-
+        u32 pll = ath9k_hw_compute_pll_control(ah, chan);
 
-                                if (AR_SREV_9280_20(ah)) {
-                                        if (((chan->channel % 20) == 0)
-                                            || ((chan->channel % 10) == 0))
-                                                pll = 0x2850;
-                                        else
-                                                pll = 0x142c;
-                                }
-                        } else {
-                                pll |= SM(0x2c, AR_RTC_9160_PLL_DIV);
-                        }
-
-                } else if (AR_SREV_9160_10_OR_LATER(ah)) {
-
-                        pll = SM(0x5, AR_RTC_9160_PLL_REFDIV);
-
-                        if (chan && IS_CHAN_HALF_RATE(chan))
-                                pll |= SM(0x1, AR_RTC_9160_PLL_CLKSEL);
-                        else if (chan && IS_CHAN_QUARTER_RATE(chan))
-                                pll |= SM(0x2, AR_RTC_9160_PLL_CLKSEL);
-
-                        if (chan && IS_CHAN_5GHZ(chan))
-                                pll |= SM(0x50, AR_RTC_9160_PLL_DIV);
-                        else
-                                pll |= SM(0x58, AR_RTC_9160_PLL_DIV);
-                } else {
-                        pll = AR_RTC_PLL_REFDIV_5 | AR_RTC_PLL_DIV2;
-
-                        if (chan && IS_CHAN_HALF_RATE(chan))
-                                pll |= SM(0x1, AR_RTC_PLL_CLKSEL);
-                        else if (chan && IS_CHAN_QUARTER_RATE(chan))
-                                pll |= SM(0x2, AR_RTC_PLL_CLKSEL);
-
-                        if (chan && IS_CHAN_5GHZ(chan))
-                                pll |= SM(0xa, AR_RTC_PLL_DIV);
-                        else
-                                pll |= SM(0xb, AR_RTC_PLL_DIV);
-                }
-        }
         REG_WRITE(ah, AR_RTC_PLL_CONTROL, pll);
 
         /* Switch the core clock for ar9271 to 117Mhz */
@@ -1087,43 +693,6 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
         REG_WRITE(ah, AR_RTC_SLEEP_CLK, AR_RTC_FORCE_DERIVED_CLK);
 }
 
-static void ath9k_hw_init_chain_masks(struct ath_hw *ah)
-{
-        int rx_chainmask, tx_chainmask;
-
-        rx_chainmask = ah->rxchainmask;
-        tx_chainmask = ah->txchainmask;
-
-        switch (rx_chainmask) {
-        case 0x5:
-                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
-                            AR_PHY_SWAP_ALT_CHAIN);
-        case 0x3:
-                if (ah->hw_version.macVersion == AR_SREV_REVISION_5416_10) {
-                        REG_WRITE(ah, AR_PHY_RX_CHAINMASK, 0x7);
-                        REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, 0x7);
-                        break;
-                }
-        case 0x1:
-        case 0x2:
-        case 0x7:
-                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx_chainmask);
-                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx_chainmask);
-                break;
-        default:
-                break;
-        }
-
-        REG_WRITE(ah, AR_SELFGEN_MASK, tx_chainmask);
-        if (tx_chainmask == 0x5) {
-                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
-                            AR_PHY_SWAP_ALT_CHAIN);
-        }
-        if (AR_SREV_9100(ah))
-                REG_WRITE(ah, AR_PHY_ANALOG_SWAP,
-                          REG_READ(ah, AR_PHY_ANALOG_SWAP) | 0x00000001);
-}
-
 static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                                           enum nl80211_iftype opmode)
 {
@@ -1133,16 +702,30 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 AR_IMR_RXORN |
                 AR_IMR_BCNMISC;
 
-        if (ah->config.rx_intr_mitigation)
-                imr_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
-        else
-                imr_reg |= AR_IMR_RXOK;
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                imr_reg |= AR_IMR_RXOK_HP;
+                if (ah->config.rx_intr_mitigation)
+                        imr_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
+                else
+                        imr_reg |= AR_IMR_RXOK_LP;
 
-        imr_reg |= AR_IMR_TXOK;
+        } else {
+                if (ah->config.rx_intr_mitigation)
+                        imr_reg |= AR_IMR_RXINTM | AR_IMR_RXMINTR;
+                else
+                        imr_reg |= AR_IMR_RXOK;
+        }
+
+        if (ah->config.tx_intr_mitigation)
+                imr_reg |= AR_IMR_TXINTM | AR_IMR_TXMINTR;
+        else
+                imr_reg |= AR_IMR_TXOK;
 
         if (opmode == NL80211_IFTYPE_AP)
                 imr_reg |= AR_IMR_MIB;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_IMR, imr_reg);
         ah->imrs2_reg |= AR_IMR_S2_GTT;
         REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
@@ -1152,6 +735,16 @@ static void ath9k_hw_init_interrupt_masks(struct ath_hw *ah,
                 REG_WRITE(ah, AR_INTR_SYNC_ENABLE, AR_INTR_SYNC_DEFAULT);
                 REG_WRITE(ah, AR_INTR_SYNC_MASK, 0);
         }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_WRITE(ah, AR_INTR_PRIO_ASYNC_ENABLE, 0);
+                REG_WRITE(ah, AR_INTR_PRIO_ASYNC_MASK, 0);
+                REG_WRITE(ah, AR_INTR_PRIO_SYNC_ENABLE, 0);
+                REG_WRITE(ah, AR_INTR_PRIO_SYNC_MASK, 0);
+        }
 }
 
 static void ath9k_hw_setslottime(struct ath_hw *ah, u32 us)
@@ -1237,14 +830,10 @@ void ath9k_hw_deinit(struct ath_hw *ah)
         if (common->state < ATH_HW_INITIALIZED)
                 goto free_hw;
 
-        if (!AR_SREV_9100(ah))
-                ath9k_hw_ani_disable(ah);
-
         ath9k_hw_setpower(ah, ATH9K_PM_FULL_SLEEP);
 
 free_hw:
-        if (!AR_SREV_9280_10_OR_LATER(ah))
-                ath9k_hw_rf_free_ext_banks(ah);
+        ath9k_hw_rf_free_ext_banks(ah);
 }
 EXPORT_SYMBOL(ath9k_hw_deinit);
 
@@ -1252,73 +841,7 @@ EXPORT_SYMBOL(ath9k_hw_deinit);
 /* INI */
 /*******/
 
-static void ath9k_hw_override_ini(struct ath_hw *ah,
-                                  struct ath9k_channel *chan)
-{
-        u32 val;
-
-        /*
-         * Set the RX_ABORT and RX_DIS and clear if off only after
-         * RXE is set for MAC. This prevents frames with corrupted
-         * descriptor status.
-         */
-        REG_SET_BIT(ah, AR_DIAG_SW, (AR_DIAG_RX_DIS | AR_DIAG_RX_ABORT));
-
-        if (AR_SREV_9280_10_OR_LATER(ah)) {
-                val = REG_READ(ah, AR_PCU_MISC_MODE2);
-
-                if (!AR_SREV_9271(ah))
-                        val &= ~AR_PCU_MISC_MODE2_HWWAR1;
-
-                if (AR_SREV_9287_10_OR_LATER(ah))
-                        val = val & (~AR_PCU_MISC_MODE2_HWWAR2);
-
-                REG_WRITE(ah, AR_PCU_MISC_MODE2, val);
-        }
-
-        if (!AR_SREV_5416_20_OR_LATER(ah) ||
-            AR_SREV_9280_10_OR_LATER(ah))
-                return;
-        /*
-         * Disable BB clock gating
-         * Necessary to avoid issues on AR5416 2.0
-         */
-        REG_WRITE(ah, 0x9800 + (651 << 2), 0x11);
-
-        /*
-         * Disable RIFS search on some chips to avoid baseband
-         * hang issues.
-         */
-        if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
-                val = REG_READ(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS);
-                val &= ~AR_PHY_RIFS_INIT_DELAY;
-                REG_WRITE(ah, AR_PHY_HEAVY_CLIP_FACTOR_RIFS, val);
-        }
-}
-
-static void ath9k_olc_init(struct ath_hw *ah)
-{
-        u32 i;
-
-        if (OLC_FOR_AR9287_10_LATER) {
-                REG_SET_BIT(ah, AR_PHY_TX_PWRCTRL9,
-                                AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL);
-                ath9k_hw_analog_shift_rmw(ah, AR9287_AN_TXPC0,
-                                AR9287_AN_TXPC0_TXPCMODE,
-                                AR9287_AN_TXPC0_TXPCMODE_S,
-                                AR9287_AN_TXPC0_TXPCMODE_TEMPSENSE);
-                udelay(100);
-        } else {
-                for (i = 0; i < AR9280_TX_GAIN_TABLE_SIZE; i++)
-                        ah->originalGain[i] =
-                                MS(REG_READ(ah, AR_PHY_TX_GAIN_TBL1 + i * 4),
-                                                AR_PHY_TX_GAIN);
-                ah->PDADCdelta = 0;
-        }
-}
-
-static u32 ath9k_regd_get_ctl(struct ath_regulatory *reg,
-                              struct ath9k_channel *chan)
+u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan)
 {
         u32 ctl = ath_regd_get_band_ctl(reg, chan->chan->band);
 
@@ -1332,193 +855,24 @@ static u32 ath9k_regd_get_ctl(struct ath_regulatory *reg,
         return ctl;
 }
 
-static int ath9k_hw_process_ini(struct ath_hw *ah,
-                                struct ath9k_channel *chan)
-{
-        struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
-        int i, regWrites = 0;
-        struct ieee80211_channel *channel = chan->chan;
-        u32 modesIndex, freqIndex;
-
-        switch (chan->chanmode) {
-        case CHANNEL_A:
-        case CHANNEL_A_HT20:
-                modesIndex = 1;
-                freqIndex = 1;
-                break;
-        case CHANNEL_A_HT40PLUS:
-        case CHANNEL_A_HT40MINUS:
-                modesIndex = 2;
-                freqIndex = 1;
-                break;
-        case CHANNEL_G:
-        case CHANNEL_G_HT20:
-        case CHANNEL_B:
-                modesIndex = 4;
-                freqIndex = 2;
-                break;
-        case CHANNEL_G_HT40PLUS:
-        case CHANNEL_G_HT40MINUS:
-                modesIndex = 3;
-                freqIndex = 2;
-                break;
-
-        default:
-                return -EINVAL;
-        }
-
-        /* Set correct baseband to analog shift setting to access analog chips */
-        REG_WRITE(ah, AR_PHY(0), 0x00000007);
-
-        /* Write ADDAC shifts */
-        REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_EXTERNAL_RADIO);
-        ah->eep_ops->set_addac(ah, chan);
-
-        if (AR_SREV_5416_22_OR_LATER(ah)) {
-                REG_WRITE_ARRAY(&ah->iniAddac, 1, regWrites);
-        } else {
-                struct ar5416IniArray temp;
-                u32 addacSize =
-                        sizeof(u32) * ah->iniAddac.ia_rows *
-                        ah->iniAddac.ia_columns;
-
-                /* For AR5416 2.0/2.1 */
-                memcpy(ah->addac5416_21,
-                       ah->iniAddac.ia_array, addacSize);
-
-                /* override CLKDRV value at [row, column] = [31, 1] */
-                (ah->addac5416_21)[31 * ah->iniAddac.ia_columns + 1] = 0;
-
-                temp.ia_array = ah->addac5416_21;
-                temp.ia_columns = ah->iniAddac.ia_columns;
-                temp.ia_rows = ah->iniAddac.ia_rows;
-                REG_WRITE_ARRAY(&temp, 1, regWrites);
-        }
-
-        REG_WRITE(ah, AR_PHY_ADC_SERIAL_CTL, AR_PHY_SEL_INTERNAL_ADDAC);
-
-        for (i = 0; i < ah->iniModes.ia_rows; i++) {
-                u32 reg = INI_RA(&ah->iniModes, i, 0);
-                u32 val = INI_RA(&ah->iniModes, i, modesIndex);
-
-                if (reg == AR_AN_TOP2 && ah->need_an_top2_fixup)
-                        val &= ~AR_AN_TOP2_PWDCLKIND;
-
-                REG_WRITE(ah, reg, val);
-
-                if (reg >= 0x7800 && reg < 0x78a0
-                    && ah->config.analog_shiftreg) {
-                        udelay(100);
-                }
-
-                DO_DELAY(regWrites);
-        }
-
-        if (AR_SREV_9280(ah) || AR_SREV_9287_10_OR_LATER(ah))
-                REG_WRITE_ARRAY(&ah->iniModesRxGain, modesIndex, regWrites);
-
-        if (AR_SREV_9280(ah) || AR_SREV_9285_12_OR_LATER(ah) ||
-            AR_SREV_9287_10_OR_LATER(ah))
-                REG_WRITE_ARRAY(&ah->iniModesTxGain, modesIndex, regWrites);
-
-        if (AR_SREV_9271_10(ah))
-                REG_WRITE_ARRAY(&ah->iniModes_9271_1_0_only,
-                                modesIndex, regWrites);
-
-        /* Write common array parameters */
-        for (i = 0; i < ah->iniCommon.ia_rows; i++) {
-                u32 reg = INI_RA(&ah->iniCommon, i, 0);
-                u32 val = INI_RA(&ah->iniCommon, i, 1);
-
-                REG_WRITE(ah, reg, val);
-
-                if (reg >= 0x7800 && reg < 0x78a0
-                    && ah->config.analog_shiftreg) {
-                        udelay(100);
-                }
-
-                DO_DELAY(regWrites);
-        }
-
-        if (AR_SREV_9271(ah)) {
-                if (ah->eep_ops->get_eeprom(ah, EEP_TXGAIN_TYPE) == 1)
-                        REG_WRITE_ARRAY(&ah->iniModes_high_power_tx_gain_9271,
-                                        modesIndex, regWrites);
-                else
-                        REG_WRITE_ARRAY(&ah->iniModes_normal_power_tx_gain_9271,
-                                        modesIndex, regWrites);
-        }
-
-        ath9k_hw_write_regs(ah, freqIndex, regWrites);
-
-        if (AR_SREV_9280_20(ah) && IS_CHAN_A_5MHZ_SPACED(chan)) {
-                REG_WRITE_ARRAY(&ah->iniModesAdditional, modesIndex,
-                                regWrites);
-        }
-
-        ath9k_hw_override_ini(ah, chan);
-        ath9k_hw_set_regs(ah, chan);
-        ath9k_hw_init_chain_masks(ah);
-
-        if (OLC_FOR_AR9280_20_LATER)
-                ath9k_olc_init(ah);
-
-        /* Set TX power */
-        ah->eep_ops->set_txpower(ah, chan,
-                                 ath9k_regd_get_ctl(regulatory, chan),
-                                 channel->max_antenna_gain * 2,
-                                 channel->max_power * 2,
-                                 min((u32) MAX_RATE_POWER,
-                                 (u32) regulatory->power_limit));
-
-        /* Write analog registers */
-        if (!ath9k_hw_set_rf_regs(ah, chan, freqIndex)) {
-                ath_print(ath9k_hw_common(ah), ATH_DBG_FATAL,
-                          "ar5416SetRfRegs failed\n");
-                return -EIO;
-        }
-
-        return 0;
-}
-
 /****************************************/
 /* Reset and Channel Switching Routines */
 /****************************************/
 
-static void ath9k_hw_set_rfmode(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        u32 rfMode = 0;
-
-        if (chan == NULL)
-                return;
-
-        rfMode |= (IS_CHAN_B(chan) || IS_CHAN_G(chan))
-                ? AR_PHY_MODE_DYNAMIC : AR_PHY_MODE_OFDM;
-
-        if (!AR_SREV_9280_10_OR_LATER(ah))
-                rfMode |= (IS_CHAN_5GHZ(chan)) ?
-                        AR_PHY_MODE_RF5GHZ : AR_PHY_MODE_RF2GHZ;
-
-        if (AR_SREV_9280_20(ah) && IS_CHAN_A_5MHZ_SPACED(chan))
-                rfMode |= (AR_PHY_MODE_DYNAMIC | AR_PHY_MODE_DYN_CCK_DISABLE);
-
-        REG_WRITE(ah, AR_PHY_MODE, rfMode);
-}
-
-static void ath9k_hw_mark_phy_inactive(struct ath_hw *ah)
-{
-        REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
-}
-
 static inline void ath9k_hw_set_dma(struct ath_hw *ah)
 {
+        struct ath_common *common = ath9k_hw_common(ah);
         u32 regval;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         /*
          * set AHB_MODE not to do cacheline prefetches
         */
-        regval = REG_READ(ah, AR_AHB_MODE);
-        REG_WRITE(ah, AR_AHB_MODE, regval | AR_AHB_PREFETCH_RD_EN);
+        if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                regval = REG_READ(ah, AR_AHB_MODE);
+                REG_WRITE(ah, AR_AHB_MODE, regval | AR_AHB_PREFETCH_RD_EN);
+        }
 
         /*
          * let mac dma reads be in 128 byte chunks
@@ -1526,12 +880,18 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
         regval = REG_READ(ah, AR_TXCFG) & ~AR_TXCFG_DMASZ_MASK;
         REG_WRITE(ah, AR_TXCFG, regval | AR_TXCFG_DMASZ_128B);
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         /*
          * Restore TX Trigger Level to its pre-reset value.
          * The initial value depends on whether aggregation is enabled, and is
          * adjusted whenever underruns are detected.
          */
-        REG_RMW_FIELD(ah, AR_TXCFG, AR_FTRIG, ah->tx_trig_level);
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                REG_RMW_FIELD(ah, AR_TXCFG, AR_FTRIG, ah->tx_trig_level);
+
+        ENABLE_REGWRITE_BUFFER(ah);
 
         /*
          * let mac dma writes be in 128 byte chunks
@@ -1544,6 +904,14 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
          */
         REG_WRITE(ah, AR_RXFIFO_CFG, 0x200);
 
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                REG_RMW_FIELD(ah, AR_RXBP_THRESH, AR_RXBP_THRESH_HP, 0x1);
+                REG_RMW_FIELD(ah, AR_RXBP_THRESH, AR_RXBP_THRESH_LP, 0x1);
+
+                ath9k_hw_set_rx_bufsize(ah, common->rx_bufsize -
+                        ah->caps.rx_status_len);
+        }
+
         /*
          * reduce the number of usable entries in PCU TXBUF to avoid
          * wrap around issues.
@@ -1559,6 +927,12 @@ static inline void ath9k_hw_set_dma(struct ath_hw *ah)
                 REG_WRITE(ah, AR_PCU_TXBUF_CTRL,
                           AR_PCU_TXBUF_CTRL_USABLE_SIZE);
         }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ath9k_hw_reset_txstatus_ring(ah);
 }
 
 static void ath9k_hw_set_operating_mode(struct ath_hw *ah, int opmode)
@@ -1586,10 +960,8 @@ static void ath9k_hw_set_operating_mode(struct ath_hw *ah, int opmode)
         }
 }
 
-static inline void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah,
-                                                 u32 coef_scaled,
-                                                 u32 *coef_mantissa,
-                                                 u32 *coef_exponent)
+void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
+                                   u32 *coef_mantissa, u32 *coef_exponent)
 {
         u32 coef_exp, coef_man;
 
@@ -1605,40 +977,6 @@ static inline void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah,
         *coef_exponent = coef_exp - 16;
 }
 
-static void ath9k_hw_set_delta_slope(struct ath_hw *ah,
-                                     struct ath9k_channel *chan)
-{
-        u32 coef_scaled, ds_coef_exp, ds_coef_man;
-        u32 clockMhzScaled = 0x64000000;
-        struct chan_centers centers;
-
-        if (IS_CHAN_HALF_RATE(chan))
-                clockMhzScaled = clockMhzScaled >> 1;
-        else if (IS_CHAN_QUARTER_RATE(chan))
-                clockMhzScaled = clockMhzScaled >> 2;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        coef_scaled = clockMhzScaled / centers.synth_center;
-
-        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
-                                      &ds_coef_exp);
-
-        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
-                      AR_PHY_TIMING3_DSC_MAN, ds_coef_man);
-        REG_RMW_FIELD(ah, AR_PHY_TIMING3,
-                      AR_PHY_TIMING3_DSC_EXP, ds_coef_exp);
-
-        coef_scaled = (9 * coef_scaled) / 10;
-
-        ath9k_hw_get_delta_slope_vals(ah, coef_scaled, &ds_coef_man,
-                                      &ds_coef_exp);
-
-        REG_RMW_FIELD(ah, AR_PHY_HALFGI,
-                      AR_PHY_HALFGI_DSC_MAN, ds_coef_man);
-        REG_RMW_FIELD(ah, AR_PHY_HALFGI,
-                      AR_PHY_HALFGI_DSC_EXP, ds_coef_exp);
-}
-
 static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 {
         u32 rst_flags;
@@ -1652,6 +990,8 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
                 (void)REG_READ(ah, AR_RTC_DERIVED_CLK);
         }
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN |
                   AR_RTC_FORCE_WAKE_ON_INT);
 
@@ -1663,11 +1003,16 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
                 if (tmpReg &
                     (AR_INTR_SYNC_LOCAL_TIMEOUT |
                      AR_INTR_SYNC_RADM_CPL_TIMEOUT)) {
+                        u32 val;
                         REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
-                        REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
-                } else {
+
+                        val = AR_RC_HOSTIF;
+                        if (!AR_SREV_9300_20_OR_LATER(ah))
+                                val |= AR_RC_AHB;
+                        REG_WRITE(ah, AR_RC, val);
+
+                } else if (!AR_SREV_9300_20_OR_LATER(ah))
                         REG_WRITE(ah, AR_RC, AR_RC_AHB);
-                }
 
                 rst_flags = AR_RTC_RC_MAC_WARM;
                 if (type == ATH9K_RESET_COLD)
@@ -1675,6 +1020,10 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         }
 
         REG_WRITE(ah, AR_RTC_RC, rst_flags);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         udelay(50);
 
         REG_WRITE(ah, AR_RTC_RC, 0);
@@ -1695,16 +1044,23 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 
 static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
 {
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_EN |
                   AR_RTC_FORCE_WAKE_ON_INT);
 
-        if (!AR_SREV_9100(ah))
+        if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 REG_WRITE(ah, AR_RC, AR_RC_AHB);
 
         REG_WRITE(ah, AR_RTC_RESET, 0);
-        udelay(2);
 
-        if (!AR_SREV_9100(ah))
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                udelay(2);
+
+        if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 REG_WRITE(ah, AR_RC, 0);
 
         REG_WRITE(ah, AR_RTC_RESET, 1);
@@ -1740,34 +1096,6 @@ static bool ath9k_hw_set_reset_reg(struct ath_hw *ah, u32 type)
         }
 }
 
-static void ath9k_hw_set_regs(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        u32 phymode;
-        u32 enableDacFifo = 0;
-
-        if (AR_SREV_9285_10_OR_LATER(ah))
-                enableDacFifo = (REG_READ(ah, AR_PHY_TURBO) &
-                                         AR_PHY_FC_ENABLE_DAC_FIFO);
-
-        phymode = AR_PHY_FC_HT_EN | AR_PHY_FC_SHORT_GI_40
-                | AR_PHY_FC_SINGLE_HT_LTF1 | AR_PHY_FC_WALSH | enableDacFifo;
-
-        if (IS_CHAN_HT40(chan)) {
-                phymode |= AR_PHY_FC_DYN2040_EN;
-
-                if ((chan->chanmode == CHANNEL_A_HT40PLUS) ||
-                    (chan->chanmode == CHANNEL_G_HT40PLUS))
-                        phymode |= AR_PHY_FC_DYN2040_PRI_CH;
-
-        }
-        REG_WRITE(ah, AR_PHY_TURBO, phymode);
-
-        ath9k_hw_set11nmac2040(ah);
-
-        REG_WRITE(ah, AR_GTXTO, 25 << AR_GTXTO_TIMEOUT_LIMIT_S);
-        REG_WRITE(ah, AR_CST, 0xF << AR_CST_TIMEOUT_LIMIT_S);
-}
-
 static bool ath9k_hw_chip_reset(struct ath_hw *ah,
                                 struct ath9k_channel *chan)
 {
@@ -1793,7 +1121,7 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         struct ath_regulatory *regulatory = ath9k_hw_regulatory(ah);
         struct ath_common *common = ath9k_hw_common(ah);
         struct ieee80211_channel *channel = chan->chan;
-        u32 synthDelay, qnum;
+        u32 qnum;
         int r;
 
         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
@@ -1805,17 +1133,15 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                 }
         }
 
-        REG_WRITE(ah, AR_PHY_RFBUS_REQ, AR_PHY_RFBUS_REQ_EN);
-        if (!ath9k_hw_wait(ah, AR_PHY_RFBUS_GRANT, AR_PHY_RFBUS_GRANT_EN,
-                           AR_PHY_RFBUS_GRANT_EN, AH_WAIT_TIMEOUT)) {
+        if (!ath9k_hw_rfbus_req(ah)) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Could not kill baseband RX\n");
                 return false;
         }
 
-        ath9k_hw_set_regs(ah, chan);
+        ath9k_hw_set_channel_regs(ah, chan);
 
-        r = ah->ath9k_hw_rf_set_freq(ah, chan);
+        r = ath9k_hw_rf_set_freq(ah, chan);
         if (r) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to set channel\n");
@@ -1829,20 +1155,12 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
                              min((u32) MAX_RATE_POWER,
                              (u32) regulatory->power_limit));
 
-        synthDelay = REG_READ(ah, AR_PHY_RX_DELAY) & AR_PHY_RX_DELAY_DELAY;
-        if (IS_CHAN_B(chan))
-                synthDelay = (4 * synthDelay) / 22;
-        else
-                synthDelay /= 10;
-
-        udelay(synthDelay + BASE_ACTIVATE_DELAY);
-
-        REG_WRITE(ah, AR_PHY_RFBUS_REQ, 0);
+        ath9k_hw_rfbus_done(ah);
 
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
 
-        ah->ath9k_hw_spur_mitigate_freq(ah, chan);
+        ath9k_hw_spur_mitigate_freq(ah, chan);
 
         if (!chan->oneTimeCalsDone)
                 chan->oneTimeCalsDone = true;
@@ -1850,17 +1168,33 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         return true;
 }
 
-static void ath9k_enable_rfkill(struct ath_hw *ah)
+bool ath9k_hw_check_alive(struct ath_hw *ah)
 {
-        REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL,
-                    AR_GPIO_INPUT_EN_VAL_RFSILENT_BB);
+        int count = 50;
+        u32 reg;
+
+        if (AR_SREV_9285_10_OR_LATER(ah))
+                return true;
+
+        do {
+                reg = REG_READ(ah, AR_OBS_BUS_1);
 
-        REG_CLR_BIT(ah, AR_GPIO_INPUT_MUX2,
-                    AR_GPIO_INPUT_MUX2_RFSILENT);
+                if ((reg & 0x7E7FFFEF) == 0x00702400)
+                        continue;
 
-        ath9k_hw_cfg_gpio_input(ah, ah->rfkill_gpio);
-        REG_SET_BIT(ah, AR_PHY_TEST, RFSILENT_BB);
+                switch (reg & 0x7E000B00) {
+                case 0x1E000000:
+                case 0x52000B00:
+                case 0x18000B00:
+                        continue;
+                default:
+                        return true;
+                }
+        } while (count-- > 0);
+
+        return false;
 }
+EXPORT_SYMBOL(ath9k_hw_check_alive);
 
 int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                     bool bChannelChange)
@@ -1871,11 +1205,18 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         u32 saveDefAntenna;
         u32 macStaId1;
         u64 tsf = 0;
-        int i, rx_chainmask, r;
+        int i, r;
 
         ah->txchainmask = common->tx_chainmask;
         ah->rxchainmask = common->rx_chainmask;
 
+        if (!ah->chip_fullsleep) {
+                ath9k_hw_abortpcurecv(ah);
+                if (!ath9k_hw_stopdmarecv(ah))
+                        ath_print(common, ATH_DBG_XMIT,
+                                "Failed to stop receive dma\n");
+        }
+
         if (!ath9k_hw_setpower(ah, ATH9K_PM_AWAKE))
                 return -EIO;
 
@@ -1888,8 +1229,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
             (chan->channel != ah->curchan->channel) &&
             ((chan->channelFlags & CHANNEL_ALL) ==
              (ah->curchan->channelFlags & CHANNEL_ALL)) &&
-             !(AR_SREV_9280(ah) || IS_CHAN_A_5MHZ_SPACED(chan) ||
-             IS_CHAN_A_5MHZ_SPACED(ah->curchan))) {
+            !AR_SREV_9280(ah)) {
 
                 if (ath9k_hw_channel_change(ah, chan)) {
                         ath9k_hw_loadnf(ah, ah->curchan);
@@ -1943,16 +1283,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (AR_SREV_9280_10_OR_LATER(ah))
                 REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL, AR_GPIO_JTAG_DISABLE);
 
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
-                /* Enable ASYNC FIFO */
-                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_DATAPATH_SEL);
-                REG_SET_BIT(ah, AR_PHY_MODE, AR_PHY_MODE_ASYNCFIFO);
-                REG_CLR_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
-                REG_SET_BIT(ah, AR_MAC_PCU_ASYNC_FIFO_REG3,
-                                AR_MAC_PCU_ASYNC_FIFO_REG3_SOFT_RESET);
-        }
         r = ath9k_hw_process_ini(ah, chan);
         if (r)
                 return r;
@@ -1977,9 +1307,13 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
 
-        ah->ath9k_hw_spur_mitigate_freq(ah, chan);
+        ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
+        ath9k_hw_set_operating_mode(ah, ah->opmode);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
         REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
                   | macStaId1
@@ -1987,25 +1321,27 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                   | (ah->config.
                      ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
                   | ah->sta_id1_defaults);
-        ath9k_hw_set_operating_mode(ah, ah->opmode);
-
         ath_hw_setbssidmask(common);
-
         REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
-
         ath9k_hw_write_associd(ah);
-
         REG_WRITE(ah, AR_ISR, ~0);
-
         REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
 
-        r = ah->ath9k_hw_rf_set_freq(ah, chan);
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
+        r = ath9k_hw_rf_set_freq(ah, chan);
         if (r)
                 return r;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         for (i = 0; i < AR_NUM_DCU; i++)
                 REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         ah->intr_txqs = 0;
         for (i = 0; i < ah->caps.total_queues; i++)
                 ath9k_hw_resettxqueue(ah, i);
@@ -2018,25 +1354,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_init_global_settings(ah);
 
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
-                REG_WRITE(ah, AR_D_GBL_IFS_SIFS,
-                          AR_D_GBL_IFS_SIFS_ASYNC_FIFO_DUR);
-                REG_WRITE(ah, AR_D_GBL_IFS_SLOT,
-                          AR_D_GBL_IFS_SLOT_ASYNC_FIFO_DUR);
-                REG_WRITE(ah, AR_D_GBL_IFS_EIFS,
-                          AR_D_GBL_IFS_EIFS_ASYNC_FIFO_DUR);
-
-                REG_WRITE(ah, AR_TIME_OUT, AR_TIME_OUT_ACK_CTS_ASYNC_FIFO_DUR);
-                REG_WRITE(ah, AR_USEC, AR_USEC_ASYNC_FIFO_DUR);
-
-                REG_SET_BIT(ah, AR_MAC_PCU_LOGIC_ANALYZER,
-                            AR_MAC_PCU_LOGIC_ANALYZER_DISBUG20768);
-                REG_RMW_FIELD(ah, AR_AHB_MODE, AR_AHB_CUSTOM_BURST_EN,
-                              AR_AHB_CUSTOM_BURST_ASYNC_FIFO_VAL);
-        }
-        if (AR_SREV_9287_12_OR_LATER(ah)) {
-                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
-                                AR_PCU_MISC_MODE2_ENABLE_AGGWEP);
+        if (!AR_SREV_9300_20_OR_LATER(ah)) {
+                ar9002_hw_enable_async_fifo(ah);
+                ar9002_hw_enable_wep_aggregation(ah);
         }
 
         REG_WRITE(ah, AR_STA_ID1,
@@ -2051,19 +1371,24 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, 2000);
         }
 
+        if (ah->config.tx_intr_mitigation) {
+                REG_RMW_FIELD(ah, AR_TIMT, AR_TIMT_LAST, 300);
+                REG_RMW_FIELD(ah, AR_TIMT, AR_TIMT_FIRST, 750);
+        }
+
         ath9k_hw_init_bb(ah, chan);
 
         if (!ath9k_hw_init_cal(ah, chan))
                 return -EIO;
 
-        rx_chainmask = ah->rxchainmask;
-        if ((rx_chainmask == 0x5) || (rx_chainmask == 0x3)) {
-                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx_chainmask);
-                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx_chainmask);
-        }
+        ENABLE_REGWRITE_BUFFER(ah);
 
+        ath9k_hw_restore_chainmask(ah);
         REG_WRITE(ah, AR_CFG_LED, saveLedState | AR_CFG_SCLK_32KHZ);
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         /*
          * For big endian systems turn on swapping for descriptors
          */
@@ -2093,6 +1418,11 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (ah->btcoex_hw.enabled)
                 ath9k_hw_btcoex_enable(ah);
 
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ath9k_hw_loadnf(ah, curchan);
+                ath9k_hw_start_nfcal(ah);
+        }
+
         return 0;
 }
 EXPORT_SYMBOL(ath9k_hw_reset);
@@ -2379,21 +1709,35 @@ EXPORT_SYMBOL(ath9k_hw_keyisvalid);
 /* Power Management (Chipset) */
 /******************************/
 
+/*
+ * Notify Power Mgt is disabled in self-generated frames.
+ * If requested, force chip to sleep.
+ */
 static void ath9k_set_power_sleep(struct ath_hw *ah, int setChip)
 {
         REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
         if (setChip) {
+                /*
+                 * Clear the RTC force wake bit to allow the
+                 * mac to go to sleep.
+                 */
                 REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE,
                             AR_RTC_FORCE_WAKE_EN);
-                if (!AR_SREV_9100(ah))
+                if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                         REG_WRITE(ah, AR_RC, AR_RC_AHB | AR_RC_HOSTIF);
 
+                /* Shutdown chip. Active low */
                 if (!AR_SREV_5416(ah) && !AR_SREV_9271(ah))
                         REG_CLR_BIT(ah, (AR_RTC_RESET),
                                     AR_RTC_RESET_EN);
         }
 }
 
+/*
+ * Notify Power Management is enabled in self-generating
+ * frames. If request, set power mode of chip to
+ * auto/normal.  Duration in units of 128us (1/8 TU).
+ */
 static void ath9k_set_power_network_sleep(struct ath_hw *ah, int setChip)
 {
         REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
@@ -2401,9 +1745,14 @@ static void ath9k_set_power_network_sleep(struct ath_hw *ah, int setChip)
                 struct ath9k_hw_capabilities *pCap = &ah->caps;
 
                 if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                        /* Set WakeOnInterrupt bit; clear ForceWake bit */
                         REG_WRITE(ah, AR_RTC_FORCE_WAKE,
                                   AR_RTC_FORCE_WAKE_ON_INT);
                 } else {
+                        /*
+                         * Clear the RTC force wake bit to allow the
+                         * mac to go to sleep.
+                         */
                         REG_CLR_BIT(ah, AR_RTC_FORCE_WAKE,
                                     AR_RTC_FORCE_WAKE_EN);
                 }
@@ -2422,7 +1771,8 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah, int setChip)
                                            ATH9K_RESET_POWER_ON) != true) {
                                 return false;
                         }
-                        ath9k_hw_init_pll(ah, NULL);
+                        if (!AR_SREV_9300_20_OR_LATER(ah))
+                                ath9k_hw_init_pll(ah, NULL);
                 }
                 if (AR_SREV_9100(ah))
                         REG_SET_BIT(ah, AR_RTC_RESET,
@@ -2492,420 +1842,6 @@ bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode)
 }
 EXPORT_SYMBOL(ath9k_hw_setpower);
 
-/*
- * Helper for ASPM support.
- *
- * Disable PLL when in L0s as well as receiver clock when in L1.
- * This power saving option must be enabled through the SerDes.
- *
- * Programming the SerDes must go through the same 288 bit serial shift
- * register as the other analog registers.  Hence the 9 writes.
- */
-void ath9k_hw_configpcipowersave(struct ath_hw *ah, int restore, int power_off)
-{
-        u8 i;
-        u32 val;
-
-        if (ah->is_pciexpress != true)
-                return;
-
-        /* Do not touch SerDes registers */
-        if (ah->config.pcie_powersave_enable == 2)
-                return;
-
-        /* Nothing to do on restore for 11N */
-        if (!restore) {
-                if (AR_SREV_9280_20_OR_LATER(ah)) {
-                        /*
-                         * AR9280 2.0 or later chips use SerDes values from the
-                         * initvals.h initialized depending on chipset during
-                         * ath9k_hw_init()
-                         */
-                        for (i = 0; i < ah->iniPcieSerdes.ia_rows; i++) {
-                                REG_WRITE(ah, INI_RA(&ah->iniPcieSerdes, i, 0),
-                                          INI_RA(&ah->iniPcieSerdes, i, 1));
-                        }
-                } else if (AR_SREV_9280(ah) &&
-                           (ah->hw_version.macRev == AR_SREV_REVISION_9280_10)) {
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x9248fd00);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x24924924);
-
-                        /* RX shut off when elecidle is asserted */
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0xa8000019);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x13160820);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0xe5980560);
-
-                        /* Shut off CLKREQ active in L1 */
-                        if (ah->config.pcie_clock_req)
-                                REG_WRITE(ah, AR_PCIE_SERDES, 0x401deffc);
-                        else
-                                REG_WRITE(ah, AR_PCIE_SERDES, 0x401deffd);
-
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x1aaabe40);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0xbe105554);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x00043007);
-
-                        /* Load the new settings */
-                        REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
-
-                } else {
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x9248fc00);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x24924924);
-
-                        /* RX shut off when elecidle is asserted */
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x28000039);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x53160824);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0xe5980579);
-
-                        /*
-                         * Ignore ah->ah_config.pcie_clock_req setting for
-                         * pre-AR9280 11n
-                         */
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x001defff);
-
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x1aaabe40);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0xbe105554);
-                        REG_WRITE(ah, AR_PCIE_SERDES, 0x000e3007);
-
-                        /* Load the new settings */
-                        REG_WRITE(ah, AR_PCIE_SERDES2, 0x00000000);
-                }
-
-                udelay(1000);
-
-                /* set bit 19 to allow forcing of pcie core into L1 state */
-                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, AR_PCIE_PM_CTRL_ENA);
-
-                /* Several PCIe massages to ensure proper behaviour */
-                if (ah->config.pcie_waen) {
-                        val = ah->config.pcie_waen;
-                        if (!power_off)
-                                val &= (~AR_WA_D3_L1_DISABLE);
-                } else {
-                        if (AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
-                            AR_SREV_9287(ah)) {
-                                val = AR9285_WA_DEFAULT;
-                                if (!power_off)
-                                        val &= (~AR_WA_D3_L1_DISABLE);
-                        } else if (AR_SREV_9280(ah)) {
-                                /*
-                                 * On AR9280 chips bit 22 of 0x4004 needs to be
-                                 * set otherwise card may disappear.
-                                 */
-                                val = AR9280_WA_DEFAULT;
-                                if (!power_off)
-                                        val &= (~AR_WA_D3_L1_DISABLE);
-                        } else
-                                val = AR_WA_DEFAULT;
-                }
-
-                REG_WRITE(ah, AR_WA, val);
-        }
-
-        if (power_off) {
-                /*
-                 * Set PCIe workaround bits
-                 * bit 14 in WA register (disable L1) should only
-                 * be set when device enters D3 and be cleared
-                 * when device comes back to D0.
-                 */
-                if (ah->config.pcie_waen) {
-                        if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
-                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
-                } else {
-                        if (((AR_SREV_9285(ah) || AR_SREV_9271(ah) ||
-                              AR_SREV_9287(ah)) &&
-                             (AR9285_WA_DEFAULT & AR_WA_D3_L1_DISABLE)) ||
-                            (AR_SREV_9280(ah) &&
-                             (AR9280_WA_DEFAULT & AR_WA_D3_L1_DISABLE))) {
-                                REG_SET_BIT(ah, AR_WA, AR_WA_D3_L1_DISABLE);
-                        }
-                }
-        }
-}
-EXPORT_SYMBOL(ath9k_hw_configpcipowersave);
-
-/**********************/
-/* Interrupt Handling */
-/**********************/
-
-bool ath9k_hw_intrpend(struct ath_hw *ah)
-{
-        u32 host_isr;
-
-        if (AR_SREV_9100(ah))
-                return true;
-
-        host_isr = REG_READ(ah, AR_INTR_ASYNC_CAUSE);
-        if ((host_isr & AR_INTR_MAC_IRQ) && (host_isr != AR_INTR_SPURIOUS))
-                return true;
-
-        host_isr = REG_READ(ah, AR_INTR_SYNC_CAUSE);
-        if ((host_isr & AR_INTR_SYNC_DEFAULT)
-            && (host_isr != AR_INTR_SPURIOUS))
-                return true;
-
-        return false;
-}
-EXPORT_SYMBOL(ath9k_hw_intrpend);
-
-bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
-{
-        u32 isr = 0;
-        u32 mask2 = 0;
-        struct ath9k_hw_capabilities *pCap = &ah->caps;
-        u32 sync_cause = 0;
-        bool fatal_int = false;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (!AR_SREV_9100(ah)) {
-                if (REG_READ(ah, AR_INTR_ASYNC_CAUSE) & AR_INTR_MAC_IRQ) {
-                        if ((REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M)
-                            == AR_RTC_STATUS_ON) {
-                                isr = REG_READ(ah, AR_ISR);
-                        }
-                }
-
-                sync_cause = REG_READ(ah, AR_INTR_SYNC_CAUSE) &
-                        AR_INTR_SYNC_DEFAULT;
-
-                *masked = 0;
-
-                if (!isr && !sync_cause)
-                        return false;
-        } else {
-                *masked = 0;
-                isr = REG_READ(ah, AR_ISR);
-        }
-
-        if (isr) {
-                if (isr & AR_ISR_BCNMISC) {
-                        u32 isr2;
-                        isr2 = REG_READ(ah, AR_ISR_S2);
-                        if (isr2 & AR_ISR_S2_TIM)
-                                mask2 |= ATH9K_INT_TIM;
-                        if (isr2 & AR_ISR_S2_DTIM)
-                                mask2 |= ATH9K_INT_DTIM;
-                        if (isr2 & AR_ISR_S2_DTIMSYNC)
-                                mask2 |= ATH9K_INT_DTIMSYNC;
-                        if (isr2 & (AR_ISR_S2_CABEND))
-                                mask2 |= ATH9K_INT_CABEND;
-                        if (isr2 & AR_ISR_S2_GTT)
-                                mask2 |= ATH9K_INT_GTT;
-                        if (isr2 & AR_ISR_S2_CST)
-                                mask2 |= ATH9K_INT_CST;
-                        if (isr2 & AR_ISR_S2_TSFOOR)
-                                mask2 |= ATH9K_INT_TSFOOR;
-                }
-
-                isr = REG_READ(ah, AR_ISR_RAC);
-                if (isr == 0xffffffff) {
-                        *masked = 0;
-                        return false;
-                }
-
-                *masked = isr & ATH9K_INT_COMMON;
-
-                if (ah->config.rx_intr_mitigation) {
-                        if (isr & (AR_ISR_RXMINTR | AR_ISR_RXINTM))
-                                *masked |= ATH9K_INT_RX;
-                }
-
-                if (isr & (AR_ISR_RXOK | AR_ISR_RXERR))
-                        *masked |= ATH9K_INT_RX;
-                if (isr &
-                    (AR_ISR_TXOK | AR_ISR_TXDESC | AR_ISR_TXERR |
-                     AR_ISR_TXEOL)) {
-                        u32 s0_s, s1_s;
-
-                        *masked |= ATH9K_INT_TX;
-
-                        s0_s = REG_READ(ah, AR_ISR_S0_S);
-                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
-                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
-
-                        s1_s = REG_READ(ah, AR_ISR_S1_S);
-                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
-                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
-                }
-
-                if (isr & AR_ISR_RXORN) {
-                        ath_print(common, ATH_DBG_INTERRUPT,
-                                  "receive FIFO overrun interrupt\n");
-                }
-
-                if (!AR_SREV_9100(ah)) {
-                        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
-                                u32 isr5 = REG_READ(ah, AR_ISR_S5_S);
-                                if (isr5 & AR_ISR_S5_TIM_TIMER)
-                                        *masked |= ATH9K_INT_TIM_TIMER;
-                        }
-                }
-
-                *masked |= mask2;
-        }
-
-        if (AR_SREV_9100(ah))
-                return true;
-
-        if (isr & AR_ISR_GENTMR) {
-                u32 s5_s;
-
-                s5_s = REG_READ(ah, AR_ISR_S5_S);
-                if (isr & AR_ISR_GENTMR) {
-                        ah->intr_gen_timer_trigger =
-                                MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
-
-                        ah->intr_gen_timer_thresh =
-                                MS(s5_s, AR_ISR_S5_GENTIMER_THRESH);
-
-                        if (ah->intr_gen_timer_trigger)
-                                *masked |= ATH9K_INT_GENTIMER;
-
-                }
-        }
-
-        if (sync_cause) {
-                fatal_int =
-                        (sync_cause &
-                         (AR_INTR_SYNC_HOST1_FATAL | AR_INTR_SYNC_HOST1_PERR))
-                        ? true : false;
-
-                if (fatal_int) {
-                        if (sync_cause & AR_INTR_SYNC_HOST1_FATAL) {
-                                ath_print(common, ATH_DBG_ANY,
-                                          "received PCI FATAL interrupt\n");
-                        }
-                        if (sync_cause & AR_INTR_SYNC_HOST1_PERR) {
-                                ath_print(common, ATH_DBG_ANY,
-                                          "received PCI PERR interrupt\n");
-                        }
-                        *masked |= ATH9K_INT_FATAL;
-                }
-                if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT) {
-                        ath_print(common, ATH_DBG_INTERRUPT,
-                                  "AR_INTR_SYNC_RADM_CPL_TIMEOUT\n");
-                        REG_WRITE(ah, AR_RC, AR_RC_HOSTIF);
-                        REG_WRITE(ah, AR_RC, 0);
-                        *masked |= ATH9K_INT_FATAL;
-                }
-                if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT) {
-                        ath_print(common, ATH_DBG_INTERRUPT,
-                                  "AR_INTR_SYNC_LOCAL_TIMEOUT\n");
-                }
-
-                REG_WRITE(ah, AR_INTR_SYNC_CAUSE_CLR, sync_cause);
-                (void) REG_READ(ah, AR_INTR_SYNC_CAUSE_CLR);
-        }
-
-        return true;
-}
-EXPORT_SYMBOL(ath9k_hw_getisr);
-
-enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
-{
-        enum ath9k_int omask = ah->imask;
-        u32 mask, mask2;
-        struct ath9k_hw_capabilities *pCap = &ah->caps;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        ath_print(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
-
-        if (omask & ATH9K_INT_GLOBAL) {
-                ath_print(common, ATH_DBG_INTERRUPT, "disable IER\n");
-                REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
-                (void) REG_READ(ah, AR_IER);
-                if (!AR_SREV_9100(ah)) {
-                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE, 0);
-                        (void) REG_READ(ah, AR_INTR_ASYNC_ENABLE);
-
-                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
-                        (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
-                }
-        }
-
-        mask = ints & ATH9K_INT_COMMON;
-        mask2 = 0;
-
-        if (ints & ATH9K_INT_TX) {
-                if (ah->txok_interrupt_mask)
-                        mask |= AR_IMR_TXOK;
-                if (ah->txdesc_interrupt_mask)
-                        mask |= AR_IMR_TXDESC;
-                if (ah->txerr_interrupt_mask)
-                        mask |= AR_IMR_TXERR;
-                if (ah->txeol_interrupt_mask)
-                        mask |= AR_IMR_TXEOL;
-        }
-        if (ints & ATH9K_INT_RX) {
-                mask |= AR_IMR_RXERR;
-                if (ah->config.rx_intr_mitigation)
-                        mask |= AR_IMR_RXMINTR | AR_IMR_RXINTM;
-                else
-                        mask |= AR_IMR_RXOK | AR_IMR_RXDESC;
-                if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
-                        mask |= AR_IMR_GENTMR;
-        }
-
-        if (ints & (ATH9K_INT_BMISC)) {
-                mask |= AR_IMR_BCNMISC;
-                if (ints & ATH9K_INT_TIM)
-                        mask2 |= AR_IMR_S2_TIM;
-                if (ints & ATH9K_INT_DTIM)
-                        mask2 |= AR_IMR_S2_DTIM;
-                if (ints & ATH9K_INT_DTIMSYNC)
-                        mask2 |= AR_IMR_S2_DTIMSYNC;
-                if (ints & ATH9K_INT_CABEND)
-                        mask2 |= AR_IMR_S2_CABEND;
-                if (ints & ATH9K_INT_TSFOOR)
-                        mask2 |= AR_IMR_S2_TSFOOR;
-        }
-
-        if (ints & (ATH9K_INT_GTT | ATH9K_INT_CST)) {
-                mask |= AR_IMR_BCNMISC;
-                if (ints & ATH9K_INT_GTT)
-                        mask2 |= AR_IMR_S2_GTT;
-                if (ints & ATH9K_INT_CST)
-                        mask2 |= AR_IMR_S2_CST;
-        }
-
-        ath_print(common, ATH_DBG_INTERRUPT, "new IMR 0x%x\n", mask);
-        REG_WRITE(ah, AR_IMR, mask);
-        ah->imrs2_reg &= ~(AR_IMR_S2_TIM | AR_IMR_S2_DTIM | AR_IMR_S2_DTIMSYNC |
-                           AR_IMR_S2_CABEND | AR_IMR_S2_CABTO |
-                           AR_IMR_S2_TSFOOR | AR_IMR_S2_GTT | AR_IMR_S2_CST);
-        ah->imrs2_reg |= mask2;
-        REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
-
-        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
-                if (ints & ATH9K_INT_TIM_TIMER)
-                        REG_SET_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
-                else
-                        REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
-        }
-
-        if (ints & ATH9K_INT_GLOBAL) {
-                ath_print(common, ATH_DBG_INTERRUPT, "enable IER\n");
-                REG_WRITE(ah, AR_IER, AR_IER_ENABLE);
-                if (!AR_SREV_9100(ah)) {
-                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE,
-                                  AR_INTR_MAC_IRQ);
-                        REG_WRITE(ah, AR_INTR_ASYNC_MASK, AR_INTR_MAC_IRQ);
-
-
-                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE,
-                                  AR_INTR_SYNC_DEFAULT);
-                        REG_WRITE(ah, AR_INTR_SYNC_MASK,
-                                  AR_INTR_SYNC_DEFAULT);
-                }
-                ath_print(common, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
-                          REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
-        }
-
-        return omask;
-}
-EXPORT_SYMBOL(ath9k_hw_set_interrupts);
-
 /*******************/
 /* Beacon Handling */
 /*******************/
@@ -2916,6 +1852,8 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
 
         ah->beacon_interval = beacon_period;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         switch (ah->opmode) {
         case NL80211_IFTYPE_STATION:
         case NL80211_IFTYPE_MONITOR:
@@ -2959,6 +1897,9 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
         REG_WRITE(ah, AR_SWBA_PERIOD, TU_TO_USEC(beacon_period));
         REG_WRITE(ah, AR_NDP_PERIOD, TU_TO_USEC(beacon_period));
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         beacon_period &= ~ATH9K_BEACON_ENA;
         if (beacon_period & ATH9K_BEACON_RESET_TSF) {
                 ath9k_hw_reset_tsf(ah);
@@ -2975,6 +1916,8 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         struct ath9k_hw_capabilities *pCap = &ah->caps;
         struct ath_common *common = ath9k_hw_common(ah);
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_NEXT_TBTT_TIMER, TU_TO_USEC(bs->bs_nexttbtt));
 
         REG_WRITE(ah, AR_BEACON_PERIOD,
@@ -2982,6 +1925,9 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         REG_WRITE(ah, AR_DMA_BEACON_PERIOD,
                   TU_TO_USEC(bs->bs_intval & ATH9K_BEACON_PERIOD));
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         REG_RMW_FIELD(ah, AR_RSSI_THR,
                       AR_RSSI_THR_BM_THR, bs->bs_bmissthreshold);
 
@@ -3004,6 +1950,8 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         ath_print(common, ATH_DBG_BEACON, "beacon period %d\n", beaconintval);
         ath_print(common, ATH_DBG_BEACON, "DTIM period %d\n", dtimperiod);
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_NEXT_DTIM,
                   TU_TO_USEC(bs->bs_nextdtim - SLEEP_SLOP));
         REG_WRITE(ah, AR_NEXT_TIM, TU_TO_USEC(nextTbtt - SLEEP_SLOP));
@@ -3023,6 +1971,9 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         REG_WRITE(ah, AR_TIM_PERIOD, TU_TO_USEC(beaconintval));
         REG_WRITE(ah, AR_DTIM_PERIOD, TU_TO_USEC(dtimperiod));
 
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         REG_SET_BIT(ah, AR_TIMER_MODE,
                     AR_TBTT_TIMER_EN | AR_TIM_TIMER_EN |
                     AR_DTIM_TIMER_EN);
@@ -3241,6 +2192,26 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                 btcoex_hw->scheme = ATH_BTCOEX_CFG_NONE;
         }
 
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                pCap->hw_caps |= ATH9K_HW_CAP_EDMA | ATH9K_HW_CAP_LDPC |
+                                 ATH9K_HW_CAP_FASTCLOCK;
+                pCap->rx_hp_qdepth = ATH9K_HW_RX_HP_QDEPTH;
+                pCap->rx_lp_qdepth = ATH9K_HW_RX_LP_QDEPTH;
+                pCap->rx_status_len = sizeof(struct ar9003_rxs);
+                pCap->tx_desc_len = sizeof(struct ar9003_txc);
+                pCap->txs_len = sizeof(struct ar9003_txs);
+        } else {
+                pCap->tx_desc_len = sizeof(struct ath_desc);
+                if (AR_SREV_9280_20(ah) &&
+                    ((ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV) <=
+                      AR5416_EEP_MINOR_VER_16) ||
+                     ah->eep_ops->get_eeprom(ah, EEP_FSTCLK_5G)))
+                        pCap->hw_caps |= ATH9K_HW_CAP_FASTCLOCK;
+        }
+
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                pCap->hw_caps |= ATH9K_HW_CAP_RAC_SUPPORTED;
+
         return 0;
 }
 
@@ -3273,10 +2244,6 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
         case ATH9K_CAP_TKIP_SPLIT:
                 return (ah->misc_mode & AR_PCU_MIC_NEW_LOC_ENA) ?
                         false : true;
-        case ATH9K_CAP_DIVERSITY:
-                return (REG_READ(ah, AR_PHY_CCK_DETECT) &
-                        AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV) ?
-                        true : false;
         case ATH9K_CAP_MCAST_KEYSRCH:
                 switch (capability) {
                 case 0:
@@ -3319,8 +2286,6 @@ EXPORT_SYMBOL(ath9k_hw_getcapability);
 bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 setting, int *status)
 {
-        u32 v;
-
         switch (type) {
         case ATH9K_CAP_TKIP_MIC:
                 if (setting)
@@ -3330,14 +2295,6 @@ bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                         ah->sta_id1_defaults &=
                                 ~AR_STA_ID1_CRPT_MIC_ENABLE;
                 return true;
-        case ATH9K_CAP_DIVERSITY:
-                v = REG_READ(ah, AR_PHY_CCK_DETECT);
-                if (setting)
-                        v |= AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
-                else
-                        v &= ~AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV;
-                REG_WRITE(ah, AR_PHY_CCK_DETECT, v);
-                return true;
         case ATH9K_CAP_MCAST_KEYSRCH:
                 if (setting)
                         ah->sta_id1_defaults |= AR_STA_ID1_MCAST_KSRCH;
@@ -3405,7 +2362,9 @@ u32 ath9k_hw_gpio_get(struct ath_hw *ah, u32 gpio)
         if (gpio >= ah->caps.num_gpio_pins)
                 return 0xffffffff;
 
-        if (AR_SREV_9271(ah))
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                return MS_REG_READ(AR9300, gpio) != 0;
+        else if (AR_SREV_9271(ah))
                 return MS_REG_READ(AR9271, gpio) != 0;
         else if (AR_SREV_9287_10_OR_LATER(ah))
                 return MS_REG_READ(AR9287, gpio) != 0;
@@ -3478,6 +2437,8 @@ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits)
 {
         u32 phybits;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_RX_FILTER, bits);
 
         phybits = 0;
@@ -3493,6 +2454,9 @@ void ath9k_hw_setrxfilter(struct ath_hw *ah, u32 bits)
         else
                 REG_WRITE(ah, AR_RXCFG,
                           REG_READ(ah, AR_RXCFG) & ~AR_RXCFG_ZLFDMA);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 EXPORT_SYMBOL(ath9k_hw_setrxfilter);
 
@@ -3565,14 +2529,25 @@ void ath9k_hw_write_associd(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_write_associd);
 
+#define ATH9K_MAX_TSF_READ 10
+
 u64 ath9k_hw_gettsf64(struct ath_hw *ah)
 {
-        u64 tsf;
+        u32 tsf_lower, tsf_upper1, tsf_upper2;
+        int i;
+
+        tsf_upper1 = REG_READ(ah, AR_TSF_U32);
+        for (i = 0; i < ATH9K_MAX_TSF_READ; i++) {
+                tsf_lower = REG_READ(ah, AR_TSF_L32);
+                tsf_upper2 = REG_READ(ah, AR_TSF_U32);
+                if (tsf_upper2 == tsf_upper1)
+                        break;
+                tsf_upper1 = tsf_upper2;
+        }
 
-        tsf = REG_READ(ah, AR_TSF_U32);
-        tsf = (tsf << 32) | REG_READ(ah, AR_TSF_L32);
+        WARN_ON( i == ATH9K_MAX_TSF_READ );
 
-        return tsf;
+        return (((u64)tsf_upper1 << 32) | tsf_lower);
 }
 EXPORT_SYMBOL(ath9k_hw_gettsf64);
 
@@ -3847,6 +2822,7 @@ static struct {
         { AR_SREV_VERSION_9285,         "9285" },
         { AR_SREV_VERSION_9287,         "9287" },
         { AR_SREV_VERSION_9271,         "9271" },
+        { AR_SREV_VERSION_9300,         "9300" },
 };
 
 /* For devices with external radios */
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index f4821cf33b87..77245dff5993 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008-2009 Atheros Communications Inc.
+ * Copyright (c) 2008-2010 Atheros Communications Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -41,6 +41,9 @@
 #define AR9280_DEVID_PCIE       0x002a
 #define AR9285_DEVID_PCIE       0x002b
 #define AR2427_DEVID_PCIE       0x002c
+#define AR9287_DEVID_PCI        0x002d
+#define AR9287_DEVID_PCIE       0x002e
+#define AR9300_DEVID_PCIE       0x0030
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -48,9 +51,6 @@
 #define AR_SUBVENDOR_ID_NEW_A   0x7065
 #define AR5416_MAGIC            0x19641014
 
-#define AR5416_DEVID_AR9287_PCI  0x002D
-#define AR5416_DEVID_AR9287_PCIE 0x002E
-
 #define AR9280_COEX2WIRE_SUBSYSID       0x309b
 #define AT9285_COEX3WIRE_SA_SUBSYSID    0x30aa
 #define AT9285_COEX3WIRE_DA_SUBSYSID    0x30ab
@@ -68,6 +68,24 @@
 #define REG_READ(_ah, _reg) \
         ath9k_hw_common(_ah)->ops->read((_ah), (_reg))
 
+#define ENABLE_REGWRITE_BUFFER(_ah)                                     \
+        do {                                                            \
+                if (AR_SREV_9271(_ah))                                  \
+                        ath9k_hw_common(_ah)->ops->enable_write_buffer((_ah)); \
+        } while (0)
+
+#define DISABLE_REGWRITE_BUFFER(_ah)                                    \
+        do {                                                            \
+                if (AR_SREV_9271(_ah))                                  \
+                        ath9k_hw_common(_ah)->ops->disable_write_buffer((_ah)); \
+        } while (0)
+
+#define REGWRITE_BUFFER_FLUSH(_ah)                                      \
+        do {                                                            \
+                if (AR_SREV_9271(_ah))                                  \
+                        ath9k_hw_common(_ah)->ops->write_flush((_ah));  \
+        } while (0)
+
 #define SM(_v, _f)  (((_v) << _f##_S) & _f)
 #define MS(_v, _f)  (((_v) & _f) >> _f##_S)
 #define REG_RMW(_a, _r, _set, _clr)    \
@@ -75,6 +93,8 @@
 #define REG_RMW_FIELD(_a, _r, _f, _v) \
         REG_WRITE(_a, _r, \
         (REG_READ(_a, _r) & ~_f) | (((_v) << _f##_S) & _f))
+#define REG_READ_FIELD(_a, _r, _f) \
+        (((REG_READ(_a, _r) & _f) >> _f##_S))
 #define REG_SET_BIT(_a, _r, _f) \
         REG_WRITE(_a, _r, REG_READ(_a, _r) | _f)
 #define REG_CLR_BIT(_a, _r, _f) \
@@ -135,6 +155,16 @@
 
 #define TU_TO_USEC(_tu)             ((_tu) << 10)
 
+#define ATH9K_HW_RX_HP_QDEPTH   16
+#define ATH9K_HW_RX_LP_QDEPTH   128
+
+enum ath_ini_subsys {
+        ATH_INI_PRE = 0,
+        ATH_INI_CORE,
+        ATH_INI_POST,
+        ATH_INI_NUM_SPLIT,
+};
+
 enum wireless_mode {
         ATH9K_MODE_11A = 0,
         ATH9K_MODE_11G,
@@ -165,13 +195,16 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_ENHANCEDPM                 = BIT(14),
         ATH9K_HW_CAP_AUTOSLEEP                  = BIT(15),
         ATH9K_HW_CAP_4KB_SPLITTRANS             = BIT(16),
+        ATH9K_HW_CAP_EDMA                       = BIT(17),
+        ATH9K_HW_CAP_RAC_SUPPORTED              = BIT(18),
+        ATH9K_HW_CAP_LDPC                       = BIT(19),
+        ATH9K_HW_CAP_FASTCLOCK                  = BIT(20),
 };
 
 enum ath9k_capability_type {
         ATH9K_CAP_CIPHER = 0,
         ATH9K_CAP_TKIP_MIC,
         ATH9K_CAP_TKIP_SPLIT,
-        ATH9K_CAP_DIVERSITY,
         ATH9K_CAP_TXPOW,
         ATH9K_CAP_MCAST_KEYSRCH,
         ATH9K_CAP_DS
@@ -192,6 +225,11 @@ struct ath9k_hw_capabilities {
         u8 num_gpio_pins;
         u8 num_antcfg_2ghz;
         u8 num_antcfg_5ghz;
+        u8 rx_hp_qdepth;
+        u8 rx_lp_qdepth;
+        u8 rx_status_len;
+        u8 tx_desc_len;
+        u8 txs_len;
 };
 
 struct ath9k_ops_config {
@@ -212,6 +250,7 @@ struct ath9k_ops_config {
         u32 enable_ani;
         int serialize_regmode;
         bool rx_intr_mitigation;
+        bool tx_intr_mitigation;
 #define SPUR_DISABLE            0
 #define SPUR_ENABLE_IOCTL       1
 #define SPUR_ENABLE_EEPROM      2
@@ -223,6 +262,7 @@ struct ath9k_ops_config {
 #define AR_BASE_FREQ_5GHZ       4900
 #define AR_SPUR_FEEQ_BOUND_HT40 19
 #define AR_SPUR_FEEQ_BOUND_HT20 10
+        bool tx_iq_calibration; /* Only available for >= AR9003 */
         int spurmode;
         u16 spurchans[AR_EEPROM_MODAL_SPURS][2];
         u8 max_txtrig_level;
@@ -231,6 +271,8 @@ struct ath9k_ops_config {
 enum ath9k_int {
         ATH9K_INT_RX = 0x00000001,
         ATH9K_INT_RXDESC = 0x00000002,
+        ATH9K_INT_RXHP = 0x00000001,
+        ATH9K_INT_RXLP = 0x00000002,
         ATH9K_INT_RXNOFRM = 0x00000008,
         ATH9K_INT_RXEOL = 0x00000010,
         ATH9K_INT_RXORN = 0x00000020,
@@ -327,10 +369,9 @@ struct ath9k_channel {
 #define IS_CHAN_2GHZ(_c) (((_c)->channelFlags & CHANNEL_2GHZ) != 0)
 #define IS_CHAN_HALF_RATE(_c) (((_c)->channelFlags & CHANNEL_HALF) != 0)
 #define IS_CHAN_QUARTER_RATE(_c) (((_c)->channelFlags & CHANNEL_QUARTER) != 0)
-#define IS_CHAN_A_5MHZ_SPACED(_c)                       \
+#define IS_CHAN_A_FAST_CLOCK(_ah, _c)                   \
         ((((_c)->channelFlags & CHANNEL_5GHZ) != 0) &&  \
-         (((_c)->channel % 20) != 0) &&                 \
-         (((_c)->channel % 10) != 0))
+         ((_ah)->caps.hw_caps & ATH9K_HW_CAP_FASTCLOCK))
 
 /* These macros check chanmode and not channelFlags */
 #define IS_CHAN_B(_c) ((_c)->chanmode == CHANNEL_B)
@@ -363,6 +404,12 @@ enum ser_reg_mode {
         SER_REG_MODE_AUTO = 2,
 };
 
+enum ath9k_rx_qtype {
+        ATH9K_RX_QUEUE_HP,
+        ATH9K_RX_QUEUE_LP,
+        ATH9K_RX_QUEUE_MAX,
+};
+
 struct ath9k_beacon_state {
         u32 bs_nexttbtt;
         u32 bs_nextdtim;
@@ -440,6 +487,124 @@ struct ath_gen_timer_table {
         } timer_mask;
 };
 
+/**
+ * struct ath_hw_private_ops - callbacks used internally by hardware code
+ *
+ * This structure contains private callbacks designed to only be used internally
+ * by the hardware core.
+ *
+ * @init_cal_settings: setup types of calibrations supported
+ * @init_cal: starts actual calibration
+ *
+ * @init_mode_regs: Initializes mode registers
+ * @init_mode_gain_regs: Initialize TX/RX gain registers
+ * @macversion_supported: If this specific mac revision is supported
+ *
+ * @rf_set_freq: change frequency
+ * @spur_mitigate_freq: spur mitigation
+ * @rf_alloc_ext_banks:
+ * @rf_free_ext_banks:
+ * @set_rf_regs:
+ * @compute_pll_control: compute the PLL control value to use for
+ *      AR_RTC_PLL_CONTROL for a given channel
+ * @setup_calibration: set up calibration
+ * @iscal_supported: used to query if a type of calibration is supported
+ * @loadnf: load noise floor read from each chain on the CCA registers
+ */
+struct ath_hw_private_ops {
+        /* Calibration ops */
+        void (*init_cal_settings)(struct ath_hw *ah);
+        bool (*init_cal)(struct ath_hw *ah, struct ath9k_channel *chan);
+
+        void (*init_mode_regs)(struct ath_hw *ah);
+        void (*init_mode_gain_regs)(struct ath_hw *ah);
+        bool (*macversion_supported)(u32 macversion);
+        void (*setup_calibration)(struct ath_hw *ah,
+                                  struct ath9k_cal_list *currCal);
+        bool (*iscal_supported)(struct ath_hw *ah,
+                                enum ath9k_cal_types calType);
+
+        /* PHY ops */
+        int (*rf_set_freq)(struct ath_hw *ah,
+                           struct ath9k_channel *chan);
+        void (*spur_mitigate_freq)(struct ath_hw *ah,
+                                   struct ath9k_channel *chan);
+        int (*rf_alloc_ext_banks)(struct ath_hw *ah);
+        void (*rf_free_ext_banks)(struct ath_hw *ah);
+        bool (*set_rf_regs)(struct ath_hw *ah,
+                            struct ath9k_channel *chan,
+                            u16 modesIndex);
+        void (*set_channel_regs)(struct ath_hw *ah, struct ath9k_channel *chan);
+        void (*init_bb)(struct ath_hw *ah,
+                        struct ath9k_channel *chan);
+        int (*process_ini)(struct ath_hw *ah, struct ath9k_channel *chan);
+        void (*olc_init)(struct ath_hw *ah);
+        void (*set_rfmode)(struct ath_hw *ah, struct ath9k_channel *chan);
+        void (*mark_phy_inactive)(struct ath_hw *ah);
+        void (*set_delta_slope)(struct ath_hw *ah, struct ath9k_channel *chan);
+        bool (*rfbus_req)(struct ath_hw *ah);
+        void (*rfbus_done)(struct ath_hw *ah);
+        void (*enable_rfkill)(struct ath_hw *ah);
+        void (*restore_chainmask)(struct ath_hw *ah);
+        void (*set_diversity)(struct ath_hw *ah, bool value);
+        u32 (*compute_pll_control)(struct ath_hw *ah,
+                                   struct ath9k_channel *chan);
+        bool (*ani_control)(struct ath_hw *ah, enum ath9k_ani_cmd cmd,
+                            int param);
+        void (*do_getnf)(struct ath_hw *ah, int16_t nfarray[NUM_NF_READINGS]);
+        void (*loadnf)(struct ath_hw *ah, struct ath9k_channel *chan);
+};
+
+/**
+ * struct ath_hw_ops - callbacks used by hardware code and driver code
+ *
+ * This structure contains callbacks designed to to be used internally by
+ * hardware code and also by the lower level driver.
+ *
+ * @config_pci_powersave:
+ * @calibrate: periodic calibration for NF, ANI, IQ, ADC gain, ADC-DC
+ */
+struct ath_hw_ops {
+        void (*config_pci_powersave)(struct ath_hw *ah,
+                                     int restore,
+                                     int power_off);
+        void (*rx_enable)(struct ath_hw *ah);
+        void (*set_desc_link)(void *ds, u32 link);
+        void (*get_desc_link)(void *ds, u32 **link);
+        bool (*calibrate)(struct ath_hw *ah,
+                          struct ath9k_channel *chan,
+                          u8 rxchainmask,
+                          bool longcal);
+        bool (*get_isr)(struct ath_hw *ah, enum ath9k_int *masked);
+        void (*fill_txdesc)(struct ath_hw *ah, void *ds, u32 seglen,
+                            bool is_firstseg, bool is_is_lastseg,
+                            const void *ds0, dma_addr_t buf_addr,
+                            unsigned int qcu);
+        int (*proc_txdesc)(struct ath_hw *ah, void *ds,
+                           struct ath_tx_status *ts);
+        void (*set11n_txdesc)(struct ath_hw *ah, void *ds,
+                              u32 pktLen, enum ath9k_pkt_type type,
+                              u32 txPower, u32 keyIx,
+                              enum ath9k_key_type keyType,
+                              u32 flags);
+        void (*set11n_ratescenario)(struct ath_hw *ah, void *ds,
+                                void *lastds,
+                                u32 durUpdateEn, u32 rtsctsRate,
+                                u32 rtsctsDuration,
+                                struct ath9k_11n_rate_series series[],
+                                u32 nseries, u32 flags);
+        void (*set11n_aggr_first)(struct ath_hw *ah, void *ds,
+                                  u32 aggrLen);
+        void (*set11n_aggr_middle)(struct ath_hw *ah, void *ds,
+                                   u32 numDelims);
+        void (*set11n_aggr_last)(struct ath_hw *ah, void *ds);
+        void (*clr11n_aggr)(struct ath_hw *ah, void *ds);
+        void (*set11n_burstduration)(struct ath_hw *ah, void *ds,
+                                     u32 burstDuration);
+        void (*set11n_virtualmorefrag)(struct ath_hw *ah, void *ds,
+                                       u32 vmf);
+};
+
 struct ath_hw {
         struct ieee80211_hw *hw;
         struct ath_common common;
@@ -453,14 +618,18 @@ struct ath_hw {
                 struct ar5416_eeprom_def def;
                 struct ar5416_eeprom_4k map4k;
                 struct ar9287_eeprom map9287;
+                struct ar9300_eeprom ar9300_eep;
         } eeprom;
         const struct eeprom_ops *eep_ops;
-        enum ath9k_eep_map eep_map;
 
         bool sw_mgmt_crypto;
         bool is_pciexpress;
         bool need_an_top2_fixup;
         u16 tx_trig_level;
+        s16 nf_2g_max;
+        s16 nf_2g_min;
+        s16 nf_5g_max;
+        s16 nf_5g_min;
         u16 rfsilent;
         u32 rfkill_gpio;
         u32 rfkill_polarity;
@@ -493,6 +662,7 @@ struct ath_hw {
         struct ath9k_cal_list adcgain_caldata;
         struct ath9k_cal_list adcdc_calinitdata;
         struct ath9k_cal_list adcdc_caldata;
+        struct ath9k_cal_list tempCompCalData;
         struct ath9k_cal_list *cal_list;
         struct ath9k_cal_list *cal_list_last;
         struct ath9k_cal_list *cal_list_curr;
@@ -533,12 +703,10 @@ struct ath_hw {
                 DONT_USE_32KHZ,
         } enable_32kHz_clock;
 
-        /* Callback for radio frequency change */
-        int (*ath9k_hw_rf_set_freq)(struct ath_hw *ah, struct ath9k_channel *chan);
-
-        /* Callback for baseband spur frequency */
-        void (*ath9k_hw_spur_mitigate_freq)(struct ath_hw *ah,
-                                            struct ath9k_channel *chan);
+        /* Private to hardware code */
+        struct ath_hw_private_ops private_ops;
+        /* Accessed by the lower level driver */
+        struct ath_hw_ops ops;
 
         /* Used to program the radio on non single-chip devices */
         u32 *analogBank0Data;
@@ -551,6 +719,7 @@ struct ath_hw {
         u32 *addac5416_21;
         u32 *bank6Temp;
 
+        u8 txpower_limit;
         int16_t txpower_indexoffset;
         int coverage_class;
         u32 beacon_interval;
@@ -592,6 +761,7 @@ struct ath_hw {
         struct ar5416IniArray iniBank7;
         struct ar5416IniArray iniAddac;
         struct ar5416IniArray iniPcieSerdes;
+        struct ar5416IniArray iniPcieSerdesLowPower;
         struct ar5416IniArray iniModesAdditional;
         struct ar5416IniArray iniModesRxGain;
         struct ar5416IniArray iniModesTxGain;
@@ -604,9 +774,21 @@ struct ath_hw {
         struct ar5416IniArray iniModes_high_power_tx_gain_9271;
         struct ar5416IniArray iniModes_normal_power_tx_gain_9271;
 
+        struct ar5416IniArray iniMac[ATH_INI_NUM_SPLIT];
+        struct ar5416IniArray iniBB[ATH_INI_NUM_SPLIT];
+        struct ar5416IniArray iniRadio[ATH_INI_NUM_SPLIT];
+        struct ar5416IniArray iniSOC[ATH_INI_NUM_SPLIT];
+
         u32 intr_gen_timer_trigger;
         u32 intr_gen_timer_thresh;
         struct ath_gen_timer_table hw_gen_timers;
+
+        struct ar9003_txs *ts_ring;
+        void *ts_start;
+        u32 ts_paddr_start;
+        u32 ts_paddr_end;
+        u16 ts_tail;
+        u8 ts_size;
 };
 
 static inline struct ath_common *ath9k_hw_common(struct ath_hw *ah)
@@ -619,6 +801,16 @@ static inline struct ath_regulatory *ath9k_hw_regulatory(struct ath_hw *ah)
         return &(ath9k_hw_common(ah)->regulatory);
 }
 
+static inline struct ath_hw_private_ops *ath9k_hw_private_ops(struct ath_hw *ah)
+{
+        return &ah->private_ops;
+}
+
+static inline struct ath_hw_ops *ath9k_hw_ops(struct ath_hw *ah)
+{
+        return &ah->ops;
+}
+
 /* Initialization, Detach, Reset */
 const char *ath9k_hw_probe(u16 vendorid, u16 devid);
 void ath9k_hw_deinit(struct ath_hw *ah);
@@ -630,6 +822,7 @@ bool ath9k_hw_getcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 *result);
 bool ath9k_hw_setcapability(struct ath_hw *ah, enum ath9k_capability_type type,
                             u32 capability, u32 setting, int *status);
+u32 ath9k_regd_get_ctl(struct ath_regulatory *reg, struct ath9k_channel *chan);
 
 /* Key Cache Management */
 bool ath9k_hw_keyreset(struct ath_hw *ah, u16 entry);
@@ -678,16 +871,10 @@ void ath9k_hw_set11nmac2040(struct ath_hw *ah);
 void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period);
 void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
                                     const struct ath9k_beacon_state *bs);
+bool ath9k_hw_check_alive(struct ath_hw *ah);
 
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
 
-void ath9k_hw_configpcipowersave(struct ath_hw *ah, int restore, int power_off);
-
-/* Interrupt Handling */
-bool ath9k_hw_intrpend(struct ath_hw *ah);
-bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked);
-enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints);
-
 /* Generic hw timer primitives */
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
@@ -709,6 +896,36 @@ void ath9k_hw_name(struct ath_hw *ah, char *hw_name, size_t len);
 /* HTC */
 void ath9k_hw_htc_resetinit(struct ath_hw *ah);
 
+/* PHY */
+void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
+                                   u32 *coef_mantissa, u32 *coef_exponent);
+
+/*
+ * Code Specific to AR5008, AR9001 or AR9002,
+ * we stuff these here to avoid callbacks for AR9003.
+ */
+void ar9002_hw_cck_chan14_spread(struct ath_hw *ah);
+int ar9002_hw_rf_claim(struct ath_hw *ah);
+void ar9002_hw_enable_async_fifo(struct ath_hw *ah);
+void ar9002_hw_enable_wep_aggregation(struct ath_hw *ah);
+
+/*
+ * Code specifric to AR9003, we stuff these here to avoid callbacks
+ * for older families
+ */
+void ar9003_hw_set_nf_limits(struct ath_hw *ah);
+
+/* Hardware family op attach helpers */
+void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
+void ar9002_hw_attach_phy_ops(struct ath_hw *ah);
+void ar9003_hw_attach_phy_ops(struct ath_hw *ah);
+
+void ar9002_hw_attach_calib_ops(struct ath_hw *ah);
+void ar9003_hw_attach_calib_ops(struct ath_hw *ah);
+
+void ar9002_hw_attach_ops(struct ath_hw *ah);
+void ar9003_hw_attach_ops(struct ath_hw *ah);
+
 #define ATH_PCIE_CAP_LINK_CTRL  0x70
 #define ATH_PCIE_CAP_LINK_L0S   1
 #define ATH_PCIE_CAP_LINK_L1    2
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index b78308c3c4d4..8c795488ebc3 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -175,6 +175,18 @@ static const struct ath_ops ath9k_common_ops = {
         .write = ath9k_iowrite32,
 };
 
+static int count_streams(unsigned int chainmask, int max)
+{
+        int streams = 0;
+
+        do {
+                if (++streams == max)
+                        break;
+        } while ((chainmask = chainmask & (chainmask - 1)));
+
+        return streams;
+}
+
 /**************************/
 /*     Initialization     */
 /**************************/
@@ -182,8 +194,10 @@ static const struct ath_ops ath9k_common_ops = {
 static void setup_ht_cap(struct ath_softc *sc,
                          struct ieee80211_sta_ht_cap *ht_info)
 {
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         u8 tx_streams, rx_streams;
+        int i, max_streams;
 
         ht_info->ht_supported = true;
         ht_info->cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
@@ -191,28 +205,40 @@ static void setup_ht_cap(struct ath_softc *sc,
                        IEEE80211_HT_CAP_SGI_40 |
                        IEEE80211_HT_CAP_DSSSCCK40;
 
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_LDPC)
+                ht_info->cap |= IEEE80211_HT_CAP_LDPC_CODING;
+
         ht_info->ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
         ht_info->ampdu_density = IEEE80211_HT_MPDU_DENSITY_8;
 
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                max_streams = 3;
+        else
+                max_streams = 2;
+
+        if (AR_SREV_9280_10_OR_LATER(ah)) {
+                if (max_streams >= 2)
+                        ht_info->cap |= IEEE80211_HT_CAP_TX_STBC;
+                ht_info->cap |= (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
+        }
+
         /* set up supported mcs set */
         memset(&ht_info->mcs, 0, sizeof(ht_info->mcs));
-        tx_streams = !(common->tx_chainmask & (common->tx_chainmask - 1)) ?
-                     1 : 2;
-        rx_streams = !(common->rx_chainmask & (common->rx_chainmask - 1)) ?
-                     1 : 2;
+        tx_streams = count_streams(common->tx_chainmask, max_streams);
+        rx_streams = count_streams(common->rx_chainmask, max_streams);
+
+        ath_print(common, ATH_DBG_CONFIG,
+                  "TX streams %d, RX streams: %d\n",
+                  tx_streams, rx_streams);
 
         if (tx_streams != rx_streams) {
-                ath_print(common, ATH_DBG_CONFIG,
-                          "TX streams %d, RX streams: %d\n",
-                          tx_streams, rx_streams);
                 ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_RX_DIFF;
                 ht_info->mcs.tx_params |= ((tx_streams - 1) <<
                                 IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT);
         }
 
-        ht_info->mcs.rx_mask[0] = 0xff;
-        if (rx_streams >= 2)
-                ht_info->mcs.rx_mask[1] = 0xff;
+        for (i = 0; i < rx_streams; i++)
+                ht_info->mcs.rx_mask[i] = 0xff;
 
         ht_info->mcs.tx_params |= IEEE80211_HT_MCS_TX_DEFINED;
 }
@@ -235,31 +261,37 @@ static int ath9k_reg_notifier(struct wiphy *wiphy,
 */
 int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                       struct list_head *head, const char *name,
-                      int nbuf, int ndesc)
+                      int nbuf, int ndesc, bool is_tx)
 {
 #define DS2PHYS(_dd, _ds)                                               \
         ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
 #define ATH_DESC_4KB_BOUND_CHECK(_daddr) ((((_daddr) & 0xFFF) > 0xF7F) ? 1 : 0)
 #define ATH_DESC_4KB_BOUND_NUM_SKIPPED(_len) ((_len) / 4096)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        struct ath_desc *ds;
+        u8 *ds;
         struct ath_buf *bf;
-        int i, bsize, error;
+        int i, bsize, error, desc_len;
 
         ath_print(common, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n",
                   name, nbuf, ndesc);
 
         INIT_LIST_HEAD(head);
+
+        if (is_tx)
+                desc_len = sc->sc_ah->caps.tx_desc_len;
+        else
+                desc_len = sizeof(struct ath_desc);
+
         /* ath_desc must be a multiple of DWORDs */
-        if ((sizeof(struct ath_desc) % 4) != 0) {
+        if ((desc_len % 4) != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "ath_desc not DWORD aligned\n");
-                BUG_ON((sizeof(struct ath_desc) % 4) != 0);
+                BUG_ON((desc_len % 4) != 0);
                 error = -ENOMEM;
                 goto fail;
         }
 
-        dd->dd_desc_len = sizeof(struct ath_desc) * nbuf * ndesc;
+        dd->dd_desc_len = desc_len * nbuf * ndesc;
 
         /*
          * Need additional DMA memory because we can't use
@@ -272,7 +304,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                 u32 dma_len;
 
                 while (ndesc_skipped) {
-                        dma_len = ndesc_skipped * sizeof(struct ath_desc);
+                        dma_len = ndesc_skipped * desc_len;
                         dd->dd_desc_len += dma_len;
 
                         ndesc_skipped = ATH_DESC_4KB_BOUND_NUM_SKIPPED(dma_len);
@@ -286,7 +318,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                 error = -ENOMEM;
                 goto fail;
         }
-        ds = dd->dd_desc;
+        ds = (u8 *) dd->dd_desc;
         ath_print(common, ATH_DBG_CONFIG, "%s DMA map: %p (%u) -> %llx (%u)\n",
                   name, ds, (u32) dd->dd_desc_len,
                   ito64(dd->dd_desc_paddr), /*XXX*/(u32) dd->dd_desc_len);
@@ -300,7 +332,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
         }
         dd->dd_bufptr = bf;
 
-        for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
+        for (i = 0; i < nbuf; i++, bf++, ds += (desc_len * ndesc)) {
                 bf->bf_desc = ds;
                 bf->bf_daddr = DS2PHYS(dd, ds);
 
@@ -316,7 +348,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
                                        ((caddr_t) dd->dd_desc +
                                         dd->dd_desc_len));
 
-                                ds += ndesc;
+                                ds += (desc_len * ndesc);
                                 bf->bf_desc = ds;
                                 bf->bf_daddr = DS2PHYS(dd, ds);
                         }
@@ -514,7 +546,7 @@ static void ath9k_init_misc(struct ath_softc *sc)
         common->tx_chainmask = sc->sc_ah->caps.tx_chainmask;
         common->rx_chainmask = sc->sc_ah->caps.rx_chainmask;
 
-        ath9k_hw_setcapability(sc->sc_ah, ATH9K_CAP_DIVERSITY, 1, true, NULL);
+        ath9k_hw_set_diversity(sc->sc_ah, true);
         sc->rx.defant = ath9k_hw_getdefantenna(sc->sc_ah);
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_BSSIDMASK)
@@ -568,13 +600,10 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, u16 subsysid,
         ath_read_cachesize(common, &csz);
         common->cachelsz = csz << 2; /* convert to bytes */
 
+        /* Initializes the hardware for all supported chipsets */
         ret = ath9k_hw_init(ah);
-        if (ret) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Unable to initialize hardware; "
-                          "initialization status: %d\n", ret);
+        if (ret)
                 goto err_hw;
-        }
 
         ret = ath9k_init_debug(ah);
         if (ret) {
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 4a2060e5a777..0e425cb4bbb1 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -25,6 +25,8 @@ static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
                   ah->txdesc_interrupt_mask, ah->txeol_interrupt_mask,
                   ah->txurn_interrupt_mask);
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_IMR_S0,
                   SM(ah->txok_interrupt_mask, AR_IMR_S0_QCU_TXOK)
                   | SM(ah->txdesc_interrupt_mask, AR_IMR_S0_QCU_TXDESC));
@@ -35,6 +37,9 @@ static void ath9k_hw_set_txq_interrupts(struct ath_hw *ah,
         ah->imrs2_reg &= ~AR_IMR_S2_QCU_TXURN;
         ah->imrs2_reg |= (ah->txurn_interrupt_mask & AR_IMR_S2_QCU_TXURN);
         REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
 }
 
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q)
@@ -57,6 +62,18 @@ void ath9k_hw_txstart(struct ath_hw *ah, u32 q)
 }
 EXPORT_SYMBOL(ath9k_hw_txstart);
 
+void ath9k_hw_cleartxdesc(struct ath_hw *ah, void *ds)
+{
+        struct ar5416_desc *ads = AR5416DESC(ds);
+
+        ads->ds_txstatus0 = ads->ds_txstatus1 = 0;
+        ads->ds_txstatus2 = ads->ds_txstatus3 = 0;
+        ads->ds_txstatus4 = ads->ds_txstatus5 = 0;
+        ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
+        ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
+}
+EXPORT_SYMBOL(ath9k_hw_cleartxdesc);
+
 u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q)
 {
         u32 npend;
@@ -207,281 +224,6 @@ bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q)
 }
 EXPORT_SYMBOL(ath9k_hw_stoptxdma);
 
-void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
-                         u32 segLen, bool firstSeg,
-                         bool lastSeg, const struct ath_desc *ds0)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        if (firstSeg) {
-                ads->ds_ctl1 |= segLen | (lastSeg ? 0 : AR_TxMore);
-        } else if (lastSeg) {
-                ads->ds_ctl0 = 0;
-                ads->ds_ctl1 = segLen;
-                ads->ds_ctl2 = AR5416DESC_CONST(ds0)->ds_ctl2;
-                ads->ds_ctl3 = AR5416DESC_CONST(ds0)->ds_ctl3;
-        } else {
-                ads->ds_ctl0 = 0;
-                ads->ds_ctl1 = segLen | AR_TxMore;
-                ads->ds_ctl2 = 0;
-                ads->ds_ctl3 = 0;
-        }
-        ads->ds_txstatus0 = ads->ds_txstatus1 = 0;
-        ads->ds_txstatus2 = ads->ds_txstatus3 = 0;
-        ads->ds_txstatus4 = ads->ds_txstatus5 = 0;
-        ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
-        ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
-}
-EXPORT_SYMBOL(ath9k_hw_filltxdesc);
-
-void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        ads->ds_txstatus0 = ads->ds_txstatus1 = 0;
-        ads->ds_txstatus2 = ads->ds_txstatus3 = 0;
-        ads->ds_txstatus4 = ads->ds_txstatus5 = 0;
-        ads->ds_txstatus6 = ads->ds_txstatus7 = 0;
-        ads->ds_txstatus8 = ads->ds_txstatus9 = 0;
-}
-EXPORT_SYMBOL(ath9k_hw_cleartxdesc);
-
-int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds,
-                        struct ath_tx_status *ts)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        if ((ads->ds_txstatus9 & AR_TxDone) == 0)
-                return -EINPROGRESS;
-
-        ts->ts_seqnum = MS(ads->ds_txstatus9, AR_SeqNum);
-        ts->ts_tstamp = ads->AR_SendTimestamp;
-        ts->ts_status = 0;
-        ts->ts_flags = 0;
-
-        if (ads->ds_txstatus1 & AR_FrmXmitOK)
-                ts->ts_status |= ATH9K_TX_ACKED;
-        if (ads->ds_txstatus1 & AR_ExcessiveRetries)
-                ts->ts_status |= ATH9K_TXERR_XRETRY;
-        if (ads->ds_txstatus1 & AR_Filtered)
-                ts->ts_status |= ATH9K_TXERR_FILT;
-        if (ads->ds_txstatus1 & AR_FIFOUnderrun) {
-                ts->ts_status |= ATH9K_TXERR_FIFO;
-                ath9k_hw_updatetxtriglevel(ah, true);
-        }
-        if (ads->ds_txstatus9 & AR_TxOpExceeded)
-                ts->ts_status |= ATH9K_TXERR_XTXOP;
-        if (ads->ds_txstatus1 & AR_TxTimerExpired)
-                ts->ts_status |= ATH9K_TXERR_TIMER_EXPIRED;
-
-        if (ads->ds_txstatus1 & AR_DescCfgErr)
-                ts->ts_flags |= ATH9K_TX_DESC_CFG_ERR;
-        if (ads->ds_txstatus1 & AR_TxDataUnderrun) {
-                ts->ts_flags |= ATH9K_TX_DATA_UNDERRUN;
-                ath9k_hw_updatetxtriglevel(ah, true);
-        }
-        if (ads->ds_txstatus1 & AR_TxDelimUnderrun) {
-                ts->ts_flags |= ATH9K_TX_DELIM_UNDERRUN;
-                ath9k_hw_updatetxtriglevel(ah, true);
-        }
-        if (ads->ds_txstatus0 & AR_TxBaStatus) {
-                ts->ts_flags |= ATH9K_TX_BA;
-                ts->ba_low = ads->AR_BaBitmapLow;
-                ts->ba_high = ads->AR_BaBitmapHigh;
-        }
-
-        ts->ts_rateindex = MS(ads->ds_txstatus9, AR_FinalTxIdx);
-        switch (ts->ts_rateindex) {
-        case 0:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate0);
-                break;
-        case 1:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate1);
-                break;
-        case 2:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate2);
-                break;
-        case 3:
-                ts->ts_ratecode = MS(ads->ds_ctl3, AR_XmitRate3);
-                break;
-        }
-
-        ts->ts_rssi = MS(ads->ds_txstatus5, AR_TxRSSICombined);
-        ts->ts_rssi_ctl0 = MS(ads->ds_txstatus0, AR_TxRSSIAnt00);
-        ts->ts_rssi_ctl1 = MS(ads->ds_txstatus0, AR_TxRSSIAnt01);
-        ts->ts_rssi_ctl2 = MS(ads->ds_txstatus0, AR_TxRSSIAnt02);
-        ts->ts_rssi_ext0 = MS(ads->ds_txstatus5, AR_TxRSSIAnt10);
-        ts->ts_rssi_ext1 = MS(ads->ds_txstatus5, AR_TxRSSIAnt11);
-        ts->ts_rssi_ext2 = MS(ads->ds_txstatus5, AR_TxRSSIAnt12);
-        ts->evm0 = ads->AR_TxEVM0;
-        ts->evm1 = ads->AR_TxEVM1;
-        ts->evm2 = ads->AR_TxEVM2;
-        ts->ts_shortretry = MS(ads->ds_txstatus1, AR_RTSFailCnt);
-        ts->ts_longretry = MS(ads->ds_txstatus1, AR_DataFailCnt);
-        ts->ts_virtcol = MS(ads->ds_txstatus1, AR_VirtRetryCnt);
-        ts->ts_antenna = 0;
-
-        return 0;
-}
-EXPORT_SYMBOL(ath9k_hw_txprocdesc);
-
-void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
-                            u32 pktLen, enum ath9k_pkt_type type, u32 txPower,
-                            u32 keyIx, enum ath9k_key_type keyType, u32 flags)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        txPower += ah->txpower_indexoffset;
-        if (txPower > 63)
-                txPower = 63;
-
-        ads->ds_ctl0 = (pktLen & AR_FrameLen)
-                | (flags & ATH9K_TXDESC_VMF ? AR_VirtMoreFrag : 0)
-                | SM(txPower, AR_XmitPower)
-                | (flags & ATH9K_TXDESC_VEOL ? AR_VEOL : 0)
-                | (flags & ATH9K_TXDESC_CLRDMASK ? AR_ClrDestMask : 0)
-                | (flags & ATH9K_TXDESC_INTREQ ? AR_TxIntrReq : 0)
-                | (keyIx != ATH9K_TXKEYIX_INVALID ? AR_DestIdxValid : 0);
-
-        ads->ds_ctl1 =
-                (keyIx != ATH9K_TXKEYIX_INVALID ? SM(keyIx, AR_DestIdx) : 0)
-                | SM(type, AR_FrameType)
-                | (flags & ATH9K_TXDESC_NOACK ? AR_NoAck : 0)
-                | (flags & ATH9K_TXDESC_EXT_ONLY ? AR_ExtOnly : 0)
-                | (flags & ATH9K_TXDESC_EXT_AND_CTL ? AR_ExtAndCtl : 0);
-
-        ads->ds_ctl6 = SM(keyType, AR_EncrType);
-
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah)) {
-                ads->ds_ctl8 = 0;
-                ads->ds_ctl9 = 0;
-                ads->ds_ctl10 = 0;
-                ads->ds_ctl11 = 0;
-        }
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_txdesc);
-
-void ath9k_hw_set11n_ratescenario(struct ath_hw *ah, struct ath_desc *ds,
-                                  struct ath_desc *lastds,
-                                  u32 durUpdateEn, u32 rtsctsRate,
-                                  u32 rtsctsDuration,
-                                  struct ath9k_11n_rate_series series[],
-                                  u32 nseries, u32 flags)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-        struct ar5416_desc *last_ads = AR5416DESC(lastds);
-        u32 ds_ctl0;
-
-        if (flags & (ATH9K_TXDESC_RTSENA | ATH9K_TXDESC_CTSENA)) {
-                ds_ctl0 = ads->ds_ctl0;
-
-                if (flags & ATH9K_TXDESC_RTSENA) {
-                        ds_ctl0 &= ~AR_CTSEnable;
-                        ds_ctl0 |= AR_RTSEnable;
-                } else {
-                        ds_ctl0 &= ~AR_RTSEnable;
-                        ds_ctl0 |= AR_CTSEnable;
-                }
-
-                ads->ds_ctl0 = ds_ctl0;
-        } else {
-                ads->ds_ctl0 =
-                        (ads->ds_ctl0 & ~(AR_RTSEnable | AR_CTSEnable));
-        }
-
-        ads->ds_ctl2 = set11nTries(series, 0)
-                | set11nTries(series, 1)
-                | set11nTries(series, 2)
-                | set11nTries(series, 3)
-                | (durUpdateEn ? AR_DurUpdateEna : 0)
-                | SM(0, AR_BurstDur);
-
-        ads->ds_ctl3 = set11nRate(series, 0)
-                | set11nRate(series, 1)
-                | set11nRate(series, 2)
-                | set11nRate(series, 3);
-
-        ads->ds_ctl4 = set11nPktDurRTSCTS(series, 0)
-                | set11nPktDurRTSCTS(series, 1);
-
-        ads->ds_ctl5 = set11nPktDurRTSCTS(series, 2)
-                | set11nPktDurRTSCTS(series, 3);
-
-        ads->ds_ctl7 = set11nRateFlags(series, 0)
-                | set11nRateFlags(series, 1)
-                | set11nRateFlags(series, 2)
-                | set11nRateFlags(series, 3)
-                | SM(rtsctsRate, AR_RTSCTSRate);
-        last_ads->ds_ctl2 = ads->ds_ctl2;
-        last_ads->ds_ctl3 = ads->ds_ctl3;
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_ratescenario);
-
-void ath9k_hw_set11n_aggr_first(struct ath_hw *ah, struct ath_desc *ds,
-                                u32 aggrLen)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        ads->ds_ctl1 |= (AR_IsAggr | AR_MoreAggr);
-        ads->ds_ctl6 &= ~AR_AggrLen;
-        ads->ds_ctl6 |= SM(aggrLen, AR_AggrLen);
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_aggr_first);
-
-void ath9k_hw_set11n_aggr_middle(struct ath_hw *ah, struct ath_desc *ds,
-                                 u32 numDelims)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-        unsigned int ctl6;
-
-        ads->ds_ctl1 |= (AR_IsAggr | AR_MoreAggr);
-
-        ctl6 = ads->ds_ctl6;
-        ctl6 &= ~AR_PadDelim;
-        ctl6 |= SM(numDelims, AR_PadDelim);
-        ads->ds_ctl6 = ctl6;
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_aggr_middle);
-
-void ath9k_hw_set11n_aggr_last(struct ath_hw *ah, struct ath_desc *ds)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        ads->ds_ctl1 |= AR_IsAggr;
-        ads->ds_ctl1 &= ~AR_MoreAggr;
-        ads->ds_ctl6 &= ~AR_PadDelim;
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_aggr_last);
-
-void ath9k_hw_clr11n_aggr(struct ath_hw *ah, struct ath_desc *ds)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        ads->ds_ctl1 &= (~AR_IsAggr & ~AR_MoreAggr);
-}
-EXPORT_SYMBOL(ath9k_hw_clr11n_aggr);
-
-void ath9k_hw_set11n_burstduration(struct ath_hw *ah, struct ath_desc *ds,
-                                   u32 burstDuration)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        ads->ds_ctl2 &= ~AR_BurstDur;
-        ads->ds_ctl2 |= SM(burstDuration, AR_BurstDur);
-}
-EXPORT_SYMBOL(ath9k_hw_set11n_burstduration);
-
-void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, struct ath_desc *ds,
-                                     u32 vmf)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-
-        if (vmf)
-                ads->ds_ctl0 |= AR_VirtMoreFrag;
-        else
-                ads->ds_ctl0 &= ~AR_VirtMoreFrag;
-}
-
 void ath9k_hw_gettxintrtxqs(struct ath_hw *ah, u32 *txqs)
 {
         *txqs &= ah->intr_txqs;
@@ -733,6 +475,8 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         } else
                 cwMin = qi->tqi_cwmin;
 
+        ENABLE_REGWRITE_BUFFER(ah);
+
         REG_WRITE(ah, AR_DLCL_IFS(q),
                   SM(cwMin, AR_D_LCL_IFS_CWMIN) |
                   SM(qi->tqi_cwmax, AR_D_LCL_IFS_CWMAX) |
@@ -747,6 +491,8 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         REG_WRITE(ah, AR_DMISC(q),
                   AR_D_MISC_CW_BKOFF_EN | AR_D_MISC_FRAG_WAIT_EN | 0x2);
 
+        REGWRITE_BUFFER_FLUSH(ah);
+
         if (qi->tqi_cbrPeriod) {
                 REG_WRITE(ah, AR_QCBRCFG(q),
                           SM(qi->tqi_cbrPeriod, AR_Q_CBRCFG_INTERVAL) |
@@ -762,6 +508,8 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                           AR_Q_RDYTIMECFG_EN);
         }
 
+        REGWRITE_BUFFER_FLUSH(ah);
+
         REG_WRITE(ah, AR_DCHNTIME(q),
                   SM(qi->tqi_burstTime, AR_D_CHNTIME_DUR) |
                   (qi->tqi_burstTime ? AR_D_CHNTIME_EN : 0));
@@ -779,6 +527,10 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                           REG_READ(ah, AR_DMISC(q)) |
                           AR_D_MISC_POST_FR_BKOFF_DIS);
         }
+
+        REGWRITE_BUFFER_FLUSH(ah);
+        DISABLE_REGWRITE_BUFFER(ah);
+
         if (qi->tqi_qflags & TXQ_FLAG_FRAG_BURST_BACKOFF_ENABLE) {
                 REG_WRITE(ah, AR_DMISC(q),
                           REG_READ(ah, AR_DMISC(q)) |
@@ -786,6 +538,8 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
         }
         switch (qi->tqi_type) {
         case ATH9K_TX_QUEUE_BEACON:
+                ENABLE_REGWRITE_BUFFER(ah);
+
                 REG_WRITE(ah, AR_QMISC(q), REG_READ(ah, AR_QMISC(q))
                           | AR_Q_MISC_FSP_DBA_GATED
                           | AR_Q_MISC_BEACON_USE
@@ -796,8 +550,20 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                              AR_D_MISC_ARB_LOCKOUT_CNTRL_S)
                           | AR_D_MISC_BEACON_USE
                           | AR_D_MISC_POST_FR_BKOFF_DIS);
+
+                REGWRITE_BUFFER_FLUSH(ah);
+                DISABLE_REGWRITE_BUFFER(ah);
+
+                /* cwmin and cwmax should be 0 for beacon queue */
+                if (AR_SREV_9300_20_OR_LATER(ah)) {
+                        REG_WRITE(ah, AR_DLCL_IFS(q), SM(0, AR_D_LCL_IFS_CWMIN)
+                                  | SM(0, AR_D_LCL_IFS_CWMAX)
+                                  | SM(qi->tqi_aifs, AR_D_LCL_IFS_AIFS));
+                }
                 break;
         case ATH9K_TX_QUEUE_CAB:
+                ENABLE_REGWRITE_BUFFER(ah);
+
                 REG_WRITE(ah, AR_QMISC(q), REG_READ(ah, AR_QMISC(q))
                           | AR_Q_MISC_FSP_DBA_GATED
                           | AR_Q_MISC_CBR_INCR_DIS1
@@ -811,6 +577,10 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                 REG_WRITE(ah, AR_DMISC(q), REG_READ(ah, AR_DMISC(q))
                           | (AR_D_MISC_ARB_LOCKOUT_CNTRL_GLOBAL <<
                              AR_D_MISC_ARB_LOCKOUT_CNTRL_S));
+
+                REGWRITE_BUFFER_FLUSH(ah);
+                DISABLE_REGWRITE_BUFFER(ah);
+
                 break;
         case ATH9K_TX_QUEUE_PSPOLL:
                 REG_WRITE(ah, AR_QMISC(q),
@@ -832,6 +602,9 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                           AR_D_MISC_POST_FR_BKOFF_DIS);
         }
 
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                REG_WRITE(ah, AR_Q_DESC_CRCCHK, AR_Q_DESC_CRCCHK_EN);
+
         if (qi->tqi_qflags & TXQ_FLAG_TXOKINT_ENABLE)
                 ah->txok_interrupt_mask |= 1 << q;
         else
@@ -940,22 +713,6 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 }
 EXPORT_SYMBOL(ath9k_hw_rxprocdesc);
 
-void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
-                          u32 size, u32 flags)
-{
-        struct ar5416_desc *ads = AR5416DESC(ds);
-        struct ath9k_hw_capabilities *pCap = &ah->caps;
-
-        ads->ds_ctl1 = size & AR_BufLen;
-        if (flags & ATH9K_RXDESC_INTREQ)
-                ads->ds_ctl1 |= AR_RxIntrReq;
-
-        ads->ds_rxstatus8 &= ~AR_RxDone;
-        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
-                memset(&(ads->u), 0, sizeof(ads->u));
-}
-EXPORT_SYMBOL(ath9k_hw_setuprxdesc);
-
 /*
  * This can stop or re-enables RX.
  *
@@ -999,12 +756,6 @@ void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp)
 }
 EXPORT_SYMBOL(ath9k_hw_putrxbuf);
 
-void ath9k_hw_rxena(struct ath_hw *ah)
-{
-        REG_WRITE(ah, AR_CR, AR_CR_RXE);
-}
-EXPORT_SYMBOL(ath9k_hw_rxena);
-
 void ath9k_hw_startpcureceive(struct ath_hw *ah)
 {
         ath9k_enable_mib_counters(ah);
@@ -1023,6 +774,14 @@ void ath9k_hw_stoppcurecv(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_stoppcurecv);
 
+void ath9k_hw_abortpcurecv(struct ath_hw *ah)
+{
+        REG_SET_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_ABORT | AR_DIAG_RX_DIS);
+
+        ath9k_hw_disable_mib_counters(ah);
+}
+EXPORT_SYMBOL(ath9k_hw_abortpcurecv);
+
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah)
 {
 #define AH_RX_STOP_DMA_TIMEOUT 10000   /* usec */
@@ -1068,3 +827,142 @@ int ath9k_hw_beaconq_setup(struct ath_hw *ah)
         return ath9k_hw_setuptxqueue(ah, ATH9K_TX_QUEUE_BEACON, &qi);
 }
 EXPORT_SYMBOL(ath9k_hw_beaconq_setup);
+
+bool ath9k_hw_intrpend(struct ath_hw *ah)
+{
+        u32 host_isr;
+
+        if (AR_SREV_9100(ah))
+                return true;
+
+        host_isr = REG_READ(ah, AR_INTR_ASYNC_CAUSE);
+        if ((host_isr & AR_INTR_MAC_IRQ) && (host_isr != AR_INTR_SPURIOUS))
+                return true;
+
+        host_isr = REG_READ(ah, AR_INTR_SYNC_CAUSE);
+        if ((host_isr & AR_INTR_SYNC_DEFAULT)
+            && (host_isr != AR_INTR_SPURIOUS))
+                return true;
+
+        return false;
+}
+EXPORT_SYMBOL(ath9k_hw_intrpend);
+
+enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah,
+                                              enum ath9k_int ints)
+{
+        enum ath9k_int omask = ah->imask;
+        u32 mask, mask2;
+        struct ath9k_hw_capabilities *pCap = &ah->caps;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ath_print(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
+
+        if (omask & ATH9K_INT_GLOBAL) {
+                ath_print(common, ATH_DBG_INTERRUPT, "disable IER\n");
+                REG_WRITE(ah, AR_IER, AR_IER_DISABLE);
+                (void) REG_READ(ah, AR_IER);
+                if (!AR_SREV_9100(ah)) {
+                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE, 0);
+                        (void) REG_READ(ah, AR_INTR_ASYNC_ENABLE);
+
+                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE, 0);
+                        (void) REG_READ(ah, AR_INTR_SYNC_ENABLE);
+                }
+        }
+
+        /* TODO: global int Ref count */
+        mask = ints & ATH9K_INT_COMMON;
+        mask2 = 0;
+
+        if (ints & ATH9K_INT_TX) {
+                if (ah->config.tx_intr_mitigation)
+                        mask |= AR_IMR_TXMINTR | AR_IMR_TXINTM;
+                else {
+                        if (ah->txok_interrupt_mask)
+                                mask |= AR_IMR_TXOK;
+                        if (ah->txdesc_interrupt_mask)
+                                mask |= AR_IMR_TXDESC;
+                }
+                if (ah->txerr_interrupt_mask)
+                        mask |= AR_IMR_TXERR;
+                if (ah->txeol_interrupt_mask)
+                        mask |= AR_IMR_TXEOL;
+        }
+        if (ints & ATH9K_INT_RX) {
+                if (AR_SREV_9300_20_OR_LATER(ah)) {
+                        mask |= AR_IMR_RXERR | AR_IMR_RXOK_HP;
+                        if (ah->config.rx_intr_mitigation) {
+                                mask &= ~AR_IMR_RXOK_LP;
+                                mask |=  AR_IMR_RXMINTR | AR_IMR_RXINTM;
+                        } else {
+                                mask |= AR_IMR_RXOK_LP;
+                        }
+                } else {
+                        if (ah->config.rx_intr_mitigation)
+                                mask |= AR_IMR_RXMINTR | AR_IMR_RXINTM;
+                        else
+                                mask |= AR_IMR_RXOK | AR_IMR_RXDESC;
+                }
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
+                        mask |= AR_IMR_GENTMR;
+        }
+
+        if (ints & (ATH9K_INT_BMISC)) {
+                mask |= AR_IMR_BCNMISC;
+                if (ints & ATH9K_INT_TIM)
+                        mask2 |= AR_IMR_S2_TIM;
+                if (ints & ATH9K_INT_DTIM)
+                        mask2 |= AR_IMR_S2_DTIM;
+                if (ints & ATH9K_INT_DTIMSYNC)
+                        mask2 |= AR_IMR_S2_DTIMSYNC;
+                if (ints & ATH9K_INT_CABEND)
+                        mask2 |= AR_IMR_S2_CABEND;
+                if (ints & ATH9K_INT_TSFOOR)
+                        mask2 |= AR_IMR_S2_TSFOOR;
+        }
+
+        if (ints & (ATH9K_INT_GTT | ATH9K_INT_CST)) {
+                mask |= AR_IMR_BCNMISC;
+                if (ints & ATH9K_INT_GTT)
+                        mask2 |= AR_IMR_S2_GTT;
+                if (ints & ATH9K_INT_CST)
+                        mask2 |= AR_IMR_S2_CST;
+        }
+
+        ath_print(common, ATH_DBG_INTERRUPT, "new IMR 0x%x\n", mask);
+        REG_WRITE(ah, AR_IMR, mask);
+        ah->imrs2_reg &= ~(AR_IMR_S2_TIM | AR_IMR_S2_DTIM | AR_IMR_S2_DTIMSYNC |
+                           AR_IMR_S2_CABEND | AR_IMR_S2_CABTO |
+                           AR_IMR_S2_TSFOOR | AR_IMR_S2_GTT | AR_IMR_S2_CST);
+        ah->imrs2_reg |= mask2;
+        REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
+
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                if (ints & ATH9K_INT_TIM_TIMER)
+                        REG_SET_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
+                else
+                        REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
+        }
+
+        if (ints & ATH9K_INT_GLOBAL) {
+                ath_print(common, ATH_DBG_INTERRUPT, "enable IER\n");
+                REG_WRITE(ah, AR_IER, AR_IER_ENABLE);
+                if (!AR_SREV_9100(ah)) {
+                        REG_WRITE(ah, AR_INTR_ASYNC_ENABLE,
+                                  AR_INTR_MAC_IRQ);
+                        REG_WRITE(ah, AR_INTR_ASYNC_MASK, AR_INTR_MAC_IRQ);
+
+
+                        REG_WRITE(ah, AR_INTR_SYNC_ENABLE,
+                                  AR_INTR_SYNC_DEFAULT);
+                        REG_WRITE(ah, AR_INTR_SYNC_MASK,
+                                  AR_INTR_SYNC_DEFAULT);
+                }
+                ath_print(common, ATH_DBG_INTERRUPT, "AR_IMR 0x%x IER 0x%x\n",
+                          REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER));
+        }
+
+        return omask;
+}
+EXPORT_SYMBOL(ath9k_hw_set_interrupts);
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 68dbd7a8ddca..00f3e0c7528a 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -37,6 +37,8 @@
           AR_2040_##_index : 0)                                         \
          |((_series)[_index].RateFlags & ATH9K_RATESERIES_HALFGI ?      \
            AR_GI##_index : 0)                                           \
+         |((_series)[_index].RateFlags & ATH9K_RATESERIES_STBC ?        \
+           AR_STBC##_index : 0)                                         \
          |SM((_series)[_index].ChSel, AR_ChainSel##_index))
 
 #define CCK_SIFS_TIME        10
@@ -86,7 +88,6 @@
 #define ATH9K_TX_DESC_CFG_ERR      0x04
 #define ATH9K_TX_DATA_UNDERRUN     0x08
 #define ATH9K_TX_DELIM_UNDERRUN    0x10
-#define ATH9K_TX_SW_ABORTED        0x40
 #define ATH9K_TX_SW_FILTERED       0x80
 
 /* 64 bytes */
@@ -117,7 +118,10 @@ struct ath_tx_status {
         int8_t ts_rssi_ext0;
         int8_t ts_rssi_ext1;
         int8_t ts_rssi_ext2;
-        u8 pad[3];
+        u8 qid;
+        u16 desc_id;
+        u8 tid;
+        u8 pad[2];
         u32 ba_low;
         u32 ba_high;
         u32 evm0;
@@ -148,11 +152,13 @@ struct ath_rx_status {
         u32 evm0;
         u32 evm1;
         u32 evm2;
+        u32 evm3;
+        u32 evm4;
 };
 
 struct ath_htc_rx_status {
-        u64 rs_tstamp;
-        u16 rs_datalen;
+        __be64 rs_tstamp;
+        __be16 rs_datalen;
         u8 rs_status;
         u8 rs_phyerr;
         int8_t rs_rssi;
@@ -171,9 +177,9 @@ struct ath_htc_rx_status {
         u8 rs_num_delims;
         u8 rs_flags;
         u8 rs_dummy;
-        u32 evm0;
-        u32 evm1;
-        u32 evm2;
+        __be32 evm0;
+        __be32 evm1;
+        __be32 evm2;
 };
 
 #define ATH9K_RXERR_CRC           0x01
@@ -259,7 +265,8 @@ struct ath_desc {
 #define ATH9K_TXDESC_EXT_AND_CTL        0x0080
 #define ATH9K_TXDESC_VMF                0x0100
 #define ATH9K_TXDESC_FRAG_IS_ON         0x0200
-#define ATH9K_TXDESC_CAB                0x0400
+#define ATH9K_TXDESC_LOWRXCHAIN         0x0400
+#define ATH9K_TXDESC_LDPC               0x00010000
 
 #define ATH9K_RXDESC_INTREQ             0x0020
 
@@ -353,7 +360,6 @@ struct ar5416_desc {
 #define AR_DestIdxValid     0x40000000
 #define AR_CTSEnable        0x80000000
 
-#define AR_BufLen           0x00000fff
 #define AR_TxMore           0x00001000
 #define AR_DestIdx          0x000fe000
 #define AR_DestIdx_S        13
@@ -410,6 +416,7 @@ struct ar5416_desc {
 #define AR_EncrType         0x0c000000
 #define AR_EncrType_S       26
 #define AR_TxCtlRsvd61      0xf0000000
+#define AR_LDPC             0x80000000
 
 #define AR_2040_0           0x00000001
 #define AR_GI0              0x00000002
@@ -429,7 +436,10 @@ struct ar5416_desc {
 #define AR_ChainSel3_S      17
 #define AR_RTSCTSRate       0x0ff00000
 #define AR_RTSCTSRate_S     20
-#define AR_TxCtlRsvd70      0xf0000000
+#define AR_STBC0            0x10000000
+#define AR_STBC1            0x20000000
+#define AR_STBC2            0x40000000
+#define AR_STBC3            0x80000000
 
 #define AR_TxRSSIAnt00      0x000000ff
 #define AR_TxRSSIAnt00_S    0
@@ -493,7 +503,6 @@ struct ar5416_desc {
 
 #define AR_RxCTLRsvd00  0xffffffff
 
-#define AR_BufLen       0x00000fff
 #define AR_RxCtlRsvd00  0x00001000
 #define AR_RxIntrReq    0x00002000
 #define AR_RxCtlRsvd01  0xffffc000
@@ -643,6 +652,7 @@ enum ath9k_rx_filter {
 #define ATH9K_RATESERIES_RTS_CTS  0x0001
 #define ATH9K_RATESERIES_2040     0x0002
 #define ATH9K_RATESERIES_HALFGI   0x0004
+#define ATH9K_RATESERIES_STBC     0x0008
 
 struct ath9k_11n_rate_series {
         u32 Tries;
@@ -686,34 +696,10 @@ struct ath9k_channel;
 u32 ath9k_hw_gettxbuf(struct ath_hw *ah, u32 q);
 void ath9k_hw_puttxbuf(struct ath_hw *ah, u32 q, u32 txdp);
 void ath9k_hw_txstart(struct ath_hw *ah, u32 q);
+void ath9k_hw_cleartxdesc(struct ath_hw *ah, void *ds);
 u32 ath9k_hw_numtxpending(struct ath_hw *ah, u32 q);
 bool ath9k_hw_updatetxtriglevel(struct ath_hw *ah, bool bIncTrigLevel);
 bool ath9k_hw_stoptxdma(struct ath_hw *ah, u32 q);
-void ath9k_hw_filltxdesc(struct ath_hw *ah, struct ath_desc *ds,
-                         u32 segLen, bool firstSeg,
-                         bool lastSeg, const struct ath_desc *ds0);
-void ath9k_hw_cleartxdesc(struct ath_hw *ah, struct ath_desc *ds);
-int ath9k_hw_txprocdesc(struct ath_hw *ah, struct ath_desc *ds,
-                        struct ath_tx_status *ts);
-void ath9k_hw_set11n_txdesc(struct ath_hw *ah, struct ath_desc *ds,
-                            u32 pktLen, enum ath9k_pkt_type type, u32 txPower,
-                            u32 keyIx, enum ath9k_key_type keyType, u32 flags);
-void ath9k_hw_set11n_ratescenario(struct ath_hw *ah, struct ath_desc *ds,
-                                  struct ath_desc *lastds,
-                                  u32 durUpdateEn, u32 rtsctsRate,
-                                  u32 rtsctsDuration,
-                                  struct ath9k_11n_rate_series series[],
-                                  u32 nseries, u32 flags);
-void ath9k_hw_set11n_aggr_first(struct ath_hw *ah, struct ath_desc *ds,
-                                u32 aggrLen);
-void ath9k_hw_set11n_aggr_middle(struct ath_hw *ah, struct ath_desc *ds,
-                                 u32 numDelims);
-void ath9k_hw_set11n_aggr_last(struct ath_hw *ah, struct ath_desc *ds);
-void ath9k_hw_clr11n_aggr(struct ath_hw *ah, struct ath_desc *ds);
-void ath9k_hw_set11n_burstduration(struct ath_hw *ah, struct ath_desc *ds,
-                                   u32 burstDuration);
-void ath9k_hw_set11n_virtualmorefrag(struct ath_hw *ah, struct ath_desc *ds,
-                                     u32 vmf);
 void ath9k_hw_gettxintrtxqs(struct ath_hw *ah, u32 *txqs);
 bool ath9k_hw_set_txq_props(struct ath_hw *ah, int q,
                             const struct ath9k_tx_queue_info *qinfo);
@@ -729,10 +715,17 @@ void ath9k_hw_setuprxdesc(struct ath_hw *ah, struct ath_desc *ds,
                           u32 size, u32 flags);
 bool ath9k_hw_setrxabort(struct ath_hw *ah, bool set);
 void ath9k_hw_putrxbuf(struct ath_hw *ah, u32 rxdp);
-void ath9k_hw_rxena(struct ath_hw *ah);
 void ath9k_hw_startpcureceive(struct ath_hw *ah);
 void ath9k_hw_stoppcurecv(struct ath_hw *ah);
+void ath9k_hw_abortpcurecv(struct ath_hw *ah);
 bool ath9k_hw_stopdmarecv(struct ath_hw *ah);
 int ath9k_hw_beaconq_setup(struct ath_hw *ah);
 
+/* Interrupt Handling */
+bool ath9k_hw_intrpend(struct ath_hw *ah);
+enum ath9k_int ath9k_hw_set_interrupts(struct ath_hw *ah,
+                                       enum ath9k_int ints);
+
+void ar9002_hw_attach_mac_ops(struct ath_hw *ah);
+
 #endif /* MAC_H */
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index f7ef11407e27..893b552981a0 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -401,23 +401,41 @@ void ath9k_tasklet(unsigned long data)
         struct ath_common *common = ath9k_hw_common(ah);
 
         u32 status = sc->intrstatus;
+        u32 rxmask;
 
         ath9k_ps_wakeup(sc);
 
-        if (status & ATH9K_INT_FATAL) {
+        if ((status & ATH9K_INT_FATAL) ||
+            !ath9k_hw_check_alive(ah)) {
                 ath_reset(sc, false);
                 ath9k_ps_restore(sc);
                 return;
         }
 
-        if (status & (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN)) {
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                rxmask = (ATH9K_INT_RXHP | ATH9K_INT_RXLP | ATH9K_INT_RXEOL |
+                          ATH9K_INT_RXORN);
+        else
+                rxmask = (ATH9K_INT_RX | ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
+
+        if (status & rxmask) {
                 spin_lock_bh(&sc->rx.rxflushlock);
-                ath_rx_tasklet(sc, 0);
+
+                /* Check for high priority Rx first */
+                if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
+                    (status & ATH9K_INT_RXHP))
+                        ath_rx_tasklet(sc, 0, true);
+
+                ath_rx_tasklet(sc, 0, false);
                 spin_unlock_bh(&sc->rx.rxflushlock);
         }
 
-        if (status & ATH9K_INT_TX)
-                ath_tx_tasklet(sc);
+        if (status & ATH9K_INT_TX) {
+                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                        ath_tx_edma_tasklet(sc);
+                else
+                        ath_tx_tasklet(sc);
+        }
 
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
@@ -445,6 +463,8 @@ irqreturn_t ath_isr(int irq, void *dev)
                 ATH9K_INT_RXORN |               \
                 ATH9K_INT_RXEOL |               \
                 ATH9K_INT_RX |                  \
+                ATH9K_INT_RXLP |                \
+                ATH9K_INT_RXHP |                \
                 ATH9K_INT_TX |                  \
                 ATH9K_INT_BMISS |               \
                 ATH9K_INT_CST |                 \
@@ -496,7 +516,8 @@ irqreturn_t ath_isr(int irq, void *dev)
          * If a FATAL or RXORN interrupt is received, we have to reset the
          * chip immediately.
          */
-        if (status & (ATH9K_INT_FATAL | ATH9K_INT_RXORN))
+        if ((status & ATH9K_INT_FATAL) || ((status & ATH9K_INT_RXORN) &&
+            !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
                 goto chip_reset;
 
         if (status & ATH9K_INT_SWBA)
@@ -505,6 +526,13 @@ irqreturn_t ath_isr(int irq, void *dev)
         if (status & ATH9K_INT_TXURN)
                 ath9k_hw_updatetxtriglevel(ah, true);
 
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                if (status & ATH9K_INT_RXEOL) {
+                        ah->imask &= ~(ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
+                        ath9k_hw_set_interrupts(ah, ah->imask);
+                }
+        }
+
         if (status & ATH9K_INT_MIB) {
                 /*
                  * Disable interrupts until we service the MIB
@@ -724,6 +752,7 @@ static int ath_key_config(struct ath_common *common,
         struct ath_hw *ah = common->ah;
         struct ath9k_keyval hk;
         const u8 *mac = NULL;
+        u8 gmac[ETH_ALEN];
         int ret = 0;
         int idx;
 
@@ -747,9 +776,30 @@ static int ath_key_config(struct ath_common *common,
         memcpy(hk.kv_val, key->key, key->keylen);
 
         if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
-                /* For now, use the default keys for broadcast keys. This may
-                 * need to change with virtual interfaces. */
-                idx = key->keyidx;
+
+                if (key->ap_addr) {
+                        /*
+                         * Group keys on hardware that supports multicast frame
+                         * key search use a mac that is the sender's address with
+                         * the high bit set instead of the app-specified address.
+                         */
+                        memcpy(gmac, key->ap_addr, ETH_ALEN);
+                        gmac[0] |= 0x80;
+                        mac = gmac;
+
+                        if (key->alg == ALG_TKIP)
+                                idx = ath_reserve_key_cache_slot_tkip(common);
+                        else
+                                idx = ath_reserve_key_cache_slot(common);
+                        if (idx < 0)
+                                mac = NULL; /* no free key cache entries */
+                }
+
+                if (!mac) {
+                        /* For now, use the default keys for broadcast keys. This may
+                         * need to change with virtual interfaces. */
+                        idx = key->keyidx;
+                }
         } else if (key->keyidx) {
                 if (WARN_ON(!sta))
                         return -EOPNOTSUPP;
@@ -1162,9 +1212,14 @@ static int ath9k_start(struct ieee80211_hw *hw)
         }
 
         /* Setup our intr mask. */
-        ah->imask = ATH9K_INT_RX | ATH9K_INT_TX
-                | ATH9K_INT_RXEOL | ATH9K_INT_RXORN
-                | ATH9K_INT_FATAL | ATH9K_INT_GLOBAL;
+        ah->imask = ATH9K_INT_TX | ATH9K_INT_RXEOL |
+                    ATH9K_INT_RXORN | ATH9K_INT_FATAL |
+                    ATH9K_INT_GLOBAL;
+
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ah->imask |= ATH9K_INT_RXHP | ATH9K_INT_RXLP;
+        else
+                ah->imask |= ATH9K_INT_RX;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_GTT)
                 ah->imask |= ATH9K_INT_GTT;
@@ -1436,7 +1491,8 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
         if ((vif->type == NL80211_IFTYPE_STATION) ||
             (vif->type == NL80211_IFTYPE_ADHOC) ||
             (vif->type == NL80211_IFTYPE_MESH_POINT)) {
-                ah->imask |= ATH9K_INT_MIB;
+                if (ah->config.enable_ani)
+                        ah->imask |= ATH9K_INT_MIB;
                 ah->imask |= ATH9K_INT_TSFOOR;
         }
 
@@ -1988,6 +2044,25 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         return ret;
 }
 
+static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
+                             struct survey_info *survey)
+{
+        struct ath_wiphy *aphy = hw->priv;
+        struct ath_softc *sc = aphy->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ieee80211_conf *conf = &hw->conf;
+
+         if (idx != 0)
+                return -ENOENT;
+
+        survey->channel = conf->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = common->ani.noise_floor;
+
+        return 0;
+}
+
 static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_wiphy *aphy = hw->priv;
@@ -2059,6 +2134,7 @@ struct ieee80211_ops ath9k_ops = {
         .set_tsf            = ath9k_set_tsf,
         .reset_tsf          = ath9k_reset_tsf,
         .ampdu_action       = ath9k_ampdu_action,
+        .get_survey         = ath9k_get_survey,
         .sw_scan_start      = ath9k_sw_scan_start,
         .sw_scan_complete   = ath9k_sw_scan_complete,
         .rfkill_poll        = ath9k_rfkill_poll_state,
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 1ec836cf1c0d..257b10ba6f57 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -28,6 +28,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+        { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
         { 0 }
 };
 
diff --git a/drivers/net/wireless/ath/ath9k/phy.c b/drivers/net/wireless/ath/ath9k/phy.c
deleted file mode 100644
index 2547b3c4a26c..000000000000
--- a/drivers/net/wireless/ath/ath9k/phy.c
+++ /dev/null
@@ -1,978 +0,0 @@
-/*
- * Copyright (c) 2008-2009 Atheros Communications Inc.
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/**
- * DOC: Programming Atheros 802.11n analog front end radios
- *
- * AR5416 MAC based PCI devices and AR518 MAC based PCI-Express
- * devices have either an external AR2133 analog front end radio for single
- * band 2.4 GHz communication or an AR5133 analog front end radio for dual
- * band 2.4 GHz / 5 GHz communication.
- *
- * All devices after the AR5416 and AR5418 family starting with the AR9280
- * have their analog front radios, MAC/BB and host PCIe/USB interface embedded
- * into a single-chip and require less programming.
- *
- * The following single-chips exist with a respective embedded radio:
- *
- * AR9280 - 11n dual-band 2x2 MIMO for PCIe
- * AR9281 - 11n single-band 1x2 MIMO for PCIe
- * AR9285 - 11n single-band 1x1 for PCIe
- * AR9287 - 11n single-band 2x2 MIMO for PCIe
- *
- * AR9220 - 11n dual-band 2x2 MIMO for PCI
- * AR9223 - 11n single-band 2x2 MIMO for PCI
- *
- * AR9287 - 11n single-band 1x1 MIMO for USB
- */
-
-#include <linux/slab.h>
-
-#include "hw.h"
-
-/**
- * ath9k_hw_write_regs - ??
- *
- * @ah: atheros hardware structure
- * @freqIndex:
- * @regWrites:
- *
- * Used for both the chipsets with an external AR2133/AR5133 radios and
- * single-chip devices.
- */
-void ath9k_hw_write_regs(struct ath_hw *ah, u32 freqIndex, int regWrites)
-{
-        REG_WRITE_ARRAY(&ah->iniBB_RfGain, freqIndex, regWrites);
-}
-
-/**
- * ath9k_hw_ar9280_set_channel - set channel on single-chip device
- * @ah: atheros hardware structure
- * @chan:
- *
- * This is the function to change channel on single-chip devices, that is
- * all devices after ar9280.
- *
- * This function takes the channel value in MHz and sets
- * hardware channel value. Assumes writes have been enabled to analog bus.
- *
- * Actual Expression,
- *
- * For 2GHz channel,
- * Channel Frequency = (3/4) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^17)
- * (freq_ref = 40MHz)
- *
- * For 5GHz channel,
- * Channel Frequency = (3/2) * freq_ref * (chansel[8:0] + chanfrac[16:0]/2^10)
- * (freq_ref = 40MHz/(24>>amodeRefSel))
- */
-int ath9k_hw_ar9280_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        u16 bMode, fracMode, aModeRefSel = 0;
-        u32 freq, ndiv, channelSel = 0, channelFrac = 0, reg32 = 0;
-        struct chan_centers centers;
-        u32 refDivA = 24;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        freq = centers.synth_center;
-
-        reg32 = REG_READ(ah, AR_PHY_SYNTH_CONTROL);
-        reg32 &= 0xc0000000;
-
-        if (freq < 4800) { /* 2 GHz, fractional mode */
-                u32 txctl;
-                int regWrites = 0;
-
-                bMode = 1;
-                fracMode = 1;
-                aModeRefSel = 0;
-                channelSel = (freq * 0x10000) / 15;
-
-                if (AR_SREV_9287_11_OR_LATER(ah)) {
-                        if (freq == 2484) {
-                                /* Enable channel spreading for channel 14 */
-                                REG_WRITE_ARRAY(&ah->iniCckfirJapan2484,
-                                                1, regWrites);
-                        } else {
-                                REG_WRITE_ARRAY(&ah->iniCckfirNormal,
-                                                1, regWrites);
-                        }
-                } else {
-                        txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
-                        if (freq == 2484) {
-                                /* Enable channel spreading for channel 14 */
-                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                          txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
-                        } else {
-                                REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                          txctl &~ AR_PHY_CCK_TX_CTRL_JAPAN);
-                        }
-                }
-        } else {
-                bMode = 0;
-                fracMode = 0;
-
-                switch(ah->eep_ops->get_eeprom(ah, EEP_FRAC_N_5G)) {
-                case 0:
-                        if ((freq % 20) == 0) {
-                                aModeRefSel = 3;
-                        } else if ((freq % 10) == 0) {
-                                aModeRefSel = 2;
-                        }
-                        if (aModeRefSel)
-                                break;
-                case 1:
-                default:
-                        aModeRefSel = 0;
-                        /*
-                         * Enable 2G (fractional) mode for channels
-                         * which are 5MHz spaced.
-                         */
-                        fracMode = 1;
-                        refDivA = 1;
-                        channelSel = (freq * 0x8000) / 15;
-
-                        /* RefDivA setting */
-                        REG_RMW_FIELD(ah, AR_AN_SYNTH9,
-                                      AR_AN_SYNTH9_REFDIVA, refDivA);
-
-                }
-
-                if (!fracMode) {
-                        ndiv = (freq * (refDivA >> aModeRefSel)) / 60;
-                        channelSel = ndiv & 0x1ff;
-                        channelFrac = (ndiv & 0xfffffe00) * 2;
-                        channelSel = (channelSel << 17) | channelFrac;
-                }
-        }
-
-        reg32 = reg32 |
-            (bMode << 29) |
-            (fracMode << 28) | (aModeRefSel << 26) | (channelSel);
-
-        REG_WRITE(ah, AR_PHY_SYNTH_CONTROL, reg32);
-
-        ah->curchan = chan;
-        ah->curchan_rad_index = -1;
-
-        return 0;
-}
-
-/**
- * ath9k_hw_9280_spur_mitigate - convert baseband spur frequency
- * @ah: atheros hardware structure
- * @chan:
- *
- * For single-chip solutions. Converts to baseband spur frequency given the
- * input channel frequency and compute register settings below.
- */
-void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int bb_spur = AR_NO_SPUR;
-        int freq;
-        int bin, cur_bin;
-        int bb_spur_off, spur_subchannel_sd;
-        int spur_freq_sd;
-        int spur_delta_phase;
-        int denominator;
-        int upper, lower, cur_vit_mask;
-        int tmp, newVal;
-        int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
-        };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
-        };
-        int inc[4] = { 0, 100, 0, 0 };
-        struct chan_centers centers;
-
-        int8_t mask_m[123];
-        int8_t mask_p[123];
-        int8_t mask_amt;
-        int tmp_mask;
-        int cur_bb_spur;
-        bool is2GHz = IS_CHAN_2GHZ(chan);
-
-        memset(&mask_m, 0, sizeof(int8_t) * 123);
-        memset(&mask_p, 0, sizeof(int8_t) * 123);
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        freq = centers.synth_center;
-
-        ah->config.spurmode = SPUR_ENABLE_EEPROM;
-        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
-                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
-
-                if (is2GHz)
-                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_2GHZ;
-                else
-                        cur_bb_spur = (cur_bb_spur / 10) + AR_BASE_FREQ_5GHZ;
-
-                if (AR_NO_SPUR == cur_bb_spur)
-                        break;
-                cur_bb_spur = cur_bb_spur - freq;
-
-                if (IS_CHAN_HT40(chan)) {
-                        if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT40) &&
-                            (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT40)) {
-                                bb_spur = cur_bb_spur;
-                                break;
-                        }
-                } else if ((cur_bb_spur > -AR_SPUR_FEEQ_BOUND_HT20) &&
-                           (cur_bb_spur < AR_SPUR_FEEQ_BOUND_HT20)) {
-                        bb_spur = cur_bb_spur;
-                        break;
-                }
-        }
-
-        if (AR_NO_SPUR == bb_spur) {
-                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
-                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
-                return;
-        } else {
-                REG_CLR_BIT(ah, AR_PHY_FORCE_CLKEN_CCK,
-                            AR_PHY_FORCE_CLKEN_CCK_MRC_MUX);
-        }
-
-        bin = bb_spur * 320;
-
-        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
-
-        newVal = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
-                        AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
-                        AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
-                        AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
-        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), newVal);
-
-        newVal = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
-                  AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
-                  AR_PHY_SPUR_REG_MASK_RATE_SELECT |
-                  AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
-                  SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
-        REG_WRITE(ah, AR_PHY_SPUR_REG, newVal);
-
-        if (IS_CHAN_HT40(chan)) {
-                if (bb_spur < 0) {
-                        spur_subchannel_sd = 1;
-                        bb_spur_off = bb_spur + 10;
-                } else {
-                        spur_subchannel_sd = 0;
-                        bb_spur_off = bb_spur - 10;
-                }
-        } else {
-                spur_subchannel_sd = 0;
-                bb_spur_off = bb_spur;
-        }
-
-        if (IS_CHAN_HT40(chan))
-                spur_delta_phase =
-                        ((bb_spur * 262144) /
-                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-        else
-                spur_delta_phase =
-                        ((bb_spur * 524288) /
-                         10) & AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-
-        denominator = IS_CHAN_2GHZ(chan) ? 44 : 40;
-        spur_freq_sd = ((bb_spur_off * 2048) / denominator) & 0x3ff;
-
-        newVal = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
-                  SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
-                  SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
-        REG_WRITE(ah, AR_PHY_TIMING11, newVal);
-
-        newVal = spur_subchannel_sd << AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S;
-        REG_WRITE(ah, AR_PHY_SFCORR_EXT, newVal);
-
-        cur_bin = -6000;
-        upper = bin + 100;
-        lower = bin - 100;
-
-        for (i = 0; i < 4; i++) {
-                int pilot_mask = 0;
-                int chan_mask = 0;
-                int bp = 0;
-                for (bp = 0; bp < 30; bp++) {
-                        if ((cur_bin > lower) && (cur_bin < upper)) {
-                                pilot_mask = pilot_mask | 0x1 << bp;
-                                chan_mask = chan_mask | 0x1 << bp;
-                        }
-                        cur_bin += 100;
-                }
-                cur_bin += inc[i];
-                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
-                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
-        }
-
-        cur_vit_mask = 6100;
-        upper = bin + 120;
-        lower = bin - 120;
-
-        for (i = 0; i < 123; i++) {
-                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
-
-                        /* workaround for gcc bug #37014 */
-                        volatile int tmp_v = abs(cur_vit_mask - bin);
-
-                        if (tmp_v < 75)
-                                mask_amt = 1;
-                        else
-                                mask_amt = 0;
-                        if (cur_vit_mask < 0)
-                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
-                        else
-                                mask_p[cur_vit_mask / 100] = mask_amt;
-                }
-                cur_vit_mask -= 100;
-        }
-
-        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
-                | (mask_m[48] << 26) | (mask_m[49] << 24)
-                | (mask_m[50] << 22) | (mask_m[51] << 20)
-                | (mask_m[52] << 18) | (mask_m[53] << 16)
-                | (mask_m[54] << 14) | (mask_m[55] << 12)
-                | (mask_m[56] << 10) | (mask_m[57] << 8)
-                | (mask_m[58] << 6) | (mask_m[59] << 4)
-                | (mask_m[60] << 2) | (mask_m[61] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
-
-        tmp_mask = (mask_m[31] << 28)
-                | (mask_m[32] << 26) | (mask_m[33] << 24)
-                | (mask_m[34] << 22) | (mask_m[35] << 20)
-                | (mask_m[36] << 18) | (mask_m[37] << 16)
-                | (mask_m[48] << 14) | (mask_m[39] << 12)
-                | (mask_m[40] << 10) | (mask_m[41] << 8)
-                | (mask_m[42] << 6) | (mask_m[43] << 4)
-                | (mask_m[44] << 2) | (mask_m[45] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
-
-        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
-                | (mask_m[18] << 26) | (mask_m[18] << 24)
-                | (mask_m[20] << 22) | (mask_m[20] << 20)
-                | (mask_m[22] << 18) | (mask_m[22] << 16)
-                | (mask_m[24] << 14) | (mask_m[24] << 12)
-                | (mask_m[25] << 10) | (mask_m[26] << 8)
-                | (mask_m[27] << 6) | (mask_m[28] << 4)
-                | (mask_m[29] << 2) | (mask_m[30] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
-
-        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
-                | (mask_m[2] << 26) | (mask_m[3] << 24)
-                | (mask_m[4] << 22) | (mask_m[5] << 20)
-                | (mask_m[6] << 18) | (mask_m[7] << 16)
-                | (mask_m[8] << 14) | (mask_m[9] << 12)
-                | (mask_m[10] << 10) | (mask_m[11] << 8)
-                | (mask_m[12] << 6) | (mask_m[13] << 4)
-                | (mask_m[14] << 2) | (mask_m[15] << 0);
-        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
-
-        tmp_mask = (mask_p[15] << 28)
-                | (mask_p[14] << 26) | (mask_p[13] << 24)
-                | (mask_p[12] << 22) | (mask_p[11] << 20)
-                | (mask_p[10] << 18) | (mask_p[9] << 16)
-                | (mask_p[8] << 14) | (mask_p[7] << 12)
-                | (mask_p[6] << 10) | (mask_p[5] << 8)
-                | (mask_p[4] << 6) | (mask_p[3] << 4)
-                | (mask_p[2] << 2) | (mask_p[1] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
-
-        tmp_mask = (mask_p[30] << 28)
-                | (mask_p[29] << 26) | (mask_p[28] << 24)
-                | (mask_p[27] << 22) | (mask_p[26] << 20)
-                | (mask_p[25] << 18) | (mask_p[24] << 16)
-                | (mask_p[23] << 14) | (mask_p[22] << 12)
-                | (mask_p[21] << 10) | (mask_p[20] << 8)
-                | (mask_p[19] << 6) | (mask_p[18] << 4)
-                | (mask_p[17] << 2) | (mask_p[16] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
-
-        tmp_mask = (mask_p[45] << 28)
-                | (mask_p[44] << 26) | (mask_p[43] << 24)
-                | (mask_p[42] << 22) | (mask_p[41] << 20)
-                | (mask_p[40] << 18) | (mask_p[39] << 16)
-                | (mask_p[38] << 14) | (mask_p[37] << 12)
-                | (mask_p[36] << 10) | (mask_p[35] << 8)
-                | (mask_p[34] << 6) | (mask_p[33] << 4)
-                | (mask_p[32] << 2) | (mask_p[31] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
-
-        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
-                | (mask_p[59] << 26) | (mask_p[58] << 24)
-                | (mask_p[57] << 22) | (mask_p[56] << 20)
-                | (mask_p[55] << 18) | (mask_p[54] << 16)
-                | (mask_p[53] << 14) | (mask_p[52] << 12)
-                | (mask_p[51] << 10) | (mask_p[50] << 8)
-                | (mask_p[49] << 6) | (mask_p[48] << 4)
-                | (mask_p[47] << 2) | (mask_p[46] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
-}
-
-/* All code below is for non single-chip solutions */
-
-/**
- * ath9k_phy_modify_rx_buffer() - perform analog swizzling of parameters
- * @rfbuf:
- * @reg32:
- * @numBits:
- * @firstBit:
- * @column:
- *
- * Performs analog "swizzling" of parameters into their location.
- * Used on external AR2133/AR5133 radios.
- */
-static void ath9k_phy_modify_rx_buffer(u32 *rfBuf, u32 reg32,
-                                       u32 numBits, u32 firstBit,
-                                       u32 column)
-{
-        u32 tmp32, mask, arrayEntry, lastBit;
-        int32_t bitPosition, bitsLeft;
-
-        tmp32 = ath9k_hw_reverse_bits(reg32, numBits);
-        arrayEntry = (firstBit - 1) / 8;
-        bitPosition = (firstBit - 1) % 8;
-        bitsLeft = numBits;
-        while (bitsLeft > 0) {
-                lastBit = (bitPosition + bitsLeft > 8) ?
-                    8 : bitPosition + bitsLeft;
-                mask = (((1 << lastBit) - 1) ^ ((1 << bitPosition) - 1)) <<
-                    (column * 8);
-                rfBuf[arrayEntry] &= ~mask;
-                rfBuf[arrayEntry] |= ((tmp32 << bitPosition) <<
-                                      (column * 8)) & mask;
-                bitsLeft -= 8 - bitPosition;
-                tmp32 = tmp32 >> (8 - bitPosition);
-                bitPosition = 0;
-                arrayEntry++;
-        }
-}
-
-/*
- * Fix on 2.4 GHz band for orientation sensitivity issue by increasing
- * rf_pwd_icsyndiv.
- *
- * Theoretical Rules:
- *   if 2 GHz band
- *      if forceBiasAuto
- *         if synth_freq < 2412
- *            bias = 0
- *         else if 2412 <= synth_freq <= 2422
- *            bias = 1
- *         else // synth_freq > 2422
- *            bias = 2
- *      else if forceBias > 0
- *         bias = forceBias & 7
- *      else
- *         no change, use value from ini file
- *   else
- *      no change, invalid band
- *
- *  1st Mod:
- *    2422 also uses value of 2
- *    <approved>
- *
- *  2nd Mod:
- *    Less than 2412 uses value of 0, 2412 and above uses value of 2
- */
-static void ath9k_hw_force_bias(struct ath_hw *ah, u16 synth_freq)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 tmp_reg;
-        int reg_writes = 0;
-        u32 new_bias = 0;
-
-        if (!AR_SREV_5416(ah) || synth_freq >= 3000) {
-                return;
-        }
-
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
-
-        if (synth_freq < 2412)
-                new_bias = 0;
-        else if (synth_freq < 2422)
-                new_bias = 1;
-        else
-                new_bias = 2;
-
-        /* pre-reverse this field */
-        tmp_reg = ath9k_hw_reverse_bits(new_bias, 3);
-
-        ath_print(common, ATH_DBG_CONFIG,
-                  "Force rf_pwd_icsyndiv to %1d on %4d\n",
-                  new_bias, synth_freq);
-
-        /* swizzle rf_pwd_icsyndiv */
-        ath9k_phy_modify_rx_buffer(ah->analogBank6Data, tmp_reg, 3, 181, 3);
-
-        /* write Bank 6 with new params */
-        REG_WRITE_RF_ARRAY(&ah->iniBank6, ah->analogBank6Data, reg_writes);
-}
-
-/**
- * ath9k_hw_set_channel - tune to a channel on the external AR2133/AR5133 radios
- * @ah: atheros hardware stucture
- * @chan:
- *
- * For the external AR2133/AR5133 radios, takes the MHz channel value and set
- * the channel value. Assumes writes enabled to analog bus and bank6 register
- * cache in ah->analogBank6Data.
- */
-int ath9k_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 channelSel = 0;
-        u32 bModeSynth = 0;
-        u32 aModeRefSel = 0;
-        u32 reg32 = 0;
-        u16 freq;
-        struct chan_centers centers;
-
-        ath9k_hw_get_channel_centers(ah, chan, &centers);
-        freq = centers.synth_center;
-
-        if (freq < 4800) {
-                u32 txctl;
-
-                if (((freq - 2192) % 5) == 0) {
-                        channelSel = ((freq - 672) * 2 - 3040) / 10;
-                        bModeSynth = 0;
-                } else if (((freq - 2224) % 5) == 0) {
-                        channelSel = ((freq - 704) * 2 - 3040) / 10;
-                        bModeSynth = 1;
-                } else {
-                        ath_print(common, ATH_DBG_FATAL,
-                                  "Invalid channel %u MHz\n", freq);
-                        return -EINVAL;
-                }
-
-                channelSel = (channelSel << 2) & 0xff;
-                channelSel = ath9k_hw_reverse_bits(channelSel, 8);
-
-                txctl = REG_READ(ah, AR_PHY_CCK_TX_CTRL);
-                if (freq == 2484) {
-
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl | AR_PHY_CCK_TX_CTRL_JAPAN);
-                } else {
-                        REG_WRITE(ah, AR_PHY_CCK_TX_CTRL,
-                                  txctl & ~AR_PHY_CCK_TX_CTRL_JAPAN);
-                }
-
-        } else if ((freq % 20) == 0 && freq >= 5120) {
-                channelSel =
-                    ath9k_hw_reverse_bits(((freq - 4800) / 20 << 2), 8);
-                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else if ((freq % 10) == 0) {
-                channelSel =
-                    ath9k_hw_reverse_bits(((freq - 4800) / 10 << 1), 8);
-                if (AR_SREV_9100(ah) || AR_SREV_9160_10_OR_LATER(ah))
-                        aModeRefSel = ath9k_hw_reverse_bits(2, 2);
-                else
-                        aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else if ((freq % 5) == 0) {
-                channelSel = ath9k_hw_reverse_bits((freq - 4800) / 5, 8);
-                aModeRefSel = ath9k_hw_reverse_bits(1, 2);
-        } else {
-                ath_print(common, ATH_DBG_FATAL,
-                          "Invalid channel %u MHz\n", freq);
-                return -EINVAL;
-        }
-
-        ath9k_hw_force_bias(ah, freq);
-
-        reg32 =
-            (channelSel << 8) | (aModeRefSel << 2) | (bModeSynth << 1) |
-            (1 << 5) | 0x1;
-
-        REG_WRITE(ah, AR_PHY(0x37), reg32);
-
-        ah->curchan = chan;
-        ah->curchan_rad_index = -1;
-
-        return 0;
-}
-
-/**
- * ath9k_hw_spur_mitigate - convert baseband spur frequency for external radios
- * @ah: atheros hardware structure
- * @chan:
- *
- * For non single-chip solutions. Converts to baseband spur frequency given the
- * input channel frequency and compute register settings below.
- */
-void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan)
-{
-        int bb_spur = AR_NO_SPUR;
-        int bin, cur_bin;
-        int spur_freq_sd;
-        int spur_delta_phase;
-        int denominator;
-        int upper, lower, cur_vit_mask;
-        int tmp, new;
-        int i;
-        int pilot_mask_reg[4] = { AR_PHY_TIMING7, AR_PHY_TIMING8,
-                          AR_PHY_PILOT_MASK_01_30, AR_PHY_PILOT_MASK_31_60
-        };
-        int chan_mask_reg[4] = { AR_PHY_TIMING9, AR_PHY_TIMING10,
-                         AR_PHY_CHANNEL_MASK_01_30, AR_PHY_CHANNEL_MASK_31_60
-        };
-        int inc[4] = { 0, 100, 0, 0 };
-
-        int8_t mask_m[123];
-        int8_t mask_p[123];
-        int8_t mask_amt;
-        int tmp_mask;
-        int cur_bb_spur;
-        bool is2GHz = IS_CHAN_2GHZ(chan);
-
-        memset(&mask_m, 0, sizeof(int8_t) * 123);
-        memset(&mask_p, 0, sizeof(int8_t) * 123);
-
-        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
-                cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
-                if (AR_NO_SPUR == cur_bb_spur)
-                        break;
-                cur_bb_spur = cur_bb_spur - (chan->channel * 10);
-                if ((cur_bb_spur > -95) && (cur_bb_spur < 95)) {
-                        bb_spur = cur_bb_spur;
-                        break;
-                }
-        }
-
-        if (AR_NO_SPUR == bb_spur)
-                return;
-
-        bin = bb_spur * 32;
-
-        tmp = REG_READ(ah, AR_PHY_TIMING_CTRL4(0));
-        new = tmp | (AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI |
-                     AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER |
-                     AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK |
-                     AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK);
-
-        REG_WRITE(ah, AR_PHY_TIMING_CTRL4(0), new);
-
-        new = (AR_PHY_SPUR_REG_MASK_RATE_CNTL |
-               AR_PHY_SPUR_REG_ENABLE_MASK_PPM |
-               AR_PHY_SPUR_REG_MASK_RATE_SELECT |
-               AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI |
-               SM(SPUR_RSSI_THRESH, AR_PHY_SPUR_REG_SPUR_RSSI_THRESH));
-        REG_WRITE(ah, AR_PHY_SPUR_REG, new);
-
-        spur_delta_phase = ((bb_spur * 524288) / 100) &
-                AR_PHY_TIMING11_SPUR_DELTA_PHASE;
-
-        denominator = IS_CHAN_2GHZ(chan) ? 440 : 400;
-        spur_freq_sd = ((bb_spur * 2048) / denominator) & 0x3ff;
-
-        new = (AR_PHY_TIMING11_USE_SPUR_IN_AGC |
-               SM(spur_freq_sd, AR_PHY_TIMING11_SPUR_FREQ_SD) |
-               SM(spur_delta_phase, AR_PHY_TIMING11_SPUR_DELTA_PHASE));
-        REG_WRITE(ah, AR_PHY_TIMING11, new);
-
-        cur_bin = -6000;
-        upper = bin + 100;
-        lower = bin - 100;
-
-        for (i = 0; i < 4; i++) {
-                int pilot_mask = 0;
-                int chan_mask = 0;
-                int bp = 0;
-                for (bp = 0; bp < 30; bp++) {
-                        if ((cur_bin > lower) && (cur_bin < upper)) {
-                                pilot_mask = pilot_mask | 0x1 << bp;
-                                chan_mask = chan_mask | 0x1 << bp;
-                        }
-                        cur_bin += 100;
-                }
-                cur_bin += inc[i];
-                REG_WRITE(ah, pilot_mask_reg[i], pilot_mask);
-                REG_WRITE(ah, chan_mask_reg[i], chan_mask);
-        }
-
-        cur_vit_mask = 6100;
-        upper = bin + 120;
-        lower = bin - 120;
-
-        for (i = 0; i < 123; i++) {
-                if ((cur_vit_mask > lower) && (cur_vit_mask < upper)) {
-
-                        /* workaround for gcc bug #37014 */
-                        volatile int tmp_v = abs(cur_vit_mask - bin);
-
-                        if (tmp_v < 75)
-                                mask_amt = 1;
-                        else
-                                mask_amt = 0;
-                        if (cur_vit_mask < 0)
-                                mask_m[abs(cur_vit_mask / 100)] = mask_amt;
-                        else
-                                mask_p[cur_vit_mask / 100] = mask_amt;
-                }
-                cur_vit_mask -= 100;
-        }
-
-        tmp_mask = (mask_m[46] << 30) | (mask_m[47] << 28)
-                | (mask_m[48] << 26) | (mask_m[49] << 24)
-                | (mask_m[50] << 22) | (mask_m[51] << 20)
-                | (mask_m[52] << 18) | (mask_m[53] << 16)
-                | (mask_m[54] << 14) | (mask_m[55] << 12)
-                | (mask_m[56] << 10) | (mask_m[57] << 8)
-                | (mask_m[58] << 6) | (mask_m[59] << 4)
-                | (mask_m[60] << 2) | (mask_m[61] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_VIT_MASK2_M_46_61, tmp_mask);
-
-        tmp_mask = (mask_m[31] << 28)
-                | (mask_m[32] << 26) | (mask_m[33] << 24)
-                | (mask_m[34] << 22) | (mask_m[35] << 20)
-                | (mask_m[36] << 18) | (mask_m[37] << 16)
-                | (mask_m[48] << 14) | (mask_m[39] << 12)
-                | (mask_m[40] << 10) | (mask_m[41] << 8)
-                | (mask_m[42] << 6) | (mask_m[43] << 4)
-                | (mask_m[44] << 2) | (mask_m[45] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_31_45, tmp_mask);
-
-        tmp_mask = (mask_m[16] << 30) | (mask_m[16] << 28)
-                | (mask_m[18] << 26) | (mask_m[18] << 24)
-                | (mask_m[20] << 22) | (mask_m[20] << 20)
-                | (mask_m[22] << 18) | (mask_m[22] << 16)
-                | (mask_m[24] << 14) | (mask_m[24] << 12)
-                | (mask_m[25] << 10) | (mask_m[26] << 8)
-                | (mask_m[27] << 6) | (mask_m[28] << 4)
-                | (mask_m[29] << 2) | (mask_m[30] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_16_30, tmp_mask);
-
-        tmp_mask = (mask_m[0] << 30) | (mask_m[1] << 28)
-                | (mask_m[2] << 26) | (mask_m[3] << 24)
-                | (mask_m[4] << 22) | (mask_m[5] << 20)
-                | (mask_m[6] << 18) | (mask_m[7] << 16)
-                | (mask_m[8] << 14) | (mask_m[9] << 12)
-                | (mask_m[10] << 10) | (mask_m[11] << 8)
-                | (mask_m[12] << 6) | (mask_m[13] << 4)
-                | (mask_m[14] << 2) | (mask_m[15] << 0);
-        REG_WRITE(ah, AR_PHY_MASK_CTL, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_M_00_15, tmp_mask);
-
-        tmp_mask = (mask_p[15] << 28)
-                | (mask_p[14] << 26) | (mask_p[13] << 24)
-                | (mask_p[12] << 22) | (mask_p[11] << 20)
-                | (mask_p[10] << 18) | (mask_p[9] << 16)
-                | (mask_p[8] << 14) | (mask_p[7] << 12)
-                | (mask_p[6] << 10) | (mask_p[5] << 8)
-                | (mask_p[4] << 6) | (mask_p[3] << 4)
-                | (mask_p[2] << 2) | (mask_p[1] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_1, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_15_01, tmp_mask);
-
-        tmp_mask = (mask_p[30] << 28)
-                | (mask_p[29] << 26) | (mask_p[28] << 24)
-                | (mask_p[27] << 22) | (mask_p[26] << 20)
-                | (mask_p[25] << 18) | (mask_p[24] << 16)
-                | (mask_p[23] << 14) | (mask_p[22] << 12)
-                | (mask_p[21] << 10) | (mask_p[20] << 8)
-                | (mask_p[19] << 6) | (mask_p[18] << 4)
-                | (mask_p[17] << 2) | (mask_p[16] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_2, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_30_16, tmp_mask);
-
-        tmp_mask = (mask_p[45] << 28)
-                | (mask_p[44] << 26) | (mask_p[43] << 24)
-                | (mask_p[42] << 22) | (mask_p[41] << 20)
-                | (mask_p[40] << 18) | (mask_p[39] << 16)
-                | (mask_p[38] << 14) | (mask_p[37] << 12)
-                | (mask_p[36] << 10) | (mask_p[35] << 8)
-                | (mask_p[34] << 6) | (mask_p[33] << 4)
-                | (mask_p[32] << 2) | (mask_p[31] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_3, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_45_31, tmp_mask);
-
-        tmp_mask = (mask_p[61] << 30) | (mask_p[60] << 28)
-                | (mask_p[59] << 26) | (mask_p[58] << 24)
-                | (mask_p[57] << 22) | (mask_p[56] << 20)
-                | (mask_p[55] << 18) | (mask_p[54] << 16)
-                | (mask_p[53] << 14) | (mask_p[52] << 12)
-                | (mask_p[51] << 10) | (mask_p[50] << 8)
-                | (mask_p[49] << 6) | (mask_p[48] << 4)
-                | (mask_p[47] << 2) | (mask_p[46] << 0);
-        REG_WRITE(ah, AR_PHY_BIN_MASK2_4, tmp_mask);
-        REG_WRITE(ah, AR_PHY_MASK2_P_61_45, tmp_mask);
-}
-
-/**
- * ath9k_hw_rf_alloc_ext_banks - allocates banks for external radio programming
- * @ah: atheros hardware structure
- *
- * Only required for older devices with external AR2133/AR5133 radios.
- */
-int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah)
-{
-#define ATH_ALLOC_BANK(bank, size) do { \
-                bank = kzalloc((sizeof(u32) * size), GFP_KERNEL); \
-                if (!bank) { \
-                        ath_print(common, ATH_DBG_FATAL, \
-                                  "Cannot allocate RF banks\n"); \
-                        return -ENOMEM; \
-                } \
-        } while (0);
-
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
-
-        ATH_ALLOC_BANK(ah->analogBank0Data, ah->iniBank0.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank1Data, ah->iniBank1.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank2Data, ah->iniBank2.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank3Data, ah->iniBank3.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank6Data, ah->iniBank6.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank6TPCData, ah->iniBank6TPC.ia_rows);
-        ATH_ALLOC_BANK(ah->analogBank7Data, ah->iniBank7.ia_rows);
-        ATH_ALLOC_BANK(ah->addac5416_21,
-                       ah->iniAddac.ia_rows * ah->iniAddac.ia_columns);
-        ATH_ALLOC_BANK(ah->bank6Temp, ah->iniBank6.ia_rows);
-
-        return 0;
-#undef ATH_ALLOC_BANK
-}
-
-
-/**
- * ath9k_hw_rf_free_ext_banks - Free memory for analog bank scratch buffers
- * @ah: atheros hardware struture
- * For the external AR2133/AR5133 radios banks.
- */
-void
-ath9k_hw_rf_free_ext_banks(struct ath_hw *ah)
-{
-#define ATH_FREE_BANK(bank) do { \
-                kfree(bank); \
-                bank = NULL; \
-        } while (0);
-
-        BUG_ON(AR_SREV_9280_10_OR_LATER(ah));
-
-        ATH_FREE_BANK(ah->analogBank0Data);
-        ATH_FREE_BANK(ah->analogBank1Data);
-        ATH_FREE_BANK(ah->analogBank2Data);
-        ATH_FREE_BANK(ah->analogBank3Data);
-        ATH_FREE_BANK(ah->analogBank6Data);
-        ATH_FREE_BANK(ah->analogBank6TPCData);
-        ATH_FREE_BANK(ah->analogBank7Data);
-        ATH_FREE_BANK(ah->addac5416_21);
-        ATH_FREE_BANK(ah->bank6Temp);
-
-#undef ATH_FREE_BANK
-}
-
-/* *
- * ath9k_hw_set_rf_regs - programs rf registers based on EEPROM
- * @ah: atheros hardware structure
- * @chan:
- * @modesIndex:
- *
- * Used for the external AR2133/AR5133 radios.
- *
- * Reads the EEPROM header info from the device structure and programs
- * all rf registers. This routine requires access to the analog
- * rf device. This is not required for single-chip devices.
- */
-bool ath9k_hw_set_rf_regs(struct ath_hw *ah, struct ath9k_channel *chan,
-                          u16 modesIndex)
-{
-        u32 eepMinorRev;
-        u32 ob5GHz = 0, db5GHz = 0;
-        u32 ob2GHz = 0, db2GHz = 0;
-        int regWrites = 0;
-
-        /*
-         * Software does not need to program bank data
-         * for single chip devices, that is AR9280 or anything
-         * after that.
-         */
-        if (AR_SREV_9280_10_OR_LATER(ah))
-                return true;
-
-        /* Setup rf parameters */
-        eepMinorRev = ah->eep_ops->get_eeprom(ah, EEP_MINOR_REV);
-
-        /* Setup Bank 0 Write */
-        RF_BANK_SETUP(ah->analogBank0Data, &ah->iniBank0, 1);
-
-        /* Setup Bank 1 Write */
-        RF_BANK_SETUP(ah->analogBank1Data, &ah->iniBank1, 1);
-
-        /* Setup Bank 2 Write */
-        RF_BANK_SETUP(ah->analogBank2Data, &ah->iniBank2, 1);
-
-        /* Setup Bank 6 Write */
-        RF_BANK_SETUP(ah->analogBank3Data, &ah->iniBank3,
-                      modesIndex);
-        {
-                int i;
-                for (i = 0; i < ah->iniBank6TPC.ia_rows; i++) {
-                        ah->analogBank6Data[i] =
-                            INI_RA(&ah->iniBank6TPC, i, modesIndex);
-                }
-        }
-
-        /* Only the 5 or 2 GHz OB/DB need to be set for a mode */
-        if (eepMinorRev >= 2) {
-                if (IS_CHAN_2GHZ(chan)) {
-                        ob2GHz = ah->eep_ops->get_eeprom(ah, EEP_OB_2);
-                        db2GHz = ah->eep_ops->get_eeprom(ah, EEP_DB_2);
-                        ath9k_phy_modify_rx_buffer(ah->analogBank6Data,
-                                                   ob2GHz, 3, 197, 0);
-                        ath9k_phy_modify_rx_buffer(ah->analogBank6Data,
-                                                   db2GHz, 3, 194, 0);
-                } else {
-                        ob5GHz = ah->eep_ops->get_eeprom(ah, EEP_OB_5);
-                        db5GHz = ah->eep_ops->get_eeprom(ah, EEP_DB_5);
-                        ath9k_phy_modify_rx_buffer(ah->analogBank6Data,
-                                                   ob5GHz, 3, 203, 0);
-                        ath9k_phy_modify_rx_buffer(ah->analogBank6Data,
-                                                   db5GHz, 3, 200, 0);
-                }
-        }
-
-        /* Setup Bank 7 Setup */
-        RF_BANK_SETUP(ah->analogBank7Data, &ah->iniBank7, 1);
-
-        /* Write Analog registers */
-        REG_WRITE_RF_ARRAY(&ah->iniBank0, ah->analogBank0Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank1, ah->analogBank1Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank2, ah->analogBank2Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank3, ah->analogBank3Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank6TPC, ah->analogBank6Data,
-                           regWrites);
-        REG_WRITE_RF_ARRAY(&ah->iniBank7, ah->analogBank7Data,
-                           regWrites);
-
-        return true;
-}
diff --git a/drivers/net/wireless/ath/ath9k/phy.h b/drivers/net/wireless/ath/ath9k/phy.h
index 0132e4c9a9f9..e724c2c1ae2a 100644
--- a/drivers/net/wireless/ath/ath9k/phy.h
+++ b/drivers/net/wireless/ath/ath9k/phy.h
@@ -17,504 +17,15 @@
 #ifndef PHY_H
 #define PHY_H
 
-/* Common between single chip and non single-chip solutions */
-void ath9k_hw_write_regs(struct ath_hw *ah, u32 freqIndex, int regWrites);
-
-/* Single chip radio settings */
-int ath9k_hw_ar9280_set_channel(struct ath_hw *ah, struct ath9k_channel *chan);
-void ath9k_hw_9280_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
-
-/* Routines below are for non single-chip solutions */
-int ath9k_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan);
-void ath9k_hw_spur_mitigate(struct ath_hw *ah, struct ath9k_channel *chan);
-
-int ath9k_hw_rf_alloc_ext_banks(struct ath_hw *ah);
-void ath9k_hw_rf_free_ext_banks(struct ath_hw *ah);
-
-bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
-                          struct ath9k_channel *chan,
-                          u16 modesIndex);
+#define CHANSEL_DIV             15
+#define CHANSEL_2G(_freq)       (((_freq) * 0x10000) / CHANSEL_DIV)
+#define CHANSEL_5G(_freq)       (((_freq) * 0x8000) / CHANSEL_DIV)
 
 #define AR_PHY_BASE     0x9800
 #define AR_PHY(_n)      (AR_PHY_BASE + ((_n)<<2))
 
