Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

133 files changed, 4465 insertions, 4698 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index de491a3e2313..edb2f0b07616 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -437,3 +437,10 @@ Why:	Superseded by tdfxfb. I2C/DDC support used to live in a separate
         driver but this caused driver conflicts.
 Who:    Jean Delvare <khali@linux-fr.org>
         Krzysztof Helt <krzysztof.h1@wp.pl>
+
+---------------------------
+
+What:   CONFIG_RFKILL_INPUT
+When:   2.6.33
+Why:    Should be implemented in userspace, policy daemon.
+Who:    Johannes Berg <johannes@sipsolutions.net>
diff --git a/Documentation/rfkill.txt b/Documentation/rfkill.txt
index 40c3a3f10816..1b74b5f30af4 100644
--- a/Documentation/rfkill.txt
+++ b/Documentation/rfkill.txt
@@ -1,571 +1,136 @@
-rfkill - RF switch subsystem support
-====================================
+rfkill - RF kill switch support
+===============================
 
-1 Introduction
-2 Implementation details
-3 Kernel driver guidelines
-3.1 wireless device drivers
-3.2 platform/switch drivers
-3.3 input device drivers
-4 Kernel API
-5 Userspace support
+1. Introduction
+2. Implementation details
+3. Kernel driver guidelines
+4. Kernel API
+5. Userspace support
 
 
-1. Introduction:
+1. Introduction
 
-The rfkill switch subsystem exists to add a generic interface to circuitry that
-can enable or disable the signal output of a wireless *transmitter* of any
-type.  By far, the most common use is to disable radio-frequency transmitters.
+The rfkill subsystem provides a generic interface to disabling any radio
+transmitter in the system. When a transmitter is blocked, it shall not
+radiate any power.
 
-Note that disabling the signal output means that the the transmitter is to be
-made to not emit any energy when "blocked".  rfkill is not about blocking data
-transmissions, it is about blocking energy emission.
+The subsystem also provides the ability to react on button presses and
+disable all transmitters of a certain type (or all). This is intended for
+situations where transmitters need to be turned off, for example on
+aircraft.
 
-The rfkill subsystem offers support for keys and switches often found on
-laptops to enable wireless devices like WiFi and Bluetooth, so that these keys
-and switches actually perform an action in all wireless devices of a given type
-attached to the system.
 
-The buttons to enable and disable the wireless transmitters are important in
-situations where the user is for example using his laptop on a location where
-radio-frequency transmitters _must_ be disabled (e.g. airplanes).
 
-Because of this requirement, userspace support for the keys should not be made
-mandatory.  Because userspace might want to perform some additional smarter
-tasks when the key is pressed, rfkill provides userspace the possibility to
-take over the task to handle the key events.
-
-===============================================================================
-2: Implementation details
+2. Implementation details
 
 The rfkill subsystem is composed of various components: the rfkill class, the
 rfkill-input module (an input layer handler), and some specific input layer
 events.
 