-#define AR_PHY_TEST             0x9800
-#define PHY_AGC_CLR             0x10000000
-#define RFSILENT_BB             0x00002000
-
-#define AR_PHY_TURBO                0x9804
-#define AR_PHY_FC_TURBO_MODE        0x00000001
-#define AR_PHY_FC_TURBO_SHORT       0x00000002
-#define AR_PHY_FC_DYN2040_EN        0x00000004
-#define AR_PHY_FC_DYN2040_PRI_ONLY  0x00000008
-#define AR_PHY_FC_DYN2040_PRI_CH    0x00000010
-/* For 25 MHz channel spacing -- not used but supported by hw */
-#define AR_PHY_FC_DYN2040_EXT_CH    0x00000020
-#define AR_PHY_FC_HT_EN             0x00000040
-#define AR_PHY_FC_SHORT_GI_40       0x00000080
-#define AR_PHY_FC_WALSH             0x00000100
-#define AR_PHY_FC_SINGLE_HT_LTF1    0x00000200
-#define AR_PHY_FC_ENABLE_DAC_FIFO   0x00000800
-
-#define AR_PHY_TEST2                0x9808
-
-#define AR_PHY_TIMING2           0x9810
-#define AR_PHY_TIMING3           0x9814
-#define AR_PHY_TIMING3_DSC_MAN   0xFFFE0000
-#define AR_PHY_TIMING3_DSC_MAN_S 17
-#define AR_PHY_TIMING3_DSC_EXP   0x0001E000
-#define AR_PHY_TIMING3_DSC_EXP_S 13
-
-#define AR_PHY_CHIP_ID            0x9818
-#define AR_PHY_CHIP_ID_REV_0      0x80
-#define AR_PHY_CHIP_ID_REV_1      0x81
-#define AR_PHY_CHIP_ID_9160_REV_0 0xb0
-
-#define AR_PHY_ACTIVE       0x981C
-#define AR_PHY_ACTIVE_EN    0x00000001
-#define AR_PHY_ACTIVE_DIS   0x00000000
-
-#define AR_PHY_RF_CTL2             0x9824
-#define AR_PHY_TX_END_DATA_START   0x000000FF
-#define AR_PHY_TX_END_DATA_START_S 0
-#define AR_PHY_TX_END_PA_ON        0x0000FF00
-#define AR_PHY_TX_END_PA_ON_S      8
-
-#define AR_PHY_RF_CTL3                  0x9828
-#define AR_PHY_TX_END_TO_A2_RX_ON       0x00FF0000
-#define AR_PHY_TX_END_TO_A2_RX_ON_S     16
-
-#define AR_PHY_ADC_CTL                  0x982C
-#define AR_PHY_ADC_CTL_OFF_INBUFGAIN    0x00000003
-#define AR_PHY_ADC_CTL_OFF_INBUFGAIN_S  0
-#define AR_PHY_ADC_CTL_OFF_PWDDAC       0x00002000
-#define AR_PHY_ADC_CTL_OFF_PWDBANDGAP   0x00004000
-#define AR_PHY_ADC_CTL_OFF_PWDADC       0x00008000
-#define AR_PHY_ADC_CTL_ON_INBUFGAIN     0x00030000
-#define AR_PHY_ADC_CTL_ON_INBUFGAIN_S   16
-
-#define AR_PHY_ADC_SERIAL_CTL       0x9830
-#define AR_PHY_SEL_INTERNAL_ADDAC   0x00000000
-#define AR_PHY_SEL_EXTERNAL_RADIO   0x00000001
-
-#define AR_PHY_RF_CTL4                    0x9834
-#define AR_PHY_RF_CTL4_TX_END_XPAB_OFF    0xFF000000
-#define AR_PHY_RF_CTL4_TX_END_XPAB_OFF_S  24
-#define AR_PHY_RF_CTL4_TX_END_XPAA_OFF    0x00FF0000
-#define AR_PHY_RF_CTL4_TX_END_XPAA_OFF_S  16
-#define AR_PHY_RF_CTL4_FRAME_XPAB_ON      0x0000FF00
-#define AR_PHY_RF_CTL4_FRAME_XPAB_ON_S    8
-#define AR_PHY_RF_CTL4_FRAME_XPAA_ON      0x000000FF
-#define AR_PHY_RF_CTL4_FRAME_XPAA_ON_S    0
-
-#define AR_PHY_TSTDAC_CONST               0x983c
-
-#define AR_PHY_SETTLING          0x9844
-#define AR_PHY_SETTLING_SWITCH   0x00003F80
-#define AR_PHY_SETTLING_SWITCH_S 7
-
-#define AR_PHY_RXGAIN                   0x9848
-#define AR_PHY_RXGAIN_TXRX_ATTEN        0x0003F000
-#define AR_PHY_RXGAIN_TXRX_ATTEN_S      12
-#define AR_PHY_RXGAIN_TXRX_RF_MAX       0x007C0000
-#define AR_PHY_RXGAIN_TXRX_RF_MAX_S     18
-#define AR9280_PHY_RXGAIN_TXRX_ATTEN    0x00003F80
-#define AR9280_PHY_RXGAIN_TXRX_ATTEN_S  7
-#define AR9280_PHY_RXGAIN_TXRX_MARGIN   0x001FC000
-#define AR9280_PHY_RXGAIN_TXRX_MARGIN_S 14
-
-#define AR_PHY_DESIRED_SZ           0x9850
-#define AR_PHY_DESIRED_SZ_ADC       0x000000FF
-#define AR_PHY_DESIRED_SZ_ADC_S     0
-#define AR_PHY_DESIRED_SZ_PGA       0x0000FF00
-#define AR_PHY_DESIRED_SZ_PGA_S     8
-#define AR_PHY_DESIRED_SZ_TOT_DES   0x0FF00000
-#define AR_PHY_DESIRED_SZ_TOT_DES_S 20
-
-#define AR_PHY_FIND_SIG           0x9858
-#define AR_PHY_FIND_SIG_FIRSTEP   0x0003F000
-#define AR_PHY_FIND_SIG_FIRSTEP_S 12
-#define AR_PHY_FIND_SIG_FIRPWR    0x03FC0000
-#define AR_PHY_FIND_SIG_FIRPWR_S  18
-
-#define AR_PHY_AGC_CTL1                  0x985C
-#define AR_PHY_AGC_CTL1_COARSE_LOW       0x00007F80
-#define AR_PHY_AGC_CTL1_COARSE_LOW_S     7
-#define AR_PHY_AGC_CTL1_COARSE_HIGH      0x003F8000
-#define AR_PHY_AGC_CTL1_COARSE_HIGH_S    15
-
-#define AR_PHY_AGC_CONTROL               0x9860
-#define AR_PHY_AGC_CONTROL_CAL           0x00000001
-#define AR_PHY_AGC_CONTROL_NF            0x00000002
-#define AR_PHY_AGC_CONTROL_ENABLE_NF     0x00008000
-#define AR_PHY_AGC_CONTROL_FLTR_CAL      0x00010000
-#define AR_PHY_AGC_CONTROL_NO_UPDATE_NF  0x00020000
-
-#define AR_PHY_CCA                  0x9864
-#define AR_PHY_MINCCA_PWR           0x0FF80000
-#define AR_PHY_MINCCA_PWR_S         19
-#define AR_PHY_CCA_THRESH62         0x0007F000
-#define AR_PHY_CCA_THRESH62_S       12
-#define AR9280_PHY_MINCCA_PWR       0x1FF00000
-#define AR9280_PHY_MINCCA_PWR_S     20
-#define AR9280_PHY_CCA_THRESH62     0x000FF000
-#define AR9280_PHY_CCA_THRESH62_S   12
-
-#define AR_PHY_SFCORR_LOW                    0x986C
-#define AR_PHY_SFCORR_LOW_USE_SELF_CORR_LOW  0x00000001
-#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW    0x00003F00
-#define AR_PHY_SFCORR_LOW_M2COUNT_THR_LOW_S  8
-#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW      0x001FC000
-#define AR_PHY_SFCORR_LOW_M1_THRESH_LOW_S    14
-#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW      0x0FE00000
-#define AR_PHY_SFCORR_LOW_M2_THRESH_LOW_S    21
-
-#define AR_PHY_SFCORR                0x9868
-#define AR_PHY_SFCORR_M2COUNT_THR    0x0000001F
-#define AR_PHY_SFCORR_M2COUNT_THR_S  0
-#define AR_PHY_SFCORR_M1_THRESH      0x00FE0000
-#define AR_PHY_SFCORR_M1_THRESH_S    17
-#define AR_PHY_SFCORR_M2_THRESH      0x7F000000
-#define AR_PHY_SFCORR_M2_THRESH_S    24
-
-#define AR_PHY_SLEEP_CTR_CONTROL    0x9870
-#define AR_PHY_SLEEP_CTR_LIMIT      0x9874
-#define AR_PHY_SYNTH_CONTROL        0x9874
-#define AR_PHY_SLEEP_SCAL           0x9878
-
-#define AR_PHY_PLL_CTL          0x987c
-#define AR_PHY_PLL_CTL_40       0xaa
-#define AR_PHY_PLL_CTL_40_5413  0x04
-#define AR_PHY_PLL_CTL_44       0xab
-#define AR_PHY_PLL_CTL_44_2133  0xeb
-#define AR_PHY_PLL_CTL_40_2133  0xea
-
-#define AR_PHY_SPECTRAL_SCAN                    0x9910  /* AR9280 spectral scan configuration register */
-#define AR_PHY_SPECTRAL_SCAN_ENABLE             0x1
-#define AR_PHY_SPECTRAL_SCAN_ENA                0x00000001  /* Enable spectral scan, reg 68, bit 0 */
-#define AR_PHY_SPECTRAL_SCAN_ENA_S              0  /* Enable spectral scan, reg 68, bit 0 */
-#define AR_PHY_SPECTRAL_SCAN_ACTIVE             0x00000002  /* Activate spectral scan reg 68, bit 1*/
-#define AR_PHY_SPECTRAL_SCAN_ACTIVE_S           1  /* Activate spectral scan reg 68, bit 1*/
-#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD         0x000000F0  /* Interval for FFT reports, reg 68, bits 4-7*/
-#define AR_PHY_SPECTRAL_SCAN_FFT_PERIOD_S       4
-#define AR_PHY_SPECTRAL_SCAN_PERIOD             0x0000FF00  /* Interval for FFT reports, reg 68, bits 8-15*/
-#define AR_PHY_SPECTRAL_SCAN_PERIOD_S           8
-#define AR_PHY_SPECTRAL_SCAN_COUNT              0x00FF0000  /* Number of reports, reg 68, bits 16-23*/
-#define AR_PHY_SPECTRAL_SCAN_COUNT_S            16
-#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT       0x01000000  /* Short repeat, reg 68, bit 24*/
-#define AR_PHY_SPECTRAL_SCAN_SHORT_REPEAT_S     24  /* Short repeat, reg 68, bit 24*/
-
-#define AR_PHY_RX_DELAY           0x9914
-#define AR_PHY_SEARCH_START_DELAY 0x9918
-#define AR_PHY_RX_DELAY_DELAY     0x00003FFF
-
-#define AR_PHY_TIMING_CTRL4(_i)     (0x9920 + ((_i) << 12))
-#define AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF 0x01F
-#define AR_PHY_TIMING_CTRL4_IQCORR_Q_Q_COFF_S   0
-#define AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF 0x7E0
-#define AR_PHY_TIMING_CTRL4_IQCORR_Q_I_COFF_S   5
-#define AR_PHY_TIMING_CTRL4_IQCORR_ENABLE   0x800
-#define AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX 0xF000
-#define AR_PHY_TIMING_CTRL4_IQCAL_LOG_COUNT_MAX_S   12
-#define AR_PHY_TIMING_CTRL4_DO_CAL    0x10000
-
-#define AR_PHY_TIMING_CTRL4_ENABLE_SPUR_RSSI    0x80000000
-#define AR_PHY_TIMING_CTRL4_ENABLE_SPUR_FILTER  0x40000000
-#define AR_PHY_TIMING_CTRL4_ENABLE_CHAN_MASK    0x20000000
-#define AR_PHY_TIMING_CTRL4_ENABLE_PILOT_MASK   0x10000000
-
-#define AR_PHY_TIMING5               0x9924
-#define AR_PHY_TIMING5_CYCPWR_THR1   0x000000FE
-#define AR_PHY_TIMING5_CYCPWR_THR1_S 1
-
-#define AR_PHY_POWER_TX_RATE1               0x9934
-#define AR_PHY_POWER_TX_RATE2               0x9938
-#define AR_PHY_POWER_TX_RATE_MAX            0x993c
-#define AR_PHY_POWER_TX_RATE_MAX_TPC_ENABLE 0x00000040
-
-#define AR_PHY_FRAME_CTL            0x9944
-#define AR_PHY_FRAME_CTL_TX_CLIP    0x00000038
-#define AR_PHY_FRAME_CTL_TX_CLIP_S  3
-
-#define AR_PHY_TXPWRADJ                   0x994C
-#define AR_PHY_TXPWRADJ_CCK_GAIN_DELTA    0x00000FC0
-#define AR_PHY_TXPWRADJ_CCK_GAIN_DELTA_S  6
-#define AR_PHY_TXPWRADJ_CCK_PCDAC_INDEX   0x00FC0000
-#define AR_PHY_TXPWRADJ_CCK_PCDAC_INDEX_S 18
-
-#define AR_PHY_RADAR_EXT      0x9940
-#define AR_PHY_RADAR_EXT_ENA  0x00004000
-
-#define AR_PHY_RADAR_0          0x9954
-#define AR_PHY_RADAR_0_ENA      0x00000001
-#define AR_PHY_RADAR_0_FFT_ENA  0x80000000
-#define AR_PHY_RADAR_0_INBAND   0x0000003e
-#define AR_PHY_RADAR_0_INBAND_S 1
-#define AR_PHY_RADAR_0_PRSSI    0x00000FC0
-#define AR_PHY_RADAR_0_PRSSI_S  6
-#define AR_PHY_RADAR_0_HEIGHT   0x0003F000
-#define AR_PHY_RADAR_0_HEIGHT_S 12
-#define AR_PHY_RADAR_0_RRSSI    0x00FC0000
-#define AR_PHY_RADAR_0_RRSSI_S  18
-#define AR_PHY_RADAR_0_FIRPWR   0x7F000000
-#define AR_PHY_RADAR_0_FIRPWR_S 24
-
-#define AR_PHY_RADAR_1                  0x9958
-#define AR_PHY_RADAR_1_RELPWR_ENA       0x00800000
-#define AR_PHY_RADAR_1_USE_FIR128       0x00400000
-#define AR_PHY_RADAR_1_RELPWR_THRESH    0x003F0000
-#define AR_PHY_RADAR_1_RELPWR_THRESH_S  16
-#define AR_PHY_RADAR_1_BLOCK_CHECK      0x00008000
-#define AR_PHY_RADAR_1_MAX_RRSSI        0x00004000
-#define AR_PHY_RADAR_1_RELSTEP_CHECK    0x00002000
-#define AR_PHY_RADAR_1_RELSTEP_THRESH   0x00001F00
-#define AR_PHY_RADAR_1_RELSTEP_THRESH_S 8
-#define AR_PHY_RADAR_1_MAXLEN           0x000000FF
-#define AR_PHY_RADAR_1_MAXLEN_S         0
-
-#define AR_PHY_SWITCH_CHAIN_0     0x9960
-#define AR_PHY_SWITCH_COM         0x9964
-
-#define AR_PHY_SIGMA_DELTA            0x996C
-#define AR_PHY_SIGMA_DELTA_ADC_SEL    0x00000003
-#define AR_PHY_SIGMA_DELTA_ADC_SEL_S  0
-#define AR_PHY_SIGMA_DELTA_FILT2      0x000000F8
-#define AR_PHY_SIGMA_DELTA_FILT2_S    3
-#define AR_PHY_SIGMA_DELTA_FILT1      0x00001F00
-#define AR_PHY_SIGMA_DELTA_FILT1_S    8
-#define AR_PHY_SIGMA_DELTA_ADC_CLIP   0x01FFE000
-#define AR_PHY_SIGMA_DELTA_ADC_CLIP_S 13
-
-#define AR_PHY_RESTART          0x9970
-#define AR_PHY_RESTART_DIV_GC   0x001C0000
-#define AR_PHY_RESTART_DIV_GC_S 18
-
-#define AR_PHY_RFBUS_REQ        0x997C
-#define AR_PHY_RFBUS_REQ_EN     0x00000001
-
-#define AR_PHY_TIMING7                  0x9980
-#define AR_PHY_TIMING8                  0x9984
-#define AR_PHY_TIMING8_PILOT_MASK_2     0x000FFFFF
-#define AR_PHY_TIMING8_PILOT_MASK_2_S   0
-
-#define AR_PHY_BIN_MASK2_1      0x9988
-#define AR_PHY_BIN_MASK2_2      0x998c
-#define AR_PHY_BIN_MASK2_3      0x9990
-#define AR_PHY_BIN_MASK2_4      0x9994
-
-#define AR_PHY_BIN_MASK_1       0x9900
-#define AR_PHY_BIN_MASK_2       0x9904
-#define AR_PHY_BIN_MASK_3       0x9908
-
-#define AR_PHY_MASK_CTL         0x990c
-
-#define AR_PHY_BIN_MASK2_4_MASK_4       0x00003FFF
-#define AR_PHY_BIN_MASK2_4_MASK_4_S     0
-
-#define AR_PHY_TIMING9                  0x9998
-#define AR_PHY_TIMING10                 0x999c
-#define AR_PHY_TIMING10_PILOT_MASK_2    0x000FFFFF
-#define AR_PHY_TIMING10_PILOT_MASK_2_S  0
-
-#define AR_PHY_TIMING11                         0x99a0
-#define AR_PHY_TIMING11_SPUR_DELTA_PHASE        0x000FFFFF
-#define AR_PHY_TIMING11_SPUR_DELTA_PHASE_S      0
-#define AR_PHY_TIMING11_SPUR_FREQ_SD            0x3FF00000
-#define AR_PHY_TIMING11_SPUR_FREQ_SD_S          20
-#define AR_PHY_TIMING11_USE_SPUR_IN_AGC         0x40000000
-#define AR_PHY_TIMING11_USE_SPUR_IN_SELFCOR     0x80000000
-
-#define AR_PHY_RX_CHAINMASK     0x99a4
-#define AR_PHY_NEW_ADC_DC_GAIN_CORR(_i) (0x99b4 + ((_i) << 12))
-#define AR_PHY_NEW_ADC_GAIN_CORR_ENABLE 0x40000000
-#define AR_PHY_NEW_ADC_DC_OFFSET_CORR_ENABLE 0x80000000
-
-#define AR_PHY_MULTICHAIN_GAIN_CTL          0x99ac
-#define AR_PHY_9285_ANT_DIV_CTL_ALL         0x7f000000
-#define AR_PHY_9285_ANT_DIV_CTL             0x01000000
-#define AR_PHY_9285_ANT_DIV_CTL_S           24
-#define AR_PHY_9285_ANT_DIV_ALT_LNACONF     0x06000000
-#define AR_PHY_9285_ANT_DIV_ALT_LNACONF_S   25
-#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF    0x18000000
-#define AR_PHY_9285_ANT_DIV_MAIN_LNACONF_S  27
-#define AR_PHY_9285_ANT_DIV_ALT_GAINTB      0x20000000
-#define AR_PHY_9285_ANT_DIV_ALT_GAINTB_S    29
-#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB     0x40000000
-#define AR_PHY_9285_ANT_DIV_MAIN_GAINTB_S   30
-#define AR_PHY_9285_ANT_DIV_LNA1            2
-#define AR_PHY_9285_ANT_DIV_LNA2            1
-#define AR_PHY_9285_ANT_DIV_LNA1_PLUS_LNA2  3
-#define AR_PHY_9285_ANT_DIV_LNA1_MINUS_LNA2 0
-#define AR_PHY_9285_ANT_DIV_GAINTB_0        0
-#define AR_PHY_9285_ANT_DIV_GAINTB_1        1
-
-#define AR_PHY_EXT_CCA0             0x99b8
-#define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
-#define AR_PHY_EXT_CCA0_THRESH62_S  0
-
-#define AR_PHY_EXT_CCA                  0x99bc
-#define AR_PHY_EXT_CCA_CYCPWR_THR1      0x0000FE00
-#define AR_PHY_EXT_CCA_CYCPWR_THR1_S    9
-#define AR_PHY_EXT_CCA_THRESH62         0x007F0000
-#define AR_PHY_EXT_CCA_THRESH62_S       16
-#define AR_PHY_EXT_MINCCA_PWR           0xFF800000
-#define AR_PHY_EXT_MINCCA_PWR_S         23
-#define AR9280_PHY_EXT_MINCCA_PWR       0x01FF0000
-#define AR9280_PHY_EXT_MINCCA_PWR_S     16
-
-#define AR_PHY_SFCORR_EXT                 0x99c0
-#define AR_PHY_SFCORR_EXT_M1_THRESH       0x0000007F
-#define AR_PHY_SFCORR_EXT_M1_THRESH_S     0
-#define AR_PHY_SFCORR_EXT_M2_THRESH       0x00003F80
-#define AR_PHY_SFCORR_EXT_M2_THRESH_S     7
-#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW   0x001FC000
-#define AR_PHY_SFCORR_EXT_M1_THRESH_LOW_S 14
-#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW   0x0FE00000
-#define AR_PHY_SFCORR_EXT_M2_THRESH_LOW_S 21
-#define AR_PHY_SFCORR_SPUR_SUBCHNL_SD_S   28
-
-#define AR_PHY_HALFGI           0x99D0
-#define AR_PHY_HALFGI_DSC_MAN   0x0007FFF0
-#define AR_PHY_HALFGI_DSC_MAN_S 4
-#define AR_PHY_HALFGI_DSC_EXP   0x0000000F
-#define AR_PHY_HALFGI_DSC_EXP_S 0
-
-#define AR_PHY_CHAN_INFO_MEMORY               0x99DC
-#define AR_PHY_CHAN_INFO_MEMORY_CAPTURE_MASK  0x0001
-
-#define AR_PHY_HEAVY_CLIP_ENABLE         0x99E0
-
-#define AR_PHY_HEAVY_CLIP_FACTOR_RIFS    0x99EC
-#define AR_PHY_RIFS_INIT_DELAY         0x03ff0000
-
-#define AR_PHY_M_SLEEP      0x99f0
-#define AR_PHY_REFCLKDLY    0x99f4
-#define AR_PHY_REFCLKPD     0x99f8
-
-#define AR_PHY_CALMODE      0x99f0
-
-#define AR_PHY_CALMODE_IQ           0x00000000
-#define AR_PHY_CALMODE_ADC_GAIN     0x00000001
-#define AR_PHY_CALMODE_ADC_DC_PER   0x00000002
-#define AR_PHY_CALMODE_ADC_DC_INIT  0x00000003
-
-#define AR_PHY_CAL_MEAS_0(_i)     (0x9c10 + ((_i) << 12))
-#define AR_PHY_CAL_MEAS_1(_i)     (0x9c14 + ((_i) << 12))
-#define AR_PHY_CAL_MEAS_2(_i)     (0x9c18 + ((_i) << 12))
-#define AR_PHY_CAL_MEAS_3(_i)     (0x9c1c + ((_i) << 12))
-
-#define AR_PHY_CURRENT_RSSI 0x9c1c
-#define AR9280_PHY_CURRENT_RSSI 0x9c3c
-
-#define AR_PHY_RFBUS_GRANT       0x9C20
-#define AR_PHY_RFBUS_GRANT_EN    0x00000001
-
-#define AR_PHY_CHAN_INFO_GAIN_DIFF             0x9CF4
-#define AR_PHY_CHAN_INFO_GAIN_DIFF_UPPER_LIMIT 320
-
-#define AR_PHY_CHAN_INFO_GAIN          0x9CFC
-
-#define AR_PHY_MODE         0xA200
-#define AR_PHY_MODE_ASYNCFIFO 0x80
-#define AR_PHY_MODE_AR2133  0x08
-#define AR_PHY_MODE_AR5111  0x00
-#define AR_PHY_MODE_AR5112  0x08
-#define AR_PHY_MODE_DYNAMIC 0x04
-#define AR_PHY_MODE_RF2GHZ  0x02
-#define AR_PHY_MODE_RF5GHZ  0x00
-#define AR_PHY_MODE_CCK     0x01
-#define AR_PHY_MODE_OFDM    0x00
-#define AR_PHY_MODE_DYN_CCK_DISABLE 0x100
-
-#define AR_PHY_CCK_TX_CTRL       0xA204
-#define AR_PHY_CCK_TX_CTRL_JAPAN 0x00000010
-#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK         0x0000000C
-#define AR_PHY_CCK_TX_CTRL_TX_DAC_SCALE_CCK_S       2
-
-#define AR_PHY_CCK_DETECT                           0xA208
-#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003F
-#define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
-/* [12:6] settling time for antenna switch */
-#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001FC0
-#define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME_S         6
-#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV    0x2000
-#define AR_PHY_CCK_DETECT_BB_ENABLE_ANT_FAST_DIV_S  13
-
-#define AR_PHY_GAIN_2GHZ                0xA20C
-#define AR_PHY_GAIN_2GHZ_RXTX_MARGIN    0x00FC0000
-#define AR_PHY_GAIN_2GHZ_RXTX_MARGIN_S  18
-#define AR_PHY_GAIN_2GHZ_BSW_MARGIN     0x00003C00
-#define AR_PHY_GAIN_2GHZ_BSW_MARGIN_S   10
-#define AR_PHY_GAIN_2GHZ_BSW_ATTEN      0x0000001F
-#define AR_PHY_GAIN_2GHZ_BSW_ATTEN_S    0
-
-#define AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN     0x003E0000
-#define AR_PHY_GAIN_2GHZ_XATTEN2_MARGIN_S   17
-#define AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN     0x0001F000
-#define AR_PHY_GAIN_2GHZ_XATTEN1_MARGIN_S   12
-#define AR_PHY_GAIN_2GHZ_XATTEN2_DB         0x00000FC0
-#define AR_PHY_GAIN_2GHZ_XATTEN2_DB_S       6
-#define AR_PHY_GAIN_2GHZ_XATTEN1_DB         0x0000003F
-#define AR_PHY_GAIN_2GHZ_XATTEN1_DB_S       0
-
-#define AR_PHY_CCK_RXCTRL4  0xA21C
-#define AR_PHY_CCK_RXCTRL4_FREQ_EST_SHORT   0x01F80000
-#define AR_PHY_CCK_RXCTRL4_FREQ_EST_SHORT_S 19
-
-#define AR_PHY_DAG_CTRLCCK  0xA228
-#define AR_PHY_DAG_CTRLCCK_EN_RSSI_THR  0x00000200
-#define AR_PHY_DAG_CTRLCCK_RSSI_THR     0x0001FC00
-#define AR_PHY_DAG_CTRLCCK_RSSI_THR_S   10
-
-#define AR_PHY_FORCE_CLKEN_CCK              0xA22C
-#define AR_PHY_FORCE_CLKEN_CCK_MRC_MUX      0x00000040
-
-#define AR_PHY_POWER_TX_RATE3   0xA234
-#define AR_PHY_POWER_TX_RATE4   0xA238
-
-#define AR_PHY_SCRM_SEQ_XR       0xA23C
-#define AR_PHY_HEADER_DETECT_XR  0xA240
-#define AR_PHY_CHIRP_DETECTED_XR 0xA244
-#define AR_PHY_BLUETOOTH         0xA254
-
-#define AR_PHY_TPCRG1   0xA258
-#define AR_PHY_TPCRG1_NUM_PD_GAIN   0x0000c000
-#define AR_PHY_TPCRG1_NUM_PD_GAIN_S 14
-
-#define AR_PHY_TPCRG1_PD_GAIN_1    0x00030000
-#define AR_PHY_TPCRG1_PD_GAIN_1_S  16
-#define AR_PHY_TPCRG1_PD_GAIN_2    0x000C0000
-#define AR_PHY_TPCRG1_PD_GAIN_2_S  18
-#define AR_PHY_TPCRG1_PD_GAIN_3    0x00300000
-#define AR_PHY_TPCRG1_PD_GAIN_3_S  20
-
-#define AR_PHY_TPCRG1_PD_CAL_ENABLE   0x00400000
-#define AR_PHY_TPCRG1_PD_CAL_ENABLE_S 22
-
-#define AR_PHY_TX_PWRCTRL4       0xa264
-#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID     0x00000001
-#define AR_PHY_TX_PWRCTRL_PD_AVG_VALID_S   0
-#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT       0x000001FE
-#define AR_PHY_TX_PWRCTRL_PD_AVG_OUT_S     1
-
-#define AR_PHY_TX_PWRCTRL6_0     0xa270
-#define AR_PHY_TX_PWRCTRL6_1     0xb270
-#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE     0x03000000
-#define AR_PHY_TX_PWRCTRL_ERR_EST_MODE_S   24
-
-#define AR_PHY_TX_PWRCTRL7       0xa274
 #define AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX   0x0007E000
 #define AR_PHY_TX_PWRCTRL_TX_GAIN_TAB_MAX_S 13
-#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN     0x01F80000
-#define AR_PHY_TX_PWRCTRL_INIT_TX_GAIN_S   19
-
-#define AR_PHY_TX_PWRCTRL9       0xa27C
-#define AR_PHY_TX_DESIRED_SCALE_CCK        0x00007C00
-#define AR_PHY_TX_DESIRED_SCALE_CCK_S      10
-#define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL  0x80000000
-#define AR_PHY_TX_PWRCTRL9_RES_DC_REMOVAL_S 31
-
-#define AR_PHY_TX_GAIN_TBL1      0xa300
 #define AR_PHY_TX_GAIN_CLC       0x0000001E
 #define AR_PHY_TX_GAIN_CLC_S     1
 #define AR_PHY_TX_GAIN           0x0007F000
@@ -526,91 +37,6 @@ bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
 #define AR_PHY_CLC_Q0        0x0000ffd0
 #define AR_PHY_CLC_Q0_S      5
 
-#define AR_PHY_CH0_TX_PWRCTRL11  0xa398
-#define AR_PHY_CH1_TX_PWRCTRL11  0xb398
-#define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP   0x0000FC00
-#define AR_PHY_TX_PWRCTRL_OLPC_TEMP_COMP_S 10
-
-#define AR_PHY_VIT_MASK2_M_46_61 0xa3a0
-#define AR_PHY_MASK2_M_31_45     0xa3a4
-#define AR_PHY_MASK2_M_16_30     0xa3a8
-#define AR_PHY_MASK2_M_00_15     0xa3ac
-#define AR_PHY_MASK2_P_15_01     0xa3b8
-#define AR_PHY_MASK2_P_30_16     0xa3bc
-#define AR_PHY_MASK2_P_45_31     0xa3c0
-#define AR_PHY_MASK2_P_61_45     0xa3c4
-#define AR_PHY_SPUR_REG          0x994c
-
-#define AR_PHY_SPUR_REG_MASK_RATE_CNTL       (0xFF << 18)
-#define AR_PHY_SPUR_REG_MASK_RATE_CNTL_S     18
-
-#define AR_PHY_SPUR_REG_ENABLE_MASK_PPM      0x20000
-#define AR_PHY_SPUR_REG_MASK_RATE_SELECT     (0xFF << 9)
-#define AR_PHY_SPUR_REG_MASK_RATE_SELECT_S   9
-#define AR_PHY_SPUR_REG_ENABLE_VIT_SPUR_RSSI 0x100
-#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH     0x7F
-#define AR_PHY_SPUR_REG_SPUR_RSSI_THRESH_S   0
-
-#define AR_PHY_PILOT_MASK_01_30   0xa3b0
-#define AR_PHY_PILOT_MASK_31_60   0xa3b4
-
-#define AR_PHY_CHANNEL_MASK_01_30 0x99d4
-#define AR_PHY_CHANNEL_MASK_31_60 0x99d8
-
-#define AR_PHY_ANALOG_SWAP      0xa268
-#define AR_PHY_SWAP_ALT_CHAIN   0x00000040
-
-#define AR_PHY_TPCRG5   0xA26C
-#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP       0x0000000F
-#define AR_PHY_TPCRG5_PD_GAIN_OVERLAP_S     0
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1    0x000003F0
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_1_S  4
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2    0x0000FC00
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_2_S  10
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3    0x003F0000
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_3_S  16
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4    0x0FC00000
-#define AR_PHY_TPCRG5_PD_GAIN_BOUNDARY_4_S  22
-
-/* Carrier leak calibration control, do it after AGC calibration */
-#define AR_PHY_CL_CAL_CTL       0xA358
-#define AR_PHY_CL_CAL_ENABLE    0x00000002
-#define AR_PHY_PARALLEL_CAL_ENABLE    0x00000001
-
-#define AR_PHY_POWER_TX_RATE5   0xA38C
-#define AR_PHY_POWER_TX_RATE6   0xA390
-
-#define AR_PHY_CAL_CHAINMASK    0xA39C
-
-#define AR_PHY_POWER_TX_SUB     0xA3C8
-#define AR_PHY_POWER_TX_RATE7   0xA3CC
-#define AR_PHY_POWER_TX_RATE8   0xA3D0
-#define AR_PHY_POWER_TX_RATE9   0xA3D4
-
-#define AR_PHY_XPA_CFG          0xA3D8
-#define AR_PHY_FORCE_XPA_CFG    0x000000001
-#define AR_PHY_FORCE_XPA_CFG_S  0
-
-#define AR_PHY_CH1_CCA          0xa864
-#define AR_PHY_CH1_MINCCA_PWR   0x0FF80000
-#define AR_PHY_CH1_MINCCA_PWR_S 19
-#define AR9280_PHY_CH1_MINCCA_PWR   0x1FF00000
-#define AR9280_PHY_CH1_MINCCA_PWR_S 20
-
-#define AR_PHY_CH2_CCA          0xb864
-#define AR_PHY_CH2_MINCCA_PWR   0x0FF80000
-#define AR_PHY_CH2_MINCCA_PWR_S 19
-
-#define AR_PHY_CH1_EXT_CCA          0xa9bc
-#define AR_PHY_CH1_EXT_MINCCA_PWR   0xFF800000
-#define AR_PHY_CH1_EXT_MINCCA_PWR_S 23
-#define AR9280_PHY_CH1_EXT_MINCCA_PWR   0x01FF0000
-#define AR9280_PHY_CH1_EXT_MINCCA_PWR_S 16
-
-#define AR_PHY_CH2_EXT_CCA          0xb9bc
-#define AR_PHY_CH2_EXT_MINCCA_PWR   0xFF800000
-#define AR_PHY_CH2_EXT_MINCCA_PWR_S 23
-
 #define REG_WRITE_RF_ARRAY(iniarray, regData, regWr) do {               \
                 int r;                                                  \
                 for (r = 0; r < ((iniarray)->ia_rows); r++) {           \
@@ -625,6 +51,7 @@ bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
 #define ANTSWAP_AB 0x0001
 #define REDUCE_CHAIN_0 0x00000050
 #define REDUCE_CHAIN_1 0x00000051
+#define AR_PHY_CHIP_ID 0x9818
 
 #define RF_BANK_SETUP(_bank, _iniarray, _col) do {                      \
                 int i;                                                  \
@@ -632,4 +59,7 @@ bool ath9k_hw_set_rf_regs(struct ath_hw *ah,
                         (_bank)[i] = INI_RA((_iniarray), i, _col);;     \
         } while (0)
 
+#define AR_PHY_TIMING11_SPUR_FREQ_SD            0x3FF00000
+#define AR_PHY_TIMING11_SPUR_FREQ_SD_S          20
+
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/rc.c b/drivers/net/wireless/ath/ath9k/rc.c
index ee81291f2fba..8519452c95f1 100644
--- a/drivers/net/wireless/ath/ath9k/rc.c
+++ b/drivers/net/wireless/ath/ath9k/rc.c
@@ -691,6 +691,19 @@ static void ath_get_rate(void *priv, struct ieee80211_sta *sta, void *priv_sta,
         rate_table = sc->cur_rate_table;
         rix = ath_rc_get_highest_rix(sc, ath_rc_priv, rate_table, &is_probe);
 
+        /*
+         * If we're in HT mode and both us and our peer supports LDPC.
+         * We don't need to check our own device's capabilities as our own
+         * ht capabilities would have already been intersected with our peer's.
+         */
+        if (conf_is_ht(&sc->hw->conf) &&
+            (sta->ht_cap.cap & IEEE80211_HT_CAP_LDPC_CODING))
+                tx_info->flags |= IEEE80211_TX_CTL_LDPC;
+
+        if (conf_is_ht(&sc->hw->conf) &&
+            (sta->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
+                tx_info->flags |= (1 << IEEE80211_TX_CTL_STBC_SHIFT);
+
         if (is_probe) {
                 /* set one try for probe rates. For the
                  * probes don't enable rts */
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 94560e2fe376..ac60c4ee62d3 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -15,6 +15,9 @@
  */
 
 #include "ath9k.h"
+#include "ar9003_mac.h"
+
+#define SKB_CB_ATHBUF(__skb)    (*((struct ath_buf **)__skb->cb))
 
 static struct ieee80211_hw * ath_get_virt_hw(struct ath_softc *sc,
                                              struct ieee80211_hdr *hdr)
@@ -115,56 +118,246 @@ static void ath_opmode_init(struct ath_softc *sc)
         ath9k_hw_setmcastfilter(ah, mfilt[0], mfilt[1]);
 }
 
-int ath_rx_init(struct ath_softc *sc, int nbufs)
+static bool ath_rx_edma_buf_link(struct ath_softc *sc,
+                                 enum ath9k_rx_qtype qtype)
 {
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_rx_edma *rx_edma;
         struct sk_buff *skb;
         struct ath_buf *bf;
-        int error = 0;
 
-        spin_lock_init(&sc->rx.rxflushlock);
-        sc->sc_flags &= ~SC_OP_RXFLUSH;
-        spin_lock_init(&sc->rx.rxbuflock);
+        rx_edma = &sc->rx.rx_edma[qtype];
+        if (skb_queue_len(&rx_edma->rx_fifo) >= rx_edma->rx_fifo_hwsize)
+                return false;
 
-        common->rx_bufsize = roundup(IEEE80211_MAX_MPDU_LEN,
-                                     min(common->cachelsz, (u16)64));
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        list_del_init(&bf->list);
 
-        ath_print(common, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
-                  common->cachelsz, common->rx_bufsize);
+        skb = bf->bf_mpdu;
+
+        ATH_RXBUF_RESET(bf);
+        memset(skb->data, 0, ah->caps.rx_status_len);
+        dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+                                ah->caps.rx_status_len, DMA_TO_DEVICE);
 
-        /* Initialize rx descriptors */
+        SKB_CB_ATHBUF(skb) = bf;
+        ath9k_hw_addrxbuf_edma(ah, bf->bf_buf_addr, qtype);
+        skb_queue_tail(&rx_edma->rx_fifo, skb);
 
-        error = ath_descdma_setup(sc, &sc->rx.rxdma, &sc->rx.rxbuf,
-                                  "rx", nbufs, 1);
-        if (error != 0) {
-                ath_print(common, ATH_DBG_FATAL,
-                          "failed to allocate rx descriptors: %d\n", error);
-                goto err;
+        return true;
+}
+
+static void ath_rx_addbuffer_edma(struct ath_softc *sc,
+                                  enum ath9k_rx_qtype qtype, int size)
+{
+        struct ath_rx_edma *rx_edma;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        u32 nbuf = 0;
+
+        rx_edma = &sc->rx.rx_edma[qtype];
+        if (list_empty(&sc->rx.rxbuf)) {
+                ath_print(common, ATH_DBG_QUEUE, "No free rx buf available\n");
+                return;
         }
 
+        while (!list_empty(&sc->rx.rxbuf)) {
+                nbuf++;
+
+                if (!ath_rx_edma_buf_link(sc, qtype))
+                        break;
+
+                if (nbuf >= size)
+                        break;
+        }
+}
+
+static void ath_rx_remove_buffer(struct ath_softc *sc,
+                                 enum ath9k_rx_qtype qtype)
+{
+        struct ath_buf *bf;
+        struct ath_rx_edma *rx_edma;
+        struct sk_buff *skb;
+
+        rx_edma = &sc->rx.rx_edma[qtype];
+
+        while ((skb = skb_dequeue(&rx_edma->rx_fifo)) != NULL) {
+                bf = SKB_CB_ATHBUF(skb);
+                BUG_ON(!bf);
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+        }
+}
+
+static void ath_rx_edma_cleanup(struct ath_softc *sc)
+{
+        struct ath_buf *bf;
+
+        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
+        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
+
         list_for_each_entry(bf, &sc->rx.rxbuf, list) {
+                if (bf->bf_mpdu)
+                        dev_kfree_skb_any(bf->bf_mpdu);
+        }
+
+        INIT_LIST_HEAD(&sc->rx.rxbuf);
+
+        kfree(sc->rx.rx_bufptr);
+        sc->rx.rx_bufptr = NULL;
+}
+
+static void ath_rx_edma_init_queue(struct ath_rx_edma *rx_edma, int size)
+{
+        skb_queue_head_init(&rx_edma->rx_fifo);
+        skb_queue_head_init(&rx_edma->rx_buffers);
+        rx_edma->rx_fifo_hwsize = size;
+}
+
+static int ath_rx_edma_init(struct ath_softc *sc, int nbufs)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct sk_buff *skb;
+        struct ath_buf *bf;
+        int error = 0, i;
+        u32 size;
+
+
+        common->rx_bufsize = roundup(IEEE80211_MAX_MPDU_LEN +
+                                     ah->caps.rx_status_len,
+                                     min(common->cachelsz, (u16)64));
+
+        ath9k_hw_set_rx_bufsize(ah, common->rx_bufsize -
+                                    ah->caps.rx_status_len);
+
+        ath_rx_edma_init_queue(&sc->rx.rx_edma[ATH9K_RX_QUEUE_LP],
+                               ah->caps.rx_lp_qdepth);
+        ath_rx_edma_init_queue(&sc->rx.rx_edma[ATH9K_RX_QUEUE_HP],
+                               ah->caps.rx_hp_qdepth);
+
+        size = sizeof(struct ath_buf) * nbufs;
+        bf = kzalloc(size, GFP_KERNEL);
+        if (!bf)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&sc->rx.rxbuf);
+        sc->rx.rx_bufptr = bf;
+
+        for (i = 0; i < nbufs; i++, bf++) {
                 skb = ath_rxbuf_alloc(common, common->rx_bufsize, GFP_KERNEL);
-                if (skb == NULL) {
+                if (!skb) {
                         error = -ENOMEM;
-                        goto err;
+                        goto rx_init_fail;
                 }
 
+                memset(skb->data, 0, common->rx_bufsize);
                 bf->bf_mpdu = skb;
+
                 bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
                                                  common->rx_bufsize,
-                                                 DMA_FROM_DEVICE);
+                                                 DMA_BIDIRECTIONAL);
                 if (unlikely(dma_mapping_error(sc->dev,
-                                               bf->bf_buf_addr))) {
-                        dev_kfree_skb_any(skb);
-                        bf->bf_mpdu = NULL;
+                                                bf->bf_buf_addr))) {
+                                dev_kfree_skb_any(skb);
+                                bf->bf_mpdu = NULL;
+                                ath_print(common, ATH_DBG_FATAL,
+                                        "dma_mapping_error() on RX init\n");
+                                error = -ENOMEM;
+                                goto rx_init_fail;
+                }
+
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+        }
+
+        return 0;
+
+rx_init_fail:
+        ath_rx_edma_cleanup(sc);
+        return error;
+}
+
+static void ath_edma_start_recv(struct ath_softc *sc)
+{
+        spin_lock_bh(&sc->rx.rxbuflock);
+
+        ath9k_hw_rxena(sc->sc_ah);
+
+        ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP,
+                              sc->rx.rx_edma[ATH9K_RX_QUEUE_HP].rx_fifo_hwsize);
+
+        ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_LP,
+                              sc->rx.rx_edma[ATH9K_RX_QUEUE_LP].rx_fifo_hwsize);
+
+        spin_unlock_bh(&sc->rx.rxbuflock);
+
+        ath_opmode_init(sc);
+
+        ath9k_hw_startpcureceive(sc->sc_ah);
+}
+
+static void ath_edma_stop_recv(struct ath_softc *sc)
+{
+        spin_lock_bh(&sc->rx.rxbuflock);
+        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_HP);
+        ath_rx_remove_buffer(sc, ATH9K_RX_QUEUE_LP);
+        spin_unlock_bh(&sc->rx.rxbuflock);
+}
+
+int ath_rx_init(struct ath_softc *sc, int nbufs)
+{
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct sk_buff *skb;
+        struct ath_buf *bf;
+        int error = 0;
+
+        spin_lock_init(&sc->rx.rxflushlock);
+        sc->sc_flags &= ~SC_OP_RXFLUSH;
+        spin_lock_init(&sc->rx.rxbuflock);
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                return ath_rx_edma_init(sc, nbufs);
+        } else {
+                common->rx_bufsize = roundup(IEEE80211_MAX_MPDU_LEN,
+                                min(common->cachelsz, (u16)64));
+
+                ath_print(common, ATH_DBG_CONFIG, "cachelsz %u rxbufsize %u\n",
+                                common->cachelsz, common->rx_bufsize);
+
+                /* Initialize rx descriptors */
+
+                error = ath_descdma_setup(sc, &sc->rx.rxdma, &sc->rx.rxbuf,
+                                "rx", nbufs, 1, 0);
+                if (error != 0) {
                         ath_print(common, ATH_DBG_FATAL,
-                                  "dma_mapping_error() on RX init\n");
-                        error = -ENOMEM;
+                                  "failed to allocate rx descriptors: %d\n",
+                                  error);
                         goto err;
                 }
-                bf->bf_dmacontext = bf->bf_buf_addr;
+
+                list_for_each_entry(bf, &sc->rx.rxbuf, list) {
+                        skb = ath_rxbuf_alloc(common, common->rx_bufsize,
+                                              GFP_KERNEL);
+                        if (skb == NULL) {
+                                error = -ENOMEM;
+                                goto err;
+                        }
+
+                        bf->bf_mpdu = skb;
+                        bf->bf_buf_addr = dma_map_single(sc->dev, skb->data,
+                                        common->rx_bufsize,
+                                        DMA_FROM_DEVICE);
+                        if (unlikely(dma_mapping_error(sc->dev,
+                                                        bf->bf_buf_addr))) {
+                                dev_kfree_skb_any(skb);
+                                bf->bf_mpdu = NULL;
+                                ath_print(common, ATH_DBG_FATAL,
+                                          "dma_mapping_error() on RX init\n");
+                                error = -ENOMEM;
+                                goto err;
+                        }
+                        bf->bf_dmacontext = bf->bf_buf_addr;
+                }
+                sc->rx.rxlink = NULL;
         }
-        sc->rx.rxlink = NULL;
 
 err:
         if (error)
@@ -180,17 +373,23 @@ void ath_rx_cleanup(struct ath_softc *sc)
         struct sk_buff *skb;
         struct ath_buf *bf;
 
-        list_for_each_entry(bf, &sc->rx.rxbuf, list) {
-                skb = bf->bf_mpdu;
-                if (skb) {
-                        dma_unmap_single(sc->dev, bf->bf_buf_addr,
-                                         common->rx_bufsize, DMA_FROM_DEVICE);
-                        dev_kfree_skb(skb);
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                ath_rx_edma_cleanup(sc);
+                return;
+        } else {
+                list_for_each_entry(bf, &sc->rx.rxbuf, list) {
+                        skb = bf->bf_mpdu;
+                        if (skb) {
+                                dma_unmap_single(sc->dev, bf->bf_buf_addr,
+                                                common->rx_bufsize,
+                                                DMA_FROM_DEVICE);
+                                dev_kfree_skb(skb);
+                        }
                 }
-        }
 
-        if (sc->rx.rxdma.dd_desc_len != 0)
-                ath_descdma_cleanup(sc, &sc->rx.rxdma, &sc->rx.rxbuf);
+                if (sc->rx.rxdma.dd_desc_len != 0)
+                        ath_descdma_cleanup(sc, &sc->rx.rxdma, &sc->rx.rxbuf);
+        }
 }
 
 /*
@@ -273,6 +472,11 @@ int ath_startrecv(struct ath_softc *sc)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_buf *bf, *tbf;
 
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                ath_edma_start_recv(sc);
+                return 0;
+        }
+
         spin_lock_bh(&sc->rx.rxbuflock);
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
@@ -306,7 +510,11 @@ bool ath_stoprecv(struct ath_softc *sc)
         ath9k_hw_stoppcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah);
-        sc->rx.rxlink = NULL;
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_edma_stop_recv(sc);
+        else
+                sc->rx.rxlink = NULL;
 
         return stopped;
 }
@@ -315,7 +523,9 @@ void ath_flushrecv(struct ath_softc *sc)
 {
         spin_lock_bh(&sc->rx.rxflushlock);
         sc->sc_flags |= SC_OP_RXFLUSH;
-        ath_rx_tasklet(sc, 1);
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_rx_tasklet(sc, 1, true);
+        ath_rx_tasklet(sc, 1, false);
         sc->sc_flags &= ~SC_OP_RXFLUSH;
         spin_unlock_bh(&sc->rx.rxflushlock);
 }
@@ -469,14 +679,147 @@ static void ath_rx_send_to_mac80211(struct ieee80211_hw *hw,
                 ieee80211_rx(hw, skb);
 }
 
-int ath_rx_tasklet(struct ath_softc *sc, int flush)
+static bool ath_edma_get_buffers(struct ath_softc *sc,
+                                 enum ath9k_rx_qtype qtype)
 {
-#define PA2DESC(_sc, _pa)                                               \
-        ((struct ath_desc *)((caddr_t)(_sc)->rx.rxdma.dd_desc +         \
-                             ((_pa) - (_sc)->rx.rxdma.dd_desc_paddr)))
+        struct ath_rx_edma *rx_edma = &sc->rx.rx_edma[qtype];
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct sk_buff *skb;
+        struct ath_buf *bf;
+        int ret;
+
+        skb = skb_peek(&rx_edma->rx_fifo);
+        if (!skb)
+                return false;
+
+        bf = SKB_CB_ATHBUF(skb);
+        BUG_ON(!bf);
+
+        dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+                                common->rx_bufsize, DMA_FROM_DEVICE);
+
+        ret = ath9k_hw_process_rxdesc_edma(ah, NULL, skb->data);
+        if (ret == -EINPROGRESS)
+                return false;
+
+        __skb_unlink(skb, &rx_edma->rx_fifo);
+        if (ret == -EINVAL) {
+                /* corrupt descriptor, skip this one and the following one */
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+                ath_rx_edma_buf_link(sc, qtype);
+                skb = skb_peek(&rx_edma->rx_fifo);
+                if (!skb)
+                        return true;
+
+                bf = SKB_CB_ATHBUF(skb);
+                BUG_ON(!bf);
+
+                __skb_unlink(skb, &rx_edma->rx_fifo);
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+                ath_rx_edma_buf_link(sc, qtype);
+        }
+        skb_queue_tail(&rx_edma->rx_buffers, skb);
+
+        return true;
+}
 
+static struct ath_buf *ath_edma_get_next_rx_buf(struct ath_softc *sc,
+                                                struct ath_rx_status *rs,
+                                                enum ath9k_rx_qtype qtype)
+{
+        struct ath_rx_edma *rx_edma = &sc->rx.rx_edma[qtype];
+        struct sk_buff *skb;
         struct ath_buf *bf;
+
+        while (ath_edma_get_buffers(sc, qtype));
+        skb = __skb_dequeue(&rx_edma->rx_buffers);
+        if (!skb)
+                return NULL;
+
+        bf = SKB_CB_ATHBUF(skb);
+        ath9k_hw_process_rxdesc_edma(sc->sc_ah, rs, skb->data);
+        return bf;
+}
+
+static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
+                                           struct ath_rx_status *rs)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
         struct ath_desc *ds;
+        struct ath_buf *bf;
+        int ret;
+
+        if (list_empty(&sc->rx.rxbuf)) {
+                sc->rx.rxlink = NULL;
+                return NULL;
+        }
+
+        bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
+        ds = bf->bf_desc;
+
+        /*
+         * Must provide the virtual address of the current
+         * descriptor, the physical address, and the virtual
+         * address of the next descriptor in the h/w chain.
+         * This allows the HAL to look ahead to see if the
+         * hardware is done with a descriptor by checking the
+         * done bit in the following descriptor and the address
+         * of the current descriptor the DMA engine is working
+         * on.  All this is necessary because of our use of
+         * a self-linked list to avoid rx overruns.
+         */
+        ret = ath9k_hw_rxprocdesc(ah, ds, rs, 0);
+        if (ret == -EINPROGRESS) {
+                struct ath_rx_status trs;
+                struct ath_buf *tbf;
+                struct ath_desc *tds;
+
+                memset(&trs, 0, sizeof(trs));
+                if (list_is_last(&bf->list, &sc->rx.rxbuf)) {
+                        sc->rx.rxlink = NULL;
+                        return NULL;
+                }
+
+                tbf = list_entry(bf->list.next, struct ath_buf, list);
+
+                /*
+                 * On some hardware the descriptor status words could
+                 * get corrupted, including the done bit. Because of
+                 * this, check if the next descriptor's done bit is
+                 * set or not.
+                 *
+                 * If the next descriptor's done bit is set, the current
+                 * descriptor has been corrupted. Force s/w to discard
+                 * this descriptor and continue...
+                 */
+
+                tds = tbf->bf_desc;
+                ret = ath9k_hw_rxprocdesc(ah, tds, &trs, 0);
+                if (ret == -EINPROGRESS)
+                        return NULL;
+        }
+
+        if (!bf->bf_mpdu)
+                return bf;
+
+        /*
+         * Synchronize the DMA transfer with CPU before
+         * 1. accessing the frame
+         * 2. requeueing the same buffer to h/w
+         */
+        dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
+                        common->rx_bufsize,
+                        DMA_FROM_DEVICE);
+
+        return bf;
+}
+
+
+int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
+{
+        struct ath_buf *bf;
         struct sk_buff *skb = NULL, *requeue_skb;
         struct ieee80211_rx_status *rxs;
         struct ath_hw *ah = sc->sc_ah;
@@ -491,7 +834,16 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
         int retval;
         bool decrypt_error = false;
         struct ath_rx_status rs;
+        enum ath9k_rx_qtype qtype;
+        bool edma = !!(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA);
+        int dma_type;
 
+        if (edma)
+                dma_type = DMA_FROM_DEVICE;
+        else
+                dma_type = DMA_BIDIRECTIONAL;
+
+        qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
         spin_lock_bh(&sc->rx.rxbuflock);
 
         do {
@@ -499,71 +851,19 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 if ((sc->sc_flags & SC_OP_RXFLUSH) && (flush == 0))
                         break;
 
-                if (list_empty(&sc->rx.rxbuf)) {
-                        sc->rx.rxlink = NULL;
-                        break;
-                }
-
-                bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
-                ds = bf->bf_desc;
-
-                /*
-                 * Must provide the virtual address of the current
-                 * descriptor, the physical address, and the virtual
-                 * address of the next descriptor in the h/w chain.
-                 * This allows the HAL to look ahead to see if the
-                 * hardware is done with a descriptor by checking the
-                 * done bit in the following descriptor and the address
-                 * of the current descriptor the DMA engine is working
-                 * on.  All this is necessary because of our use of
-                 * a self-linked list to avoid rx overruns.
-                 */
                 memset(&rs, 0, sizeof(rs));
-                retval = ath9k_hw_rxprocdesc(ah, ds, &rs, 0);
-                if (retval == -EINPROGRESS) {
-                        struct ath_rx_status trs;
-                        struct ath_buf *tbf;
-                        struct ath_desc *tds;
-
-                        memset(&trs, 0, sizeof(trs));
-                        if (list_is_last(&bf->list, &sc->rx.rxbuf)) {
-                                sc->rx.rxlink = NULL;
-                                break;
-                        }
+                if (edma)
+                        bf = ath_edma_get_next_rx_buf(sc, &rs, qtype);
+                else
+                        bf = ath_get_next_rx_buf(sc, &rs);
 
-                        tbf = list_entry(bf->list.next, struct ath_buf, list);
-
-                        /*
-                         * On some hardware the descriptor status words could
-                         * get corrupted, including the done bit. Because of
-                         * this, check if the next descriptor's done bit is
-                         * set or not.
-                         *
-                         * If the next descriptor's done bit is set, the current
-                         * descriptor has been corrupted. Force s/w to discard
-                         * this descriptor and continue...
-                         */
-
-                        tds = tbf->bf_desc;
-                        retval = ath9k_hw_rxprocdesc(ah, tds, &trs, 0);
-                        if (retval == -EINPROGRESS) {
-                                break;
-                        }
-                }
+                if (!bf)
+                        break;
 
                 skb = bf->bf_mpdu;
                 if (!skb)
                         continue;
 
-                /*
-                 * Synchronize the DMA transfer with CPU before
-                 * 1. accessing the frame
-                 * 2. requeueing the same buffer to h/w
-                 */
-                dma_sync_single_for_cpu(sc->dev, bf->bf_buf_addr,
-                                common->rx_bufsize,
-                                DMA_FROM_DEVICE);
-
                 hdr = (struct ieee80211_hdr *) skb->data;
                 rxs =  IEEE80211_SKB_RXCB(skb);
 
@@ -597,9 +897,11 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 /* Unmap the frame */
                 dma_unmap_single(sc->dev, bf->bf_buf_addr,
                                  common->rx_bufsize,
-                                 DMA_FROM_DEVICE);
+                                 dma_type);
 
-                skb_put(skb, rs.rs_datalen);
+                skb_put(skb, rs.rs_datalen + ah->caps.rx_status_len);
+                if (ah->caps.rx_status_len)
+                        skb_pull(skb, ah->caps.rx_status_len);
 
                 ath9k_cmn_rx_skb_postprocess(common, skb, &rs,
                                              rxs, decrypt_error);
@@ -608,7 +910,7 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 bf->bf_mpdu = requeue_skb;
                 bf->bf_buf_addr = dma_map_single(sc->dev, requeue_skb->data,
                                                  common->rx_bufsize,
-                                                 DMA_FROM_DEVICE);
+                                                 dma_type);
                 if (unlikely(dma_mapping_error(sc->dev,
                           bf->bf_buf_addr))) {
                         dev_kfree_skb_any(requeue_skb);
@@ -639,12 +941,16 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush)
                 ath_rx_send_to_mac80211(hw, sc, skb, rxs);
 
 requeue:
-                list_move_tail(&bf->list, &sc->rx.rxbuf);
-                ath_rx_buf_link(sc, bf);
+                if (edma) {
+                        list_add_tail(&bf->list, &sc->rx.rxbuf);
+                        ath_rx_edma_buf_link(sc, qtype);
+                } else {
+                        list_move_tail(&bf->list, &sc->rx.rxbuf);
+                        ath_rx_buf_link(sc, bf);
+                }
         } while (1);
 
         spin_unlock_bh(&sc->rx.rxbuflock);
 
         return 0;
-#undef PA2DESC
 }
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index 7e36ad7421b7..d4371a43bdaa 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -20,7 +20,7 @@
 #include "../reg.h"
 
 #define AR_CR                0x0008
-#define AR_CR_RXE            0x00000004
+#define AR_CR_RXE            (AR_SREV_9300_20_OR_LATER(ah) ? 0x0000000c : 0x00000004)
 #define AR_CR_RXD            0x00000020
 #define AR_CR_SWI            0x00000040
 
@@ -39,6 +39,12 @@
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH         0x00060000
 #define AR_CFG_PCI_MASTER_REQ_Q_THRESH_S       17
 
+#define AR_RXBP_THRESH       0x0018
+#define AR_RXBP_THRESH_HP    0x0000000f
+#define AR_RXBP_THRESH_HP_S  0
+#define AR_RXBP_THRESH_LP    0x00003f00
+#define AR_RXBP_THRESH_LP_S  8
+
 #define AR_MIRT              0x0020
 #define AR_MIRT_VAL          0x0000ffff
 #define AR_MIRT_VAL_S        16
@@ -144,6 +150,9 @@
 #define AR_MACMISC_MISC_OBS_BUS_MSB_S   15
 #define AR_MACMISC_MISC_OBS_BUS_1       1
 
+#define AR_DATABUF_SIZE         0x0060
+#define AR_DATABUF_SIZE_MASK    0x00000FFF
+
 #define AR_GTXTO    0x0064
 #define AR_GTXTO_TIMEOUT_COUNTER    0x0000FFFF
 #define AR_GTXTO_TIMEOUT_LIMIT      0xFFFF0000
@@ -160,9 +169,14 @@
 #define AR_CST_TIMEOUT_LIMIT      0xFFFF0000
 #define AR_CST_TIMEOUT_LIMIT_S    16
 
+#define AR_HP_RXDP 0x0074
+#define AR_LP_RXDP 0x0078
+
 #define AR_ISR               0x0080
 #define AR_ISR_RXOK          0x00000001
 #define AR_ISR_RXDESC        0x00000002
+#define AR_ISR_HP_RXOK       0x00000001
+#define AR_ISR_LP_RXOK       0x00000002
 #define AR_ISR_RXERR         0x00000004
 #define AR_ISR_RXNOPKT       0x00000008
 #define AR_ISR_RXEOL         0x00000010
@@ -232,7 +246,6 @@
 #define AR_ISR_S5_TIMER_THRESH      0x0007FE00
 #define AR_ISR_S5_TIM_TIMER         0x00000010
 #define AR_ISR_S5_DTIM_TIMER        0x00000020
-#define AR_ISR_S5_S                 0x00d8
 #define AR_IMR_S5                   0x00b8
 #define AR_IMR_S5_TIM_TIMER         0x00000010
 #define AR_IMR_S5_DTIM_TIMER        0x00000020
@@ -240,7 +253,6 @@
 #define AR_ISR_S5_GENTIMER_TRIG_S   0
 #define AR_ISR_S5_GENTIMER_THRESH   0xFF800000
 #define AR_ISR_S5_GENTIMER_THRESH_S 16
-#define AR_ISR_S5_S                 0x00d8
 #define AR_IMR_S5_GENTIMER_TRIG     0x0000FF80
 #define AR_IMR_S5_GENTIMER_TRIG_S   0
 #define AR_IMR_S5_GENTIMER_THRESH   0xFF800000
@@ -249,6 +261,8 @@
 #define AR_IMR               0x00a0
 #define AR_IMR_RXOK          0x00000001
 #define AR_IMR_RXDESC        0x00000002
+#define AR_IMR_RXOK_HP       0x00000001
+#define AR_IMR_RXOK_LP       0x00000002
 #define AR_IMR_RXERR         0x00000004
 #define AR_IMR_RXNOPKT       0x00000008
 #define AR_IMR_RXEOL         0x00000010
@@ -332,10 +346,10 @@
 #define AR_ISR_S1_QCU_TXEOL    0x03FF0000
 #define AR_ISR_S1_QCU_TXEOL_S  16
 
-#define AR_ISR_S2_S           0x00cc
-#define AR_ISR_S3_S           0x00d0
-#define AR_ISR_S4_S           0x00d4
-#define AR_ISR_S5_S           0x00d8
+#define AR_ISR_S2_S           (AR_SREV_9300_20_OR_LATER(ah) ? 0x00d0 : 0x00cc)
+#define AR_ISR_S3_S           (AR_SREV_9300_20_OR_LATER(ah) ? 0x00d4 : 0x00d0)
+#define AR_ISR_S4_S           (AR_SREV_9300_20_OR_LATER(ah) ? 0x00d8 : 0x00d4)
+#define AR_ISR_S5_S           (AR_SREV_9300_20_OR_LATER(ah) ? 0x00dc : 0x00d8)
 #define AR_DMADBG_0           0x00e0
 #define AR_DMADBG_1           0x00e4
 #define AR_DMADBG_2           0x00e8
@@ -369,6 +383,9 @@
 #define AR_Q9_TXDP           0x0824
 #define AR_QTXDP(_i)    (AR_Q0_TXDP + ((_i)<<2))
 
+#define AR_Q_STATUS_RING_START  0x830
+#define AR_Q_STATUS_RING_END    0x834
+
 #define AR_Q_TXE             0x0840
 #define AR_Q_TXE_M           0x000003FF
 
@@ -461,6 +478,10 @@
 #define AR_Q_RDYTIMESHDN    0x0a40
 #define AR_Q_RDYTIMESHDN_M  0x000003FF
 
+/* MAC Descriptor CRC check */
+#define AR_Q_DESC_CRCCHK    0xa44
+/* Enable CRC check on the descriptor fetched from host */
+#define AR_Q_DESC_CRCCHK_EN 1
 
 #define AR_NUM_DCU      10
 #define AR_DCU_0        0x0001
@@ -759,6 +780,8 @@
 #define AR_SREV_VERSION_9271                    0x140
 #define AR_SREV_REVISION_9271_10                0
 #define AR_SREV_REVISION_9271_11                1
+#define AR_SREV_VERSION_9300                  0x1c0
+#define AR_SREV_REVISION_9300_20              2 /* 2.0 and 2.1 */
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -844,6 +867,15 @@
 #define AR_SREV_9271_11(_ah) \
     (AR_SREV_9271(_ah) && \
      ((_ah)->hw_version.macRev == AR_SREV_REVISION_9271_11))
+#define AR_SREV_9300(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300))
+#define AR_SREV_9300_20(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9300_20))
+#define AR_SREV_9300_20_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion > AR_SREV_VERSION_9300) || \
+         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9300) && \
+          ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9300_20)))
 
 #define AR_SREV_9285E_20(_ah) \
     (AR_SREV_9285_12_OR_LATER(_ah) && \
@@ -945,6 +977,7 @@ enum {
 #define AR9285_NUM_GPIO                          12
 #define AR9287_NUM_GPIO                          11
 #define AR9271_NUM_GPIO                          16
+#define AR9300_NUM_GPIO                          17
 
 #define AR_GPIO_IN_OUT                           0x4048
 #define AR_GPIO_IN_VAL                           0x0FFFC000
@@ -957,19 +990,21 @@ enum {
 #define AR9287_GPIO_IN_VAL_S                     11
 #define AR9271_GPIO_IN_VAL                       0xFFFF0000
 #define AR9271_GPIO_IN_VAL_S                     16
+#define AR9300_GPIO_IN_VAL                       0x0001FFFF
+#define AR9300_GPIO_IN_VAL_S                     0
 
-#define AR_GPIO_OE_OUT                           0x404c
+#define AR_GPIO_OE_OUT                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4050 : 0x404c)
 #define AR_GPIO_OE_OUT_DRV                       0x3
 #define AR_GPIO_OE_OUT_DRV_NO                    0x0
 #define AR_GPIO_OE_OUT_DRV_LOW                   0x1
 #define AR_GPIO_OE_OUT_DRV_HI                    0x2
 #define AR_GPIO_OE_OUT_DRV_ALL                   0x3
 
-#define AR_GPIO_INTR_POL                         0x4050
-#define AR_GPIO_INTR_POL_VAL                     0x00001FFF
+#define AR_GPIO_INTR_POL                         (AR_SREV_9300_20_OR_LATER(ah) ? 0x4058 : 0x4050)
+#define AR_GPIO_INTR_POL_VAL                     0x0001FFFF
 #define AR_GPIO_INTR_POL_VAL_S                   0
 
-#define AR_GPIO_INPUT_EN_VAL                     0x4054
+#define AR_GPIO_INPUT_EN_VAL                     (AR_SREV_9300_20_OR_LATER(ah) ? 0x405c : 0x4054)
 #define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_DEF     0x00000004
 #define AR_GPIO_INPUT_EN_VAL_BT_PRIORITY_S       2
 #define AR_GPIO_INPUT_EN_VAL_BT_FREQUENCY_DEF    0x00000008
@@ -987,13 +1022,13 @@ enum {
 #define AR_GPIO_RTC_RESET_OVERRIDE_ENABLE        0x00010000
 #define AR_GPIO_JTAG_DISABLE                     0x00020000
 
-#define AR_GPIO_INPUT_MUX1                       0x4058
+#define AR_GPIO_INPUT_MUX1                       (AR_SREV_9300_20_OR_LATER(ah) ? 0x4060 : 0x4058)
 #define AR_GPIO_INPUT_MUX1_BT_ACTIVE             0x000f0000
 #define AR_GPIO_INPUT_MUX1_BT_ACTIVE_S           16
 #define AR_GPIO_INPUT_MUX1_BT_PRIORITY           0x00000f00
 #define AR_GPIO_INPUT_MUX1_BT_PRIORITY_S         8
 
-#define AR_GPIO_INPUT_MUX2                       0x405c
+#define AR_GPIO_INPUT_MUX2                       (AR_SREV_9300_20_OR_LATER(ah) ? 0x4064 : 0x405c)
 #define AR_GPIO_INPUT_MUX2_CLK25                 0x0000000f
 #define AR_GPIO_INPUT_MUX2_CLK25_S               0
 #define AR_GPIO_INPUT_MUX2_RFSILENT              0x000000f0
@@ -1001,13 +1036,13 @@ enum {
 #define AR_GPIO_INPUT_MUX2_RTC_RESET             0x00000f00
 #define AR_GPIO_INPUT_MUX2_RTC_RESET_S           8
 
-#define AR_GPIO_OUTPUT_MUX1                      0x4060
-#define AR_GPIO_OUTPUT_MUX2                      0x4064
-#define AR_GPIO_OUTPUT_MUX3                      0x4068
+#define AR_GPIO_OUTPUT_MUX1                      (AR_SREV_9300_20_OR_LATER(ah) ? 0x4068 : 0x4060)
+#define AR_GPIO_OUTPUT_MUX2                      (AR_SREV_9300_20_OR_LATER(ah) ? 0x406c : 0x4064)
+#define AR_GPIO_OUTPUT_MUX3                      (AR_SREV_9300_20_OR_LATER(ah) ? 0x4070 : 0x4068)
 
-#define AR_INPUT_STATE                           0x406c
+#define AR_INPUT_STATE                           (AR_SREV_9300_20_OR_LATER(ah) ? 0x4074 : 0x406c)
 
-#define AR_EEPROM_STATUS_DATA                    0x407c
+#define AR_EEPROM_STATUS_DATA                    (AR_SREV_9300_20_OR_LATER(ah) ? 0x4084 : 0x407c)
 #define AR_EEPROM_STATUS_DATA_VAL                0x0000ffff
 #define AR_EEPROM_STATUS_DATA_VAL_S              0
 #define AR_EEPROM_STATUS_DATA_BUSY               0x00010000
@@ -1015,13 +1050,24 @@ enum {
 #define AR_EEPROM_STATUS_DATA_PROT_ACCESS        0x00040000
 #define AR_EEPROM_STATUS_DATA_ABSENT_ACCESS      0x00080000
 
-#define AR_OBS                  0x4080
+#define AR_OBS                  (AR_SREV_9300_20_OR_LATER(ah) ? 0x4088 : 0x4080)
 
-#define AR_GPIO_PDPU                             0x4088
+#define AR_GPIO_PDPU                             (AR_SREV_9300_20_OR_LATER(ah) ? 0x4090 : 0x4088)
 
-#define AR_PCIE_MSI                              0x4094
+#define AR_PCIE_MSI                              (AR_SREV_9300_20_OR_LATER(ah) ? 0x40a4 : 0x4094)
 #define AR_PCIE_MSI_ENABLE                       0x00000001
 
+#define AR_INTR_PRIO_SYNC_ENABLE  0x40c4
+#define AR_INTR_PRIO_ASYNC_MASK   0x40c8
+#define AR_INTR_PRIO_SYNC_MASK    0x40cc
+#define AR_INTR_PRIO_ASYNC_ENABLE 0x40d4
+
+#define AR_RTC_9300_PLL_DIV          0x000003ff
+#define AR_RTC_9300_PLL_DIV_S        0
+#define AR_RTC_9300_PLL_REFDIV       0x00003C00
+#define AR_RTC_9300_PLL_REFDIV_S     10
+#define AR_RTC_9300_PLL_CLKSEL       0x0000C000
+#define AR_RTC_9300_PLL_CLKSEL_S     14
 
 #define AR_RTC_9160_PLL_DIV     0x000003ff
 #define AR_RTC_9160_PLL_DIV_S   0
@@ -1039,6 +1085,16 @@ enum {
 #define AR_RTC_RC_COLD_RESET    0x00000004
 #define AR_RTC_RC_WARM_RESET    0x00000008
 
+/* Crystal Control */
+#define AR_RTC_XTAL_CONTROL     0x7004
+
+/* Reg Control 0 */
+#define AR_RTC_REG_CONTROL0     0x7008
+
+/* Reg Control 1 */
+#define AR_RTC_REG_CONTROL1     0x700c
+#define AR_RTC_REG_CONTROL1_SWREG_PROGRAM       0x00000001
+
 #define AR_RTC_PLL_CONTROL \
         ((AR_SREV_9100(ah)) ? (AR_RTC_BASE + 0x0014) : 0x7014)
 
@@ -1069,6 +1125,7 @@ enum {
 #define AR_RTC_SLEEP_CLK \
         ((AR_SREV_9100(ah)) ? (AR_RTC_BASE + 0x0048) : 0x7048)
 #define AR_RTC_FORCE_DERIVED_CLK    0x2
+#define AR_RTC_FORCE_SWREG_PRD      0x00000004
 
 #define AR_RTC_FORCE_WAKE \
         ((AR_SREV_9100(ah)) ? (AR_RTC_BASE + 0x004c) : 0x704c)
@@ -1533,7 +1590,7 @@ enum {
 #define AR_TSFOOR_THRESHOLD       0x813c
 #define AR_TSFOOR_THRESHOLD_VAL   0x0000FFFF
 
-#define AR_PHY_ERR_EIFS_MASK   8144
+#define AR_PHY_ERR_EIFS_MASK   0x8144
 
 #define AR_PHY_ERR_3           0x8168
 #define AR_PHY_ERR_3_COUNT     0x00FFFFFF
@@ -1599,24 +1656,26 @@ enum {
 #define AR_FIRST_NDP_TIMER                  7
 #define AR_NDP2_PERIOD                      0x81a0
 #define AR_NDP2_TIMER_MODE                  0x81c0
-#define AR_NEXT_TBTT_TIMER                  0x8200
-#define AR_NEXT_DMA_BEACON_ALERT            0x8204
-#define AR_NEXT_SWBA                        0x8208
-#define AR_NEXT_CFP                         0x8208
-#define AR_NEXT_HCF                         0x820C
-#define AR_NEXT_TIM                         0x8210
-#define AR_NEXT_DTIM                        0x8214
-#define AR_NEXT_QUIET_TIMER                 0x8218
-#define AR_NEXT_NDP_TIMER                   0x821C
-
-#define AR_BEACON_PERIOD                    0x8220
-#define AR_DMA_BEACON_PERIOD                0x8224
-#define AR_SWBA_PERIOD                      0x8228
-#define AR_HCF_PERIOD                       0x822C
-#define AR_TIM_PERIOD                       0x8230
-#define AR_DTIM_PERIOD                      0x8234
-#define AR_QUIET_PERIOD                     0x8238
-#define AR_NDP_PERIOD                       0x823C
+
+#define AR_GEN_TIMERS(_i)                   (0x8200 + ((_i) << 2))
+#define AR_NEXT_TBTT_TIMER                  AR_GEN_TIMERS(0)
+#define AR_NEXT_DMA_BEACON_ALERT            AR_GEN_TIMERS(1)
+#define AR_NEXT_SWBA                        AR_GEN_TIMERS(2)
+#define AR_NEXT_CFP                         AR_GEN_TIMERS(2)
+#define AR_NEXT_HCF                         AR_GEN_TIMERS(3)
+#define AR_NEXT_TIM                         AR_GEN_TIMERS(4)
+#define AR_NEXT_DTIM                        AR_GEN_TIMERS(5)
+#define AR_NEXT_QUIET_TIMER                 AR_GEN_TIMERS(6)
+#define AR_NEXT_NDP_TIMER                   AR_GEN_TIMERS(7)
+
+#define AR_BEACON_PERIOD                    AR_GEN_TIMERS(8)
+#define AR_DMA_BEACON_PERIOD                AR_GEN_TIMERS(9)
+#define AR_SWBA_PERIOD                      AR_GEN_TIMERS(10)
+#define AR_HCF_PERIOD                       AR_GEN_TIMERS(11)
+#define AR_TIM_PERIOD                       AR_GEN_TIMERS(12)
+#define AR_DTIM_PERIOD                      AR_GEN_TIMERS(13)
+#define AR_QUIET_PERIOD                     AR_GEN_TIMERS(14)
+#define AR_NDP_PERIOD                       AR_GEN_TIMERS(15)
 
 #define AR_TIMER_MODE                       0x8240
 #define AR_TBTT_TIMER_EN                    0x00000001
@@ -1730,4 +1789,32 @@ enum {
 #define AR9271_CORE_CLOCK       117   /* clock to 117Mhz */
 #define AR9271_TARGET_BAUD_RATE 19200 /* 115200 */
 
+#define AR_AGG_WEP_ENABLE_FIX           0x00000008  /* This allows the use of AR_AGG_WEP_ENABLE */
+#define AR_ADHOC_MCAST_KEYID_ENABLE     0x00000040  /* This bit enables the Multicast search
+                                                     * based on both MAC Address and Key ID.
+                                                     * If bit is 0, then Multicast search is
+                                                     * based on MAC address only.
+                                                     * For Merlin and above only.
+                                                     */
+#define AR_AGG_WEP_ENABLE               0x00020000  /* This field enables AGG_WEP feature,
+                                                     * when it is enable, AGG_WEP would takes
+                                                     * charge of the encryption interface of
+                                                     * pcu_txsm.
+                                                     */
+
+#define AR9300_SM_BASE                          0xa200
+#define AR9002_PHY_AGC_CONTROL                  0x9860
+#define AR9003_PHY_AGC_CONTROL                  AR9300_SM_BASE + 0xc4
+#define AR_PHY_AGC_CONTROL                      (AR_SREV_9300_20_OR_LATER(ah) ? AR9003_PHY_AGC_CONTROL : AR9002_PHY_AGC_CONTROL)
+#define AR_PHY_AGC_CONTROL_CAL                  0x00000001  /* do internal calibration */
+#define AR_PHY_AGC_CONTROL_NF                   0x00000002  /* do noise-floor calibration */
+#define AR_PHY_AGC_CONTROL_OFFSET_CAL           0x00000800  /* allow offset calibration */
+#define AR_PHY_AGC_CONTROL_ENABLE_NF            0x00008000  /* enable noise floor calibration to happen */
+#define AR_PHY_AGC_CONTROL_FLTR_CAL             0x00010000  /* allow tx filter calibration */
+#define AR_PHY_AGC_CONTROL_NO_UPDATE_NF         0x00020000  /* don't update noise floor automatically */
+#define AR_PHY_AGC_CONTROL_EXT_NF_PWR_MEAS      0x00040000  /* extend noise floor power measurement */
+#define AR_PHY_AGC_CONTROL_CLC_SUCCESS          0x00080000  /* carrier leak calibration done */
+#define AR_PHY_AGC_CONTROL_YCOK_MAX             0x000003c0
+#define AR_PHY_AGC_CONTROL_YCOK_MAX_S           6
+
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index f2ff18cf3e60..e23172c9caaf 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -101,6 +101,7 @@ struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv)
         wmi->drv_priv = priv;
         wmi->stopped = false;
         mutex_init(&wmi->op_mutex);
+        mutex_init(&wmi->multi_write_mutex);
         init_completion(&wmi->cmd_wait);
 
         return wmi;
@@ -128,7 +129,7 @@ void ath9k_wmi_tasklet(unsigned long data)
         void *wmi_event;
         unsigned long flags;
 #ifdef CONFIG_ATH9K_HTC_DEBUGFS
-        u32 txrate;
+        __be32 txrate;
 #endif
 
         spin_lock_irqsave(&priv->wmi->wmi_lock, flags);
@@ -203,6 +204,14 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
                 return;
         }
 
+        /* Check if there has been a timeout. */
+        spin_lock(&wmi->wmi_lock);
+        if (cmd_id != wmi->last_cmd_id) {
+                spin_unlock(&wmi->wmi_lock);
+                goto free_skb;
+        }
+        spin_unlock(&wmi->wmi_lock);
+
         /* WMI command response */
         ath9k_wmi_rsp_callback(wmi, skb);
 
@@ -265,6 +274,10 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
         struct sk_buff *skb;
         u8 *data;
         int time_left, ret = 0;
+        unsigned long flags;
+
+        if (wmi->drv_priv->op_flags & OP_UNPLUGGED)
+                return 0;
 
         if (!wmi)
                 return -EINVAL;
@@ -292,6 +305,10 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
         wmi->cmd_rsp_buf = rsp_buf;
         wmi->cmd_rsp_len = rsp_len;
 
+        spin_lock_irqsave(&wmi->wmi_lock, flags);
+        wmi->last_cmd_id = cmd_id;
+        spin_unlock_irqrestore(&wmi->wmi_lock, flags);
+
         ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/ath/ath9k/wmi.h b/drivers/net/wireless/ath/ath9k/wmi.h
index 39ef926f27c2..765db5faa2d3 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.h
+++ b/drivers/net/wireless/ath/ath9k/wmi.h
@@ -19,7 +19,7 @@
 
 
 struct wmi_event_txrate {
-        u32 txrate;
+        __be32 txrate;
         struct {
                 u8 rssi_thresh;
                 u8 per;
@@ -27,8 +27,8 @@ struct wmi_event_txrate {
 } __packed;
 
 struct wmi_cmd_hdr {
-        u16 command_id;
-        u16 seq_no;
+        __be16 command_id;
+        __be16 seq_no;
 } __packed;
 
 struct wmi_swba {
@@ -84,12 +84,20 @@ enum wmi_event_id {
         WMI_TXRATE_EVENTID,
 };
 
+#define MAX_CMD_NUMBER 62
+
+struct register_write {
+        __be32 reg;
+        __be32 val;
+};
+
 struct wmi {
         struct ath9k_htc_priv *drv_priv;
         struct htc_target *htc;
         enum htc_endpoint_id ctrl_epid;
         struct mutex op_mutex;
         struct completion cmd_wait;
+        enum wmi_cmd_id last_cmd_id;
         u16 tx_seq_id;
         u8 *cmd_rsp_buf;
         u32 cmd_rsp_len;
@@ -97,6 +105,11 @@ struct wmi {
 
         struct sk_buff *wmi_skb;
         spinlock_t wmi_lock;
+
+        atomic_t mwrite_cnt;
+        struct register_write multi_write[MAX_CMD_NUMBER];
+        u32 multi_write_idx;
+        struct mutex multi_write_mutex;
 };
 
 struct wmi *ath9k_init_wmi(struct ath9k_htc_priv *priv);
@@ -113,14 +126,14 @@ void ath9k_wmi_tasklet(unsigned long data);
         do {                                                            \
                 ret = ath9k_wmi_cmd(priv->wmi, _wmi_cmd, NULL, 0,       \
                                     (u8 *) &cmd_rsp,                    \
-                                    sizeof(cmd_rsp), HZ);               \
+                                    sizeof(cmd_rsp), HZ*2);             \
         } while (0)
 
 #define WMI_CMD_BUF(_wmi_cmd, _buf)                                     \
         do {                                                            \
                 ret = ath9k_wmi_cmd(priv->wmi, _wmi_cmd,                \
                                     (u8 *) _buf, sizeof(*_buf),         \
-                                    &cmd_rsp, sizeof(cmd_rsp), HZ);     \
+                                    &cmd_rsp, sizeof(cmd_rsp), HZ*2);   \
         } while (0)
 
 #endif /* WMI_H */
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 02df4cbf179f..3db19172b43b 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -15,10 +15,11 @@
  */
 
 #include "ath9k.h"
+#include "ar9003_mac.h"
 
 #define BITS_PER_BYTE           8
 #define OFDM_PLCP_BITS          22
-#define HT_RC_2_MCS(_rc)        ((_rc) & 0x0f)
+#define HT_RC_2_MCS(_rc)        ((_rc) & 0x1f)
 #define HT_RC_2_STREAMS(_rc)    ((((_rc) & 0x78) >> 3) + 1)
 #define L_STF                   8
 #define L_LTF                   8
@@ -33,7 +34,7 @@
 
 #define OFDM_SIFS_TIME              16
 
-static u32 bits_per_symbol[][2] = {
+static u16 bits_per_symbol[][2] = {
         /* 20MHz 40MHz */
         {    26,   54 },     /*  0: BPSK */
         {    52,  108 },     /*  1: QPSK 1/2 */
@@ -43,14 +44,6 @@ static u32 bits_per_symbol[][2] = {
         {   208,  432 },     /*  5: 64-QAM 2/3 */
         {   234,  486 },     /*  6: 64-QAM 3/4 */
         {   260,  540 },     /*  7: 64-QAM 5/6 */
-        {    52,  108 },     /*  8: BPSK */
-        {   104,  216 },     /*  9: QPSK 1/2 */
-        {   156,  324 },     /* 10: QPSK 3/4 */
-        {   208,  432 },     /* 11: 16-QAM 1/2 */
-        {   312,  648 },     /* 12: 16-QAM 3/4 */
-        {   416,  864 },     /* 13: 64-QAM 2/3 */
-        {   468,  972 },     /* 14: 64-QAM 3/4 */
-        {   520, 1080 },     /* 15: 64-QAM 5/6 */
 };
 
 #define IS_HT_RATE(_rate)     ((_rate) & 0x80)
@@ -70,28 +63,39 @@ static void ath_tx_rc_status(struct ath_buf *bf, struct ath_tx_status *ts,
                              int nbad, int txok, bool update_rc);
 
 enum {
-        MCS_DEFAULT,
+        MCS_HT20,
+        MCS_HT20_SGI,
         MCS_HT40,
         MCS_HT40_SGI,
 };
 
-static int ath_max_4ms_framelen[3][16] = {
-        [MCS_DEFAULT] = {
-                3216,  6434,  9650,  12868, 19304, 25740,  28956,  32180,
-                6430,  12860, 19300, 25736, 38600, 51472,  57890,  64320,
+static int ath_max_4ms_framelen[4][32] = {
+        [MCS_HT20] = {
+                3212,  6432,  9648,  12864,  19300,  25736,  28952,  32172,
+                6424,  12852, 19280, 25708,  38568,  51424,  57852,  64280,
+                9628,  19260, 28896, 38528,  57792,  65532,  65532,  65532,
+                12828, 25656, 38488, 51320,  65532,  65532,  65532,  65532,
+        },
+        [MCS_HT20_SGI] = {
+                3572,  7144,  10720,  14296,  21444,  28596,  32172,  35744,
+                7140,  14284, 21428,  28568,  42856,  57144,  64288,  65532,
+                10700, 21408, 32112,  42816,  64228,  65532,  65532,  65532,
+                14256, 28516, 42780,  57040,  65532,  65532,  65532,  65532,
         },
         [MCS_HT40] = {
-                6684,  13368, 20052, 26738, 40104, 53476,  60156,  66840,
-                13360, 26720, 40080, 53440, 80160, 106880, 120240, 133600,
+                6680,  13360,  20044,  26724,  40092,  53456,  60140,  65532,
+                13348, 26700,  40052,  53400,  65532,  65532,  65532,  65532,
+                20004, 40008,  60016,  65532,  65532,  65532,  65532,  65532,
+                26644, 53292,  65532,  65532,  65532,  65532,  65532,  65532,
         },
         [MCS_HT40_SGI] = {
-                /* TODO: Only MCS 7 and 15 updated, recalculate the rest */
-                6684,  13368, 20052, 26738, 40104, 53476,  60156,  74200,
-                13360, 26720, 40080, 53440, 80160, 106880, 120240, 148400,
+                7420,  14844,  22272,  29696,  44544,  59396,  65532,  65532,
+                14832, 29668,  44504,  59340,  65532,  65532,  65532,  65532,
+                22232, 44464,  65532,  65532,  65532,  65532,  65532,  65532,
+                29616, 59232,  65532,  65532,  65532,  65532,  65532,  65532,
         }
 };
 
-
 /*********************/
 /* Aggregation logic */
 /*********************/
@@ -261,25 +265,46 @@ static void ath_tx_set_retry(struct ath_softc *sc, struct ath_txq *txq,
         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_RETRY);
 }
 
-static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
+static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
 {
-        struct ath_buf *tbf;
+        struct ath_buf *bf = NULL;
 
         spin_lock_bh(&sc->tx.txbuflock);
-        if (WARN_ON(list_empty(&sc->tx.txbuf))) {
+
+        if (unlikely(list_empty(&sc->tx.txbuf))) {
                 spin_unlock_bh(&sc->tx.txbuflock);
                 return NULL;
         }
-        tbf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
-        list_del(&tbf->list);
+
+        bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
+        list_del(&bf->list);
+
         spin_unlock_bh(&sc->tx.txbuflock);
 
+        return bf;
+}
+
+static void ath_tx_return_buffer(struct ath_softc *sc, struct ath_buf *bf)
+{
+        spin_lock_bh(&sc->tx.txbuflock);
+        list_add_tail(&bf->list, &sc->tx.txbuf);
+        spin_unlock_bh(&sc->tx.txbuflock);
+}
+
+static struct ath_buf* ath_clone_txbuf(struct ath_softc *sc, struct ath_buf *bf)
+{
+        struct ath_buf *tbf;
+
+        tbf = ath_tx_get_buffer(sc);
+        if (WARN_ON(!tbf))
+                return NULL;
+
         ATH_TXBUF_RESET(tbf);
 
         tbf->aphy = bf->aphy;
         tbf->bf_mpdu = bf->bf_mpdu;
         tbf->bf_buf_addr = bf->bf_buf_addr;
-        *(tbf->bf_desc) = *(bf->bf_desc);
+        memcpy(tbf->bf_desc, bf->bf_desc, sc->sc_ah->caps.tx_desc_len);
         tbf->bf_state = bf->bf_state;
         tbf->bf_dmacontext = bf->bf_dmacontext;
 
@@ -359,7 +384,7 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         acked_cnt++;
                 } else {
                         if (!(tid->state & AGGR_CLEANUP) &&
-                            ts->ts_flags != ATH9K_TX_SW_ABORTED) {
+                            !bf_last->bf_tx_aborted) {
                                 if (bf->bf_retries < ATH_MAX_SW_RETRIES) {
                                         ath_tx_set_retry(sc, txq, bf);
                                         txpending = 1;
@@ -378,7 +403,8 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                         }
                 }
 
-                if (bf_next == NULL) {
+                if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
+                    bf_next == NULL) {
                         /*
                          * Make sure the last desc is reclaimed if it
                          * not a holding desc.
@@ -412,36 +438,43 @@ static void ath_tx_complete_aggr(struct ath_softc *sc, struct ath_txq *txq,
                                 !txfail, sendbar);
                 } else {
                         /* retry the un-acked ones */
-                        if (bf->bf_next == NULL && bf_last->bf_stale) {
-                                struct ath_buf *tbf;
-
-                                tbf = ath_clone_txbuf(sc, bf_last);
-                                /*
-                                 * Update tx baw and complete the frame with
-                                 * failed status if we run out of tx buf
-                                 */
-                                if (!tbf) {
-                                        spin_lock_bh(&txq->axq_lock);
-                                        ath_tx_update_baw(sc, tid,
-                                                          bf->bf_seqno);
-                                        spin_unlock_bh(&txq->axq_lock);
-
-                                        bf->bf_state.bf_type |= BUF_XRETRY;
-                                        ath_tx_rc_status(bf, ts, nbad,
-                                                         0, false);
-                                        ath_tx_complete_buf(sc, bf, txq,
-                                                            &bf_head, ts, 0, 0);
-                                        break;
+                        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)) {
+                                if (bf->bf_next == NULL && bf_last->bf_stale) {
+                                        struct ath_buf *tbf;
+
+                                        tbf = ath_clone_txbuf(sc, bf_last);
+                                        /*
+                                         * Update tx baw and complete the
+                                         * frame with failed status if we
+                                         * run out of tx buf.
+                                         */
+                                        if (!tbf) {
+                                                spin_lock_bh(&txq->axq_lock);
+                                                ath_tx_update_baw(sc, tid,
+                                                                bf->bf_seqno);
+                                                spin_unlock_bh(&txq->axq_lock);
+
+                                                bf->bf_state.bf_type |=
+                                                        BUF_XRETRY;
+                                                ath_tx_rc_status(bf, ts, nbad,
+                                                                0, false);
+                                                ath_tx_complete_buf(sc, bf, txq,
+                                                                    &bf_head,
+                                                                    ts, 0, 0);
+                                                break;
+                                        }
+
+                                        ath9k_hw_cleartxdesc(sc->sc_ah,
+                                                             tbf->bf_desc);
+                                        list_add_tail(&tbf->list, &bf_head);
+                                } else {
+                                        /*
+                                         * Clear descriptor status words for
+                                         * software retry
+                                         */
+                                        ath9k_hw_cleartxdesc(sc->sc_ah,
+                                                             bf->bf_desc);
                                 }
-
-                                ath9k_hw_cleartxdesc(sc->sc_ah, tbf->bf_desc);
-                                list_add_tail(&tbf->list, &bf_head);
-                        } else {
-                                /*
-                                 * Clear descriptor status words for
-                                 * software retry
-                                 */
-                                ath9k_hw_cleartxdesc(sc->sc_ah, bf->bf_desc);
                         }
 
                         /*
@@ -509,12 +542,13 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
                                 break;
                         }
 
-                        if (rates[i].flags & IEEE80211_TX_RC_SHORT_GI)
-                                modeidx = MCS_HT40_SGI;
-                        else if (rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
+                        if (rates[i].flags & IEEE80211_TX_RC_40_MHZ_WIDTH)
                                 modeidx = MCS_HT40;
                         else
-                                modeidx = MCS_DEFAULT;
+                                modeidx = MCS_HT20;
+
+                        if (rates[i].flags & IEEE80211_TX_RC_SHORT_GI)
+                                modeidx++;
 
                         frmlen = ath_max_4ms_framelen[modeidx][rates[i].idx];
                         max_4ms_framelen = min(max_4ms_framelen, frmlen);
@@ -559,7 +593,7 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         u32 nsymbits, nsymbols;
         u16 minlen;
         u8 flags, rix;
-        int width, half_gi, ndelim, mindelim;
+        int width, streams, half_gi, ndelim, mindelim;
 
         /* Select standard number of delimiters based on frame length alone */
         ndelim = ATH_AGGR_GET_NDELIM(frmlen);
@@ -599,7 +633,8 @@ static int ath_compute_num_delims(struct ath_softc *sc, struct ath_atx_tid *tid,
         if (nsymbols == 0)
                 nsymbols = 1;
 
-        nsymbits = bits_per_symbol[rix][width];
+        streams = HT_RC_2_STREAMS(rix);
+        nsymbits = bits_per_symbol[rix % 8][width] * streams;
         minlen = (nsymbols * nsymbits) / BITS_PER_BYTE;
 
         if (frmlen < minlen) {
@@ -665,7 +700,7 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                 bpad = PADBYTES(al_delta) + (ndelim << 2);
 
                 bf->bf_next = NULL;
-                bf->bf_desc->ds_link = 0;
+                ath9k_hw_set_desc_link(sc->sc_ah, bf->bf_desc, 0);
 
                 /* link buffers of this frame to the aggregate */
                 ath_tx_addto_baw(sc, tid, bf);
@@ -673,7 +708,8 @@ static enum ATH_AGGR_STATUS ath_tx_form_aggr(struct ath_softc *sc,
                 list_move_tail(&bf->list, bf_q);
                 if (bf_prev) {
                         bf_prev->bf_next = bf;
-                        bf_prev->bf_desc->ds_link = bf->bf_daddr;
+                        ath9k_hw_set_desc_link(sc->sc_ah, bf_prev->bf_desc,
+                                               bf->bf_daddr);
                 }
                 bf_prev = bf;
 
@@ -853,7 +889,7 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_tx_queue_info qi;
-        int qnum;
+        int qnum, i;
 
         memset(&qi, 0, sizeof(qi));
         qi.tqi_subtype = subtype;
@@ -877,11 +913,16 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
          * The UAPSD queue is an exception, since we take a desc-
          * based intr on the EOSP frames.
          */
-        if (qtype == ATH9K_TX_QUEUE_UAPSD)
-                qi.tqi_qflags = TXQ_FLAG_TXDESCINT_ENABLE;
-        else
-                qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE |
-                        TXQ_FLAG_TXDESCINT_ENABLE;
+        if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                qi.tqi_qflags = TXQ_FLAG_TXOKINT_ENABLE |
+                                TXQ_FLAG_TXERRINT_ENABLE;
+        } else {
+                if (qtype == ATH9K_TX_QUEUE_UAPSD)
+                        qi.tqi_qflags = TXQ_FLAG_TXDESCINT_ENABLE;
+                else
+                        qi.tqi_qflags = TXQ_FLAG_TXEOLINT_ENABLE |
+                                        TXQ_FLAG_TXDESCINT_ENABLE;
+        }
         qnum = ath9k_hw_setuptxqueue(ah, qtype, &qi);
         if (qnum == -1) {
                 /*
@@ -908,6 +949,11 @@ struct ath_txq *ath_txq_setup(struct ath_softc *sc, int qtype, int subtype)
                 txq->axq_depth = 0;
                 txq->axq_tx_inprogress = false;
                 sc->tx.txqsetup |= 1<<qnum;
+
+                txq->txq_headidx = txq->txq_tailidx = 0;
+                for (i = 0; i < ATH_TXFIFO_DEPTH; i++)
+                        INIT_LIST_HEAD(&txq->txq_fifo[i]);
+                INIT_LIST_HEAD(&txq->txq_fifo_pending);
         }
         return &sc->tx.txq[qnum];
 }
@@ -1035,36 +1081,52 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
         struct ath_tx_status ts;
 
         memset(&ts, 0, sizeof(ts));
-        if (!retry_tx)
-                ts.ts_flags = ATH9K_TX_SW_ABORTED;
-
         INIT_LIST_HEAD(&bf_head);
 
         for (;;) {
                 spin_lock_bh(&txq->axq_lock);
 
-                if (list_empty(&txq->axq_q)) {
-                        txq->axq_link = NULL;
-                        spin_unlock_bh(&txq->axq_lock);
-                        break;
-                }
-
-                bf = list_first_entry(&txq->axq_q, struct ath_buf, list);
+                if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                        if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
+                                txq->txq_headidx = txq->txq_tailidx = 0;
+                                spin_unlock_bh(&txq->axq_lock);
+                                break;
+                        } else {
+                                bf = list_first_entry(&txq->txq_fifo[txq->txq_tailidx],
+                                                      struct ath_buf, list);
+                        }
+                } else {
+                        if (list_empty(&txq->axq_q)) {
+                                txq->axq_link = NULL;
+                                spin_unlock_bh(&txq->axq_lock);
+                                break;
+                        }
+                        bf = list_first_entry(&txq->axq_q, struct ath_buf,
+                                              list);
 
-                if (bf->bf_stale) {
-                        list_del(&bf->list);
-                        spin_unlock_bh(&txq->axq_lock);
+                        if (bf->bf_stale) {
+                                list_del(&bf->list);
+                                spin_unlock_bh(&txq->axq_lock);
 
-                        spin_lock_bh(&sc->tx.txbuflock);
-                        list_add_tail(&bf->list, &sc->tx.txbuf);
-                        spin_unlock_bh(&sc->tx.txbuflock);
-                        continue;
+                                ath_tx_return_buffer(sc, bf);
+                                continue;
+                        }
                 }
 
                 lastbf = bf->bf_lastbf;
+                if (!retry_tx)
+                        lastbf->bf_tx_aborted = true;
+
+                if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                        list_cut_position(&bf_head,
+                                          &txq->txq_fifo[txq->txq_tailidx],
+                                          &lastbf->list);
+                        INCR(txq->txq_tailidx, ATH_TXFIFO_DEPTH);
+                } else {
+                        /* remove ath_buf's of the same mpdu from txq */
+                        list_cut_position(&bf_head, &txq->axq_q, &lastbf->list);
+                }
 
-                /* remove ath_buf's of the same mpdu from txq */
-                list_cut_position(&bf_head, &txq->axq_q, &lastbf->list);
                 txq->axq_depth--;
 
                 spin_unlock_bh(&txq->axq_lock);
@@ -1087,6 +1149,27 @@ void ath_draintxq(struct ath_softc *sc, struct ath_txq *txq, bool retry_tx)
                         spin_unlock_bh(&txq->axq_lock);
                 }
         }
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                spin_lock_bh(&txq->axq_lock);
+                while (!list_empty(&txq->txq_fifo_pending)) {
+                        bf = list_first_entry(&txq->txq_fifo_pending,
+                                              struct ath_buf, list);
+                        list_cut_position(&bf_head,
+                                          &txq->txq_fifo_pending,
+                                          &bf->bf_lastbf->list);
+                        spin_unlock_bh(&txq->axq_lock);
+
+                        if (bf_isampdu(bf))
+                                ath_tx_complete_aggr(sc, txq, bf, &bf_head,
+                                                     &ts, 0);
+                        else
+                                ath_tx_complete_buf(sc, bf, txq, &bf_head,
+                                                    &ts, 0, 0);
+                        spin_lock_bh(&txq->axq_lock);
+                }
+                spin_unlock_bh(&txq->axq_lock);
+        }
 }
 
 void ath_drain_all_txq(struct ath_softc *sc, bool retry_tx)
@@ -1224,44 +1307,47 @@ static void ath_tx_txqaddbuf(struct ath_softc *sc, struct ath_txq *txq,
 
         bf = list_first_entry(head, struct ath_buf, list);
 
-        list_splice_tail_init(head, &txq->axq_q);
-        txq->axq_depth++;
-
         ath_print(common, ATH_DBG_QUEUE,
                   "qnum: %d, txq depth: %d\n", txq->axq_qnum, txq->axq_depth);
 
-        if (txq->axq_link == NULL) {
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                if (txq->axq_depth >= ATH_TXFIFO_DEPTH) {
+                        list_splice_tail_init(head, &txq->txq_fifo_pending);
+                        return;
+                }
+                if (!list_empty(&txq->txq_fifo[txq->txq_headidx]))
+                        ath_print(common, ATH_DBG_XMIT,
+                                  "Initializing tx fifo %d which "
+                                  "is non-empty\n",
+                                  txq->txq_headidx);
+                INIT_LIST_HEAD(&txq->txq_fifo[txq->txq_headidx]);
+                list_splice_init(head, &txq->txq_fifo[txq->txq_headidx]);
+                INCR(txq->txq_headidx, ATH_TXFIFO_DEPTH);
                 ath9k_hw_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
                 ath_print(common, ATH_DBG_XMIT,
                           "TXDP[%u] = %llx (%p)\n",
                           txq->axq_qnum, ito64(bf->bf_daddr), bf->bf_desc);
         } else {
-                *txq->axq_link = bf->bf_daddr;
-                ath_print(common, ATH_DBG_XMIT, "link[%u] (%p)=%llx (%p)\n",
-                          txq->axq_qnum, txq->axq_link,
-                          ito64(bf->bf_daddr), bf->bf_desc);
-        }
-        txq->axq_link = &(bf->bf_lastbf->bf_desc->ds_link);
-        ath9k_hw_txstart(ah, txq->axq_qnum);
-}
-
-static struct ath_buf *ath_tx_get_buffer(struct ath_softc *sc)
-{
-        struct ath_buf *bf = NULL;
+                list_splice_tail_init(head, &txq->axq_q);
 
-        spin_lock_bh(&sc->tx.txbuflock);
-
-        if (unlikely(list_empty(&sc->tx.txbuf))) {
-                spin_unlock_bh(&sc->tx.txbuflock);
-                return NULL;
+                if (txq->axq_link == NULL) {
+                        ath9k_hw_puttxbuf(ah, txq->axq_qnum, bf->bf_daddr);
+                        ath_print(common, ATH_DBG_XMIT,
+                                        "TXDP[%u] = %llx (%p)\n",
+                                        txq->axq_qnum, ito64(bf->bf_daddr),
+                                        bf->bf_desc);
+                } else {
+                        *txq->axq_link = bf->bf_daddr;
+                        ath_print(common, ATH_DBG_XMIT,
+                                        "link[%u] (%p)=%llx (%p)\n",
+                                        txq->axq_qnum, txq->axq_link,
+                                        ito64(bf->bf_daddr), bf->bf_desc);
+                }
+                ath9k_hw_get_desc_link(ah, bf->bf_lastbf->bf_desc,
+                                       &txq->axq_link);
+                ath9k_hw_txstart(ah, txq->axq_qnum);
         }
-
-        bf = list_first_entry(&sc->tx.txbuf, struct ath_buf, list);
-        list_del(&bf->list);
-
-        spin_unlock_bh(&sc->tx.txbuflock);
-
-        return bf;
+        txq->axq_depth++;
 }
 
 static void ath_tx_send_ampdu(struct ath_softc *sc, struct ath_atx_tid *tid,
@@ -1408,8 +1494,7 @@ static void assign_aggr_tid_seqno(struct sk_buff *skb,
         INCR(tid->seq_next, IEEE80211_SEQ_MAX);
 }
 
-static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
-                          struct ath_txq *txq)
+static int setup_tx_flags(struct sk_buff *skb, bool use_ldpc)
 {
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         int flags = 0;
@@ -1420,6 +1505,9 @@ static int setup_tx_flags(struct ath_softc *sc, struct sk_buff *skb,
         if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
                 flags |= ATH9K_TXDESC_NOACK;
 
+        if (use_ldpc)
+                flags |= ATH9K_TXDESC_LDPC;
+
         return flags;
 }
 
@@ -1438,8 +1526,9 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
         pktlen = bf_isaggr(bf) ? bf->bf_al : bf->bf_frmlen;
 
         /* find number of symbols: PLCP + data */
+        streams = HT_RC_2_STREAMS(rix);
         nbits = (pktlen << 3) + OFDM_PLCP_BITS;
-        nsymbits = bits_per_symbol[rix][width];
+        nsymbits = bits_per_symbol[rix % 8][width] * streams;
         nsymbols = (nbits + nsymbits - 1) / nsymbits;
 
         if (!half_gi)
@@ -1448,7 +1537,6 @@ static u32 ath_pkt_duration(struct ath_softc *sc, u8 rix, struct ath_buf *bf,
                 duration = SYMBOL_TIME_HALFGI(nsymbols);
 
         /* addup duration for legacy/ht training and signal fields */
-        streams = HT_RC_2_STREAMS(rix);
         duration += L_STF + L_LTF + L_SIG + HT_SIG + HT_STF + HT_LTF(streams);
 
         return duration;
@@ -1519,6 +1607,8 @@ static void ath_buf_set_rate(struct ath_softc *sc, struct ath_buf *bf)
                         series[i].Rate = rix | 0x80;
                         series[i].PktDuration = ath_pkt_duration(sc, rix, bf,
                                  is_40, is_sgi, is_sp);
+                        if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
+                                series[i].RateFlags |= ATH9K_RATESERIES_STBC;
                         continue;
                 }
 
@@ -1571,6 +1661,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
         int hdrlen;
         __le16 fc;
         int padpos, padsize;
+        bool use_ldpc = false;
 
         tx_info->pad[0] = 0;
         switch (txctl->frame_type) {
@@ -1597,10 +1688,13 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf))
+        if (conf_is_ht(&hw->conf)) {
                 bf->bf_state.bf_type |= BUF_HT;
+                if (tx_info->flags & IEEE80211_TX_CTL_LDPC)
+                        use_ldpc = true;
+        }
 
-        bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
+        bf->bf_flags = setup_tx_flags(skb, use_ldpc);
 
         bf->bf_keytype = get_hw_crypto_keytype(skb);
         if (bf->bf_keytype != ATH9K_KEY_TYPE_CLEAR) {
@@ -1659,8 +1753,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
         list_add_tail(&bf->list, &bf_head);
 
         ds = bf->bf_desc;
-        ds->ds_link = 0;
-        ds->ds_data = bf->bf_buf_addr;
+        ath9k_hw_set_desc_link(ah, ds, 0);
 
         ath9k_hw_set11n_txdesc(ah, ds, bf->bf_frmlen, frm_type, MAX_RATE_POWER,
                                bf->bf_keyix, bf->bf_keytype, bf->bf_flags);
@@ -1669,7 +1762,9 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                             skb->len,   /* segment length */
                             true,       /* first segment */
                             true,       /* last segment */
-                            ds);        /* first descriptor */
+                            ds,         /* first descriptor */
+                            bf->bf_buf_addr,
+                            txctl->txq->axq_qnum);
 
         spin_lock_bh(&txctl->txq->axq_lock);
 
@@ -1738,9 +1833,7 @@ int ath_tx_start(struct ieee80211_hw *hw, struct sk_buff *skb,
                 }
                 spin_unlock_bh(&txq->axq_lock);
 
-                spin_lock_bh(&sc->tx.txbuflock);
-                list_add_tail(&bf->list, &sc->tx.txbuf);
-                spin_unlock_bh(&sc->tx.txbuflock);
+                ath_tx_return_buffer(sc, bf);
 
                 return r;
         }
@@ -1896,7 +1989,7 @@ static int ath_tx_num_badfrms(struct ath_softc *sc, struct ath_buf *bf,
         int nbad = 0;
         int isaggr = 0;
 
-        if (ts->ts_flags == ATH9K_TX_SW_ABORTED)
+        if (bf->bf_tx_aborted)
                 return 0;
 
         isaggr = bf_isaggr(bf);
@@ -2054,13 +2147,12 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                 txq->axq_depth--;
                 txok = !(ts.ts_status & ATH9K_TXERR_MASK);
                 txq->axq_tx_inprogress = false;
+                if (bf_held)
+                        list_del(&bf_held->list);
                 spin_unlock_bh(&txq->axq_lock);
 
-                if (bf_held) {
-                        spin_lock_bh(&sc->tx.txbuflock);
-                        list_move_tail(&bf_held->list, &sc->tx.txbuf);
-                        spin_unlock_bh(&sc->tx.txbuflock);
-                }
+                if (bf_held)
+                        ath_tx_return_buffer(sc, bf_held);
 
                 if (!bf_isampdu(bf)) {
                         /*
@@ -2138,10 +2230,121 @@ void ath_tx_tasklet(struct ath_softc *sc)
         }
 }
 
+void ath_tx_edma_tasklet(struct ath_softc *sc)
+{
+        struct ath_tx_status txs;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_txq *txq;
+        struct ath_buf *bf, *lastbf;
+        struct list_head bf_head;
+        int status;
+        int txok;
+
+        for (;;) {
+                status = ath9k_hw_txprocdesc(ah, NULL, (void *)&txs);
+                if (status == -EINPROGRESS)
+                        break;
+                if (status == -EIO) {
+                        ath_print(common, ATH_DBG_XMIT,
+                                  "Error processing tx status\n");
+                        break;
+                }
+
+                /* Skip beacon completions */
+                if (txs.qid == sc->beacon.beaconq)
+                        continue;
+
+                txq = &sc->tx.txq[txs.qid];
+
+                spin_lock_bh(&txq->axq_lock);
+                if (list_empty(&txq->txq_fifo[txq->txq_tailidx])) {
+                        spin_unlock_bh(&txq->axq_lock);
+                        return;
+                }
+
+                bf = list_first_entry(&txq->txq_fifo[txq->txq_tailidx],
+                                      struct ath_buf, list);
+                lastbf = bf->bf_lastbf;
+
+                INIT_LIST_HEAD(&bf_head);
+                list_cut_position(&bf_head, &txq->txq_fifo[txq->txq_tailidx],
+                                  &lastbf->list);
+                INCR(txq->txq_tailidx, ATH_TXFIFO_DEPTH);
+                txq->axq_depth--;
+                txq->axq_tx_inprogress = false;
+                spin_unlock_bh(&txq->axq_lock);
+
+                txok = !(txs.ts_status & ATH9K_TXERR_MASK);
+
+                if (!bf_isampdu(bf)) {
+                        bf->bf_retries = txs.ts_longretry;
+                        if (txs.ts_status & ATH9K_TXERR_XRETRY)
+                                bf->bf_state.bf_type |= BUF_XRETRY;
+                        ath_tx_rc_status(bf, &txs, 0, txok, true);
+                }
+
+                if (bf_isampdu(bf))
+                        ath_tx_complete_aggr(sc, txq, bf, &bf_head, &txs, txok);
+                else
+                        ath_tx_complete_buf(sc, bf, txq, &bf_head,
+                                            &txs, txok, 0);
+
+                ath_wake_mac80211_queue(sc, txq);
+
+                spin_lock_bh(&txq->axq_lock);
+                if (!list_empty(&txq->txq_fifo_pending)) {
+                        INIT_LIST_HEAD(&bf_head);
+                        bf = list_first_entry(&txq->txq_fifo_pending,
+                                struct ath_buf, list);
+                        list_cut_position(&bf_head, &txq->txq_fifo_pending,
+                                &bf->bf_lastbf->list);
+                        ath_tx_txqaddbuf(sc, txq, &bf_head);
+                } else if (sc->sc_flags & SC_OP_TXAGGR)
+                        ath_txq_schedule(sc, txq);
+                spin_unlock_bh(&txq->axq_lock);
+        }
+}
+
 /*****************/
 /* Init, Cleanup */
 /*****************/
 
+static int ath_txstatus_setup(struct ath_softc *sc, int size)
+{
+        struct ath_descdma *dd = &sc->txsdma;
+        u8 txs_len = sc->sc_ah->caps.txs_len;
+
+        dd->dd_desc_len = size * txs_len;
+        dd->dd_desc = dma_alloc_coherent(sc->dev, dd->dd_desc_len,
+                                         &dd->dd_desc_paddr, GFP_KERNEL);
+        if (!dd->dd_desc)
+                return -ENOMEM;
+
+        return 0;
+}
+
+static int ath_tx_edma_init(struct ath_softc *sc)
+{
+        int err;
+
+        err = ath_txstatus_setup(sc, ATH_TXSTATUS_RING_SIZE);
+        if (!err)
+                ath9k_hw_setup_statusring(sc->sc_ah, sc->txsdma.dd_desc,
+                                          sc->txsdma.dd_desc_paddr,
+                                          ATH_TXSTATUS_RING_SIZE);
+
+        return err;
+}
+
+static void ath_tx_edma_cleanup(struct ath_softc *sc)
+{
+        struct ath_descdma *dd = &sc->txsdma;
+
+        dma_free_coherent(sc->dev, dd->dd_desc_len, dd->dd_desc,
+                          dd->dd_desc_paddr);
+}
+
 int ath_tx_init(struct ath_softc *sc, int nbufs)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -2150,7 +2353,7 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
         spin_lock_init(&sc->tx.txbuflock);
 
         error = ath_descdma_setup(sc, &sc->tx.txdma, &sc->tx.txbuf,
-                                  "tx", nbufs, 1);
+                                  "tx", nbufs, 1, 1);
         if (error != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to allocate tx descriptors: %d\n", error);
@@ -2158,7 +2361,7 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
         }
 
         error = ath_descdma_setup(sc, &sc->beacon.bdma, &sc->beacon.bbuf,
-                                  "beacon", ATH_BCBUF, 1);
+                                  "beacon", ATH_BCBUF, 1, 1);
         if (error != 0) {
                 ath_print(common, ATH_DBG_FATAL,
                           "Failed to allocate beacon descriptors: %d\n", error);
@@ -2167,6 +2370,12 @@ int ath_tx_init(struct ath_softc *sc, int nbufs)
 
         INIT_DELAYED_WORK(&sc->tx_complete_work, ath_tx_complete_poll_work);
 
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                error = ath_tx_edma_init(sc);
+                if (error)
+                        goto err;
+        }
+
 err:
         if (error != 0)
                 ath_tx_cleanup(sc);
@@ -2181,6 +2390,9 @@ void ath_tx_cleanup(struct ath_softc *sc)
 
         if (sc->tx.txdma.dd_desc_len != 0)
                 ath_descdma_cleanup(sc, &sc->tx.txdma, &sc->tx.txbuf);
+
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_tx_edma_cleanup(sc);
 }
 
 void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 997303bcf4ae..7965b70efbab 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -4571,6 +4571,23 @@ static void b43_op_sw_scan_complete_notifier(struct ieee80211_hw *hw)
         mutex_unlock(&wl->mutex);
 }
 
+static int b43_op_get_survey(struct ieee80211_hw *hw, int idx,
+                             struct survey_info *survey)
+{
+        struct b43_wl *wl = hw_to_b43_wl(hw);
+        struct b43_wldev *dev = wl->current_dev;
+        struct ieee80211_conf *conf = &hw->conf;
+
+        if (idx != 0)
+                return -ENOENT;
+
+        survey->channel = conf->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = dev->stats.link_noise;
+
+        return 0;
+}
+
 static const struct ieee80211_ops b43_hw_ops = {
         .tx                     = b43_op_tx,
         .conf_tx                = b43_op_conf_tx,
@@ -4590,6 +4607,7 @@ static const struct ieee80211_ops b43_hw_ops = {
         .sta_notify             = b43_op_sta_notify,
         .sw_scan_start          = b43_op_sw_scan_start_notifier,
         .sw_scan_complete       = b43_op_sw_scan_complete_notifier,
+        .get_survey             = b43_op_get_survey,
         .rfkill_poll            = b43_rfkill_poll,
 };
 
@@ -4905,8 +4923,7 @@ static int b43_wireless_init(struct ssb_device *dev)
 
         /* fill hw info */
         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                    IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM;
+                    IEEE80211_HW_SIGNAL_DBM;
 
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_AP) |
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index eda06529ef5f..e6b0528f3b52 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -610,7 +610,6 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
         }
 
         /* Link quality statistics */
-        status.noise = dev->stats.link_noise;
         if ((chanstat & B43_RX_CHAN_PHYTYPE) == B43_PHYTYPE_N) {
 //              s8 rssi = max(rxhdr->power0, rxhdr->power1);
                 //TODO: Find out what the rssi value is (dBm or percentage?)
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index bb2dd9329aa0..1713f5f7a58b 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3482,6 +3482,23 @@ static int b43legacy_op_beacon_set_tim(struct ieee80211_hw *hw,
         return 0;
 }
 
+static int b43legacy_op_get_survey(struct ieee80211_hw *hw, int idx,
+                                   struct survey_info *survey)
+{
+        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
+        struct b43legacy_wldev *dev = wl->current_dev;
+        struct ieee80211_conf *conf = &hw->conf;
+
+        if (idx != 0)
+                return -ENOENT;
+
+        survey->channel = conf->channel;
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = dev->stats.link_noise;
+
+        return 0;
+}
+
 static const struct ieee80211_ops b43legacy_hw_ops = {
         .tx                     = b43legacy_op_tx,
         .conf_tx                = b43legacy_op_conf_tx,
@@ -3494,6 +3511,7 @@ static const struct ieee80211_ops b43legacy_hw_ops = {
         .start                  = b43legacy_op_start,
         .stop                   = b43legacy_op_stop,
         .set_tim                = b43legacy_op_beacon_set_tim,
+        .get_survey             = b43legacy_op_get_survey,
         .rfkill_poll            = b43legacy_rfkill_poll,
 };
 
@@ -3769,8 +3787,7 @@ static int b43legacy_wireless_init(struct ssb_device *dev)
 
         /* fill hw info */
         hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                    IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM;
+                    IEEE80211_HW_SIGNAL_DBM;
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_STATION) |
diff --git a/drivers/net/wireless/b43legacy/xmit.c b/drivers/net/wireless/b43legacy/xmit.c
index 9c8882d9275e..7d177d97f1f7 100644
--- a/drivers/net/wireless/b43legacy/xmit.c
+++ b/drivers/net/wireless/b43legacy/xmit.c
@@ -548,7 +548,6 @@ void b43legacy_rx(struct b43legacy_wldev *dev,
                                       (phystat0 & B43legacy_RX_PHYST0_OFDM),
                                       (phystat0 & B43legacy_RX_PHYST0_GAINCTL),
                                       (phystat3 & B43legacy_RX_PHYST3_TRSTATE));
-        status.noise = dev->stats.link_noise;
         /* change to support A PHY */
         if (phystat0 & B43legacy_RX_PHYST0_OFDM)
                 status.rate_idx = b43legacy_plcp_get_bitrate_idx_ofdm(plcp, false);
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index a684a72eb6e9..7c7235385513 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -12,6 +12,7 @@ obj-$(CONFIG_IWLAGN)	+= iwlagn.o
 iwlagn-objs             := iwl-agn.o iwl-agn-rs.o iwl-agn-led.o iwl-agn-ict.o
 iwlagn-objs             += iwl-agn-ucode.o iwl-agn-hcmd.o iwl-agn-tx.o
 iwlagn-objs             += iwl-agn-lib.o
+iwlagn-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-agn-debugfs.o
 
 iwlagn-$(CONFIG_IWL4965) += iwl-4965.o
 iwlagn-$(CONFIG_IWL5000) += iwl-5000.o
@@ -21,5 +22,6 @@ iwlagn-$(CONFIG_IWL5000) += iwl-1000.o
 # 3945
 obj-$(CONFIG_IWL3945)   += iwl3945.o
 iwl3945-objs            := iwl3945-base.o iwl-3945.o iwl-3945-rs.o iwl-3945-led.o
+iwl3945-$(CONFIG_IWLWIFI_DEBUGFS) += iwl-3945-debugfs.o
 
 ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 9a0191a5ea35..fb59af2d41c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -46,6 +46,7 @@
 #include "iwl-helpers.h"
 #include "iwl-agn-hw.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL1000_UCODE_API_MAX 3
@@ -212,6 +213,11 @@ static struct iwl_lib_ops iwl1000_lib = {
                 .set_ct_kill = iwl1000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
@@ -276,7 +282,6 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .use_bsm = false,
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .support_ct_kill_exit = true,
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
new file mode 100644
index 000000000000..6a9c64a50e36
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.c
@@ -0,0 +1,500 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-3945-debugfs.h"
+
+ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
+                                    char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl39_statistics_rx_phy) * 40 +
+                    sizeof(struct iwl39_statistics_rx_non_phy) * 40 + 400;
+        ssize_t ret;
+        struct iwl39_statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
+        struct iwl39_statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
+        struct iwl39_statistics_rx_non_phy *general, *accum_general;
+        struct iwl39_statistics_rx_non_phy *delta_general, *max_general;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        ofdm = &priv->_3945.statistics.rx.ofdm;
+        cck = &priv->_3945.statistics.rx.cck;
+        general = &priv->_3945.statistics.rx.general;
+        accum_ofdm = &priv->_3945.accum_statistics.rx.ofdm;
+        accum_cck = &priv->_3945.accum_statistics.rx.cck;
+        accum_general = &priv->_3945.accum_statistics.rx.general;
+        delta_ofdm = &priv->_3945.delta_statistics.rx.ofdm;
+        delta_cck = &priv->_3945.delta_statistics.rx.cck;
+        delta_general = &priv->_3945.delta_statistics.rx.general;
+        max_ofdm = &priv->_3945.max_delta.rx.ofdm;
+        max_cck = &priv->_3945.max_delta.rx.cck;
+        max_general = &priv->_3945.max_delta.rx.general;
+
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         accum_ofdm->ina_cnt,
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "plcp_err:",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",  "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err, delta_ofdm->overrun_err,
+                         max_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err,
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good, delta_ofdm->crc32_good,
+                         max_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt,
+                         delta_ofdm->false_alarm_cnt,
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt,
+                         delta_ofdm->fina_sync_err_cnt,
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout,
+                         delta_ofdm->sfd_timeout,
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_timeout:",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout,
+                         delta_ofdm->fina_timeout,
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts,
+                         delta_ofdm->unresponded_rts,
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun,
+                         delta_ofdm->rxe_frame_limit_overrun,
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ack_cnt:",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt,
+                         delta_ofdm->sent_ack_cnt,
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_cts_cnt:",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt,
+                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err,
+                         delta_cck->overrun_err, max_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err,
+                         delta_cck->early_overrun_err,
+                         max_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good,
+                         max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "false_alarm_cnt:",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt,
+                         delta_cck->fina_sync_err_cnt,
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout,
+                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_timeout:",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout,
+                         delta_cck->fina_timeout, max_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts,
+                         delta_cck->unresponded_rts,
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun,
+                         delta_cck->rxe_frame_limit_overrun,
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ack_cnt:",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt,
+                         delta_cck->sent_ack_cnt,
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_cts_cnt:",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt,
+                         delta_cck->sent_cts_cnt,
+                         max_cck->sent_cts_cnt);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bogus_cts:",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts,
+                         delta_general->bogus_cts, max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bogus_ack:",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack,
+                         delta_general->bogus_ack, max_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_bssid_frames:",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames,
+                         delta_general->non_bssid_frames,
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "filtered_frames:",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames,
+                         delta_general->filtered_frames,
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_channel_beacons:",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons,
+                         delta_general->non_channel_beacons,
+                         max_general->non_channel_beacons);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl3945_ucode_tx_stats_read(struct file *file,
+                                    char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct iwl39_statistics_tx) * 48) + 250;
+        ssize_t ret;
+        struct iwl39_statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        tx = &priv->_3945.statistics.tx;
+        accum_tx = &priv->_3945.accum_statistics.tx;
+        delta_tx = &priv->_3945.delta_statistics.tx;
+        max_tx = &priv->_3945.max_delta.tx;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "preamble:",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_detected_cnt:",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_defer_cnt:",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt,
+                         delta_tx->bt_prio_defer_cnt,
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_kill_cnt:",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt,
+                         delta_tx->bt_prio_kill_cnt,
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "few_bytes_cnt:",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout:",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_timeout:",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "expected_ack_cnt:",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt,
+                         delta_tx->expected_ack_cnt,
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "actual_ack_cnt:",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt,
+                         delta_tx->actual_ack_cnt,
+                         max_tx->actual_ack_cnt);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct iwl39_statistics_general) * 10 + 300;
+        ssize_t ret;
+        struct iwl39_statistics_general *general, *accum_general;
+        struct iwl39_statistics_general *delta_general, *max_general;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct iwl39_statistics_div *div, *accum_div, *delta_div, *max_div;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * The statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        general = &priv->_3945.statistics.general;
+        dbg = &priv->_3945.statistics.general.dbg;
+        div = &priv->_3945.statistics.general.div;
+        accum_general = &priv->_3945.accum_statistics.general;
+        delta_general = &priv->_3945.delta_statistics.general;
+        max_general = &priv->_3945.max_delta.general;
+        accum_dbg = &priv->_3945.accum_statistics.general.dbg;
+        delta_dbg = &priv->_3945.delta_statistics.general.dbg;
+        max_dbg = &priv->_3945.max_delta.general.dbg;
+        accum_div = &priv->_3945.accum_statistics.general.div;
+        delta_div = &priv->_3945.delta_statistics.general.div;
+        max_div = &priv->_3945.max_delta.general.div;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_check:",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check,
+                         delta_dbg->burst_check, max_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_count:",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count,
+                         delta_dbg->burst_count, max_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sleep_time:",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time,
+                         delta_general->sleep_time, max_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_out:",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out,
+                         delta_general->slots_out, max_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_idle:",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_a:",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
+                         delta_div->tx_on_a, max_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_b:",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
+                         delta_div->tx_on_b, max_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "exec_time:",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h
new file mode 100644
index 000000000000..70809c53c215
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debugfs.h
@@ -0,0 +1,60 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-debug.h"
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+ssize_t iwl3945_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos);
+ssize_t iwl3945_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos);
+ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                         char __user *user_buf, size_t count,
+                                         loff_t *ppos);
+#else
+static ssize_t iwl3945_ucode_rx_stats_read(struct file *file,
+                                           char __user *user_buf, size_t count,
+                                           loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl3945_ucode_tx_stats_read(struct file *file,
+                                           char __user *user_buf, size_t count,
+                                           loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl3945_ucode_general_stats_read(struct file *file,
+                                                char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index bde3b4cbab9d..17197a78d894 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -50,6 +50,7 @@
 #include "iwl-helpers.h"
 #include "iwl-led.h"
 #include "iwl-3945-led.h"
+#include "iwl-3945-debugfs.h"
 
 #define IWL_DECLARE_RATE_INFO(r, ip, in, rp, rn, pp, np)    \
         [IWL_RATE_##r##M_INDEX] = { IWL_RATE_##r##M_PLCP,   \
@@ -293,7 +294,7 @@ static void iwl3945_tx_queue_reclaim(struct iwl_priv *priv,
  * iwl3945_rx_reply_tx - Handle Tx response
  */
 static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
-                            struct iwl_rx_mem_buffer *rxb)
+                                struct iwl_rx_mem_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
         u16 sequence = le16_to_cpu(pkt->hdr.sequence);
@@ -351,18 +352,81 @@ static void iwl3945_rx_reply_tx(struct iwl_priv *priv,
  *  RX handler implementations
  *
  *****************************************************************************/
+#ifdef CONFIG_IWLWIFI_DEBUG
+/*
+ *  based on the assumption of all statistics counter are in DWORD
+ *  FIXME: This function is for debugging, do not deal with
+ *  the case of counters roll-over.
+ */
+static void iwl3945_accumulative_statistics(struct iwl_priv *priv,
+                                            __le32 *stats)
+{
+        int i;
+        __le32 *prev_stats;
+        u32 *accum_stats;
+        u32 *delta, *max_delta;
+
+        prev_stats = (__le32 *)&priv->_3945.statistics;
+        accum_stats = (u32 *)&priv->_3945.accum_statistics;
+        delta = (u32 *)&priv->_3945.delta_statistics;
+        max_delta = (u32 *)&priv->_3945.max_delta;
+
+        for (i = sizeof(__le32); i < sizeof(struct iwl3945_notif_statistics);
+             i += sizeof(__le32), stats++, prev_stats++, delta++,
+             max_delta++, accum_stats++) {
+                if (le32_to_cpu(*stats) > le32_to_cpu(*prev_stats)) {
+                        *delta = (le32_to_cpu(*stats) -
+                                le32_to_cpu(*prev_stats));
+                        *accum_stats += *delta;
+                        if (*delta > *max_delta)
+                                *max_delta = *delta;
+                }
+        }
+
+        /* reset accumulative statistics for "no-counter" type statistics */
+        priv->_3945.accum_statistics.general.temperature =
+                priv->_3945.statistics.general.temperature;
+        priv->_3945.accum_statistics.general.ttl_timestamp =
+                priv->_3945.statistics.general.ttl_timestamp;
+}
+#endif
 
 void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                 struct iwl_rx_mem_buffer *rxb)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
+
         IWL_DEBUG_RX(priv, "Statistics notification received (%d vs %d).\n",
                      (int)sizeof(struct iwl3945_notif_statistics),
                      le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK);
+#ifdef CONFIG_IWLWIFI_DEBUG
+        iwl3945_accumulative_statistics(priv, (__le32 *)&pkt->u.raw);
+#endif
 
         memcpy(&priv->_3945.statistics, pkt->u.raw, sizeof(priv->_3945.statistics));
 }
 
+void iwl3945_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        __le32 *flag = (__le32 *)&pkt->u.raw;
+
+        if (le32_to_cpu(*flag) & UCODE_STATISTICS_CLEAR_MSK) {
+#ifdef CONFIG_IWLWIFI_DEBUG
+                memset(&priv->_3945.accum_statistics, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+                memset(&priv->_3945.delta_statistics, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+                memset(&priv->_3945.max_delta, 0,
+                        sizeof(struct iwl3945_notif_statistics));
+#endif
+                IWL_DEBUG_RX(priv, "Statistics have been cleared\n");
+        }
+        iwl3945_hw_rx_statistics(priv, rxb);
+}
+
+
 /******************************************************************************
  *
  * Misc. internal state and helper functions
@@ -2688,6 +2752,7 @@ IWL3945_UCODE_GET(boot_size);
 static struct iwl_hcmd_ops iwl3945_hcmd = {
         .rxon_assoc = iwl3945_send_rxon_assoc,
         .commit_rxon = iwl3945_commit_rxon,
+        .send_bt_config = iwl_send_bt_config,
 };
 
 static struct iwl_ucode_ops iwl3945_ucode = {
@@ -2735,12 +2800,19 @@ static struct iwl_lib_ops iwl3945_lib = {
         .isr = iwl_isr_legacy,
         .config_ap = iwl3945_config_ap,
         .add_bcast_station = iwl3945_add_bcast_station,
+
+        .debugfs_ops = {
+                .rx_stats_read = iwl3945_ucode_rx_stats_read,
+                .tx_stats_read = iwl3945_ucode_tx_stats_read,
+                .general_stats_read = iwl3945_ucode_general_stats_read,
+        },
 };
 
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
         .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
+        .request_scan = iwl3945_request_scan,
 };
 
 static const struct iwl_ops iwl3945_ops = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index b89219573b91..643adb644bb8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -264,6 +264,8 @@ extern int iwl3945_hw_reg_send_txpower(struct iwl_priv *priv);
 extern int iwl3945_hw_reg_set_txpower(struct iwl_priv *priv, s8 power);
 extern void iwl3945_hw_rx_statistics(struct iwl_priv *priv,
                                  struct iwl_rx_mem_buffer *rxb);
+void iwl3945_reply_statistics(struct iwl_priv *priv,
+                              struct iwl_rx_mem_buffer *rxb);
 extern void iwl3945_disable_events(struct iwl_priv *priv);
 extern int iwl4965_get_temperature(const struct iwl_priv *priv);
 extern void iwl3945_post_associate(struct iwl_priv *priv);
@@ -294,6 +296,9 @@ extern const struct iwl_channel_info *iwl3945_get_channel_info(
 
 extern int iwl3945_rs_next_rate(struct iwl_priv *priv, int rate);
 
+/* scanning */
+void iwl3945_request_scan(struct iwl_priv *priv);
+
 /* Requires full declaration of iwl_priv before including */
 #include "iwl-io.h"
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 2e3cda75f3ad..136c29067489 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -47,6 +47,7 @@
 #include "iwl-sta.h"
 #include "iwl-agn-led.h"
 #include "iwl-agn.h"
+#include "iwl-agn-debugfs.h"
 
 static int iwl4965_send_tx_power(struct iwl_priv *priv);
 static int iwl4965_hw_get_temperature(struct iwl_priv *priv);
@@ -2143,6 +2144,7 @@ static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
         .set_rxon_chain = iwl_set_rxon_chain,
+        .send_bt_config = iwl_send_bt_config,
 };
 
 static struct iwl_ucode_ops iwl4965_ucode = {
@@ -2162,6 +2164,7 @@ static struct iwl_hcmd_utils_ops iwl4965_hcmd_utils = {
         .gain_computation = iwl4965_gain_computation,
         .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
         .calc_rssi = iwl4965_calc_rssi,
+        .request_scan = iwlagn_request_scan,
 };
 
 static struct iwl_lib_ops iwl4965_lib = {
@@ -2216,6 +2219,11 @@ static struct iwl_lib_ops iwl4965_lib = {
                 .set_ct_kill = iwl4965_set_ct_threshold,
         },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .check_plcp_health = iwl_good_plcp_health,
 };
 
@@ -2253,8 +2261,13 @@ struct iwl_cfg iwl4965_agn_cfg = {
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
         .monitor_recover_period = IWL_MONITORING_PERIOD,
         .temperature_kelvin = true,
-        .off_channel_workaround = true,
         .max_event_log_size = 512,
+
+        /*
+         * Force use of chains B and C for scan RX on 5 GHz band
+         * because the device has off-channel reception on chain A.
+         */
+        .scan_antennas[IEEE80211_BAND_5GHZ] = ANT_BC,
 };
 
 /* Module firmware */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index e967cfcac224..115d3ea1142f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -48,6 +48,7 @@
 #include "iwl-agn-led.h"
 #include "iwl-agn-hw.h"
 #include "iwl-5000-hw.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL5000_UCODE_API_MAX 2
@@ -199,26 +200,57 @@ static int iwl5000_hw_set_hw_params(struct iwl_priv *priv)
 
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_5150:
-                priv->hw_params.sens = &iwl5150_sensitivity;
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_DC)               |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-
-                break;
-        default:
-                priv->hw_params.sens = &iwl5000_sensitivity;
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_TX_IQ_PERD)       |
-                        BIT(IWL_CALIB_BASE_BAND);
-                break;
-        }
+        priv->hw_params.sens = &iwl5000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_TX_IQ_PERD)       |
+                BIT(IWL_CALIB_BASE_BAND);
+
+        return 0;
+}
+
+static int iwl5150_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwlagn_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+
+        priv->hw_params.max_data_size = IWLAGN_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWLAGN_RTC_INST_SIZE;
+
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl5150_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_DC)               |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
 
         return 0;
 }
@@ -320,13 +352,18 @@ static struct iwl_lib_ops iwl5000_lib = {
                 .set_ct_kill = iwl5000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
 };
 
 static struct iwl_lib_ops iwl5150_lib = {
-        .set_hw_params = iwl5000_hw_set_hw_params,
+        .set_hw_params = iwl5150_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
         .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
         .txq_set_sched = iwlagn_txq_set_sched,
@@ -377,6 +414,11 @@ static struct iwl_lib_ops iwl5150_lib = {
                 .set_ct_kill = iwl5150_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index dd03384432f4..7acef703253a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -47,17 +47,19 @@
 #include "iwl-agn-hw.h"
 #include "iwl-6000-hw.h"
 #include "iwl-agn-led.h"
+#include "iwl-agn-debugfs.h"
 
 /* Highest firmware API version supported */
 #define IWL6000_UCODE_API_MAX 4
 #define IWL6050_UCODE_API_MAX 4
+#define IWL6000G2_UCODE_API_MAX 4
 
 /* Lowest firmware API version supported */
 #define IWL6000_UCODE_API_MIN 4
 #define IWL6050_UCODE_API_MIN 4
+#define IWL6000G2_UCODE_API_MIN 4
 
 #define IWL6000_FW_PRE "iwlwifi-6000-"
-#define IWL6000_G2_FW_PRE "iwlwifi-6005-"
 #define _IWL6000_MODULE_FIRMWARE(api) IWL6000_FW_PRE #api ".ucode"
 #define IWL6000_MODULE_FIRMWARE(api) _IWL6000_MODULE_FIRMWARE(api)
 
@@ -65,6 +67,10 @@
 #define _IWL6050_MODULE_FIRMWARE(api) IWL6050_FW_PRE #api ".ucode"
 #define IWL6050_MODULE_FIRMWARE(api) _IWL6050_MODULE_FIRMWARE(api)
 
+#define IWL6000G2_FW_PRE "iwlwifi-6005-"
+#define _IWL6000G2_MODULE_FIRMWARE(api) IWL6000G2_FW_PRE #api ".ucode"
+#define IWL6000G2_MODULE_FIRMWARE(api) _IWL6000G2_MODULE_FIRMWARE(api)
+
 static void iwl6000_set_ct_threshold(struct iwl_priv *priv)
 {
         /* want Celsius */
@@ -170,24 +176,56 @@ static int iwl6000_hw_set_hw_params(struct iwl_priv *priv)
         /* Set initial sensitivity parameters */
         /* Set initial calibration set */
         priv->hw_params.sens = &iwl6000_sensitivity;
-        switch (priv->hw_rev & CSR_HW_REV_TYPE_MSK) {
-        case CSR_HW_REV_TYPE_6x50:
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_DC)               |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-
-                break;
-        default:
-                priv->hw_params.calib_init_cfg =
-                        BIT(IWL_CALIB_XTAL)             |
-                        BIT(IWL_CALIB_LO)               |
-                        BIT(IWL_CALIB_TX_IQ)            |
-                        BIT(IWL_CALIB_BASE_BAND);
-                break;
-        }
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
+
+        return 0;
+}
+
+static int iwl6050_hw_set_hw_params(struct iwl_priv *priv)
+{
+        if (priv->cfg->mod_params->num_of_queues >= IWL_MIN_NUM_QUEUES &&
+            priv->cfg->mod_params->num_of_queues <= IWLAGN_NUM_QUEUES)
+                priv->cfg->num_of_queues =
+                        priv->cfg->mod_params->num_of_queues;
+
+        priv->hw_params.max_txq_num = priv->cfg->num_of_queues;
+        priv->hw_params.dma_chnl_num = FH50_TCSR_CHNL_NUM;
+        priv->hw_params.scd_bc_tbls_size =
+                        priv->cfg->num_of_queues *
+                        sizeof(struct iwlagn_scd_bc_tbl);
+        priv->hw_params.tfd_size = sizeof(struct iwl_tfd);
+        priv->hw_params.max_stations = IWL5000_STATION_COUNT;
+        priv->hw_params.bcast_sta_id = IWL5000_BROADCAST_ID;
+
+        priv->hw_params.max_data_size = IWL60_RTC_DATA_SIZE;
+        priv->hw_params.max_inst_size = IWL60_RTC_INST_SIZE;
+
+        priv->hw_params.max_bsm_size = 0;
+        priv->hw_params.ht40_channel =  BIT(IEEE80211_BAND_2GHZ) |
+                                        BIT(IEEE80211_BAND_5GHZ);
+        priv->hw_params.rx_wrt_ptr_reg = FH_RSCSR_CHNL0_WPTR;
+
+        priv->hw_params.tx_chains_num = num_of_ant(priv->cfg->valid_tx_ant);
+        priv->hw_params.rx_chains_num = num_of_ant(priv->cfg->valid_rx_ant);
+        priv->hw_params.valid_tx_ant = priv->cfg->valid_tx_ant;
+        priv->hw_params.valid_rx_ant = priv->cfg->valid_rx_ant;
+
+        if (priv->cfg->ops->lib->temp_ops.set_ct_kill)
+                priv->cfg->ops->lib->temp_ops.set_ct_kill(priv);
+
+        /* Set initial sensitivity parameters */
+        /* Set initial calibration set */
+        priv->hw_params.sens = &iwl6000_sensitivity;
+        priv->hw_params.calib_init_cfg =
+                BIT(IWL_CALIB_XTAL)             |
+                BIT(IWL_CALIB_DC)               |
+                BIT(IWL_CALIB_LO)               |
+                BIT(IWL_CALIB_TX_IQ)            |
+                BIT(IWL_CALIB_BASE_BAND);
 
         return 0;
 }
@@ -261,7 +299,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                         EEPROM_REG_BAND_3_CHANNELS,
                         EEPROM_REG_BAND_4_CHANNELS,
                         EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -279,6 +317,11 @@ static struct iwl_lib_ops iwl6000_lib = {
                 .set_ct_kill = iwl6000_set_ct_threshold,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
@@ -293,7 +336,7 @@ static const struct iwl_ops iwl6000_ops = {
 };
 
 static struct iwl_lib_ops iwl6050_lib = {
-        .set_hw_params = iwl6000_hw_set_hw_params,
+        .set_hw_params = iwl6050_hw_set_hw_params,
         .txq_update_byte_cnt_tbl = iwlagn_txq_update_byte_cnt_tbl,
         .txq_inval_byte_cnt_tbl = iwlagn_txq_inval_byte_cnt_tbl,
         .txq_set_sched = iwlagn_txq_set_sched,
@@ -328,7 +371,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                         EEPROM_REG_BAND_3_CHANNELS,
                         EEPROM_REG_BAND_4_CHANNELS,
                         EEPROM_REG_BAND_5_CHANNELS,
-                        EEPROM_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                         EEPROM_REG_BAND_52_HT40_CHANNELS
                 },
                 .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -347,6 +390,11 @@ static struct iwl_lib_ops iwl6050_lib = {
                 .set_calib_version = iwl6050_set_calib_version,
          },
         .add_bcast_station = iwl_add_bcast_station,
+        .debugfs_ops = {
+                .rx_stats_read = iwl_ucode_rx_stats_read,
+                .tx_stats_read = iwl_ucode_tx_stats_read,
+                .general_stats_read = iwl_ucode_general_stats_read,
+        },
         .recover_from_tx_stall = iwl_bg_monitor_recover,
         .check_plcp_health = iwl_good_plcp_health,
         .check_ack_health = iwl_good_ack_health,
@@ -363,16 +411,16 @@ static const struct iwl_ops iwl6050_ops = {
 /*
  * "i": Internal configuration, use internal Power Amplifier
  */
-struct iwl_cfg iwl6000i_g2_2agn_cfg = {
+struct iwl_cfg iwl6000g2_2agn_cfg = {
         .name = "6000 Series 2x2 AGN Gen2",
-        .fw_name_pre = IWL6000_G2_FW_PRE,
-        .ucode_api_max = IWL6000_UCODE_API_MAX,
-        .ucode_api_min = IWL6000_UCODE_API_MIN,
+        .fw_name_pre = IWL6000G2_FW_PRE,
+        .ucode_api_max = IWL6000G2_UCODE_API_MAX,
+        .ucode_api_min = IWL6000G2_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
         .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
-        .eeprom_ver = EEPROM_6000_EEPROM_VERSION,
-        .eeprom_calib_ver = EEPROM_6000_TX_POWER_VERSION,
+        .eeprom_ver = EEPROM_6000G2_EEPROM_VERSION,
+        .eeprom_calib_ver = EEPROM_6000G2_TX_POWER_VERSION,
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .num_of_ampdu_queues = IWLAGN_NUM_AMPDU_QUEUES,
         .mod_params = &iwlagn_mod_params,
@@ -381,7 +429,7 @@ struct iwl_cfg iwl6000i_g2_2agn_cfg = {
         .pll_cfg_val = 0,
         .set_l0s = true,
         .use_bsm = false,
-        .pa_type = IWL_PA_INTERNAL,
+        .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .ht_greenfield_support = true,
@@ -452,7 +500,6 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -485,7 +532,6 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .pa_type = IWL_PA_INTERNAL,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -552,7 +598,6 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .pa_type = IWL_PA_SYSTEM,
         .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
-        .ht_greenfield_support = true,
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .supports_idle = true,
@@ -600,3 +645,4 @@ struct iwl_cfg iwl6000_3agn_cfg = {
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
 MODULE_FIRMWARE(IWL6050_MODULE_FIRMWARE(IWL6050_UCODE_API_MAX));
+MODULE_FIRMWARE(IWL6000G2_MODULE_FIRMWARE(IWL6000G2_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
new file mode 100644
index 000000000000..f249b706bf17
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.c
@@ -0,0 +1,834 @@
+/******************************************************************************
+*
+* GPL LICENSE SUMMARY
+*
+* Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+*
+* This program is free software; you can redistribute it and/or modify
+* it under the terms of version 2 of the GNU General Public License as
+* published by the Free Software Foundation.
+*
+* This program is distributed in the hope that it will be useful, but
+* WITHOUT ANY WARRANTY; without even the implied warranty of
+* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+* General Public License for more details.
+*
+* You should have received a copy of the GNU General Public License
+* along with this program; if not, write to the Free Software
+* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+* USA
+*
+* The full GNU General Public License is included in this distribution
+* in the file called LICENSE.GPL.
+*
+* Contact Information:
+*  Intel Linux Wireless <ilw@linux.intel.com>
+* Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+*****************************************************************************/
+
+#include "iwl-agn-debugfs.h"
+
+ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+  {
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
+                    sizeof(struct statistics_rx_non_phy) * 40 +
+                    sizeof(struct statistics_rx_ht_phy) * 40 + 400;
+        ssize_t ret;
+        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
+        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
+        struct statistics_rx_non_phy *general, *accum_general;
+        struct statistics_rx_non_phy *delta_general, *max_general;
+        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /*
+         * the statistic information display here is based on
+         * the last statistics notification from uCode
+         * might not reflect the current uCode activity
+         */
+        ofdm = &priv->statistics.rx.ofdm;
+        cck = &priv->statistics.rx.cck;
+        general = &priv->statistics.rx.general;
+        ht = &priv->statistics.rx.ofdm_ht;
+        accum_ofdm = &priv->accum_statistics.rx.ofdm;
+        accum_cck = &priv->accum_statistics.rx.cck;
+        accum_general = &priv->accum_statistics.rx.general;
+        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
+        delta_ofdm = &priv->delta_statistics.rx.ofdm;
+        delta_cck = &priv->delta_statistics.rx.cck;
+        delta_general = &priv->delta_statistics.rx.general;
+        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
+        max_ofdm = &priv->max_delta.rx.ofdm;
+        max_cck = &priv->max_delta.rx.cck;
+        max_general = &priv->max_delta.rx.general;
+        max_ht = &priv->max_delta.rx.ofdm_ht;
+
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
+                         accum_ofdm->ina_cnt,
+                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
+                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
+                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "crc32_err:",
+                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
+                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "overrun_err:",
+                         le32_to_cpu(ofdm->overrun_err),
+                         accum_ofdm->overrun_err, delta_ofdm->overrun_err,
+                         max_ofdm->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ofdm->early_overrun_err),
+                         accum_ofdm->early_overrun_err,
+                         delta_ofdm->early_overrun_err,
+                         max_ofdm->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:", le32_to_cpu(ofdm->crc32_good),
+                         accum_ofdm->crc32_good, delta_ofdm->crc32_good,
+                         max_ofdm->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "false_alarm_cnt:",
+                         le32_to_cpu(ofdm->false_alarm_cnt),
+                         accum_ofdm->false_alarm_cnt,
+                         delta_ofdm->false_alarm_cnt,
+                         max_ofdm->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(ofdm->fina_sync_err_cnt),
+                         accum_ofdm->fina_sync_err_cnt,
+                         delta_ofdm->fina_sync_err_cnt,
+                         max_ofdm->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sfd_timeout:",
+                         le32_to_cpu(ofdm->sfd_timeout),
+                         accum_ofdm->sfd_timeout, delta_ofdm->sfd_timeout,
+                         max_ofdm->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         le32_to_cpu(ofdm->fina_timeout),
+                         accum_ofdm->fina_timeout, delta_ofdm->fina_timeout,
+                         max_ofdm->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(ofdm->unresponded_rts),
+                         accum_ofdm->unresponded_rts,
+                         delta_ofdm->unresponded_rts,
+                         max_ofdm->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
+                         accum_ofdm->rxe_frame_limit_overrun,
+                         delta_ofdm->rxe_frame_limit_overrun,
+                         max_ofdm->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         le32_to_cpu(ofdm->sent_ack_cnt),
+                         accum_ofdm->sent_ack_cnt, delta_ofdm->sent_ack_cnt,
+                         max_ofdm->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         le32_to_cpu(ofdm->sent_cts_cnt),
+                         accum_ofdm->sent_cts_cnt, delta_ofdm->sent_cts_cnt,
+                         max_ofdm->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sent_ba_rsp_cnt:",
+                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
+                         accum_ofdm->sent_ba_rsp_cnt,
+                         delta_ofdm->sent_ba_rsp_cnt,
+                         max_ofdm->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         le32_to_cpu(ofdm->dsp_self_kill),
+                         accum_ofdm->dsp_self_kill,
+                         delta_ofdm->dsp_self_kill,
+                         max_ofdm->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "mh_format_err:",
+                         le32_to_cpu(ofdm->mh_format_err),
+                         accum_ofdm->mh_format_err,
+                         delta_ofdm->mh_format_err,
+                         max_ofdm->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
+                         accum_ofdm->re_acq_main_rssi_sum,
+                         delta_ofdm->re_acq_main_rssi_sum,
+                         max_ofdm->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - CCK:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_cnt:",
+                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
+                         delta_cck->ina_cnt, max_cck->ina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_cnt:",
+                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
+                         delta_cck->fina_cnt, max_cck->fina_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
+                         delta_cck->plcp_err, max_cck->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
+                         delta_cck->crc32_err, max_cck->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(cck->overrun_err),
+                         accum_cck->overrun_err, delta_cck->overrun_err,
+                         max_cck->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(cck->early_overrun_err),
+                         accum_cck->early_overrun_err,
+                         delta_cck->early_overrun_err,
+                         max_cck->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
+                         delta_cck->crc32_good, max_cck->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "false_alarm_cnt:",
+                         le32_to_cpu(cck->false_alarm_cnt),
+                         accum_cck->false_alarm_cnt,
+                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "fina_sync_err_cnt:",
+                         le32_to_cpu(cck->fina_sync_err_cnt),
+                         accum_cck->fina_sync_err_cnt,
+                         delta_cck->fina_sync_err_cnt,
+                         max_cck->fina_sync_err_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sfd_timeout:",
+                         le32_to_cpu(cck->sfd_timeout),
+                         accum_cck->sfd_timeout, delta_cck->sfd_timeout,
+                         max_cck->sfd_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "fina_timeout:",
+                         le32_to_cpu(cck->fina_timeout),
+                         accum_cck->fina_timeout, delta_cck->fina_timeout,
+                         max_cck->fina_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unresponded_rts:",
+                         le32_to_cpu(cck->unresponded_rts),
+                         accum_cck->unresponded_rts, delta_cck->unresponded_rts,
+                         max_cck->unresponded_rts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rxe_frame_lmt_ovrun:",
+                         le32_to_cpu(cck->rxe_frame_limit_overrun),
+                         accum_cck->rxe_frame_limit_overrun,
+                         delta_cck->rxe_frame_limit_overrun,
+                         max_cck->rxe_frame_limit_overrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ack_cnt:",
+                         le32_to_cpu(cck->sent_ack_cnt),
+                         accum_cck->sent_ack_cnt, delta_cck->sent_ack_cnt,
+                         max_cck->sent_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_cts_cnt:",
+                         le32_to_cpu(cck->sent_cts_cnt),
+                         accum_cck->sent_cts_cnt, delta_cck->sent_cts_cnt,
+                         max_cck->sent_cts_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "sent_ba_rsp_cnt:",
+                         le32_to_cpu(cck->sent_ba_rsp_cnt),
+                         accum_cck->sent_ba_rsp_cnt,
+                         delta_cck->sent_ba_rsp_cnt,
+                         max_cck->sent_ba_rsp_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "dsp_self_kill:",
+                         le32_to_cpu(cck->dsp_self_kill),
+                         accum_cck->dsp_self_kill, delta_cck->dsp_self_kill,
+                         max_cck->dsp_self_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "mh_format_err:",
+                         le32_to_cpu(cck->mh_format_err),
+                         accum_cck->mh_format_err, delta_cck->mh_format_err,
+                         max_cck->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "re_acq_main_rssi_sum:",
+                         le32_to_cpu(cck->re_acq_main_rssi_sum),
+                         accum_cck->re_acq_main_rssi_sum,
+                         delta_cck->re_acq_main_rssi_sum,
+                         max_cck->re_acq_main_rssi_sum);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - GENERAL:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_cts:",
+                         le32_to_cpu(general->bogus_cts),
+                         accum_general->bogus_cts, delta_general->bogus_cts,
+                         max_general->bogus_cts);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n", "bogus_ack:",
+                         le32_to_cpu(general->bogus_ack),
+                         accum_general->bogus_ack, delta_general->bogus_ack,
+                         max_general->bogus_ack);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_bssid_frames:",
+                         le32_to_cpu(general->non_bssid_frames),
+                         accum_general->non_bssid_frames,
+                         delta_general->non_bssid_frames,
+                         max_general->non_bssid_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "filtered_frames:",
+                         le32_to_cpu(general->filtered_frames),
+                         accum_general->filtered_frames,
+                         delta_general->filtered_frames,
+                         max_general->filtered_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "non_channel_beacons:",
+                         le32_to_cpu(general->non_channel_beacons),
+                         accum_general->non_channel_beacons,
+                         delta_general->non_channel_beacons,
+                         max_general->non_channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "channel_beacons:",
+                         le32_to_cpu(general->channel_beacons),
+                         accum_general->channel_beacons,
+                         delta_general->channel_beacons,
+                         max_general->channel_beacons);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "num_missed_bcon:",
+                         le32_to_cpu(general->num_missed_bcon),
+                         accum_general->num_missed_bcon,
+                         delta_general->num_missed_bcon,
+                         max_general->num_missed_bcon);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "adc_rx_saturation_time:",
+                         le32_to_cpu(general->adc_rx_saturation_time),
+                         accum_general->adc_rx_saturation_time,
+                         delta_general->adc_rx_saturation_time,
+                         max_general->adc_rx_saturation_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ina_detect_search_tm:",
+                         le32_to_cpu(general->ina_detection_search_time),
+                         accum_general->ina_detection_search_time,
+                         delta_general->ina_detection_search_time,
+                         max_general->ina_detection_search_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_a:",
+                         le32_to_cpu(general->beacon_silence_rssi_a),
+                         accum_general->beacon_silence_rssi_a,
+                         delta_general->beacon_silence_rssi_a,
+                         max_general->beacon_silence_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_b:",
+                         le32_to_cpu(general->beacon_silence_rssi_b),
+                         accum_general->beacon_silence_rssi_b,
+                         delta_general->beacon_silence_rssi_b,
+                         max_general->beacon_silence_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_silence_rssi_c:",
+                         le32_to_cpu(general->beacon_silence_rssi_c),
+                         accum_general->beacon_silence_rssi_c,
+                         delta_general->beacon_silence_rssi_c,
+                         max_general->beacon_silence_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "interference_data_flag:",
+                         le32_to_cpu(general->interference_data_flag),
+                         accum_general->interference_data_flag,
+                         delta_general->interference_data_flag,
+                         max_general->interference_data_flag);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "channel_load:",
+                         le32_to_cpu(general->channel_load),
+                         accum_general->channel_load,
+                         delta_general->channel_load,
+                         max_general->channel_load);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "dsp_false_alarms:",
+                         le32_to_cpu(general->dsp_false_alarms),
+                         accum_general->dsp_false_alarms,
+                         delta_general->dsp_false_alarms,
+                         max_general->dsp_false_alarms);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_a:",
+                         le32_to_cpu(general->beacon_rssi_a),
+                         accum_general->beacon_rssi_a,
+                         delta_general->beacon_rssi_a,
+                         max_general->beacon_rssi_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_b:",
+                         le32_to_cpu(general->beacon_rssi_b),
+                         accum_general->beacon_rssi_b,
+                         delta_general->beacon_rssi_b,
+                         max_general->beacon_rssi_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_rssi_c:",
+                         le32_to_cpu(general->beacon_rssi_c),
+                         accum_general->beacon_rssi_c,
+                         delta_general->beacon_rssi_c,
+                         max_general->beacon_rssi_c);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_a:",
+                         le32_to_cpu(general->beacon_energy_a),
+                         accum_general->beacon_energy_a,
+                         delta_general->beacon_energy_a,
+                         max_general->beacon_energy_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_b:",
+                         le32_to_cpu(general->beacon_energy_b),
+                         accum_general->beacon_energy_b,
+                         delta_general->beacon_energy_b,
+                         max_general->beacon_energy_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "beacon_energy_c:",
+                         le32_to_cpu(general->beacon_energy_c),
+                         accum_general->beacon_energy_c,
+                         delta_general->beacon_energy_c,
+                         max_general->beacon_energy_c);
+
+        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Rx - OFDM_HT:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "plcp_err:",
+                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
+                         delta_ht->plcp_err, max_ht->plcp_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "overrun_err:",
+                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
+                         delta_ht->overrun_err, max_ht->overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "early_overrun_err:",
+                         le32_to_cpu(ht->early_overrun_err),
+                         accum_ht->early_overrun_err,
+                         delta_ht->early_overrun_err,
+                         max_ht->early_overrun_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_good:",
+                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
+                         delta_ht->crc32_good, max_ht->crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "crc32_err:",
+                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
+                         delta_ht->crc32_err, max_ht->crc32_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "mh_format_err:",
+                         le32_to_cpu(ht->mh_format_err),
+                         accum_ht->mh_format_err,
+                         delta_ht->mh_format_err, max_ht->mh_format_err);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_crc32_good:",
+                         le32_to_cpu(ht->agg_crc32_good),
+                         accum_ht->agg_crc32_good,
+                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_mpdu_cnt:",
+                         le32_to_cpu(ht->agg_mpdu_cnt),
+                         accum_ht->agg_mpdu_cnt,
+                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg_cnt:",
+                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
+                         delta_ht->agg_cnt, max_ht->agg_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "unsupport_mcs:",
+                         le32_to_cpu(ht->unsupport_mcs),
+                         accum_ht->unsupport_mcs,
+                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl_ucode_tx_stats_read(struct file *file,
+                                char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
+        ssize_t ret;
+        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+          * the last statistics notification from uCode
+          * might not reflect the current uCode activity
+          */
+        tx = &priv->statistics.tx;
+        accum_tx = &priv->accum_statistics.tx;
+        delta_tx = &priv->delta_statistics.tx;
+        max_tx = &priv->max_delta.tx;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos,  "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_Tx:");
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "preamble:",
+                         le32_to_cpu(tx->preamble_cnt),
+                         accum_tx->preamble_cnt,
+                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_detected_cnt:",
+                         le32_to_cpu(tx->rx_detected_cnt),
+                         accum_tx->rx_detected_cnt,
+                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_defer_cnt:",
+                         le32_to_cpu(tx->bt_prio_defer_cnt),
+                         accum_tx->bt_prio_defer_cnt,
+                         delta_tx->bt_prio_defer_cnt,
+                         max_tx->bt_prio_defer_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "bt_prio_kill_cnt:",
+                         le32_to_cpu(tx->bt_prio_kill_cnt),
+                         accum_tx->bt_prio_kill_cnt,
+                         delta_tx->bt_prio_kill_cnt,
+                         max_tx->bt_prio_kill_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "few_bytes_cnt:",
+                         le32_to_cpu(tx->few_bytes_cnt),
+                         accum_tx->few_bytes_cnt,
+                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout:",
+                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
+                         delta_tx->cts_timeout, max_tx->cts_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_timeout:",
+                         le32_to_cpu(tx->ack_timeout),
+                         accum_tx->ack_timeout,
+                         delta_tx->ack_timeout, max_tx->ack_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "expected_ack_cnt:",
+                         le32_to_cpu(tx->expected_ack_cnt),
+                         accum_tx->expected_ack_cnt,
+                         delta_tx->expected_ack_cnt,
+                         max_tx->expected_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "actual_ack_cnt:",
+                         le32_to_cpu(tx->actual_ack_cnt),
+                         accum_tx->actual_ack_cnt,
+                         delta_tx->actual_ack_cnt,
+                         max_tx->actual_ack_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "dump_msdu_cnt:",
+                         le32_to_cpu(tx->dump_msdu_cnt),
+                         accum_tx->dump_msdu_cnt,
+                         delta_tx->dump_msdu_cnt,
+                         max_tx->dump_msdu_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "abort_nxt_frame_mismatch:",
+                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
+                         accum_tx->burst_abort_next_frame_mismatch_cnt,
+                         delta_tx->burst_abort_next_frame_mismatch_cnt,
+                         max_tx->burst_abort_next_frame_mismatch_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "abort_missing_nxt_frame:",
+                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
+                         accum_tx->burst_abort_missing_next_frame_cnt,
+                         delta_tx->burst_abort_missing_next_frame_cnt,
+                         max_tx->burst_abort_missing_next_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "cts_timeout_collision:",
+                         le32_to_cpu(tx->cts_timeout_collision),
+                         accum_tx->cts_timeout_collision,
+                         delta_tx->cts_timeout_collision,
+                         max_tx->cts_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "ack_ba_timeout_collision:",
+                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
+                         accum_tx->ack_or_ba_timeout_collision,
+                         delta_tx->ack_or_ba_timeout_collision,
+                         max_tx->ack_or_ba_timeout_collision);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg ba_timeout:",
+                         le32_to_cpu(tx->agg.ba_timeout),
+                         accum_tx->agg.ba_timeout,
+                         delta_tx->agg.ba_timeout,
+                         max_tx->agg.ba_timeout);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg ba_resched_frames:",
+                         le32_to_cpu(tx->agg.ba_reschedule_frames),
+                         accum_tx->agg.ba_reschedule_frames,
+                         delta_tx->agg.ba_reschedule_frames,
+                         max_tx->agg.ba_reschedule_frames);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_agg_frame:",
+                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
+                         accum_tx->agg.scd_query_agg_frame_cnt,
+                         delta_tx->agg.scd_query_agg_frame_cnt,
+                         max_tx->agg.scd_query_agg_frame_cnt);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_no_agg:",
+                         le32_to_cpu(tx->agg.scd_query_no_agg),
+                         accum_tx->agg.scd_query_no_agg,
+                         delta_tx->agg.scd_query_no_agg,
+                         max_tx->agg.scd_query_no_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_agg:",
+                         le32_to_cpu(tx->agg.scd_query_agg),
+                         accum_tx->agg.scd_query_agg,
+                         delta_tx->agg.scd_query_agg,
+                         max_tx->agg.scd_query_agg);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg scd_query_mismatch:",
+                         le32_to_cpu(tx->agg.scd_query_mismatch),
+                         accum_tx->agg.scd_query_mismatch,
+                         delta_tx->agg.scd_query_mismatch,
+                         max_tx->agg.scd_query_mismatch);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg frame_not_ready:",
+                         le32_to_cpu(tx->agg.frame_not_ready),
+                         accum_tx->agg.frame_not_ready,
+                         delta_tx->agg.frame_not_ready,
+                         max_tx->agg.frame_not_ready);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg underrun:",
+                         le32_to_cpu(tx->agg.underrun),
+                         accum_tx->agg.underrun,
+                         delta_tx->agg.underrun, max_tx->agg.underrun);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg bt_prio_kill:",
+                         le32_to_cpu(tx->agg.bt_prio_kill),
+                         accum_tx->agg.bt_prio_kill,
+                         delta_tx->agg.bt_prio_kill,
+                         max_tx->agg.bt_prio_kill);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "agg rx_ba_rsp_cnt:",
+                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
+                         accum_tx->agg.rx_ba_rsp_cnt,
+                         delta_tx->agg.rx_ba_rsp_cnt,
+                         max_tx->agg.rx_ba_rsp_cnt);
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
+
+ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct iwl_priv *priv = file->private_data;
+        int pos = 0;
+        char *buf;
+        int bufsz = sizeof(struct statistics_general) * 10 + 300;
+        ssize_t ret;
+        struct statistics_general *general, *accum_general;
+        struct statistics_general *delta_general, *max_general;
+        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
+        struct statistics_div *div, *accum_div, *delta_div, *max_div;
+
+        if (!iwl_is_alive(priv))
+                return -EAGAIN;
+
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf) {
+                IWL_ERR(priv, "Can not allocate Buffer\n");
+                return -ENOMEM;
+        }
+
+        /* the statistic information display here is based on
+          * the last statistics notification from uCode
+          * might not reflect the current uCode activity
+          */
+        general = &priv->statistics.general;
+        dbg = &priv->statistics.general.dbg;
+        div = &priv->statistics.general.div;
+        accum_general = &priv->accum_statistics.general;
+        delta_general = &priv->delta_statistics.general;
+        max_general = &priv->max_delta.general;
+        accum_dbg = &priv->accum_statistics.general.dbg;
+        delta_dbg = &priv->delta_statistics.general.dbg;
+        max_dbg = &priv->max_delta.general.dbg;
+        accum_div = &priv->accum_statistics.general.div;
+        delta_div = &priv->delta_statistics.general.div;
+        max_div = &priv->max_delta.general.div;
+        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
+        pos += scnprintf(buf + pos, bufsz - pos, "%-32s     current"
+                         "acumulative       delta         max\n",
+                         "Statistics_General:");
+        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
+                         "temperature:",
+                         le32_to_cpu(general->temperature));
+        pos += scnprintf(buf + pos, bufsz - pos, "  %-30s %10u\n",
+                         "temperature_m:",
+                         le32_to_cpu(general->temperature_m));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_check:",
+                         le32_to_cpu(dbg->burst_check),
+                         accum_dbg->burst_check,
+                         delta_dbg->burst_check, max_dbg->burst_check);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "burst_count:",
+                         le32_to_cpu(dbg->burst_count),
+                         accum_dbg->burst_count,
+                         delta_dbg->burst_count, max_dbg->burst_count);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "sleep_time:",
+                         le32_to_cpu(general->sleep_time),
+                         accum_general->sleep_time,
+                         delta_general->sleep_time, max_general->sleep_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_out:",
+                         le32_to_cpu(general->slots_out),
+                         accum_general->slots_out,
+                         delta_general->slots_out, max_general->slots_out);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "slots_idle:",
+                         le32_to_cpu(general->slots_idle),
+                         accum_general->slots_idle,
+                         delta_general->slots_idle, max_general->slots_idle);
+        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
+                         le32_to_cpu(general->ttl_timestamp));
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_a:",
+                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
+                         delta_div->tx_on_a, max_div->tx_on_a);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "tx_on_b:",
+                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
+                         delta_div->tx_on_b, max_div->tx_on_b);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "exec_time:",
+                         le32_to_cpu(div->exec_time), accum_div->exec_time,
+                         delta_div->exec_time, max_div->exec_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "probe_time:",
+                         le32_to_cpu(div->probe_time), accum_div->probe_time,
+                         delta_div->probe_time, max_div->probe_time);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "rx_enable_counter:",
+                         le32_to_cpu(general->rx_enable_counter),
+                         accum_general->rx_enable_counter,
+                         delta_general->rx_enable_counter,
+                         max_general->rx_enable_counter);
+        pos += scnprintf(buf + pos, bufsz - pos,
+                         "  %-30s %10u  %10u  %10u  %10u\n",
+                         "num_of_sos_states:",
+                         le32_to_cpu(general->num_of_sos_states),
+                         accum_general->num_of_sos_states,
+                         delta_general->num_of_sos_states,
+                         max_general->num_of_sos_states);
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        kfree(buf);
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
new file mode 100644
index 000000000000..59b1f25f0d85
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-debugfs.h
@@ -0,0 +1,56 @@
+/******************************************************************************
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 - 2010 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include "iwl-dev.h"
+#include "iwl-core.h"
+#include "iwl-debug.h"
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
+ssize_t iwl_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos);
+ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos);
+#else
+static ssize_t iwl_ucode_rx_stats_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl_ucode_tx_stats_read(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        return 0;
+}
+static ssize_t iwl_ucode_general_stats_read(struct file *file, char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        return 0;
+}
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
index 28bc8f8ba981..44ef5d93befc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hcmd.c
@@ -262,6 +262,7 @@ struct iwl_hcmd_ops iwlagn_hcmd = {
         .commit_rxon = iwl_commit_rxon,
         .set_rxon_chain = iwl_set_rxon_chain,
         .set_tx_ant = iwlagn_send_tx_ant_config,
+        .send_bt_config = iwl_send_bt_config,
 };
 
 struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
@@ -271,4 +272,5 @@ struct iwl_hcmd_utils_ops iwlagn_hcmd_utils = {
         .chain_noise_reset = iwlagn_chain_noise_reset,
         .rts_tx_cmd_flag = iwlagn_rts_tx_cmd_flag,
         .calc_rssi = iwlagn_calc_rssi,
+        .request_scan = iwlagn_request_scan,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index c465c8590833..a27347425968 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -331,7 +331,7 @@ u16 iwlagn_eeprom_calib_version(struct iwl_priv *priv)
         } *hdr;
 
         hdr = (struct iwl_eeprom_calib_hdr *)iwl_eeprom_query_addr(priv,
-                                                        EEPROM_5000_CALIB_ALL);
+                                                        EEPROM_CALIB_ALL);
         return hdr->version;
 
 }
@@ -348,22 +348,22 @@ static u32 eeprom_indirect_address(const struct iwl_priv *priv, u32 address)
 
         switch (address & INDIRECT_TYPE_MSK) {
         case INDIRECT_HOST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_HOST);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_HOST);
                 break;
         case INDIRECT_GENERAL:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_GENERAL);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_GENERAL);
                 break;
         case INDIRECT_REGULATORY:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_REGULATORY);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_REGULATORY);
                 break;
         case INDIRECT_CALIBRATION:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_CALIBRATION);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_CALIBRATION);
                 break;
         case INDIRECT_PROCESS_ADJST:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_PROCESS_ADJST);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_PROCESS_ADJST);
                 break;
         case INDIRECT_OTHERS:
-                offset = iwl_eeprom_query16(priv, EEPROM_5000_LINK_OTHERS);
+                offset = iwl_eeprom_query16(priv, EEPROM_LINK_OTHERS);
                 break;
         default:
                 IWL_ERR(priv, "illegal indirect type: 0x%X\n",
@@ -1111,3 +1111,405 @@ void iwlagn_rx_reply_rx_phy(struct iwl_priv *priv,
         memcpy(&priv->_agn.last_phy_res, pkt->u.raw,
                sizeof(struct iwl_rx_phy_res));
 }
+
+static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     struct iwl_scan_channel *scan_ch)
+{
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int i, added = 0;
+        u16 channel = 0;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband) {
+                IWL_ERR(priv, "invalid band\n");
+                return added;
+        }
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+        /* only scan single channel, good enough to reset the RF */
+        /* pick the first valid not in-use channel */
+        if (band == IEEE80211_BAND_5GHZ) {
+                for (i = 14; i < priv->channel_count; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                channel = priv->channel_info[i].channel;
+                                ch_info = iwl_get_channel_info(priv,
+                                        band, channel);
+                                if (is_channel_valid(ch_info))
+                                        break;
+                        }
+                }
+        } else {
+                for (i = 0; i < 14; i++) {
+                        if (priv->channel_info[i].channel !=
+                            le16_to_cpu(priv->staging_rxon.channel)) {
+                                        channel =
+                                                priv->channel_info[i].channel;
+                                        ch_info = iwl_get_channel_info(priv,
+                                                band, channel);
+                                        if (is_channel_valid(ch_info))
+                                                break;
+                        }
+                }
+        }
+        if (channel) {
+                scan_ch->channel = cpu_to_le16(channel);
+                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+                added++;
+        } else
+                IWL_ERR(priv, "no valid channel found\n");
+        return added;
+}
+
+static int iwl_get_channels_for_scan(struct iwl_priv *priv,
+                                     enum ieee80211_band band,
+                                     u8 is_active, u8 n_probes,
+                                     struct iwl_scan_channel *scan_ch)
+{
+        struct ieee80211_channel *chan;
+        const struct ieee80211_supported_band *sband;
+        const struct iwl_channel_info *ch_info;
+        u16 passive_dwell = 0;
+        u16 active_dwell = 0;
+        int added, i;
+        u16 channel;
+
+        sband = iwl_get_hw_mode(priv, band);
+        if (!sband)
+                return 0;
+
+        active_dwell = iwl_get_active_dwell_time(priv, band, n_probes);
+        passive_dwell = iwl_get_passive_dwell_time(priv, band);
+
+        if (passive_dwell <= active_dwell)
+                passive_dwell = active_dwell + 1;
+
+        for (i = 0, added = 0; i < priv->scan_request->n_channels; i++) {
+                chan = priv->scan_request->channels[i];
+
+                if (chan->band != band)
+                        continue;
+
+                channel = ieee80211_frequency_to_channel(chan->center_freq);
+                scan_ch->channel = cpu_to_le16(channel);
+
+                ch_info = iwl_get_channel_info(priv, band, channel);
+                if (!is_channel_valid(ch_info)) {
+                        IWL_DEBUG_SCAN(priv, "Channel %d is INVALID for this band.\n",
+                                        channel);
+                        continue;
+                }
+
+                if (!is_active || is_channel_passive(ch_info) ||
+                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                        scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
+                else
+                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
+
+                if (n_probes)
+                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
+
+                scan_ch->active_dwell = cpu_to_le16(active_dwell);
+                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
+
+                /* Set txpower levels to defaults */
+                scan_ch->dsp_atten = 110;
+
+                /* NOTE: if we were doing 6Mb OFDM for scans we'd use
+                 * power level:
+                 * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
+                 */
+                if (band == IEEE80211_BAND_5GHZ)
+                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
+                else
+                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
+
+                IWL_DEBUG_SCAN(priv, "Scanning ch=%d prob=0x%X [%s %d]\n",
+                               channel, le32_to_cpu(scan_ch->type),
+                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
+                                "ACTIVE" : "PASSIVE",
+                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
+                               active_dwell : passive_dwell);
+
+                scan_ch++;
+                added++;
+        }
+
+        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
+        return added;
+}
+
+void iwlagn_request_scan(struct iwl_priv *priv)
+{
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_SCAN_CMD,
+                .len = sizeof(struct iwl_scan_cmd),
+                .flags = CMD_SIZE_HUGE,
+        };
+        struct iwl_scan_cmd *scan;
+        struct ieee80211_conf *conf = NULL;
+        u32 rate_flags = 0;
+        u16 cmd_len;
+        u16 rx_chain = 0;
+        enum ieee80211_band band;
+        u8 n_probes = 0;
+        u8 rx_ant = priv->hw_params.valid_rx_ant;
+        u8 rate;
+        bool is_active = false;
+        int  chan_mod;
+        u8 active_chains;
+
+        conf = ieee80211_get_hw_conf(priv->hw);
+
+        cancel_delayed_work(&priv->scan_check);
+
+        if (!iwl_is_ready(priv)) {
+                IWL_WARN(priv, "request scan called when driver not ready.\n");
+                goto done;
+        }
+
+        /* Make sure the scan wasn't canceled before this queued work
+         * was given the chance to run... */
+        if (!test_bit(STATUS_SCANNING, &priv->status))
+                goto done;
+
+        /* This should never be called or scheduled if there is currently
+         * a scan active in the hardware. */
+        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
+                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
+                               "Ignoring second request.\n");
+                goto done;
+        }
+
+        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
+                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
+                goto done;
+        }
+
+        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
+                goto done;
+        }
+
+        if (iwl_is_rfkill(priv)) {
+                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
+                goto done;
+        }
+
+        if (!test_bit(STATUS_READY, &priv->status)) {
+                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
+                goto done;
+        }
+
+        if (!priv->scan_cmd) {
+                priv->scan_cmd = kmalloc(sizeof(struct iwl_scan_cmd) +
+                                         IWL_MAX_SCAN_SIZE, GFP_KERNEL);
+                if (!priv->scan_cmd) {
+                        IWL_DEBUG_SCAN(priv,
+                                       "fail to allocate memory for scan\n");
+                        goto done;
+                }
+        }
+        scan = priv->scan_cmd;
+        memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
+
+        scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
+        scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
+
+        if (iwl_is_associated(priv)) {
+                u16 interval = 0;
+                u32 extra;
+                u32 suspend_time = 100;
+                u32 scan_suspend_time = 100;
+                unsigned long flags;
+
+                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
+                spin_lock_irqsave(&priv->lock, flags);
+                interval = priv->beacon_int;
+                spin_unlock_irqrestore(&priv->lock, flags);
+
+                scan->suspend_time = 0;
+                scan->max_out_time = cpu_to_le32(200 * 1024);
+                if (!interval)
+                        interval = suspend_time;
+
+                extra = (suspend_time / interval) << 22;
+                scan_suspend_time = (extra |
+                    ((suspend_time % interval) * 1024));
+                scan->suspend_time = cpu_to_le32(scan_suspend_time);
+                IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
+                               scan_suspend_time, interval);
+        }
+
+        if (priv->is_internal_short_scan) {
+                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
+        } else if (priv->scan_request->n_ssids) {
+                int i, p = 0;
+                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
+                for (i = 0; i < priv->scan_request->n_ssids; i++) {
+                        /* always does wildcard anyway */
+                        if (!priv->scan_request->ssids[i].ssid_len)
+                                continue;
+                        scan->direct_scan[p].id = WLAN_EID_SSID;
+                        scan->direct_scan[p].len =
+                                priv->scan_request->ssids[i].ssid_len;
+                        memcpy(scan->direct_scan[p].ssid,
+                               priv->scan_request->ssids[i].ssid,
+                               priv->scan_request->ssids[i].ssid_len);
+                        n_probes++;
+                        p++;
+                }
+                is_active = true;
+        } else
+                IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
+
+        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
+        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
+        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
+
+        switch (priv->scan_band) {
+        case IEEE80211_BAND_2GHZ:
+                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
+                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
+                                       >> RXON_FLG_CHANNEL_MODE_POS;
+                if (chan_mod == CHANNEL_MODE_PURE_40) {
+                        rate = IWL_RATE_6M_PLCP;
+                } else {
+                        rate = IWL_RATE_1M_PLCP;
+                        rate_flags = RATE_MCS_CCK_MSK;
+                }
+                scan->good_CRC_th = IWL_GOOD_CRC_TH_DISABLED;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                rate = IWL_RATE_6M_PLCP;
+                /*
+                 * If active scanning is requested but a certain channel is
+                 * marked passive, we can do active scanning if we detect
+                 * transmissions.
+                 *
+                 * There is an issue with some firmware versions that triggers
+                 * a sysassert on a "good CRC threshold" of zero (== disabled),
+                 * on a radar channel even though this means that we should NOT
+                 * send probes.
+                 *
+                 * The "good CRC threshold" is the number of frames that we
+                 * need to receive during our dwell time on a channel before
+                 * sending out probes -- setting this to a huge value will
+                 * mean we never reach it, but at the same time work around
+                 * the aforementioned issue. Thus use IWL_GOOD_CRC_TH_NEVER
+                 * here instead of IWL_GOOD_CRC_TH_DISABLED.
+                 */
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_NEVER;
+                break;
+        default:
+                IWL_WARN(priv, "Invalid scan band count\n");
+                goto done;
+        }
+
+        band = priv->scan_band;
+
+        if (priv->cfg->scan_antennas[band])
+                rx_ant = priv->cfg->scan_antennas[band];
+
+        priv->scan_tx_ant[band] =
+                        iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band]);
+        rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
+        scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
+
+        /* In power save mode use one chain, otherwise use all chains */
+        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
+                /* rx_ant has been set to all valid chains previously */
+                active_chains = rx_ant &
+                                ((u8)(priv->chain_noise_data.active_chains));
+                if (!active_chains)
+                        active_chains = rx_ant;
+
+                IWL_DEBUG_SCAN(priv, "chain_noise_data.active_chains: %u\n",
+                                priv->chain_noise_data.active_chains);
+
+                rx_ant = first_antenna(active_chains);
+        }
+        /* MIMO is not used here, but value is required */
+        rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
+        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
+        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
+        scan->rx_chain = cpu_to_le16(rx_chain);
+        if (!priv->is_internal_short_scan) {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        priv->scan_request->ie,
+                                        priv->scan_request->ie_len,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+        } else {
+                cmd_len = iwl_fill_probe_req(priv,
+                                        (struct ieee80211_mgmt *)scan->data,
+                                        NULL, 0,
+                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
+
+        }
+        scan->tx_cmd.len = cpu_to_le16(cmd_len);
+
+        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
+                               RXON_FILTER_BCON_AWARE_MSK);
+
+        if (priv->is_internal_short_scan) {
+                scan->channel_count =
+                        iwl_get_single_channel_for_scan(priv, band,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        } else {
+                scan->channel_count =
+                        iwl_get_channels_for_scan(priv, band,
+                                is_active, n_probes,
+                                (void *)&scan->data[le16_to_cpu(
+                                scan->tx_cmd.len)]);
+        }
+        if (scan->channel_count == 0) {
+                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
+                goto done;
+        }
+
+        cmd.len += le16_to_cpu(scan->tx_cmd.len) +
+            scan->channel_count * sizeof(struct iwl_scan_channel);
+        cmd.data = scan;
+        scan->len = cpu_to_le16(cmd.len);
+
+        set_bit(STATUS_SCAN_HW, &priv->status);
+        if (iwl_send_cmd_sync(priv, &cmd))
+                goto done;
+
+        queue_delayed_work(priv->workqueue, &priv->scan_check,
+                           IWL_SCAN_CHECK_WATCHDOG);
+
+        return;
+
+ done:
+        /* Cannot perform scan. Make sure we clear scanning
+        * bits from status so next scan request can be performed.
+        * If we don't clear scanning status bit here all next scan
+        * will fail
+        */
+        clear_bit(STATUS_SCAN_HW, &priv->status);
+        clear_bit(STATUS_SCANNING, &priv->status);
+        /* inform mac80211 scan aborted */
+        queue_work(priv->workqueue, &priv->scan_completed);
+}
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index f7d85a2173c8..bfcac5608d87 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -295,11 +295,11 @@ static u32 rs_tl_get_load(struct iwl_lq_sta *lq_data, u8 tid)
         return tl->total;
 }
 
-static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
+static int rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                                       struct iwl_lq_sta *lq_data, u8 tid,
                                       struct ieee80211_sta *sta)
 {
-        int ret;
+        int ret = -EAGAIN;
 
         if (rs_tl_get_load(lq_data, tid) > IWL_AGG_LOAD_THRESHOLD) {
                 IWL_DEBUG_HT(priv, "Starting Tx agg: STA: %pM tid: %d\n",
@@ -313,29 +313,29 @@ static void rs_tl_turn_on_agg_for_tid(struct iwl_priv *priv,
                          */
                         IWL_DEBUG_HT(priv, "Fail start Tx agg on tid: %d\n",
                                 tid);
-                        ret = ieee80211_stop_tx_ba_session(sta, tid,
+                        ieee80211_stop_tx_ba_session(sta, tid,
                                                 WLAN_BACK_INITIATOR);
                 }
-        }
+        } else
+                IWL_ERR(priv, "Fail finding valid aggregation tid: %d\n", tid);
+        return ret;
 }
 
 static void rs_tl_turn_on_agg(struct iwl_priv *priv, u8 tid,
                               struct iwl_lq_sta *lq_data,
                               struct ieee80211_sta *sta)
 {
-        if ((tid < TID_MAX_LOAD_COUNT))
-                rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
-        else if (tid == IWL_AGG_ALL_TID)
-                for (tid = 0; tid < TID_MAX_LOAD_COUNT; tid++)
-                        rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta);
-        if (priv->cfg->use_rts_for_ht) {
-                /*
-                 * switch to RTS/CTS if it is the prefer protection method
-                 * for HT traffic
-                 */
-                IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
-                priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
-                iwlcore_commit_rxon(priv);
+        if ((tid < TID_MAX_LOAD_COUNT) &&
+            !rs_tl_turn_on_agg_for_tid(priv, lq_data, tid, sta)) {
+                if (priv->cfg->use_rts_for_ht) {
+                        /*
+                         * switch to RTS/CTS if it is the prefer protection
+                         * method for HT traffic
+                         */
+                        IWL_DEBUG_HT(priv, "use RTS/CTS protection for HT\n");
+                        priv->staging_rxon.flags &= ~RXON_FLG_SELF_CTS_EN;
+                        iwlcore_commit_rxon(priv);
+                }
         }
 }
 
@@ -868,14 +868,14 @@ static void rs_tx_status(void *priv_r, struct ieee80211_supported_band *sband,
                 rs_get_tbl_info_from_mcs(tx_rate, priv->band, &tbl_type,
                                 &rs_index);
                 rs_collect_tx_data(curr_tbl, rs_index,
-                                   info->status.ampdu_ack_len,
-                                   info->status.ampdu_ack_map);
+                                   info->status.ampdu_len,
+                                   info->status.ampdu_ack_len);
 
                 /* Update success/fail counts if not searching for new mode */
                 if (lq_sta->stay_in_tbl) {
-                        lq_sta->total_success += info->status.ampdu_ack_map;
-                        lq_sta->total_failed += (info->status.ampdu_ack_len -
-                                        info->status.ampdu_ack_map);
+                        lq_sta->total_success += info->status.ampdu_ack_len;
+                        lq_sta->total_failed += (info->status.ampdu_len -
+                                        info->status.ampdu_ack_len);
                 }
         } else {
         /*
@@ -2078,10 +2078,12 @@ static void rs_rate_scale_perform(struct iwl_priv *priv,
         }
         /* Else we have enough samples; calculate estimate of
          * actual average throughput */
-
-        /* Sanity-check TPT calculations */
-        BUG_ON(window->average_tpt != ((window->success_ratio *
-                        tbl->expected_tpt[index] + 64) / 128));
+        if (window->average_tpt != ((window->success_ratio *
+                        tbl->expected_tpt[index] + 64) / 128)) {
+                IWL_ERR(priv, "expected_tpt should have been calculated by now\n");
+                window->average_tpt = ((window->success_ratio *
+                                        tbl->expected_tpt[index] + 64) / 128);
+        }
 
         /* If we are searching for better modulation mode, check success. */
         if (lq_sta->search_better_tbl &&
@@ -2558,8 +2560,17 @@ void iwl_rs_rate_init(struct iwl_priv *priv, struct ieee80211_sta *sta, u8 sta_i
                      lq_sta->active_mimo3_rate);
 
         /* These values will be overridden later */
-        lq_sta->lq.general_params.single_stream_ant_msk = ANT_A;
-        lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
+        lq_sta->lq.general_params.single_stream_ant_msk =
+                first_antenna(priv->hw_params.valid_tx_ant);
+        lq_sta->lq.general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!lq_sta->lq.general_params.dual_stream_ant_msk) {
+                lq_sta->lq.general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                lq_sta->lq.general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
index 3077eac58880..c2a5c85542bf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
@@ -83,6 +83,15 @@ static inline int get_fifo_from_ac(u8 ac)
         return ac_to_fifo[ac];
 }
 
+static inline int get_ac_from_tid(u16 tid)
+{
+        if (likely(tid < ARRAY_SIZE(tid_to_ac)))
+                return tid_to_ac[tid];
+
+        /* no support for TIDs 8-15 yet */
+        return -EINVAL;
+}
+
 static inline int get_fifo_from_tid(u16 tid)
 {
         if (likely(tid < ARRAY_SIZE(tid_to_ac)))
@@ -167,7 +176,7 @@ static int iwlagn_tx_queue_set_q2ratid(struct iwl_priv *priv, u16 ra_tid,
         scd_q2ratid = ra_tid & IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK;
 
         tbl_dw_addr = priv->scd_base_addr +
-                        IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
+                        IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(txq_id);
 
         tbl_dw = iwl_read_targ_mem(priv, tbl_dw_addr);
 
@@ -186,9 +195,9 @@ static void iwlagn_tx_queue_stop_scheduler(struct iwl_priv *priv, u16 txq_id)
         /* Simply stop the queue, but don't change any configuration;
          * the SCD_ACT_EN bit is the write-enable mask for the ACTIVE bit. */
         iwl_write_prph(priv,
-                IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                (0 << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
-                (1 << IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
+                IWLAGN_SCD_QUEUE_STATUS_BITS(txq_id),
+                (0 << IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE)|
+                (1 << IWLAGN_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
 }
 
 void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
@@ -196,7 +205,7 @@ void iwlagn_set_wr_ptrs(struct iwl_priv *priv,
 {
         iwl_write_direct32(priv, HBUS_TARG_WRPTR,
                         (index & 0xff) | (txq_id << 8));
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(txq_id), index);
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUE_RDPTR(txq_id), index);
 }
 
 void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
@@ -206,11 +215,11 @@ void iwlagn_tx_queue_set_status(struct iwl_priv *priv,
         int txq_id = txq->q.id;
         int active = test_bit(txq_id, &priv->txq_ctx_active_msk) ? 1 : 0;
 
-        iwl_write_prph(priv, IWL50_SCD_QUEUE_STATUS_BITS(txq_id),
-                        (active << IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
-                        (tx_fifo_id << IWL50_SCD_QUEUE_STTS_REG_POS_TXF) |
-                        (1 << IWL50_SCD_QUEUE_STTS_REG_POS_WSL) |
-                        IWL50_SCD_QUEUE_STTS_REG_MSK);
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUE_STATUS_BITS(txq_id),
+                        (active << IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE) |
+                        (tx_fifo_id << IWLAGN_SCD_QUEUE_STTS_REG_POS_TXF) |
+                        (1 << IWLAGN_SCD_QUEUE_STTS_REG_POS_WSL) |
+                        IWLAGN_SCD_QUEUE_STTS_REG_MSK);
 
         txq->sched_retry = scd_retry;
 
@@ -250,10 +259,10 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
         iwlagn_tx_queue_set_q2ratid(priv, ra_tid, txq_id);
 
         /* Set this queue as a chain-building queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_QUEUECHAIN_SEL, (1<<txq_id));
+        iwl_set_bits_prph(priv, IWLAGN_SCD_QUEUECHAIN_SEL, (1<<txq_id));
 
         /* enable aggregations for the queue */
-        iwl_set_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1<<txq_id));
+        iwl_set_bits_prph(priv, IWLAGN_SCD_AGGR_SEL, (1<<txq_id));
 
         /* Place first TFD at index corresponding to start sequence number.
          * Assumes that ssn_idx is valid (!= 0xFFF) */
@@ -263,16 +272,16 @@ int iwlagn_txq_agg_enable(struct iwl_priv *priv, int txq_id,
 
         /* Set up Tx window size and frame limit for this queue */
         iwl_write_targ_mem(priv, priv->scd_base_addr +
-                        IWL50_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
+                        IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(txq_id) +
                         sizeof(u32),
                         ((SCD_WIN_SIZE <<
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                        IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                        IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
                         ((SCD_FRAME_LIMIT <<
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                        IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+                        IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                        IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
 
-        iwl_set_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
+        iwl_set_bits_prph(priv, IWLAGN_SCD_INTERRUPT_MASK, (1 << txq_id));
 
         /* Set up Status area in SRAM, map to Tx DMA/FIFO, activate the queue */
         iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 1);
@@ -298,14 +307,14 @@ int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
 
         iwlagn_tx_queue_stop_scheduler(priv, txq_id);
 
-        iwl_clear_bits_prph(priv, IWL50_SCD_AGGR_SEL, (1 << txq_id));
+        iwl_clear_bits_prph(priv, IWLAGN_SCD_AGGR_SEL, (1 << txq_id));
 
         priv->txq[txq_id].q.read_ptr = (ssn_idx & 0xff);
         priv->txq[txq_id].q.write_ptr = (ssn_idx & 0xff);
         /* supposes that ssn_idx is valid (!= 0xFFF) */
         iwlagn_set_wr_ptrs(priv, txq_id, ssn_idx);
 
-        iwl_clear_bits_prph(priv, IWL50_SCD_INTERRUPT_MASK, (1 << txq_id));
+        iwl_clear_bits_prph(priv, IWLAGN_SCD_INTERRUPT_MASK, (1 << txq_id));
         iwl_txq_ctx_deactivate(priv, txq_id);
         iwlagn_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
 
@@ -318,7 +327,7 @@ int iwlagn_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
  */
 void iwlagn_txq_set_sched(struct iwl_priv *priv, u32 mask)
 {
-        iwl_write_prph(priv, IWL50_SCD_TXFACT, mask);
+        iwl_write_prph(priv, IWLAGN_SCD_TXFACT, mask);
 }
 
 static inline int get_queue_from_ac(u16 ac)
@@ -991,7 +1000,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, const u8 *ra, u16 tid, u16 *ssn)
         tid_data = &priv->stations[sta_id].tid[tid];
         *ssn = SEQ_TO_SN(tid_data->seq_number);
         tid_data->agg.txq_id = txq_id;
-        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(tx_fifo, txq_id);
+        priv->txq[txq_id].swq_id = iwl_virtual_agg_queue_num(get_ac_from_tid(tid), txq_id);
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         ret = priv->cfg->ops->lib->txq_agg_enable(priv, txq_id, tx_fifo,
@@ -1224,8 +1233,9 @@ static int iwlagn_tx_status_reply_compressed_ba(struct iwl_priv *priv,
         memset(&info->status, 0, sizeof(info->status));
         info->flags |= IEEE80211_TX_STAT_ACK;
         info->flags |= IEEE80211_TX_STAT_AMPDU;
-        info->status.ampdu_ack_map = successes;
-        info->status.ampdu_ack_len = agg->frame_count;
+        info->status.ampdu_ack_len = successes;
+        info->status.ampdu_ack_map = bitmap;
+        info->status.ampdu_len = agg->frame_count;
         iwlagn_hwrate_to_tx_control(priv, agg->rate_n_flags, info);
 
         IWL_DEBUG_TX_REPLY(priv, "Bitmap %llx\n", (unsigned long long)bitmap);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
index 52ae157968b2..ae476c234a7c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-ucode.c
@@ -207,7 +207,7 @@ static int iwlagn_set_Xtal_calib(struct iwl_priv *priv)
 {
         struct iwl_calib_xtal_freq_cmd cmd;
         __le16 *xtal_calib =
-                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_5000_XTAL);
+                (__le16 *)iwl_eeprom_query_addr(priv, EEPROM_XTAL);
 
         cmd.hdr.op_code = IWL_PHY_CALIBRATE_CRYSTAL_FRQ_CMD;
         cmd.hdr.first_group = 0;
@@ -329,19 +329,19 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
 
         spin_lock_irqsave(&priv->lock, flags);
 
-        priv->scd_base_addr = iwl_read_prph(priv, IWL50_SCD_SRAM_BASE_ADDR);
-        a = priv->scd_base_addr + IWL50_SCD_CONTEXT_DATA_OFFSET;
-        for (; a < priv->scd_base_addr + IWL50_SCD_TX_STTS_BITMAP_OFFSET;
+        priv->scd_base_addr = iwl_read_prph(priv, IWLAGN_SCD_SRAM_BASE_ADDR);
+        a = priv->scd_base_addr + IWLAGN_SCD_CONTEXT_DATA_OFFSET;
+        for (; a < priv->scd_base_addr + IWLAGN_SCD_TX_STTS_BITMAP_OFFSET;
                 a += 4)
                 iwl_write_targ_mem(priv, a, 0);
-        for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
+        for (; a < priv->scd_base_addr + IWLAGN_SCD_TRANSLATE_TBL_OFFSET;
                 a += 4)
                 iwl_write_targ_mem(priv, a, 0);
         for (; a < priv->scd_base_addr +
-               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
+               IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
                 iwl_write_targ_mem(priv, a, 0);
 
-        iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,
+        iwl_write_prph(priv, IWLAGN_SCD_DRAM_BASE_ADDR,
                        priv->scd_bc_tbls.dma >> 10);
 
         /* Enable DMA channel */
@@ -355,28 +355,28 @@ int iwlagn_alive_notify(struct iwl_priv *priv)
         iwl_write_direct32(priv, FH_TX_CHICKEN_BITS_REG,
                            reg_val | FH_TX_CHICKEN_BITS_SCD_AUTO_RETRY_EN);
 
-        iwl_write_prph(priv, IWL50_SCD_QUEUECHAIN_SEL,
-                IWL50_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
-        iwl_write_prph(priv, IWL50_SCD_AGGR_SEL, 0);
+        iwl_write_prph(priv, IWLAGN_SCD_QUEUECHAIN_SEL,
+                IWLAGN_SCD_QUEUECHAIN_SEL_ALL(priv->hw_params.max_txq_num));
+        iwl_write_prph(priv, IWLAGN_SCD_AGGR_SEL, 0);
 
         /* initiate the queues */
         for (i = 0; i < priv->hw_params.max_txq_num; i++) {
-                iwl_write_prph(priv, IWL50_SCD_QUEUE_RDPTR(i), 0);
+                iwl_write_prph(priv, IWLAGN_SCD_QUEUE_RDPTR(i), 0);
                 iwl_write_direct32(priv, HBUS_TARG_WRPTR, 0 | (i << 8));
                 iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
+                                IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(i), 0);
                 iwl_write_targ_mem(priv, priv->scd_base_addr +
-                                IWL50_SCD_CONTEXT_QUEUE_OFFSET(i) +
+                                IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(i) +
                                 sizeof(u32),
                                 ((SCD_WIN_SIZE <<
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
+                                IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS) &
+                                IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK) |
                                 ((SCD_FRAME_LIMIT <<
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
-                                IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
+                                IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS) &
+                                IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK));
         }
 
-        iwl_write_prph(priv, IWL50_SCD_INTERRUPT_MASK,
+        iwl_write_prph(priv, IWLAGN_SCD_INTERRUPT_MASK,
                         IWL_MASK(0, priv->hw_params.max_txq_num));
 
         /* Activate all Tx DMA/FIFO channels */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0b497d4bc659..a672d3379cfd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2174,7 +2174,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
         }
 
         /* Configure Bluetooth device coexistence support */
-        iwl_send_bt_config(priv);
+        priv->cfg->ops->hcmd->send_bt_config(priv);
 
         iwl_reset_run_time_calib(priv);
 
@@ -2654,7 +2654,6 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_AMPDU_AGGREGATION |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
@@ -3002,18 +3001,6 @@ static int iwl_mac_ampdu_action(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int iwl_mac_get_stats(struct ieee80211_hw *hw,
-                             struct ieee80211_low_level_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-
-        priv = hw->priv;
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-
 static void iwl_mac_sta_notify(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif,
                                enum sta_notify_cmd cmd,
@@ -3178,44 +3165,6 @@ static ssize_t store_tx_power(struct device *d,
 
 static DEVICE_ATTR(tx_power, S_IWUSR | S_IRUGO, show_tx_power, store_tx_power);
 
-static ssize_t show_statistics(struct device *d,
-                               struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        u32 size = sizeof(struct iwl_notif_statistics);
-        u32 len = 0, ofs = 0;
-        u8 *data = (u8 *)&priv->statistics;
-        int rc = 0;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-
-        if (rc) {
-                len = sprintf(buf,
-                              "Error sending statistics request: 0x%08X\n", rc);
-                return len;
-        }
-
-        while (size && (PAGE_SIZE - len)) {
-                hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
-                                   PAGE_SIZE - len, 1);
-                len = strlen(buf);
-                if (PAGE_SIZE - len)
-                        buf[len++] = '\n';
-
-                ofs += 16;
-                size -= min(size, 16U);
-        }
-
-        return len;
-}
-
-static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
-
 static ssize_t show_rts_ht_protection(struct device *d,
                              struct device_attribute *attr, char *buf)
 {
@@ -3305,6 +3254,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 
         cancel_delayed_work_sync(&priv->init_alive_start);
         cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->beacon_update);
         del_timer_sync(&priv->statistics_periodic);
@@ -3400,11 +3350,10 @@ static void iwl_uninit_drv(struct iwl_priv *priv)
         iwl_calib_free_results(priv);
         iwlcore_free_geos(priv);
         iwl_free_channel_map(priv);
-        kfree(priv->scan);
+        kfree(priv->scan_cmd);
 }
 
 static struct attribute *iwl_sysfs_entries[] = {
-        &dev_attr_statistics.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
         &dev_attr_rts_ht_protection.attr,
@@ -3429,7 +3378,6 @@ static struct ieee80211_ops iwl_hw_ops = {
         .configure_filter = iwl_configure_filter,
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
-        .get_stats = iwl_mac_get_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
@@ -3835,7 +3783,12 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x4238, 0x1111, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1311, iwl6000i_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4239, 0x1316, iwl6000i_2abg_cfg)},
-        {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000i_g2_2agn_cfg)},
+
+/* 6x00 Series Gen2 */
+        {IWL_PCI_DEVICE(0x0082, 0x1201, iwl6000g2_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1301, iwl6000g2_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0082, 0x1321, iwl6000g2_2agn_cfg)},
+        {IWL_PCI_DEVICE(0x0085, 0x1311, iwl6000g2_2agn_cfg)},
 
 /* 6x50 WiFi/WiMax Series */
         {IWL_PCI_DEVICE(0x0087, 0x1301, iwl6050_2agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 5d3142287e14..cfee9994383e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -171,4 +171,7 @@ static inline bool iwl_is_tx_success(u32 status)
                (status == TX_STATUS_DIRECT_DONE);
 }
 
+/* scan */
+void iwlagn_request_scan(struct iwl_priv *priv);
+
 #endif /* __iwl_agn_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-calib.c b/drivers/net/wireless/iwlwifi/iwl-calib.c
index 0471c3f8713e..f1fd00b1a65d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-calib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-calib.c
@@ -808,6 +808,18 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv,
                 }
         }
 
+        /*
+         * The above algorithm sometimes fails when the ucode
+         * reports 0 for all chains. It's not clear why that
+         * happens to start with, but it is then causing trouble
+         * because this can make us enable more chains than the
+         * hardware really has.
+         *
+         * To be safe, simply mask out any chains that we know
+         * are not on the device.
+         */
+        active_chains &= priv->hw_params.valid_rx_ant;
+
         num_tx_chains = 0;
         for (i = 0; i < NUM_RX_CHAINS; i++) {
                 /* loops on all the bits of
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index d830086ca195..0086019b7a15 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -1443,7 +1443,7 @@ struct iwl4965_rx_mpdu_res_start {
 
 /* 1: Ignore Bluetooth priority for this frame.
  * 0: Delay Tx until Bluetooth device is done (normal usage). */
-#define TX_CMD_FLG_BT_DIS_MSK cpu_to_le32(1 << 12)
+#define TX_CMD_FLG_IGNORE_BT cpu_to_le32(1 << 12)
 
 /* 1: uCode overrides sequence control field in MAC header.
  * 0: Driver provides sequence control field in MAC header.
@@ -2663,7 +2663,9 @@ struct iwl_ssid_ie {
 #define PROBE_OPTION_MAX_3945           4
 #define PROBE_OPTION_MAX                20
 #define TX_CMD_LIFE_TIME_INFINITE       cpu_to_le32(0xFFFFFFFF)
-#define IWL_GOOD_CRC_TH                 cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_DISABLED        0
+#define IWL_GOOD_CRC_TH_DEFAULT         cpu_to_le16(1)
+#define IWL_GOOD_CRC_TH_NEVER           cpu_to_le16(0xffff)
 #define IWL_MAX_SCAN_SIZE 1024
 #define IWL_MAX_CMD_SIZE 4096
 #define IWL_MAX_PROBE_REQUEST           200
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 2a89747d3473..4cdf4d3a9ddb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -829,19 +829,6 @@ static u8 iwl_count_chain_bitmap(u32 chain_bitmap)
 }
 
 /**
- * iwl_is_monitor_mode - Determine if interface in monitor mode
- *
- * priv->iw_mode is set in add_interface, but add_interface is
- * never called for monitor mode. The only way mac80211 informs us about
- * monitor mode is through configuring filters (call to configure_filter).
- */
-bool iwl_is_monitor_mode(struct iwl_priv *priv)
-{
-        return !!(priv->staging_rxon.filter_flags & RXON_FILTER_PROMISC_MSK);
-}
-EXPORT_SYMBOL(iwl_is_monitor_mode);
-
-/**
  * iwl_set_rxon_chain - Set up Rx chain usage in "staging" RXON image
  *
  * Selects how many and which Rx receivers/antennas/chains to use.
@@ -884,19 +871,6 @@ void iwl_set_rxon_chain(struct iwl_priv *priv)
         rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
         rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
 
-        /* copied from 'iwl_bg_request_scan()' */
-        /* Force use of chains B and C (0x6) for Rx
-         * Avoid A (0x1) for the device has off-channel reception on A-band.
-         * MIMO is not used here, but value is required */
-        if (iwl_is_monitor_mode(priv) &&
-            !(priv->staging_rxon.flags & RXON_FLG_BAND_24G_MSK) &&
-            priv->cfg->off_channel_workaround) {
-                rx_chain = ANT_ABC << RXON_RX_CHAIN_VALID_POS;
-                rx_chain |= ANT_BC << RXON_RX_CHAIN_FORCE_SEL_POS;
-                rx_chain |= ANT_ABC << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
-                rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
-        }
-
         priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
 
         if (!is_single && (active_rx_cnt >= IWL_NUM_RX_CHAINS_SINGLE) && is_cam)
@@ -1480,7 +1454,7 @@ irqreturn_t iwl_isr_legacy(int irq, void *data)
 }
 EXPORT_SYMBOL(iwl_isr_legacy);
 
-int iwl_send_bt_config(struct iwl_priv *priv)
+void iwl_send_bt_config(struct iwl_priv *priv)
 {
         struct iwl_bt_cmd bt_cmd = {
                 .lead_time = BT_LEAD_TIME_DEF,
@@ -1497,8 +1471,9 @@ int iwl_send_bt_config(struct iwl_priv *priv)
         IWL_DEBUG_INFO(priv, "BT coex %s\n",
                 (bt_cmd.flags == BT_COEX_DISABLE) ? "disable" : "active");
 
-        return iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
-                                sizeof(struct iwl_bt_cmd), &bt_cmd);
+        if (iwl_send_cmd_pdu(priv, REPLY_BT_CONFIG,
+                             sizeof(struct iwl_bt_cmd), &bt_cmd))
+                IWL_ERR(priv, "failed to send BT Coex Config\n");
 }
 EXPORT_SYMBOL(iwl_send_bt_config);
 
@@ -1868,7 +1843,6 @@ static inline void iwl_set_no_assoc(struct iwl_priv *priv)
         iwlcore_commit_rxon(priv);
 }
 
-#define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                           struct ieee80211_vif *vif,
                           struct ieee80211_bss_conf *bss_conf,
@@ -1989,14 +1963,6 @@ void iwl_bss_info_changed(struct ieee80211_hw *hw,
 
                         iwl_led_associate(priv);
 
-                        /*
-                         * We have just associated, don't start scan too early
-                         * leave time for EAPOL exchange to complete.
-                         *
-                         * XXX: do this in mac80211
-                         */
-                        priv->next_scan_jiffies = jiffies +
-                                        IWL_DELAY_NEXT_SCAN_AFTER_ASSOC;
                         if (!iwl_is_rfkill(priv))
                                 priv->cfg->ops->lib->post_associate(priv);
                 } else
@@ -2151,10 +2117,6 @@ EXPORT_SYMBOL(iwl_mac_remove_interface);
 
 /**
  * iwl_mac_config - mac80211 config callback
- *
- * We ignore conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME since it seems to
- * be set inappropriately and the driver currently sets the hardware up to
- * use it whenever needed.
  */
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
@@ -2383,11 +2345,11 @@ EXPORT_SYMBOL(iwl_free_txq_mem);
 
 int iwl_send_wimax_coex(struct iwl_priv *priv)
 {
-        struct iwl_wimax_coex_cmd uninitialized_var(coex_cmd);
+        struct iwl_wimax_coex_cmd coex_cmd;
 
         if (priv->cfg->support_wimax_coexist) {
                 /* UnMask wake up src at associated sleep */
-                coex_cmd.flags |= COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
+                coex_cmd.flags = COEX_FLAGS_ASSOC_WA_UNMASK_MSK;
 
                 /* UnMask wake up src at unassociated sleep */
                 coex_cmd.flags |= COEX_FLAGS_UNASSOC_WA_UNMASK_MSK;
@@ -2802,7 +2764,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
          */
         IWL_DEBUG_INFO(priv, "perform radio reset.\n");
         iwl_internal_short_hw_scan(priv);
-        return;
 }
 
 
@@ -2970,6 +2931,12 @@ int iwl_pci_resume(struct pci_dev *pdev)
         struct iwl_priv *priv = pci_get_drvdata(pdev);
         int ret;
 
+        /*
+         * We disable the RETRY_TIMEOUT register (0x41) to keep
+         * PCI Tx retries from interfering with C3 CPU state.
+         */
+        pci_write_config_byte(pdev, PCI_CFG_RETRY_TIMEOUT, 0x00);
+
         pci_set_power_state(pdev, PCI_D0);
         ret = pci_enable_device(pdev);
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index d89755f5031a..727360944859 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -90,6 +90,7 @@ struct iwl_hcmd_ops {
         int (*commit_rxon)(struct iwl_priv *priv);
         void (*set_rxon_chain)(struct iwl_priv *priv);
         int (*set_tx_ant)(struct iwl_priv *priv, u8 valid_tx_ant);
+        void (*send_bt_config)(struct iwl_priv *priv);
 };
 
 struct iwl_hcmd_utils_ops {
@@ -105,6 +106,7 @@ struct iwl_hcmd_utils_ops {
                         __le32 *tx_flags);
         int  (*calc_rssi)(struct iwl_priv *priv,
                           struct iwl_rx_phy_res *rx_resp);
+        void (*request_scan)(struct iwl_priv *priv);
 };
 
 struct iwl_apm_ops {
@@ -114,6 +116,15 @@ struct iwl_apm_ops {
         int (*set_pwr_src)(struct iwl_priv *priv, enum iwl_pwr_src src);
 };
 
+struct iwl_debugfs_ops {
+        ssize_t (*rx_stats_read)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
+        ssize_t (*tx_stats_read)(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos);
+        ssize_t (*general_stats_read)(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos);
+};
+
 struct iwl_temp_ops {
         void (*temperature)(struct iwl_priv *priv);
         void (*set_ct_kill)(struct iwl_priv *priv);
@@ -199,6 +210,7 @@ struct iwl_lib_ops {
         /* check for ack health */
         bool (*check_ack_health)(struct iwl_priv *priv,
                                         struct iwl_rx_packet *pkt);
+        struct iwl_debugfs_ops debugfs_ops;
 };
 
 struct iwl_led_ops {
@@ -306,8 +318,8 @@ struct iwl_cfg {
         /* timer period for monitor the driver queues */
         u32 monitor_recover_period;
         bool temperature_kelvin;
-        bool off_channel_workaround;
         u32 max_event_log_size;
+        u8 scan_antennas[IEEE80211_NUM_BANDS];
 };
 
 /***************************
@@ -339,7 +351,6 @@ void iwl_configure_filter(struct ieee80211_hw *hw,
                           unsigned int changed_flags,
                           unsigned int *total_flags, u64 multicast);
 int iwl_set_hw_params(struct iwl_priv *priv);
-bool iwl_is_monitor_mode(struct iwl_priv *priv);
 void iwl_post_associate(struct iwl_priv *priv);
 void iwl_bss_info_changed(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
@@ -501,8 +512,10 @@ static inline __le32 iwl_hw_set_rate_n_flags(u8 rate, u32 flags)
 void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
-int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+int iwl_mac_hw_scan(struct ieee80211_hw *hw,
+                    struct ieee80211_vif *vif,
+                    struct cfg80211_scan_request *req);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                        const u8 *ie, int ie_len, int left);
@@ -526,6 +539,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv);
 #define IWL_ACTIVE_QUIET_TIME       cpu_to_le16(10)  /* msec */
 #define IWL_PLCP_QUIET_THRESH       cpu_to_le16(1)  /* packets */
 
+#define IWL_SCAN_CHECK_WATCHDOG         (HZ * 7)
 
 /*******************************************************************************
  * Calibrations - implemented in iwl-calib.c
@@ -665,7 +679,7 @@ static inline int iwl_is_ready_rf(struct iwl_priv *priv)
 }
 
 extern void iwl_rf_kill_ct_config(struct iwl_priv *priv);
-extern int iwl_send_bt_config(struct iwl_priv *priv);
+extern void iwl_send_bt_config(struct iwl_priv *priv);
 extern int iwl_send_statistics_request(struct iwl_priv *priv,
                                        u8 flags, bool clear);
 extern int iwl_verify_ucode(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 808b7146bead..254c35ae8b38 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -298,6 +298,7 @@
 #define CSR_HW_REV_TYPE_1000           (0x0000060)
 #define CSR_HW_REV_TYPE_6x00           (0x0000070)
 #define CSR_HW_REV_TYPE_6x50           (0x0000080)
+#define CSR_HW_REV_TYPE_6x00g2         (0x00000B0)
 #define CSR_HW_REV_TYPE_NONE           (0x00000F0)
 
 /* EEPROM REG */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index 1c7b53d511c7..5c2bcef5df0c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -78,6 +78,8 @@ static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_dbgfs_register(struct iwl_priv *priv, const char *name);
 void iwl_dbgfs_unregister(struct iwl_priv *priv);
+extern int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
+                                     int bufsz);
 #else
 static inline int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
 {
diff --git a/drivers/net/wireless/iwlwifi/iwl-debugfs.c b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
index 607a91f3eb6b..4aabb542fcbe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-debugfs.c
@@ -106,6 +106,26 @@ static const struct file_operations iwl_dbgfs_##name##_ops = {          \
         .open = iwl_dbgfs_open_file_generic,                            \
 };
 
+int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf, int bufsz)
+{
+        int p = 0;
+
+        p += scnprintf(buf + p, bufsz - p, "Statistics Flag(0x%X):\n",
+                       le32_to_cpu(priv->statistics.flag));
+        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
+                p += scnprintf(buf + p, bufsz - p,
+                               "\tStatistics have been cleared\n");
+        p += scnprintf(buf + p, bufsz - p, "\tOperational Frequency: %s\n",
+                       (le32_to_cpu(priv->statistics.flag) &
+                        UCODE_STATISTICS_FREQUENCY_MSK)
+                        ? "2.4 GHz" : "5.2 GHz");
+        p += scnprintf(buf + p, bufsz - p, "\tTGj Narrow Band: %s\n",
+                       (le32_to_cpu(priv->statistics.flag) &
+                        UCODE_STATISTICS_NARROW_BAND_MSK)
+                        ? "enabled" : "disabled");
+        return p;
+}
+EXPORT_SYMBOL(iwl_dbgfs_statistics_flag);
 
 static ssize_t iwl_dbgfs_tx_statistics_read(struct file *file,
                                                 char __user *user_buf,
@@ -1034,474 +1054,13 @@ static ssize_t iwl_dbgfs_rx_queue_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static int iwl_dbgfs_statistics_flag(struct iwl_priv *priv, char *buf,
-                                     int bufsz)
-{
-        int p = 0;
-
-        p += scnprintf(buf + p, bufsz - p,
-                "Statistics Flag(0x%X):\n",
-                le32_to_cpu(priv->statistics.flag));
-        if (le32_to_cpu(priv->statistics.flag) & UCODE_STATISTICS_CLEAR_MSK)
-                p += scnprintf(buf + p, bufsz - p,
-                "\tStatistics have been cleared\n");
-        p += scnprintf(buf + p, bufsz - p,
-                "\tOperational Frequency: %s\n",
-                (le32_to_cpu(priv->statistics.flag) &
-                UCODE_STATISTICS_FREQUENCY_MSK)
-                 ? "2.4 GHz" : "5.2 GHz");
-        p += scnprintf(buf + p, bufsz - p,
-                "\tTGj Narrow Band: %s\n",
-                (le32_to_cpu(priv->statistics.flag) &
-                UCODE_STATISTICS_NARROW_BAND_MSK)
-                 ? "enabled" : "disabled");
-        return p;
-}
-
-static const char ucode_stats_header[] =
-        "%-32s     current  acumulative       delta         max\n";
-static const char ucode_stats_short_format[] =
-        "  %-30s %10u\n";
-static const char ucode_stats_format[] =
-        "  %-30s %10u  %10u  %10u  %10u\n";
-
 static ssize_t iwl_dbgfs_ucode_rx_stats_read(struct file *file,
                                         char __user *user_buf,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = sizeof(struct statistics_rx_phy) * 40 +
-                sizeof(struct statistics_rx_non_phy) * 40 +
-                sizeof(struct statistics_rx_ht_phy) * 40 + 400;
-        ssize_t ret;
-        struct statistics_rx_phy *ofdm, *accum_ofdm, *delta_ofdm, *max_ofdm;
-        struct statistics_rx_phy *cck, *accum_cck, *delta_cck, *max_cck;
-        struct statistics_rx_non_phy *general, *accum_general;
-        struct statistics_rx_non_phy *delta_general, *max_general;
-        struct statistics_rx_ht_phy *ht, *accum_ht, *delta_ht, *max_ht;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        ofdm = &priv->statistics.rx.ofdm;
-        cck = &priv->statistics.rx.cck;
-        general = &priv->statistics.rx.general;
-        ht = &priv->statistics.rx.ofdm_ht;
-        accum_ofdm = &priv->accum_statistics.rx.ofdm;
-        accum_cck = &priv->accum_statistics.rx.cck;
-        accum_general = &priv->accum_statistics.rx.general;
-        accum_ht = &priv->accum_statistics.rx.ofdm_ht;
-        delta_ofdm = &priv->delta_statistics.rx.ofdm;
-        delta_cck = &priv->delta_statistics.rx.cck;
-        delta_general = &priv->delta_statistics.rx.general;
-        delta_ht = &priv->delta_statistics.rx.ofdm_ht;
-        max_ofdm = &priv->max_delta.rx.ofdm;
-        max_cck = &priv->max_delta.rx.cck;
-        max_general = &priv->max_delta.rx.general;
-        max_ht = &priv->max_delta.rx.ofdm_ht;
-
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                         "Statistics_Rx - OFDM:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ina_cnt:", le32_to_cpu(ofdm->ina_cnt),
-                         accum_ofdm->ina_cnt,
-                         delta_ofdm->ina_cnt, max_ofdm->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_cnt:",
-                         le32_to_cpu(ofdm->fina_cnt), accum_ofdm->fina_cnt,
-                         delta_ofdm->fina_cnt, max_ofdm->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(ofdm->plcp_err), accum_ofdm->plcp_err,
-                         delta_ofdm->plcp_err, max_ofdm->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(ofdm->crc32_err), accum_ofdm->crc32_err,
-                         delta_ofdm->crc32_err, max_ofdm->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(ofdm->overrun_err),
-                         accum_ofdm->overrun_err,
-                         delta_ofdm->overrun_err, max_ofdm->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(ofdm->early_overrun_err),
-                         accum_ofdm->early_overrun_err,
-                         delta_ofdm->early_overrun_err,
-                         max_ofdm->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(ofdm->crc32_good),
-                         accum_ofdm->crc32_good,
-                         delta_ofdm->crc32_good, max_ofdm->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "false_alarm_cnt:",
-                         le32_to_cpu(ofdm->false_alarm_cnt),
-                         accum_ofdm->false_alarm_cnt,
-                         delta_ofdm->false_alarm_cnt,
-                         max_ofdm->false_alarm_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_sync_err_cnt:",
-                         le32_to_cpu(ofdm->fina_sync_err_cnt),
-                         accum_ofdm->fina_sync_err_cnt,
-                         delta_ofdm->fina_sync_err_cnt,
-                         max_ofdm->fina_sync_err_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sfd_timeout:",
-                         le32_to_cpu(ofdm->sfd_timeout),
-                         accum_ofdm->sfd_timeout,
-                         delta_ofdm->sfd_timeout,
-                         max_ofdm->sfd_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_timeout:",
-                         le32_to_cpu(ofdm->fina_timeout),
-                         accum_ofdm->fina_timeout,
-                         delta_ofdm->fina_timeout,
-                         max_ofdm->fina_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unresponded_rts:",
-                         le32_to_cpu(ofdm->unresponded_rts),
-                         accum_ofdm->unresponded_rts,
-                         delta_ofdm->unresponded_rts,
-                         max_ofdm->unresponded_rts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "rxe_frame_lmt_ovrun:",
-                         le32_to_cpu(ofdm->rxe_frame_limit_overrun),
-                         accum_ofdm->rxe_frame_limit_overrun,
-                         delta_ofdm->rxe_frame_limit_overrun,
-                         max_ofdm->rxe_frame_limit_overrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ack_cnt:",
-                         le32_to_cpu(ofdm->sent_ack_cnt),
-                         accum_ofdm->sent_ack_cnt,
-                         delta_ofdm->sent_ack_cnt,
-                         max_ofdm->sent_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_cts_cnt:",
-                         le32_to_cpu(ofdm->sent_cts_cnt),
-                         accum_ofdm->sent_cts_cnt,
-                         delta_ofdm->sent_cts_cnt, max_ofdm->sent_cts_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ba_rsp_cnt:",
-                         le32_to_cpu(ofdm->sent_ba_rsp_cnt),
-                         accum_ofdm->sent_ba_rsp_cnt,
-                         delta_ofdm->sent_ba_rsp_cnt,
-                         max_ofdm->sent_ba_rsp_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_self_kill:",
-                         le32_to_cpu(ofdm->dsp_self_kill),
-                         accum_ofdm->dsp_self_kill,
-                         delta_ofdm->dsp_self_kill,
-                         max_ofdm->dsp_self_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(ofdm->mh_format_err),
-                         accum_ofdm->mh_format_err,
-                         delta_ofdm->mh_format_err,
-                         max_ofdm->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "re_acq_main_rssi_sum:",
-                         le32_to_cpu(ofdm->re_acq_main_rssi_sum),
-                         accum_ofdm->re_acq_main_rssi_sum,
-                         delta_ofdm->re_acq_main_rssi_sum,
-                        max_ofdm->re_acq_main_rssi_sum);
-
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                         "Statistics_Rx - CCK:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ina_cnt:",
-                         le32_to_cpu(cck->ina_cnt), accum_cck->ina_cnt,
-                         delta_cck->ina_cnt, max_cck->ina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_cnt:",
-                         le32_to_cpu(cck->fina_cnt), accum_cck->fina_cnt,
-                         delta_cck->fina_cnt, max_cck->fina_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(cck->plcp_err), accum_cck->plcp_err,
-                         delta_cck->plcp_err, max_cck->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(cck->crc32_err), accum_cck->crc32_err,
-                         delta_cck->crc32_err, max_cck->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(cck->overrun_err),
-                         accum_cck->overrun_err,
-                         delta_cck->overrun_err, max_cck->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(cck->early_overrun_err),
-                         accum_cck->early_overrun_err,
-                         delta_cck->early_overrun_err,
-                         max_cck->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(cck->crc32_good), accum_cck->crc32_good,
-                         delta_cck->crc32_good,
-                         max_cck->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "false_alarm_cnt:",
-                         le32_to_cpu(cck->false_alarm_cnt),
-                         accum_cck->false_alarm_cnt,
-                         delta_cck->false_alarm_cnt, max_cck->false_alarm_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_sync_err_cnt:",
-                         le32_to_cpu(cck->fina_sync_err_cnt),
-                         accum_cck->fina_sync_err_cnt,
-                         delta_cck->fina_sync_err_cnt,
-                         max_cck->fina_sync_err_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sfd_timeout:",
-                         le32_to_cpu(cck->sfd_timeout),
-                         accum_cck->sfd_timeout,
-                         delta_cck->sfd_timeout, max_cck->sfd_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "fina_timeout:",
-                         le32_to_cpu(cck->fina_timeout),
-                         accum_cck->fina_timeout,
-                         delta_cck->fina_timeout, max_cck->fina_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unresponded_rts:",
-                         le32_to_cpu(cck->unresponded_rts),
-                         accum_cck->unresponded_rts,
-                         delta_cck->unresponded_rts,
-                         max_cck->unresponded_rts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "rxe_frame_lmt_ovrun:",
-                         le32_to_cpu(cck->rxe_frame_limit_overrun),
-                         accum_cck->rxe_frame_limit_overrun,
-                         delta_cck->rxe_frame_limit_overrun,
-                         max_cck->rxe_frame_limit_overrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ack_cnt:",
-                         le32_to_cpu(cck->sent_ack_cnt),
-                         accum_cck->sent_ack_cnt,
-                         delta_cck->sent_ack_cnt,
-                         max_cck->sent_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_cts_cnt:",
-                         le32_to_cpu(cck->sent_cts_cnt),
-                         accum_cck->sent_cts_cnt,
-                         delta_cck->sent_cts_cnt,
-                         max_cck->sent_cts_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sent_ba_rsp_cnt:",
-                         le32_to_cpu(cck->sent_ba_rsp_cnt),
-                         accum_cck->sent_ba_rsp_cnt,
-                         delta_cck->sent_ba_rsp_cnt,
-                         max_cck->sent_ba_rsp_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_self_kill:",
-                         le32_to_cpu(cck->dsp_self_kill),
-                         accum_cck->dsp_self_kill,
-                         delta_cck->dsp_self_kill,
-                         max_cck->dsp_self_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(cck->mh_format_err),
-                         accum_cck->mh_format_err,
-                         delta_cck->mh_format_err, max_cck->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "re_acq_main_rssi_sum:",
-                         le32_to_cpu(cck->re_acq_main_rssi_sum),
-                         accum_cck->re_acq_main_rssi_sum,
-                         delta_cck->re_acq_main_rssi_sum,
-                         max_cck->re_acq_main_rssi_sum);
-
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_Rx - GENERAL:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bogus_cts:",
-                         le32_to_cpu(general->bogus_cts),
-                         accum_general->bogus_cts,
-                         delta_general->bogus_cts, max_general->bogus_cts);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bogus_ack:",
-                         le32_to_cpu(general->bogus_ack),
-                         accum_general->bogus_ack,
-                         delta_general->bogus_ack, max_general->bogus_ack);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "non_bssid_frames:",
-                         le32_to_cpu(general->non_bssid_frames),
-                         accum_general->non_bssid_frames,
-                         delta_general->non_bssid_frames,
-                         max_general->non_bssid_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "filtered_frames:",
-                         le32_to_cpu(general->filtered_frames),
-                         accum_general->filtered_frames,
-                         delta_general->filtered_frames,
-                         max_general->filtered_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "non_channel_beacons:",
-                         le32_to_cpu(general->non_channel_beacons),
-                         accum_general->non_channel_beacons,
-                         delta_general->non_channel_beacons,
-                         max_general->non_channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "channel_beacons:",
-                         le32_to_cpu(general->channel_beacons),
-                         accum_general->channel_beacons,
-                         delta_general->channel_beacons,
-                         max_general->channel_beacons);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "num_missed_bcon:",
-                         le32_to_cpu(general->num_missed_bcon),
-                         accum_general->num_missed_bcon,
-                         delta_general->num_missed_bcon,
-                         max_general->num_missed_bcon);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "adc_rx_saturation_time:",
-                         le32_to_cpu(general->adc_rx_saturation_time),
-                         accum_general->adc_rx_saturation_time,
-                         delta_general->adc_rx_saturation_time,
-                         max_general->adc_rx_saturation_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "ina_detect_search_tm:",
-                         le32_to_cpu(general->ina_detection_search_time),
-                         accum_general->ina_detection_search_time,
-                         delta_general->ina_detection_search_time,
-                         max_general->ina_detection_search_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_a:",
-                         le32_to_cpu(general->beacon_silence_rssi_a),
-                         accum_general->beacon_silence_rssi_a,
-                         delta_general->beacon_silence_rssi_a,
-                         max_general->beacon_silence_rssi_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_b:",
-                         le32_to_cpu(general->beacon_silence_rssi_b),
-                         accum_general->beacon_silence_rssi_b,
-                         delta_general->beacon_silence_rssi_b,
-                         max_general->beacon_silence_rssi_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_silence_rssi_c:",
-                         le32_to_cpu(general->beacon_silence_rssi_c),
-                         accum_general->beacon_silence_rssi_c,
-                         delta_general->beacon_silence_rssi_c,
-                         max_general->beacon_silence_rssi_c);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "interference_data_flag:",
-                         le32_to_cpu(general->interference_data_flag),
-                         accum_general->interference_data_flag,
-                         delta_general->interference_data_flag,
-                         max_general->interference_data_flag);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "channel_load:",
-                         le32_to_cpu(general->channel_load),
-                         accum_general->channel_load,
-                         delta_general->channel_load,
-                         max_general->channel_load);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dsp_false_alarms:",
-                         le32_to_cpu(general->dsp_false_alarms),
-                         accum_general->dsp_false_alarms,
-                         delta_general->dsp_false_alarms,
-                         max_general->dsp_false_alarms);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_a:",
-                         le32_to_cpu(general->beacon_rssi_a),
-                         accum_general->beacon_rssi_a,
-                         delta_general->beacon_rssi_a,
-                         max_general->beacon_rssi_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_b:",
-                         le32_to_cpu(general->beacon_rssi_b),
-                         accum_general->beacon_rssi_b,
-                         delta_general->beacon_rssi_b,
-                         max_general->beacon_rssi_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_rssi_c:",
-                         le32_to_cpu(general->beacon_rssi_c),
-                         accum_general->beacon_rssi_c,
-                         delta_general->beacon_rssi_c,
-                         max_general->beacon_rssi_c);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_a:",
-                         le32_to_cpu(general->beacon_energy_a),
-                         accum_general->beacon_energy_a,
-                         delta_general->beacon_energy_a,
-                         max_general->beacon_energy_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_b:",
-                         le32_to_cpu(general->beacon_energy_b),
-                         accum_general->beacon_energy_b,
-                         delta_general->beacon_energy_b,
-                         max_general->beacon_energy_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "beacon_energy_c:",
-                         le32_to_cpu(general->beacon_energy_c),
-                         accum_general->beacon_energy_c,
-                         delta_general->beacon_energy_c,
-                         max_general->beacon_energy_c);
-
-        pos += scnprintf(buf + pos, bufsz - pos, "Statistics_Rx - OFDM_HT:\n");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_Rx - OFDM_HT:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "plcp_err:",
-                         le32_to_cpu(ht->plcp_err), accum_ht->plcp_err,
-                         delta_ht->plcp_err, max_ht->plcp_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "overrun_err:",
-                         le32_to_cpu(ht->overrun_err), accum_ht->overrun_err,
-                         delta_ht->overrun_err, max_ht->overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "early_overrun_err:",
-                         le32_to_cpu(ht->early_overrun_err),
-                         accum_ht->early_overrun_err,
-                         delta_ht->early_overrun_err,
-                         max_ht->early_overrun_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_good:",
-                         le32_to_cpu(ht->crc32_good), accum_ht->crc32_good,
-                         delta_ht->crc32_good, max_ht->crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "crc32_err:",
-                         le32_to_cpu(ht->crc32_err), accum_ht->crc32_err,
-                         delta_ht->crc32_err, max_ht->crc32_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "mh_format_err:",
-                         le32_to_cpu(ht->mh_format_err),
-                         accum_ht->mh_format_err,
-                         delta_ht->mh_format_err, max_ht->mh_format_err);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_crc32_good:",
-                         le32_to_cpu(ht->agg_crc32_good),
-                         accum_ht->agg_crc32_good,
-                         delta_ht->agg_crc32_good, max_ht->agg_crc32_good);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_mpdu_cnt:",
-                         le32_to_cpu(ht->agg_mpdu_cnt),
-                         accum_ht->agg_mpdu_cnt,
-                         delta_ht->agg_mpdu_cnt, max_ht->agg_mpdu_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg_cnt:",
-                         le32_to_cpu(ht->agg_cnt), accum_ht->agg_cnt,
-                         delta_ht->agg_cnt, max_ht->agg_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "unsupport_mcs:",
-                         le32_to_cpu(ht->unsupport_mcs),
-                         accum_ht->unsupport_mcs,
-                         delta_ht->unsupport_mcs, max_ht->unsupport_mcs);
-
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.rx_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
@@ -1509,173 +1068,8 @@ static ssize_t iwl_dbgfs_ucode_tx_stats_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = (sizeof(struct statistics_tx) * 48) + 250;
-        ssize_t ret;
-        struct statistics_tx *tx, *accum_tx, *delta_tx, *max_tx;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        tx = &priv->statistics.tx;
-        accum_tx = &priv->accum_statistics.tx;
-        delta_tx = &priv->delta_statistics.tx;
-        max_tx = &priv->max_delta.tx;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos,  ucode_stats_header,
-                        "Statistics_Tx:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "preamble:",
-                         le32_to_cpu(tx->preamble_cnt),
-                         accum_tx->preamble_cnt,
-                         delta_tx->preamble_cnt, max_tx->preamble_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "rx_detected_cnt:",
-                         le32_to_cpu(tx->rx_detected_cnt),
-                         accum_tx->rx_detected_cnt,
-                         delta_tx->rx_detected_cnt, max_tx->rx_detected_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bt_prio_defer_cnt:",
-                         le32_to_cpu(tx->bt_prio_defer_cnt),
-                         accum_tx->bt_prio_defer_cnt,
-                         delta_tx->bt_prio_defer_cnt,
-                         max_tx->bt_prio_defer_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "bt_prio_kill_cnt:",
-                         le32_to_cpu(tx->bt_prio_kill_cnt),
-                         accum_tx->bt_prio_kill_cnt,
-                         delta_tx->bt_prio_kill_cnt,
-                         max_tx->bt_prio_kill_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "few_bytes_cnt:",
-                         le32_to_cpu(tx->few_bytes_cnt),
-                         accum_tx->few_bytes_cnt,
-                         delta_tx->few_bytes_cnt, max_tx->few_bytes_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "cts_timeout:",
-                         le32_to_cpu(tx->cts_timeout), accum_tx->cts_timeout,
-                         delta_tx->cts_timeout, max_tx->cts_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "ack_timeout:",
-                         le32_to_cpu(tx->ack_timeout),
-                         accum_tx->ack_timeout,
-                         delta_tx->ack_timeout, max_tx->ack_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "expected_ack_cnt:",
-                         le32_to_cpu(tx->expected_ack_cnt),
-                         accum_tx->expected_ack_cnt,
-                         delta_tx->expected_ack_cnt,
-                         max_tx->expected_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "actual_ack_cnt:",
-                         le32_to_cpu(tx->actual_ack_cnt),
-                         accum_tx->actual_ack_cnt,
-                         delta_tx->actual_ack_cnt,
-                         max_tx->actual_ack_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "dump_msdu_cnt:",
-                         le32_to_cpu(tx->dump_msdu_cnt),
-                         accum_tx->dump_msdu_cnt,
-                         delta_tx->dump_msdu_cnt,
-                         max_tx->dump_msdu_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "abort_nxt_frame_mismatch:",
-                         le32_to_cpu(tx->burst_abort_next_frame_mismatch_cnt),
-                         accum_tx->burst_abort_next_frame_mismatch_cnt,
-                         delta_tx->burst_abort_next_frame_mismatch_cnt,
-                         max_tx->burst_abort_next_frame_mismatch_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "abort_missing_nxt_frame:",
-                         le32_to_cpu(tx->burst_abort_missing_next_frame_cnt),
-                         accum_tx->burst_abort_missing_next_frame_cnt,
-                         delta_tx->burst_abort_missing_next_frame_cnt,
-                         max_tx->burst_abort_missing_next_frame_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "cts_timeout_collision:",
-                         le32_to_cpu(tx->cts_timeout_collision),
-                         accum_tx->cts_timeout_collision,
-                         delta_tx->cts_timeout_collision,
-                         max_tx->cts_timeout_collision);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "ack_ba_timeout_collision:",
-                         le32_to_cpu(tx->ack_or_ba_timeout_collision),
-                         accum_tx->ack_or_ba_timeout_collision,
-                         delta_tx->ack_or_ba_timeout_collision,
-                         max_tx->ack_or_ba_timeout_collision);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg ba_timeout:",
-                         le32_to_cpu(tx->agg.ba_timeout),
-                         accum_tx->agg.ba_timeout,
-                         delta_tx->agg.ba_timeout,
-                         max_tx->agg.ba_timeout);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg ba_resched_frames:",
-                         le32_to_cpu(tx->agg.ba_reschedule_frames),
-                         accum_tx->agg.ba_reschedule_frames,
-                         delta_tx->agg.ba_reschedule_frames,
-                         max_tx->agg.ba_reschedule_frames);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg scd_query_agg_frame:",
-                         le32_to_cpu(tx->agg.scd_query_agg_frame_cnt),
-                         accum_tx->agg.scd_query_agg_frame_cnt,
-                         delta_tx->agg.scd_query_agg_frame_cnt,
-                         max_tx->agg.scd_query_agg_frame_cnt);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg scd_query_no_agg:",
-                         le32_to_cpu(tx->agg.scd_query_no_agg),
-                         accum_tx->agg.scd_query_no_agg,
-                         delta_tx->agg.scd_query_no_agg,
-                         max_tx->agg.scd_query_no_agg);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg scd_query_agg:",
-                         le32_to_cpu(tx->agg.scd_query_agg),
-                         accum_tx->agg.scd_query_agg,
-                         delta_tx->agg.scd_query_agg,
-                         max_tx->agg.scd_query_agg);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                        "agg scd_query_mismatch:",
-                         le32_to_cpu(tx->agg.scd_query_mismatch),
-                         accum_tx->agg.scd_query_mismatch,
-                         delta_tx->agg.scd_query_mismatch,
-                         max_tx->agg.scd_query_mismatch);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg frame_not_ready:",
-                         le32_to_cpu(tx->agg.frame_not_ready),
-                         accum_tx->agg.frame_not_ready,
-                         delta_tx->agg.frame_not_ready,
-                         max_tx->agg.frame_not_ready);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg underrun:",
-                         le32_to_cpu(tx->agg.underrun),
-                         accum_tx->agg.underrun,
-                         delta_tx->agg.underrun, max_tx->agg.underrun);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg bt_prio_kill:",
-                         le32_to_cpu(tx->agg.bt_prio_kill),
-                         accum_tx->agg.bt_prio_kill,
-                         delta_tx->agg.bt_prio_kill,
-                         max_tx->agg.bt_prio_kill);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "agg rx_ba_rsp_cnt:",
-                         le32_to_cpu(tx->agg.rx_ba_rsp_cnt),
-                         accum_tx->agg.rx_ba_rsp_cnt,
-                         delta_tx->agg.rx_ba_rsp_cnt,
-                         max_tx->agg.rx_ba_rsp_cnt);
-
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.tx_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
@@ -1683,107 +1077,8 @@ static ssize_t iwl_dbgfs_ucode_general_stats_read(struct file *file,
                                         size_t count, loff_t *ppos)
 {
         struct iwl_priv *priv = file->private_data;
-        int pos = 0;
-        char *buf;
-        int bufsz = sizeof(struct statistics_general) * 10 + 300;
-        ssize_t ret;
-        struct statistics_general *general, *accum_general;
-        struct statistics_general *delta_general, *max_general;
-        struct statistics_dbg *dbg, *accum_dbg, *delta_dbg, *max_dbg;
-        struct statistics_div *div, *accum_div, *delta_div, *max_div;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf) {
-                IWL_ERR(priv, "Can not allocate Buffer\n");
-                return -ENOMEM;
-        }
-
-        /* the statistic information display here is based on
-         * the last statistics notification from uCode
-         * might not reflect the current uCode activity
-         */
-        general = &priv->statistics.general;
-        dbg = &priv->statistics.general.dbg;
-        div = &priv->statistics.general.div;
-        accum_general = &priv->accum_statistics.general;
-        delta_general = &priv->delta_statistics.general;
-        max_general = &priv->max_delta.general;
-        accum_dbg = &priv->accum_statistics.general.dbg;
-        delta_dbg = &priv->delta_statistics.general.dbg;
-        max_dbg = &priv->max_delta.general.dbg;
-        accum_div = &priv->accum_statistics.general.div;
-        delta_div = &priv->delta_statistics.general.div;
-        max_div = &priv->max_delta.general.div;
-        pos += iwl_dbgfs_statistics_flag(priv, buf, bufsz);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_header,
-                        "Statistics_General:");
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
-                         "temperature:",
-                         le32_to_cpu(general->temperature));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_short_format,
-                         "temperature_m:",
-                         le32_to_cpu(general->temperature_m));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "burst_check:",
-                         le32_to_cpu(dbg->burst_check),
-                         accum_dbg->burst_check,
-                         delta_dbg->burst_check, max_dbg->burst_check);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "burst_count:",
-                         le32_to_cpu(dbg->burst_count),
-                         accum_dbg->burst_count,
-                         delta_dbg->burst_count, max_dbg->burst_count);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "sleep_time:",
-                         le32_to_cpu(general->sleep_time),
-                         accum_general->sleep_time,
-                         delta_general->sleep_time, max_general->sleep_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "slots_out:",
-                         le32_to_cpu(general->slots_out),
-                         accum_general->slots_out,
-                         delta_general->slots_out, max_general->slots_out);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "slots_idle:",
-                         le32_to_cpu(general->slots_idle),
-                         accum_general->slots_idle,
-                         delta_general->slots_idle, max_general->slots_idle);
-        pos += scnprintf(buf + pos, bufsz - pos, "ttl_timestamp:\t\t\t%u\n",
-                         le32_to_cpu(general->ttl_timestamp));
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "tx_on_a:",
-                         le32_to_cpu(div->tx_on_a), accum_div->tx_on_a,
-                         delta_div->tx_on_a, max_div->tx_on_a);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "tx_on_b:",
-                         le32_to_cpu(div->tx_on_b), accum_div->tx_on_b,
-                         delta_div->tx_on_b, max_div->tx_on_b);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "exec_time:",
-                         le32_to_cpu(div->exec_time), accum_div->exec_time,
-                         delta_div->exec_time, max_div->exec_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "probe_time:",
-                         le32_to_cpu(div->probe_time), accum_div->probe_time,
-                         delta_div->probe_time, max_div->probe_time);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "rx_enable_counter:",
-                         le32_to_cpu(general->rx_enable_counter),
-                         accum_general->rx_enable_counter,
-                         delta_general->rx_enable_counter,
-                         max_general->rx_enable_counter);
-        pos += scnprintf(buf + pos, bufsz - pos, ucode_stats_format,
-                         "num_of_sos_states:",
-                         le32_to_cpu(general->num_of_sos_states),
-                         accum_general->num_of_sos_states,
-                         delta_general->num_of_sos_states,
-                         max_general->num_of_sos_states);
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-        kfree(buf);
-        return ret;
+        return priv->cfg->ops->lib->debugfs_ops.general_stats_read(file,
+                        user_buf, count, ppos);
 }
 
 static ssize_t iwl_dbgfs_sensitivity_read(struct file *file,
@@ -2341,10 +1636,11 @@ int iwl_dbgfs_register(struct iwl_priv *priv, const char *name)
         DEBUGFS_ADD_FILE(missed_beacon, dir_debug, S_IWUSR);
         DEBUGFS_ADD_FILE(plcp_delta, dir_debug, S_IWUSR | S_IRUSR);
         DEBUGFS_ADD_FILE(force_reset, dir_debug, S_IWUSR | S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
+        DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
+
         if ((priv->hw_rev & CSR_HW_REV_TYPE_MSK) != CSR_HW_REV_TYPE_3945) {
-                DEBUGFS_ADD_FILE(ucode_rx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_tx_stats, dir_debug, S_IRUSR);
-                DEBUGFS_ADD_FILE(ucode_general_stats, dir_debug, S_IRUSR);
                 DEBUGFS_ADD_FILE(sensitivity, dir_debug, S_IRUSR);
                 DEBUGFS_ADD_FILE(chain_noise, dir_debug, S_IRUSR);
                 DEBUGFS_ADD_FILE(ucode_tracing, dir_debug, S_IWUSR | S_IRUSR);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 9466e909f553..58c69a5798d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -58,7 +58,7 @@ extern struct iwl_cfg iwl5100_abg_cfg;
 extern struct iwl_cfg iwl5150_agn_cfg;
 extern struct iwl_cfg iwl5150_abg_cfg;
 extern struct iwl_cfg iwl6000i_2agn_cfg;
-extern struct iwl_cfg iwl6000i_g2_2agn_cfg;
+extern struct iwl_cfg iwl6000g2_2agn_cfg;
 extern struct iwl_cfg iwl6000i_2abg_cfg;
 extern struct iwl_cfg iwl6000i_2bg_cfg;
 extern struct iwl_cfg iwl6000_3agn_cfg;
@@ -1049,12 +1049,10 @@ struct iwl_priv {
         struct iwl_calib_result calib_results[IWL_CALIB_MAX];
 
         /* Scan related variables */
-        unsigned long next_scan_jiffies;
         unsigned long scan_start;
-        unsigned long scan_pass_start;
         unsigned long scan_start_tsf;
-        void *scan;
-        int scan_bands;
+        void *scan_cmd;
+        enum ieee80211_band scan_band;
         struct cfg80211_scan_request *scan_request;
         bool is_internal_short_scan;
         u8 scan_tx_ant[IEEE80211_NUM_BANDS];
@@ -1204,6 +1202,11 @@ struct iwl_priv {
                         struct delayed_work rfkill_poll;
 
                         struct iwl3945_notif_statistics statistics;
+#ifdef CONFIG_IWLWIFI_DEBUG
+                        struct iwl3945_notif_statistics accum_statistics;
+                        struct iwl3945_notif_statistics delta_statistics;
+                        struct iwl3945_notif_statistics max_delta;
+#endif
 
                         u32 sta_supp_rates;
                         int last_rx_rssi;       /* From Rx packet statistics */
@@ -1259,11 +1262,11 @@ struct iwl_priv {
         struct work_struct scan_completed;
         struct work_struct rx_replenish;
         struct work_struct abort_scan;
-        struct work_struct request_scan;
         struct work_struct beacon_update;
         struct work_struct tt_work;
         struct work_struct ct_enter;
         struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
 
         struct tasklet_struct irq_tasklet;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index cb6d50b78140..95aa202c85e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -172,22 +172,22 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_TX_POWER_VERSION    (4)
 #define EEPROM_5000_EEPROM_VERSION      (0x11A)
 
-/*5000 calibrations */
-#define EEPROM_5000_CALIB_ALL   (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
-#define EEPROM_5000_XTAL        ((2*0x128) | EEPROM_5000_CALIB_ALL)
-#define EEPROM_5000_TEMPERATURE ((2*0x12A) | EEPROM_5000_CALIB_ALL)
-
-/* 5000 links */
-#define EEPROM_5000_LINK_HOST             (2*0x64)
-#define EEPROM_5000_LINK_GENERAL          (2*0x65)
-#define EEPROM_5000_LINK_REGULATORY       (2*0x66)
-#define EEPROM_5000_LINK_CALIBRATION      (2*0x67)
-#define EEPROM_5000_LINK_PROCESS_ADJST    (2*0x68)
-#define EEPROM_5000_LINK_OTHERS           (2*0x69)
-
-/* 5000 regulatory - indirect access */
-#define EEPROM_5000_REG_SKU_ID ((0x02)\
-                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 4  bytes */
+/* 5000 and up calibration */
+#define EEPROM_CALIB_ALL        (INDIRECT_ADDRESS | INDIRECT_CALIBRATION)
+#define EEPROM_XTAL             ((2*0x128) | EEPROM_CALIB_ALL)
+
+/* 5000 temperature */
+#define EEPROM_5000_TEMPERATURE ((2*0x12A) | EEPROM_CALIB_ALL)
+
+/* agn links */
+#define EEPROM_LINK_HOST             (2*0x64)
+#define EEPROM_LINK_GENERAL          (2*0x65)
+#define EEPROM_LINK_REGULATORY       (2*0x66)
+#define EEPROM_LINK_CALIBRATION      (2*0x67)
+#define EEPROM_LINK_PROCESS_ADJST    (2*0x68)
+#define EEPROM_LINK_OTHERS           (2*0x69)
+
+/* agn regulatory - indirect access */
 #define EEPROM_REG_BAND_1_CHANNELS       ((0x08)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 28 bytes */
 #define EEPROM_REG_BAND_2_CHANNELS       ((0x26)\
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                 | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
 
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
+
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
@@ -272,6 +276,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_6050_TX_POWER_VERSION    (4)
 #define EEPROM_6050_EEPROM_VERSION      (0x532)
 
+/* 6x00g2 Specific */
+#define EEPROM_6000G2_TX_POWER_VERSION    (6)
+#define EEPROM_6000G2_EEPROM_VERSION    (0x709)
+
 /* OTP */
 /* lower blocks contain EEPROM image and calibration data */
 #define OTP_LOW_IMAGE_SIZE              (2 * 512 * sizeof(u16)) /* 2 KB */
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 5944de7a98a2..b1f101caf19d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -529,48 +529,48 @@
 #define IWL_SCD_TXFIFO_POS_RA                   (4)
 #define IWL_SCD_QUEUE_RA_TID_MAP_RATID_MSK      (0x01FF)
 
-/* 5000 SCD */
-#define IWL50_SCD_QUEUE_STTS_REG_POS_TXF        (0)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_ACTIVE     (3)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_WSL        (4)
-#define IWL50_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN (19)
-#define IWL50_SCD_QUEUE_STTS_REG_MSK            (0x00FF0000)
-
-#define IWL50_SCD_QUEUE_CTX_REG1_CREDIT_POS             (8)
-#define IWL50_SCD_QUEUE_CTX_REG1_CREDIT_MSK             (0x00FFFF00)
-#define IWL50_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_POS       (24)
-#define IWL50_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_MSK       (0xFF000000)
-#define IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS           (0)
-#define IWL50_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK           (0x0000007F)
-#define IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS        (16)
-#define IWL50_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK        (0x007F0000)
-
-#define IWL50_SCD_CONTEXT_DATA_OFFSET           (0x600)
-#define IWL50_SCD_TX_STTS_BITMAP_OFFSET         (0x7B1)
-#define IWL50_SCD_TRANSLATE_TBL_OFFSET          (0x7E0)
-
-#define IWL50_SCD_CONTEXT_QUEUE_OFFSET(x)\
-        (IWL50_SCD_CONTEXT_DATA_OFFSET + ((x) * 8))
-
-#define IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
-        ((IWL50_SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffc)
-
-#define IWL50_SCD_QUEUECHAIN_SEL_ALL(x)         (((1<<(x)) - 1) &\
+/* agn SCD */
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_TXF       (0)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_ACTIVE    (3)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_WSL       (4)
+#define IWLAGN_SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN (19)
+#define IWLAGN_SCD_QUEUE_STTS_REG_MSK           (0x00FF0000)
+
+#define IWLAGN_SCD_QUEUE_CTX_REG1_CREDIT_POS            (8)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_CREDIT_MSK            (0x00FFFF00)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_POS      (24)
+#define IWLAGN_SCD_QUEUE_CTX_REG1_SUPER_CREDIT_MSK      (0xFF000000)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_POS          (0)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_WIN_SIZE_MSK          (0x0000007F)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_POS       (16)
+#define IWLAGN_SCD_QUEUE_CTX_REG2_FRAME_LIMIT_MSK       (0x007F0000)
+
+#define IWLAGN_SCD_CONTEXT_DATA_OFFSET          (0x600)
+#define IWLAGN_SCD_TX_STTS_BITMAP_OFFSET                (0x7B1)
+#define IWLAGN_SCD_TRANSLATE_TBL_OFFSET         (0x7E0)
+
+#define IWLAGN_SCD_CONTEXT_QUEUE_OFFSET(x)\
+        (IWLAGN_SCD_CONTEXT_DATA_OFFSET + ((x) * 8))
+
+#define IWLAGN_SCD_TRANSLATE_TBL_OFFSET_QUEUE(x) \
+        ((IWLAGN_SCD_TRANSLATE_TBL_OFFSET + ((x) * 2)) & 0xfffc)
+
+#define IWLAGN_SCD_QUEUECHAIN_SEL_ALL(x)                (((1<<(x)) - 1) &\
         (~(1<<IWL_CMD_QUEUE_NUM)))
 
-#define IWL50_SCD_BASE                  (PRPH_BASE + 0xa02c00)
-
-#define IWL50_SCD_SRAM_BASE_ADDR         (IWL50_SCD_BASE + 0x0)
-#define IWL50_SCD_DRAM_BASE_ADDR         (IWL50_SCD_BASE + 0x8)
-#define IWL50_SCD_AIT                    (IWL50_SCD_BASE + 0x0c)
-#define IWL50_SCD_TXFACT                 (IWL50_SCD_BASE + 0x10)
-#define IWL50_SCD_ACTIVE                 (IWL50_SCD_BASE + 0x14)
-#define IWL50_SCD_QUEUE_WRPTR(x)         (IWL50_SCD_BASE + 0x18 + (x) * 4)
-#define IWL50_SCD_QUEUE_RDPTR(x)         (IWL50_SCD_BASE + 0x68 + (x) * 4)
-#define IWL50_SCD_QUEUECHAIN_SEL         (IWL50_SCD_BASE + 0xe8)
-#define IWL50_SCD_AGGR_SEL               (IWL50_SCD_BASE + 0x248)
-#define IWL50_SCD_INTERRUPT_MASK         (IWL50_SCD_BASE + 0x108)
-#define IWL50_SCD_QUEUE_STATUS_BITS(x)   (IWL50_SCD_BASE + 0x10c + (x) * 4)
+#define IWLAGN_SCD_BASE                 (PRPH_BASE + 0xa02c00)
+
+#define IWLAGN_SCD_SRAM_BASE_ADDR       (IWLAGN_SCD_BASE + 0x0)
+#define IWLAGN_SCD_DRAM_BASE_ADDR       (IWLAGN_SCD_BASE + 0x8)
+#define IWLAGN_SCD_AIT                  (IWLAGN_SCD_BASE + 0x0c)
+#define IWLAGN_SCD_TXFACT               (IWLAGN_SCD_BASE + 0x10)
+#define IWLAGN_SCD_ACTIVE               (IWLAGN_SCD_BASE + 0x14)
+#define IWLAGN_SCD_QUEUE_WRPTR(x)       (IWLAGN_SCD_BASE + 0x18 + (x) * 4)
+#define IWLAGN_SCD_QUEUE_RDPTR(x)       (IWLAGN_SCD_BASE + 0x68 + (x) * 4)
+#define IWLAGN_SCD_QUEUECHAIN_SEL       (IWLAGN_SCD_BASE + 0xe8)
+#define IWLAGN_SCD_AGGR_SEL             (IWLAGN_SCD_BASE + 0x248)
+#define IWLAGN_SCD_INTERRUPT_MASK       (IWLAGN_SCD_BASE + 0x108)
+#define IWLAGN_SCD_QUEUE_STATUS_BITS(x) (IWLAGN_SCD_BASE + 0x10c + (x) * 4)
 
 /*********************** END TX SCHEDULER *************************************/
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index ae981932ce61..d12fd5553846 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -69,9 +69,8 @@ int iwl_scan_cancel(struct iwl_priv *priv)
         }
 
         if (test_bit(STATUS_SCANNING, &priv->status)) {
-                if (!test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+                if (!test_and_set_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                         IWL_DEBUG_SCAN(priv, "Queuing scan abort.\n");
-                        set_bit(STATUS_SCAN_ABORTING, &priv->status);
                         queue_work(priv->workqueue, &priv->abort_scan);
 
                 } else
@@ -201,9 +200,6 @@ static void iwl_rx_scan_results_notif(struct iwl_priv *priv,
                        le32_to_cpu(notif->statistics[0]),
                        le32_to_cpu(notif->tsf_low) - priv->scan_start_tsf);
 #endif
-
-        if (!priv->is_internal_short_scan)
-                priv->next_scan_jiffies = 0;
 }
 
 /* Service SCAN_COMPLETE_NOTIFICATION (0x84) */
@@ -223,49 +219,24 @@ static void iwl_rx_scan_complete_notif(struct iwl_priv *priv,
         /* The HW is no longer scanning */
         clear_bit(STATUS_SCAN_HW, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan pass on %sGHz took %dms\n",
-                       (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) ?
-                                                "2.4" : "5.2",
+        IWL_DEBUG_INFO(priv, "Scan on %sGHz took %dms\n",
+                       (priv->scan_band == IEEE80211_BAND_2GHZ) ? "2.4" : "5.2",
                        jiffies_to_msecs(elapsed_jiffies
-                                        (priv->scan_pass_start, jiffies)));
+                                        (priv->scan_start, jiffies)));
 
-        /* Remove this scanned band from the list of pending
-         * bands to scan, band G precedes A in order of scanning
-         * as seen in iwl_bg_request_scan */
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_2GHZ);
-        else if (priv->scan_bands &  BIT(IEEE80211_BAND_5GHZ))
-                priv->scan_bands &= ~BIT(IEEE80211_BAND_5GHZ);
-
-        /* If a request to abort was given, or the scan did not succeed
+        /*
+         * If a request to abort was given, or the scan did not succeed
          * then we reset the scan state machine and terminate,
-         * re-queuing another scan if one has been requested */
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
+         * re-queuing another scan if one has been requested
+         */
+        if (test_and_clear_bit(STATUS_SCAN_ABORTING, &priv->status))
                 IWL_DEBUG_INFO(priv, "Aborted scan completed.\n");
-                clear_bit(STATUS_SCAN_ABORTING, &priv->status);
-        } else {
-                /* If there are more bands on this scan pass reschedule */
-                if (priv->scan_bands)
-                        goto reschedule;
-        }
-
-        if (!priv->is_internal_short_scan)
-                priv->next_scan_jiffies = 0;
 
         IWL_DEBUG_INFO(priv, "Setting scan to off\n");
 
         clear_bit(STATUS_SCANNING, &priv->status);
 
-        IWL_DEBUG_INFO(priv, "Scan took %dms\n",
-                jiffies_to_msecs(elapsed_jiffies(priv->scan_start, jiffies)));
-
         queue_work(priv->workqueue, &priv->scan_completed);
-
-        return;
-
-reschedule:
-        priv->scan_pass_start = jiffies;
-        queue_work(priv->workqueue, &priv->request_scan);
 }
 
 void iwl_setup_rx_scan_handlers(struct iwl_priv *priv)
@@ -314,150 +285,6 @@ u16 iwl_get_passive_dwell_time(struct iwl_priv *priv,
 }
 EXPORT_SYMBOL(iwl_get_passive_dwell_time);
 
-static int iwl_get_single_channel_for_scan(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     struct iwl_scan_channel *scan_ch)
-{
-        const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
-        u16 passive_dwell = 0;
-        u16 active_dwell = 0;
-        int i, added = 0;
-        u16 channel = 0;
-
-        sband = iwl_get_hw_mode(priv, band);
-        if (!sband) {
-                IWL_ERR(priv, "invalid band\n");
-                return added;
-        }
-
-        active_dwell = iwl_get_active_dwell_time(priv, band, 0);
-        passive_dwell = iwl_get_passive_dwell_time(priv, band);
-
-        if (passive_dwell <= active_dwell)
-                passive_dwell = active_dwell + 1;
-
-        /* only scan single channel, good enough to reset the RF */
-        /* pick the first valid not in-use channel */
-        if (band == IEEE80211_BAND_5GHZ) {
-                for (i = 14; i < priv->channel_count; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                channel = priv->channel_info[i].channel;
-                                ch_info = iwl_get_channel_info(priv,
-                                        band, channel);
-                                if (is_channel_valid(ch_info))
-                                        break;
-                        }
-                }
-        } else {
-                for (i = 0; i < 14; i++) {
-                        if (priv->channel_info[i].channel !=
-                            le16_to_cpu(priv->staging_rxon.channel)) {
-                                        channel =
-                                                priv->channel_info[i].channel;
-                                        ch_info = iwl_get_channel_info(priv,
-                                                band, channel);
-                                        if (is_channel_valid(ch_info))
-                                                break;
-                        }
-                }
-        }
-        if (channel) {
-                scan_ch->channel = cpu_to_le16(channel);
-                scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                scan_ch->active_dwell = cpu_to_le16(active_dwell);
-                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
-                /* Set txpower levels to defaults */
-                scan_ch->dsp_atten = 110;
-                if (band == IEEE80211_BAND_5GHZ)
-                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
-                else
-                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
-                added++;
-        } else
-                IWL_ERR(priv, "no valid channel found\n");
-        return added;
-}
-
-static int iwl_get_channels_for_scan(struct iwl_priv *priv,
-                                     enum ieee80211_band band,
-                                     u8 is_active, u8 n_probes,
-                                     struct iwl_scan_channel *scan_ch)
-{
-        struct ieee80211_channel *chan;
-        const struct ieee80211_supported_band *sband;
-        const struct iwl_channel_info *ch_info;
-        u16 passive_dwell = 0;
-        u16 active_dwell = 0;
-        int added, i;
-        u16 channel;
-
-        sband = iwl_get_hw_mode(priv, band);
-        if (!sband)
-                return 0;
-
-        active_dwell = iwl_get_active_dwell_time(priv, band, n_probes);
-        passive_dwell = iwl_get_passive_dwell_time(priv, band);
-
-        if (passive_dwell <= active_dwell)
-                passive_dwell = active_dwell + 1;
-
-        for (i = 0, added = 0; i < priv->scan_request->n_channels; i++) {
-                chan = priv->scan_request->channels[i];
-
-                if (chan->band != band)
-                        continue;
-
-                channel = ieee80211_frequency_to_channel(chan->center_freq);
-                scan_ch->channel = cpu_to_le16(channel);
-
-                ch_info = iwl_get_channel_info(priv, band, channel);
-                if (!is_channel_valid(ch_info)) {
-                        IWL_DEBUG_SCAN(priv, "Channel %d is INVALID for this band.\n",
-                                        channel);
-                        continue;
-                }
-
-                if (!is_active || is_channel_passive(ch_info) ||
-                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
-                        scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
-                else
-                        scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
-
-                if (n_probes)
-                        scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
-
-                scan_ch->active_dwell = cpu_to_le16(active_dwell);
-                scan_ch->passive_dwell = cpu_to_le16(passive_dwell);
-
-                /* Set txpower levels to defaults */
-                scan_ch->dsp_atten = 110;
-
-                /* NOTE: if we were doing 6Mb OFDM for scans we'd use
-                 * power level:
-                 * scan_ch->tx_gain = ((1 << 5) | (2 << 3)) | 3;
-                 */
-                if (band == IEEE80211_BAND_5GHZ)
-                        scan_ch->tx_gain = ((1 << 5) | (3 << 3)) | 3;
-                else
-                        scan_ch->tx_gain = ((1 << 5) | (5 << 3));
-
-                IWL_DEBUG_SCAN(priv, "Scanning ch=%d prob=0x%X [%s %d]\n",
-                               channel, le32_to_cpu(scan_ch->type),
-                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
-                                "ACTIVE" : "PASSIVE",
-                               (scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) ?
-                               active_dwell : passive_dwell);
-
-                scan_ch++;
-                added++;
-        }
-
-        IWL_DEBUG_SCAN(priv, "total channels to scan %d\n", added);
-        return added;
-}
-
 void iwl_init_scan_params(struct iwl_priv *priv)
 {
         u8 ant_idx = fls(priv->hw_params.valid_tx_ant) - 1;
@@ -470,30 +297,34 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
+
         IWL_DEBUG_INFO(priv, "Starting scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = false;
         priv->scan_start = jiffies;
-        priv->scan_pass_start = priv->scan_start;
 
-        queue_work(priv->workqueue, &priv->request_scan);
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                return -EOPNOTSUPP;
+
+        priv->cfg->ops->utils->request_scan(priv);
 
         return 0;
 }
 
-#define IWL_DELAY_NEXT_SCAN (HZ*2)
-
 int iwl_mac_hw_scan(struct ieee80211_hw *hw,
-                     struct cfg80211_scan_request *req)
+                    struct ieee80211_vif *vif,
+                    struct cfg80211_scan_request *req)
 {
-        unsigned long flags;
         struct iwl_priv *priv = hw->priv;
-        int ret, i;
+        int ret;
 
         IWL_DEBUG_MAC80211(priv, "enter\n");
 
+        if (req->n_channels == 0)
+                return -EINVAL;
+
         mutex_lock(&priv->mutex);
-        spin_lock_irqsave(&priv->lock, flags);
 
         if (!iwl_is_ready_rf(priv)) {
                 ret = -EIO;
@@ -513,22 +344,8 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
                 goto out_unlock;
         }
 
-        /* We don't schedule scan within next_scan_jiffies period.
-         * Avoid scanning during possible EAPOL exchange, return
-         * success immediately.
-         */
-        if (priv->next_scan_jiffies &&
-            time_after(priv->next_scan_jiffies, jiffies)) {
-                IWL_DEBUG_SCAN(priv, "scan rejected: within next scan period\n");
-                queue_work(priv->workqueue, &priv->scan_completed);
-                ret = 0;
-                goto out_unlock;
-        }
-
-        priv->scan_bands = 0;
-        for (i = 0; i < req->n_channels; i++)
-                priv->scan_bands |= BIT(req->channels[i]->band);
-
+        /* mac80211 will only ask for one band at a time */
+        priv->scan_band = req->channels[0]->band;
         priv->scan_request = req;
 
         ret = iwl_scan_initiate(priv);
@@ -536,7 +353,6 @@ int iwl_mac_hw_scan(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(priv, "leave\n");
 
 out_unlock:
-        spin_unlock_irqrestore(&priv->lock, flags);
         mutex_unlock(&priv->mutex);
 
         return ret;
@@ -547,42 +363,46 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
  * internal short scan, this function should only been called while associated.
  * It will reset and tune the radio to prevent possible RF related problem
  */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+
+        mutex_lock(&priv->mutex);
 
         if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                 IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCANNING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
+
         if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                 IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
-                goto out;
+                goto unlock;
         }
 
-        priv->scan_bands = 0;
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                priv->scan_bands |= BIT(IEEE80211_BAND_5GHZ);
-        else
-                priv->scan_bands |= BIT(IEEE80211_BAND_2GHZ);
+        priv->scan_band = priv->band;
 
         IWL_DEBUG_SCAN(priv, "Start internal short scan...\n");
         set_bit(STATUS_SCANNING, &priv->status);
         priv->is_internal_short_scan = true;
-        queue_work(priv->workqueue, &priv->request_scan);
 
-out:
-        return ret;
-}
+        if (WARN_ON(!priv->cfg->ops->utils->request_scan))
+                goto unlock;
 
-#define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
+        priv->cfg->ops->utils->request_scan(priv);
+ unlock:
+        mutex_unlock(&priv->mutex);
+}
 
 void iwl_bg_scan_check(struct work_struct *data)
 {
@@ -645,275 +465,15 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
         if (WARN_ON(left < ie_len))
                 return len;
 
-        if (ies)
+        if (ies && ie_len) {
                 memcpy(pos, ies, ie_len);
-        len += ie_len;
-        left -= ie_len;
+                len += ie_len;
+        }
 
         return (u16)len;
 }
 EXPORT_SYMBOL(iwl_fill_probe_req);
 
-static void iwl_bg_request_scan(struct work_struct *data)
-{
-        struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, request_scan);
-        struct iwl_host_cmd cmd = {
-                .id = REPLY_SCAN_CMD,
-                .len = sizeof(struct iwl_scan_cmd),
-                .flags = CMD_SIZE_HUGE,
-        };
-        struct iwl_scan_cmd *scan;
-        struct ieee80211_conf *conf = NULL;
-        u32 rate_flags = 0;
-        u16 cmd_len;
-        u16 rx_chain = 0;
-        enum ieee80211_band band;
-        u8 n_probes = 0;
-        u8 rx_ant = priv->hw_params.valid_rx_ant;
-        u8 rate;
-        bool is_active = false;
-        int  chan_mod;
-        u8 active_chains;
-
-        conf = ieee80211_get_hw_conf(priv->hw);
-
-        mutex_lock(&priv->mutex);
-
-        cancel_delayed_work(&priv->scan_check);
-
-        if (!iwl_is_ready(priv)) {
-                IWL_WARN(priv, "request scan called when driver not ready.\n");
-                goto done;
-        }
-
-        /* Make sure the scan wasn't canceled before this queued work
-         * was given the chance to run... */
-        if (!test_bit(STATUS_SCANNING, &priv->status))
-                goto done;
-
-        /* This should never be called or scheduled if there is currently
-         * a scan active in the hardware. */
-        if (test_bit(STATUS_SCAN_HW, &priv->status)) {
-                IWL_DEBUG_INFO(priv, "Multiple concurrent scan requests in parallel. "
-                               "Ignoring second request.\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_EXIT_PENDING, &priv->status)) {
-                IWL_DEBUG_SCAN(priv, "Aborting scan due to device shutdown\n");
-                goto done;
-        }
-
-        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while abort pending.  Queuing.\n");
-                goto done;
-        }
-
-        if (iwl_is_rfkill(priv)) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to RF Kill activation\n");
-                goto done;
-        }
-
-        if (!test_bit(STATUS_READY, &priv->status)) {
-                IWL_DEBUG_HC(priv, "Scan request while uninitialized.  Queuing.\n");
-                goto done;
-        }
-
-        if (!priv->scan_bands) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to no requested bands\n");
-                goto done;
-        }
-
-        if (!priv->scan) {
-                priv->scan = kmalloc(sizeof(struct iwl_scan_cmd) +
-                                     IWL_MAX_SCAN_SIZE, GFP_KERNEL);
-                if (!priv->scan) {
-                        IWL_DEBUG_SCAN(priv,
-                                       "fail to allocate memory for scan\n");
-                        goto done;
-                }
-        }
-        scan = priv->scan;
-        memset(scan, 0, sizeof(struct iwl_scan_cmd) + IWL_MAX_SCAN_SIZE);
-
-        scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
-        scan->quiet_time = IWL_ACTIVE_QUIET_TIME;
-
-        if (iwl_is_associated(priv)) {
-                u16 interval = 0;
-                u32 extra;
-                u32 suspend_time = 100;
-                u32 scan_suspend_time = 100;
-                unsigned long flags;
-
-                IWL_DEBUG_INFO(priv, "Scanning while associated...\n");
-                spin_lock_irqsave(&priv->lock, flags);
-                interval = priv->beacon_int;
-                spin_unlock_irqrestore(&priv->lock, flags);
-
-                scan->suspend_time = 0;
-                scan->max_out_time = cpu_to_le32(200 * 1024);
-                if (!interval)
-                        interval = suspend_time;
-
-                extra = (suspend_time / interval) << 22;
-                scan_suspend_time = (extra |
-                    ((suspend_time % interval) * 1024));
-                scan->suspend_time = cpu_to_le32(scan_suspend_time);
-                IWL_DEBUG_SCAN(priv, "suspend_time 0x%X beacon interval %d\n",
-                               scan_suspend_time, interval);
-        }
-
-        if (priv->is_internal_short_scan) {
-                IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
-        } else if (priv->scan_request->n_ssids) {
-                int i, p = 0;
-                IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-                for (i = 0; i < priv->scan_request->n_ssids; i++) {
-                        /* always does wildcard anyway */
-                        if (!priv->scan_request->ssids[i].ssid_len)
-                                continue;
-                        scan->direct_scan[p].id = WLAN_EID_SSID;
-                        scan->direct_scan[p].len =
-                                priv->scan_request->ssids[i].ssid_len;
-                        memcpy(scan->direct_scan[p].ssid,
-                               priv->scan_request->ssids[i].ssid,
-                               priv->scan_request->ssids[i].ssid_len);
-                        n_probes++;
-                        p++;
-                }
-                is_active = true;
-        } else
-                IWL_DEBUG_SCAN(priv, "Start passive scan.\n");
-
-        scan->tx_cmd.tx_flags = TX_CMD_FLG_SEQ_CTL_MSK;
-        scan->tx_cmd.sta_id = priv->hw_params.bcast_sta_id;
-        scan->tx_cmd.stop_time.life_time = TX_CMD_LIFE_TIME_INFINITE;
-
-
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
-                band = IEEE80211_BAND_2GHZ;
-                scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
-                chan_mod = le32_to_cpu(priv->active_rxon.flags & RXON_FLG_CHANNEL_MODE_MSK)
-                                       >> RXON_FLG_CHANNEL_MODE_POS;
-                if (chan_mod == CHANNEL_MODE_PURE_40) {
-                        rate = IWL_RATE_6M_PLCP;
-                } else {
-                        rate = IWL_RATE_1M_PLCP;
-                        rate_flags = RATE_MCS_CCK_MSK;
-                }
-                scan->good_CRC_th = 0;
-        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
-                band = IEEE80211_BAND_5GHZ;
-                rate = IWL_RATE_6M_PLCP;
-                /*
-                 * If active scaning is requested but a certain channel
-                 * is marked passive, we can do active scanning if we
-                 * detect transmissions.
-                 */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
-
-                /* Force use of chains B and C (0x6) for scan Rx
-                 * Avoid A (0x1) for the device has off-channel reception
-                 * on A-band.
-                 */
-                if (priv->cfg->off_channel_workaround)
-                        rx_ant = ANT_BC;
-        } else {
-                IWL_WARN(priv, "Invalid scan band count\n");
-                goto done;
-        }
-
-        priv->scan_tx_ant[band] =
-                         iwl_toggle_tx_ant(priv, priv->scan_tx_ant[band]);
-        rate_flags |= iwl_ant_idx_to_flags(priv->scan_tx_ant[band]);
-        scan->tx_cmd.rate_n_flags = iwl_hw_set_rate_n_flags(rate, rate_flags);
-
-        /* In power save mode use one chain, otherwise use all chains */
-        if (test_bit(STATUS_POWER_PMI, &priv->status)) {
-                /* rx_ant has been set to all valid chains previously */
-                active_chains = rx_ant &
-                                ((u8)(priv->chain_noise_data.active_chains));
-                if (!active_chains)
-                        active_chains = rx_ant;
-
-                IWL_DEBUG_SCAN(priv, "chain_noise_data.active_chains: %u\n",
-                                priv->chain_noise_data.active_chains);
-
-                rx_ant = first_antenna(active_chains);
-        }
-        /* MIMO is not used here, but value is required */
-        rx_chain |= priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
-        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_MIMO_SEL_POS;
-        rx_chain |= rx_ant << RXON_RX_CHAIN_FORCE_SEL_POS;
-        rx_chain |= 0x1 << RXON_RX_CHAIN_DRIVER_FORCE_POS;
-        scan->rx_chain = cpu_to_le16(rx_chain);
-        if (!priv->is_internal_short_scan) {
-                cmd_len = iwl_fill_probe_req(priv,
-                                        (struct ieee80211_mgmt *)scan->data,
-                                        priv->scan_request->ie,
-                                        priv->scan_request->ie_len,
-                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-        } else {
-                cmd_len = iwl_fill_probe_req(priv,
-                                        (struct ieee80211_mgmt *)scan->data,
-                                        NULL, 0,
-                                        IWL_MAX_SCAN_SIZE - sizeof(*scan));
-
-        }
-        scan->tx_cmd.len = cpu_to_le16(cmd_len);
-        if (iwl_is_monitor_mode(priv))
-                scan->filter_flags = RXON_FILTER_PROMISC_MSK;
-
-        scan->filter_flags |= (RXON_FILTER_ACCEPT_GRP_MSK |
-                               RXON_FILTER_BCON_AWARE_MSK);
-
-        if (priv->is_internal_short_scan) {
-                scan->channel_count =
-                        iwl_get_single_channel_for_scan(priv, band,
-                                (void *)&scan->data[le16_to_cpu(
-                                scan->tx_cmd.len)]);
-        } else {
-                scan->channel_count =
-                        iwl_get_channels_for_scan(priv, band,
-                                is_active, n_probes,
-                                (void *)&scan->data[le16_to_cpu(
-                                scan->tx_cmd.len)]);
-        }
-        if (scan->channel_count == 0) {
-                IWL_DEBUG_SCAN(priv, "channel count %d\n", scan->channel_count);
-                goto done;
-        }
-
-        cmd.len += le16_to_cpu(scan->tx_cmd.len) +
-            scan->channel_count * sizeof(struct iwl_scan_channel);
-        cmd.data = scan;
-        scan->len = cpu_to_le16(cmd.len);
-
-        set_bit(STATUS_SCAN_HW, &priv->status);
-        if (iwl_send_cmd_sync(priv, &cmd))
-                goto done;
-
-        queue_delayed_work(priv->workqueue, &priv->scan_check,
-                           IWL_SCAN_CHECK_WATCHDOG);
-
-        mutex_unlock(&priv->mutex);
-        return;
-
- done:
-        /* Cannot perform scan. Make sure we clear scanning
-        * bits from status so next scan request can be performed.
-        * If we don't clear scanning status bit here all next scan
-        * will fail
-        */
-        clear_bit(STATUS_SCAN_HW, &priv->status);
-        clear_bit(STATUS_SCANNING, &priv->status);
-        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
-        mutex_unlock(&priv->mutex);
-}
-
 void iwl_bg_abort_scan(struct work_struct *work)
 {
         struct iwl_priv *priv = container_of(work, struct iwl_priv, abort_scan);
@@ -961,8 +521,8 @@ EXPORT_SYMBOL(iwl_bg_scan_completed);
 void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
 {
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
-        INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index d86ecd2f9ec2..db934476b5e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -451,7 +451,17 @@ static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 
         link_cmd.general_params.single_stream_ant_msk =
                                 first_antenna(priv->hw_params.valid_tx_ant);
-        link_cmd.general_params.dual_stream_ant_msk = 3;
+
+        link_cmd.general_params.dual_stream_ant_msk =
+                priv->hw_params.valid_tx_ant &
+                ~first_antenna(priv->hw_params.valid_tx_ant);
+        if (!link_cmd.general_params.dual_stream_ant_msk) {
+                link_cmd.general_params.dual_stream_ant_msk = ANT_AB;
+        } else if (num_of_ant(priv->hw_params.valid_tx_ant) == 2) {
+                link_cmd.general_params.dual_stream_ant_msk =
+                        priv->hw_params.valid_tx_ant;
+        }
+
         link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
         link_cmd.agg_params.agg_time_limit =
                 cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
@@ -1196,7 +1206,6 @@ int iwl_send_lq_cmd(struct iwl_priv *priv,
         iwl_dump_lq_cmd(priv, lq);
         BUG_ON(init && (cmd.flags & CMD_ASYNC));
 
-        iwl_dump_lq_cmd(priv, lq);
         ret = iwl_send_cmd(priv, &cmd);
         if (ret || (cmd.flags & CMD_ASYNC))
                 return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 9f362024a29c..c7e1d7d09e02 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -957,7 +957,7 @@ static void iwl3945_setup_rx_handlers(struct iwl_priv *priv)
          * statistics request from the host as well as for the periodic
          * statistics notifications (after received beacons) from the uCode.
          */
-        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_hw_rx_statistics;
+        priv->rx_handlers[REPLY_STATISTICS_CMD] = iwl3945_reply_statistics;
         priv->rx_handlers[STATISTICS_NOTIFICATION] = iwl3945_hw_rx_statistics;
 
         iwl_setup_rx_scan_handlers(priv);
@@ -2527,7 +2527,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
         }
 
         /* Configure Bluetooth device coexistence support */
-        iwl_send_bt_config(priv);
+        priv->cfg->ops->hcmd->send_bt_config(priv);
 
         /* Configure the adapter for unassociated operation */
         iwlcore_commit_rxon(priv);
@@ -2791,11 +2791,8 @@ static void iwl3945_rfkill_poll(struct work_struct *data)
 
 }
 
-#define IWL_SCAN_CHECK_WATCHDOG (7 * HZ)
-static void iwl3945_bg_request_scan(struct work_struct *data)
+void iwl3945_request_scan(struct iwl_priv *priv)
 {
-        struct iwl_priv *priv =
-            container_of(data, struct iwl_priv, request_scan);
         struct iwl_host_cmd cmd = {
                 .id = REPLY_SCAN_CMD,
                 .len = sizeof(struct iwl3945_scan_cmd),
@@ -2809,8 +2806,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         conf = ieee80211_get_hw_conf(priv->hw);
 
-        mutex_lock(&priv->mutex);
-
         cancel_delayed_work(&priv->scan_check);
 
         if (!iwl_is_ready(priv)) {
@@ -2853,20 +2848,15 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
                 goto done;
         }
 
-        if (!priv->scan_bands) {
-                IWL_DEBUG_HC(priv, "Aborting scan due to no requested bands\n");
-                goto done;
-        }
-
-        if (!priv->scan) {
-                priv->scan = kmalloc(sizeof(struct iwl3945_scan_cmd) +
-                                     IWL_MAX_SCAN_SIZE, GFP_KERNEL);
-                if (!priv->scan) {
+        if (!priv->scan_cmd) {
+                priv->scan_cmd = kmalloc(sizeof(struct iwl3945_scan_cmd) +
+                                         IWL_MAX_SCAN_SIZE, GFP_KERNEL);
+                if (!priv->scan_cmd) {
                         IWL_DEBUG_SCAN(priv, "Fail to allocate scan memory\n");
                         goto done;
                 }
         }
-        scan = priv->scan;
+        scan = priv->scan_cmd;
         memset(scan, 0, sizeof(struct iwl3945_scan_cmd) + IWL_MAX_SCAN_SIZE);
 
         scan->quiet_plcp_th = IWL_PLCP_QUIET_THRESH;
@@ -2935,22 +2925,26 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         /* flags + rate selection */
 
-        if (priv->scan_bands & BIT(IEEE80211_BAND_2GHZ)) {
+        switch (priv->scan_band) {
+        case IEEE80211_BAND_2GHZ:
                 scan->flags = RXON_FLG_BAND_24G_MSK | RXON_FLG_AUTO_DETECT_MSK;
                 scan->tx_cmd.rate = IWL_RATE_1M_PLCP;
                 scan->good_CRC_th = 0;
                 band = IEEE80211_BAND_2GHZ;
-        } else if (priv->scan_bands & BIT(IEEE80211_BAND_5GHZ)) {
+                break;
+        case IEEE80211_BAND_5GHZ:
                 scan->tx_cmd.rate = IWL_RATE_6M_PLCP;
                 /*
                  * If active scaning is requested but a certain channel
                  * is marked passive, we can do active scanning if we
                  * detect transmissions.
                  */
-                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH : 0;
+                scan->good_CRC_th = is_active ? IWL_GOOD_CRC_TH_DEFAULT :
+                                                IWL_GOOD_CRC_TH_DISABLED;
                 band = IEEE80211_BAND_5GHZ;
-        } else {
-                IWL_WARN(priv, "Invalid scan band count\n");
+                break;
+        default:
+                IWL_WARN(priv, "Invalid scan band\n");
                 goto done;
         }
 
@@ -2971,9 +2965,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         /* select Rx antennas */
         scan->flags |= iwl3945_get_antenna_flags(priv);
 
-        if (iwl_is_monitor_mode(priv))
-                scan->filter_flags = RXON_FILTER_PROMISC_MSK;
-
         scan->channel_count =
                 iwl3945_get_channels_for_scan(priv, band, is_active, n_probes,
                         (void *)&scan->data[le16_to_cpu(scan->tx_cmd.len)]);
@@ -2995,7 +2986,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
         queue_delayed_work(priv->workqueue, &priv->scan_check,
                            IWL_SCAN_CHECK_WATCHDOG);
 
-        mutex_unlock(&priv->mutex);
         return;
 
  done:
@@ -3009,7 +2999,6 @@ static void iwl3945_bg_request_scan(struct work_struct *data)
 
         /* inform mac80211 scan aborted */
         queue_work(priv->workqueue, &priv->scan_completed);
-        mutex_unlock(&priv->mutex);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
@@ -3051,8 +3040,6 @@ static void iwl3945_bg_rx_replenish(struct work_struct *data)
         mutex_unlock(&priv->mutex);
 }
 
-#define IWL_DELAY_NEXT_SCAN (HZ*2)
-
 void iwl3945_post_associate(struct iwl_priv *priv)
 {
         int rc = 0;
@@ -3137,9 +3124,6 @@ void iwl3945_post_associate(struct iwl_priv *priv)
                            __func__, priv->iw_mode);
                 break;
         }
-
-        /* we have just associated, don't start scan too early */
-        priv->next_scan_jiffies = jiffies + IWL_DELAY_NEXT_SCAN;
 }
 
 /*****************************************************************************
@@ -3672,44 +3656,6 @@ static ssize_t show_channels(struct device *d,
 
 static DEVICE_ATTR(channels, S_IRUSR, show_channels, NULL);
 
-static ssize_t show_statistics(struct device *d,
-                               struct device_attribute *attr, char *buf)
-{
-        struct iwl_priv *priv = dev_get_drvdata(d);
-        u32 size = sizeof(struct iwl3945_notif_statistics);
-        u32 len = 0, ofs = 0;
-        u8 *data = (u8 *)&priv->_3945.statistics;
-        int rc = 0;
-
-        if (!iwl_is_alive(priv))
-                return -EAGAIN;
-
-        mutex_lock(&priv->mutex);
-        rc = iwl_send_statistics_request(priv, CMD_SYNC, false);
-        mutex_unlock(&priv->mutex);
-
-        if (rc) {
-                len = sprintf(buf,
-                              "Error sending statistics request: 0x%08X\n", rc);
-                return len;
-        }
-
-        while (size && (PAGE_SIZE - len)) {
-                hex_dump_to_buffer(data + ofs, size, 16, 1, buf + len,
-                                   PAGE_SIZE - len, 1);
-                len = strlen(buf);
-                if (PAGE_SIZE - len)
-                        buf[len++] = '\n';
-
-                ofs += 16;
-                size -= min(size, 16U);
-        }
-
-        return len;
-}
-
-static DEVICE_ATTR(statistics, S_IRUGO, show_statistics, NULL);
-
 static ssize_t show_antenna(struct device *d,
                             struct device_attribute *attr, char *buf)
 {
@@ -3793,7 +3739,6 @@ static void iwl3945_setup_deferred_work(struct iwl_priv *priv)
         INIT_DELAYED_WORK(&priv->alive_start, iwl3945_bg_alive_start);
         INIT_DELAYED_WORK(&priv->_3945.rfkill_poll, iwl3945_rfkill_poll);
         INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
-        INIT_WORK(&priv->request_scan, iwl3945_bg_request_scan);
         INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
         INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 
@@ -3830,7 +3775,6 @@ static struct attribute *iwl3945_sysfs_entries[] = {
         &dev_attr_filter_flags.attr,
         &dev_attr_measurement.attr,
         &dev_attr_retry_rate.attr,
-        &dev_attr_statistics.attr,
         &dev_attr_status.attr,
         &dev_attr_temperature.attr,
         &dev_attr_tx_power.attr,
@@ -3930,7 +3874,6 @@ static int iwl3945_setup_mac(struct iwl_priv *priv)
 
         /* Tell mac80211 our characteristics */
         hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                    IEEE80211_HW_NOISE_DBM |
                     IEEE80211_HW_SPECTRUM_MGMT;
 
         if (!priv->cfg->broken_powersave)
@@ -4253,7 +4196,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
 
         iwl_free_channel_map(priv);
         iwlcore_free_geos(priv);
-        kfree(priv->scan);
+        kfree(priv->scan_cmd);
         if (priv->ibss_beacon)
                 dev_kfree_skb(priv->ibss_beacon);
 
diff --git a/drivers/net/wireless/iwmc3200wifi/Makefile b/drivers/net/wireless/iwmc3200wifi/Makefile
index aeed5cd80819..cdc7e07ba113 100644
--- a/drivers/net/wireless/iwmc3200wifi/Makefile
+++ b/drivers/net/wireless/iwmc3200wifi/Makefile
@@ -6,3 +6,5 @@ iwmc3200wifi-$(CONFIG_IWM_DEBUG) += debugfs.o
 iwmc3200wifi-$(CONFIG_IWM_TRACING) += trace.o
 
 CFLAGS_trace.o := -I$(src)
+
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/iwmc3200wifi/bus.h b/drivers/net/wireless/iwmc3200wifi/bus.h
index 836663eec257..62edd5888a7b 100644
--- a/drivers/net/wireless/iwmc3200wifi/bus.h
+++ b/drivers/net/wireless/iwmc3200wifi/bus.h
@@ -31,7 +31,7 @@ struct iwm_if_ops {
         int (*disable)(struct iwm_priv *iwm);
         int (*send_chunk)(struct iwm_priv *iwm, u8* buf, int count);
 
-        int (*debugfs_init)(struct iwm_priv *iwm, struct dentry *parent_dir);
+        void (*debugfs_init)(struct iwm_priv *iwm, struct dentry *parent_dir);
         void (*debugfs_exit)(struct iwm_priv *iwm);
 
         const char *umac_name;
diff --git a/drivers/net/wireless/iwmc3200wifi/debug.h b/drivers/net/wireless/iwmc3200wifi/debug.h
index e35c9b693d1f..a0c13a49ab3c 100644
--- a/drivers/net/wireless/iwmc3200wifi/debug.h
+++ b/drivers/net/wireless/iwmc3200wifi/debug.h
@@ -113,13 +113,10 @@ struct iwm_debugfs {
 };
 
 #ifdef CONFIG_IWM_DEBUG
-int iwm_debugfs_init(struct iwm_priv *iwm);
+void iwm_debugfs_init(struct iwm_priv *iwm);
 void iwm_debugfs_exit(struct iwm_priv *iwm);
 #else
-static inline int iwm_debugfs_init(struct iwm_priv *iwm)
-{
-        return 0;
-}
+static inline void iwm_debugfs_init(struct iwm_priv *iwm) {}
 static inline void iwm_debugfs_exit(struct iwm_priv *iwm) {}
 #endif
 
diff --git a/drivers/net/wireless/iwmc3200wifi/debugfs.c b/drivers/net/wireless/iwmc3200wifi/debugfs.c
index 724441368a18..53b0b7711f02 100644
--- a/drivers/net/wireless/iwmc3200wifi/debugfs.c
+++ b/drivers/net/wireless/iwmc3200wifi/debugfs.c
@@ -48,12 +48,11 @@ static struct {
 
 #define add_dbg_module(dbg, name, id, initlevel)        \
 do {                                                    \
-        struct dentry *d;                               \
         dbg.dbg_module[id] = (initlevel);               \
-        d = debugfs_create_x8(name, 0600, dbg.dbgdir,   \
-                             &(dbg.dbg_module[id]));    \
-        if (!IS_ERR(d))                                 \
-                dbg.dbg_module_dentries[id] = d;        \
+        dbg.dbg_module_dentries[id] =                   \
+                debugfs_create_x8(name, 0600,           \
+                                dbg.dbgdir,             \
+                                &(dbg.dbg_module[id])); \
 } while (0)
 
 static int iwm_debugfs_u32_read(void *data, u64 *val)
@@ -423,89 +422,29 @@ static const struct file_operations iwm_debugfs_fw_err_fops = {
         .read =         iwm_debugfs_fw_err_read,
 };
 
-int iwm_debugfs_init(struct iwm_priv *iwm)
+void iwm_debugfs_init(struct iwm_priv *iwm)
 {
-        int i, result;
-        char devdir[16];
+        int i;
 
         iwm->dbg.rootdir = debugfs_create_dir(KBUILD_MODNAME, NULL);
-        result = PTR_ERR(iwm->dbg.rootdir);
-        if (!result || IS_ERR(iwm->dbg.rootdir)) {
-                if (result == -ENODEV) {
-                        IWM_ERR(iwm, "DebugFS (CONFIG_DEBUG_FS) not "
-                                "enabled in kernel config\n");
-                        result = 0;     /* No debugfs support */
-                }
-                IWM_ERR(iwm, "Couldn't create rootdir: %d\n", result);
-                goto error;
-        }
-
-        snprintf(devdir, sizeof(devdir), "%s", wiphy_name(iwm_to_wiphy(iwm)));
-
-        iwm->dbg.devdir = debugfs_create_dir(devdir, iwm->dbg.rootdir);
-        result = PTR_ERR(iwm->dbg.devdir);
-        if (IS_ERR(iwm->dbg.devdir) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create devdir: %d\n", result);
-                goto error;
-        }
-
+        iwm->dbg.devdir = debugfs_create_dir(wiphy_name(iwm_to_wiphy(iwm)),
+                                             iwm->dbg.rootdir);
         iwm->dbg.dbgdir = debugfs_create_dir("debug", iwm->dbg.devdir);
-        result = PTR_ERR(iwm->dbg.dbgdir);
-        if (IS_ERR(iwm->dbg.dbgdir) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create dbgdir: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.rxdir = debugfs_create_dir("rx", iwm->dbg.devdir);
-        result = PTR_ERR(iwm->dbg.rxdir);
-        if (IS_ERR(iwm->dbg.rxdir) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create rx dir: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.txdir = debugfs_create_dir("tx", iwm->dbg.devdir);
-        result = PTR_ERR(iwm->dbg.txdir);
-        if (IS_ERR(iwm->dbg.txdir) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create tx dir: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.busdir = debugfs_create_dir("bus", iwm->dbg.devdir);
-        result = PTR_ERR(iwm->dbg.busdir);
-        if (IS_ERR(iwm->dbg.busdir) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create bus dir: %d\n", result);
-                goto error;
-        }
-
-        if (iwm->bus_ops->debugfs_init) {
-                result = iwm->bus_ops->debugfs_init(iwm, iwm->dbg.busdir);
-                if (result < 0) {
-                        IWM_ERR(iwm, "Couldn't create bus entry: %d\n", result);
-                        goto error;
-                }
-        }
-
+        if (iwm->bus_ops->debugfs_init)
+                iwm->bus_ops->debugfs_init(iwm, iwm->dbg.busdir);
 
         iwm->dbg.dbg_level = IWM_DL_NONE;
         iwm->dbg.dbg_level_dentry =
                 debugfs_create_file("level", 0200, iwm->dbg.dbgdir, iwm,
                                     &fops_iwm_dbg_level);
-        result = PTR_ERR(iwm->dbg.dbg_level_dentry);
-        if (IS_ERR(iwm->dbg.dbg_level_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create dbg_level: %d\n", result);
-                goto error;
-        }
-
 
         iwm->dbg.dbg_modules = IWM_DM_DEFAULT;
         iwm->dbg.dbg_modules_dentry =
                 debugfs_create_file("modules", 0200, iwm->dbg.dbgdir, iwm,
                                     &fops_iwm_dbg_modules);
-        result = PTR_ERR(iwm->dbg.dbg_modules_dentry);
-        if (IS_ERR(iwm->dbg.dbg_modules_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create dbg_modules: %d\n", result);
-                goto error;
-        }
 
         for (i = 0; i < __IWM_DM_NR; i++)
                 add_dbg_module(iwm->dbg, iwm_debug_module[i].name,
@@ -514,44 +453,15 @@ int iwm_debugfs_init(struct iwm_priv *iwm)
         iwm->dbg.txq_dentry = debugfs_create_file("queues", 0200,
                                                   iwm->dbg.txdir, iwm,
                                                   &iwm_debugfs_txq_fops);
-        result = PTR_ERR(iwm->dbg.txq_dentry);
-        if (IS_ERR(iwm->dbg.txq_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create tx queue: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.tx_credit_dentry = debugfs_create_file("credits", 0200,
                                                    iwm->dbg.txdir, iwm,
                                                    &iwm_debugfs_tx_credit_fops);
-        result = PTR_ERR(iwm->dbg.tx_credit_dentry);
-        if (IS_ERR(iwm->dbg.tx_credit_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create tx credit: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.rx_ticket_dentry = debugfs_create_file("tickets", 0200,
                                                   iwm->dbg.rxdir, iwm,
                                                   &iwm_debugfs_rx_ticket_fops);
-        result = PTR_ERR(iwm->dbg.rx_ticket_dentry);
-        if (IS_ERR(iwm->dbg.rx_ticket_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create rx ticket: %d\n", result);
-                goto error;
-        }
-
         iwm->dbg.fw_err_dentry = debugfs_create_file("last_fw_err", 0200,
                                                      iwm->dbg.dbgdir, iwm,
                                                      &iwm_debugfs_fw_err_fops);
-        result = PTR_ERR(iwm->dbg.fw_err_dentry);
-        if (IS_ERR(iwm->dbg.fw_err_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create last FW err: %d\n", result);
-                goto error;
-        }
-
-
-        return 0;
-
- error:
-        return result;
 }
 
 void iwm_debugfs_exit(struct iwm_priv *iwm)
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index ad5398779240..e1184deca559 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -431,7 +431,8 @@ static int iwm_ntf_rx_ticket(struct iwm_priv *iwm, u8 *buf,
                                 return PTR_ERR(ticket_node);
 
                         IWM_DBG_RX(iwm, DBG, "TICKET %s(%d)\n",
-                                   ticket->action ==  IWM_RX_TICKET_RELEASE ?
+                                   __le16_to_cpu(ticket->action) ==
+                                                        IWM_RX_TICKET_RELEASE ?
                                    "RELEASE" : "DROP",
                                    ticket->id);
                         spin_lock(&iwm->ticket_lock);
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
index 1eafd6dec3fd..1acea37f39f8 100644
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ b/drivers/net/wireless/iwmc3200wifi/sdio.c
@@ -366,21 +366,13 @@ static const struct file_operations iwm_debugfs_sdio_fops = {
         .read =         iwm_debugfs_sdio_read,
 };
 
-static int if_sdio_debugfs_init(struct iwm_priv *iwm, struct dentry *parent_dir)
+static void if_sdio_debugfs_init(struct iwm_priv *iwm, struct dentry *parent_dir)
 {
-        int result;
         struct iwm_sdio_priv *hw = iwm_to_if_sdio(iwm);
 
         hw->cccr_dentry = debugfs_create_file("cccr", 0200,
                                               parent_dir, iwm,
                                               &iwm_debugfs_sdio_fops);
-        result = PTR_ERR(hw->cccr_dentry);
-        if (IS_ERR(hw->cccr_dentry) && (result != -ENODEV)) {
-                IWM_ERR(iwm, "Couldn't create CCCR entry: %d\n", result);
-                return result;
-        }
-
-        return 0;
 }
 
 static void if_sdio_debugfs_exit(struct iwm_priv *iwm)
@@ -440,11 +432,7 @@ static int iwm_sdio_probe(struct sdio_func *func,
         hw = iwm_private(iwm);
         hw->iwm = iwm;
 
-        ret = iwm_debugfs_init(iwm);
-        if (ret < 0) {
-                IWM_ERR(iwm, "Debugfs registration failed\n");
-                goto if_free;
-        }
+        iwm_debugfs_init(iwm);
 
         sdio_set_drvdata(func, hw);
 
@@ -473,7 +461,6 @@ static int iwm_sdio_probe(struct sdio_func *func,
         destroy_workqueue(hw->isr_wq);
  debugfs_exit:
         iwm_debugfs_exit(iwm);
- if_free:
         iwm_if_free(iwm);
         return ret;
 }
diff --git a/drivers/net/wireless/iwmc3200wifi/trace.h b/drivers/net/wireless/iwmc3200wifi/trace.h
index 320e54fbb38c..abb4805fa8df 100644
--- a/drivers/net/wireless/iwmc3200wifi/trace.h
+++ b/drivers/net/wireless/iwmc3200wifi/trace.h
@@ -76,7 +76,7 @@ TRACE_EVENT(iwm_tx_wifi_cmd,
                 IWM_ASSIGN;
                 __entry->opcode = hdr->sw_hdr.cmd.cmd;
                 __entry->lmac = 0;
-                __entry->seq = hdr->sw_hdr.cmd.seq_num;
+                __entry->seq = __le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
                 __entry->resp = GET_VAL8(hdr->sw_hdr.cmd.flags, UMAC_DEV_CMD_FLAGS_RESP_REQ);
                 __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
                 __entry->eot = GET_VAL32(hdr->hw_hdr.cmd, UMAC_HDI_OUT_CMD_EOT);
@@ -123,7 +123,7 @@ TRACE_EVENT(iwm_tx_packets,
                 __entry->ra_tid = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_RATID);
                 __entry->credit_group = GET_VAL32(hdr->hw_hdr.meta_data, UMAC_HDI_OUT_CREDIT_GRP);
                 __entry->color = GET_VAL32(hdr->sw_hdr.meta_data, UMAC_FW_CMD_TX_STA_COLOR);
-                __entry->seq = hdr->sw_hdr.cmd.seq_num;
+                __entry->seq = __le16_to_cpu(hdr->sw_hdr.cmd.seq_num);
                 __entry->npkt = 1;
                 __entry->bytes = len;
 
diff --git a/drivers/net/wireless/iwmc3200wifi/tx.c b/drivers/net/wireless/iwmc3200wifi/tx.c
index 9537cdb13d3f..3216621fc55a 100644
--- a/drivers/net/wireless/iwmc3200wifi/tx.c
+++ b/drivers/net/wireless/iwmc3200wifi/tx.c
@@ -302,8 +302,8 @@ void iwm_tx_credit_init_pools(struct iwm_priv *iwm,
 
 #define IWM_UDMA_HDR_LEN        sizeof(struct iwm_umac_wifi_out_hdr)
 
-static int iwm_tx_build_packet(struct iwm_priv *iwm, struct sk_buff *skb,
-                               int pool_id, u8 *buf)
+static __le16 iwm_tx_build_packet(struct iwm_priv *iwm, struct sk_buff *skb,
+                                  int pool_id, u8 *buf)
 {
         struct iwm_umac_wifi_out_hdr *hdr = (struct iwm_umac_wifi_out_hdr *)buf;
         struct iwm_udma_wifi_cmd udma_cmd;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index cd464a2589b9..64dd345d30f5 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -315,12 +315,30 @@ out:
         return ret;
 }
 
+static int if_sdio_wait_status(struct if_sdio_card *card, const u8 condition)
+{
+        u8 status;
+        unsigned long timeout;
+        int ret = 0;
+
+        timeout = jiffies + HZ;
+        while (1) {
+                status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
+                if (ret)
+                        return ret;
+                if ((status & condition) == condition)
+                        break;
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+                mdelay(1);
+        }
+        return ret;
+}
+
 static int if_sdio_card_to_host(struct if_sdio_card *card)
 {
         int ret;
-        u8 status;
         u16 size, type, chunk;
-        unsigned long timeout;
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
@@ -335,19 +353,9 @@ static int if_sdio_card_to_host(struct if_sdio_card *card)
                 goto out;
         }
 
-        timeout = jiffies + HZ;
-        while (1) {
-                status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
-                if (ret)
-                        goto out;
-                if (status & IF_SDIO_IO_RDY)
-                        break;
-                if (time_after(jiffies, timeout)) {
-                        ret = -ETIMEDOUT;
-                        goto out;
-                }
-                mdelay(1);
-        }
+        ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
+        if (ret)
+                goto out;
 
         /*
          * The transfer must be in one transaction or the firmware
@@ -414,8 +422,6 @@ static void if_sdio_host_to_card_worker(struct work_struct *work)
 {
         struct if_sdio_card *card;
         struct if_sdio_packet *packet;
-        unsigned long timeout;
-        u8 status;
         int ret;
         unsigned long flags;
 
@@ -435,25 +441,15 @@ static void if_sdio_host_to_card_worker(struct work_struct *work)
 
                 sdio_claim_host(card->func);
 
-                timeout = jiffies + HZ;
-                while (1) {
-                        status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
-                        if (ret)
-                                goto release;
-                        if (status & IF_SDIO_IO_RDY)
-                                break;
-                        if (time_after(jiffies, timeout)) {
-                                ret = -ETIMEDOUT;
-                                goto release;
-                        }
-                        mdelay(1);
+                ret = if_sdio_wait_status(card, IF_SDIO_IO_RDY);
+                if (ret == 0) {
+                        ret = sdio_writesb(card->func, card->ioport,
+                                           packet->buffer, packet->nb);
                 }
 
-                ret = sdio_writesb(card->func, card->ioport,
-                                packet->buffer, packet->nb);
                 if (ret)
-                        goto release;
-release:
+                        lbs_pr_err("error %d sending packet to firmware\n", ret);
+
                 sdio_release_host(card->func);
 
                 kfree(packet);
@@ -466,10 +462,11 @@ release:
 /* Firmware                                                         */
 /********************************************************************/
 
+#define FW_DL_READY_STATUS (IF_SDIO_IO_RDY | IF_SDIO_DL_RDY)
+
 static int if_sdio_prog_helper(struct if_sdio_card *card)
 {
         int ret;
-        u8 status;
         const struct firmware *fw;
         unsigned long timeout;
         u8 *chunk_buffer;
@@ -501,20 +498,14 @@ static int if_sdio_prog_helper(struct if_sdio_card *card)
         size = fw->size;
 
         while (size) {
-                timeout = jiffies + HZ;
-                while (1) {
-                        status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
-                        if (ret)
-                                goto release;
-                        if ((status & IF_SDIO_IO_RDY) &&
-                                        (status & IF_SDIO_DL_RDY))
-                                break;
-                        if (time_after(jiffies, timeout)) {
-                                ret = -ETIMEDOUT;
-                                goto release;
-                        }
-                        mdelay(1);
-                }
+                ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
+                if (ret)
+                        goto release;
+
+                /* On some platforms (like Davinci) the chip needs more time
+                 * between helper blocks.
+                 */
+                mdelay(2);
 
                 chunk_size = min(size, (size_t)60);
 
@@ -584,7 +575,6 @@ out:
 static int if_sdio_prog_real(struct if_sdio_card *card)
 {
         int ret;
-        u8 status;
         const struct firmware *fw;
         unsigned long timeout;
         u8 *chunk_buffer;
@@ -616,20 +606,9 @@ static int if_sdio_prog_real(struct if_sdio_card *card)
         size = fw->size;
 
         while (size) {
-                timeout = jiffies + HZ;
-                while (1) {
-                        status = sdio_readb(card->func, IF_SDIO_STATUS, &ret);
-                        if (ret)
-                                goto release;
-                        if ((status & IF_SDIO_IO_RDY) &&
-                                        (status & IF_SDIO_DL_RDY))
-                                break;
-                        if (time_after(jiffies, timeout)) {
-                                ret = -ETIMEDOUT;
-                                goto release;
-                        }
-                        mdelay(1);
-                }
+                ret = if_sdio_wait_status(card, FW_DL_READY_STATUS);
+                if (ret)
+                        goto release;
 
                 req_size = sdio_readb(card->func, IF_SDIO_RD_BASE, &ret);
                 if (ret)
diff --git a/drivers/net/wireless/libertas_tf/cmd.c b/drivers/net/wireless/libertas_tf/cmd.c
index b620daf59ef7..8945afd6ce3e 100644
--- a/drivers/net/wireless/libertas_tf/cmd.c
+++ b/drivers/net/wireless/libertas_tf/cmd.c
@@ -7,6 +7,8 @@
  *  the Free Software Foundation; either version 2 of the License, or (at
  *  your option) any later version.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 
 #include "libertas_tf.h"
@@ -82,6 +84,8 @@ int lbtf_update_hw_spec(struct lbtf_private *priv)
         int ret = -1;
         u32 i;
 
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         memset(&cmd, 0, sizeof(cmd));
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         memcpy(cmd.permanentaddr, priv->current_addr, ETH_ALEN);
@@ -104,6 +108,8 @@ int lbtf_update_hw_spec(struct lbtf_private *priv)
                 priv->fwrelease >>  8 & 0xff,
                 priv->fwrelease       & 0xff,
                 priv->fwcapinfo);
+        lbtf_deb_cmd("GET_HW_SPEC: hardware interface 0x%x, hardware spec 0x%04x\n",
+                    cmd.hwifversion, cmd.version);
 
         /* Clamp region code to 8-bit since FW spec indicates that it should
          * only ever be 8-bit, even though the field size is 16-bit.  Some
@@ -118,8 +124,10 @@ int lbtf_update_hw_spec(struct lbtf_private *priv)
         }
 
         /* if it's unidentified region code, use the default (USA) */
-        if (i >= MRVDRV_MAX_REGION_CODE)
+        if (i >= MRVDRV_MAX_REGION_CODE) {
                 priv->regioncode = 0x10;
+                pr_info("unidentified region code; using the default (USA)\n");
+        }
 
         if (priv->current_addr[0] == 0xff)
                 memmove(priv->current_addr, cmd.permanentaddr, ETH_ALEN);
@@ -128,6 +136,7 @@ int lbtf_update_hw_spec(struct lbtf_private *priv)
 
         lbtf_geo_init(priv);
 out:
+        lbtf_deb_leave(LBTF_DEB_CMD);
         return ret;
 }
 
@@ -141,13 +150,18 @@ out:
  */
 int lbtf_set_channel(struct lbtf_private *priv, u8 channel)
 {
+        int ret = 0;
         struct cmd_ds_802_11_rf_channel cmd;
 
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_OPT_802_11_RF_CHANNEL_SET);
         cmd.channel = cpu_to_le16(channel);
 
-        return lbtf_cmd_with_response(priv, CMD_802_11_RF_CHANNEL, &cmd);
+        ret = lbtf_cmd_with_response(priv, CMD_802_11_RF_CHANNEL, &cmd);
+        lbtf_deb_leave_args(LBTF_DEB_CMD, "ret %d", ret);
+        return ret;
 }
 
 int lbtf_beacon_set(struct lbtf_private *priv, struct sk_buff *beacon)
@@ -155,20 +169,28 @@ int lbtf_beacon_set(struct lbtf_private *priv, struct sk_buff *beacon)
         struct cmd_ds_802_11_beacon_set cmd;
         int size;
 
-        if (beacon->len > MRVL_MAX_BCN_SIZE)
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
+        if (beacon->len > MRVL_MAX_BCN_SIZE) {
+                lbtf_deb_leave_args(LBTF_DEB_CMD, "ret %d", -1);
                 return -1;
+        }
         size =  sizeof(cmd) - sizeof(cmd.beacon) + beacon->len;
         cmd.hdr.size = cpu_to_le16(size);
         cmd.len = cpu_to_le16(beacon->len);
         memcpy(cmd.beacon, (u8 *) beacon->data, beacon->len);
 
         lbtf_cmd_async(priv, CMD_802_11_BEACON_SET, &cmd.hdr, size);
+
+        lbtf_deb_leave_args(LBTF_DEB_CMD, "ret %d", 0);
         return 0;
 }
 
 int lbtf_beacon_ctrl(struct lbtf_private *priv, bool beacon_enable,
-                     int beacon_int) {
+                     int beacon_int)
+{
         struct cmd_ds_802_11_beacon_control cmd;
+        lbtf_deb_enter(LBTF_DEB_CMD);
 
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_SET);
@@ -176,6 +198,8 @@ int lbtf_beacon_ctrl(struct lbtf_private *priv, bool beacon_enable,
         cmd.beacon_period = cpu_to_le16(beacon_int);
 
         lbtf_cmd_async(priv, CMD_802_11_BEACON_CTRL, &cmd.hdr, sizeof(cmd));
+
+        lbtf_deb_leave(LBTF_DEB_CMD);
         return 0;
 }
 
@@ -183,17 +207,28 @@ static void lbtf_queue_cmd(struct lbtf_private *priv,
                           struct cmd_ctrl_node *cmdnode)
 {
         unsigned long flags;
+        lbtf_deb_enter(LBTF_DEB_HOST);
 
-        if (!cmdnode)
-                return;
+        if (!cmdnode) {
+                lbtf_deb_host("QUEUE_CMD: cmdnode is NULL\n");
+                goto qcmd_done;
+        }
 
-        if (!cmdnode->cmdbuf->size)
-                return;
+        if (!cmdnode->cmdbuf->size) {
+                lbtf_deb_host("DNLD_CMD: cmd size is zero\n");
+                goto qcmd_done;
+        }
 
         cmdnode->result = 0;
         spin_lock_irqsave(&priv->driver_lock, flags);
         list_add_tail(&cmdnode->list, &priv->cmdpendingq);
         spin_unlock_irqrestore(&priv->driver_lock, flags);
+
+        lbtf_deb_host("QUEUE_CMD: inserted command 0x%04x into cmdpendingq\n",
+                     le16_to_cpu(cmdnode->cmdbuf->command));
+
+qcmd_done:
+        lbtf_deb_leave(LBTF_DEB_HOST);
 }
 
 static void lbtf_submit_command(struct lbtf_private *priv,
@@ -206,22 +241,33 @@ static void lbtf_submit_command(struct lbtf_private *priv,
         int timeo = 5 * HZ;
         int ret;
 
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         cmd = cmdnode->cmdbuf;
 
         spin_lock_irqsave(&priv->driver_lock, flags);
         priv->cur_cmd = cmdnode;
         cmdsize = le16_to_cpu(cmd->size);
         command = le16_to_cpu(cmd->command);
+
+        lbtf_deb_cmd("DNLD_CMD: command 0x%04x, seq %d, size %d\n",
+                     command, le16_to_cpu(cmd->seqnum), cmdsize);
+        lbtf_deb_hex(LBTF_DEB_CMD, "DNLD_CMD", (void *) cmdnode->cmdbuf, cmdsize);
+
         ret = priv->hw_host_to_card(priv, MVMS_CMD, (u8 *) cmd, cmdsize);
         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
-        if (ret)
+        if (ret) {
+                pr_info("DNLD_CMD: hw_host_to_card failed: %d\n", ret);
                 /* Let the timer kick in and retry, and potentially reset
                    the whole thing if the condition persists */
                 timeo = HZ;
+        }
 
         /* Setup the timer after transmit command */
         mod_timer(&priv->command_timer, jiffies + timeo);
+
+        lbtf_deb_leave(LBTF_DEB_HOST);
 }
 
 /**
@@ -231,8 +277,10 @@ static void lbtf_submit_command(struct lbtf_private *priv,
 static void __lbtf_cleanup_and_insert_cmd(struct lbtf_private *priv,
                                          struct cmd_ctrl_node *cmdnode)
 {
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         if (!cmdnode)
-                return;
+                goto cl_ins_out;
 
         cmdnode->callback = NULL;
         cmdnode->callback_arg = 0;
@@ -240,6 +288,9 @@ static void __lbtf_cleanup_and_insert_cmd(struct lbtf_private *priv,
         memset(cmdnode->cmdbuf, 0, LBS_CMD_BUFFER_SIZE);
 
         list_add_tail(&cmdnode->list, &priv->cmdfreeq);
+
+cl_ins_out:
+        lbtf_deb_leave(LBTF_DEB_HOST);
 }
 
 static void lbtf_cleanup_and_insert_cmd(struct lbtf_private *priv,
@@ -268,29 +319,41 @@ int lbtf_cmd_set_mac_multicast_addr(struct lbtf_private *priv)
 {
         struct cmd_ds_mac_multicast_addr cmd;
 
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_SET);
 
         cmd.nr_of_adrs = cpu_to_le16((u16) priv->nr_of_multicastmacaddr);
+
+        lbtf_deb_cmd("MULTICAST_ADR: setting %d addresses\n", cmd.nr_of_adrs);
+
         memcpy(cmd.maclist, priv->multicastlist,
                priv->nr_of_multicastmacaddr * ETH_ALEN);
 
         lbtf_cmd_async(priv, CMD_MAC_MULTICAST_ADR, &cmd.hdr, sizeof(cmd));
+
+        lbtf_deb_leave(LBTF_DEB_CMD);
         return 0;
 }
 
 void lbtf_set_mode(struct lbtf_private *priv, enum lbtf_mode mode)
 {
         struct cmd_ds_set_mode cmd;
+        lbtf_deb_enter(LBTF_DEB_WEXT);
 
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.mode = cpu_to_le16(mode);
+        lbtf_deb_wext("Switching to mode: 0x%x\n", mode);
         lbtf_cmd_async(priv, CMD_802_11_SET_MODE, &cmd.hdr, sizeof(cmd));
+
+        lbtf_deb_leave(LBTF_DEB_WEXT);
 }
 
 void lbtf_set_bssid(struct lbtf_private *priv, bool activate, const u8 *bssid)
 {
         struct cmd_ds_set_bssid cmd;
+        lbtf_deb_enter(LBTF_DEB_CMD);
 
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.activate = activate ? 1 : 0;
@@ -298,11 +361,13 @@ void lbtf_set_bssid(struct lbtf_private *priv, bool activate, const u8 *bssid)
                 memcpy(cmd.bssid, bssid, ETH_ALEN);
 
         lbtf_cmd_async(priv, CMD_802_11_SET_BSSID, &cmd.hdr, sizeof(cmd));
+        lbtf_deb_leave(LBTF_DEB_CMD);
 }
 
 int lbtf_set_mac_address(struct lbtf_private *priv, uint8_t *mac_addr)
 {
         struct cmd_ds_802_11_mac_address cmd;
+        lbtf_deb_enter(LBTF_DEB_CMD);
 
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_SET);
@@ -310,6 +375,7 @@ int lbtf_set_mac_address(struct lbtf_private *priv, uint8_t *mac_addr)
         memcpy(cmd.macadd, mac_addr, ETH_ALEN);
 
         lbtf_cmd_async(priv, CMD_802_11_MAC_ADDRESS, &cmd.hdr, sizeof(cmd));
+        lbtf_deb_leave(LBTF_DEB_CMD);
         return 0;
 }
 
@@ -318,6 +384,8 @@ int lbtf_set_radio_control(struct lbtf_private *priv)
         int ret = 0;
         struct cmd_ds_802_11_radio_control cmd;
 
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(CMD_ACT_SET);
 
@@ -341,19 +409,28 @@ int lbtf_set_radio_control(struct lbtf_private *priv)
         else
                 cmd.control &= cpu_to_le16(~TURN_ON_RF);
 
+        lbtf_deb_cmd("RADIO_SET: radio %d, preamble %d\n", priv->radioon,
+                    priv->preamble);
+
         ret = lbtf_cmd_with_response(priv, CMD_802_11_RADIO_CONTROL, &cmd);
+
+        lbtf_deb_leave_args(LBTF_DEB_CMD, "ret %d", ret);
         return ret;
 }
 
 void lbtf_set_mac_control(struct lbtf_private *priv)
 {
         struct cmd_ds_mac_control cmd;
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         cmd.hdr.size = cpu_to_le16(sizeof(cmd));
         cmd.action = cpu_to_le16(priv->mac_control);
         cmd.reserved = 0;
 
         lbtf_cmd_async(priv, CMD_MAC_CONTROL,
                 &cmd.hdr, sizeof(cmd));
+
+        lbtf_deb_leave(LBTF_DEB_CMD);
 }
 
 /**
@@ -365,29 +442,43 @@ void lbtf_set_mac_control(struct lbtf_private *priv)
  */
 int lbtf_allocate_cmd_buffer(struct lbtf_private *priv)
 {
+        int ret = 0;
         u32 bufsize;
         u32 i;
         struct cmd_ctrl_node *cmdarray;
 
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         /* Allocate and initialize the command array */
         bufsize = sizeof(struct cmd_ctrl_node) * LBS_NUM_CMD_BUFFERS;
         cmdarray = kzalloc(bufsize, GFP_KERNEL);
-        if (!cmdarray)
-                return -1;
+        if (!cmdarray) {
+                lbtf_deb_host("ALLOC_CMD_BUF: tempcmd_array is NULL\n");
+                ret = -1;
+                goto done;
+        }
         priv->cmd_array = cmdarray;
 
         /* Allocate and initialize each command buffer in the command array */
         for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
                 cmdarray[i].cmdbuf = kzalloc(LBS_CMD_BUFFER_SIZE, GFP_KERNEL);
-                if (!cmdarray[i].cmdbuf)
-                        return -1;
+                if (!cmdarray[i].cmdbuf) {
+                        lbtf_deb_host("ALLOC_CMD_BUF: ptempvirtualaddr is NULL\n");
+                        ret = -1;
+                        goto done;
+                }
         }
 
         for (i = 0; i < LBS_NUM_CMD_BUFFERS; i++) {
                 init_waitqueue_head(&cmdarray[i].cmdwait_q);
                 lbtf_cleanup_and_insert_cmd(priv, &cmdarray[i]);
         }
-        return 0;
+
+        ret = 0;
+
+done:
+        lbtf_deb_leave_args(LBTF_DEB_HOST, "ret %d", ret);
+        return ret;
 }
 
 /**
@@ -402,9 +493,13 @@ int lbtf_free_cmd_buffer(struct lbtf_private *priv)
         struct cmd_ctrl_node *cmdarray;
         unsigned int i;
 
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         /* need to check if cmd array is allocated or not */
-        if (priv->cmd_array == NULL)
-                return 0;
+        if (priv->cmd_array == NULL) {
+                lbtf_deb_host("FREE_CMD_BUF: cmd_array is NULL\n");
+                goto done;
+        }
 
         cmdarray = priv->cmd_array;
 
@@ -418,6 +513,8 @@ int lbtf_free_cmd_buffer(struct lbtf_private *priv)
         kfree(priv->cmd_array);
         priv->cmd_array = NULL;
 
+done:
+        lbtf_deb_leave(LBTF_DEB_HOST);
         return 0;
 }
 
@@ -433,6 +530,8 @@ static struct cmd_ctrl_node *lbtf_get_cmd_ctrl_node(struct lbtf_private *priv)
         struct cmd_ctrl_node *tempnode;
         unsigned long flags;
 
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         if (!priv)
                 return NULL;
 
@@ -442,11 +541,14 @@ static struct cmd_ctrl_node *lbtf_get_cmd_ctrl_node(struct lbtf_private *priv)
                 tempnode = list_first_entry(&priv->cmdfreeq,
                                             struct cmd_ctrl_node, list);
                 list_del(&tempnode->list);
-        } else
+        } else {
+                lbtf_deb_host("GET_CMD_NODE: cmd_ctrl_node is not available\n");
                 tempnode = NULL;
+        }
 
         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
+        lbtf_deb_leave(LBTF_DEB_HOST);
         return tempnode;
 }
 
@@ -462,16 +564,20 @@ int lbtf_execute_next_command(struct lbtf_private *priv)
         struct cmd_ctrl_node *cmdnode = NULL;
         struct cmd_header *cmd;
         unsigned long flags;
+        int ret = 0;
 
-        /* Debug group is LBS_DEB_THREAD and not LBS_DEB_HOST, because the
+        /* Debug group is lbtf_deb_THREAD and not lbtf_deb_HOST, because the
          * only caller to us is lbtf_thread() and we get even when a
          * data packet is received */
+        lbtf_deb_enter(LBTF_DEB_THREAD);
 
         spin_lock_irqsave(&priv->driver_lock, flags);
 
         if (priv->cur_cmd) {
+                pr_alert("EXEC_NEXT_CMD: already processing command!\n");
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
-                return -1;
+                ret = -1;
+                goto done;
         }
 
         if (!list_empty(&priv->cmdpendingq)) {
@@ -483,11 +589,17 @@ int lbtf_execute_next_command(struct lbtf_private *priv)
                 cmd = cmdnode->cmdbuf;
 
                 list_del(&cmdnode->list);
+                lbtf_deb_host("EXEC_NEXT_CMD: sending command 0x%04x\n",
+                            le16_to_cpu(cmd->command));
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
                 lbtf_submit_command(priv, cmdnode);
         } else
                 spin_unlock_irqrestore(&priv->driver_lock, flags);
-        return 0;
+
+        ret = 0;
+done:
+        lbtf_deb_leave(LBTF_DEB_THREAD);
+        return ret;
 }
 
 static struct cmd_ctrl_node *__lbtf_cmd_async(struct lbtf_private *priv,
@@ -498,14 +610,22 @@ static struct cmd_ctrl_node *__lbtf_cmd_async(struct lbtf_private *priv,
 {
         struct cmd_ctrl_node *cmdnode;
 
-        if (priv->surpriseremoved)
-                return ERR_PTR(-ENOENT);
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
+        if (priv->surpriseremoved) {
+                lbtf_deb_host("PREP_CMD: card removed\n");
+                cmdnode = ERR_PTR(-ENOENT);
+                goto done;
+        }
 
         cmdnode = lbtf_get_cmd_ctrl_node(priv);
         if (cmdnode == NULL) {
+                lbtf_deb_host("PREP_CMD: cmdnode is NULL\n");
+
                 /* Wake up main thread to execute next command */
                 queue_work(lbtf_wq, &priv->cmd_work);
-                return ERR_PTR(-ENOBUFS);
+                cmdnode = ERR_PTR(-ENOBUFS);
+                goto done;
         }
 
         cmdnode->callback = callback;
@@ -520,17 +640,24 @@ static struct cmd_ctrl_node *__lbtf_cmd_async(struct lbtf_private *priv,
         cmdnode->cmdbuf->size    = cpu_to_le16(in_cmd_size);
         cmdnode->cmdbuf->seqnum  = cpu_to_le16(priv->seqnum);
         cmdnode->cmdbuf->result  = 0;
+
+        lbtf_deb_host("PREP_CMD: command 0x%04x\n", command);
+
         cmdnode->cmdwaitqwoken = 0;
         lbtf_queue_cmd(priv, cmdnode);
         queue_work(lbtf_wq, &priv->cmd_work);
 
+ done:
+        lbtf_deb_leave_args(LBTF_DEB_HOST, "ret %p", cmdnode);
         return cmdnode;
 }
 
 void lbtf_cmd_async(struct lbtf_private *priv, uint16_t command,
         struct cmd_header *in_cmd, int in_cmd_size)
 {
+        lbtf_deb_enter(LBTF_DEB_CMD);
         __lbtf_cmd_async(priv, command, in_cmd, in_cmd_size, NULL, 0);
+        lbtf_deb_leave(LBTF_DEB_CMD);
 }
 
 int __lbtf_cmd(struct lbtf_private *priv, uint16_t command,
@@ -543,30 +670,35 @@ int __lbtf_cmd(struct lbtf_private *priv, uint16_t command,
         unsigned long flags;
         int ret = 0;
 
+        lbtf_deb_enter(LBTF_DEB_HOST);
+
         cmdnode = __lbtf_cmd_async(priv, command, in_cmd, in_cmd_size,
                                   callback, callback_arg);
-        if (IS_ERR(cmdnode))
-                return PTR_ERR(cmdnode);
+        if (IS_ERR(cmdnode)) {
+                ret = PTR_ERR(cmdnode);
+                goto done;
+        }
 
         might_sleep();
         ret = wait_event_interruptible(cmdnode->cmdwait_q,
                                        cmdnode->cmdwaitqwoken);
-       if (ret) {
-                printk(KERN_DEBUG
-                       "libertastf: command 0x%04x interrupted by signal",
-                       command);
-                return ret;
+        if (ret) {
+                pr_info("PREP_CMD: command 0x%04x interrupted by signal: %d\n",
+                            command, ret);
+                goto done;
         }
 
         spin_lock_irqsave(&priv->driver_lock, flags);
         ret = cmdnode->result;
         if (ret)
-                printk(KERN_DEBUG "libertastf: command 0x%04x failed: %d\n",
+                pr_info("PREP_CMD: command 0x%04x failed: %d\n",
                             command, ret);
 
         __lbtf_cleanup_and_insert_cmd(priv, cmdnode);
         spin_unlock_irqrestore(&priv->driver_lock, flags);
 
+done:
+        lbtf_deb_leave_args(LBTF_DEB_HOST, "ret %d", ret);
         return ret;
 }
 EXPORT_SYMBOL_GPL(__lbtf_cmd);
@@ -587,6 +719,8 @@ int lbtf_process_rx_command(struct lbtf_private *priv)
         unsigned long flags;
         uint16_t result;
 
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         mutex_lock(&priv->lock);
         spin_lock_irqsave(&priv->driver_lock, flags);
 
@@ -602,7 +736,7 @@ int lbtf_process_rx_command(struct lbtf_private *priv)
         result = le16_to_cpu(resp->result);
 
         if (net_ratelimit())
-                printk(KERN_DEBUG "libertastf: cmd response 0x%04x, seq %d, size %d\n",
+                pr_info("libertastf: cmd response 0x%04x, seq %d, size %d\n",
                         respcmd, le16_to_cpu(resp->seqnum),
                         le16_to_cpu(resp->size));
 
@@ -639,7 +773,7 @@ int lbtf_process_rx_command(struct lbtf_private *priv)
                 switch (respcmd) {
                 case CMD_RET(CMD_GET_HW_SPEC):
                 case CMD_RET(CMD_802_11_RESET):
-                        printk(KERN_DEBUG "libertastf: reset failed\n");
+                        pr_info("libertastf: reset failed\n");
                         break;
 
                 }
@@ -666,5 +800,6 @@ int lbtf_process_rx_command(struct lbtf_private *priv)
 
 done:
         mutex_unlock(&priv->lock);
+        lbtf_deb_leave_args(LBTF_DEB_CMD, "ret %d", ret);
         return ret;
 }
diff --git a/drivers/net/wireless/libertas_tf/deb_defs.h b/drivers/net/wireless/libertas_tf/deb_defs.h
new file mode 100644
index 000000000000..ae753962d8b5
--- /dev/null
+++ b/drivers/net/wireless/libertas_tf/deb_defs.h
@@ -0,0 +1,104 @@
+/**
+  * This header file contains global constant/enum definitions,
+  * global variable declaration.
+  */
+#ifndef _LBS_DEB_DEFS_H_
+#define _LBS_DEB_EFS_H_
+
+#ifndef DRV_NAME
+#define DRV_NAME "libertas_tf"
+#endif
+
+#include <linux/spinlock.h>
+
+#ifdef CONFIG_LIBERTAS_THINFIRM_DEBUG
+#define DEBUG
+#define PROC_DEBUG
+#endif
+
+#define LBTF_DEB_ENTER  0x00000001
+#define LBTF_DEB_LEAVE  0x00000002
+#define LBTF_DEB_MAIN   0x00000004
+#define LBTF_DEB_NET    0x00000008
+#define LBTF_DEB_MESH   0x00000010
+#define LBTF_DEB_WEXT   0x00000020
+#define LBTF_DEB_IOCTL  0x00000040
+#define LBTF_DEB_SCAN   0x00000080
+#define LBTF_DEB_ASSOC  0x00000100
+#define LBTF_DEB_JOIN   0x00000200
+#define LBTF_DEB_11D    0x00000400
+#define LBTF_DEB_DEBUGFS        0x00000800
+#define LBTF_DEB_ETHTOOL        0x00001000
+#define LBTF_DEB_HOST   0x00002000
+#define LBTF_DEB_CMD    0x00004000
+#define LBTF_DEB_RX     0x00008000
+#define LBTF_DEB_TX     0x00010000
+#define LBTF_DEB_USB    0x00020000
+#define LBTF_DEB_CS     0x00040000
+#define LBTF_DEB_FW     0x00080000
+#define LBTF_DEB_THREAD 0x00100000
+#define LBTF_DEB_HEX    0x00200000
+#define LBTF_DEB_SDIO   0x00400000
+#define LBTF_DEB_MACOPS 0x00800000
+
+extern unsigned int lbtf_debug;
+
+
+#ifdef DEBUG
+#define LBTF_DEB_LL(grp, grpnam, fmt, args...) \
+do { if ((lbtf_debug & (grp)) == (grp)) \
+  printk(KERN_DEBUG DRV_NAME grpnam "%s: " fmt, \
+         in_interrupt() ? " (INT)" : "", ## args); } while (0)
+#else
+#define LBTF_DEB_LL(grp, grpnam, fmt, args...) do {} while (0)
+#endif
+
+#define lbtf_deb_enter(grp) \
+  LBTF_DEB_LL(grp | LBTF_DEB_ENTER, " enter", "%s()\n", __func__);
+#define lbtf_deb_enter_args(grp, fmt, args...) \
+  LBTF_DEB_LL(grp | LBTF_DEB_ENTER, " enter", "%s(" fmt ")\n", __func__, ## args);
+#define lbtf_deb_leave(grp) \
+  LBTF_DEB_LL(grp | LBTF_DEB_LEAVE, " leave", "%s()\n", __func__);
+#define lbtf_deb_leave_args(grp, fmt, args...) \
+  LBTF_DEB_LL(grp | LBTF_DEB_LEAVE, " leave", "%s(), " fmt "\n", \
+  __func__, ##args);
+#define lbtf_deb_main(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_MAIN, " main", fmt, ##args)
+#define lbtf_deb_net(fmt, args...)       LBTF_DEB_LL(LBTF_DEB_NET, " net", fmt, ##args)
+#define lbtf_deb_mesh(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_MESH, " mesh", fmt, ##args)
+#define lbtf_deb_wext(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_WEXT, " wext", fmt, ##args)
+#define lbtf_deb_ioctl(fmt, args...)     LBTF_DEB_LL(LBTF_DEB_IOCTL, " ioctl", fmt, ##args)
+#define lbtf_deb_scan(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_SCAN, " scan", fmt, ##args)
+#define lbtf_deb_assoc(fmt, args...)     LBTF_DEB_LL(LBTF_DEB_ASSOC, " assoc", fmt, ##args)
+#define lbtf_deb_join(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_JOIN, " join", fmt, ##args)
+#define lbtf_deb_11d(fmt, args...)       LBTF_DEB_LL(LBTF_DEB_11D, " 11d", fmt, ##args)
+#define lbtf_deb_debugfs(fmt, args...)   LBTF_DEB_LL(LBTF_DEB_DEBUGFS, " debugfs", fmt, ##args)
+#define lbtf_deb_ethtool(fmt, args...)   LBTF_DEB_LL(LBTF_DEB_ETHTOOL, " ethtool", fmt, ##args)
+#define lbtf_deb_host(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_HOST, " host", fmt, ##args)
+#define lbtf_deb_cmd(fmt, args...)       LBTF_DEB_LL(LBTF_DEB_CMD, " cmd", fmt, ##args)
+#define lbtf_deb_rx(fmt, args...)        LBTF_DEB_LL(LBTF_DEB_RX, " rx", fmt, ##args)
+#define lbtf_deb_tx(fmt, args...)        LBTF_DEB_LL(LBTF_DEB_TX, " tx", fmt, ##args)
+#define lbtf_deb_fw(fmt, args...)        LBTF_DEB_LL(LBTF_DEB_FW, " fw", fmt, ##args)
+#define lbtf_deb_usb(fmt, args...)       LBTF_DEB_LL(LBTF_DEB_USB, " usb", fmt, ##args)
+#define lbtf_deb_usbd(dev, fmt, args...) LBTF_DEB_LL(LBTF_DEB_USB, " usbd", "%s:" fmt, dev_name(dev), ##args)
+#define lbtf_deb_cs(fmt, args...)        LBTF_DEB_LL(LBTF_DEB_CS, " cs", fmt, ##args)
+#define lbtf_deb_thread(fmt, args...)    LBTF_DEB_LL(LBTF_DEB_THREAD, " thread", fmt, ##args)
+#define lbtf_deb_sdio(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_SDIO, " thread", fmt, ##args)
+#define lbtf_deb_macops(fmt, args...)      LBTF_DEB_LL(LBTF_DEB_MACOPS, " thread", fmt, ##args)
+
+#ifdef DEBUG
+static inline void lbtf_deb_hex(unsigned int grp, const char *prompt, u8 *buf, int len)
+{
+        char newprompt[32];
+
+        if (len &&
+            (lbtf_debug & LBTF_DEB_HEX) &&
+            (lbtf_debug & grp)) {
+                snprintf(newprompt, sizeof(newprompt), DRV_NAME " %s: ", prompt);
+                print_hex_dump_bytes(prompt, DUMP_PREFIX_NONE, buf, len);
+        }
+}
+#else
+#define lbtf_deb_hex(grp, prompt, buf, len)     do {} while (0)
+#endif
+
+#endif
diff --git a/drivers/net/wireless/libertas_tf/if_usb.c b/drivers/net/wireless/libertas_tf/if_usb.c
index 8cc9db60c14b..4412c279ca94 100644
--- a/drivers/net/wireless/libertas_tf/if_usb.c
+++ b/drivers/net/wireless/libertas_tf/if_usb.c
@@ -7,6 +7,13 @@
  *  the Free Software Foundation; either version 2 of the License, or (at
  *  your option) any later version.
  */
+#define DRV_NAME "lbtf_usb"
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include "libertas_tf.h"
+#include "if_usb.h"
+
 #include <linux/delay.h>
 #include <linux/moduleparam.h>
 #include <linux/firmware.h>
@@ -14,10 +21,8 @@
 #include <linux/slab.h>
 #include <linux/usb.h>
 
-#define DRV_NAME "lbtf_usb"
-
-#include "libertas_tf.h"
-#include "if_usb.h"
+#define INSANEDEBUG     0
+#define lbtf_deb_usb2(...) do { if (INSANEDEBUG) lbtf_deb_usbd(__VA_ARGS__); } while (0)
 
 #define MESSAGE_HEADER_LEN      4
 
@@ -53,9 +58,14 @@ static int if_usb_reset_device(struct if_usb_card *cardp);
  */
 static void if_usb_write_bulk_callback(struct urb *urb)
 {
-        if (urb->status != 0)
-                printk(KERN_INFO "libertastf: URB in failure status: %d\n",
-                       urb->status);
+        if (urb->status != 0) {
+                /* print the failure status number for debug */
+                pr_info("URB in failure status: %d\n", urb->status);
+        } else {
+                lbtf_deb_usb2(&urb->dev->dev, "URB status is successful\n");
+                lbtf_deb_usb2(&urb->dev->dev, "Actual length transmitted %d\n",
+                             urb->actual_length);
+        }
 }
 
 /**
@@ -65,6 +75,8 @@ static void if_usb_write_bulk_callback(struct urb *urb)
  */
 static void if_usb_free(struct if_usb_card *cardp)
 {
+        lbtf_deb_enter(LBTF_DEB_USB);
+
         /* Unlink tx & rx urb */
         usb_kill_urb(cardp->tx_urb);
         usb_kill_urb(cardp->rx_urb);
@@ -81,6 +93,8 @@ static void if_usb_free(struct if_usb_card *cardp)
 
         kfree(cardp->ep_out_buf);
         cardp->ep_out_buf = NULL;
+
+        lbtf_deb_leave(LBTF_DEB_USB);
 }
 
 static void if_usb_setup_firmware(struct lbtf_private *priv)
@@ -88,23 +102,33 @@ static void if_usb_setup_firmware(struct lbtf_private *priv)
         struct if_usb_card *cardp = priv->card;
         struct cmd_ds_set_boot2_ver b2_cmd;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
+
         if_usb_submit_rx_urb(cardp);
         b2_cmd.hdr.size = cpu_to_le16(sizeof(b2_cmd));
         b2_cmd.action = 0;
         b2_cmd.version = cardp->boot2_version;
 
         if (lbtf_cmd_with_response(priv, CMD_SET_BOOT2_VER, &b2_cmd))
-                printk(KERN_INFO "libertastf: setting boot2 version failed\n");
+                lbtf_deb_usb("Setting boot2 version failed\n");
+
+        lbtf_deb_leave(LBTF_DEB_USB);
 }
 
 static void if_usb_fw_timeo(unsigned long priv)
 {
         struct if_usb_card *cardp = (void *)priv;
 
-        if (!cardp->fwdnldover)
+        lbtf_deb_enter(LBTF_DEB_USB);
+        if (!cardp->fwdnldover) {
                 /* Download timed out */
                 cardp->priv->surpriseremoved = 1;
+                pr_err("Download timed out\n");
+        } else {
+                lbtf_deb_usb("Download complete, no event. Assuming success\n");
+        }
         wake_up(&cardp->fw_wq);
+        lbtf_deb_leave(LBTF_DEB_USB);
 }
 
 /**
@@ -125,11 +149,14 @@ static int if_usb_probe(struct usb_interface *intf,
         struct if_usb_card *cardp;
         int i;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
         udev = interface_to_usbdev(intf);
 
         cardp = kzalloc(sizeof(struct if_usb_card), GFP_KERNEL);
-        if (!cardp)
+        if (!cardp) {
+                pr_err("Out of memory allocating private data.\n");
                 goto error;
+        }
 
         setup_timer(&cardp->fw_timeout, if_usb_fw_timeo, (unsigned long)cardp);
         init_waitqueue_head(&cardp->fw_wq);
@@ -137,38 +164,62 @@ static int if_usb_probe(struct usb_interface *intf,
         cardp->udev = udev;
         iface_desc = intf->cur_altsetting;
 
+        lbtf_deb_usbd(&udev->dev, "bcdUSB = 0x%X bDeviceClass = 0x%X"
+                     " bDeviceSubClass = 0x%X, bDeviceProtocol = 0x%X\n",
+                     le16_to_cpu(udev->descriptor.bcdUSB),
+                     udev->descriptor.bDeviceClass,
+                     udev->descriptor.bDeviceSubClass,
+                     udev->descriptor.bDeviceProtocol);
+
         for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
                 endpoint = &iface_desc->endpoint[i].desc;
                 if (usb_endpoint_is_bulk_in(endpoint)) {
                         cardp->ep_in_size =
                                 le16_to_cpu(endpoint->wMaxPacketSize);
                         cardp->ep_in = usb_endpoint_num(endpoint);
+
+                        lbtf_deb_usbd(&udev->dev, "in_endpoint = %d\n", cardp->ep_in);
+                        lbtf_deb_usbd(&udev->dev, "Bulk in size is %d\n", cardp->ep_in_size);
                 } else if (usb_endpoint_is_bulk_out(endpoint)) {
                         cardp->ep_out_size =
                                 le16_to_cpu(endpoint->wMaxPacketSize);
                         cardp->ep_out = usb_endpoint_num(endpoint);
+
+                        lbtf_deb_usbd(&udev->dev, "out_endpoint = %d\n", cardp->ep_out);
+                        lbtf_deb_usbd(&udev->dev, "Bulk out size is %d\n",
+                                      cardp->ep_out_size);
                 }
         }
-        if (!cardp->ep_out_size || !cardp->ep_in_size)
+        if (!cardp->ep_out_size || !cardp->ep_in_size) {
+                lbtf_deb_usbd(&udev->dev, "Endpoints not found\n");
                 /* Endpoints not found */
                 goto dealloc;
+        }
 
         cardp->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!cardp->rx_urb)
+        if (!cardp->rx_urb) {
+                lbtf_deb_usbd(&udev->dev, "Rx URB allocation failed\n");
                 goto dealloc;
+        }
 
         cardp->tx_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!cardp->tx_urb)
+        if (!cardp->tx_urb) {
+                lbtf_deb_usbd(&udev->dev, "Tx URB allocation failed\n");
                 goto dealloc;
+        }
 
         cardp->cmd_urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (!cardp->cmd_urb)
+        if (!cardp->cmd_urb) {
+                lbtf_deb_usbd(&udev->dev, "Cmd URB allocation failed\n");
                 goto dealloc;
+        }
 
         cardp->ep_out_buf = kmalloc(MRVDRV_ETH_TX_PACKET_BUFFER_SIZE,
                                     GFP_KERNEL);
-        if (!cardp->ep_out_buf)
+        if (!cardp->ep_out_buf) {
+                lbtf_deb_usbd(&udev->dev, "Could not allocate buffer\n");
                 goto dealloc;
+        }
 
         priv = lbtf_add_card(cardp, &udev->dev);
         if (!priv)
@@ -189,6 +240,7 @@ static int if_usb_probe(struct usb_interface *intf,
 dealloc:
         if_usb_free(cardp);
 error:
+lbtf_deb_leave(LBTF_DEB_MAIN);
         return -ENOMEM;
 }
 
@@ -202,6 +254,8 @@ static void if_usb_disconnect(struct usb_interface *intf)
         struct if_usb_card *cardp = usb_get_intfdata(intf);
         struct lbtf_private *priv = (struct lbtf_private *) cardp->priv;
 
+        lbtf_deb_enter(LBTF_DEB_MAIN);
+
         if_usb_reset_device(cardp);
 
         if (priv)
@@ -212,6 +266,8 @@ static void if_usb_disconnect(struct usb_interface *intf)
 
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
+
+        lbtf_deb_leave(LBTF_DEB_MAIN);
 }
 
 /**
@@ -226,6 +282,8 @@ static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
         struct fwdata *fwdata = cardp->ep_out_buf;
         u8 *firmware = (u8 *) cardp->fw->data;
 
+        lbtf_deb_enter(LBTF_DEB_FW);
+
         /* If we got a CRC failure on the last block, back
            up and retry it */
         if (!cardp->CRC_OK) {
@@ -233,6 +291,9 @@ static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
                 cardp->fwseqnum--;
         }
 
+        lbtf_deb_usb2(&cardp->udev->dev, "totalbytes = %d\n",
+                     cardp->totalbytes);
+
         /* struct fwdata (which we sent to the card) has an
            extra __le32 field in between the header and the data,
            which is not in the struct fwheader in the actual
@@ -246,18 +307,33 @@ static int if_usb_send_fw_pkt(struct if_usb_card *cardp)
         memcpy(fwdata->data, &firmware[cardp->totalbytes],
                le32_to_cpu(fwdata->hdr.datalength));
 
+        lbtf_deb_usb2(&cardp->udev->dev, "Data length = %d\n",
+                     le32_to_cpu(fwdata->hdr.datalength));
+
         fwdata->seqnum = cpu_to_le32(++cardp->fwseqnum);
         cardp->totalbytes += le32_to_cpu(fwdata->hdr.datalength);
 
         usb_tx_block(cardp, cardp->ep_out_buf, sizeof(struct fwdata) +
                      le32_to_cpu(fwdata->hdr.datalength), 0);
 
-        if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK))
+        if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_DATA_TO_RECV)) {
+                lbtf_deb_usb2(&cardp->udev->dev, "There are data to follow\n");
+                lbtf_deb_usb2(&cardp->udev->dev, "seqnum = %d totalbytes = %d\n",
+                             cardp->fwseqnum, cardp->totalbytes);
+        } else if (fwdata->hdr.dnldcmd == cpu_to_le32(FW_HAS_LAST_BLOCK)) {
+                lbtf_deb_usb2(&cardp->udev->dev, "Host has finished FW downloading\n");
+                lbtf_deb_usb2(&cardp->udev->dev, "Donwloading FW JUMP BLOCK\n");
+
                 /* Host has finished FW downloading
                  * Donwloading FW JUMP BLOCK
                  */
                 cardp->fwfinalblk = 1;
+        }
 
+        lbtf_deb_usb2(&cardp->udev->dev, "Firmware download done; size %d\n",
+                     cardp->totalbytes);
+
+        lbtf_deb_leave(LBTF_DEB_FW);
         return 0;
 }
 
@@ -266,6 +342,8 @@ static int if_usb_reset_device(struct if_usb_card *cardp)
         struct cmd_ds_802_11_reset *cmd = cardp->ep_out_buf + 4;
         int ret;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
+
         *(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
 
         cmd->hdr.command = cpu_to_le16(CMD_802_11_RESET);
@@ -280,6 +358,8 @@ static int if_usb_reset_device(struct if_usb_card *cardp)
         ret = usb_reset_device(cardp->udev);
         msleep(100);
 
+        lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
+
         return ret;
 }
 EXPORT_SYMBOL_GPL(if_usb_reset_device);
@@ -297,11 +377,15 @@ EXPORT_SYMBOL_GPL(if_usb_reset_device);
 static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
                         uint16_t nb, u8 data)
 {
+        int ret = -1;
         struct urb *urb;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
         /* check if device is removed */
-        if (cardp->priv->surpriseremoved)
-                return -1;
+        if (cardp->priv->surpriseremoved) {
+                lbtf_deb_usbd(&cardp->udev->dev, "Device removed\n");
+                goto tx_ret;
+        }
 
         if (data)
                 urb = cardp->tx_urb;
@@ -315,19 +399,34 @@ static int usb_tx_block(struct if_usb_card *cardp, uint8_t *payload,
 
         urb->transfer_flags |= URB_ZERO_PACKET;
 
-        if (usb_submit_urb(urb, GFP_ATOMIC))
-                return -1;
-        return 0;
+        if (usb_submit_urb(urb, GFP_ATOMIC)) {
+                lbtf_deb_usbd(&cardp->udev->dev, "usb_submit_urb failed: %d\n", ret);
+                goto tx_ret;
+        }
+
+        lbtf_deb_usb2(&cardp->udev->dev, "usb_submit_urb success\n");
+
+        ret = 0;
+
+tx_ret:
+        lbtf_deb_leave(LBTF_DEB_USB);
+        return ret;
 }
 
 static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
                                   void (*callbackfn)(struct urb *urb))
 {
         struct sk_buff *skb;
+        int ret = -1;
+
+        lbtf_deb_enter(LBTF_DEB_USB);
 
         skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE);
-        if (!skb)
+        if (!skb) {
+                pr_err("No free skb\n");
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return -1;
+        }
 
         cardp->rx_skb = skb;
 
@@ -339,12 +438,19 @@ static int __if_usb_submit_rx_urb(struct if_usb_card *cardp,
 
         cardp->rx_urb->transfer_flags |= URB_ZERO_PACKET;
 
-        if (usb_submit_urb(cardp->rx_urb, GFP_ATOMIC)) {
+        lbtf_deb_usb2(&cardp->udev->dev, "Pointer for rx_urb %p\n", cardp->rx_urb);
+        ret = usb_submit_urb(cardp->rx_urb, GFP_ATOMIC);
+        if (ret) {
+                lbtf_deb_usbd(&cardp->udev->dev, "Submit Rx URB failed: %d\n", ret);
                 kfree_skb(skb);
                 cardp->rx_skb = NULL;
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return -1;
-        } else
+        } else {
+                lbtf_deb_usb2(&cardp->udev->dev, "Submit Rx URB success\n");
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return 0;
+        }
 }
 
 static int if_usb_submit_rx_urb_fwload(struct if_usb_card *cardp)
@@ -364,8 +470,12 @@ static void if_usb_receive_fwload(struct urb *urb)
         struct fwsyncheader *syncfwheader;
         struct bootcmdresp bcmdresp;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
         if (urb->status) {
+                lbtf_deb_usbd(&cardp->udev->dev,
+                             "URB status is failed during fw load\n");
                 kfree_skb(skb);
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
 
@@ -373,12 +483,17 @@ static void if_usb_receive_fwload(struct urb *urb)
                 __le32 *tmp = (__le32 *)(skb->data);
 
                 if (tmp[0] == cpu_to_le32(CMD_TYPE_INDICATION) &&
-                    tmp[1] == cpu_to_le32(MACREG_INT_CODE_FIRMWARE_READY))
+                    tmp[1] == cpu_to_le32(MACREG_INT_CODE_FIRMWARE_READY)) {
                         /* Firmware ready event received */
+                        pr_info("Firmware ready event received\n");
                         wake_up(&cardp->fw_wq);
-                else
+                } else {
+                        lbtf_deb_usb("Waiting for confirmation; got %x %x\n",
+                                    le32_to_cpu(tmp[0]), le32_to_cpu(tmp[1]));
                         if_usb_submit_rx_urb_fwload(cardp);
+                }
                 kfree_skb(skb);
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
         if (cardp->bootcmdresp <= 0) {
@@ -389,34 +504,60 @@ static void if_usb_receive_fwload(struct urb *urb)
                         if_usb_submit_rx_urb_fwload(cardp);
                         cardp->bootcmdresp = 1;
                         /* Received valid boot command response */
+                        lbtf_deb_usbd(&cardp->udev->dev,
+                                     "Received valid boot command response\n");
+                        lbtf_deb_leave(LBTF_DEB_USB);
                         return;
                 }
                 if (bcmdresp.magic != cpu_to_le32(BOOT_CMD_MAGIC_NUMBER)) {
                         if (bcmdresp.magic == cpu_to_le32(CMD_TYPE_REQUEST) ||
                             bcmdresp.magic == cpu_to_le32(CMD_TYPE_DATA) ||
-                            bcmdresp.magic == cpu_to_le32(CMD_TYPE_INDICATION))
+                            bcmdresp.magic == cpu_to_le32(CMD_TYPE_INDICATION)) {
+                                if (!cardp->bootcmdresp)
+                                        pr_info("Firmware already seems alive; resetting\n");
                                 cardp->bootcmdresp = -1;
-                } else if (bcmdresp.cmd == BOOT_CMD_FW_BY_USB &&
-                           bcmdresp.result == BOOT_CMD_RESP_OK)
+                        } else {
+                                pr_info("boot cmd response wrong magic number (0x%x)\n",
+                                            le32_to_cpu(bcmdresp.magic));
+                        }
+                } else if (bcmdresp.cmd != BOOT_CMD_FW_BY_USB) {
+                        pr_info("boot cmd response cmd_tag error (%d)\n",
+                                    bcmdresp.cmd);
+                } else if (bcmdresp.result != BOOT_CMD_RESP_OK) {
+                        pr_info("boot cmd response result error (%d)\n",
+                                    bcmdresp.result);
+                } else {
                         cardp->bootcmdresp = 1;
+                        lbtf_deb_usbd(&cardp->udev->dev,
+                                     "Received valid boot command response\n");
+                }
 
                 kfree_skb(skb);
                 if_usb_submit_rx_urb_fwload(cardp);
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
 
         syncfwheader = kmalloc(sizeof(struct fwsyncheader), GFP_ATOMIC);
         if (!syncfwheader) {
+                lbtf_deb_usbd(&cardp->udev->dev, "Failure to allocate syncfwheader\n");
                 kfree_skb(skb);
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
 
         memcpy(syncfwheader, skb->data, sizeof(struct fwsyncheader));
 
-        if (!syncfwheader->cmd)
+        if (!syncfwheader->cmd) {
+                lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk with correct CRC\n");
+                lbtf_deb_usb2(&cardp->udev->dev, "FW received Blk seqnum = %d\n",
+                             le32_to_cpu(syncfwheader->seqnum));
                 cardp->CRC_OK = 1;
-        else
+        } else {
+                lbtf_deb_usbd(&cardp->udev->dev, "FW received Blk with CRC error\n");
                 cardp->CRC_OK = 0;
+        }
+
         kfree_skb(skb);
 
         /* reschedule timer for 200ms hence */
@@ -434,6 +575,7 @@ static void if_usb_receive_fwload(struct urb *urb)
 
         kfree(syncfwheader);
 
+        lbtf_deb_leave(LBTF_DEB_USB);
         return;
 }
 
@@ -445,6 +587,7 @@ static inline void process_cmdtypedata(int recvlength, struct sk_buff *skb,
 {
         if (recvlength > MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + MESSAGE_HEADER_LEN
             || recvlength < MRVDRV_MIN_PKT_LEN) {
+                lbtf_deb_usbd(&cardp->udev->dev, "Packet length is Invalid\n");
                 kfree_skb(skb);
                 return;
         }
@@ -460,6 +603,8 @@ static inline void process_cmdrequest(int recvlength, uint8_t *recvbuff,
                                       struct lbtf_private *priv)
 {
         if (recvlength > LBS_CMD_BUFFER_SIZE) {
+                lbtf_deb_usbd(&cardp->udev->dev,
+                             "The receive buffer is too large\n");
                 kfree_skb(skb);
                 return;
         }
@@ -489,16 +634,24 @@ static void if_usb_receive(struct urb *urb)
         uint32_t recvtype = 0;
         __le32 *pkt = (__le32 *) skb->data;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
+
         if (recvlength) {
                 if (urb->status) {
+                        lbtf_deb_usbd(&cardp->udev->dev, "RX URB failed: %d\n",
+                                     urb->status);
                         kfree_skb(skb);
                         goto setup_for_next;
                 }
 
                 recvbuff = skb->data;
                 recvtype = le32_to_cpu(pkt[0]);
+                lbtf_deb_usbd(&cardp->udev->dev,
+                            "Recv length = 0x%x, Recv type = 0x%X\n",
+                            recvlength, recvtype);
         } else if (urb->status) {
                 kfree_skb(skb);
+                lbtf_deb_leave(LBTF_DEB_USB);
                 return;
         }
 
@@ -515,6 +668,7 @@ static void if_usb_receive(struct urb *urb)
         {
                 /* Event cause handling */
                 u32 event_cause = le32_to_cpu(pkt[1]);
+                lbtf_deb_usbd(&cardp->udev->dev, "**EVENT** 0x%X\n", event_cause);
 
                 /* Icky undocumented magic special case */
                 if (event_cause & 0xffff0000) {
@@ -529,21 +683,22 @@ static void if_usb_receive(struct urb *urb)
                 } else if (event_cause == LBTF_EVENT_BCN_SENT)
                         lbtf_bcn_sent(priv);
                 else
-                        printk(KERN_DEBUG
+                        lbtf_deb_usbd(&cardp->udev->dev,
                                "Unsupported notification %d received\n",
                                event_cause);
                 kfree_skb(skb);
                 break;
         }
         default:
-                printk(KERN_DEBUG "libertastf: unknown command type 0x%X\n",
-                             recvtype);
+                lbtf_deb_usbd(&cardp->udev->dev,
+                         "libertastf: unknown command type 0x%X\n", recvtype);
                 kfree_skb(skb);
                 break;
         }
 
 setup_for_next:
         if_usb_submit_rx_urb(cardp);
+        lbtf_deb_leave(LBTF_DEB_USB);
 }
 
 /**
@@ -562,6 +717,9 @@ static int if_usb_host_to_card(struct lbtf_private *priv, uint8_t type,
         struct if_usb_card *cardp = priv->card;
         u8 data = 0;
 
+        lbtf_deb_usbd(&cardp->udev->dev, "*** type = %u\n", type);
+        lbtf_deb_usbd(&cardp->udev->dev, "size after = %d\n", nb);
+
         if (type == MVMS_CMD) {
                 *(__le32 *)cardp->ep_out_buf = cpu_to_le32(CMD_TYPE_REQUEST);
         } else {
@@ -639,8 +797,10 @@ static int check_fwfile_format(const u8 *data, u32 totlen)
         } while (!exit);
 
         if (ret)
-                printk(KERN_INFO
-                       "libertastf: firmware file format check failed\n");
+                pr_err("firmware file format check FAIL\n");
+        else
+                lbtf_deb_fw("firmware file format check PASS\n");
+
         return ret;
 }
 
@@ -651,10 +811,12 @@ static int if_usb_prog_firmware(struct if_usb_card *cardp)
         static int reset_count = 10;
         int ret = 0;
 
+        lbtf_deb_enter(LBTF_DEB_USB);
+
         ret = request_firmware(&cardp->fw, lbtf_fw_name, &cardp->udev->dev);
         if (ret < 0) {
-                printk(KERN_INFO "libertastf: firmware %s not found\n",
-                       lbtf_fw_name);
+                pr_err("request_firmware() failed with %#x\n", ret);
+                pr_err("firmware %s not found\n", lbtf_fw_name);
                 goto done;
         }
 
@@ -663,6 +825,7 @@ static int if_usb_prog_firmware(struct if_usb_card *cardp)
 
 restart:
         if (if_usb_submit_rx_urb_fwload(cardp) < 0) {
+                lbtf_deb_usbd(&cardp->udev->dev, "URB submission is failed\n");
                 ret = -1;
                 goto release_fw;
         }
@@ -709,14 +872,13 @@ restart:
         usb_kill_urb(cardp->rx_urb);
 
         if (!cardp->fwdnldover) {
-                printk(KERN_INFO "libertastf: failed to load fw,"
-                                 " resetting device!\n");
+                pr_info("failed to load fw, resetting device!\n");
                 if (--reset_count >= 0) {
                         if_usb_reset_device(cardp);
                         goto restart;
                 }
 
-                printk(KERN_INFO "libertastf: fw download failure\n");
+                pr_info("FW download failure, time = %d ms\n", i * 100);
                 ret = -1;
                 goto release_fw;
         }
@@ -730,6 +892,7 @@ restart:
         if_usb_setup_firmware(cardp->priv);
 
  done:
+        lbtf_deb_leave_args(LBTF_DEB_USB, "ret %d", ret);
         return ret;
 }
 EXPORT_SYMBOL_GPL(if_usb_prog_firmware);
@@ -751,13 +914,19 @@ static int __init if_usb_init_module(void)
 {
         int ret = 0;
 
+        lbtf_deb_enter(LBTF_DEB_MAIN);
+
         ret = usb_register(&if_usb_driver);
+
+        lbtf_deb_leave_args(LBTF_DEB_MAIN, "ret %d", ret);
         return ret;
 }
 
 static void __exit if_usb_exit_module(void)
 {
+        lbtf_deb_enter(LBTF_DEB_MAIN);
         usb_deregister(&if_usb_driver);
+        lbtf_deb_leave(LBTF_DEB_MAIN);
 }
 
 module_init(if_usb_init_module);
diff --git a/drivers/net/wireless/libertas_tf/libertas_tf.h b/drivers/net/wireless/libertas_tf/libertas_tf.h
index 4cc42dd5a005..fbbaaae7a1ae 100644
--- a/drivers/net/wireless/libertas_tf/libertas_tf.h
+++ b/drivers/net/wireless/libertas_tf/libertas_tf.h
@@ -13,6 +13,8 @@
 #include <linux/kthread.h>
 #include <net/mac80211.h>
 
+#include "deb_defs.h"
+
 #ifndef DRV_NAME
 #define DRV_NAME "libertas_tf"
 #endif
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index 7533a23e0500..60787de56f3a 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -7,10 +7,12 @@
  *  the Free Software Foundation; either version 2 of the License, or (at
  *  your option) any later version.
  */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
 #include <linux/slab.h>
 
+#include <linux/etherdevice.h>
 #include "libertas_tf.h"
-#include "linux/etherdevice.h"
 
 #define DRIVER_RELEASE_VERSION "004.p0"
 /* thinfirm version: 5.132.X.pX */
@@ -18,7 +20,17 @@
 #define LBTF_FW_VER_MAX         0x0584ffff
 #define QOS_CONTROL_LEN         2
 
-static const char lbtf_driver_version[] = "THINFIRM-USB8388-" DRIVER_RELEASE_VERSION;
+/* Module parameters */
+unsigned int lbtf_debug;
+EXPORT_SYMBOL_GPL(lbtf_debug);
+module_param_named(libertas_tf_debug, lbtf_debug, int, 0644);
+
+static const char lbtf_driver_version[] = "THINFIRM-USB8388-" DRIVER_RELEASE_VERSION
+#ifdef DEBUG
+        "-dbg"
+#endif
+        "";
+
 struct workqueue_struct *lbtf_wq;
 
 static const struct ieee80211_channel lbtf_channels[] = {
@@ -81,6 +93,9 @@ static void lbtf_cmd_work(struct work_struct *work)
 {
         struct lbtf_private *priv = container_of(work, struct lbtf_private,
                                          cmd_work);
+
+        lbtf_deb_enter(LBTF_DEB_CMD);
+
         spin_lock_irq(&priv->driver_lock);
         /* command response? */
         if (priv->cmd_response_rxed) {
@@ -108,11 +123,16 @@ static void lbtf_cmd_work(struct work_struct *work)
         priv->cmd_timed_out = 0;
         spin_unlock_irq(&priv->driver_lock);
 
-        if (!priv->fw_ready)
+        if (!priv->fw_ready) {
+                lbtf_deb_leave_args(LBTF_DEB_CMD, "fw not ready");
                 return;
+        }
+
         /* Execute the next command */
         if (!priv->cur_cmd)
                 lbtf_execute_next_command(priv);
+
+        lbtf_deb_leave(LBTF_DEB_CMD);
 }
 
 /**
@@ -126,6 +146,7 @@ static int lbtf_setup_firmware(struct lbtf_private *priv)
 {
         int ret = -1;
 
+        lbtf_deb_enter(LBTF_DEB_FW);
         /*
          * Read priv address from HW
          */
@@ -141,6 +162,7 @@ static int lbtf_setup_firmware(struct lbtf_private *priv)
 
         ret = 0;
 done:
+        lbtf_deb_leave_args(LBTF_DEB_FW, "ret: %d", ret);
         return ret;
 }
 
@@ -152,6 +174,7 @@ static void command_timer_fn(unsigned long data)
 {
         struct lbtf_private *priv = (struct lbtf_private *)data;
         unsigned long flags;
+        lbtf_deb_enter(LBTF_DEB_CMD);
 
         spin_lock_irqsave(&priv->driver_lock, flags);
 