-The rfkill class provides kernel drivers with an interface that allows them to
-know when they should enable or disable a wireless network device transmitter.
-This is enabled by the CONFIG_RFKILL Kconfig option.
-
-The rfkill class support makes sure userspace will be notified of all state
-changes on rfkill devices through uevents.  It provides a notification chain
-for interested parties in the kernel to also get notified of rfkill state
-changes in other drivers.  It creates several sysfs entries which can be used
-by userspace.  See section "Userspace support".
-
-The rfkill-input module provides the kernel with the ability to implement a
-basic response when the user presses a key or button (or toggles a switch)
-related to rfkill functionality.  It is an in-kernel implementation of default
-policy of reacting to rfkill-related input events and neither mandatory nor
-required for wireless drivers to operate.  It is enabled by the
-CONFIG_RFKILL_INPUT Kconfig option.
-
-rfkill-input is a rfkill-related events input layer handler.  This handler will
-listen to all rfkill key events and will change the rfkill state of the
-wireless devices accordingly.  With this option enabled userspace could either
-do nothing or simply perform monitoring tasks.
-
-The rfkill-input module also provides EPO (emergency power-off) functionality
-for all wireless transmitters.  This function cannot be overridden, and it is
-always active.  rfkill EPO is related to *_RFKILL_ALL input layer events.
-
-
-Important terms for the rfkill subsystem:
-
-In order to avoid confusion, we avoid the term "switch" in rfkill when it is
-referring to an electronic control circuit that enables or disables a
-transmitter.  We reserve it for the physical device a human manipulates
-(which is an input device, by the way):
-
-rfkill switch:
-
-        A physical device a human manipulates.  Its state can be perceived by
-        the kernel either directly (through a GPIO pin, ACPI GPE) or by its
-        effect on a rfkill line of a wireless device.
-
-rfkill controller:
-
-        A hardware circuit that controls the state of a rfkill line, which a
-        kernel driver can interact with *to modify* that state (i.e. it has
-        either write-only or read/write access).
-
-rfkill line:
-
-        An input channel (hardware or software) of a wireless device, which
-        causes a wireless transmitter to stop emitting energy (BLOCK) when it
-        is active.  Point of view is extremely important here: rfkill lines are
-        always seen from the PoV of a wireless device (and its driver).
-
-soft rfkill line/software rfkill line:
-
-        A rfkill line the wireless device driver can directly change the state
-        of.  Related to rfkill_state RFKILL_STATE_SOFT_BLOCKED.
-
-hard rfkill line/hardware rfkill line:
-
-        A rfkill line that works fully in hardware or firmware, and that cannot
-        be overridden by the kernel driver.  The hardware device or the
-        firmware just exports its status to the driver, but it is read-only.
-        Related to rfkill_state RFKILL_STATE_HARD_BLOCKED.
-
-The enum rfkill_state describes the rfkill state of a transmitter:
-
-When a rfkill line or rfkill controller is in the RFKILL_STATE_UNBLOCKED state,
-the wireless transmitter (radio TX circuit for example) is *enabled*.  When the
-it is in the RFKILL_STATE_SOFT_BLOCKED or RFKILL_STATE_HARD_BLOCKED, the
-wireless transmitter is to be *blocked* from operating.
-
-RFKILL_STATE_SOFT_BLOCKED indicates that a call to toggle_radio() can change
-that state.  RFKILL_STATE_HARD_BLOCKED indicates that a call to toggle_radio()
-will not be able to change the state and will return with a suitable error if
-attempts are made to set the state to RFKILL_STATE_UNBLOCKED.
-
-RFKILL_STATE_HARD_BLOCKED is used by drivers to signal that the device is
-locked in the BLOCKED state by a hardwire rfkill line (typically an input pin
-that, when active, forces the transmitter to be disabled) which the driver
-CANNOT override.
-
-Full rfkill functionality requires two different subsystems to cooperate: the
-input layer and the rfkill class.  The input layer issues *commands* to the
-entire system requesting that devices registered to the rfkill class change
-state.  The way this interaction happens is not complex, but it is not obvious
-either:
-
-Kernel Input layer:
-
-        * Generates KEY_WWAN, KEY_WLAN, KEY_BLUETOOTH, SW_RFKILL_ALL, and
-          other such events when the user presses certain keys, buttons, or
-          toggles certain physical switches.
-
-        THE INPUT LAYER IS NEVER USED TO PROPAGATE STATUS, NOTIFICATIONS OR THE
-        KIND OF STUFF AN ON-SCREEN-DISPLAY APPLICATION WOULD REPORT.  It is
-        used to issue *commands* for the system to change behaviour, and these
-        commands may or may not be carried out by some kernel driver or
-        userspace application.  It follows that doing user feedback based only
-        on input events is broken, as there is no guarantee that an input event
-        will be acted upon.
-
-        Most wireless communication device drivers implementing rfkill
-        functionality MUST NOT generate these events, and have no reason to
-        register themselves with the input layer.  Doing otherwise is a common