@@ -168,10 +191,12 @@ static void command_timer_fn(unsigned long data)
         queue_work(lbtf_wq, &priv->cmd_work);
 out:
         spin_unlock_irqrestore(&priv->driver_lock, flags);
+        lbtf_deb_leave(LBTF_DEB_CMD);
 }
 
 static int lbtf_init_adapter(struct lbtf_private *priv)
 {
+        lbtf_deb_enter(LBTF_DEB_MAIN);
         memset(priv->current_addr, 0xff, ETH_ALEN);
         mutex_init(&priv->lock);
 
@@ -188,13 +213,16 @@ static int lbtf_init_adapter(struct lbtf_private *priv)
         if (lbtf_allocate_cmd_buffer(priv))
                 return -1;
 
+        lbtf_deb_leave(LBTF_DEB_MAIN);
         return 0;
 }
 
 static void lbtf_free_adapter(struct lbtf_private *priv)
 {
+        lbtf_deb_enter(LBTF_DEB_MAIN);
         lbtf_free_cmd_buffer(priv);
         del_timer(&priv->command_timer);
+        lbtf_deb_leave(LBTF_DEB_MAIN);
 }
 
 static int lbtf_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
@@ -221,14 +249,18 @@ static void lbtf_tx_work(struct work_struct *work)
         struct sk_buff *skb = NULL;
         int err;
 
+        lbtf_deb_enter(LBTF_DEB_MACOPS | LBTF_DEB_TX);
+
         if ((priv->vif->type == NL80211_IFTYPE_AP) &&
             (!skb_queue_empty(&priv->bc_ps_buf)))
                 skb = skb_dequeue(&priv->bc_ps_buf);
         else if (priv->skb_to_tx) {
                 skb = priv->skb_to_tx;
                 priv->skb_to_tx = NULL;
-        } else
+        } else {
+                lbtf_deb_leave(LBTF_DEB_MACOPS | LBTF_DEB_TX);
                 return;
+        }
 
         len = skb->len;
         info  = IEEE80211_SKB_CB(skb);
@@ -236,6 +268,7 @@ static void lbtf_tx_work(struct work_struct *work)
 
         if (priv->surpriseremoved) {
                 dev_kfree_skb_any(skb);
+                lbtf_deb_leave(LBTF_DEB_MACOPS | LBTF_DEB_TX);
                 return;
         }
 
@@ -249,6 +282,7 @@ static void lbtf_tx_work(struct work_struct *work)
                 ETH_ALEN);
         txpd->tx_packet_length = cpu_to_le16(len);
         txpd->tx_packet_location = cpu_to_le32(sizeof(struct txpd));
+        lbtf_deb_hex(LBTF_DEB_TX, "TX Data", skb->data, min_t(unsigned int, skb->len, 100));
         BUG_ON(priv->tx_skb);
         spin_lock_irq(&priv->driver_lock);
         priv->tx_skb = skb;
@@ -257,7 +291,9 @@ static void lbtf_tx_work(struct work_struct *work)
         if (err) {
                 dev_kfree_skb_any(skb);
                 priv->tx_skb = NULL;
+                pr_err("TX error: %d", err);
         }
+        lbtf_deb_leave(LBTF_DEB_MACOPS | LBTF_DEB_TX);
 }
 
 static int lbtf_op_start(struct ieee80211_hw *hw)
@@ -266,6 +302,8 @@ static int lbtf_op_start(struct ieee80211_hw *hw)
         void *card = priv->card;
         int ret = -1;
 
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
+
         if (!priv->fw_ready)
                 /* Upload firmware */
                 if (priv->hw_prog_firmware(card))
@@ -286,10 +324,12 @@ static int lbtf_op_start(struct ieee80211_hw *hw)
         }
 
         printk(KERN_INFO "libertastf: Marvell WLAN 802.11 thinfirm adapter\n");
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
         return 0;
 
 err_prog_firmware:
         priv->hw_reset_device(card);
+        lbtf_deb_leave_args(LBTF_DEB_MACOPS, "error programing fw; ret=%d", ret);
         return ret;
 }
 
@@ -300,6 +340,9 @@ static void lbtf_op_stop(struct ieee80211_hw *hw)
         struct sk_buff *skb;
 
         struct cmd_ctrl_node *cmdnode;
+
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
+
         /* Flush pending command nodes */
         spin_lock_irqsave(&priv->driver_lock, flags);
         list_for_each_entry(cmdnode, &priv->cmdpendingq, list) {
@@ -316,6 +359,7 @@ static void lbtf_op_stop(struct ieee80211_hw *hw)
         priv->radioon = RADIO_OFF;
         lbtf_set_radio_control(priv);
 
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
         return;
 }
 
@@ -323,6 +367,7 @@ static int lbtf_op_add_interface(struct ieee80211_hw *hw,
                         struct ieee80211_vif *vif)
 {
         struct lbtf_private *priv = hw->priv;
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
         if (priv->vif != NULL)
                 return -EOPNOTSUPP;
 
@@ -340,6 +385,7 @@ static int lbtf_op_add_interface(struct ieee80211_hw *hw,
                 return -EOPNOTSUPP;
         }
         lbtf_set_mac_address(priv, (u8 *) vif->addr);
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
         return 0;
 }
 
@@ -347,6 +393,7 @@ static void lbtf_op_remove_interface(struct ieee80211_hw *hw,
                         struct ieee80211_vif *vif)
 {
         struct lbtf_private *priv = hw->priv;
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
 
         if (priv->vif->type == NL80211_IFTYPE_AP ||
             priv->vif->type == NL80211_IFTYPE_MESH_POINT)
@@ -354,17 +401,20 @@ static void lbtf_op_remove_interface(struct ieee80211_hw *hw,
         lbtf_set_mode(priv, LBTF_PASSIVE_MODE);
         lbtf_set_bssid(priv, 0, NULL);
         priv->vif = NULL;
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
 }
 
 static int lbtf_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct lbtf_private *priv = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
 
         if (conf->channel->center_freq != priv->cur_freq) {
                 priv->cur_freq = conf->channel->center_freq;
                 lbtf_set_channel(priv, conf->channel->hw_value);
         }
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
         return 0;
 }
 
@@ -395,11 +445,16 @@ static void lbtf_op_configure_filter(struct ieee80211_hw *hw,
 {
         struct lbtf_private *priv = hw->priv;
         int old_mac_control = priv->mac_control;
+
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
+
         changed_flags &= SUPPORTED_FIF_FLAGS;
         *new_flags &= SUPPORTED_FIF_FLAGS;
 
-        if (!changed_flags)
+        if (!changed_flags) {
+                lbtf_deb_leave(LBTF_DEB_MACOPS);
                 return;
+        }
 
         if (*new_flags & (FIF_PROMISC_IN_BSS))
                 priv->mac_control |= CMD_ACT_MAC_PROMISCUOUS_ENABLE;
@@ -425,6 +480,8 @@ static void lbtf_op_configure_filter(struct ieee80211_hw *hw,
 
         if (priv->mac_control != old_mac_control)
                 lbtf_set_mac_control(priv);
+
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
 }
 
 static void lbtf_op_bss_info_changed(struct ieee80211_hw *hw,
@@ -434,6 +491,7 @@ static void lbtf_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct lbtf_private *priv = hw->priv;
         struct sk_buff *beacon;
+        lbtf_deb_enter(LBTF_DEB_MACOPS);
 
         if (changes & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_INT)) {
                 switch (priv->vif->type) {
@@ -464,6 +522,8 @@ static void lbtf_op_bss_info_changed(struct ieee80211_hw *hw,
                         priv->preamble = CMD_TYPE_LONG_PREAMBLE;
                 lbtf_set_radio_control(priv);
         }
+
+        lbtf_deb_leave(LBTF_DEB_MACOPS);
 }
 
 static const struct ieee80211_ops lbtf_ops = {
@@ -486,6 +546,8 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
         unsigned int flags;
         struct ieee80211_hdr *hdr;
 
+        lbtf_deb_enter(LBTF_DEB_RX);
+
         prxpd = (struct rxpd *) skb->data;
 
         stats.flag = 0;
@@ -494,7 +556,6 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
         stats.freq = priv->cur_freq;
         stats.band = IEEE80211_BAND_2GHZ;
         stats.signal = prxpd->snr;
-        stats.noise = prxpd->nf;
         /* Marvell rate index has a hole at value 4 */
         if (prxpd->rx_rate > 4)
                 --prxpd->rx_rate;
@@ -516,7 +577,15 @@ int lbtf_rx(struct lbtf_private *priv, struct sk_buff *skb)
         }
 
         memcpy(IEEE80211_SKB_RXCB(skb), &stats, sizeof(stats));
+
+        lbtf_deb_rx("rx data: skb->len-sizeof(RxPd) = %d-%zd = %zd\n",
+               skb->len, sizeof(struct rxpd), skb->len - sizeof(struct rxpd));
+        lbtf_deb_hex(LBTF_DEB_RX, "RX Data", skb->data,
+                     min_t(unsigned int, skb->len, 100));
+
         ieee80211_rx_irqsafe(priv->hw, skb);
+
+        lbtf_deb_leave(LBTF_DEB_RX);
         return 0;
 }
 EXPORT_SYMBOL_GPL(lbtf_rx);
@@ -533,6 +602,8 @@ struct lbtf_private *lbtf_add_card(void *card, struct device *dmdev)
         struct ieee80211_hw *hw;
         struct lbtf_private *priv = NULL;
 
+        lbtf_deb_enter(LBTF_DEB_MAIN);
+
         hw = ieee80211_alloc_hw(sizeof(struct lbtf_private), &lbtf_ops);
         if (!hw)
                 goto done;
@@ -575,6 +646,7 @@ err_init_adapter:
         priv = NULL;
 
 done:
+        lbtf_deb_leave_args(LBTF_DEB_MAIN, "priv %p", priv);
         return priv;
 }
 EXPORT_SYMBOL_GPL(lbtf_add_card);
@@ -584,6 +656,8 @@ int lbtf_remove_card(struct lbtf_private *priv)
 {
         struct ieee80211_hw *hw = priv->hw;
 
+        lbtf_deb_enter(LBTF_DEB_MAIN);
+
         priv->surpriseremoved = 1;
         del_timer(&priv->command_timer);
         lbtf_free_adapter(priv);
@@ -591,6 +665,7 @@ int lbtf_remove_card(struct lbtf_private *priv)
         ieee80211_unregister_hw(hw);
         ieee80211_free_hw(hw);
 
+    lbtf_deb_leave(LBTF_DEB_MAIN);
         return 0;
 }
 EXPORT_SYMBOL_GPL(lbtf_remove_card);
@@ -649,17 +724,21 @@ EXPORT_SYMBOL_GPL(lbtf_bcn_sent);
 
 static int __init lbtf_init_module(void)
 {
+        lbtf_deb_enter(LBTF_DEB_MAIN);
         lbtf_wq = create_workqueue("libertastf");
         if (lbtf_wq == NULL) {
                 printk(KERN_ERR "libertastf: couldn't create workqueue\n");
                 return -ENOMEM;
         }
+        lbtf_deb_leave(LBTF_DEB_MAIN);
         return 0;
 }
 
 static void __exit lbtf_exit_module(void)
 {
+        lbtf_deb_enter(LBTF_DEB_MAIN);
         destroy_workqueue(lbtf_wq);
+        lbtf_deb_leave(LBTF_DEB_MAIN);
 }
 
 module_init(lbtf_init_module);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index dfff02f5c86d..9fd2beadb6f5 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -830,6 +830,33 @@ static int mac80211_hwsim_conf_tx(
         return 0;
 }
 
+static int mac80211_hwsim_get_survey(
+        struct ieee80211_hw *hw, int idx,
+        struct survey_info *survey)
+{
+        struct ieee80211_conf *conf = &hw->conf;
+
+        printk(KERN_DEBUG "%s:%s (idx=%d)\n",
+               wiphy_name(hw->wiphy), __func__, idx);
+
+        if (idx != 0)
+                return -ENOENT;
+
+        /* Current channel */
+        survey->channel = conf->channel;
+
+        /*
+         * Magically conjured noise level --- this is only ok for simulated hardware.
+         *
+         * A real driver which cannot determine the real channel noise MUST NOT
+         * report any noise, especially not a magically conjured one :-)
+         */
+        survey->filled = SURVEY_INFO_NOISE_DBM;
+        survey->noise = -92;
+
+        return 0;
+}
+
 #ifdef CONFIG_NL80211_TESTMODE
 /*
  * This section contains example code for using netlink
@@ -947,6 +974,7 @@ static void hw_scan_done(struct work_struct *work)
 }
 
 static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
                                   struct cfg80211_scan_request *req)
 {
         struct hw_scan_done *hsd = kzalloc(sizeof(*hsd), GFP_KERNEL);
@@ -993,7 +1021,7 @@ static void mac80211_hwsim_sw_scan_complete(struct ieee80211_hw *hw)
         mutex_lock(&hwsim->mutex);
 
         printk(KERN_DEBUG "hwsim sw_scan_complete\n");
-        hwsim->scanning = true;
+        hwsim->scanning = false;
 
         mutex_unlock(&hwsim->mutex);
 }
@@ -1013,6 +1041,7 @@ static struct ieee80211_ops mac80211_hwsim_ops =
         .sta_notify = mac80211_hwsim_sta_notify,
         .set_tim = mac80211_hwsim_set_tim,
         .conf_tx = mac80211_hwsim_conf_tx,
+        .get_survey = mac80211_hwsim_get_survey,
         CFG80211_TESTMODE_CMD(mac80211_hwsim_testmode_cmd)
         .ampdu_action = mac80211_hwsim_ampdu_action,
         .sw_scan_start = mac80211_hwsim_sw_scan,
@@ -1271,7 +1300,8 @@ static int __init init_mac80211_hwsim(void)
                 hw->flags = IEEE80211_HW_MFP_CAPABLE |
                             IEEE80211_HW_SIGNAL_DBM |
                             IEEE80211_HW_SUPPORTS_STATIC_SMPS |
-                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS;
+                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                            IEEE80211_HW_AMPDU_AGGREGATION;
 
                 /* ask mac80211 to reserve space for magic */
                 hw->vif_data_size = sizeof(struct hwsim_vif_priv);
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 73bbd080c6e7..808adb909095 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -750,7 +750,6 @@ mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
         memset(status, 0, sizeof(*status));
 
         status->signal = -rxd->rssi;
-        status->noise = -rxd->noise_floor;
 
         if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
                 status->flag |= RX_FLAG_HT;
@@ -852,7 +851,6 @@ mwl8k_rxd_sta_process(void *_rxd, struct ieee80211_rx_status *status,
         memset(status, 0, sizeof(*status));
 
         status->signal = -rxd->rssi;
-        status->noise = -rxd->noise_level;
         status->antenna = MWL8K_STA_RATE_INFO_ANTSELECT(rate_info);
         status->rate_idx = MWL8K_STA_RATE_INFO_RATEID(rate_info);
 
@@ -3984,8 +3982,8 @@ static int __devinit mwl8k_probe(struct pci_dev *pdev,
 
         hw->queues = MWL8K_TX_QUEUES;
 
-        /* Set rssi and noise values to dBm */
-        hw->flags |= IEEE80211_HW_SIGNAL_DBM | IEEE80211_HW_NOISE_DBM;
+        /* Set rssi values to dBm */
+        hw->flags |= IEEE80211_HW_SIGNAL_DBM;
         hw->vif_data_size = sizeof(struct mwl8k_vif);
         hw->sta_data_size = sizeof(struct mwl8k_sta);
 
diff --git a/drivers/net/wireless/orinoco/Kconfig b/drivers/net/wireless/orinoco/Kconfig
index 6116b546861d..60819bcf4377 100644
--- a/drivers/net/wireless/orinoco/Kconfig
+++ b/drivers/net/wireless/orinoco/Kconfig
@@ -132,3 +132,10 @@ config PCMCIA_SPECTRUM
           This driver requires firmware download on startup.  Utilities
           for downloading Symbol firmware are available at
           <http://sourceforge.net/projects/orinoco/>
+
+config ORINOCO_USB
+        tristate "Agere Orinoco USB support"
+        depends on USB && HERMES
+        select FW_LOADER
+        ---help---
+          This driver is for USB versions of the Agere Orinoco card.
diff --git a/drivers/net/wireless/orinoco/Makefile b/drivers/net/wireless/orinoco/Makefile
index 9abd6329bcbd..bfdefb85abcd 100644
--- a/drivers/net/wireless/orinoco/Makefile
+++ b/drivers/net/wireless/orinoco/Makefile
@@ -11,3 +11,7 @@ obj-$(CONFIG_PCI_HERMES)	+= orinoco_pci.o
 obj-$(CONFIG_TMD_HERMES)        += orinoco_tmd.o
 obj-$(CONFIG_NORTEL_HERMES)     += orinoco_nortel.o
 obj-$(CONFIG_PCMCIA_SPECTRUM)   += spectrum_cs.o
+obj-$(CONFIG_ORINOCO_USB)       += orinoco_usb.o
+
+# Orinoco should be endian clean.
+ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/orinoco/airport.c b/drivers/net/wireless/orinoco/airport.c
index c60df2c1aca3..9bcee10c9308 100644
--- a/drivers/net/wireless/orinoco/airport.c
+++ b/drivers/net/wireless/orinoco/airport.c
@@ -77,9 +77,9 @@ airport_resume(struct macio_dev *mdev)
 
         enable_irq(card->irq);
 
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, &flags);
         err = orinoco_up(priv);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
 
         return err;
 }
@@ -195,7 +195,7 @@ airport_attach(struct macio_dev *mdev, const struct of_device_id *match)
         ssleep(1);
 
         /* Reset it before we get the interrupt */
-        hermes_init(hw);
+        hw->ops->init(hw);
 
         if (request_irq(card->irq, orinoco_interrupt, 0, DRIVER_NAME, priv)) {
                 printk(KERN_ERR PFX "Couldn't get IRQ %d\n", card->irq);
@@ -210,7 +210,7 @@ airport_attach(struct macio_dev *mdev, const struct of_device_id *match)
         }
 
         /* Register an interface with the stack */
-        if (orinoco_if_add(priv, phys_addr, card->irq) != 0) {
+        if (orinoco_if_add(priv, phys_addr, card->irq, NULL) != 0) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto failed;
         }
diff --git a/drivers/net/wireless/orinoco/cfg.c b/drivers/net/wireless/orinoco/cfg.c
index 27f2d3342645..81d228de9e5d 100644
--- a/drivers/net/wireless/orinoco/cfg.c
+++ b/drivers/net/wireless/orinoco/cfg.c
@@ -88,7 +88,9 @@ int orinoco_wiphy_register(struct wiphy *wiphy)
 
         wiphy->rts_threshold = priv->rts_thresh;
         if (!priv->has_mwo)
-                wiphy->frag_threshold = priv->frag_thresh;
+                wiphy->frag_threshold = priv->frag_thresh + 1;
+        wiphy->retry_short = priv->short_retry_limit;
+        wiphy->retry_long = priv->long_retry_limit;
 
         return wiphy_register(wiphy);
 }
@@ -187,7 +189,7 @@ static int orinoco_set_channel(struct wiphy *wiphy,
         if (priv->iw_mode == NL80211_IFTYPE_MONITOR) {
                 /* Fast channel change - no commit if successful */
                 hermes_t *hw = &priv->hw;
-                err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
+                err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST |
                                             HERMES_TEST_SET_CHANNEL,
                                         channel, NULL);
         }
@@ -196,8 +198,92 @@ static int orinoco_set_channel(struct wiphy *wiphy,
         return err;
 }
 
+static int orinoco_set_wiphy_params(struct wiphy *wiphy, u32 changed)
+{
+        struct orinoco_private *priv = wiphy_priv(wiphy);
+        int frag_value = -1;
+        int rts_value = -1;
+        int err = 0;
+
+        if (changed & WIPHY_PARAM_RETRY_SHORT) {
+                /* Setting short retry not supported */
+                err = -EINVAL;
+        }
+
+        if (changed & WIPHY_PARAM_RETRY_LONG) {
+                /* Setting long retry not supported */
+                err = -EINVAL;
+        }
+
+        if (changed & WIPHY_PARAM_FRAG_THRESHOLD) {
+                /* Set fragmentation */
+                if (priv->has_mwo) {
+                        if (wiphy->frag_threshold < 0)
+                                frag_value = 0;
+                        else {
+                                printk(KERN_WARNING "%s: Fixed fragmentation "
+                                       "is not supported on this firmware. "
+                                       "Using MWO robust instead.\n",
+                                       priv->ndev->name);
+                                frag_value = 1;
+                        }
+                } else {
+                        if (wiphy->frag_threshold < 0)
+                                frag_value = 2346;
+                        else if ((wiphy->frag_threshold < 257) ||
+                                 (wiphy->frag_threshold > 2347))
+                                err = -EINVAL;
+                        else
+                                /* cfg80211 value is 257-2347 (odd only)
+                                 * orinoco rid has range 256-2346 (even only) */
+                                frag_value = wiphy->frag_threshold & ~0x1;
+                }
+        }
+
+        if (changed & WIPHY_PARAM_RTS_THRESHOLD) {
+                /* Set RTS.
+                 *
+                 * Prism documentation suggests default of 2432,
+                 * and a range of 0-3000.
+                 *
+                 * Current implementation uses 2347 as the default and
+                 * the upper limit.
+                 */
+
+                if (wiphy->rts_threshold < 0)
+                        rts_value = 2347;
+                else if (wiphy->rts_threshold > 2347)
+                        err = -EINVAL;
+                else
+                        rts_value = wiphy->rts_threshold;
+        }
+
+        if (!err) {
+                unsigned long flags;
+
+                if (orinoco_lock(priv, &flags) != 0)
+                        return -EBUSY;
+
+                if (frag_value >= 0) {
+                        if (priv->has_mwo)
+                                priv->mwo_robust = frag_value;
+                        else
+                                priv->frag_thresh = frag_value;
+                }
+                if (rts_value >= 0)
+                        priv->rts_thresh = rts_value;
+
+                err = orinoco_commit(priv);
+
+                orinoco_unlock(priv, &flags);
+        }
+
+        return err;
+}
+
 const struct cfg80211_ops orinoco_cfg_ops = {
         .change_virtual_intf = orinoco_change_vif,
         .set_channel = orinoco_set_channel,
         .scan = orinoco_scan,
+        .set_wiphy_params = orinoco_set_wiphy_params,
 };
diff --git a/drivers/net/wireless/orinoco/fw.c b/drivers/net/wireless/orinoco/fw.c
index 5ea0f7cf85b1..3e1947d097ca 100644
--- a/drivers/net/wireless/orinoco/fw.c
+++ b/drivers/net/wireless/orinoco/fw.c
@@ -122,7 +122,7 @@ orinoco_dl_firmware(struct orinoco_private *priv,
         dev_dbg(dev, "Attempting to download firmware %s\n", firmware);
 
         /* Read current plug data */
-        err = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 0);
+        err = hw->ops->read_pda(hw, pda, fw->pda_addr, fw->pda_size);
         dev_dbg(dev, "Read PDA returned %d\n", err);
         if (err)
                 goto free;
@@ -149,7 +149,7 @@ orinoco_dl_firmware(struct orinoco_private *priv,
         }
 
         /* Enable aux port to allow programming */
-        err = hermesi_program_init(hw, le32_to_cpu(hdr->entry_point));
+        err = hw->ops->program_init(hw, le32_to_cpu(hdr->entry_point));
         dev_dbg(dev, "Program init returned %d\n", err);
         if (err != 0)
                 goto abort;
@@ -177,7 +177,7 @@ orinoco_dl_firmware(struct orinoco_private *priv,
                 goto abort;
 
         /* Tell card we've finished */
-        err = hermesi_program_end(hw);
+        err = hw->ops->program_end(hw);
         dev_dbg(dev, "Program end returned %d\n", err);
         if (err != 0)
                 goto abort;
@@ -224,7 +224,7 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
                 if (!pda)
                         return -ENOMEM;
 
-                ret = hermes_read_pda(hw, pda, fw->pda_addr, fw->pda_size, 1);
+                ret = hw->ops->read_pda(hw, pda, fw->pda_addr, fw->pda_size);
                 if (ret)
                         goto free;
         }
@@ -260,7 +260,7 @@ symbol_dl_image(struct orinoco_private *priv, const struct fw_info *fw,
         }
 
         /* Reset hermes chip and make sure it responds */
-        ret = hermes_init(hw);
+        ret = hw->ops->init(hw);
 
         /* hermes_reset() should return 0 with the secondary firmware */
         if (secondary && ret != 0)
diff --git a/drivers/net/wireless/orinoco/hermes.c b/drivers/net/wireless/orinoco/hermes.c
index 1a2fca76fd3c..6c6a23e08df6 100644
--- a/drivers/net/wireless/orinoco/hermes.c
+++ b/drivers/net/wireless/orinoco/hermes.c
@@ -52,6 +52,26 @@
 #define ALLOC_COMPL_TIMEOUT (1000) /* in iterations of ~10us */
 
 /*
+ * AUX port access.  To unlock the AUX port write the access keys to the
+ * PARAM0-2 registers, then write HERMES_AUX_ENABLE to the HERMES_CONTROL
+ * register.  Then read it and make sure it's HERMES_AUX_ENABLED.
+ */
+#define HERMES_AUX_ENABLE       0x8000  /* Enable auxiliary port access */
+#define HERMES_AUX_DISABLE      0x4000  /* Disable to auxiliary port access */
+#define HERMES_AUX_ENABLED      0xC000  /* Auxiliary port is open */
+#define HERMES_AUX_DISABLED     0x0000  /* Auxiliary port is closed */
+
+#define HERMES_AUX_PW0  0xFE01
+#define HERMES_AUX_PW1  0xDC23
+#define HERMES_AUX_PW2  0xBA45
+
+/* HERMES_CMD_DOWNLD */
+#define HERMES_PROGRAM_DISABLE             (0x0000 | HERMES_CMD_DOWNLD)
+#define HERMES_PROGRAM_ENABLE_VOLATILE     (0x0100 | HERMES_CMD_DOWNLD)
+#define HERMES_PROGRAM_ENABLE_NON_VOLATILE (0x0200 | HERMES_CMD_DOWNLD)
+#define HERMES_PROGRAM_NON_VOLATILE        (0x0300 | HERMES_CMD_DOWNLD)
+
+/*
  * Debugging helpers
  */
 
@@ -70,6 +90,7 @@
 
 #endif /* ! HERMES_DEBUG */
 
+static const struct hermes_ops hermes_ops_local;
 
 /*
  * Internal functions
@@ -111,9 +132,9 @@ static int hermes_issue_cmd(hermes_t *hw, u16 cmd, u16 param0,
  */
 
 /* For doing cmds that wipe the magic constant in SWSUPPORT0 */
-int hermes_doicmd_wait(hermes_t *hw, u16 cmd,
-                       u16 parm0, u16 parm1, u16 parm2,
-                       struct hermes_response *resp)
+static int hermes_doicmd_wait(hermes_t *hw, u16 cmd,
+                              u16 parm0, u16 parm1, u16 parm2,
+                              struct hermes_response *resp)
 {
         int err = 0;
         int k;
@@ -163,17 +184,18 @@ int hermes_doicmd_wait(hermes_t *hw, u16 cmd,
 out:
         return err;
 }
-EXPORT_SYMBOL(hermes_doicmd_wait);
 
 void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing)
 {
         hw->iobase = address;
         hw->reg_spacing = reg_spacing;
         hw->inten = 0x0;
+        hw->eeprom_pda = false;
+        hw->ops = &hermes_ops_local;
 }
 EXPORT_SYMBOL(hermes_struct_init);
 
-int hermes_init(hermes_t *hw)
+static int hermes_init(hermes_t *hw)
 {
         u16 reg;
         int err = 0;
@@ -217,7 +239,6 @@ int hermes_init(hermes_t *hw)
 
         return err;
 }
-EXPORT_SYMBOL(hermes_init);
 
 /* Issue a command to the chip, and (busy!) wait for it to
  * complete.
@@ -228,8 +249,8 @@ EXPORT_SYMBOL(hermes_init);
  *     > 0 on error returned by the firmware
  *
  * Callable from any context, but locking is your problem. */
-int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
-                      struct hermes_response *resp)
+static int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
+                             struct hermes_response *resp)
 {
         int err;
         int k;
@@ -291,9 +312,8 @@ int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
  out:
         return err;
 }
-EXPORT_SYMBOL(hermes_docmd_wait);
 
-int hermes_allocate(hermes_t *hw, u16 size, u16 *fid)
+static int hermes_allocate(hermes_t *hw, u16 size, u16 *fid)
 {
         int err = 0;
         int k;
@@ -333,7 +353,6 @@ int hermes_allocate(hermes_t *hw, u16 size, u16 *fid)
 
         return 0;
 }
-EXPORT_SYMBOL(hermes_allocate);
 
 /* Set up a BAP to read a particular chunk of data from card's internal buffer.
  *
@@ -403,8 +422,8 @@ static int hermes_bap_seek(hermes_t *hw, int bap, u16 id, u16 offset)
  *       0 on success
  *     > 0 on error from firmware
  */
-int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
-                     u16 id, u16 offset)
+static int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
+                            u16 id, u16 offset)
 {
         int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
         int err = 0;
@@ -422,7 +441,6 @@ int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
  out:
         return err;
 }
-EXPORT_SYMBOL(hermes_bap_pread);
 
 /* Write a block of data to the chip's buffer, via the
  * BAP. Synchronization/serialization is the caller's problem.
@@ -432,8 +450,8 @@ EXPORT_SYMBOL(hermes_bap_pread);
  *       0 on success
  *     > 0 on error from firmware
  */
-int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
-                      u16 id, u16 offset)
+static int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
+                             u16 id, u16 offset)
 {
         int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
         int err = 0;
@@ -451,7 +469,6 @@ int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
  out:
         return err;
 }
-EXPORT_SYMBOL(hermes_bap_pwrite);
 
 /* Read a Length-Type-Value record from the card.
  *
@@ -461,8 +478,8 @@ EXPORT_SYMBOL(hermes_bap_pwrite);
  * practice.
  *
  * Callable from user or bh context.  */
-int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned bufsize,
-                    u16 *length, void *buf)
+static int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned bufsize,
+                           u16 *length, void *buf)
 {
         int err = 0;
         int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
@@ -505,10 +522,9 @@ int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned bufsize,
 
         return 0;
 }
-EXPORT_SYMBOL(hermes_read_ltv);
 
-int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
-                     u16 length, const void *value)
+static int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
+                            u16 length, const void *value)
 {
         int dreg = bap ? HERMES_DATA1 : HERMES_DATA0;
         int err = 0;
@@ -533,4 +549,228 @@ int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
 
         return err;
 }
-EXPORT_SYMBOL(hermes_write_ltv);
+
+/*** Hermes AUX control ***/
+
+static inline void
+hermes_aux_setaddr(hermes_t *hw, u32 addr)
+{
+        hermes_write_reg(hw, HERMES_AUXPAGE, (u16) (addr >> 7));
+        hermes_write_reg(hw, HERMES_AUXOFFSET, (u16) (addr & 0x7F));
+}
+
+static inline int
+hermes_aux_control(hermes_t *hw, int enabled)
+{
+        int desired_state = enabled ? HERMES_AUX_ENABLED : HERMES_AUX_DISABLED;
+        int action = enabled ? HERMES_AUX_ENABLE : HERMES_AUX_DISABLE;
+        int i;
+
+        /* Already open? */
+        if (hermes_read_reg(hw, HERMES_CONTROL) == desired_state)
+                return 0;
+
+        hermes_write_reg(hw, HERMES_PARAM0, HERMES_AUX_PW0);
+        hermes_write_reg(hw, HERMES_PARAM1, HERMES_AUX_PW1);
+        hermes_write_reg(hw, HERMES_PARAM2, HERMES_AUX_PW2);
+        hermes_write_reg(hw, HERMES_CONTROL, action);
+
+        for (i = 0; i < 20; i++) {
+                udelay(10);
+                if (hermes_read_reg(hw, HERMES_CONTROL) ==
+                    desired_state)
+                        return 0;
+        }
+
+        return -EBUSY;
+}
+
+/*** Hermes programming ***/
+
+/* About to start programming data (Hermes I)
+ * offset is the entry point
+ *
+ * Spectrum_cs' Symbol fw does not require this
+ * wl_lkm Agere fw does
+ * Don't know about intersil
+ */
+static int hermesi_program_init(hermes_t *hw, u32 offset)
+{
+        int err;
+
+        /* Disable interrupts?*/
+        /*hw->inten = 0x0;*/
+        /*hermes_write_regn(hw, INTEN, 0);*/
+        /*hermes_set_irqmask(hw, 0);*/
+
+        /* Acknowledge any outstanding command */
+        hermes_write_regn(hw, EVACK, 0xFFFF);
+
+        /* Using init_cmd_wait rather than cmd_wait */
+        err = hw->ops->init_cmd_wait(hw,
+                                     0x0100 | HERMES_CMD_INIT,
+                                     0, 0, 0, NULL);
+        if (err)
+                return err;
+
+        err = hw->ops->init_cmd_wait(hw,
+                                     0x0000 | HERMES_CMD_INIT,
+                                     0, 0, 0, NULL);
+        if (err)
+                return err;
+
+        err = hermes_aux_control(hw, 1);
+        pr_debug("AUX enable returned %d\n", err);
+
+        if (err)
+                return err;
+
+        pr_debug("Enabling volatile, EP 0x%08x\n", offset);
+        err = hw->ops->init_cmd_wait(hw,
+                                     HERMES_PROGRAM_ENABLE_VOLATILE,
+                                     offset & 0xFFFFu,
+                                     offset >> 16,
+                                     0,
+                                     NULL);
+        pr_debug("PROGRAM_ENABLE returned %d\n", err);
+
+        return err;
+}
+
+/* Done programming data (Hermes I)
+ *
+ * Spectrum_cs' Symbol fw does not require this
+ * wl_lkm Agere fw does
+ * Don't know about intersil
+ */
+static int hermesi_program_end(hermes_t *hw)
+{
+        struct hermes_response resp;
+        int rc = 0;
+        int err;
+
+        rc = hw->ops->cmd_wait(hw, HERMES_PROGRAM_DISABLE, 0, &resp);
+
+        pr_debug("PROGRAM_DISABLE returned %d, "
+                 "r0 0x%04x, r1 0x%04x, r2 0x%04x\n",
+                 rc, resp.resp0, resp.resp1, resp.resp2);
+
+        if ((rc == 0) &&
+            ((resp.status & HERMES_STATUS_CMDCODE) != HERMES_CMD_DOWNLD))
+                rc = -EIO;
+
+        err = hermes_aux_control(hw, 0);
+        pr_debug("AUX disable returned %d\n", err);
+
+        /* Acknowledge any outstanding command */
+        hermes_write_regn(hw, EVACK, 0xFFFF);
+
+        /* Reinitialise, ignoring return */
+        (void) hw->ops->init_cmd_wait(hw, 0x0000 | HERMES_CMD_INIT,
+                                      0, 0, 0, NULL);
+
+        return rc ? rc : err;
+}
+
+static int hermes_program_bytes(struct hermes *hw, const char *data,
+                                u32 addr, u32 len)
+{
+        /* wl lkm splits the programming into chunks of 2000 bytes.
+         * This restriction appears to come from USB. The PCMCIA
+         * adapters can program the whole lot in one go */
+        hermes_aux_setaddr(hw, addr);
+        hermes_write_bytes(hw, HERMES_AUXDATA, data, len);
+        return 0;
+}
+
+/* Read PDA from the adapter */
+static int hermes_read_pda(hermes_t *hw, __le16 *pda, u32 pda_addr, u16 pda_len)
+{
+        int ret;
+        u16 pda_size;
+        u16 data_len = pda_len;
+        __le16 *data = pda;
+
+        if (hw->eeprom_pda) {
+                /* PDA of spectrum symbol is in eeprom */
+
+                /* Issue command to read EEPROM */
+                ret = hw->ops->cmd_wait(hw, HERMES_CMD_READMIF, 0, NULL);
+                if (ret)
+                        return ret;
+        } else {
+                /* wl_lkm does not include PDA size in the PDA area.
+                 * We will pad the information into pda, so other routines
+                 * don't have to be modified */
+                pda[0] = cpu_to_le16(pda_len - 2);
+                        /* Includes CFG_PROD_DATA but not itself */
+                pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */
+                data_len = pda_len - 4;
+                data = pda + 2;
+        }
+
+        /* Open auxiliary port */
+        ret = hermes_aux_control(hw, 1);
+        pr_debug("AUX enable returned %d\n", ret);
+        if (ret)
+                return ret;
+
+        /* Read PDA */
+        hermes_aux_setaddr(hw, pda_addr);
+        hermes_read_words(hw, HERMES_AUXDATA, data, data_len / 2);
+
+        /* Close aux port */
+        ret = hermes_aux_control(hw, 0);
+        pr_debug("AUX disable returned %d\n", ret);
+
+        /* Check PDA length */
+        pda_size = le16_to_cpu(pda[0]);
+        pr_debug("Actual PDA length %d, Max allowed %d\n",
+                 pda_size, pda_len);
+        if (pda_size > pda_len)
+                return -EINVAL;
+
+        return 0;
+}
+
+static void hermes_lock_irqsave(spinlock_t *lock,
+                                unsigned long *flags) __acquires(lock)
+{
+        spin_lock_irqsave(lock, *flags);
+}
+
+static void hermes_unlock_irqrestore(spinlock_t *lock,
+                                     unsigned long *flags) __releases(lock)
+{
+        spin_unlock_irqrestore(lock, *flags);
+}
+
+static void hermes_lock_irq(spinlock_t *lock) __acquires(lock)
+{
+        spin_lock_irq(lock);
+}
+
+static void hermes_unlock_irq(spinlock_t *lock) __releases(lock)
+{
+        spin_unlock_irq(lock);
+}
+
+/* Hermes operations for local buses */
+static const struct hermes_ops hermes_ops_local = {
+        .init = hermes_init,
+        .cmd_wait = hermes_docmd_wait,
+        .init_cmd_wait = hermes_doicmd_wait,
+        .allocate = hermes_allocate,
+        .read_ltv = hermes_read_ltv,
+        .write_ltv = hermes_write_ltv,
+        .bap_pread = hermes_bap_pread,
+        .bap_pwrite = hermes_bap_pwrite,
+        .read_pda = hermes_read_pda,
+        .program_init = hermesi_program_init,
+        .program_end = hermesi_program_end,
+        .program = hermes_program_bytes,
+        .lock_irqsave = hermes_lock_irqsave,
+        .unlock_irqrestore = hermes_unlock_irqrestore,
+        .lock_irq = hermes_lock_irq,
+        .unlock_irq = hermes_unlock_irq,
+};
diff --git a/drivers/net/wireless/orinoco/hermes.h b/drivers/net/wireless/orinoco/hermes.h
index 2dddbb597c4d..9ca34e722b45 100644
--- a/drivers/net/wireless/orinoco/hermes.h
+++ b/drivers/net/wireless/orinoco/hermes.h
@@ -374,6 +374,37 @@ struct hermes_multicast {
 /* Timeouts */
 #define HERMES_BAP_BUSY_TIMEOUT (10000) /* In iterations of ~1us */
 
+struct hermes;
+
+/* Functions to access hardware */
+struct hermes_ops {
+        int (*init)(struct hermes *hw);
+        int (*cmd_wait)(struct hermes *hw, u16 cmd, u16 parm0,
+                        struct hermes_response *resp);
+        int (*init_cmd_wait)(struct hermes *hw, u16 cmd,
+                             u16 parm0, u16 parm1, u16 parm2,
+                             struct hermes_response *resp);
+        int (*allocate)(struct hermes *hw, u16 size, u16 *fid);
+        int (*read_ltv)(struct hermes *hw, int bap, u16 rid, unsigned buflen,
+                        u16 *length, void *buf);
+        int (*write_ltv)(struct hermes *hw, int bap, u16 rid,
+                         u16 length, const void *value);
+        int (*bap_pread)(struct hermes *hw, int bap, void *buf, int len,
+                         u16 id, u16 offset);
+        int (*bap_pwrite)(struct hermes *hw, int bap, const void *buf,
+                          int len, u16 id, u16 offset);
+        int (*read_pda)(struct hermes *hw, __le16 *pda,
+                        u32 pda_addr, u16 pda_len);
+        int (*program_init)(struct hermes *hw, u32 entry_point);
+        int (*program_end)(struct hermes *hw);
+        int (*program)(struct hermes *hw, const char *buf,
+                       u32 addr, u32 len);
+        void (*lock_irqsave)(spinlock_t *lock, unsigned long *flags);
+        void (*unlock_irqrestore)(spinlock_t *lock, unsigned long *flags);
+        void (*lock_irq)(spinlock_t *lock);
+        void (*unlock_irq)(spinlock_t *lock);
+};
+
 /* Basic control structure */
 typedef struct hermes {
         void __iomem *iobase;
@@ -381,6 +412,9 @@ typedef struct hermes {
 #define HERMES_16BIT_REGSPACING 0
 #define HERMES_32BIT_REGSPACING 1
         u16 inten; /* Which interrupts should be enabled? */
+        bool eeprom_pda;
+        const struct hermes_ops *ops;
+        void *priv;
 } hermes_t;
 
 /* Register access convenience macros */
@@ -394,22 +428,6 @@ typedef struct hermes {
 
 /* Function prototypes */
 void hermes_struct_init(hermes_t *hw, void __iomem *address, int reg_spacing);
-int hermes_init(hermes_t *hw);
-int hermes_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
-                      struct hermes_response *resp);
-int hermes_doicmd_wait(hermes_t *hw, u16 cmd,
-                       u16 parm0, u16 parm1, u16 parm2,
-                       struct hermes_response *resp);
-int hermes_allocate(hermes_t *hw, u16 size, u16 *fid);
-
-int hermes_bap_pread(hermes_t *hw, int bap, void *buf, int len,
-                       u16 id, u16 offset);
-int hermes_bap_pwrite(hermes_t *hw, int bap, const void *buf, int len,
-                        u16 id, u16 offset);
-int hermes_read_ltv(hermes_t *hw, int bap, u16 rid, unsigned buflen,
-                    u16 *length, void *buf);
-int hermes_write_ltv(hermes_t *hw, int bap, u16 rid,
-                      u16 length, const void *value);
 
 /* Inline functions */
 
@@ -426,13 +444,13 @@ static inline void hermes_set_irqmask(hermes_t *hw, u16 events)
 
 static inline int hermes_enable_port(hermes_t *hw, int port)
 {
-        return hermes_docmd_wait(hw, HERMES_CMD_ENABLE | (port << 8),
+        return hw->ops->cmd_wait(hw, HERMES_CMD_ENABLE | (port << 8),
                                  0, NULL);
 }
 
 static inline int hermes_disable_port(hermes_t *hw, int port)
 {
-        return hermes_docmd_wait(hw, HERMES_CMD_DISABLE | (port << 8),
+        return hw->ops->cmd_wait(hw, HERMES_CMD_DISABLE | (port << 8),
                                  0, NULL);
 }
 
@@ -440,7 +458,7 @@ static inline int hermes_disable_port(hermes_t *hw, int port)
  * information frame in __orinoco_ev_info() */
 static inline int hermes_inquire(hermes_t *hw, u16 rid)
 {
-        return hermes_docmd_wait(hw, HERMES_CMD_INQUIRE, rid, NULL);
+        return hw->ops->cmd_wait(hw, HERMES_CMD_INQUIRE, rid, NULL);
 }
 
 #define HERMES_BYTES_TO_RECLEN(n) ((((n)+1)/2) + 1)
@@ -475,10 +493,10 @@ static inline void hermes_clear_words(struct hermes *hw, int off,
 }
 
 #define HERMES_READ_RECORD(hw, bap, rid, buf) \
-        (hermes_read_ltv((hw), (bap), (rid), sizeof(*buf), NULL, (buf)))
+        (hw->ops->read_ltv((hw), (bap), (rid), sizeof(*buf), NULL, (buf)))
 #define HERMES_WRITE_RECORD(hw, bap, rid, buf) \
-        (hermes_write_ltv((hw), (bap), (rid), \
-                          HERMES_BYTES_TO_RECLEN(sizeof(*buf)), (buf)))
+        (hw->ops->write_ltv((hw), (bap), (rid), \
+                            HERMES_BYTES_TO_RECLEN(sizeof(*buf)), (buf)))
 
 static inline int hermes_read_wordrec(hermes_t *hw, int bap, u16 rid, u16 *word)
 {
diff --git a/drivers/net/wireless/orinoco/hermes_dld.c b/drivers/net/wireless/orinoco/hermes_dld.c
index fb157eb889ca..6da85e75fce0 100644
--- a/drivers/net/wireless/orinoco/hermes_dld.c
+++ b/drivers/net/wireless/orinoco/hermes_dld.c
@@ -46,37 +46,11 @@
 
 #define PFX "hermes_dld: "
 
-/*
- * AUX port access.  To unlock the AUX port write the access keys to the
- * PARAM0-2 registers, then write HERMES_AUX_ENABLE to the HERMES_CONTROL
- * register.  Then read it and make sure it's HERMES_AUX_ENABLED.
- */
-#define HERMES_AUX_ENABLE       0x8000  /* Enable auxiliary port access */
-#define HERMES_AUX_DISABLE      0x4000  /* Disable to auxiliary port access */
-#define HERMES_AUX_ENABLED      0xC000  /* Auxiliary port is open */
-#define HERMES_AUX_DISABLED     0x0000  /* Auxiliary port is closed */
-
-#define HERMES_AUX_PW0  0xFE01
-#define HERMES_AUX_PW1  0xDC23
-#define HERMES_AUX_PW2  0xBA45
-
-/* HERMES_CMD_DOWNLD */
-#define HERMES_PROGRAM_DISABLE             (0x0000 | HERMES_CMD_DOWNLD)
-#define HERMES_PROGRAM_ENABLE_VOLATILE     (0x0100 | HERMES_CMD_DOWNLD)
-#define HERMES_PROGRAM_ENABLE_NON_VOLATILE (0x0200 | HERMES_CMD_DOWNLD)
-#define HERMES_PROGRAM_NON_VOLATILE        (0x0300 | HERMES_CMD_DOWNLD)
-
 /* End markers used in dblocks */
 #define PDI_END         0x00000000      /* End of PDA */
 #define BLOCK_END       0xFFFFFFFF      /* Last image block */
 #define TEXT_END        0x1A            /* End of text header */
 
-/* Limit the amout we try to download in a single shot.
- * Size is in bytes.
- */
-#define MAX_DL_SIZE 1024
-#define LIMIT_PROGRAM_SIZE 0
-
 /*
  * The following structures have little-endian fields denoted by
  * the leading underscore.  Don't access them directly - use inline
@@ -165,41 +139,6 @@ pdi_len(const struct pdi *pdi)
         return 2 * (le16_to_cpu(pdi->len) - 1);
 }
 
-/*** Hermes AUX control ***/
-
-static inline void
-hermes_aux_setaddr(hermes_t *hw, u32 addr)
-{
-        hermes_write_reg(hw, HERMES_AUXPAGE, (u16) (addr >> 7));
-        hermes_write_reg(hw, HERMES_AUXOFFSET, (u16) (addr & 0x7F));
-}
-
-static inline int
-hermes_aux_control(hermes_t *hw, int enabled)
-{
-        int desired_state = enabled ? HERMES_AUX_ENABLED : HERMES_AUX_DISABLED;
-        int action = enabled ? HERMES_AUX_ENABLE : HERMES_AUX_DISABLE;
-        int i;
-
-        /* Already open? */
-        if (hermes_read_reg(hw, HERMES_CONTROL) == desired_state)
-                return 0;
-
-        hermes_write_reg(hw, HERMES_PARAM0, HERMES_AUX_PW0);
-        hermes_write_reg(hw, HERMES_PARAM1, HERMES_AUX_PW1);
-        hermes_write_reg(hw, HERMES_PARAM2, HERMES_AUX_PW2);
-        hermes_write_reg(hw, HERMES_CONTROL, action);
-
-        for (i = 0; i < 20; i++) {
-                udelay(10);
-                if (hermes_read_reg(hw, HERMES_CONTROL) ==
-                    desired_state)
-                        return 0;
-        }
-
-        return -EBUSY;
-}
-
 /*** Plug Data Functions ***/
 
 /*
@@ -271,62 +210,7 @@ hermes_plug_pdi(hermes_t *hw, const struct pdr *first_pdr,
                 return -EINVAL;
 
         /* do the actual plugging */
-        hermes_aux_setaddr(hw, pdr_addr(pdr));
-        hermes_write_bytes(hw, HERMES_AUXDATA, pdi->data, pdi_len(pdi));
-
-        return 0;
-}
-
-/* Read PDA from the adapter */
-int hermes_read_pda(hermes_t *hw,
-                    __le16 *pda,
-                    u32 pda_addr,
-                    u16 pda_len,
-                    int use_eeprom) /* can we get this into hw? */
-{
-        int ret;
-        u16 pda_size;
-        u16 data_len = pda_len;
-        __le16 *data = pda;
-
-        if (use_eeprom) {
-                /* PDA of spectrum symbol is in eeprom */
-
-                /* Issue command to read EEPROM */
-                ret = hermes_docmd_wait(hw, HERMES_CMD_READMIF, 0, NULL);
-                if (ret)
-                        return ret;
-        } else {
-                /* wl_lkm does not include PDA size in the PDA area.
-                 * We will pad the information into pda, so other routines
-                 * don't have to be modified */
-                pda[0] = cpu_to_le16(pda_len - 2);
-                        /* Includes CFG_PROD_DATA but not itself */
-                pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */
-                data_len = pda_len - 4;
-                data = pda + 2;
-        }
-
-        /* Open auxiliary port */
-        ret = hermes_aux_control(hw, 1);
-        pr_debug(PFX "AUX enable returned %d\n", ret);
-        if (ret)
-                return ret;
-
-        /* read PDA from EEPROM */
-        hermes_aux_setaddr(hw, pda_addr);
-        hermes_read_words(hw, HERMES_AUXDATA, data, data_len / 2);
-
-        /* Close aux port */
-        ret = hermes_aux_control(hw, 0);
-        pr_debug(PFX "AUX disable returned %d\n", ret);
-
-        /* Check PDA length */
-        pda_size = le16_to_cpu(pda[0]);
-        pr_debug(PFX "Actual PDA length %d, Max allowed %d\n",
-                 pda_size, pda_len);
-        if (pda_size > pda_len)
-                return -EINVAL;
+        hw->ops->program(hw, pdi->data, pdr_addr(pdr), pdi_len(pdi));
 
         return 0;
 }
@@ -389,101 +273,13 @@ hermes_blocks_length(const char *first_block, const void *end)
 
 /*** Hermes programming ***/
 
-/* About to start programming data (Hermes I)
- * offset is the entry point
- *
- * Spectrum_cs' Symbol fw does not require this
- * wl_lkm Agere fw does
- * Don't know about intersil
- */
-int hermesi_program_init(hermes_t *hw, u32 offset)
-{
-        int err;
-
-        /* Disable interrupts?*/
-        /*hw->inten = 0x0;*/
-        /*hermes_write_regn(hw, INTEN, 0);*/
-        /*hermes_set_irqmask(hw, 0);*/
-
-        /* Acknowledge any outstanding command */
-        hermes_write_regn(hw, EVACK, 0xFFFF);
-
-        /* Using doicmd_wait rather than docmd_wait */
-        err = hermes_doicmd_wait(hw,
-                                 0x0100 | HERMES_CMD_INIT,
-                                 0, 0, 0, NULL);
-        if (err)
-                return err;
-
-        err = hermes_doicmd_wait(hw,
-                                 0x0000 | HERMES_CMD_INIT,
-                                 0, 0, 0, NULL);
-        if (err)
-                return err;
-
-        err = hermes_aux_control(hw, 1);
-        pr_debug(PFX "AUX enable returned %d\n", err);
-
-        if (err)
-                return err;
-
-        pr_debug(PFX "Enabling volatile, EP 0x%08x\n", offset);
-        err = hermes_doicmd_wait(hw,
-                                 HERMES_PROGRAM_ENABLE_VOLATILE,
-                                 offset & 0xFFFFu,
-                                 offset >> 16,
-                                 0,
-                                 NULL);
-        pr_debug(PFX "PROGRAM_ENABLE returned %d\n", err);
-
-        return err;
-}
-
-/* Done programming data (Hermes I)
- *
- * Spectrum_cs' Symbol fw does not require this
- * wl_lkm Agere fw does
- * Don't know about intersil
- */
-int hermesi_program_end(hermes_t *hw)
-{
-        struct hermes_response resp;
-        int rc = 0;
-        int err;
-
-        rc = hermes_docmd_wait(hw, HERMES_PROGRAM_DISABLE, 0, &resp);
-
-        pr_debug(PFX "PROGRAM_DISABLE returned %d, "
-                 "r0 0x%04x, r1 0x%04x, r2 0x%04x\n",
-                 rc, resp.resp0, resp.resp1, resp.resp2);
-
-        if ((rc == 0) &&
-            ((resp.status & HERMES_STATUS_CMDCODE) != HERMES_CMD_DOWNLD))
-                rc = -EIO;
-
-        err = hermes_aux_control(hw, 0);
-        pr_debug(PFX "AUX disable returned %d\n", err);
-
-        /* Acknowledge any outstanding command */
-        hermes_write_regn(hw, EVACK, 0xFFFF);
-
-        /* Reinitialise, ignoring return */
-        (void) hermes_doicmd_wait(hw, 0x0000 | HERMES_CMD_INIT,
-                                  0, 0, 0, NULL);
-
-        return rc ? rc : err;
-}
-
 /* Program the data blocks */
 int hermes_program(hermes_t *hw, const char *first_block, const void *end)
 {
         const struct dblock *blk;
         u32 blkaddr;
         u32 blklen;
-#if LIMIT_PROGRAM_SIZE
-        u32 addr;
-        u32 len;
-#endif
+        int err = 0;
 
         blk = (const struct dblock *) first_block;
 
@@ -498,30 +294,10 @@ int hermes_program(hermes_t *hw, const char *first_block, const void *end)
                 pr_debug(PFX "Programming block of length %d "
                          "to address 0x%08x\n", blklen, blkaddr);
 
-#if !LIMIT_PROGRAM_SIZE
-                /* wl_lkm driver splits this into writes of 2000 bytes */
-                hermes_aux_setaddr(hw, blkaddr);
-                hermes_write_bytes(hw, HERMES_AUXDATA, blk->data,
-                                   blklen);
-#else
-                len = (blklen < MAX_DL_SIZE) ? blklen : MAX_DL_SIZE;
-                addr = blkaddr;
-
-                while (addr < (blkaddr + blklen)) {
-                        pr_debug(PFX "Programming subblock of length %d "
-                                 "to address 0x%08x. Data @ %p\n",
-                                 len, addr, &blk->data[addr - blkaddr]);
-
-                        hermes_aux_setaddr(hw, addr);
-                        hermes_write_bytes(hw, HERMES_AUXDATA,
-                                           &blk->data[addr - blkaddr],
-                                           len);
-
-                        addr += len;
-                        len = ((blkaddr + blklen - addr) < MAX_DL_SIZE) ?
-                                (blkaddr + blklen - addr) : MAX_DL_SIZE;
-                }
-#endif
+                err = hw->ops->program(hw, blk->data, blkaddr, blklen);
+                if (err)
+                        break;
+
                 blk = (const struct dblock *) &blk->data[blklen];
 
                 if ((void *) blk > (end - sizeof(*blk)))
@@ -530,7 +306,7 @@ int hermes_program(hermes_t *hw, const char *first_block, const void *end)
                 blkaddr = dblock_addr(blk);
                 blklen = dblock_len(blk);
         }
-        return 0;
+        return err;
 }
 
 /*** Default plugging data for Hermes I ***/
@@ -690,9 +466,8 @@ int hermes_apply_pda_with_defaults(hermes_t *hw,
                         if ((pdi_len(pdi) == pdr_len(pdr)) &&
                             ((void *) pdi->data + pdi_len(pdi) < pda_end)) {
                                 /* do the actual plugging */
-                                hermes_aux_setaddr(hw, pdr_addr(pdr));
-                                hermes_write_bytes(hw, HERMES_AUXDATA,
-                                                   pdi->data, pdi_len(pdi));
+                                hw->ops->program(hw, pdi->data, pdr_addr(pdr),
+                                                 pdi_len(pdi));
                         }
                 }
 
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 9f657afaa3e5..6fbd78850123 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -177,9 +177,9 @@ int determine_fw_capabilities(struct orinoco_private *priv,
                 /* 3Com MAC : 00:50:DA:* */
                 memset(tmp, 0, sizeof(tmp));
                 /* Get the Symbol firmware version */
-                err = hermes_read_ltv(hw, USER_BAP,
-                                      HERMES_RID_SECONDARYVERSION_SYMBOL,
-                                      SYMBOL_MAX_VER_LEN, NULL, &tmp);
+                err = hw->ops->read_ltv(hw, USER_BAP,
+                                        HERMES_RID_SECONDARYVERSION_SYMBOL,
+                                        SYMBOL_MAX_VER_LEN, NULL, &tmp);
                 if (err) {
                         dev_warn(dev, "Error %d reading Symbol firmware info. "
                                  "Wildly guessing capabilities...\n", err);
@@ -286,8 +286,8 @@ int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr)
         u16 reclen;
 
         /* Get the MAC address */
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
-                              ETH_ALEN, NULL, dev_addr);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
+                                ETH_ALEN, NULL, dev_addr);
         if (err) {
                 dev_warn(dev, "Failed to read MAC address!\n");
                 goto out;
@@ -296,8 +296,8 @@ int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr)
         dev_dbg(dev, "MAC address %pM\n", dev_addr);
 
         /* Get the station name */
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
-                              sizeof(nickbuf), &reclen, &nickbuf);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
+                                sizeof(nickbuf), &reclen, &nickbuf);
         if (err) {
                 dev_err(dev, "failed to read station name\n");
                 goto out;
@@ -374,6 +374,32 @@ int orinoco_hw_read_card_settings(struct orinoco_private *priv, u8 *dev_addr)
                 err = hermes_read_wordrec(hw, USER_BAP,
                                           HERMES_RID_CNFPREAMBLE_SYMBOL,
                                           &priv->preamble);
+                if (err) {
+                        dev_err(dev, "Failed to read preamble setup\n");
+                        goto out;
+                }
+        }
+
+        /* Retry settings */
+        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT,
+                                  &priv->short_retry_limit);
+        if (err) {
+                dev_err(dev, "Failed to read short retry limit\n");
+                goto out;
+        }
+
+        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT,
+                                  &priv->long_retry_limit);
+        if (err) {
+                dev_err(dev, "Failed to read long retry limit\n");
+                goto out;
+        }
+
+        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME,
+                                  &priv->retry_lifetime);
+        if (err) {
+                dev_err(dev, "Failed to read max retry lifetime\n");
+                goto out;
         }
 
 out:
@@ -387,11 +413,11 @@ int orinoco_hw_allocate_fid(struct orinoco_private *priv)
         struct hermes *hw = &priv->hw;
         int err;
 
-        err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+        err = hw->ops->allocate(hw, priv->nicbuf_size, &priv->txfid);
         if (err == -EIO && priv->nicbuf_size > TX_NICBUF_SIZE_BUG) {
                 /* Try workaround for old Symbol firmware bug */
                 priv->nicbuf_size = TX_NICBUF_SIZE_BUG;
-                err = hermes_allocate(hw, priv->nicbuf_size, &priv->txfid);
+                err = hw->ops->allocate(hw, priv->nicbuf_size, &priv->txfid);
 
                 dev_warn(dev, "Firmware ALLOC bug detected "
                          "(old Symbol firmware?). Work around %s\n",
@@ -437,8 +463,9 @@ int orinoco_hw_program_rids(struct orinoco_private *priv)
         struct hermes_idstring idbuf;
 
         /* Set the MAC address */
-        err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
-                               HERMES_BYTES_TO_RECLEN(ETH_ALEN), dev->dev_addr);
+        err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNMACADDR,
+                                 HERMES_BYTES_TO_RECLEN(ETH_ALEN),
+                                 dev->dev_addr);
         if (err) {
                 printk(KERN_ERR "%s: Error %d setting MAC address\n",
                        dev->name, err);
@@ -501,7 +528,7 @@ int orinoco_hw_program_rids(struct orinoco_private *priv)
         idbuf.len = cpu_to_le16(strlen(priv->desired_essid));
         memcpy(&idbuf.val, priv->desired_essid, sizeof(idbuf.val));
         /* WinXP wants partner to configure OWNSSID even in IBSS mode. (jimc) */
-        err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID,
+        err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNSSID,
                         HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
                         &idbuf);
         if (err) {
@@ -509,7 +536,7 @@ int orinoco_hw_program_rids(struct orinoco_private *priv)
                        dev->name, err);
                 return err;
         }
-        err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID,
+        err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFDESIREDSSID,
                         HERMES_BYTES_TO_RECLEN(strlen(priv->desired_essid)+2),
                         &idbuf);
         if (err) {
@@ -521,9 +548,9 @@ int orinoco_hw_program_rids(struct orinoco_private *priv)
         /* Set the station name */
         idbuf.len = cpu_to_le16(strlen(priv->nick));
         memcpy(&idbuf.val, priv->nick, sizeof(idbuf.val));
-        err = hermes_write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
-                               HERMES_BYTES_TO_RECLEN(strlen(priv->nick)+2),
-                               &idbuf);
+        err = hw->ops->write_ltv(hw, USER_BAP, HERMES_RID_CNFOWNNAME,
+                                 HERMES_BYTES_TO_RECLEN(strlen(priv->nick)+2),
+                                 &idbuf);
         if (err) {
                 printk(KERN_ERR "%s: Error %d setting nickname\n",
                        dev->name, err);
@@ -638,12 +665,12 @@ int orinoco_hw_program_rids(struct orinoco_private *priv)
         if (priv->iw_mode == NL80211_IFTYPE_MONITOR) {
                 /* Enable monitor mode */
                 dev->type = ARPHRD_IEEE80211;
-                err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
+                err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST |
                                             HERMES_TEST_MONITOR, 0, NULL);
         } else {
                 /* Disable monitor mode */
                 dev->type = ARPHRD_ETHER;
-                err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
+                err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST |
                                             HERMES_TEST_STOP, 0, NULL);
         }
         if (err)
@@ -669,8 +696,8 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
         if ((key < 0) || (key >= 4))
                 return -EINVAL;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
-                              sizeof(tsc_arr), NULL, &tsc_arr);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
+                                sizeof(tsc_arr), NULL, &tsc_arr);
         if (!err)
                 memcpy(tsc, &tsc_arr[key][0], sizeof(tsc_arr[0]));
 
@@ -849,7 +876,7 @@ int __orinoco_hw_setup_wepkeys(struct orinoco_private *priv)
                                 memcpy(key, priv->keys[i].key,
                                        priv->keys[i].key_len);
 
-                                err = hermes_write_ltv(hw, USER_BAP,
+                                err = hw->ops->write_ltv(hw, USER_BAP,
                                                 HERMES_RID_CNFDEFAULTKEY0 + i,
                                                 HERMES_BYTES_TO_RECLEN(keylen),
                                                 key);
@@ -1066,7 +1093,7 @@ int __orinoco_hw_set_multicast_list(struct orinoco_private *priv,
                         memcpy(mclist.addr[i++], ha->addr, ETH_ALEN);
                 }
 
-                err = hermes_write_ltv(hw, USER_BAP,
+                err = hw->ops->write_ltv(hw, USER_BAP,
                                    HERMES_RID_CNFGROUPADDRESSES,
                                    HERMES_BYTES_TO_RECLEN(mc_count * ETH_ALEN),
                                    &mclist);
@@ -1108,15 +1135,15 @@ int orinoco_hw_get_essid(struct orinoco_private *priv, int *active,
                 rid = (priv->port_type == 3) ? HERMES_RID_CNFOWNSSID :
                         HERMES_RID_CNFDESIREDSSID;
 
-                err = hermes_read_ltv(hw, USER_BAP, rid, sizeof(essidbuf),
-                                      NULL, &essidbuf);
+                err = hw->ops->read_ltv(hw, USER_BAP, rid, sizeof(essidbuf),
+                                        NULL, &essidbuf);
                 if (err)
                         goto fail_unlock;
         } else {
                 *active = 0;
 
-                err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID,
-                                      sizeof(essidbuf), NULL, &essidbuf);
+                err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTSSID,
+                                        sizeof(essidbuf), NULL, &essidbuf);
                 if (err)
                         goto fail_unlock;
         }
@@ -1187,8 +1214,8 @@ int orinoco_hw_get_bitratelist(struct orinoco_private *priv,
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES,
-                              sizeof(list), NULL, &list);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_SUPPORTEDDATARATES,
+                                sizeof(list), NULL, &list);
         orinoco_unlock(priv, &flags);
 
         if (err)
@@ -1255,7 +1282,7 @@ int orinoco_hw_trigger_scan(struct orinoco_private *priv,
                                 idbuf.len = cpu_to_le16(len);
                                 memcpy(idbuf.val, ssid->ssid, len);
 
-                                err = hermes_write_ltv(hw, USER_BAP,
+                                err = hw->ops->write_ltv(hw, USER_BAP,
                                                HERMES_RID_CNFSCANSSID_AGERE,
                                                HERMES_BYTES_TO_RECLEN(len + 2),
                                                &idbuf);
@@ -1319,8 +1346,8 @@ int orinoco_hw_get_current_bssid(struct orinoco_private *priv,
         hermes_t *hw = &priv->hw;
         int err;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
-                              ETH_ALEN, NULL, addr);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
+                                ETH_ALEN, NULL, addr);
 
         return err;
 }
diff --git a/drivers/net/wireless/orinoco/main.c b/drivers/net/wireless/orinoco/main.c
index 413e9ab6cab3..1d60c7e4392a 100644
--- a/drivers/net/wireless/orinoco/main.c
+++ b/drivers/net/wireless/orinoco/main.c
@@ -254,7 +254,7 @@ void set_port_type(struct orinoco_private *priv)
 /* Device methods                                                   */
 /********************************************************************/
 
-static int orinoco_open(struct net_device *dev)
+int orinoco_open(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         unsigned long flags;
@@ -272,8 +272,9 @@ static int orinoco_open(struct net_device *dev)
 
         return err;
 }
+EXPORT_SYMBOL(orinoco_open);
 
-static int orinoco_stop(struct net_device *dev)
+int orinoco_stop(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         int err = 0;
@@ -281,25 +282,27 @@ static int orinoco_stop(struct net_device *dev)
         /* We mustn't use orinoco_lock() here, because we need to be
            able to close the interface even if hw_unavailable is set
            (e.g. as we're released after a PC Card removal) */
-        spin_lock_irq(&priv->lock);
+        orinoco_lock_irq(priv);
 
         priv->open = 0;
 
         err = __orinoco_down(priv);
 
-        spin_unlock_irq(&priv->lock);
+        orinoco_unlock_irq(priv);
 
         return err;
 }
+EXPORT_SYMBOL(orinoco_stop);
 
-static struct net_device_stats *orinoco_get_stats(struct net_device *dev)
+struct net_device_stats *orinoco_get_stats(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
 
         return &priv->stats;
 }
+EXPORT_SYMBOL(orinoco_get_stats);
 
-static void orinoco_set_multicast_list(struct net_device *dev)
+void orinoco_set_multicast_list(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         unsigned long flags;
@@ -313,8 +316,9 @@ static void orinoco_set_multicast_list(struct net_device *dev)
         __orinoco_set_multicast_list(dev);
         orinoco_unlock(priv, &flags);
 }
+EXPORT_SYMBOL(orinoco_set_multicast_list);
 
-static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
+int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 {
         struct orinoco_private *priv = ndev_priv(dev);
 
@@ -330,6 +334,7 @@ static int orinoco_change_mtu(struct net_device *dev, int new_mtu)
 
         return 0;
 }
+EXPORT_SYMBOL(orinoco_change_mtu);
 
 /********************************************************************/
 /* Tx path                                                          */
@@ -400,8 +405,8 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 memset(&desc, 0, sizeof(desc));
 
                 *txcntl = cpu_to_le16(tx_control);
-                err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
-                                        txfid, 0);
+                err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
+                                          txfid, 0);
                 if (err) {
                         if (net_ratelimit())
                                 printk(KERN_ERR "%s: Error %d writing Tx "
@@ -414,8 +419,8 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 memset(&desc, 0, sizeof(desc));
 
                 desc.tx_control = cpu_to_le16(tx_control);
-                err = hermes_bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
-                                        txfid, 0);
+                err = hw->ops->bap_pwrite(hw, USER_BAP, &desc, sizeof(desc),
+                                          txfid, 0);
                 if (err) {
                         if (net_ratelimit())
                                 printk(KERN_ERR "%s: Error %d writing Tx "
@@ -458,8 +463,8 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                 memcpy(eh, &hdr, sizeof(hdr));
         }
 
-        err = hermes_bap_pwrite(hw, USER_BAP, skb->data, skb->len,
-                                txfid, HERMES_802_3_OFFSET);
+        err = hw->ops->bap_pwrite(hw, USER_BAP, skb->data, skb->len,
+                                  txfid, HERMES_802_3_OFFSET);
         if (err) {
                 printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
                        dev->name, err);
@@ -490,8 +495,8 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
                             skb->data + ETH_HLEN, skb->len - ETH_HLEN, mic);
 
                 /* Write the MIC */
-                err = hermes_bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
-                                        txfid, HERMES_802_3_OFFSET + offset);
+                err = hw->ops->bap_pwrite(hw, USER_BAP, &mic_buf[0], len,
+                                          txfid, HERMES_802_3_OFFSET + offset);
                 if (err) {
                         printk(KERN_ERR "%s: Error %d writing MIC to BAP\n",
                                dev->name, err);
@@ -502,7 +507,7 @@ static netdev_tx_t orinoco_xmit(struct sk_buff *skb, struct net_device *dev)
         /* Finally, we actually initiate the send */
         netif_stop_queue(dev);
 
-        err = hermes_docmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
+        err = hw->ops->cmd_wait(hw, HERMES_CMD_TX | HERMES_CMD_RECL,
                                 txfid, NULL);
         if (err) {
                 netif_start_queue(dev);
@@ -572,9 +577,9 @@ static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
                 return; /* Nothing's really happened */
 
         /* Read part of the frame header - we need status and addr1 */
-        err = hermes_bap_pread(hw, IRQ_BAP, &hdr,
-                               sizeof(struct hermes_txexc_data),
-                               fid, 0);
+        err = hw->ops->bap_pread(hw, IRQ_BAP, &hdr,
+                                 sizeof(struct hermes_txexc_data),
+                                 fid, 0);
 
         hermes_write_regn(hw, TXCOMPLFID, DUMMY_FID);
         stats->tx_errors++;
@@ -615,7 +620,7 @@ static void __orinoco_ev_txexc(struct net_device *dev, hermes_t *hw)
         netif_wake_queue(dev);
 }
 
-static void orinoco_tx_timeout(struct net_device *dev)
+void orinoco_tx_timeout(struct net_device *dev)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         struct net_device_stats *stats = &priv->stats;
@@ -630,6 +635,7 @@ static void orinoco_tx_timeout(struct net_device *dev)
 
         schedule_work(&priv->reset_work);
 }
+EXPORT_SYMBOL(orinoco_tx_timeout);
 
 /********************************************************************/
 /* Rx path (data frames)                                            */
@@ -764,9 +770,9 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
 
         /* If any, copy the data from the card to the skb */
         if (datalen > 0) {
-                err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, datalen),
-                                       ALIGN(datalen, 2), rxfid,
-                                       HERMES_802_2_OFFSET);
+                err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, datalen),
+                                         ALIGN(datalen, 2), rxfid,
+                                         HERMES_802_2_OFFSET);
                 if (err) {
                         printk(KERN_ERR "%s: error %d reading monitor frame\n",
                                dev->name, err);
@@ -792,7 +798,7 @@ static void orinoco_rx_monitor(struct net_device *dev, u16 rxfid,
         stats->rx_dropped++;
 }
 
-static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
+void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         struct net_device_stats *stats = &priv->stats;
@@ -814,8 +820,8 @@ static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
 
         rxfid = hermes_read_regn(hw, RXFID);
 
-        err = hermes_bap_pread(hw, IRQ_BAP, desc, sizeof(*desc),
-                               rxfid, 0);
+        err = hw->ops->bap_pread(hw, IRQ_BAP, desc, sizeof(*desc),
+                                 rxfid, 0);
         if (err) {
                 printk(KERN_ERR "%s: error %d reading Rx descriptor. "
                        "Frame dropped.\n", dev->name, err);
@@ -882,9 +888,9 @@ static void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw)
            nothing is removed.  2 is for aligning the IP header.  */
         skb_reserve(skb, ETH_HLEN + 2);
 
-        err = hermes_bap_pread(hw, IRQ_BAP, skb_put(skb, length),
-                               ALIGN(length, 2), rxfid,
-                               HERMES_802_2_OFFSET);
+        err = hw->ops->bap_pread(hw, IRQ_BAP, skb_put(skb, length),
+                                 ALIGN(length, 2), rxfid,
+                                 HERMES_802_2_OFFSET);
         if (err) {
                 printk(KERN_ERR "%s: error %d reading frame. "
                        "Frame dropped.\n", dev->name, err);
@@ -913,6 +919,7 @@ update_stats:
 out:
         kfree(desc);
 }
+EXPORT_SYMBOL(__orinoco_ev_rx);
 
 static void orinoco_rx(struct net_device *dev,
                        struct hermes_rx_descriptor *desc,
@@ -1145,9 +1152,9 @@ static void orinoco_join_ap(struct work_struct *work)
                 goto out;
 
         /* Read scan results from the firmware */
-        err = hermes_read_ltv(hw, USER_BAP,
-                              HERMES_RID_SCANRESULTSTABLE,
-                              MAX_SCAN_LEN, &len, buf);
+        err = hw->ops->read_ltv(hw, USER_BAP,
+                                HERMES_RID_SCANRESULTSTABLE,
+                                MAX_SCAN_LEN, &len, buf);
         if (err) {
                 printk(KERN_ERR "%s: Cannot read scan results\n",
                        dev->name);
@@ -1194,8 +1201,8 @@ static void orinoco_send_bssid_wevent(struct orinoco_private *priv)
         union iwreq_data wrqu;
         int err;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
-                              ETH_ALEN, NULL, wrqu.ap_addr.sa_data);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENTBSSID,
+                                ETH_ALEN, NULL, wrqu.ap_addr.sa_data);
         if (err != 0)
                 return;
 
@@ -1217,8 +1224,8 @@ static void orinoco_send_assocreqie_wevent(struct orinoco_private *priv)
         if (!priv->has_wpa)
                 return;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO,
-                              sizeof(buf), NULL, &buf);
+        err = hw->ops->read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_ASSOC_REQ_INFO,
+                                sizeof(buf), NULL, &buf);
         if (err != 0)
                 return;
 
@@ -1247,8 +1254,9 @@ static void orinoco_send_assocrespie_wevent(struct orinoco_private *priv)
         if (!priv->has_wpa)
                 return;
 
-        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_ASSOC_RESP_INFO,
-                              sizeof(buf), NULL, &buf);
+        err = hw->ops->read_ltv(hw, USER_BAP,
+                                HERMES_RID_CURRENT_ASSOC_RESP_INFO,
+                                sizeof(buf), NULL, &buf);
         if (err != 0)
                 return;
 
@@ -1353,7 +1361,7 @@ static void orinoco_process_scan_results(struct work_struct *work)
         spin_unlock_irqrestore(&priv->scan_lock, flags);
 }
 
-static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
+void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
 {
         struct orinoco_private *priv = ndev_priv(dev);
         u16 infofid;
@@ -1371,8 +1379,8 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
         infofid = hermes_read_regn(hw, INFOFID);
 
         /* Read the info frame header - don't try too hard */
-        err = hermes_bap_pread(hw, IRQ_BAP, &info, sizeof(info),
-                               infofid, 0);
+        err = hw->ops->bap_pread(hw, IRQ_BAP, &info, sizeof(info),
+                                 infofid, 0);
         if (err) {
                 printk(KERN_ERR "%s: error %d reading info frame. "
                        "Frame dropped.\n", dev->name, err);
@@ -1393,8 +1401,8 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
                         len = sizeof(tallies);
                 }
 
-                err = hermes_bap_pread(hw, IRQ_BAP, &tallies, len,
-                                       infofid, sizeof(info));
+                err = hw->ops->bap_pread(hw, IRQ_BAP, &tallies, len,
+                                         infofid, sizeof(info));
                 if (err)
                         break;
 
@@ -1429,8 +1437,8 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
                         break;
                 }
 
-                err = hermes_bap_pread(hw, IRQ_BAP, &linkstatus, len,
-                                       infofid, sizeof(info));
+                err = hw->ops->bap_pread(hw, IRQ_BAP, &linkstatus, len,
+                                         infofid, sizeof(info));
                 if (err)
                         break;
                 newstatus = le16_to_cpu(linkstatus.linkstatus);
@@ -1494,8 +1502,8 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
                 }
 
                 /* Read scan data */
-                err = hermes_bap_pread(hw, IRQ_BAP, (void *) buf, len,
-                                       infofid, sizeof(info));
+                err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) buf, len,
+                                         infofid, sizeof(info));
                 if (err) {
                         kfree(buf);
                         qabort_scan(priv);
@@ -1547,8 +1555,8 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
                         break;
 
                 /* Read scan data */
-                err = hermes_bap_pread(hw, IRQ_BAP, (void *) bss, len,
-                                       infofid, sizeof(info));
+                err = hw->ops->bap_pread(hw, IRQ_BAP, (void *) bss, len,
+                                         infofid, sizeof(info));
                 if (err)
                         kfree(bss);
                 else
@@ -1571,6 +1579,7 @@ static void __orinoco_ev_info(struct net_device *dev, hermes_t *hw)
 
         return;
 }
+EXPORT_SYMBOL(__orinoco_ev_info);
 
 static void __orinoco_ev_infdrop(struct net_device *dev, hermes_t *hw)
 {
@@ -1647,7 +1656,7 @@ static int orinoco_reinit_firmware(struct orinoco_private *priv)
         struct hermes *hw = &priv->hw;
         int err;
 
-        err = hermes_init(hw);
+        err = hw->ops->init(hw);
         if (priv->do_fw_download && !err) {
                 err = orinoco_download(priv);
                 if (err)
@@ -1735,7 +1744,7 @@ void orinoco_reset(struct work_struct *work)
         }
 
         /* This has to be called from user context */
-        spin_lock_irq(&priv->lock);
+        orinoco_lock_irq(priv);
 
         priv->hw_unavailable--;
 
@@ -1750,7 +1759,7 @@ void orinoco_reset(struct work_struct *work)
                         dev->trans_start = jiffies;
         }
 
-        spin_unlock_irq(&priv->lock);
+        orinoco_unlock_irq(priv);
 
         return;
  disable:
@@ -1984,7 +1993,7 @@ int orinoco_init(struct orinoco_private *priv)
         priv->nicbuf_size = IEEE80211_MAX_FRAME_LEN + ETH_HLEN;
 
         /* Initialize the firmware */
-        err = hermes_init(hw);
+        err = hw->ops->init(hw);
         if (err != 0) {
                 dev_err(dev, "Failed to initialize firmware (err = %d)\n",
                         err);
@@ -2067,9 +2076,9 @@ int orinoco_init(struct orinoco_private *priv)
 
         /* Make the hardware available, as long as it hasn't been
          * removed elsewhere (e.g. by PCMCIA hot unplug) */
-        spin_lock_irq(&priv->lock);
+        orinoco_lock_irq(priv);
         priv->hw_unavailable--;
-        spin_unlock_irq(&priv->lock);
+        orinoco_unlock_irq(priv);
 
         dev_dbg(dev, "Ready\n");
 
@@ -2192,7 +2201,8 @@ EXPORT_SYMBOL(alloc_orinocodev);
  */
 int orinoco_if_add(struct orinoco_private *priv,
                    unsigned long base_addr,
-                   unsigned int irq)
+                   unsigned int irq,
+                   const struct net_device_ops *ops)
 {
         struct wiphy *wiphy = priv_to_wiphy(priv);
         struct wireless_dev *wdev;
@@ -2211,12 +2221,17 @@ int orinoco_if_add(struct orinoco_private *priv,
 
         /* Setup / override net_device fields */
         dev->ieee80211_ptr = wdev;
-        dev->netdev_ops = &orinoco_netdev_ops;
         dev->watchdog_timeo = HZ; /* 1 second timeout */
         dev->wireless_handlers = &orinoco_handler_def;
 #ifdef WIRELESS_SPY
         dev->wireless_data = &priv->wireless_data;
 #endif
+        /* Default to standard ops if not set */
+        if (ops)
+                dev->netdev_ops = ops;
+        else
+                dev->netdev_ops = &orinoco_netdev_ops;
+
         /* we use the default eth_mac_addr for setting the MAC addr */
 
         /* Reserve space in skb for the SNAP header */
@@ -2305,7 +2320,7 @@ int orinoco_up(struct orinoco_private *priv)
         unsigned long flags;
         int err;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, &flags);
 
         err = orinoco_reinit_firmware(priv);
         if (err) {
@@ -2325,7 +2340,7 @@ int orinoco_up(struct orinoco_private *priv)
         }
 
 exit:
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
 
         return 0;
 }
@@ -2337,7 +2352,7 @@ void orinoco_down(struct orinoco_private *priv)
         unsigned long flags;
         int err;
 
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, &flags);
         err = __orinoco_down(priv);
         if (err)
                 printk(KERN_WARNING "%s: Error %d downing interface\n",
@@ -2345,7 +2360,7 @@ void orinoco_down(struct orinoco_private *priv)
 
         netif_device_detach(dev);
         priv->hw_unavailable++;
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
 }
 EXPORT_SYMBOL(orinoco_down);
 
diff --git a/drivers/net/wireless/orinoco/main.h b/drivers/net/wireless/orinoco/main.h
index 21ab36cd76c7..4dadf9880a97 100644
--- a/drivers/net/wireless/orinoco/main.h
+++ b/drivers/net/wireless/orinoco/main.h
@@ -33,18 +33,6 @@ int orinoco_commit(struct orinoco_private *priv);
 void orinoco_reset(struct work_struct *work);
 
 /* Information element helpers - find a home for these... */
-static inline u8 *orinoco_get_ie(u8 *data, size_t len,
-                                 enum ieee80211_eid eid)
-{
-        u8 *p = data;
-        while ((p + 2) < (data + len)) {
-                if (p[0] == eid)
-                        return p;
-                p += p[1] + 2;
-        }
-        return NULL;
-}
-
 #define WPA_OUI_TYPE    "\x00\x50\xF2\x01"
 #define WPA_SELECTOR_LEN 4
 static inline u8 *orinoco_get_wpa_ie(u8 *data, size_t len)
diff --git a/drivers/net/wireless/orinoco/orinoco.h b/drivers/net/wireless/orinoco/orinoco.h
index 665ef56f8382..e9f415a56d4d 100644
--- a/drivers/net/wireless/orinoco/orinoco.h
+++ b/drivers/net/wireless/orinoco/orinoco.h
@@ -131,6 +131,8 @@ struct orinoco_private {
         u16 ap_density, rts_thresh;
         u16 pm_on, pm_mcast, pm_period, pm_timeout;
         u16 preamble;
+        u16 short_retry_limit, long_retry_limit;
+        u16 retry_lifetime;
 #ifdef WIRELESS_SPY
         struct iw_spy_data spy_data; /* iwspy support */
         struct iw_public_data   wireless_data;
@@ -188,12 +190,24 @@ extern void free_orinocodev(struct orinoco_private *priv);
 extern int orinoco_init(struct orinoco_private *priv);
 extern int orinoco_if_add(struct orinoco_private *priv,
                           unsigned long base_addr,
-                          unsigned int irq);
+                          unsigned int irq,
+                          const struct net_device_ops *ops);
 extern void orinoco_if_del(struct orinoco_private *priv);
 extern int orinoco_up(struct orinoco_private *priv);
 extern void orinoco_down(struct orinoco_private *priv);
 extern irqreturn_t orinoco_interrupt(int irq, void *dev_id);
 
+extern void __orinoco_ev_info(struct net_device *dev, hermes_t *hw);
+extern void __orinoco_ev_rx(struct net_device *dev, hermes_t *hw);
+
+/* Common ndo functions exported for reuse by orinoco_usb */
+int orinoco_open(struct net_device *dev);
+int orinoco_stop(struct net_device *dev);
+struct net_device_stats *orinoco_get_stats(struct net_device *dev);
+void orinoco_set_multicast_list(struct net_device *dev);
+int orinoco_change_mtu(struct net_device *dev, int new_mtu);
+void orinoco_tx_timeout(struct net_device *dev);
+
 /********************************************************************/
 /* Locking and synchronization functions                            */
 /********************************************************************/
@@ -201,11 +215,11 @@ extern irqreturn_t orinoco_interrupt(int irq, void *dev_id);
 static inline int orinoco_lock(struct orinoco_private *priv,
                                unsigned long *flags)
 {
-        spin_lock_irqsave(&priv->lock, *flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, flags);
         if (priv->hw_unavailable) {
                 DEBUG(1, "orinoco_lock() called with hw_unavailable (dev=%p)\n",
                        priv->ndev);
-                spin_unlock_irqrestore(&priv->lock, *flags);
+                priv->hw.ops->unlock_irqrestore(&priv->lock, flags);
                 return -EBUSY;
         }
         return 0;
@@ -214,7 +228,17 @@ static inline int orinoco_lock(struct orinoco_private *priv,
 static inline void orinoco_unlock(struct orinoco_private *priv,
                                   unsigned long *flags)
 {
-        spin_unlock_irqrestore(&priv->lock, *flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, flags);
+}
+
+static inline void orinoco_lock_irq(struct orinoco_private *priv)
+{
+        priv->hw.ops->lock_irq(&priv->lock);
+}
+
+static inline void orinoco_unlock_irq(struct orinoco_private *priv)
+{
+        priv->hw.ops->unlock_irq(&priv->lock);
 }
 
 /*** Navigate from net_device to orinoco_private ***/
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index fdc961379170..f99b13ba92b3 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -296,7 +296,7 @@ orinoco_cs_config(struct pcmcia_device *link)
 
         /* Register an interface with the stack */
         if (orinoco_if_add(priv, link->io.BasePort1,
-                           link->irq.AssignedIRQ) != 0) {
+                           link->irq.AssignedIRQ, NULL) != 0) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto failed;
         }
@@ -327,9 +327,9 @@ orinoco_cs_release(struct pcmcia_device *link)
 
         /* We're committed to taking the device away now, so mark the
          * hardware as unavailable */
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, &flags);
         priv->hw_unavailable++;
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
 
         pcmcia_disable_device(link);
         if (priv->hw.iobase)
diff --git a/drivers/net/wireless/orinoco/orinoco_nortel.c b/drivers/net/wireless/orinoco/orinoco_nortel.c
index 075f446b3139..bc3ea0b67a4f 100644
--- a/drivers/net/wireless/orinoco/orinoco_nortel.c
+++ b/drivers/net/wireless/orinoco/orinoco_nortel.c
@@ -220,7 +220,7 @@ static int orinoco_nortel_init_one(struct pci_dev *pdev,
                 goto fail;
         }
 
-        err = orinoco_if_add(priv, 0, 0);
+        err = orinoco_if_add(priv, 0, 0, NULL);
         if (err) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto fail;
diff --git a/drivers/net/wireless/orinoco/orinoco_pci.c b/drivers/net/wireless/orinoco/orinoco_pci.c
index bda5317cc596..468197f86673 100644
--- a/drivers/net/wireless/orinoco/orinoco_pci.c
+++ b/drivers/net/wireless/orinoco/orinoco_pci.c
@@ -170,7 +170,7 @@ static int orinoco_pci_init_one(struct pci_dev *pdev,
                 goto fail;
         }
 
-        err = orinoco_if_add(priv, 0, 0);
+        err = orinoco_if_add(priv, 0, 0, NULL);
         if (err) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto fail;
diff --git a/drivers/net/wireless/orinoco/orinoco_plx.c b/drivers/net/wireless/orinoco/orinoco_plx.c
index e0d5874ab42f..9358f4d2307b 100644
--- a/drivers/net/wireless/orinoco/orinoco_plx.c
+++ b/drivers/net/wireless/orinoco/orinoco_plx.c
@@ -259,7 +259,7 @@ static int orinoco_plx_init_one(struct pci_dev *pdev,
                 goto fail;
         }
 
-        err = orinoco_if_add(priv, 0, 0);
+        err = orinoco_if_add(priv, 0, 0, NULL);
         if (err) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto fail;
diff --git a/drivers/net/wireless/orinoco/orinoco_tmd.c b/drivers/net/wireless/orinoco/orinoco_tmd.c
index 88cbc7902aa0..784605f0af15 100644
--- a/drivers/net/wireless/orinoco/orinoco_tmd.c
+++ b/drivers/net/wireless/orinoco/orinoco_tmd.c
@@ -156,7 +156,7 @@ static int orinoco_tmd_init_one(struct pci_dev *pdev,
                 goto fail;
         }
 
-        err = orinoco_if_add(priv, 0, 0);
+        err = orinoco_if_add(priv, 0, 0, NULL);
         if (err) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto fail;
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
new file mode 100644
index 000000000000..e22093359f3e
--- /dev/null
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -0,0 +1,1800 @@
+/*
+ * USB Orinoco driver
+ *
+ * Copyright (c) 2003 Manuel Estrada Sainz
+ *
+ * The contents of this file are subject to the Mozilla Public License
+ * Version 1.1 (the "License"); you may not use this file except in
+ * compliance with the License. You may obtain a copy of the License
+ * at http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS"
+ * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
+ * the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * Alternatively, the contents of this file may be used under the
+ * terms of the GNU General Public License version 2 (the "GPL"), in
+ * which case the provisions of the GPL are applicable instead of the
+ * above.  If you wish to allow the use of your version of this file
+ * only under the terms of the GPL and not to allow others to use your
+ * version of this file under the MPL, indicate your decision by
+ * deleting the provisions above and replace them with the notice and
+ * other provisions required by the GPL.  If you do not delete the
+ * provisions above, a recipient may use your version of this file
+ * under either the MPL or the GPL.
+ *
+ * Queueing code based on linux-wlan-ng 0.2.1-pre5
+ *
+ * Copyright (C) 1999 AbsoluteValue Systems, Inc.  All Rights Reserved.
+ *
+ *      The license is the same as above.
+ *
+ * Initialy based on USB Skeleton driver - 0.7
+ *
+ * Copyright (c) 2001 Greg Kroah-Hartman (greg@kroah.com)
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License as
+ *      published by the Free Software Foundation; either version 2 of
+ *      the License, or (at your option) any later version.
+ *
+ * NOTE: The original USB Skeleton driver is GPL, but all that code is
+ * gone so MPL/GPL applies.
+ */
+
+#define DRIVER_NAME "orinoco_usb"
+#define PFX DRIVER_NAME ": "
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/signal.h>
+#include <linux/errno.h>
+#include <linux/poll.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/fcntl.h>
+#include <linux/spinlock.h>
+#include <linux/list.h>
+#include <linux/smp_lock.h>
+#include <linux/usb.h>
+#include <linux/timer.h>
+
+#include <linux/netdevice.h>
+#include <linux/if_arp.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/firmware.h>
+
+#include "orinoco.h"
+
+#ifndef URB_ASYNC_UNLINK
+#define URB_ASYNC_UNLINK 0
+#endif
+
+/* 802.2 LLC/SNAP header used for Ethernet encapsulation over 802.11 */
+static const u8 encaps_hdr[] = {0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00};
+#define ENCAPS_OVERHEAD         (sizeof(encaps_hdr) + 2)
+
+struct header_struct {
+        /* 802.3 */
+        u8 dest[ETH_ALEN];
+        u8 src[ETH_ALEN];
+        __be16 len;
+        /* 802.2 */
+        u8 dsap;
+        u8 ssap;
+        u8 ctrl;
+        /* SNAP */
+        u8 oui[3];
+        __be16 ethertype;
+} __attribute__ ((packed));
+
+struct ez_usb_fw {
+        u16 size;
+        const u8 *code;
+};
+
+static struct ez_usb_fw firmware = {
+        .size = 0,
+        .code = NULL,
+};
+
+#ifdef CONFIG_USB_DEBUG
+static int debug = 1;
+#else
+static int debug;
+#endif
+
+/* Debugging macros */
+#undef dbg
+#define dbg(format, arg...) \
+        do { if (debug) printk(KERN_DEBUG PFX "%s: " format "\n", \
+                               __func__ , ## arg); } while (0)
+#undef err
+#define err(format, arg...) \
+        do { printk(KERN_ERR PFX format "\n", ## arg); } while (0)
+
+/* Module paramaters */
+module_param(debug, int, 0644);
+MODULE_PARM_DESC(debug, "Debug enabled or not");
+
+MODULE_FIRMWARE("orinoco_ezusb_fw");
+
+/*
+ * Under some conditions, the card gets stuck and stops paying attention
+ * to the world (i.e. data communication stalls) until we do something to
+ * it.  Sending an INQ_TALLIES command seems to be enough and should be
+ * harmless otherwise.  This behaviour has been observed when using the
+ * driver on a systemimager client during installation.  In the past a
+ * timer was used to send INQ_TALLIES commands when there was no other
+ * activity, but it was troublesome and was removed.
+ */
+
+#define USB_COMPAQ_VENDOR_ID     0x049f /* Compaq Computer Corp. */
+#define USB_COMPAQ_WL215_ID      0x001f /* Compaq WL215 USB Adapter */
+#define USB_COMPAQ_W200_ID       0x0076 /* Compaq W200 USB Adapter */
+#define USB_HP_WL215_ID          0x0082 /* Compaq WL215 USB Adapter */
+
+#define USB_MELCO_VENDOR_ID      0x0411
+#define USB_BUFFALO_L11_ID       0x0006 /* BUFFALO WLI-USB-L11 */
+#define USB_BUFFALO_L11G_WR_ID   0x000B /* BUFFALO WLI-USB-L11G-WR */
+#define USB_BUFFALO_L11G_ID      0x000D /* BUFFALO WLI-USB-L11G */
+
+#define USB_LUCENT_VENDOR_ID     0x047E /* Lucent Technologies */
+#define USB_LUCENT_ORINOCO_ID    0x0300 /* Lucent/Agere Orinoco USB Client */
+
+#define USB_AVAYA8_VENDOR_ID     0x0D98
+#define USB_AVAYAE_VENDOR_ID     0x0D9E
+#define USB_AVAYA_WIRELESS_ID    0x0300 /* Avaya Wireless USB Card */
+
+#define USB_AGERE_VENDOR_ID      0x0D4E /* Agere Systems */
+#define USB_AGERE_MODEL0801_ID   0x1000 /* Wireless USB Card Model 0801 */
+#define USB_AGERE_MODEL0802_ID   0x1001 /* Wireless USB Card Model 0802 */
+#define USB_AGERE_REBRANDED_ID   0x047A /* WLAN USB Card */
+
+#define USB_ELSA_VENDOR_ID       0x05CC
+#define USB_ELSA_AIRLANCER_ID    0x3100 /* ELSA AirLancer USB-11 */
+
+#define USB_LEGEND_VENDOR_ID     0x0E7C
+#define USB_LEGEND_JOYNET_ID     0x0300 /* Joynet WLAN USB Card */
+
+#define USB_SAMSUNG_VENDOR_ID    0x04E8
+#define USB_SAMSUNG_SEW2001U1_ID 0x5002 /* Samsung SEW-2001u Card */
+#define USB_SAMSUNG_SEW2001U2_ID 0x5B11 /* Samsung SEW-2001u Card */
+#define USB_SAMSUNG_SEW2003U_ID  0x7011 /* Samsung SEW-2003U Card */
+
+#define USB_IGATE_VENDOR_ID      0x0681
+#define USB_IGATE_IGATE_11M_ID   0x0012 /* I-GATE 11M USB Card */
+
+#define USB_FUJITSU_VENDOR_ID    0x0BF8
+#define USB_FUJITSU_E1100_ID     0x1002 /* connect2AIR WLAN E-1100 USB */
+
+#define USB_2WIRE_VENDOR_ID      0x1630
+#define USB_2WIRE_WIRELESS_ID    0xff81 /* 2Wire Wireless USB adapter */
+
+
+#define EZUSB_REQUEST_FW_TRANS          0xA0
+#define EZUSB_REQUEST_TRIGER            0xAA
+#define EZUSB_REQUEST_TRIG_AC           0xAC
+#define EZUSB_CPUCS_REG                 0x7F92
+
+#define EZUSB_RID_TX                    0x0700
+#define EZUSB_RID_RX                    0x0701
+#define EZUSB_RID_INIT1                 0x0702
+#define EZUSB_RID_ACK                   0x0710
+#define EZUSB_RID_READ_PDA              0x0800
+#define EZUSB_RID_PROG_INIT             0x0852
+#define EZUSB_RID_PROG_SET_ADDR         0x0853
+#define EZUSB_RID_PROG_BYTES            0x0854
+#define EZUSB_RID_PROG_END              0x0855
+#define EZUSB_RID_DOCMD                 0x0860
+
+/* Recognize info frames */
+#define EZUSB_IS_INFO(id)               ((id >= 0xF000) && (id <= 0xF2FF))
+
+#define EZUSB_MAGIC                     0x0210
+
+#define EZUSB_FRAME_DATA                1
+#define EZUSB_FRAME_CONTROL             2
+
+#define DEF_TIMEOUT                     (3*HZ)
+
+#define BULK_BUF_SIZE                   2048
+
+#define MAX_DL_SIZE (BULK_BUF_SIZE - sizeof(struct ezusb_packet))
+
+#define FW_BUF_SIZE                     64
+#define FW_VAR_OFFSET_PTR               0x359
+#define FW_VAR_VALUE                    0
+#define FW_HOLE_START                   0x100
+#define FW_HOLE_END                     0x300
+
+struct ezusb_packet {
+        __le16 magic;           /* 0x0210 */
+        u8 req_reply_count;
+        u8 ans_reply_count;
+        __le16 frame_type;      /* 0x01 for data frames, 0x02 otherwise */
+        __le16 size;            /* transport size */
+        __le16 crc;             /* CRC up to here */
+        __le16 hermes_len;
+        __le16 hermes_rid;
+        u8 data[0];
+} __attribute__ ((packed));
+
+/* Table of devices that work or may work with this driver */
+static struct usb_device_id ezusb_table[] = {
+        {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_WL215_ID)},
+        {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_HP_WL215_ID)},
+        {USB_DEVICE(USB_COMPAQ_VENDOR_ID, USB_COMPAQ_W200_ID)},
+        {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11_ID)},
+        {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_WR_ID)},
+        {USB_DEVICE(USB_MELCO_VENDOR_ID, USB_BUFFALO_L11G_ID)},
+        {USB_DEVICE(USB_LUCENT_VENDOR_ID, USB_LUCENT_ORINOCO_ID)},
+        {USB_DEVICE(USB_AVAYA8_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
+        {USB_DEVICE(USB_AVAYAE_VENDOR_ID, USB_AVAYA_WIRELESS_ID)},
+        {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0801_ID)},
+        {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_MODEL0802_ID)},
+        {USB_DEVICE(USB_ELSA_VENDOR_ID, USB_ELSA_AIRLANCER_ID)},
+        {USB_DEVICE(USB_LEGEND_VENDOR_ID, USB_LEGEND_JOYNET_ID)},
+        {USB_DEVICE_VER(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U1_ID,
+                        0, 0)},
+        {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2001U2_ID)},
+        {USB_DEVICE(USB_SAMSUNG_VENDOR_ID, USB_SAMSUNG_SEW2003U_ID)},
+        {USB_DEVICE(USB_IGATE_VENDOR_ID, USB_IGATE_IGATE_11M_ID)},
+        {USB_DEVICE(USB_FUJITSU_VENDOR_ID, USB_FUJITSU_E1100_ID)},
+        {USB_DEVICE(USB_2WIRE_VENDOR_ID, USB_2WIRE_WIRELESS_ID)},
+        {USB_DEVICE(USB_AGERE_VENDOR_ID, USB_AGERE_REBRANDED_ID)},
+        {}                      /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, ezusb_table);
+
+/* Structure to hold all of our device specific stuff */
+struct ezusb_priv {
+        struct usb_device *udev;
+        struct net_device *dev;
+        struct mutex mtx;
+        spinlock_t req_lock;
+        struct list_head req_pending;
+        struct list_head req_active;
+        spinlock_t reply_count_lock;
+        u16 hermes_reg_fake[0x40];
+        u8 *bap_buf;
+        struct urb *read_urb;
+        int read_pipe;
+        int write_pipe;
+        u8 reply_count;
+};
+
+enum ezusb_state {
+        EZUSB_CTX_START,
+        EZUSB_CTX_QUEUED,
+        EZUSB_CTX_REQ_SUBMITTED,
+        EZUSB_CTX_REQ_COMPLETE,
+        EZUSB_CTX_RESP_RECEIVED,
+        EZUSB_CTX_REQ_TIMEOUT,
+        EZUSB_CTX_REQ_FAILED,
+        EZUSB_CTX_RESP_TIMEOUT,
+        EZUSB_CTX_REQSUBMIT_FAIL,
+        EZUSB_CTX_COMPLETE,
+};
+
+struct request_context {
+        struct list_head list;
+        atomic_t refcount;
+        struct completion done; /* Signals that CTX is dead */
+        int killed;
+        struct urb *outurb;     /* OUT for req pkt */
+        struct ezusb_priv *upriv;
+        struct ezusb_packet *buf;
+        int buf_length;
+        struct timer_list timer;        /* Timeout handling */
+        enum ezusb_state state; /* Current state */
+        /* the RID that we will wait for */
+        u16 out_rid;
+        u16 in_rid;
+};
+
+
+/* Forward declarations */
+static void ezusb_ctx_complete(struct request_context *ctx);
+static void ezusb_req_queue_run(struct ezusb_priv *upriv);
+static void ezusb_bulk_in_callback(struct urb *urb);
+
+static inline u8 ezusb_reply_inc(u8 count)
+{
+        if (count < 0x7F)
+                return count + 1;
+        else
+                return 1;
+}
+
+static void ezusb_request_context_put(struct request_context *ctx)
+{
+        if (!atomic_dec_and_test(&ctx->refcount))
+                return;
+
+        WARN_ON(!ctx->done.done);
+        BUG_ON(ctx->outurb->status == -EINPROGRESS);
+        BUG_ON(timer_pending(&ctx->timer));
+        usb_free_urb(ctx->outurb);
+        kfree(ctx->buf);
+        kfree(ctx);
+}
+
+static inline void ezusb_mod_timer(struct ezusb_priv *upriv,
+                                   struct timer_list *timer,
+                                   unsigned long expire)
+{
+        if (!upriv->udev)
+                return;
+        mod_timer(timer, expire);
+}
+
+static void ezusb_request_timerfn(u_long _ctx)
+{
+        struct request_context *ctx = (void *) _ctx;
+
+        ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
+        if (usb_unlink_urb(ctx->outurb) == -EINPROGRESS) {
+                ctx->state = EZUSB_CTX_REQ_TIMEOUT;
+        } else {
+                ctx->state = EZUSB_CTX_RESP_TIMEOUT;
+                dbg("couldn't unlink");
+                atomic_inc(&ctx->refcount);
+                ctx->killed = 1;
+                ezusb_ctx_complete(ctx);
+                ezusb_request_context_put(ctx);
+        }
+};
+
+static struct request_context *ezusb_alloc_ctx(struct ezusb_priv *upriv,
+                                               u16 out_rid, u16 in_rid)
+{
+        struct request_context *ctx;
+
+        ctx = kmalloc(sizeof(*ctx), GFP_ATOMIC);
+        if (!ctx)
+                return NULL;
+
+        memset(ctx, 0, sizeof(*ctx));
+
+        ctx->buf = kmalloc(BULK_BUF_SIZE, GFP_ATOMIC);
+        if (!ctx->buf) {
+                kfree(ctx);
+                return NULL;
+        }
+        ctx->outurb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!ctx->outurb) {
+                kfree(ctx->buf);
+                kfree(ctx);
+                return NULL;
+        }
+
+        ctx->upriv = upriv;
+        ctx->state = EZUSB_CTX_START;
+        ctx->out_rid = out_rid;
+        ctx->in_rid = in_rid;
+
+        atomic_set(&ctx->refcount, 1);
+        init_completion(&ctx->done);
+
+        init_timer(&ctx->timer);
+        ctx->timer.function = ezusb_request_timerfn;
+        ctx->timer.data = (u_long) ctx;
+        return ctx;
+}
+
+
+/* Hopefully the real complete_all will soon be exported, in the mean
+ * while this should work. */
+static inline void ezusb_complete_all(struct completion *comp)
+{
+        complete(comp);
+        complete(comp);
+        complete(comp);
+        complete(comp);
+}
+
+static void ezusb_ctx_complete(struct request_context *ctx)
+{
+        struct ezusb_priv *upriv = ctx->upriv;
+        unsigned long flags;
+
+        spin_lock_irqsave(&upriv->req_lock, flags);
+
+        list_del_init(&ctx->list);
+        if (upriv->udev) {
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                ezusb_req_queue_run(upriv);
+                spin_lock_irqsave(&upriv->req_lock, flags);
+        }
+
+        switch (ctx->state) {
+        case EZUSB_CTX_COMPLETE:
+        case EZUSB_CTX_REQSUBMIT_FAIL:
+        case EZUSB_CTX_REQ_FAILED:
+        case EZUSB_CTX_REQ_TIMEOUT:
+        case EZUSB_CTX_RESP_TIMEOUT:
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                if ((ctx->out_rid == EZUSB_RID_TX) && upriv->dev) {
+                        struct net_device *dev = upriv->dev;
+                        struct orinoco_private *priv = ndev_priv(dev);
+                        struct net_device_stats *stats = &priv->stats;
+
+                        if (ctx->state != EZUSB_CTX_COMPLETE)
+                                stats->tx_errors++;
+                        else
+                                stats->tx_packets++;
+
+                        netif_wake_queue(dev);
+                }
+                ezusb_complete_all(&ctx->done);
+                ezusb_request_context_put(ctx);
+                break;
+
+        default:
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                if (!upriv->udev) {
+                        /* This is normal, as all request contexts get flushed
+                         * when the device is disconnected */
+                        err("Called, CTX not terminating, but device gone");
+                        ezusb_complete_all(&ctx->done);
+                        ezusb_request_context_put(ctx);
+                        break;
+                }
+
+                err("Called, CTX not in terminating state.");
+                /* Things are really bad if this happens. Just leak
+                 * the CTX because it may still be linked to the
+                 * queue or the OUT urb may still be active.
+                 * Just leaking at least prevents an Oops or Panic.
+                 */
+                break;
+        }
+}
+
+/**
+ * ezusb_req_queue_run:
+ * Description:
+ *      Note: Only one active CTX at any one time, because there's no
+ *      other (reliable) way to match the response URB to the correct
+ *      CTX.
+ **/
+static void ezusb_req_queue_run(struct ezusb_priv *upriv)
+{
+        unsigned long flags;
+        struct request_context *ctx;
+        int result;
+
+        spin_lock_irqsave(&upriv->req_lock, flags);
+
+        if (!list_empty(&upriv->req_active))
+                goto unlock;
+
+        if (list_empty(&upriv->req_pending))
+                goto unlock;
+
+        ctx =
+            list_entry(upriv->req_pending.next, struct request_context,
+                       list);
+
+        if (!ctx->upriv->udev)
+                goto unlock;
+
+        /* We need to split this off to avoid a race condition */
+        list_move_tail(&ctx->list, &upriv->req_active);
+
+        if (ctx->state == EZUSB_CTX_QUEUED) {
+                atomic_inc(&ctx->refcount);
+                result = usb_submit_urb(ctx->outurb, GFP_ATOMIC);
+                if (result) {
+                        ctx->state = EZUSB_CTX_REQSUBMIT_FAIL;
+
+                        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                        err("Fatal, failed to submit command urb."
+                            " error=%d\n", result);
+
+                        ezusb_ctx_complete(ctx);
+                        ezusb_request_context_put(ctx);
+                        goto done;
+                }
+
+                ctx->state = EZUSB_CTX_REQ_SUBMITTED;
+                ezusb_mod_timer(ctx->upriv, &ctx->timer,
+                                jiffies + DEF_TIMEOUT);
+        }
+
+ unlock:
+        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+ done:
+        return;
+}
+
+static void ezusb_req_enqueue_run(struct ezusb_priv *upriv,
+                                  struct request_context *ctx)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&upriv->req_lock, flags);
+
+        if (!ctx->upriv->udev) {
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                goto done;
+        }
+        atomic_inc(&ctx->refcount);
+        list_add_tail(&ctx->list, &upriv->req_pending);
+        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+        ctx->state = EZUSB_CTX_QUEUED;
+        ezusb_req_queue_run(upriv);
+
+ done:
+        return;
+}
+
+static void ezusb_request_out_callback(struct urb *urb)
+{
+        unsigned long flags;
+        enum ezusb_state state;
+        struct request_context *ctx = urb->context;
+        struct ezusb_priv *upriv = ctx->upriv;
+
+        spin_lock_irqsave(&upriv->req_lock, flags);
+
+        del_timer(&ctx->timer);
+
+        if (ctx->killed) {
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                pr_warning("interrupt called with dead ctx");
+                goto out;
+        }
+
+        state = ctx->state;
+
+        if (urb->status == 0) {
+                switch (state) {
+                case EZUSB_CTX_REQ_SUBMITTED:
+                        if (ctx->in_rid) {
+                                ctx->state = EZUSB_CTX_REQ_COMPLETE;
+                                /* reply URB still pending */
+                                ezusb_mod_timer(upriv, &ctx->timer,
+                                                jiffies + DEF_TIMEOUT);
+                                spin_unlock_irqrestore(&upriv->req_lock,
+                                                       flags);
+                                break;
+                        }
+                        /* fall through */
+                case EZUSB_CTX_RESP_RECEIVED:
+                        /* IN already received before this OUT-ACK */
+                        ctx->state = EZUSB_CTX_COMPLETE;
+                        spin_unlock_irqrestore(&upriv->req_lock, flags);
+                        ezusb_ctx_complete(ctx);
+                        break;
+
+                default:
+                        spin_unlock_irqrestore(&upriv->req_lock, flags);
+                        err("Unexpected state(0x%x, %d) in OUT URB",
+                            state, urb->status);
+                        break;
+                }
+        } else {
+                /* If someone cancels the OUT URB then its status
+                 * should be either -ECONNRESET or -ENOENT.
+                 */
+                switch (state) {
+                case EZUSB_CTX_REQ_SUBMITTED:
+                case EZUSB_CTX_RESP_RECEIVED:
+                        ctx->state = EZUSB_CTX_REQ_FAILED;
+                        /* fall through */
+
+                case EZUSB_CTX_REQ_FAILED:
+                case EZUSB_CTX_REQ_TIMEOUT:
+                        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                        ezusb_ctx_complete(ctx);
+                        break;
+
+                default:
+                        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                        err("Unexpected state(0x%x, %d) in OUT URB",
+                            state, urb->status);
+                        break;
+                }
+        }
+ out:
+        ezusb_request_context_put(ctx);
+}
+
+static void ezusb_request_in_callback(struct ezusb_priv *upriv,
+                                      struct urb *urb)
+{
+        struct ezusb_packet *ans = urb->transfer_buffer;
+        struct request_context *ctx = NULL;
+        enum ezusb_state state;
+        unsigned long flags;
+
+        /* Find the CTX on the active queue that requested this URB */
+        spin_lock_irqsave(&upriv->req_lock, flags);
+        if (upriv->udev) {
+                struct list_head *item;
+
+                list_for_each(item, &upriv->req_active) {
+                        struct request_context *c;
+                        int reply_count;
+
+                        c = list_entry(item, struct request_context, list);
+                        reply_count =
+                            ezusb_reply_inc(c->buf->req_reply_count);
+                        if ((ans->ans_reply_count == reply_count)
+                            && (le16_to_cpu(ans->hermes_rid) == c->in_rid)) {
+                                ctx = c;
+                                break;
+                        }
+                        dbg("Skipped (0x%x/0x%x) (%d/%d)",
+                            le16_to_cpu(ans->hermes_rid),
+                            c->in_rid, ans->ans_reply_count, reply_count);
+                }
+        }
+
+        if (ctx == NULL) {
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                err("%s: got unexpected RID: 0x%04X", __func__,
+                    le16_to_cpu(ans->hermes_rid));
+                ezusb_req_queue_run(upriv);
+                return;
+        }
+
+        /* The data we want is in the in buffer, exchange */
+        urb->transfer_buffer = ctx->buf;
+        ctx->buf = (void *) ans;
+        ctx->buf_length = urb->actual_length;
+
+        state = ctx->state;
+        switch (state) {
+        case EZUSB_CTX_REQ_SUBMITTED:
+                /* We have received our response URB before
+                 * our request has been acknowledged. Do NOT
+                 * destroy our CTX yet, because our OUT URB
+                 * is still alive ...
+                 */
+                ctx->state = EZUSB_CTX_RESP_RECEIVED;
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                /* Let the machine continue running. */
+                break;
+
+        case EZUSB_CTX_REQ_COMPLETE:
+                /* This is the usual path: our request
+                 * has already been acknowledged, and
+                 * we have now received the reply.
+                 */
+                ctx->state = EZUSB_CTX_COMPLETE;
+
+                /* Stop the intimer */
+                del_timer(&ctx->timer);
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                /* Call the completion handler */
+                ezusb_ctx_complete(ctx);
+                break;
+
+        default:
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+                pr_warning("Matched IN URB, unexpected context state(0x%x)",
+                     state);
+                /* Throw this CTX away and try submitting another */
+                del_timer(&ctx->timer);
+                ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
+                usb_unlink_urb(ctx->outurb);
+                ezusb_req_queue_run(upriv);
+                break;
+        }                       /* switch */
+}
+
+
+static void ezusb_req_ctx_wait(struct ezusb_priv *upriv,
+                               struct request_context *ctx)
+{
+        switch (ctx->state) {
+        case EZUSB_CTX_QUEUED:
+        case EZUSB_CTX_REQ_SUBMITTED:
+        case EZUSB_CTX_REQ_COMPLETE:
+        case EZUSB_CTX_RESP_RECEIVED:
+                if (in_softirq()) {
+                        /* If we get called from a timer, timeout timers don't
+                         * get the chance to run themselves. So we make sure
+                         * that we don't sleep for ever */
+                        int msecs = DEF_TIMEOUT * (1000 / HZ);
+                        while (!ctx->done.done && msecs--)
+                                udelay(1000);
+                } else {
+                        wait_event_interruptible(ctx->done.wait,
+                                                 ctx->done.done);
+                }
+                break;
+        default:
+                /* Done or failed - nothing to wait for */
+                break;
+        }
+}
+
+static inline u16 build_crc(struct ezusb_packet *data)
+{
+        u16 crc = 0;
+        u8 *bytes = (u8 *)data;
+        int i;
+
+        for (i = 0; i < 8; i++)
+                crc = (crc << 1) + bytes[i];
+
+        return crc;
+}
+
+/**
+ * ezusb_fill_req:
+ *
+ * if data == NULL and length > 0 the data is assumed to be already in
+ * the target buffer and only the header is filled.
+ *
+ */
+static int ezusb_fill_req(struct ezusb_packet *req, u16 length, u16 rid,
+                          const void *data, u16 frame_type, u8 reply_count)
+{
+        int total_size = sizeof(*req) + length;
+
+        BUG_ON(total_size > BULK_BUF_SIZE);
+
+        req->magic = cpu_to_le16(EZUSB_MAGIC);
+        req->req_reply_count = reply_count;
+        req->ans_reply_count = 0;
+        req->frame_type = cpu_to_le16(frame_type);
+        req->size = cpu_to_le16(length + 4);
+        req->crc = cpu_to_le16(build_crc(req));
+        req->hermes_len = cpu_to_le16(HERMES_BYTES_TO_RECLEN(length));
+        req->hermes_rid = cpu_to_le16(rid);
+        if (data)
+                memcpy(req->data, data, length);
+        return total_size;
+}
+
+static int ezusb_submit_in_urb(struct ezusb_priv *upriv)
+{
+        int retval = 0;
+        void *cur_buf = upriv->read_urb->transfer_buffer;
+
+        if (upriv->read_urb->status == -EINPROGRESS) {
+                dbg("urb busy, not resubmiting");
+                retval = -EBUSY;
+                goto exit;
+        }
+        usb_fill_bulk_urb(upriv->read_urb, upriv->udev, upriv->read_pipe,
+                          cur_buf, BULK_BUF_SIZE,
+                          ezusb_bulk_in_callback, upriv);
+        upriv->read_urb->transfer_flags = 0;
+        retval = usb_submit_urb(upriv->read_urb, GFP_ATOMIC);
+        if (retval)
+                err("%s submit failed %d", __func__, retval);
+
+ exit:
+        return retval;
+}
+
+static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)
+{
+        u8 res_val = reset;     /* avoid argument promotion */
+
+        if (!upriv->udev) {
+                err("%s: !upriv->udev", __func__);
+                return -EFAULT;
+        }
+        return usb_control_msg(upriv->udev,
+                               usb_sndctrlpipe(upriv->udev, 0),
+                               EZUSB_REQUEST_FW_TRANS,
+                               USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+                               USB_DIR_OUT, EZUSB_CPUCS_REG, 0, &res_val,
+                               sizeof(res_val), DEF_TIMEOUT);
+}
+
+static int ezusb_firmware_download(struct ezusb_priv *upriv,
+                                   struct ez_usb_fw *fw)
+{
+        u8 fw_buffer[FW_BUF_SIZE];
+        int retval, addr;
+        int variant_offset;
+
+        /*
+         * This byte is 1 and should be replaced with 0.  The offset is
+         * 0x10AD in version 0.0.6.  The byte in question should follow
+         * the end of the code pointed to by the jump in the beginning
+         * of the firmware.  Also, it is read by code located at 0x358.
+         */
+        variant_offset = be16_to_cpup((__be16 *) &fw->code[FW_VAR_OFFSET_PTR]);
+        if (variant_offset >= fw->size) {
+                printk(KERN_ERR PFX "Invalid firmware variant offset: "
+                       "0x%04x\n", variant_offset);
+                retval = -EINVAL;
+                goto fail;
+        }
+
+        retval = ezusb_8051_cpucs(upriv, 1);
+        if (retval < 0)
+                goto fail;
+        for (addr = 0; addr < fw->size; addr += FW_BUF_SIZE) {
+                /* 0x100-0x300 should be left alone, it contains card
+                 * specific data, like USB enumeration information */
+                if ((addr >= FW_HOLE_START) && (addr < FW_HOLE_END))
+                        continue;
+
+                memcpy(fw_buffer, &fw->code[addr], FW_BUF_SIZE);
+                if (variant_offset >= addr &&
+                    variant_offset < addr + FW_BUF_SIZE) {
+                        dbg("Patching card_variant byte at 0x%04X",
+                            variant_offset);
+                        fw_buffer[variant_offset - addr] = FW_VAR_VALUE;
+                }
+                retval = usb_control_msg(upriv->udev,
+                                         usb_sndctrlpipe(upriv->udev, 0),
+                                         EZUSB_REQUEST_FW_TRANS,
+                                         USB_TYPE_VENDOR | USB_RECIP_DEVICE
+                                         | USB_DIR_OUT,
+                                         addr, 0x0,
+                                         fw_buffer, FW_BUF_SIZE,
+                                         DEF_TIMEOUT);
+
+                if (retval < 0)
+                        goto fail;
+        }
+        retval = ezusb_8051_cpucs(upriv, 0);
+        if (retval < 0)
+                goto fail;
+
+        goto exit;
+ fail:
+        printk(KERN_ERR PFX "Firmware download failed, error %d\n",
+               retval);
+ exit:
+        return retval;
+}
+
+static int ezusb_access_ltv(struct ezusb_priv *upriv,
+                            struct request_context *ctx,
+                            u16 length, const void *data, u16 frame_type,
+                            void *ans_buff, int ans_size, u16 *ans_length)
+{
+        int req_size;
+        int retval = 0;
+        enum ezusb_state state;
+
+        BUG_ON(in_irq());
+
+        if (!upriv->udev) {
+                dbg("Device disconnected");
+                return -ENODEV;
+        }
+
+        if (upriv->read_urb->status != -EINPROGRESS)
+                err("%s: in urb not pending", __func__);
+
+        /* protect upriv->reply_count, guarantee sequential numbers */
+        spin_lock_bh(&upriv->reply_count_lock);
+        req_size = ezusb_fill_req(ctx->buf, length, ctx->out_rid, data,
+                                  frame_type, upriv->reply_count);
+        usb_fill_bulk_urb(ctx->outurb, upriv->udev, upriv->write_pipe,
+                          ctx->buf, req_size,
+                          ezusb_request_out_callback, ctx);
+
+        if (ctx->in_rid)
+                upriv->reply_count = ezusb_reply_inc(upriv->reply_count);
+
+        ezusb_req_enqueue_run(upriv, ctx);
+
+        spin_unlock_bh(&upriv->reply_count_lock);
+
+        if (ctx->in_rid)
+                ezusb_req_ctx_wait(upriv, ctx);
+
+        state = ctx->state;
+        switch (state) {
+        case EZUSB_CTX_COMPLETE:
+                retval = ctx->outurb->status;
+                break;
+
+        case EZUSB_CTX_QUEUED:
+        case EZUSB_CTX_REQ_SUBMITTED:
+                if (!ctx->in_rid)
+                        break;
+        default:
+                err("%s: Unexpected context state %d", __func__,
+                    state);
+                /* fall though */
+        case EZUSB_CTX_REQ_TIMEOUT:
+        case EZUSB_CTX_REQ_FAILED:
+        case EZUSB_CTX_RESP_TIMEOUT:
+        case EZUSB_CTX_REQSUBMIT_FAIL:
+                printk(KERN_ERR PFX "Access failed, resetting (state %d,"
+                       " reply_count %d)\n", state, upriv->reply_count);
+                upriv->reply_count = 0;
+                if (state == EZUSB_CTX_REQ_TIMEOUT
+                    || state == EZUSB_CTX_RESP_TIMEOUT) {
+                        printk(KERN_ERR PFX "ctx timed out\n");
+                        retval = -ETIMEDOUT;
+                } else {
+                        printk(KERN_ERR PFX "ctx failed\n");
+                        retval = -EFAULT;
+                }
+                goto exit;
+                break;
+        }
+        if (ctx->in_rid) {
+                struct ezusb_packet *ans = ctx->buf;
+                int exp_len;
+
+                if (ans->hermes_len != 0)
+                        exp_len = le16_to_cpu(ans->hermes_len) * 2 + 12;
+                else
+                        exp_len = 14;
+
+                if (exp_len != ctx->buf_length) {
+                        err("%s: length mismatch for RID 0x%04x: "
+                            "expected %d, got %d", __func__,
+                            ctx->in_rid, exp_len, ctx->buf_length);
+                        retval = -EIO;
+                        goto exit;
+                }
+
+                if (ans_buff)
+                        memcpy(ans_buff, ans->data,
+                               min_t(int, exp_len, ans_size));
+                if (ans_length)
+                        *ans_length = le16_to_cpu(ans->hermes_len);
+        }
+ exit:
+        ezusb_request_context_put(ctx);
+        return retval;
+}
+
+static int ezusb_write_ltv(hermes_t *hw, int bap, u16 rid,
+                           u16 length, const void *data)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        u16 frame_type;
+        struct request_context *ctx;
+
+        if (length == 0)
+                return -EINVAL;
+
+        length = HERMES_RECLEN_TO_BYTES(length);
+
+        /* On memory mapped devices HERMES_RID_CNFGROUPADDRESSES can be
+         * set to be empty, but the USB bridge doesn't like it */
+        if (length == 0)
+                return 0;
+
+        ctx = ezusb_alloc_ctx(upriv, rid, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        if (rid == EZUSB_RID_TX)
+                frame_type = EZUSB_FRAME_DATA;
+        else
+                frame_type = EZUSB_FRAME_CONTROL;
+
+        return ezusb_access_ltv(upriv, ctx, length, data, frame_type,
+                                NULL, 0, NULL);
+}
+
+static int ezusb_read_ltv(hermes_t *hw, int bap, u16 rid,
+                          unsigned bufsize, u16 *length, void *buf)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+
+        if ((bufsize < 0) || (bufsize % 2))
+                return -EINVAL;
+
+        ctx = ezusb_alloc_ctx(upriv, rid, rid);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, 0, NULL, EZUSB_FRAME_CONTROL,
+                                buf, bufsize, length);
+}
+
+static int ezusb_doicmd_wait(hermes_t *hw, u16 cmd, u16 parm0, u16 parm1,
+                             u16 parm2, struct hermes_response *resp)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+
+        __le16 data[4] = {
+                cpu_to_le16(cmd),
+                cpu_to_le16(parm0),
+                cpu_to_le16(parm1),
+                cpu_to_le16(parm2),
+        };
+        dbg("0x%04X, parm0 0x%04X, parm1 0x%04X, parm2 0x%04X",
+            cmd, parm0, parm1, parm2);
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
+                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+}
+
+static int ezusb_docmd_wait(hermes_t *hw, u16 cmd, u16 parm0,
+                            struct hermes_response *resp)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+
+        __le16 data[4] = {
+                cpu_to_le16(cmd),
+                cpu_to_le16(parm0),
+                0,
+                0,
+        };
+        dbg("0x%04X, parm0 0x%04X", cmd, parm0);
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_DOCMD, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
+                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+}
+
+static int ezusb_bap_pread(struct hermes *hw, int bap,
+                           void *buf, int len, u16 id, u16 offset)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct ezusb_packet *ans = (void *) upriv->read_urb->transfer_buffer;
+        int actual_length = upriv->read_urb->actual_length;
+
+        if (id == EZUSB_RID_RX) {
+                if ((sizeof(*ans) + offset + len) > actual_length) {
+                        printk(KERN_ERR PFX "BAP read beyond buffer end "
+                               "in rx frame\n");
+                        return -EINVAL;
+                }
+                memcpy(buf, ans->data + offset, len);
+                return 0;
+        }
+
+        if (EZUSB_IS_INFO(id)) {
+                /* Include 4 bytes for length/type */
+                if ((sizeof(*ans) + offset + len - 4) > actual_length) {
+                        printk(KERN_ERR PFX "BAP read beyond buffer end "
+                               "in info frame\n");
+                        return -EFAULT;
+                }
+                memcpy(buf, ans->data + offset - 4, len);
+        } else {
+                printk(KERN_ERR PFX "Unexpected fid 0x%04x\n", id);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static int ezusb_read_pda(struct hermes *hw, __le16 *pda,
+                          u32 pda_addr, u16 pda_len)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+        __le16 data[] = {
+                cpu_to_le16(pda_addr & 0xffff),
+                cpu_to_le16(pda_len - 4)
+        };
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_READ_PDA, EZUSB_RID_READ_PDA);
+        if (!ctx)
+                return -ENOMEM;
+
+        /* wl_lkm does not include PDA size in the PDA area.
+         * We will pad the information into pda, so other routines
+         * don't have to be modified */
+        pda[0] = cpu_to_le16(pda_len - 2);
+        /* Includes CFG_PROD_DATA but not itself */
+        pda[1] = cpu_to_le16(0x0800); /* CFG_PROD_DATA */
+
+        return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
+                                EZUSB_FRAME_CONTROL, &pda[2], pda_len - 4,
+                                NULL);
+}
+
+static int ezusb_program_init(struct hermes *hw, u32 entry_point)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+        __le32 data = cpu_to_le32(entry_point);
+
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_INIT, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
+                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+}
+
+static int ezusb_program_end(struct hermes *hw)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_END, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, 0, NULL,
+                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+}
+
+static int ezusb_program_bytes(struct hermes *hw, const char *buf,
+                               u32 addr, u32 len)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        struct request_context *ctx;
+        __le32 data = cpu_to_le32(addr);
+        int err;
+
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_SET_ADDR, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        err = ezusb_access_ltv(upriv, ctx, sizeof(data), &data,
+                               EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+        if (err)
+                return err;
+
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_PROG_BYTES, EZUSB_RID_ACK);
+        if (!ctx)
+                return -ENOMEM;
+
+        return ezusb_access_ltv(upriv, ctx, len, buf,
+                                EZUSB_FRAME_CONTROL, NULL, 0, NULL);
+}
+
+static int ezusb_program(struct hermes *hw, const char *buf,
+                         u32 addr, u32 len)
+{
+        u32 ch_addr;
+        u32 ch_len;
+        int err = 0;
+
+        /* We can only send 2048 bytes out of the bulk xmit at a time,
+         * so we have to split any programming into chunks of <2048
+         * bytes. */
+
+        ch_len = (len < MAX_DL_SIZE) ? len : MAX_DL_SIZE;
+        ch_addr = addr;
+
+        while (ch_addr < (addr + len)) {
+                pr_debug("Programming subblock of length %d "
+                         "to address 0x%08x. Data @ %p\n",
+                         ch_len, ch_addr, &buf[ch_addr - addr]);
+
+                err = ezusb_program_bytes(hw, &buf[ch_addr - addr],
+                                          ch_addr, ch_len);
+                if (err)
+                        break;
+
+                ch_addr += ch_len;
+                ch_len = ((addr + len - ch_addr) < MAX_DL_SIZE) ?
+                        (addr + len - ch_addr) : MAX_DL_SIZE;
+        }
+
+        return err;
+}
+
+static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct orinoco_private *priv = ndev_priv(dev);
+        struct net_device_stats *stats = &priv->stats;
+        struct ezusb_priv *upriv = priv->card;
+        int err = 0;
+        char *p;
+        struct ethhdr *eh;
+        int len, data_len, data_off;
+        __le16 tx_control;
+        unsigned long flags;
+        struct request_context *ctx;
+        u8 *buf;
+        int tx_size;
+
+        if (!netif_running(dev)) {
+                printk(KERN_ERR "%s: Tx on stopped device!\n",
+                       dev->name);
+                return NETDEV_TX_BUSY;
+        }
+
+        if (netif_queue_stopped(dev)) {
+                printk(KERN_DEBUG "%s: Tx while transmitter busy!\n",
+                       dev->name);
+                return NETDEV_TX_BUSY;
+        }
+
+        if (orinoco_lock(priv, &flags) != 0) {
+                printk(KERN_ERR
+                       "%s: orinoco_xmit() called while hw_unavailable\n",
+                       dev->name);
+                return NETDEV_TX_BUSY;
+        }
+
+        if (!netif_carrier_ok(dev) ||
+            (priv->iw_mode == NL80211_IFTYPE_MONITOR)) {
+                /* Oops, the firmware hasn't established a connection,
+                   silently drop the packet (this seems to be the
+                   safest approach). */
+                stats->tx_errors++;
+                orinoco_unlock(priv, &flags);
+                dev_kfree_skb(skb);
+                return NETDEV_TX_OK;
+        }
+
+        ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0);
+        if (!ctx)
+                goto fail;
+
+        memset(ctx->buf, 0, BULK_BUF_SIZE);
+        buf = ctx->buf->data;
+
+        /* Length of the packet body */
+        /* FIXME: what if the skb is smaller than this? */
+        len = max_t(int, skb->len - ETH_HLEN, ETH_ZLEN - ETH_HLEN);
+
+        eh = (struct ethhdr *) skb->data;
+
+        tx_control = cpu_to_le16(0);
+        memcpy(buf, &tx_control, sizeof(tx_control));
+        buf += sizeof(tx_control);
+        /* Encapsulate Ethernet-II frames */
+        if (ntohs(eh->h_proto) > ETH_DATA_LEN) {        /* Ethernet-II frame */
+                struct header_struct *hdr = (void *) buf;
+                buf += sizeof(*hdr);
+                data_len = len;
+                data_off = sizeof(tx_control) + sizeof(*hdr);
+                p = skb->data + ETH_HLEN;
+
+                /* 802.3 header */
+                memcpy(hdr->dest, eh->h_dest, ETH_ALEN);
+                memcpy(hdr->src, eh->h_source, ETH_ALEN);
+                hdr->len = htons(data_len + ENCAPS_OVERHEAD);
+
+                /* 802.2 header */
+                memcpy(&hdr->dsap, &encaps_hdr, sizeof(encaps_hdr));
+
+                hdr->ethertype = eh->h_proto;
+        } else {                /* IEEE 802.3 frame */
+                data_len = len + ETH_HLEN;
+                data_off = sizeof(tx_control);
+                p = skb->data;
+        }
+
+        memcpy(buf, p, data_len);
+        buf += data_len;
+
+        /* Finally, we actually initiate the send */
+        netif_stop_queue(dev);
+
+        /* The card may behave better if we send evenly sized usb transfers */
+        tx_size = ALIGN(buf - ctx->buf->data, 2);
+
+        err = ezusb_access_ltv(upriv, ctx, tx_size, NULL,
+                               EZUSB_FRAME_DATA, NULL, 0, NULL);
+
+        if (err) {
+                netif_start_queue(dev);
+                if (net_ratelimit())
+                        printk(KERN_ERR "%s: Error %d transmitting packet\n",
+                                dev->name, err);
+                stats->tx_errors++;
+                goto fail;
+        }
+
+        dev->trans_start = jiffies;
+        stats->tx_bytes += data_off + data_len;
+
+        orinoco_unlock(priv, &flags);
+
+        dev_kfree_skb(skb);
+
+        return NETDEV_TX_OK;
+
+ fail:
+        orinoco_unlock(priv, &flags);
+        return NETDEV_TX_BUSY;
+}
+
+static int ezusb_allocate(struct hermes *hw, u16 size, u16 *fid)
+{
+        *fid = EZUSB_RID_TX;
+        return 0;
+}
+
+
+static int ezusb_hard_reset(struct orinoco_private *priv)
+{
+        struct ezusb_priv *upriv = priv->card;
+        int retval = ezusb_8051_cpucs(upriv, 1);
+
+        if (retval < 0) {
+                err("Failed to reset");
+                return retval;
+        }
+
+        retval = ezusb_8051_cpucs(upriv, 0);
+        if (retval < 0) {
+                err("Failed to unreset");
+                return retval;
+        }
+
+        dbg("sending control message");
+        retval = usb_control_msg(upriv->udev,
+                                 usb_sndctrlpipe(upriv->udev, 0),
+                                 EZUSB_REQUEST_TRIGER,
+                                 USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+                                 USB_DIR_OUT, 0x0, 0x0, NULL, 0,
+                                 DEF_TIMEOUT);
+        if (retval < 0) {
+                err("EZUSB_REQUEST_TRIGER failed retval %d", retval);
+                return retval;
+        }
+#if 0
+        dbg("Sending EZUSB_REQUEST_TRIG_AC");
+        retval = usb_control_msg(upriv->udev,
+                                 usb_sndctrlpipe(upriv->udev, 0),
+                                 EZUSB_REQUEST_TRIG_AC,
+                                 USB_TYPE_VENDOR | USB_RECIP_DEVICE |
+                                 USB_DIR_OUT, 0x00FA, 0x0, NULL, 0,
+                                 DEF_TIMEOUT);
+        if (retval < 0) {
+                err("EZUSB_REQUEST_TRIG_AC failed retval %d", retval);
+                return retval;
+        }
+#endif
+
+        return 0;
+}
+
+
+static int ezusb_init(hermes_t *hw)
+{
+        struct ezusb_priv *upriv = hw->priv;
+        int retval;
+
+        BUG_ON(in_interrupt());
+        BUG_ON(!upriv);
+
+        upriv->reply_count = 0;
+        /* Write the MAGIC number on the simulated registers to keep
+         * orinoco.c happy */
+        hermes_write_regn(hw, SWSUPPORT0, HERMES_MAGIC);
+        hermes_write_regn(hw, RXFID, EZUSB_RID_RX);
+
+        usb_kill_urb(upriv->read_urb);
+        ezusb_submit_in_urb(upriv);
+
+        retval = ezusb_write_ltv(hw, 0, EZUSB_RID_INIT1,
+                                 HERMES_BYTES_TO_RECLEN(2), "\x10\x00");
+        if (retval < 0) {
+                printk(KERN_ERR PFX "EZUSB_RID_INIT1 error %d\n", retval);
+                return retval;
+        }
+
+        retval = ezusb_docmd_wait(hw, HERMES_CMD_INIT, 0, NULL);
+        if (retval < 0) {
+                printk(KERN_ERR PFX "HERMES_CMD_INIT error %d\n", retval);
+                return retval;
+        }
+
+        return 0;
+}
+
+static void ezusb_bulk_in_callback(struct urb *urb)
+{
+        struct ezusb_priv *upriv = (struct ezusb_priv *) urb->context;
+        struct ezusb_packet *ans = urb->transfer_buffer;
+        u16 crc;
+        u16 hermes_rid;
+
+        if (upriv->udev == NULL) {
+                dbg("disconnected");
+                return;
+        }
+
+        if (urb->status == -ETIMEDOUT) {
+                /* When a device gets unplugged we get this every time
+                 * we resubmit, flooding the logs.  Since we don't use
+                 * USB timeouts, it shouldn't happen any other time*/
+                pr_warning("%s: urb timed out, not resubmiting", __func__);
+                return;
+        }
+        if (urb->status == -ECONNABORTED) {
+                pr_warning("%s: connection abort, resubmiting urb",
+                     __func__);
+                goto resubmit;
+        }
+        if ((urb->status == -EILSEQ)
+            || (urb->status == -ENOENT)
+            || (urb->status == -ECONNRESET)) {
+                dbg("status %d, not resubmiting", urb->status);
+                return;
+        }
+        if (urb->status)
+                dbg("status: %d length: %d",
+                    urb->status, urb->actual_length);
+        if (urb->actual_length < sizeof(*ans)) {
+                err("%s: short read, ignoring", __func__);
+                goto resubmit;
+        }
+        crc = build_crc(ans);
+        if (le16_to_cpu(ans->crc) != crc) {
+                err("CRC error, ignoring packet");
+                goto resubmit;
+        }
+
+        hermes_rid = le16_to_cpu(ans->hermes_rid);
+        if ((hermes_rid != EZUSB_RID_RX) && !EZUSB_IS_INFO(hermes_rid)) {
+                ezusb_request_in_callback(upriv, urb);
+        } else if (upriv->dev) {
+                struct net_device *dev = upriv->dev;
+                struct orinoco_private *priv = ndev_priv(dev);
+                hermes_t *hw = &priv->hw;
+
+                if (hermes_rid == EZUSB_RID_RX) {
+                        __orinoco_ev_rx(dev, hw);
+                } else {
+                        hermes_write_regn(hw, INFOFID,
+                                          le16_to_cpu(ans->hermes_rid));
+                        __orinoco_ev_info(dev, hw);
+                }
+        }
+
+ resubmit:
+        if (upriv->udev)
+                ezusb_submit_in_urb(upriv);
+}
+
+static inline void ezusb_delete(struct ezusb_priv *upriv)
+{
+        struct net_device *dev;
+        struct list_head *item;
+        struct list_head *tmp_item;
+        unsigned long flags;
+
+        BUG_ON(in_interrupt());
+        BUG_ON(!upriv);
+
+        dev = upriv->dev;
+        mutex_lock(&upriv->mtx);
+
+        upriv->udev = NULL;     /* No timer will be rearmed from here */
+
+        usb_kill_urb(upriv->read_urb);
+
+        spin_lock_irqsave(&upriv->req_lock, flags);
+        list_for_each_safe(item, tmp_item, &upriv->req_active) {
+                struct request_context *ctx;
+                int err;
+
+                ctx = list_entry(item, struct request_context, list);
+                atomic_inc(&ctx->refcount);
+
+                ctx->outurb->transfer_flags |= URB_ASYNC_UNLINK;
+                err = usb_unlink_urb(ctx->outurb);
+
+                spin_unlock_irqrestore(&upriv->req_lock, flags);
+                if (err == -EINPROGRESS)
+                        wait_for_completion(&ctx->done);
+
+                del_timer_sync(&ctx->timer);
+                /* FIXME: there is an slight chance for the irq handler to
+                 * be running */
+                if (!list_empty(&ctx->list))
+                        ezusb_ctx_complete(ctx);
+
+                ezusb_request_context_put(ctx);
+                spin_lock_irqsave(&upriv->req_lock, flags);
+        }
+        spin_unlock_irqrestore(&upriv->req_lock, flags);
+
+        list_for_each_safe(item, tmp_item, &upriv->req_pending)
+            ezusb_ctx_complete(list_entry(item,
+                                          struct request_context, list));
+
+        if (upriv->read_urb->status == -EINPROGRESS)
+                printk(KERN_ERR PFX "Some URB in progress\n");
+
+        mutex_unlock(&upriv->mtx);
+
+        kfree(upriv->read_urb->transfer_buffer);
+        if (upriv->bap_buf != NULL)
+                kfree(upriv->bap_buf);
+        if (upriv->read_urb != NULL)
+                usb_free_urb(upriv->read_urb);
+        if (upriv->dev) {
+                struct orinoco_private *priv = ndev_priv(upriv->dev);
+                orinoco_if_del(priv);
+                free_orinocodev(priv);
+        }
+}
+
+static void ezusb_lock_irqsave(spinlock_t *lock,
+                               unsigned long *flags) __acquires(lock)
+{
+        spin_lock_bh(lock);
+}
+
+static void ezusb_unlock_irqrestore(spinlock_t *lock,
+                                    unsigned long *flags) __releases(lock)
+{
+        spin_unlock_bh(lock);
+}
+
+static void ezusb_lock_irq(spinlock_t *lock) __acquires(lock)
+{
+        spin_lock_bh(lock);
+}
+
+static void ezusb_unlock_irq(spinlock_t *lock) __releases(lock)
+{
+        spin_unlock_bh(lock);
+}
+
+static const struct hermes_ops ezusb_ops = {
+        .init = ezusb_init,
+        .cmd_wait = ezusb_docmd_wait,
+        .init_cmd_wait = ezusb_doicmd_wait,
+        .allocate = ezusb_allocate,
+        .read_ltv = ezusb_read_ltv,
+        .write_ltv = ezusb_write_ltv,
+        .bap_pread = ezusb_bap_pread,
+        .read_pda = ezusb_read_pda,
+        .program_init = ezusb_program_init,
+        .program_end = ezusb_program_end,
+        .program = ezusb_program,
+        .lock_irqsave = ezusb_lock_irqsave,
+        .unlock_irqrestore = ezusb_unlock_irqrestore,
+        .lock_irq = ezusb_lock_irq,
+        .unlock_irq = ezusb_unlock_irq,
+};
+
+static const struct net_device_ops ezusb_netdev_ops = {
+        .ndo_open               = orinoco_open,
+        .ndo_stop               = orinoco_stop,
+        .ndo_start_xmit         = ezusb_xmit,
+        .ndo_set_multicast_list = orinoco_set_multicast_list,
+        .ndo_change_mtu         = orinoco_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_tx_timeout         = orinoco_tx_timeout,
+        .ndo_get_stats          = orinoco_get_stats,
+};
+
+static int ezusb_probe(struct usb_interface *interface,
+                       const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(interface);
+        struct orinoco_private *priv;
+        hermes_t *hw;
+        struct ezusb_priv *upriv = NULL;
+        struct usb_interface_descriptor *iface_desc;
+        struct usb_endpoint_descriptor *ep;
+        const struct firmware *fw_entry;
+        int retval = 0;
+        int i;
+
+        priv = alloc_orinocodev(sizeof(*upriv), &udev->dev,
+                                ezusb_hard_reset, NULL);
+        if (!priv) {
+                err("Couldn't allocate orinocodev");
+                goto exit;
+        }
+
+        hw = &priv->hw;
+
+        upriv = priv->card;
+
+        mutex_init(&upriv->mtx);
+        spin_lock_init(&upriv->reply_count_lock);
+
+        spin_lock_init(&upriv->req_lock);
+        INIT_LIST_HEAD(&upriv->req_pending);
+        INIT_LIST_HEAD(&upriv->req_active);
+
+        upriv->udev = udev;
+
+        hw->iobase = (void __force __iomem *) &upriv->hermes_reg_fake;
+        hw->reg_spacing = HERMES_16BIT_REGSPACING;
+        hw->priv = upriv;
+        hw->ops = &ezusb_ops;
+
+        /* set up the endpoint information */
+        /* check out the endpoints */
+
+        iface_desc = &interface->altsetting[0].desc;
+        for (i = 0; i < iface_desc->bNumEndpoints; ++i) {
+                ep = &interface->altsetting[0].endpoint[i].desc;
+
+                if (((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+                     == USB_DIR_IN) &&
+                    ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                     == USB_ENDPOINT_XFER_BULK)) {
+                        /* we found a bulk in endpoint */
+                        if (upriv->read_urb != NULL) {
+                                pr_warning("Found a second bulk in ep, ignored");
+                                continue;
+                        }
+
+                        upriv->read_urb = usb_alloc_urb(0, GFP_KERNEL);
+                        if (!upriv->read_urb) {
+                                err("No free urbs available");
+                                goto error;
+                        }
+                        if (le16_to_cpu(ep->wMaxPacketSize) != 64)
+                                pr_warning("bulk in: wMaxPacketSize!= 64");
+                        if (ep->bEndpointAddress != (2 | USB_DIR_IN))
+                                pr_warning("bulk in: bEndpointAddress: %d",
+                                     ep->bEndpointAddress);
+                        upriv->read_pipe = usb_rcvbulkpipe(udev,
+                                                         ep->
+                                                         bEndpointAddress);
+                        upriv->read_urb->transfer_buffer =
+                            kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
+                        if (!upriv->read_urb->transfer_buffer) {
+                                err("Couldn't allocate IN buffer");
+                                goto error;
+                        }
+                }
+
+                if (((ep->bEndpointAddress & USB_ENDPOINT_DIR_MASK)
+                     == USB_DIR_OUT) &&
+                    ((ep->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK)
+                     == USB_ENDPOINT_XFER_BULK)) {
+                        /* we found a bulk out endpoint */
+                        if (upriv->bap_buf != NULL) {
+                                pr_warning("Found a second bulk out ep, ignored");
+                                continue;
+                        }
+
+                        if (le16_to_cpu(ep->wMaxPacketSize) != 64)
+                                pr_warning("bulk out: wMaxPacketSize != 64");
+                        if (ep->bEndpointAddress != 2)
+                                pr_warning("bulk out: bEndpointAddress: %d",
+                                     ep->bEndpointAddress);
+                        upriv->write_pipe = usb_sndbulkpipe(udev,
+                                                          ep->
+                                                          bEndpointAddress);
+                        upriv->bap_buf = kmalloc(BULK_BUF_SIZE, GFP_KERNEL);
+                        if (!upriv->bap_buf) {
+                                err("Couldn't allocate bulk_out_buffer");
+                                goto error;
+                        }
+                }
+        }
+        if (!upriv->bap_buf || !upriv->read_urb) {
+                err("Didn't find the required bulk endpoints");
+                goto error;
+        }
+
+        if (request_firmware(&fw_entry, "orinoco_ezusb_fw",
+                             &interface->dev) == 0) {
+                firmware.size = fw_entry->size;
+                firmware.code = fw_entry->data;
+        }
+        if (firmware.size && firmware.code) {
+                ezusb_firmware_download(upriv, &firmware);
+        } else {
+                err("No firmware to download");
+                goto error;
+        }
+
+        if (ezusb_hard_reset(priv) < 0) {
+                err("Cannot reset the device");
+                goto error;
+        }
+
+        /* If the firmware is already downloaded orinoco.c will call
+         * ezusb_init but if the firmware is not already there, that will make
+         * the kernel very unstable, so we try initializing here and quit in
+         * case of error */
+        if (ezusb_init(hw) < 0) {
+                err("Couldn't initialize the device");
+                err("Firmware may not be downloaded or may be wrong.");
+                goto error;
+        }
+
+        /* Initialise the main driver */
+        if (orinoco_init(priv) != 0) {
+                err("orinoco_init() failed\n");
+                goto error;
+        }
+
+        if (orinoco_if_add(priv, 0, 0, &ezusb_netdev_ops) != 0) {
+                upriv->dev = NULL;
+                err("%s: orinoco_if_add() failed", __func__);
+                goto error;
+        }
+        upriv->dev = priv->ndev;
+
+        goto exit;
+
+ error:
+        ezusb_delete(upriv);
+        if (upriv->dev) {
+                /* upriv->dev was 0, so ezusb_delete() didn't free it */
+                free_orinocodev(priv);
+        }
+        upriv = NULL;
+        retval = -EFAULT;
+ exit:
+        if (fw_entry) {
+                firmware.code = NULL;
+                firmware.size = 0;
+                release_firmware(fw_entry);
+        }
+        usb_set_intfdata(interface, upriv);
+        return retval;
+}
+
+
+static void ezusb_disconnect(struct usb_interface *intf)
+{
+        struct ezusb_priv *upriv = usb_get_intfdata(intf);
+        usb_set_intfdata(intf, NULL);
+        ezusb_delete(upriv);
+        printk(KERN_INFO PFX "Disconnected\n");
+}
+
+
+/* usb specific object needed to register this driver with the usb subsystem */
+static struct usb_driver orinoco_driver = {
+        .name = DRIVER_NAME,
+        .probe = ezusb_probe,
+        .disconnect = ezusb_disconnect,
+        .id_table = ezusb_table,
+};
+
+/* Can't be declared "const" or the whole __initdata section will
+ * become const */
+static char version[] __initdata = DRIVER_NAME " " DRIVER_VERSION
+    " (Manuel Estrada Sainz)";
+
+static int __init ezusb_module_init(void)
+{
+        int err;
+
+        printk(KERN_DEBUG "%s\n", version);
+
+        /* register this driver with the USB subsystem */
+        err = usb_register(&orinoco_driver);
+        if (err < 0) {
+                printk(KERN_ERR PFX "usb_register failed, error %d\n",
+                       err);
+                return err;
+        }
+
+        return 0;
+}
+
+static void __exit ezusb_module_exit(void)
+{
+        /* deregister this driver with the USB subsystem */
+        usb_deregister(&orinoco_driver);
+}
+
+
+module_init(ezusb_module_init);
+module_exit(ezusb_module_exit);
+
+MODULE_AUTHOR("Manuel Estrada Sainz");
+MODULE_DESCRIPTION
+    ("Driver for Orinoco wireless LAN cards using EZUSB bridge");
+MODULE_LICENSE("Dual MPL/GPL");
diff --git a/drivers/net/wireless/orinoco/scan.c b/drivers/net/wireless/orinoco/scan.c
index 330d42d45333..4300d9db7d8c 100644
--- a/drivers/net/wireless/orinoco/scan.c
+++ b/drivers/net/wireless/orinoco/scan.c
@@ -127,7 +127,7 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
 {
         struct wiphy *wiphy = priv_to_wiphy(priv);
         struct ieee80211_channel *channel;
-        u8 *ie;
+        const u8 *ie;
         u64 timestamp;
         s32 signal;
         u16 capability;
@@ -136,7 +136,7 @@ void orinoco_add_extscan_result(struct orinoco_private *priv,
         int chan, freq;
 
         ie_len = len - sizeof(*bss);
-        ie = orinoco_get_ie(bss->data, ie_len, WLAN_EID_DS_PARAMS);
+        ie = cfg80211_find_ie(WLAN_EID_DS_PARAMS, bss->data, ie_len);
         chan = ie ? ie[2] : 0;
         freq = ieee80211_dsss_chan_to_freq(chan);
         channel = ieee80211_get_channel(wiphy, freq);
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index 59bda240fdc2..9b1af4976bf5 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -349,6 +349,7 @@ spectrum_cs_config(struct pcmcia_device *link)
                 goto failed;
 
         hermes_struct_init(hw, mem, HERMES_16BIT_REGSPACING);
+        hw->eeprom_pda = true;
 
         /*
          * This actually configures the PCMCIA socket -- setting up
@@ -374,7 +375,7 @@ spectrum_cs_config(struct pcmcia_device *link)
 
         /* Register an interface with the stack */
         if (orinoco_if_add(priv, link->io.BasePort1,
-                           link->irq.AssignedIRQ) != 0) {
+                           link->irq.AssignedIRQ, NULL) != 0) {
                 printk(KERN_ERR PFX "orinoco_if_add() failed\n");
                 goto failed;
         }
@@ -405,9 +406,9 @@ spectrum_cs_release(struct pcmcia_device *link)
 
         /* We're committed to taking the device away now, so mark the
          * hardware as unavailable */
-        spin_lock_irqsave(&priv->lock, flags);
+        priv->hw.ops->lock_irqsave(&priv->lock, &flags);
         priv->hw_unavailable++;
-        spin_unlock_irqrestore(&priv->lock, flags);
+        priv->hw.ops->unlock_irqrestore(&priv->lock, &flags);
 
         pcmcia_disable_device(link);
         if (priv->hw.iobase)
diff --git a/drivers/net/wireless/orinoco/wext.c b/drivers/net/wireless/orinoco/wext.c
index 57b850ebfeb2..5775124e2aee 100644
--- a/drivers/net/wireless/orinoco/wext.c
+++ b/drivers/net/wireless/orinoco/wext.c
@@ -458,7 +458,7 @@ static int orinoco_ioctl_setfreq(struct net_device *dev,
         if (priv->iw_mode == NL80211_IFTYPE_MONITOR) {
                 /* Fast channel change - no commit if successful */
                 hermes_t *hw = &priv->hw;
-                err = hermes_docmd_wait(hw, HERMES_CMD_TEST |
+                err = hw->ops->cmd_wait(hw, HERMES_CMD_TEST |
                                             HERMES_TEST_SET_CHANNEL,
                                         chan, NULL);
         }
@@ -538,125 +538,6 @@ static int orinoco_ioctl_setsens(struct net_device *dev,
         return -EINPROGRESS;            /* Call commit handler */
 }
 
-static int orinoco_ioctl_setrts(struct net_device *dev,
-                                struct iw_request_info *info,
-                                struct iw_param *rrq,
-                                char *extra)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-        int val = rrq->value;
-        unsigned long flags;
-
-        if (rrq->disabled)
-                val = 2347;
-
-        if ((val < 0) || (val > 2347))
-                return -EINVAL;
-
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
-        priv->rts_thresh = val;
-        orinoco_unlock(priv, &flags);
-
-        return -EINPROGRESS;            /* Call commit handler */
-}
-
-static int orinoco_ioctl_getrts(struct net_device *dev,
-                                struct iw_request_info *info,
-                                struct iw_param *rrq,
-                                char *extra)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-
-        rrq->value = priv->rts_thresh;
-        rrq->disabled = (rrq->value == 2347);
-        rrq->fixed = 1;
-
-        return 0;
-}
-
-static int orinoco_ioctl_setfrag(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct iw_param *frq,
-                                 char *extra)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-        int err = -EINPROGRESS;         /* Call commit handler */
-        unsigned long flags;
-
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
-        if (priv->has_mwo) {
-                if (frq->disabled)
-                        priv->mwo_robust = 0;
-                else {
-                        if (frq->fixed)
-                                printk(KERN_WARNING "%s: Fixed fragmentation "
-                                       "is not supported on this firmware. "
-                                       "Using MWO robust instead.\n",
-                                       dev->name);
-                        priv->mwo_robust = 1;
-                }
-        } else {
-                if (frq->disabled)
-                        priv->frag_thresh = 2346;
-                else {
-                        if ((frq->value < 256) || (frq->value > 2346))
-                                err = -EINVAL;
-                        else
-                                /* must be even */
-                                priv->frag_thresh = frq->value & ~0x1;
-                }
-        }
-
-        orinoco_unlock(priv, &flags);
-
-        return err;
-}
-
-static int orinoco_ioctl_getfrag(struct net_device *dev,
-                                 struct iw_request_info *info,
-                                 struct iw_param *frq,
-                                 char *extra)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-        hermes_t *hw = &priv->hw;
-        int err;
-        u16 val;
-        unsigned long flags;
-
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
-        if (priv->has_mwo) {
-                err = hermes_read_wordrec(hw, USER_BAP,
-                                          HERMES_RID_CNFMWOROBUST_AGERE,
-                                          &val);
-                if (err)
-                        val = 0;
-
-                frq->value = val ? 2347 : 0;
-                frq->disabled = !val;
-                frq->fixed = 0;
-        } else {
-                err = hermes_read_wordrec(hw, USER_BAP,
-                                          HERMES_RID_CNFFRAGMENTATIONTHRESHOLD,
-                                          &val);
-                if (err)
-                        val = 0;
-
-                frq->value = val;
-                frq->disabled = (val >= 2346);
-                frq->fixed = 1;
-        }
-
-        orinoco_unlock(priv, &flags);
-
-        return err;
-}
-
 static int orinoco_ioctl_setrate(struct net_device *dev,
                                  struct iw_request_info *info,
                                  struct iw_param *rrq,
@@ -1201,60 +1082,6 @@ static int orinoco_ioctl_set_mlme(struct net_device *dev,
         return ret;
 }
 
-static int orinoco_ioctl_getretry(struct net_device *dev,
-                                  struct iw_request_info *info,
-                                  struct iw_param *rrq,
-                                  char *extra)
-{
-        struct orinoco_private *priv = ndev_priv(dev);
-        hermes_t *hw = &priv->hw;
-        int err = 0;
-        u16 short_limit, long_limit, lifetime;
-        unsigned long flags;
-
-        if (orinoco_lock(priv, &flags) != 0)
-                return -EBUSY;
-
-        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_SHORTRETRYLIMIT,
-                                  &short_limit);
-        if (err)
-                goto out;
-
-        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_LONGRETRYLIMIT,
-                                  &long_limit);
-        if (err)
-                goto out;
-
-        err = hermes_read_wordrec(hw, USER_BAP, HERMES_RID_MAXTRANSMITLIFETIME,
-                                  &lifetime);
-        if (err)
-                goto out;
-
-        rrq->disabled = 0;              /* Can't be disabled */
-
-        /* Note : by default, display the retry number */
-        if ((rrq->flags & IW_RETRY_TYPE) == IW_RETRY_LIFETIME) {
-                rrq->flags = IW_RETRY_LIFETIME;
-                rrq->value = lifetime * 1000;   /* ??? */
-        } else {
-                /* By default, display the min number */
-                if ((rrq->flags & IW_RETRY_LONG)) {
-                        rrq->flags = IW_RETRY_LIMIT | IW_RETRY_LONG;
-                        rrq->value = long_limit;
-                } else {
-                        rrq->flags = IW_RETRY_LIMIT;
-                        rrq->value = short_limit;
-                        if (short_limit != long_limit)
-                                rrq->flags |= IW_RETRY_SHORT;
-                }
-        }
-
- out:
-        orinoco_unlock(priv, &flags);
-
-        return err;
-}
-
 static int orinoco_ioctl_reset(struct net_device *dev,
                                struct iw_request_info *info,
                                void *wrqu,
@@ -1446,8 +1273,8 @@ static int orinoco_ioctl_getrid(struct net_device *dev,
         if (orinoco_lock(priv, &flags) != 0)
                 return -EBUSY;
 
-        err = hermes_read_ltv(hw, USER_BAP, rid, MAX_RID_LEN, &length,
-                              extra);
+        err = hw->ops->read_ltv(hw, USER_BAP, rid, MAX_RID_LEN, &length,
+                                extra);
         if (err)
                 goto out;
 
@@ -1528,11 +1355,11 @@ static const iw_handler	orinoco_handler[] = {
         IW_HANDLER(SIOCGIWESSID,        (iw_handler)orinoco_ioctl_getessid),
         IW_HANDLER(SIOCSIWRATE,         (iw_handler)orinoco_ioctl_setrate),
         IW_HANDLER(SIOCGIWRATE,         (iw_handler)orinoco_ioctl_getrate),
-        IW_HANDLER(SIOCSIWRTS,          (iw_handler)orinoco_ioctl_setrts),
-        IW_HANDLER(SIOCGIWRTS,          (iw_handler)orinoco_ioctl_getrts),
-        IW_HANDLER(SIOCSIWFRAG,         (iw_handler)orinoco_ioctl_setfrag),
-        IW_HANDLER(SIOCGIWFRAG,         (iw_handler)orinoco_ioctl_getfrag),
-        IW_HANDLER(SIOCGIWRETRY,        (iw_handler)orinoco_ioctl_getretry),
+        IW_HANDLER(SIOCSIWRTS,          (iw_handler)cfg80211_wext_siwrts),
+        IW_HANDLER(SIOCGIWRTS,          (iw_handler)cfg80211_wext_giwrts),
+        IW_HANDLER(SIOCSIWFRAG,         (iw_handler)cfg80211_wext_siwfrag),
+        IW_HANDLER(SIOCGIWFRAG,         (iw_handler)cfg80211_wext_giwfrag),
+        IW_HANDLER(SIOCGIWRETRY,        (iw_handler)cfg80211_wext_giwretry),
         IW_HANDLER(SIOCSIWENCODE,       (iw_handler)orinoco_ioctl_setiwencode),
         IW_HANDLER(SIOCGIWENCODE,       (iw_handler)orinoco_ioctl_getiwencode),
         IW_HANDLER(SIOCSIWPOWER,        (iw_handler)orinoco_ioctl_setpower),
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 7bbd9d3bba60..c072f41747ca 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -546,8 +546,7 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
                      IEEE80211_HW_SUPPORTS_PS |
                      IEEE80211_HW_PS_NULLFUNC_STACK |
                      IEEE80211_HW_BEACON_FILTER |
-                     IEEE80211_HW_REPORTS_TX_ACK_STATUS |
-                     IEEE80211_HW_NOISE_DBM;
+                     IEEE80211_HW_REPORTS_TX_ACK_STATUS;
 
         dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                       BIT(NL80211_IFTYPE_ADHOC) |
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 86f3e9ac4c7a..07c4528f6e6b 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -140,7 +140,7 @@ static void p54p_refill_rx_ring(struct ieee80211_hw *dev,
 
         idx = le32_to_cpu(ring_control->host_idx[ring_index]);
         limit = idx;
-        limit -= le32_to_cpu(index);
+        limit -= index;
         limit = ring_limit - limit;
 
         i = idx % ring_limit;
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
         u32 idx, i;
 
         i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
         idx %= ring_limit;
 
         while (i != idx) {
@@ -277,6 +277,14 @@ static void p54p_tasklet(unsigned long dev_id)
         struct p54p_priv *priv = dev->priv;
         struct p54p_ring_control *ring_control = priv->ring_control;
 
+        p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
+                           ARRAY_SIZE(ring_control->tx_mgmt),
+                           priv->tx_buf_mgmt);
+
+        p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
+                           ARRAY_SIZE(ring_control->tx_data),
+                           priv->tx_buf_data);
+
         p54p_check_rx_ring(dev, &priv->rx_idx_mgmt, 2, ring_control->rx_mgmt,
                 ARRAY_SIZE(ring_control->rx_mgmt), priv->rx_buf_mgmt);
 
@@ -285,14 +293,6 @@ static void p54p_tasklet(unsigned long dev_id)
 
         wmb();
         P54P_WRITE(dev_int, cpu_to_le32(ISL38XX_DEV_INT_UPDATE));
-
-        p54p_check_tx_ring(dev, &priv->tx_idx_mgmt, 3, ring_control->tx_mgmt,
-                           ARRAY_SIZE(ring_control->tx_mgmt),
-                           priv->tx_buf_mgmt);
-
-        p54p_check_tx_ring(dev, &priv->tx_idx_data, 1, ring_control->tx_data,
-                           ARRAY_SIZE(ring_control->tx_data),
-                           priv->tx_buf_data);
 }
 
 static irqreturn_t p54p_interrupt(int irq, void *dev_id)
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 2ceff5480355..4e6891099d43 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -350,7 +350,6 @@ static int p54_rx_data(struct p54_common *priv, struct sk_buff *skb)
                 rx_status->flag |= RX_FLAG_MMIC_ERROR;
 
         rx_status->signal = p54_rssi_to_dbm(priv, hdr->rssi);
-        rx_status->noise = priv->noise;
         if (hdr->rate & 0x10)
                 rx_status->flag |= RX_FLAG_SHORTPRE;
         if (priv->hw->conf.channel->band == IEEE80211_BAND_5GHZ)
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 5239e082cd0f..eea1ef2f502b 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -87,7 +87,7 @@ if RT2800PCI
 
 config RT2800PCI_RT30XX
         bool "rt2800pci - Include support for rt30xx (PCI/PCIe/PCMCIA) devices"
-        default n
+        default y
         ---help---
           This adds support for rt30xx wireless chipset family to the
           rt2800pci driver.
@@ -156,7 +156,7 @@ if RT2800USB
 
 config RT2800USB_RT30XX
         bool "rt2800usb - Include support for rt30xx (USB) devices"
-        default n
+        default y
         ---help---
           This adds support for rt30xx wireless chipset family to the
           rt2800usb driver.
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index cdbf59108ef9..06b92f8b7a55 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1018,8 +1018,8 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_desc_write(entry_priv->desc, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
-        rt2x00_set_field32(&word, TXD_W2_BUFFER_LENGTH, skb->len);
-        rt2x00_set_field32(&word, TXD_W2_DATABYTE_COUNT, skb->len);
+        rt2x00_set_field32(&word, TXD_W2_BUFFER_LENGTH, txdesc->length);
+        rt2x00_set_field32(&word, TXD_W2_DATABYTE_COUNT, txdesc->length);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 3, &word);
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 89e986f449da..ae8e205df269 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1209,7 +1209,7 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 7185cb05f257..41d9996c80e6 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1072,7 +1072,7 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
                            test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
         rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
         rt2x00_desc_write(txd, 0, word);
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index ec893721cc80..2aa03751c341 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -107,7 +107,7 @@
 /*
  * INT_SOURCE_CSR: Interrupt source register.
  * Write one to clear corresponding bit.
- * TX_FIFO_STATUS: FIFO Statistics is full, sw should read 0x171c
+ * TX_FIFO_STATUS: FIFO Statistics is full, sw should read TX_STA_FIFO
  */
 #define INT_SOURCE_CSR                  0x0200
 #define INT_SOURCE_CSR_RXDELAYINT       FIELD32(0x00000001)
@@ -845,7 +845,7 @@
  * TX_BAND_CFG: 0x1 use upper 20MHz, 0x0 use lower 20MHz
  */
 #define TX_BAND_CFG                     0x132c
-#define TX_BAND_CFG_HT40_PLUS           FIELD32(0x00000001)
+#define TX_BAND_CFG_HT40_MINUS          FIELD32(0x00000001)
 #define TX_BAND_CFG_A                   FIELD32(0x00000002)
 #define TX_BAND_CFG_BG                  FIELD32(0x00000004)
 
@@ -1519,7 +1519,7 @@ struct mac_iveiv_entry {
  * BBP 3: RX Antenna
  */
 #define BBP3_RX_ANTENNA                 FIELD8(0x18)
-#define BBP3_HT40_PLUS                  FIELD8(0x20)
+#define BBP3_HT40_MINUS                 FIELD8(0x20)
 
 /*
  * BBP 4: Bandwidth
@@ -1566,6 +1566,11 @@ struct mac_iveiv_entry {
 #define RFCSR12_TX_POWER                FIELD8(0x1f)
 
 /*
+ * RFCSR 13:
+ */
+#define RFCSR13_TX_POWER                FIELD8(0x1f)
+
+/*
  * RFCSR 15:
  */
 #define RFCSR15_TX_LO2_EN               FIELD8(0x08)
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 2648f315a934..e37bbeab9233 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -41,9 +41,6 @@
 #if defined(CONFIG_RT2X00_LIB_USB) || defined(CONFIG_RT2X00_LIB_USB_MODULE)
 #include "rt2x00usb.h"
 #endif
-#if defined(CONFIG_RT2X00_LIB_PCI) || defined(CONFIG_RT2X00_LIB_PCI_MODULE)
-#include "rt2x00pci.h"
-#endif
 #include "rt2800lib.h"
 #include "rt2800.h"
 #include "rt2800usb.h"
@@ -76,6 +73,23 @@ MODULE_LICENSE("GPL");
         rt2800_regbusy_read((__dev), H2M_MAILBOX_CSR, \
                             H2M_MAILBOX_CSR_OWNER, (__reg))
 
+static inline bool rt2800_is_305x_soc(struct rt2x00_dev *rt2x00dev)
+{
+        /* check for rt2872 on SoC */
+        if (!rt2x00_is_soc(rt2x00dev) ||
+            !rt2x00_rt(rt2x00dev, RT2872))
+                return false;
+
+        /* we know for sure that these rf chipsets are used on rt305x boards */
+        if (rt2x00_rf(rt2x00dev, RF3020) ||
+            rt2x00_rf(rt2x00dev, RF3021) ||
+            rt2x00_rf(rt2x00dev, RF3022))
+                return true;
+
+        NOTICE(rt2x00dev, "Unknown RF chipset on rt305x\n");
+        return false;
+}
+
 static void rt2800_bbp_write(struct rt2x00_dev *rt2x00dev,
                              const unsigned int word, const u8 value)
 {
@@ -794,6 +808,11 @@ static void rt2800_config_channel_rf3xxx(struct rt2x00_dev *rt2x00dev,
                           TXPOWER_G_TO_DEV(info->tx_power1));
         rt2800_rfcsr_write(rt2x00dev, 12, rfcsr);
 
+        rt2800_rfcsr_read(rt2x00dev, 13, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR13_TX_POWER,
+                          TXPOWER_G_TO_DEV(info->tx_power2));
+        rt2800_rfcsr_write(rt2x00dev, 13, rfcsr);
+
         rt2800_rfcsr_read(rt2x00dev, 23, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR23_FREQ_OFFSET, rt2x00dev->freq_offset);
         rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
@@ -849,7 +868,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         }
 
         rt2800_register_read(rt2x00dev, TX_BAND_CFG, &reg);
-        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2x00_set_field32(&reg, TX_BAND_CFG_HT40_MINUS, conf_is_ht40_minus(conf));
         rt2x00_set_field32(&reg, TX_BAND_CFG_A, rf->channel > 14);
         rt2x00_set_field32(&reg, TX_BAND_CFG_BG, rf->channel <= 14);
         rt2800_register_write(rt2x00dev, TX_BAND_CFG, reg);
@@ -882,7 +901,7 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         rt2800_bbp_write(rt2x00dev, 4, bbp);
 
         rt2800_bbp_read(rt2x00dev, 3, &bbp);
-        rt2x00_set_field8(&bbp, BBP3_HT40_PLUS, conf_is_ht40_plus(conf));
+        rt2x00_set_field8(&bbp, BBP3_HT40_MINUS, conf_is_ht40_minus(conf));
         rt2800_bbp_write(rt2x00dev, 3, bbp);
 
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C)) {
@@ -1551,6 +1570,9 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                      rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EACCES;
 
+        if (rt2800_is_305x_soc(rt2x00dev))
+                rt2800_bbp_write(rt2x00dev, 31, 0x08);
+
         rt2800_bbp_write(rt2x00dev, 65, 0x2c);
         rt2800_bbp_write(rt2x00dev, 66, 0x38);
 
@@ -1571,6 +1593,9 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                 rt2800_bbp_write(rt2x00dev, 79, 0x13);
                 rt2800_bbp_write(rt2x00dev, 80, 0x05);
                 rt2800_bbp_write(rt2x00dev, 81, 0x33);
+        } else if (rt2800_is_305x_soc(rt2x00dev)) {
+                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
+                rt2800_bbp_write(rt2x00dev, 80, 0x08);
         } else {
                 rt2800_bbp_write(rt2x00dev, 81, 0x37);
         }
@@ -1591,12 +1616,16 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt_rev_gte(rt2x00dev, RT3070, REV_RT3070F) ||
             rt2x00_rt_rev_gte(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_gte(rt2x00dev, RT3090, REV_RT3090E) ||
-            rt2x00_rt_rev_gte(rt2x00dev, RT3390, REV_RT3390E))
+            rt2x00_rt_rev_gte(rt2x00dev, RT3390, REV_RT3390E) ||
+            rt2800_is_305x_soc(rt2x00dev))
                 rt2800_bbp_write(rt2x00dev, 103, 0xc0);
         else
                 rt2800_bbp_write(rt2x00dev, 103, 0x00);
 
-        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+        if (rt2800_is_305x_soc(rt2x00dev))
+                rt2800_bbp_write(rt2x00dev, 105, 0x01);
+        else
+                rt2800_bbp_write(rt2x00dev, 105, 0x05);
         rt2800_bbp_write(rt2x00dev, 106, 0x35);
 
         if (rt2x00_rt(rt2x00dev, RT3071) ||
@@ -1613,11 +1642,6 @@ int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                 rt2800_bbp_write(rt2x00dev, 138, value);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT2872)) {
-                rt2800_bbp_write(rt2x00dev, 31, 0x08);
-                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
-                rt2800_bbp_write(rt2x00dev, 80, 0x08);
-        }
 
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
                 rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i, &eeprom);
@@ -1703,7 +1727,8 @@ int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         if (!rt2x00_rt(rt2x00dev, RT3070) &&
             !rt2x00_rt(rt2x00dev, RT3071) &&
             !rt2x00_rt(rt2x00dev, RT3090) &&
-            !rt2x00_rt(rt2x00dev, RT3390))
+            !rt2x00_rt(rt2x00dev, RT3390) &&
+            !rt2800_is_305x_soc(rt2x00dev))
                 return 0;
 
         /*
@@ -1771,6 +1796,40 @@ int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 29, 0x8f);
                 rt2800_rfcsr_write(rt2x00dev, 30, 0x20);
                 rt2800_rfcsr_write(rt2x00dev, 31, 0x0f);
+        } else if (rt2800_is_305x_soc(rt2x00dev)) {
+                rt2800_rfcsr_write(rt2x00dev, 0, 0x50);
+                rt2800_rfcsr_write(rt2x00dev, 1, 0x01);
+                rt2800_rfcsr_write(rt2x00dev, 2, 0xf7);
+                rt2800_rfcsr_write(rt2x00dev, 3, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 4, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 5, 0x03);
+                rt2800_rfcsr_write(rt2x00dev, 6, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 7, 0x50);
+                rt2800_rfcsr_write(rt2x00dev, 8, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 9, 0x0f);
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x60);
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x21);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 13, 0x75);
+                rt2800_rfcsr_write(rt2x00dev, 14, 0x90);
+                rt2800_rfcsr_write(rt2x00dev, 15, 0x58);
+                rt2800_rfcsr_write(rt2x00dev, 16, 0xb3);
+                rt2800_rfcsr_write(rt2x00dev, 17, 0x92);
+                rt2800_rfcsr_write(rt2x00dev, 18, 0x2c);
+                rt2800_rfcsr_write(rt2x00dev, 19, 0x02);
+                rt2800_rfcsr_write(rt2x00dev, 20, 0xba);
+                rt2800_rfcsr_write(rt2x00dev, 21, 0xdb);
+                rt2800_rfcsr_write(rt2x00dev, 22, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 23, 0x31);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x08);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x01);
+                rt2800_rfcsr_write(rt2x00dev, 26, 0x25);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x23);
+                rt2800_rfcsr_write(rt2x00dev, 28, 0x13);
+                rt2800_rfcsr_write(rt2x00dev, 29, 0x83);
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 31, 0x00);
+                return 0;
         }
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -1986,7 +2045,6 @@ int rt2800_validate_eeprom(struct rt2x00_dev *rt2x00dev)
                 EEPROM(rt2x00dev, "Antenna: 0x%04x\n", word);
         } else if (rt2x00_rt(rt2x00dev, RT2860) ||
                    rt2x00_rt(rt2x00dev, RT2870) ||
-                   rt2x00_rt(rt2x00dev, RT2872) ||
                    rt2x00_rt(rt2x00dev, RT2872)) {
                 /*
                  * There is a max of 2 RX streams for RT28x0 series
@@ -2318,8 +2376,11 @@ int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         else
                 spec->ht.ht_supported = false;
 
+        /*
+         * Don't set IEEE80211_HT_CAP_SUP_WIDTH_20_40 for now as it causes
+         * reception problems with HT40 capable 11n APs
+         */
         spec->ht.cap =
-            IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
             IEEE80211_HT_CAP_GRN_FLD |
             IEEE80211_HT_CAP_SGI_20 |
             IEEE80211_HT_CAP_SGI_40 |
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 2131f8f0c502..f08b6a37bf2d 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -613,15 +613,23 @@ static int rt2800pci_set_device_state(struct rt2x00_dev *rt2x00dev,
 /*
  * TX descriptor initialization
  */
-static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
-                                    struct sk_buff *skb,
-                                    struct txentry_desc *txdesc)
+static int rt2800pci_write_tx_data(struct queue_entry* entry,
+                                   struct txentry_desc *txdesc)
 {
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = skbdesc->desc;
-        __le32 *txwi = (__le32 *)(skb->data - rt2x00dev->ops->extra_tx_headroom);
+        struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
+        struct sk_buff *skb = entry->skb;
+        struct skb_frame_desc *skbdesc;
+        int ret;
+        __le32 *txwi;
         u32 word;
 
+        ret = rt2x00pci_write_tx_data(entry, txdesc);
+        if (ret)
+                return ret;
+
+        skbdesc = get_skb_frame_desc(skb);
+        txwi = (__le32 *)(skb->data - rt2x00dev->ops->extra_tx_headroom);
+
         /*
          * Initialize TX Info descriptor
          */
@@ -655,7 +663,7 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
                            txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
-                           skb->len - txdesc->l2pad);
+                           txdesc->length);
         rt2x00_set_field32(&word, TXWI_W1_PACKETID,
                            skbdesc->entry->queue->qid + 1);
         rt2x00_desc_write(txwi, 1, word);
@@ -670,6 +678,18 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         _rt2x00_desc_write(txwi, 2, 0 /* skbdesc->iv[0] */);
         _rt2x00_desc_write(txwi, 3, 0 /* skbdesc->iv[1] */);
 
+        return 0;
+}
+
+
+static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
+                                    struct sk_buff *skb,
+                                    struct txentry_desc *txdesc)
+{
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
+        __le32 *txd = skbdesc->desc;
+        u32 word;
+
         /*
          * The buffers pointed by SD_PTR0/SD_LEN0 and SD_PTR1/SD_LEN1
          * must contains a TXWI structure + 802.11 header + padding + 802.11
@@ -875,10 +895,6 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
             (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
              rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
 
-        rxdesc->noise =
-            (rt2x00_get_field32(rxwi3, RXWI_W3_SNR0) +
-             rt2x00_get_field32(rxwi3, RXWI_W3_SNR1)) / 2;
-
         rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
 
         /*
@@ -1135,7 +1151,7 @@ static const struct rt2x00lib_ops rt2800pci_rt2x00_ops = {
         .reset_tuner            = rt2800_reset_tuner,
         .link_tuner             = rt2800_link_tuner,
         .write_tx_desc          = rt2800pci_write_tx_desc,
-        .write_tx_data          = rt2x00pci_write_tx_data,
+        .write_tx_data          = rt2800pci_write_tx_data,
         .write_beacon           = rt2800pci_write_beacon,
         .kick_tx_queue          = rt2800pci_kick_tx_queue,
         .kill_tx_queue          = rt2800pci_kill_tx_queue,
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 6b809ab42c61..e3f3a97db807 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -437,7 +437,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags) ?
                            txdesc->key_idx : 0xff);
         rt2x00_set_field32(&word, TXWI_W1_MPDU_TOTAL_BYTE_COUNT,
-                           skb->len - txdesc->l2pad);
+                           txdesc->length);
         rt2x00_set_field32(&word, TXWI_W1_PACKETID,
                            skbdesc->entry->queue->qid + 1);
         rt2x00_desc_write(txwi, 1, word);
@@ -645,10 +645,6 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
             (rt2x00_get_field32(rxwi2, RXWI_W2_RSSI0) +
              rt2x00_get_field32(rxwi2, RXWI_W2_RSSI1)) / 2;
 
-        rxdesc->noise =
-            (rt2x00_get_field32(rxwi3, RXWI_W3_SNR0) +
-             rt2x00_get_field32(rxwi3, RXWI_W3_SNR1)) / 2;
-
         rxdesc->size = rt2x00_get_field32(rxwi0, RXWI_W0_MPDU_TOTAL_BYTE_COUNT);
 
         /*
@@ -806,6 +802,10 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07b8, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07b8, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1482, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Allwin */
+        { USB_DEVICE(0x8516, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amit */
         { USB_DEVICE(0x15c5, 0x0008), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Askey */
@@ -848,6 +848,11 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Hawking */
         { USB_DEVICE(0x0e66, 0x0001), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0003), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0013), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0017), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0e66, 0x0018), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Linksys */
         { USB_DEVICE(0x1737, 0x0070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1737, 0x0071), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -907,6 +912,10 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07b8, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AirTies */
         { USB_DEVICE(0x1eda, 0x2310), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Allwin */
+        { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* ASUS */
         { USB_DEVICE(0x0b05, 0x1784), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* AzureWave */
@@ -991,6 +1000,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
 #endif
 #ifdef CONFIG_RT2800USB_RT35XX
+        /* Allwin */
+        { USB_DEVICE(0x8516, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Askey */
         { USB_DEVICE(0x1690, 0x0744), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Cisco */
@@ -1012,16 +1023,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
 #ifdef CONFIG_RT2800USB_UNKNOWN
         /*
          * Unclear what kind of devices these are (they aren't supported by the
-         * vendor driver).
+         * vendor linux driver).
          */
-        /* Allwin */
-        { USB_DEVICE(0x8516, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x2870), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3070), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x8516, 0x3572), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Amigo */
         { USB_DEVICE(0x0e0b, 0x9031), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e0b, 0x9041), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -1033,6 +1036,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* AzureWave */
         { USB_DEVICE(0x13d3, 0x3262), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x13d3, 0x3284), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x13d3, 0x3322), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Belkin */
         { USB_DEVICE(0x050d, 0x825a), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Buffalo */
@@ -1051,15 +1055,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c15), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c17), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Encore */
         { USB_DEVICE(0x203d, 0x14a1), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gemtek */
         { USB_DEVICE(0x15a9, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Gigabyte */
         { USB_DEVICE(0x1044, 0x800c), USB_DEVICE_DATA(&rt2800usb_ops) },
-        /* Hawking */
-        { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
-        { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* LevelOne */
         { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -1070,11 +1072,13 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Motorola */
         { USB_DEVICE(0x100d, 0x9032), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ovislink */
+        { USB_DEVICE(0x1b75, 0x3071), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1b75, 0x3072), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Pegatron */
         { USB_DEVICE(0x05a6, 0x0101), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x0010), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x0011), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
         { USB_DEVICE(0x2019, 0xab24), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Qcom */
@@ -1083,6 +1087,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x083a, 0xa512), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xc522), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0xd522), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x083a, 0xf511), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Sweex */
         { USB_DEVICE(0x177f, 0x0153), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x177f, 0x0313), USB_DEVICE_DATA(&rt2800usb_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 4de505b98331..4f9b666f7a7f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -549,7 +549,8 @@ struct rt2x00lib_ops {
         void (*write_tx_desc) (struct rt2x00_dev *rt2x00dev,
                                struct sk_buff *skb,
                                struct txentry_desc *txdesc);
-        int (*write_tx_data) (struct queue_entry *entry);
+        int (*write_tx_data) (struct queue_entry *entry,
+                              struct txentry_desc *txdesc);
         void (*write_beacon) (struct queue_entry *entry);
         int (*get_tx_data_len) (struct queue_entry *entry);
         void (*kick_tx_queue) (struct rt2x00_dev *rt2x00dev,
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index eda73ba735a6..3ae468c4d760 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -435,7 +435,6 @@ void rt2x00lib_rxdone(struct rt2x00_dev *rt2x00dev,
         rx_status->mactime = rxdesc.timestamp;
         rx_status->rate_idx = rate_idx;
         rx_status->signal = rxdesc.rssi;
-        rx_status->noise = rxdesc.noise;
         rx_status->flag = rxdesc.flags;
         rx_status->antenna = rt2x00dev->link.ant.active.rx;
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index cf3f1c0c4382..4b941e9c794e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -63,7 +63,8 @@ EXPORT_SYMBOL_GPL(rt2x00pci_regbusy_read);
 /*
  * TX data handlers.
  */
-int rt2x00pci_write_tx_data(struct queue_entry *entry)
+int rt2x00pci_write_tx_data(struct queue_entry *entry,
+                            struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_pci *entry_priv = entry->priv_data;
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index 8149ff68410a..51bcef3839ce 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -92,7 +92,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
  * This function will initialize the DMA and skb descriptor
  * to prepare the entry for the actual TX operation.
  */
-int rt2x00pci_write_tx_data(struct queue_entry *entry);
+int rt2x00pci_write_tx_data(struct queue_entry *entry,
+                            struct txentry_desc *txdesc);
 
 /**
  * struct queue_entry_priv_pci: Per entry PCI specific information
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index a0bd36fc4d2e..e22029fcf411 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -334,12 +334,10 @@ static void rt2x00queue_create_tx_descriptor(struct queue_entry *entry,
         txdesc->aifs = entry->queue->aifs;
 
         /*
-         * Header and alignment information.
+         * Header and frame information.
          */
+        txdesc->length = entry->skb->len;
         txdesc->header_length = ieee80211_get_hdrlen_from_skb(entry->skb);
-        if (test_bit(DRIVER_REQUIRE_L2PAD, &rt2x00dev->flags) &&
-            (entry->skb->len > txdesc->header_length))
-                txdesc->l2pad = L2PAD_SIZE(txdesc->header_length);
 
         /*
          * Check whether this frame is to be acked.
@@ -526,7 +524,8 @@ int rt2x00queue_write_tx_frame(struct data_queue *queue, struct sk_buff *skb,
          * call failed. Since we always return NETDEV_TX_OK to mac80211,
          * this frame will simply be dropped.
          */
-        if (unlikely(queue->rt2x00dev->ops->lib->write_tx_data(entry))) {
+        if (unlikely(queue->rt2x00dev->ops->lib->write_tx_data(entry,
+                                                               &txdesc))) {
                 clear_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
                 entry->skb = NULL;
                 return -EIO;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index c1e482bb37b3..94a48c174d67 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -183,7 +183,6 @@ enum rxdone_entry_desc_flags {
  * @timestamp: RX Timestamp
  * @signal: Signal of the received frame.
  * @rssi: RSSI of the received frame.
- * @noise: Measured noise during frame reception.
  * @size: Data size of the received frame.
  * @flags: MAC80211 receive flags (See &enum mac80211_rx_flags).
  * @dev_flags: Ralink receive flags (See &enum rxdone_entry_desc_flags).
@@ -197,7 +196,6 @@ struct rxdone_entry_desc {
         u64 timestamp;
         int signal;
         int rssi;
-        int noise;
         int size;
         int flags;
         int dev_flags;
@@ -287,8 +285,8 @@ enum txentry_desc_flags {
  *
  * @flags: Descriptor flags (See &enum queue_entry_flags).
  * @queue: Queue identification (See &enum data_queue_qid).
+ * @length: Length of the entire frame.
  * @header_length: Length of 802.11 header.
- * @l2pad: Amount of padding to align 802.11 payload to 4-byte boundrary.
  * @length_high: PLCP length high word.
  * @length_low: PLCP length low word.
  * @signal: PLCP signal.
@@ -313,8 +311,8 @@ struct txentry_desc {
 
         enum data_queue_qid queue;
 
+        u16 length;
         u16 header_length;
-        u16 l2pad;
 
         u16 length_high;
         u16 length_low;
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index f9a7f8b17411..da111c0c2928 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -216,7 +216,8 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         rt2x00lib_txdone(entry, &txdesc);
 }
 
-int rt2x00usb_write_tx_data(struct queue_entry *entry)
+int rt2x00usb_write_tx_data(struct queue_entry *entry,
+                            struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index 3da6841b5d42..621d0f829251 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -376,7 +376,8 @@ void rt2x00usb_disable_radio(struct rt2x00_dev *rt2x00dev);
  * This function will initialize the URB and skb descriptor
  * to prepare the entry for the actual TX operation.
  */
-int rt2x00usb_write_tx_data(struct queue_entry *entry);
+int rt2x00usb_write_tx_data(struct queue_entry *entry,
+                            struct txentry_desc *txdesc);
 
 /**
  * struct queue_entry_priv_usb: Per entry USB specific information
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index b9885981f3a8..26ee7911fba9 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1809,7 +1809,8 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 
         if (skbdesc->desc_len > TXINFO_SIZE) {
                 rt2x00_desc_read(txd, 11, &word);
-                rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0, skb->len);
+                rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0,
+                                   txdesc->length);
                 rt2x00_desc_write(txd, 11, word);
         }
 
@@ -1832,7 +1833,7 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_KEY_TABLE,
                            test_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_KEY_INDEX, txdesc->key_idx);
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_BURST,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 576ea9dd2824..39b3c6d04af4 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1495,7 +1495,7 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_KEY_TABLE,
                            test_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_KEY_INDEX, txdesc->key_idx);
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, skb->len);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_BURST2,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
diff --git a/drivers/net/wireless/rtl818x/Kconfig b/drivers/net/wireless/rtl818x/Kconfig
new file mode 100644
index 000000000000..17d80fe556de
--- /dev/null
+++ b/drivers/net/wireless/rtl818x/Kconfig
@@ -0,0 +1,88 @@
+#
+# RTL818X Wireless LAN device configuration
+#
+config RTL8180
+        tristate "Realtek 8180/8185 PCI support"
+        depends on MAC80211 && PCI && EXPERIMENTAL
+        select EEPROM_93CX6
+        ---help---
+          This is a driver for RTL8180 and RTL8185 based cards.
+          These are PCI based chips found in cards such as:
+
+          (RTL8185 802.11g)
+          A-Link WL54PC
+
+          (RTL8180 802.11b)
+          Belkin F5D6020 v3
+          Belkin F5D6020 v3
+          Dlink DWL-610
+          Dlink DWL-510
+          Netgear MA521
+          Level-One WPC-0101
+          Acer Aspire 1357 LMi
+          VCTnet PC-11B1
+          Ovislink AirLive WL-1120PCM
+          Mentor WL-PCI
+          Linksys WPC11 v4
+          TrendNET TEW-288PI
+          D-Link DWL-520 Rev D
+          Repotec RP-WP7126
+          TP-Link TL-WN250/251
+          Zonet ZEW1000
+          Longshine LCS-8031-R
+          HomeLine HLW-PCC200
+          GigaFast WF721-AEX
+          Planet WL-3553
+          Encore ENLWI-PCI1-NT
+          TrendNET TEW-266PC
+          Gigabyte GN-WLMR101
+          Siemens-fujitsu Amilo D1840W
+          Edimax EW-7126
+          PheeNet WL-11PCIR
+          Tonze PC-2100T
+          Planet WL-8303
+          Dlink DWL-650 v M1
+          Edimax EW-7106
+          Q-Tec 770WC
+          Topcom Skyr@cer 4011b
+          Roper FreeLan 802.11b (edition 2004)
+          Wistron Neweb Corp CB-200B
+          Pentagram HorNET
+          QTec 775WC
+          TwinMOS Booming B Series
+          Micronet SP906BB
+          Sweex LC700010
+          Surecom EP-9428
+          Safecom SWLCR-1100
+
+          Thanks to Realtek for their support!
+
+config RTL8187
+        tristate "Realtek 8187 and 8187B USB support"
+        depends on MAC80211 && USB
+        select EEPROM_93CX6
+        ---help---
+          This is a driver for RTL8187 and RTL8187B based cards.
+          These are USB based chips found in devices such as:
+
+          Netgear WG111v2
+          Level 1 WNC-0301USB
+          Micronet SP907GK V5
+          Encore ENUWI-G2
+          Trendnet TEW-424UB
+          ASUS P5B Deluxe/P5K Premium motherboards
+          Toshiba Satellite Pro series of laptops
+          Asus Wireless Link
+          Linksys WUSB54GC-EU v2
+            (v1 = rt73usb; v3 is rt2070-based,
+             use staging/rt3070 or try rt2800usb)
+
+          Thanks to Realtek for their support!
+
+# If possible, automatically enable LEDs for RTL8187.
+
+config RTL8187_LEDS
+        bool
+        depends on RTL8187 && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = RTL8187)
+        default y
+
diff --git a/drivers/net/wireless/rtl818x/rtl8180_dev.c b/drivers/net/wireless/rtl818x/rtl8180_dev.c
index 6b46329b732f..21307f2412b8 100644
--- a/drivers/net/wireless/rtl818x/rtl8180_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180_dev.c
@@ -188,6 +188,7 @@ static void rtl8180_handle_tx(struct ieee80211_hw *dev, unsigned int prio)
                         info->flags |= IEEE80211_TX_STAT_ACK;
 
                 info->status.rates[0].count = (flags & 0xFF) + 1;
+                info->status.rates[1].idx = -1;
 
                 ieee80211_tx_status_irqsafe(dev, skb);
                 if (ring->entries - skb_queue_len(&ring->queue) == 2)
@@ -297,7 +298,7 @@ static int rtl8180_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
         entry->flags = cpu_to_le32(tx_flags);
         __skb_queue_tail(&ring->queue, skb);
         if (ring->entries - skb_queue_len(&ring->queue) < 2)
-                ieee80211_stop_queue(dev, skb_get_queue_mapping(skb));
+                ieee80211_stop_queue(dev, prio);
         spin_unlock_irqrestore(&priv->lock, flags);
 
         rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING, (1 << (prio + 4)));
@@ -827,6 +828,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         const char *chip_name, *rf_name = NULL;
         u32 reg;
         u16 eeprom_val;
+        u8 mac_addr[ETH_ALEN];
 
         err = pci_enable_device(pdev);
         if (err) {
@@ -987,12 +989,13 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
                 eeprom_93cx6_read(&eeprom, 0x19, &priv->rfparam);
         }
 
-        eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)dev->wiphy->perm_addr, 3);
-        if (!is_valid_ether_addr(dev->wiphy->perm_addr)) {
+        eeprom_93cx6_multiread(&eeprom, 0x7, (__le16 *)mac_addr, 3);
+        if (!is_valid_ether_addr(mac_addr)) {
                 printk(KERN_WARNING "%s (rtl8180): Invalid hwaddr! Using"
                        " randomly generated MAC addr\n", pci_name(pdev));
-                random_ether_addr(dev->wiphy->perm_addr);
+                random_ether_addr(mac_addr);
         }
+        SET_IEEE80211_PERM_ADDR(dev, mac_addr);
 
         /* CCK TX power */
         for (i = 0; i < 14; i += 2) {
@@ -1024,7 +1027,7 @@ static int __devinit rtl8180_probe(struct pci_dev *pdev,
         }
 
         printk(KERN_INFO "%s: hwaddr %pM, %s + %s\n",
-               wiphy_name(dev->wiphy), dev->wiphy->perm_addr,
+               wiphy_name(dev->wiphy), mac_addr,
                chip_name, priv->rf->name);
 
         return 0;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 738921fda027..891b8490e349 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1333,6 +1333,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         u16 txpwr, reg;
         u16 product_id = le16_to_cpu(udev->descriptor.idProduct);
         int err, i;
+        u8 mac_addr[ETH_ALEN];
 
         dev = ieee80211_alloc_hw(sizeof(*priv), &rtl8187_ops);
         if (!dev) {
@@ -1390,12 +1391,13 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         udelay(10);
 
         eeprom_93cx6_multiread(&eeprom, RTL8187_EEPROM_MAC_ADDR,
-                               (__le16 __force *)dev->wiphy->perm_addr, 3);
-        if (!is_valid_ether_addr(dev->wiphy->perm_addr)) {
+                               (__le16 __force *)mac_addr, 3);
+        if (!is_valid_ether_addr(mac_addr)) {
                 printk(KERN_WARNING "rtl8187: Invalid hwaddr! Using randomly "
                        "generated MAC address\n");
-                random_ether_addr(dev->wiphy->perm_addr);
+                random_ether_addr(mac_addr);
         }
+        SET_IEEE80211_PERM_ADDR(dev, mac_addr);
 
         channel = priv->channels;
         for (i = 0; i < 3; i++) {
@@ -1526,7 +1528,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         skb_queue_head_init(&priv->b_tx_status.queue);
 
         printk(KERN_INFO "%s: hwaddr %pM, %s V%d + %s, rfkill mask %d\n",
-               wiphy_name(dev->wiphy), dev->wiphy->perm_addr,
+               wiphy_name(dev->wiphy), mac_addr,
                chip_name, priv->asic_rev, priv->rf->name, priv->rfkill_mask);
 
 #ifdef CONFIG_RTL8187_LEDS
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index 4d479708158d..00b24282fc73 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -857,6 +857,7 @@ out:
 }
 
 static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
                              struct cfg80211_scan_request *req)
 {
         struct wl1251 *wl = hw->priv;
@@ -1196,6 +1197,66 @@ static const struct ieee80211_ops wl1251_ops = {
         .conf_tx = wl1251_op_conf_tx,
 };
 
+static int wl1251_read_eeprom_byte(struct wl1251 *wl, off_t offset, u8 *data)
+{
+        unsigned long timeout;
+
+        wl1251_reg_write32(wl, EE_ADDR, offset);
+        wl1251_reg_write32(wl, EE_CTL, EE_CTL_READ);
+
+        /* EE_CTL_READ clears when data is ready */
+        timeout = jiffies + msecs_to_jiffies(100);
+        while (1) {
+                if (!(wl1251_reg_read32(wl, EE_CTL) & EE_CTL_READ))
+                        break;
+
+                if (time_after(jiffies, timeout))
+                        return -ETIMEDOUT;
+
+                msleep(1);
+        }
+
+        *data = wl1251_reg_read32(wl, EE_DATA);
+        return 0;
+}
+
+static int wl1251_read_eeprom(struct wl1251 *wl, off_t offset,
+                              u8 *data, size_t len)
+{
+        size_t i;
+        int ret;
+
+        wl1251_reg_write32(wl, EE_START, 0);
+
+        for (i = 0; i < len; i++) {
+                ret = wl1251_read_eeprom_byte(wl, offset + i, &data[i]);
+                if (ret < 0)
+                        return ret;
+        }
+
+        return 0;
+}
+
+static int wl1251_read_eeprom_mac(struct wl1251 *wl)
+{
+        u8 mac[ETH_ALEN];
+        int i, ret;
+
+        wl1251_set_partition(wl, 0, 0, REGISTERS_BASE, REGISTERS_DOWN_SIZE);
+
+        ret = wl1251_read_eeprom(wl, 0x1c, mac, sizeof(mac));
+        if (ret < 0) {
+                wl1251_warning("failed to read MAC address from EEPROM");
+                return ret;
+        }
+
+        /* MAC is stored in reverse order */
+        for (i = 0; i < ETH_ALEN; i++)
+                wl->mac_addr[i] = mac[ETH_ALEN - i - 1];
+
+        return 0;
+}
+
 static int wl1251_register_hw(struct wl1251 *wl)
 {
         int ret;
@@ -1231,7 +1292,6 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
         wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_BEACON_FILTER |
                 IEEE80211_HW_SUPPORTS_UAPSD;
@@ -1242,6 +1302,9 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
 
         wl->hw->queues = 4;
 
+        if (wl->use_eeprom)
+                wl1251_read_eeprom_mac(wl);
+
         ret = wl1251_register_hw(wl);
         if (ret)
                 goto out;
diff --git a/drivers/net/wireless/wl12xx/wl1251_reg.h b/drivers/net/wireless/wl12xx/wl1251_reg.h
index 0ca3b4326056..d16edd9bf06c 100644
--- a/drivers/net/wireless/wl12xx/wl1251_reg.h
+++ b/drivers/net/wireless/wl12xx/wl1251_reg.h
@@ -46,7 +46,14 @@
 #define SOR_CFG                        (REGISTERS_BASE + 0x0800)
 #define ECPU_CTRL                      (REGISTERS_BASE + 0x0804)
 #define HI_CFG                         (REGISTERS_BASE + 0x0808)
+
+/* EEPROM registers */
 #define EE_START                       (REGISTERS_BASE + 0x080C)
+#define EE_CTL                         (REGISTERS_BASE + 0x2000)
+#define EE_DATA                        (REGISTERS_BASE + 0x2004)
+#define EE_ADDR                        (REGISTERS_BASE + 0x2008)
+
+#define EE_CTL_READ                   2
 
 #define CHIP_ID_B                      (REGISTERS_BASE + 0x5674)
 
diff --git a/drivers/net/wireless/wl12xx/wl1251_rx.c b/drivers/net/wireless/wl12xx/wl1251_rx.c
index 6f229e0990f4..af5c67b4da95 100644
--- a/drivers/net/wireless/wl12xx/wl1251_rx.c
+++ b/drivers/net/wireless/wl12xx/wl1251_rx.c
@@ -74,12 +74,6 @@ static void wl1251_rx_status(struct wl1251 *wl,
 
         status->signal = desc->rssi;
 
-        /*
-         * FIXME: guessing that snr needs to be divided by two, otherwise
-         * the values don't make any sense
-         */
-        status->noise = desc->rssi - desc->snr / 2;
-
         status->freq = ieee80211_channel_to_frequency(desc->channel);
 
         status->flag |= RX_FLAG_TSFT;
diff --git a/drivers/net/wireless/wl12xx/wl1251_sdio.c b/drivers/net/wireless/wl12xx/wl1251_sdio.c
index 2051ef06e9ec..d234285c2c81 100644
--- a/drivers/net/wireless/wl12xx/wl1251_sdio.c
+++ b/drivers/net/wireless/wl12xx/wl1251_sdio.c
@@ -23,6 +23,9 @@
 #include <linux/mod_devicetable.h>
 #include <linux/mmc/sdio_func.h>
 #include <linux/mmc/sdio_ids.h>
+#include <linux/platform_device.h>
+#include <linux/spi/wl12xx.h>
+#include <linux/irq.h>
 
 #include "wl1251.h"
 
@@ -34,6 +37,8 @@
 #define SDIO_DEVICE_ID_TI_WL1251        0x9066
 #endif
 
+static struct wl12xx_platform_data *wl12xx_board_data;
+
 static struct sdio_func *wl_to_func(struct wl1251 *wl)
 {
         return wl->if_priv;
@@ -130,18 +135,60 @@ static void wl1251_sdio_disable_irq(struct wl1251 *wl)
         sdio_release_host(func);
 }
 
+/* Interrupts when using dedicated WLAN_IRQ pin */
+static irqreturn_t wl1251_line_irq(int irq, void *cookie)
+{
+        struct wl1251 *wl = cookie;
+
+        ieee80211_queue_work(wl->hw, &wl->irq_work);
+
+        return IRQ_HANDLED;
+}
+
+static void wl1251_enable_line_irq(struct wl1251 *wl)
+{
+        return enable_irq(wl->irq);
+}
+
+static void wl1251_disable_line_irq(struct wl1251 *wl)
+{
+        return disable_irq(wl->irq);
+}
+
 static void wl1251_sdio_set_power(bool enable)
 {
 }
 
-static const struct wl1251_if_operations wl1251_sdio_ops = {
+static struct wl1251_if_operations wl1251_sdio_ops = {
         .read = wl1251_sdio_read,
         .write = wl1251_sdio_write,
         .write_elp = wl1251_sdio_write_elp,
         .read_elp = wl1251_sdio_read_elp,
         .reset = wl1251_sdio_reset,
-        .enable_irq = wl1251_sdio_enable_irq,
-        .disable_irq = wl1251_sdio_disable_irq,
+};
+
+static int wl1251_platform_probe(struct platform_device *pdev)
+{
+        if (pdev->id != -1) {
+                wl1251_error("can only handle single device");
+                return -ENODEV;
+        }
+
+        wl12xx_board_data = pdev->dev.platform_data;
+        return 0;
+}
+
+/*
+ * Dummy platform_driver for passing platform_data to this driver,
+ * until we have a way to pass this through SDIO subsystem or
+ * some other way.
+ */
+static struct platform_driver wl1251_platform_driver = {
+        .driver = {
+                .name   = "wl1251_data",
+                .owner  = THIS_MODULE,
+        },
+        .probe  = wl1251_platform_probe,
 };
 
 static int wl1251_sdio_probe(struct sdio_func *func,
@@ -163,20 +210,50 @@ static int wl1251_sdio_probe(struct sdio_func *func,
                 goto release;
 
         sdio_set_block_size(func, 512);
+        sdio_release_host(func);
 
         SET_IEEE80211_DEV(hw, &func->dev);
         wl->if_priv = func;
         wl->if_ops = &wl1251_sdio_ops;
         wl->set_power = wl1251_sdio_set_power;
 
-        sdio_release_host(func);
+        if (wl12xx_board_data != NULL) {
+                wl->set_power = wl12xx_board_data->set_power;
+                wl->irq = wl12xx_board_data->irq;
+                wl->use_eeprom = wl12xx_board_data->use_eeprom;
+        }
+
+        if (wl->irq) {
+                ret = request_irq(wl->irq, wl1251_line_irq, 0, "wl1251", wl);
+                if (ret < 0) {
+                        wl1251_error("request_irq() failed: %d", ret);
+                        goto disable;
+                }
+
+                set_irq_type(wl->irq, IRQ_TYPE_EDGE_RISING);
+                disable_irq(wl->irq);
+
+                wl1251_sdio_ops.enable_irq = wl1251_enable_line_irq;
+                wl1251_sdio_ops.disable_irq = wl1251_disable_line_irq;
+
+                wl1251_info("using dedicated interrupt line");
+        } else {
+                wl1251_sdio_ops.enable_irq = wl1251_sdio_enable_irq;
+                wl1251_sdio_ops.disable_irq = wl1251_sdio_disable_irq;
+
+                wl1251_info("using SDIO interrupt");
+        }
+
         ret = wl1251_init_ieee80211(wl);
         if (ret)
-                goto disable;
+                goto out_free_irq;
 
         sdio_set_drvdata(func, wl);
         return ret;
 
+out_free_irq:
+        if (wl->irq)
+                free_irq(wl->irq, wl);
 disable:
         sdio_claim_host(func);
         sdio_disable_func(func);
@@ -189,6 +266,8 @@ static void __devexit wl1251_sdio_remove(struct sdio_func *func)
 {
         struct wl1251 *wl = sdio_get_drvdata(func);
 
+        if (wl->irq)
+                free_irq(wl->irq, wl);
         wl1251_free_hw(wl);
 
         sdio_claim_host(func);
@@ -208,6 +287,12 @@ static int __init wl1251_sdio_init(void)
 {
         int err;
 
+        err = platform_driver_register(&wl1251_platform_driver);
+        if (err) {
+                wl1251_error("failed to register platform driver: %d", err);
+                return err;
+        }
+
         err = sdio_register_driver(&wl1251_sdio_driver);
         if (err)
                 wl1251_error("failed to register sdio driver: %d", err);
@@ -217,6 +302,7 @@ static int __init wl1251_sdio_init(void)
 static void __exit wl1251_sdio_exit(void)
 {
         sdio_unregister_driver(&wl1251_sdio_driver);
+        platform_driver_unregister(&wl1251_platform_driver);
         wl1251_notice("unloaded");
 }
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_acx.c b/drivers/net/wireless/wl12xx/wl1271_acx.c
index 2ad086efe06e..e19e2f8f1e52 100644
--- a/drivers/net/wireless/wl12xx/wl1271_acx.c
+++ b/drivers/net/wireless/wl12xx/wl1271_acx.c
@@ -590,7 +590,7 @@ int wl1271_acx_sg_cfg(struct wl1271 *wl)
 
         /* BT-WLAN coext parameters */
         for (i = 0; i < CONF_SG_PARAMS_MAX; i++)
-                param->params[i] = c->params[i];
+                param->params[i] = cpu_to_le32(c->params[i]);
         param->param_idx = CONF_SG_PARAMS_ALL;
 
         ret = wl1271_cmd_configure(wl, ACX_SG_CFG, param, sizeof(*param));
diff --git a/drivers/net/wireless/wl12xx/wl1271_boot.c b/drivers/net/wireless/wl12xx/wl1271_boot.c
index 8087dc17f29d..acb1d9e6b7d2 100644
--- a/drivers/net/wireless/wl12xx/wl1271_boot.c
+++ b/drivers/net/wireless/wl12xx/wl1271_boot.c
@@ -351,7 +351,7 @@ static int wl1271_boot_soft_reset(struct wl1271 *wl)
 static int wl1271_boot_run_firmware(struct wl1271 *wl)
 {
         int loop, ret;
-        u32 chip_id, interrupt;
+        u32 chip_id, intr;
 
         wl1271_boot_set_ecpu_ctrl(wl, ECPU_CONTROL_HALT);
 
@@ -368,15 +368,15 @@ static int wl1271_boot_run_firmware(struct wl1271 *wl)
         loop = 0;
         while (loop++ < INIT_LOOP) {
                 udelay(INIT_LOOP_DELAY);
-                interrupt = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
+                intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
 
-                if (interrupt == 0xffffffff) {
+                if (intr == 0xffffffff) {
                         wl1271_error("error reading hardware complete "
                                      "init indication");
                         return -EIO;
                 }
                 /* check that ACX_INTR_INIT_COMPLETE is enabled */
-                else if (interrupt & WL1271_ACX_INTR_INIT_COMPLETE) {
+                else if (intr & WL1271_ACX_INTR_INIT_COMPLETE) {
                         wl1271_write32(wl, ACX_REG_INTERRUPT_ACK,
                                        WL1271_ACX_INTR_INIT_COMPLETE);
                         break;
diff --git a/drivers/net/wireless/wl12xx/wl1271_cmd.c b/drivers/net/wireless/wl12xx/wl1271_cmd.c
index 6b5ba8ec94c9..62c11af1d8e2 100644
--- a/drivers/net/wireless/wl12xx/wl1271_cmd.c
+++ b/drivers/net/wireless/wl12xx/wl1271_cmd.c
@@ -37,7 +37,7 @@
 #include "wl1271_cmd.h"
 #include "wl1271_event.h"
 
-#define WL1271_CMD_POLL_COUNT       5
+#define WL1271_CMD_FAST_POLL_COUNT       50
 
 /*
  * send command to firmware
@@ -77,11 +77,11 @@ int wl1271_cmd_send(struct wl1271 *wl, u16 id, void *buf, size_t len,
                         goto out;
                 }
 
-                udelay(10);
                 poll_count++;
-                if (poll_count == WL1271_CMD_POLL_COUNT)
-                        wl1271_info("cmd polling took over %d cycles",
-                                    poll_count);
+                if (poll_count < WL1271_CMD_FAST_POLL_COUNT)
+                        udelay(10);
+                else
+                        msleep(1);
 
                 intr = wl1271_read32(wl, ACX_REG_INTERRUPT_NO_CLEAR);
         }
@@ -318,7 +318,7 @@ int wl1271_cmd_join(struct wl1271 *wl, u8 bss_type)
         join->rx_config_options = cpu_to_le32(wl->rx_config);
         join->rx_filter_options = cpu_to_le32(wl->rx_filter);
         join->bss_type = bss_type;
-        join->basic_rate_set = wl->basic_rate_set;
+        join->basic_rate_set = cpu_to_le32(wl->basic_rate_set);
 
         if (wl->band == IEEE80211_BAND_5GHZ)
                 join->bss_type |= WL1271_JOIN_CMD_BSS_TYPE_5GHZ;
@@ -615,7 +615,7 @@ int wl1271_cmd_scan(struct wl1271 *wl, const u8 *ssid, size_t ssid_len,
         params->params.scan_options = cpu_to_le16(scan_options);
 
         params->params.num_probe_requests = probe_requests;
-        params->params.tx_rate = rate;
+        params->params.tx_rate = cpu_to_le32(rate);
         params->params.tid_trigger = 0;
         params->params.scan_tag = WL1271_SCAN_DEFAULT_TAG;
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_conf.h b/drivers/net/wireless/wl12xx/wl1271_conf.h
index c44307c4bcf8..d046d044b5bd 100644
--- a/drivers/net/wireless/wl12xx/wl1271_conf.h
+++ b/drivers/net/wireless/wl12xx/wl1271_conf.h
@@ -401,7 +401,7 @@ enum {
 };
 
 struct conf_sg_settings {
-        __le32 params[CONF_SG_PARAMS_MAX];
+        u32 params[CONF_SG_PARAMS_MAX];
         u8 state;
 };
 
diff --git a/drivers/net/wireless/wl12xx/wl1271_main.c b/drivers/net/wireless/wl12xx/wl1271_main.c
index 814f300c3f17..62e544041d0d 100644
--- a/drivers/net/wireless/wl12xx/wl1271_main.c
+++ b/drivers/net/wireless/wl12xx/wl1271_main.c
@@ -1118,14 +1118,13 @@ static void wl1271_configure_filters(struct wl1271 *wl, unsigned int filters)
         }
 }
 
-static int wl1271_join_channel(struct wl1271 *wl, int channel)
+static int wl1271_dummy_join(struct wl1271 *wl)
 {
         int ret = 0;
         /* we need to use a dummy BSSID for now */
         static const u8 dummy_bssid[ETH_ALEN] = { 0x0b, 0xad, 0xde,
                                                   0xad, 0xbe, 0xef };
 
-        wl->channel = channel;
         memcpy(wl->bssid, dummy_bssid, ETH_ALEN);
 
         /* pass through frames from all BSS */
@@ -1141,7 +1140,47 @@ out:
         return ret;
 }
 
-static int wl1271_unjoin_channel(struct wl1271 *wl)
+static int wl1271_join(struct wl1271 *wl)
+{
+        int ret;
+
+        ret = wl1271_cmd_join(wl, wl->set_bss_type);
+        if (ret < 0)
+                goto out;
+
+        set_bit(WL1271_FLAG_JOINED, &wl->flags);
+
+        if (!test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags))
+                goto out;
+
+        /*
+         * The join command disable the keep-alive mode, shut down its process,
+         * and also clear the template config, so we need to reset it all after
+         * the join. The acx_aid starts the keep-alive process, and the order
+         * of the commands below is relevant.
+         */
+        ret = wl1271_acx_keep_alive_mode(wl, true);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_acx_aid(wl, wl->aid);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_cmd_build_klv_null_data(wl);
+        if (ret < 0)
+                goto out;
+
+        ret = wl1271_acx_keep_alive_config(wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
+                                           ACX_KEEP_ALIVE_TPL_VALID);
+        if (ret < 0)
+                goto out;
+
+out:
+        return ret;
+}
+
+static int wl1271_unjoin(struct wl1271 *wl)
 {
         int ret;
 
@@ -1231,7 +1270,7 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
                                        "failed %d", ret);
 
                 if (test_bit(WL1271_FLAG_JOINED, &wl->flags)) {
-                        ret = wl1271_cmd_join(wl, wl->set_bss_type);
+                        ret = wl1271_join(wl);
                         if (ret < 0)
                                 wl1271_warning("cmd join to update channel "
                                                "failed %d", ret);
@@ -1241,9 +1280,9 @@ static int wl1271_op_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_IDLE) {
                 if (conf->flags & IEEE80211_CONF_IDLE &&
                     test_bit(WL1271_FLAG_JOINED, &wl->flags))
-                        wl1271_unjoin_channel(wl);
+                        wl1271_unjoin(wl);
                 else if (!(conf->flags & IEEE80211_CONF_IDLE))
-                        wl1271_join_channel(wl, channel);
+                        wl1271_dummy_join(wl);
 
                 if (conf->flags & IEEE80211_CONF_IDLE) {
                         wl->rate_set = wl1271_min_rate_get(wl);
@@ -1311,7 +1350,6 @@ static u64 wl1271_op_prepare_multicast(struct ieee80211_hw *hw,
         struct wl1271_filter_params *fp;
         struct netdev_hw_addr *ha;
         struct wl1271 *wl = hw->priv;
-        int i;
 
         if (unlikely(wl->state == WL1271_STATE_OFF))
                 return 0;
@@ -1520,6 +1558,7 @@ out:
 }
 
 static int wl1271_op_hw_scan(struct ieee80211_hw *hw,
+                             struct ieee80211_vif *vif,
                              struct cfg80211_scan_request *req)
 {
         struct wl1271 *wl = hw->priv;
@@ -1608,7 +1647,6 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         enum wl1271_cmd_ps_mode mode;
         struct wl1271 *wl = hw->priv;
         bool do_join = false;
-        bool do_keepalive = false;
         int ret;
 
         wl1271_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1703,6 +1741,10 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         if (ret < 0)
                                 goto out_sleep;
 
+                        ret = wl1271_build_qos_null_data(wl);
+                        if (ret < 0)
+                                goto out_sleep;
+
                         /* filter out all packets not from this BSSID */
                         wl1271_configure_filters(wl, 0);
 
@@ -1747,19 +1789,6 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
                         ret = wl1271_cmd_build_probe_req(wl, NULL, 0,
                                                          NULL, 0, wl->band);
 
-                        /* Enable the keep-alive feature */
-                        ret = wl1271_acx_keep_alive_mode(wl, true);
-                        if (ret < 0)
-                                goto out_sleep;
-
-                        /*
-                         * This is awkward. The keep-alive configs must be done
-                         * *after* the join command, because otherwise it will
-                         * not work, but it must only be done *once* because
-                         * otherwise the firmware will start complaining.
-                         */
-                        do_keepalive = true;
-
                         /* enable the connection monitoring feature */
                         ret = wl1271_acx_conn_monit_params(wl, true);
                         if (ret < 0)
@@ -1827,35 +1856,11 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (do_join) {
-                ret = wl1271_cmd_join(wl, wl->set_bss_type);
+                ret = wl1271_join(wl);
                 if (ret < 0) {
                         wl1271_warning("cmd join failed %d", ret);
                         goto out_sleep;
                 }
-                set_bit(WL1271_FLAG_JOINED, &wl->flags);
-        }
-
-        /*
-         * The JOIN operation shuts down the firmware keep-alive as a side
-         * effect, and the ACX_AID will start the keep-alive as a side effect.
-         * Hence, for non-IBSS, the ACX_AID must always happen *after* the
-         * JOIN operation, and the template config after the ACX_AID.
-         */
-        if (test_bit(WL1271_FLAG_STA_ASSOCIATED, &wl->flags)) {
-                ret = wl1271_acx_aid(wl, wl->aid);
-                if (ret < 0)
-                        goto out_sleep;
-        }
-
-        if (do_keepalive) {
-                ret = wl1271_cmd_build_klv_null_data(wl);
-                if (ret < 0)
-                        goto out_sleep;
-                ret = wl1271_acx_keep_alive_config(
-                        wl, CMD_TEMPL_KLV_IDX_NULL_DATA,
-                        ACX_KEEP_ALIVE_TPL_VALID);
-                if (ret < 0)
-                        goto out_sleep;
         }
 
 out_sleep:
@@ -2266,7 +2271,6 @@ int wl1271_init_ieee80211(struct wl1271 *wl)
         wl->hw->max_listen_interval = wl->conf.conn.max_listen_interval;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
-                IEEE80211_HW_NOISE_DBM |
                 IEEE80211_HW_BEACON_FILTER |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_SUPPORTS_UAPSD |
diff --git a/drivers/net/xilinx_emaclite.c b/drivers/net/xilinx_emaclite.c
index e9381fe3baf4..93828d565390 100644
--- a/drivers/net/xilinx_emaclite.c
+++ b/drivers/net/xilinx_emaclite.c
@@ -1171,7 +1171,7 @@ static int __devinit xemaclite_of_probe(struct of_device *ofdev,
         }
 
         /* Get the virtual base address for the device */
-        lp->base_addr = ioremap(r_mem.start, r_mem.end - r_mem.start + 1);
+        lp->base_addr = ioremap(r_mem.start, resource_size(&r_mem));
         if (NULL == lp->base_addr) {
                 dev_err(dev, "EmacLite: Could not allocate iomem\n");
                 rc = -EIO;
@@ -1224,7 +1224,7 @@ static int __devinit xemaclite_of_probe(struct of_device *ofdev,
         return 0;
 
 error1:
-        release_mem_region(ndev->mem_start, r_mem.end - r_mem.start + 1);
+        release_mem_region(ndev->mem_start, resource_size(&r_mem));
 
 error2:
         xemaclite_remove_ndev(ndev);
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index f230f6543bff..854959cada3a 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -1484,6 +1484,11 @@ int pccard_validate_cis(struct pcmcia_socket *s, unsigned int *info)
         if (!s)
                 return -EINVAL;
 
+        if (s->functions) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
+
         /* We do not want to validate the CIS cache... */
         mutex_lock(&s->ops_mutex);
         destroy_cis_cache(s);
@@ -1639,7 +1644,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
                 count = 0;
         else {
                 struct pcmcia_socket *s;
-                unsigned int chains;
+                unsigned int chains = 1;
 
                 if (off + count > size)
                         count = size - off;
@@ -1648,7 +1653,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
 
                 if (!(s->state & SOCKET_PRESENT))
                         return -ENODEV;
-                if (pccard_validate_cis(s, &chains))
+                if (!s->functions && pccard_validate_cis(s, &chains))
                         return -EIO;
                 if (!chains)
                         return -ENODATA;
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 6206408e196c..2d48196a48cd 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -166,8 +166,10 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
 
                 ret = request_irq(sock->insert_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_insert", sock);
-                if (ret)
+                if (ret) {
+                        local_irq_restore(flags);
                         goto out1;
+                }
 
                 ret = request_irq(sock->eject_irq, db1200_pcmcia_cdirq,
                                   IRQF_DISABLED, "pcmcia_eject", sock);
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index cb6036d89e59..4014cf8e4a26 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -687,12 +687,10 @@ static void pcmcia_requery(struct pcmcia_socket *s)
                         new_funcs = mfc.nfn;
                 else
                         new_funcs = 1;
-                if (old_funcs > new_funcs) {
+                if (old_funcs != new_funcs) {
+                        /* we need to re-start */
                         pcmcia_card_remove(s, NULL);
                         pcmcia_card_add(s);
-                } else if (new_funcs > old_funcs) {
-                        s->functions = new_funcs;
-                        pcmcia_device_add(s, 1);
                 }
         }
 
@@ -728,6 +726,8 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
         struct pcmcia_socket *s = dev->socket;
         const struct firmware *fw;
         int ret = -ENOMEM;
+        cistpl_longlink_mfc_t mfc;
+        int old_funcs, new_funcs = 1;
 
         if (!filename)
                 return -EINVAL;
@@ -750,6 +750,14 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
                         goto release;
                 }
 
+                /* we need to re-start if the number of functions changed */
+                old_funcs = s->functions;
+                if (!pccard_read_tuple(s, BIND_FN_ALL, CISTPL_LONGLINK_MFC,
+                                        &mfc))
+                        new_funcs = mfc.nfn;
+
+                if (old_funcs != new_funcs)
+                        ret = -EBUSY;
 
                 /* update information */
                 pcmcia_device_query(dev);
@@ -858,10 +866,8 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_FAKE_CIS) {
                 dev_dbg(&dev->dev, "device needs a fake CIS\n");
                 if (!dev->socket->fake_cis)
-                        pcmcia_load_firmware(dev, did->cisfile);
-
-                if (!dev->socket->fake_cis)
-                        return 0;
+                        if (pcmcia_load_firmware(dev, did->cisfile))
+                                return 0;
         }
 
         if (did->match_flags & PCMCIA_DEV_ID_MATCH_ANONYMOUS) {
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index caec1dee2a4b..7c3d03bb4f30 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -755,12 +755,12 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
         else
                 printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
 
-#ifdef CONFIG_PCMCIA_PROBE
-
-        if (s->irq.AssignedIRQ != 0) {
-                /* If the interrupt is already assigned, it must be the same */
+        /* If the interrupt is already assigned, it must be the same */
+        if (s->irq.AssignedIRQ != 0)
                 irq = s->irq.AssignedIRQ;
-        } else {
+
+#ifdef CONFIG_PCMCIA_PROBE
+        if (!irq) {
                 int try;
                 u32 mask = s->irq_mask;
                 void *data = p_dev; /* something unique to this device */
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 559069a80a3b..a6eb7b59ba9f 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -214,7 +214,7 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
                 return;
         }
         for (i = base, most = 0; i < base+num; i += 8) {
-                res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+                res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
                 if (!res)
                         continue;
                 hole = inb(i);
@@ -231,9 +231,14 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
 
         bad = any = 0;
         for (i = base; i < base+num; i += 8) {
-                res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
-                if (!res)
+                res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+                if (!res) {
+                        if (!any)
+                                printk(" excluding");
+                        if (!bad)
+                                bad = any = i;
                         continue;
+                }
                 for (j = 0; j < 8; j++)
                         if (inb(i+j) != most)
                                 break;
@@ -253,6 +258,7 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
         }
         if (bad) {
                 if ((num > 16) && (bad == base) && (i == base+num)) {
+                        sub_interval(&s_data->io_db, bad, i-bad);
                         printk(" nothing: probe failed.\n");
                         return;
                 } else {
@@ -804,7 +810,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
 static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long start, unsigned long end)
 {
         struct socket_data *data = s->resource_data;
-        unsigned long size = end - start + 1;
+        unsigned long size;
         int ret = 0;
 
 #if defined(CONFIG_X86)
@@ -814,6 +820,8 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
                 start = 0x100;
 #endif
 
+        size = end - start + 1;
+
         if (end < start)
                 return -EINVAL;
 
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 0ee725ced511..9eae04afa9a0 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -599,9 +599,9 @@ static void iscsi_sw_tcp_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
         set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
         write_unlock_bh(&tcp_sw_conn->sock->sk->sk_callback_lock);
 
-        if (sock->sk->sk_sleep && waitqueue_active(sock->sk->sk_sleep)) {
+        if (sk_sleep(sock->sk) && waitqueue_active(sk_sleep(sock->sk))) {
                 sock->sk->sk_err = EIO;
-                wake_up_interruptible(sock->sk->sk_sleep);
+                wake_up_interruptible(sk_sleep(sock->sk));
         }
 
         iscsi_conn_stop(cls_conn, flag);
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 175d202ab37e..8cfa5b12ea7a 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -105,6 +105,10 @@ struct serial_cfg_mem {
  * manfid 0x0160, 0x0104
  * This card appears to have a 14.7456MHz clock.
  */
+/* Generic Modem: MD55x (GPRS/EDGE) have
+ * Elan VPU16551 UART with 14.7456MHz oscillator
+ * manfid 0x015D, 0x4C45
+ */
 static void quirk_setup_brainboxes_0104(struct pcmcia_device *link, struct uart_port *port)
 {
         port->uartclk = 14745600;
@@ -196,6 +200,11 @@ static const struct serial_quirk quirks[] = {
                 .multi  = -1,
                 .setup  = quirk_setup_brainboxes_0104,
         }, {
+                .manfid = 0x015D,
+                .prodid = 0x4C45,
+                .multi  = -1,
+                .setup  = quirk_setup_brainboxes_0104,
+        }, {
                 .manfid = MANFID_IBM,
                 .prodid = ~0,
                 .multi  = -1,
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index 59c3c0fdbecd..59ae76bace14 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -233,6 +233,8 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
 {
         if (!cc->dev)
                 return; /* We don't have a ChipCommon */
+        if (cc->dev->id.revision >= 11)
+                cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
         ssb_pmu_init(cc);
         chipco_powercontrol_init(cc);
         ssb_chipco_set_clockmode(cc, SSB_CLKMODE_FAST);
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index f1dcd7969a5c..0e8d35224614 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -246,20 +246,12 @@ static struct pci_controller ssb_pcicore_controller = {
         .pci_ops        = &ssb_pcicore_pciops,
         .io_resource    = &ssb_pcicore_io_resource,
         .mem_resource   = &ssb_pcicore_mem_resource,
-        .mem_offset     = 0x24000000,
 };
 
-static u32 ssb_pcicore_pcibus_iobase = 0x100;
-static u32 ssb_pcicore_pcibus_membase = SSB_PCI_DMA;
-
 /* This function is called when doing a pci_enable_device().
  * We must first check if the device is a device on the PCI-core bridge. */
 int ssb_pcicore_plat_dev_init(struct pci_dev *d)
 {
-        struct resource *res;
-        int pos, size;
-        u32 *base;
-
         if (d->bus->ops != &ssb_pcicore_pciops) {
                 /* This is not a device on the PCI-core bridge. */
                 return -ENODEV;
@@ -268,27 +260,6 @@ int ssb_pcicore_plat_dev_init(struct pci_dev *d)
         ssb_printk(KERN_INFO "PCI: Fixing up device %s\n",
                    pci_name(d));
 
-        /* Fix up resource bases */
-        for (pos = 0; pos < 6; pos++) {
-                res = &d->resource[pos];
-                if (res->flags & IORESOURCE_IO)
-                        base = &ssb_pcicore_pcibus_iobase;
-                else
-                        base = &ssb_pcicore_pcibus_membase;
-                res->flags |= IORESOURCE_PCI_FIXED;
-                if (res->end) {
-                        size = res->end - res->start + 1;
-                        if (*base & (size - 1))
-                                *base = (*base + size) & ~(size - 1);
-                        res->start = *base;
-                        res->end = res->start + size - 1;
-                        *base += size;
-                        pci_write_config_dword(d, PCI_BASE_ADDRESS_0 + (pos << 2), res->start);
-                }
-                /* Fix up PCI bridge BAR0 only */
-                if (d->bus->number == 0 && PCI_SLOT(d->devfn) == 0)
-                        break;
-        }
         /* Fix up interrupt lines */
         d->irq = ssb_mips_irq(extpci_core->dev) + 2;
         pci_write_config_byte(d, PCI_INTERRUPT_LINE, d->irq);
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 80ff7d9e60de..7e5b8a8a64cc 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -834,6 +834,9 @@ int ssb_bus_pcibus_register(struct ssb_bus *bus,
         if (!err) {
                 ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
                            "PCI device %s\n", dev_name(&host_pci->dev));
+        } else {
+                ssb_printk(KERN_ERR PFX "Failed to register PCI version"
+                           " of SSB with error %d\n", err);
         }
 
         return err;
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index a8dbb06623c9..989e2752cc36 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -168,7 +168,7 @@ err_pci:
 }
 
 /* Get the word-offset for a SSB_SPROM_XXX define. */
-#define SPOFF(offset)   (((offset) - SSB_SPROM_BASE) / sizeof(u16))
+#define SPOFF(offset)   ((offset) / sizeof(u16))
 /* Helper to extract some _offset, which is one of the SSB_SPROM_XXX defines. */
 #define SPEX16(_outvar, _offset, _mask, _shift) \
         out->_outvar = ((in[SPOFF(_offset)] & (_mask)) >> (_shift))
@@ -254,7 +254,7 @@ static int sprom_do_read(struct ssb_bus *bus, u16 *sprom)
         int i;
 
         for (i = 0; i < bus->sprom_size; i++)
-                sprom[i] = ioread16(bus->mmio + SSB_SPROM_BASE + (i * 2));
+                sprom[i] = ioread16(bus->mmio + bus->sprom_offset + (i * 2));
 
         return 0;
 }
@@ -285,7 +285,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
                         ssb_printk("75%%");
                 else if (i % 2)
                         ssb_printk(".");
-                writew(sprom[i], bus->mmio + SSB_SPROM_BASE + (i * 2));
+                writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
                 mmiowb();
                 msleep(20);
         }
@@ -621,6 +621,14 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
         int err = -ENOMEM;
         u16 *buf;
 
+        if (!ssb_is_sprom_available(bus)) {
+                ssb_printk(KERN_ERR PFX "No SPROM available!\n");
+                return -ENODEV;
+        }
+
+        bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
+                SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
+
         buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
         if (!buf)
                 goto out;
diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
index f2f920fef10d..007bc3a03486 100644
--- a/drivers/ssb/sprom.c
+++ b/drivers/ssb/sprom.c
@@ -176,3 +176,17 @@ const struct ssb_sprom *ssb_get_fallback_sprom(void)
 {
         return fallback_sprom;
 }
+
+/* http://bcm-v4.sipsolutions.net/802.11/IsSpromAvailable */
+bool ssb_is_sprom_available(struct ssb_bus *bus)
+{
+        /* status register only exists on chipcomon rev >= 11 and we need check
+           for >= 31 only */
+        /* this routine differs from specs as we do not access SPROM directly
+           on PCMCIA */
+        if (bus->bustype == SSB_BUSTYPE_PCI &&
+            bus->chipco.dev->id.revision >= 31)
+                return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;
+
+        return true;
+}
diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig
index 0e8468ffd100..0bf5020d0d32 100644
--- a/drivers/watchdog/Kconfig
+++ b/drivers/watchdog/Kconfig
@@ -194,10 +194,10 @@ config EP93XX_WATCHDOG
 
 config OMAP_WATCHDOG
         tristate "OMAP Watchdog"
-        depends on ARCH_OMAP16XX || ARCH_OMAP2 || ARCH_OMAP3
+        depends on ARCH_OMAP16XX || ARCH_OMAP2PLUS
         help
-          Support for TI OMAP1610/OMAP1710/OMAP2420/OMAP3430 watchdog.  Say 'Y'
-          here to enable the OMAP1610/OMAP1710/OMAP2420/OMAP3430 watchdog timer.
+          Support for TI OMAP1610/OMAP1710/OMAP2420/OMAP3430/OMAP4430 watchdog.  Say 'Y'
+          here to enable the OMAP1610/OMAP1710/OMAP2420/OMAP3430/OMAP4430 watchdog timer.
 
 config PNX4008_WATCHDOG
         tristate "PNX4008 Watchdog"
@@ -302,7 +302,7 @@ config TS72XX_WATCHDOG
 
 config MAX63XX_WATCHDOG
         tristate "Max63xx watchdog"
-        depends on ARM
+        depends on ARM && HAS_IOMEM
         help
           Support for memory mapped max63{69,70,71,72,73,74} watchdog timer.
 
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 8b724aad6825..500d38342e1e 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -44,7 +44,7 @@ u32 booke_wdt_period = WDT_PERIOD_DEFAULT;
 
 #ifdef  CONFIG_FSL_BOOKE
 #define WDTP(x)         ((((x)&0x3)<<30)|(((x)&0x3c)<<15))
-#define WDTP_MASK       (WDTP(0))
+#define WDTP_MASK       (WDTP(0x3f))
 #else
 #define WDTP(x)         (TCR_WP(x))
 #define WDTP_MASK       (TCR_WP_MASK)
diff --git a/drivers/watchdog/max63xx_wdt.c b/drivers/watchdog/max63xx_wdt.c
index 75f3a83c0361..3053ff05ca41 100644
--- a/drivers/watchdog/max63xx_wdt.c
+++ b/drivers/watchdog/max63xx_wdt.c
@@ -154,9 +154,14 @@ static void max63xx_wdt_enable(struct max63xx_timeout *entry)
 
 static void max63xx_wdt_disable(void)
 {
+        u8 val;
+
         spin_lock(&io_lock);
 
-        __raw_writeb(3, wdt_base);
+        val = __raw_readb(wdt_base);
+        val &= ~MAX6369_WDSET;
+        val |= 3;
+        __raw_writeb(val, wdt_base);
 
         spin_unlock(&io_lock);
 
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 9e23ffea7f54..b34d32fdaaec 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -3235,7 +3235,8 @@ int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
                                 u64 bytes)
 {
         struct btrfs_space_info *data_sinfo;
-        int ret = 0, committed = 0;
+        u64 used;
+        int ret = 0, committed = 0, flushed = 0;
 
         /* make sure bytes are sectorsize aligned */
         bytes = (bytes + root->sectorsize - 1) & ~((u64)root->sectorsize - 1);
@@ -3247,12 +3248,21 @@ int btrfs_check_data_free_space(struct btrfs_root *root, struct inode *inode,
 again:
         /* make sure we have enough space to handle the data first */
         spin_lock(&data_sinfo->lock);
-        if (data_sinfo->total_bytes - data_sinfo->bytes_used -
-            data_sinfo->bytes_delalloc - data_sinfo->bytes_reserved -
-            data_sinfo->bytes_pinned - data_sinfo->bytes_readonly -
-            data_sinfo->bytes_may_use - data_sinfo->bytes_super < bytes) {
+        used = data_sinfo->bytes_used + data_sinfo->bytes_delalloc +
+                data_sinfo->bytes_reserved + data_sinfo->bytes_pinned +
+                data_sinfo->bytes_readonly + data_sinfo->bytes_may_use +
+                data_sinfo->bytes_super;
+
+        if (used + bytes > data_sinfo->total_bytes) {
                 struct btrfs_trans_handle *trans;
 
+                if (!flushed) {
+                        spin_unlock(&data_sinfo->lock);
+                        flush_delalloc(root, data_sinfo);
+                        flushed = 1;
+                        goto again;
+                }
+
                 /*
                  * if we don't have enough free bytes in this space then we need
                  * to alloc a new chunk.
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index aa7dc36dac78..8db7b14bbae8 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -2250,6 +2250,12 @@ again:
         if (!looped)
                 calc_size = max_t(u64, min_stripe_size, calc_size);
 
+        /*
+         * we're about to do_div by the stripe_len so lets make sure
+         * we end up with something bigger than a stripe
+         */
+        calc_size = max_t(u64, calc_size, stripe_len * 4);
+
         do_div(calc_size, stripe_len);
         calc_size *= stripe_len;
 
diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c
index aa3cd7cc3e40..412593703d1e 100644
--- a/fs/ceph/addr.c
+++ b/fs/ceph/addr.c
@@ -337,16 +337,15 @@ out:
 /*
  * Get ref for the oldest snapc for an inode with dirty data... that is, the
  * only snap context we are allowed to write back.
- *
- * Caller holds i_lock.
  */
-static struct ceph_snap_context *__get_oldest_context(struct inode *inode,
-                                                      u64 *snap_size)
+static struct ceph_snap_context *get_oldest_context(struct inode *inode,
+                                                    u64 *snap_size)
 {
         struct ceph_inode_info *ci = ceph_inode(inode);
         struct ceph_snap_context *snapc = NULL;
         struct ceph_cap_snap *capsnap = NULL;
 
+        spin_lock(&inode->i_lock);
         list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
                 dout(" cap_snap %p snapc %p has %d dirty pages\n", capsnap,
                      capsnap->context, capsnap->dirty_pages);
@@ -357,21 +356,11 @@ static struct ceph_snap_context *__get_oldest_context(struct inode *inode,
                         break;
                 }
         }
-        if (!snapc && ci->i_snap_realm) {
-                snapc = ceph_get_snap_context(ci->i_snap_realm->cached_context);
+        if (!snapc && ci->i_head_snapc) {
+                snapc = ceph_get_snap_context(ci->i_head_snapc);
                 dout(" head snapc %p has %d dirty pages\n",
                      snapc, ci->i_wrbuffer_ref_head);
         }
-        return snapc;
-}
-
-static struct ceph_snap_context *get_oldest_context(struct inode *inode,
-                                                    u64 *snap_size)
-{
-        struct ceph_snap_context *snapc = NULL;
-
-        spin_lock(&inode->i_lock);
-        snapc = __get_oldest_context(inode, snap_size);
         spin_unlock(&inode->i_lock);
         return snapc;
 }
@@ -392,7 +381,7 @@ static int writepage_nounlock(struct page *page, struct writeback_control *wbc)
         int len = PAGE_CACHE_SIZE;
         loff_t i_size;
         int err = 0;
-        struct ceph_snap_context *snapc;
+        struct ceph_snap_context *snapc, *oldest;
         u64 snap_size = 0;
         long writeback_stat;
 
@@ -413,13 +402,16 @@ static int writepage_nounlock(struct page *page, struct writeback_control *wbc)
                 dout("writepage %p page %p not dirty?\n", inode, page);
                 goto out;
         }
-        if (snapc != get_oldest_context(inode, &snap_size)) {
+        oldest = get_oldest_context(inode, &snap_size);
+        if (snapc->seq > oldest->seq) {
                 dout("writepage %p page %p snapc %p not writeable - noop\n",
                      inode, page, (void *)page->private);
                 /* we should only noop if called by kswapd */
                 WARN_ON((current->flags & PF_MEMALLOC) == 0);
+                ceph_put_snap_context(oldest);
                 goto out;
         }
+        ceph_put_snap_context(oldest);
 
         /* is this a partial page at end of file? */
         if (snap_size)
@@ -458,7 +450,7 @@ static int writepage_nounlock(struct page *page, struct writeback_control *wbc)
         ClearPagePrivate(page);
         end_page_writeback(page);
         ceph_put_wrbuffer_cap_refs(ci, 1, snapc);
-        ceph_put_snap_context(snapc);
+        ceph_put_snap_context(snapc);  /* page's reference */
 out:
         return err;
 }
@@ -558,9 +550,9 @@ static void writepages_finish(struct ceph_osd_request *req,
                         dout("inode %p skipping page %p\n", inode, page);
                         wbc->pages_skipped++;
                 }
+                ceph_put_snap_context((void *)page->private);
                 page->private = 0;
                 ClearPagePrivate(page);
-                ceph_put_snap_context(snapc);
                 dout("unlocking %d %p\n", i, page);
                 end_page_writeback(page);
 
@@ -618,7 +610,7 @@ static int ceph_writepages_start(struct address_space *mapping,
         int range_whole = 0;
         int should_loop = 1;
         pgoff_t max_pages = 0, max_pages_ever = 0;
-        struct ceph_snap_context *snapc = NULL, *last_snapc = NULL;
+        struct ceph_snap_context *snapc = NULL, *last_snapc = NULL, *pgsnapc;
         struct pagevec pvec;
         int done = 0;
         int rc = 0;
@@ -770,9 +762,10 @@ get_more_pages:
                         }
 
                         /* only if matching snap context */
-                        if (snapc != (void *)page->private) {
-                                dout("page snapc %p != oldest %p\n",
-                                     (void *)page->private, snapc);
+                        pgsnapc = (void *)page->private;
+                        if (pgsnapc->seq > snapc->seq) {
+                                dout("page snapc %p %lld > oldest %p %lld\n",
+                                     pgsnapc, pgsnapc->seq, snapc, snapc->seq);
                                 unlock_page(page);
                                 if (!locked_pages)
                                         continue; /* keep looking for snap */
@@ -914,7 +907,10 @@ static int context_is_writeable_or_written(struct inode *inode,
                                            struct ceph_snap_context *snapc)
 {
         struct ceph_snap_context *oldest = get_oldest_context(inode, NULL);
-        return !oldest || snapc->seq <= oldest->seq;
+        int ret = !oldest || snapc->seq <= oldest->seq;
+
+        ceph_put_snap_context(oldest);
+        return ret;
 }
 
 /*
@@ -936,8 +932,8 @@ static int ceph_update_writeable_page(struct file *file,
         int pos_in_page = pos & ~PAGE_CACHE_MASK;
         int end_in_page = pos_in_page + len;
         loff_t i_size;
-        struct ceph_snap_context *snapc;
         int r;
+        struct ceph_snap_context *snapc, *oldest;
 
 retry_locked:
         /* writepages currently holds page lock, but if we change that later, */
@@ -947,23 +943,24 @@ retry_locked:
         BUG_ON(!ci->i_snap_realm);
         down_read(&mdsc->snap_rwsem);
         BUG_ON(!ci->i_snap_realm->cached_context);
-        if (page->private &&
-            (void *)page->private != ci->i_snap_realm->cached_context) {
+        snapc = (void *)page->private;
+        if (snapc && snapc != ci->i_head_snapc) {
                 /*
                  * this page is already dirty in another (older) snap
                  * context!  is it writeable now?
                  */
-                snapc = get_oldest_context(inode, NULL);
+                oldest = get_oldest_context(inode, NULL);
                 up_read(&mdsc->snap_rwsem);
 
-                if (snapc != (void *)page->private) {
+                if (snapc->seq > oldest->seq) {
+                        ceph_put_snap_context(oldest);
                         dout(" page %p snapc %p not current or oldest\n",
-                             page, (void *)page->private);
+                             page, snapc);
                         /*
                          * queue for writeback, and wait for snapc to
                          * be writeable or written
                          */
-                        snapc = ceph_get_snap_context((void *)page->private);
+                        snapc = ceph_get_snap_context(snapc);
                         unlock_page(page);
                         ceph_queue_writeback(inode);
                         r = wait_event_interruptible(ci->i_cap_wq,
@@ -973,6 +970,7 @@ retry_locked:
                                 return r;
                         return -EAGAIN;
                 }
+                ceph_put_snap_context(oldest);
 
                 /* yay, writeable, do it now (without dropping page lock) */
                 dout(" page %p snapc %p not current, but oldest\n",
diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
index 3710e077a857..aa2239fa9a3b 100644
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -1205,6 +1205,12 @@ retry:
                 if (capsnap->dirty_pages || capsnap->writing)
                         continue;
 
+                /*
+                 * if cap writeback already occurred, we should have dropped
+                 * the capsnap in ceph_put_wrbuffer_cap_refs.
+                 */
+                BUG_ON(capsnap->dirty == 0);
+
                 /* pick mds, take s_mutex */
                 mds = __ceph_get_cap_mds(ci, &mseq);
                 if (session && session->s_mds != mds) {
@@ -2118,8 +2124,8 @@ void ceph_put_cap_refs(struct ceph_inode_info *ci, int had)
                 }
         spin_unlock(&inode->i_lock);
 
-        dout("put_cap_refs %p had %s %s\n", inode, ceph_cap_string(had),
-             last ? "last" : "");
+        dout("put_cap_refs %p had %s%s%s\n", inode, ceph_cap_string(had),
+             last ? " last" : "", put ? " put" : "");
 
         if (last && !flushsnaps)
                 ceph_check_caps(ci, 0, NULL);
@@ -2143,7 +2149,8 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
 {
         struct inode *inode = &ci->vfs_inode;
         int last = 0;
-        int last_snap = 0;
+        int complete_capsnap = 0;
+        int drop_capsnap = 0;
         int found = 0;
         struct ceph_cap_snap *capsnap = NULL;
 
@@ -2166,19 +2173,32 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
                 list_for_each_entry(capsnap, &ci->i_cap_snaps, ci_item) {
                         if (capsnap->context == snapc) {
                                 found = 1;
-                                capsnap->dirty_pages -= nr;
-                                last_snap = !capsnap->dirty_pages;
                                 break;
                         }
                 }
                 BUG_ON(!found);
+                capsnap->dirty_pages -= nr;
+                if (capsnap->dirty_pages == 0) {
+                        complete_capsnap = 1;
+                        if (capsnap->dirty == 0)
+                                /* cap writeback completed before we created
+                                 * the cap_snap; no FLUSHSNAP is needed */
+                                drop_capsnap = 1;
+                }
                 dout("put_wrbuffer_cap_refs on %p cap_snap %p "
-                     " snap %lld %d/%d -> %d/%d %s%s\n",
+                     " snap %lld %d/%d -> %d/%d %s%s%s\n",
                      inode, capsnap, capsnap->context->seq,
                      ci->i_wrbuffer_ref+nr, capsnap->dirty_pages + nr,
                      ci->i_wrbuffer_ref, capsnap->dirty_pages,
                      last ? " (wrbuffer last)" : "",
-                     last_snap ? " (capsnap last)" : "");
+                     complete_capsnap ? " (complete capsnap)" : "",
+                     drop_capsnap ? " (drop capsnap)" : "");
+                if (drop_capsnap) {
+                        ceph_put_snap_context(capsnap->context);
+                        list_del(&capsnap->ci_item);
+                        list_del(&capsnap->flushing_item);
+                        ceph_put_cap_snap(capsnap);
+                }
         }
 
         spin_unlock(&inode->i_lock);
@@ -2186,10 +2206,12 @@ void ceph_put_wrbuffer_cap_refs(struct ceph_inode_info *ci, int nr,
         if (last) {
                 ceph_check_caps(ci, CHECK_CAPS_AUTHONLY, NULL);
                 iput(inode);
-        } else if (last_snap) {
+        } else if (complete_capsnap) {
                 ceph_flush_snaps(ci);
                 wake_up(&ci->i_cap_wq);
         }
+        if (drop_capsnap)
+                iput(inode);
 }
 
 /*
@@ -2465,8 +2487,8 @@ static void handle_cap_flushsnap_ack(struct inode *inode, u64 flush_tid,
                                 break;
                         }
                         WARN_ON(capsnap->dirty_pages || capsnap->writing);
-                        dout(" removing cap_snap %p follows %lld\n",
-                             capsnap, follows);
+                        dout(" removing %p cap_snap %p follows %lld\n",
+                             inode, capsnap, follows);
                         ceph_put_snap_context(capsnap->context);
                         list_del(&capsnap->ci_item);
                         list_del(&capsnap->flushing_item);
diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
index 7261dc6c2ead..ea8ee2e526aa 100644
--- a/fs/ceph/dir.c
+++ b/fs/ceph/dir.c
@@ -171,11 +171,11 @@ more:
         spin_lock(&inode->i_lock);
         spin_lock(&dcache_lock);
 
+        last = dentry;
+
         if (err < 0)
                 goto out_unlock;
 
-        last = dentry;
-
         p = p->prev;
         filp->f_pos++;
 
@@ -312,7 +312,7 @@ more:
                 req->r_readdir_offset = fi->next_offset;
                 req->r_args.readdir.frag = cpu_to_le32(frag);
                 req->r_args.readdir.max_entries = cpu_to_le32(max_entries);
-                req->r_num_caps = max_entries;
+                req->r_num_caps = max_entries + 1;
                 err = ceph_mdsc_do_request(mdsc, NULL, req);
                 if (err < 0) {
                         ceph_mdsc_put_request(req);
@@ -489,6 +489,7 @@ struct dentry *ceph_finish_lookup(struct ceph_mds_request *req,
                 struct inode *inode = ceph_get_snapdir(parent);
                 dout("ENOENT on snapdir %p '%.*s', linking to snapdir %p\n",
                      dentry, dentry->d_name.len, dentry->d_name.name, inode);
+                BUG_ON(!d_unhashed(dentry));
                 d_add(dentry, inode);
                 err = 0;
         }
diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index aca82d55cc53..26f883c275e8 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -886,6 +886,7 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
         struct inode *in = NULL;
         struct ceph_mds_reply_inode *ininfo;
         struct ceph_vino vino;
+        struct ceph_client *client = ceph_sb_to_client(sb);
         int i = 0;
         int err = 0;
 
@@ -949,7 +950,14 @@ int ceph_fill_trace(struct super_block *sb, struct ceph_mds_request *req,
                         return err;
         }
 
-        if (rinfo->head->is_dentry && !req->r_aborted) {
+        /*
+         * ignore null lease/binding on snapdir ENOENT, or else we
+         * will have trouble splicing in the virtual snapdir later
+         */
+        if (rinfo->head->is_dentry && !req->r_aborted &&
+            (rinfo->head->is_target || strncmp(req->r_dentry->d_name.name,
+                                               client->mount_args->snapdir_name,
+                                               req->r_dentry->d_name.len))) {
                 /*
                  * lookup link rename   : null -> possibly existing inode
                  * mknod symlink mkdir  : null -> new inode
diff --git a/fs/ceph/messenger.c b/fs/ceph/messenger.c
index 8f1715ffbe4b..cdaaa131add3 100644
--- a/fs/ceph/messenger.c
+++ b/fs/ceph/messenger.c
@@ -30,6 +30,10 @@ static char tag_msg = CEPH_MSGR_TAG_MSG;
 static char tag_ack = CEPH_MSGR_TAG_ACK;
 static char tag_keepalive = CEPH_MSGR_TAG_KEEPALIVE;
 
+#ifdef CONFIG_LOCKDEP
+static struct lock_class_key socket_class;
+#endif
+
 
 static void queue_con(struct ceph_connection *con);
 static void con_work(struct work_struct *);
@@ -228,6 +232,10 @@ static struct socket *ceph_tcp_connect(struct ceph_connection *con)
         con->sock = sock;
         sock->sk->sk_allocation = GFP_NOFS;
 
+#ifdef CONFIG_LOCKDEP
+        lockdep_set_class(&sock->sk->sk_lock, &socket_class);
+#endif
+
         set_sock_callbacks(sock, con);
 
         dout("connect %s\n", pr_addr(&con->peer_addr.in_addr));
@@ -333,6 +341,7 @@ static void reset_connection(struct ceph_connection *con)
                 con->out_msg = NULL;
         }
         con->in_seq = 0;
+        con->in_seq_acked = 0;
 }
 
 /*
diff --git a/fs/ceph/osdmap.c b/fs/ceph/osdmap.c
index 21c6623c4b07..2e2c15eed82a 100644
--- a/fs/ceph/osdmap.c
+++ b/fs/ceph/osdmap.c
@@ -314,71 +314,6 @@ bad:
         return ERR_PTR(err);
 }
 
-
-/*
- * osd map
- */
-void ceph_osdmap_destroy(struct ceph_osdmap *map)
-{
-        dout("osdmap_destroy %p\n", map);
-        if (map->crush)
-                crush_destroy(map->crush);
-        while (!RB_EMPTY_ROOT(&map->pg_temp)) {
-                struct ceph_pg_mapping *pg =
-                        rb_entry(rb_first(&map->pg_temp),
-                                 struct ceph_pg_mapping, node);
-                rb_erase(&pg->node, &map->pg_temp);
-                kfree(pg);
-        }
-        while (!RB_EMPTY_ROOT(&map->pg_pools)) {
-                struct ceph_pg_pool_info *pi =
-                        rb_entry(rb_first(&map->pg_pools),
-                                 struct ceph_pg_pool_info, node);
-                rb_erase(&pi->node, &map->pg_pools);
-                kfree(pi);
-        }
-        kfree(map->osd_state);
-        kfree(map->osd_weight);
-        kfree(map->osd_addr);
-        kfree(map);
-}
-
-/*
- * adjust max osd value.  reallocate arrays.
- */
-static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
-{
-        u8 *state;
-        struct ceph_entity_addr *addr;
-        u32 *weight;
-
-        state = kcalloc(max, sizeof(*state), GFP_NOFS);
-        addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
-        weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
-        if (state == NULL || addr == NULL || weight == NULL) {
-                kfree(state);
-                kfree(addr);
-                kfree(weight);
-                return -ENOMEM;
-        }
-
-        /* copy old? */
-        if (map->osd_state) {
-                memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
-                memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
-                memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
-                kfree(map->osd_state);
-                kfree(map->osd_addr);
-                kfree(map->osd_weight);
-        }
-
-        map->osd_state = state;
-        map->osd_weight = weight;
-        map->osd_addr = addr;
-        map->max_osd = max;
-        return 0;
-}
-
 /*
  * rbtree of pg_mapping for handling pg_temp (explicit mapping of pgid
  * to a set of osds)
@@ -482,6 +417,13 @@ static struct ceph_pg_pool_info *__lookup_pg_pool(struct rb_root *root, int id)
         return NULL;
 }
 
+static void __remove_pg_pool(struct rb_root *root, struct ceph_pg_pool_info *pi)
+{
+        rb_erase(&pi->node, root);
+        kfree(pi->name);
+        kfree(pi);
+}
+
 void __decode_pool(void **p, struct ceph_pg_pool_info *pi)
 {
         ceph_decode_copy(p, &pi->v, sizeof(pi->v));
@@ -490,6 +432,98 @@ void __decode_pool(void **p, struct ceph_pg_pool_info *pi)
         *p += le32_to_cpu(pi->v.num_removed_snap_intervals) * sizeof(u64) * 2;
 }
 
+static int __decode_pool_names(void **p, void *end, struct ceph_osdmap *map)
+{
+        struct ceph_pg_pool_info *pi;
+        u32 num, len, pool;
+
+        ceph_decode_32_safe(p, end, num, bad);
+        dout(" %d pool names\n", num);
+        while (num--) {
+                ceph_decode_32_safe(p, end, pool, bad);
+                ceph_decode_32_safe(p, end, len, bad);
+                dout("  pool %d len %d\n", pool, len);
+                pi = __lookup_pg_pool(&map->pg_pools, pool);
+                if (pi) {
+                        kfree(pi->name);
+                        pi->name = kmalloc(len + 1, GFP_NOFS);
+                        if (pi->name) {
+                                memcpy(pi->name, *p, len);
+                                pi->name[len] = '\0';
+                                dout("  name is %s\n", pi->name);
+                        }
+                }
+                *p += len;
+        }
+        return 0;
+
+bad:
+        return -EINVAL;
+}
+
+/*
+ * osd map
+ */
+void ceph_osdmap_destroy(struct ceph_osdmap *map)
+{
+        dout("osdmap_destroy %p\n", map);
+        if (map->crush)
+                crush_destroy(map->crush);
+        while (!RB_EMPTY_ROOT(&map->pg_temp)) {
+                struct ceph_pg_mapping *pg =
+                        rb_entry(rb_first(&map->pg_temp),
+                                 struct ceph_pg_mapping, node);
+                rb_erase(&pg->node, &map->pg_temp);
+                kfree(pg);
+        }
+        while (!RB_EMPTY_ROOT(&map->pg_pools)) {
+                struct ceph_pg_pool_info *pi =
+                        rb_entry(rb_first(&map->pg_pools),
+                                 struct ceph_pg_pool_info, node);
+                __remove_pg_pool(&map->pg_pools, pi);
+        }
+        kfree(map->osd_state);
+        kfree(map->osd_weight);
+        kfree(map->osd_addr);
+        kfree(map);
+}
+
+/*
+ * adjust max osd value.  reallocate arrays.
+ */
+static int osdmap_set_max_osd(struct ceph_osdmap *map, int max)
+{
+        u8 *state;
+        struct ceph_entity_addr *addr;
+        u32 *weight;
+
+        state = kcalloc(max, sizeof(*state), GFP_NOFS);
+        addr = kcalloc(max, sizeof(*addr), GFP_NOFS);
+        weight = kcalloc(max, sizeof(*weight), GFP_NOFS);
+        if (state == NULL || addr == NULL || weight == NULL) {
+                kfree(state);
+                kfree(addr);
+                kfree(weight);
+                return -ENOMEM;
+        }
+
+        /* copy old? */
+        if (map->osd_state) {
+                memcpy(state, map->osd_state, map->max_osd*sizeof(*state));
+                memcpy(addr, map->osd_addr, map->max_osd*sizeof(*addr));
+                memcpy(weight, map->osd_weight, map->max_osd*sizeof(*weight));
+                kfree(map->osd_state);
+                kfree(map->osd_addr);
+                kfree(map->osd_weight);
+        }
+
+        map->osd_state = state;
+        map->osd_weight = weight;
+        map->osd_addr = addr;
+        map->max_osd = max;
+        return 0;
+}
+
 /*
  * decode a full map.
  */
@@ -526,7 +560,7 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
         ceph_decode_32_safe(p, end, max, bad);
         while (max--) {
                 ceph_decode_need(p, end, 4 + 1 + sizeof(pi->v), bad);
-                pi = kmalloc(sizeof(*pi), GFP_NOFS);
+                pi = kzalloc(sizeof(*pi), GFP_NOFS);
                 if (!pi)
                         goto bad;
                 pi->id = ceph_decode_32(p);
@@ -539,6 +573,10 @@ struct ceph_osdmap *osdmap_decode(void **p, void *end)
                 __decode_pool(p, pi);
                 __insert_pg_pool(&map->pg_pools, pi);
         }
+
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
+
         ceph_decode_32_safe(p, end, map->pool_max, bad);
 
         ceph_decode_32_safe(p, end, map->flags, bad);
@@ -712,7 +750,7 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 }
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
                 if (!pi) {
-                        pi = kmalloc(sizeof(*pi), GFP_NOFS);
+                        pi = kzalloc(sizeof(*pi), GFP_NOFS);
                         if (!pi) {
                                 err = -ENOMEM;
                                 goto bad;
@@ -722,6 +760,8 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
                 }
                 __decode_pool(p, pi);
         }
+        if (version >= 5 && __decode_pool_names(p, end, map) < 0)
+                goto bad;
 
         /* old_pool */
         ceph_decode_32_safe(p, end, len, bad);
@@ -730,10 +770,8 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
 
                 ceph_decode_32_safe(p, end, pool, bad);
                 pi = __lookup_pg_pool(&map->pg_pools, pool);
-                if (pi) {
-                        rb_erase(&pi->node, &map->pg_pools);
-                        kfree(pi);
-                }
+                if (pi)
+                        __remove_pg_pool(&map->pg_pools, pi);
         }
 
         /* new_up */
diff --git a/fs/ceph/osdmap.h b/fs/ceph/osdmap.h
index 1fb55afb2642..8bc9f1e4f562 100644
--- a/fs/ceph/osdmap.h
+++ b/fs/ceph/osdmap.h
@@ -23,6 +23,7 @@ struct ceph_pg_pool_info {
         int id;
         struct ceph_pg_pool v;
         int pg_num_mask, pgp_num_mask, lpg_num_mask, lpgp_num_mask;
+        char *name;
 };
 
 struct ceph_pg_mapping {
diff --git a/fs/ceph/rados.h b/fs/ceph/rados.h
index 26ac8b89a676..a1fc1d017b58 100644
--- a/fs/ceph/rados.h
+++ b/fs/ceph/rados.h
@@ -11,8 +11,10 @@
 /*
  * osdmap encoding versions
  */
-#define CEPH_OSDMAP_INC_VERSION 4
-#define CEPH_OSDMAP_VERSION     4
+#define CEPH_OSDMAP_INC_VERSION     5
+#define CEPH_OSDMAP_INC_VERSION_EXT 5
+#define CEPH_OSDMAP_VERSION         5
+#define CEPH_OSDMAP_VERSION_EXT     5
 
 /*
  * fs id
diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
index e6f9bc57d472..2b881262ef67 100644
--- a/fs/ceph/snap.c
+++ b/fs/ceph/snap.c
@@ -431,8 +431,7 @@ static int dup_array(u64 **dst, __le64 *src, int num)
  * Caller must hold snap_rwsem for read (i.e., the realm topology won't
  * change).
  */
-void ceph_queue_cap_snap(struct ceph_inode_info *ci,
-                         struct ceph_snap_context *snapc)
+void ceph_queue_cap_snap(struct ceph_inode_info *ci)
 {
         struct inode *inode = &ci->vfs_inode;
         struct ceph_cap_snap *capsnap;
@@ -451,10 +450,11 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci,
                    as no new writes are allowed to start when pending, so any
                    writes in progress now were started before the previous
                    cap_snap.  lucky us. */
-                dout("queue_cap_snap %p snapc %p seq %llu used %d"
-                     " already pending\n", inode, snapc, snapc->seq, used);
+                dout("queue_cap_snap %p already pending\n", inode);
                 kfree(capsnap);
         } else if (ci->i_wrbuffer_ref_head || (used & CEPH_CAP_FILE_WR)) {
+                struct ceph_snap_context *snapc = ci->i_head_snapc;
+
                 igrab(inode);
 
                 atomic_set(&capsnap->nref, 1);
@@ -463,7 +463,6 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci,
                 INIT_LIST_HEAD(&capsnap->flushing_item);
 
                 capsnap->follows = snapc->seq - 1;
-                capsnap->context = ceph_get_snap_context(snapc);
                 capsnap->issued = __ceph_caps_issued(ci, NULL);
                 capsnap->dirty = __ceph_caps_dirty(ci);
 
@@ -480,7 +479,7 @@ void ceph_queue_cap_snap(struct ceph_inode_info *ci,
                    snapshot. */
                 capsnap->dirty_pages = ci->i_wrbuffer_ref_head;
                 ci->i_wrbuffer_ref_head = 0;
-                ceph_put_snap_context(ci->i_head_snapc);
+                capsnap->context = snapc;
                 ci->i_head_snapc = NULL;
                 list_add_tail(&capsnap->ci_item, &ci->i_cap_snaps);
 
@@ -522,15 +521,17 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
         capsnap->ctime = inode->i_ctime;
         capsnap->time_warp_seq = ci->i_time_warp_seq;
         if (capsnap->dirty_pages) {
-                dout("finish_cap_snap %p cap_snap %p snapc %p %llu s=%llu "
+                dout("finish_cap_snap %p cap_snap %p snapc %p %llu %s s=%llu "
                      "still has %d dirty pages\n", inode, capsnap,
                      capsnap->context, capsnap->context->seq,
-                     capsnap->size, capsnap->dirty_pages);
+                     ceph_cap_string(capsnap->dirty), capsnap->size,
+                     capsnap->dirty_pages);
                 return 0;
         }
-        dout("finish_cap_snap %p cap_snap %p snapc %p %llu s=%llu clean\n",
+        dout("finish_cap_snap %p cap_snap %p snapc %p %llu %s s=%llu\n",
              inode, capsnap, capsnap->context,
-             capsnap->context->seq, capsnap->size);
+             capsnap->context->seq, ceph_cap_string(capsnap->dirty),
+             capsnap->size);
 
         spin_lock(&mdsc->snap_flush_lock);
         list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
@@ -602,7 +603,7 @@ more:
                                 if (lastinode)
                                         iput(lastinode);
                                 lastinode = inode;
-                                ceph_queue_cap_snap(ci, realm->cached_context);
+                                ceph_queue_cap_snap(ci);
                                 spin_lock(&realm->inodes_with_caps_lock);
                         }
                         spin_unlock(&realm->inodes_with_caps_lock);
@@ -824,8 +825,7 @@ void ceph_handle_snap(struct ceph_mds_client *mdsc,
                         spin_unlock(&realm->inodes_with_caps_lock);
                         spin_unlock(&inode->i_lock);
 
-                        ceph_queue_cap_snap(ci,
-                                            ci->i_snap_realm->cached_context);
+                        ceph_queue_cap_snap(ci);
 
                         iput(inode);
                         continue;
diff --git a/fs/ceph/super.h b/fs/ceph/super.h
index ca702c67bc66..e30dfbb056c3 100644
--- a/fs/ceph/super.h
+++ b/fs/ceph/super.h
@@ -715,8 +715,7 @@ extern int ceph_update_snap_trace(struct ceph_mds_client *m,
 extern void ceph_handle_snap(struct ceph_mds_client *mdsc,
                              struct ceph_mds_session *session,
                              struct ceph_msg *msg);
-extern void ceph_queue_cap_snap(struct ceph_inode_info *ci,
-                                struct ceph_snap_context *snapc);
+extern void ceph_queue_cap_snap(struct ceph_inode_info *ci);
 extern int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
                                   struct ceph_cap_snap *capsnap);
 extern void ceph_cleanup_empty_realms(struct ceph_mds_client *mdsc);
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index efb2b9400391..1cc087635a5e 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -382,8 +382,8 @@ out:
 static void ecryptfs_lower_offset_for_extent(loff_t *offset, loff_t extent_num,
                                              struct ecryptfs_crypt_stat *crypt_stat)
 {
-        (*offset) = (crypt_stat->num_header_bytes_at_front
-                     + (crypt_stat->extent_size * extent_num));
+        (*offset) = ecryptfs_lower_header_size(crypt_stat)
+                    + (crypt_stat->extent_size * extent_num);
 }
 
 /**
@@ -835,13 +835,13 @@ void ecryptfs_set_default_sizes(struct ecryptfs_crypt_stat *crypt_stat)
         set_extent_mask_and_shift(crypt_stat);
         crypt_stat->iv_bytes = ECRYPTFS_DEFAULT_IV_BYTES;
         if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                crypt_stat->num_header_bytes_at_front = 0;
+                crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
         else {
                 if (PAGE_CACHE_SIZE <= ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)
-                        crypt_stat->num_header_bytes_at_front =
+                        crypt_stat->metadata_size =
                                 ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
                 else
-                        crypt_stat->num_header_bytes_at_front = PAGE_CACHE_SIZE;
+                        crypt_stat->metadata_size = PAGE_CACHE_SIZE;
         }
 }
 
@@ -1108,9 +1108,9 @@ static void write_ecryptfs_marker(char *page_virt, size_t *written)
         (*written) = MAGIC_ECRYPTFS_MARKER_SIZE_BYTES;
 }
 
-static void
-write_ecryptfs_flags(char *page_virt, struct ecryptfs_crypt_stat *crypt_stat,
-                     size_t *written)
+void ecryptfs_write_crypt_stat_flags(char *page_virt,
+                                     struct ecryptfs_crypt_stat *crypt_stat,
+                                     size_t *written)
 {
         u32 flags = 0;
         int i;
@@ -1238,8 +1238,7 @@ ecryptfs_write_header_metadata(char *virt,
 
         header_extent_size = (u32)crypt_stat->extent_size;
         num_header_extents_at_front =
-                (u16)(crypt_stat->num_header_bytes_at_front
-                      / crypt_stat->extent_size);
+                (u16)(crypt_stat->metadata_size / crypt_stat->extent_size);
         put_unaligned_be32(header_extent_size, virt);
         virt += 4;
         put_unaligned_be16(num_header_extents_at_front, virt);
@@ -1292,7 +1291,8 @@ static int ecryptfs_write_headers_virt(char *page_virt, size_t max,
         offset = ECRYPTFS_FILE_SIZE_BYTES;
         write_ecryptfs_marker((page_virt + offset), &written);
         offset += written;
-        write_ecryptfs_flags((page_virt + offset), crypt_stat, &written);
+        ecryptfs_write_crypt_stat_flags((page_virt + offset), crypt_stat,
+                                        &written);
         offset += written;
         ecryptfs_write_header_metadata((page_virt + offset), crypt_stat,
                                        &written);
@@ -1382,7 +1382,7 @@ int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry)
                 rc = -EINVAL;
                 goto out;
         }
-        virt_len = crypt_stat->num_header_bytes_at_front;
+        virt_len = crypt_stat->metadata_size;
         order = get_order(virt_len);
         /* Released in this function */
         virt = (char *)ecryptfs_get_zeroed_pages(GFP_KERNEL, order);
@@ -1428,16 +1428,15 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
         header_extent_size = get_unaligned_be32(virt);
         virt += sizeof(__be32);
         num_header_extents_at_front = get_unaligned_be16(virt);
-        crypt_stat->num_header_bytes_at_front =
-                (((size_t)num_header_extents_at_front
-                  * (size_t)header_extent_size));
+        crypt_stat->metadata_size = (((size_t)num_header_extents_at_front
+                                     * (size_t)header_extent_size));
         (*bytes_read) = (sizeof(__be32) + sizeof(__be16));
         if ((validate_header_size == ECRYPTFS_VALIDATE_HEADER_SIZE)
-            && (crypt_stat->num_header_bytes_at_front
+            && (crypt_stat->metadata_size
                 < ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE)) {
                 rc = -EINVAL;
                 printk(KERN_WARNING "Invalid header size: [%zd]\n",
-                       crypt_stat->num_header_bytes_at_front);
+                       crypt_stat->metadata_size);
         }
         return rc;
 }
@@ -1452,8 +1451,7 @@ static int parse_header_metadata(struct ecryptfs_crypt_stat *crypt_stat,
  */
 static void set_default_header_data(struct ecryptfs_crypt_stat *crypt_stat)
 {
-        crypt_stat->num_header_bytes_at_front =
-                ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
+        crypt_stat->metadata_size = ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
 }
 
 /**
@@ -1607,6 +1605,7 @@ int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry)
                                                 ecryptfs_dentry,
                                                 ECRYPTFS_VALIDATE_HEADER_SIZE);
         if (rc) {
+                memset(page_virt, 0, PAGE_CACHE_SIZE);
                 rc = ecryptfs_read_xattr_region(page_virt, ecryptfs_inode);
                 if (rc) {
                         printk(KERN_DEBUG "Valid eCryptfs headers not found in "
diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h
index 542f625312f3..bc7115403f38 100644
--- a/fs/ecryptfs/ecryptfs_kernel.h
+++ b/fs/ecryptfs/ecryptfs_kernel.h
@@ -273,7 +273,7 @@ struct ecryptfs_crypt_stat {
         u32 flags;
         unsigned int file_version;
         size_t iv_bytes;
-        size_t num_header_bytes_at_front;
+        size_t metadata_size;
         size_t extent_size; /* Data extent size; default is 4096 */
         size_t key_size;
         size_t extent_shift;
@@ -464,6 +464,14 @@ struct ecryptfs_daemon {
 
 extern struct mutex ecryptfs_daemon_hash_mux;
 
+static inline size_t
+ecryptfs_lower_header_size(struct ecryptfs_crypt_stat *crypt_stat)
+{
+        if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
+                return 0;
+        return crypt_stat->metadata_size;
+}
+
 static inline struct ecryptfs_file_info *
 ecryptfs_file_to_private(struct file *file)
 {
@@ -651,6 +659,9 @@ int ecryptfs_decrypt_page(struct page *page);
 int ecryptfs_write_metadata(struct dentry *ecryptfs_dentry);
 int ecryptfs_read_metadata(struct dentry *ecryptfs_dentry);
 int ecryptfs_new_file_context(struct dentry *ecryptfs_dentry);
+void ecryptfs_write_crypt_stat_flags(char *page_virt,
+                                     struct ecryptfs_crypt_stat *crypt_stat,
+                                     size_t *written);
 int ecryptfs_read_and_validate_header_region(char *data,
                                              struct inode *ecryptfs_inode);
 int ecryptfs_read_and_validate_xattr_region(char *page_virt,
diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index d3362faf3852..e2d4418affac 100644
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -324,6 +324,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
         rc = ecryptfs_read_and_validate_header_region(page_virt,
                                                       ecryptfs_dentry->d_inode);
         if (rc) {
+                memset(page_virt, 0, PAGE_CACHE_SIZE);
                 rc = ecryptfs_read_and_validate_xattr_region(page_virt,
                                                              ecryptfs_dentry);
                 if (rc) {
@@ -336,7 +337,7 @@ int ecryptfs_lookup_and_interpose_lower(struct dentry *ecryptfs_dentry,
                 ecryptfs_dentry->d_sb)->mount_crypt_stat;
         if (mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) {
                 if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR)
-                        file_size = (crypt_stat->num_header_bytes_at_front
+                        file_size = (crypt_stat->metadata_size
                                      + i_size_read(lower_dentry->d_inode));
                 else
                         file_size = i_size_read(lower_dentry->d_inode);
@@ -388,9 +389,9 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
         if (IS_ERR(lower_dentry)) {
                 rc = PTR_ERR(lower_dentry);
-                printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
-                       "lower_dentry = [%s]\n", __func__, rc,
-                       ecryptfs_dentry->d_name.name);
+                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
+                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
+                                encrypted_and_encoded_name);
                 goto out_d_drop;
         }
         if (lower_dentry->d_inode)
@@ -417,9 +418,9 @@ static struct dentry *ecryptfs_lookup(struct inode *ecryptfs_dir_inode,
         mutex_unlock(&lower_dir_dentry->d_inode->i_mutex);
         if (IS_ERR(lower_dentry)) {
                 rc = PTR_ERR(lower_dentry);
-                printk(KERN_ERR "%s: lookup_one_len() returned [%d] on "
-                       "lower_dentry = [%s]\n", __func__, rc,
-                       encrypted_and_encoded_name);
+                ecryptfs_printk(KERN_DEBUG, "%s: lookup_one_len() returned "
+                                "[%d] on lower_dentry = [%s]\n", __func__, rc,
+                                encrypted_and_encoded_name);
                 goto out_d_drop;
         }
 lookup_and_interpose:
@@ -456,8 +457,8 @@ static int ecryptfs_link(struct dentry *old_dentry, struct inode *dir,
         rc = ecryptfs_interpose(lower_new_dentry, new_dentry, dir->i_sb, 0);
         if (rc)
                 goto out_lock;
-        fsstack_copy_attr_times(dir, lower_new_dentry->d_inode);
-        fsstack_copy_inode_size(dir, lower_new_dentry->d_inode);
+        fsstack_copy_attr_times(dir, lower_dir_dentry->d_inode);
+        fsstack_copy_inode_size(dir, lower_dir_dentry->d_inode);
         old_dentry->d_inode->i_nlink =
                 ecryptfs_inode_to_lower(old_dentry->d_inode)->i_nlink;
         i_size_write(new_dentry->d_inode, file_size_save);
@@ -648,38 +649,17 @@ out_lock:
         return rc;
 }
 
-static int
-ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+static int ecryptfs_readlink_lower(struct dentry *dentry, char **buf,
+                                   size_t *bufsiz)
 {
+        struct dentry *lower_dentry = ecryptfs_dentry_to_lower(dentry);
         char *lower_buf;
-        size_t lower_bufsiz;
-        struct dentry *lower_dentry;
-        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
-        char *plaintext_name;
-        size_t plaintext_name_size;
+        size_t lower_bufsiz = PATH_MAX;
         mm_segment_t old_fs;
         int rc;
 
-        lower_dentry = ecryptfs_dentry_to_lower(dentry);
-        if (!lower_dentry->d_inode->i_op->readlink) {
-                rc = -EINVAL;
-                goto out;
-        }
-        mount_crypt_stat = &ecryptfs_superblock_to_private(
-                                                dentry->d_sb)->mount_crypt_stat;
-        /*
-         * If the lower filename is encrypted, it will result in a significantly
-         * longer name.  If needed, truncate the name after decode and decrypt.
-         */
-        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES)
-                lower_bufsiz = PATH_MAX;
-        else
-                lower_bufsiz = bufsiz;
-        /* Released in this function */
         lower_buf = kmalloc(lower_bufsiz, GFP_KERNEL);
-        if (lower_buf == NULL) {
-                printk(KERN_ERR "%s: Out of memory whilst attempting to "
-                       "kmalloc [%zd] bytes\n", __func__, lower_bufsiz);
+        if (!lower_buf) {
                 rc = -ENOMEM;
                 goto out;
         }
@@ -689,29 +669,31 @@ ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
                                                    (char __user *)lower_buf,
                                                    lower_bufsiz);
         set_fs(old_fs);
-        if (rc >= 0) {
-                rc = ecryptfs_decode_and_decrypt_filename(&plaintext_name,
-                                                          &plaintext_name_size,
-                                                          dentry, lower_buf,
-                                                          rc);
-                if (rc) {
-                        printk(KERN_ERR "%s: Error attempting to decode and "
-                               "decrypt filename; rc = [%d]\n", __func__,
-                                rc);
-                        goto out_free_lower_buf;
-                }
-                /* Check for bufsiz <= 0 done in sys_readlinkat() */
-                rc = copy_to_user(buf, plaintext_name,
-                                  min((size_t) bufsiz, plaintext_name_size));
-                if (rc)
-                        rc = -EFAULT;
-                else
-                        rc = plaintext_name_size;
-                kfree(plaintext_name);
-                fsstack_copy_attr_atime(dentry->d_inode, lower_dentry->d_inode);
-        }
-out_free_lower_buf:
+        if (rc < 0)
+                goto out;
+        lower_bufsiz = rc;
+        rc = ecryptfs_decode_and_decrypt_filename(buf, bufsiz, dentry,
+                                                  lower_buf, lower_bufsiz);
+out:
         kfree(lower_buf);
+        return rc;
+}
+
+static int
+ecryptfs_readlink(struct dentry *dentry, char __user *buf, int bufsiz)
+{
+        char *kbuf;
+        size_t kbufsiz, copied;
+        int rc;
+
+        rc = ecryptfs_readlink_lower(dentry, &kbuf, &kbufsiz);
+        if (rc)
+                goto out;
+        copied = min_t(size_t, bufsiz, kbufsiz);
+        rc = copy_to_user(buf, kbuf, copied) ? -EFAULT : copied;
+        kfree(kbuf);
+        fsstack_copy_attr_atime(dentry->d_inode,
+                                ecryptfs_dentry_to_lower(dentry)->d_inode);
 out:
         return rc;
 }
@@ -769,7 +751,7 @@ upper_size_to_lower_size(struct ecryptfs_crypt_stat *crypt_stat,
 {
         loff_t lower_size;
 
-        lower_size = crypt_stat->num_header_bytes_at_front;
+        lower_size = ecryptfs_lower_header_size(crypt_stat);
         if (upper_size != 0) {
                 loff_t num_extents;
 
@@ -1016,6 +998,28 @@ out:
         return rc;
 }
 
+int ecryptfs_getattr_link(struct vfsmount *mnt, struct dentry *dentry,
+                          struct kstat *stat)
+{
+        struct ecryptfs_mount_crypt_stat *mount_crypt_stat;
+        int rc = 0;
+
+        mount_crypt_stat = &ecryptfs_superblock_to_private(
+                                                dentry->d_sb)->mount_crypt_stat;
+        generic_fillattr(dentry->d_inode, stat);
+        if (mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) {
+                char *target;
+                size_t targetsiz;
+
+                rc = ecryptfs_readlink_lower(dentry, &target, &targetsiz);
+                if (!rc) {
+                        kfree(target);
+                        stat->size = targetsiz;
+                }
+        }
+        return rc;
+}
+
 int ecryptfs_getattr(struct vfsmount *mnt, struct dentry *dentry,
                      struct kstat *stat)
 {
@@ -1040,7 +1044,7 @@ ecryptfs_setxattr(struct dentry *dentry, const char *name, const void *value,
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->setxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1058,7 +1062,7 @@ ecryptfs_getxattr_lower(struct dentry *lower_dentry, const char *name,
         int rc = 0;
 
         if (!lower_dentry->d_inode->i_op->getxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1085,7 +1089,7 @@ ecryptfs_listxattr(struct dentry *dentry, char *list, size_t size)
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->listxattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1102,7 +1106,7 @@ static int ecryptfs_removexattr(struct dentry *dentry, const char *name)
 
         lower_dentry = ecryptfs_dentry_to_lower(dentry);
         if (!lower_dentry->d_inode->i_op->removexattr) {
-                rc = -ENOSYS;
+                rc = -EOPNOTSUPP;
                 goto out;
         }
         mutex_lock(&lower_dentry->d_inode->i_mutex);
@@ -1133,6 +1137,7 @@ const struct inode_operations ecryptfs_symlink_iops = {
         .put_link = ecryptfs_put_link,
         .permission = ecryptfs_permission,
         .setattr = ecryptfs_setattr,
+        .getattr = ecryptfs_getattr_link,
         .setxattr = ecryptfs_setxattr,
         .getxattr = ecryptfs_getxattr,
         .listxattr = ecryptfs_listxattr,
diff --git a/fs/ecryptfs/mmap.c b/fs/ecryptfs/mmap.c
index d491237c98e7..2ee9a3a7b68c 100644
--- a/fs/ecryptfs/mmap.c
+++ b/fs/ecryptfs/mmap.c
@@ -83,6 +83,19 @@ out:
         return rc;
 }
 
+static void strip_xattr_flag(char *page_virt,
+                             struct ecryptfs_crypt_stat *crypt_stat)
+{
+        if (crypt_stat->flags & ECRYPTFS_METADATA_IN_XATTR) {
+                size_t written;
+
+                crypt_stat->flags &= ~ECRYPTFS_METADATA_IN_XATTR;
+                ecryptfs_write_crypt_stat_flags(page_virt, crypt_stat,
+                                                &written);
+                crypt_stat->flags |= ECRYPTFS_METADATA_IN_XATTR;
+        }
+}
+
 /**
  *   Header Extent:
  *     Octets 0-7:        Unencrypted file size (big-endian)
@@ -98,19 +111,6 @@ out:
  *                        (big-endian)
  *     Octet  26:         Begin RFC 2440 authentication token packet set
  */
-static void set_header_info(char *page_virt,
-                            struct ecryptfs_crypt_stat *crypt_stat)
-{
-        size_t written;
-        size_t save_num_header_bytes_at_front =
-                crypt_stat->num_header_bytes_at_front;
-
-        crypt_stat->num_header_bytes_at_front =
-                ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE;
-        ecryptfs_write_header_metadata(page_virt + 20, crypt_stat, &written);
-        crypt_stat->num_header_bytes_at_front =
-                save_num_header_bytes_at_front;
-}
 
 /**
  * ecryptfs_copy_up_encrypted_with_header
@@ -136,8 +136,7 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                                            * num_extents_per_page)
                                           + extent_num_in_page);
                 size_t num_header_extents_at_front =
-                        (crypt_stat->num_header_bytes_at_front
-                         / crypt_stat->extent_size);
+                        (crypt_stat->metadata_size / crypt_stat->extent_size);
 
                 if (view_extent_num < num_header_extents_at_front) {
                         /* This is a header extent */
@@ -147,9 +146,14 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                         memset(page_virt, 0, PAGE_CACHE_SIZE);
                         /* TODO: Support more than one header extent */
                         if (view_extent_num == 0) {
+                                size_t written;
+
                                 rc = ecryptfs_read_xattr_region(
                                         page_virt, page->mapping->host);
-                                set_header_info(page_virt, crypt_stat);
+                                strip_xattr_flag(page_virt + 16, crypt_stat);
+                                ecryptfs_write_header_metadata(page_virt + 20,
+                                                               crypt_stat,
+                                                               &written);
                         }
                         kunmap_atomic(page_virt, KM_USER0);
                         flush_dcache_page(page);
@@ -162,7 +166,7 @@ ecryptfs_copy_up_encrypted_with_header(struct page *page,
                         /* This is an encrypted data extent */
                         loff_t lower_offset =
                                 ((view_extent_num * crypt_stat->extent_size)
-                                 - crypt_stat->num_header_bytes_at_front);
+                                 - crypt_stat->metadata_size);
 
                         rc = ecryptfs_read_lower_page_segment(
                                 page, (lower_offset >> PAGE_CACHE_SHIFT),
diff --git a/fs/ecryptfs/super.c b/fs/ecryptfs/super.c
index fcef41c1d2cf..278743c7716a 100644
--- a/fs/ecryptfs/super.c
+++ b/fs/ecryptfs/super.c
@@ -86,7 +86,6 @@ static void ecryptfs_destroy_inode(struct inode *inode)
                 if (lower_dentry->d_inode) {
                         fput(inode_info->lower_file);
                         inode_info->lower_file = NULL;
-                        d_drop(lower_dentry);
                 }
         }
         ecryptfs_destroy_crypt_stat(&inode_info->crypt_stat);
diff --git a/fs/ext2/symlink.c b/fs/ext2/symlink.c
index 4e2426e22bbe..565cf817bbf1 100644
--- a/fs/ext2/symlink.c
+++ b/fs/ext2/symlink.c
@@ -32,6 +32,7 @@ const struct inode_operations ext2_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
+        .setattr        = ext2_setattr,
 #ifdef CONFIG_EXT2_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
@@ -43,6 +44,7 @@ const struct inode_operations ext2_symlink_inode_operations = {
 const struct inode_operations ext2_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = ext2_follow_link,
+        .setattr        = ext2_setattr,
 #ifdef CONFIG_EXT2_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
diff --git a/fs/ext3/symlink.c b/fs/ext3/symlink.c
index ff7b4ccd8983..7c4898207776 100644
--- a/fs/ext3/symlink.c
+++ b/fs/ext3/symlink.c
@@ -34,6 +34,7 @@ const struct inode_operations ext3_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
+        .setattr        = ext3_setattr,
 #ifdef CONFIG_EXT3_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
@@ -45,6 +46,7 @@ const struct inode_operations ext3_symlink_inode_operations = {
 const struct inode_operations ext3_fast_symlink_inode_operations = {
         .readlink       = generic_readlink,
         .follow_link    = ext3_follow_link,
+        .setattr        = ext3_setattr,
 #ifdef CONFIG_EXT3_FS_XATTR
         .setxattr       = generic_setxattr,
         .getxattr       = generic_getxattr,
diff --git a/fs/fcntl.c b/fs/fcntl.c
index 452d02f9075e..0a140741b39e 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -614,9 +614,15 @@ int send_sigurg(struct fown_struct *fown)
         return ret;
 }
 
-static DEFINE_RWLOCK(fasync_lock);
+static DEFINE_SPINLOCK(fasync_lock);
 static struct kmem_cache *fasync_cache __read_mostly;
 
+static void fasync_free_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(fasync_cache,
+                        container_of(head, struct fasync_struct, fa_rcu));
+}
+
 /*
  * Remove a fasync entry. If successfully removed, return
  * positive and clear the FASYNC flag. If no entry exists,
@@ -625,8 +631,6 @@ static struct kmem_cache *fasync_cache __read_mostly;
  * NOTE! It is very important that the FASYNC flag always
  * match the state "is the filp on a fasync list".
  *
- * We always take the 'filp->f_lock', in since fasync_lock
- * needs to be irq-safe.
  */
 static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
 {
@@ -634,17 +638,22 @@ static int fasync_remove_entry(struct file *filp, struct fasync_struct **fapp)
         int result = 0;
 
         spin_lock(&filp->f_lock);
-        write_lock_irq(&fasync_lock);
+        spin_lock(&fasync_lock);
         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
                 if (fa->fa_file != filp)
                         continue;
+
+                spin_lock_irq(&fa->fa_lock);
+                fa->fa_file = NULL;
+                spin_unlock_irq(&fa->fa_lock);
+
                 *fp = fa->fa_next;
-                kmem_cache_free(fasync_cache, fa);
+                call_rcu(&fa->fa_rcu, fasync_free_rcu);
                 filp->f_flags &= ~FASYNC;
                 result = 1;
                 break;
         }
-        write_unlock_irq(&fasync_lock);
+        spin_unlock(&fasync_lock);
         spin_unlock(&filp->f_lock);
         return result;
 }
@@ -666,25 +675,30 @@ static int fasync_add_entry(int fd, struct file *filp, struct fasync_struct **fa
                 return -ENOMEM;
 
         spin_lock(&filp->f_lock);
-        write_lock_irq(&fasync_lock);
+        spin_lock(&fasync_lock);
         for (fp = fapp; (fa = *fp) != NULL; fp = &fa->fa_next) {
                 if (fa->fa_file != filp)
                         continue;
+
+                spin_lock_irq(&fa->fa_lock);
                 fa->fa_fd = fd;
+                spin_unlock_irq(&fa->fa_lock);
+
                 kmem_cache_free(fasync_cache, new);
                 goto out;
         }
 
+        spin_lock_init(&new->fa_lock);
         new->magic = FASYNC_MAGIC;
         new->fa_file = filp;
         new->fa_fd = fd;
         new->fa_next = *fapp;
-        *fapp = new;
+        rcu_assign_pointer(*fapp, new);
         result = 1;
         filp->f_flags |= FASYNC;
 
 out:
-        write_unlock_irq(&fasync_lock);
+        spin_unlock(&fasync_lock);
         spin_unlock(&filp->f_lock);
         return result;
 }
@@ -704,37 +718,41 @@ int fasync_helper(int fd, struct file * filp, int on, struct fasync_struct **fap
 
 EXPORT_SYMBOL(fasync_helper);
 
-void __kill_fasync(struct fasync_struct *fa, int sig, int band)
+/*
+ * rcu_read_lock() is held
+ */
+static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)
 {
         while (fa) {
-                struct fown_struct * fown;
+                struct fown_struct *fown;
                 if (fa->magic != FASYNC_MAGIC) {
                         printk(KERN_ERR "kill_fasync: bad magic number in "
                                "fasync_struct!\n");
                         return;
                 }
-                fown = &fa->fa_file->f_owner;
-                /* Don't send SIGURG to processes which have not set a
-                   queued signum: SIGURG has its own default signalling
-                   mechanism. */
-                if (!(sig == SIGURG && fown->signum == 0))
-                        send_sigio(fown, fa->fa_fd, band);
-                fa = fa->fa_next;
+                spin_lock(&fa->fa_lock);
+                if (fa->fa_file) {
+                        fown = &fa->fa_file->f_owner;
+                        /* Don't send SIGURG to processes which have not set a
+                           queued signum: SIGURG has its own default signalling
+                           mechanism. */
+                        if (!(sig == SIGURG && fown->signum == 0))
+                                send_sigio(fown, fa->fa_fd, band);
+                }
+                spin_unlock(&fa->fa_lock);
+                fa = rcu_dereference(fa->fa_next);
         }
 }
 
-EXPORT_SYMBOL(__kill_fasync);
-
 void kill_fasync(struct fasync_struct **fp, int sig, int band)
 {
         /* First a quick test without locking: usually
          * the list is empty.
          */
         if (*fp) {
-                read_lock(&fasync_lock);
-                /* reread *fp after obtaining the lock */
-                __kill_fasync(*fp, sig, band);
-                read_unlock(&fasync_lock);
+                rcu_read_lock();
+                kill_fasync_rcu(rcu_dereference(*fp), sig, band);
+                rcu_read_unlock();
         }
 }
 EXPORT_SYMBOL(kill_fasync);
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index 2a3d352c0bff..a8766c4ef2e0 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1294,7 +1294,8 @@ static int nfs4_init_server(struct nfs_server *server,
 
         /* Initialise the client representation from the mount data */
         server->flags = data->flags;
-        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR;
+        server->caps |= NFS_CAP_ATOMIC_OPEN|NFS_CAP_CHANGE_ATTR|
+                NFS_CAP_POSIX_LOCK;
         server->options = data->options;
 
         /* Get a client record */
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index c6f2750648f4..be46f26c9a56 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1025,12 +1025,12 @@ static struct dentry *nfs_atomic_lookup(struct inode *dir, struct dentry *dentry
                                 res = NULL;
                                 goto out;
                         /* This turned out not to be a regular file */
+                        case -EISDIR:
                         case -ENOTDIR:
                                 goto no_open;
                         case -ELOOP:
                                 if (!(nd->intent.open.flags & O_NOFOLLOW))
                                         goto no_open;
-                        /* case -EISDIR: */
                         /* case -EINVAL: */
                         default:
                                 goto out;
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 737128f777f3..50a56edca0b5 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -623,10 +623,10 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, struct rpc_c
         list_for_each_entry(pos, &nfsi->open_files, list) {
                 if (cred != NULL && pos->cred != cred)
                         continue;
-                if ((pos->mode & mode) == mode) {
-                        ctx = get_nfs_open_context(pos);
-                        break;
-                }
+                if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode)
+                        continue;
+                ctx = get_nfs_open_context(pos);
+                break;
         }
         spin_unlock(&inode->i_lock);
         return ctx;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index fe0cd9eb1d4d..638067007c65 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1523,6 +1523,8 @@ static int _nfs4_proc_open(struct nfs4_opendata *data)
                 nfs_post_op_update_inode(dir, o_res->dir_attr);
         } else
                 nfs_refresh_inode(dir, o_res->dir_attr);
+        if ((o_res->rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) == 0)
+                server->caps &= ~NFS_CAP_POSIX_LOCK;
         if(o_res->rflags & NFS4_OPEN_RESULT_CONFIRM) {
                 status = _nfs4_proc_open_confirm(data);
                 if (status != 0)
@@ -1664,7 +1666,7 @@ static int _nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, in
         status = PTR_ERR(state);
         if (IS_ERR(state))
                 goto err_opendata_put;
-        if ((opendata->o_res.rflags & NFS4_OPEN_RESULT_LOCKTYPE_POSIX) != 0)
+        if (server->caps & NFS_CAP_POSIX_LOCK)
                 set_bit(NFS_STATE_POSIX_LOCKS, &state->flags);
         nfs4_opendata_put(opendata);
         nfs4_put_state_owner(sp);
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
index 53ff70e23993..de38d63aa920 100644
--- a/fs/nfs/write.c
+++ b/fs/nfs/write.c
@@ -201,6 +201,7 @@ static int nfs_set_page_writeback(struct page *page)
                 struct inode *inode = page->mapping->host;
                 struct nfs_server *nfss = NFS_SERVER(inode);
 
+                page_cache_get(page);
                 if (atomic_long_inc_return(&nfss->writeback) >
                                 NFS_CONGESTION_ON_THRESH) {
                         set_bdi_congested(&nfss->backing_dev_info,
@@ -216,6 +217,7 @@ static void nfs_end_page_writeback(struct page *page)
         struct nfs_server *nfss = NFS_SERVER(inode);
 
         end_page_writeback(page);
+        page_cache_release(page);
         if (atomic_long_dec_return(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH)
                 clear_bdi_congested(&nfss->backing_dev_info, BLK_RW_ASYNC);
 }
@@ -421,6 +423,7 @@ static void
 nfs_mark_request_dirty(struct nfs_page *req)
 {
         __set_page_dirty_nobuffers(req->wb_page);
+        __mark_inode_dirty(req->wb_page->mapping->host, I_DIRTY_DATASYNC);
 }
 
 #if defined(CONFIG_NFS_V3) || defined(CONFIG_NFS_V4)
@@ -660,9 +663,11 @@ static int nfs_writepage_setup(struct nfs_open_context *ctx, struct page *page,
         req = nfs_setup_write_request(ctx, page, offset, count);
         if (IS_ERR(req))
                 return PTR_ERR(req);
+        nfs_mark_request_dirty(req);
         /* Update file length */
         nfs_grow_file(page, offset, count);
         nfs_mark_uptodate(page, req->wb_pgbase, req->wb_bytes);
+        nfs_mark_request_dirty(req);
         nfs_clear_page_tag_locked(req);
         return 0;
 }
@@ -739,8 +744,6 @@ int nfs_updatepage(struct file *file, struct page *page,
         status = nfs_writepage_setup(ctx, page, offset, count);
         if (status < 0)
                 nfs_set_pageerror(page);
-        else
-                __set_page_dirty_nobuffers(page);
 
         dprintk("NFS:       nfs_updatepage returns %d (isize %lld)\n",
                         status, (long long)i_size_read(inode));
@@ -749,13 +752,12 @@ int nfs_updatepage(struct file *file, struct page *page,
 
 static void nfs_writepage_release(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
 
-        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req)) {
-                nfs_end_page_writeback(req->wb_page);
+        if (PageError(req->wb_page) || !nfs_reschedule_unstable_write(req))
                 nfs_inode_remove_request(req);
-        } else
-                nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 static int flush_task_priority(int how)
@@ -779,7 +781,6 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 int how)
 {
         struct inode *inode = req->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -794,9 +795,10 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 .callback_ops = call_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
+        int ret = 0;
 
         /* Set up the RPC argument and reply structs
          * NB: take care not to mess about with data->commit et al. */
@@ -835,10 +837,18 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
                 (unsigned long long)data->args.offset);
 
         task = rpc_run_task(&task_setup_data);
-        if (IS_ERR(task))
-                return PTR_ERR(task);
+        if (IS_ERR(task)) {
+                ret = PTR_ERR(task);
+                goto out;
+        }
+        if (how & FLUSH_SYNC) {
+                ret = rpc_wait_for_completion_task(task);
+                if (ret == 0)
+                        ret = task->tk_status;
+        }
         rpc_put_task(task);
-        return 0;
+out:
+        return ret;
 }
 
 /* If a nfs_flush_* function fails, it should remove reqs from @head and
@@ -847,9 +857,11 @@ static int nfs_write_rpcsetup(struct nfs_page *req,
  */
 static void nfs_redirty_request(struct nfs_page *req)
 {
+        struct page *page = req->wb_page;
+
         nfs_mark_request_dirty(req);
-        nfs_end_page_writeback(req->wb_page);
         nfs_clear_page_tag_locked(req);
+        nfs_end_page_writeback(page);
 }
 
 /*
@@ -1084,16 +1096,15 @@ static void nfs_writeback_release_full(void *calldata)
                 if (nfs_write_need_commit(data)) {
                         memcpy(&req->wb_verf, &data->verf, sizeof(req->wb_verf));
                         nfs_mark_request_commit(req);
-                        nfs_end_page_writeback(page);
                         dprintk(" marked for commit\n");
                         goto next;
                 }
                 dprintk(" OK\n");
 remove_request:
-                nfs_end_page_writeback(page);
                 nfs_inode_remove_request(req);
         next:
                 nfs_clear_page_tag_locked(req);
+                nfs_end_page_writeback(page);
         }
         nfs_writedata_release(calldata);
 }
@@ -1207,7 +1218,6 @@ static int nfs_commit_rpcsetup(struct list_head *head,
 {
         struct nfs_page *first = nfs_list_entry(head->next);
         struct inode *inode = first->wb_context->path.dentry->d_inode;
-        int flags = (how & FLUSH_SYNC) ? 0 : RPC_TASK_ASYNC;
         int priority = flush_task_priority(how);
         struct rpc_task *task;
         struct rpc_message msg = {
@@ -1222,7 +1232,7 @@ static int nfs_commit_rpcsetup(struct list_head *head,
                 .callback_ops = &nfs_commit_ops,
                 .callback_data = data,
                 .workqueue = nfsiod_workqueue,
-                .flags = flags,
+                .flags = RPC_TASK_ASYNC,
                 .priority = priority,
         };
 
@@ -1252,6 +1262,8 @@ static int nfs_commit_rpcsetup(struct list_head *head,
         task = rpc_run_task(&task_setup_data);
         if (IS_ERR(task))
                 return PTR_ERR(task);
+        if (how & FLUSH_SYNC)
+                rpc_wait_for_completion_task(task);
         rpc_put_task(task);
         return 0;
 }
diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c
index 8d6356a804f3..7cfb87e692da 100644
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -426,7 +426,7 @@ void nilfs_palloc_abort_alloc_entry(struct inode *inode,
         bitmap = bitmap_kaddr + bh_offset(req->pr_bitmap_bh);
         if (!nilfs_clear_bit_atomic(nilfs_mdt_bgl_lock(inode, group),
                                     group_offset, bitmap))
-                printk(KERN_WARNING "%s: entry numer %llu already freed\n",
+                printk(KERN_WARNING "%s: entry number %llu already freed\n",
                        __func__, (unsigned long long)req->pr_entry_nr);
 
         nilfs_palloc_group_desc_add_entries(inode, group, desc, 1);
diff --git a/fs/nilfs2/btree.c b/fs/nilfs2/btree.c
index 7cdd98b8d514..76c38e3e19d2 100644
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1879,7 +1879,7 @@ static int nilfs_btree_propagate_v(struct nilfs_btree *btree,
                                    struct nilfs_btree_path *path,
                                    int level, struct buffer_head *bh)
 {
-        int maxlevel, ret;
+        int maxlevel = 0, ret;
         struct nilfs_btree_node *parent;
         struct inode *dat = nilfs_bmap_get_dat(&btree->bt_bmap);
         __u64 ptr;
diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index c2ff1b306012..f90a33d9a5b0 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c
@@ -649,7 +649,7 @@ static int nilfs_ioctl_get_info(struct inode *inode, struct file *filp,
 long nilfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-        void __user *argp = (void * __user *)arg;
+        void __user *argp = (void __user *)arg;
 
         switch (cmd) {
         case NILFS_IOCTL_CHANGE_CPMODE:
diff --git a/fs/quota/Kconfig b/fs/quota/Kconfig
index dad7fb247ddc..3e21b1e2ad3a 100644
--- a/fs/quota/Kconfig
+++ b/fs/quota/Kconfig
@@ -33,6 +33,14 @@ config PRINT_QUOTA_WARNING
           Note that this behavior is currently deprecated and may go away in
           future. Please use notification via netlink socket instead.
 
+config QUOTA_DEBUG
+        bool "Additional quota sanity checks"
+        depends on QUOTA
+        default n
+        help
+          If you say Y here, quota subsystem will perform some additional
+          sanity checks of quota internal structures. If unsure, say N.
+
 # Generic support for tree structured quota files. Selected when needed.
 config QUOTA_TREE
          tristate
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index e0b870f4749f..788b5802a7ce 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -80,8 +80,6 @@
 
 #include <asm/uaccess.h>
 
-#define __DQUOT_PARANOIA
-
 /*
  * There are three quota SMP locks. dq_list_lock protects all lists with quotas
  * and quota formats, dqstats structure containing statistics about the lists
@@ -695,7 +693,7 @@ void dqput(struct dquot *dquot)
 
         if (!dquot)
                 return;
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         if (!atomic_read(&dquot->dq_count)) {
                 printk("VFS: dqput: trying to free free dquot\n");
                 printk("VFS: device %s, dquot of %s %d\n",
@@ -748,7 +746,7 @@ we_slept:
                 goto we_slept;
         }
         atomic_dec(&dquot->dq_count);
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         /* sanity check */
         BUG_ON(!list_empty(&dquot->dq_free));
 #endif
@@ -845,7 +843,7 @@ we_slept:
                 dquot = NULL;
                 goto out;
         }
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
         BUG_ON(!dquot->dq_sb);  /* Has somebody invalidated entry under us? */
 #endif
 out:
@@ -874,14 +872,18 @@ static int dqinit_needed(struct inode *inode, int type)
 static void add_dquot_ref(struct super_block *sb, int type)
 {
         struct inode *inode, *old_inode = NULL;
+#ifdef CONFIG_QUOTA_DEBUG
         int reserved = 0;
+#endif
 
         spin_lock(&inode_lock);
         list_for_each_entry(inode, &sb->s_inodes, i_sb_list) {
                 if (inode->i_state & (I_FREEING|I_CLEAR|I_WILL_FREE|I_NEW))
                         continue;
+#ifdef CONFIG_QUOTA_DEBUG
                 if (unlikely(inode_get_rsv_space(inode) > 0))
                         reserved = 1;
+#endif
                 if (!atomic_read(&inode->i_writecount))
                         continue;
                 if (!dqinit_needed(inode, type))
@@ -903,11 +905,13 @@ static void add_dquot_ref(struct super_block *sb, int type)
         spin_unlock(&inode_lock);
         iput(old_inode);
 
+#ifdef CONFIG_QUOTA_DEBUG
         if (reserved) {
                 printk(KERN_WARNING "VFS (%s): Writes happened before quota"
                         " was turned on thus quota information is probably "
                         "inconsistent. Please run quotacheck(8).\n", sb->s_id);
         }
+#endif
 }
 
 /*
@@ -934,7 +938,7 @@ static int remove_inode_dquot_ref(struct inode *inode, int type,
         inode->i_dquot[type] = NULL;
         if (dquot) {
                 if (dqput_blocks(dquot)) {
-#ifdef __DQUOT_PARANOIA
+#ifdef CONFIG_QUOTA_DEBUG
                         if (atomic_read(&dquot->dq_count) != 1)
                                 printk(KERN_WARNING "VFS: Adding dquot with dq_count %d to dispose list.\n", atomic_read(&dquot->dq_count));
 #endif
@@ -2322,34 +2326,34 @@ static int do_set_dqblk(struct dquot *dquot, struct if_dqblk *di)
         if (di->dqb_valid & QIF_SPACE) {
                 dm->dqb_curspace = di->dqb_curspace - dm->dqb_rsvspace;
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_SPACE_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_BLIMITS) {
                 dm->dqb_bsoftlimit = qbtos(di->dqb_bsoftlimit);
                 dm->dqb_bhardlimit = qbtos(di->dqb_bhardlimit);
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_BLIMITS_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_INODES) {
                 dm->dqb_curinodes = di->dqb_curinodes;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_INODES_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_ILIMITS) {
                 dm->dqb_isoftlimit = di->dqb_isoftlimit;
                 dm->dqb_ihardlimit = di->dqb_ihardlimit;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_ILIMITS_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_BTIME) {
                 dm->dqb_btime = di->dqb_btime;
                 check_blim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_BTIME_B, &dquot->dq_flags);
         }
         if (di->dqb_valid & QIF_ITIME) {
                 dm->dqb_itime = di->dqb_itime;
                 check_ilim = 1;
-                __set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
+                set_bit(DQ_LASTSET_B + QIF_ITIME_B, &dquot->dq_flags);
         }
 
         if (check_blim) {
diff --git a/fs/udf/balloc.c b/fs/udf/balloc.c
index 19626e2491c4..9a9378b4eb5a 100644
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -125,9 +125,8 @@ static void udf_bitmap_free_blocks(struct super_block *sb,
 
         mutex_lock(&sbi->s_alloc_mutex);
         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-        if (bloc->logicalBlockNum < 0 ||
-            (bloc->logicalBlockNum + count) >
-                partmap->s_partition_len) {
+        if (bloc->logicalBlockNum + count < count ||
+            (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
                 udf_debug("%d < %d || %d + %d > %d\n",
                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
                           count, partmap->s_partition_len);
@@ -393,9 +392,8 @@ static void udf_table_free_blocks(struct super_block *sb,
 
         mutex_lock(&sbi->s_alloc_mutex);
         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-        if (bloc->logicalBlockNum < 0 ||
-            (bloc->logicalBlockNum + count) >
-                partmap->s_partition_len) {
+        if (bloc->logicalBlockNum + count < count ||
+            (bloc->logicalBlockNum + count) > partmap->s_partition_len) {
                 udf_debug("%d < %d || %d + %d > %d\n",
                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum, count,
                           partmap->s_partition_len);
diff --git a/fs/udf/file.c b/fs/udf/file.c
index 1eb06774ed90..4b6a46ccbf46 100644
--- a/fs/udf/file.c
+++ b/fs/udf/file.c
@@ -218,7 +218,7 @@ const struct file_operations udf_file_operations = {
         .llseek                 = generic_file_llseek,
 };
 
-static int udf_setattr(struct dentry *dentry, struct iattr *iattr)
+int udf_setattr(struct dentry *dentry, struct iattr *iattr)
 {
         struct inode *inode = dentry->d_inode;
         int error;
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index bb863fe579ac..8a3fbd177cab 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -1314,7 +1314,7 @@ static void udf_fill_inode(struct inode *inode, struct buffer_head *bh)
                 break;
         case ICBTAG_FILE_TYPE_SYMLINK:
                 inode->i_data.a_ops = &udf_symlink_aops;
-                inode->i_op = &page_symlink_inode_operations;
+                inode->i_op = &udf_symlink_inode_operations;
                 inode->i_mode = S_IFLNK | S_IRWXUGO;
                 break;
         case ICBTAG_FILE_TYPE_MAIN:
diff --git a/fs/udf/namei.c b/fs/udf/namei.c
index db423ab078b1..75816025f95f 100644
--- a/fs/udf/namei.c
+++ b/fs/udf/namei.c
@@ -925,7 +925,7 @@ static int udf_symlink(struct inode *dir, struct dentry *dentry,
         iinfo = UDF_I(inode);
         inode->i_mode = S_IFLNK | S_IRWXUGO;
         inode->i_data.a_ops = &udf_symlink_aops;
-        inode->i_op = &page_symlink_inode_operations;
+        inode->i_op = &udf_symlink_inode_operations;
 
         if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB) {
                 struct kernel_lb_addr eloc;
@@ -1393,6 +1393,7 @@ const struct export_operations udf_export_ops = {
 const struct inode_operations udf_dir_inode_operations = {
         .lookup                         = udf_lookup,
         .create                         = udf_create,
+        .setattr                        = udf_setattr,
         .link                           = udf_link,
         .unlink                         = udf_unlink,
         .symlink                        = udf_symlink,
@@ -1401,3 +1402,9 @@ const struct inode_operations udf_dir_inode_operations = {
         .mknod                          = udf_mknod,
         .rename                         = udf_rename,
 };
+const struct inode_operations udf_symlink_inode_operations = {
+        .readlink       = generic_readlink,
+        .follow_link    = page_follow_link_light,
+        .put_link       = page_put_link,
+        .setattr        = udf_setattr,
+};
diff --git a/fs/udf/udfdecl.h b/fs/udf/udfdecl.h
index 4223ac855da9..702a1148e702 100644
--- a/fs/udf/udfdecl.h
+++ b/fs/udf/udfdecl.h
@@ -76,6 +76,7 @@ extern const struct inode_operations udf_dir_inode_operations;
 extern const struct file_operations udf_dir_operations;
 extern const struct inode_operations udf_file_inode_operations;
 extern const struct file_operations udf_file_operations;
+extern const struct inode_operations udf_symlink_inode_operations;
 extern const struct address_space_operations udf_aops;
 extern const struct address_space_operations udf_adinicb_aops;
 extern const struct address_space_operations udf_symlink_aops;
@@ -131,7 +132,7 @@ extern int udf_write_fi(struct inode *inode, struct fileIdentDesc *,
 /* file.c */
 extern int udf_ioctl(struct inode *, struct file *, unsigned int,
                      unsigned long);
-
+extern int udf_setattr(struct dentry *dentry, struct iattr *iattr);
 /* inode.c */
 extern struct inode *udf_iget(struct super_block *, struct kernel_lb_addr *);
 extern int udf_sync_inode(struct inode *);
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 05cd85317f6f..fd9698215759 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -820,10 +820,10 @@ xfs_reclaim_inode(
          * call into reclaim to find it in a clean state instead of waiting for
          * it now. We also don't return errors here - if the error is transient
          * then the next reclaim pass will flush the inode, and if the error
-         * is permanent then the next sync reclaim will relcaim the inode and
+         * is permanent then the next sync reclaim will reclaim the inode and
          * pass on the error.
          */
-        if (error && !XFS_FORCED_SHUTDOWN(ip->i_mount)) {
+        if (error && error != EAGAIN && !XFS_FORCED_SHUTDOWN(ip->i_mount)) {
                 xfs_fs_cmn_err(CE_WARN, ip->i_mount,
                         "inode 0x%llx background reclaim flush failed with %d",
                         (long long)ip->i_ino, error);
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index e8fba92d7cd9..2be019136287 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -745,9 +745,16 @@ xfs_log_move_tail(xfs_mount_t	*mp,
 
 /*
  * Determine if we have a transaction that has gone to disk
- * that needs to be covered. Log activity needs to be idle (no AIL and
- * nothing in the iclogs). And, we need to be in the right state indicating
- * something has gone out.
+ * that needs to be covered. To begin the transition to the idle state
+ * firstly the log needs to be idle (no AIL and nothing in the iclogs).
+ * If we are then in a state where covering is needed, the caller is informed
+ * that dummy transactions are required to move the log into the idle state.
+ *
+ * Because this is called as part of the sync process, we should also indicate
+ * that dummy transactions should be issued in anything but the covered or
+ * idle states. This ensures that the log tail is accurately reflected in
+ * the log at the end of the sync, hence if a crash occurrs avoids replay
+ * of transactions where the metadata is already on disk.
  */
 int
 xfs_log_need_covered(xfs_mount_t *mp)
@@ -759,17 +766,24 @@ xfs_log_need_covered(xfs_mount_t *mp)
                 return 0;
 
         spin_lock(&log->l_icloglock);
-        if (((log->l_covered_state == XLOG_STATE_COVER_NEED) ||
-                (log->l_covered_state == XLOG_STATE_COVER_NEED2))
-                        && !xfs_trans_ail_tail(log->l_ailp)
-                        && xlog_iclogs_empty(log)) {
-                if (log->l_covered_state == XLOG_STATE_COVER_NEED)
-                        log->l_covered_state = XLOG_STATE_COVER_DONE;
-                else {
-                        ASSERT(log->l_covered_state == XLOG_STATE_COVER_NEED2);
-                        log->l_covered_state = XLOG_STATE_COVER_DONE2;
+        switch (log->l_covered_state) {
+        case XLOG_STATE_COVER_DONE:
+        case XLOG_STATE_COVER_DONE2:
+        case XLOG_STATE_COVER_IDLE:
+                break;
+        case XLOG_STATE_COVER_NEED:
+        case XLOG_STATE_COVER_NEED2:
+                if (!xfs_trans_ail_tail(log->l_ailp) &&
+                    xlog_iclogs_empty(log)) {
+                        if (log->l_covered_state == XLOG_STATE_COVER_NEED)
+                                log->l_covered_state = XLOG_STATE_COVER_DONE;
+                        else
+                                log->l_covered_state = XLOG_STATE_COVER_DONE2;
                 }
+                /* FALLTHRU */
+        default:
                 needed = 1;
+                break;
         }
         spin_unlock(&log->l_icloglock);
         return needed;
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 04a6ebc27b96..2d428b088cc8 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -6,6 +6,7 @@
         {0x1002, 0x3150, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY}, \
         {0x1002, 0x3152, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x3154, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
+        {0x1002, 0x3155, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x3E50, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x3E54, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RV380|RADEON_NEW_MEMMAP}, \
         {0x1002, 0x4136, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS100|RADEON_IS_IGP}, \
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index e2ea0b2159cd..2fc8e14cc24a 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -94,6 +94,7 @@ header-y += if_ppp.h
 header-y += if_slip.h
 header-y += if_strip.h
 header-y += if_tun.h
+header-y += if_x25.h
 header-y += in_route.h
 header-y += ioctl.h
 header-y += ip6_tunnel.h
diff --git a/include/linux/caif/caif_socket.h b/include/linux/caif/caif_socket.h
index 8e5c8444a3f4..2a61eb1beb85 100644
--- a/include/linux/caif/caif_socket.h
+++ b/include/linux/caif/caif_socket.h
@@ -16,7 +16,6 @@
 #include <sys/socket.h>
 #endif
 
-
 /**
  * enum caif_link_selector -    Physical Link Selection.
  * @CAIF_LINK_HIGH_BANDW:       Physical interface for high-bandwidth
@@ -59,7 +58,7 @@ enum caif_channel_priority {
 /**
  * enum caif_protocol_type  -   CAIF Channel type.
  * @CAIFPROTO_AT:               Classic AT channel.
- * @CAIFPROTO_DATAGRAM:         Datagram channel.
+ * @CAIFPROTO_DATAGRAM: Datagram channel.
  * @CAIFPROTO_DATAGRAM_LOOP:    Datagram loopback channel, used for testing.
  * @CAIFPROTO_UTIL:             Utility (Psock) channel.
  * @CAIFPROTO_RFM:              Remote File Manager
@@ -87,6 +86,7 @@ enum caif_at_type {
 
 /**
  * struct sockaddr_caif - the sockaddr structure for CAIF sockets.
+ * @family:                  Address family number, must be AF_CAIF.
  * @u:                       Union of address data 'switched' by family.
  * :
  * @u.at:                    Applies when family = CAIFPROTO_AT.
@@ -153,6 +153,7 @@ struct sockaddr_caif {
  *
  *
  * This enum defines the CAIF Socket options to be used on a socket
+ * of type PF_CAIF.
  *
  */
 enum caif_socket_opts {
diff --git a/include/linux/dcbnl.h b/include/linux/dcbnl.h
index b7cdbb4373df..8723491f7dfd 100644
--- a/include/linux/dcbnl.h
+++ b/include/linux/dcbnl.h
@@ -22,8 +22,6 @@
 
 #include <linux/types.h>
 
-#define DCB_PROTO_VERSION 1
-
 struct dcbmsg {
         __u8               dcb_family;
         __u8               cmd;
diff --git a/include/linux/fib_rules.h b/include/linux/fib_rules.h
index 04a397619ebe..51da65b68b85 100644
--- a/include/linux/fib_rules.h
+++ b/include/linux/fib_rules.h
@@ -15,14 +15,6 @@
 /* try to find source address in routing lookups */
 #define FIB_RULE_FIND_SADDR     0x00010000
 
-/* fib_rules families. values up to 127 are reserved for real address
- * families, values above 128 may be used arbitrarily.
- */
-#define FIB_RULES_IPV4          AF_INET
-#define FIB_RULES_IPV6          AF_INET6
-#define FIB_RULES_DECNET        AF_DECnet
-#define FIB_RULES_IPMR          128
-
 struct fib_rule_hdr {
         __u8            family;
         __u8            dst_len;
diff --git a/include/linux/filter.h b/include/linux/filter.h
index 29a0e3db9f43..151f5d703b7e 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -123,7 +123,8 @@ struct sock_fprog {	/* Required for SO_ATTACH_FILTER. */
 #define SKF_AD_NLATTR_NEST      16
 #define SKF_AD_MARK     20
 #define SKF_AD_QUEUE    24
-#define SKF_AD_MAX      28
+#define SKF_AD_HATYPE   28
+#define SKF_AD_MAX      32
 #define SKF_NET_OFF   (-0x100000)
 #define SKF_LL_OFF    (-0x200000)
 
diff --git a/include/linux/firewire-cdev.h b/include/linux/firewire-cdev.h
index 40b11013408e..81f3b14d5d76 100644
--- a/include/linux/firewire-cdev.h
+++ b/include/linux/firewire-cdev.h
@@ -1,21 +1,26 @@
 /*
  * Char device interface.
  *
- * Copyright (C) 2005-2006  Kristian Hoegsberg <krh@bitplanet.net>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software Foundation,
- * Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
  */
 
 #ifndef _LINUX_FIREWIRE_CDEV_H
@@ -438,7 +443,7 @@ struct fw_cdev_remove_descriptor {
  * @type:       %FW_CDEV_ISO_CONTEXT_TRANSMIT or %FW_CDEV_ISO_CONTEXT_RECEIVE
  * @header_size: Header size to strip for receive contexts
  * @channel:    Channel to bind to
- * @speed:      Speed to transmit at
+ * @speed:      Speed for transmit contexts
  * @closure:    To be returned in &fw_cdev_event_iso_interrupt
  * @handle:     Handle to context, written back by kernel
  *
@@ -451,6 +456,9 @@ struct fw_cdev_remove_descriptor {
  * If a context was successfully created, the kernel writes back a handle to the
  * context, which must be passed in for subsequent operations on that context.
  *
+ * For receive contexts, @header_size must be at least 4 and must be a multiple
+ * of 4.
+ *
  * Note that the effect of a @header_size > 4 depends on
  * &fw_cdev_get_info.version, as documented at &fw_cdev_event_iso_interrupt.
  */
@@ -481,10 +489,34 @@ struct fw_cdev_create_iso_context {
  *
  * &struct fw_cdev_iso_packet is used to describe isochronous packet queues.
  *
- * Use the FW_CDEV_ISO_ macros to fill in @control.  The sy and tag fields are
- * specified by IEEE 1394a and IEC 61883.
- *
- * FIXME - finish this documentation
+ * Use the FW_CDEV_ISO_ macros to fill in @control.
+ *
+ * For transmit packets, the header length must be a multiple of 4 and specifies
+ * the numbers of bytes in @header that will be prepended to the packet's
+ * payload; these bytes are copied into the kernel and will not be accessed
+ * after the ioctl has returned.  The sy and tag fields are copied to the iso
+ * packet header (these fields are specified by IEEE 1394a and IEC 61883-1).
+ * The skip flag specifies that no packet is to be sent in a frame; when using
+ * this, all other fields except the interrupt flag must be zero.
+ *
+ * For receive packets, the header length must be a multiple of the context's
+ * header size; if the header length is larger than the context's header size,
+ * multiple packets are queued for this entry.  The sy and tag fields are
+ * ignored.  If the sync flag is set, the context drops all packets until
+ * a packet with a matching sy field is received (the sync value to wait for is
+ * specified in the &fw_cdev_start_iso structure).  The payload length defines
+ * how many payload bytes can be received for one packet (in addition to payload
+ * quadlets that have been defined as headers and are stripped and returned in
+ * the &fw_cdev_event_iso_interrupt structure).  If more bytes are received, the
+ * additional bytes are dropped.  If less bytes are received, the remaining
+ * bytes in this part of the payload buffer will not be written to, not even by
+ * the next packet, i.e., packets received in consecutive frames will not
+ * necessarily be consecutive in memory.  If an entry has queued multiple
+ * packets, the payload length is divided equally among them.
+ *
+ * When a packet with the interrupt flag set has been completed, the
+ * &fw_cdev_event_iso_interrupt event will be sent.  An entry that has queued
+ * multiple receive packets is completed when its last packet is completed.
  */
 struct fw_cdev_iso_packet {
         __u32 control;
@@ -501,7 +533,7 @@ struct fw_cdev_iso_packet {
  * Queue a number of isochronous packets for reception or transmission.
  * This ioctl takes a pointer to an array of &fw_cdev_iso_packet structs,
  * which describe how to transmit from or receive into a contiguous region
- * of a mmap()'ed payload buffer.  As part of the packet descriptors,
+ * of a mmap()'ed payload buffer.  As part of transmit packet descriptors,
  * a series of headers can be supplied, which will be prepended to the
  * payload during DMA.
  *
@@ -620,8 +652,8 @@ struct fw_cdev_get_cycle_timer2 {
  * instead of allocated.
  * An %FW_CDEV_EVENT_ISO_RESOURCE_DEALLOCATED event concludes this operation.
  *
- * To summarize, %FW_CDEV_IOC_DEALLOCATE_ISO_RESOURCE allocates iso resources
- * for the lifetime of the fd or handle.
+ * To summarize, %FW_CDEV_IOC_ALLOCATE_ISO_RESOURCE allocates iso resources
+ * for the lifetime of the fd or @handle.
  * In contrast, %FW_CDEV_IOC_ALLOCATE_ISO_RESOURCE_ONCE allocates iso resources
  * for the duration of a bus generation.
  *
diff --git a/include/linux/firewire-constants.h b/include/linux/firewire-constants.h
index b316770a43fd..9c63f06e67f2 100644
--- a/include/linux/firewire-constants.h
+++ b/include/linux/firewire-constants.h
@@ -1,3 +1,28 @@
+/*
+ * IEEE 1394 constants.
+ *
+ * Copyright (C) 2005-2007  Kristian Hoegsberg <krh@bitplanet.net>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a
+ * copy of this software and associated documentation files (the "Software"),
+ * to deal in the Software without restriction, including without limitation
+ * the rights to use, copy, modify, merge, publish, distribute, sublicense,
+ * and/or sell copies of the Software, and to permit persons to whom the
+ * Software is furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice (including the next
+ * paragraph) shall be included in all copies or substantial portions of the
+ * Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL
+ * PRECISION INSIGHT AND/OR ITS SUPPLIERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
 #ifndef _LINUX_FIREWIRE_CONSTANTS_H
 #define _LINUX_FIREWIRE_CONSTANTS_H
 
@@ -21,7 +46,7 @@
 #define EXTCODE_WRAP_ADD                0x6
 #define EXTCODE_VENDOR_DEPENDENT        0x7
 
-/* Juju specific tcodes */
+/* Linux firewire-core (Juju) specific tcodes */
 #define TCODE_LOCK_MASK_SWAP            (0x10 | EXTCODE_MASK_SWAP)
 #define TCODE_LOCK_COMPARE_SWAP         (0x10 | EXTCODE_COMPARE_SWAP)
 #define TCODE_LOCK_FETCH_ADD            (0x10 | EXTCODE_FETCH_ADD)
@@ -36,7 +61,7 @@
 #define RCODE_TYPE_ERROR                0x6
 #define RCODE_ADDRESS_ERROR             0x7
 
-/* Juju specific rcodes */
+/* Linux firewire-core (Juju) specific rcodes */
 #define RCODE_SEND_ERROR                0x10
 #define RCODE_CANCELLED                 0x11
 #define RCODE_BUSY                      0x12
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 39d57bc6cc71..018d382f6f92 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1280,10 +1280,12 @@ static inline int lock_may_write(struct inode *inode, loff_t start,
 
 
 struct fasync_struct {
-        int     magic;
-        int     fa_fd;
-        struct  fasync_struct   *fa_next; /* singly linked list */
-        struct  file            *fa_file;
+        spinlock_t              fa_lock;
+        int                     magic;
+        int                     fa_fd;
+        struct fasync_struct    *fa_next; /* singly linked list */
+        struct file             *fa_file;
+        struct rcu_head         fa_rcu;
 };
 
 #define FASYNC_MAGIC 0x4601
@@ -1292,8 +1294,6 @@ struct fasync_struct {
 extern int fasync_helper(int, struct file *, int, struct fasync_struct **);
 /* can be called from interrupts */
 extern void kill_fasync(struct fasync_struct **, int, int);
-/* only for net: no internal synchronization */
-extern void __kill_fasync(struct fasync_struct *, int, int);
 
 extern int __f_setown(struct file *filp, struct pid *, enum pid_type, int force);
 extern int f_setown(struct file *filp, unsigned long arg, int force);
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 1252ba1fbff5..97b2eae6a22c 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -876,6 +876,7 @@ struct ieee80211_ht_cap {
 #define IEEE80211_HT_CAP_SGI_40                 0x0040
 #define IEEE80211_HT_CAP_TX_STBC                0x0080
 #define IEEE80211_HT_CAP_RX_STBC                0x0300
+#define         IEEE80211_HT_CAP_RX_STBC_SHIFT  8
 #define IEEE80211_HT_CAP_DELAY_BA               0x0400
 #define IEEE80211_HT_CAP_MAX_AMSDU              0x0800
 #define IEEE80211_HT_CAP_DSSSCCK40              0x1000
diff --git a/include/linux/if.h b/include/linux/if.h
index 3a9f410a296b..be350e62a905 100644
--- a/include/linux/if.h
+++ b/include/linux/if.h
@@ -71,6 +71,8 @@
                                          * release skb->dst
                                          */
 #define IFF_DONT_BRIDGE 0x800           /* disallow bridging this ether dev */
+#define IFF_IN_NETPOLL  0x1000          /* whether we are processing netpoll */
+#define IFF_DISABLE_NETPOLL     0x2000  /* disable netpoll at run-time */
 
 #define IF_GET_IFACE    0x0001          /* for querying only */
 #define IF_GET_PROTO    0x0002
diff --git a/include/linux/if_tun.h b/include/linux/if_tun.h
index 1350a246893a..06b1829731fd 100644
--- a/include/linux/if_tun.h
+++ b/include/linux/if_tun.h
@@ -51,6 +51,8 @@
 #define TUNSETSNDBUF   _IOW('T', 212, int)
 #define TUNATTACHFILTER _IOW('T', 213, struct sock_fprog)
 #define TUNDETACHFILTER _IOW('T', 214, struct sock_fprog)
+#define TUNGETVNETHDRSZ _IOR('T', 215, int)
+#define TUNSETVNETHDRSZ _IOW('T', 216, int)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN         0x0001
diff --git a/include/linux/if_x25.h b/include/linux/if_x25.h
new file mode 100644
index 000000000000..897765f5feb8
--- /dev/null
+++ b/include/linux/if_x25.h
@@ -0,0 +1,26 @@
+/*
+ *  Linux X.25 packet to device interface
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ *  GNU General Public License for more details.
+ */
+
+#ifndef _IF_X25_H
+#define _IF_X25_H
+
+#include <linux/types.h>
+
+/* Documentation/networking/x25-iface.txt */
+#define X25_IFACE_DATA          0x00
+#define X25_IFACE_CONNECT       0x01
+#define X25_IFACE_DISCONNECT    0x02
+#define X25_IFACE_PARAMS        0x03
+
+#endif /* _IF_X25_H */
diff --git a/include/linux/in6.h b/include/linux/in6.h
index bd55c6e46b2e..c4bf46f764bf 100644
--- a/include/linux/in6.h
+++ b/include/linux/in6.h
@@ -221,10 +221,10 @@ struct in6_flowlabel_req {
 #define IPV6_RTHDR              57
 #define IPV6_RECVDSTOPTS        58
 #define IPV6_DSTOPTS            59
-#if 0   /* not yet */
 #define IPV6_RECVPATHMTU        60
 #define IPV6_PATHMTU            61
 #define IPV6_DONTFRAG           62
+#if 0   /* not yet */
 #define IPV6_USE_MIN_MTU        63
 #endif
 
@@ -265,6 +265,9 @@ struct in6_flowlabel_req {
 #define IPV6_PREFER_SRC_CGA             0x0008
 #define IPV6_PREFER_SRC_NONCGA          0x0800
 
+/* RFC5082: Generalized Ttl Security Mechanism */
+#define IPV6_MINHOPCOUNT                73
+
 /*
  * Multicast Routing:
  * see include/linux/mroute6.h.
diff --git a/include/linux/input/matrix_keypad.h b/include/linux/input/matrix_keypad.h
index 3bd018baae20..c964cd7f436a 100644
--- a/include/linux/input/matrix_keypad.h
+++ b/include/linux/input/matrix_keypad.h
@@ -44,6 +44,7 @@ struct matrix_keymap_data {
  * @active_low: gpio polarity
  * @wakeup: controls whether the device should be set up as wakeup
  *      source
+ * @no_autorepeat: disable key autorepeat
  *
  * This structure represents platform-specific data that use used by
  * matrix_keypad driver to perform proper initialization.
@@ -64,6 +65,7 @@ struct matrix_keypad_platform_data {
 
         bool            active_low;
         bool            wakeup;
+        bool            no_autorepeat;
 };
 
 /**
diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 7bdf6ffe2b49..0e269038bb38 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -21,6 +21,10 @@ struct in6_pktinfo {
         int             ipi6_ifindex;
 };
 
+struct ip6_mtuinfo {
+        struct sockaddr_in6     ip6m_addr;
+        __u32                   ip6m_mtu;
+};
 
 struct in6_ifreq {
         struct in6_addr ifr6_addr;
@@ -254,6 +258,7 @@ struct inet6_skb_parm {
 };
 
 #define IP6CB(skb)      ((struct inet6_skb_parm*)((skb)->cb))
+#define IP6CBMTU(skb)   ((struct ip6_mtuinfo *)((skb)->cb))
 
 static inline int inet6_iif(const struct sk_buff *skb)
 {
@@ -335,21 +340,25 @@ struct ipv6_pinfo {
                                 dstopts:1,
                                 odstopts:1,
                                 rxflow:1,
-                                rxtclass:1;
+                                rxtclass:1,
+                                rxpmtu:1;
                 } bits;
                 __u16           all;
         } rxopt;
 
         /* sockopt flags */
-        __u8                    recverr:1,
+        __u16                   recverr:1,
                                 sndflow:1,
                                 pmtudisc:2,
                                 ipv6only:1,
-                                srcprefs:3;     /* 001: prefer temporary address
+                                srcprefs:3,     /* 001: prefer temporary address
                                                  * 010: prefer public address
                                                  * 100: prefer care-of address
                                                  */
+                                dontfrag:1;
+        __u8                    min_hopcount;
         __u8                    tclass;
+        __u8                    padding;
 
         __u32                   dst_cookie;
 
@@ -359,6 +368,7 @@ struct ipv6_pinfo {
 
         struct ipv6_txoptions   *opt;
         struct sk_buff          *pktoptions;
+        struct sk_buff          *rxpmtu;
         struct {
                 struct ipv6_txoptions *opt;
                 u8 hop_limit;
diff --git a/include/linux/ks8842.h b/include/linux/ks8842.h
new file mode 100644
index 000000000000..da0341b8ca0a
--- /dev/null
+++ b/include/linux/ks8842.h
@@ -0,0 +1,34 @@
+/*
+ * ks8842.h KS8842 platform data struct definition
+ * Copyright (c) 2010 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#ifndef _LINUX_KS8842_H
+#define _LINUX_KS8842_H
+
+#include <linux/if_ether.h>
+
+/**
+ * struct ks8842_platform_data - Platform data of the KS8842 network driver
+ * @macaddr:    The MAC address of the device, set to all 0:s to use the on in
+ *              the chip.
+ *
+ */
+struct ks8842_platform_data {
+        u8 macaddr[ETH_ALEN];
+};
+
+#endif
diff --git a/include/linux/net.h b/include/linux/net.h
index 4157b5d42bd6..2b4deeeb8646 100644
--- a/include/linux/net.h
+++ b/include/linux/net.h
@@ -59,6 +59,7 @@ typedef enum {
 #include <linux/wait.h>
 #include <linux/fcntl.h>        /* For O_CLOEXEC and O_NONBLOCK */
 #include <linux/kmemcheck.h>
+#include <linux/rcupdate.h>
 
 struct poll_table_struct;
 struct pipe_inode_info;
@@ -116,6 +117,12 @@ enum sock_shutdown_cmd {
         SHUT_RDWR       = 2,
 };
 
+struct socket_wq {
+        wait_queue_head_t       wait;
+        struct fasync_struct    *fasync_list;
+        struct rcu_head         rcu;
+} ____cacheline_aligned_in_smp;
+
 /**
  *  struct socket - general BSD socket
  *  @state: socket state (%SS_CONNECTED, etc)
@@ -135,11 +142,8 @@ struct socket {
         kmemcheck_bitfield_end(type);
 
         unsigned long           flags;
-        /*
-         * Please keep fasync_list & wait fields in the same cache line
-         */
-        struct fasync_struct    *fasync_list;
-        wait_queue_head_t       wait;
+
+        struct socket_wq        *wq;
 
         struct file             *file;
         struct sock             *sk;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 3c5ed5f5274e..69022d47d6f2 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -218,16 +218,6 @@ struct neighbour;
 struct neigh_parms;
 struct sk_buff;
 
-struct netif_rx_stats {
-        unsigned total;
-        unsigned dropped;
-        unsigned time_squeeze;
-        unsigned cpu_collision;
-        unsigned received_rps;
-};
-
-DECLARE_PER_CPU(struct netif_rx_stats, netdev_rx_stat);
-
 struct netdev_hw_addr {
         struct list_head        list;
         unsigned char           addr[MAX_ADDR_LEN];
@@ -734,6 +724,7 @@ struct net_device_ops {
                                                         unsigned short vid);
 #ifdef CONFIG_NET_POLL_CONTROLLER
         void                    (*ndo_poll_controller)(struct net_device *dev);
+        void                    (*ndo_netpoll_cleanup)(struct net_device *dev);
 #endif
         int                     (*ndo_set_vf_mac)(struct net_device *dev,
                                                   int queue, u8 *mac);
@@ -888,7 +879,7 @@ struct net_device {
         unsigned char           operstate; /* RFC2863 operstate */
         unsigned char           link_mode; /* mapping policy to operstate */
 
-        unsigned                mtu;    /* interface MTU value          */
+        unsigned int            mtu;    /* interface MTU value          */
         unsigned short          type;   /* interface hardware type      */
         unsigned short          hard_header_len;        /* hardware hdr length  */
 
@@ -1385,8 +1376,16 @@ static inline int unregister_gifconf(unsigned int family)
  */
 struct softnet_data {
         struct Qdisc            *output_queue;
+        struct Qdisc            **output_queue_tailp;
         struct list_head        poll_list;
         struct sk_buff          *completion_queue;
+        struct sk_buff_head     process_queue;
+
+        /* stats */
+        unsigned int            processed;
+        unsigned int            time_squeeze;
+        unsigned int            cpu_collision;
+        unsigned int            received_rps;
 
 #ifdef CONFIG_RPS
         struct softnet_data     *rps_ipi_list;
@@ -1397,14 +1396,16 @@ struct softnet_data {
         unsigned int            cpu;
         unsigned int            input_queue_head;
 #endif
+        unsigned                dropped;
         struct sk_buff_head     input_pkt_queue;
         struct napi_struct      backlog;
 };
 
-static inline void input_queue_head_incr(struct softnet_data *sd)
+static inline void input_queue_head_add(struct softnet_data *sd,
+                                        unsigned int len)
 {
 #ifdef CONFIG_RPS
-        sd->input_queue_head++;
+        sd->input_queue_head += len;
 #endif
 }
 
diff --git a/include/linux/netpoll.h b/include/linux/netpoll.h
index a765ea898549..e9e231215865 100644
--- a/include/linux/netpoll.h
+++ b/include/linux/netpoll.h
@@ -14,6 +14,7 @@
 
 struct netpoll {
         struct net_device *dev;
+        struct net_device *real_dev;
         char dev_name[IFNAMSIZ];
         const char *name;
         void (*rx_hook)(struct netpoll *, int, char *, int);
@@ -36,8 +37,11 @@ struct netpoll_info {
         struct sk_buff_head txq;
 
         struct delayed_work tx_work;
+
+        struct netpoll *netpoll;
 };
 
+void netpoll_poll_dev(struct net_device *dev);
 void netpoll_poll(struct netpoll *np);
 void netpoll_send_udp(struct netpoll *np, const char *msg, int len);
 void netpoll_print_options(struct netpoll *np);
@@ -47,22 +51,23 @@ int netpoll_trap(void);
 void netpoll_set_trap(int trap);
 void netpoll_cleanup(struct netpoll *np);
 int __netpoll_rx(struct sk_buff *skb);
+void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb);
 
 
 #ifdef CONFIG_NETPOLL
-static inline int netpoll_rx(struct sk_buff *skb)
+static inline bool netpoll_rx(struct sk_buff *skb)
 {
         struct netpoll_info *npinfo = skb->dev->npinfo;
         unsigned long flags;
-        int ret = 0;
+        bool ret = false;
 
         if (!npinfo || (list_empty(&npinfo->rx_np) && !npinfo->rx_flags))
-                return 0;
+                return false;
 
         spin_lock_irqsave(&npinfo->rx_lock, flags);
         /* check rx_flags again with the lock held */
         if (npinfo->rx_flags && __netpoll_rx(skb))
-                ret = 1;
+                ret = true;
         spin_unlock_irqrestore(&npinfo->rx_lock, flags);
 
         return ret;
diff --git a/include/linux/nfs_fs_sb.h b/include/linux/nfs_fs_sb.h
index 717a5e54eb1d..e82957acea56 100644
--- a/include/linux/nfs_fs_sb.h
+++ b/include/linux/nfs_fs_sb.h
@@ -176,6 +176,7 @@ struct nfs_server {
 #define NFS_CAP_ATIME           (1U << 11)
 #define NFS_CAP_CTIME           (1U << 12)
 #define NFS_CAP_MTIME           (1U << 13)
+#define NFS_CAP_POSIX_LOCK      (1U << 14)
 
 
 /* maximum number of slots to use */
diff --git a/include/linux/nl80211.h b/include/linux/nl80211.h
index 2ea3edeee7aa..f8750f9a65b8 100644
--- a/include/linux/nl80211.h
+++ b/include/linux/nl80211.h
@@ -709,6 +709,9 @@ enum nl80211_commands {
  *      NL80211_CMD_AUTHENTICATE, NL80211_CMD_DEAUTHENTICATE,
  *      NL80211_CMD_DISASSOCIATE.
  *
+ * @NL80211_ATTR_AP_ISOLATE: (AP mode) Do not forward traffic between stations
+ *      connected to this BSS.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -864,6 +867,8 @@ enum nl80211_attrs {
 
         NL80211_ATTR_LOCAL_STATE_CHANGE,
 
+        NL80211_ATTR_AP_ISOLATE,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index 9c5d3fad01f3..7c3609622334 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -206,6 +206,7 @@ static inline int notifier_to_errno(int ret)
 #define NETDEV_POST_TYPE_CHANGE 0x000F
 #define NETDEV_POST_INIT        0x0010
 #define NETDEV_UNREGISTER_BATCH 0x0011
+#define NETDEV_BONDING_DESLAVE  0x0012
 
 #define SYS_DOWN        0x0001  /* Notify of system down */
 #define SYS_RESTART     SYS_DOWN
diff --git a/include/linux/pci_regs.h b/include/linux/pci_regs.h
index c8f302991b66..c4c3d68be19a 100644
--- a/include/linux/pci_regs.h
+++ b/include/linux/pci_regs.h
@@ -442,7 +442,10 @@
 #define  PCI_EXP_LNKCTL_LABIE   0x0800  /* Lnk Autonomous Bandwidth Interrupt Enable */
 #define PCI_EXP_LNKSTA          18      /* Link Status */
 #define  PCI_EXP_LNKSTA_CLS     0x000f  /* Current Link Speed */
+#define  PCI_EXP_LNKSTA_CLS_2_5GB 0x01  /* Current Link Speed 2.5GT/s */
+#define  PCI_EXP_LNKSTA_CLS_5_0GB 0x02  /* Current Link Speed 5.0GT/s */
 #define  PCI_EXP_LNKSTA_NLW     0x03f0  /* Nogotiated Link Width */
+#define  PCI_EXP_LNKSTA_NLW_SHIFT 4     /* start of NLW mask in link status */
 #define  PCI_EXP_LNKSTA_LT      0x0800  /* Link Training */
 #define  PCI_EXP_LNKSTA_SLC     0x1000  /* Slot Clock Configuration */
 #define  PCI_EXP_LNKSTA_DLLLA   0x2000  /* Data Link Layer Link Active */
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 004908b104d5..4ec3b38ce9c5 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -429,6 +429,23 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
                 pos = rcu_dereference_raw(pos->next))
 
 /**
+ * hlist_for_each_entry_rcu_bh - iterate over rcu list of given type
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @head:       the head for your list.
+ * @member:     the name of the hlist_node within the struct.
+ *
+ * This list-traversal primitive may safely run concurrently with
+ * the _rcu list-mutation primitives such as hlist_add_head_rcu()
+ * as long as the traversal is guarded by rcu_read_lock().
+ */
+#define hlist_for_each_entry_rcu_bh(tpos, pos, head, member)             \
+        for (pos = rcu_dereference_bh((head)->first);                    \
+                pos && ({ prefetch(pos->next); 1; }) &&                  \
+                ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; }); \
+                pos = rcu_dereference_bh(pos->next))
+
+/**
  * hlist_for_each_entry_continue_rcu - iterate over a hlist continuing after current point
  * @tpos:       the type * to use as a loop cursor.
  * @pos:        the &struct hlist_node to use as a loop cursor.
@@ -440,6 +457,18 @@ static inline void hlist_add_after_rcu(struct hlist_node *prev,
              ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });  \
              pos = rcu_dereference(pos->next))
 
+/**
+ * hlist_for_each_entry_continue_rcu_bh - iterate over a hlist continuing after current point
+ * @tpos:       the type * to use as a loop cursor.
+ * @pos:        the &struct hlist_node to use as a loop cursor.
+ * @member:     the name of the hlist_node within the struct.
+ */
+#define hlist_for_each_entry_continue_rcu_bh(tpos, pos, member)         \
+        for (pos = rcu_dereference_bh((pos)->next);                     \
+             pos && ({ prefetch(pos->next); 1; }) &&                    \
+             ({ tpos = hlist_entry(pos, typeof(*tpos), member); 1; });  \
+             pos = rcu_dereference_bh(pos->next))
+
 
 #endif  /* __KERNEL__ */
 #endif
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 872a98e13d6a..07db2feb8572 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -101,10 +101,7 @@ extern struct lockdep_map rcu_sched_lock_map;
 # define rcu_read_release_sched() \
                 lock_release(&rcu_sched_lock_map, 1, _THIS_IP_)
 
-static inline int debug_lockdep_rcu_enabled(void)
-{
-        return likely(rcu_scheduler_active && debug_locks);
-}
+extern int debug_lockdep_rcu_enabled(void);
 
 /**
  * rcu_read_lock_held - might we be in RCU read-side critical section?
@@ -195,12 +192,30 @@ static inline int rcu_read_lock_sched_held(void)
 
 /**
  * rcu_dereference_check - rcu_dereference with debug checking
+ * @p: The pointer to read, prior to dereferencing
+ * @c: The conditions under which the dereference will take place
+ *
+ * Do an rcu_dereference(), but check that the conditions under which the
+ * dereference will take place are correct.  Typically the conditions indicate
+ * the various locking conditions that should be held at that point.  The check
+ * should return true if the conditions are satisfied.
+ *
+ * For example:
+ *
+ *      bar = rcu_dereference_check(foo->bar, rcu_read_lock_held() ||
+ *                                            lockdep_is_held(&foo->lock));
  *
- * Do an rcu_dereference(), but check that the context is correct.
- * For example, rcu_dereference_check(gp, rcu_read_lock_held()) to
- * ensure that the rcu_dereference_check() executes within an RCU
- * read-side critical section.  It is also possible to check for
- * locks being held, for example, by using lockdep_is_held().
+ * could be used to indicate to lockdep that foo->bar may only be dereferenced
+ * if either the RCU read lock is held, or that the lock required to replace
+ * the bar struct at foo->bar is held.
+ *
+ * Note that the list of conditions may also include indications of when a lock
+ * need not be held, for example during initialisation or destruction of the
+ * target struct:
+ *
+ *      bar = rcu_dereference_check(foo->bar, rcu_read_lock_held() ||
+ *                                            lockdep_is_held(&foo->lock) ||
+ *                                            atomic_read(&foo->usage) == 0);
  */
 #define rcu_dereference_check(p, c) \
         ({ \
@@ -209,13 +224,45 @@ static inline int rcu_read_lock_sched_held(void)
                 rcu_dereference_raw(p); \
         })
 
+/**
+ * rcu_dereference_protected - fetch RCU pointer when updates prevented
+ *
+ * Return the value of the specified RCU-protected pointer, but omit
+ * both the smp_read_barrier_depends() and the ACCESS_ONCE().  This
+ * is useful in cases where update-side locks prevent the value of the
+ * pointer from changing.  Please note that this primitive does -not-
+ * prevent the compiler from repeating this reference or combining it
+ * with other references, so it should not be used without protection
+ * of appropriate locks.
+ */
+#define rcu_dereference_protected(p, c) \
+        ({ \
+                if (debug_lockdep_rcu_enabled() && !(c)) \
+                        lockdep_rcu_dereference(__FILE__, __LINE__); \
+                (p); \
+        })
+
 #else /* #ifdef CONFIG_PROVE_RCU */
 
 #define rcu_dereference_check(p, c)     rcu_dereference_raw(p)
+#define rcu_dereference_protected(p, c) (p)
 
 #endif /* #else #ifdef CONFIG_PROVE_RCU */
 
 /**
+ * rcu_access_pointer - fetch RCU pointer with no dereferencing
+ *
+ * Return the value of the specified RCU-protected pointer, but omit the
+ * smp_read_barrier_depends() and keep the ACCESS_ONCE().  This is useful
+ * when the value of this pointer is accessed, but the pointer is not
+ * dereferenced, for example, when testing an RCU-protected pointer against
+ * NULL.  This may also be used in cases where update-side locks prevent
+ * the value of the pointer from changing, but rcu_dereference_protected()
+ * is a lighter-weight primitive for this use case.
+ */
+#define rcu_access_pointer(p)   ACCESS_ONCE(p)
+
+/**
  * rcu_read_lock - mark the beginning of an RCU read-side critical section.
  *
  * When synchronize_rcu() is invoked on one CPU while other CPUs
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index d1c7c90e9cd4..5a42c36cb6aa 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -7,6 +7,12 @@
 #include <linux/if_addr.h>
 #include <linux/neighbour.h>
 
+/* rtnetlink families. Values up to 127 are reserved for real address
+ * families, values above 128 may be used arbitrarily.
+ */
+#define RTNL_FAMILY_IPMR                128
+#define RTNL_FAMILY_MAX                 128
+
 /****
  *              Routing/neighbour discovery messages.
  ****/
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 38501d20650c..c9525bce80f6 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -187,7 +187,6 @@ union skb_shared_tx {
  * the end of the header data, ie. at skb->end.
  */
 struct skb_shared_info {
-        atomic_t        dataref;
         unsigned short  nr_frags;
         unsigned short  gso_size;
         /* Warning: this field is not always filled in (UFO)! */
@@ -197,6 +196,12 @@ struct skb_shared_info {
         union skb_shared_tx tx_flags;
         struct sk_buff  *frag_list;
         struct skb_shared_hwtstamps hwtstamps;
+
+        /*
+         * Warning : all fields before dataref are cleared in __alloc_skb()
+         */
+        atomic_t        dataref;
+
         skb_frag_t      frags[MAX_SKB_FRAGS];
         /* Intermediate layers must ensure that destructor_arg
          * remains valid until skb destructor */
@@ -470,10 +475,6 @@ extern int	       skb_cow_data(struct sk_buff *skb, int tailbits,
                                     struct sk_buff **trailer);
 extern int             skb_pad(struct sk_buff *skb, int pad);
 #define dev_kfree_skb(a)        consume_skb(a)
-extern void           skb_over_panic(struct sk_buff *skb, int len,
-                                     void *here);
-extern void           skb_under_panic(struct sk_buff *skb, int len,
-                                      void *here);
 
 extern int skb_append_datato_frags(struct sock *sk, struct sk_buff *skb,
                         int getfrag(void *from, char *to, int offset,
@@ -1132,6 +1133,11 @@ static inline unsigned char *__skb_pull(struct sk_buff *skb, unsigned int len)
         return skb->data += len;
 }
 
+static inline unsigned char *skb_pull_inline(struct sk_buff *skb, unsigned int len)
+{
+        return unlikely(len > skb->len) ? NULL : __skb_pull(skb, len);
+}
+
 extern unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta);
 
 static inline unsigned char *__pskb_pull(struct sk_buff *skb, unsigned int len)
@@ -1355,9 +1361,12 @@ static inline int skb_network_offset(const struct sk_buff *skb)
  *
  * Various parts of the networking layer expect at least 32 bytes of
  * headroom, you should not reduce this.
+ * With RPS, we raised NET_SKB_PAD to 64 so that get_rps_cpus() fetches span
+ * a 64 bytes aligned block to fit modern (>= 64 bytes) cache line sizes
+ * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
  */
 #ifndef NET_SKB_PAD
-#define NET_SKB_PAD     32
+#define NET_SKB_PAD     64
 #endif
 
 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff --git a/include/linux/spi/wl12xx.h b/include/linux/spi/wl12xx.h
index aed64ed3dc8a..a223ecbc71ef 100644
--- a/include/linux/spi/wl12xx.h
+++ b/include/linux/spi/wl12xx.h
@@ -26,6 +26,8 @@
 
 struct wl12xx_platform_data {
         void (*set_power)(bool enable);
+        /* SDIO only: IRQ number if WLAN_IRQ line is used, 0 for SDIO IRQs */
+        int irq;
         bool use_eeprom;
 };
 
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 24f988547361..a2608bff9c78 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -305,6 +305,7 @@ struct ssb_bus {
         /* ID information about the Chip. */
         u16 chip_id;
         u16 chip_rev;
+        u16 sprom_offset;
         u16 sprom_size;         /* number of words in sprom */
         u8 chip_package;
 
@@ -394,6 +395,9 @@ extern int ssb_bus_sdiobus_register(struct ssb_bus *bus,
 
 extern void ssb_bus_unregister(struct ssb_bus *bus);
 
+/* Does the device have an SPROM? */
+extern bool ssb_is_sprom_available(struct ssb_bus *bus);
+
 /* Set a fallback SPROM.
  * See kdoc at the function definition for complete documentation. */
 extern int ssb_arch_set_fallback_sprom(const struct ssb_sprom *sprom);
diff --git a/include/linux/ssb/ssb_driver_chipcommon.h b/include/linux/ssb/ssb_driver_chipcommon.h
index 4e27acf0a92f..2cdf249b4e5f 100644
--- a/include/linux/ssb/ssb_driver_chipcommon.h
+++ b/include/linux/ssb/ssb_driver_chipcommon.h
@@ -53,6 +53,7 @@
 #define  SSB_CHIPCO_CAP_64BIT           0x08000000      /* 64-bit Backplane */
 #define  SSB_CHIPCO_CAP_PMU             0x10000000      /* PMU available (rev >= 20) */
 #define  SSB_CHIPCO_CAP_ECI             0x20000000      /* ECI available (rev >= 20) */
+#define  SSB_CHIPCO_CAP_SPROM           0x40000000      /* SPROM present */
 #define SSB_CHIPCO_CORECTL              0x0008
 #define  SSB_CHIPCO_CORECTL_UARTCLK0    0x00000001      /* Drive UART with internal clock */
 #define  SSB_CHIPCO_CORECTL_SE          0x00000002      /* sync clk out enable (corerev >= 3) */
@@ -385,6 +386,7 @@
 