-        misconception.  There is an API to propagate rfkill status change
-        information, and it is NOT the input layer.
-
-rfkill class:
-
-        * Calls a hook in a driver to effectively change the wireless
-          transmitter state;
-        * Keeps track of the wireless transmitter state (with help from
-          the driver);
-        * Generates userspace notifications (uevents) and a call to a
-          notification chain (kernel) when there is a wireless transmitter
-          state change;
-        * Connects a wireless communications driver with the common rfkill
-          control system, which, for example, allows actions such as
-          "switch all bluetooth devices offline" to be carried out by
-          userspace or by rfkill-input.
-
-        THE RFKILL CLASS NEVER ISSUES INPUT EVENTS.  THE RFKILL CLASS DOES
-        NOT LISTEN TO INPUT EVENTS.  NO DRIVER USING THE RFKILL CLASS SHALL
-        EVER LISTEN TO, OR ACT ON RFKILL INPUT EVENTS.  Doing otherwise is
-        a layering violation.
-
-        Most wireless data communication drivers in the kernel have just to
-        implement the rfkill class API to work properly.  Interfacing to the
-        input layer is not often required (and is very often a *bug*) on
-        wireless drivers.
-
-        Platform drivers often have to attach to the input layer to *issue*
-        (but never to listen to) rfkill events for rfkill switches, and also to
-        the rfkill class to export a control interface for the platform rfkill
-        controllers to the rfkill subsystem.  This does NOT mean the rfkill
-        switch is attached to a rfkill class (doing so is almost always wrong).
-        It just means the same kernel module is the driver for different
-        devices (rfkill switches and rfkill controllers).
-
-
-Userspace input handlers (uevents) or kernel input handlers (rfkill-input):
-
-        * Implements the policy of what should happen when one of the input
-          layer events related to rfkill operation is received.
-        * Uses the sysfs interface (userspace) or private rfkill API calls
-          to tell the devices registered with the rfkill class to change
-          their state (i.e. translates the input layer event into real
-          action).
-
-        * rfkill-input implements EPO by handling EV_SW SW_RFKILL_ALL 0
-          (power off all transmitters) in a special way: it ignores any
-          overrides and local state cache and forces all transmitters to the
-          RFKILL_STATE_SOFT_BLOCKED state (including those which are already
-          supposed to be BLOCKED).
-        * rfkill EPO will remain active until rfkill-input receives an
-          EV_SW SW_RFKILL_ALL 1 event.  While the EPO is active, transmitters
-          are locked in the blocked state (rfkill will refuse to unblock them).
-        * rfkill-input implements different policies that the user can
-          select for handling EV_SW SW_RFKILL_ALL 1.  It will unlock rfkill,
-          and either do nothing (leave transmitters blocked, but now unlocked),
-          restore the transmitters to their state before the EPO, or unblock
-          them all.
-
-Userspace uevent handler or kernel platform-specific drivers hooked to the
-rfkill notifier chain:
-
-        * Taps into the rfkill notifier chain or to KOBJ_CHANGE uevents,
-          in order to know when a device that is registered with the rfkill
-          class changes state;
-        * Issues feedback notifications to the user;
-        * In the rare platforms where this is required, synthesizes an input
-          event to command all *OTHER* rfkill devices to also change their
-          statues when a specific rfkill device changes state.
-
-
-===============================================================================
-3: Kernel driver guidelines
-
-Remember: point-of-view is everything for a driver that connects to the rfkill
-subsystem.  All the details below must be measured/perceived from the point of
-view of the specific driver being modified.
-
-The first thing one needs to know is whether his driver should be talking to
-the rfkill class or to the input layer.  In rare cases (platform drivers), it
-could happen that you need to do both, as platform drivers often handle a
-variety of devices in the same driver.
-
-Do not mistake input devices for rfkill controllers.  The only type of "rfkill
-switch" device that is to be registered with the rfkill class are those
-directly controlling the circuits that cause a wireless transmitter to stop
-working (or the software equivalent of them), i.e. what we call a rfkill
-controller.  Every other kind of "rfkill switch" is just an input device and
-MUST NOT be registered with the rfkill class.
-
-A driver should register a device with the rfkill class when ALL of the
-following conditions are met (they define a rfkill controller):
-
-1. The device is/controls a data communications wireless transmitter;
-
-2. The kernel can interact with the hardware/firmware to CHANGE the wireless
-   transmitter state (block/unblock TX operation);
-
-3. The transmitter can be made to not emit any energy when "blocked":
-   rfkill is not about blocking data transmissions, it is about blocking
-   energy emission;
-
-A driver should register a device with the input subsystem to issue
-rfkill-related events (KEY_WLAN, KEY_BLUETOOTH, KEY_WWAN, KEY_WIMAX,