 
 /** Chip specific Chip-Status register contents. */
+#define SSB_CHIPCO_CHST_4322_SPROM_EXISTS       0x00000040 /* SPROM present */
 #define SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL      0x00000003
 #define SSB_CHIPCO_CHST_4325_DEFCIS_SEL         0 /* OTP is powered up, use def. CIS, no SPROM */
 #define SSB_CHIPCO_CHST_4325_SPROM_SEL          1 /* OTP is powered up, SPROM is present */
@@ -398,6 +400,18 @@
 #define SSB_CHIPCO_CHST_4325_RCAL_VALUE_SHIFT   4
 #define SSB_CHIPCO_CHST_4325_PMUTOP_2B          0x00000200 /* 1 for 2b, 0 for to 2a */
 
+/** Macros to determine SPROM presence based on Chip-Status register. */
+#define SSB_CHIPCO_CHST_4312_SPROM_PRESENT(status) \
+        ((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
+                SSB_CHIPCO_CHST_4325_OTP_SEL)
+#define SSB_CHIPCO_CHST_4322_SPROM_PRESENT(status) \
+        (status & SSB_CHIPCO_CHST_4322_SPROM_EXISTS)
+#define SSB_CHIPCO_CHST_4325_SPROM_PRESENT(status) \
+        (((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
+                SSB_CHIPCO_CHST_4325_DEFCIS_SEL) && \
+         ((status & SSB_CHIPCO_CHST_4325_SPROM_OTP_SEL) != \
+                SSB_CHIPCO_CHST_4325_OTP_SEL))
+
 
 
 /** Clockcontrol masks and values **/
@@ -564,6 +578,7 @@ struct ssb_chipcommon_pmu {
 struct ssb_chipcommon {
         struct ssb_device *dev;
         u32 capabilities;
+        u32 status;
         /* Fast Powerup Delay constant */
         u16 fast_pwrup_delay;
         struct ssb_chipcommon_pmu pmu;
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 9ae9082eaeb4..a6d5225b9275 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -170,26 +170,27 @@
 #define SSB_SPROMSIZE_WORDS_R4          220
 #define SSB_SPROMSIZE_BYTES_R123        (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
 #define SSB_SPROMSIZE_BYTES_R4          (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
-#define SSB_SPROM_BASE                  0x1000
-#define SSB_SPROM_REVISION              0x107E
+#define SSB_SPROM_BASE1                 0x1000
+#define SSB_SPROM_BASE31                0x0800
+#define SSB_SPROM_REVISION              0x007E
 #define  SSB_SPROM_REVISION_REV         0x00FF  /* SPROM Revision number */
 #define  SSB_SPROM_REVISION_CRC         0xFF00  /* SPROM CRC8 value */
 #define  SSB_SPROM_REVISION_CRC_SHIFT   8
 
 /* SPROM Revision 1 */
-#define SSB_SPROM1_SPID                 0x1004  /* Subsystem Product ID for PCI */
-#define SSB_SPROM1_SVID                 0x1006  /* Subsystem Vendor ID for PCI */
-#define SSB_SPROM1_PID                  0x1008  /* Product ID for PCI */
-#define SSB_SPROM1_IL0MAC               0x1048  /* 6 bytes MAC address for 802.11b/g */
-#define SSB_SPROM1_ET0MAC               0x104E  /* 6 bytes MAC address for Ethernet */
-#define SSB_SPROM1_ET1MAC               0x1054  /* 6 bytes MAC address for 802.11a */
-#define SSB_SPROM1_ETHPHY               0x105A  /* Ethernet PHY settings */
+#define SSB_SPROM1_SPID                 0x0004  /* Subsystem Product ID for PCI */
+#define SSB_SPROM1_SVID                 0x0006  /* Subsystem Vendor ID for PCI */
+#define SSB_SPROM1_PID                  0x0008  /* Product ID for PCI */
+#define SSB_SPROM1_IL0MAC               0x0048  /* 6 bytes MAC address for 802.11b/g */
+#define SSB_SPROM1_ET0MAC               0x004E  /* 6 bytes MAC address for Ethernet */
+#define SSB_SPROM1_ET1MAC               0x0054  /* 6 bytes MAC address for 802.11a */
+#define SSB_SPROM1_ETHPHY               0x005A  /* Ethernet PHY settings */
 #define  SSB_SPROM1_ETHPHY_ET0A         0x001F  /* MII Address for enet0 */
 #define  SSB_SPROM1_ETHPHY_ET1A         0x03E0  /* MII Address for enet1 */
 #define  SSB_SPROM1_ETHPHY_ET1A_SHIFT   5
 #define  SSB_SPROM1_ETHPHY_ET0M         (1<<14) /* MDIO for enet0 */
 #define  SSB_SPROM1_ETHPHY_ET1M         (1<<15) /* MDIO for enet1 */
-#define SSB_SPROM1_BINF                 0x105C  /* Board info */
+#define SSB_SPROM1_BINF                 0x005C  /* Board info */
 #define  SSB_SPROM1_BINF_BREV           0x00FF  /* Board Revision */
 #define  SSB_SPROM1_BINF_CCODE          0x0F00  /* Country Code */
 #define  SSB_SPROM1_BINF_CCODE_SHIFT    8
@@ -197,63 +198,63 @@
 #define  SSB_SPROM1_BINF_ANTBG_SHIFT    12
 #define  SSB_SPROM1_BINF_ANTA           0xC000  /* Available A-PHY antennas */
 #define  SSB_SPROM1_BINF_ANTA_SHIFT     14
-#define SSB_SPROM1_PA0B0                0x105E
-#define SSB_SPROM1_PA0B1                0x1060
-#define SSB_SPROM1_PA0B2                0x1062
-#define SSB_SPROM1_GPIOA                0x1064  /* General Purpose IO pins 0 and 1 */
+#define SSB_SPROM1_PA0B0                0x005E
+#define SSB_SPROM1_PA0B1                0x0060
+#define SSB_SPROM1_PA0B2                0x0062
+#define SSB_SPROM1_GPIOA                0x0064  /* General Purpose IO pins 0 and 1 */
 #define  SSB_SPROM1_GPIOA_P0            0x00FF  /* Pin 0 */
 #define  SSB_SPROM1_GPIOA_P1            0xFF00  /* Pin 1 */
 #define  SSB_SPROM1_GPIOA_P1_SHIFT      8
-#define SSB_SPROM1_GPIOB                0x1066  /* General Purpuse IO pins 2 and 3 */
+#define SSB_SPROM1_GPIOB                0x0066  /* General Purpuse IO pins 2 and 3 */
 #define  SSB_SPROM1_GPIOB_P2            0x00FF  /* Pin 2 */
 #define  SSB_SPROM1_GPIOB_P3            0xFF00  /* Pin 3 */
 #define  SSB_SPROM1_GPIOB_P3_SHIFT      8
-#define SSB_SPROM1_MAXPWR               0x1068  /* Power Amplifier Max Power */
+#define SSB_SPROM1_MAXPWR               0x0068  /* Power Amplifier Max Power */
 #define  SSB_SPROM1_MAXPWR_BG           0x00FF  /* B-PHY and G-PHY (in dBm Q5.2) */
 #define  SSB_SPROM1_MAXPWR_A            0xFF00  /* A-PHY (in dBm Q5.2) */
 #define  SSB_SPROM1_MAXPWR_A_SHIFT      8
-#define SSB_SPROM1_PA1B0                0x106A
-#define SSB_SPROM1_PA1B1                0x106C
-#define SSB_SPROM1_PA1B2                0x106E
-#define SSB_SPROM1_ITSSI                0x1070  /* Idle TSSI Target */
+#define SSB_SPROM1_PA1B0                0x006A
+#define SSB_SPROM1_PA1B1                0x006C
+#define SSB_SPROM1_PA1B2                0x006E
+#define SSB_SPROM1_ITSSI                0x0070  /* Idle TSSI Target */
 #define  SSB_SPROM1_ITSSI_BG            0x00FF  /* B-PHY and G-PHY*/
 #define  SSB_SPROM1_ITSSI_A             0xFF00  /* A-PHY */
 #define  SSB_SPROM1_ITSSI_A_SHIFT       8
-#define SSB_SPROM1_BFLLO                0x1072  /* Boardflags (low 16 bits) */
-#define SSB_SPROM1_AGAIN                0x1074  /* Antenna Gain (in dBm Q5.2) */
+#define SSB_SPROM1_BFLLO                0x0072  /* Boardflags (low 16 bits) */
+#define SSB_SPROM1_AGAIN                0x0074  /* Antenna Gain (in dBm Q5.2) */
 #define  SSB_SPROM1_AGAIN_BG            0x00FF  /* B-PHY and G-PHY */
 #define  SSB_SPROM1_AGAIN_BG_SHIFT      0
 #define  SSB_SPROM1_AGAIN_A             0xFF00  /* A-PHY */
 #define  SSB_SPROM1_AGAIN_A_SHIFT       8
 
 /* SPROM Revision 2 (inherits from rev 1) */
-#define SSB_SPROM2_BFLHI                0x1038  /* Boardflags (high 16 bits) */
-#define SSB_SPROM2_MAXP_A               0x103A  /* A-PHY Max Power */
+#define SSB_SPROM2_BFLHI                0x0038  /* Boardflags (high 16 bits) */
+#define SSB_SPROM2_MAXP_A               0x003A  /* A-PHY Max Power */
 #define  SSB_SPROM2_MAXP_A_HI           0x00FF  /* Max Power High */
 #define  SSB_SPROM2_MAXP_A_LO           0xFF00  /* Max Power Low */
 #define  SSB_SPROM2_MAXP_A_LO_SHIFT     8
-#define SSB_SPROM2_PA1LOB0              0x103C  /* A-PHY PowerAmplifier Low Settings */
-#define SSB_SPROM2_PA1LOB1              0x103E  /* A-PHY PowerAmplifier Low Settings */
-#define SSB_SPROM2_PA1LOB2              0x1040  /* A-PHY PowerAmplifier Low Settings */
-#define SSB_SPROM2_PA1HIB0              0x1042  /* A-PHY PowerAmplifier High Settings */
-#define SSB_SPROM2_PA1HIB1              0x1044  /* A-PHY PowerAmplifier High Settings */
-#define SSB_SPROM2_PA1HIB2              0x1046  /* A-PHY PowerAmplifier High Settings */
-#define SSB_SPROM2_OPO                  0x1078  /* OFDM Power Offset from CCK Level */
+#define SSB_SPROM2_PA1LOB0              0x003C  /* A-PHY PowerAmplifier Low Settings */
+#define SSB_SPROM2_PA1LOB1              0x003E  /* A-PHY PowerAmplifier Low Settings */
+#define SSB_SPROM2_PA1LOB2              0x0040  /* A-PHY PowerAmplifier Low Settings */
+#define SSB_SPROM2_PA1HIB0              0x0042  /* A-PHY PowerAmplifier High Settings */
+#define SSB_SPROM2_PA1HIB1              0x0044  /* A-PHY PowerAmplifier High Settings */
+#define SSB_SPROM2_PA1HIB2              0x0046  /* A-PHY PowerAmplifier High Settings */
+#define SSB_SPROM2_OPO                  0x0078  /* OFDM Power Offset from CCK Level */
 #define  SSB_SPROM2_OPO_VALUE           0x00FF
 #define  SSB_SPROM2_OPO_UNUSED          0xFF00
-#define SSB_SPROM2_CCODE                0x107C  /* Two char Country Code */
+#define SSB_SPROM2_CCODE                0x007C  /* Two char Country Code */
 
 /* SPROM Revision 3 (inherits most data from rev 2) */
-#define SSB_SPROM3_IL0MAC               0x104A  /* 6 bytes MAC address for 802.11b/g */
-#define SSB_SPROM3_OFDMAPO              0x102C  /* A-PHY OFDM Mid Power Offset (4 bytes, BigEndian) */
-#define SSB_SPROM3_OFDMALPO             0x1030  /* A-PHY OFDM Low Power Offset (4 bytes, BigEndian) */
-#define SSB_SPROM3_OFDMAHPO             0x1034  /* A-PHY OFDM High Power Offset (4 bytes, BigEndian) */
-#define SSB_SPROM3_GPIOLDC              0x1042  /* GPIO LED Powersave Duty Cycle (4 bytes, BigEndian) */
+#define SSB_SPROM3_OFDMAPO              0x002C  /* A-PHY OFDM Mid Power Offset (4 bytes, BigEndian) */
+#define SSB_SPROM3_OFDMALPO             0x0030  /* A-PHY OFDM Low Power Offset (4 bytes, BigEndian) */
+#define SSB_SPROM3_OFDMAHPO             0x0034  /* A-PHY OFDM High Power Offset (4 bytes, BigEndian) */
+#define SSB_SPROM3_GPIOLDC              0x0042  /* GPIO LED Powersave Duty Cycle (4 bytes, BigEndian) */
 #define  SSB_SPROM3_GPIOLDC_OFF         0x0000FF00      /* Off Count */
 #define  SSB_SPROM3_GPIOLDC_OFF_SHIFT   8
 #define  SSB_SPROM3_GPIOLDC_ON          0x00FF0000      /* On Count */
 #define  SSB_SPROM3_GPIOLDC_ON_SHIFT    16
-#define SSB_SPROM3_CCKPO                0x1078  /* CCK Power Offset */
+#define SSB_SPROM3_IL0MAC               0x004A  /* 6 bytes MAC address for 802.11b/g */
+#define SSB_SPROM3_CCKPO                0x0078  /* CCK Power Offset */
 #define  SSB_SPROM3_CCKPO_1M            0x000F  /* 1M Rate PO */
 #define  SSB_SPROM3_CCKPO_2M            0x00F0  /* 2M Rate PO */
 #define  SSB_SPROM3_CCKPO_2M_SHIFT      4
@@ -264,100 +265,100 @@
 #define  SSB_SPROM3_OFDMGPO             0x107A  /* G-PHY OFDM Power Offset (4 bytes, BigEndian) */
 
 /* SPROM Revision 4 */
-#define SSB_SPROM4_IL0MAC               0x104C  /* 6 byte MAC address for a/b/g/n */
-#define SSB_SPROM4_ETHPHY               0x105A  /* Ethernet PHY settings ?? */
+#define SSB_SPROM4_BFLLO                0x0044  /* Boardflags (low 16 bits) */
+#define SSB_SPROM4_BFLHI                0x0046  /* Board Flags Hi */
+#define SSB_SPROM4_IL0MAC               0x004C  /* 6 byte MAC address for a/b/g/n */
+#define SSB_SPROM4_CCODE                0x0052  /* Country Code (2 bytes) */
+#define SSB_SPROM4_GPIOA                0x0056  /* Gen. Purpose IO # 0 and 1 */
+#define  SSB_SPROM4_GPIOA_P0            0x00FF  /* Pin 0 */
+#define  SSB_SPROM4_GPIOA_P1            0xFF00  /* Pin 1 */
+#define  SSB_SPROM4_GPIOA_P1_SHIFT      8
+#define SSB_SPROM4_GPIOB                0x0058  /* Gen. Purpose IO # 2 and 3 */
+#define  SSB_SPROM4_GPIOB_P2            0x00FF  /* Pin 2 */
+#define  SSB_SPROM4_GPIOB_P3            0xFF00  /* Pin 3 */
+#define  SSB_SPROM4_GPIOB_P3_SHIFT      8
+#define SSB_SPROM4_ETHPHY               0x005A  /* Ethernet PHY settings ?? */
 #define  SSB_SPROM4_ETHPHY_ET0A         0x001F  /* MII Address for enet0 */
 #define  SSB_SPROM4_ETHPHY_ET1A         0x03E0  /* MII Address for enet1 */
 #define  SSB_SPROM4_ETHPHY_ET1A_SHIFT   5
 #define  SSB_SPROM4_ETHPHY_ET0M         (1<<14) /* MDIO for enet0 */
 #define  SSB_SPROM4_ETHPHY_ET1M         (1<<15) /* MDIO for enet1 */
-#define SSB_SPROM4_CCODE                0x1052  /* Country Code (2 bytes) */
-#define SSB_SPROM4_ANTAVAIL             0x105D  /* Antenna available bitfields */
-#define SSB_SPROM4_ANTAVAIL_A           0x00FF  /* A-PHY bitfield */
-#define SSB_SPROM4_ANTAVAIL_A_SHIFT     0
-#define SSB_SPROM4_ANTAVAIL_BG          0xFF00  /* B-PHY and G-PHY bitfield */
-#define SSB_SPROM4_ANTAVAIL_BG_SHIFT    8
-#define SSB_SPROM4_BFLLO                0x1044  /* Boardflags (low 16 bits) */
-#define SSB_SPROM4_AGAIN01              0x105E  /* Antenna Gain (in dBm Q5.2) */
+#define SSB_SPROM4_ANTAVAIL             0x005D  /* Antenna available bitfields */
+#define  SSB_SPROM4_ANTAVAIL_A          0x00FF  /* A-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_A_SHIFT    0
+#define  SSB_SPROM4_ANTAVAIL_BG         0xFF00  /* B-PHY and G-PHY bitfield */
+#define  SSB_SPROM4_ANTAVAIL_BG_SHIFT   8
+#define SSB_SPROM4_AGAIN01              0x005E  /* Antenna Gain (in dBm Q5.2) */
 #define  SSB_SPROM4_AGAIN0              0x00FF  /* Antenna 0 */
 #define  SSB_SPROM4_AGAIN0_SHIFT        0
 #define  SSB_SPROM4_AGAIN1              0xFF00  /* Antenna 1 */
 #define  SSB_SPROM4_AGAIN1_SHIFT        8
-#define SSB_SPROM4_AGAIN23              0x1060
+#define SSB_SPROM4_AGAIN23              0x0060
 #define  SSB_SPROM4_AGAIN2              0x00FF  /* Antenna 2 */
 #define  SSB_SPROM4_AGAIN2_SHIFT        0
 #define  SSB_SPROM4_AGAIN3              0xFF00  /* Antenna 3 */
 #define  SSB_SPROM4_AGAIN3_SHIFT        8
-#define SSB_SPROM4_BFLHI                0x1046  /* Board Flags Hi */
-#define SSB_SPROM4_MAXP_BG              0x1080  /* Max Power BG in path 1 */
+#define SSB_SPROM4_MAXP_BG              0x0080  /* Max Power BG in path 1 */
 #define  SSB_SPROM4_MAXP_BG_MASK        0x00FF  /* Mask for Max Power BG */
 #define  SSB_SPROM4_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
 #define  SSB_SPROM4_ITSSI_BG_SHIFT      8
-#define SSB_SPROM4_MAXP_A               0x108A  /* Max Power A in path 1 */
+#define SSB_SPROM4_MAXP_A               0x008A  /* Max Power A in path 1 */
 #define  SSB_SPROM4_MAXP_A_MASK         0x00FF  /* Mask for Max Power A */
 #define  SSB_SPROM4_ITSSI_A             0xFF00  /* Mask for path 1 itssi_a */
 #define  SSB_SPROM4_ITSSI_A_SHIFT       8
-#define SSB_SPROM4_GPIOA                0x1056  /* Gen. Purpose IO # 0 and 1 */
-#define  SSB_SPROM4_GPIOA_P0            0x00FF  /* Pin 0 */
-#define  SSB_SPROM4_GPIOA_P1            0xFF00  /* Pin 1 */
-#define  SSB_SPROM4_GPIOA_P1_SHIFT      8
-#define SSB_SPROM4_GPIOB                0x1058  /* Gen. Purpose IO # 2 and 3 */
-#define  SSB_SPROM4_GPIOB_P2            0x00FF  /* Pin 2 */
-#define  SSB_SPROM4_GPIOB_P3            0xFF00  /* Pin 3 */
-#define  SSB_SPROM4_GPIOB_P3_SHIFT      8
-#define SSB_SPROM4_PA0B0                0x1082  /* The paXbY locations are */
-#define SSB_SPROM4_PA0B1                0x1084  /*   only guesses */
-#define SSB_SPROM4_PA0B2                0x1086
-#define SSB_SPROM4_PA1B0                0x108E
-#define SSB_SPROM4_PA1B1                0x1090
-#define SSB_SPROM4_PA1B2                0x1092
+#define SSB_SPROM4_PA0B0                0x0082  /* The paXbY locations are */
+#define SSB_SPROM4_PA0B1                0x0084  /*   only guesses */
+#define SSB_SPROM4_PA0B2                0x0086
+#define SSB_SPROM4_PA1B0                0x008E
+#define SSB_SPROM4_PA1B1                0x0090
+#define SSB_SPROM4_PA1B2                0x0092
 
 /* SPROM Revision 5 (inherits most data from rev 4) */
-#define SSB_SPROM5_BFLLO                0x104A  /* Boardflags (low 16 bits) */
-#define SSB_SPROM5_BFLHI                0x104C  /* Board Flags Hi */
-#define SSB_SPROM5_IL0MAC               0x1052  /* 6 byte MAC address for a/b/g/n */
-#define SSB_SPROM5_CCODE                0x1044  /* Country Code (2 bytes) */
-#define SSB_SPROM5_GPIOA                0x1076  /* Gen. Purpose IO # 0 and 1 */
+#define SSB_SPROM5_CCODE                0x0044  /* Country Code (2 bytes) */
+#define SSB_SPROM5_BFLLO                0x004A  /* Boardflags (low 16 bits) */
+#define SSB_SPROM5_BFLHI                0x004C  /* Board Flags Hi */
+#define SSB_SPROM5_IL0MAC               0x0052  /* 6 byte MAC address for a/b/g/n */
+#define SSB_SPROM5_GPIOA                0x0076  /* Gen. Purpose IO # 0 and 1 */
 #define  SSB_SPROM5_GPIOA_P0            0x00FF  /* Pin 0 */
 #define  SSB_SPROM5_GPIOA_P1            0xFF00  /* Pin 1 */
 #define  SSB_SPROM5_GPIOA_P1_SHIFT      8
-#define SSB_SPROM5_GPIOB                0x1078  /* Gen. Purpose IO # 2 and 3 */
+#define SSB_SPROM5_GPIOB                0x0078  /* Gen. Purpose IO # 2 and 3 */
 #define  SSB_SPROM5_GPIOB_P2            0x00FF  /* Pin 2 */
 #define  SSB_SPROM5_GPIOB_P3            0xFF00  /* Pin 3 */
 #define  SSB_SPROM5_GPIOB_P3_SHIFT      8
 
 /* SPROM Revision 8 */
-#define SSB_SPROM8_BOARDREV             0x1082  /* Board revision */
-#define SSB_SPROM8_BFLLO                0x1084  /* Board flags (bits 0-15) */
-#define SSB_SPROM8_BFLHI                0x1086  /* Board flags (bits 16-31) */
-#define SSB_SPROM8_BFL2LO               0x1088  /* Board flags (bits 32-47) */
-#define SSB_SPROM8_BFL2HI               0x108A  /* Board flags (bits 48-63) */
-#define SSB_SPROM8_IL0MAC               0x108C  /* 6 byte MAC address */
-#define SSB_SPROM8_CCODE                0x1092  /* 2 byte country code */
-#define SSB_SPROM8_ANTAVAIL             0x109C  /* Antenna available bitfields*/
-#define SSB_SPROM8_ANTAVAIL_A           0xFF00  /* A-PHY bitfield */
-#define SSB_SPROM8_ANTAVAIL_A_SHIFT     8
-#define SSB_SPROM8_ANTAVAIL_BG          0x00FF  /* B-PHY and G-PHY bitfield */
-#define SSB_SPROM8_ANTAVAIL_BG_SHIFT    0
-#define SSB_SPROM8_AGAIN01              0x109E  /* Antenna Gain (in dBm Q5.2) */
+#define SSB_SPROM8_BOARDREV             0x0082  /* Board revision */
+#define SSB_SPROM8_BFLLO                0x0084  /* Board flags (bits 0-15) */
+#define SSB_SPROM8_BFLHI                0x0086  /* Board flags (bits 16-31) */
+#define SSB_SPROM8_BFL2LO               0x0088  /* Board flags (bits 32-47) */
+#define SSB_SPROM8_BFL2HI               0x008A  /* Board flags (bits 48-63) */
+#define SSB_SPROM8_IL0MAC               0x008C  /* 6 byte MAC address */
+#define SSB_SPROM8_CCODE                0x0092  /* 2 byte country code */
+#define SSB_SPROM8_GPIOA                0x0096  /*Gen. Purpose IO # 0 and 1 */
+#define  SSB_SPROM8_GPIOA_P0            0x00FF  /* Pin 0 */
+#define  SSB_SPROM8_GPIOA_P1            0xFF00  /* Pin 1 */
+#define  SSB_SPROM8_GPIOA_P1_SHIFT      8
+#define SSB_SPROM8_GPIOB                0x0098  /* Gen. Purpose IO # 2 and 3 */
+#define  SSB_SPROM8_GPIOB_P2            0x00FF  /* Pin 2 */
+#define  SSB_SPROM8_GPIOB_P3            0xFF00  /* Pin 3 */
+#define  SSB_SPROM8_GPIOB_P3_SHIFT      8
+#define SSB_SPROM8_ANTAVAIL             0x009C  /* Antenna available bitfields*/
+#define  SSB_SPROM8_ANTAVAIL_A          0xFF00  /* A-PHY bitfield */
+#define  SSB_SPROM8_ANTAVAIL_A_SHIFT    8
+#define  SSB_SPROM8_ANTAVAIL_BG         0x00FF  /* B-PHY and G-PHY bitfield */
+#define  SSB_SPROM8_ANTAVAIL_BG_SHIFT   0
+#define SSB_SPROM8_AGAIN01              0x009E  /* Antenna Gain (in dBm Q5.2) */
 #define  SSB_SPROM8_AGAIN0              0x00FF  /* Antenna 0 */
 #define  SSB_SPROM8_AGAIN0_SHIFT        0
 #define  SSB_SPROM8_AGAIN1              0xFF00  /* Antenna 1 */
 #define  SSB_SPROM8_AGAIN1_SHIFT        8
-#define SSB_SPROM8_AGAIN23              0x10A0
+#define SSB_SPROM8_AGAIN23              0x00A0
 #define  SSB_SPROM8_AGAIN2              0x00FF  /* Antenna 2 */
 #define  SSB_SPROM8_AGAIN2_SHIFT        0
 #define  SSB_SPROM8_AGAIN3              0xFF00  /* Antenna 3 */
 #define  SSB_SPROM8_AGAIN3_SHIFT        8
-#define SSB_SPROM8_GPIOA                0x1096  /*Gen. Purpose IO # 0 and 1 */
-#define  SSB_SPROM8_GPIOA_P0            0x00FF  /* Pin 0 */
-#define  SSB_SPROM8_GPIOA_P1            0xFF00  /* Pin 1 */
-#define  SSB_SPROM8_GPIOA_P1_SHIFT      8
-#define SSB_SPROM8_GPIOB                0x1098  /* Gen. Purpose IO # 2 and 3 */
-#define  SSB_SPROM8_GPIOB_P2            0x00FF  /* Pin 2 */
-#define  SSB_SPROM8_GPIOB_P3            0xFF00  /* Pin 3 */
-#define  SSB_SPROM8_GPIOB_P3_SHIFT      8
-#define SSB_SPROM8_RSSIPARM2G           0x10A4  /* RSSI params for 2GHz */
+#define SSB_SPROM8_RSSIPARM2G           0x00A4  /* RSSI params for 2GHz */
 #define  SSB_SPROM8_RSSISMF2G           0x000F
 #define  SSB_SPROM8_RSSISMC2G           0x00F0
 #define  SSB_SPROM8_RSSISMC2G_SHIFT     4
@@ -365,7 +366,7 @@
 #define  SSB_SPROM8_RSSISAV2G_SHIFT     8
 #define  SSB_SPROM8_BXA2G               0x1800
 #define  SSB_SPROM8_BXA2G_SHIFT         11
-#define SSB_SPROM8_RSSIPARM5G           0x10A6  /* RSSI params for 5GHz */
+#define SSB_SPROM8_RSSIPARM5G           0x00A6  /* RSSI params for 5GHz */
 #define  SSB_SPROM8_RSSISMF5G           0x000F
 #define  SSB_SPROM8_RSSISMC5G           0x00F0
 #define  SSB_SPROM8_RSSISMC5G_SHIFT     4
@@ -373,47 +374,47 @@
 #define  SSB_SPROM8_RSSISAV5G_SHIFT     8
 #define  SSB_SPROM8_BXA5G               0x1800
 #define  SSB_SPROM8_BXA5G_SHIFT         11
-#define SSB_SPROM8_TRI25G               0x10A8  /* TX isolation 2.4&5.3GHz */
+#define SSB_SPROM8_TRI25G               0x00A8  /* TX isolation 2.4&5.3GHz */
 #define  SSB_SPROM8_TRI2G               0x00FF  /* TX isolation 2.4GHz */
 #define  SSB_SPROM8_TRI5G               0xFF00  /* TX isolation 5.3GHz */
 #define  SSB_SPROM8_TRI5G_SHIFT         8
-#define SSB_SPROM8_TRI5GHL              0x10AA  /* TX isolation 5.2/5.8GHz */
+#define SSB_SPROM8_TRI5GHL              0x00AA  /* TX isolation 5.2/5.8GHz */
 #define  SSB_SPROM8_TRI5GL              0x00FF  /* TX isolation 5.2GHz */
 #define  SSB_SPROM8_TRI5GH              0xFF00  /* TX isolation 5.8GHz */
 #define  SSB_SPROM8_TRI5GH_SHIFT        8
-#define SSB_SPROM8_RXPO                 0x10AC  /* RX power offsets */
+#define SSB_SPROM8_RXPO                 0x00AC  /* RX power offsets */
 #define  SSB_SPROM8_RXPO2G              0x00FF  /* 2GHz RX power offset */
 #define  SSB_SPROM8_RXPO5G              0xFF00  /* 5GHz RX power offset */
 #define  SSB_SPROM8_RXPO5G_SHIFT        8
-#define SSB_SPROM8_MAXP_BG              0x10C0  /* Max Power 2GHz in path 1 */
+#define SSB_SPROM8_MAXP_BG              0x00C0  /* Max Power 2GHz in path 1 */
 #define  SSB_SPROM8_MAXP_BG_MASK        0x00FF  /* Mask for Max Power 2GHz */
 #define  SSB_SPROM8_ITSSI_BG            0xFF00  /* Mask for path 1 itssi_bg */
 #define  SSB_SPROM8_ITSSI_BG_SHIFT      8
-#define SSB_SPROM8_PA0B0                0x10C2  /* 2GHz power amp settings */
-#define SSB_SPROM8_PA0B1                0x10C4
-#define SSB_SPROM8_PA0B2                0x10C6
-#define SSB_SPROM8_MAXP_A               0x10C8  /* Max Power 5.3GHz */
+#define SSB_SPROM8_PA0B0                0x00C2  /* 2GHz power amp settings */
+#define SSB_SPROM8_PA0B1                0x00C4
+#define SSB_SPROM8_PA0B2                0x00C6
+#define SSB_SPROM8_MAXP_A               0x00C8  /* Max Power 5.3GHz */
 #define  SSB_SPROM8_MAXP_A_MASK         0x00FF  /* Mask for Max Power 5.3GHz */
 #define  SSB_SPROM8_ITSSI_A             0xFF00  /* Mask for path 1 itssi_a */
 #define  SSB_SPROM8_ITSSI_A_SHIFT       8
-#define SSB_SPROM8_MAXP_AHL             0x10CA  /* Max Power 5.2/5.8GHz */
+#define SSB_SPROM8_MAXP_AHL             0x00CA  /* Max Power 5.2/5.8GHz */
 #define  SSB_SPROM8_MAXP_AH_MASK        0x00FF  /* Mask for Max Power 5.8GHz */
 #define  SSB_SPROM8_MAXP_AL_MASK        0xFF00  /* Mask for Max Power 5.2GHz */
 #define  SSB_SPROM8_MAXP_AL_SHIFT       8
-#define SSB_SPROM8_PA1B0                0x10CC  /* 5.3GHz power amp settings */
-#define SSB_SPROM8_PA1B1                0x10CE
-#define SSB_SPROM8_PA1B2                0x10D0
-#define SSB_SPROM8_PA1LOB0              0x10D2  /* 5.2GHz power amp settings */
-#define SSB_SPROM8_PA1LOB1              0x10D4
-#define SSB_SPROM8_PA1LOB2              0x10D6
-#define SSB_SPROM8_PA1HIB0              0x10D8  /* 5.8GHz power amp settings */
-#define SSB_SPROM8_PA1HIB1              0x10DA
-#define SSB_SPROM8_PA1HIB2              0x10DC
-#define SSB_SPROM8_CCK2GPO              0x1140  /* CCK power offset */
-#define SSB_SPROM8_OFDM2GPO             0x1142  /* 2.4GHz OFDM power offset */
-#define SSB_SPROM8_OFDM5GPO             0x1146  /* 5.3GHz OFDM power offset */
-#define SSB_SPROM8_OFDM5GLPO            0x114A  /* 5.2GHz OFDM power offset */
-#define SSB_SPROM8_OFDM5GHPO            0x114E  /* 5.8GHz OFDM power offset */
+#define SSB_SPROM8_PA1B0                0x00CC  /* 5.3GHz power amp settings */
+#define SSB_SPROM8_PA1B1                0x00CE
+#define SSB_SPROM8_PA1B2                0x00D0
+#define SSB_SPROM8_PA1LOB0              0x00D2  /* 5.2GHz power amp settings */
+#define SSB_SPROM8_PA1LOB1              0x00D4
+#define SSB_SPROM8_PA1LOB2              0x00D6
+#define SSB_SPROM8_PA1HIB0              0x00D8  /* 5.8GHz power amp settings */
+#define SSB_SPROM8_PA1HIB1              0x00DA
+#define SSB_SPROM8_PA1HIB2              0x00DC
+#define SSB_SPROM8_CCK2GPO              0x0140  /* CCK power offset */
+#define SSB_SPROM8_OFDM2GPO             0x0142  /* 2.4GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GPO             0x0146  /* 5.3GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GLPO            0x014A  /* 5.2GHz OFDM power offset */
+#define SSB_SPROM8_OFDM5GHPO            0x014E  /* 5.8GHz OFDM power offset */
 
 /* Values for SSB_SPROM1_BINF_CCODE */
 enum {
diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index 1614d78c60ed..20725e213aee 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
@@ -30,7 +30,7 @@ struct unix_skb_parms {
 #endif
 };
 
-#define UNIXCB(skb)     (*(struct unix_skb_parms*)&((skb)->cb))
+#define UNIXCB(skb)     (*(struct unix_skb_parms *)&((skb)->cb))
 #define UNIXCREDS(skb)  (&UNIXCB((skb)).creds)
 #define UNIXSID(skb)    (&UNIXCB((skb)).secid)
 
@@ -45,21 +45,23 @@ struct unix_skb_parms {
 struct unix_sock {
         /* WARNING: sk has to be the first member */
         struct sock             sk;
-        struct unix_address     *addr;
-        struct dentry           *dentry;
-        struct vfsmount         *mnt;
+        struct unix_address     *addr;
+        struct dentry           *dentry;
+        struct vfsmount         *mnt;
         struct mutex            readlock;
-        struct sock             *peer;
-        struct sock             *other;
+        struct sock             *peer;
+        struct sock             *other;
         struct list_head        link;
-        atomic_long_t           inflight;
-        spinlock_t              lock;
+        atomic_long_t           inflight;
+        spinlock_t              lock;
         unsigned int            gc_candidate : 1;
         unsigned int            gc_maybe_cycle : 1;
-        wait_queue_head_t       peer_wait;
+        struct socket_wq        peer_wq;
 };
 #define unix_sk(__sk) ((struct unix_sock *)__sk)
 
+#define peer_wait peer_wq.wait
+
 #ifdef CONFIG_SYSCTL
 extern int unix_sysctl_register(struct net *net);
 extern void unix_sysctl_unregister(struct net *net);
diff --git a/include/net/caif/caif_dev.h b/include/net/caif/caif_dev.h
index 42a7c7867849..318ab9478a44 100644
--- a/include/net/caif/caif_dev.h
+++ b/include/net/caif/caif_dev.h
@@ -23,17 +23,19 @@ struct caif_param {
 };
 
 /**
- * caif_connect_request - Request data for CAIF channel setup.
+ * struct caif_connect_request - Request data for CAIF channel setup.
+ * @protocol:           Type of CAIF protocol to use (at, datagram etc)
  * @sockaddr:           Socket address to connect.
  * @priority:           Priority of the connection.
  * @link_selector:      Link selector (high bandwidth or low latency)
  * @link_name:          Name of the CAIF Link Layer to use.
+ * @param:              Connect Request parameters (CAIF_SO_REQ_PARAM).
  *
  * This struct is used when connecting a CAIF channel.
  * It contains all CAIF channel configuration options.
  */
 struct caif_connect_request {
-        int protocol;
+        enum caif_protocol_type protocol;
         struct sockaddr_caif sockaddr;
         enum caif_channel_priority priority;
         enum caif_link_selector link_selector;
@@ -68,6 +70,17 @@ int caif_connect_client(struct caif_connect_request *config,
 int caif_disconnect_client(struct cflayer *client_layer);
 
 /**
+ * caif_release_client - Release adaptation layer reference to client.
+ *
+ * @client_layer: Client layer.
+ *
+ * Releases a client/adaptation layer use of the caif stack.
+ * This function must be used after caif_disconnect_client to
+ * decrease the reference count of the service layer.
+ */
+void caif_release_client(struct cflayer *client_layer);
+
+/**
  * connect_req_to_link_param - Translate configuration parameters
  *                              from socket format to internal format.
  * @cnfg:       Pointer to configuration handler
diff --git a/include/net/caif/cfcnfg.h b/include/net/caif/cfcnfg.h
index 366082c5d435..9fc2fc20b884 100644
--- a/include/net/caif/cfcnfg.h
+++ b/include/net/caif/cfcnfg.h
@@ -87,13 +87,21 @@ cfcnfg_add_phy_layer(struct cfcnfg *cnfg, enum cfcnfg_phy_type phy_type,
 int cfcnfg_del_phy_layer(struct cfcnfg *cnfg, struct cflayer *phy_layer);
 
 /**
- * cfcnfg_del_adapt_layer - Deletes an adaptation layer from the CAIF stack.
+ * cfcnfg_disconn_adapt_layer - Disconnects an adaptation layer.
  *
  * @cnfg:       Pointer to a CAIF configuration object, created by
  *              cfcnfg_create().
  * @adap_layer: Adaptation layer to be removed.
  */
-int cfcnfg_del_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer);
+int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg,
+                        struct cflayer *adap_layer);
+
+/**
+ * cfcnfg_release_adap_layer - Used by client to release the adaptation layer.
+ *
+ * @adap_layer: Adaptation layer.
+ */
+void cfcnfg_release_adap_layer(struct cflayer *adap_layer);
 
 /**
  * cfcnfg_add_adaptation_layer - Add an adaptation layer to the CAIF stack.
@@ -102,14 +110,13 @@ int cfcnfg_del_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer);
  * driver functionality is implemented.
  *
  * @cnfg:               Pointer to a CAIF configuration object, created by
- *                              cfcnfg_create().
+ *                      cfcnfg_create().
  * @param:              Link setup parameters.
  * @adap_layer:         Specify the adaptation layer; the receive and
  *                      flow-control functions MUST be set in the structure.
  *
  */
-int
-cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
+int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
                             struct cfctrl_link_param *param,
                             struct cflayer *adap_layer);
 
diff --git a/include/net/caif/cfctrl.h b/include/net/caif/cfctrl.h
index dee25b86caa0..997603f2bf4c 100644
--- a/include/net/caif/cfctrl.h
+++ b/include/net/caif/cfctrl.h
@@ -43,8 +43,7 @@ struct cfctrl_rsp {
         void (*linksetup_rsp)(struct cflayer *layer, u8 linkid,
                               enum cfctrl_srv serv, u8 phyid,
                               struct cflayer *adapt_layer);
-        void (*linkdestroy_rsp)(struct cflayer *layer, u8 linkid,
-                                struct cflayer *client_layer);
+        void (*linkdestroy_rsp)(struct cflayer *layer, u8 linkid);
         void (*linkerror_ind)(void);
         void (*enum_rsp)(void);
         void (*sleep_rsp)(void);
@@ -117,7 +116,7 @@ struct cfctrl {
 };
 
 void cfctrl_enum_req(struct cflayer *cfctrl, u8 physlinkid);
-void cfctrl_linkup_request(struct cflayer *cfctrl,
+int cfctrl_linkup_request(struct cflayer *cfctrl,
                            struct cfctrl_link_param *param,
                            struct cflayer *user_layer);
 int  cfctrl_linkdown_req(struct cflayer *cfctrl, u8 linkid,
@@ -135,4 +134,6 @@ void cfctrl_insert_req(struct cfctrl *ctrl,
                               struct cfctrl_request_info *req);
 struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
                                               struct cfctrl_request_info *req);
+void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer);
+
 #endif                          /* CFCTRL_H_ */
diff --git a/include/net/caif/cfsrvl.h b/include/net/caif/cfsrvl.h
index b2a12db20cd2..2dc9eb193ecf 100644
--- a/include/net/caif/cfsrvl.h
+++ b/include/net/caif/cfsrvl.h
@@ -9,14 +9,18 @@
 #include <linux/list.h>
 #include <linux/stddef.h>
 #include <linux/types.h>
+#include <linux/kref.h>
+
 struct cfsrvl {
         struct cflayer layer;
         bool open;
         bool phy_flow_on;
         bool modem_flow_on;
         struct dev_info dev_info;
+        struct kref ref;
 };
 
+void cfsrvl_release(struct kref *kref);
 struct cflayer *cfvei_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfdgml_create(u8 linkid, struct dev_info *dev_info);
 struct cflayer *cfutill_create(u8 linkid, struct dev_info *dev_info);
@@ -31,4 +35,22 @@ void cfsrvl_init(struct cfsrvl *service,
 bool cfsrvl_ready(struct cfsrvl *service, int *err);
 u8 cfsrvl_getphyid(struct cflayer *layer);
 
+static inline void cfsrvl_get(struct cflayer *layr)
+{
+        struct cfsrvl *s;
+        if (layr == NULL)
+                return;
+        s = container_of(layr, struct cfsrvl, layer);
+        kref_get(&s->ref);
+}
+
+static inline void cfsrvl_put(struct cflayer *layr)
+{
+        struct cfsrvl *s;
+        if (layr == NULL)
+                return;
+        s = container_of(layr, struct cfsrvl, layer);
+        kref_put(&s->ref, cfsrvl_release);
+}
+
 #endif                          /* CFSRVL_H_ */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 37cebd3aa0f7..7d10c0182f53 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -511,6 +511,7 @@ struct mpath_info {
  * @basic_rates: basic rates in IEEE 802.11 format
  *      (or NULL for no change)
  * @basic_rates_len: number of basic rates
+ * @ap_isolate: do not forward packets between connected stations
  */
 struct bss_parameters {
         int use_cts_prot;
@@ -518,6 +519,7 @@ struct bss_parameters {
         int use_short_slot_time;
         u8 *basic_rates;
         u8 basic_rates_len;
+        int ap_isolate;
 };
 
 struct mesh_config {
@@ -1018,6 +1020,8 @@ struct cfg80211_pmksa {
  *      RSN IE. It allows for faster roaming between WPA2 BSSIDs.
  * @del_pmksa: Delete a cached PMKID.
  * @flush_pmksa: Flush all cached PMKIDs.
+ * @set_power_mgmt: Configure WLAN power management. A timeout value of -1
+ *      allows the driver to adjust the dynamic ps timeout value.
  * @set_cqm_rssi_config: Configure connection quality monitor RSSI threshold.
  *
  */
@@ -1643,7 +1647,7 @@ struct ieee80211_radiotap_iterator {
         const struct ieee80211_radiotap_namespace *current_namespace;
 
         unsigned char *_arg, *_next_ns_data;
-        uint32_t *_next_bitmap;
+        __le32 *_next_bitmap;
 
         unsigned char *this_arg;
         int this_arg_index;
diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h
index 52bd9e6c9141..e8923bc20f9f 100644
--- a/include/net/fib_rules.h
+++ b/include/net/fib_rules.h
@@ -104,7 +104,7 @@ static inline u32 frh_get_table(struct fib_rule_hdr *frh, struct nlattr **nla)
         return frh->table;
 }
 
-extern struct fib_rules_ops *fib_rules_register(struct fib_rules_ops *, struct net *);
+extern struct fib_rules_ops *fib_rules_register(const struct fib_rules_ops *, struct net *);
 extern void fib_rules_unregister(struct fib_rules_ops *);
 extern void                     fib_rules_cleanup_ops(struct fib_rules_ops *);
 
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index b487bc1b99ab..1653de515cee 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -102,7 +102,6 @@ struct rtable;
  * @uc_ttl - Unicast TTL
  * @inet_sport - Source port
  * @inet_id - ID counter for DF pkts
- * @rxhash - flow hash received from netif layer
  * @tos - TOS
  * @mc_ttl - Multicasting TTL
  * @is_icsk - is this an inet_connection_sock?
@@ -126,9 +125,6 @@ struct inet_sock {
         __u16                   cmsg_flags;
         __be16                  inet_sport;
         __u16                   inet_id;
-#ifdef CONFIG_RPS
-        __u32                   rxhash;
-#endif
 
         struct ip_options       *opt;
         __u8                    tos;
@@ -224,37 +220,4 @@ static inline __u8 inet_sk_flowi_flags(const struct sock *sk)
         return inet_sk(sk)->transparent ? FLOWI_FLAG_ANYSRC : 0;
 }
 
-static inline void inet_rps_record_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_record_sock_flow(sock_flow_table, inet_sk(sk)->rxhash);
-        rcu_read_unlock();
-#endif
-}
-
-static inline void inet_rps_reset_flow(const struct sock *sk)
-{
-#ifdef CONFIG_RPS
-        struct rps_sock_flow_table *sock_flow_table;
-
-        rcu_read_lock();
-        sock_flow_table = rcu_dereference(rps_sock_flow_table);
-        rps_reset_sock_flow(sock_flow_table, inet_sk(sk)->rxhash);
-        rcu_read_unlock();
-#endif
-}
-
-static inline void inet_rps_save_rxhash(const struct sock *sk, u32 rxhash)
-{
-#ifdef CONFIG_RPS
-        if (unlikely(inet_sk(sk)->rxhash != rxhash)) {
-                inet_rps_reset_flow(sk);
-                inet_sk(sk)->rxhash = rxhash;
-        }
-#endif
-}
 #endif  /* _INET_SOCK_H */
diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h
index 79f67eae8a7e..a066fdd50da6 100644
--- a/include/net/inet_timewait_sock.h
+++ b/include/net/inet_timewait_sock.h
@@ -224,7 +224,9 @@ static inline
 struct net *twsk_net(const struct inet_timewait_sock *twsk)
 {
 #ifdef CONFIG_NET_NS
-        return rcu_dereference(twsk->tw_net);
+        return rcu_dereference_raw(twsk->tw_net); /* protected by locking, */
+                                                  /* reference counting, */
+                                                  /* initialization, or RCU. */
 #else
         return &init_net;
 #endif
diff --git a/include/net/ip.h b/include/net/ip.h
index a84ceb692687..8149b77cea9b 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -393,6 +393,7 @@ extern int ip_options_rcv_srr(struct sk_buff *skb);
  *      Functions provided by ip_sockglue.c
  */
 
+extern int      ip_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 extern void     ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb);
 extern int      ip_cmsg_send(struct net *net,
                              struct msghdr *msg, struct ipcm_cookie *ipc);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index b1d8db90b214..eba5cc00325a 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -503,7 +503,8 @@ extern int			ip6_append_data(struct sock *sk,
                                                 struct ipv6_txoptions *opt,
                                                 struct flowi *fl,
                                                 struct rt6_info *rt,
-                                                unsigned int flags);
+                                                unsigned int flags,
+                                                int dontfrag);
 
 extern int                      ip6_push_pending_frames(struct sock *sk);
 
@@ -577,9 +578,11 @@ extern int			ip6_datagram_connect(struct sock *sk,
                                                      struct sockaddr *addr, int addr_len);
 
 extern int                      ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len);
+extern int                      ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len);
 extern void                     ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err, __be16 port,
                                                 u32 info, u8 *payload);
 extern void                     ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info);
+extern void                     ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu);
 
 extern int inet6_release(struct socket *sock);
 extern int inet6_bind(struct socket *sock, struct sockaddr *uaddr, 
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 344e5bf72062..54aa16b98b76 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -145,6 +145,7 @@ struct ieee80211_low_level_stats {
  * @BSS_CHANGED_BEACON_ENABLED: Beaconing should be
  *      enabled/disabled (beaconing modes)
  * @BSS_CHANGED_CQM: Connection quality monitor config changed
+ * @BSS_CHANGED_IBSS: IBSS join status changed
  */
 enum ieee80211_bss_change {
         BSS_CHANGED_ASSOC               = 1<<0,
@@ -158,6 +159,7 @@ enum ieee80211_bss_change {
         BSS_CHANGED_BEACON              = 1<<8,
         BSS_CHANGED_BEACON_ENABLED      = 1<<9,
         BSS_CHANGED_CQM                 = 1<<10,
+        BSS_CHANGED_IBSS                = 1<<11,
 };
 
 /**
@@ -167,6 +169,8 @@ enum ieee80211_bss_change {
  * to that BSS) that can change during the lifetime of the BSS.
  *
  * @assoc: association status
+ * @ibss_joined: indicates whether this station is part of an IBSS
+ *      or not
  * @aid: association ID number, valid only when @assoc is true
  * @use_cts_prot: use CTS protection
  * @use_short_preamble: use 802.11b short preamble;
@@ -194,7 +198,7 @@ enum ieee80211_bss_change {
 struct ieee80211_bss_conf {
         const u8 *bssid;
         /* association related data */
-        bool assoc;
+        bool assoc, ibss_joined;
         u16 aid;
         /* erp related data */
         bool use_cts_prot;
@@ -274,6 +278,9 @@ struct ieee80211_bss_conf {
  * @IEEE80211_TX_INTFL_NL80211_FRAME_TX: Frame was requested through nl80211
  *      MLME command (internal to mac80211 to figure out whether to send TX
  *      status to user space)
+ * @IEEE80211_TX_CTL_LDPC: tells the driver to use LDPC for this frame
+ * @IEEE80211_TX_CTL_STBC: Enables Space-Time Block Coding (STBC) for this
+ *      frame and selects the maximum number of streams that it can use.
  */
 enum mac80211_tx_control_flags {
         IEEE80211_TX_CTL_REQ_TX_STATUS          = BIT(0),
@@ -297,6 +304,9 @@ enum mac80211_tx_control_flags {
         IEEE80211_TX_INTFL_RETRANSMISSION       = BIT(19),
         IEEE80211_TX_INTFL_HAS_RADIOTAP         = BIT(20),
         IEEE80211_TX_INTFL_NL80211_FRAME_TX     = BIT(21),
+        IEEE80211_TX_CTL_LDPC                   = BIT(22),
+        IEEE80211_TX_CTL_STBC                   = BIT(23) | BIT(24),
+#define IEEE80211_TX_CTL_STBC_SHIFT             23
 };
 
 /**
@@ -395,11 +405,11 @@ struct ieee80211_tx_rate {
  * @status: union for status data
  * @driver_data: array of driver_data pointers
  * @ampdu_ack_len: number of acked aggregated frames.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ampdu_ack_map: block ack bit map for the aggregation.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ampdu_len: number of aggregated frames.
- *      relevant only if IEEE80211_TX_STATUS_AMPDU was set.
+ *      relevant only if IEEE80211_TX_STAT_AMPDU was set.
  * @ack_signal: signal strength of the ACK frame
  */
 struct ieee80211_tx_info {
@@ -550,7 +560,6 @@ enum mac80211_rx_flags {
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *      unspecified depending on the hardware capabilities flags
  *      @IEEE80211_HW_SIGNAL_*
- * @noise: noise when receiving this frame, in dBm (DEPRECATED).
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT rates are use (RX_FLAG_HT)
@@ -561,7 +570,6 @@ struct ieee80211_rx_status {
         enum ieee80211_band band;
         int freq;
         int signal;
-        int noise __deprecated;
         int antenna;
         int rate_idx;
         int flag;
@@ -610,6 +618,7 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_RETRY_LIMITS: retry limits changed
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  * @IEEE80211_CONF_CHANGE_SMPS: Spatial multiplexing powersave mode changed
+ * @IEEE80211_CONF_CHANGE_QOS: Quality of service was enabled or disabled
  */
 enum ieee80211_conf_changed {
         IEEE80211_CONF_CHANGE_SMPS              = BIT(1),
@@ -661,6 +670,9 @@ enum ieee80211_smps_mode {
  * @dynamic_ps_timeout: The dynamic powersave timeout (in ms), see the
  *      powersave documentation below. This variable is valid only when
  *      the CONF_PS flag is set.
+ * @dynamic_ps_forced_timeout: The dynamic powersave timeout (in ms) configured
+ *      by cfg80211 (essentially, wext) If set, this value overrules the value
+ *      chosen by mac80211 based on ps qos network latency.
  *
  * @power_level: requested transmit power (in dBm)
  *
@@ -680,7 +692,7 @@ enum ieee80211_smps_mode {
  */
 struct ieee80211_conf {
         u32 flags;
-        int power_level, dynamic_ps_timeout;
+        int power_level, dynamic_ps_timeout, dynamic_ps_forced_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
@@ -791,6 +803,7 @@ struct ieee80211_key_conf {
         u8 iv_len;
         u8 hw_key_idx;
         u8 flags;
+        u8 *ap_addr;
         s8 keyidx;
         u8 keylen;
         u8 key[0];
@@ -919,10 +932,6 @@ enum ieee80211_tkip_key_type {
  *      one milliwatt. This is the preferred method since it is standardized
  *      between different devices. @max_signal does not need to be set.
  *
- * @IEEE80211_HW_NOISE_DBM:
- *      Hardware can provide noise (radio interference) values in units dBm,
- *      decibel difference from one milliwatt.
- *
  * @IEEE80211_HW_SPECTRUM_MGMT:
  *      Hardware supports spectrum management defined in 802.11h
  *      Measurement, Channel Switch, Quieting, TPC
@@ -986,7 +995,7 @@ enum ieee80211_hw_flags {
         IEEE80211_HW_2GHZ_SHORT_PREAMBLE_INCAPABLE      = 1<<4,
         IEEE80211_HW_SIGNAL_UNSPEC                      = 1<<5,
         IEEE80211_HW_SIGNAL_DBM                         = 1<<6,
-        IEEE80211_HW_NOISE_DBM                          = 1<<7,
+        /* use this hole */
         IEEE80211_HW_SPECTRUM_MGMT                      = 1<<8,
         IEEE80211_HW_AMPDU_AGGREGATION                  = 1<<9,
         IEEE80211_HW_SUPPORTS_PS                        = 1<<10,
@@ -1646,7 +1655,7 @@ struct ieee80211_ops {
                                 struct ieee80211_key_conf *conf,
                                 struct ieee80211_sta *sta,
                                 u32 iv32, u16 *phase1key);
-        int (*hw_scan)(struct ieee80211_hw *hw,
+        int (*hw_scan)(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
                        struct cfg80211_scan_request *req);
         void (*sw_scan_start)(struct ieee80211_hw *hw);
         void (*sw_scan_complete)(struct ieee80211_hw *hw);
@@ -1671,7 +1680,8 @@ struct ieee80211_ops {
                             struct ieee80211_vif *vif,
                             enum ieee80211_ampdu_mlme_action action,
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
-
+        int (*get_survey)(struct ieee80211_hw *hw, int idx,
+                struct survey_info *survey);
         void (*rfkill_poll)(struct ieee80211_hw *hw);
         void (*set_coverage_class)(struct ieee80211_hw *hw, u8 coverage_class);
 #ifdef CONFIG_NL80211_TESTMODE
diff --git a/include/net/mld.h b/include/net/mld.h
new file mode 100644
index 000000000000..467143cd4e2f
--- /dev/null
+++ b/include/net/mld.h
@@ -0,0 +1,75 @@
+#ifndef LINUX_MLD_H
+#define LINUX_MLD_H
+
+#include <linux/in6.h>
+#include <linux/icmpv6.h>
+
+/* MLDv1 Query/Report/Done */
+struct mld_msg {
+        struct icmp6hdr         mld_hdr;
+        struct in6_addr         mld_mca;
+};
+
+#define mld_type                mld_hdr.icmp6_type
+#define mld_code                mld_hdr.icmp6_code
+#define mld_cksum               mld_hdr.icmp6_cksum
+#define mld_maxdelay            mld_hdr.icmp6_maxdelay
+#define mld_reserved            mld_hdr.icmp6_dataun.un_data16[1]
+
+/* Multicast Listener Discovery version 2 headers */
+/* MLDv2 Report */
+struct mld2_grec {
+        __u8            grec_type;
+        __u8            grec_auxwords;
+        __be16          grec_nsrcs;
+        struct in6_addr grec_mca;
+        struct in6_addr grec_src[0];
+};
+
+struct mld2_report {
+        struct icmp6hdr         mld2r_hdr;
+        struct mld2_grec        mld2r_grec[0];
+};
+
+#define mld2r_type              mld2r_hdr.icmp6_type
+#define mld2r_resv1             mld2r_hdr.icmp6_code
+#define mld2r_cksum             mld2r_hdr.icmp6_cksum
+#define mld2r_resv2             mld2r_hdr.icmp6_dataun.un_data16[0]
+#define mld2r_ngrec             mld2r_hdr.icmp6_dataun.un_data16[1]
+
+/* MLDv2 Query */
+struct mld2_query {
+        struct icmp6hdr         mld2q_hdr;
+        struct in6_addr         mld2q_mca;
+#if defined(__LITTLE_ENDIAN_BITFIELD)
+        __u8                    mld2q_qrv:3,
+                                mld2q_suppress:1,
+                                mld2q_resv2:4;
+#elif defined(__BIG_ENDIAN_BITFIELD)
+        __u8                    mld2q_resv2:4,
+                                mld2q_suppress:1,
+                                mld2q_qrv:3;
+#else
+#error "Please fix <asm/byteorder.h>"
+#endif
+        __u8                    mld2q_qqic;
+        __be16                  mld2q_nsrcs;
+        struct in6_addr         mld2q_srcs[0];
+};
+
+#define mld2q_type              mld2q_hdr.icmp6_type
+#define mld2q_code              mld2q_hdr.icmp6_code
+#define mld2q_cksum             mld2q_hdr.icmp6_cksum
+#define mld2q_mrc               mld2q_hdr.icmp6_maxdelay
+#define mld2q_resv1             mld2q_hdr.icmp6_dataun.un_data16[1]
+
+/* Max Response Code */
+#define MLDV2_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
+#define MLDV2_EXP(thresh, nbmant, nbexp, value) \
+        ((value) < (thresh) ? (value) : \
+        ((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
+        (MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
+
+#define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
+
+#endif
diff --git a/include/net/netns/generic.h b/include/net/netns/generic.h
index ff4982ab84b6..81a31c0db3e7 100644
--- a/include/net/netns/generic.h
+++ b/include/net/netns/generic.h
@@ -14,11 +14,8 @@
  * The rules are simple:
  * 1. set pernet_operations->id.  After register_pernet_device you
  *    will have the id of your private pointer.
- * 2. Either set pernet_operations->size (to have the code allocate and
- *    free a private structure pointed to from struct net ) or 
- *    call net_assign_generic() to put the private data on the struct
- *    net (most preferably this should be done in the ->init callback
- *    of the ops registered);
+ * 2. set pernet_operations->size to have the code allocate and free
+ *    a private structure pointed to from struct net.
  * 3. do not change this pointer while the net is alive;
  * 4. do not try to have any private reference on the net_generic object.
  *
@@ -46,6 +43,4 @@ static inline void *net_generic(struct net *net, int id)
 
         return ptr;
 }
-
-extern int net_assign_generic(struct net *net, int id, void *data);
 #endif
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index ae07feec6446..d68c3f121774 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -55,7 +55,6 @@ struct netns_ipv4 {
         int sysctl_rt_cache_rebuild_count;
         int current_rt_cache_rebuild_count;
 
-        struct timer_list rt_secret_timer;
         atomic_t rt_genid;
 
 #ifdef CONFIG_IP_MROUTE
diff --git a/include/net/sctp/command.h b/include/net/sctp/command.h
index 8be5135ff7aa..2c55a7ea20af 100644
--- a/include/net/sctp/command.h
+++ b/include/net/sctp/command.h
@@ -107,6 +107,7 @@ typedef enum {
         SCTP_CMD_T1_RETRAN,      /* Mark for retransmission after T1 timeout  */
         SCTP_CMD_UPDATE_INITTAG, /* Update peer inittag */
         SCTP_CMD_SEND_MSG,       /* Send the whole use message */
+        SCTP_CMD_SEND_NEXT_ASCONF, /* Send the next ASCONF after ACK */
         SCTP_CMD_LAST
 } sctp_verb_t;
 
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 59151557406c..65946bc43d00 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -128,6 +128,7 @@ extern int sctp_register_pf(struct sctp_pf *, sa_family_t);
 int sctp_backlog_rcv(struct sock *sk, struct sk_buff *skb);
 int sctp_inet_listen(struct socket *sock, int backlog);
 void sctp_write_space(struct sock *sk);
+void sctp_data_ready(struct sock *sk, int len);
 unsigned int sctp_poll(struct file *file, struct socket *sock,
                 poll_table *wait);
 void sctp_sock_rfree(struct sk_buff *skb);
@@ -546,7 +547,7 @@ for (pos = chunk->subh.fwdtsn_hdr->skip;\
 #define WORD_ROUND(s) (((s)+3)&~3)
 
 /* Make a new instance of type.  */
-#define t_new(type, flags)      (type *)kmalloc(sizeof(type), flags)
+#define t_new(type, flags)      (type *)kzalloc(sizeof(type), flags)
 
 /* Compare two timevals.  */
 #define tv_lt(s, t) \
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 851c813adb3a..273a8bb683e3 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -437,7 +437,7 @@ sctp_vtag_verify_either(const struct sctp_chunk *chunk,
          */
         if ((!sctp_test_T_bit(chunk) &&
              (ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag)) ||
-            (sctp_test_T_bit(chunk) &&
+            (sctp_test_T_bit(chunk) && asoc->c.peer_vtag &&
              (ntohl(chunk->sctp_hdr->vtag) == asoc->c.peer_vtag))) {
                 return 1;
         }
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index ff3017744711..43257b903c82 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -643,17 +643,15 @@ struct sctp_pf {
 struct sctp_datamsg {
         /* Chunks waiting to be submitted to lower layer. */
         struct list_head chunks;
-        /* Chunks that have been transmitted. */
-        size_t msg_size;
         /* Reference counting. */
         atomic_t refcnt;
         /* When is this message no longer interesting to the peer? */
         unsigned long expires_at;
         /* Did the messenge fail to send? */
         int send_error;
-        char send_failed;
-        /* Control whether chunks from this message can be abandoned. */
-        char can_abandon;
+        u8 send_failed:1,
+           can_abandon:1,   /* can chunks from this message can be abandoned. */
+           can_delay;       /* should this message be Nagle delayed */
 };
 
 struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *,
@@ -757,7 +755,6 @@ struct sctp_chunk {
 #define SCTP_NEED_FRTX 0x1
 #define SCTP_DONT_FRTX 0x2
         __u16   rtt_in_progress:1,      /* This chunk used for RTT calc? */
-                resent:1,               /* Has this chunk ever been resent. */
                 has_tsn:1,              /* Does this chunk have a TSN yet? */
                 has_ssn:1,              /* Does this chunk have a SSN yet? */
                 singleton:1,            /* Only chunk in the packet? */
@@ -778,6 +775,7 @@ int sctp_user_addto_chunk(struct sctp_chunk *chunk, int off, int len,
                           struct iovec *data);
 void sctp_chunk_free(struct sctp_chunk *);
 void  *sctp_addto_chunk(struct sctp_chunk *, int len, const void *data);
+void  *sctp_addto_chunk_fixed(struct sctp_chunk *, int len, const void *data);
 struct sctp_chunk *sctp_chunkify(struct sk_buff *,
                                  const struct sctp_association *,
                                  struct sock *);
@@ -878,7 +876,30 @@ struct sctp_transport {
 
         /* Reference counting. */
         atomic_t refcnt;
-        int      dead;
+        int      dead:1,
+                /* RTO-Pending : A flag used to track if one of the DATA
+                 *              chunks sent to this address is currently being
+                 *              used to compute a RTT. If this flag is 0,
+                 *              the next DATA chunk sent to this destination
+                 *              should be used to compute a RTT and this flag
+                 *              should be set. Every time the RTT
+                 *              calculation completes (i.e. the DATA chunk
+                 *              is SACK'd) clear this flag.
+                 */
+                 rto_pending:1,
+
+                /*
+                 * hb_sent : a flag that signals that we have a pending
+                 * heartbeat.
+                 */
+                hb_sent:1,
+
+                /* Is the Path MTU update pending on this tranport */
+                pmtu_pending:1,
+
+                /* Is this structure kfree()able? */
+                malloced:1;
+
 
         /* This is the peer's IP address and port. */
         union sctp_addr ipaddr;
@@ -908,22 +929,6 @@ struct sctp_transport {
         /* SRTT        : The current smoothed round trip time.  */
         __u32 srtt;
 
-        /* RTO-Pending : A flag used to track if one of the DATA
-         *              chunks sent to this address is currently being
-         *              used to compute a RTT. If this flag is 0,
-         *              the next DATA chunk sent to this destination
-         *              should be used to compute a RTT and this flag
-         *              should be set. Every time the RTT
-         *              calculation completes (i.e. the DATA chunk
-         *              is SACK'd) clear this flag.
-         * hb_sent : a flag that signals that we have a pending heartbeat.
-         */
-        __u8 rto_pending;
-        __u8 hb_sent;
-
-        /* Flag to track the current fast recovery state */
-        __u8 fast_recovery;
-
         /*
          * These are the congestion stats.
          */
@@ -943,9 +948,6 @@ struct sctp_transport {
 
         __u32 burst_limited;    /* Holds old cwnd when max.burst is applied */
 
-        /* TSN marking the fast recovery exit point */
-        __u32 fast_recovery_exit;
-
         /* Destination */
         struct dst_entry *dst;
         /* Source address. */
@@ -976,9 +978,6 @@ struct sctp_transport {
          */
         __u16 pathmaxrxt;
 
-        /* is the Path MTU update pending on this tranport */
-        __u8 pmtu_pending;
-
         /* PMTU       : The current known path MTU.  */
         __u32 pathmtu;
 
@@ -1022,8 +1021,6 @@ struct sctp_transport {
         /* This is the list of transports that have chunks to send.  */
         struct list_head send_ready;
 
-        int malloced; /* Is this structure kfree()able? */
-
         /* State information saved for SFR_CACC algorithm. The key
          * idea in SFR_CACC is to maintain state at the sender on a
          * per-destination basis when a changeover happens.
@@ -1065,7 +1062,7 @@ void sctp_transport_route(struct sctp_transport *, union sctp_addr *,
                           struct sctp_sock *);
 void sctp_transport_pmtu(struct sctp_transport *);
 void sctp_transport_free(struct sctp_transport *);
-void sctp_transport_reset_timers(struct sctp_transport *, int);
+void sctp_transport_reset_timers(struct sctp_transport *);
 void sctp_transport_hold(struct sctp_transport *);
 void sctp_transport_put(struct sctp_transport *);
 void sctp_transport_update_rto(struct sctp_transport *, __u32);
@@ -1719,6 +1716,12 @@ struct sctp_association {
         /* Highest TSN that is acknowledged by incoming SACKs. */
         __u32 highest_sacked;
 
+        /* TSN marking the fast recovery exit point */
+        __u32 fast_recovery_exit;
+
+        /* Flag to track the current fast recovery state */
+        __u8 fast_recovery;
+
         /* The number of unacknowledged data chunks.  Reported through
          * the SCTP_STATUS sockopt.
          */
diff --git a/include/net/snmp.h b/include/net/snmp.h
index 884fdbb74b23..92456f1035f5 100644
--- a/include/net/snmp.h
+++ b/include/net/snmp.h
@@ -133,6 +133,8 @@ struct linux_xfrm_mib {
                         __this_cpu_add(mib[0]->mibs[field], addend)
 #define SNMP_ADD_STATS_USER(mib, field, addend) \
                         this_cpu_add(mib[1]->mibs[field], addend)
+#define SNMP_ADD_STATS(mib, field, addend)      \
+                        this_cpu_add(mib[0]->mibs[field], addend)
 /*
  * Use "__typeof__(*mib[0]) *ptr" instead of "__typeof__(mib[0]) ptr"
  * to make @ptr a non-percpu pointer.
diff --git a/include/net/sock.h b/include/net/sock.h
index 56df440a950b..328e03f47dd1 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -74,7 +74,7 @@
                                         printk(KERN_DEBUG msg); } while (0)
 #else
 /* Validate arguments and do nothing */
-static void inline int __attribute__ ((format (printf, 2, 3)))
+static inline void __attribute__ ((format (printf, 2, 3)))
 SOCK_DEBUG(struct sock *sk, const char *msg, ...)
 {
 }
@@ -159,7 +159,7 @@ struct sock_common {
   *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
   *     @sk_lock:       synchronizer
   *     @sk_rcvbuf: size of receive buffer in bytes
-  *     @sk_sleep: sock wait queue
+  *     @sk_wq: sock wait queue and async head
   *     @sk_dst_cache: destination cache
   *     @sk_dst_lock: destination cache lock
   *     @sk_policy: flow policy
@@ -198,6 +198,7 @@ struct sock_common {
   *     @sk_rcvlowat: %SO_RCVLOWAT setting
   *     @sk_rcvtimeo: %SO_RCVTIMEO setting
   *     @sk_sndtimeo: %SO_SNDTIMEO setting
+  *     @sk_rxhash: flow hash received from netif layer
   *     @sk_filter: socket filtering instructions
   *     @sk_protinfo: private area, net family specific, when not using slab
   *     @sk_timer: sock cleanup timer
@@ -255,9 +256,8 @@ struct sock {
                 struct sk_buff *head;
                 struct sk_buff *tail;
                 int len;
-                int limit;
         } sk_backlog;
-        wait_queue_head_t       *sk_sleep;
+        struct socket_wq        *sk_wq;
         struct dst_entry        *sk_dst_cache;
 #ifdef CONFIG_XFRM
         struct xfrm_policy      *sk_policy[2];
@@ -279,6 +279,9 @@ struct sock {
         int                     sk_gso_type;
         unsigned int            sk_gso_max_size;
         int                     sk_rcvlowat;
+#ifdef CONFIG_RPS
+        __u32                   sk_rxhash;
+#endif
         unsigned long           sk_flags;
         unsigned long           sk_lingertime;
         struct sk_buff_head     sk_error_queue;
@@ -604,10 +607,20 @@ static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
         skb->next = NULL;
 }
 
+/*
+ * Take into account size of receive queue and backlog queue
+ */
+static inline bool sk_rcvqueues_full(const struct sock *sk, const struct sk_buff *skb)
+{
+        unsigned int qsize = sk->sk_backlog.len + atomic_read(&sk->sk_rmem_alloc);
+
+        return qsize + skb->truesize > sk->sk_rcvbuf;
+}
+
 /* The per-socket spinlock must be held here. */
 static inline __must_check int sk_add_backlog(struct sock *sk, struct sk_buff *skb)
 {
-        if (sk->sk_backlog.len >= max(sk->sk_backlog.limit, sk->sk_rcvbuf << 1))
+        if (sk_rcvqueues_full(sk, skb))
                 return -ENOBUFS;
 
         __sk_add_backlog(sk, skb);
@@ -620,6 +633,40 @@ static inline int sk_backlog_rcv(struct sock *sk, struct sk_buff *skb)
         return sk->sk_backlog_rcv(sk, skb);
 }
 
+static inline void sock_rps_record_flow(const struct sock *sk)
+{
+#ifdef CONFIG_RPS
+        struct rps_sock_flow_table *sock_flow_table;
+
+        rcu_read_lock();
+        sock_flow_table = rcu_dereference(rps_sock_flow_table);
+        rps_record_sock_flow(sock_flow_table, sk->sk_rxhash);
+        rcu_read_unlock();
+#endif
+}
+
+static inline void sock_rps_reset_flow(const struct sock *sk)
+{
+#ifdef CONFIG_RPS
+        struct rps_sock_flow_table *sock_flow_table;
+
+        rcu_read_lock();
+        sock_flow_table = rcu_dereference(rps_sock_flow_table);
+        rps_reset_sock_flow(sock_flow_table, sk->sk_rxhash);
+        rcu_read_unlock();
+#endif
+}
+
+static inline void sock_rps_save_rxhash(struct sock *sk, u32 rxhash)
+{
+#ifdef CONFIG_RPS
+        if (unlikely(sk->sk_rxhash != rxhash)) {
+                sock_rps_reset_flow(sk);
+                sk->sk_rxhash = rxhash;
+        }
+#endif
+}
+
 #define sk_wait_event(__sk, __timeo, __condition)                       \
         ({      int __rc;                                               \
                 release_sock(__sk);                                     \
@@ -974,6 +1021,16 @@ extern void release_sock(struct sock *sk);
                                 SINGLE_DEPTH_NESTING)
 #define bh_unlock_sock(__sk)    spin_unlock(&((__sk)->sk_lock.slock))
 
+static inline void lock_sock_bh(struct sock *sk)
+{
+        spin_lock_bh(&sk->sk_lock.slock);
+}
+
+static inline void unlock_sock_bh(struct sock *sk)
+{
+        spin_unlock_bh(&sk->sk_lock.slock);
+}
+
 extern struct sock              *sk_alloc(struct net *net, int family,
                                           gfp_t priority,
                                           struct proto *prot);
@@ -1160,6 +1217,10 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
         sk->sk_socket = sock;
 }
 
+static inline wait_queue_head_t *sk_sleep(struct sock *sk)
+{
+        return &sk->sk_wq->wait;
+}
 /* Detach socket from process context.
  * Announce socket dead, detach it from wait queue and inode.
  * Note that parent inode held reference count on this struct sock,
@@ -1172,14 +1233,14 @@ static inline void sock_orphan(struct sock *sk)
         write_lock_bh(&sk->sk_callback_lock);
         sock_set_flag(sk, SOCK_DEAD);
         sk_set_socket(sk, NULL);
-        sk->sk_sleep  = NULL;
+        sk->sk_wq  = NULL;
         write_unlock_bh(&sk->sk_callback_lock);
 }
 
 static inline void sock_graft(struct sock *sk, struct socket *parent)
 {
         write_lock_bh(&sk->sk_callback_lock);
-        sk->sk_sleep = &parent->wait;
+        rcu_assign_pointer(sk->sk_wq, parent->wq);
         parent->sk = sk;
         sk_set_socket(sk, parent);
         security_sock_graft(sk, parent);
@@ -1193,7 +1254,8 @@ static inline struct dst_entry *
 __sk_dst_get(struct sock *sk)
 {
         return rcu_dereference_check(sk->sk_dst_cache, rcu_read_lock_held() ||
-                                                       sock_owned_by_user(sk));
+                                                       sock_owned_by_user(sk) ||
+                                                       lockdep_is_held(&sk->sk_lock.slock));
 }
 
 static inline struct dst_entry *
@@ -1231,8 +1293,11 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst)
         struct dst_entry *old_dst;
 
         sk_tx_queue_clear(sk);
-        old_dst = rcu_dereference_check(sk->sk_dst_cache,
-                                        lockdep_is_held(&sk->sk_dst_lock));
+        /*
+         * This can be called while sk is owned by the caller only,
+         * with no state that can be checked in a rcu_dereference_check() cond
+         */
+        old_dst = rcu_dereference_raw(sk->sk_dst_cache);
         rcu_assign_pointer(sk->sk_dst_cache, dst);
         dst_release(old_dst);
 }
@@ -1327,12 +1392,12 @@ static inline int sk_has_allocations(const struct sock *sk)
 }
 
 /**
- * sk_has_sleeper - check if there are any waiting processes
- * @sk: socket
+ * wq_has_sleeper - check if there are any waiting processes
+ * @sk: struct socket_wq
  *
- * Returns true if socket has waiting processes
+ * Returns true if socket_wq has waiting processes
  *
- * The purpose of the sk_has_sleeper and sock_poll_wait is to wrap the memory
+ * The purpose of the wq_has_sleeper and sock_poll_wait is to wrap the memory
  * barrier call. They were added due to the race found within the tcp code.
  *
  * Consider following tcp code paths:
@@ -1345,9 +1410,10 @@ static inline int sk_has_allocations(const struct sock *sk)
  *   ...                 ...
  *   tp->rcv_nxt check   sock_def_readable
  *   ...                 {
- *   schedule               ...
- *                          if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
- *                              wake_up_interruptible(sk->sk_sleep)
+ *   schedule               rcu_read_lock();
+ *                          wq = rcu_dereference(sk->sk_wq);
+ *                          if (wq && waitqueue_active(&wq->wait))
+ *                              wake_up_interruptible(&wq->wait)
  *                          ...
  *                       }
  *
@@ -1356,19 +1422,18 @@ static inline int sk_has_allocations(const struct sock *sk)
  * could then endup calling schedule and sleep forever if there are no more
  * data on the socket.
  *
- * The sk_has_sleeper is always called right after a call to read_lock, so we
- * can use smp_mb__after_lock barrier.
  */
-static inline int sk_has_sleeper(struct sock *sk)
+static inline bool wq_has_sleeper(struct socket_wq *wq)
 {
+
         /*
          * We need to be sure we are in sync with the
          * add_wait_queue modifications to the wait queue.
          *
          * This memory barrier is paired in the sock_poll_wait.
          */
-        smp_mb__after_lock();
-        return sk->sk_sleep && waitqueue_active(sk->sk_sleep);
+        smp_mb();
+        return wq && waitqueue_active(&wq->wait);
 }
 
 /**
@@ -1377,7 +1442,7 @@ static inline int sk_has_sleeper(struct sock *sk)
  * @wait_address:   socket wait queue
  * @p:              poll_table
  *
- * See the comments in the sk_has_sleeper function.
+ * See the comments in the wq_has_sleeper function.
  */
 static inline void sock_poll_wait(struct file *filp,
                 wait_queue_head_t *wait_address, poll_table *p)
@@ -1388,7 +1453,7 @@ static inline void sock_poll_wait(struct file *filp,
                  * We need to be sure we are in sync with the
                  * socket flags modification.
                  *
-                 * This memory barrier is paired in the sk_has_sleeper.
+                 * This memory barrier is paired in the wq_has_sleeper.
                 */
                 smp_mb();
         }
@@ -1570,7 +1635,24 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
                 sk->sk_stamp = kt;
 }
 
-extern void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk, struct sk_buff *skb);
+extern void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+                                     struct sk_buff *skb);
+
+static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+                                          struct sk_buff *skb)
+{
+#define FLAGS_TS_OR_DROPS ((1UL << SOCK_RXQ_OVFL)                       | \
+                           (1UL << SOCK_RCVTSTAMP)                      | \
+                           (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE)       | \
+                           (1UL << SOCK_TIMESTAMPING_SOFTWARE)          | \
+                           (1UL << SOCK_TIMESTAMPING_RAW_HARDWARE)      | \
+                           (1UL << SOCK_TIMESTAMPING_SYS_HARDWARE))
+
+        if (sk->sk_flags & FLAGS_TS_OR_DROPS)
+                __sock_recv_ts_and_drops(msg, sk, skb);
+        else
+                sk->sk_stamp = skb->tstamp;
+}
 
 /**
  * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 70c5159f4b36..fb5c66b2ab81 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -294,6 +294,7 @@ extern struct proto tcp_prot;
 #define TCP_INC_STATS_BH(net, field)    SNMP_INC_STATS_BH((net)->mib.tcp_statistics, field)
 #define TCP_DEC_STATS(net, field)       SNMP_DEC_STATS((net)->mib.tcp_statistics, field)
 #define TCP_ADD_STATS_USER(net, field, val) SNMP_ADD_STATS_USER((net)->mib.tcp_statistics, field, val)
+#define TCP_ADD_STATS(net, field, val)  SNMP_ADD_STATS((net)->mib.tcp_statistics, field, val)
 
 extern void                     tcp_v4_err(struct sk_buff *skb, u32);
 
@@ -939,7 +940,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
 
                 tp->ucopy.memory = 0;
         } else if (skb_queue_len(&tp->ucopy.prequeue) == 1) {
-                wake_up_interruptible_sync_poll(sk->sk_sleep,
+                wake_up_interruptible_sync_poll(sk_sleep(sk),
                                            POLLIN | POLLRDNORM | POLLRDBAND);
                 if (!inet_csk_ack_scheduled(sk))
                         inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK,
@@ -1032,6 +1033,14 @@ static inline int keepalive_probes(const struct tcp_sock *tp)
         return tp->keepalive_probes ? : sysctl_tcp_keepalive_probes;
 }
 
+static inline u32 keepalive_time_elapsed(const struct tcp_sock *tp)
+{
+        const struct inet_connection_sock *icsk = &tp->inet_conn;
+
+        return min_t(u32, tcp_time_stamp - icsk->icsk_ack.lrcvtime,
+                          tcp_time_stamp - tp->rcv_tstamp);
+}
+
 static inline int tcp_fin_time(const struct sock *sk)
 {
         int fin_timeout = tcp_sk(sk)->linger2 ? : sysctl_tcp_fin_timeout;
diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h
index d65381cad0fc..42a0eb68b7b6 100644
--- a/include/net/transp_v6.h
+++ b/include/net/transp_v6.h
@@ -44,7 +44,8 @@ extern int			datagram_send_ctl(struct net *net,
                                                   struct msghdr *msg,
                                                   struct flowi *fl,
                                                   struct ipv6_txoptions *opt,
-                                                  int *hlimit, int *tclass);
+                                                  int *hlimit, int *tclass,
+                                                  int *dontfrag);
 
 #define         LOOPBACK4_IPV6          cpu_to_be32(0x7f000006)
 
diff --git a/include/net/x25device.h b/include/net/x25device.h
index 1415bcf93980..1fa08b49f1c2 100644
--- a/include/net/x25device.h
+++ b/include/net/x25device.h
@@ -3,6 +3,7 @@
 
 #include <linux/if_ether.h>
 #include <linux/if_packet.h>
+#include <linux/if_x25.h>
 #include <linux/skbuff.h>
 
 static inline __be16 x25_type_trans(struct sk_buff *skb, struct net_device *dev)
diff --git a/kernel/power/user.c b/kernel/power/user.c
index 4d2289626a84..a8c96212bc1b 100644
--- a/kernel/power/user.c
+++ b/kernel/power/user.c
@@ -420,7 +420,7 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,
                          * User space encodes device types as two-byte values,
                          * so we need to recode them
                          */
-                        swdev = old_decode_dev(swap_area.dev);
+                        swdev = new_decode_dev(swap_area.dev);
                         if (swdev) {
                                 offset = swap_area.offset;
                                 data->swap = swap_type_of(swdev, offset, NULL);
diff --git a/kernel/rcupdate.c b/kernel/rcupdate.c
index 63fe25433980..03a7ea1579f6 100644
--- a/kernel/rcupdate.c
+++ b/kernel/rcupdate.c
@@ -69,6 +69,13 @@ EXPORT_SYMBOL_GPL(rcu_scheduler_active);
 
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 
+int debug_lockdep_rcu_enabled(void)
+{
+        return rcu_scheduler_active && debug_locks &&
+               current->lockdep_recursion == 0;
+}
+EXPORT_SYMBOL_GPL(debug_lockdep_rcu_enabled);
+
 /**
  * rcu_read_lock_bh_held - might we be in RCU-bh read-side critical section?
  *
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index 59030570f5ca..937d31dc8566 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -224,7 +224,6 @@ static const struct bin_table bin_net_ipv4_route_table[] = {
         { CTL_INT,      NET_IPV4_ROUTE_MTU_EXPIRES,             "mtu_expires" },
         { CTL_INT,      NET_IPV4_ROUTE_MIN_PMTU,                "min_pmtu" },
         { CTL_INT,      NET_IPV4_ROUTE_MIN_ADVMSS,              "min_adv_mss" },
-        { CTL_INT,      NET_IPV4_ROUTE_SECRET_INTERVAL,         "secret_interval" },
         {}
 };
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index ff017108700d..935248bdbc47 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -356,7 +356,7 @@ config SLUB_STATS
 config DEBUG_KMEMLEAK
         bool "Kernel memory leak detector"
         depends on DEBUG_KERNEL && EXPERIMENTAL && !MEMORY_HOTPLUG && \
-                (X86 || ARM || PPC || S390 || SUPERH || MICROBLAZE)
+                (X86 || ARM || PPC || S390 || SPARC64 || SUPERH || MICROBLAZE)
 
         select DEBUG_FS if SYSFS
         select STACKTRACE if STACKTRACE_SUPPORT
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index ba8b67039d13..01e64270e246 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -570,7 +570,7 @@ static ssize_t filter_write(struct file *file, const char __user *userbuf,
          * Now parse out the first token and use it as the name for the
          * driver to filter for.
          */
-        for (i = 0; i < NAME_MAX_LEN; ++i) {
+        for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
                 current_driver_name[i] = buf[i];
                 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
                         break;
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 24112e5a5780..7376b7c55ffe 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -408,12 +408,12 @@ enum format_type {
 };
 
 struct printf_spec {
-        u16     type;
-        s16     field_width;    /* width of output field */
+        u8      type;           /* format_type enum */
         u8      flags;          /* flags to number() */
-        u8      base;
-        s8      precision;      /* # of digits/chars */
-        u8      qualifier;
+        u8      base;           /* number base, 8, 10 or 16 only */
+        u8      qualifier;      /* number qualifier, one of 'hHlLtzZ' */
+        s16     field_width;    /* width of output field */
+        s16     precision;      /* # of digits/chars */
 };
 
 static char *number(char *buf, char *end, unsigned long long num,
diff --git a/mm/mmap.c b/mm/mmap.c
index 75557c639ad4..f90ea92f755a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -507,11 +507,12 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start,
         struct address_space *mapping = NULL;
         struct prio_tree_root *root = NULL;
         struct file *file = vma->vm_file;
-        struct anon_vma *anon_vma = NULL;
         long adjust_next = 0;
         int remove_next = 0;
 
         if (next && !insert) {
+                struct vm_area_struct *exporter = NULL;
+
                 if (end >= next->vm_end) {
                         /*
                          * vma expands, overlapping all the next, and
@@ -519,7 +520,7 @@ int vma_adjust(struct vm_area_struct *vma, unsigned long start,
                          */
 again:                  remove_next = 1 + (end > next->vm_end);
                         end = next->vm_end;
-                        anon_vma = next->anon_vma;
+                        exporter = next;
                         importer = vma;
                 } else if (end > next->vm_start) {
                         /*
@@ -527,7 +528,7 @@ again:			remove_next = 1 + (end > next->vm_end);
                          * mprotect case 5 shifting the boundary up.
                          */
                         adjust_next = (end - next->vm_start) >> PAGE_SHIFT;
-                        anon_vma = next->anon_vma;
+                        exporter = next;
                         importer = vma;
                 } else if (end < vma->vm_end) {
                         /*
@@ -536,28 +537,19 @@ again:			remove_next = 1 + (end > next->vm_end);
                          * mprotect case 4 shifting the boundary down.
                          */
                         adjust_next = - ((vma->vm_end - end) >> PAGE_SHIFT);
-                        anon_vma = next->anon_vma;
+                        exporter = vma;
                         importer = next;
                 }
-        }
 
-        /*
-         * When changing only vma->vm_end, we don't really need anon_vma lock.
-         */
-        if (vma->anon_vma && (insert || importer || start != vma->vm_start))
-                anon_vma = vma->anon_vma;
-        if (anon_vma) {
                 /*
                  * Easily overlooked: when mprotect shifts the boundary,
                  * make sure the expanding vma has anon_vma set if the
                  * shrinking vma had, to cover any anon pages imported.
                  */
-                if (importer && !importer->anon_vma) {
-                        /* Block reverse map lookups until things are set up. */
-                        if (anon_vma_clone(importer, vma)) {
+                if (exporter && exporter->anon_vma && !importer->anon_vma) {
+                        if (anon_vma_clone(importer, exporter))
                                 return -ENOMEM;
-                        }
-                        importer->anon_vma = anon_vma;
+                        importer->anon_vma = exporter->anon_vma;
                 }
         }
 
@@ -825,6 +817,61 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
 }
 
 /*
+ * Rough compatbility check to quickly see if it's even worth looking
+ * at sharing an anon_vma.
+ *
+ * They need to have the same vm_file, and the flags can only differ
+ * in things that mprotect may change.
+ *
+ * NOTE! The fact that we share an anon_vma doesn't _have_ to mean that
+ * we can merge the two vma's. For example, we refuse to merge a vma if
+ * there is a vm_ops->close() function, because that indicates that the
+ * driver is doing some kind of reference counting. But that doesn't
+ * really matter for the anon_vma sharing case.
+ */
+static int anon_vma_compatible(struct vm_area_struct *a, struct vm_area_struct *b)
+{
+        return a->vm_end == b->vm_start &&
+                mpol_equal(vma_policy(a), vma_policy(b)) &&
+                a->vm_file == b->vm_file &&
+                !((a->vm_flags ^ b->vm_flags) & ~(VM_READ|VM_WRITE|VM_EXEC)) &&
+                b->vm_pgoff == a->vm_pgoff + ((b->vm_start - a->vm_start) >> PAGE_SHIFT);
+}
+
+/*
+ * Do some basic sanity checking to see if we can re-use the anon_vma
+ * from 'old'. The 'a'/'b' vma's are in VM order - one of them will be
+ * the same as 'old', the other will be the new one that is trying
+ * to share the anon_vma.
+ *
+ * NOTE! This runs with mm_sem held for reading, so it is possible that
+ * the anon_vma of 'old' is concurrently in the process of being set up
+ * by another page fault trying to merge _that_. But that's ok: if it
+ * is being set up, that automatically means that it will be a singleton
+ * acceptable for merging, so we can do all of this optimistically. But
+ * we do that ACCESS_ONCE() to make sure that we never re-load the pointer.
+ *
+ * IOW: that the "list_is_singular()" test on the anon_vma_chain only
+ * matters for the 'stable anon_vma' case (ie the thing we want to avoid
+ * is to return an anon_vma that is "complex" due to having gone through
+ * a fork).
+ *
+ * We also make sure that the two vma's are compatible (adjacent,
+ * and with the same memory policies). That's all stable, even with just
+ * a read lock on the mm_sem.
+ */
+static struct anon_vma *reusable_anon_vma(struct vm_area_struct *old, struct vm_area_struct *a, struct vm_area_struct *b)
+{
+        if (anon_vma_compatible(a, b)) {
+                struct anon_vma *anon_vma = ACCESS_ONCE(old->anon_vma);
+
+                if (anon_vma && list_is_singular(&old->anon_vma_chain))
+                        return anon_vma;
+        }
+        return NULL;
+}
+
+/*
  * find_mergeable_anon_vma is used by anon_vma_prepare, to check
  * neighbouring vmas for a suitable anon_vma, before it goes off
  * to allocate a new anon_vma.  It checks because a repetitive
@@ -834,28 +881,16 @@ struct vm_area_struct *vma_merge(struct mm_struct *mm,
  */
 struct anon_vma *find_mergeable_anon_vma(struct vm_area_struct *vma)
 {
+        struct anon_vma *anon_vma;
         struct vm_area_struct *near;
-        unsigned long vm_flags;
 
         near = vma->vm_next;
         if (!near)
                 goto try_prev;
 
-        /*
-         * Since only mprotect tries to remerge vmas, match flags
-         * which might be mprotected into each other later on.
-         * Neither mlock nor madvise tries to remerge at present,
-         * so leave their flags as obstructing a merge.
-         */
-        vm_flags = vma->vm_flags & ~(VM_READ|VM_WRITE|VM_EXEC);
-        vm_flags |= near->vm_flags & (VM_READ|VM_WRITE|VM_EXEC);
-
-        if (near->anon_vma && vma->vm_end == near->vm_start &&
-                        mpol_equal(vma_policy(vma), vma_policy(near)) &&
-                        can_vma_merge_before(near, vm_flags,
-                                NULL, vma->vm_file, vma->vm_pgoff +
-                                ((vma->vm_end - vma->vm_start) >> PAGE_SHIFT)))
-                return near->anon_vma;
+        anon_vma = reusable_anon_vma(near, vma, near);
+        if (anon_vma)
+                return anon_vma;
 try_prev:
         /*
          * It is potentially slow to have to call find_vma_prev here.
@@ -868,14 +903,9 @@ try_prev:
         if (!near)
                 goto none;
 
-        vm_flags = vma->vm_flags & ~(VM_READ|VM_WRITE|VM_EXEC);
-        vm_flags |= near->vm_flags & (VM_READ|VM_WRITE|VM_EXEC);
-
-        if (near->anon_vma && near->vm_end == vma->vm_start &&
-                        mpol_equal(vma_policy(near), vma_policy(vma)) &&
-                        can_vma_merge_after(near, vm_flags,
-                                NULL, vma->vm_file, vma->vm_pgoff))
-                return near->anon_vma;
+        anon_vma = reusable_anon_vma(near, near, vma);
+        if (anon_vma)
+                return anon_vma;
 none:
         /*
          * There's no absolute need to look only at touching neighbours:
diff --git a/mm/rmap.c b/mm/rmap.c
index eaa7a09eb72e..526704e8215d 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -182,7 +182,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src)
 {
         struct anon_vma_chain *avc, *pavc;
 
-        list_for_each_entry(pavc, &src->anon_vma_chain, same_vma) {
+        list_for_each_entry_reverse(pavc, &src->anon_vma_chain, same_vma) {
                 avc = anon_vma_chain_alloc();
                 if (!avc)
                         goto enomem_failure;
@@ -730,13 +730,29 @@ void page_move_anon_rmap(struct page *page,
  * @page:       the page to add the mapping to
  * @vma:        the vm area in which the mapping is added
  * @address:    the user virtual address mapped
+ * @exclusive:  the page is exclusively owned by the current process
  */
 static void __page_set_anon_rmap(struct page *page,
-        struct vm_area_struct *vma, unsigned long address)
+        struct vm_area_struct *vma, unsigned long address, int exclusive)
 {
         struct anon_vma *anon_vma = vma->anon_vma;
 
         BUG_ON(!anon_vma);
+
+        /*
+         * If the page isn't exclusively mapped into this vma,
+         * we must use the _oldest_ possible anon_vma for the
+         * page mapping!
+         *
+         * So take the last AVC chain entry in the vma, which is
+         * the deepest ancestor, and use the anon_vma from that.
+         */
+        if (!exclusive) {
+                struct anon_vma_chain *avc;
+                avc = list_entry(vma->anon_vma_chain.prev, struct anon_vma_chain, same_vma);
+                anon_vma = avc->anon_vma;
+        }
+
         anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
         page->mapping = (struct address_space *) anon_vma;
         page->index = linear_page_index(vma, address);
@@ -791,7 +807,7 @@ void page_add_anon_rmap(struct page *page,
         VM_BUG_ON(!PageLocked(page));
         VM_BUG_ON(address < vma->vm_start || address >= vma->vm_end);
         if (first)
-                __page_set_anon_rmap(page, vma, address);
+                __page_set_anon_rmap(page, vma, address, 0);
         else
                 __page_check_anon_rmap(page, vma, address);
 }
@@ -813,7 +829,7 @@ void page_add_new_anon_rmap(struct page *page,
         SetPageSwapBacked(page);
         atomic_set(&page->_mapcount, 0); /* increment count (starts at -1) */
         __inc_zone_page_state(page, NR_ANON_PAGES);
-        __page_set_anon_rmap(page, vma, address);
+        __page_set_anon_rmap(page, vma, address, 1);
         if (page_evictable(page, vma))
                 lru_cache_add_lru(page, LRU_ACTIVE_ANON);
         else
diff --git a/net/atm/common.c b/net/atm/common.c
index 97ed94aa0cbc..b43feb1a3995 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -90,10 +90,13 @@ static void vcc_sock_destruct(struct sock *sk)
 
 static void vcc_def_wakeup(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
-        if (sk_has_sleeper(sk))
-                wake_up(sk->sk_sleep);
-        read_unlock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up(&wq->wait);
+        rcu_read_unlock();
 }
 
 static inline int vcc_writable(struct sock *sk)
@@ -106,16 +109,19 @@ static inline int vcc_writable(struct sock *sk)
 
 static void vcc_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
 
         if (vcc_writable(sk)) {
-                if (sk_has_sleeper(sk))
-                        wake_up_interruptible(sk->sk_sleep);
+                wq = rcu_dereference(sk->sk_wq);
+                if (wq_has_sleeper(wq))
+                        wake_up_interruptible(&wq->wait);
 
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
 
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 static struct proto vcc_proto = {
@@ -549,7 +555,7 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
         }
 
         eff = (size+3) & ~3; /* align to word boundary */
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         error = 0;
         while (!(skb = alloc_tx(vcc, eff))) {
                 if (m->msg_flags & MSG_DONTWAIT) {
@@ -568,9 +574,9 @@ int vcc_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *m,
                         send_sig(SIGPIPE, current, 0);
                         break;
                 }
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (error)
                 goto out;
         skb->dev = NULL; /* for paths shared with net_device interfaces */
@@ -595,7 +601,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct atm_vcc *vcc;
         unsigned int mask;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         vcc = ATM_SD(sock);
diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 6ba6e466ee54..509c8ac02b63 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -131,7 +131,7 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb)
                 }
                 sk->sk_ack_backlog++;
                 skb_queue_tail(&sk->sk_receive_queue, skb);
-                pr_debug("waking sk->sk_sleep 0x%p\n", sk->sk_sleep);
+                pr_debug("waking sk_sleep(sk) 0x%p\n", sk_sleep(sk));
                 sk->sk_state_change(sk);
 as_indicate_complete:
                 release_sock(sk);
diff --git a/net/atm/svc.c b/net/atm/svc.c
index 3ba9a45a51ac..754ee4791d96 100644
--- a/net/atm/svc.c
+++ b/net/atm/svc.c
@@ -49,14 +49,14 @@ static void svc_disconnect(struct atm_vcc *vcc)
 
         pr_debug("%p\n", vcc);
         if (test_bit(ATM_VF_REGIS, &vcc->flags)) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
                 sigd_enq(vcc, as_close, NULL, NULL, NULL);
                 while (!test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                         schedule();
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_UNINTERRUPTIBLE);
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
         }
         /* beware - socket is still in use by atmsigd until the last
            as_indicate has been answered */
@@ -125,13 +125,13 @@ static int svc_bind(struct socket *sock, struct sockaddr *sockaddr,
         }
         vcc->local = *addr;
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc, as_bind, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         clear_bit(ATM_VF_REGIS, &vcc->flags); /* doesn't count */
         if (!sigd) {
                 error = -EUNATCH;
@@ -201,10 +201,10 @@ static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
                 }
                 vcc->remote = *addr;
                 set_bit(ATM_VF_WAITING, &vcc->flags);
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 sigd_enq(vcc, as_connect, NULL, NULL, &vcc->remote);
                 if (flags & O_NONBLOCK) {
-                        finish_wait(sk->sk_sleep, &wait);
+                        finish_wait(sk_sleep(sk), &wait);
                         sock->state = SS_CONNECTING;
                         error = -EINPROGRESS;
                         goto out;
@@ -213,7 +213,7 @@ static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
                 while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                         schedule();
                         if (!signal_pending(current)) {
-                                prepare_to_wait(sk->sk_sleep, &wait,
+                                prepare_to_wait(sk_sleep(sk), &wait,
                                                 TASK_INTERRUPTIBLE);
                                 continue;
                         }
@@ -232,14 +232,14 @@ static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
                          */
                         sigd_enq(vcc, as_close, NULL, NULL, NULL);
                         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
-                                prepare_to_wait(sk->sk_sleep, &wait,
+                                prepare_to_wait(sk_sleep(sk), &wait,
                                                 TASK_INTERRUPTIBLE);
                                 schedule();
                         }
                         if (!sk->sk_err)
                                 while (!test_bit(ATM_VF_RELEASED, &vcc->flags) &&
                                        sigd) {
-                                        prepare_to_wait(sk->sk_sleep, &wait,
+                                        prepare_to_wait(sk_sleep(sk), &wait,
                                                         TASK_INTERRUPTIBLE);
                                         schedule();
                                 }
@@ -250,7 +250,7 @@ static int svc_connect(struct socket *sock, struct sockaddr *sockaddr,
                         error = -EINTR;
                         break;
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
                 if (error)
                         goto out;
                 if (!sigd) {
@@ -302,13 +302,13 @@ static int svc_listen(struct socket *sock, int backlog)
                 goto out;
         }
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq(vcc, as_listen, NULL, NULL, &vcc->local);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (!sigd) {
                 error = -EUNATCH;
                 goto out;
@@ -343,7 +343,7 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
         while (1) {
                 DEFINE_WAIT(wait);
 
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 while (!(skb = skb_dequeue(&sk->sk_receive_queue)) &&
                        sigd) {
                         if (test_bit(ATM_VF_RELEASED, &old_vcc->flags))
@@ -363,10 +363,10 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
                                 error = -ERESTARTSYS;
                                 break;
                         }
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_INTERRUPTIBLE);
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
                 if (error)
                         goto out;
                 if (!skb) {
@@ -392,17 +392,17 @@ static int svc_accept(struct socket *sock, struct socket *newsock, int flags)
                 }
                 /* wait should be short, so we ignore the non-blocking flag */
                 set_bit(ATM_VF_WAITING, &new_vcc->flags);
-                prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
                                 TASK_UNINTERRUPTIBLE);
                 sigd_enq(new_vcc, as_accept, old_vcc, NULL, NULL);
                 while (test_bit(ATM_VF_WAITING, &new_vcc->flags) && sigd) {
                         release_sock(sk);
                         schedule();
                         lock_sock(sk);
-                        prepare_to_wait(sk_atm(new_vcc)->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk_atm(new_vcc)), &wait,
                                         TASK_UNINTERRUPTIBLE);
                 }
-                finish_wait(sk_atm(new_vcc)->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk_atm(new_vcc)), &wait);
                 if (!sigd) {
                         error = -EUNATCH;
                         goto out;
@@ -438,14 +438,14 @@ int svc_change_qos(struct atm_vcc *vcc, struct atm_qos *qos)
         DEFINE_WAIT(wait);
 
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         sigd_enq2(vcc, as_modify, NULL, NULL, &vcc->local, qos, 0);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) &&
                !test_bit(ATM_VF_RELEASED, &vcc->flags) && sigd) {
                 schedule();
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_UNINTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_UNINTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (!sigd)
                 return -EUNATCH;
         return -sk->sk_err;
@@ -534,20 +534,20 @@ static int svc_addparty(struct socket *sock, struct sockaddr *sockaddr,
 
         lock_sock(sk);
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         sigd_enq(vcc, as_addparty, NULL, NULL,
                  (struct sockaddr_atmsvc *) sockaddr);
         if (flags & O_NONBLOCK) {
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
                 error = -EINPROGRESS;
                 goto out;
         }
         pr_debug("added wait queue\n");
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         error = xchg(&sk->sk_err_soft, 0);
 out:
         release_sock(sk);
@@ -563,13 +563,13 @@ static int svc_dropparty(struct socket *sock, int ep_ref)
 
         lock_sock(sk);
         set_bit(ATM_VF_WAITING, &vcc->flags);
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         sigd_enq2(vcc, as_dropparty, NULL, NULL, NULL, NULL, ep_ref);
         while (test_bit(ATM_VF_WAITING, &vcc->flags) && sigd) {
                 schedule();
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (!sigd) {
                 error = -EUNATCH;
                 goto out;
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 65c5801261f9..cfdfd7e2a172 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1281,7 +1281,7 @@ static int __must_check ax25_connect(struct socket *sock,
                 DEFINE_WAIT(wait);
 
                 for (;;) {
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_INTERRUPTIBLE);
                         if (sk->sk_state != TCP_SYN_SENT)
                                 break;
@@ -1294,7 +1294,7 @@ static int __must_check ax25_connect(struct socket *sock,
                         err = -ERESTARTSYS;
                         break;
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
 
                 if (err)
                         goto out_release;
@@ -1346,7 +1346,7 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
          *      hooked into the SABM we saved
          */
         for (;;) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb)
                         break;
@@ -1364,7 +1364,7 @@ static int ax25_accept(struct socket *sock, struct socket *newsock, int flags)
                 err = -ERESTARTSYS;
                 break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 
         if (err)
                 goto out;
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 404a8500fd03..421c45bd1b95 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -288,7 +288,7 @@ unsigned int bt_sock_poll(struct file * file, struct socket *sock, poll_table *w
 
         BT_DBG("sock %p, sk %p", sock, sk);
 
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         if (sk->sk_state == BT_LISTEN)
                 return bt_accept_poll(sk);
@@ -378,7 +378,7 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
 
         BT_DBG("sk %p", sk);
 
-        add_wait_queue(sk->sk_sleep, &wait);
+        add_wait_queue(sk_sleep(sk), &wait);
         while (sk->sk_state != state) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
@@ -401,7 +401,7 @@ int bt_sock_wait_state(struct sock *sk, int state, unsigned long timeo)
                         break;
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         return err;
 }
 EXPORT_SYMBOL(bt_sock_wait_state);
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 8062dad6d10d..f10b41fb05a0 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -474,7 +474,7 @@ static int bnep_session(void *arg)
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
-        add_wait_queue(sk->sk_sleep, &wait);
+        add_wait_queue(sk_sleep(sk), &wait);
         while (!atomic_read(&s->killed)) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
@@ -496,7 +496,7 @@ static int bnep_session(void *arg)
                 schedule();
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         /* Cleanup session */
         down_write(&bnep_session_sem);
@@ -507,7 +507,7 @@ static int bnep_session(void *arg)
         /* Wakeup user-space polling for socket errors */
         s->sock->sk->sk_err = EUNATCH;
 
-        wake_up_interruptible(s->sock->sk->sk_sleep);
+        wake_up_interruptible(sk_sleep(s->sock->sk));
 
         /* Release the socket */
         fput(s->sock->file);
@@ -638,7 +638,7 @@ int bnep_del_connection(struct bnep_conndel_req *req)
 
                 /* Kill session thread */
                 atomic_inc(&s->killed);
-                wake_up_interruptible(s->sock->sk->sk_sleep);
+                wake_up_interruptible(sk_sleep(s->sock->sk));
         } else
                 err = -ENOENT;
 
diff --git a/net/bluetooth/bnep/netdev.c b/net/bluetooth/bnep/netdev.c
index d48b33f4d4ba..0faad5ce6dc4 100644
--- a/net/bluetooth/bnep/netdev.c
+++ b/net/bluetooth/bnep/netdev.c
@@ -109,7 +109,7 @@ static void bnep_net_set_mc_list(struct net_device *dev)
         }
 
         skb_queue_tail(&sk->sk_write_queue, skb);
-        wake_up_interruptible(sk->sk_sleep);
+        wake_up_interruptible(sk_sleep(sk));
 #endif
 }
 
@@ -193,11 +193,11 @@ static netdev_tx_t bnep_net_xmit(struct sk_buff *skb,
         /*
          * We cannot send L2CAP packets from here as we are potentially in a bh.
          * So we have to queue them and wake up session thread which is sleeping
-         * on the sk->sk_sleep.
+         * on the sk_sleep(sk).
          */
         dev->trans_start = jiffies;
         skb_queue_tail(&sk->sk_write_queue, skb);
-        wake_up_interruptible(sk->sk_sleep);
+        wake_up_interruptible(sk_sleep(sk));
 
         if (skb_queue_len(&sk->sk_write_queue) >= BNEP_TX_QUEUE_LEN) {
                 BT_DBG("tx queue is full");
diff --git a/net/bluetooth/cmtp/cmtp.h b/net/bluetooth/cmtp/cmtp.h
index e4663aa14d26..785e79e953c5 100644
--- a/net/bluetooth/cmtp/cmtp.h
+++ b/net/bluetooth/cmtp/cmtp.h
@@ -125,7 +125,7 @@ static inline void cmtp_schedule(struct cmtp_session *session)
 {
         struct sock *sk = session->sock->sk;
 
-        wake_up_interruptible(sk->sk_sleep);
+        wake_up_interruptible(sk_sleep(sk));
 }
 
 /* CMTP init defines */
diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
index 0073ec8495da..d4c6af082d48 100644
--- a/net/bluetooth/cmtp/core.c
+++ b/net/bluetooth/cmtp/core.c
@@ -284,7 +284,7 @@ static int cmtp_session(void *arg)
         set_user_nice(current, -15);
 
         init_waitqueue_entry(&wait, current);
-        add_wait_queue(sk->sk_sleep, &wait);
+        add_wait_queue(sk_sleep(sk), &wait);
         while (!atomic_read(&session->terminate)) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
@@ -301,7 +301,7 @@ static int cmtp_session(void *arg)
                 schedule();
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         down_write(&cmtp_session_sem);
 
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 280529ad9274..bfe641b7dfaf 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -561,8 +561,8 @@ static int hidp_session(void *arg)
 
         init_waitqueue_entry(&ctrl_wait, current);
         init_waitqueue_entry(&intr_wait, current);
-        add_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
-        add_wait_queue(intr_sk->sk_sleep, &intr_wait);
+        add_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
+        add_wait_queue(sk_sleep(intr_sk), &intr_wait);
         while (!atomic_read(&session->terminate)) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
@@ -584,8 +584,8 @@ static int hidp_session(void *arg)
                 schedule();
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(intr_sk->sk_sleep, &intr_wait);
-        remove_wait_queue(ctrl_sk->sk_sleep, &ctrl_wait);
+        remove_wait_queue(sk_sleep(intr_sk), &intr_wait);
+        remove_wait_queue(sk_sleep(ctrl_sk), &ctrl_wait);
 
         down_write(&hidp_session_sem);
 
@@ -609,7 +609,7 @@ static int hidp_session(void *arg)
 
         fput(session->intr_sock->file);
 
-        wait_event_timeout(*(ctrl_sk->sk_sleep),
+        wait_event_timeout(*(sk_sleep(ctrl_sk)),
                 (ctrl_sk->sk_state == BT_CLOSED), msecs_to_jiffies(500));
 
         fput(session->ctrl_sock->file);
diff --git a/net/bluetooth/hidp/hidp.h b/net/bluetooth/hidp/hidp.h
index a4e215d50c10..8d934a19da0a 100644
--- a/net/bluetooth/hidp/hidp.h
+++ b/net/bluetooth/hidp/hidp.h
@@ -164,8 +164,8 @@ static inline void hidp_schedule(struct hidp_session *session)
         struct sock *ctrl_sk = session->ctrl_sock->sk;
         struct sock *intr_sk = session->intr_sock->sk;
 
-        wake_up_interruptible(ctrl_sk->sk_sleep);
-        wake_up_interruptible(intr_sk->sk_sleep);
+        wake_up_interruptible(sk_sleep(ctrl_sk));
+        wake_up_interruptible(sk_sleep(intr_sk));
 }
 
 /* HIDP init defines */
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 99d68c34e4f1..864c76f4a678 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1147,7 +1147,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!timeo) {
@@ -1170,7 +1170,7 @@ static int l2cap_sock_accept(struct socket *sock, struct socket *newsock, int fl
                 }
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
                 goto done;
@@ -1626,7 +1626,10 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
         /* Connectionless channel */
         if (sk->sk_type == SOCK_DGRAM) {
                 skb = l2cap_create_connless_pdu(sk, msg, len);
-                err = l2cap_do_send(sk, skb);
+                if (IS_ERR(skb))
+                        err = PTR_ERR(skb);
+                else
+                        err = l2cap_do_send(sk, skb);
                 goto done;
         }
 
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 8ed3c37684fa..43fbf6b4b4bf 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -503,7 +503,7 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         while (!(nsk = bt_accept_dequeue(sk, newsock))) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!timeo) {
@@ -526,7 +526,7 @@ static int rfcomm_sock_accept(struct socket *sock, struct socket *newsock, int f
                 }
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
                 goto done;
@@ -621,7 +621,7 @@ static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
 {
         DECLARE_WAITQUEUE(wait, current);
 
-        add_wait_queue(sk->sk_sleep, &wait);
+        add_wait_queue(sk_sleep(sk), &wait);
         for (;;) {
                 set_current_state(TASK_INTERRUPTIBLE);
 
@@ -640,7 +640,7 @@ static long rfcomm_sock_data_wait(struct sock *sk, long timeo)
         }
 
         __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         return timeo;
 }
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index ca6b2ad1c3fc..b406d3eff53a 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -567,7 +567,7 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
         BT_DBG("sk %p timeo %ld", sk, timeo);
 
         /* Wait for an incoming connection. (wake-one). */
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         while (!(ch = bt_accept_dequeue(sk, newsock))) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!timeo) {
@@ -590,7 +590,7 @@ static int sco_sock_accept(struct socket *sock, struct socket *newsock, int flag
                 }
         }
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
                 goto done;
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index d115d5cea5b6..9190ae462cb4 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -33,14 +33,14 @@ config BRIDGE
           If unsure, say N.
 
 config BRIDGE_IGMP_SNOOPING
-        bool "IGMP snooping"
+        bool "IGMP/MLD snooping"
         depends on BRIDGE
         depends on INET
         default y
         ---help---
           If you say Y here, then the Ethernet bridge will be able selectively
-          forward multicast traffic based on IGMP traffic received from each
-          port.
+          forward multicast traffic based on IGMP/MLD traffic received from
+          each port.
 
           Say N to exclude this support and reduce the binary size.
 
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 007bde87415d..f15f9c4a0dd2 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -13,9 +13,12 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/netpoll.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
+#include <linux/list.h>
 #include <linux/netfilter_bridge.h>
+
 #include <asm/uaccess.h>
 #include "br_private.h"
 
@@ -43,7 +46,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         skb_reset_mac_header(skb);
         skb_pull(skb, ETH_HLEN);
 
-        if (dest[0] & 1) {
+        if (is_multicast_ether_addr(dest)) {
                 if (br_multicast_rcv(br, NULL, skb))
                         goto out;
 
@@ -195,6 +198,59 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
         return 0;
 }
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+bool br_devices_support_netpoll(struct net_bridge *br)
+{
+        struct net_bridge_port *p;
+        bool ret = true;
+        int count = 0;
+        unsigned long flags;
+
+        spin_lock_irqsave(&br->lock, flags);
+        list_for_each_entry(p, &br->port_list, list) {
+                count++;
+                if ((p->dev->priv_flags & IFF_DISABLE_NETPOLL) ||
+                    !p->dev->netdev_ops->ndo_poll_controller)
+                        ret = false;
+        }
+        spin_unlock_irqrestore(&br->lock, flags);
+        return count != 0 && ret;
+}
+
+static void br_poll_controller(struct net_device *br_dev)
+{
+        struct netpoll *np = br_dev->npinfo->netpoll;
+
+        if (np->real_dev != br_dev)
+                netpoll_poll_dev(np->real_dev);
+}
+
+void br_netpoll_cleanup(struct net_device *br_dev)
+{
+        struct net_bridge *br = netdev_priv(br_dev);
+        struct net_bridge_port *p, *n;
+        const struct net_device_ops *ops;
+
+        br->dev->npinfo = NULL;
+        list_for_each_entry_safe(p, n, &br->port_list, list) {
+                if (p->dev) {
+                        ops = p->dev->netdev_ops;
+                        if (ops->ndo_netpoll_cleanup)
+                                ops->ndo_netpoll_cleanup(p->dev);
+                        else
+                                p->dev->npinfo = NULL;
+                }
+        }
+}
+
+#else
+
+void br_netpoll_cleanup(struct net_device *br_dev)
+{
+}
+
+#endif
+
 static const struct ethtool_ops br_ethtool_ops = {
         .get_drvinfo    = br_getinfo,
         .get_link       = ethtool_op_get_link,
@@ -218,6 +274,10 @@ static const struct net_device_ops br_netdev_ops = {
         .ndo_set_multicast_list  = br_dev_set_multicast_list,
         .ndo_change_mtu          = br_change_mtu,
         .ndo_do_ioctl            = br_dev_ioctl,
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        .ndo_netpoll_cleanup     = br_netpoll_cleanup,
+        .ndo_poll_controller     = br_poll_controller,
+#endif
 };
 
 static void br_dev_free(struct net_device *dev)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 92fb3293a215..a98ef1393097 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -15,6 +15,7 @@
 #include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/netpoll.h>
 #include <linux/skbuff.h>
 #include <linux/if_vlan.h>
 #include <linux/netfilter_bridge.h>
@@ -50,7 +51,13 @@ int br_dev_queue_push_xmit(struct sk_buff *skb)
                 else {
                         skb_push(skb, ETH_HLEN);
 
-                        dev_queue_xmit(skb);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+                        if (unlikely(skb->dev->priv_flags & IFF_IN_NETPOLL)) {
+                                netpoll_send_skb(skb->dev->npinfo->netpoll, skb);
+                                skb->dev->priv_flags &= ~IFF_IN_NETPOLL;
+                        } else
+#endif
+                                dev_queue_xmit(skb);
                 }
         }
 
@@ -66,9 +73,23 @@ int br_forward_finish(struct sk_buff *skb)
 
 static void __br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 {
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        struct net_bridge *br = to->br;
+        if (unlikely(br->dev->priv_flags & IFF_IN_NETPOLL)) {
+                struct netpoll *np;
+                to->dev->npinfo = skb->dev->npinfo;
+                np = skb->dev->npinfo->netpoll;
+                np->real_dev = np->dev = to->dev;
+                to->dev->priv_flags |= IFF_IN_NETPOLL;
+        }
+#endif
         skb->dev = to->dev;
         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                 br_forward_finish);
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (skb->dev->npinfo)
+                skb->dev->npinfo->netpoll->dev = br->dev;
+#endif
 }
 
 static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
@@ -208,17 +229,15 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
 {
         struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
         struct net_bridge *br = netdev_priv(dev);
-        struct net_bridge_port *port;
-        struct net_bridge_port *lport, *rport;
-        struct net_bridge_port *prev;
+        struct net_bridge_port *prev = NULL;
         struct net_bridge_port_group *p;
         struct hlist_node *rp;
 
-        prev = NULL;
-
-        rp = br->router_list.first;
-        p = mdst ? mdst->ports : NULL;
+        rp = rcu_dereference(br->router_list.first);
+        p = mdst ? rcu_dereference(mdst->ports) : NULL;
         while (p || rp) {
+                struct net_bridge_port *port, *lport, *rport;
+
                 lport = p ? p->port : NULL;
                 rport = rp ? hlist_entry(rp, struct net_bridge_port, rlist) :
                              NULL;
@@ -231,9 +250,9 @@ static void br_multicast_flood(struct net_bridge_mdb_entry *mdst,
                         goto out;
 
                 if ((unsigned long)lport >= (unsigned long)port)
-                        p = p->next;
+                        p = rcu_dereference(p->next);
                 if ((unsigned long)rport >= (unsigned long)port)
-                        rp = rp->next;
+                        rp = rcu_dereference(rp->next);
         }
 
         if (!prev)
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 521439333316..537bdd60d9b9 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -13,6 +13,7 @@
 
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
+#include <linux/netpoll.h>
 #include <linux/ethtool.h>
 #include <linux/if_arp.h>
 #include <linux/module.h>
@@ -153,6 +154,14 @@ static void del_nbp(struct net_bridge_port *p)
         kobject_uevent(&p->kobj, KOBJ_REMOVE);
         kobject_del(&p->kobj);
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (br_devices_support_netpoll(br))
+                br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+        if (dev->netdev_ops->ndo_netpoll_cleanup)
+                dev->netdev_ops->ndo_netpoll_cleanup(dev);
+        else
+                dev->npinfo = NULL;
+#endif
         call_rcu(&p->rcu, destroy_nbp_rcu);
 }
 
@@ -165,6 +174,8 @@ static void del_br(struct net_bridge *br, struct list_head *head)
                 del_nbp(p);
         }
 
+        br_netpoll_cleanup(br->dev);
+
         del_timer_sync(&br->gc_timer);
 
         br_sysfs_delbr(br->dev);
@@ -444,6 +455,20 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
 
         kobject_uevent(&p->kobj, KOBJ_ADD);
 
+#ifdef CONFIG_NET_POLL_CONTROLLER
+        if (br_devices_support_netpoll(br)) {
+                br->dev->priv_flags &= ~IFF_DISABLE_NETPOLL;
+                if (br->dev->npinfo)
+                        dev->npinfo = br->dev->npinfo;
+        } else if (!(br->dev->priv_flags & IFF_DISABLE_NETPOLL)) {
+                br->dev->priv_flags |= IFF_DISABLE_NETPOLL;
+                printk(KERN_INFO "New device %s does not support netpoll\n",
+                        dev->name);
+                printk(KERN_INFO "Disabling netpoll for %s\n",
+                        br->dev->name);
+        }
+#endif
+
         return 0;
 err2:
         br_fdb_delete_by_port(br, p, 1);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 8ccdb8ee3928..c8419e240316 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -24,51 +24,139 @@
 #include <linux/slab.h>
 #include <linux/timer.h>
 #include <net/ip.h>
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+#include <net/ipv6.h>
+#include <net/mld.h>
+#include <net/addrconf.h>
+#include <net/ip6_checksum.h>
+#endif
 
 #include "br_private.h"
 
-static inline int br_ip_hash(struct net_bridge_mdb_htable *mdb, __be32 ip)
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline int ipv6_is_local_multicast(const struct in6_addr *addr)
 {
-        return jhash_1word(mdb->secret, (u32)ip) & (mdb->max - 1);
+        if (ipv6_addr_is_multicast(addr) &&
+            IPV6_ADDR_MC_SCOPE(addr) <= IPV6_ADDR_SCOPE_LINKLOCAL)
+                return 1;
+        return 0;
+}
+#endif
+
+static inline int br_ip_equal(const struct br_ip *a, const struct br_ip *b)
+{
+        if (a->proto != b->proto)
+                return 0;
+        switch (a->proto) {
+        case htons(ETH_P_IP):
+                return a->u.ip4 == b->u.ip4;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case htons(ETH_P_IPV6):
+                return ipv6_addr_equal(&a->u.ip6, &b->u.ip6);
+#endif
+        }
+        return 0;
+}
+
+static inline int __br_ip4_hash(struct net_bridge_mdb_htable *mdb, __be32 ip)
+{
+        return jhash_1word(mdb->secret, (__force u32)ip) & (mdb->max - 1);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static inline int __br_ip6_hash(struct net_bridge_mdb_htable *mdb,
+                                const struct in6_addr *ip)
+{
+        return jhash2((__force u32 *)ip->s6_addr32, 4, mdb->secret) & (mdb->max - 1);
+}
+#endif
+
+static inline int br_ip_hash(struct net_bridge_mdb_htable *mdb,
+                             struct br_ip *ip)
+{
+        switch (ip->proto) {
+        case htons(ETH_P_IP):
+                return __br_ip4_hash(mdb, ip->u.ip4);
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case htons(ETH_P_IPV6):
+                return __br_ip6_hash(mdb, &ip->u.ip6);
+#endif
+        }
+        return 0;
 }
 
 static struct net_bridge_mdb_entry *__br_mdb_ip_get(
-        struct net_bridge_mdb_htable *mdb, __be32 dst, int hash)
+        struct net_bridge_mdb_htable *mdb, struct br_ip *dst, int hash)
 {
         struct net_bridge_mdb_entry *mp;
         struct hlist_node *p;
 
         hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
-                if (dst == mp->addr)
+                if (br_ip_equal(&mp->addr, dst))
                         return mp;
         }
 
         return NULL;
 }
 
-static struct net_bridge_mdb_entry *br_mdb_ip_get(
+static struct net_bridge_mdb_entry *br_mdb_ip4_get(
         struct net_bridge_mdb_htable *mdb, __be32 dst)
 {
-        if (!mdb)
-                return NULL;
+        struct br_ip br_dst;
+
+        br_dst.u.ip4 = dst;
+        br_dst.proto = htons(ETH_P_IP);
+
+        return __br_mdb_ip_get(mdb, &br_dst, __br_ip4_hash(mdb, dst));
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static struct net_bridge_mdb_entry *br_mdb_ip6_get(
+        struct net_bridge_mdb_htable *mdb, const struct in6_addr *dst)
+{
+        struct br_ip br_dst;
 
+        ipv6_addr_copy(&br_dst.u.ip6, dst);
+        br_dst.proto = htons(ETH_P_IPV6);
+
+        return __br_mdb_ip_get(mdb, &br_dst, __br_ip6_hash(mdb, dst));
+}
+#endif
+
+static struct net_bridge_mdb_entry *br_mdb_ip_get(
+        struct net_bridge_mdb_htable *mdb, struct br_ip *dst)
+{
         return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
 }
 
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
-        if (br->multicast_disabled)
+        struct net_bridge_mdb_htable *mdb = br->mdb;
+        struct br_ip ip;
+
+        if (!mdb || br->multicast_disabled)
+                return NULL;
+
+        if (BR_INPUT_SKB_CB(skb)->igmp)
                 return NULL;
 
+        ip.proto = skb->protocol;
+
         switch (skb->protocol) {
         case htons(ETH_P_IP):
-                if (BR_INPUT_SKB_CB(skb)->igmp)
-                        break;
-                return br_mdb_ip_get(br->mdb, ip_hdr(skb)->daddr);
+                ip.u.ip4 = ip_hdr(skb)->daddr;
+                break;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case htons(ETH_P_IPV6):
+                ipv6_addr_copy(&ip.u.ip6, &ipv6_hdr(skb)->daddr);
+                break;
+#endif
+        default:
+                return NULL;
         }
 
-        return NULL;
+        return br_mdb_ip_get(mdb, &ip);
 }
 
 static void br_mdb_free(struct rcu_head *head)
@@ -95,7 +183,7 @@ static int br_mdb_copy(struct net_bridge_mdb_htable *new,
         for (i = 0; i < old->max; i++)
                 hlist_for_each_entry(mp, p, &old->mhash[i], hlist[old->ver])
                         hlist_add_head(&mp->hlist[new->ver],
-                                       &new->mhash[br_ip_hash(new, mp->addr)]);
+                                       &new->mhash[br_ip_hash(new, &mp->addr)]);
 
         if (!elasticity)
                 return 0;
@@ -163,7 +251,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
         struct net_bridge_port_group *p;
         struct net_bridge_port_group **pp;
 
-        mp = br_mdb_ip_get(mdb, pg->addr);
+        mp = br_mdb_ip_get(mdb, &pg->addr);
         if (WARN_ON(!mp))
                 return;
 
@@ -171,7 +259,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 if (p != pg)
                         continue;
 
-                *pp = p->next;
+                rcu_assign_pointer(*pp, p->next);
                 hlist_del_init(&p->mglist);
                 del_timer(&p->timer);
                 del_timer(&p->query_timer);
@@ -249,8 +337,8 @@ out:
         return 0;
 }
 
-static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
-                                                __be32 group)
+static struct sk_buff *br_ip4_multicast_alloc_query(struct net_bridge *br,
+                                                    __be32 group)
 {
         struct sk_buff *skb;
         struct igmphdr *ih;
@@ -314,12 +402,104 @@ out:
         return skb;
 }
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
+                                                    struct in6_addr *group)
+{
+        struct sk_buff *skb;
+        struct ipv6hdr *ip6h;
+        struct mld_msg *mldq;
+        struct ethhdr *eth;
+        u8 *hopopt;
+        unsigned long interval;
+
+        skb = netdev_alloc_skb_ip_align(br->dev, sizeof(*eth) + sizeof(*ip6h) +
+                                                 8 + sizeof(*mldq));
+        if (!skb)
+                goto out;
+
+        skb->protocol = htons(ETH_P_IPV6);
+
+        /* Ethernet header */
+        skb_reset_mac_header(skb);
+        eth = eth_hdr(skb);
+
+        memcpy(eth->h_source, br->dev->dev_addr, 6);
+        ipv6_eth_mc_map(group, eth->h_dest);
+        eth->h_proto = htons(ETH_P_IPV6);
+        skb_put(skb, sizeof(*eth));
+
+        /* IPv6 header + HbH option */
+        skb_set_network_header(skb, skb->len);
+        ip6h = ipv6_hdr(skb);
+
+        *(__force __be32 *)ip6h = htonl(0x60000000);
+        ip6h->payload_len = 8 + sizeof(*mldq);
+        ip6h->nexthdr = IPPROTO_HOPOPTS;
+        ip6h->hop_limit = 1;
+        ipv6_addr_set(&ip6h->saddr, 0, 0, 0, 0);
+        ipv6_addr_set(&ip6h->daddr, htonl(0xff020000), 0, 0, htonl(1));
+
+        hopopt = (u8 *)(ip6h + 1);
+        hopopt[0] = IPPROTO_ICMPV6;             /* next hdr */
+        hopopt[1] = 0;                          /* length of HbH */
+        hopopt[2] = IPV6_TLV_ROUTERALERT;       /* Router Alert */
+        hopopt[3] = 2;                          /* Length of RA Option */
+        hopopt[4] = 0;                          /* Type = 0x0000 (MLD) */
+        hopopt[5] = 0;
+        hopopt[6] = IPV6_TLV_PAD0;              /* Pad0 */
+        hopopt[7] = IPV6_TLV_PAD0;              /* Pad0 */
+
+        skb_put(skb, sizeof(*ip6h) + 8);
+
+        /* ICMPv6 */
+        skb_set_transport_header(skb, skb->len);
+        mldq = (struct mld_msg *) icmp6_hdr(skb);
+
+        interval = ipv6_addr_any(group) ? br->multicast_last_member_interval :
+                                          br->multicast_query_response_interval;
+
+        mldq->mld_type = ICMPV6_MGM_QUERY;
+        mldq->mld_code = 0;
+        mldq->mld_cksum = 0;
+        mldq->mld_maxdelay = htons((u16)jiffies_to_msecs(interval));
+        mldq->mld_reserved = 0;
+        ipv6_addr_copy(&mldq->mld_mca, group);
+
+        /* checksum */
+        mldq->mld_cksum = csum_ipv6_magic(&ip6h->saddr, &ip6h->daddr,
+                                          sizeof(*mldq), IPPROTO_ICMPV6,
+                                          csum_partial(mldq,
+                                                       sizeof(*mldq), 0));
+        skb_put(skb, sizeof(*mldq));
+
+        __skb_pull(skb, sizeof(*eth));
+
+out:
+        return skb;
+}
+#endif
+
+static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
+                                                struct br_ip *addr)
+{
+        switch (addr->proto) {
+        case htons(ETH_P_IP):
+                return br_ip4_multicast_alloc_query(br, addr->u.ip4);
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case htons(ETH_P_IPV6):
+                return br_ip6_multicast_alloc_query(br, &addr->u.ip6);
+#endif
+        }
+        return NULL;
+}
+
 static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
 {
         struct net_bridge *br = mp->br;
         struct sk_buff *skb;
 
-        skb = br_multicast_alloc_query(br, mp->addr);
+        skb = br_multicast_alloc_query(br, &mp->addr);
         if (!skb)
                 goto timer;
 
@@ -353,7 +533,7 @@ static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
         struct net_bridge *br = port->br;
         struct sk_buff *skb;
 
-        skb = br_multicast_alloc_query(br, pg->addr);
+        skb = br_multicast_alloc_query(br, &pg->addr);
         if (!skb)
                 goto timer;
 
@@ -383,8 +563,8 @@ out:
 }
 
 static struct net_bridge_mdb_entry *br_multicast_get_group(
-        struct net_bridge *br, struct net_bridge_port *port, __be32 group,
-        int hash)
+        struct net_bridge *br, struct net_bridge_port *port,
+        struct br_ip *group, int hash)
 {
         struct net_bridge_mdb_htable *mdb = br->mdb;
         struct net_bridge_mdb_entry *mp;
@@ -396,9 +576,8 @@ static struct net_bridge_mdb_entry *br_multicast_get_group(
 
         hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
                 count++;
-                if (unlikely(group == mp->addr)) {
+                if (unlikely(br_ip_equal(group, &mp->addr)))
                         return mp;
-                }
         }
 
         elasticity = 0;
@@ -463,7 +642,8 @@ err:
 }
 
 static struct net_bridge_mdb_entry *br_multicast_new_group(
-        struct net_bridge *br, struct net_bridge_port *port, __be32 group)
+        struct net_bridge *br, struct net_bridge_port *port,
+        struct br_ip *group)
 {
         struct net_bridge_mdb_htable *mdb = br->mdb;
         struct net_bridge_mdb_entry *mp;
@@ -496,7 +676,7 @@ rehash:
                 goto out;
 
         mp->br = br;
-        mp->addr = group;
+        mp->addr = *group;
         setup_timer(&mp->timer, br_multicast_group_expired,
                     (unsigned long)mp);
         setup_timer(&mp->query_timer, br_multicast_group_query_expired,
@@ -510,7 +690,8 @@ out:
 }
 
 static int br_multicast_add_group(struct net_bridge *br,
-                                  struct net_bridge_port *port, __be32 group)
+                                  struct net_bridge_port *port,
+                                  struct br_ip *group)
 {
         struct net_bridge_mdb_entry *mp;
         struct net_bridge_port_group *p;
@@ -518,9 +699,6 @@ static int br_multicast_add_group(struct net_bridge *br,
         unsigned long now = jiffies;
         int err;
 
-        if (ipv4_is_local_multicast(group))
-                return 0;
-
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
             (port && port->state == BR_STATE_DISABLED))
@@ -549,7 +727,7 @@ static int br_multicast_add_group(struct net_bridge *br,
         if (unlikely(!p))
                 goto err;
 
-        p->addr = group;
+        p->addr = *group;
         p->port = port;
         p->next = *pp;
         hlist_add_head(&p->mglist, &port->mglist);
@@ -570,6 +748,38 @@ err:
         return err;
 }
 
+static int br_ip4_multicast_add_group(struct net_bridge *br,
+                                      struct net_bridge_port *port,
+                                      __be32 group)
+{
+        struct br_ip br_group;
+
+        if (ipv4_is_local_multicast(group))
+                return 0;
+
+        br_group.u.ip4 = group;
+        br_group.proto = htons(ETH_P_IP);
+
+        return br_multicast_add_group(br, port, &br_group);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int br_ip6_multicast_add_group(struct net_bridge *br,
+                                      struct net_bridge_port *port,
+                                      const struct in6_addr *group)
+{
+        struct br_ip br_group;
+
+        if (ipv6_is_local_multicast(group))
+                return 0;
+
+        ipv6_addr_copy(&br_group.u.ip6, group);
+        br_group.proto = htons(ETH_P_IP);
+
+        return br_multicast_add_group(br, port, &br_group);
+}
+#endif
+
 static void br_multicast_router_expired(unsigned long data)
 {
         struct net_bridge_port *port = (void *)data;
@@ -591,19 +801,15 @@ static void br_multicast_local_router_expired(unsigned long data)
 {
 }
 
-static void br_multicast_send_query(struct net_bridge *br,
-                                    struct net_bridge_port *port, u32 sent)
+static void __br_multicast_send_query(struct net_bridge *br,
+                                      struct net_bridge_port *port,
+                                      struct br_ip *ip)
 {
-        unsigned long time;
         struct sk_buff *skb;
 
-        if (!netif_running(br->dev) || br->multicast_disabled ||
-            timer_pending(&br->multicast_querier_timer))
-                return;
-
-        skb = br_multicast_alloc_query(br, 0);
+        skb = br_multicast_alloc_query(br, ip);
         if (!skb)
-                goto timer;
+                return;
 
         if (port) {
                 __skb_push(skb, sizeof(struct ethhdr));
@@ -612,8 +818,28 @@ static void br_multicast_send_query(struct net_bridge *br,
                         dev_queue_xmit);
         } else
                 netif_rx(skb);
+}
+
+static void br_multicast_send_query(struct net_bridge *br,
+                                    struct net_bridge_port *port, u32 sent)
+{
+        unsigned long time;
+        struct br_ip br_group;
+
+        if (!netif_running(br->dev) || br->multicast_disabled ||
+            timer_pending(&br->multicast_querier_timer))
+                return;
+
+        memset(&br_group.u, 0, sizeof(br_group.u));
+
+        br_group.proto = htons(ETH_P_IP);
+        __br_multicast_send_query(br, port, &br_group);
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        br_group.proto = htons(ETH_P_IPV6);
+        __br_multicast_send_query(br, port, &br_group);
+#endif
 
-timer:
         time = jiffies;
         time += sent < br->multicast_startup_query_count ?
                 br->multicast_startup_query_interval :
@@ -698,9 +924,9 @@ void br_multicast_disable_port(struct net_bridge_port *port)
         spin_unlock(&br->multicast_lock);
 }
 
-static int br_multicast_igmp3_report(struct net_bridge *br,
-                                     struct net_bridge_port *port,
-                                     struct sk_buff *skb)
+static int br_ip4_multicast_igmp3_report(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         struct sk_buff *skb)
 {
         struct igmpv3_report *ih;
         struct igmpv3_grec *grec;
@@ -727,7 +953,7 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                 group = grec->grec_mca;
                 type = grec->grec_type;
 
-                len += grec->grec_nsrcs * 4;
+                len += ntohs(grec->grec_nsrcs) * 4;
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
@@ -745,7 +971,7 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                         continue;
                 }
 
-                err = br_multicast_add_group(br, port, group);
+                err = br_ip4_multicast_add_group(br, port, group);
                 if (err)
                         break;
         }
@@ -753,24 +979,87 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
         return err;
 }
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int br_ip6_multicast_mld2_report(struct net_bridge *br,
+                                        struct net_bridge_port *port,
+                                        struct sk_buff *skb)
+{
+        struct icmp6hdr *icmp6h;
+        struct mld2_grec *grec;
+        int i;
+        int len;
+        int num;
+        int err = 0;
+
+        if (!pskb_may_pull(skb, sizeof(*icmp6h)))
+                return -EINVAL;
+
+        icmp6h = icmp6_hdr(skb);
+        num = ntohs(icmp6h->icmp6_dataun.un_data16[1]);
+        len = sizeof(*icmp6h);
+
+        for (i = 0; i < num; i++) {
+                __be16 *nsrcs, _nsrcs;
+
+                nsrcs = skb_header_pointer(skb,
+                                           len + offsetof(struct mld2_grec,
+                                                          grec_mca),
+                                           sizeof(_nsrcs), &_nsrcs);
+                if (!nsrcs)
+                        return -EINVAL;
+
+                if (!pskb_may_pull(skb,
+                                   len + sizeof(*grec) +
+                                   sizeof(struct in6_addr) * (*nsrcs)))
+                        return -EINVAL;
+
+                grec = (struct mld2_grec *)(skb->data + len);
+                len += sizeof(*grec) + sizeof(struct in6_addr) * (*nsrcs);
+
+                /* We treat these as MLDv1 reports for now. */
+                switch (grec->grec_type) {
+                case MLD2_MODE_IS_INCLUDE:
+                case MLD2_MODE_IS_EXCLUDE:
+                case MLD2_CHANGE_TO_INCLUDE:
+                case MLD2_CHANGE_TO_EXCLUDE:
+                case MLD2_ALLOW_NEW_SOURCES:
+                case MLD2_BLOCK_OLD_SOURCES:
+                        break;
+
+                default:
+                        continue;
+                }
+
+                err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
+                if (!err)
+                        break;
+        }
+
+        return err;
+}
+#endif
+
+/*
+ * Add port to rotuer_list
+ *  list is maintained ordered by pointer value
+ *  and locked by br->multicast_lock and RCU
+ */
 static void br_multicast_add_router(struct net_bridge *br,
                                     struct net_bridge_port *port)
 {
-        struct hlist_node *p;
-        struct hlist_node **h;
-
-        for (h = &br->router_list.first;
-             (p = *h) &&
-             (unsigned long)container_of(p, struct net_bridge_port, rlist) >
-             (unsigned long)port;
-             h = &p->next)
-                ;
-
-        port->rlist.pprev = h;
-        port->rlist.next = p;
-        rcu_assign_pointer(*h, &port->rlist);
-        if (p)
-                p->pprev = &port->rlist.next;
+        struct net_bridge_port *p;
+        struct hlist_node *n, *slot = NULL;
+
+        hlist_for_each_entry(p, n, &br->router_list, rlist) {
+                if ((unsigned long) port >= (unsigned long) p)
+                        break;
+                slot = n;
+        }
+
+        if (slot)
+                hlist_add_after_rcu(slot, &port->rlist);
+        else
+                hlist_add_head_rcu(&port->rlist, &br->router_list);
 }
 
 static void br_multicast_mark_router(struct net_bridge *br,
@@ -800,7 +1089,7 @@ timer:
 
 static void br_multicast_query_received(struct net_bridge *br,
                                         struct net_bridge_port *port,
-                                        __be32 saddr)
+                                        int saddr)
 {
         if (saddr)
                 mod_timer(&br->multicast_querier_timer,
@@ -811,9 +1100,9 @@ static void br_multicast_query_received(struct net_bridge *br,
         br_multicast_mark_router(br, port);
 }
 
-static int br_multicast_query(struct net_bridge *br,
-                              struct net_bridge_port *port,
-                              struct sk_buff *skb)
+static int br_ip4_multicast_query(struct net_bridge *br,
+                                  struct net_bridge_port *port,
+                                  struct sk_buff *skb)
 {
         struct iphdr *iph = ip_hdr(skb);
         struct igmphdr *ih = igmp_hdr(skb);
@@ -831,7 +1120,7 @@ static int br_multicast_query(struct net_bridge *br,
             (port && port->state == BR_STATE_DISABLED))
                 goto out;
 
-        br_multicast_query_received(br, port, iph->saddr);
+        br_multicast_query_received(br, port, !!iph->saddr);
 
         group = ih->group;
 
@@ -859,7 +1148,7 @@ static int br_multicast_query(struct net_bridge *br,
         if (!group)
                 goto out;
 
-        mp = br_mdb_ip_get(br->mdb, group);
+        mp = br_mdb_ip4_get(br->mdb, group);
         if (!mp)
                 goto out;
 
@@ -883,9 +1172,78 @@ out:
         return err;
 }
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int br_ip6_multicast_query(struct net_bridge *br,
+                                  struct net_bridge_port *port,
+                                  struct sk_buff *skb)
+{
+        struct ipv6hdr *ip6h = ipv6_hdr(skb);
+        struct mld_msg *mld = (struct mld_msg *) icmp6_hdr(skb);
+        struct net_bridge_mdb_entry *mp;
+        struct mld2_query *mld2q;
+        struct net_bridge_port_group *p, **pp;
+        unsigned long max_delay;
+        unsigned long now = jiffies;
+        struct in6_addr *group = NULL;
+        int err = 0;
+
+        spin_lock(&br->multicast_lock);
+        if (!netif_running(br->dev) ||
+            (port && port->state == BR_STATE_DISABLED))
+                goto out;
+
+        br_multicast_query_received(br, port, !ipv6_addr_any(&ip6h->saddr));
+
+        if (skb->len == sizeof(*mld)) {
+                if (!pskb_may_pull(skb, sizeof(*mld))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld = (struct mld_msg *) icmp6_hdr(skb);
+                max_delay = msecs_to_jiffies(htons(mld->mld_maxdelay));
+                if (max_delay)
+                        group = &mld->mld_mca;
+        } else if (skb->len >= sizeof(*mld2q)) {
+                if (!pskb_may_pull(skb, sizeof(*mld2q))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld2q = (struct mld2_query *)icmp6_hdr(skb);
+                if (!mld2q->mld2q_nsrcs)
+                        group = &mld2q->mld2q_mca;
+                max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1;
+        }
+
+        if (!group)
+                goto out;
+
+        mp = br_mdb_ip6_get(br->mdb, group);
+        if (!mp)
+                goto out;
+
+        max_delay *= br->multicast_last_member_count;
+        if (!hlist_unhashed(&mp->mglist) &&
+            (timer_pending(&mp->timer) ?
+             time_after(mp->timer.expires, now + max_delay) :
+             try_to_del_timer_sync(&mp->timer) >= 0))
+                mod_timer(&mp->timer, now + max_delay);
+
+        for (pp = &mp->ports; (p = *pp); pp = &p->next) {
+                if (timer_pending(&p->timer) ?
+                    time_after(p->timer.expires, now + max_delay) :
+                    try_to_del_timer_sync(&p->timer) >= 0)
+                        mod_timer(&mp->timer, now + max_delay);
+        }
+
+out:
+        spin_unlock(&br->multicast_lock);
+        return err;
+}
+#endif
+
 static void br_multicast_leave_group(struct net_bridge *br,
                                      struct net_bridge_port *port,
-                                     __be32 group)
+                                     struct br_ip *group)
 {
         struct net_bridge_mdb_htable *mdb;
         struct net_bridge_mdb_entry *mp;
@@ -893,9 +1251,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
         unsigned long now;
         unsigned long time;
 
-        if (ipv4_is_local_multicast(group))
-                return;
-
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
             (port && port->state == BR_STATE_DISABLED) ||
@@ -946,6 +1301,38 @@ out:
         spin_unlock(&br->multicast_lock);
 }
 
+static void br_ip4_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         __be32 group)
+{
+        struct br_ip br_group;
+
+        if (ipv4_is_local_multicast(group))
+                return;
+
+        br_group.u.ip4 = group;
+        br_group.proto = htons(ETH_P_IP);
+
+        br_multicast_leave_group(br, port, &br_group);
+}
+
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static void br_ip6_multicast_leave_group(struct net_bridge *br,
+                                         struct net_bridge_port *port,
+                                         const struct in6_addr *group)
+{
+        struct br_ip br_group;
+
+        if (ipv6_is_local_multicast(group))
+                return;
+
+        ipv6_addr_copy(&br_group.u.ip6, group);
+        br_group.proto = htons(ETH_P_IPV6);
+
+        br_multicast_leave_group(br, port, &br_group);
+}
+#endif
+
 static int br_multicast_ipv4_rcv(struct net_bridge *br,
                                  struct net_bridge_port *port,
                                  struct sk_buff *skb)
@@ -957,9 +1344,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned offset;
         int err;
 
-        BR_INPUT_SKB_CB(skb)->igmp = 0;
-        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
-
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
                 return -EINVAL;
@@ -1023,16 +1407,16 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         case IGMP_HOST_MEMBERSHIP_REPORT:
         case IGMPV2_HOST_MEMBERSHIP_REPORT:
                 BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
-                err = br_multicast_add_group(br, port, ih->group);
+                err = br_ip4_multicast_add_group(br, port, ih->group);
                 break;
         case IGMPV3_HOST_MEMBERSHIP_REPORT:
-                err = br_multicast_igmp3_report(br, port, skb2);
+                err = br_ip4_multicast_igmp3_report(br, port, skb2);
                 break;
         case IGMP_HOST_MEMBERSHIP_QUERY:
-                err = br_multicast_query(br, port, skb2);
+                err = br_ip4_multicast_query(br, port, skb2);
                 break;
         case IGMP_HOST_LEAVE_MESSAGE:
-                br_multicast_leave_group(br, port, ih->group);
+                br_ip4_multicast_leave_group(br, port, ih->group);
                 break;
         }
 
@@ -1044,15 +1428,139 @@ err_out:
         return err;
 }
 
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+static int br_multicast_ipv6_rcv(struct net_bridge *br,
+                                 struct net_bridge_port *port,
+                                 struct sk_buff *skb)
+{
+        struct sk_buff *skb2 = skb;
+        struct ipv6hdr *ip6h;
+        struct icmp6hdr *icmp6h;
+        u8 nexthdr;
+        unsigned len;
+        unsigned offset;
+        int err;
+
+        if (!pskb_may_pull(skb, sizeof(*ip6h)))
+                return -EINVAL;
+
+        ip6h = ipv6_hdr(skb);
+
+        /*
+         * We're interested in MLD messages only.
+         *  - Version is 6
+         *  - MLD has always Router Alert hop-by-hop option
+         *  - But we do not support jumbrograms.
+         */
+        if (ip6h->version != 6 ||
+            ip6h->nexthdr != IPPROTO_HOPOPTS ||
+            ip6h->payload_len == 0)
+                return 0;
+
+        len = ntohs(ip6h->payload_len);
+        if (skb->len < len)
+                return -EINVAL;
+
+        nexthdr = ip6h->nexthdr;
+        offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
+
+        if (offset < 0 || nexthdr != IPPROTO_ICMPV6)
+                return 0;
+
+        /* Okay, we found ICMPv6 header */
+        skb2 = skb_clone(skb, GFP_ATOMIC);
+        if (!skb2)
+                return -ENOMEM;
+
+        len -= offset - skb_network_offset(skb2);
+
+        __skb_pull(skb2, offset);
+        skb_reset_transport_header(skb2);
+
+        err = -EINVAL;
+        if (!pskb_may_pull(skb2, sizeof(*icmp6h)))
+                goto out;
+
+        icmp6h = icmp6_hdr(skb2);
+
+        switch (icmp6h->icmp6_type) {
+        case ICMPV6_MGM_QUERY:
+        case ICMPV6_MGM_REPORT:
+        case ICMPV6_MGM_REDUCTION:
+        case ICMPV6_MLD2_REPORT:
+                break;
+        default:
+                err = 0;
+                goto out;
+        }
+
+        /* Okay, we found MLD message. Check further. */
+        if (skb2->len > len) {
+                err = pskb_trim_rcsum(skb2, len);
+                if (err)
+                        goto out;
+        }
+
+        switch (skb2->ip_summed) {
+        case CHECKSUM_COMPLETE:
+                if (!csum_fold(skb2->csum))
+                        break;
+                /*FALLTHROUGH*/
+        case CHECKSUM_NONE:
+                skb2->csum = 0;
+                if (skb_checksum_complete(skb2))
+                        goto out;
+        }
+
+        err = 0;
+
+        BR_INPUT_SKB_CB(skb)->igmp = 1;
+
+        switch (icmp6h->icmp6_type) {
+        case ICMPV6_MGM_REPORT:
+            {
+                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
+                err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
+                break;
+            }
+        case ICMPV6_MLD2_REPORT:
+                err = br_ip6_multicast_mld2_report(br, port, skb2);
+                break;
+        case ICMPV6_MGM_QUERY:
+                err = br_ip6_multicast_query(br, port, skb2);
+                break;
+        case ICMPV6_MGM_REDUCTION:
+            {
+                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                br_ip6_multicast_leave_group(br, port, &mld->mld_mca);
+            }
+        }
+
+out:
+        __skb_push(skb2, offset);
+        if (skb2 != skb)
+                kfree_skb(skb2);
+        return err;
+}
+#endif
+
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
                      struct sk_buff *skb)
 {
+        BR_INPUT_SKB_CB(skb)->igmp = 0;
+        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
         if (br->multicast_disabled)
                 return 0;
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 return br_multicast_ipv4_rcv(br, port, skb);
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+        case htons(ETH_P_IPV6):
+                return br_multicast_ipv6_rcv(br, port, skb);
+#endif
         }
 
         return 0;
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 791d4ab0fd4d..3d2d3fe0a97e 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -45,6 +45,17 @@ struct mac_addr
         unsigned char   addr[6];
 };
 
+struct br_ip
+{
+        union {
+                __be32  ip4;
+#if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
+                struct in6_addr ip6;
+#endif
+        } u;
+        __be16          proto;
+};
+
 struct net_bridge_fdb_entry
 {
         struct hlist_node               hlist;
@@ -64,7 +75,7 @@ struct net_bridge_port_group {
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct timer_list               query_timer;
-        __be32                          addr;
+        struct br_ip                    addr;
         u32                             queries_sent;
 };
 
@@ -77,7 +88,7 @@ struct net_bridge_mdb_entry
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct timer_list               query_timer;
-        __be32                          addr;
+        struct br_ip                    addr;
         u32                             queries_sent;
 };
 
@@ -130,19 +141,20 @@ struct net_bridge_port
 #endif
 };
 
+struct br_cpu_netstats {
+        unsigned long   rx_packets;
+        unsigned long   rx_bytes;
+        unsigned long   tx_packets;
+        unsigned long   tx_bytes;
+};
+
 struct net_bridge
 {
         spinlock_t                      lock;
         struct list_head                port_list;
         struct net_device               *dev;
 
-        struct br_cpu_netstats __percpu {
-                unsigned long   rx_packets;
-                unsigned long   rx_bytes;
-                unsigned long   tx_packets;
-                unsigned long   tx_bytes;
-        } *stats;
-
+        struct br_cpu_netstats __percpu *stats;
         spinlock_t                      hash_lock;
         struct hlist_head               hash[BR_HASH_SIZE];
         unsigned long                   feature_mask;
@@ -241,6 +253,8 @@ static inline int br_is_root_bridge(const struct net_bridge *br)
 extern void br_dev_setup(struct net_device *dev);
 extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
                                struct net_device *dev);
+extern bool br_devices_support_netpoll(struct net_bridge *br);
+extern void br_netpoll_cleanup(struct net_device *br_dev);
 
 /* br_fdb.c */
 extern int br_fdb_init(void);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index e84837e1bc86..024fd5bb2d39 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -247,10 +247,10 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
                 switch (caifdev->link_select) {
                 case CAIF_LINK_HIGH_BANDW:
-                        pref = CFPHYPREF_LOW_LAT;
+                        pref = CFPHYPREF_HIGH_BW;
                         break;
                 case CAIF_LINK_LOW_LATENCY:
-                        pref = CFPHYPREF_HIGH_BW;
+                        pref = CFPHYPREF_LOW_LAT;
                         break;
                 default:
                         pref = CFPHYPREF_HIGH_BW;
@@ -330,23 +330,28 @@ int caif_connect_client(struct caif_connect_request *conn_req,
                            struct cflayer *client_layer)
 {
         struct cfctrl_link_param param;
-        if (connect_req_to_link_param(get_caif_conf(), conn_req, &param) == 0)
-                /* Hook up the adaptation layer. */
-                return cfcnfg_add_adaptation_layer(get_caif_conf(),
+        int ret;
+        ret = connect_req_to_link_param(get_caif_conf(), conn_req, &param);
+        if (ret)
+                return ret;
+        /* Hook up the adaptation layer. */
+        return cfcnfg_add_adaptation_layer(get_caif_conf(),
                                                 &param, client_layer);
-
-        return -EINVAL;
-
-        caif_assert(0);
 }
 EXPORT_SYMBOL(caif_connect_client);
 
 int caif_disconnect_client(struct cflayer *adap_layer)
 {
-        return cfcnfg_del_adapt_layer(get_caif_conf(), adap_layer);
+       return cfcnfg_disconn_adapt_layer(get_caif_conf(), adap_layer);
 }
 EXPORT_SYMBOL(caif_disconnect_client);
 
+void caif_release_client(struct cflayer *adap_layer)
+{
+       cfcnfg_release_adap_layer(adap_layer);
+}
+EXPORT_SYMBOL(caif_release_client);
+
 /* Per-namespace Caif devices handling */
 static int caif_init_net(struct net *net)
 {
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index cdf62b9fefac..c3a70c5c893a 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -1,7 +1,6 @@
 /*
  * Copyright (C) ST-Ericsson AB 2010
  * Author:      Sjur Brendeland sjur.brandeland@stericsson.com
- *              Per Sigmond per.sigmond@stericsson.com
  * License terms: GNU General Public License (GPL) version 2
  */
 
@@ -16,91 +15,52 @@
 #include <linux/poll.h>
 #include <linux/tcp.h>
 #include <linux/uaccess.h>
-#include <asm/atomic.h>
-
+#include <linux/mutex.h>
+#include <linux/debugfs.h>
 #include <linux/caif/caif_socket.h>
+#include <asm/atomic.h>
+#include <net/sock.h>
+#include <net/tcp_states.h>
 #include <net/caif/caif_layer.h>
 #include <net/caif/caif_dev.h>
 #include <net/caif/cfpkt.h>
 
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_NETPROTO(AF_CAIF);
+
+#define CAIF_DEF_SNDBUF (CAIF_MAX_PAYLOAD_SIZE*10)
+#define CAIF_DEF_RCVBUF (CAIF_MAX_PAYLOAD_SIZE*100)
+
+/*
+ * CAIF state is re-using the TCP socket states.
+ * caif_states stored in sk_state reflect the state as reported by
+ * the CAIF stack, while sk_socket->state is the state of the socket.
+ */
+enum caif_states {
+        CAIF_CONNECTED          = TCP_ESTABLISHED,
+        CAIF_CONNECTING = TCP_SYN_SENT,
+        CAIF_DISCONNECTED       = TCP_CLOSE
+};
+
+#define TX_FLOW_ON_BIT  1
+#define RX_FLOW_ON_BIT  2
 
-#define CHNL_SKT_READ_QUEUE_HIGH 200
-#define CHNL_SKT_READ_QUEUE_LOW 100
-
-static int caif_sockbuf_size = 40000;
-static atomic_t caif_nr_socks = ATOMIC_INIT(0);
-
-#define CONN_STATE_OPEN_BIT           1
-#define CONN_STATE_PENDING_BIT        2
-#define CONN_STATE_PEND_DESTROY_BIT   3
-#define CONN_REMOTE_SHUTDOWN_BIT      4
-
-#define TX_FLOW_ON_BIT                1
-#define RX_FLOW_ON_BIT                2
-
-#define STATE_IS_OPEN(cf_sk) test_bit(CONN_STATE_OPEN_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-#define STATE_IS_REMOTE_SHUTDOWN(cf_sk) test_bit(CONN_REMOTE_SHUTDOWN_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-#define STATE_IS_PENDING(cf_sk) test_bit(CONN_STATE_PENDING_BIT,\
-                                       (void *) &(cf_sk)->conn_state)
-#define STATE_IS_PENDING_DESTROY(cf_sk) test_bit(CONN_STATE_PEND_DESTROY_BIT,\
-                                       (void *) &(cf_sk)->conn_state)
-
-#define SET_STATE_PENDING_DESTROY(cf_sk) set_bit(CONN_STATE_PEND_DESTROY_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-#define SET_STATE_OPEN(cf_sk) set_bit(CONN_STATE_OPEN_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-#define SET_STATE_CLOSED(cf_sk) clear_bit(CONN_STATE_OPEN_BIT,\
-                                        (void *) &(cf_sk)->conn_state)
-#define SET_PENDING_ON(cf_sk) set_bit(CONN_STATE_PENDING_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-#define SET_PENDING_OFF(cf_sk) clear_bit(CONN_STATE_PENDING_BIT,\
-                                       (void *) &(cf_sk)->conn_state)
-#define SET_REMOTE_SHUTDOWN(cf_sk) set_bit(CONN_REMOTE_SHUTDOWN_BIT,\
-                                    (void *) &(cf_sk)->conn_state)
-
-#define SET_REMOTE_SHUTDOWN_OFF(dev) clear_bit(CONN_REMOTE_SHUTDOWN_BIT,\
-                                    (void *) &(dev)->conn_state)
-#define RX_FLOW_IS_ON(cf_sk) test_bit(RX_FLOW_ON_BIT,\
-                                    (void *) &(cf_sk)->flow_state)
-#define TX_FLOW_IS_ON(cf_sk) test_bit(TX_FLOW_ON_BIT,\
-                                    (void *) &(cf_sk)->flow_state)
-
-#define SET_RX_FLOW_OFF(cf_sk) clear_bit(RX_FLOW_ON_BIT,\
-                                       (void *) &(cf_sk)->flow_state)
-#define SET_RX_FLOW_ON(cf_sk) set_bit(RX_FLOW_ON_BIT,\
-                                    (void *) &(cf_sk)->flow_state)
-#define SET_TX_FLOW_OFF(cf_sk) clear_bit(TX_FLOW_ON_BIT,\
-                                       (void *) &(cf_sk)->flow_state)
-#define SET_TX_FLOW_ON(cf_sk) set_bit(TX_FLOW_ON_BIT,\
-                                    (void *) &(cf_sk)->flow_state)
-
-#define SKT_READ_FLAG 0x01
-#define SKT_WRITE_FLAG 0x02
 static struct dentry *debugfsdir;
-#include <linux/debugfs.h>
 
 #ifdef CONFIG_DEBUG_FS
 struct debug_fs_counter {
-        atomic_t num_open;
-        atomic_t num_close;
-        atomic_t num_init;
-        atomic_t num_init_resp;
-        atomic_t num_init_fail_resp;
-        atomic_t num_deinit;
-        atomic_t num_deinit_resp;
+        atomic_t caif_nr_socks;
+        atomic_t num_connect_req;
+        atomic_t num_connect_resp;
+        atomic_t num_connect_fail_resp;
+        atomic_t num_disconnect;
         atomic_t num_remote_shutdown_ind;
         atomic_t num_tx_flow_off_ind;
         atomic_t num_tx_flow_on_ind;
         atomic_t num_rx_flow_off;
         atomic_t num_rx_flow_on;
-        atomic_t skb_in_use;
-        atomic_t skb_alloc;
-        atomic_t skb_free;
 };
-static struct debug_fs_counter cnt;
+struct debug_fs_counter cnt;
 #define dbfs_atomic_inc(v) atomic_inc(v)
 #define dbfs_atomic_dec(v) atomic_dec(v)
 #else
@@ -108,624 +68,666 @@ static struct debug_fs_counter cnt;
 #define dbfs_atomic_dec(v)
 #endif
 
-/* The AF_CAIF socket */
 struct caifsock {
-        /* NOTE: sk has to be the first member */
-        struct sock sk;
+        struct sock sk; /* must be first member */
         struct cflayer layer;
-        char name[CAIF_LAYER_NAME_SZ];
-        u32 conn_state;
+        char name[CAIF_LAYER_NAME_SZ]; /* Used for debugging */
         u32 flow_state;
-        struct cfpktq *pktq;
-        int file_mode;
         struct caif_connect_request conn_req;
-        int read_queue_len;
-        /* protect updates of read_queue_len */
-        spinlock_t read_queue_len_lock;
+        struct mutex readlock;
         struct dentry *debugfs_socket_dir;
 };
 
-static void drain_queue(struct caifsock *cf_sk);
+static int rx_flow_is_on(struct caifsock *cf_sk)
+{
+        return test_bit(RX_FLOW_ON_BIT,
+                        (void *) &cf_sk->flow_state);
+}
+
+static int tx_flow_is_on(struct caifsock *cf_sk)
+{
+        return test_bit(TX_FLOW_ON_BIT,
+                        (void *) &cf_sk->flow_state);
+}
 
-/* Packet Receive Callback function called from CAIF Stack */
-static int caif_sktrecv_cb(struct cflayer *layr, struct cfpkt *pkt)
+static void set_rx_flow_off(struct caifsock *cf_sk)
 {
-        struct caifsock *cf_sk;
-        int read_queue_high;
-        cf_sk = container_of(layr, struct caifsock, layer);
+         clear_bit(RX_FLOW_ON_BIT,
+                 (void *) &cf_sk->flow_state);
+}
 
-        if (!STATE_IS_OPEN(cf_sk)) {
-                /*FIXME: This should be allowed finally!*/
-                pr_debug("CAIF: %s(): called after close request\n", __func__);
-                cfpkt_destroy(pkt);
-                return 0;
-        }
-        /* NOTE: This function may be called in Tasklet context! */
+static void set_rx_flow_on(struct caifsock *cf_sk)
+{
+         set_bit(RX_FLOW_ON_BIT,
+                        (void *) &cf_sk->flow_state);
+}
 
-        /* The queue has its own lock */
-        cfpkt_queue(cf_sk->pktq, pkt, 0);
+static void set_tx_flow_off(struct caifsock *cf_sk)
+{
+         clear_bit(TX_FLOW_ON_BIT,
+                (void *) &cf_sk->flow_state);
+}
 
-        spin_lock(&cf_sk->read_queue_len_lock);
-        cf_sk->read_queue_len++;
+static void set_tx_flow_on(struct caifsock *cf_sk)
+{
+         set_bit(TX_FLOW_ON_BIT,
+                (void *) &cf_sk->flow_state);
+}
 
-        read_queue_high = (cf_sk->read_queue_len > CHNL_SKT_READ_QUEUE_HIGH);
-        spin_unlock(&cf_sk->read_queue_len_lock);
+static void caif_read_lock(struct sock *sk)
+{
+        struct caifsock *cf_sk;
+        cf_sk = container_of(sk, struct caifsock, sk);
+        mutex_lock(&cf_sk->readlock);
+}
 
-        if (RX_FLOW_IS_ON(cf_sk) && read_queue_high) {
-                dbfs_atomic_inc(&cnt.num_rx_flow_off);
-                SET_RX_FLOW_OFF(cf_sk);
+static void caif_read_unlock(struct sock *sk)
+{
+        struct caifsock *cf_sk;
+        cf_sk = container_of(sk, struct caifsock, sk);
+        mutex_unlock(&cf_sk->readlock);
+}
 
-                /* Send flow off (NOTE: must not sleep) */
-                pr_debug("CAIF: %s():"
-                        " sending flow OFF (queue len = %d)\n",
-                        __func__,
-                     cf_sk->read_queue_len);
-                caif_assert(cf_sk->layer.dn);
-                caif_assert(cf_sk->layer.dn->ctrlcmd);
+int sk_rcvbuf_lowwater(struct caifsock *cf_sk)
+{
+        /* A quarter of full buffer is used a low water mark */
+        return cf_sk->sk.sk_rcvbuf / 4;
+}
 
-                (void) cf_sk->layer.dn->modemcmd(cf_sk->layer.dn,
-                                               CAIF_MODEMCMD_FLOW_OFF_REQ);
-        }
+void caif_flow_ctrl(struct sock *sk, int mode)
+{
+        struct caifsock *cf_sk;
+        cf_sk = container_of(sk, struct caifsock, sk);
+        if (cf_sk->layer.dn)
+                cf_sk->layer.dn->modemcmd(cf_sk->layer.dn, mode);
+}
 
-        /* Signal reader that data is available. */
+/*
+ * Copied from sock.c:sock_queue_rcv_skb(), but changed so packets are
+ * not dropped, but CAIF is sending flow off instead.
+ */
+int caif_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        int err;
+        int skb_len;
+        unsigned long flags;
+        struct sk_buff_head *list = &sk->sk_receive_queue;
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
 
-        wake_up_interruptible(cf_sk->sk.sk_sleep);
+        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+                (unsigned)sk->sk_rcvbuf && rx_flow_is_on(cf_sk)) {
+                trace_printk("CAIF: %s():"
+                        " sending flow OFF (queue len = %d %d)\n",
+                        __func__,
+                        atomic_read(&cf_sk->sk.sk_rmem_alloc),
+                        sk_rcvbuf_lowwater(cf_sk));
+                set_rx_flow_off(cf_sk);
+                if (cf_sk->layer.dn)
+                        cf_sk->layer.dn->modemcmd(cf_sk->layer.dn,
+                                                CAIF_MODEMCMD_FLOW_OFF_REQ);
+        }
 
+        err = sk_filter(sk, skb);
+        if (err)
+                return err;
+        if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
+                set_rx_flow_off(cf_sk);
+                trace_printk("CAIF: %s():"
+                        " sending flow OFF due to rmem_schedule\n",
+                        __func__);
+                if (cf_sk->layer.dn)
+                        cf_sk->layer.dn->modemcmd(cf_sk->layer.dn,
+                                                CAIF_MODEMCMD_FLOW_OFF_REQ);
+        }
+        skb->dev = NULL;
+        skb_set_owner_r(skb, sk);
+        /* Cache the SKB length before we tack it onto the receive
+         * queue. Once it is added it no longer belongs to us and
+         * may be freed by other threads of control pulling packets
+         * from the queue.
+         */
+        skb_len = skb->len;
+        spin_lock_irqsave(&list->lock, flags);
+        if (!sock_flag(sk, SOCK_DEAD))
+                __skb_queue_tail(list, skb);
+        spin_unlock_irqrestore(&list->lock, flags);
+
+        if (!sock_flag(sk, SOCK_DEAD))
+                sk->sk_data_ready(sk, skb_len);
+        else
+                kfree_skb(skb);
         return 0;
 }
 
-/* Packet Flow Control Callback function called from CAIF */
-static void caif_sktflowctrl_cb(struct cflayer *layr,
-                                enum caif_ctrlcmd flow,
-                                int phyid)
+/* Packet Receive Callback function called from CAIF Stack */
+static int caif_sktrecv_cb(struct cflayer *layr, struct cfpkt *pkt)
 {
         struct caifsock *cf_sk;
-
-        /* NOTE: This function may be called in Tasklet context! */
-        pr_debug("CAIF: %s(): flowctrl func called: %s.\n",
-                      __func__,
-                      flow == CAIF_CTRLCMD_FLOW_ON_IND ? "ON" :
-                      flow == CAIF_CTRLCMD_FLOW_OFF_IND ? "OFF" :
-                      flow == CAIF_CTRLCMD_INIT_RSP ? "INIT_RSP" :
-                      flow == CAIF_CTRLCMD_DEINIT_RSP ? "DEINIT_RSP" :
-                      flow == CAIF_CTRLCMD_INIT_FAIL_RSP ? "INIT_FAIL_RSP" :
-                      flow ==
-                      CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND ? "REMOTE_SHUTDOWN" :
-                      "UKNOWN CTRL COMMAND");
-
-        if (layr == NULL)
-                return;
+        struct sk_buff *skb;
 
         cf_sk = container_of(layr, struct caifsock, layer);
+        skb = cfpkt_tonative(pkt);
+
+        if (unlikely(cf_sk->sk.sk_state != CAIF_CONNECTED)) {
+                cfpkt_destroy(pkt);
+                return 0;
+        }
+        caif_queue_rcv_skb(&cf_sk->sk, skb);
+        return 0;
+}
 
+/* Packet Control Callback function called from CAIF */
+static void caif_ctrl_cb(struct cflayer *layr,
+                                enum caif_ctrlcmd flow,
+                                int phyid)
+{
+        struct caifsock *cf_sk = container_of(layr, struct caifsock, layer);
         switch (flow) {
         case CAIF_CTRLCMD_FLOW_ON_IND:
+                /* OK from modem to start sending again */
                 dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
-                /* Signal reader that data is available. */
-                SET_TX_FLOW_ON(cf_sk);
-                wake_up_interruptible(cf_sk->sk.sk_sleep);
+                set_tx_flow_on(cf_sk);
+                cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
         case CAIF_CTRLCMD_FLOW_OFF_IND:
+                /* Modem asks us to shut up */
                 dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
-                SET_TX_FLOW_OFF(cf_sk);
+                set_tx_flow_off(cf_sk);
+                cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
         case CAIF_CTRLCMD_INIT_RSP:
-                dbfs_atomic_inc(&cnt.num_init_resp);
-                /* Signal reader that data is available. */
-                caif_assert(STATE_IS_OPEN(cf_sk));
-                SET_PENDING_OFF(cf_sk);
-                SET_TX_FLOW_ON(cf_sk);
-                wake_up_interruptible(cf_sk->sk.sk_sleep);
+                /* We're now connected */
+                dbfs_atomic_inc(&cnt.num_connect_resp);
+                cf_sk->sk.sk_state = CAIF_CONNECTED;
+                set_tx_flow_on(cf_sk);
+                cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
         case CAIF_CTRLCMD_DEINIT_RSP:
-                dbfs_atomic_inc(&cnt.num_deinit_resp);
-                caif_assert(!STATE_IS_OPEN(cf_sk));
-                SET_PENDING_OFF(cf_sk);
-                if (!STATE_IS_PENDING_DESTROY(cf_sk)) {
-                        if (cf_sk->sk.sk_sleep != NULL)
-                                wake_up_interruptible(cf_sk->sk.sk_sleep);
-                }
-                dbfs_atomic_inc(&cnt.num_deinit);
-                sock_put(&cf_sk->sk);
+                /* We're now disconnected */
+                cf_sk->sk.sk_state = CAIF_DISCONNECTED;
+                cf_sk->sk.sk_state_change(&cf_sk->sk);
+                cfcnfg_release_adap_layer(&cf_sk->layer);
                 break;
 
         case CAIF_CTRLCMD_INIT_FAIL_RSP:
-                dbfs_atomic_inc(&cnt.num_init_fail_resp);
-                caif_assert(STATE_IS_OPEN(cf_sk));
-                SET_STATE_CLOSED(cf_sk);
-                SET_PENDING_OFF(cf_sk);
-                SET_TX_FLOW_OFF(cf_sk);
-                wake_up_interruptible(cf_sk->sk.sk_sleep);
+                /* Connect request failed */
+                dbfs_atomic_inc(&cnt.num_connect_fail_resp);
+                cf_sk->sk.sk_err = ECONNREFUSED;
+                cf_sk->sk.sk_state = CAIF_DISCONNECTED;
+                cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
+                /*
+                 * Socket "standards" seems to require POLLOUT to
+                 * be set at connect failure.
+                 */
+                set_tx_flow_on(cf_sk);
+                cf_sk->sk.sk_state_change(&cf_sk->sk);
                 break;
 
         case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
+                /* Modem has closed this connection, or device is down. */
                 dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
-                SET_REMOTE_SHUTDOWN(cf_sk);
-                /* Use sk_shutdown to indicate remote shutdown indication */
-                cf_sk->sk.sk_shutdown |= RCV_SHUTDOWN;
-                cf_sk->file_mode = 0;
-                wake_up_interruptible(cf_sk->sk.sk_sleep);
+                cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
+                cf_sk->sk.sk_err = ECONNRESET;
+                set_rx_flow_on(cf_sk);
+                cf_sk->sk.sk_error_report(&cf_sk->sk);
                 break;
 
         default:
                 pr_debug("CAIF: %s(): Unexpected flow command %d\n",
-                              __func__, flow);
+                                __func__, flow);
         }
 }
 
-static void skb_destructor(struct sk_buff *skb)
+static void caif_check_flow_release(struct sock *sk)
 {
-        dbfs_atomic_inc(&cnt.skb_free);
-        dbfs_atomic_dec(&cnt.skb_in_use);
-}
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
 
+        if (cf_sk->layer.dn == NULL || cf_sk->layer.dn->modemcmd == NULL)
+                return;
+        if (rx_flow_is_on(cf_sk))
+                return;
 
-static int caif_recvmsg(struct kiocb *iocb, struct socket *sock,
+        if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
+                        dbfs_atomic_inc(&cnt.num_rx_flow_on);
+                        set_rx_flow_on(cf_sk);
+                        cf_sk->layer.dn->modemcmd(cf_sk->layer.dn,
+                                                CAIF_MODEMCMD_FLOW_ON_REQ);
+        }
+}
+/*
+ * Copied from sock.c:sock_queue_rcv_skb(), and added check that user buffer
+ * has sufficient size.
+ */
+
+static int caif_seqpkt_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 struct msghdr *m, size_t buf_len, int flags)
 
 {
         struct sock *sk = sock->sk;
-        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        struct cfpkt *pkt = NULL;
-        size_t len;
-        int result;
         struct sk_buff *skb;
-        ssize_t ret = -EIO;
-        int read_queue_low;
-
-        if (cf_sk == NULL) {
-                pr_debug("CAIF: %s(): private_data not set!\n",
-                              __func__);
-                ret = -EBADFD;
-                goto read_error;
-        }
-
-        /* Don't do multiple iovec entries yet */
-        if (m->msg_iovlen != 1)
-                return -EOPNOTSUPP;
+        int ret = 0;
+        int len;
 
         if (unlikely(!buf_len))
                 return -EINVAL;
 
-        lock_sock(&(cf_sk->sk));
-
-        caif_assert(cf_sk->pktq);
-
-        if (!STATE_IS_OPEN(cf_sk)) {
-                /* Socket is closed or closing. */
-                if (!STATE_IS_PENDING(cf_sk)) {
-                        pr_debug("CAIF: %s(): socket is closed (by remote)\n",
-                                 __func__);
-                        ret = -EPIPE;
-                } else {
-                        pr_debug("CAIF: %s(): socket is closing..\n", __func__);
-                        ret = -EBADF;
-                }
+        skb = skb_recv_datagram(sk, flags, 0 , &ret);
+        if (!skb)
                 goto read_error;
-        }
-        /* Socket is open or opening. */
-        if (STATE_IS_PENDING(cf_sk)) {
-                pr_debug("CAIF: %s(): socket is opening...\n", __func__);
-
-                if (flags & MSG_DONTWAIT) {
-                        /* We can't block. */
-                        pr_debug("CAIF: %s():state pending and MSG_DONTWAIT\n",
-                                 __func__);
-                        ret = -EAGAIN;
-                        goto read_error;
-                }
 
+        len = skb->len;
+
+        if (skb && skb->len > buf_len && !(flags & MSG_PEEK)) {
+                len = buf_len;
                 /*
-                 * Blocking mode; state is pending and we need to wait
-                 * for its conclusion.
+                 * Push skb back on receive queue if buffer too small.
+                 * This has a built-in race where multi-threaded receive
+                 * may get packet in wrong order, but multiple read does
+                 * not really guarantee ordered delivery anyway.
+                 * Let's optimize for speed without taking locks.
                  */
-                release_sock(&cf_sk->sk);
-
-                result =
-                    wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                             !STATE_IS_PENDING(cf_sk));
 
-                lock_sock(&(cf_sk->sk));
-
-                if (result == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s(): wait_event_interruptible"
-                                 " woken by a signal (1)", __func__);
-                        ret = -ERESTARTSYS;
-                        goto read_error;
-                }
+                skb_queue_head(&sk->sk_receive_queue, skb);
+                ret = -EMSGSIZE;
+                goto read_error;
         }
 
-        if (STATE_IS_REMOTE_SHUTDOWN(cf_sk) ||
-                !STATE_IS_OPEN(cf_sk) ||
-                STATE_IS_PENDING(cf_sk)) {
-
-                pr_debug("CAIF: %s(): socket closed\n",
-                        __func__);
-                ret = -ESHUTDOWN;
+        ret = skb_copy_datagram_iovec(skb, 0, m->msg_iov, len);
+        if (ret)
                 goto read_error;
-        }
 
-        /*
-         * Block if we don't have any received buffers.
-         * The queue has its own lock.
-         */
-        while ((pkt = cfpkt_qpeek(cf_sk->pktq)) == NULL) {
+        skb_free_datagram(sk, skb);
 
-                if (flags & MSG_DONTWAIT) {
-                        pr_debug("CAIF: %s(): MSG_DONTWAIT\n", __func__);
-                        ret = -EAGAIN;
-                        goto read_error;
-                }
-                trace_printk("CAIF: %s() wait_event\n", __func__);
+        caif_check_flow_release(sk);
 
-                /* Let writers in. */
-                release_sock(&cf_sk->sk);
+        return len;
 
-                /* Block reader until data arrives or socket is closed. */
-                if (wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                        cfpkt_qpeek(cf_sk->pktq)
-                                        || STATE_IS_REMOTE_SHUTDOWN(cf_sk)
-                                        || !STATE_IS_OPEN(cf_sk)) ==
-                    -ERESTARTSYS) {
-                        pr_debug("CAIF: %s():"
-                                " wait_event_interruptible woken by "
-                                "a signal, signal_pending(current) = %d\n",
-                                __func__,
-                                signal_pending(current));
-                        return -ERESTARTSYS;
-                }
+read_error:
+        return ret;
+}
 
-                trace_printk("CAIF: %s() awake\n", __func__);
-                if (STATE_IS_REMOTE_SHUTDOWN(cf_sk)) {
-                        pr_debug("CAIF: %s(): "
-                                 "received remote_shutdown indication\n",
-                                 __func__);
-                        ret = -ESHUTDOWN;
-                        goto read_error_no_unlock;
-                }
 
-                /* I want to be alone on cf_sk (except status and queue). */
-                lock_sock(&(cf_sk->sk));
+/* Copied from unix_stream_wait_data, identical except for lock call. */
+static long caif_stream_data_wait(struct sock *sk, long timeo)
+{
+        DEFINE_WAIT(wait);
+        lock_sock(sk);
+
+        for (;;) {
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+
+                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                        sk->sk_err ||
+                        sk->sk_state != CAIF_CONNECTED ||
+                        sock_flag(sk, SOCK_DEAD) ||
+                        (sk->sk_shutdown & RCV_SHUTDOWN) ||
+                        signal_pending(current) ||
+                        !timeo)
+                        break;
 
-                if (!STATE_IS_OPEN(cf_sk)) {
-                        /* Someone closed the link, report error. */
-                        pr_debug("CAIF: %s(): remote end shutdown!\n",
-                                      __func__);
-                        ret = -EPIPE;
-                        goto read_error;
-                }
+                set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
+                release_sock(sk);
+                timeo = schedule_timeout(timeo);
+                lock_sock(sk);
+                clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
-        /* The queue has its own lock. */
-        len = cfpkt_getlen(pkt);
-
-        /* Check max length that can be copied. */
-        if (len <= buf_len)
-                pkt = cfpkt_dequeue(cf_sk->pktq);
-        else {
-                pr_debug("CAIF: %s(): user buffer too small (%ld,%ld)\n",
-                         __func__, (long) len, (long) buf_len);
-                if (sock->type == SOCK_SEQPACKET) {
-                        ret = -EMSGSIZE;
-                        goto read_error;
-                }
-                len = buf_len;
-        }
+        finish_wait(sk_sleep(sk), &wait);
+        release_sock(sk);
+        return timeo;
+}
 
 
-        spin_lock(&cf_sk->read_queue_len_lock);
-        cf_sk->read_queue_len--;
-        read_queue_low = (cf_sk->read_queue_len < CHNL_SKT_READ_QUEUE_LOW);
-        spin_unlock(&cf_sk->read_queue_len_lock);
+/*
+ * Copied from unix_stream_recvmsg, but removed credit checks,
+ * changed locking calls, changed address handling.
+ */
+static int caif_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
+                                struct msghdr *msg, size_t size,
+                                int flags)
+{
+        struct sock *sk = sock->sk;
+        int copied = 0;
+        int target;
+        int err = 0;
+        long timeo;
 
-        if (!RX_FLOW_IS_ON(cf_sk) && read_queue_low) {
-                dbfs_atomic_inc(&cnt.num_rx_flow_on);
-                SET_RX_FLOW_ON(cf_sk);
+        err = -EOPNOTSUPP;
+        if (flags&MSG_OOB)
+                goto out;
 
-                /* Send flow on. */
-                pr_debug("CAIF: %s(): sending flow ON (queue len = %d)\n",
-                         __func__, cf_sk->read_queue_len);
-                caif_assert(cf_sk->layer.dn);
-                caif_assert(cf_sk->layer.dn->ctrlcmd);
-                (void) cf_sk->layer.dn->modemcmd(cf_sk->layer.dn,
-                                               CAIF_MODEMCMD_FLOW_ON_REQ);
+        msg->msg_namelen = 0;
 
-                caif_assert(cf_sk->read_queue_len >= 0);
-        }
+        /*
+         * Lock the socket to prevent queue disordering
+         * while sleeps in memcpy_tomsg
+         */
+        err = -EAGAIN;
+        if (sk->sk_state == CAIF_CONNECTING)
+                goto out;
 
-        skb = cfpkt_tonative(pkt);
-        result = skb_copy_datagram_iovec(skb, 0, m->msg_iov, len);
-        skb_pull(skb, len);
+        caif_read_lock(sk);
+        target = sock_rcvlowat(sk, flags&MSG_WAITALL, size);
+        timeo = sock_rcvtimeo(sk, flags&MSG_DONTWAIT);
 
-        if (result) {
-                pr_debug("CAIF: %s(): copy to_iovec failed\n", __func__);
-                cfpkt_destroy(pkt);
-                ret = -EFAULT;
-                goto read_error;
-        }
+        do {
+                int chunk;
+                struct sk_buff *skb;
 
-        /* Free packet and remove from queue */
-        if (skb->len == 0)
-                skb_free_datagram(sk, skb);
+                lock_sock(sk);
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                caif_check_flow_release(sk);
 
-        /* Let the others in. */
-        release_sock(&cf_sk->sk);
-        return len;
+                if (skb == NULL) {
+                        if (copied >= target)
+                                goto unlock;
+                        /*
+                         *      POSIX 1003.1g mandates this order.
+                         */
+                        err = sock_error(sk);
+                        if (err)
+                                goto unlock;
+                        err = -ECONNRESET;
+                        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                                goto unlock;
 
-read_error:
-        release_sock(&cf_sk->sk);
-read_error_no_unlock:
-        return ret;
-}
+                        err = -EPIPE;
+                        if (sk->sk_state != CAIF_CONNECTED)
+                                goto unlock;
+                        if (sock_flag(sk, SOCK_DEAD))
+                                goto unlock;
 
-/* Send a signal as a consequence of sendmsg, sendto or caif_sendmsg. */
-static int caif_sendmsg(struct kiocb *kiocb, struct socket *sock,
-                        struct msghdr *msg, size_t len)
-{
+                        release_sock(sk);
 
-        struct sock *sk = sock->sk;
-        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        size_t payload_size = msg->msg_iov->iov_len;
-        struct cfpkt *pkt = NULL;
-        struct caif_payload_info info;
-        unsigned char *txbuf;
-        ssize_t ret = -EIO;
-        int result;
-        struct sk_buff *skb;
-        caif_assert(msg->msg_iovlen == 1);
+                        err = -EAGAIN;
+                        if (!timeo)
+                                break;
 
-        if (cf_sk == NULL) {
-                pr_debug("CAIF: %s(): private_data not set!\n",
-                              __func__);
-                ret = -EBADFD;
-                goto write_error_no_unlock;
-        }
+                        caif_read_unlock(sk);
 
-        if (unlikely(msg->msg_iov->iov_base == NULL)) {
-                pr_warning("CAIF: %s(): Buffer is NULL.\n", __func__);
-                ret = -EINVAL;
-                goto write_error_no_unlock;
-        }
+                        timeo = caif_stream_data_wait(sk, timeo);
 
-        if (payload_size > CAIF_MAX_PAYLOAD_SIZE) {
-                pr_debug("CAIF: %s(): buffer too long\n", __func__);
-                if (sock->type == SOCK_SEQPACKET) {
-                        ret = -EINVAL;
-                        goto write_error_no_unlock;
+                        if (signal_pending(current)) {
+                                err = sock_intr_errno(timeo);
+                                goto out;
+                        }
+                        caif_read_lock(sk);
+                        continue;
+unlock:
+                        release_sock(sk);
+                        break;
                 }
-                payload_size = CAIF_MAX_PAYLOAD_SIZE;
-        }
+                release_sock(sk);
+                chunk = min_t(unsigned int, skb->len, size);
+                if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        if (copied == 0)
+                                copied = -EFAULT;
+                        break;
+                }
+                copied += chunk;
+                size -= chunk;
 
-        /* I want to be alone on cf_sk (except status and queue) */
-        lock_sock(&(cf_sk->sk));
+                /* Mark read part of skb as used */
+                if (!(flags & MSG_PEEK)) {
+                        skb_pull(skb, chunk);
 
-        caif_assert(cf_sk->pktq);
+                        /* put the skb back if we didn't use it up. */
+                        if (skb->len) {
+                                skb_queue_head(&sk->sk_receive_queue, skb);
+                                break;
+                        }
+                        kfree_skb(skb);
 
-        if (!STATE_IS_OPEN(cf_sk)) {
-                /* Socket is closed or closing */
-                if (!STATE_IS_PENDING(cf_sk)) {
-                        pr_debug("CAIF: %s(): socket is closed (by remote)\n",
-                                 __func__);
-                        ret = -EPIPE;
                 } else {
-                        pr_debug("CAIF: %s(): socket is closing...\n",
-                                 __func__);
-                        ret = -EBADF;
-                }
-                goto write_error;
-        }
-
-        /* Socket is open or opening */
-        if (STATE_IS_PENDING(cf_sk)) {
-                pr_debug("CAIF: %s(): socket is opening...\n", __func__);
-
-                if (msg->msg_flags & MSG_DONTWAIT) {
-                        /* We can't block */
-                        trace_printk("CAIF: %s():state pending:"
-                                     "state=MSG_DONTWAIT\n", __func__);
-                        ret = -EAGAIN;
-                        goto write_error;
+                        /*
+                         * It is questionable, see note in unix_dgram_recvmsg.
+                         */
+                        /* put message back and return */
+                        skb_queue_head(&sk->sk_receive_queue, skb);
+                        break;
                 }
-                /* Let readers in */
-                release_sock(&cf_sk->sk);
-
-                /*
-                 * Blocking mode; state is pending and we need to wait
-                 * for its conclusion.
-                 */
-                result =
-                    wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                             !STATE_IS_PENDING(cf_sk));
-                /* I want to be alone on cf_sk (except status and queue) */
-                lock_sock(&(cf_sk->sk));
+        } while (size);
+        caif_read_unlock(sk);
 
-                if (result == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s(): wait_event_interruptible"
-                                 " woken by a signal (1)", __func__);
-                        ret = -ERESTARTSYS;
-                        goto write_error;
-                }
-        }
-        if (STATE_IS_REMOTE_SHUTDOWN(cf_sk) ||
-                !STATE_IS_OPEN(cf_sk) ||
-                STATE_IS_PENDING(cf_sk)) {
+out:
+        return copied ? : err;
+}
 
-                pr_debug("CAIF: %s(): socket closed\n",
-                        __func__);
-                ret = -ESHUTDOWN;
-                goto write_error;
+/*
+ * Copied from sock.c:sock_wait_for_wmem, but change to wait for
+ * CAIF flow-on and sock_writable.
+ */
+static long caif_wait_for_flow_on(struct caifsock *cf_sk,
+                                int wait_writeable, long timeo, int *err)
+{
+        struct sock *sk = &cf_sk->sk;
+        DEFINE_WAIT(wait);
+        for (;;) {
+                *err = 0;
+                if (tx_flow_is_on(cf_sk) &&
+                        (!wait_writeable || sock_writeable(&cf_sk->sk)))
+                        break;
+                *err = -ETIMEDOUT;
+                if (!timeo)
+                        break;
+                *err = -ERESTARTSYS;
+                if (signal_pending(current))
+                        break;
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
+                *err = -ECONNRESET;
+                if (sk->sk_shutdown & SHUTDOWN_MASK)
+                        break;
+                *err = -sk->sk_err;
+                if (sk->sk_err)
+                        break;
+                *err = -EPIPE;
+                if (cf_sk->sk.sk_state != CAIF_CONNECTED)
+                        break;
+                timeo = schedule_timeout(timeo);
         }
+        finish_wait(sk_sleep(sk), &wait);
+        return timeo;
+}
 
-        if (!TX_FLOW_IS_ON(cf_sk)) {
+/*
+ * Transmit a SKB. The device may temporarily request re-transmission
+ * by returning EAGAIN.
+ */
+static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
+                        int noblock, long timeo)
+{
+        struct cfpkt *pkt;
+        int ret, loopcnt = 0;
 
-                /* Flow is off. Check non-block flag */
-                if (msg->msg_flags & MSG_DONTWAIT) {
-                        trace_printk("CAIF: %s(): MSG_DONTWAIT and tx flow off",
-                                 __func__);
-                        ret = -EAGAIN;
-                        goto write_error;
-                }
+        pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
+        memset(cfpkt_info(pkt), 0, sizeof(struct caif_payload_info));
+        do {
 
-                /* release lock before waiting */
-                release_sock(&cf_sk->sk);
+                ret = -ETIMEDOUT;
 
-                /* Wait until flow is on or socket is closed */
-                if (wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                        TX_FLOW_IS_ON(cf_sk)
-                                        || !STATE_IS_OPEN(cf_sk)
-                                        || STATE_IS_REMOTE_SHUTDOWN(cf_sk)
-                                        ) == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s():"
-                                 " wait_event_interruptible woken by a signal",
-                                 __func__);
-                        ret = -ERESTARTSYS;
-                        goto write_error_no_unlock;
+                /* Slight paranoia, probably not needed. */
+                if (unlikely(loopcnt++ > 1000)) {
+                        pr_warning("CAIF: %s(): transmit retries failed,"
+                                " error = %d\n", __func__, ret);
+                        break;
                 }
 
-                /* I want to be alone on cf_sk (except status and queue) */
-                lock_sock(&(cf_sk->sk));
-
-                if (!STATE_IS_OPEN(cf_sk)) {
-                        /* someone closed the link, report error */
-                        pr_debug("CAIF: %s(): remote end shutdown!\n",
-                                      __func__);
-                        ret = -EPIPE;
-                        goto write_error;
+                if (cf_sk->layer.dn != NULL)
+                        ret = cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
+                if (likely(ret >= 0))
+                        break;
+                /* if transmit return -EAGAIN, then retry */
+                if (noblock && ret == -EAGAIN)
+                        break;
+                timeo = caif_wait_for_flow_on(cf_sk, 0, timeo, &ret);
+                if (signal_pending(current)) {
+                        ret = sock_intr_errno(timeo);
+                        break;
                 }
-
-                if (STATE_IS_REMOTE_SHUTDOWN(cf_sk)) {
-                        pr_debug("CAIF: %s(): "
-                                 "received remote_shutdown indication\n",
-                                 __func__);
-                        ret = -ESHUTDOWN;
-                        goto write_error;
+                if (ret)
+                        break;
+                if (cf_sk->sk.sk_state != CAIF_CONNECTED ||
+                        sock_flag(&cf_sk->sk, SOCK_DEAD) ||
+                        (cf_sk->sk.sk_shutdown & RCV_SHUTDOWN)) {
+                        ret = -EPIPE;
+                        cf_sk->sk.sk_err = EPIPE;
+                        break;
                 }
-        }
+        } while (ret == -EAGAIN);
+        return ret;
+}
 
-        pkt = cfpkt_create(payload_size);
-        skb = (struct sk_buff *)pkt;
-        skb->destructor = skb_destructor;
-        skb->sk = sk;
-        dbfs_atomic_inc(&cnt.skb_alloc);
-        dbfs_atomic_inc(&cnt.skb_in_use);
-        if (cfpkt_raw_append(pkt, (void **) &txbuf, payload_size) < 0) {
-                pr_debug("CAIF: %s(): cfpkt_raw_append failed\n", __func__);
-                cfpkt_destroy(pkt);
-                ret = -EINVAL;
-                goto write_error;
-        }
+/* Copied from af_unix:unix_dgram_sendmsg, and adapted to CAIF */
+static int caif_seqpkt_sendmsg(struct kiocb *kiocb, struct socket *sock,
+                        struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        int buffer_size;
+        int ret = 0;
+        struct sk_buff *skb = NULL;
+        int noblock;
+        long timeo;
+        caif_assert(cf_sk);
+        ret = sock_error(sk);
+        if (ret)
+                goto err;
+
+        ret = -EOPNOTSUPP;
+        if (msg->msg_flags&MSG_OOB)
+                goto err;
+
+        ret = -EOPNOTSUPP;
+        if (msg->msg_namelen)
+                goto err;
+
+        ret = -EINVAL;
+        if (unlikely(msg->msg_iov->iov_base == NULL))
+                goto err;
+        noblock = msg->msg_flags & MSG_DONTWAIT;
+
+        buffer_size = len + CAIF_NEEDED_HEADROOM + CAIF_NEEDED_TAILROOM;
+
+        ret = -EMSGSIZE;
+        if (buffer_size > CAIF_MAX_PAYLOAD_SIZE)
+                goto err;
+
+        timeo = sock_sndtimeo(sk, noblock);
+        timeo = caif_wait_for_flow_on(container_of(sk, struct caifsock, sk),
+                                1, timeo, &ret);
+
+        ret = -EPIPE;
+        if (cf_sk->sk.sk_state != CAIF_CONNECTED ||
+                sock_flag(sk, SOCK_DEAD) ||
+                (sk->sk_shutdown & RCV_SHUTDOWN))
+                goto err;
+
+        ret = -ENOMEM;
+        skb = sock_alloc_send_skb(sk, buffer_size, noblock, &ret);
+        if (!skb)
+                goto err;
+        skb_reserve(skb, CAIF_NEEDED_HEADROOM);
+
+        ret = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+
+        if (ret)
+                goto err;
+        ret = transmit_skb(skb, cf_sk, noblock, timeo);
+        if (ret < 0)
+                goto err;
+        return len;
+err:
+        kfree_skb(skb);
+        return ret;
+}
 
-        /* Copy data into buffer. */
-        if (copy_from_user(txbuf, msg->msg_iov->iov_base, payload_size)) {
-                pr_debug("CAIF: %s(): copy_from_user returned non zero.\n",
-                         __func__);
-                cfpkt_destroy(pkt);
-                ret = -EINVAL;
-                goto write_error;
-        }
-        memset(&info, 0, sizeof(info));
+/*
+ * Copied from unix_stream_sendmsg and adapted to CAIF:
+ * Changed removed permission handling and added waiting for flow on
+ * and other minor adaptations.
+ */
+static int caif_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
+                                struct msghdr *msg, size_t len)
+{
+        struct sock *sk = sock->sk;
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        int err, size;
+        struct sk_buff *skb;
+        int sent = 0;
+        long timeo;
 
-        /* Send the packet down the stack. */
-        caif_assert(cf_sk->layer.dn);
-        caif_assert(cf_sk->layer.dn->transmit);
+        err = -EOPNOTSUPP;
 
-        do {
-                ret = cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
+        if (unlikely(msg->msg_flags&MSG_OOB))
+                goto out_err;
 
-                if (likely((ret >= 0) || (ret != -EAGAIN)))
-                        break;
+        if (unlikely(msg->msg_namelen))
+                goto out_err;
 
-                /* EAGAIN - retry */
-                if (msg->msg_flags & MSG_DONTWAIT) {
-                        pr_debug("CAIF: %s(): NONBLOCK and transmit failed,"
-                                 " error = %ld\n", __func__, (long) ret);
-                        ret = -EAGAIN;
-                        goto write_error;
-                }
+        timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
+        timeo = caif_wait_for_flow_on(cf_sk, 1, timeo, &err);
 
-                /* Let readers in */
-                release_sock(&cf_sk->sk);
+        if (unlikely(sk->sk_shutdown & SEND_SHUTDOWN))
+                goto pipe_err;
 
-                /* Wait until flow is on or socket is closed */
-                if (wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                        TX_FLOW_IS_ON(cf_sk)
-                                        || !STATE_IS_OPEN(cf_sk)
-                                        || STATE_IS_REMOTE_SHUTDOWN(cf_sk)
-                                        ) == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s(): wait_event_interruptible"
-                                 " woken by a signal", __func__);
-                        ret = -ERESTARTSYS;
-                        goto write_error_no_unlock;
-                }
+        while (sent < len) {
 
-                /* I want to be alone on cf_sk (except status and queue) */
-                lock_sock(&(cf_sk->sk));
+                size = len-sent;
 
-        } while (ret == -EAGAIN);
+                if (size > CAIF_MAX_PAYLOAD_SIZE)
+                        size = CAIF_MAX_PAYLOAD_SIZE;
 
-        if (ret < 0) {
-                cfpkt_destroy(pkt);
-                pr_debug("CAIF: %s(): transmit failed, error = %ld\n",
-                         __func__, (long) ret);
+                /* If size is more than half of sndbuf, chop up message */
+                if (size > ((sk->sk_sndbuf >> 1) - 64))
+                        size = (sk->sk_sndbuf >> 1) - 64;
 
-                goto write_error;
-        }
+                if (size > SKB_MAX_ALLOC)
+                        size = SKB_MAX_ALLOC;
 
-        release_sock(&cf_sk->sk);
-        return payload_size;
+                skb = sock_alloc_send_skb(sk,
+                                        size + CAIF_NEEDED_HEADROOM
+                                        + CAIF_NEEDED_TAILROOM,
+                                        msg->msg_flags&MSG_DONTWAIT,
+                                        &err);
+                if (skb == NULL)
+                        goto out_err;
 
-write_error:
-        release_sock(&cf_sk->sk);
-write_error_no_unlock:
-        return ret;
-}
+                skb_reserve(skb, CAIF_NEEDED_HEADROOM);
+                /*
+                 *      If you pass two values to the sock_alloc_send_skb
+                 *      it tries to grab the large buffer with GFP_NOFS
+                 *      (which can fail easily), and if it fails grab the
+                 *      fallback size buffer which is under a page and will
+                 *      succeed. [Alan]
+                 */
+                size = min_t(int, size, skb_tailroom(skb));
 
-static unsigned int caif_poll(struct file *file, struct socket *sock,
-                                                poll_table *wait)
-{
-        struct sock *sk = sock->sk;
-        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
-        u32 mask = 0;
-        poll_wait(file, sk->sk_sleep, wait);
-        lock_sock(&(cf_sk->sk));
-        if (!STATE_IS_OPEN(cf_sk)) {
-                if (!STATE_IS_PENDING(cf_sk))
-                        mask |= POLLHUP;
-        } else {
-                if (cfpkt_qpeek(cf_sk->pktq) != NULL)
-                        mask |= (POLLIN | POLLRDNORM);
-                if (TX_FLOW_IS_ON(cf_sk))
-                        mask |= (POLLOUT | POLLWRNORM);
+                err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
+                if (err) {
+                        kfree_skb(skb);
+                        goto out_err;
+                }
+                err = transmit_skb(skb, cf_sk,
+                                msg->msg_flags&MSG_DONTWAIT, timeo);
+                if (err < 0) {
+                        kfree_skb(skb);
+                        goto pipe_err;
+                }
+                sent += size;
         }
-        release_sock(&cf_sk->sk);
-        trace_printk("CAIF: %s(): poll mask=0x%04x\n",
-                      __func__, mask);
-        return mask;
-}
-
-static void drain_queue(struct caifsock *cf_sk)
-{
-        struct cfpkt *pkt = NULL;
-
-        /* Empty the queue */
-        do {
-                /* The queue has its own lock */
-                if (!cf_sk->pktq)
-                        break;
-
-                pkt = cfpkt_dequeue(cf_sk->pktq);
-                if (!pkt)
-                        break;
-                pr_debug("CAIF: %s(): freeing packet from read queue\n",
-                         __func__);
-                cfpkt_destroy(pkt);
 
-        } while (1);
+        return sent;
 
-        cf_sk->read_queue_len = 0;
+pipe_err:
+        if (sent == 0 && !(msg->msg_flags&MSG_NOSIGNAL))
+                send_sig(SIGPIPE, current, 0);
+        err = -EPIPE;
+out_err:
+        return sent ? : err;
 }
 
 static int setsockopt(struct socket *sock,
@@ -736,19 +738,13 @@ static int setsockopt(struct socket *sock,
         int prio, linksel;
         struct ifreq ifreq;
 
-        if (STATE_IS_OPEN(cf_sk)) {
-                pr_debug("CAIF: %s(): setsockopt "
-                         "cannot be done on a connected socket\n",
-                         __func__);
+        if (cf_sk->sk.sk_socket->state != SS_UNCONNECTED)
                 return -ENOPROTOOPT;
-        }
+
         switch (opt) {
         case CAIFSO_LINK_SELECT:
-                if (ol < sizeof(int)) {
-                        pr_debug("CAIF: %s(): setsockopt"
-                                 " CAIFSO_CHANNEL_CONFIG bad size\n", __func__);
+                if (ol < sizeof(int))
                         return -EINVAL;
-                }
                 if (lvl != SOL_CAIF)
                         goto bad_sol;
                 if (copy_from_user(&linksel, ov, sizeof(int)))
@@ -761,28 +757,20 @@ static int setsockopt(struct socket *sock,
         case SO_PRIORITY:
                 if (lvl != SOL_SOCKET)
                         goto bad_sol;
-                if (ol < sizeof(int)) {
-                        pr_debug("CAIF: %s(): setsockopt"
-                                 " SO_PRIORITY bad size\n", __func__);
+                if (ol < sizeof(int))
                         return -EINVAL;
-                }
                 if (copy_from_user(&prio, ov, sizeof(int)))
                         return -EINVAL;
                 lock_sock(&(cf_sk->sk));
                 cf_sk->conn_req.priority = prio;
-                pr_debug("CAIF: %s(): Setting sockopt priority=%d\n", __func__,
-                        cf_sk->conn_req.priority);
                 release_sock(&cf_sk->sk);
                 return 0;
 
         case SO_BINDTODEVICE:
                 if (lvl != SOL_SOCKET)
                         goto bad_sol;
-                if (ol < sizeof(struct ifreq)) {
-                        pr_debug("CAIF: %s(): setsockopt"
-                                 " SO_PRIORITY bad size\n", __func__);
+                if (ol < sizeof(struct ifreq))
                         return -EINVAL;
-                }
                 if (copy_from_user(&ifreq, ov, sizeof(ifreq)))
                         return -EFAULT;
                 lock_sock(&(cf_sk->sk));
@@ -798,359 +786,275 @@ static int setsockopt(struct socket *sock,
                         goto bad_sol;
                 if (cf_sk->sk.sk_protocol != CAIFPROTO_UTIL)
                         return -ENOPROTOOPT;
-                if (ol > sizeof(cf_sk->conn_req.param.data))
-                        goto req_param_bad_size;
-
                 lock_sock(&(cf_sk->sk));
                 cf_sk->conn_req.param.size = ol;
-                if (copy_from_user(&cf_sk->conn_req.param.data, ov, ol)) {
+                if (ol > sizeof(cf_sk->conn_req.param.data) ||
+                        copy_from_user(&cf_sk->conn_req.param.data, ov, ol)) {
                         release_sock(&cf_sk->sk);
-req_param_bad_size:
-                        pr_debug("CAIF: %s(): setsockopt"
-                                 " CAIFSO_CHANNEL_CONFIG bad size\n", __func__);
                         return -EINVAL;
                 }
-
                 release_sock(&cf_sk->sk);
                 return 0;
 
         default:
-                pr_debug("CAIF: %s(): unhandled option %d\n", __func__, opt);
-                return -EINVAL;
+                return -ENOPROTOOPT;
         }
 
         return 0;
 bad_sol:
-        pr_debug("CAIF: %s(): setsockopt bad level\n", __func__);
         return -ENOPROTOOPT;
 
 }
 
-static int caif_connect(struct socket *sock, struct sockaddr *uservaddr,
-               int sockaddr_len, int flags)
+/*
+ * caif_connect() - Connect a CAIF Socket
+ * Copied and modified af_irda.c:irda_connect().
+ *
+ * Note : by consulting "errno", the user space caller may learn the cause
+ * of the failure. Most of them are visible in the function, others may come
+ * from subroutines called and are listed here :
+ *  o -EAFNOSUPPORT: bad socket family or type.
+ *  o -ESOCKTNOSUPPORT: bad socket type or protocol
+ *  o -EINVAL: bad socket address, or CAIF link type
+ *  o -ECONNREFUSED: remote end refused the connection.
+ *  o -EINPROGRESS: connect request sent but timed out (or non-blocking)
+ *  o -EISCONN: already connected.
+ *  o -ETIMEDOUT: Connection timed out (send timeout)
+ *  o -ENODEV: No link layer to send request
+ *  o -ECONNRESET: Received Shutdown indication or lost link layer
+ *  o -ENOMEM: Out of memory
+ *
+ *  State Strategy:
+ *  o sk_state: holds the CAIF_* protocol state, it's updated by
+ *      caif_ctrl_cb.
+ *  o sock->state: holds the SS_* socket state and is updated by connect and
+ *      disconnect.
+ */
+static int caif_connect(struct socket *sock, struct sockaddr *uaddr,
+                        int addr_len, int flags)
 {
-        struct caifsock *cf_sk = NULL;
-        int result = -1;
-        int mode = 0;
-        int ret = -EIO;
         struct sock *sk = sock->sk;
-        BUG_ON(sk == NULL);
-
-        cf_sk = container_of(sk, struct caifsock, sk);
-
-        trace_printk("CAIF: %s(): cf_sk=%p OPEN=%d, TX_FLOW=%d, RX_FLOW=%d\n",
-                 __func__, cf_sk,
-                STATE_IS_OPEN(cf_sk),
-                TX_FLOW_IS_ON(cf_sk), RX_FLOW_IS_ON(cf_sk));
-
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        long timeo;
+        int err;
+        lock_sock(sk);
 
-        if (sock->type == SOCK_SEQPACKET || sock->type == SOCK_STREAM)
-                sock->state     = SS_CONNECTING;
-        else
+        err = -EAFNOSUPPORT;
+        if (uaddr->sa_family != AF_CAIF)
                 goto out;
 
-        /* I want to be alone on cf_sk (except status and queue) */
-        lock_sock(&(cf_sk->sk));
-
-        if (sockaddr_len != sizeof(struct sockaddr_caif)) {
-                pr_debug("CAIF: %s(): Bad address len (%ld,%lu)\n",
-                         __func__, (long) sockaddr_len,
-                        (long unsigned) sizeof(struct sockaddr_caif));
-                ret = -EINVAL;
-                goto open_error;
+        err = -ESOCKTNOSUPPORT;
+        if (unlikely(!(sk->sk_type == SOCK_STREAM &&
+                       cf_sk->sk.sk_protocol == CAIFPROTO_AT) &&
+                       sk->sk_type != SOCK_SEQPACKET))
+                goto out;
+        switch (sock->state) {
+        case SS_UNCONNECTED:
+                /* Normal case, a fresh connect */
+                caif_assert(sk->sk_state == CAIF_DISCONNECTED);
+                break;
+        case SS_CONNECTING:
+                switch (sk->sk_state) {
+                case CAIF_CONNECTED:
+                        sock->state = SS_CONNECTED;
+                        err = -EISCONN;
+                        goto out;
+                case CAIF_DISCONNECTED:
+                        /* Reconnect allowed */
+                        break;
+                case CAIF_CONNECTING:
+                        err = -EALREADY;
+                        if (flags & O_NONBLOCK)
+                                goto out;
+                        goto wait_connect;
+                }
+                break;
+        case SS_CONNECTED:
+                caif_assert(sk->sk_state == CAIF_CONNECTED ||
+                                sk->sk_state == CAIF_DISCONNECTED);
+                if (sk->sk_shutdown & SHUTDOWN_MASK) {
+                        /* Allow re-connect after SHUTDOWN_IND */
+                        caif_disconnect_client(&cf_sk->layer);
+                        break;
+                }
+                /* No reconnect on a seqpacket socket */
+                err = -EISCONN;
+                goto out;
+        case SS_DISCONNECTING:
+        case SS_FREE:
+                caif_assert(1); /*Should never happen */
+                break;
         }
+        sk->sk_state = CAIF_DISCONNECTED;
+        sock->state = SS_UNCONNECTED;
+        sk_stream_kill_queues(&cf_sk->sk);
 
-        if (uservaddr->sa_family != AF_CAIF) {
-                pr_debug("CAIF: %s(): Bad address family (%d)\n",
-                         __func__, uservaddr->sa_family);
-                ret = -EAFNOSUPPORT;
-                goto open_error;
-        }
+        err = -EINVAL;
+        if (addr_len != sizeof(struct sockaddr_caif) ||
+                !uaddr)
+                goto out;
 
-        memcpy(&cf_sk->conn_req.sockaddr, uservaddr,
+        memcpy(&cf_sk->conn_req.sockaddr, uaddr,
                 sizeof(struct sockaddr_caif));
 
-        dbfs_atomic_inc(&cnt.num_open);
-        mode = SKT_READ_FLAG | SKT_WRITE_FLAG;
-
-        /* If socket is not open, make sure socket is in fully closed state */
-        if (!STATE_IS_OPEN(cf_sk)) {
-                /* Has link close response been received (if we ever sent it)?*/
-                if (STATE_IS_PENDING(cf_sk)) {
-                        /*
-                         * Still waiting for close response from remote.
-                         * If opened non-blocking, report "would block"
-                         */
-                        if (flags & O_NONBLOCK) {
-                                pr_debug("CAIF: %s(): O_NONBLOCK"
-                                        " && close pending\n", __func__);
-                                ret = -EAGAIN;
-                                goto open_error;
-                        }
-
-                        pr_debug("CAIF: %s(): Wait for close response"
-                                 " from remote...\n", __func__);
-
-                        release_sock(&cf_sk->sk);
-
-                        /*
-                         * Blocking mode; close is pending and we need to wait
-                         * for its conclusion.
-                         */
-                        result =
-                            wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                                     !STATE_IS_PENDING(cf_sk));
-
-                        lock_sock(&(cf_sk->sk));
-                        if (result == -ERESTARTSYS) {
-                                pr_debug("CAIF: %s(): wait_event_interruptible"
-                                         "woken by a signal (1)", __func__);
-                                ret = -ERESTARTSYS;
-                                goto open_error;
-                        }
-                }
+        /* Move to connecting socket, start sending Connect Requests */
+        sock->state = SS_CONNECTING;
+        sk->sk_state = CAIF_CONNECTING;
+
+        dbfs_atomic_inc(&cnt.num_connect_req);
+        cf_sk->layer.receive = caif_sktrecv_cb;
+        err = caif_connect_client(&cf_sk->conn_req,
+                                &cf_sk->layer);
+        if (err < 0) {
+                cf_sk->sk.sk_socket->state = SS_UNCONNECTED;
+                cf_sk->sk.sk_state = CAIF_DISCONNECTED;
+                goto out;
         }
 
-        /* socket is now either closed, pending open or open */
-        if (STATE_IS_OPEN(cf_sk) && !STATE_IS_PENDING(cf_sk)) {
-                /* Open */
-                pr_debug("CAIF: %s(): Socket is already opened (cf_sk=%p)"
-                        " check access f_flags = 0x%x file_mode = 0x%x\n",
-                         __func__, cf_sk, mode, cf_sk->file_mode);
-
-        } else {
-                /* We are closed or pending open.
-                 * If closed:       send link setup
-                 * If pending open: link setup already sent (we could have been
-                 *                  interrupted by a signal last time)
-                 */
-                if (!STATE_IS_OPEN(cf_sk)) {
-                        /* First opening of file; connect lower layers: */
-                        /* Drain queue (very unlikely) */
-                        drain_queue(cf_sk);
-
-                        cf_sk->layer.receive = caif_sktrecv_cb;
-                        SET_STATE_OPEN(cf_sk);
-                        SET_PENDING_ON(cf_sk);
-
-                        /* Register this channel. */
-                        result =
-                                caif_connect_client(&cf_sk->conn_req,
-                                                        &cf_sk->layer);
-                        if (result < 0) {
-                                pr_debug("CAIF: %s(): can't register channel\n",
-                                        __func__);
-                                ret = -EIO;
-                                SET_STATE_CLOSED(cf_sk);
-                                SET_PENDING_OFF(cf_sk);
-                                goto open_error;
-                        }
-                        dbfs_atomic_inc(&cnt.num_init);
-                }
-
-                /* If opened non-blocking, report "success".
-                 */
-                if (flags & O_NONBLOCK) {
-                        pr_debug("CAIF: %s(): O_NONBLOCK success\n",
-                                 __func__);
-                        ret = -EINPROGRESS;
-                        cf_sk->sk.sk_err = -EINPROGRESS;
-                        goto open_error;
-                }
-
-                trace_printk("CAIF: %s(): Wait for connect response\n",
-                             __func__);
+        err = -EINPROGRESS;
+wait_connect:
 
-                /* release lock before waiting */
-                release_sock(&cf_sk->sk);
-
-                result =
-                    wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                             !STATE_IS_PENDING(cf_sk));
-
-                lock_sock(&(cf_sk->sk));
-
-                if (result == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s(): wait_event_interruptible"
-                                 "woken by a signal (2)", __func__);
-                        ret = -ERESTARTSYS;
-                        goto open_error;
-                }
-
-                if (!STATE_IS_OPEN(cf_sk)) {
-                        /* Lower layers said "no" */
-                        pr_debug("CAIF: %s(): Closed received\n", __func__);
-                        ret = -EPIPE;
-                        goto open_error;
-                }
+        if (sk->sk_state != CAIF_CONNECTED && (flags & O_NONBLOCK))
+                goto out;
 
-                trace_printk("CAIF: %s(): Connect received\n", __func__);
+        timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
+
+        release_sock(sk);
+        err = wait_event_interruptible_timeout(*sk_sleep(sk),
+                        sk->sk_state != CAIF_CONNECTING,
+                        timeo);
+        lock_sock(sk);
+        if (err < 0)
+                goto out; /* -ERESTARTSYS */
+        if (err == 0 && sk->sk_state != CAIF_CONNECTED) {
+                err = -ETIMEDOUT;
+                goto out;
         }
-        /* Open is ok */
-        cf_sk->file_mode |= mode;
 
-        trace_printk("CAIF: %s(): Connected - file mode = %x\n",
-                  __func__, cf_sk->file_mode);
-
-        release_sock(&cf_sk->sk);
-        return 0;
-open_error:
-        sock->state     = SS_UNCONNECTED;
-        release_sock(&cf_sk->sk);
+        if (sk->sk_state != CAIF_CONNECTED) {
+                sock->state = SS_UNCONNECTED;
+                err = sock_error(sk);
+                if (!err)
+                        err = -ECONNREFUSED;
+                goto out;
+        }
+        sock->state = SS_CONNECTED;
+        err = 0;
 out:
-        return ret;
+        release_sock(sk);
+        return err;
 }
 
-static int caif_shutdown(struct socket *sock, int how)
+
+/*
+ * caif_release() - Disconnect a CAIF Socket
+ * Copied and modified af_irda.c:irda_release().
+ */
+static int caif_release(struct socket *sock)
 {
-        struct caifsock *cf_sk = NULL;
-        int result = 0;
-        int tx_flow_state_was_on;
         struct sock *sk = sock->sk;
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
+        int res = 0;
 
-        trace_printk("CAIF: %s(): enter\n", __func__);
-        pr_debug("f_flags=%x\n", sock->file->f_flags);
-
-        if (how != SHUT_RDWR)
-                return -EOPNOTSUPP;
-
-        cf_sk = container_of(sk, struct caifsock, sk);
-        if (cf_sk == NULL) {
-                pr_debug("CAIF: %s(): COULD NOT FIND SOCKET\n", __func__);
-                return -EBADF;
-        }
-
-        /* I want to be alone on cf_sk (except status queue) */
-        lock_sock(&(cf_sk->sk));
-        sock_hold(&cf_sk->sk);
-
-        /* IS_CLOSED have double meaning:
-         * 1) Spontanous Remote Shutdown Request.
-         * 2) Ack on a channel teardown(disconnect)
-         * Must clear bit in case we previously received
-         * remote shudown request.
-         */
-        if (STATE_IS_OPEN(cf_sk) && !STATE_IS_PENDING(cf_sk)) {
-                SET_STATE_CLOSED(cf_sk);
-                SET_PENDING_ON(cf_sk);
-                tx_flow_state_was_on = TX_FLOW_IS_ON(cf_sk);
-                SET_TX_FLOW_OFF(cf_sk);
-
-                /* Hold the socket until DEINIT_RSP is received */
-                sock_hold(&cf_sk->sk);
-                result = caif_disconnect_client(&cf_sk->layer);
-
-                if (result < 0) {
-                        pr_debug("CAIF: %s(): "
-                                        "caif_disconnect_client() failed\n",
-                                         __func__);
-                        SET_STATE_CLOSED(cf_sk);
-                        SET_PENDING_OFF(cf_sk);
-                        SET_TX_FLOW_OFF(cf_sk);
-                        release_sock(&cf_sk->sk);
-                        sock_put(&cf_sk->sk);
-                        return -EIO;
-                }
+        if (!sk)
+                return 0;
 
-        }
-        if (STATE_IS_REMOTE_SHUTDOWN(cf_sk)) {
-                SET_PENDING_OFF(cf_sk);
-                SET_REMOTE_SHUTDOWN_OFF(cf_sk);
-        }
+        set_tx_flow_off(cf_sk);
 
         /*
-         * Socket is no longer in state pending close,
-         * and we can release the reference.
+         * Ensure that packets are not queued after this point in time.
+         * caif_queue_rcv_skb checks SOCK_DEAD holding the queue lock,
+         * this ensures no packets when sock is dead.
          */
+        spin_lock(&sk->sk_receive_queue.lock);
+        sock_set_flag(sk, SOCK_DEAD);
+        spin_unlock(&sk->sk_receive_queue.lock);
+        sock->sk = NULL;
 
-        dbfs_atomic_inc(&cnt.num_close);
-        drain_queue(cf_sk);
-        SET_RX_FLOW_ON(cf_sk);
-        cf_sk->file_mode = 0;
-        sock_put(&cf_sk->sk);
-        release_sock(&cf_sk->sk);
-        if (!result && (sock->file->f_flags & O_NONBLOCK)) {
-                pr_debug("nonblocking shutdown returing -EAGAIN\n");
-                return -EAGAIN;
-        } else
-                return result;
-}
-
-static ssize_t caif_sock_no_sendpage(struct socket *sock,
-                                     struct page *page,
-                                     int offset, size_t size, int flags)
-{
-        return -EOPNOTSUPP;
-}
-
-/* This function is called as part of close. */
-static int caif_release(struct socket *sock)
-{
-        struct sock *sk = sock->sk;
-        struct caifsock *cf_sk = NULL;
-        int res;
-        caif_assert(sk != NULL);
-        cf_sk = container_of(sk, struct caifsock, sk);
+        dbfs_atomic_inc(&cnt.num_disconnect);
 
         if (cf_sk->debugfs_socket_dir != NULL)
                 debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
 
-        res = caif_shutdown(sock, SHUT_RDWR);
-        if (res && res != -EINPROGRESS)
-                return res;
-
-        /*
-         * FIXME: Shutdown should probably be possible to do async
-         * without flushing queues, allowing reception of frames while
-         * waiting for DEINIT_IND.
-         * Release should always block, to allow secure decoupling of
-         * CAIF stack.
-         */
-        if (!(sock->file->f_flags & O_NONBLOCK)) {
-                res = wait_event_interruptible(*cf_sk->sk.sk_sleep,
-                                                !STATE_IS_PENDING(cf_sk));
-
-                if (res == -ERESTARTSYS) {
-                        pr_debug("CAIF: %s(): wait_event_interruptible"
-                                "woken by a signal (1)", __func__);
-                }
-        }
         lock_sock(&(cf_sk->sk));
+        sk->sk_state = CAIF_DISCONNECTED;
+        sk->sk_shutdown = SHUTDOWN_MASK;
 
-        sock->sk = NULL;
+        if (cf_sk->sk.sk_socket->state == SS_CONNECTED ||
+                cf_sk->sk.sk_socket->state == SS_CONNECTING)
+                res = caif_disconnect_client(&cf_sk->layer);
 
-        /* Detach the socket from its process context by making it orphan. */
-        sock_orphan(sk);
+        cf_sk->sk.sk_socket->state = SS_DISCONNECTING;
+        wake_up_interruptible_poll(sk_sleep(sk), POLLERR|POLLHUP);
 
-        /*
-         * Setting SHUTDOWN_MASK means that both send and receive are shutdown
-         * for the socket.
-         */
-        sk->sk_shutdown = SHUTDOWN_MASK;
+        sock_orphan(sk);
+        cf_sk->layer.dn = NULL;
+        sk_stream_kill_queues(&cf_sk->sk);
+        release_sock(sk);
+        sock_put(sk);
+        return res;
+}
 
-        /*
-         * Set the socket state to closed, the TCP_CLOSE macro is used when
-         * closing any socket.
-         */
+/* Copied from af_unix.c:unix_poll(), added CAIF tx_flow handling */
+static unsigned int caif_poll(struct file *file,
+                                struct socket *sock, poll_table *wait)
+{
+        struct sock *sk = sock->sk;
+        unsigned int mask;
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
 
-        /* Flush out this sockets receive queue. */
-        drain_queue(cf_sk);
+        sock_poll_wait(file, sk_sleep(sk), wait);
+        mask = 0;
 
-        /* Finally release the socket. */
-        SET_STATE_PENDING_DESTROY(cf_sk);
+        /* exceptional events? */
+        if (sk->sk_err)
+                mask |= POLLERR;
+        if (sk->sk_shutdown == SHUTDOWN_MASK)
+                mask |= POLLHUP;
+        if (sk->sk_shutdown & RCV_SHUTDOWN)
+                mask |= POLLRDHUP;
 
-        release_sock(&cf_sk->sk);
+        /* readable? */
+        if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                (sk->sk_shutdown & RCV_SHUTDOWN))
+                mask |= POLLIN | POLLRDNORM;
 
-        sock_put(sk);
+        /* Connection-based need to check for termination and startup */
+        if (sk->sk_state == CAIF_DISCONNECTED)
+                mask |= POLLHUP;
 
         /*
-         * The rest of the cleanup will be handled from the
-         * caif_sock_destructor
+         * we set writable also when the other side has shut down the
+         * connection. This prevents stuck sockets.
          */
-        return res;
+        if (sock_writeable(sk) && tx_flow_is_on(cf_sk))
+                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
+
+        return mask;
 }
 
-static const struct proto_ops caif_ops = {
+static const struct proto_ops caif_seqpacket_ops = {
+        .family = PF_CAIF,
+        .owner = THIS_MODULE,
+        .release = caif_release,
+        .bind = sock_no_bind,
+        .connect = caif_connect,
+        .socketpair = sock_no_socketpair,
+        .accept = sock_no_accept,
+        .getname = sock_no_getname,
+        .poll = caif_poll,
+        .ioctl = sock_no_ioctl,
+        .listen = sock_no_listen,
+        .shutdown = sock_no_shutdown,
+        .setsockopt = setsockopt,
+        .getsockopt = sock_no_getsockopt,
+        .sendmsg = caif_seqpkt_sendmsg,
+        .recvmsg = caif_seqpkt_recvmsg,
+        .mmap = sock_no_mmap,
+        .sendpage = sock_no_sendpage,
+};
+
+static const struct proto_ops caif_stream_ops = {
         .family = PF_CAIF,
         .owner = THIS_MODULE,
         .release = caif_release,
@@ -1162,73 +1066,62 @@ static const struct proto_ops caif_ops = {
         .poll = caif_poll,
         .ioctl = sock_no_ioctl,
         .listen = sock_no_listen,
-        .shutdown = caif_shutdown,
+        .shutdown = sock_no_shutdown,
         .setsockopt = setsockopt,
         .getsockopt = sock_no_getsockopt,
-        .sendmsg = caif_sendmsg,
-        .recvmsg = caif_recvmsg,
+        .sendmsg = caif_stream_sendmsg,
+        .recvmsg = caif_stream_recvmsg,
         .mmap = sock_no_mmap,
-        .sendpage = caif_sock_no_sendpage,
+        .sendpage = sock_no_sendpage,
 };
 
 /* This function is called when a socket is finally destroyed. */
 static void caif_sock_destructor(struct sock *sk)
 {
-        struct caifsock *cf_sk = NULL;
-        cf_sk = container_of(sk, struct caifsock, sk);
-        /* Error checks. */
+        struct caifsock *cf_sk = container_of(sk, struct caifsock, sk);
         caif_assert(!atomic_read(&sk->sk_wmem_alloc));
         caif_assert(sk_unhashed(sk));
         caif_assert(!sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
-                pr_debug("CAIF: %s(): 0x%p", __func__, sk);
+                pr_info("Attempt to release alive CAIF socket: %p\n", sk);
                 return;
         }
-
-        if (STATE_IS_OPEN(cf_sk)) {
-                pr_debug("CAIF: %s(): socket is opened (cf_sk=%p)"
-                         " file_mode = 0x%x\n", __func__,
-                         cf_sk, cf_sk->file_mode);
-                return;
-        }
-        drain_queue(cf_sk);
-        kfree(cf_sk->pktq);
-
-        trace_printk("CAIF: %s(): caif_sock_destructor: Removing socket %s\n",
-                __func__, cf_sk->name);
-        atomic_dec(&caif_nr_socks);
+        sk_stream_kill_queues(&cf_sk->sk);
+        dbfs_atomic_dec(&cnt.caif_nr_socks);
 }
 
 static int caif_create(struct net *net, struct socket *sock, int protocol,
-                       int kern)
+                        int kern)
 {
         struct sock *sk = NULL;
         struct caifsock *cf_sk = NULL;
-        int result = 0;
         static struct proto prot = {.name = "PF_CAIF",
                 .owner = THIS_MODULE,
                 .obj_size = sizeof(struct caifsock),
         };
 
+        if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN))
+                return -EPERM;
         /*
          * The sock->type specifies the socket type to use.
-         * in SEQPACKET mode packet boundaries are enforced.
+         * The CAIF socket is a packet stream in the sense
+         * that it is packet based. CAIF trusts the reliability
+         * of the link, no resending is implemented.
          */
-        if (sock->type != SOCK_SEQPACKET && sock->type != SOCK_STREAM)
+        if (sock->type == SOCK_SEQPACKET)
+                sock->ops = &caif_seqpacket_ops;
+        else if (sock->type == SOCK_STREAM)
+                sock->ops = &caif_stream_ops;
+        else
                 return -ESOCKTNOSUPPORT;
 
-        if (net != &init_net)
-                return -EAFNOSUPPORT;
-
         if (protocol < 0 || protocol >= CAIFPROTO_MAX)
                 return -EPROTONOSUPPORT;
         /*
-         * Set the socket state to unconnected.  The socket state is really
-         * not used at all in the net/core or socket.c but the
+         * Set the socket state to unconnected.  The socket state
+         * is really not used at all in the net/core or socket.c but the
          * initialization makes sure that sock->state is not uninitialized.
          */
-        sock->state = SS_UNCONNECTED;
-
         sk = sk_alloc(net, PF_CAIF, GFP_KERNEL, &prot);
         if (!sk)
                 return -ENOMEM;
@@ -1238,11 +1131,9 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
         /* Store the protocol */
         sk->sk_protocol = (unsigned char) protocol;
 
-        spin_lock_init(&cf_sk->read_queue_len_lock);
-
-        /* Fill in some information concerning the misc socket. */
-        snprintf(cf_sk->name, sizeof(cf_sk->name), "cf_sk%d",
-                atomic_read(&caif_nr_socks));
+        /* Sendbuf dictates the amount of outbound packets not yet sent */
+        sk->sk_sndbuf = CAIF_DEF_SNDBUF;
+        sk->sk_rcvbuf = CAIF_DEF_RCVBUF;
 
         /*
          * Lock in order to try to stop someone from opening the socket
@@ -1252,108 +1143,85 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
 
         /* Initialize the nozero default sock structure data. */
         sock_init_data(sock, sk);
-        sock->ops = &caif_ops;
         sk->sk_destruct = caif_sock_destructor;
-        sk->sk_sndbuf = caif_sockbuf_size;
-        sk->sk_rcvbuf = caif_sockbuf_size;
 
-        cf_sk->pktq = cfpktq_create();
+        mutex_init(&cf_sk->readlock); /* single task reading lock */
+        cf_sk->layer.ctrlcmd = caif_ctrl_cb;
+        cf_sk->sk.sk_socket->state = SS_UNCONNECTED;
+        cf_sk->sk.sk_state = CAIF_DISCONNECTED;
 
-        if (!cf_sk->pktq) {
-                pr_err("CAIF: %s(): queue create failed.\n", __func__);
-                result = -ENOMEM;
-                release_sock(&cf_sk->sk);
-                goto err_failed;
-        }
-        cf_sk->layer.ctrlcmd = caif_sktflowctrl_cb;
-        SET_STATE_CLOSED(cf_sk);
-        SET_PENDING_OFF(cf_sk);
-        SET_TX_FLOW_OFF(cf_sk);
-        SET_RX_FLOW_ON(cf_sk);
+        set_tx_flow_off(cf_sk);
+        set_rx_flow_on(cf_sk);
 
         /* Set default options on configuration */
         cf_sk->conn_req.priority = CAIF_PRIO_NORMAL;
-        cf_sk->conn_req.link_selector = CAIF_LINK_HIGH_BANDW;
+        cf_sk->conn_req.link_selector = CAIF_LINK_LOW_LATENCY;
         cf_sk->conn_req.protocol = protocol;
         /* Increase the number of sockets created. */
-        atomic_inc(&caif_nr_socks);
+        dbfs_atomic_inc(&cnt.caif_nr_socks);
+#ifdef CONFIG_DEBUG_FS
         if (!IS_ERR(debugfsdir)) {
+                /* Fill in some information concerning the misc socket. */
+                snprintf(cf_sk->name, sizeof(cf_sk->name), "cfsk%d",
+                                atomic_read(&cnt.caif_nr_socks));
+
                 cf_sk->debugfs_socket_dir =
                         debugfs_create_dir(cf_sk->name, debugfsdir);
-                debugfs_create_u32("conn_state", S_IRUSR | S_IWUSR,
-                                cf_sk->debugfs_socket_dir, &cf_sk->conn_state);
+                debugfs_create_u32("sk_state", S_IRUSR | S_IWUSR,
+                                cf_sk->debugfs_socket_dir,
+                                (u32 *) &cf_sk->sk.sk_state);
                 debugfs_create_u32("flow_state", S_IRUSR | S_IWUSR,
                                 cf_sk->debugfs_socket_dir, &cf_sk->flow_state);
-                debugfs_create_u32("read_queue_len", S_IRUSR | S_IWUSR,
+                debugfs_create_u32("sk_rmem_alloc", S_IRUSR | S_IWUSR,
+                                cf_sk->debugfs_socket_dir,
+                                (u32 *) &cf_sk->sk.sk_rmem_alloc);
+                debugfs_create_u32("sk_wmem_alloc", S_IRUSR | S_IWUSR,
                                 cf_sk->debugfs_socket_dir,
-                                (u32 *) &cf_sk->read_queue_len);
+                                (u32 *) &cf_sk->sk.sk_wmem_alloc);
                 debugfs_create_u32("identity", S_IRUSR | S_IWUSR,
                                 cf_sk->debugfs_socket_dir,
                                 (u32 *) &cf_sk->layer.id);
         }
+#endif
         release_sock(&cf_sk->sk);
         return 0;
-err_failed:
-        sk_free(sk);
-        return result;
 }
 
+
 static struct net_proto_family caif_family_ops = {
         .family = PF_CAIF,
         .create = caif_create,
         .owner = THIS_MODULE,
 };
 
-static int af_caif_init(void)
+int af_caif_init(void)
 {
-        int err;
-        err = sock_register(&caif_family_ops);
-
+        int err = sock_register(&caif_family_ops);
         if (!err)
                 return err;
-
         return 0;
 }
 
 static int __init caif_sktinit_module(void)
 {
-        int stat;
 #ifdef CONFIG_DEBUG_FS
-        debugfsdir = debugfs_create_dir("chnl_skt", NULL);
+        debugfsdir = debugfs_create_dir("caif_sk", NULL);
         if (!IS_ERR(debugfsdir)) {
-                debugfs_create_u32("skb_inuse", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.skb_in_use);
-                debugfs_create_u32("skb_alloc", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.skb_alloc);
-                debugfs_create_u32("skb_free", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.skb_free);
                 debugfs_create_u32("num_sockets", S_IRUSR | S_IWUSR,
                                 debugfsdir,
-                                (u32 *) &caif_nr_socks);
-                debugfs_create_u32("num_open", S_IRUSR | S_IWUSR,
+                                (u32 *) &cnt.caif_nr_socks);
+                debugfs_create_u32("num_connect_req", S_IRUSR | S_IWUSR,
                                 debugfsdir,
-                                (u32 *) &cnt.num_open);
-                debugfs_create_u32("num_close", S_IRUSR | S_IWUSR,
+                                (u32 *) &cnt.num_connect_req);
+                debugfs_create_u32("num_connect_resp", S_IRUSR | S_IWUSR,
                                 debugfsdir,
-                                (u32 *) &cnt.num_close);
-                debugfs_create_u32("num_init", S_IRUSR | S_IWUSR,
+                                (u32 *) &cnt.num_connect_resp);
+                debugfs_create_u32("num_connect_fail_resp", S_IRUSR | S_IWUSR,
                                 debugfsdir,
-                                (u32 *) &cnt.num_init);
-                debugfs_create_u32("num_init_resp", S_IRUSR | S_IWUSR,
+                                (u32 *) &cnt.num_connect_fail_resp);
+                debugfs_create_u32("num_disconnect", S_IRUSR | S_IWUSR,
                                 debugfsdir,
-                                (u32 *) &cnt.num_init_resp);
-                debugfs_create_u32("num_init_fail_resp", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_init_fail_resp);
-                debugfs_create_u32("num_deinit", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_deinit);
-                debugfs_create_u32("num_deinit_resp", S_IRUSR | S_IWUSR,
-                                debugfsdir,
-                                (u32 *) &cnt.num_deinit_resp);
+                                (u32 *) &cnt.num_disconnect);
                 debugfs_create_u32("num_remote_shutdown_ind",
                                 S_IRUSR | S_IWUSR, debugfsdir,
                                 (u32 *) &cnt.num_remote_shutdown_ind);
@@ -1371,13 +1239,7 @@ static int __init caif_sktinit_module(void)
                                 (u32 *) &cnt.num_rx_flow_on);
         }
 #endif
-        stat = af_caif_init();
-        if (stat) {
-                pr_err("CAIF: %s(): Failed to initialize CAIF socket layer.",
-                       __func__);
-                return stat;
-        }
-        return 0;
+        return af_caif_init();
 }
 
 static void __exit caif_sktexit_module(void)
@@ -1386,6 +1248,5 @@ static void __exit caif_sktexit_module(void)
         if (debugfsdir != NULL)
                 debugfs_remove_recursive(debugfsdir);
 }
-
 module_init(caif_sktinit_module);
 module_exit(caif_sktexit_module);
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index c873e3d4387c..471c62939fad 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -51,12 +51,11 @@ struct cfcnfg {
         struct cfcnfg_phyinfo phy_layers[MAX_PHY_LAYERS];
 };
 
-static void cncfg_linkup_rsp(struct cflayer *layer, u8 linkid,
+static void cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id,
                              enum cfctrl_srv serv, u8 phyid,
                              struct cflayer *adapt_layer);
-static void cncfg_linkdestroy_rsp(struct cflayer *layer, u8 linkid,
-                                  struct cflayer *client_layer);
-static void cncfg_reject_rsp(struct cflayer *layer, u8 linkid,
+static void cfcnfg_linkdestroy_rsp(struct cflayer *layer, u8 channel_id);
+static void cfcnfg_reject_rsp(struct cflayer *layer, u8 channel_id,
                              struct cflayer *adapt_layer);
 static void cfctrl_resp_func(void);
 static void cfctrl_enum_resp(void);
@@ -82,13 +81,13 @@ struct cfcnfg *cfcnfg_create(void)
         resp = cfctrl_get_respfuncs(this->ctrl);
         resp->enum_rsp = cfctrl_enum_resp;
         resp->linkerror_ind = cfctrl_resp_func;
-        resp->linkdestroy_rsp = cncfg_linkdestroy_rsp;
+        resp->linkdestroy_rsp = cfcnfg_linkdestroy_rsp;
         resp->sleep_rsp = cfctrl_resp_func;
         resp->wake_rsp = cfctrl_resp_func;
         resp->restart_rsp = cfctrl_resp_func;
         resp->radioset_rsp = cfctrl_resp_func;
-        resp->linksetup_rsp = cncfg_linkup_rsp;
-        resp->reject_rsp = cncfg_reject_rsp;
+        resp->linksetup_rsp = cfcnfg_linkup_rsp;
+        resp->reject_rsp = cfcnfg_reject_rsp;
 
         this->last_phyid = 1;
 
@@ -175,142 +174,82 @@ int cfcnfg_get_named(struct cfcnfg *cnfg, char *name)
         return 0;
 }
 
-/*
- * NOTE: What happens on destroy failure:
- *       1a) No response - Too early
- *            This will not happen because enumerate has already
- *            completed.
- *       1b) No response - FATAL
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- *            Modem error, response is really expected -  this
- *            case is not really handled.
- *       2) O/E-bit indicate error
- *            Ignored - this link is destroyed anyway.
- *       3) Not able to match on request
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- *       4) Link-Error - (no response)
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- */
-
-int cfcnfg_del_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
+int cfcnfg_disconn_adapt_layer(struct cfcnfg *cnfg, struct cflayer *adap_layer)
 {
         u8 channel_id = 0;
         int ret = 0;
+        struct cflayer *servl = NULL;
         struct cfcnfg_phyinfo *phyinfo = NULL;
         u8 phyid = 0;
-
         caif_assert(adap_layer != NULL);
         channel_id = adap_layer->id;
-        if (channel_id == 0) {
+        if (adap_layer->dn == NULL || channel_id == 0) {
                 pr_err("CAIF: %s():adap_layer->id is 0\n", __func__);
                 ret = -ENOTCONN;
                 goto end;
         }
-
-        if (adap_layer->dn == NULL) {
-                pr_err("CAIF: %s():adap_layer->dn is NULL\n", __func__);
-                ret = -ENODEV;
-                goto end;
-        }
-
-        if (adap_layer->dn != NULL)
-                phyid = cfsrvl_getphyid(adap_layer->dn);
-
-        phyinfo = cfcnfg_get_phyinfo(cnfg, phyid);
-        if (phyinfo == NULL) {
-                pr_warning("CAIF: %s(): No interface to send disconnect to\n",
-                           __func__);
-                ret = -ENODEV;
+        servl = cfmuxl_remove_uplayer(cnfg->mux, channel_id);
+        if (servl == NULL)
                 goto end;
-        }
-
-        if (phyinfo->id != phyid
-                || phyinfo->phy_layer->id != phyid
-                || phyinfo->frm_layer->id != phyid) {
-
-                pr_err("CAIF: %s(): Inconsistency in phy registration\n",
-                        __func__);
+        layer_set_up(servl, NULL);
+        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
+        if (servl == NULL) {
+                pr_err("CAIF: %s(): PROTOCOL ERROR "
+                       "- Error removing service_layer Channel_Id(%d)",
+                        __func__, channel_id);
                 ret = -EINVAL;
                 goto end;
         }
+        caif_assert(channel_id == servl->id);
+        if (adap_layer->dn != NULL) {
+                phyid = cfsrvl_getphyid(adap_layer->dn);
 
-        ret = cfctrl_linkdown_req(cnfg->ctrl, channel_id, adap_layer);
-
-end:
+                phyinfo = cfcnfg_get_phyinfo(cnfg, phyid);
+                if (phyinfo == NULL) {
+                        pr_warning("CAIF: %s(): "
+                                "No interface to send disconnect to\n",
+                                __func__);
+                        ret = -ENODEV;
+                        goto end;
+                }
+                if (phyinfo->id != phyid ||
+                        phyinfo->phy_layer->id != phyid ||
+                        phyinfo->frm_layer->id != phyid) {
+                        pr_err("CAIF: %s(): "
+                                "Inconsistency in phy registration\n",
+                                __func__);
+                        ret = -EINVAL;
+                        goto end;
+                }
+        }
         if (phyinfo != NULL && --phyinfo->phy_ref_count == 0 &&
                 phyinfo->phy_layer != NULL &&
                 phyinfo->phy_layer->modemcmd != NULL) {
                 phyinfo->phy_layer->modemcmd(phyinfo->phy_layer,
                                              _CAIF_MODEMCMD_PHYIF_USELESS);
         }
+end:
+        cfsrvl_put(servl);
+        cfctrl_cancel_req(cnfg->ctrl, adap_layer);
+        if (adap_layer->ctrlcmd != NULL)
+                adap_layer->ctrlcmd(adap_layer, CAIF_CTRLCMD_DEINIT_RSP, 0);
         return ret;
 
 }
-EXPORT_SYMBOL(cfcnfg_del_adapt_layer);
+EXPORT_SYMBOL(cfcnfg_disconn_adapt_layer);
 
-static void cncfg_linkdestroy_rsp(struct cflayer *layer, u8 linkid,
-                                  struct cflayer *client_layer)
+void cfcnfg_release_adap_layer(struct cflayer *adap_layer)
 {
-        struct cfcnfg *cnfg = container_obj(layer);
-        struct cflayer *servl;
-
-        /*
-         * 1) Remove service from the MUX layer. The MUX must
-         *    guarante that no more payload sent "upwards" (receive)
-         */
-        servl = cfmuxl_remove_uplayer(cnfg->mux, linkid);
-
-        if (servl == NULL) {
-                pr_err("CAIF: %s(): PROTOCOL ERROR "
-                       "- Error removing service_layer Linkid(%d)",
-                        __func__, linkid);
-                return;
-        }
-        caif_assert(linkid == servl->id);
-
-        if (servl != client_layer && servl->up != client_layer) {
-                pr_err("CAIF: %s(): Error removing service_layer "
-                       "Linkid(%d) %p %p",
-                        __func__, linkid, (void *) servl,
-                        (void *) client_layer);
-                return;
-        }
-
-        /*
-         * 2) DEINIT_RSP must guarantee that no more packets are transmitted
-         *    from client (adap_layer) when it returns.
-         */
-
-        if (servl->ctrlcmd == NULL) {
-                pr_err("CAIF: %s(): Error servl->ctrlcmd == NULL", __func__);
-                return;
-        }
-
-        servl->ctrlcmd(servl, CAIF_CTRLCMD_DEINIT_RSP, 0);
-
-        /* 3) It is now safe to destroy the service layer. */
-        cfservl_destroy(servl);
+        if (adap_layer->dn)
+                cfsrvl_put(adap_layer->dn);
 }
+EXPORT_SYMBOL(cfcnfg_release_adap_layer);
 
-/*
- * NOTE: What happens on linksetup failure:
- *       1a) No response - Too early
- *            This will not happen because enumerate is secured
- *            before using interface.
- *       1b) No response - FATAL
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- *            Modem error, response is really expected -  this case is
- *            not really handled.
- *       2) O/E-bit indicate error
- *            Handled in cnfg_reject_rsp
- *       3) Not able to match on request
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- *       4) Link-Error - (no response)
- *            Not handled, but this should be a CAIF PROTOCOL ERROR
- */
+static void cfcnfg_linkdestroy_rsp(struct cflayer *layer, u8 channel_id)
+{
+}
 
-int
-cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
+int cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
                                 struct cfctrl_link_param *param,
                                 struct cflayer *adap_layer)
 {
@@ -340,12 +279,11 @@ cfcnfg_add_adaptation_layer(struct cfcnfg *cnfg,
                      param->phyid);
         /* FIXME: ENUMERATE INITIALLY WHEN ACTIVATING PHYSICAL INTERFACE */
         cfctrl_enum_req(cnfg->ctrl, param->phyid);
-        cfctrl_linkup_request(cnfg->ctrl, param, adap_layer);
-        return 0;
+        return cfctrl_linkup_request(cnfg->ctrl, param, adap_layer);
 }
 EXPORT_SYMBOL(cfcnfg_add_adaptation_layer);
 
-static void cncfg_reject_rsp(struct cflayer *layer, u8 linkid,
+static void cfcnfg_reject_rsp(struct cflayer *layer, u8 channel_id,
                              struct cflayer *adapt_layer)
 {
         if (adapt_layer != NULL && adapt_layer->ctrlcmd != NULL)
@@ -354,15 +292,17 @@ static void cncfg_reject_rsp(struct cflayer *layer, u8 linkid,
 }
 
 static void
-cncfg_linkup_rsp(struct cflayer *layer, u8 linkid, enum cfctrl_srv serv,
+cfcnfg_linkup_rsp(struct cflayer *layer, u8 channel_id, enum cfctrl_srv serv,
                  u8 phyid, struct cflayer *adapt_layer)
 {
         struct cfcnfg *cnfg = container_obj(layer);
         struct cflayer *servicel = NULL;
         struct cfcnfg_phyinfo *phyinfo;
         if (adapt_layer == NULL) {
-                pr_err("CAIF: %s(): PROTOCOL ERROR "
-                        "- LinkUp Request/Response did not match\n", __func__);
+                pr_debug("CAIF: %s(): link setup response "
+                                "but no client exist, send linkdown back\n",
+                                __func__);
+                cfctrl_linkdown_req(cnfg->ctrl, channel_id, NULL);
                 return;
         }
 
@@ -383,26 +323,26 @@ cncfg_linkup_rsp(struct cflayer *layer, u8 linkid, enum cfctrl_srv serv,
                                              _CAIF_MODEMCMD_PHYIF_USEFULL);
 
         }
-        adapt_layer->id = linkid;
+        adapt_layer->id = channel_id;
 
         switch (serv) {
         case CFCTRL_SRV_VEI:
-                servicel = cfvei_create(linkid, &phyinfo->dev_info);
+                servicel = cfvei_create(channel_id, &phyinfo->dev_info);
                 break;
         case CFCTRL_SRV_DATAGRAM:
-                servicel = cfdgml_create(linkid, &phyinfo->dev_info);
+                servicel = cfdgml_create(channel_id, &phyinfo->dev_info);
                 break;
         case CFCTRL_SRV_RFM:
-                servicel = cfrfml_create(linkid, &phyinfo->dev_info);
+                servicel = cfrfml_create(channel_id, &phyinfo->dev_info);
                 break;
         case CFCTRL_SRV_UTIL:
-                servicel = cfutill_create(linkid, &phyinfo->dev_info);
+                servicel = cfutill_create(channel_id, &phyinfo->dev_info);
                 break;
         case CFCTRL_SRV_VIDEO:
-                servicel = cfvidl_create(linkid, &phyinfo->dev_info);
+                servicel = cfvidl_create(channel_id, &phyinfo->dev_info);
                 break;
         case CFCTRL_SRV_DBG:
-                servicel = cfdbgl_create(linkid, &phyinfo->dev_info);
+                servicel = cfdbgl_create(channel_id, &phyinfo->dev_info);
                 break;
         default:
                 pr_err("CAIF: %s(): Protocol error. "
@@ -415,9 +355,10 @@ cncfg_linkup_rsp(struct cflayer *layer, u8 linkid, enum cfctrl_srv serv,
                 return;
         }
         layer_set_dn(servicel, cnfg->mux);
-        cfmuxl_set_uplayer(cnfg->mux, servicel, linkid);
+        cfmuxl_set_uplayer(cnfg->mux, servicel, channel_id);
         layer_set_up(servicel, adapt_layer);
         layer_set_dn(adapt_layer, servicel);
+        cfsrvl_get(servicel);
         servicel->ctrlcmd(servicel, CAIF_CTRLCMD_INIT_RSP, 0);
 }
 
diff --git a/net/caif/cfctrl.c b/net/caif/cfctrl.c
index 11f80140f3cb..a521d32cfe56 100644
--- a/net/caif/cfctrl.c
+++ b/net/caif/cfctrl.c
@@ -32,6 +32,7 @@ static void cfctrl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 
 struct cflayer *cfctrl_create(void)
 {
+        struct dev_info dev_info;
         struct cfctrl *this =
                 kmalloc(sizeof(struct cfctrl), GFP_ATOMIC);
         if (!this) {
@@ -39,12 +40,13 @@ struct cflayer *cfctrl_create(void)
                 return NULL;
         }
         caif_assert(offsetof(struct cfctrl, serv.layer) == 0);
+        memset(&dev_info, 0, sizeof(dev_info));
+        dev_info.id = 0xff;
         memset(this, 0, sizeof(*this));
+        cfsrvl_init(&this->serv, 0, &dev_info);
         spin_lock_init(&this->info_list_lock);
         atomic_set(&this->req_seq_no, 1);
         atomic_set(&this->rsp_seq_no, 1);
-        this->serv.dev_info.id = 0xff;
-        this->serv.layer.id = 0;
         this->serv.layer.receive = cfctrl_recv;
         sprintf(this->serv.layer.name, "ctrl");
         this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
@@ -127,20 +129,6 @@ void cfctrl_insert_req(struct cfctrl *ctrl,
         spin_unlock(&ctrl->info_list_lock);
 }
 
-static void cfctrl_insert_req2(struct cfctrl *ctrl, enum cfctrl_cmd cmd,
-                               u8 linkid, struct cflayer *user_layer)
-{
-        struct cfctrl_request_info *req = kmalloc(sizeof(*req), GFP_KERNEL);
-        if (!req) {
-                pr_warning("CAIF: %s(): Out of memory\n", __func__);
-                return;
-        }
-        req->client_layer = user_layer;
-        req->cmd = cmd;
-        req->channel_id = linkid;
-        cfctrl_insert_req(ctrl, req);
-}
-
 /* Compare and remove request */
 struct cfctrl_request_info *cfctrl_remove_req(struct cfctrl *ctrl,
                                               struct cfctrl_request_info *req)
@@ -234,7 +222,7 @@ void cfctrl_enum_req(struct cflayer *layer, u8 physlinkid)
         }
 }
 
-void cfctrl_linkup_request(struct cflayer *layer,
+int cfctrl_linkup_request(struct cflayer *layer,
                            struct cfctrl_link_param *param,
                            struct cflayer *user_layer)
 {
@@ -248,7 +236,7 @@ void cfctrl_linkup_request(struct cflayer *layer,
         struct cfpkt *pkt = cfpkt_create(CFPKT_CTRL_PKT_LEN);
         if (!pkt) {
                 pr_warning("CAIF: %s(): Out of memory\n", __func__);
-                return;
+                return -ENOMEM;
         }
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_SETUP);
         cfpkt_addbdy(pkt, (param->chtype << 4) + param->linktype);
@@ -294,11 +282,12 @@ void cfctrl_linkup_request(struct cflayer *layer,
         default:
                 pr_warning("CAIF: %s():Request setup of bad link type = %d\n",
                            __func__, param->linktype);
+                return -EINVAL;
         }
         req = kmalloc(sizeof(*req), GFP_KERNEL);
         if (!req) {
                 pr_warning("CAIF: %s(): Out of memory\n", __func__);
-                return;
+                return -ENOMEM;
         }
         memset(req, 0, sizeof(*req));
         req->client_layer = user_layer;
@@ -306,6 +295,11 @@ void cfctrl_linkup_request(struct cflayer *layer,
         req->param = *param;
         cfctrl_insert_req(cfctrl, req);
         init_info(cfpkt_info(pkt), cfctrl);
+        /*
+         * NOTE:Always send linkup and linkdown request on the same
+         *      device as the payload. Otherwise old queued up payload
+         *      might arrive with the newly allocated channel ID.
+         */
         cfpkt_info(pkt)->dev_info->id = param->phyid;
         ret =
             cfctrl->serv.layer.dn->transmit(cfctrl->serv.layer.dn, pkt);
@@ -313,7 +307,9 @@ void cfctrl_linkup_request(struct cflayer *layer,
                 pr_err("CAIF: %s(): Could not transmit linksetup request\n",
                         __func__);
                 cfpkt_destroy(pkt);
+                return -ENODEV;
         }
+        return 0;
 }
 
 int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
@@ -326,7 +322,6 @@ int cfctrl_linkdown_req(struct cflayer *layer, u8 channelid,
                 pr_warning("CAIF: %s(): Out of memory\n", __func__);
                 return -ENOMEM;
         }
-        cfctrl_insert_req2(cfctrl, CFCTRL_CMD_LINK_DESTROY, channelid, client);
         cfpkt_addbdy(pkt, CFCTRL_CMD_LINK_DESTROY);
         cfpkt_addbdy(pkt, channelid);
         init_info(cfpkt_info(pkt), cfctrl);
@@ -392,6 +387,38 @@ void cfctrl_getstartreason_req(struct cflayer *layer)
 }
 
 
+void cfctrl_cancel_req(struct cflayer *layr, struct cflayer *adap_layer)
+{
+        struct cfctrl_request_info *p, *req;
+        struct cfctrl *ctrl = container_obj(layr);
+        spin_lock(&ctrl->info_list_lock);
+
+        if (ctrl->first_req == NULL) {
+                spin_unlock(&ctrl->info_list_lock);
+                return;
+        }
+
+        if (ctrl->first_req->client_layer == adap_layer) {
+
+                req = ctrl->first_req;
+                ctrl->first_req = ctrl->first_req->next;
+                kfree(req);
+        }
+
+        p = ctrl->first_req;
+        while (p != NULL && p->next != NULL) {
+                if (p->next->client_layer == adap_layer) {
+
+                        req = p->next;
+                        p->next = p->next->next;
+                        kfree(p->next);
+                }
+                p = p->next;
+        }
+
+        spin_unlock(&ctrl->info_list_lock);
+}
+
 static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
 {
         u8 cmdrsp;
@@ -409,11 +436,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
         cmd = cmdrsp & CFCTRL_CMD_MASK;
         if (cmd != CFCTRL_CMD_LINK_ERR
             && CFCTRL_RSP_BIT != (CFCTRL_RSP_BIT & cmdrsp)) {
-                if (handle_loop(cfctrl, cmd, pkt) == CAIF_FAILURE) {
-                        pr_info("CAIF: %s() CAIF Protocol error:"
-                                "Response bit not set\n", __func__);
-                        goto error;
-                }
+                if (handle_loop(cfctrl, cmd, pkt) == CAIF_FAILURE)
+                        cmdrsp |= CFCTRL_ERR_BIT;
         }
 
         switch (cmd) {
@@ -451,12 +475,16 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                         switch (serv) {
                         case CFCTRL_SRV_VEI:
                         case CFCTRL_SRV_DBG:
+                                if (CFCTRL_ERR_BIT & cmdrsp)
+                                        break;
                                 /* Link ID */
                                 cfpkt_extr_head(pkt, &linkid, 1);
                                 break;
                         case CFCTRL_SRV_VIDEO:
                                 cfpkt_extr_head(pkt, &tmp, 1);
                                 linkparam.u.video.connid = tmp;
+                                if (CFCTRL_ERR_BIT & cmdrsp)
+                                        break;
                                 /* Link ID */
                                 cfpkt_extr_head(pkt, &linkid, 1);
                                 break;
@@ -465,6 +493,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                                 cfpkt_extr_head(pkt, &tmp32, 4);
                                 linkparam.u.datagram.connid =
                                     le32_to_cpu(tmp32);
+                                if (CFCTRL_ERR_BIT & cmdrsp)
+                                        break;
                                 /* Link ID */
                                 cfpkt_extr_head(pkt, &linkid, 1);
                                 break;
@@ -483,6 +513,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                                         *cp++ = tmp;
                                 *cp = '\0';
 
+                                if (CFCTRL_ERR_BIT & cmdrsp)
+                                        break;
                                 /* Link ID */
                                 cfpkt_extr_head(pkt, &linkid, 1);
 
@@ -519,6 +551,8 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                                         cfpkt_extr_head(pkt, &tmp, 1);
                                         *cp++ = tmp;
                                 }
+                                if (CFCTRL_ERR_BIT & cmdrsp)
+                                        break;
                                 /* Link ID */
                                 cfpkt_extr_head(pkt, &linkid, 1);
                                 /* Length */
@@ -560,13 +594,7 @@ static int cfctrl_recv(struct cflayer *layer, struct cfpkt *pkt)
                 break;
         case CFCTRL_CMD_LINK_DESTROY:
                 cfpkt_extr_head(pkt, &linkid, 1);
-                rsp.cmd = cmd;
-                rsp.channel_id = linkid;
-                req = cfctrl_remove_req(cfctrl, &rsp);
-                cfctrl->res.linkdestroy_rsp(cfctrl->serv.layer.up, linkid,
-                                            req ? req->client_layer : NULL);
-                if (req != NULL)
-                        kfree(req);
+                cfctrl->res.linkdestroy_rsp(cfctrl->serv.layer.up, linkid);
                 break;
         case CFCTRL_CMD_LINK_ERR:
                 pr_err("CAIF: %s(): Frame Error Indication received\n",
@@ -608,7 +636,7 @@ static void cfctrl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
         case CAIF_CTRLCMD_FLOW_OFF_IND:
                 spin_lock(&this->info_list_lock);
                 if (this->first_req != NULL) {
-                        pr_warning("CAIF: %s(): Received flow off in "
+                        pr_debug("CAIF: %s(): Received flow off in "
                                    "control layer", __func__);
                 }
                 spin_unlock(&this->info_list_lock);
@@ -633,6 +661,7 @@ static int handle_loop(struct cfctrl *ctrl, int cmd, struct cfpkt *pkt)
                         if (!ctrl->loop_linkused[linkid])
                                 goto found;
                 spin_unlock(&ctrl->loop_linkid_lock);
+                pr_err("CAIF: %s(): Out of link-ids\n", __func__);
                 return -EINVAL;
 found:
                 if (!ctrl->loop_linkused[linkid])
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index 6fb9f9e96cf8..7372f27f1d32 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -62,6 +62,7 @@ int cfmuxl_set_uplayer(struct cflayer *layr, struct cflayer *up, u8 linkid)
 {
         struct cfmuxl *muxl = container_obj(layr);
         spin_lock(&muxl->receive_lock);
+        cfsrvl_get(up);
         list_add(&up->node, &muxl->srvl_list);
         spin_unlock(&muxl->receive_lock);
         return 0;
@@ -172,8 +173,11 @@ struct cflayer *cfmuxl_remove_uplayer(struct cflayer *layr, u8 id)
         struct cfmuxl *muxl = container_obj(layr);
         spin_lock(&muxl->receive_lock);
         up = get_up(muxl, id);
+        if (up == NULL)
+                return NULL;
         memset(muxl->up_cache, 0, sizeof(muxl->up_cache));
         list_del(&up->node);
+        cfsrvl_put(up);
         spin_unlock(&muxl->receive_lock);
         return up;
 }
@@ -203,8 +207,9 @@ static int cfmuxl_receive(struct cflayer *layr, struct cfpkt *pkt)
                  */
                 return /* CFGLU_EPROT; */ 0;
         }
-
+        cfsrvl_get(up);
         ret = up->receive(up, pkt);
+        cfsrvl_put(up);
         return ret;
 }
 
diff --git a/net/caif/cfsrvl.c b/net/caif/cfsrvl.c
index d470c51c6431..aff31f34528f 100644
--- a/net/caif/cfsrvl.c
+++ b/net/caif/cfsrvl.c
@@ -158,6 +158,13 @@ void cfsrvl_init(struct cfsrvl *service,
         service->layer.ctrlcmd = cfservl_ctrlcmd;
         service->layer.modemcmd = cfservl_modemcmd;
         service->dev_info = *dev_info;
+        kref_init(&service->ref);
+}
+
+void cfsrvl_release(struct kref *kref)
+{
+        struct cfsrvl *service = container_of(kref, struct cfsrvl, ref);
+        kfree(service);
 }
 
 bool cfsrvl_ready(struct cfsrvl *service, int *err)
diff --git a/net/caif/chnl_net.c b/net/caif/chnl_net.c
index f622ff1d39ba..610966abe2dc 100644
--- a/net/caif/chnl_net.c
+++ b/net/caif/chnl_net.c
@@ -22,10 +22,10 @@
 #include <net/caif/cfpkt.h>
 #include <net/caif/caif_dev.h>
 
-#define CAIF_CONNECT_TIMEOUT 30
+/* GPRS PDP connection has MTU to 1500 */
 #define SIZE_MTU 1500
-#define SIZE_MTU_MAX 4080
-#define SIZE_MTU_MIN 68
+/* 5 sec. connect timeout */
+#define CONNECT_TIMEOUT (5 * HZ)
 #define CAIF_NET_DEFAULT_QUEUE_LEN 500
 
 #undef pr_debug
@@ -37,6 +37,13 @@ static LIST_HEAD(chnl_net_list);
 MODULE_LICENSE("GPL");
 MODULE_ALIAS_RTNL_LINK("caif");
 
+enum caif_states {
+        CAIF_CONNECTED          = 1,
+        CAIF_CONNECTING,
+        CAIF_DISCONNECTED,
+        CAIF_SHUTDOWN
+};
+
 struct chnl_net {
         struct cflayer chnl;
         struct net_device_stats stats;
@@ -47,7 +54,7 @@ struct chnl_net {
         wait_queue_head_t netmgmt_wq;
         /* Flow status to remember and control the transmission. */
         bool flowenabled;
-        bool pending_close;
+        enum caif_states state;
 };
 
 static void robust_list_del(struct list_head *delete_node)
@@ -58,15 +65,16 @@ static void robust_list_del(struct list_head *delete_node)
         list_for_each_safe(list_node, n, &chnl_net_list) {
                 if (list_node == delete_node) {
                         list_del(list_node);
-                        break;
+                        return;
                 }
         }
+        WARN_ON(1);
 }
 
 static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
 {
         struct sk_buff *skb;
-        struct chnl_net *priv  = NULL;
+        struct chnl_net *priv  = container_of(layr, struct chnl_net, chnl);
         int pktlen;
         int err = 0;
 
@@ -91,7 +99,6 @@ static int chnl_recv_cb(struct cflayer *layr, struct cfpkt *pkt)
         else
                 skb->ip_summed = CHECKSUM_NONE;
 
-        /* FIXME: Drivers should call this in tasklet context. */
         if (in_interrupt())
                 netif_rx(skb);
         else
@@ -117,23 +124,25 @@ static void close_work(struct work_struct *work)
         struct chnl_net *dev = NULL;
         struct list_head *list_node;
         struct list_head *_tmp;
-        rtnl_lock();
+        /* May be called with or without RTNL lock held */
+        int islocked = rtnl_is_locked();
+        if (!islocked)
+                rtnl_lock();
         list_for_each_safe(list_node, _tmp, &chnl_net_list) {
                 dev = list_entry(list_node, struct chnl_net, list_field);
-                if (!dev->pending_close)
-                        continue;
-                list_del(list_node);
-                delete_device(dev);
+                if (dev->state == CAIF_SHUTDOWN)
+                        dev_close(dev->netdev);
         }
-        rtnl_unlock();
+        if (!islocked)
+                rtnl_unlock();
 }
 static DECLARE_WORK(close_worker, close_work);
 
 static void chnl_flowctrl_cb(struct cflayer *layr, enum caif_ctrlcmd flow,
                                 int phyid)
 {
-        struct chnl_net *priv;
-        pr_debug("CAIF: %s(): NET flowctrl func called flow: %s.\n",
+        struct chnl_net *priv = container_of(layr, struct chnl_net, chnl);
+        pr_debug("CAIF: %s(): NET flowctrl func called flow: %s\n",
                 __func__,
                 flow == CAIF_CTRLCMD_FLOW_ON_IND ? "ON" :
                 flow == CAIF_CTRLCMD_INIT_RSP ? "INIT" :
@@ -143,21 +152,31 @@ static void chnl_flowctrl_cb(struct cflayer *layr, enum caif_ctrlcmd flow,
                 flow == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND ?
                  "REMOTE_SHUTDOWN" : "UKNOWN CTRL COMMAND");
 
-        priv = container_of(layr, struct chnl_net, chnl);
+
 
         switch (flow) {
         case CAIF_CTRLCMD_FLOW_OFF_IND:
+                priv->flowenabled = false;
+                netif_stop_queue(priv->netdev);
+                break;
         case CAIF_CTRLCMD_DEINIT_RSP:
+                priv->state = CAIF_DISCONNECTED;
+                break;
         case CAIF_CTRLCMD_INIT_FAIL_RSP:
+                priv->state = CAIF_DISCONNECTED;
+                wake_up_interruptible(&priv->netmgmt_wq);
+                break;
         case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
-                priv->flowenabled = false;
+                priv->state = CAIF_SHUTDOWN;
                 netif_tx_disable(priv->netdev);
-                pr_warning("CAIF: %s(): done\n", __func__);
-                priv->pending_close = 1;
                 schedule_work(&close_worker);
                 break;
         case CAIF_CTRLCMD_FLOW_ON_IND:
+                priv->flowenabled = true;
+                netif_wake_queue(priv->netdev);
+                break;
         case CAIF_CTRLCMD_INIT_RSP:
+                priv->state = CAIF_CONNECTED;
                 priv->flowenabled = true;
                 netif_wake_queue(priv->netdev);
                 wake_up_interruptible(&priv->netmgmt_wq);
@@ -194,9 +213,6 @@ static int chnl_net_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         pkt = cfpkt_fromnative(CAIF_DIR_OUT, (void *) skb);
 
-        pr_debug("CAIF: %s(): transmit inst %s %d,%p\n",
-                __func__, dev->name, priv->chnl.dn->id, &priv->chnl.dn);
-
         /* Send the packet down the stack. */
         result = priv->chnl.dn->transmit(priv->chnl.dn, pkt);
         if (result) {
@@ -217,61 +233,59 @@ static int chnl_net_open(struct net_device *dev)
         struct chnl_net *priv = NULL;
         int result = -1;
         ASSERT_RTNL();
-
         priv = netdev_priv(dev);
-        pr_debug("CAIF: %s(): dev name: %s\n", __func__, priv->name);
-
         if (!priv) {
                 pr_debug("CAIF: %s(): chnl_net_open: no priv\n", __func__);
                 return -ENODEV;
         }
-        result = caif_connect_client(&priv->conn_req, &priv->chnl);
-        if (result != 0) {
-                pr_debug("CAIF: %s(): err: "
-                         "Unable to register and open device, Err:%d\n",
-                        __func__,
-                        result);
-                return -ENODEV;
+
+        if (priv->state != CAIF_CONNECTING) {
+                priv->state = CAIF_CONNECTING;
+                result = caif_connect_client(&priv->conn_req, &priv->chnl);
+                if (result != 0) {
+                                priv->state = CAIF_DISCONNECTED;
+                                pr_debug("CAIF: %s(): err: "
+                                        "Unable to register and open device,"
+                                        " Err:%d\n",
+                                        __func__,
+                                        result);
+                                return result;
+                }
         }
-        result = wait_event_interruptible(priv->netmgmt_wq, priv->flowenabled);
+
+        result = wait_event_interruptible_timeout(priv->netmgmt_wq,
+                                                priv->state != CAIF_CONNECTING,
+                                                CONNECT_TIMEOUT);
 
         if (result == -ERESTARTSYS) {
                 pr_debug("CAIF: %s(): wait_event_interruptible"
                          " woken by a signal\n", __func__);
                 return -ERESTARTSYS;
-        } else
-                pr_debug("CAIF: %s(): Flow on recieved\n", __func__);
+        }
+        if (result == 0) {
+                pr_debug("CAIF: %s(): connect timeout\n", __func__);
+                caif_disconnect_client(&priv->chnl);
+                priv->state = CAIF_DISCONNECTED;
+                pr_debug("CAIF: %s(): state disconnected\n", __func__);
+                return -ETIMEDOUT;
+        }
 
+        if (priv->state != CAIF_CONNECTED) {
+                pr_debug("CAIF: %s(): connect failed\n", __func__);
+                return -ECONNREFUSED;
+        }
+        pr_debug("CAIF: %s(): CAIF Netdevice connected\n", __func__);
         return 0;
 }
 
 static int chnl_net_stop(struct net_device *dev)
 {
         struct chnl_net *priv;
-        int result = -1;
+
         ASSERT_RTNL();
         priv = netdev_priv(dev);
-
-        result = caif_disconnect_client(&priv->chnl);
-        if (result != 0) {
-                pr_debug("CAIF: %s(): chnl_net_stop: err: "
-                         "Unable to STOP device, Err:%d\n",
-                         __func__, result);
-                return -EBUSY;
-        }
-        result = wait_event_interruptible(priv->netmgmt_wq,
-                                          !priv->flowenabled);
-
-        if (result == -ERESTARTSYS) {
-                pr_debug("CAIF: %s(): wait_event_interruptible woken by"
-                         " signal, signal_pending(current) = %d\n",
-                         __func__,
-                         signal_pending(current));
-        } else {
-                pr_debug("CAIF: %s(): disconnect received\n", __func__);
-
-        }
-
+        priv->state = CAIF_DISCONNECTED;
+        caif_disconnect_client(&priv->chnl);
         return 0;
 }
 
@@ -377,6 +391,8 @@ static int ipcaif_newlink(struct net *src_net, struct net_device *dev,
         ASSERT_RTNL();
         caifdev = netdev_priv(dev);
         caif_netlink_parms(data, &caifdev->conn_req);
+        dev_net_set(caifdev->netdev, src_net);
+
         ret = register_netdevice(dev);
         if (ret)
                 pr_warning("CAIF: %s(): device rtml registration failed\n",
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 2dccd4ee591b..e0097531417a 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -86,7 +86,7 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
         int error;
         DEFINE_WAIT_FUNC(wait, receiver_wake_function);
 
-        prepare_to_wait_exclusive(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
         /* Socket errors? */
         error = sock_error(sk);
@@ -115,7 +115,7 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
         error = 0;
         *timeo_p = schedule_timeout(*timeo_p);
 out:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return error;
 interrupted:
         error = sock_intr_errno(*timeo_p);
@@ -229,9 +229,18 @@ EXPORT_SYMBOL(skb_free_datagram);
 
 void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
 {
-        lock_sock(sk);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
+        if (likely(atomic_read(&skb->users) == 1))
+                smp_rmb();
+        else if (likely(!atomic_dec_and_test(&skb->users)))
+                return;
+
+        lock_sock_bh(sk);
+        skb_orphan(skb);
+        sk_mem_reclaim_partial(sk);
+        unlock_sock_bh(sk);
+
+        /* skb is now orphaned, can be freed outside of locked section */
+        __kfree_skb(skb);
 }
 EXPORT_SYMBOL(skb_free_datagram_locked);
 
@@ -726,7 +735,7 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         /* exceptional events? */
diff --git a/net/core/dev.c b/net/core/dev.c
index b31d5d69a467..32611c8f1219 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1557,8 +1557,9 @@ static inline void __netif_reschedule(struct Qdisc *q)
 
         local_irq_save(flags);
         sd = &__get_cpu_var(softnet_data);
-        q->next_sched = sd->output_queue;
-        sd->output_queue = q;
+        q->next_sched = NULL;
+        *sd->output_queue_tailp = q;
+        sd->output_queue_tailp = &q->next_sched;
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_restore(flags);
 }
@@ -1902,13 +1903,6 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                 if (!list_empty(&ptype_all))
                         dev_queue_xmit_nit(skb, dev);
 
-                if (netif_needs_gso(dev, skb)) {
-                        if (unlikely(dev_gso_segment(skb)))
-                                goto out_kfree_skb;
-                        if (skb->next)
-                                goto gso;
-                }
-
                 /*
                  * If device doesnt need skb->dst, release it right now while
                  * its hot in this cpu cache
@@ -1917,6 +1911,14 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                         skb_dst_drop(skb);
 
                 skb_orphan_try(skb);
+
+                if (netif_needs_gso(dev, skb)) {
+                        if (unlikely(dev_gso_segment(skb)))
+                                goto out_kfree_skb;
+                        if (skb->next)
+                                goto gso;
+                }
+
                 rc = ops->ndo_start_xmit(skb, dev);
                 if (rc == NETDEV_TX_OK)
                         txq_trans_update(txq);
@@ -1937,7 +1939,6 @@ gso:
                 if (dev->priv_flags & IFF_XMIT_DST_RELEASE)
                         skb_dst_drop(nskb);
 
-                skb_orphan_try(nskb);
                 rc = ops->ndo_start_xmit(nskb, dev);
                 if (unlikely(rc != NETDEV_TX_OK)) {
                         if (rc & ~NETDEV_TX_MASK)
@@ -2015,8 +2016,12 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
                         if (dev->real_num_tx_queues > 1)
                                 queue_index = skb_tx_hash(dev, skb);
 
-                        if (sk && rcu_dereference_check(sk->sk_dst_cache, 1))
-                                sk_tx_queue_set(sk, queue_index);
+                        if (sk) {
+                                struct dst_entry *dst = rcu_dereference_check(sk->sk_dst_cache, 1);
+
+                                if (dst && skb_dst(skb) == dst)
+                                        sk_tx_queue_set(sk, queue_index);
+                        }
                 }
         }
 
@@ -2200,7 +2205,13 @@ int netdev_max_backlog __read_mostly = 1000;
 int netdev_budget __read_mostly = 300;
 int weight_p __read_mostly = 64;            /* old backlog weight */
 
-DEFINE_PER_CPU(struct netif_rx_stats, netdev_rx_stat) = { 0, };
+/* Called with irq disabled */
+static inline void ____napi_schedule(struct softnet_data *sd,
+                                     struct napi_struct *napi)
+{
+        list_add_tail(&napi->poll_list, &sd->poll_list);
+        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+}
 
 #ifdef CONFIG_RPS
 
@@ -2225,7 +2236,11 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         int cpu = -1;
         u8 ip_proto;
         u16 tcpu;
-        u32 addr1, addr2, ports, ihl;
+        u32 addr1, addr2, ihl;
+        union {
+                u32 v32;
+                u16 v16[2];
+        } ports;
 
         if (skb_rx_queue_recorded(skb)) {
                 u16 index = skb_get_rx_queue(skb);
@@ -2271,7 +2286,6 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         default:
                 goto done;
         }
-        ports = 0;
         switch (ip_proto) {
         case IPPROTO_TCP:
         case IPPROTO_UDP:
@@ -2281,25 +2295,20 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         case IPPROTO_SCTP:
         case IPPROTO_UDPLITE:
                 if (pskb_may_pull(skb, (ihl * 4) + 4)) {
-                        __be16 *hports = (__be16 *) (skb->data + (ihl * 4));
-                        u32 sport, dport;
-
-                        sport = (__force u16) hports[0];
-                        dport = (__force u16) hports[1];
-                        if (dport < sport)
-                                swap(sport, dport);
-                        ports = (sport << 16) + dport;
+                        ports.v32 = * (__force u32 *) (skb->data + (ihl * 4));
+                        if (ports.v16[1] < ports.v16[0])
+                                swap(ports.v16[0], ports.v16[1]);
+                        break;
                 }
-                break;
-
         default:
+                ports.v32 = 0;
                 break;
         }
 
         /* get a consistent hash (same value on both flow directions) */
         if (addr2 < addr1)
                 swap(addr1, addr2);
-        skb->rxhash = jhash_3words(addr1, addr2, ports, hashrnd);
+        skb->rxhash = jhash_3words(addr1, addr2, ports.v32, hashrnd);
         if (!skb->rxhash)
                 skb->rxhash = 1;
 
@@ -2362,8 +2371,8 @@ static void rps_trigger_softirq(void *data)
 {
         struct softnet_data *sd = data;
 
-        __napi_schedule(&sd->backlog);
-        __get_cpu_var(netdev_rx_stat).received_rps++;
+        ____napi_schedule(sd, &sd->backlog);
+        sd->received_rps++;
 }
 
 #endif /* CONFIG_RPS */
@@ -2402,15 +2411,15 @@ static int enqueue_to_backlog(struct sk_buff *skb, int cpu,
         sd = &per_cpu(softnet_data, cpu);
 
         local_irq_save(flags);
-        __get_cpu_var(netdev_rx_stat).total++;
 
         rps_lock(sd);
-        if (sd->input_pkt_queue.qlen <= netdev_max_backlog) {
-                if (sd->input_pkt_queue.qlen) {
+        if (skb_queue_len(&sd->input_pkt_queue) <= netdev_max_backlog) {
+                if (skb_queue_len(&sd->input_pkt_queue)) {
 enqueue:
                         __skb_queue_tail(&sd->input_pkt_queue, skb);
 #ifdef CONFIG_RPS
-                        *qtail = sd->input_queue_head + sd->input_pkt_queue.qlen;
+                        *qtail = sd->input_queue_head +
+                                        skb_queue_len(&sd->input_pkt_queue);
 #endif
                         rps_unlock(sd);
                         local_irq_restore(flags);
@@ -2420,14 +2429,14 @@ enqueue:
                 /* Schedule NAPI for backlog device */
                 if (napi_schedule_prep(&sd->backlog)) {
                         if (!rps_ipi_queued(sd))
-                                __napi_schedule(&sd->backlog);
+                                ____napi_schedule(sd, &sd->backlog);
                 }
                 goto enqueue;
         }
 
+        sd->dropped++;
         rps_unlock(sd);
 
-        __get_cpu_var(netdev_rx_stat).dropped++;
         local_irq_restore(flags);
 
         kfree_skb(skb);
@@ -2527,6 +2536,7 @@ static void net_tx_action(struct softirq_action *h)
                 local_irq_disable();
                 head = sd->output_queue;
                 sd->output_queue = NULL;
+                sd->output_queue_tailp = &sd->output_queue;
                 local_irq_enable();
 
                 while (head) {
@@ -2801,7 +2811,7 @@ static int __netif_receive_skb(struct sk_buff *skb)
                         skb->dev = master;
         }
 
-        __get_cpu_var(netdev_rx_stat).total++;
+        __get_cpu_var(softnet_data).processed++;
 
         skb_reset_network_header(skb);
         skb_reset_transport_header(skb);
@@ -2930,13 +2940,21 @@ static void flush_backlog(void *arg)
         struct sk_buff *skb, *tmp;
 
         rps_lock(sd);
-        skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp)
+        skb_queue_walk_safe(&sd->input_pkt_queue, skb, tmp) {
                 if (skb->dev == dev) {
                         __skb_unlink(skb, &sd->input_pkt_queue);
                         kfree_skb(skb);
-                        input_queue_head_incr(sd);
+                        input_queue_head_add(sd, 1);
                 }
+        }
         rps_unlock(sd);
+
+        skb_queue_walk_safe(&sd->process_queue, skb, tmp) {
+                if (skb->dev == dev) {
+                        __skb_unlink(skb, &sd->process_queue);
+                        kfree_skb(skb);
+                }
+        }
 }
 
 static int napi_gro_complete(struct sk_buff *skb)
@@ -3239,30 +3257,85 @@ gro_result_t napi_gro_frags(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(napi_gro_frags);
 
+/*
+ * net_rps_action sends any pending IPI's for rps.
+ * Note: called with local irq disabled, but exits with local irq enabled.
+ */
+static void net_rps_action_and_irq_enable(struct softnet_data *sd)
+{
+#ifdef CONFIG_RPS
+        struct softnet_data *remsd = sd->rps_ipi_list;
+
+        if (remsd) {
+                sd->rps_ipi_list = NULL;
+
+                local_irq_enable();
+
+                /* Send pending IPI's to kick RPS processing on remote cpus. */
+                while (remsd) {
+                        struct softnet_data *next = remsd->rps_ipi_next;
+
+                        if (cpu_online(remsd->cpu))
+                                __smp_call_function_single(remsd->cpu,
+                                                           &remsd->csd, 0);
+                        remsd = next;
+                }
+        } else
+#endif
+                local_irq_enable();
+}
+
 static int process_backlog(struct napi_struct *napi, int quota)
 {
         int work = 0;
-        struct softnet_data *sd = &__get_cpu_var(softnet_data);
+        struct softnet_data *sd = container_of(napi, struct softnet_data, backlog);
 
+#ifdef CONFIG_RPS
+        /* Check if we have pending ipi, its better to send them now,
+         * not waiting net_rx_action() end.
+         */
+        if (sd->rps_ipi_list) {
+                local_irq_disable();
+                net_rps_action_and_irq_enable(sd);
+        }
+#endif
         napi->weight = weight_p;
-        do {
+        local_irq_disable();
+        while (work < quota) {
                 struct sk_buff *skb;
+                unsigned int qlen;
 
-                local_irq_disable();
-                rps_lock(sd);
-                skb = __skb_dequeue(&sd->input_pkt_queue);
-                if (!skb) {
-                        __napi_complete(napi);
-                        rps_unlock(sd);
+                while ((skb = __skb_dequeue(&sd->process_queue))) {
                         local_irq_enable();
-                        break;
+                        __netif_receive_skb(skb);
+                        if (++work >= quota)
+                                return work;
+                        local_irq_disable();
                 }
-                input_queue_head_incr(sd);
-                rps_unlock(sd);
-                local_irq_enable();
 
-                __netif_receive_skb(skb);
-        } while (++work < quota);
+                rps_lock(sd);
+                qlen = skb_queue_len(&sd->input_pkt_queue);
+                if (qlen) {
+                        input_queue_head_add(sd, qlen);
+                        skb_queue_splice_tail_init(&sd->input_pkt_queue,
+                                                   &sd->process_queue);
+                }
+                if (qlen < quota - work) {
+                        /*
+                         * Inline a custom version of __napi_complete().
+                         * only current cpu owns and manipulates this napi,
+                         * and NAPI_STATE_SCHED is the only possible flag set on backlog.
+                         * we can use a plain write instead of clear_bit(),
+                         * and we dont need an smp_mb() memory barrier.
+                         */
+                        list_del(&napi->poll_list);
+                        napi->state = 0;
+
+                        quota = work + qlen;
+                }
+                rps_unlock(sd);
+        }
+        local_irq_enable();
 
         return work;
 }
@@ -3278,8 +3351,7 @@ void __napi_schedule(struct napi_struct *n)
         unsigned long flags;
 
         local_irq_save(flags);
-        list_add_tail(&n->poll_list, &__get_cpu_var(softnet_data).poll_list);
-        __raise_softirq_irqoff(NET_RX_SOFTIRQ);
+        ____napi_schedule(&__get_cpu_var(softnet_data), n);
         local_irq_restore(flags);
 }
 EXPORT_SYMBOL(__napi_schedule);
@@ -3350,45 +3422,16 @@ void netif_napi_del(struct napi_struct *napi)
 }
 EXPORT_SYMBOL(netif_napi_del);
 
-/*
- * net_rps_action sends any pending IPI's for rps.
- * Note: called with local irq disabled, but exits with local irq enabled.
- */
-static void net_rps_action_and_irq_disable(void)
-{
-#ifdef CONFIG_RPS
-        struct softnet_data *sd = &__get_cpu_var(softnet_data);
-        struct softnet_data *remsd = sd->rps_ipi_list;
-
-        if (remsd) {
-                sd->rps_ipi_list = NULL;
-
-                local_irq_enable();
-
-                /* Send pending IPI's to kick RPS processing on remote cpus. */
-                while (remsd) {
-                        struct softnet_data *next = remsd->rps_ipi_next;
-
-                        if (cpu_online(remsd->cpu))
-                                __smp_call_function_single(remsd->cpu,
-                                                           &remsd->csd, 0);
-                        remsd = next;
-                }
-        } else
-#endif
-                local_irq_enable();
-}
-
 static void net_rx_action(struct softirq_action *h)
 {
-        struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
+        struct softnet_data *sd = &__get_cpu_var(softnet_data);
         unsigned long time_limit = jiffies + 2;
         int budget = netdev_budget;
         void *have;
 
         local_irq_disable();
 
-        while (!list_empty(list)) {
+        while (!list_empty(&sd->poll_list)) {
                 struct napi_struct *n;
                 int work, weight;
 
@@ -3406,7 +3449,7 @@ static void net_rx_action(struct softirq_action *h)
                  * entries to the tail of this list, and only ->poll()
                  * calls can remove this head entry from the list.
                  */
-                n = list_first_entry(list, struct napi_struct, poll_list);
+                n = list_first_entry(&sd->poll_list, struct napi_struct, poll_list);
 
                 have = netpoll_poll_lock(n);
 
@@ -3441,13 +3484,13 @@ static void net_rx_action(struct softirq_action *h)
                                 napi_complete(n);
                                 local_irq_disable();
                         } else
-                                list_move_tail(&n->poll_list, list);
+                                list_move_tail(&n->poll_list, &sd->poll_list);
                 }
 
                 netpoll_poll_unlock(have);
         }
 out:
-        net_rps_action_and_irq_disable();
+        net_rps_action_and_irq_enable(sd);
 
 #ifdef CONFIG_NET_DMA
         /*
@@ -3460,7 +3503,7 @@ out:
         return;
 
 softnet_break:
-        __get_cpu_var(netdev_rx_stat).time_squeeze++;
+        sd->time_squeeze++;
         __raise_softirq_irqoff(NET_RX_SOFTIRQ);
         goto out;
 }
@@ -3661,17 +3704,17 @@ static int dev_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct netif_rx_stats *softnet_get_online(loff_t *pos)
+static struct softnet_data *softnet_get_online(loff_t *pos)
 {
-        struct netif_rx_stats *rc = NULL;
+        struct softnet_data *sd = NULL;
 
         while (*pos < nr_cpu_ids)
                 if (cpu_online(*pos)) {
-                        rc = &per_cpu(netdev_rx_stat, *pos);
+                        sd = &per_cpu(softnet_data, *pos);
                         break;
                 } else
                         ++*pos;
-        return rc;
+        return sd;
 }
 
 static void *softnet_seq_start(struct seq_file *seq, loff_t *pos)
@@ -3691,12 +3734,12 @@ static void softnet_seq_stop(struct seq_file *seq, void *v)
 
 static int softnet_seq_show(struct seq_file *seq, void *v)
 {
-        struct netif_rx_stats *s = v;
+        struct softnet_data *sd = v;
 
         seq_printf(seq, "%08x %08x %08x %08x %08x %08x %08x %08x %08x %08x\n",
-                   s->total, s->dropped, s->time_squeeze, 0,
+                   sd->processed, sd->dropped, sd->time_squeeze, 0,
                    0, 0, 0, 0, /* was fastroute */
-                   s->cpu_collision, s->received_rps);
+                   sd->cpu_collision, sd->received_rps);
         return 0;
 }
 
@@ -5584,7 +5627,6 @@ static int dev_cpu_callback(struct notifier_block *nfb,
                             void *ocpu)
 {
         struct sk_buff **list_skb;
-        struct Qdisc **list_net;
         struct sk_buff *skb;
         unsigned int cpu, oldcpu = (unsigned long)ocpu;
         struct softnet_data *sd, *oldsd;
@@ -5605,13 +5647,13 @@ static int dev_cpu_callback(struct notifier_block *nfb,
         *list_skb = oldsd->completion_queue;
         oldsd->completion_queue = NULL;
 
-        /* Find end of our output_queue. */
-        list_net = &sd->output_queue;
-        while (*list_net)
-                list_net = &(*list_net)->next_sched;
         /* Append output queue from offline CPU. */
-        *list_net = oldsd->output_queue;
-        oldsd->output_queue = NULL;
+        if (oldsd->output_queue) {
+                *sd->output_queue_tailp = oldsd->output_queue;
+                sd->output_queue_tailp = oldsd->output_queue_tailp;
+                oldsd->output_queue = NULL;
+                oldsd->output_queue_tailp = &oldsd->output_queue;
+        }
 
         raise_softirq_irqoff(NET_TX_SOFTIRQ);
         local_irq_enable();
@@ -5619,8 +5661,10 @@ static int dev_cpu_callback(struct notifier_block *nfb,
         /* Process offline CPU's input_pkt_queue */
         while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
                 netif_rx(skb);
-                input_queue_head_incr(oldsd);
+                input_queue_head_add(oldsd, 1);
         }
+        while ((skb = __skb_dequeue(&oldsd->process_queue)))
+                netif_rx(skb);
 
         return NOTIFY_OK;
 }
@@ -5838,10 +5882,13 @@ static int __init net_dev_init(void)
         for_each_possible_cpu(i) {
                 struct softnet_data *sd = &per_cpu(softnet_data, i);
 
+                memset(sd, 0, sizeof(*sd));
                 skb_queue_head_init(&sd->input_pkt_queue);
+                skb_queue_head_init(&sd->process_queue);
                 sd->completion_queue = NULL;
                 INIT_LIST_HEAD(&sd->poll_list);
-
+                sd->output_queue = NULL;
+                sd->output_queue_tailp = &sd->output_queue;
 #ifdef CONFIG_RPS
                 sd->csd.func = rps_trigger_softirq;
                 sd->csd.info = sd;
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 1bc66592453c..42e84e08a1be 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -122,7 +122,7 @@ errout:
 }
 
 struct fib_rules_ops *
-fib_rules_register(struct fib_rules_ops *tmpl, struct net *net)
+fib_rules_register(const struct fib_rules_ops *tmpl, struct net *net)
 {
         struct fib_rules_ops *ops;
         int err;
diff --git a/net/core/filter.c b/net/core/filter.c
index ff943bed21af..da69fb728d32 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -302,6 +302,8 @@ load_b:
                         A = skb->pkt_type;
                         continue;
                 case SKF_AD_IFINDEX:
+                        if (!skb->dev)
+                                return 0;
                         A = skb->dev->ifindex;
                         continue;
                 case SKF_AD_MARK:
@@ -310,6 +312,11 @@ load_b:
                 case SKF_AD_QUEUE:
                         A = skb->queue_mapping;
                         continue;
+                case SKF_AD_HATYPE:
+                        if (!skb->dev)
+                                return 0;
+                        A = skb->dev->type;
+                        continue;
                 case SKF_AD_NLATTR: {
                         struct nlattr *nla;
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index bd8c4712ea24..c988e685433a 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -27,6 +27,51 @@ EXPORT_SYMBOL(init_net);
 
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 
+static void net_generic_release(struct rcu_head *rcu)
+{
+        struct net_generic *ng;
+
+        ng = container_of(rcu, struct net_generic, rcu);
+        kfree(ng);
+}
+
+static int net_assign_generic(struct net *net, int id, void *data)
+{
+        struct net_generic *ng, *old_ng;
+
+        BUG_ON(!mutex_is_locked(&net_mutex));
+        BUG_ON(id == 0);
+
+        ng = old_ng = net->gen;
+        if (old_ng->len >= id)
+                goto assign;
+
+        ng = kzalloc(sizeof(struct net_generic) +
+                        id * sizeof(void *), GFP_KERNEL);
+        if (ng == NULL)
+                return -ENOMEM;
+
+        /*
+         * Some synchronisation notes:
+         *
+         * The net_generic explores the net->gen array inside rcu
+         * read section. Besides once set the net->gen->ptr[x]
+         * pointer never changes (see rules in netns/generic.h).
+         *
+         * That said, we simply duplicate this array and schedule
+         * the old copy for kfree after a grace period.
+         */
+
+        ng->len = id;
+        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
+
+        rcu_assign_pointer(net->gen, ng);
+        call_rcu(&old_ng->rcu, net_generic_release);
+assign:
+        ng->ptr[id - 1] = data;
+        return 0;
+}
+
 static int ops_init(const struct pernet_operations *ops, struct net *net)
 {
         int err;
@@ -469,10 +514,10 @@ EXPORT_SYMBOL_GPL(register_pernet_subsys);
  *      addition run the exit method for all existing network
  *      namespaces.
  */
-void unregister_pernet_subsys(struct pernet_operations *module)
+void unregister_pernet_subsys(struct pernet_operations *ops)
 {
         mutex_lock(&net_mutex);
-        unregister_pernet_operations(module);
+        unregister_pernet_operations(ops);
         mutex_unlock(&net_mutex);
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_subsys);
@@ -526,49 +571,3 @@ void unregister_pernet_device(struct pernet_operations *ops)
         mutex_unlock(&net_mutex);
 }
 EXPORT_SYMBOL_GPL(unregister_pernet_device);
-
-static void net_generic_release(struct rcu_head *rcu)
-{
-        struct net_generic *ng;
-
-        ng = container_of(rcu, struct net_generic, rcu);
-        kfree(ng);
-}
-
-int net_assign_generic(struct net *net, int id, void *data)
-{
-        struct net_generic *ng, *old_ng;
-
-        BUG_ON(!mutex_is_locked(&net_mutex));
-        BUG_ON(id == 0);
-
-        ng = old_ng = net->gen;
-        if (old_ng->len >= id)
-                goto assign;
-
-        ng = kzalloc(sizeof(struct net_generic) +
-                        id * sizeof(void *), GFP_KERNEL);
-        if (ng == NULL)
-                return -ENOMEM;
-
-        /*
-         * Some synchronisation notes:
-         *
-         * The net_generic explores the net->gen array inside rcu
-         * read section. Besides once set the net->gen->ptr[x]
-         * pointer never changes (see rules in netns/generic.h).
-         *
-         * That said, we simply duplicate this array and schedule
-         * the old copy for kfree after a grace period.
-         */
-
-        ng->len = id;
-        memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
-
-        rcu_assign_pointer(net->gen, ng);
-        call_rcu(&old_ng->rcu, net_generic_release);
-assign:
-        ng->ptr[id - 1] = data;
-        return 0;
-}
-EXPORT_SYMBOL_GPL(net_assign_generic);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a58f59b97597..94825b109551 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -179,9 +179,8 @@ static void service_arp_queue(struct netpoll_info *npi)
         }
 }
 
-void netpoll_poll(struct netpoll *np)
+void netpoll_poll_dev(struct net_device *dev)
 {
-        struct net_device *dev = np->dev;
         const struct net_device_ops *ops;
 
         if (!dev || !netif_running(dev))
@@ -201,6 +200,11 @@ void netpoll_poll(struct netpoll *np)
         zap_completion_queue();
 }
 
+void netpoll_poll(struct netpoll *np)
+{
+        netpoll_poll_dev(np->dev);
+}
+
 static void refill_skbs(void)
 {
         struct sk_buff *skb;
@@ -282,7 +286,7 @@ static int netpoll_owner_active(struct net_device *dev)
         return 0;
 }
 
-static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
+void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
 {
         int status = NETDEV_TX_BUSY;
         unsigned long tries;
@@ -308,7 +312,9 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
                      tries > 0; --tries) {
                         if (__netif_tx_trylock(txq)) {
                                 if (!netif_tx_queue_stopped(txq)) {
+                                        dev->priv_flags |= IFF_IN_NETPOLL;
                                         status = ops->ndo_start_xmit(skb, dev);
+                                        dev->priv_flags &= ~IFF_IN_NETPOLL;
                                         if (status == NETDEV_TX_OK)
                                                 txq_trans_update(txq);
                                 }
@@ -756,7 +762,10 @@ int netpoll_setup(struct netpoll *np)
                 atomic_inc(&npinfo->refcnt);
         }
 
-        if (!ndev->netdev_ops->ndo_poll_controller) {
+        npinfo->netpoll = np;
+
+        if ((ndev->priv_flags & IFF_DISABLE_NETPOLL) ||
+            !ndev->netdev_ops->ndo_poll_controller) {
                 printk(KERN_ERR "%s: %s doesn't support polling, aborting.\n",
                        np->name, np->dev_name);
                 err = -ENOTSUPP;
@@ -878,6 +887,7 @@ void netpoll_cleanup(struct netpoll *np)
                         }
 
                         if (atomic_dec_and_test(&npinfo->refcnt)) {
+                                const struct net_device_ops *ops;
                                 skb_queue_purge(&npinfo->arp_tx);
                                 skb_queue_purge(&npinfo->txq);
                                 cancel_rearming_delayed_work(&npinfo->tx_work);
@@ -885,7 +895,11 @@ void netpoll_cleanup(struct netpoll *np)
                                 /* clean after last, unfinished work */
                                 __skb_queue_purge(&npinfo->txq);
                                 kfree(npinfo);
-                                np->dev->npinfo = NULL;
+                                ops = np->dev->netdev_ops;
+                                if (ops->ndo_netpoll_cleanup)
+                                        ops->ndo_netpoll_cleanup(np->dev);
+                                else
+                                        np->dev->npinfo = NULL;
                         }
                 }
 
@@ -908,6 +922,7 @@ void netpoll_set_trap(int trap)
                 atomic_dec(&trapped);
 }
 
+EXPORT_SYMBOL(netpoll_send_skb);
 EXPORT_SYMBOL(netpoll_set_trap);
 EXPORT_SYMBOL(netpoll_trap);
 EXPORT_SYMBOL(netpoll_print_options);
@@ -915,4 +930,5 @@ EXPORT_SYMBOL(netpoll_parse_options);
 EXPORT_SYMBOL(netpoll_setup);
 EXPORT_SYMBOL(netpoll_cleanup);
 EXPORT_SYMBOL(netpoll_send_udp);
+EXPORT_SYMBOL(netpoll_poll_dev);
 EXPORT_SYMBOL(netpoll_poll);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 78c85985cb30..23a71cb21273 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -98,7 +98,7 @@ int lockdep_rtnl_is_held(void)
 EXPORT_SYMBOL(lockdep_rtnl_is_held);
 #endif /* #ifdef CONFIG_PROVE_LOCKING */
 
-static struct rtnl_link *rtnl_msg_handlers[NPROTO];
+static struct rtnl_link *rtnl_msg_handlers[RTNL_FAMILY_MAX + 1];
 
 static inline int rtm_msgindex(int msgtype)
 {
@@ -118,7 +118,7 @@ static rtnl_doit_func rtnl_get_doit(int protocol, int msgindex)
 {
         struct rtnl_link *tab;
 
-        if (protocol < NPROTO)
+        if (protocol <= RTNL_FAMILY_MAX)
                 tab = rtnl_msg_handlers[protocol];
         else
                 tab = NULL;
@@ -133,7 +133,7 @@ static rtnl_dumpit_func rtnl_get_dumpit(int protocol, int msgindex)
 {
         struct rtnl_link *tab;
 
-        if (protocol < NPROTO)
+        if (protocol <= RTNL_FAMILY_MAX)
                 tab = rtnl_msg_handlers[protocol];
         else
                 tab = NULL;
@@ -167,7 +167,7 @@ int __rtnl_register(int protocol, int msgtype,
         struct rtnl_link *tab;
         int msgindex;
 
-        BUG_ON(protocol < 0 || protocol >= NPROTO);
+        BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
         msgindex = rtm_msgindex(msgtype);
 
         tab = rtnl_msg_handlers[protocol];
@@ -219,7 +219,7 @@ int rtnl_unregister(int protocol, int msgtype)
 {
         int msgindex;
 
-        BUG_ON(protocol < 0 || protocol >= NPROTO);
+        BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
         msgindex = rtm_msgindex(msgtype);
 
         if (rtnl_msg_handlers[protocol] == NULL)
@@ -241,7 +241,7 @@ EXPORT_SYMBOL_GPL(rtnl_unregister);
  */
 void rtnl_unregister_all(int protocol)
 {
-        BUG_ON(protocol < 0 || protocol >= NPROTO);
+        BUG_ON(protocol < 0 || protocol > RTNL_FAMILY_MAX);
 
         kfree(rtnl_msg_handlers[protocol]);
         rtnl_msg_handlers[protocol] = NULL;
@@ -1319,10 +1319,11 @@ replay:
                         err = ops->newlink(net, dev, tb, data);
                 else
                         err = register_netdevice(dev);
-                if (err < 0 && !IS_ERR(dev)) {
+
+                if (err < 0 && !IS_ERR(dev))
                         free_netdev(dev);
+                if (err < 0)
                         goto out;
-                }
 
                 err = rtnl_configure_link(dev, ifm);
                 if (err < 0)
@@ -1384,7 +1385,7 @@ static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
 
         if (s_idx == 0)
                 s_idx = 1;
-        for (idx = 1; idx < NPROTO; idx++) {
+        for (idx = 1; idx <= RTNL_FAMILY_MAX; idx++) {
                 int type = cb->nlh->nlmsg_type-RTM_BASE;
                 if (idx < s_idx || idx == PF_PACKET)
                         continue;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index bdea0efdf8cb..a9b0e1f77806 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -117,7 +117,7 @@ static const struct pipe_buf_operations sock_pipe_buf_ops = {
  *
  *      Out of line support code for skb_put(). Not user callable.
  */
-void skb_over_panic(struct sk_buff *skb, int sz, void *here)
+static void skb_over_panic(struct sk_buff *skb, int sz, void *here)
 {
         printk(KERN_EMERG "skb_over_panic: text:%p len:%d put:%d head:%p "
                           "data:%p tail:%#lx end:%#lx dev:%s\n",
@@ -126,7 +126,6 @@ void skb_over_panic(struct sk_buff *skb, int sz, void *here)
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
-EXPORT_SYMBOL(skb_over_panic);
 
 /**
  *      skb_under_panic -       private function
@@ -137,7 +136,7 @@ EXPORT_SYMBOL(skb_over_panic);
  *      Out of line support code for skb_push(). Not user callable.
  */
 
-void skb_under_panic(struct sk_buff *skb, int sz, void *here)
+static void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 {
         printk(KERN_EMERG "skb_under_panic: text:%p len:%d put:%d head:%p "
                           "data:%p tail:%#lx end:%#lx dev:%s\n",
@@ -146,7 +145,6 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
                skb->dev ? skb->dev->name : "<NULL>");
         BUG();
 }
-EXPORT_SYMBOL(skb_under_panic);
 
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
@@ -183,12 +181,14 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         skb = kmem_cache_alloc_node(cache, gfp_mask & ~__GFP_DMA, node);
         if (!skb)
                 goto out;
+        prefetchw(skb);
 
         size = SKB_DATA_ALIGN(size);
         data = kmalloc_node_track_caller(size + sizeof(struct skb_shared_info),
                         gfp_mask, node);
         if (!data)
                 goto nodata;
+        prefetchw(data + size);
 
         /*
          * Only clear those fields we need to clear, not those that we will
@@ -210,15 +210,8 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 
         /* make sure we initialize shinfo sequentially */
         shinfo = skb_shinfo(skb);
+        memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
-        shinfo->nr_frags  = 0;
-        shinfo->gso_size = 0;
-        shinfo->gso_segs = 0;
-        shinfo->gso_type = 0;
-        shinfo->ip6_frag_id = 0;
-        shinfo->tx_flags.flags = 0;
-        skb_frag_list_init(skb);
-        memset(&shinfo->hwtstamps, 0, sizeof(shinfo->hwtstamps));
 
         if (fclone) {
                 struct sk_buff *child = skb + 1;
@@ -507,16 +500,10 @@ int skb_recycle_check(struct sk_buff *skb, int skb_size)
                 return 0;
 
         skb_release_head_state(skb);
+
         shinfo = skb_shinfo(skb);
+        memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
-        shinfo->nr_frags = 0;
-        shinfo->gso_size = 0;
-        shinfo->gso_segs = 0;
-        shinfo->gso_type = 0;
-        shinfo->ip6_frag_id = 0;
-        shinfo->tx_flags.flags = 0;
-        skb_frag_list_init(skb);
-        memset(&shinfo->hwtstamps, 0, sizeof(shinfo->hwtstamps));
 
         memset(skb, 0, offsetof(struct sk_buff, tail));
         skb->data = skb->head + NET_SKB_PAD;
@@ -1053,7 +1040,7 @@ EXPORT_SYMBOL(skb_push);
  */
 unsigned char *skb_pull(struct sk_buff *skb, unsigned int len)
 {
-        return unlikely(len > skb->len) ? NULL : __skb_pull(skb, len);
+        return skb_pull_inline(skb, len);
 }
 EXPORT_SYMBOL(skb_pull);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 7effa1e689df..94c4affdda9b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -327,6 +327,10 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
 
         skb->dev = NULL;
 
+        if (sk_rcvqueues_full(sk, skb)) {
+                atomic_inc(&sk->sk_drops);
+                goto discard_and_relse;
+        }
         if (nested)
                 bh_lock_sock_nested(sk);
         else
@@ -1207,7 +1211,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
                  */
                 sk_refcnt_debug_inc(newsk);
                 sk_set_socket(newsk, NULL);
-                newsk->sk_sleep  = NULL;
+                newsk->sk_wq = NULL;
 
                 if (newsk->sk_prot->sockets_allocated)
                         percpu_counter_inc(newsk->sk_prot->sockets_allocated);
@@ -1395,7 +1399,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
                 if (signal_pending(current))
                         break;
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf)
                         break;
                 if (sk->sk_shutdown & SEND_SHUTDOWN)
@@ -1404,7 +1408,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
                         break;
                 timeo = schedule_timeout(timeo);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return timeo;
 }
 
@@ -1570,11 +1574,11 @@ int sk_wait_data(struct sock *sk, long *timeo)
         int rc;
         DEFINE_WAIT(wait);
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         rc = sk_wait_event(sk, timeo, !skb_queue_empty(&sk->sk_receive_queue));
         clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return rc;
 }
 EXPORT_SYMBOL(sk_wait_data);
@@ -1796,41 +1800,53 @@ EXPORT_SYMBOL(sock_no_sendpage);
 
 static void sock_def_wakeup(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
-        if (sk_has_sleeper(sk))
-                wake_up_interruptible_all(sk->sk_sleep);
-        read_unlock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_all(&wq->wait);
+        rcu_read_unlock();
 }
 
 static void sock_def_error_report(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
-        if (sk_has_sleeper(sk))
-                wake_up_interruptible_poll(sk->sk_sleep, POLLERR);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_poll(&wq->wait, POLLERR);
         sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 static void sock_def_readable(struct sock *sk, int len)
 {
-        read_lock(&sk->sk_callback_lock);
-        if (sk_has_sleeper(sk))
-                wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
                                                 POLLRDNORM | POLLRDBAND);
         sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 static void sock_def_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
 
         /* Do not wake up a writer until he can make "significant"
          * progress.  --DaveM
          */
         if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
-                if (sk_has_sleeper(sk))
-                        wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT |
+                wq = rcu_dereference(sk->sk_wq);
+                if (wq_has_sleeper(wq))
+                        wake_up_interruptible_sync_poll(&wq->wait, POLLOUT |
                                                 POLLWRNORM | POLLWRBAND);
 
                 /* Should agree with poll, otherwise some programs break */
@@ -1838,7 +1854,7 @@ static void sock_def_write_space(struct sock *sk)
                         sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
 
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 static void sock_def_destruct(struct sock *sk)
@@ -1885,7 +1901,6 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk->sk_allocation       =       GFP_KERNEL;
         sk->sk_rcvbuf           =       sysctl_rmem_default;
         sk->sk_sndbuf           =       sysctl_wmem_default;
-        sk->sk_backlog.limit    =       sk->sk_rcvbuf << 1;
         sk->sk_state            =       TCP_CLOSE;
         sk_set_socket(sk, sock);
 
@@ -1893,10 +1908,10 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         if (sock) {
                 sk->sk_type     =       sock->type;
-                sk->sk_sleep    =       &sock->wait;
+                sk->sk_wq       =       sock->wq;
                 sock->sk        =       sk;
         } else
-                sk->sk_sleep    =       NULL;
+                sk->sk_wq       =       NULL;
 
         spin_lock_init(&sk->sk_dst_lock);
         rwlock_init(&sk->sk_callback_lock);
diff --git a/net/core/stream.c b/net/core/stream.c
index a37debfeb1b2..cc196f42b8d8 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -28,15 +28,19 @@
 void sk_stream_write_space(struct sock *sk)
 {
         struct socket *sock = sk->sk_socket;
+        struct socket_wq *wq;
 
         if (sk_stream_wspace(sk) >= sk_stream_min_wspace(sk) && sock) {
                 clear_bit(SOCK_NOSPACE, &sock->flags);
 
-                if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                        wake_up_interruptible_poll(sk->sk_sleep, POLLOUT |
+                rcu_read_lock();
+                wq = rcu_dereference(sk->sk_wq);
+                if (wq_has_sleeper(wq))
+                        wake_up_interruptible_poll(&wq->wait, POLLOUT |
                                                 POLLWRNORM | POLLWRBAND);
-                if (sock->fasync_list && !(sk->sk_shutdown & SEND_SHUTDOWN))
+                if (wq && wq->fasync_list && !(sk->sk_shutdown & SEND_SHUTDOWN))
                         sock_wake_async(sock, SOCK_WAKE_SPACE, POLL_OUT);
+                rcu_read_unlock();
         }
 }
 
@@ -66,13 +70,13 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
                 if (signal_pending(tsk))
                         return sock_intr_errno(*timeo_p);
 
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 sk->sk_write_pending++;
                 done = sk_wait_event(sk, timeo_p,
                                      !sk->sk_err &&
                                      !((1 << sk->sk_state) &
                                        ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)));
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
                 sk->sk_write_pending--;
         } while (!done);
         return 0;
@@ -96,13 +100,13 @@ void sk_stream_wait_close(struct sock *sk, long timeout)
                 DEFINE_WAIT(wait);
 
                 do {
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_INTERRUPTIBLE);
                         if (sk_wait_event(sk, &timeout, !sk_stream_closing(sk)))
                                 break;
                 } while (!signal_pending(current) && timeout);
 
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
         }
 }
 
@@ -126,7 +130,7 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
         while (1) {
                 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
 
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                 if (sk->sk_err || (sk->sk_shutdown & SEND_SHUTDOWN))
                         goto do_error;
@@ -157,7 +161,7 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
                 *timeo_p = current_timeo;
         }
 out:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return err;
 
 do_error:
diff --git a/net/dccp/output.c b/net/dccp/output.c
index e98b65e9569f..aadbdb58758b 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -195,15 +195,17 @@ EXPORT_SYMBOL_GPL(dccp_sync_mss);
 
 void dccp_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
 
-        if (sk_has_sleeper(sk))
-                wake_up_interruptible(sk->sk_sleep);
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible(&wq->wait);
         /* Should agree with poll, otherwise some programs break */
         if (sock_writeable(sk))
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
 
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 /**
@@ -225,7 +227,7 @@ static int dccp_wait_for_ccid(struct sock *sk, struct sk_buff *skb, int delay)
                 dccp_pr_debug("delayed send by %d msec\n", delay);
                 jiffdelay = msecs_to_jiffies(delay);
 
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                 sk->sk_write_pending++;
                 release_sock(sk);
@@ -241,7 +243,7 @@ static int dccp_wait_for_ccid(struct sock *sk, struct sk_buff *skb, int delay)
                 rc = ccid_hc_tx_send_packet(dp->dccps_hc_tx_ccid, sk, skb);
         } while ((delay = rc) > 0);
 out:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return rc;
 
 do_error:
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a0e38d8018f5..b03ecf6b2bb0 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -312,7 +312,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         if (sk->sk_state == DCCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index 55e3b6b0061a..d6b93d19790f 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -832,7 +832,7 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
         scp->segsize_loc = dst_metric(__sk_dst_get(sk), RTAX_ADVMSS);
         dn_send_conn_conf(sk, allocation);
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         for(;;) {
                 release_sock(sk);
                 if (scp->state == DN_CC)
@@ -850,9 +850,9 @@ static int dn_confirm_accept(struct sock *sk, long *timeo, gfp_t allocation)
                 err = -EAGAIN;
                 if (!*timeo)
                         break;
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (err == 0) {
                 sk->sk_socket->state = SS_CONNECTED;
         } else if (scp->state != DN_CC) {
@@ -873,7 +873,7 @@ static int dn_wait_run(struct sock *sk, long *timeo)
         if (!*timeo)
                 return -EALREADY;
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         for(;;) {
                 release_sock(sk);
                 if (scp->state == DN_CI || scp->state == DN_CC)
@@ -891,9 +891,9 @@ static int dn_wait_run(struct sock *sk, long *timeo)
                 err = -ETIMEDOUT;
                 if (!*timeo)
                         break;
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 out:
         if (err == 0) {
                 sk->sk_socket->state = SS_CONNECTED;
@@ -1040,7 +1040,7 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
         struct sk_buff *skb = NULL;
         int err = 0;
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         for(;;) {
                 release_sock(sk);
                 skb = skb_dequeue(&sk->sk_receive_queue);
@@ -1060,9 +1060,9 @@ static struct sk_buff *dn_wait_for_connect(struct sock *sk, long *timeo)
                 err = -EAGAIN;
                 if (!*timeo)
                         break;
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 
         return skb == NULL ? ERR_PTR(err) : skb;
 }
@@ -1746,11 +1746,11 @@ static int dn_recvmsg(struct kiocb *iocb, struct socket *sock,
                         goto out;
                 }
 
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
                 sk_wait_event(sk, &timeo, dn_data_ready(sk, queue, flags, target));
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
         }
 
         skb_queue_walk_safe(queue, skb, n) {
@@ -2003,12 +2003,12 @@ static int dn_sendmsg(struct kiocb *iocb, struct socket *sock,
                                 goto out;
                         }
 
-                        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                         set_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
                         sk_wait_event(sk, &timeo,
                                       !dn_queue_too_long(scp, queue, flags));
                         clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
-                        finish_wait(sk->sk_sleep, &wait);
+                        finish_wait(sk_sleep(sk), &wait);
                         continue;
                 }
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index af28dcc21844..48fdf10be7a1 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -216,8 +216,8 @@ static void dn_fib_rule_flush_cache(struct fib_rules_ops *ops)
         dn_rt_cache_flush(-1);
 }
 
-static struct fib_rules_ops dn_fib_rules_ops_template = {
-        .family         = FIB_RULES_DECNET,
+static const struct fib_rules_ops __net_initdata dn_fib_rules_ops_template = {
+        .family         = AF_DECnet,
         .rule_size      = sizeof(struct dn_fib_rule),
         .addr_size      = sizeof(u16),
         .action         = dn_fib_rule_action,
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 205a1c12f3c0..61ec0329316c 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -136,7 +136,7 @@ int eth_rebuild_header(struct sk_buff *skb)
         default:
                 printk(KERN_DEBUG
                        "%s: unable to resolve type %X addresses.\n",
-                       dev->name, (int)eth->h_proto);
+                       dev->name, ntohs(eth->h_proto));
 
                 memcpy(eth->h_source, dev->dev_addr, ETH_ALEN);
                 break;
@@ -162,7 +162,7 @@ __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev)
 
         skb->dev = dev;
         skb_reset_mac_header(skb);
-        skb_pull(skb, ETH_HLEN);
+        skb_pull_inline(skb, ETH_HLEN);
         eth = eth_hdr(skb);
 
         if (unlikely(is_multicast_ether_addr(eth->h_dest))) {
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index c7da600750bb..93c91b633a56 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -151,6 +151,9 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
         dev_load(sock_net(sk), ifr.ifr_name);
         dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
 
+        if (!dev)
+                return -ENODEV;
+
         if (dev->type == ARPHRD_IEEE802154 && dev->netdev_ops->ndo_do_ioctl)
                 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
 
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index c5376c725503..c6c43bcd1c6f 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -419,7 +419,7 @@ int inet_release(struct socket *sock)
         if (sk) {
                 long timeout;
 
-                inet_rps_reset_flow(sk);
+                sock_rps_reset_flow(sk);
 
                 /* Applications forget to leave groups before exiting */
                 ip_mc_drop_socket(sk);
@@ -548,7 +548,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo)
 {
         DEFINE_WAIT(wait);
 
-        prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
         /* Basic assumption: if someone sets sk->sk_err, he _must_
          * change state of the socket from TCP_SYN_*.
@@ -561,9 +561,9 @@ static long inet_wait_for_connect(struct sock *sk, long timeo)
                 lock_sock(sk);
                 if (signal_pending(current) || !timeo)
                         break;
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return timeo;
 }
 
@@ -722,7 +722,7 @@ int inet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
 {
         struct sock *sk = sock->sk;
 
-        inet_rps_record_flow(sk);
+        sock_rps_record_flow(sk);
 
         /* We may need to bind the socket. */
         if (!inet_sk(sk)->inet_num && inet_autobind(sk))
@@ -737,7 +737,7 @@ static ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset,
 {
         struct sock *sk = sock->sk;
 
-        inet_rps_record_flow(sk);
+        sock_rps_record_flow(sk);
 
         /* We may need to bind the socket. */
         if (!inet_sk(sk)->inet_num && inet_autobind(sk))
@@ -755,7 +755,7 @@ int inet_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
         int addr_len = 0;
         int err;
 
-        inet_rps_record_flow(sk);
+        sock_rps_record_flow(sk);
 
         err = sk->sk_prot->recvmsg(iocb, sk, msg, size, flags & MSG_DONTWAIT,
                                    flags & ~MSG_DONTWAIT, &addr_len);
@@ -1323,8 +1323,8 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
         if (unlikely(ip_fast_csum((u8 *)iph, iph->ihl)))
                 goto out_unlock;
 
-        id = ntohl(*(u32 *)&iph->id);
-        flush = (u16)((ntohl(*(u32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
+        id = ntohl(*(__be32 *)&iph->id);
+        flush = (u16)((ntohl(*(__be32 *)iph) ^ skb_gro_len(skb)) | (id ^ IP_DF));
         id >>= 16;
 
         for (p = *head; p; p = p->next) {
@@ -1337,8 +1337,8 @@ static struct sk_buff **inet_gro_receive(struct sk_buff **head,
 
                 if ((iph->protocol ^ iph2->protocol) |
                     (iph->tos ^ iph2->tos) |
-                    (iph->saddr ^ iph2->saddr) |
-                    (iph->daddr ^ iph2->daddr)) {
+                    ((__force u32)iph->saddr ^ (__force u32)iph2->saddr) |
+                    ((__force u32)iph->daddr ^ (__force u32)iph2->daddr)) {
                         NAPI_GRO_CB(p)->same_flow = 0;
                         continue;
                 }
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index 3ec84fea5b71..76daeb5ff564 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -245,8 +245,8 @@ static void fib4_rule_flush_cache(struct fib_rules_ops *ops)
         rt_cache_flush(ops->fro_net, -1);
 }
 
-static struct fib_rules_ops fib4_rules_ops_template = {
-        .family         = FIB_RULES_IPV4,
+static const struct fib_rules_ops __net_initdata fib4_rules_ops_template = {
+        .family         = AF_INET,
         .rule_size      = sizeof(struct fib4_rule),
         .addr_size      = sizeof(u32),
         .action         = fib4_rule_action,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 59a838795e3e..c98f115fb0fd 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -209,7 +209,9 @@ static inline struct node *tnode_get_child_rcu(struct tnode *tn, unsigned int i)
 {
         struct node *ret = tnode_get_child(tn, i);
 
-        return rcu_dereference(ret);
+        return rcu_dereference_check(ret,
+                                     rcu_read_lock_held() ||
+                                     lockdep_rtnl_is_held());
 }
 
 static inline int tnode_child_length(const struct tnode *tn)
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 8da6429269dd..e0a3e3537b14 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -234,7 +234,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
          * having to remove and re-insert us on the wait queue.
          */
         for (;;) {
-                prepare_to_wait_exclusive(sk->sk_sleep, &wait,
+                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
                 release_sock(sk);
                 if (reqsk_queue_empty(&icsk->icsk_accept_queue))
@@ -253,7 +253,7 @@ static int inet_csk_wait_for_connect(struct sock *sk, long timeo)
                 if (!timeo)
                         break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return err;
 }
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d979710684b2..252897443ef9 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -120,7 +120,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index b0aa0546a3b3..ce231780a2b1 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -954,6 +954,22 @@ e_inval:
         return -EINVAL;
 }
 
+/**
+ * ip_queue_rcv_skb - Queue an skb into sock receive queue
+ * @sk: socket
+ * @skb: buffer
+ *
+ * Queues an skb into socket receive queue. If IP_CMSG_PKTINFO option
+ * is not set, we drop skb dst entry now, while dst cache line is hot.
+ */
+int ip_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+{
+        if (!(inet_sk(sk)->cmsg_flags & IP_CMSG_PKTINFO))
+                skb_dst_drop(skb);
+        return sock_queue_rcv_skb(sk, skb);
+}
+EXPORT_SYMBOL(ip_queue_rcv_skb);
+
 int ip_setsockopt(struct sock *sk, int level,
                 int optname, char __user *optval, unsigned int optlen)
 {
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 1aa498d7a0a5..f3f1c6b5c70c 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -128,8 +128,8 @@ static int ip_mr_forward(struct net *net, struct mr_table *mrt,
                          int local);
 static int ipmr_cache_report(struct mr_table *mrt,
                              struct sk_buff *pkt, vifi_t vifi, int assert);
-static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
-                            struct mfc_cache *c, struct rtmsg *rtm);
+static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                              struct mfc_cache *c, struct rtmsg *rtm);
 static void ipmr_expire_process(unsigned long arg);
 
 #ifdef CONFIG_IP_MROUTE_MULTIPLE_TABLES
@@ -216,8 +216,8 @@ static int ipmr_rule_fill(struct fib_rule *rule, struct sk_buff *skb,
         return 0;
 }
 
-static struct fib_rules_ops ipmr_rules_ops_template = {
-        .family         = FIB_RULES_IPMR,
+static const struct fib_rules_ops __net_initdata ipmr_rules_ops_template = {
+        .family         = RTNL_FAMILY_IPMR,
         .rule_size      = sizeof(struct ipmr_rule),
         .addr_size      = sizeof(u32),
         .action         = ipmr_rule_action,
@@ -831,7 +831,7 @@ static void ipmr_cache_resolve(struct net *net, struct mr_table *mrt,
                 if (ip_hdr(skb)->version == 0) {
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct iphdr));
 
-                        if (ipmr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
+                        if (__ipmr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
                                 nlh->nlmsg_len = (skb_tail_pointer(skb) -
                                                   (u8 *)nlh);
                         } else {
@@ -1772,10 +1772,10 @@ int ip_mr_input(struct sk_buff *skb)
 
                 vif = ipmr_find_vif(mrt, skb->dev);
                 if (vif >= 0) {
-                        int err = ipmr_cache_unresolved(mrt, vif, skb);
+                        int err2 = ipmr_cache_unresolved(mrt, vif, skb);
                         read_unlock(&mrt_lock);
 
-                        return err;
+                        return err2;
                 }
                 read_unlock(&mrt_lock);
                 kfree_skb(skb);
@@ -1904,9 +1904,8 @@ drop:
 }
 #endif
 
-static int
-ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb, struct mfc_cache *c,
-                 struct rtmsg *rtm)
+static int __ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                              struct mfc_cache *c, struct rtmsg *rtm)
 {
         int ct;
         struct rtnexthop *nhp;
@@ -1994,11 +1993,93 @@ int ipmr_get_route(struct net *net,
 
         if (!nowait && (rtm->rtm_flags&RTM_F_NOTIFY))
                 cache->mfc_flags |= MFC_NOTIFY;
-        err = ipmr_fill_mroute(mrt, skb, cache, rtm);
+        err = __ipmr_fill_mroute(mrt, skb, cache, rtm);
         read_unlock(&mrt_lock);
         return err;
 }
 
+static int ipmr_fill_mroute(struct mr_table *mrt, struct sk_buff *skb,
+                            u32 pid, u32 seq, struct mfc_cache *c)
+{
+        struct nlmsghdr *nlh;
+        struct rtmsg *rtm;
+
+        nlh = nlmsg_put(skb, pid, seq, RTM_NEWROUTE, sizeof(*rtm), NLM_F_MULTI);
+        if (nlh == NULL)
+                return -EMSGSIZE;
+
+        rtm = nlmsg_data(nlh);
+        rtm->rtm_family   = RTNL_FAMILY_IPMR;
+        rtm->rtm_dst_len  = 32;
+        rtm->rtm_src_len  = 32;
+        rtm->rtm_tos      = 0;
+        rtm->rtm_table    = mrt->id;
+        NLA_PUT_U32(skb, RTA_TABLE, mrt->id);
+        rtm->rtm_type     = RTN_MULTICAST;
+        rtm->rtm_scope    = RT_SCOPE_UNIVERSE;
+        rtm->rtm_protocol = RTPROT_UNSPEC;
+        rtm->rtm_flags    = 0;
+
+        NLA_PUT_BE32(skb, RTA_SRC, c->mfc_origin);
+        NLA_PUT_BE32(skb, RTA_DST, c->mfc_mcastgrp);
+
+        if (__ipmr_fill_mroute(mrt, skb, c, rtm) < 0)
+                goto nla_put_failure;
+
+        return nlmsg_end(skb, nlh);
+
+nla_put_failure:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
+}
+
+static int ipmr_rtm_dumproute(struct sk_buff *skb, struct netlink_callback *cb)
+{
+        struct net *net = sock_net(skb->sk);
+        struct mr_table *mrt;
+        struct mfc_cache *mfc;
+        unsigned int t = 0, s_t;
+        unsigned int h = 0, s_h;
+        unsigned int e = 0, s_e;
+
+        s_t = cb->args[0];
+        s_h = cb->args[1];
+        s_e = cb->args[2];
+
+        read_lock(&mrt_lock);
+        ipmr_for_each_table(mrt, net) {
+                if (t < s_t)
+                        goto next_table;
+                if (t > s_t)
+                        s_h = 0;
+                for (h = s_h; h < MFC_LINES; h++) {
+                        list_for_each_entry(mfc, &mrt->mfc_cache_array[h], list) {
+                                if (e < s_e)
+                                        goto next_entry;
+                                if (ipmr_fill_mroute(mrt, skb,
+                                                     NETLINK_CB(cb->skb).pid,
+                                                     cb->nlh->nlmsg_seq,
+                                                     mfc) < 0)
+                                        goto done;
+next_entry:
+                                e++;
+                        }
+                        e = s_e = 0;
+                }
+                s_h = 0;
+next_table:
+                t++;
+        }
+done:
+        read_unlock(&mrt_lock);
+
+        cb->args[2] = e;
+        cb->args[1] = h;
+        cb->args[0] = t;
+
+        return skb->len;
+}
+
 #ifdef CONFIG_PROC_FS
 /*
  *      The /proc interfaces to multicast routing /proc/ip_mr_cache /proc/ip_mr_vif
@@ -2227,9 +2308,9 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
                 const struct ipmr_mfc_iter *it = seq->private;
                 const struct mr_table *mrt = it->mrt;
 
-                seq_printf(seq, "%08lX %08lX %-3hd",
-                           (unsigned long) mfc->mfc_mcastgrp,
-                           (unsigned long) mfc->mfc_origin,
+                seq_printf(seq, "%08X %08X %-3hd",
+                           (__force u32) mfc->mfc_mcastgrp,
+                           (__force u32) mfc->mfc_origin,
                            mfc->mfc_parent);
 
                 if (it->cache != &mrt->mfc_unres_queue) {
@@ -2355,6 +2436,7 @@ int __init ip_mr_init(void)
                 goto add_proto_fail;
         }
 #endif
+        rtnl_register(RTNL_FAMILY_IPMR, RTM_GETROUTE, NULL, ipmr_rtm_dumproute);
         return 0;
 
 #ifdef CONFIG_IP_PIMSM_V2
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bbda0d5f9244..2c7a1639388a 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -290,7 +290,7 @@ static int raw_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
         /* Charge it to the socket. */
 
-        if (sock_queue_rcv_skb(sk, skb) < 0) {
+        if (ip_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index cb562fdd9b9a..dea3f9264250 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -129,7 +129,6 @@ static int ip_rt_gc_elasticity __read_mostly	= 8;
 static int ip_rt_mtu_expires __read_mostly      = 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
-static int ip_rt_secret_interval __read_mostly  = 10 * 60 * HZ;
 static int rt_chain_length_max __read_mostly    = 20;
 
 static struct delayed_work expires_work;
@@ -258,10 +257,9 @@ static DEFINE_PER_CPU(struct rt_cache_stat, rt_cache_stat);
         (__raw_get_cpu_var(rt_cache_stat).field++)
 
 static inline unsigned int rt_hash(__be32 daddr, __be32 saddr, int idx,
-                int genid)
+                                   int genid)
 {
-        return jhash_3words((__force u32)(__be32)(daddr),
-                            (__force u32)(__be32)(saddr),
+        return jhash_3words((__force u32)daddr, (__force u32)saddr,
                             idx, genid)
                 & rt_hash_mask;
 }
@@ -378,12 +376,13 @@ static int rt_cache_seq_show(struct seq_file *seq, void *v)
                 struct rtable *r = v;
                 int len;
 
-                seq_printf(seq, "%s\t%08lX\t%08lX\t%8X\t%d\t%u\t%d\t"
-                              "%08lX\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
+                seq_printf(seq, "%s\t%08X\t%08X\t%8X\t%d\t%u\t%d\t"
+                              "%08X\t%d\t%u\t%u\t%02X\t%d\t%1d\t%08X%n",
                         r->u.dst.dev ? r->u.dst.dev->name : "*",
-                        (unsigned long)r->rt_dst, (unsigned long)r->rt_gateway,
+                        (__force u32)r->rt_dst,
+                        (__force u32)r->rt_gateway,
                         r->rt_flags, atomic_read(&r->u.dst.__refcnt),
-                        r->u.dst.__use, 0, (unsigned long)r->rt_src,
+                        r->u.dst.__use, 0, (__force u32)r->rt_src,
                         (dst_metric(&r->u.dst, RTAX_ADVMSS) ?
                              (int)dst_metric(&r->u.dst, RTAX_ADVMSS) + 40 : 0),
                         dst_metric(&r->u.dst, RTAX_WINDOW),
@@ -685,18 +684,17 @@ static inline bool rt_caching(const struct net *net)
 static inline bool compare_hash_inputs(const struct flowi *fl1,
                                         const struct flowi *fl2)
 {
-        return (__force u32)(((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
-                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr) |
+        return ((((__force u32)fl1->nl_u.ip4_u.daddr ^ (__force u32)fl2->nl_u.ip4_u.daddr) |
+                ((__force u32)fl1->nl_u.ip4_u.saddr ^ (__force u32)fl2->nl_u.ip4_u.saddr) |
                 (fl1->iif ^ fl2->iif)) == 0);
 }
 
 static inline int compare_keys(struct flowi *fl1, struct flowi *fl2)
 {
-        return ((__force u32)((fl1->nl_u.ip4_u.daddr ^ fl2->nl_u.ip4_u.daddr) |
-                (fl1->nl_u.ip4_u.saddr ^ fl2->nl_u.ip4_u.saddr)) |
+        return (((__force u32)fl1->nl_u.ip4_u.daddr ^ (__force u32)fl2->nl_u.ip4_u.daddr) |
+                ((__force u32)fl1->nl_u.ip4_u.saddr ^ (__force u32)fl2->nl_u.ip4_u.saddr) |
                 (fl1->mark ^ fl2->mark) |
-                (*(u16 *)&fl1->nl_u.ip4_u.tos ^
-                 *(u16 *)&fl2->nl_u.ip4_u.tos) |
+                (*(u16 *)&fl1->nl_u.ip4_u.tos ^ *(u16 *)&fl2->nl_u.ip4_u.tos) |
                 (fl1->oif ^ fl2->oif) |
                 (fl1->iif ^ fl2->iif)) == 0;
 }
@@ -919,32 +917,11 @@ void rt_cache_flush_batch(void)
         rt_do_flush(!in_softirq());
 }
 
-/*
- * We change rt_genid and let gc do the cleanup
- */
-static void rt_secret_rebuild(unsigned long __net)
-{
-        struct net *net = (struct net *)__net;
-        rt_cache_invalidate(net);
-        mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
-}
-
-static void rt_secret_rebuild_oneshot(struct net *net)
-{
-        del_timer_sync(&net->ipv4.rt_secret_timer);
-        rt_cache_invalidate(net);
-        if (ip_rt_secret_interval)
-                mod_timer(&net->ipv4.rt_secret_timer, jiffies + ip_rt_secret_interval);
-}
-
 static void rt_emergency_hash_rebuild(struct net *net)
 {
-        if (net_ratelimit()) {
+        if (net_ratelimit())
                 printk(KERN_WARNING "Route hash chain too long!\n");
-                printk(KERN_WARNING "Adjust your secret_interval!\n");
-        }
-
-        rt_secret_rebuild_oneshot(net);
+        rt_cache_invalidate(net);
 }
 
 /*
@@ -2319,8 +2296,8 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rcu_read_lock();
         for (rth = rcu_dereference(rt_hash_table[hash].chain); rth;
              rth = rcu_dereference(rth->u.dst.rt_next)) {
-                if (((rth->fl.fl4_dst ^ daddr) |
-                     (rth->fl.fl4_src ^ saddr) |
+                if ((((__force u32)rth->fl.fl4_dst ^ (__force u32)daddr) |
+                     ((__force u32)rth->fl.fl4_src ^ (__force u32)saddr) |
                      (rth->fl.iif ^ iif) |
                      rth->fl.oif |
                      (rth->fl.fl4_tos ^ tos)) == 0 &&
@@ -3102,48 +3079,6 @@ static int ipv4_sysctl_rtcache_flush(ctl_table *__ctl, int write,
         return -EINVAL;
 }
 
-static void rt_secret_reschedule(int old)
-{
-        struct net *net;
-        int new = ip_rt_secret_interval;
-        int diff = new - old;
-
-        if (!diff)
-                return;
-
-        rtnl_lock();
-        for_each_net(net) {
-                int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
-                long time;
-
-                if (!new)
-                        continue;
-
-                if (deleted) {
-                        time = net->ipv4.rt_secret_timer.expires - jiffies;
-
-                        if (time <= 0 || (time += diff) <= 0)
-                                time = 0;
-                } else
-                        time = new;
-
-                mod_timer(&net->ipv4.rt_secret_timer, jiffies + time);
-        }
-        rtnl_unlock();
-}
-
-static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
-                                          void __user *buffer, size_t *lenp,
-                                          loff_t *ppos)
-{
-        int old = ip_rt_secret_interval;
-        int ret = proc_dointvec_jiffies(ctl, write, buffer, lenp, ppos);
-
-        rt_secret_reschedule(old);
-
-        return ret;
-}
-
 static ctl_table ipv4_route_table[] = {
         {
                 .procname       = "gc_thresh",
@@ -3252,13 +3187,6 @@ static ctl_table ipv4_route_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec,
         },
-        {
-                .procname       = "secret_interval",
-                .data           = &ip_rt_secret_interval,
-                .maxlen         = sizeof(int),
-                .mode           = 0644,
-                .proc_handler   = ipv4_sysctl_rt_secret_interval,
-        },
         { }
 };
 
@@ -3337,34 +3265,15 @@ static __net_initdata struct pernet_operations sysctl_route_ops = {
 };
 #endif
 
-
-static __net_init int rt_secret_timer_init(struct net *net)
+static __net_init int rt_genid_init(struct net *net)
 {
-        atomic_set(&net->ipv4.rt_genid,
-                        (int) ((num_physpages ^ (num_physpages>>8)) ^
-                        (jiffies ^ (jiffies >> 7))));
-
-        net->ipv4.rt_secret_timer.function = rt_secret_rebuild;
-        net->ipv4.rt_secret_timer.data = (unsigned long)net;
-        init_timer_deferrable(&net->ipv4.rt_secret_timer);
-
-        if (ip_rt_secret_interval) {
-                net->ipv4.rt_secret_timer.expires =
-                        jiffies + net_random() % ip_rt_secret_interval +
-                        ip_rt_secret_interval;
-                add_timer(&net->ipv4.rt_secret_timer);
-        }
+        get_random_bytes(&net->ipv4.rt_genid,
+                         sizeof(net->ipv4.rt_genid));
         return 0;
 }
 
-static __net_exit void rt_secret_timer_exit(struct net *net)
-{
-        del_timer_sync(&net->ipv4.rt_secret_timer);
-}
-
-static __net_initdata struct pernet_operations rt_secret_timer_ops = {
-        .init = rt_secret_timer_init,
-        .exit = rt_secret_timer_exit,
+static __net_initdata struct pernet_operations rt_genid_ops = {
+        .init = rt_genid_init,
 };
 
 
@@ -3425,9 +3334,6 @@ int __init ip_rt_init(void)
         schedule_delayed_work(&expires_work,
                 net_random() % ip_rt_gc_interval + ip_rt_gc_interval);
 
-        if (register_pernet_subsys(&rt_secret_timer_ops))
-                printk(KERN_ERR "Unable to setup rt_secret_timer\n");
-
         if (ip_rt_proc_init())
                 printk(KERN_ERR "Unable to create route proc files\n");
 #ifdef CONFIG_XFRM
@@ -3439,6 +3345,7 @@ int __init ip_rt_init(void)
 #ifdef CONFIG_SYSCTL
         register_pernet_subsys(&sysctl_route_ops);
 #endif
+        register_pernet_subsys(&rt_genid_ops);
         return rc;
 }
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0f8caf64caa3..8ce29747ad9b 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -378,7 +378,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sock *sk = sock->sk;
         struct tcp_sock *tp = tcp_sk(sk);
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         if (sk->sk_state == TCP_LISTEN)
                 return inet_csk_listen_poll(sk);
 
@@ -2298,7 +2298,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                         if (sock_flag(sk, SOCK_KEEPOPEN) &&
                             !((1 << sk->sk_state) &
                               (TCPF_CLOSE | TCPF_LISTEN))) {
-                                __u32 elapsed = tcp_time_stamp - tp->rcv_tstamp;
+                                u32 elapsed = keepalive_time_elapsed(tp);
                                 if (tp->keepalive_time > elapsed)
                                         elapsed = tp->keepalive_time - elapsed;
                                 else
@@ -2721,7 +2721,7 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
         struct tcphdr *th2;
         unsigned int len;
         unsigned int thlen;
-        unsigned int flags;
+        __be32 flags;
         unsigned int mss = 1;
         unsigned int hlen;
         unsigned int off;
@@ -2771,10 +2771,10 @@ struct sk_buff **tcp_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 found:
         flush = NAPI_GRO_CB(p)->flush;
-        flush |= flags & TCP_FLAG_CWR;
-        flush |= (flags ^ tcp_flag_word(th2)) &
-                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH);
-        flush |= th->ack_seq ^ th2->ack_seq;
+        flush |= (__force int)(flags & TCP_FLAG_CWR);
+        flush |= (__force int)((flags ^ tcp_flag_word(th2)) &
+                  ~(TCP_FLAG_CWR | TCP_FLAG_FIN | TCP_FLAG_PSH));
+        flush |= (__force int)(th->ack_seq ^ th2->ack_seq);
         for (i = sizeof(*th); i < thlen; i += 4)
                 flush |= *(u32 *)((u8 *)th + i) ^
                          *(u32 *)((u8 *)th2 + i);
@@ -2795,8 +2795,9 @@ found:
 
 out_check_final:
         flush = len < mss;
-        flush |= flags & (TCP_FLAG_URG | TCP_FLAG_PSH | TCP_FLAG_RST |
-                          TCP_FLAG_SYN | TCP_FLAG_FIN);
+        flush |= (__force int)(flags & (TCP_FLAG_URG | TCP_FLAG_PSH |
+                                        TCP_FLAG_RST | TCP_FLAG_SYN |
+                                        TCP_FLAG_FIN));
 
         if (p && (!NAPI_GRO_CB(skb)->same_flow || flush))
                 pp = head;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ae3ec15fb630..e82162c211bf 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4367,6 +4367,7 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
         if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq)
                 goto drop;
 
+        skb_dst_drop(skb);
         __skb_pull(skb, th->doff * 4);
 
         TCP_ECN_accept_cwr(tp, skb);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ad08392a738c..771f8146a2e5 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1286,8 +1286,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop_and_release;
 
                 /* Secret recipe starts with IP addresses */
-                *mess++ ^= daddr;
-                *mess++ ^= saddr;
+                *mess++ ^= (__force u32)daddr;
+                *mess++ ^= (__force u32)saddr;
 
                 /* plus variable length Initiator Cookie */
                 c = (u8 *)mess;
@@ -1672,7 +1672,7 @@ process:
 
         skb->dev = NULL;
 
-        inet_rps_save_rxhash(sk, skb->rxhash);
+        sock_rps_save_rxhash(sk, skb->rxhash);
 
         bh_lock_sock_nested(sk);
         ret = 0;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 2b7d71fb8439..5db3a2c6cb33 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -861,7 +861,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                         th->urg_ptr = htons(tp->snd_up - tcb->seq);
                         th->urg = 1;
                 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
+                        th->urg_ptr = htons(0xFFFF);
                         th->urg = 1;
                 }
         }
@@ -888,7 +888,8 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
                 tcp_event_data_sent(tp, skb, sk);
 
         if (after(tcb->end_seq, tp->snd_nxt) || tcb->seq == tcb->end_seq)
-                TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+                TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS,
+                              tcp_skb_pcount(skb));
 
         err = icsk->icsk_af_ops->queue_xmit(skb);
         if (likely(err <= 0))
@@ -2485,7 +2486,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                         *tail-- ^= TCP_SKB_CB(skb)->seq + 1;
 
                         /* recommended */
-                        *tail-- ^= ((th->dest << 16) | th->source);
+                        *tail-- ^= (((__force u32)th->dest << 16) | (__force u32)th->source);
                         *tail-- ^= (u32)(unsigned long)cvp; /* per sockopt */
 
                         sha_transform((__u32 *)&xvp->cookie_bakery[0],
@@ -2503,7 +2504,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         th->window = htons(min(req->rcv_wnd, 65535U));
         tcp_options_write((__be32 *)(th + 1), tp, &opts);
         th->doff = (tcp_header_size >> 2);
-        TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
+        TCP_ADD_STATS(sock_net(sk), TCP_MIB_OUTSEGS, tcp_skb_pcount(skb));
 
 #ifdef CONFIG_TCP_MD5SIG
         /* Okay, we have all we need - do the md5 hash if needed */
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c732be00606b..440a5c6004f6 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -517,7 +517,7 @@ static void tcp_keepalive_timer (unsigned long data)
         struct sock *sk = (struct sock *) data;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        __u32 elapsed;
+        u32 elapsed;
 
         /* Only process if socket is not in use. */
         bh_lock_sock(sk);
@@ -554,7 +554,7 @@ static void tcp_keepalive_timer (unsigned long data)
         if (tp->packets_out || tcp_send_head(sk))
                 goto resched;
 
-        elapsed = tcp_time_stamp - tp->rcv_tstamp;
+        elapsed = keepalive_time_elapsed(tp);
 
         if (elapsed >= keepalive_time_when(tp)) {
                 if (icsk->icsk_probes_out >= keepalive_probes(tp)) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 666b963496ff..4560b291180b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -307,13 +307,13 @@ static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
 static unsigned int udp4_portaddr_hash(struct net *net, __be32 saddr,
                                        unsigned int port)
 {
-        return jhash_1word(saddr, net_hash_mix(net)) ^ port;
+        return jhash_1word((__force u32)saddr, net_hash_mix(net)) ^ port;
 }
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
         unsigned int hash2_nulladdr =
-                udp4_portaddr_hash(sock_net(sk), INADDR_ANY, snum);
+                udp4_portaddr_hash(sock_net(sk), htonl(INADDR_ANY), snum);
         unsigned int hash2_partial =
                 udp4_portaddr_hash(sock_net(sk), inet_sk(sk)->inet_rcv_saddr, 0);
 
@@ -466,14 +466,14 @@ static struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
                                           daddr, hnum, dif,
                                           hslot2, slot2);
                 if (!result) {
-                        hash2 = udp4_portaddr_hash(net, INADDR_ANY, hnum);
+                        hash2 = udp4_portaddr_hash(net, htonl(INADDR_ANY), hnum);
                         slot2 = hash2 & udptable->mask;
                         hslot2 = &udptable->hash2[slot2];
                         if (hslot->count < hslot2->count)
                                 goto begin;
 
                         result = udp4_lib_lookup2(net, saddr, sport,
-                                                  INADDR_ANY, hnum, dif,
+                                                  htonl(INADDR_ANY), hnum, dif,
                                                   hslot2, slot2);
                 }
                 rcu_read_unlock();
@@ -1062,10 +1062,10 @@ static unsigned int first_packet_length(struct sock *sk)
         spin_unlock_bh(&rcvq->lock);
 
         if (!skb_queue_empty(&list_kill)) {
-                lock_sock(sk);
+                lock_sock_bh(sk);
                 __skb_queue_purge(&list_kill);
                 sk_mem_reclaim_partial(sk);
-                release_sock(sk);
+                unlock_sock_bh(sk);
         }
         return res;
 }
@@ -1196,10 +1196,10 @@ out:
         return err;
 
 csum_copy_err:
-        lock_sock(sk);
+        lock_sock_bh(sk);
         if (!skb_kill_datagram(sk, skb, flags))
                 UDP_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
-        release_sock(sk);
+        unlock_sock_bh(sk);
 
         if (noblock)
                 return -EAGAIN;
@@ -1217,7 +1217,7 @@ int udp_disconnect(struct sock *sk, int flags)
         sk->sk_state = TCP_CLOSE;
         inet->inet_daddr = 0;
         inet->inet_dport = 0;
-        inet_rps_save_rxhash(sk, 0);
+        sock_rps_save_rxhash(sk, 0);
         sk->sk_bound_dev_if = 0;
         if (!(sk->sk_userlocks & SOCK_BINDADDR_LOCK))
                 inet_reset_saddr(sk);
@@ -1262,9 +1262,9 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         int rc;
 
         if (inet_sk(sk)->inet_daddr)
-                inet_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb->rxhash);
 
-        rc = sock_queue_rcv_skb(sk, skb);
+        rc = ip_queue_rcv_skb(sk, skb);
         if (rc < 0) {
                 int is_udplite = IS_UDPLITE(sk);
 
@@ -1372,6 +1372,10 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                         goto drop;
         }
 
+
+        if (sk_rcvqueues_full(sk, skb))
+                goto drop;
+
         rc = 0;
 
         bh_lock_sock(sk);
@@ -1620,9 +1624,9 @@ int udp_rcv(struct sk_buff *skb)
 
 void udp_destroy_sock(struct sock *sk)
 {
-        lock_sock(sk);
+        lock_sock_bh(sk);
         udp_flush_pending_frames(sk);
-        release_sock(sk);
+        unlock_sock_bh(sk);
 }
 
 /*
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7cba8845242f..3984f52181f4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -588,7 +588,8 @@ static u32 ipv6_addr_hash(const struct in6_addr *addr)
          * We perform the hash function over the last 64 bits of the address
          * This will include the IEEE address token on links that support it.
          */
-        return jhash_2words(addr->s6_addr32[2],  addr->s6_addr32[3], 0)
+        return jhash_2words((__force u32)addr->s6_addr32[2],
+                            (__force u32)addr->s6_addr32[3], 0)
                 & (IN6_ADDR_HSIZE - 1);
 }
 
@@ -1345,7 +1346,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
         struct hlist_node *node;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -2958,7 +2959,7 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq)
 
         for (state->bucket = 0; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
                 struct hlist_node *n;
-                hlist_for_each_entry_rcu(ifa, n, &inet6_addr_lst[state->bucket],
+                hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
                                          addr_lst)
                         if (net_eq(dev_net(ifa->idev->dev), net))
                                 return ifa;
@@ -2973,12 +2974,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
         struct net *net = seq_file_net(seq);
         struct hlist_node *n = &ifa->addr_lst;
 
-        hlist_for_each_entry_continue_rcu(ifa, n, addr_lst)
+        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst)
                 if (net_eq(dev_net(ifa->idev->dev), net))
                         return ifa;
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
-                hlist_for_each_entry(ifa, n,
+                hlist_for_each_entry_rcu_bh(ifa, n,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
                         if (net_eq(dev_net(ifa->idev->dev), net))
                                 return ifa;
@@ -2999,7 +3000,7 @@ static struct inet6_ifaddr *if6_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(rcu)
+        __acquires(rcu_bh)
 {
         rcu_read_lock_bh();
         return if6_get_idx(seq, *pos);
@@ -3015,7 +3016,7 @@ static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void if6_seq_stop(struct seq_file *seq, void *v)
-        __releases(rcu)
+        __releases(rcu_bh)
 {
         rcu_read_unlock_bh();
 }
@@ -3092,7 +3093,7 @@ int ipv6_chk_home_addr(struct net *net, struct in6_addr *addr)
         unsigned int hash = ipv6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, n, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -3126,7 +3127,7 @@ static void addrconf_verify(unsigned long foo)
 
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-                hlist_for_each_entry_rcu(ifp, node,
+                hlist_for_each_entry_rcu_bh(ifp, node,
                                          &inet6_addr_lst[i], addr_lst) {
                         unsigned long age;
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3192aa02ba5d..d2df3144429b 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -417,6 +417,9 @@ void inet6_destroy_sock(struct sock *sk)
         if ((skb = xchg(&np->pktoptions, NULL)) != NULL)
                 kfree_skb(skb);
 
+        if ((skb = xchg(&np->rxpmtu, NULL)) != NULL)
+                kfree_skb(skb);
+
         /* Free flowlabels */
         fl6_free_socklist(sk);
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 622dc7939a1b..5959230bc6c1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -278,6 +278,45 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
                 kfree_skb(skb);
 }
 
+void ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6hdr *iph;
+        struct sk_buff *skb;
+        struct ip6_mtuinfo *mtu_info;
+
+        if (!np->rxopt.bits.rxpmtu)
+                return;
+
+        skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        skb_put(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
+        iph = ipv6_hdr(skb);
+        ipv6_addr_copy(&iph->daddr, &fl->fl6_dst);
+
+        mtu_info = IP6CBMTU(skb);
+        if (!mtu_info) {
+                kfree_skb(skb);
+                return;
+        }
+
+        mtu_info->ip6m_mtu = mtu;
+        mtu_info->ip6m_addr.sin6_family = AF_INET6;
+        mtu_info->ip6m_addr.sin6_port = 0;
+        mtu_info->ip6m_addr.sin6_flowinfo = 0;
+        mtu_info->ip6m_addr.sin6_scope_id = fl->oif;
+        ipv6_addr_copy(&mtu_info->ip6m_addr.sin6_addr, &ipv6_hdr(skb)->daddr);
+
+        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
+        skb_reset_transport_header(skb);
+
+        skb = xchg(&np->rxpmtu, skb);
+        kfree_skb(skb);
+}
+
 /*
  *      Handle MSG_ERRQUEUE
  */
@@ -381,6 +420,54 @@ out:
         return err;
 }
 
+/*
+ *      Handle IPV6_RECVPATHMTU
+ */
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct sk_buff *skb;
+        struct sockaddr_in6 *sin;
+        struct ip6_mtuinfo mtu_info;
+        int err;
+        int copied;
+
+        err = -EAGAIN;
+        skb = xchg(&np->rxpmtu, NULL);
+        if (skb == NULL)
+                goto out;
+
+        copied = skb->len;
+        if (copied > len) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (err)
+                goto out_free_skb;
+
+        sock_recv_timestamp(msg, sk, skb);
+
+        memcpy(&mtu_info, IP6CBMTU(skb), sizeof(mtu_info));
+
+        sin = (struct sockaddr_in6 *)msg->msg_name;
+        if (sin) {
+                sin->sin6_family = AF_INET6;
+                sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
+                sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
+                ipv6_addr_copy(&sin->sin6_addr, &mtu_info.ip6m_addr.sin6_addr);
+        }
+
+        put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
+
+        err = copied;
+
+out_free_skb:
+        kfree_skb(skb);
+out:
+        return err;
+}
 
 
 int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
@@ -497,7 +584,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
 int datagram_send_ctl(struct net *net,
                       struct msghdr *msg, struct flowi *fl,
                       struct ipv6_txoptions *opt,
-                      int *hlimit, int *tclass)
+                      int *hlimit, int *tclass, int *dontfrag)
 {
         struct in6_pktinfo *src_info;
         struct cmsghdr *cmsg;
@@ -737,6 +824,25 @@ int datagram_send_ctl(struct net *net,
 
                         break;
                     }
+
+                case IPV6_DONTFRAG:
+                    {
+                        int df;
+
+                        err = -EINVAL;
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+                                goto exit_f;
+                        }
+
+                        df = *(int *)CMSG_DATA(cmsg);
+                        if (df < 0 || df > 1)
+                                goto exit_f;
+
+                        err = 0;
+                        *dontfrag = df;
+
+                        break;
+                    }
                 default:
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                        cmsg->cmsg_type);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8124f16f2ac2..8e44f8f9c188 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -237,8 +237,8 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
                + nla_total_size(16); /* src */
 }
 
-static struct fib_rules_ops fib6_rules_ops_template = {
-        .family                 = FIB_RULES_IPV6,
+static const struct fib_rules_ops __net_initdata fib6_rules_ops_template = {
+        .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
         .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 12d2fa42657d..ce7992982557 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -481,7 +481,7 @@ route_done:
                               len + sizeof(struct icmp6hdr),
                               sizeof(struct icmp6hdr), hlimit,
                               np->tclass, NULL, &fl, (struct rt6_info*)dst,
-                              MSG_DONTWAIT);
+                              MSG_DONTWAIT, np->dontfrag);
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
                 ip6_flush_pending_frames(sk);
@@ -561,7 +561,8 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
                                 sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl,
-                                (struct rt6_info*)dst, MSG_DONTWAIT);
+                                (struct rt6_info*)dst, MSG_DONTWAIT,
+                                np->dontfrag);
 
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index dc6e0b8f260d..92a122b7795d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -144,7 +144,8 @@ static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
          *      htonl(1 << ((~fn_bit)&0x1F))
          * See include/asm-generic/bitops/le.h.
          */
-        return (1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)) & addr[fn_bit >> 5];
+        return (__force __be32)(1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)) &
+               addr[fn_bit >> 5];
 }
 
 static __inline__ struct fib6_node * node_alloc(void)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 14e23216eb28..13654686aeab 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -360,7 +360,8 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                 msg.msg_control = (void*)(fl->opt+1);
                 flowi.oif = 0;
 
-                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk, &junk);
+                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk,
+                                        &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7f12e30cfa73..5173acaeb501 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -92,7 +92,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
 
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
@@ -216,8 +216,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
                         }
                         kfree_skb(skb);
                         skb = skb2;
-                        if (sk)
-                                skb_set_owner_w(skb, sk);
+                        skb_set_owner_w(skb, sk);
                 }
                 if (opt->opt_flen)
                         ipv6_push_frag_opts(skb, opt, &proto);
@@ -623,7 +622,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (!skb->local_df) {
+        if (!skb->local_df && skb->len > mtu) {
                 skb->dev = skb_dst(skb)->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
@@ -1103,7 +1102,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
-        struct rt6_info *rt, unsigned int flags)
+        struct rt6_info *rt, unsigned int flags, int dontfrag)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -1217,15 +1216,23 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          */
 
         inet->cork.length += length;
-        if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
-            (rt->u.dst.dev->features & NETIF_F_UFO)) {
+        if (length > mtu) {
+                int proto = sk->sk_protocol;
+                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
+                        ipv6_local_rxpmtu(sk, fl, mtu-exthdrlen);
+                        return -EMSGSIZE;
+                }
 
-                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                          fragheaderlen, transhdrlen, mtu,
-                                          flags);
-                if (err)
-                        goto error;
-                return 0;
+                if (proto == IPPROTO_UDP &&
+                    (rt->u.dst.dev->features & NETIF_F_UFO)) {
+
+                        err = ip6_ufo_append_data(sk, getfrag, from, length,
+                                                  hh_len, fragheaderlen,
+                                                  transhdrlen, mtu, flags);
+                        if (err)
+                                goto error;
+                        return 0;
+                }
         }
 
         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 1160400e9dbd..bd43f0152c21 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -337,6 +337,13 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 retv = 0;
                 break;
 
+        case IPV6_RECVPATHMTU:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                np->rxopt.bits.rxpmtu = valbool;
+                retv = 0;
+                break;
+
         case IPV6_HOPOPTS:
         case IPV6_RTHDRDSTOPTS:
         case IPV6_RTHDR:
@@ -451,7 +458,8 @@ sticky_done:
                 msg.msg_controllen = optlen;
                 msg.msg_control = (void*)(opt+1);
 
-                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk);
+                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk,
+                                         &junk);
                 if (retv)
                         goto done;
 update:
@@ -767,6 +775,17 @@ pref_skip_coa:
 
                 break;
             }
+        case IPV6_MINHOPCOUNT:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                if (val < 0 || val > 255)
+                        goto e_inval;
+                np->min_hopcount = val;
+                break;
+        case IPV6_DONTFRAG:
+                np->dontfrag = valbool;
+                retv = 0;
+                break;
         }
 
         release_sock(sk);
@@ -1055,6 +1074,38 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = np->rxopt.bits.rxflow;
                 break;
 
+        case IPV6_RECVPATHMTU:
+                val = np->rxopt.bits.rxpmtu;
+                break;
+
+        case IPV6_PATHMTU:
+        {
+                struct dst_entry *dst;
+                struct ip6_mtuinfo mtuinfo;
+
+                if (len < sizeof(mtuinfo))
+                        return -EINVAL;
+
+                len = sizeof(mtuinfo);
+                memset(&mtuinfo, 0, sizeof(mtuinfo));
+
+                rcu_read_lock();
+                dst = __sk_dst_get(sk);
+                if (dst)
+                        mtuinfo.ip6m_mtu = dst_mtu(dst);
+                rcu_read_unlock();
+                if (!mtuinfo.ip6m_mtu)
+                        return -ENOTCONN;
+
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &mtuinfo, len))
+                        return -EFAULT;
+
+                return 0;
+                break;
+        }
+
         case IPV6_UNICAST_HOPS:
         case IPV6_MULTICAST_HOPS:
         {
@@ -1116,6 +1167,14 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                         val |= IPV6_PREFER_SRC_HOME;
                 break;
 
+        case IPV6_MINHOPCOUNT:
+                val = np->min_hopcount;
+                break;
+
+        case IPV6_DONTFRAG:
+                val = np->dontfrag;
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f9d05ce4e03a..59f1881968c7 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -44,6 +44,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <net/mld.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -71,54 +72,11 @@
 #define MDBG(x)
 #endif
 
-/*
- *  These header formats should be in a separate include file, but icmpv6.h
- *  doesn't have in6_addr defined in all cases, there is no __u128, and no
- *  other files reference these.
- *
- *                      +-DLS 4/14/03
- */
-
-/* Multicast Listener Discovery version 2 headers */
-
-struct mld2_grec {
-        __u8            grec_type;
-        __u8            grec_auxwords;
-        __be16          grec_nsrcs;
-        struct in6_addr grec_mca;
-        struct in6_addr grec_src[0];
-};
-
-struct mld2_report {
-        __u8    type;
-        __u8    resv1;
-        __sum16 csum;
-        __be16  resv2;
-        __be16  ngrec;
-        struct mld2_grec grec[0];
-};
-
-struct mld2_query {
-        __u8 type;
-        __u8 code;
-        __sum16 csum;
-        __be16 mrc;
-        __be16 resv1;
-        struct in6_addr mca;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-        __u8 qrv:3,
-             suppress:1,
-             resv2:4;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-        __u8 resv2:4,
-             suppress:1,
-             qrv:3;
-#else
-#error "Please fix <asm/byteorder.h>"
-#endif
-        __u8 qqic;
-        __be16 nsrcs;
-        struct in6_addr srcs[0];
+/* Ensure that we have struct in6_addr aligned on 32bit word. */
+static void *__mld2_query_bugs[] __attribute__((__unused__)) = {
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_query, mld2q_srcs) % 4),
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_report, mld2r_grec) % 4),
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_grec, grec_mca) % 4)
 };
 
 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
@@ -157,14 +115,6 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                 ((idev)->mc_v1_seen && \
                 time_before(jiffies, (idev)->mc_v1_seen)))
 
-#define MLDV2_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
-#define MLDV2_EXP(thresh, nbmant, nbexp, value) \
-        ((value) < (thresh) ? (value) : \
-        ((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
-        (MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
-
-#define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
-
 #define IPV6_MLD_MAX_MSF        64
 
 int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
@@ -1161,7 +1111,7 @@ int igmp6_event_query(struct sk_buff *skb)
         struct in6_addr *group;
         unsigned long max_delay;
         struct inet6_dev *idev;
-        struct icmp6hdr *hdr;
+        struct mld_msg *mld;
         int group_type;
         int mark = 0;
         int len;
@@ -1182,8 +1132,8 @@ int igmp6_event_query(struct sk_buff *skb)
         if (idev == NULL)
                 return 0;
 
-        hdr = icmp6_hdr(skb);
-        group = (struct in6_addr *) (hdr + 1);
+        mld = (struct mld_msg *)icmp6_hdr(skb);
+        group = &mld->mld_mca;
         group_type = ipv6_addr_type(group);
 
         if (group_type != IPV6_ADDR_ANY &&
@@ -1197,7 +1147,7 @@ int igmp6_event_query(struct sk_buff *skb)
                 /* MLDv1 router present */
 
                 /* Translate milliseconds to jiffies */
-                max_delay = (ntohs(hdr->icmp6_maxdelay)*HZ)/1000;
+                max_delay = (ntohs(mld->mld_maxdelay)*HZ)/1000;
 
                 switchback = (idev->mc_qrv + 1) * max_delay;
                 idev->mc_v1_seen = jiffies + switchback;
@@ -1216,14 +1166,14 @@ int igmp6_event_query(struct sk_buff *skb)
                         return -EINVAL;
                 }
                 mlh2 = (struct mld2_query *)skb_transport_header(skb);
-                max_delay = (MLDV2_MRC(ntohs(mlh2->mrc))*HZ)/1000;
+                max_delay = (MLDV2_MRC(ntohs(mlh2->mld2q_mrc))*HZ)/1000;
                 if (!max_delay)
                         max_delay = 1;
                 idev->mc_maxdelay = max_delay;
-                if (mlh2->qrv)
-                        idev->mc_qrv = mlh2->qrv;
+                if (mlh2->mld2q_qrv)
+                        idev->mc_qrv = mlh2->mld2q_qrv;
                 if (group_type == IPV6_ADDR_ANY) { /* general query */
-                        if (mlh2->nsrcs) {
+                        if (mlh2->mld2q_nsrcs) {
                                 in6_dev_put(idev);
                                 return -EINVAL; /* no sources allowed */
                         }
@@ -1232,9 +1182,9 @@ int igmp6_event_query(struct sk_buff *skb)
                         return 0;
                 }
                 /* mark sources to include, if group & source-specific */
-                if (mlh2->nsrcs != 0) {
+                if (mlh2->mld2q_nsrcs != 0) {
                         if (!pskb_may_pull(skb, srcs_offset +
-                            ntohs(mlh2->nsrcs) * sizeof(struct in6_addr))) {
+                            ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr))) {
                                 in6_dev_put(idev);
                                 return -EINVAL;
                         }
@@ -1270,7 +1220,7 @@ int igmp6_event_query(struct sk_buff *skb)
                                         ma->mca_flags &= ~MAF_GSQUERY;
                         }
                         if (!(ma->mca_flags & MAF_GSQUERY) ||
-                            mld_marksources(ma, ntohs(mlh2->nsrcs), mlh2->srcs))
+                            mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
                                 igmp6_group_queried(ma, max_delay);
                         spin_unlock_bh(&ma->mca_lock);
                         break;
@@ -1286,9 +1236,8 @@ int igmp6_event_query(struct sk_buff *skb)
 int igmp6_event_report(struct sk_buff *skb)
 {
         struct ifmcaddr6 *ma;
-        struct in6_addr *addrp;
         struct inet6_dev *idev;
-        struct icmp6hdr *hdr;
+        struct mld_msg *mld;
         int addr_type;
 
         /* Our own report looped back. Ignore it. */
@@ -1300,10 +1249,10 @@ int igmp6_event_report(struct sk_buff *skb)
             skb->pkt_type != PACKET_BROADCAST)
                 return 0;
 
-        if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
+        if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
                 return -EINVAL;
 
-        hdr = icmp6_hdr(skb);
+        mld = (struct mld_msg *)icmp6_hdr(skb);
 
         /* Drop reports with not link local source */
         addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
@@ -1311,8 +1260,6 @@ int igmp6_event_report(struct sk_buff *skb)
             !(addr_type&IPV6_ADDR_LINKLOCAL))
                 return -EINVAL;
 
-        addrp = (struct in6_addr *) (hdr + 1);
-
         idev = in6_dev_get(skb->dev);
         if (idev == NULL)
                 return -ENODEV;
@@ -1323,7 +1270,7 @@ int igmp6_event_report(struct sk_buff *skb)
 
         read_lock_bh(&idev->lock);
         for (ma = idev->mc_list; ma; ma=ma->next) {
-                if (ipv6_addr_equal(&ma->mca_addr, addrp)) {
+                if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
                         spin_lock(&ma->mca_lock);
                         if (del_timer(&ma->mca_timer))
                                 atomic_dec(&ma->mca_refcnt);
@@ -1432,11 +1379,11 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
         skb_put(skb, sizeof(*pmr));
         pmr = (struct mld2_report *)skb_transport_header(skb);
-        pmr->type = ICMPV6_MLD2_REPORT;
-        pmr->resv1 = 0;
-        pmr->csum = 0;
-        pmr->resv2 = 0;
-        pmr->ngrec = 0;
+        pmr->mld2r_type = ICMPV6_MLD2_REPORT;
+        pmr->mld2r_resv1 = 0;
+        pmr->mld2r_cksum = 0;
+        pmr->mld2r_resv2 = 0;
+        pmr->mld2r_ngrec = 0;
         return skb;
 }
 
@@ -1458,9 +1405,10 @@ static void mld_sendpack(struct sk_buff *skb)
         mldlen = skb->tail - skb->transport_header;
         pip6->payload_len = htons(payload_len);
 
-        pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
-                IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
-                                             mldlen, 0));
+        pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
+                                           IPPROTO_ICMPV6,
+                                           csum_partial(skb_transport_header(skb),
+                                                        mldlen, 0));
 
         dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
 
@@ -1521,7 +1469,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         pgr->grec_nsrcs = 0;
         pgr->grec_mca = pmc->mca_addr;  /* structure copy */
         pmr = (struct mld2_report *)skb_transport_header(skb);
-        pmr->ngrec = htons(ntohs(pmr->ngrec)+1);
+        pmr->mld2r_ngrec = htons(ntohs(pmr->mld2r_ngrec)+1);
         *ppgr = pgr;
         return skb;
 }
@@ -1557,7 +1505,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
 
         /* EX and TO_EX get a fresh packet, if needed */
         if (truncate) {
-                if (pmr && pmr->ngrec &&
+                if (pmr && pmr->mld2r_ngrec &&
                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                         if (skb)
                                 mld_sendpack(skb);
@@ -1770,9 +1718,8 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         struct sock *sk = net->ipv6.igmp_sk;
         struct inet6_dev *idev;
         struct sk_buff *skb;
-        struct icmp6hdr *hdr;
+        struct mld_msg *hdr;
         const struct in6_addr *snd_addr, *saddr;
-        struct in6_addr *addrp;
         struct in6_addr addr_buf;
         int err, len, payload_len, full_len;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
@@ -1820,16 +1767,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
-        hdr = (struct icmp6hdr *) skb_put(skb, sizeof(struct icmp6hdr));
-        memset(hdr, 0, sizeof(struct icmp6hdr));
-        hdr->icmp6_type = type;
+        hdr = (struct mld_msg *) skb_put(skb, sizeof(struct mld_msg));
+        memset(hdr, 0, sizeof(struct mld_msg));
+        hdr->mld_type = type;
+        ipv6_addr_copy(&hdr->mld_mca, addr);
 
-        addrp = (struct in6_addr *) skb_put(skb, sizeof(struct in6_addr));
-        ipv6_addr_copy(addrp, addr);
-
-        hdr->icmp6_cksum = csum_ipv6_magic(saddr, snd_addr, len,
-                                           IPPROTO_ICMPV6,
-                                           csum_partial(hdr, len, 0));
+        hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
+                                         IPPROTO_ICMPV6,
+                                         csum_partial(hdr, len, 0));
 
         idev = in6_dev_get(skb->dev);
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 554b48b6e993..4a4dcbe4f8b2 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -381,7 +381,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
         }
 
         /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk, skb) < 0) {
+        if (ip_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -461,6 +461,9 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
 
+        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+                return ipv6_recv_rxpmtu(sk, msg, len);
+
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
                 goto out;
@@ -733,6 +736,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int addr_len = msg->msg_namelen;
         int hlimit = -1;
         int tclass = -1;
+        int dontfrag = -1;
         u16 proto;
         int err;
 
@@ -811,7 +815,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                                        &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -880,6 +885,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (tclass < 0)
                 tclass = np->tclass;
 
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 
@@ -890,7 +898,7 @@ back_from_confirm:
                 lock_sock(sk);
                 err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov,
                         len, 0, hlimit, tclass, opt, &fl, (struct rt6_info*)dst,
-                        msg->msg_flags);
+                        msg->msg_flags, dontfrag);
 
                 if (err)
                         ip6_flush_pending_frames(sk);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c2438e8cb9d0..05ebd7833043 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -815,7 +815,7 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
         int flags = 0;
 
-        if (rt6_need_strict(&fl->fl6_dst))
+        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
         if (!ipv6_addr_any(&fl->fl6_src))
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index bd5ef7b6e48e..6603511e3673 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -353,6 +353,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -1018,7 +1023,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
         t1 = (struct tcphdr *) skb_push(buff, tot_len);
-        skb_reset_transport_header(skb);
+        skb_reset_transport_header(buff);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
@@ -1050,12 +1055,13 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        buff->csum = csum_partial(t1, tot_len, 0);
-
         memset(&fl, 0, sizeof(fl));
         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
 
+        buff->ip_summed = CHECKSUM_PARTIAL;
+        buff->csum = 0;
+
         __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
 
         fl.proto = IPPROTO_TCP;
@@ -1234,12 +1240,12 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop_and_free;
 
                 /* Secret recipe starts with IP addresses */
-                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
-                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
@@ -1677,6 +1683,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         struct tcphdr *th;
+        struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
         struct net *net = dev_net(skb->dev);
@@ -1703,12 +1710,13 @@ static int tcp_v6_rcv(struct sk_buff *skb)
                 goto bad_packet;
 
         th = tcp_hdr(skb);
+        hdr = ipv6_hdr(skb);
         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
                                     skb->len - th->doff*4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
         TCP_SKB_CB(skb)->when = 0;
-        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
+        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -1719,6 +1727,11 @@ process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 90824852f598..3d7a2c0b836a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -91,9 +91,9 @@ static unsigned int udp6_portaddr_hash(struct net *net,
         if (ipv6_addr_any(addr6))
                 hash = jhash_1word(0, mix);
         else if (ipv6_addr_v4mapped(addr6))
-                hash = jhash_1word(addr6->s6_addr32[3], mix);
+                hash = jhash_1word((__force u32)addr6->s6_addr32[3], mix);
         else
-                hash = jhash2(addr6->s6_addr32, 4, mix);
+                hash = jhash2((__force u32 *)addr6->s6_addr32, 4, mix);
 
         return hash ^ port;
 }
@@ -335,6 +335,9 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
 
+        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+                return ipv6_recv_rxpmtu(sk, msg, len);
+
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
                                   &peeked, &err);
@@ -421,7 +424,7 @@ out:
         return err;
 
 csum_copy_err:
-        lock_sock(sk);
+        lock_sock_bh(sk);
         if (!skb_kill_datagram(sk, skb, flags)) {
                 if (is_udp4)
                         UDP_INC_STATS_USER(sock_net(sk),
@@ -430,7 +433,7 @@ csum_copy_err:
                         UDP6_INC_STATS_USER(sock_net(sk),
                                         UDP_MIB_INERRORS, is_udplite);
         }
-        release_sock(sk);
+        unlock_sock_bh(sk);
 
         if (flags & MSG_DONTWAIT)
                 return -EAGAIN;
@@ -511,7 +514,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
+        if ((rc = ip_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
                 if (rc == -ENOMEM)
                         UDP6_INC_STATS_BH(sock_net(sk),
@@ -581,6 +584,10 @@ static void flush_stack(struct sock **stack, unsigned int count,
 
                 sk = stack[i];
                 if (skb1) {
+                        if (sk_rcvqueues_full(sk, skb)) {
+                                kfree_skb(skb1);
+                                goto drop;
+                        }
                         bh_lock_sock(sk);
                         if (!sock_owned_by_user(sk))
                                 udpv6_queue_rcv_skb(sk, skb1);
@@ -692,7 +699,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         u32 ulen = 0;
 
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                goto short_packet;
+                goto discard;
 
         saddr = &ipv6_hdr(skb)->saddr;
         daddr = &ipv6_hdr(skb)->daddr;
@@ -756,6 +763,10 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         /* deliver */
 
+        if (sk_rcvqueues_full(sk, skb)) {
+                sock_put(sk);
+                goto discard;
+        }
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
@@ -770,9 +781,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         return 0;
 
 short_packet:
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: %d/%u\n",
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: From [%pI6c]:%u %d/%d to [%pI6c]:%u\n",
                        proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       ulen, skb->len);
+                       saddr,
+                       ntohs(uh->source),
+                       ulen,
+                       skb->len,
+                       daddr,
+                       ntohs(uh->dest));
 
 discard:
         UDP6_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
@@ -919,6 +935,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int ulen = len;
         int hlimit = -1;
         int tclass = -1;
+        int dontfrag = -1;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
         int connected = 0;
@@ -1049,7 +1066,8 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                                        &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -1120,6 +1138,9 @@ do_udp_sendmsg:
         if (tclass < 0)
                 tclass = np->tclass;
 
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 back_from_confirm:
@@ -1143,7 +1164,7 @@ do_append_data:
         err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
                 sizeof(struct udphdr), hlimit, tclass, opt, &fl,
                 (struct rt6_info*)dst,
-                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
+                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags, dontfrag);
         if (err)
                 udp_v6_flush_pending_frames(sk);
         else if (!corkreq)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8c452fd5ceae..4a0e77e14468 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -94,7 +94,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+        xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;
 
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 2a4efcea3423..79986a674f6e 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -347,7 +347,7 @@ static void irda_flow_indication(void *instance, void *sap, LOCAL_FLOW flow)
                 self->tx_flow = flow;
                 IRDA_DEBUG(1, "%s(), IrTTP wants us to start again\n",
                            __func__);
-                wake_up_interruptible(sk->sk_sleep);
+                wake_up_interruptible(sk_sleep(sk));
                 break;
         default:
                 IRDA_DEBUG(0, "%s(), Unknown flow command!\n", __func__);
@@ -900,7 +900,7 @@ static int irda_accept(struct socket *sock, struct socket *newsock, int flags)
                 if (flags & O_NONBLOCK)
                         goto out;
 
-                err = wait_event_interruptible(*(sk->sk_sleep),
+                err = wait_event_interruptible(*(sk_sleep(sk)),
                                         skb_peek(&sk->sk_receive_queue));
                 if (err)
                         goto out;
@@ -1066,7 +1066,7 @@ static int irda_connect(struct socket *sock, struct sockaddr *uaddr,
                 goto out;
 
         err = -ERESTARTSYS;
-        if (wait_event_interruptible(*(sk->sk_sleep),
+        if (wait_event_interruptible(*(sk_sleep(sk)),
                                      (sk->sk_state != TCP_SYN_SENT)))
                 goto out;
 
@@ -1318,7 +1318,7 @@ static int irda_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* Check if IrTTP is wants us to slow down */
 
-        if (wait_event_interruptible(*(sk->sk_sleep),
+        if (wait_event_interruptible(*(sk_sleep(sk)),
             (self->tx_flow != FLOW_STOP  ||  sk->sk_state != TCP_ESTABLISHED))) {
                 err = -ERESTARTSYS;
                 goto out;
@@ -1477,7 +1477,7 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
                         if (copied >= target)
                                 break;
 
-                        prepare_to_wait_exclusive(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                        prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                         /*
                          *      POSIX 1003.1g mandates this order.
@@ -1497,7 +1497,7 @@ static int irda_recvmsg_stream(struct kiocb *iocb, struct socket *sock,
                                 /* Wait process until data arrives */
                                 schedule();
 
-                        finish_wait(sk->sk_sleep, &wait);
+                        finish_wait(sk_sleep(sk), &wait);
 
                         if (err)
                                 goto out;
@@ -1787,7 +1787,7 @@ static unsigned int irda_poll(struct file * file, struct socket *sock,
         IRDA_DEBUG(4, "%s()\n", __func__);
 
         lock_kernel();
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         /* Exceptional events? */
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index c18286a2167b..8be324fe08b9 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -59,7 +59,7 @@ do {									\
         DEFINE_WAIT(__wait);                                            \
         long __timeo = timeo;                                           \
         ret = 0;                                                        \
-        prepare_to_wait(sk->sk_sleep, &__wait, TASK_INTERRUPTIBLE);     \
+        prepare_to_wait(sk_sleep(sk), &__wait, TASK_INTERRUPTIBLE);     \
         while (!(condition)) {                                          \
                 if (!__timeo) {                                         \
                         ret = -EAGAIN;                                  \
@@ -76,7 +76,7 @@ do {									\
                 if (ret)                                                \
                         break;                                          \
         }                                                               \
-        finish_wait(sk->sk_sleep, &__wait);                             \
+        finish_wait(sk_sleep(sk), &__wait);                             \
 } while (0)
 
 #define iucv_sock_wait(sk, condition, timeo)                            \
@@ -305,11 +305,14 @@ static inline int iucv_below_msglim(struct sock *sk)
  */
 static void iucv_sock_wake_msglim(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
-        if (sk_has_sleeper(sk))
-                wake_up_interruptible_all(sk->sk_sleep);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_all(&wq->wait);
         sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 /* Timers */
@@ -795,7 +798,7 @@ static int iucv_sock_accept(struct socket *sock, struct socket *newsock,
         timeo = sock_rcvtimeo(sk, flags & O_NONBLOCK);
 
         /* Wait for an incoming connection */
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         while (!(nsk = iucv_accept_dequeue(sk, newsock))) {
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (!timeo) {
@@ -819,7 +822,7 @@ static int iucv_sock_accept(struct socket *sock, struct socket *newsock,
         }
 
         set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
 
         if (err)
                 goto done;
@@ -1269,7 +1272,7 @@ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         unsigned int mask = 0;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
 
         if (sk->sk_state == IUCV_LISTEN)
                 return iucv_accept_poll(sk);
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ecc7aea9efe4..1712af1c7b3f 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1617,14 +1617,9 @@ EXPORT_SYMBOL_GPL(l2tp_session_create);
 
 static __net_init int l2tp_init_net(struct net *net)
 {
-        struct l2tp_net *pn;
-        int err;
+        struct l2tp_net *pn = net_generic(net, l2tp_net_id);
         int hash;
 
-        pn = kzalloc(sizeof(*pn), GFP_KERNEL);
-        if (!pn)
-                return -ENOMEM;
-
         INIT_LIST_HEAD(&pn->l2tp_tunnel_list);
         spin_lock_init(&pn->l2tp_tunnel_list_lock);
 
@@ -1633,33 +1628,11 @@ static __net_init int l2tp_init_net(struct net *net)
 
         spin_lock_init(&pn->l2tp_session_hlist_lock);
 
-        err = net_assign_generic(net, l2tp_net_id, pn);
-        if (err)
-                goto out;
-
         return 0;
-
-out:
-        kfree(pn);
-        return err;
-}
-
-static __net_exit void l2tp_exit_net(struct net *net)
-{
-        struct l2tp_net *pn;
-
-        pn = net_generic(net, l2tp_net_id);
-        /*
-         * if someone has cached our net then
-         * further net_generic call will return NULL
-         */
-        net_assign_generic(net, l2tp_net_id, NULL);
-        kfree(pn);
 }
 
 static struct pernet_operations l2tp_net_ops = {
         .init = l2tp_init_net,
-        .exit = l2tp_exit_net,
         .id   = &l2tp_net_id,
         .size = sizeof(struct l2tp_net),
 };
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index ca1164afeb74..58c6c4cda73b 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -276,43 +276,16 @@ out:
 
 static __net_init int l2tp_eth_init_net(struct net *net)
 {
-        struct l2tp_eth_net *pn;
-        int err;
-
-        pn = kzalloc(sizeof(*pn), GFP_KERNEL);
-        if (!pn)
-                return -ENOMEM;
+        struct l2tp_eth_net *pn = net_generic(net, l2tp_eth_net_id);
 
         INIT_LIST_HEAD(&pn->l2tp_eth_dev_list);
         spin_lock_init(&pn->l2tp_eth_lock);
 
-        err = net_assign_generic(net, l2tp_eth_net_id, pn);
-        if (err)
-                goto out;
-
         return 0;
-
-out:
-        kfree(pn);
-        return err;
-}
-
-static __net_exit void l2tp_eth_exit_net(struct net *net)
-{
-        struct l2tp_eth_net *pn;
-
-        pn = net_generic(net, l2tp_eth_net_id);
-        /*
-         * if someone has cached our net then
-         * further net_generic call will return NULL
-         */
-        net_assign_generic(net, l2tp_eth_net_id, NULL);
-        kfree(pn);
 }
 
 static __net_initdata struct pernet_operations l2tp_eth_net_ops = {
         .init = l2tp_eth_init_net,
-        .exit = l2tp_eth_exit_net,
         .id   = &l2tp_eth_net_id,
         .size = sizeof(struct l2tp_eth_net),
 };
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 2db6a9f75913..023ba820236f 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -536,7 +536,7 @@ static int llc_ui_wait_for_disc(struct sock *sk, long timeout)
         int rc = 0;
 
         while (1) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (sk_wait_event(sk, &timeout, sk->sk_state == TCP_CLOSE))
                         break;
                 rc = -ERESTARTSYS;
@@ -547,7 +547,7 @@ static int llc_ui_wait_for_disc(struct sock *sk, long timeout)
                         break;
                 rc = 0;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return rc;
 }
 
@@ -556,13 +556,13 @@ static int llc_ui_wait_for_conn(struct sock *sk, long timeout)
         DEFINE_WAIT(wait);
 
         while (1) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (sk_wait_event(sk, &timeout, sk->sk_state != TCP_SYN_SENT))
                         break;
                 if (signal_pending(current) || !timeout)
                         break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return timeout;
 }
 
@@ -573,7 +573,7 @@ static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout)
         int rc;
 
         while (1) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 rc = 0;
                 if (sk_wait_event(sk, &timeout,
                                   (sk->sk_shutdown & RCV_SHUTDOWN) ||
@@ -588,7 +588,7 @@ static int llc_ui_wait_for_busy_core(struct sock *sk, long timeout)
                 if (!timeout)
                         break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return rc;
 }
 
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 9598fdb4ad01..6bb9a9a94960 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -19,8 +19,9 @@
 #include "ieee80211_i.h"
 #include "driver-ops.h"
 
-void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
-                                    u16 initiator, u16 reason)
+static void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                            u16 initiator, u16 reason,
+                                            bool from_timer)
 {
         struct ieee80211_local *local = sta->local;
         struct tid_ampdu_rx *tid_rx;
@@ -70,10 +71,17 @@ void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         spin_unlock_bh(&sta->lock);
 
-        del_timer_sync(&tid_rx->session_timer);
+        if (!from_timer)
+                del_timer_sync(&tid_rx->session_timer);
         kfree(tid_rx);
 }
 
+void __ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
+                                    u16 initiator, u16 reason)
+{
+        ___ieee80211_stop_rx_ba_session(sta, tid, initiator, reason, false);
+}
+
 /*
  * After accepting the AddBA Request we activated a timer,
  * resetting it after each frame that arrives from the originator.
@@ -92,8 +100,8 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
 #ifdef CONFIG_MAC80211_HT_DEBUG
         printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
 #endif
-        __ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
-                                       WLAN_REASON_QSTA_TIMEOUT);
+        ___ieee80211_stop_rx_ba_session(sta, *ptid, WLAN_BACK_RECIPIENT,
+                                        WLAN_REASON_QSTA_TIMEOUT, true);
 }
 
 static void ieee80211_send_addba_resp(struct ieee80211_sub_if_data *sdata, u8 *da, u16 tid,
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 608063f11797..c163d0a149f4 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -184,10 +184,9 @@ static void sta_addba_resp_timer_expired(unsigned long data)
                        HT_AGG_STATE_REQ_STOP_BA_MSK)) !=
                                                 HT_ADDBA_REQUESTED_MSK) {
                 spin_unlock_bh(&sta->lock);
-                *state = HT_AGG_STATE_IDLE;
 #ifdef CONFIG_MAC80211_HT_DEBUG
                 printk(KERN_DEBUG "timer expired on tid %d but we are not "
-                                "(or no longer) expecting addBA response there",
+                                "(or no longer) expecting addBA response there\n",
                         tid);
 #endif
                 return;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 7dd7cda75cfa..ae37270a0633 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -97,9 +97,6 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                                             params->mesh_id_len,
                                             params->mesh_id);
 
-        if (sdata->vif.type != NL80211_IFTYPE_MONITOR || !flags)
-                return 0;
-
         if (type == NL80211_IFTYPE_AP_VLAN &&
             params && params->use_4addr == 0)
                 rcu_assign_pointer(sdata->u.vlan.sta, NULL);
@@ -107,7 +104,9 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                  params && params->use_4addr >= 0)
                 sdata->u.mgd.use_4addr = params->use_4addr;
 
-        sdata->u.mntr_flags = *flags;
+        if (sdata->vif.type == NL80211_IFTYPE_MONITOR && flags)
+                sdata->u.mntr_flags = *flags;
+
         return 0;
 }
 
@@ -411,6 +410,17 @@ static int ieee80211_dump_station(struct wiphy *wiphy, struct net_device *dev,
         return ret;
 }
 
+static int ieee80211_dump_survey(struct wiphy *wiphy, struct net_device *dev,
+                                 int idx, struct survey_info *survey)
+{
+        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+
+        if (!local->ops->get_survey)
+                return -EOPNOTSUPP;
+
+        return drv_get_survey(local, idx, survey);
+}
+
 static int ieee80211_get_station(struct wiphy *wiphy, struct net_device *dev,
                                  u8 *mac, struct station_info *sinfo)
 {
@@ -1104,6 +1114,13 @@ static int ieee80211_change_bss(struct wiphy *wiphy,
                 changed |= BSS_CHANGED_BASIC_RATES;
         }
 
+        if (params->ap_isolate >= 0) {
+                if (params->ap_isolate)
+                        sdata->flags |= IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+                else
+                        sdata->flags &= ~IEEE80211_SDATA_DONT_BRIDGE_PACKETS;
+        }
+
         ieee80211_bss_info_change_notify(sdata, changed);
 
         return 0;
@@ -1388,11 +1405,11 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
                 return -EOPNOTSUPP;
 
         if (enabled == sdata->u.mgd.powersave &&
-            timeout == conf->dynamic_ps_timeout)
+            timeout == conf->dynamic_ps_forced_timeout)
                 return 0;
 
         sdata->u.mgd.powersave = enabled;
-        conf->dynamic_ps_timeout = timeout;
+        conf->dynamic_ps_forced_timeout = timeout;
 
         /* no change, but if automatic follow powersave */
         mutex_lock(&sdata->u.mgd.mtx);
@@ -1508,6 +1525,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .change_station = ieee80211_change_station,
         .get_station = ieee80211_get_station,
         .dump_station = ieee80211_dump_station,
+        .dump_survey = ieee80211_dump_survey,
 #ifdef CONFIG_MAC80211_MESH
         .add_mpath = ieee80211_add_mpath,
         .del_mpath = ieee80211_del_mpath,
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index 6bc9b07c3eda..e763f1529ddb 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -39,6 +39,13 @@ static const struct file_operations sta_ ##name## _ops = {		\
         .open = mac80211_open_file_generic,                             \
 }
 
+#define STA_OPS_RW(name)                                                \
+static const struct file_operations sta_ ##name## _ops = {              \
+        .read = sta_##name##_read,                                      \
+        .write = sta_##name##_write,                                    \
+        .open = mac80211_open_file_generic,                             \
+}
+
 #define STA_FILE(name, field, format)                                   \
                 STA_READ_##format(name, field)                          \
                 STA_OPS(name)
@@ -156,7 +163,63 @@ static ssize_t sta_agg_status_read(struct file *file, char __user *userbuf,
 
         return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
 }
-STA_OPS(agg_status);
+
+static ssize_t sta_agg_status_write(struct file *file, const char __user *userbuf,
+                                    size_t count, loff_t *ppos)
+{
+        char _buf[12], *buf = _buf;
+        struct sta_info *sta = file->private_data;
+        bool start, tx;
+        unsigned long tid;
+        int ret;
+
+        if (count > sizeof(_buf))
+                return -EINVAL;
+
+        if (copy_from_user(buf, userbuf, count))
+                return -EFAULT;
+
+        buf[sizeof(_buf) - 1] = '\0';
+
+        if (strncmp(buf, "tx ", 3) == 0) {
+                buf += 3;
+                tx = true;
+        } else if (strncmp(buf, "rx ", 3) == 0) {
+                buf += 3;
+                tx = false;
+        } else
+                return -EINVAL;
+
+        if (strncmp(buf, "start ", 6) == 0) {
+                buf += 6;
+                start = true;
+                if (!tx)
+                        return -EINVAL;
+        } else if (strncmp(buf, "stop ", 5) == 0) {
+                buf += 5;
+                start = false;
+        } else
+                return -EINVAL;
+
+        tid = simple_strtoul(buf, NULL, 0);
+
+        if (tid >= STA_TID_NUM)
+                return -EINVAL;
+
+        if (tx) {
+                if (start)
+                        ret = ieee80211_start_tx_ba_session(&sta->sta, tid);
+                else
+                        ret = ieee80211_stop_tx_ba_session(&sta->sta, tid,
+                                                           WLAN_BACK_RECIPIENT);
+        } else {
+                __ieee80211_stop_rx_ba_session(sta, tid, WLAN_BACK_RECIPIENT, 3);
+                ret = 0;
+        }
+
+        return ret ?: count;
+}
+STA_OPS_RW(agg_status);
 
 static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
                                 size_t count, loff_t *ppos)
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 9179196da264..ee8b63f92f71 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -152,14 +152,15 @@ static inline void drv_update_tkip_key(struct ieee80211_local *local,
 }
 
 static inline int drv_hw_scan(struct ieee80211_local *local,
+                              struct ieee80211_sub_if_data *sdata,
                               struct cfg80211_scan_request *req)
 {
         int ret;
 
         might_sleep();
 
-        ret = local->ops->hw_scan(&local->hw, req);
-        trace_drv_hw_scan(local, req, ret);
+        ret = local->ops->hw_scan(&local->hw, &sdata->vif, req);
+        trace_drv_hw_scan(local, sdata, req, ret);
         return ret;
 }
 
@@ -344,6 +345,15 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
         return ret;
 }
 
+static inline int drv_get_survey(struct ieee80211_local *local, int idx,
+                                struct survey_info *survey)
+{
+        int ret = -EOPNOTSUPP;
+        if (local->ops->conf_tx)
+                ret = local->ops->get_survey(&local->hw, idx, survey);
+        /* trace_drv_get_survey(local, idx, survey, ret); */
+        return ret;
+}
 
 static inline void drv_rfkill_poll(struct ieee80211_local *local)
 {
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index e209cb82ff29..ce734b58d07a 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -363,23 +363,26 @@ TRACE_EVENT(drv_update_tkip_key,
 
 TRACE_EVENT(drv_hw_scan,
         TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sub_if_data *sdata,
                  struct cfg80211_scan_request *req, int ret),
 
-        TP_ARGS(local, req, ret),
+        TP_ARGS(local, sdata, req, ret),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
+                VIF_ENTRY
                 __field(int, ret)
         ),
 
         TP_fast_assign(
                 LOCAL_ASSIGN;
+                VIF_ASSIGN;
                 __entry->ret = ret;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT " ret:%d",
-                LOCAL_PR_ARG, __entry->ret
+                LOCAL_PR_FMT VIF_PR_FMT " ret:%d",
+                LOCAL_PR_ARG,VIF_PR_ARG, __entry->ret
         )
 );
 
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index e6f3b0c7a71f..b72ee6435fa3 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -92,6 +92,12 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         if (memcmp(ifibss->bssid, bssid, ETH_ALEN))
                 sta_info_flush(sdata->local, sdata);
 
+        /* if merging, indicate to driver that we leave the old IBSS */
+        if (sdata->vif.bss_conf.ibss_joined) {
+                sdata->vif.bss_conf.ibss_joined = false;
+                ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_IBSS);
+        }
+
         memcpy(ifibss->bssid, bssid, ETH_ALEN);
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
@@ -171,6 +177,8 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         bss_change |= BSS_CHANGED_BSSID;
         bss_change |= BSS_CHANGED_BEACON;
         bss_change |= BSS_CHANGED_BEACON_ENABLED;
+        bss_change |= BSS_CHANGED_IBSS;
+        sdata->vif.bss_conf.ibss_joined = true;
         ieee80211_bss_info_change_notify(sdata, bss_change);
 
         ieee80211_sta_def_wmm_params(sdata, sband->n_bitrates, supp_rates);
@@ -481,7 +489,9 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         printk(KERN_DEBUG "%s: No active IBSS STAs - trying to scan for other "
                "IBSS networks with same SSID (merge)\n", sdata->name);
 
-        ieee80211_request_internal_scan(sdata, ifibss->ssid, ifibss->ssid_len);
+        ieee80211_request_internal_scan(sdata,
+                        ifibss->ssid, ifibss->ssid_len,
+                        ifibss->fixed_channel ? ifibss->channel : NULL);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -588,8 +598,9 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                 printk(KERN_DEBUG "%s: Trigger new scan to find an IBSS to "
                        "join\n", sdata->name);
 
-                ieee80211_request_internal_scan(sdata, ifibss->ssid,
-                                                ifibss->ssid_len);
+                ieee80211_request_internal_scan(sdata,
+                                ifibss->ssid, ifibss->ssid_len,
+                                ifibss->fixed_channel ? ifibss->channel : NULL);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
@@ -897,6 +908,12 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         sdata->u.ibss.channel = params->channel;
         sdata->u.ibss.fixed_channel = params->channel_fixed;
 
+        /* fix ourselves to that channel now already */
+        if (params->channel_fixed) {
+                sdata->local->oper_channel = params->channel;
+                sdata->local->oper_channel_type = NL80211_CHAN_NO_HT;
+        }
+
         if (params->ie) {
                 sdata->u.ibss.ie = kmemdup(params->ie, params->ie_len,
                                            GFP_KERNEL);
@@ -951,7 +968,9 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         kfree(sdata->u.ibss.ie);
         skb = sdata->u.ibss.presp;
         rcu_assign_pointer(sdata->u.ibss.presp, NULL);
-        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
+        sdata->vif.bss_conf.ibss_joined = false;
+        ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED |
+                                                BSS_CHANGED_IBSS);
         synchronize_rcu();
         kfree_skb(skb);
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c9712f35e596..cbaf4981e110 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1019,7 +1019,8 @@ void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata);
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len);
+                                    const u8 *ssid, u8 ssid_len,
+                                    struct ieee80211_channel *chan);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index e8f6e3b252d8..8d4b41787dcf 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -140,6 +140,7 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
                                      struct ieee80211_sub_if_data,
                                      u.ap);
 
+        key->conf.ap_addr = sdata->dev->dev_addr;
         ret = drv_set_key(key->local, SET_KEY, sdata, sta, &key->conf);
 
         if (!ret) {
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 011ee85bcd57..bd632e1ee2c5 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -442,7 +442,7 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
         struct ieee80211_local *local = hw_to_local(hw);
         int result;
         enum ieee80211_band band;
-        int channels, i, j, max_bitrates;
+        int channels, max_bitrates;
         bool supp_ht;
         static const u32 cipher_suites[] = {
                 WLAN_CIPHER_SUITE_WEP40,
@@ -572,6 +572,8 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         local->hw.conf.listen_interval = local->hw.max_listen_interval;
 
+        local->hw.conf.dynamic_ps_forced_timeout = -1;
+
         result = sta_info_start(local);
         if (result < 0)
                 goto fail_sta_info;
@@ -606,21 +608,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
 
         ieee80211_led_init(local);
 
-        /* alloc internal scan request */
-        i = 0;
-        local->int_scan_req->ssids = &local->scan_ssid;
-        local->int_scan_req->n_ssids = 1;
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (!hw->wiphy->bands[band])
-                        continue;
-                for (j = 0; j < hw->wiphy->bands[band]->n_channels; j++) {
-                        local->int_scan_req->channels[i] =
-                                &hw->wiphy->bands[band]->channels[j];
-                        i++;
-                }
-        }
-        local->int_scan_req->n_channels = i;
-
         local->network_latency_notifier.notifier_call =
                 ieee80211_max_network_latency;
         result = pm_qos_add_notifier(PM_QOS_NETWORK_LATENCY,
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 35d850223a75..358226f63b81 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -175,6 +175,8 @@ static u32 ieee80211_enable_ht(struct ieee80211_sub_if_data *sdata,
         ht_changed = conf_is_ht(&local->hw.conf) != enable_ht ||
                      channel_type != local->hw.conf.channel_type;
 
+        if (local->tmp_channel)
+                local->tmp_channel_type = channel_type;
         local->oper_channel_type = channel_type;
 
         if (ht_changed) {
@@ -476,6 +478,7 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
 {
         struct ieee80211_sub_if_data *sdata, *found = NULL;
         int count = 0;
+        int timeout;
 
         if (!(local->hw.flags & IEEE80211_HW_SUPPORTS_PS)) {
                 local->ps_sdata = NULL;
@@ -509,6 +512,26 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 beaconint_us = ieee80211_tu_to_usec(
                                         found->vif.bss_conf.beacon_int);
 
+                timeout = local->hw.conf.dynamic_ps_forced_timeout;
+                if (timeout < 0) {
+                        /*
+                         * The 2 second value is there for compatibility until
+                         * the PM_QOS_NETWORK_LATENCY is configured with real
+                         * values.
+                         */
+                        if (latency == 2000000000)
+                                timeout = 100;
+                        else if (latency <= 50000)
+                                timeout = 300;
+                        else if (latency <= 100000)
+                                timeout = 100;
+                        else if (latency <= 500000)
+                                timeout = 50;
+                        else
+                                timeout = 0;
+                }
+                local->hw.conf.dynamic_ps_timeout = timeout;
+
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
                 } else {
@@ -1331,12 +1354,17 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 mutex_lock(&sdata->local->iflist_mtx);
                 ieee80211_recalc_ps(sdata->local, -1);
                 mutex_unlock(&sdata->local->iflist_mtx);
+
+                if (sdata->local->hw.flags & IEEE80211_HW_CONNECTION_MONITOR)
+                        return;
+
                 /*
                  * We've received a probe response, but are not sure whether
                  * we have or will be receiving any beacons or data, so let's
                  * schedule the timers again, just in case.
                  */
                 mod_beacon_timer(sdata);
+
                 mod_timer(&ifmgd->conn_mon_timer,
                           round_jiffies_up(jiffies +
                                            IEEE80211_CONNECTION_IDLE_TIME));
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 72efbd87c1eb..9a08f2c446c6 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -81,8 +81,6 @@ ieee80211_rx_radiotap_len(struct ieee80211_local *local,
                 len += 8;
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
                 len += 1;
-        if (local->hw.flags & IEEE80211_HW_NOISE_DBM)
-                len += 1;
 
         if (len & 1) /* padding for RX_FLAGS if necessary */
                 len++;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index e1a3defdf581..e14c44195ae9 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -85,7 +85,7 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
 {
         struct cfg80211_bss *cbss;
         struct ieee80211_bss *bss;
-        int clen;
+        int clen, srlen;
         s32 signal = 0;
 
         if (local->hw.flags & IEEE80211_HW_SIGNAL_DBM)
@@ -114,23 +114,24 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = tim_ie->dtim_period;
         }
 
-        bss->supp_rates_len = 0;
+        /* replace old supported rates if we get new values */
+        srlen = 0;
         if (elems->supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                clen = IEEE80211_MAX_SUPP_RATES;
                 if (clen > elems->supp_rates_len)
                         clen = elems->supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len], elems->supp_rates,
-                       clen);
-                bss->supp_rates_len += clen;
+                memcpy(bss->supp_rates, elems->supp_rates, clen);
+                srlen += clen;
         }
         if (elems->ext_supp_rates) {
-                clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
+                clen = IEEE80211_MAX_SUPP_RATES - srlen;
                 if (clen > elems->ext_supp_rates_len)
                         clen = elems->ext_supp_rates_len;
-                memcpy(&bss->supp_rates[bss->supp_rates_len],
-                       elems->ext_supp_rates, clen);
-                bss->supp_rates_len += clen;
+                memcpy(bss->supp_rates + srlen, elems->ext_supp_rates, clen);
+                srlen += clen;
         }
+        if (srlen)
+                bss->supp_rates_len = srlen;
 
         bss->wmm_used = elems->wmm_param || elems->wmm_info;
         bss->uapsd_supported = is_uapsd_supported(elems);
@@ -411,7 +412,7 @@ static int __ieee80211_start_scan(struct ieee80211_sub_if_data *sdata,
 
         if (local->ops->hw_scan) {
                 WARN_ON(!ieee80211_prep_hw_scan(local));
-                rc = drv_hw_scan(local, local->hw_scan_req);
+                rc = drv_hw_scan(local, sdata, local->hw_scan_req);
         } else
                 rc = ieee80211_start_sw_scan(local);
 
@@ -655,7 +656,7 @@ void ieee80211_scan_work(struct work_struct *work)
         }
 
         if (local->hw_scan_req) {
-                int rc = drv_hw_scan(local, local->hw_scan_req);
+                int rc = drv_hw_scan(local, sdata, local->hw_scan_req);
                 mutex_unlock(&local->scan_mtx);
                 if (rc)
                         ieee80211_scan_completed(&local->hw, true);
@@ -728,10 +729,12 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
 }
 
 int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len)
+                                    const u8 *ssid, u8 ssid_len,
+                                    struct ieee80211_channel *chan)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
+        enum nl80211_band band;
 
         mutex_lock(&local->scan_mtx);
 
@@ -739,6 +742,30 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
         if (local->scan_req)
                 goto unlock;
 
+        /* fill internal scan request */
+        if (!chan) {
+                int i, nchan = 0;
+
+                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                        if (!local->hw.wiphy->bands[band])
+                                continue;
+                        for (i = 0;
+                             i < local->hw.wiphy->bands[band]->n_channels;
+                             i++) {
+                                local->int_scan_req->channels[nchan] =
+                                    &local->hw.wiphy->bands[band]->channels[i];
+                                nchan++;
+                        }
+                }
+
+                local->int_scan_req->n_channels = nchan;
+        } else {
+                local->int_scan_req->channels[0] = chan;
+                local->int_scan_req->n_channels = 1;
+        }
+
+        local->int_scan_req->ssids = &local->scan_ssid;
+        local->int_scan_req->n_ssids = 1;
         memcpy(local->int_scan_req->ssids[0].ssid, ssid, IEEE80211_MAX_SSID_LEN);
         local->int_scan_req->ssids[0].ssid_len = ssid_len;
 
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ff0eb948917b..730197591ab5 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -575,7 +575,7 @@ static int sta_info_buffer_expired(struct sta_info *sta,
 }
 
 
-static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
+static bool sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                                              struct sta_info *sta)
 {
         unsigned long flags;
@@ -583,7 +583,7 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
         struct ieee80211_sub_if_data *sdata;
 
         if (skb_queue_empty(&sta->ps_tx_buf))
-                return;
+                return false;
 
         for (;;) {
                 spin_lock_irqsave(&sta->ps_tx_buf.lock, flags);
@@ -608,6 +608,8 @@ static void sta_info_cleanup_expire_buffered(struct ieee80211_local *local,
                 if (skb_queue_empty(&sta->ps_tx_buf))
                         sta_info_clear_tim_bit(sta);
         }
+
+        return true;
 }
 
 static int __must_check __sta_info_destroy(struct sta_info *sta)
@@ -755,15 +757,20 @@ static void sta_info_cleanup(unsigned long data)
 {
         struct ieee80211_local *local = (struct ieee80211_local *) data;
         struct sta_info *sta;
+        bool timer_needed = false;
 
         rcu_read_lock();
         list_for_each_entry_rcu(sta, &local->sta_list, list)
-                sta_info_cleanup_expire_buffered(local, sta);
+                if (sta_info_cleanup_expire_buffered(local, sta))
+                        timer_needed = true;
         rcu_read_unlock();
 
         if (local->quiescing)
                 return;
 
+        if (!timer_needed)
+                return;
+
         local->sta_cleanup.expires =
                 round_jiffies(jiffies + STA_INFO_CLEANUP_INTERVAL);
         add_timer(&local->sta_cleanup);
@@ -848,8 +855,12 @@ struct ieee80211_sta *ieee80211_find_sta_by_hw(struct ieee80211_hw *hw,
         struct sta_info *sta, *nxt;
 
         /* Just return a random station ... first in list ... */
-        for_each_sta_info(hw_to_local(hw), addr, sta, nxt)
+        for_each_sta_info(hw_to_local(hw), addr, sta, nxt) {
+                if (!sta->uploaded)
+                        return NULL;
                 return &sta->sta;
+        }
+
         return NULL;
 }
 EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
@@ -857,14 +868,19 @@ EXPORT_SYMBOL_GPL(ieee80211_find_sta_by_hw);
 struct ieee80211_sta *ieee80211_find_sta(struct ieee80211_vif *vif,
                                          const u8 *addr)
 {
-        struct ieee80211_sub_if_data *sdata;
+        struct sta_info *sta;
 
         if (!vif)
                 return NULL;
 
-        sdata = vif_to_sdata(vif);
+        sta = sta_info_get_bss(vif_to_sdata(vif), addr);
+        if (!sta)
+                return NULL;
+
+        if (!sta->uploaded)
+                return NULL;
 
-        return ieee80211_find_sta_by_hw(&sdata->local->hw, addr);
+        return &sta->sta;
 }
 EXPORT_SYMBOL(ieee80211_find_sta);
 
diff --git a/net/mac80211/status.c b/net/mac80211/status.c
index 11805a3a626f..94613af009f3 100644
--- a/net/mac80211/status.c
+++ b/net/mac80211/status.c
@@ -171,6 +171,7 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
         struct net_device *prev_dev = NULL;
         struct sta_info *sta, *tmp;
         int retry_count = -1, i;
+        int rates_idx = -1;
         bool send_to_cooked;
 
         for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
@@ -178,6 +179,8 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                 if (i >= hw->max_rates) {
                         info->status.rates[i].idx = -1;
                         info->status.rates[i].count = 0;
+                } else if (info->status.rates[i].idx >= 0) {
+                        rates_idx = i;
                 }
 
                 retry_count += info->status.rates[i].count;
@@ -206,6 +209,10 @@ void ieee80211_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
                         return;
                 }
 
+                if ((local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
+                    (rates_idx != -1))
+                        sta->last_tx_rate = info->status.rates[rates_idx];
+
                 if ((info->flags & IEEE80211_TX_STAT_AMPDU_NO_BACK) &&
                     (ieee80211_is_data_qos(fc))) {
                         u16 tid, ssn;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 2cb77267f733..f3841f43249e 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -429,6 +429,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
         struct sta_info *sta = tx->sta;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
+        struct ieee80211_local *local = tx->local;
         u32 staflags;
 
         if (unlikely(!sta ||
@@ -476,6 +477,12 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 info->control.vif = &tx->sdata->vif;
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
                 skb_queue_tail(&sta->ps_tx_buf, tx->skb);
+
+                if (!timer_pending(&local->sta_cleanup))
+                        mod_timer(&local->sta_cleanup,
+                                  round_jiffies(jiffies +
+                                                STA_INFO_CLEANUP_INTERVAL));
+
                 return TX_QUEUED;
         }
 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
@@ -586,7 +593,8 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
         struct ieee80211_hdr *hdr = (void *)tx->skb->data;
         struct ieee80211_supported_band *sband;
         struct ieee80211_rate *rate;
-        int i, len;
+        int i;
+        u32 len;
         bool inval = false, rts = false, short_preamble = false;
         struct ieee80211_tx_rate_control txrc;
         u32 sta_flags;
@@ -595,7 +603,7 @@ ieee80211_tx_h_rate_ctrl(struct ieee80211_tx_data *tx)
 
         sband = tx->local->hw.wiphy->bands[tx->channel->band];
 
-        len = min_t(int, tx->skb->len + FCS_LEN,
+        len = min_t(u32, tx->skb->len + FCS_LEN,
                          tx->local->hw.wiphy->frag_threshold);
 
         /* set up the tx rate control struct we give the RC algo */
diff --git a/net/mac80211/work.c b/net/mac80211/work.c
index bdb1d05b16fc..3dd07600199d 100644
--- a/net/mac80211/work.c
+++ b/net/mac80211/work.c
@@ -213,15 +213,25 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata,
 
         sband = local->hw.wiphy->bands[wk->chan->band];
 
-        /*
-         * Get all rates supported by the device and the AP as
-         * some APs don't like getting a superset of their rates
-         * in the association request (e.g. D-Link DAP 1353 in
-         * b-only mode)...
-         */
-        rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
-                                               wk->assoc.supp_rates_len,
-                                               sband, &rates);
+        if (wk->assoc.supp_rates_len) {
+                /*
+                 * Get all rates supported by the device and the AP as
+                 * some APs don't like getting a superset of their rates
+                 * in the association request (e.g. D-Link DAP 1353 in
+                 * b-only mode)...
+                 */
+                rates_len = ieee80211_compatible_rates(wk->assoc.supp_rates,
+                                                       wk->assoc.supp_rates_len,
+                                                       sband, &rates);
+        } else {
+                /*
+                 * In case AP not provide any supported rates information
+                 * before association, we send information element(s) with
+                 * all rates that we support.
+                 */
+                rates = ~0;
+                rates_len = sband->n_bitrates;
+        }
 
         skb = alloc_skb(local->hw.extra_tx_headroom +
                         sizeof(*mgmt) + /* bit too much but doesn't matter */
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index 8fb0ae616761..7ba06939829f 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -802,7 +802,7 @@ static int sync_thread_backup(void *data)
                 ip_vs_backup_mcast_ifn, ip_vs_backup_syncid);
 
         while (!kthread_should_stop()) {
-                wait_event_interruptible(*tinfo->sock->sk->sk_sleep,
+                wait_event_interruptible(*sk_sleep(tinfo->sock->sk),
                          !skb_queue_empty(&tinfo->sock->sk->sk_receive_queue)
                          || kthread_should_stop());
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index fa07f044b599..06cb02796a0e 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -739,7 +739,7 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                 DEFINE_WAIT(wait);
 
                 for (;;) {
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_INTERRUPTIBLE);
                         if (sk->sk_state != TCP_SYN_SENT)
                                 break;
@@ -752,7 +752,7 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                         err = -ERESTARTSYS;
                         break;
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
                 if (err)
                         goto out_release;
         }
@@ -798,7 +798,7 @@ static int nr_accept(struct socket *sock, struct socket *newsock, int flags)
          *      hooked into the SABM we saved
          */
         for (;;) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb)
                         break;
@@ -816,7 +816,7 @@ static int nr_accept(struct socket *sock, struct socket *newsock, int flags)
                 err = -ERESTARTSYS;
                 break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (err)
                 goto out_release;
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f162d59d8161..2078a277e06b 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2228,8 +2228,6 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         case SIOCGIFDSTADDR:
         case SIOCSIFDSTADDR:
         case SIOCSIFFLAGS:
-                if (!net_eq(sock_net(sk), &init_net))
-                        return -ENOIOCTLCMD;
                 return inet_dgram_ops.ioctl(sock, cmd, arg);
 #endif
 
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index e2a95762abd3..af4d38bc3b22 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -664,12 +664,12 @@ static int pep_wait_connreq(struct sock *sk, int noblock)
                 if (signal_pending(tsk))
                         return sock_intr_errno(timeo);
 
-                prepare_to_wait_exclusive(&sk->sk_socket->wait, &wait,
+                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                                 TASK_INTERRUPTIBLE);
                 release_sock(sk);
                 timeo = schedule_timeout(timeo);
                 lock_sock(sk);
-                finish_wait(&sk->sk_socket->wait, &wait);
+                finish_wait(sk_sleep(sk), &wait);
         }
 
         return 0;
@@ -910,10 +910,10 @@ disabled:
                         goto out;
                 }
 
-                prepare_to_wait(&sk->sk_socket->wait, &wait,
+                prepare_to_wait(sk_sleep(sk), &wait,
                                 TASK_INTERRUPTIBLE);
                 done = sk_wait_event(sk, &timeo, atomic_read(&pn->tx_credits));
-                finish_wait(&sk->sk_socket->wait, &wait);
+                finish_wait(sk_sleep(sk), &wait);
 
                 if (sk->sk_state != TCP_ESTABLISHED)
                         goto disabled;
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 9b4ced6e0968..c33da6576942 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -46,9 +46,16 @@ struct phonet_net {
 
 int phonet_net_id __read_mostly;
 
+static struct phonet_net *phonet_pernet(struct net *net)
+{
+        BUG_ON(!net);
+
+        return net_generic(net, phonet_net_id);
+}
+
 struct phonet_device_list *phonet_device_list(struct net *net)
 {
-        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(net);
         return &pnn->pndevs;
 }
 
@@ -261,7 +268,7 @@ static int phonet_device_autoconf(struct net_device *dev)
 
 static void phonet_route_autodel(struct net_device *dev)
 {
-        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(dev_net(dev));
         unsigned i;
         DECLARE_BITMAP(deleted, 64);
 
@@ -313,7 +320,7 @@ static struct notifier_block phonet_device_notifier = {
 /* Per-namespace Phonet devices handling */
 static int __net_init phonet_init_net(struct net *net)
 {
-        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(net);
 
         if (!proc_net_fops_create(net, "phonet", 0, &pn_sock_seq_fops))
                 return -ENOMEM;
@@ -326,7 +333,7 @@ static int __net_init phonet_init_net(struct net *net)
 
 static void __net_exit phonet_exit_net(struct net *net)
 {
-        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(net);
         struct net_device *dev;
         unsigned i;
 
@@ -376,7 +383,7 @@ void phonet_device_exit(void)
 
 int phonet_route_add(struct net_device *dev, u8 daddr)
 {
-        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(dev_net(dev));
         struct phonet_routes *routes = &pnn->routes;
         int err = -EEXIST;
 
@@ -393,7 +400,7 @@ int phonet_route_add(struct net_device *dev, u8 daddr)
 
 int phonet_route_del(struct net_device *dev, u8 daddr)
 {
-        struct phonet_net *pnn = net_generic(dev_net(dev), phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(dev_net(dev));
         struct phonet_routes *routes = &pnn->routes;
 
         daddr = daddr >> 2;
@@ -413,7 +420,7 @@ int phonet_route_del(struct net_device *dev, u8 daddr)
 
 struct net_device *phonet_route_get(struct net *net, u8 daddr)
 {
-        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(net);
         struct phonet_routes *routes = &pnn->routes;
         struct net_device *dev;
 
@@ -428,7 +435,7 @@ struct net_device *phonet_route_get(struct net *net, u8 daddr)
 
 struct net_device *phonet_route_output(struct net *net, u8 daddr)
 {
-        struct phonet_net *pnn = net_generic(net, phonet_net_id);
+        struct phonet_net *pnn = phonet_pernet(net);
         struct phonet_routes *routes = &pnn->routes;
         struct net_device *dev;
 
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index c785bfd0744f..6e9848bf0370 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -265,7 +265,7 @@ static unsigned int pn_socket_poll(struct file *file, struct socket *sock,
         struct pep_sock *pn = pep_sk(sk);
         unsigned int mask = 0;
 
-        poll_wait(file, &sock->wait, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         switch (sk->sk_state) {
         case TCP_LISTEN:
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index 7919a9edb8e9..aebfecbdb841 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -158,7 +158,7 @@ static unsigned int rds_poll(struct file *file, struct socket *sock,
         unsigned int mask = 0;
         unsigned long flags;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         if (rs->rs_seen_congestion)
                 poll_wait(file, &rds_poll_waitq, wait);
diff --git a/net/rds/rdma_transport.c b/net/rds/rdma_transport.c
index 5ea82fc47c3e..e599ba2f950d 100644
--- a/net/rds/rdma_transport.c
+++ b/net/rds/rdma_transport.c
@@ -133,7 +133,7 @@ static int __init rds_rdma_listen_init(void)
                 ret = PTR_ERR(cm_id);
                 printk(KERN_ERR "RDS/RDMA: failed to setup listener, "
                        "rdma_create_id() returned %d\n", ret);
-                goto out;
+                return ret;
         }
 
         sin.sin_family = AF_INET,
diff --git a/net/rds/rds.h b/net/rds/rds.h
index 4bec6e2ed495..c224b5bb3ba9 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -492,7 +492,7 @@ void rds_sock_put(struct rds_sock *rs);
 void rds_wake_sk_sleep(struct rds_sock *rs);
 static inline void __rds_wake_sk_sleep(struct sock *sk)
 {
-        wait_queue_head_t *waitq = sk->sk_sleep;
+        wait_queue_head_t *waitq = sk_sleep(sk);
 
         if (!sock_flag(sk, SOCK_DEAD) && waitq)
                 wake_up(waitq);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index e2a2b9344f7b..795a00b7f2cb 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -432,7 +432,7 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                                 break;
                         }
 
-                        timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
+                        timeo = wait_event_interruptible_timeout(*sk_sleep(sk),
                                         (!list_empty(&rs->rs_notify_queue) ||
                                          rs->rs_cong_notify ||
                                          rds_next_incoming(rs, &inc)), timeo);
diff --git a/net/rds/send.c b/net/rds/send.c
index 53d6795ac9d0..9c1c6bcaa6c9 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -915,7 +915,7 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                         goto out;
                 }
 
-                timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
+                timeo = wait_event_interruptible_timeout(*sk_sleep(sk),
                                         rds_send_queue_rm(rs, conn, rm,
                                                           rs->rs_bound_port,
                                                           dport,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4fb711a035f4..8e45e76a95f5 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -845,7 +845,7 @@ rose_try_next_neigh:
                 DEFINE_WAIT(wait);
 
                 for (;;) {
-                        prepare_to_wait(sk->sk_sleep, &wait,
+                        prepare_to_wait(sk_sleep(sk), &wait,
                                         TASK_INTERRUPTIBLE);
                         if (sk->sk_state != TCP_SYN_SENT)
                                 break;
@@ -858,7 +858,7 @@ rose_try_next_neigh:
                         err = -ERESTARTSYS;
                         break;
                 }
-                finish_wait(sk->sk_sleep, &wait);
+                finish_wait(sk_sleep(sk), &wait);
 
                 if (err)
                         goto out_release;
@@ -911,7 +911,7 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
          *      hooked into the SABM we saved
          */
         for (;;) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                 skb = skb_dequeue(&sk->sk_receive_queue);
                 if (skb)
@@ -930,7 +930,7 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
                 err = -ERESTARTSYS;
                 break;
         }
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         if (err)
                 goto out_release;
 
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index c060095b27ce..0b9bb2085ce4 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -62,13 +62,15 @@ static inline int rxrpc_writable(struct sock *sk)
 static void rxrpc_write_space(struct sock *sk)
 {
         _enter("%p", sk);
-        read_lock(&sk->sk_callback_lock);
+        rcu_read_lock();
         if (rxrpc_writable(sk)) {
-                if (sk_has_sleeper(sk))
-                        wake_up_interruptible(sk->sk_sleep);
+                struct socket_wq *wq = rcu_dereference(sk->sk_wq);
+
+                if (wq_has_sleeper(wq))
+                        wake_up_interruptible(&wq->wait);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 /*
@@ -589,7 +591,7 @@ static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
         unsigned int mask;
         struct sock *sk = sock->sk;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         /* the socket is readable if there are any messages waiting on the Rx
diff --git a/net/rxrpc/ar-recvmsg.c b/net/rxrpc/ar-recvmsg.c
index 60c2b94e6b54..0c65013e3bfe 100644
--- a/net/rxrpc/ar-recvmsg.c
+++ b/net/rxrpc/ar-recvmsg.c
@@ -91,7 +91,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                         /* wait for a message to turn up */
                         release_sock(&rx->sk);
-                        prepare_to_wait_exclusive(rx->sk.sk_sleep, &wait,
+                        prepare_to_wait_exclusive(sk_sleep(&rx->sk), &wait,
                                                   TASK_INTERRUPTIBLE);
                         ret = sock_error(&rx->sk);
                         if (ret)
@@ -102,7 +102,7 @@ int rxrpc_recvmsg(struct kiocb *iocb, struct socket *sock,
                                         goto wait_interrupted;
                                 timeo = schedule_timeout(timeo);
                         }
-                        finish_wait(rx->sk.sk_sleep, &wait);
+                        finish_wait(sk_sleep(&rx->sk), &wait);
                         lock_sock(&rx->sk);
                         continue;
                 }
@@ -356,7 +356,7 @@ csum_copy_error:
 wait_interrupted:
         ret = sock_intr_errno(timeo);
 wait_error:
-        finish_wait(rx->sk.sk_sleep, &wait);
+        finish_wait(sk_sleep(&rx->sk), &wait);
         if (continue_call)
                 rxrpc_put_call(continue_call);
         if (copied)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index aeddabfb8e4e..a969b111bd76 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -94,7 +94,7 @@ static inline int handle_dev_cpu_collision(struct sk_buff *skb,
                  * Another cpu is holding lock, requeue & delay xmits for
                  * some time.
                  */
-                __get_cpu_var(netdev_rx_stat).cpu_collision++;
+                __get_cpu_var(softnet_data).cpu_collision++;
                 ret = dev_requeue_skb(skb, q);
         }
 
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index c5a9ac566007..c65762823f5e 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -123,8 +123,8 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         case htons(ETH_P_IP):
         {
                 const struct iphdr *iph = ip_hdr(skb);
-                h = iph->daddr;
-                h2 = iph->saddr ^ iph->protocol;
+                h = (__force u32)iph->daddr;
+                h2 = (__force u32)iph->saddr ^ iph->protocol;
                 if (!(iph->frag_off&htons(IP_MF|IP_OFFSET)) &&
                     (iph->protocol == IPPROTO_TCP ||
                      iph->protocol == IPPROTO_UDP ||
@@ -138,8 +138,8 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
         case htons(ETH_P_IPV6):
         {
                 struct ipv6hdr *iph = ipv6_hdr(skb);
-                h = iph->daddr.s6_addr32[3];
-                h2 = iph->saddr.s6_addr32[3] ^ iph->nexthdr;
+                h = (__force u32)iph->daddr.s6_addr32[3];
+                h2 = (__force u32)iph->saddr.s6_addr32[3] ^ iph->nexthdr;
                 if (iph->nexthdr == IPPROTO_TCP ||
                     iph->nexthdr == IPPROTO_UDP ||
                     iph->nexthdr == IPPROTO_UDPLITE ||
@@ -150,7 +150,7 @@ static unsigned sfq_hash(struct sfq_sched_data *q, struct sk_buff *skb)
                 break;
         }
         default:
-                h = (unsigned long)skb_dst(skb) ^ skb->protocol;
+                h = (unsigned long)skb_dst(skb) ^ (__force u32)skb->protocol;
                 h2 = (unsigned long)skb->sk;
         }
 
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index 58b3e882a187..126b014eb79b 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -37,6 +37,18 @@ menuconfig IP_SCTP
 
 if IP_SCTP
 
+config NET_SCTPPROBE
+        tristate "SCTP: Association probing"
+        depends on PROC_FS && KPROBES
+        ---help---
+        This module allows for capturing the changes to SCTP association
+        state in response to incoming packets. It is used for debugging
+        SCTP congestion control algorithms. If you don't understand
+        what was just said, you don't need it: say N.
+
+        To compile this code as a module, choose M here: the
+        module will be called sctp_probe.
+
 config SCTP_DBG_MSG
         bool "SCTP: Debug messages"
         help
diff --git a/net/sctp/Makefile b/net/sctp/Makefile
index 6b794734380a..5c30b7a873df 100644
--- a/net/sctp/Makefile
+++ b/net/sctp/Makefile
@@ -3,6 +3,7 @@
 #
 
 obj-$(CONFIG_IP_SCTP) += sctp.o
+obj-$(CONFIG_NET_SCTPPROBE) += sctp_probe.o
 
 sctp-y := sm_statetable.o sm_statefuns.o sm_sideeffect.o \
           protocol.o endpointola.o associola.o \
@@ -11,6 +12,8 @@ sctp-y := sm_statetable.o sm_statefuns.o sm_sideeffect.o \
           tsnmap.o bind_addr.o socket.o primitive.o \
           output.o input.o debug.o ssnmap.o auth.o
 
+sctp_probe-y := probe.o
+
 sctp-$(CONFIG_SCTP_DBG_OBJCNT) += objcnt.o
 sctp-$(CONFIG_PROC_FS) += proc.o
 sctp-$(CONFIG_SYSCTL) += sysctl.o
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index df5abbff63e2..3912420cedcc 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -87,9 +87,6 @@ static struct sctp_association *sctp_association_init(struct sctp_association *a
         /* Retrieve the SCTP per socket area.  */
         sp = sctp_sk((struct sock *)sk);
 
-        /* Init all variables to a known value.  */
-        memset(asoc, 0, sizeof(struct sctp_association));
-
         /* Discarding const is appropriate here.  */
         asoc->ep = (struct sctp_endpoint *)ep;
         sctp_endpoint_hold(asoc->ep);
@@ -762,7 +759,8 @@ struct sctp_transport *sctp_assoc_add_peer(struct sctp_association *asoc,
                 asoc->peer.retran_path = peer;
         }
 
-        if (asoc->peer.active_path == asoc->peer.retran_path) {
+        if (asoc->peer.active_path == asoc->peer.retran_path &&
+            peer->state != SCTP_UNCONFIRMED) {
                 asoc->peer.retran_path = peer;
         }
 
@@ -1194,8 +1192,10 @@ void sctp_assoc_update(struct sctp_association *asoc,
         /* Remove any peer addresses not present in the new association. */
         list_for_each_safe(pos, temp, &asoc->peer.transport_addr_list) {
                 trans = list_entry(pos, struct sctp_transport, transports);
-                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
-                        sctp_assoc_del_peer(asoc, &trans->ipaddr);
+                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr)) {
+                        sctp_assoc_rm_peer(asoc, trans);
+                        continue;
+                }
 
                 if (asoc->state >= SCTP_STATE_ESTABLISHED)
                         sctp_transport_reset(trans);
@@ -1318,12 +1318,13 @@ void sctp_assoc_update_retran_path(struct sctp_association *asoc)
                         /* Keep track of the next transport in case
                          * we don't find any active transport.
                          */
-                        if (!next)
+                        if (t->state != SCTP_UNCONFIRMED && !next)
                                 next = t;
                 }
         }
 
-        asoc->peer.retran_path = t;
+        if (t)
+                asoc->peer.retran_path = t;
 
         SCTP_DEBUG_PRINTK_IPADDR("sctp_assoc_update_retran_path:association"
                                  " %p addr: ",
@@ -1483,7 +1484,7 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
         if (asoc->rwnd >= len) {
                 asoc->rwnd -= len;
                 if (over) {
-                        asoc->rwnd_press = asoc->rwnd;
+                        asoc->rwnd_press += asoc->rwnd;
                         asoc->rwnd = 0;
                 }
         } else {
diff --git a/net/sctp/chunk.c b/net/sctp/chunk.c
index 3eab6db59a37..476caaf100ed 100644
--- a/net/sctp/chunk.c
+++ b/net/sctp/chunk.c
@@ -58,9 +58,9 @@ static void sctp_datamsg_init(struct sctp_datamsg *msg)
         msg->send_failed = 0;
         msg->send_error = 0;
         msg->can_abandon = 0;
+        msg->can_delay = 1;
         msg->expires_at = 0;
         INIT_LIST_HEAD(&msg->chunks);
-        msg->msg_size = 0;
 }
 
 /* Allocate and initialize datamsg. */
@@ -157,7 +157,6 @@ static void sctp_datamsg_assign(struct sctp_datamsg *msg, struct sctp_chunk *chu
 {
         sctp_datamsg_hold(msg);
         chunk->msg = msg;
-        msg->msg_size += chunk->skb->len;
 }
 
 
@@ -247,6 +246,7 @@ struct sctp_datamsg *sctp_datamsg_from_user(struct sctp_association *asoc,
         if (msg_len >= first_len) {
                 msg_len -= first_len;
                 whole = 1;
+                msg->can_delay = 0;
         }
 
         /* How many full sized?  How many bytes leftover? */
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 905fda582b92..e10acc01c75f 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -70,8 +70,6 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         struct sctp_shared_key *null_key;
         int err;
 
-        memset(ep, 0, sizeof(struct sctp_endpoint));
-
         ep->digest = kzalloc(SCTP_SIGNATURE_SIZE, gfp);
         if (!ep->digest)
                 return NULL;
@@ -144,6 +142,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
         /* Use SCTP specific send buffer space queues.  */
         ep->sndbuf_policy = sctp_sndbuf_policy;
 
+        sk->sk_data_ready = sctp_data_ready;
         sk->sk_write_space = sctp_write_space;
         sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);
 
diff --git a/net/sctp/output.c b/net/sctp/output.c
index fad261d41ec2..a646681f5acd 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -429,24 +429,17 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         list_for_each_entry_safe(chunk, tmp, &packet->chunk_list, list) {
                 list_del_init(&chunk->list);
                 if (sctp_chunk_is_data(chunk)) {
+                        /* 6.3.1 C4) When data is in flight and when allowed
+                         * by rule C5, a new RTT measurement MUST be made each
+                         * round trip.  Furthermore, new RTT measurements
+                         * SHOULD be made no more than once per round-trip
+                         * for a given destination transport address.
+                         */
 
-                        if (!chunk->resent) {
-
-                                /* 6.3.1 C4) When data is in flight and when allowed
-                                 * by rule C5, a new RTT measurement MUST be made each
-                                 * round trip.  Furthermore, new RTT measurements
-                                 * SHOULD be made no more than once per round-trip
-                                 * for a given destination transport address.
-                                 */
-
-                                if (!tp->rto_pending) {
-                                        chunk->rtt_in_progress = 1;
-                                        tp->rto_pending = 1;
-                                }
+                        if (!tp->rto_pending) {
+                                chunk->rtt_in_progress = 1;
+                                tp->rto_pending = 1;
                         }
-
-                        chunk->resent = 1;
-
                         has_data = 1;
                 }
 
@@ -681,7 +674,7 @@ static sctp_xmit_t sctp_packet_can_append_data(struct sctp_packet *packet,
                  * Don't delay large message writes that may have been
                  * fragmeneted into small peices.
                  */
-                if ((len < max) && (chunk->msg->msg_size < max)) {
+                if ((len < max) && chunk->msg->can_delay) {
                         retval = SCTP_XMIT_NAGLE_DELAY;
                         goto finish;
                 }
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index abfc0b8dee74..5d057178ce0c 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -62,7 +62,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                    struct list_head *transmitted_queue,
                                    struct sctp_transport *transport,
                                    struct sctp_sackhdr *sack,
-                                   __u32 highest_new_tsn);
+                                   __u32 *highest_new_tsn);
 
 static void sctp_mark_missing(struct sctp_outq *q,
                               struct list_head *transmitted_queue,
@@ -308,7 +308,7 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
         /* If it is data, queue it up, otherwise, send it
          * immediately.
          */
-        if (SCTP_CID_DATA == chunk->chunk_hdr->type) {
+        if (sctp_chunk_is_data(chunk)) {
                 /* Is it OK to queue data chunks?  */
                 /* From 9. Termination of Association
                  *
@@ -598,11 +598,23 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                 if (fast_rtx && !chunk->fast_retransmit)
                         continue;
 
+redo:
                 /* Attempt to append this chunk to the packet. */
                 status = sctp_packet_append_chunk(pkt, chunk);
 
                 switch (status) {
                 case SCTP_XMIT_PMTU_FULL:
+                        if (!pkt->has_data && !pkt->has_cookie_echo) {
+                                /* If this packet did not contain DATA then
+                                 * retransmission did not happen, so do it
+                                 * again.  We'll ignore the error here since
+                                 * control chunks are already freed so there
+                                 * is nothing we can do.
+                                 */
+                                sctp_packet_transmit(pkt);
+                                goto redo;
+                        }
+
                         /* Send this packet.  */
                         error = sctp_packet_transmit(pkt);
 
@@ -647,14 +659,6 @@ static int sctp_outq_flush_rtx(struct sctp_outq *q, struct sctp_packet *pkt,
                         if (chunk->fast_retransmit == SCTP_NEED_FRTX)
                                 chunk->fast_retransmit = SCTP_DONT_FRTX;
 
-                        /* Force start T3-rtx timer when fast retransmitting
-                         * the earliest outstanding TSN
-                         */
-                        if (!timer && fast_rtx &&
-                            ntohl(chunk->subh.data_hdr->tsn) ==
-                                             asoc->ctsn_ack_point + 1)
-                                timer = 2;
-
                         q->empty = 0;
                         break;
                 }
@@ -854,6 +858,12 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         if (status  != SCTP_XMIT_OK) {
                                 /* put the chunk back */
                                 list_add(&chunk->list, &q->control_chunk_list);
+                        } else if (chunk->chunk_hdr->type == SCTP_CID_FWD_TSN) {
+                                /* PR-SCTP C5) If a FORWARD TSN is sent, the
+                                 * sender MUST assure that at least one T3-rtx
+                                 * timer is running.
+                                 */
+                                sctp_transport_reset_timers(transport);
                         }
                         break;
 
@@ -906,8 +916,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                                                     rtx_timeout, &start_timer);
 
                         if (start_timer)
-                                sctp_transport_reset_timers(transport,
-                                                            start_timer-1);
+                                sctp_transport_reset_timers(transport);
 
                         /* This can happen on COOKIE-ECHO resend.  Only
                          * one chunk can get bundled with a COOKIE-ECHO.
@@ -1040,7 +1049,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                         list_add_tail(&chunk->transmitted_list,
                                       &transport->transmitted);
 
-                        sctp_transport_reset_timers(transport, 0);
+                        sctp_transport_reset_timers(transport);
 
                         q->empty = 0;
 
@@ -1100,32 +1109,6 @@ static void sctp_sack_update_unack_data(struct sctp_association *assoc,
         assoc->unack_data = unack_data;
 }
 
-/* Return the highest new tsn that is acknowledged by the given SACK chunk. */
-static __u32 sctp_highest_new_tsn(struct sctp_sackhdr *sack,
-                                  struct sctp_association *asoc)
-{
-        struct sctp_transport *transport;
-        struct sctp_chunk *chunk;
-        __u32 highest_new_tsn, tsn;
-        struct list_head *transport_list = &asoc->peer.transport_addr_list;
-
-        highest_new_tsn = ntohl(sack->cum_tsn_ack);
-
-        list_for_each_entry(transport, transport_list, transports) {
-                list_for_each_entry(chunk, &transport->transmitted,
-                                transmitted_list) {
-                        tsn = ntohl(chunk->subh.data_hdr->tsn);
-
-                        if (!chunk->tsn_gap_acked &&
-                            TSN_lt(highest_new_tsn, tsn) &&
-                            sctp_acked(sack, tsn))
-                                highest_new_tsn = tsn;
-                }
-        }
-
-        return highest_new_tsn;
-}
-
 /* This is where we REALLY process a SACK.
  *
  * Process the SACK against the outqueue.  Mostly, this just frees
@@ -1145,6 +1128,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
         struct sctp_transport *primary = asoc->peer.primary_path;
         int count_of_newacks = 0;
         int gap_ack_blocks;
+        u8 accum_moved = 0;
 
         /* Grab the association's destination address list. */
         transport_list = &asoc->peer.transport_addr_list;
@@ -1193,18 +1177,15 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
         if (gap_ack_blocks)
                 highest_tsn += ntohs(frags[gap_ack_blocks - 1].gab.end);
 
-        if (TSN_lt(asoc->highest_sacked, highest_tsn)) {
-                highest_new_tsn = highest_tsn;
+        if (TSN_lt(asoc->highest_sacked, highest_tsn))
                 asoc->highest_sacked = highest_tsn;
-        } else {
-                highest_new_tsn = sctp_highest_new_tsn(sack, asoc);
-        }
 
+        highest_new_tsn = sack_ctsn;
 
         /* Run through the retransmit queue.  Credit bytes received
          * and free those chunks that we can.
          */
-        sctp_check_transmitted(q, &q->retransmit, NULL, sack, highest_new_tsn);
+        sctp_check_transmitted(q, &q->retransmit, NULL, sack, &highest_new_tsn);
 
         /* Run through the transmitted queue.
          * Credit bytes received and free those chunks which we can.
@@ -1213,7 +1194,7 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
          */
         list_for_each_entry(transport, transport_list, transports) {
                 sctp_check_transmitted(q, &transport->transmitted,
-                                       transport, sack, highest_new_tsn);
+                                       transport, sack, &highest_new_tsn);
                 /*
                  * SFR-CACC algorithm:
                  * C) Let count_of_newacks be the number of
@@ -1223,16 +1204,22 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_sackhdr *sack)
                         count_of_newacks ++;
         }
 
+        /* Move the Cumulative TSN Ack Point if appropriate.  */
+        if (TSN_lt(asoc->ctsn_ack_point, sack_ctsn)) {
+                asoc->ctsn_ack_point = sack_ctsn;
+                accum_moved = 1;
+        }
+
         if (gap_ack_blocks) {
+
+                if (asoc->fast_recovery && accum_moved)
+                        highest_new_tsn = highest_tsn;
+
                 list_for_each_entry(transport, transport_list, transports)
                         sctp_mark_missing(q, &transport->transmitted, transport,
                                           highest_new_tsn, count_of_newacks);
         }
 
-        /* Move the Cumulative TSN Ack Point if appropriate.  */
-        if (TSN_lt(asoc->ctsn_ack_point, sack_ctsn))
-                asoc->ctsn_ack_point = sack_ctsn;
-
         /* Update unack_data field in the assoc. */
         sctp_sack_update_unack_data(asoc, sack);
 
@@ -1315,7 +1302,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                    struct list_head *transmitted_queue,
                                    struct sctp_transport *transport,
                                    struct sctp_sackhdr *sack,
-                                   __u32 highest_new_tsn_in_sack)
+                                   __u32 *highest_new_tsn_in_sack)
 {
         struct list_head *lchunk;
         struct sctp_chunk *tchunk;
@@ -1387,7 +1374,6 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                                  * instance).
                                  */
                                 if (!tchunk->tsn_gap_acked &&
-                                    !tchunk->resent &&
                                     tchunk->rtt_in_progress) {
                                         tchunk->rtt_in_progress = 0;
                                         rtt = jiffies - tchunk->sent_at;
@@ -1404,6 +1390,7 @@ static void sctp_check_transmitted(struct sctp_outq *q,
                          */
                         if (!tchunk->tsn_gap_acked) {
                                 tchunk->tsn_gap_acked = 1;
+                                *highest_new_tsn_in_sack = tsn;
                                 bytes_acked += sctp_data_size(tchunk);
                                 if (!tchunk->transport)
                                         migrate_bytes += sctp_data_size(tchunk);
@@ -1677,7 +1664,8 @@ static void sctp_mark_missing(struct sctp_outq *q,
         struct sctp_chunk *chunk;
         __u32 tsn;
         char do_fast_retransmit = 0;
-        struct sctp_transport *primary = q->asoc->peer.primary_path;
+        struct sctp_association *asoc = q->asoc;
+        struct sctp_transport *primary = asoc->peer.primary_path;
 
         list_for_each_entry(chunk, transmitted_queue, transmitted_list) {
 
diff --git a/net/sctp/probe.c b/net/sctp/probe.c
new file mode 100644
index 000000000000..db3a42b8b349
--- /dev/null
+++ b/net/sctp/probe.c
@@ -0,0 +1,214 @@
+/*
+ * sctp_probe - Observe the SCTP flow with kprobes.
+ *
+ * The idea for this came from Werner Almesberger's umlsim
+ * Copyright (C) 2004, Stephen Hemminger <shemminger@osdl.org>
+ *
+ * Modified for SCTP from Stephen Hemminger's code
+ * Copyright (C) 2010, Wei Yongjun <yjwei@cn.fujitsu.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/kprobes.h>
+#include <linux/socket.h>
+#include <linux/sctp.h>
+#include <linux/proc_fs.h>
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+#include <linux/kfifo.h>
+#include <linux/time.h>
+#include <net/net_namespace.h>
+
+#include <net/sctp/sctp.h>
+#include <net/sctp/sm.h>
+
+MODULE_AUTHOR("Wei Yongjun <yjwei@cn.fujitsu.com>");
+MODULE_DESCRIPTION("SCTP snooper");
+MODULE_LICENSE("GPL");
+
+static int port __read_mostly = 0;
+MODULE_PARM_DESC(port, "Port to match (0=all)");
+module_param(port, int, 0);
+
+static int bufsize __read_mostly = 64 * 1024;
+MODULE_PARM_DESC(bufsize, "Log buffer size (default 64k)");
+module_param(bufsize, int, 0);
+
+static int full __read_mostly = 1;
+MODULE_PARM_DESC(full, "Full log (1=every ack packet received,  0=only cwnd changes)");
+module_param(full, int, 0);
+
+static const char procname[] = "sctpprobe";
+
+static struct {
+        struct kfifo      fifo;
+        spinlock_t        lock;
+        wait_queue_head_t wait;
+        struct timespec   tstart;
+} sctpw;
+
+static void printl(const char *fmt, ...)
+{
+        va_list args;
+        int len;
+        char tbuf[256];
+
+        va_start(args, fmt);
+        len = vscnprintf(tbuf, sizeof(tbuf), fmt, args);
+        va_end(args);
+
+        kfifo_in_locked(&sctpw.fifo, tbuf, len, &sctpw.lock);
+        wake_up(&sctpw.wait);
+}
+
+static int sctpprobe_open(struct inode *inode, struct file *file)
+{
+        kfifo_reset(&sctpw.fifo);
+        getnstimeofday(&sctpw.tstart);
+
+        return 0;
+}
+
+static ssize_t sctpprobe_read(struct file *file, char __user *buf,
+                              size_t len, loff_t *ppos)
+{
+        int error = 0, cnt = 0;
+        unsigned char *tbuf;
+
+        if (!buf)
+                return -EINVAL;
+
+        if (len == 0)
+                return 0;
+
+        tbuf = vmalloc(len);
+        if (!tbuf)
+                return -ENOMEM;
+
+        error = wait_event_interruptible(sctpw.wait,
+                                         kfifo_len(&sctpw.fifo) != 0);
+        if (error)
+                goto out_free;
+
+        cnt = kfifo_out_locked(&sctpw.fifo, tbuf, len, &sctpw.lock);
+        error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
+
+out_free:
+        vfree(tbuf);
+
+        return error ? error : cnt;
+}
+
+static const struct file_operations sctpprobe_fops = {
+        .owner  = THIS_MODULE,
+        .open   = sctpprobe_open,
+        .read   = sctpprobe_read,
+};
+
+sctp_disposition_t jsctp_sf_eat_sack(const struct sctp_endpoint *ep,
+                                     const struct sctp_association *asoc,
+                                     const sctp_subtype_t type,
+                                     void *arg,
+                                     sctp_cmd_seq_t *commands)
+{
+        struct sctp_transport *sp;
+        static __u32 lcwnd = 0;
+        struct timespec now;
+
+        sp = asoc->peer.primary_path;
+
+        if ((full || sp->cwnd != lcwnd) &&
+            (!port || asoc->peer.port == port ||
+             ep->base.bind_addr.port == port)) {
+                lcwnd = sp->cwnd;
+
+                getnstimeofday(&now);
+                now = timespec_sub(now, sctpw.tstart);
+
+                printl("%lu.%06lu ", (unsigned long) now.tv_sec,
+                       (unsigned long) now.tv_nsec / NSEC_PER_USEC);
+
+                printl("%p %5d %5d %5d %8d %5d ", asoc,
+                       ep->base.bind_addr.port, asoc->peer.port,
+                       asoc->pathmtu, asoc->peer.rwnd, asoc->unack_data);
+
+                list_for_each_entry(sp, &asoc->peer.transport_addr_list,
+                                        transports) {
+                        if (sp == asoc->peer.primary_path)
+                                printl("*");
+
+                        if (sp->ipaddr.sa.sa_family == AF_INET)
+                                printl("%pI4 ", &sp->ipaddr.v4.sin_addr);
+                        else
+                                printl("%pI6 ", &sp->ipaddr.v6.sin6_addr);
+
+                        printl("%2u %8u %8u %8u %8u %8u ",
+                               sp->state, sp->cwnd, sp->ssthresh,
+                               sp->flight_size, sp->partial_bytes_acked,
+                               sp->pathmtu);
+                }
+                printl("\n");
+        }
+
+        jprobe_return();
+        return 0;
+}
+
+static struct jprobe sctp_recv_probe = {
+        .kp     = {
+                .symbol_name = "sctp_sf_eat_sack_6_2",
+        },
+        .entry  = jsctp_sf_eat_sack,
+};
+
+static __init int sctpprobe_init(void)
+{
+        int ret = -ENOMEM;
+
+        init_waitqueue_head(&sctpw.wait);
+        spin_lock_init(&sctpw.lock);
+        if (kfifo_alloc(&sctpw.fifo, bufsize, GFP_KERNEL))
+                return ret;
+
+        if (!proc_net_fops_create(&init_net, procname, S_IRUSR,
+                                  &sctpprobe_fops))
+                goto free_kfifo;
+
+        ret = register_jprobe(&sctp_recv_probe);
+        if (ret)
+                goto remove_proc;
+
+        pr_info("SCTP probe registered (port=%d)\n", port);
+
+        return 0;
+
+remove_proc:
+        proc_net_remove(&init_net, procname);
+free_kfifo:
+        kfifo_free(&sctpw.fifo);
+        return ret;
+}
+
+static __exit void sctpprobe_exit(void)
+{
+        kfifo_free(&sctpw.fifo);
+        proc_net_remove(&init_net, procname);
+        unregister_jprobe(&sctp_recv_probe);
+}
+
+module_init(sctpprobe_init);
+module_exit(sctpprobe_exit);
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 704298f4b284..182749867c72 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -474,13 +474,17 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
 
         memset(&fl, 0x0, sizeof(struct flowi));
         fl.fl4_dst  = daddr->v4.sin_addr.s_addr;
+        fl.fl_ip_dport = daddr->v4.sin_port;
         fl.proto = IPPROTO_SCTP;
         if (asoc) {
                 fl.fl4_tos = RT_CONN_FLAGS(asoc->base.sk);
                 fl.oif = asoc->base.sk->sk_bound_dev_if;
+                fl.fl_ip_sport = htons(asoc->base.bind_addr.port);
         }
-        if (saddr)
+        if (saddr) {
                 fl.fl4_src = saddr->v4.sin_addr.s_addr;
+                fl.fl_ip_sport = saddr->v4.sin_port;
+        }
 
         SCTP_DEBUG_PRINTK("%s: DST:%pI4, SRC:%pI4 - ",
                           __func__, &fl.fl4_dst, &fl.fl4_src);
@@ -528,6 +532,7 @@ static struct dst_entry *sctp_v4_get_dst(struct sctp_association *asoc,
                 if ((laddr->state == SCTP_ADDR_SRC) &&
                     (AF_INET == laddr->a.sa.sa_family)) {
                         fl.fl4_src = laddr->a.v4.sin_addr.s_addr;
+                        fl.fl_ip_sport = laddr->a.v4.sin_port;
                         if (!ip_route_output_key(&init_net, &rt, &fl)) {
                                 dst = &rt->u.dst;
                                 goto out_unlock;
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 17cb400ecd6a..d8261f3d7715 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -108,7 +108,7 @@ static const struct sctp_paramhdr prsctp_param = {
         cpu_to_be16(sizeof(struct sctp_paramhdr)),
 };
 
-/* A helper to initialize to initialize an op error inside a
+/* A helper to initialize an op error inside a
  * provided chunk, as most cause codes will be embedded inside an
  * abort chunk.
  */
@@ -125,6 +125,29 @@ void  sctp_init_cause(struct sctp_chunk *chunk, __be16 cause_code,
         chunk->subh.err_hdr = sctp_addto_chunk(chunk, sizeof(sctp_errhdr_t), &err);
 }
 
+/* A helper to initialize an op error inside a
+ * provided chunk, as most cause codes will be embedded inside an
+ * abort chunk.  Differs from sctp_init_cause in that it won't oops
+ * if there isn't enough space in the op error chunk
+ */
+int sctp_init_cause_fixed(struct sctp_chunk *chunk, __be16 cause_code,
+                      size_t paylen)
+{
+        sctp_errhdr_t err;
+        __u16 len;
+
+        /* Cause code constants are now defined in network order.  */
+        err.cause = cause_code;
+        len = sizeof(sctp_errhdr_t) + paylen;
+        err.length  = htons(len);
+
+        if (skb_tailroom(chunk->skb) >  len)
+                return -ENOSPC;
+        chunk->subh.err_hdr = sctp_addto_chunk_fixed(chunk,
+                                                     sizeof(sctp_errhdr_t),
+                                                     &err);
+        return 0;
+}
 /* 3.3.2 Initiation (INIT) (1)
  *
  * This chunk is used to initiate a SCTP association between two
@@ -208,7 +231,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
         sp = sctp_sk(asoc->base.sk);
         num_types = sp->pf->supported_addrs(sp, types);
 
-        chunksize = sizeof(init) + addrs_len + SCTP_SAT_LEN(num_types);
+        chunksize = sizeof(init) + addrs_len;
+        chunksize += WORD_ROUND(SCTP_SAT_LEN(num_types));
         chunksize += sizeof(ecap_param);
 
         if (sctp_prsctp_enable)
@@ -238,14 +262,14 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
                 /* Add HMACS parameter length if any were defined */
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 /* Add CHUNKS parameter length */
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -255,7 +279,8 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
 
         /* If we have any extensions to report, account for that */
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* RFC 2960 3.3.2 Initiation (INIT) (1)
          *
@@ -397,13 +422,13 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
 
                 auth_hmacs = (sctp_paramhdr_t *)asoc->c.auth_hmacs;
                 if (auth_hmacs->length)
-                        chunksize += ntohs(auth_hmacs->length);
+                        chunksize += WORD_ROUND(ntohs(auth_hmacs->length));
                 else
                         auth_hmacs = NULL;
 
                 auth_chunks = (sctp_paramhdr_t *)asoc->c.auth_chunks;
                 if (auth_chunks->length)
-                        chunksize += ntohs(auth_chunks->length);
+                        chunksize += WORD_ROUND(ntohs(auth_chunks->length));
                 else
                         auth_chunks = NULL;
 
@@ -412,17 +437,25 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         }
 
         if (num_ext)
-                chunksize += sizeof(sctp_supported_ext_param_t) + num_ext;
+                chunksize += WORD_ROUND(sizeof(sctp_supported_ext_param_t) +
+                                        num_ext);
 
         /* Now allocate and fill out the chunk.  */
         retval = sctp_make_chunk(asoc, SCTP_CID_INIT_ACK, 0, chunksize);
         if (!retval)
                 goto nomem_chunk;
 
-        /* Per the advice in RFC 2960 6.4, send this reply to
-         * the source of the INIT packet.
+        /* RFC 2960 6.4 Multi-homed SCTP Endpoints
+         *
+         * An endpoint SHOULD transmit reply chunks (e.g., SACK,
+         * HEARTBEAT ACK, * etc.) to the same destination transport
+         * address from which it received the DATA or control chunk
+         * to which it is replying.
+         *
+         * [INIT ACK back to where the INIT came from.]
          */
         retval->transport = chunk->transport;
+
         retval->subh.init_hdr =
                 sctp_addto_chunk(retval, sizeof(initack), &initack);
         retval->param_hdr.v = sctp_addto_chunk(retval, addrs_len, addrs.v);
@@ -461,18 +494,6 @@ struct sctp_chunk *sctp_make_init_ack(const struct sctp_association *asoc,
         /* We need to remove the const qualifier at this point.  */
         retval->asoc = (struct sctp_association *) asoc;
 
-        /* RFC 2960 6.4 Multi-homed SCTP Endpoints
-         *
-         * An endpoint SHOULD transmit reply chunks (e.g., SACK,
-         * HEARTBEAT ACK, * etc.) to the same destination transport
-         * address from which it received the DATA or control chunk
-         * to which it is replying.
-         *
-         * [INIT ACK back to where the INIT came from.]
-         */
-        if (chunk)
-                retval->transport = chunk->transport;
-
 nomem_chunk:
         kfree(cookie);
 nomem_cookie:
@@ -1129,6 +1150,24 @@ nodata:
         return retval;
 }
 
+/* Create an Operation Error chunk of a fixed size,
+ * specifically, max(asoc->pathmtu, SCTP_DEFAULT_MAXSEGMENT)
+ * This is a helper function to allocate an error chunk for
+ * for those invalid parameter codes in which we may not want
+ * to report all the errors, if the incomming chunk is large
+ */
+static inline struct sctp_chunk *sctp_make_op_error_fixed(
+        const struct sctp_association *asoc,
+        const struct sctp_chunk *chunk)
+{
+        size_t size = asoc ? asoc->pathmtu : 0;
+
+        if (!size)
+                size = SCTP_DEFAULT_MAXSEGMENT;
+
+        return sctp_make_op_error_space(asoc, chunk, size);
+}
+
 /* Create an Operation Error chunk.  */
 struct sctp_chunk *sctp_make_op_error(const struct sctp_association *asoc,
                                  const struct sctp_chunk *chunk,
@@ -1210,7 +1249,6 @@ struct sctp_chunk *sctp_chunkify(struct sk_buff *skb,
         INIT_LIST_HEAD(&retval->list);
         retval->skb             = skb;
         retval->asoc            = (struct sctp_association *)asoc;
-        retval->resent          = 0;
         retval->has_tsn         = 0;
         retval->has_ssn         = 0;
         retval->rtt_in_progress = 0;
@@ -1371,6 +1409,18 @@ void *sctp_addto_chunk(struct sctp_chunk *chunk, int len, const void *data)
         return target;
 }
 
+/* Append bytes to the end of a chunk. Returns NULL if there isn't sufficient
+ * space in the chunk
+ */
+void *sctp_addto_chunk_fixed(struct sctp_chunk *chunk,
+                             int len, const void *data)
+{
+        if (skb_tailroom(chunk->skb) > len)
+                return sctp_addto_chunk(chunk, len, data);
+        else
+                return NULL;
+}
+
 /* Append bytes from user space to the end of a chunk.  Will panic if
  * chunk is not big enough.
  * Returns a kernel err value.
@@ -1974,13 +2024,12 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
                  * returning multiple unknown parameters.
                  */
                 if (NULL == *errp)
-                        *errp = sctp_make_op_error_space(asoc, chunk,
-                                        ntohs(chunk->chunk_hdr->length));
+                        *errp = sctp_make_op_error_fixed(asoc, chunk);
 
                 if (*errp) {
-                        sctp_init_cause(*errp, SCTP_ERROR_UNKNOWN_PARAM,
+                        sctp_init_cause_fixed(*errp, SCTP_ERROR_UNKNOWN_PARAM,
                                         WORD_ROUND(ntohs(param.p->length)));
-                        sctp_addto_chunk(*errp,
+                        sctp_addto_chunk_fixed(*errp,
                                         WORD_ROUND(ntohs(param.p->length)),
                                         param.v);
                 } else {
@@ -3315,21 +3364,6 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         sctp_chunk_free(asconf);
         asoc->addip_last_asconf = NULL;
 
-        /* Send the next asconf chunk from the addip chunk queue. */
-        if (!list_empty(&asoc->addip_chunk_list)) {
-                struct list_head *entry = asoc->addip_chunk_list.next;
-                asconf = list_entry(entry, struct sctp_chunk, list);
-
-                list_del_init(entry);
-
-                /* Hold the chunk until an ASCONF_ACK is received. */
-                sctp_chunk_hold(asconf);
-                if (sctp_primitive_ASCONF(asoc, asconf))
-                        sctp_chunk_free(asconf);
-                else
-                        asoc->addip_last_asconf = asconf;
-        }
-
         return retval;
 }
 
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 4c5bed9af4e3..3b7230ef77c2 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -697,11 +697,15 @@ static void sctp_cmd_setup_t2(sctp_cmd_seq_t *cmds,
 {
         struct sctp_transport *t;
 
-        t = sctp_assoc_choose_alter_transport(asoc,
+        if (chunk->transport)
+                t = chunk->transport;
+        else {
+                t = sctp_assoc_choose_alter_transport(asoc,
                                               asoc->shutdown_last_sent_to);
+                chunk->transport = t;
+        }
         asoc->shutdown_last_sent_to = t;
         asoc->timeouts[SCTP_EVENT_TIMEOUT_T2_SHUTDOWN] = t->rto;
-        chunk->transport = t;
 }
 
 /* Helper function to change the state of an association. */
@@ -962,6 +966,29 @@ static int sctp_cmd_send_msg(struct sctp_association *asoc,
 }
 
 
+/* Sent the next ASCONF packet currently stored in the association.
+ * This happens after the ASCONF_ACK was succeffully processed.
+ */
+static void sctp_cmd_send_asconf(struct sctp_association *asoc)
+{
+        /* Send the next asconf chunk from the addip chunk
+         * queue.
+         */
+        if (!list_empty(&asoc->addip_chunk_list)) {
+                struct list_head *entry = asoc->addip_chunk_list.next;
+                struct sctp_chunk *asconf = list_entry(entry,
+                                                struct sctp_chunk, list);
+                list_del_init(entry);
+
+                /* Hold the chunk until an ASCONF_ACK is received. */
+                sctp_chunk_hold(asconf);
+                if (sctp_primitive_ASCONF(asoc, asconf))
+                        sctp_chunk_free(asconf);
+                else
+                        asoc->addip_last_asconf = asconf;
+        }
+}
+
 
 /* These three macros allow us to pull the debugging code out of the
  * main flow of sctp_do_sm() to keep attention focused on the real
@@ -1617,6 +1644,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
                         }
                         error = sctp_cmd_send_msg(asoc, cmd->obj.msg);
                         break;
+                case SCTP_CMD_SEND_NEXT_ASCONF:
+                        sctp_cmd_send_asconf(asoc);
+                        break;
                 default:
                         printk(KERN_WARNING "Impossible command: %u, %p\n",
                                cmd->verb, cmd->obj.ptr);
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index abf601a1b847..24b2cd555637 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -3676,8 +3676,14 @@ sctp_disposition_t sctp_sf_do_asconf_ack(const struct sctp_endpoint *ep,
                                 SCTP_TO(SCTP_EVENT_TIMEOUT_T4_RTO));
 
                 if (!sctp_process_asconf_ack((struct sctp_association *)asoc,
-                                             asconf_ack))
+                                             asconf_ack)) {
+                        /* Successfully processed ASCONF_ACK.  We can
+                         * release the next asconf if we have one.
+                         */
+                        sctp_add_cmd_sf(commands, SCTP_CMD_SEND_NEXT_ASCONF,
+                                        SCTP_NULL());
                         return SCTP_DISPOSITION_CONSUME;
+                }
 
                 abort = sctp_make_abort(asoc, asconf_ack,
                                         sizeof(sctp_errhdr_t));
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c1941276f6e3..ba1add0b13c3 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3719,12 +3719,9 @@ SCTP_STATIC int sctp_init_sock(struct sock *sk)
         sp->hmac = NULL;
 
         SCTP_DBG_OBJCNT_INC(sock);
-        percpu_counter_inc(&sctp_sockets_allocated);
-
-        /* Set socket backlog limit. */
-        sk->sk_backlog.limit = sysctl_sctp_rmem[1];
 
         local_bh_disable();
+        percpu_counter_inc(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         local_bh_enable();
 
@@ -3741,8 +3738,8 @@ SCTP_STATIC void sctp_destroy_sock(struct sock *sk)
         /* Release our hold on the endpoint. */
         ep = sctp_sk(sk)->ep;
         sctp_endpoint_free(ep);
-        percpu_counter_dec(&sctp_sockets_allocated);
         local_bh_disable();
+        percpu_counter_dec(&sctp_sockets_allocated);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
         local_bh_enable();
 }
@@ -4387,7 +4384,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len,
                                 transports) {
                 memcpy(&temp, &from->ipaddr, sizeof(temp));
                 sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp);
-                addrlen = sctp_get_af_specific(sk->sk_family)->sockaddr_len;
+                addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
                 if (space_left < addrlen)
                         return -ENOMEM;
                 if (copy_to_user(to, &temp, addrlen))
@@ -5702,7 +5699,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         struct sctp_sock *sp = sctp_sk(sk);
         unsigned int mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         /* A TCP-style listening socket becomes readable when the accept queue
          * is not empty.
@@ -5943,7 +5940,7 @@ static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p)
         int error;
         DEFINE_WAIT(wait);
 
-        prepare_to_wait_exclusive(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+        prepare_to_wait_exclusive(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
         /* Socket errors? */
         error = sock_error(sk);
@@ -5980,14 +5977,14 @@ static int sctp_wait_for_packet(struct sock * sk, int *err, long *timeo_p)
         sctp_lock_sock(sk);
 
 ready:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         return 0;
 
 interrupted:
         error = sock_intr_errno(*timeo_p);
 
 out:
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         *err = error;
         return error;
 }
@@ -6061,14 +6058,14 @@ static void __sctp_write_space(struct sctp_association *asoc)
                         wake_up_interruptible(&asoc->wait);
 
                 if (sctp_writeable(sk)) {
-                        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                                wake_up_interruptible(sk->sk_sleep);
+                        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                                wake_up_interruptible(sk_sleep(sk));
 
                         /* Note that we try to include the Async I/O support
                          * here by modeling from the current TCP/UDP code.
                          * We have not tested with it yet.
                          */
-                        if (sock->fasync_list &&
+                        if (sock->wq->fasync_list &&
                             !(sk->sk_shutdown & SEND_SHUTDOWN))
                                 sock_wake_async(sock,
                                                 SOCK_WAKE_SPACE, POLL_OUT);
@@ -6188,6 +6185,19 @@ do_nonblock:
         goto out;
 }
 
+void sctp_data_ready(struct sock *sk, int len)
+{
+        struct socket_wq *wq;
+
+        rcu_read_lock();
+        wq = rcu_dereference(sk->sk_wq);
+        if (wq_has_sleeper(wq))
+                wake_up_interruptible_sync_poll(&wq->wait, POLLIN |
+                                                POLLRDNORM | POLLRDBAND);
+        sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
+        rcu_read_unlock();
+}
+
 /* If socket sndbuf has changed, wake up all per association waiters.  */
 void sctp_write_space(struct sock *sk)
 {
@@ -6296,7 +6306,7 @@ static int sctp_wait_for_accept(struct sock *sk, long timeo)
 
 
         for (;;) {
-                prepare_to_wait_exclusive(sk->sk_sleep, &wait,
+                prepare_to_wait_exclusive(sk_sleep(sk), &wait,
                                           TASK_INTERRUPTIBLE);
 
                 if (list_empty(&ep->asocs)) {
@@ -6322,7 +6332,7 @@ static int sctp_wait_for_accept(struct sock *sk, long timeo)
                         break;
         }
 
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 
         return err;
 }
@@ -6332,7 +6342,7 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
         DEFINE_WAIT(wait);
 
         do {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
                 if (list_empty(&sctp_sk(sk)->ep->asocs))
                         break;
                 sctp_release_sock(sk);
@@ -6340,7 +6350,7 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
                 sctp_lock_sock(sk);
         } while (!signal_pending(current) && timeout);
 
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
 }
 
 static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index be4d63d5a5cc..fccf4947aff1 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -64,9 +64,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
         /* Copy in the address.  */
         peer->ipaddr = *addr;
         peer->af_specific = sctp_get_af_specific(addr->sa.sa_family);
-        peer->asoc = NULL;
-
-        peer->dst = NULL;
         memset(&peer->saddr, 0, sizeof(union sctp_addr));
 
         /* From 6.3.1 RTO Calculation:
@@ -76,34 +73,21 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
          * parameter 'RTO.Initial'.
          */
         peer->rto = msecs_to_jiffies(sctp_rto_initial);
-        peer->rtt = 0;
-        peer->rttvar = 0;
-        peer->srtt = 0;
-        peer->rto_pending = 0;
-        peer->hb_sent = 0;
-        peer->fast_recovery = 0;
 
         peer->last_time_heard = jiffies;
         peer->last_time_ecne_reduced = jiffies;
 
-        peer->init_sent_count = 0;
-
         peer->param_flags = SPP_HB_DISABLE |
                             SPP_PMTUD_ENABLE |
                             SPP_SACKDELAY_ENABLE;
-        peer->hbinterval  = 0;
 
         /* Initialize the default path max_retrans.  */
         peer->pathmaxrxt  = sctp_max_retrans_path;
-        peer->error_count = 0;
 
         INIT_LIST_HEAD(&peer->transmitted);
         INIT_LIST_HEAD(&peer->send_ready);
         INIT_LIST_HEAD(&peer->transports);
 
-        peer->T3_rtx_timer.expires = 0;
-        peer->hb_timer.expires = 0;
-
         setup_timer(&peer->T3_rtx_timer, sctp_generate_t3_rtx_event,
                         (unsigned long)peer);
         setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
@@ -113,15 +97,6 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
         get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
 
         atomic_set(&peer->refcnt, 1);
-        peer->dead = 0;
-
-        peer->malloced = 0;
-
-        /* Initialize the state information for SFR-CACC */
-        peer->cacc.changeover_active = 0;
-        peer->cacc.cycling_changeover = 0;
-        peer->cacc.next_tsn_at_change = 0;
-        peer->cacc.cacc_saw_newack = 0;
 
         return peer;
 }
@@ -195,7 +170,7 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
 /* Start T3_rtx timer if it is not already running and update the heartbeat
  * timer.  This routine is called every time a DATA chunk is sent.
  */
-void sctp_transport_reset_timers(struct sctp_transport *transport, int force)
+void sctp_transport_reset_timers(struct sctp_transport *transport)
 {
         /* RFC 2960 6.3.2 Retransmission Timer Rules
          *
@@ -205,7 +180,7 @@ void sctp_transport_reset_timers(struct sctp_transport *transport, int force)
          * address.
          */
 
-        if (force || !timer_pending(&transport->T3_rtx_timer))
+        if (!timer_pending(&transport->T3_rtx_timer))
                 if (!mod_timer(&transport->T3_rtx_timer,
                                jiffies + transport->rto))
                         sctp_transport_hold(transport);
@@ -403,15 +378,16 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
 void sctp_transport_raise_cwnd(struct sctp_transport *transport,
                                __u32 sack_ctsn, __u32 bytes_acked)
 {
+        struct sctp_association *asoc = transport->asoc;
         __u32 cwnd, ssthresh, flight_size, pba, pmtu;
 
         cwnd = transport->cwnd;
         flight_size = transport->flight_size;
 
         /* See if we need to exit Fast Recovery first */
-        if (transport->fast_recovery &&
-            TSN_lte(transport->fast_recovery_exit, sack_ctsn))
-                transport->fast_recovery = 0;
+        if (asoc->fast_recovery &&
+            TSN_lte(asoc->fast_recovery_exit, sack_ctsn))
+                asoc->fast_recovery = 0;
 
         /* The appropriate cwnd increase algorithm is performed if, and only
          * if the cumulative TSN whould advanced and the congestion window is
@@ -440,7 +416,7 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
                  *    2) the destination's path MTU.  This upper bound protects
                  *    against the ACK-Splitting attack outlined in [SAVAGE99].
                  */
-                if (transport->fast_recovery)
+                if (asoc->fast_recovery)
                         return;
 
                 if (bytes_acked > pmtu)
@@ -491,6 +467,8 @@ void sctp_transport_raise_cwnd(struct sctp_transport *transport,
 void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                                sctp_lower_cwnd_t reason)
 {
+        struct sctp_association *asoc = transport->asoc;
+
         switch (reason) {
         case SCTP_LOWER_CWND_T3_RTX:
                 /* RFC 2960 Section 7.2.3, sctpimpguide
@@ -501,11 +479,11 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                  *      partial_bytes_acked = 0
                  */
                 transport->ssthresh = max(transport->cwnd/2,
-                                          4*transport->asoc->pathmtu);
-                transport->cwnd = transport->asoc->pathmtu;
+                                          4*asoc->pathmtu);
+                transport->cwnd = asoc->pathmtu;
 
-                /* T3-rtx also clears fast recovery on the transport */
-                transport->fast_recovery = 0;
+                /* T3-rtx also clears fast recovery */
+                asoc->fast_recovery = 0;
                 break;
 
         case SCTP_LOWER_CWND_FAST_RTX:
@@ -521,15 +499,15 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                  *      cwnd = ssthresh
                  *      partial_bytes_acked = 0
                  */
-                if (transport->fast_recovery)
+                if (asoc->fast_recovery)
                         return;
 
                 /* Mark Fast recovery */
-                transport->fast_recovery = 1;
-                transport->fast_recovery_exit = transport->asoc->next_tsn - 1;
+                asoc->fast_recovery = 1;
+                asoc->fast_recovery_exit = asoc->next_tsn - 1;
 
                 transport->ssthresh = max(transport->cwnd/2,
-                                          4*transport->asoc->pathmtu);
+                                          4*asoc->pathmtu);
                 transport->cwnd = transport->ssthresh;
                 break;
 
@@ -549,7 +527,7 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                 if (time_after(jiffies, transport->last_time_ecne_reduced +
                                         transport->rtt)) {
                         transport->ssthresh = max(transport->cwnd/2,
-                                                  4*transport->asoc->pathmtu);
+                                                  4*asoc->pathmtu);
                         transport->cwnd = transport->ssthresh;
                         transport->last_time_ecne_reduced = jiffies;
                 }
@@ -565,7 +543,7 @@ void sctp_transport_lower_cwnd(struct sctp_transport *transport,
                  * interval.
                  */
                 transport->cwnd = max(transport->cwnd/2,
-                                         4*transport->asoc->pathmtu);
+                                         4*asoc->pathmtu);
                 break;
         }
 
@@ -650,7 +628,6 @@ void sctp_transport_reset(struct sctp_transport *t)
         t->error_count = 0;
         t->rto_pending = 0;
         t->hb_sent = 0;
-        t->fast_recovery = 0;
 
         /* Initialize the state information for SFR-CACC */
         t->cacc.changeover_active = 0;
diff --git a/net/socket.c b/net/socket.c
index 35bc198bbf68..dae8c6b84a09 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -252,9 +252,14 @@ static struct inode *sock_alloc_inode(struct super_block *sb)
         ei = kmem_cache_alloc(sock_inode_cachep, GFP_KERNEL);
         if (!ei)
                 return NULL;
-        init_waitqueue_head(&ei->socket.wait);
+        ei->socket.wq = kmalloc(sizeof(struct socket_wq), GFP_KERNEL);
+        if (!ei->socket.wq) {
+                kmem_cache_free(sock_inode_cachep, ei);
+                return NULL;
+        }
+        init_waitqueue_head(&ei->socket.wq->wait);
+        ei->socket.wq->fasync_list = NULL;
 
-        ei->socket.fasync_list = NULL;
         ei->socket.state = SS_UNCONNECTED;
         ei->socket.flags = 0;
         ei->socket.ops = NULL;
@@ -264,10 +269,21 @@ static struct inode *sock_alloc_inode(struct super_block *sb)
         return &ei->vfs_inode;
 }
 
+
+static void wq_free_rcu(struct rcu_head *head)
+{
+        struct socket_wq *wq = container_of(head, struct socket_wq, rcu);
+
+        kfree(wq);
+}
+
 static void sock_destroy_inode(struct inode *inode)
 {
-        kmem_cache_free(sock_inode_cachep,
-                        container_of(inode, struct socket_alloc, vfs_inode));
+        struct socket_alloc *ei;
+
+        ei = container_of(inode, struct socket_alloc, vfs_inode);
+        call_rcu(&ei->socket.wq->rcu, wq_free_rcu);
+        kmem_cache_free(sock_inode_cachep, ei);
 }
 
 static void init_once(void *foo)
@@ -513,7 +529,7 @@ void sock_release(struct socket *sock)
                 module_put(owner);
         }
 
-        if (sock->fasync_list)
+        if (sock->wq->fasync_list)
                 printk(KERN_ERR "sock_release: fasync list not empty!\n");
 
         percpu_sub(sockets_in_use, 1);
@@ -655,13 +671,13 @@ inline void sock_recv_drops(struct msghdr *msg, struct sock *sk, struct sk_buff
                         sizeof(__u32), &skb->dropcount);
 }
 
-void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
+void __sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk,
         struct sk_buff *skb)
 {
         sock_recv_timestamp(msg, sk, skb);
         sock_recv_drops(msg, sk, skb);
 }
-EXPORT_SYMBOL_GPL(sock_recv_ts_and_drops);
+EXPORT_SYMBOL_GPL(__sock_recv_ts_and_drops);
 
 static inline int __sock_recvmsg_nosec(struct kiocb *iocb, struct socket *sock,
                                        struct msghdr *msg, size_t size, int flags)
@@ -1067,87 +1083,44 @@ static int sock_close(struct inode *inode, struct file *filp)
  *      1. fasync_list is modified only under process context socket lock
  *         i.e. under semaphore.
  *      2. fasync_list is used under read_lock(&sk->sk_callback_lock)
- *         or under socket lock.
- *      3. fasync_list can be used from softirq context, so that
- *         modification under socket lock have to be enhanced with
- *         write_lock_bh(&sk->sk_callback_lock).
- *                                                      --ANK (990710)
+ *         or under socket lock
  */
 
 static int sock_fasync(int fd, struct file *filp, int on)
 {
-        struct fasync_struct *fa, *fna = NULL, **prev;
-        struct socket *sock;
-        struct sock *sk;
-
-        if (on) {
-                fna = kmalloc(sizeof(struct fasync_struct), GFP_KERNEL);
-                if (fna == NULL)
-                        return -ENOMEM;
-        }
-
-        sock = filp->private_data;
+        struct socket *sock = filp->private_data;
+        struct sock *sk = sock->sk;
 
-        sk = sock->sk;
-        if (sk == NULL) {
-                kfree(fna);
+        if (sk == NULL)
                 return -EINVAL;
-        }
 
         lock_sock(sk);
 
-        spin_lock(&filp->f_lock);
-        if (on)
-                filp->f_flags |= FASYNC;
-        else
-                filp->f_flags &= ~FASYNC;
-        spin_unlock(&filp->f_lock);
-
-        prev = &(sock->fasync_list);
-
-        for (fa = *prev; fa != NULL; prev = &fa->fa_next, fa = *prev)
-                if (fa->fa_file == filp)
-                        break;
-
-        if (on) {
-                if (fa != NULL) {
-                        write_lock_bh(&sk->sk_callback_lock);
-                        fa->fa_fd = fd;
-                        write_unlock_bh(&sk->sk_callback_lock);
+        fasync_helper(fd, filp, on, &sock->wq->fasync_list);
 
-                        kfree(fna);
-                        goto out;
-                }
-                fna->fa_file = filp;
-                fna->fa_fd = fd;
-                fna->magic = FASYNC_MAGIC;
-                fna->fa_next = sock->fasync_list;
-                write_lock_bh(&sk->sk_callback_lock);
-                sock->fasync_list = fna;
+        if (!sock->wq->fasync_list)
+                sock_reset_flag(sk, SOCK_FASYNC);
+        else
                 sock_set_flag(sk, SOCK_FASYNC);
-                write_unlock_bh(&sk->sk_callback_lock);
-        } else {
-                if (fa != NULL) {
-                        write_lock_bh(&sk->sk_callback_lock);
-                        *prev = fa->fa_next;
-                        if (!sock->fasync_list)
-                                sock_reset_flag(sk, SOCK_FASYNC);
-                        write_unlock_bh(&sk->sk_callback_lock);
-                        kfree(fa);
-                }
-        }
 
-out:
-        release_sock(sock->sk);
+        release_sock(sk);
         return 0;
 }
 
-/* This function may be called only under socket lock or callback_lock */
+/* This function may be called only under socket lock or callback_lock or rcu_lock */
 
 int sock_wake_async(struct socket *sock, int how, int band)
 {
-        if (!sock || !sock->fasync_list)
+        struct socket_wq *wq;
+
+        if (!sock)
                 return -1;
+        rcu_read_lock();
+        wq = rcu_dereference(sock->wq);
+        if (!wq || !wq->fasync_list) {
+                rcu_read_unlock();
+                return -1;
+        }
         switch (how) {
         case SOCK_WAKE_WAITD:
                 if (test_bit(SOCK_ASYNC_WAITDATA, &sock->flags))
@@ -1159,11 +1132,12 @@ int sock_wake_async(struct socket *sock, int how, int band)
                 /* fall through */
         case SOCK_WAKE_IO:
 call_kill:
-                __kill_fasync(sock->fasync_list, SIGIO, band);
+                kill_fasync(&wq->fasync_list, SIGIO, band);
                 break;
         case SOCK_WAKE_URG:
-                __kill_fasync(sock->fasync_list, SIGURG, band);
+                kill_fasync(&wq->fasync_list, SIGURG, band);
         }
+        rcu_read_unlock();
         return 0;
 }
 
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index a29f259204e6..ce0d5b35c2ac 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -419,8 +419,8 @@ static void svc_udp_data_ready(struct sock *sk, int count)
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible(sk->sk_sleep);
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible(sk_sleep(sk));
 }
 
 /*
@@ -436,10 +436,10 @@ static void svc_write_space(struct sock *sk)
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) {
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk))) {
                 dprintk("RPC svc_write_space: someone sleeping on %p\n",
                        svsk);
-                wake_up_interruptible(sk->sk_sleep);
+                wake_up_interruptible(sk_sleep(sk));
         }
 }
 
@@ -757,8 +757,8 @@ static void svc_tcp_listen_data_ready(struct sock *sk, int count_unused)
                         printk("svc: socket %p: no user data\n", sk);
         }
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible_all(sk->sk_sleep);
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible_all(sk_sleep(sk));
 }
 
 /*
@@ -777,8 +777,8 @@ static void svc_tcp_state_change(struct sock *sk)
                 set_bit(XPT_CLOSE, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible_all(sk->sk_sleep);
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible_all(sk_sleep(sk));
 }
 
 static void svc_tcp_data_ready(struct sock *sk, int count)
@@ -791,8 +791,8 @@ static void svc_tcp_data_ready(struct sock *sk, int count)
                 set_bit(XPT_DATA, &svsk->sk_xprt.xpt_flags);
                 svc_xprt_enqueue(&svsk->sk_xprt);
         }
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible(sk->sk_sleep);
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible(sk_sleep(sk));
 }
 
 /*
@@ -1494,8 +1494,8 @@ static void svc_sock_detach(struct svc_xprt *xprt)
         sk->sk_data_ready = svsk->sk_odata;
         sk->sk_write_space = svsk->sk_owspace;
 
-        if (sk->sk_sleep && waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible(sk->sk_sleep);
+        if (sk_sleep(sk) && waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible(sk_sleep(sk));
 }
 
 /*
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 42f09ade0044..699ade68aac1 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -974,7 +974,7 @@ void xprt_reserve(struct rpc_task *task)
 
 static inline __be32 xprt_alloc_xid(struct rpc_xprt *xprt)
 {
-        return xprt->xid++;
+        return (__force __be32)xprt->xid++;
 }
 
 static inline void xprt_init_xid(struct rpc_xprt *xprt)
diff --git a/net/sunrpc/xprtrdma/svc_rdma_transport.c b/net/sunrpc/xprtrdma/svc_rdma_transport.c
index fd90eb89842b..edea15a54e51 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_transport.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_transport.c
@@ -679,7 +679,10 @@ static struct svc_xprt *svc_rdma_create(struct svc_serv *serv,
         int ret;
 
         dprintk("svcrdma: Creating RDMA socket\n");
-
+        if (sa->sa_family != AF_INET) {
+                dprintk("svcrdma: Address family %d is not supported.\n", sa->sa_family);
+                return ERR_PTR(-EAFNOSUPPORT);
+        }
         cma_xprt = rdma_create_xprt(serv, 1);
         if (!cma_xprt)
                 return ERR_PTR(-ENOMEM);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index cfb20b80b3a1..66e889ba48fd 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -446,7 +446,7 @@ static unsigned int poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk;
         u32 mask;
 
-        poll_wait(file, sk->sk_sleep, wait);
+        poll_wait(file, sk_sleep(sk), wait);
 
         if (!skb_queue_empty(&sk->sk_receive_queue) ||
             (sock->state == SS_UNCONNECTED) ||
@@ -591,7 +591,7 @@ static int send_msg(struct kiocb *iocb, struct socket *sock,
                         break;
                 }
                 release_sock(sk);
-                res = wait_event_interruptible(*sk->sk_sleep,
+                res = wait_event_interruptible(*sk_sleep(sk),
                                                !tport->congested);
                 lock_sock(sk);
                 if (res)
@@ -650,7 +650,7 @@ static int send_packet(struct kiocb *iocb, struct socket *sock,
                         break;
                 }
                 release_sock(sk);
-                res = wait_event_interruptible(*sk->sk_sleep,
+                res = wait_event_interruptible(*sk_sleep(sk),
                         (!tport->congested || !tport->connected));
                 lock_sock(sk);
                 if (res)
@@ -931,7 +931,7 @@ restart:
                         goto exit;
                 }
                 release_sock(sk);
-                res = wait_event_interruptible(*sk->sk_sleep,
+                res = wait_event_interruptible(*sk_sleep(sk),
                         (!skb_queue_empty(&sk->sk_receive_queue) ||
                          (sock->state == SS_DISCONNECTING)));
                 lock_sock(sk);
@@ -1064,7 +1064,7 @@ restart:
                         goto exit;
                 }
                 release_sock(sk);
-                res = wait_event_interruptible(*sk->sk_sleep,
+                res = wait_event_interruptible(*sk_sleep(sk),
                         (!skb_queue_empty(&sk->sk_receive_queue) ||
                          (sock->state == SS_DISCONNECTING)));
                 lock_sock(sk);
@@ -1271,8 +1271,8 @@ static u32 filter_rcv(struct sock *sk, struct sk_buff *buf)
                 tipc_disconnect_port(tipc_sk_port(sk));
         }
 
-        if (waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible(sk->sk_sleep);
+        if (waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible(sk_sleep(sk));
         return TIPC_OK;
 }
 
@@ -1343,8 +1343,8 @@ static void wakeupdispatch(struct tipc_port *tport)
 {
         struct sock *sk = (struct sock *)tport->usr_handle;
 
-        if (waitqueue_active(sk->sk_sleep))
-                wake_up_interruptible(sk->sk_sleep);
+        if (waitqueue_active(sk_sleep(sk)))
+                wake_up_interruptible(sk_sleep(sk));
 }
 
 /**
@@ -1426,7 +1426,7 @@ static int connect(struct socket *sock, struct sockaddr *dest, int destlen,
         /* Wait until an 'ACK' or 'RST' arrives, or a timeout occurs */
 
         release_sock(sk);
-        res = wait_event_interruptible_timeout(*sk->sk_sleep,
+        res = wait_event_interruptible_timeout(*sk_sleep(sk),
                         (!skb_queue_empty(&sk->sk_receive_queue) ||
                         (sock->state != SS_CONNECTING)),
                         sk->sk_rcvtimeo);
@@ -1521,7 +1521,7 @@ static int accept(struct socket *sock, struct socket *new_sock, int flags)
                         goto exit;
                 }
                 release_sock(sk);
-                res = wait_event_interruptible(*sk->sk_sleep,
+                res = wait_event_interruptible(*sk_sleep(sk),
                                 (!skb_queue_empty(&sk->sk_receive_queue)));
                 lock_sock(sk);
                 if (res)
@@ -1632,8 +1632,8 @@ restart:
                 /* Discard any unreceived messages; wake up sleeping tasks */
 
                 discard_rx_queue(sk);
-                if (waitqueue_active(sk->sk_sleep))
-                        wake_up_interruptible(sk->sk_sleep);
+                if (waitqueue_active(sk_sleep(sk)))
+                        wake_up_interruptible(sk_sleep(sk));
                 res = 0;
                 break;
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 3d9122e78f41..fef2cc5e9d2b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -313,13 +313,16 @@ static inline int unix_writable(struct sock *sk)
 
 static void unix_write_space(struct sock *sk)
 {
-        read_lock(&sk->sk_callback_lock);
+        struct socket_wq *wq;
+
+        rcu_read_lock();
         if (unix_writable(sk)) {
-                if (sk_has_sleeper(sk))
-                        wake_up_interruptible_sync(sk->sk_sleep);
+                wq = rcu_dereference(sk->sk_wq);
+                if (wq_has_sleeper(wq))
+                        wake_up_interruptible_sync(&wq->wait);
                 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
         }
-        read_unlock(&sk->sk_callback_lock);
+        rcu_read_unlock();
 }
 
 /* When dgram socket disconnects (or changes its peer), we clear its receive
@@ -406,9 +409,7 @@ static int unix_release_sock(struct sock *sk, int embrion)
                                 skpair->sk_err = ECONNRESET;
                         unix_state_unlock(skpair);
                         skpair->sk_state_change(skpair);
-                        read_lock(&skpair->sk_callback_lock);
                         sk_wake_async(skpair, SOCK_WAKE_WAITD, POLL_HUP);
-                        read_unlock(&skpair->sk_callback_lock);
                 }
                 sock_put(skpair); /* It may now die */
                 unix_peer(sk) = NULL;
@@ -1142,7 +1143,7 @@ restart:
         newsk->sk_peercred.pid  = task_tgid_vnr(current);
         current_euid_egid(&newsk->sk_peercred.uid, &newsk->sk_peercred.gid);
         newu = unix_sk(newsk);
-        newsk->sk_sleep         = &newu->peer_wait;
+        newsk->sk_wq            = &newu->peer_wq;
         otheru = unix_sk(other);
 
         /* copy address information from listening to new sock*/
@@ -1736,7 +1737,7 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
         unix_state_lock(sk);
 
         for (;;) {
-                prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
+                prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
                 if (!skb_queue_empty(&sk->sk_receive_queue) ||
                     sk->sk_err ||
@@ -1752,7 +1753,7 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
                 clear_bit(SOCK_ASYNC_WAITDATA, &sk->sk_socket->flags);
         }
 
-        finish_wait(sk->sk_sleep, &wait);
+        finish_wait(sk_sleep(sk), &wait);
         unix_state_unlock(sk);
         return timeo;
 }
@@ -1931,12 +1932,10 @@ static int unix_shutdown(struct socket *sock, int mode)
                         other->sk_shutdown |= peer_mode;
                         unix_state_unlock(other);
                         other->sk_state_change(other);
-                        read_lock(&other->sk_callback_lock);
                         if (peer_mode == SHUTDOWN_MASK)
                                 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_HUP);
                         else if (peer_mode & RCV_SHUTDOWN)
                                 sk_wake_async(other, SOCK_WAKE_WAITD, POLL_IN);
-                        read_unlock(&other->sk_callback_lock);
                 }
                 if (other)
                         sock_put(other);
@@ -1991,7 +1990,7 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
         struct sock *sk = sock->sk;
         unsigned int mask;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         /* exceptional events? */
@@ -2028,7 +2027,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
         struct sock *sk = sock->sk, *other;
         unsigned int mask, writable;
 
-        sock_poll_wait(file, sk->sk_sleep, wait);
+        sock_poll_wait(file, sk_sleep(sk), wait);
         mask = 0;
 
         /* exceptional events? */
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 14c22c3768da..c8df6fda0b1f 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -153,15 +153,6 @@ void unix_notinflight(struct file *fp)
         }
 }
 
-static inline struct sk_buff *sock_queue_head(struct sock *sk)
-{
-        return (struct sk_buff *)&sk->sk_receive_queue;
-}
-
-#define receive_queue_for_each_skb(sk, next, skb) \
-        for (skb = sock_queue_head(sk)->next, next = skb->next; \
-             skb != sock_queue_head(sk); skb = next, next = skb->next)
-
 static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
                           struct sk_buff_head *hitlist)
 {
@@ -169,7 +160,7 @@ static void scan_inflight(struct sock *x, void (*func)(struct unix_sock *),
         struct sk_buff *next;
 
         spin_lock(&x->sk_receive_queue.lock);
-        receive_queue_for_each_skb(x, next, skb) {
+        skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {
                 /*
                  *      Do we have file descriptors ?
                  */
@@ -225,7 +216,7 @@ static void scan_children(struct sock *x, void (*func)(struct unix_sock *),
                  * and perform a scan on them as well.
                  */
                 spin_lock(&x->sk_receive_queue.lock);
-                receive_queue_for_each_skb(x, next, skb) {
+                skb_queue_walk_safe(&x->sk_receive_queue, skb, next) {
                         u = unix_sk(skb->sk);
 
                         /*
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 6ac70c101523..37d0e0ab4432 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -705,7 +705,8 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                         wdev->ps = true;
                 else
                         wdev->ps = false;
-                wdev->ps_timeout = 100;
+                /* allow mac80211 to determine the timeout */
+                wdev->ps_timeout = -1;
                 if (rdev->ops->set_power_mgmt)
                         if (rdev->ops->set_power_mgmt(wdev->wiphy, dev,
                                                       wdev->ps,
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 356a84a5daee..01da83ddcff7 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -152,6 +152,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
+        [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 };
 
 /* policy for the attributes */
@@ -2442,6 +2443,7 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
         params.use_cts_prot = -1;
         params.use_short_preamble = -1;
         params.use_short_slot_time = -1;
+        params.ap_isolate = -1;
 
         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
                 params.use_cts_prot =
@@ -2458,6 +2460,8 @@ static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
                 params.basic_rates_len =
                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
         }
+        if (info->attrs[NL80211_ATTR_AP_ISOLATE])
+                params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
 
         rtnl_lock();
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index c2735775ec19..8ddf5ae0dd03 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -518,12 +518,16 @@ void cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
         ev->type = EVENT_CONNECT_RESULT;
         if (bssid)
                 memcpy(ev->cr.bssid, bssid, ETH_ALEN);
-        ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
-        ev->cr.req_ie_len = req_ie_len;
-        memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
-        ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
-        ev->cr.resp_ie_len = resp_ie_len;
-        memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
+        if (req_ie_len) {
+                ev->cr.req_ie = ((u8 *)ev) + sizeof(*ev);
+                ev->cr.req_ie_len = req_ie_len;
+                memcpy((void *)ev->cr.req_ie, req_ie, req_ie_len);
+        }
+        if (resp_ie_len) {
+                ev->cr.resp_ie = ((u8 *)ev) + sizeof(*ev) + req_ie_len;
+                ev->cr.resp_ie_len = resp_ie_len;
+                memcpy((void *)ev->cr.resp_ie, resp_ie, resp_ie_len);
+        }
         ev->cr.status = status;
 
         spin_lock_irqsave(&wdev->event_lock, flags);
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index cbddd0cb83f1..296e65e01064 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -402,6 +402,7 @@ static void __x25_destroy_socket(struct sock *sk)
                         /*
                          * Queue the unaccepted socket for death
                          */
+                        skb->sk->sk_state = TCP_LISTEN;
                         sock_set_flag(skb->sk, SOCK_DEAD);
                         x25_start_heartbeat(skb->sk);
                         x25_sk(skb->sk)->state = X25_STATE_0;
@@ -718,7 +719,7 @@ static int x25_wait_for_connection_establishment(struct sock *sk)
         DECLARE_WAITQUEUE(wait, current);
         int rc;
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         for (;;) {
                 __set_current_state(TASK_INTERRUPTIBLE);
                 rc = -ERESTARTSYS;
@@ -738,7 +739,7 @@ static int x25_wait_for_connection_establishment(struct sock *sk)
                         break;
         }
         __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         return rc;
 }
 
@@ -838,7 +839,7 @@ static int x25_wait_for_data(struct sock *sk, long timeout)
         DECLARE_WAITQUEUE(wait, current);
         int rc = 0;
 
-        add_wait_queue_exclusive(sk->sk_sleep, &wait);
+        add_wait_queue_exclusive(sk_sleep(sk), &wait);
         for (;;) {
                 __set_current_state(TASK_INTERRUPTIBLE);
                 if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -858,7 +859,7 @@ static int x25_wait_for_data(struct sock *sk, long timeout)
                         break;
         }
         __set_current_state(TASK_RUNNING);
-        remove_wait_queue(sk->sk_sleep, &wait);
+        remove_wait_queue(sk_sleep(sk), &wait);
         return rc;
 }
 
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index b9ef682230a0..9005f6daeab5 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -24,6 +24,7 @@
 #include <net/sock.h>
 #include <linux/if_arp.h>
 #include <net/x25.h>
+#include <net/x25device.h>
 
 static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
 {
@@ -115,19 +116,22 @@ int x25_lapb_receive_frame(struct sk_buff *skb, struct net_device *dev,
         }
 
         switch (skb->data[0]) {
-                case 0x00:
-                        skb_pull(skb, 1);
-                        if (x25_receive_data(skb, nb)) {
-                                x25_neigh_put(nb);
-                                goto out;
-                        }
-                        break;
-                case 0x01:
-                        x25_link_established(nb);
-                        break;
-                case 0x02:
-                        x25_link_terminated(nb);
-                        break;
+
+        case X25_IFACE_DATA:
+                skb_pull(skb, 1);
+                if (x25_receive_data(skb, nb)) {
+                        x25_neigh_put(nb);
+                        goto out;
+                }
+                break;
+
+        case X25_IFACE_CONNECT:
+                x25_link_established(nb);
+                break;
+
+        case X25_IFACE_DISCONNECT:
+                x25_link_terminated(nb);
+                break;
         }
         x25_neigh_put(nb);
 drop:
@@ -148,7 +152,7 @@ void x25_establish_link(struct x25_neigh *nb)
                                 return;
                         }
                         ptr  = skb_put(skb, 1);
-                        *ptr = 0x01;
+                        *ptr = X25_IFACE_CONNECT;
                         break;
 
 #if defined(CONFIG_LLC) || defined(CONFIG_LLC_MODULE)
@@ -184,7 +188,7 @@ void x25_terminate_link(struct x25_neigh *nb)
         }
 
         ptr  = skb_put(skb, 1);
-        *ptr = 0x02;
+        *ptr = X25_IFACE_DISCONNECT;
 
         skb->protocol = htons(ETH_P_X25);
         skb->dev      = nb->dev;
@@ -200,7 +204,7 @@ void x25_send_frame(struct sk_buff *skb, struct x25_neigh *nb)
         switch (nb->dev->type) {
                 case ARPHRD_X25:
                         dptr  = skb_push(skb, 1);
-                        *dptr = 0x00;
+                        *dptr = X25_IFACE_DATA;
                         break;
 
 #if defined(CONFIG_LLC) || defined(CONFIG_LLC_MODULE)
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index e5195c99f71e..1396572d2ade 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,8 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
 
 static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
 {
-        return ntohl(daddr->a4 + saddr->a4);
+        u32 sum = (__force u32)daddr->a4 + (__force u32)saddr->a4;
+        return ntohl((__force __be32)sum);
 }
 
 static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 7430ac26ec49..31f4ba43b48f 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1732,7 +1732,7 @@ int __xfrm_lookup(struct net *net, struct dst_entry **dst_p, struct flowi *fl,
         struct dst_entry *dst, *dst_orig = *dst_p, *route;
         u16 family = dst_orig->ops->family;
         u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
-        int i, err, num_pols, num_xfrms, drop_pols = 0;
+        int i, err, num_pols, num_xfrms = 0, drop_pols = 0;
 
 restart:
         dst = NULL;
diff --git a/security/selinux/ss/avtab.h b/security/selinux/ss/avtab.h
index 8da6a8428086..cd4f734e2749 100644
--- a/security/selinux/ss/avtab.h
+++ b/security/selinux/ss/avtab.h
@@ -82,7 +82,7 @@ struct avtab_node *avtab_search_node_next(struct avtab_node *node, int specified
 void avtab_cache_init(void);
 void avtab_cache_destroy(void);
 
-#define MAX_AVTAB_HASH_BITS 13
+#define MAX_AVTAB_HASH_BITS 11
 #define MAX_AVTAB_HASH_BUCKETS (1 << MAX_AVTAB_HASH_BITS)
 #define MAX_AVTAB_HASH_MASK (MAX_AVTAB_HASH_BUCKETS-1)
 #define MAX_AVTAB_SIZE MAX_AVTAB_HASH_BUCKETS
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 656e474dca47..91acc9a243ec 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -863,7 +863,6 @@ static int __devinit aaci_probe_ac97(struct aaci *aaci)
         struct snd_ac97 *ac97;
         int ret;
 
-        writel(0, aaci->base + AC97_POWERDOWN);
         /*
          * Assert AACIRESET for 2us
          */
@@ -1047,7 +1046,11 @@ static int __devinit aaci_probe(struct amba_device *dev, struct amba_id *id)
 
         writel(0x1fff, aaci->base + AACI_INTCLR);
         writel(aaci->maincr, aaci->base + AACI_MAINCR);
-
+        /*
+         * Fix: ac97 read back fail errors by reading
+         * from any arbitrary aaci register.
+         */
+        readl(aaci->base + AACI_CSCH1);
         ret = aaci_probe_ac97(aaci);
         if (ret)
                 goto out;
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index f8fd586ae024..f669442b7c82 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -2272,6 +2272,7 @@ static struct snd_pci_quirk position_fix_list[] __devinitdata = {
         SND_PCI_QUIRK(0x1458, 0xa022, "ga-ma770-ud3", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1462, 0x1002, "MSI Wind U115", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x1565, 0x820f, "Biostar Microtech", POS_FIX_LPIB),
+        SND_PCI_QUIRK(0x1565, 0x8218, "Biostar Microtech", POS_FIX_LPIB),
         SND_PCI_QUIRK(0x8086, 0xd601, "eMachines T5212", POS_FIX_LPIB),
         {}
 };
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index c7730dbb9ddb..aad1627f56f1 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -230,6 +230,7 @@ enum {
         ALC888_ACER_ASPIRE_7730G,
         ALC883_MEDION,
         ALC883_MEDION_MD2,
+        ALC883_MEDION_WIM2160,
         ALC883_LAPTOP_EAPD,
         ALC883_LENOVO_101E_2ch,
         ALC883_LENOVO_NB0763,
@@ -1389,22 +1390,31 @@ struct alc_fixup {
 
 static void alc_pick_fixup(struct hda_codec *codec,
                            const struct snd_pci_quirk *quirk,
-                           const struct alc_fixup *fix)
+                           const struct alc_fixup *fix,
+                           int pre_init)
 {
         const struct alc_pincfg *cfg;
 
         quirk = snd_pci_quirk_lookup(codec->bus->pci, quirk);
         if (!quirk)
                 return;
-
         fix += quirk->value;
         cfg = fix->pins;
-        if (cfg) {
+        if (pre_init && cfg) {
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+                snd_printdd(KERN_INFO "hda_codec: %s: Apply pincfg for %s\n",
+                            codec->chip_name, quirk->name);
+#endif
                 for (; cfg->nid; cfg++)
                         snd_hda_codec_set_pincfg(codec, cfg->nid, cfg->val);
         }
-        if (fix->verbs)
+        if (!pre_init && fix->verbs) {
+#ifdef CONFIG_SND_DEBUG_VERBOSE
+                snd_printdd(KERN_INFO "hda_codec: %s: Apply fix-verbs for %s\n",
+                            codec->chip_name, quirk->name);
+#endif
                 add_verb(codec->spec, fix->verbs);
+        }
 }
 
 static int alc_read_coef_idx(struct hda_codec *codec,
@@ -4808,6 +4818,25 @@ static void alc880_auto_init_analog_input(struct hda_codec *codec)
         }
 }
 
+static void alc880_auto_init_input_src(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        int c;
+
+        for (c = 0; c < spec->num_adc_nids; c++) {
+                unsigned int mux_idx;
+                const struct hda_input_mux *imux;
+                mux_idx = c >= spec->num_mux_defs ? 0 : c;
+                imux = &spec->input_mux[mux_idx];
+                if (!imux->num_items && mux_idx > 0)
+                        imux = &spec->input_mux[0];
+                if (imux)
+                        snd_hda_codec_write(codec, spec->adc_nids[c], 0,
+                                            AC_VERB_SET_CONNECT_SEL,
+                                            imux->items[0].index);
+        }
+}
+
 /* parse the BIOS configuration and set up the alc_spec */
 /* return 1 if successful, 0 if the proper config is not found,
  * or a negative error code
@@ -4886,6 +4915,7 @@ static void alc880_auto_init(struct hda_codec *codec)
         alc880_auto_init_multi_out(codec);
         alc880_auto_init_extra_out(codec);
         alc880_auto_init_analog_input(codec);
+        alc880_auto_init_input_src(codec);
         if (spec->unsol_event)
                 alc_inithook(codec);
 }
@@ -6397,6 +6427,8 @@ static void alc260_auto_init_analog_input(struct hda_codec *codec)
         }
 }
 
+#define alc260_auto_init_input_src      alc880_auto_init_input_src
+
 /*
  * generic initialization of ADC, input mixers and output mixers
  */
@@ -6483,6 +6515,7 @@ static void alc260_auto_init(struct hda_codec *codec)
         struct alc_spec *spec = codec->spec;
         alc260_auto_init_multi_out(codec);
         alc260_auto_init_analog_input(codec);
+        alc260_auto_init_input_src(codec);
         if (spec->unsol_event)
                 alc_inithook(codec);
 }
@@ -8455,6 +8488,42 @@ static struct snd_kcontrol_new alc883_medion_md2_mixer[] = {
         { } /* end */
 };
 
+static struct snd_kcontrol_new alc883_medion_wim2160_mixer[] = {
+        HDA_CODEC_VOLUME("Front Playback Volume", 0x0c, 0x0, HDA_OUTPUT),
+        HDA_BIND_MUTE("Front Playback Switch", 0x0c, 2, HDA_INPUT),
+        HDA_CODEC_MUTE("Speaker Playback Switch", 0x15, 0x0, HDA_OUTPUT),
+        HDA_CODEC_MUTE("Headphone Playback Switch", 0x1a, 0x0, HDA_OUTPUT),
+        HDA_CODEC_VOLUME("Line Playback Volume", 0x08, 0x0, HDA_INPUT),
+        HDA_CODEC_MUTE("Line Playback Switch", 0x08, 0x0, HDA_INPUT),
+        { } /* end */
+};
+
+static struct hda_verb alc883_medion_wim2160_verbs[] = {
+        /* Unmute front mixer */
+        {0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(0)},
+        {0x0c, AC_VERB_SET_AMP_GAIN_MUTE, AMP_IN_UNMUTE(1)},
+
+        /* Set speaker pin to front mixer */
+        {0x15, AC_VERB_SET_CONNECT_SEL, 0x00},
+
+        /* Init headphone pin */
+        {0x1a, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_HP},
+        {0x1a, AC_VERB_SET_AMP_GAIN_MUTE, AMP_OUT_UNMUTE},
+        {0x1a, AC_VERB_SET_CONNECT_SEL, 0x00},
+        {0x1a, AC_VERB_SET_UNSOLICITED_ENABLE, ALC880_HP_EVENT | AC_USRSP_EN},
+
+        { } /* end */
+};
+
+/* toggle speaker-output according to the hp-jack state */
+static void alc883_medion_wim2160_setup(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+
+        spec->autocfg.hp_pins[0] = 0x1a;
+        spec->autocfg.speaker_pins[0] = 0x15;
+}
+
 static struct snd_kcontrol_new alc883_acer_aspire_mixer[] = {
         HDA_CODEC_VOLUME("Front Playback Volume", 0x0c, 0x0, HDA_OUTPUT),
         HDA_BIND_MUTE("Front Playback Switch", 0x0c, 2, HDA_INPUT),
@@ -9164,6 +9233,7 @@ static const char *alc882_models[ALC882_MODEL_LAST] = {
         [ALC888_ACER_ASPIRE_7730G]      = "acer-aspire-7730g",
         [ALC883_MEDION]         = "medion",
         [ALC883_MEDION_MD2]     = "medion-md2",
+        [ALC883_MEDION_WIM2160] = "medion-wim2160",
         [ALC883_LAPTOP_EAPD]    = "laptop-eapd",
         [ALC883_LENOVO_101E_2ch] = "lenovo-101e",
         [ALC883_LENOVO_NB0763]  = "lenovo-nb0763",
@@ -9280,6 +9350,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1462, 0xaa08, "MSI", ALC883_TARGA_2ch_DIG),
 
         SND_PCI_QUIRK(0x147b, 0x1083, "Abit IP35-PRO", ALC883_6ST_DIG),
+        SND_PCI_QUIRK(0x1558, 0x0571, "Clevo laptop M570U", ALC883_3ST_6ch_DIG),
         SND_PCI_QUIRK(0x1558, 0x0721, "Clevo laptop M720R", ALC883_CLEVO_M720),
         SND_PCI_QUIRK(0x1558, 0x0722, "Clevo laptop M720SR", ALC883_CLEVO_M720),
         SND_PCI_QUIRK(0x1558, 0x5409, "Clevo laptop M540R", ALC883_CLEVO_M540R),
@@ -9818,6 +9889,21 @@ static struct alc_config_preset alc882_presets[] = {
                 .setup = alc883_medion_md2_setup,
                 .init_hook = alc_automute_amp,
         },
+        [ALC883_MEDION_WIM2160] = {
+                .mixers = { alc883_medion_wim2160_mixer },
+                .init_verbs = { alc883_init_verbs, alc883_medion_wim2160_verbs },
+                .num_dacs = ARRAY_SIZE(alc883_dac_nids),
+                .dac_nids = alc883_dac_nids,
+                .dig_out_nid = ALC883_DIGOUT_NID,
+                .num_adc_nids = ARRAY_SIZE(alc883_adc_nids),
+                .adc_nids = alc883_adc_nids,
+                .num_channel_mode = ARRAY_SIZE(alc883_3ST_2ch_modes),
+                .channel_mode = alc883_3ST_2ch_modes,
+                .input_mux = &alc883_capture_source,
+                .unsol_event = alc_automute_amp_unsol_event,
+                .setup = alc883_medion_wim2160_setup,
+                .init_hook = alc_automute_amp,
+        },
         [ALC883_LAPTOP_EAPD] = {
                 .mixers = { alc883_base_mixer },
                 .init_verbs = { alc883_init_verbs, alc882_eapd_verbs },
@@ -10363,7 +10449,8 @@ static int patch_alc882(struct hda_codec *codec)
                 board_config = ALC882_AUTO;
         }
 
-        alc_pick_fixup(codec, alc882_fixup_tbl, alc882_fixups);
+        if (board_config == ALC882_AUTO)
+                alc_pick_fixup(codec, alc882_fixup_tbl, alc882_fixups, 1);
 
         if (board_config == ALC882_AUTO) {
                 /* automatic parse from the BIOS config */
@@ -10436,6 +10523,9 @@ static int patch_alc882(struct hda_codec *codec)
         set_capture_mixer(codec);
         set_beep_amp(spec, 0x0b, 0x05, HDA_INPUT);
 
+        if (board_config == ALC882_AUTO)
+                alc_pick_fixup(codec, alc882_fixup_tbl, alc882_fixups, 0);
+
         spec->vmaster_nid = 0x0c;
 
         codec->patch_ops = alc_patch_ops;
@@ -12816,6 +12906,7 @@ static int alc268_new_analog_output(struct alc_spec *spec, hda_nid_t nid,
                 dac = 0x02;
                 break;
         case 0x15:
+        case 0x21: /* ALC269vb has this pin, too */
                 dac = 0x03;
                 break;
         default:
@@ -13735,19 +13826,19 @@ static void alc269_laptop_unsol_event(struct hda_codec *codec,
         }
 }
 
-static void alc269_laptop_dmic_setup(struct hda_codec *codec)
+static void alc269_laptop_amic_setup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
         spec->autocfg.hp_pins[0] = 0x15;
         spec->autocfg.speaker_pins[0] = 0x14;
         spec->ext_mic.pin = 0x18;
         spec->ext_mic.mux_idx = 0;
-        spec->int_mic.pin = 0x12;
-        spec->int_mic.mux_idx = 5;
+        spec->int_mic.pin = 0x19;
+        spec->int_mic.mux_idx = 1;
         spec->auto_mic = 1;
 }
 
-static void alc269vb_laptop_dmic_setup(struct hda_codec *codec)
+static void alc269_laptop_dmic_setup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
         spec->autocfg.hp_pins[0] = 0x15;
@@ -13755,14 +13846,14 @@ static void alc269vb_laptop_dmic_setup(struct hda_codec *codec)
         spec->ext_mic.pin = 0x18;
         spec->ext_mic.mux_idx = 0;
         spec->int_mic.pin = 0x12;
-        spec->int_mic.mux_idx = 6;
+        spec->int_mic.mux_idx = 5;
         spec->auto_mic = 1;
 }
 
-static void alc269_laptop_amic_setup(struct hda_codec *codec)
+static void alc269vb_laptop_amic_setup(struct hda_codec *codec)
 {
         struct alc_spec *spec = codec->spec;
-        spec->autocfg.hp_pins[0] = 0x15;
+        spec->autocfg.hp_pins[0] = 0x21;
         spec->autocfg.speaker_pins[0] = 0x14;
         spec->ext_mic.pin = 0x18;
         spec->ext_mic.mux_idx = 0;
@@ -13771,6 +13862,18 @@ static void alc269_laptop_amic_setup(struct hda_codec *codec)
         spec->auto_mic = 1;
 }
 
+static void alc269vb_laptop_dmic_setup(struct hda_codec *codec)
+{
+        struct alc_spec *spec = codec->spec;
+        spec->autocfg.hp_pins[0] = 0x21;
+        spec->autocfg.speaker_pins[0] = 0x14;
+        spec->ext_mic.pin = 0x18;
+        spec->ext_mic.mux_idx = 0;
+        spec->int_mic.pin = 0x12;
+        spec->int_mic.mux_idx = 6;
+        spec->auto_mic = 1;
+}
+
 static void alc269_laptop_inithook(struct hda_codec *codec)
 {
         alc269_speaker_automute(codec);
@@ -13975,6 +14078,27 @@ static void alc269_auto_init(struct hda_codec *codec)
                 alc_inithook(codec);
 }
 
+enum {
+        ALC269_FIXUP_SONY_VAIO,
+};
+
+const static struct hda_verb alc269_sony_vaio_fixup_verbs[] = {
+        {0x19, AC_VERB_SET_PIN_WIDGET_CONTROL, PIN_VREFGRD},
+        {}
+};
+
+static const struct alc_fixup alc269_fixups[] = {
+        [ALC269_FIXUP_SONY_VAIO] = {
+                .verbs = alc269_sony_vaio_fixup_verbs
+        },
+};
+
+static struct snd_pci_quirk alc269_fixup_tbl[] = {
+        SND_PCI_QUIRK(0x104d, 0x9071, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+        {}
+};
+
+
 /*
  * configuration and preset
  */
@@ -14034,7 +14158,7 @@ static struct snd_pci_quirk alc269_cfg_tbl[] = {
                       ALC269_DMIC),
         SND_PCI_QUIRK(0x1043, 0x8398, "ASUS P1005HA", ALC269_DMIC),
         SND_PCI_QUIRK(0x1043, 0x83ce, "ASUS P1005HA", ALC269_DMIC),
-        SND_PCI_QUIRK(0x104d, 0x9071, "SONY XTB", ALC269_DMIC),
+        SND_PCI_QUIRK(0x104d, 0x9071, "Sony VAIO", ALC269_AUTO),
         SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook ICH9M-based", ALC269_LIFEBOOK),
         SND_PCI_QUIRK(0x152d, 0x1778, "Quanta ON1", ALC269_DMIC),
         SND_PCI_QUIRK(0x1734, 0x115d, "FSC Amilo", ALC269_FUJITSU),
@@ -14108,7 +14232,7 @@ static struct alc_config_preset alc269_presets[] = {
                 .num_channel_mode = ARRAY_SIZE(alc269_modes),
                 .channel_mode = alc269_modes,
                 .unsol_event = alc269_laptop_unsol_event,
-                .setup = alc269_laptop_amic_setup,
+                .setup = alc269vb_laptop_amic_setup,
                 .init_hook = alc269_laptop_inithook,
         },
         [ALC269VB_DMIC] = {
@@ -14188,6 +14312,9 @@ static int patch_alc269(struct hda_codec *codec)
                 board_config = ALC269_AUTO;
         }
 
+        if (board_config == ALC269_AUTO)
+                alc_pick_fixup(codec, alc269_fixup_tbl, alc269_fixups, 1);
+
         if (board_config == ALC269_AUTO) {
                 /* automatic parse from the BIOS config */
                 err = alc269_parse_auto_config(codec);
@@ -14240,6 +14367,9 @@ static int patch_alc269(struct hda_codec *codec)
                 set_capture_mixer(codec);
         set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
 
+        if (board_config == ALC269_AUTO)
+                alc_pick_fixup(codec, alc269_fixup_tbl, alc269_fixups, 0);
+
         spec->vmaster_nid = 0x02;
 
         codec->patch_ops = alc_patch_ops;
@@ -15328,7 +15458,8 @@ static int patch_alc861(struct hda_codec *codec)
                 board_config = ALC861_AUTO;
         }
 
-        alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups);
+        if (board_config == ALC861_AUTO)
+                alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups, 1);
 
         if (board_config == ALC861_AUTO) {
                 /* automatic parse from the BIOS config */
@@ -15365,6 +15496,9 @@ static int patch_alc861(struct hda_codec *codec)
 
         spec->vmaster_nid = 0x03;
 
+        if (board_config == ALC861_AUTO)
+                alc_pick_fixup(codec, alc861_fixup_tbl, alc861_fixups, 0);
+
         codec->patch_ops = alc_patch_ops;
         if (board_config == ALC861_AUTO) {
                 spec->init_hook = alc861_auto_init;
@@ -16299,7 +16433,8 @@ static int patch_alc861vd(struct hda_codec *codec)
                 board_config = ALC861VD_AUTO;
         }
 
-        alc_pick_fixup(codec, alc861vd_fixup_tbl, alc861vd_fixups);
+        if (board_config == ALC861VD_AUTO)
+                alc_pick_fixup(codec, alc861vd_fixup_tbl, alc861vd_fixups, 1);
 
         if (board_config == ALC861VD_AUTO) {
                 /* automatic parse from the BIOS config */
@@ -16347,6 +16482,9 @@ static int patch_alc861vd(struct hda_codec *codec)
 
         spec->vmaster_nid = 0x02;
 
+        if (board_config == ALC861VD_AUTO)
+                alc_pick_fixup(codec, alc861vd_fixup_tbl, alc861vd_fixups, 0);
+
         codec->patch_ops = alc_patch_ops;
 
         if (board_config == ALC861VD_AUTO)
diff --git a/sound/pci/hda/patch_via.c b/sound/pci/hda/patch_via.c
index 9ddc37300f6b..73453814e098 100644
--- a/sound/pci/hda/patch_via.c
+++ b/sound/pci/hda/patch_via.c
@@ -476,7 +476,7 @@ static struct snd_kcontrol_new *via_clone_control(struct via_spec *spec,
         knew->name = kstrdup(tmpl->name, GFP_KERNEL);
         if (!knew->name)
                 return NULL;
-        return 0;
+        return knew;
 }
 
 static void via_free_kctls(struct hda_codec *codec)
@@ -1215,14 +1215,13 @@ static struct snd_kcontrol_new via_hp_mixer[2] = {
         },
 };
 
-static int via_hp_build(struct via_spec *spec)
+static int via_hp_build(struct hda_codec *codec)
 {
+        struct via_spec *spec = codec->spec;
         struct snd_kcontrol_new *knew;
         hda_nid_t nid;
-
-        knew = via_clone_control(spec, &via_hp_mixer[0]);
-        if (knew == NULL)
-                return -ENOMEM;
+        int nums;
+        hda_nid_t conn[HDA_MAX_CONNECTIONS];
 
         switch (spec->codec_type) {
         case VT1718S:
@@ -1239,6 +1238,14 @@ static int via_hp_build(struct via_spec *spec)
                 break;
         }
 
+        nums = snd_hda_get_connections(codec, nid, conn, HDA_MAX_CONNECTIONS);
+        if (nums <= 1)
+                return 0;
+
+        knew = via_clone_control(spec, &via_hp_mixer[0]);
+        if (knew == NULL)
+                return -ENOMEM;
+
         knew->subdevice = HDA_SUBDEV_NID_FLAG | nid;
         knew->private_value = nid;
 
@@ -2561,7 +2568,7 @@ static int vt1708_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
         return 1;
@@ -3087,7 +3094,7 @@ static int vt1709_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
         return 1;
@@ -3654,7 +3661,7 @@ static int vt1708B_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
         return 1;
@@ -4140,7 +4147,7 @@ static int vt1708S_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
         return 1;
@@ -4510,7 +4517,7 @@ static int vt1702_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         return 1;
 }
@@ -4930,7 +4937,7 @@ static int vt1718S_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
 
@@ -5425,7 +5432,7 @@ static int vt1716S_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         via_smart51_build(spec);
 
@@ -5781,7 +5788,7 @@ static int vt2002P_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         return 1;
 }
@@ -6000,12 +6007,12 @@ static int vt1812_auto_create_multi_out_ctls(struct via_spec *spec,
 
         /* Line-Out: PortE */
         err = via_add_control(spec, VIA_CTL_WIDGET_VOL,
-                              "Master Front Playback Volume",
+                              "Front Playback Volume",
                               HDA_COMPOSE_AMP_VAL(0x8, 3, 0, HDA_OUTPUT));
         if (err < 0)
                 return err;
         err = via_add_control(spec, VIA_CTL_WIDGET_BIND_PIN_MUTE,
-                              "Master Front Playback Switch",
+                              "Front Playback Switch",
                               HDA_COMPOSE_AMP_VAL(0x28, 3, 0, HDA_OUTPUT));
         if (err < 0)
                 return err;
@@ -6130,7 +6137,7 @@ static int vt1812_parse_auto_config(struct hda_codec *codec)
         spec->input_mux = &spec->private_imux[0];
 
         if (spec->hp_mux)
-                via_hp_build(spec);
+                via_hp_build(codec);
 
         return 1;
 }
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index a34cbcf7904f..002e289d1255 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -23,7 +23,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/firmware.h>
diff --git a/sound/soc/imx/imx-pcm-dma-mx2.c b/sound/soc/imx/imx-pcm-dma-mx2.c
index 2e79d7136298..2b31ac673ea4 100644
--- a/sound/soc/imx/imx-pcm-dma-mx2.c
+++ b/sound/soc/imx/imx-pcm-dma-mx2.c
@@ -71,7 +71,12 @@ static void imx_ssi_dma_callback(int channel, void *data)
 
 static void snd_imx_dma_err_callback(int channel, void *data, int err)
 {
-        pr_err("DMA error callback called\n");
+        struct snd_pcm_substream *substream = data;
+        struct snd_soc_pcm_runtime *rtd = substream->private_data;
+        struct imx_pcm_dma_params *dma_params = rtd->dai->cpu_dai->dma_data;
+        struct snd_pcm_runtime *runtime = substream->runtime;
+        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
+        int ret;
 
         pr_err("DMA timeout on channel %d -%s%s%s%s\n",
                  channel,
@@ -79,6 +84,14 @@ static void snd_imx_dma_err_callback(int channel, void *data, int err)
                  err & IMX_DMA_ERR_REQUEST ?  " request" : "",
                  err & IMX_DMA_ERR_TRANSFER ? " transfer" : "",
                  err & IMX_DMA_ERR_BUFFER ?   " buffer" : "");
+
+        imx_dma_disable(iprtd->dma);
+        ret = imx_dma_setup_sg(iprtd->dma, iprtd->sg_list, iprtd->sg_count,
+                        IMX_DMA_LENGTH_LOOP, dma_params->dma_addr,
+                        substream->stream == SNDRV_PCM_STREAM_PLAYBACK ?
+                        DMA_MODE_WRITE : DMA_MODE_READ);
+        if (!ret)
+                imx_dma_enable(iprtd->dma);
 }
 
 static int imx_ssi_dma_alloc(struct snd_pcm_substream *substream)
diff --git a/sound/soc/imx/imx-pcm-fiq.c b/sound/soc/imx/imx-pcm-fiq.c
index f96a373699cf..6b518e07eea9 100644
--- a/sound/soc/imx/imx-pcm-fiq.c
+++ b/sound/soc/imx/imx-pcm-fiq.c
@@ -39,23 +39,24 @@ struct imx_pcm_runtime_data {
         unsigned long offset;
         unsigned long last_offset;
         unsigned long size;
-        struct timer_list timer;
-        int poll_time;
+        struct hrtimer hrt;
+        int poll_time_ns;
+        struct snd_pcm_substream *substream;
+        atomic_t running;
 };
 
-static inline void imx_ssi_set_next_poll(struct imx_pcm_runtime_data *iprtd)
+static enum hrtimer_restart snd_hrtimer_callback(struct hrtimer *hrt)
 {
-        iprtd->timer.expires = jiffies + iprtd->poll_time;
-}
-
-static void imx_ssi_timer_callback(unsigned long data)
-{
-        struct snd_pcm_substream *substream = (void *)data;
+        struct imx_pcm_runtime_data *iprtd =
+                container_of(hrt, struct imx_pcm_runtime_data, hrt);
+        struct snd_pcm_substream *substream = iprtd->substream;
         struct snd_pcm_runtime *runtime = substream->runtime;
-        struct imx_pcm_runtime_data *iprtd = runtime->private_data;
         struct pt_regs regs;
         unsigned long delta;
 
+        if (!atomic_read(&iprtd->running))
+                return HRTIMER_NORESTART;
+
         get_fiq_regs(&regs);
 
         if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK)
@@ -72,16 +73,14 @@ static void imx_ssi_timer_callback(unsigned long data)
 
         /* If we've transferred at least a period then report it and
          * reset our poll time */
-        if (delta >= runtime->period_size) {
+        if (delta >= iprtd->period) {
                 snd_pcm_period_elapsed(substream);
                 iprtd->last_offset = iprtd->offset;
-
-                imx_ssi_set_next_poll(iprtd);
         }
 
-        /* Restart the timer; if we didn't report we'll run on the next tick */
-        add_timer(&iprtd->timer);
+        hrtimer_forward_now(hrt, ns_to_ktime(iprtd->poll_time_ns));
 
+        return HRTIMER_RESTART;
 }
 
 static struct fiq_handler fh = {
@@ -99,8 +98,8 @@ static int snd_imx_pcm_hw_params(struct snd_pcm_substream *substream,
         iprtd->period = params_period_bytes(params) ;
         iprtd->offset = 0;
         iprtd->last_offset = 0;
-        iprtd->poll_time = HZ / (params_rate(params) / params_period_size(params));
-
+        iprtd->poll_time_ns = 1000000000 / params_rate(params) *
+                                params_period_size(params);
         snd_pcm_set_runtime_buffer(substream, &substream->dma_buffer);
 
         return 0;
@@ -135,8 +134,9 @@ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
         case SNDRV_PCM_TRIGGER_START:
         case SNDRV_PCM_TRIGGER_RESUME:
         case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
-                imx_ssi_set_next_poll(iprtd);
-                add_timer(&iprtd->timer);
+                atomic_set(&iprtd->running, 1);
+                hrtimer_start(&iprtd->hrt, ns_to_ktime(iprtd->poll_time_ns),
+                      HRTIMER_MODE_REL);
                 if (++fiq_enable == 1)
                         enable_fiq(imx_pcm_fiq);
 
@@ -145,11 +145,11 @@ static int snd_imx_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
         case SNDRV_PCM_TRIGGER_STOP:
         case SNDRV_PCM_TRIGGER_SUSPEND:
         case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
-                del_timer(&iprtd->timer);
+                atomic_set(&iprtd->running, 0);
+
                 if (--fiq_enable == 0)
                         disable_fiq(imx_pcm_fiq);
 
-
                 break;
         default:
                 return -EINVAL;
@@ -180,7 +180,7 @@ static struct snd_pcm_hardware snd_imx_hardware = {
         .buffer_bytes_max = IMX_SSI_DMABUF_SIZE,
         .period_bytes_min = 128,
         .period_bytes_max = 16 * 1024,
-        .periods_min = 2,
+        .periods_min = 4,
         .periods_max = 255,
         .fifo_size = 0,
 };
@@ -194,9 +194,11 @@ static int snd_imx_open(struct snd_pcm_substream *substream)
         iprtd = kzalloc(sizeof(*iprtd), GFP_KERNEL);
         runtime->private_data = iprtd;
 
-        init_timer(&iprtd->timer);
-        iprtd->timer.data = (unsigned long)substream;
-        iprtd->timer.function = imx_ssi_timer_callback;
+        iprtd->substream = substream;
+
+        atomic_set(&iprtd->running, 0);
+        hrtimer_init(&iprtd->hrt, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        iprtd->hrt.function = snd_hrtimer_callback;
 
         ret = snd_pcm_hw_constraint_integer(substream->runtime,
                         SNDRV_PCM_HW_PARAM_PERIODS);
@@ -212,7 +214,8 @@ static int snd_imx_close(struct snd_pcm_substream *substream)
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct imx_pcm_runtime_data *iprtd = runtime->private_data;
 
-        del_timer_sync(&iprtd->timer);
+        hrtimer_cancel(&iprtd->hrt);
+
         kfree(iprtd);
 
         return 0;
diff --git a/sound/soc/imx/imx-ssi.c b/sound/soc/imx/imx-ssi.c
index 0bcc6d7d9471..80b4fee2442b 100644
--- a/sound/soc/imx/imx-ssi.c
+++ b/sound/soc/imx/imx-ssi.c
@@ -656,7 +656,8 @@ static int imx_ssi_probe(struct platform_device *pdev)
         dai->private_data = ssi;
 
         if ((cpu_is_mx27() || cpu_is_mx21()) &&
-                        !(ssi->flags & IMX_SSI_USE_AC97)) {
+                        !(ssi->flags & IMX_SSI_USE_AC97) &&
+                        (ssi->flags & IMX_SSI_DMA)) {
                 ssi->flags |= IMX_SSI_DMA;
                 platform = imx_ssi_dma_mx2_init(pdev, ssi);
         } else
diff --git a/sound/usb/usbmidi.c b/sound/usb/usbmidi.c
index 2c59afd99611..9e28b20cb2ce 100644
--- a/sound/usb/usbmidi.c
+++ b/sound/usb/usbmidi.c
@@ -986,6 +986,8 @@ static void snd_usbmidi_output_drain(struct snd_rawmidi_substream *substream)
         DEFINE_WAIT(wait);
         long timeout = msecs_to_jiffies(50);
 
+        if (ep->umidi->disconnected)
+                return;
         /*
          * The substream buffer is empty, but some data might still be in the
          * currently active URBs, so we have to wait for those to complete.
@@ -1123,14 +1125,21 @@ static int snd_usbmidi_in_endpoint_create(struct snd_usb_midi* umidi,
  * Frees an output endpoint.
  * May be called when ep hasn't been initialized completely.
  */
-static void snd_usbmidi_out_endpoint_delete(struct snd_usb_midi_out_endpoint* ep)
+static void snd_usbmidi_out_endpoint_clear(struct snd_usb_midi_out_endpoint *ep)
 {
         unsigned int i;
 
         for (i = 0; i < OUTPUT_URBS; ++i)
-                if (ep->urbs[i].urb)
+                if (ep->urbs[i].urb) {
                         free_urb_and_buffer(ep->umidi, ep->urbs[i].urb,
                                             ep->max_transfer);
+                        ep->urbs[i].urb = NULL;
+                }
+}
+
+static void snd_usbmidi_out_endpoint_delete(struct snd_usb_midi_out_endpoint *ep)
+{
+        snd_usbmidi_out_endpoint_clear(ep);
         kfree(ep);
 }
 
@@ -1262,15 +1271,18 @@ void snd_usbmidi_disconnect(struct list_head* p)
                                 usb_kill_urb(ep->out->urbs[j].urb);
                         if (umidi->usb_protocol_ops->finish_out_endpoint)
                                 umidi->usb_protocol_ops->finish_out_endpoint(ep->out);
+                        ep->out->active_urbs = 0;
+                        if (ep->out->drain_urbs) {
+                                ep->out->drain_urbs = 0;
+                                wake_up(&ep->out->drain_wait);
+                        }
                 }
                 if (ep->in)
                         for (j = 0; j < INPUT_URBS; ++j)
                                 usb_kill_urb(ep->in->urbs[j]);
                 /* free endpoints here; later call can result in Oops */
-                if (ep->out) {
-                        snd_usbmidi_out_endpoint_delete(ep->out);
-                        ep->out = NULL;
-                }
+                if (ep->out)
+                        snd_usbmidi_out_endpoint_clear(ep->out);
                 if (ep->in) {
                         snd_usbmidi_in_endpoint_delete(ep->in);
                         ep->in = NULL;