-SW_RFKILL_ALL, etc) when ALL of the folowing conditions are met:
-
-1. It is directly related to some physical device the user interacts with, to
-   command the O.S./firmware/hardware to enable/disable a data communications
-   wireless transmitter.
-
-   Examples of the physical device are: buttons, keys and switches the user
-   will press/touch/slide/switch to enable or disable the wireless
-   communication device.
-
-2. It is NOT slaved to another device, i.e. there is no other device that
-   issues rfkill-related input events in preference to this one.
-
-   Please refer to the corner cases and examples section for more details.
-
-When in doubt, do not issue input events.  For drivers that should generate
-input events in some platforms, but not in others (e.g. b43), the best solution
-is to NEVER generate input events in the first place.  That work should be
-deferred to a platform-specific kernel module (which will know when to generate
-events through the rfkill notifier chain) or to userspace.  This avoids the
-usual maintenance problems with DMI whitelisting.
-
-
-Corner cases and examples:
-====================================
-
-1. If the device is an input device that, because of hardware or firmware,
-causes wireless transmitters to be blocked regardless of the kernel's will, it
-is still just an input device, and NOT to be registered with the rfkill class.
-
-2. If the wireless transmitter switch control is read-only, it is an input
-device and not to be registered with the rfkill class (and maybe not to be made
-an input layer event source either, see below).
-
-3. If there is some other device driver *closer* to the actual hardware the
-user interacted with (the button/switch/key) to issue an input event, THAT is
-the device driver that should be issuing input events.
-
-E.g:
-  [RFKILL slider switch] -- [GPIO hardware] -- [WLAN card rf-kill input]
-                           (platform driver)    (wireless card driver)
-
-The user is closer to the RFKILL slide switch plaform driver, so the driver
-which must issue input events is the platform driver looking at the GPIO
-hardware, and NEVER the wireless card driver (which is just a slave).  It is
-very likely that there are other leaves than just the WLAN card rf-kill input
-(e.g. a bluetooth card, etc)...
-
-On the other hand, some embedded devices do this:
-
-  [RFKILL slider switch] -- [WLAN card rf-kill input]
-                             (wireless card driver)
-
-In this situation, the wireless card driver *could* register itself as an input
-device and issue rf-kill related input events... but in order to AVOID the need
-for DMI whitelisting, the wireless card driver does NOT do it.  Userspace (HAL)
-or a platform driver (that exists only on these embedded devices) will do the
-dirty job of issuing the input events.
-
-
-COMMON MISTAKES in kernel drivers, related to rfkill:
-====================================
-
-1. NEVER confuse input device keys and buttons with input device switches.
-
-  1a. Switches are always set or reset.  They report the current state
-      (on position or off position).
-
-  1b. Keys and buttons are either in the pressed or not-pressed state, and
-      that's it.  A "button" that latches down when you press it, and
-      unlatches when you press it again is in fact a switch as far as input
-      devices go.
-
-Add the SW_* events you need for switches, do NOT try to emulate a button using
-KEY_* events just because there is no such SW_* event yet.  Do NOT try to use,
-for example, KEY_BLUETOOTH when you should be using SW_BLUETOOTH instead.
-
-2. Input device switches (sources of EV_SW events) DO store their current state
-(so you *must* initialize it by issuing a gratuitous input layer event on
-driver start-up and also when resuming from sleep), and that state CAN be
-queried from userspace through IOCTLs.  There is no sysfs interface for this,
-but that doesn't mean you should break things trying to hook it to the rfkill
-class to get a sysfs interface :-)
-
-3. Do not issue *_RFKILL_ALL events by default, unless you are sure it is the
-correct event for your switch/button.  These events are emergency power-off
-events when they are trying to turn the transmitters off.  An example of an
-input device which SHOULD generate *_RFKILL_ALL events is the wireless-kill
-switch in a laptop which is NOT a hotkey, but a real sliding/rocker switch.
-An example of an input device which SHOULD NOT generate *_RFKILL_ALL events by
-default, is any sort of hot key that is type-specific (e.g. the one for WLAN).
-
-
-3.1 Guidelines for wireless device drivers
-------------------------------------------
-
-(in this text, rfkill->foo means the foo field of struct rfkill).
-
-1. Each independent transmitter in a wireless device (usually there is only one
-transmitter per device) should have a SINGLE rfkill class attached to it.
-
-2. If the device does not have any sort of hardware assistance to allow the
-driver to rfkill the device, the driver should emulate it by taking all actions
-required to silence the transmitter.
-
-3. If it is impossible to silence the transmitter (i.e. it still emits energy,
-even if it is just in brief pulses, when there is no data to transmit and there
-is no hardware support to turn it off) do NOT lie to the users.  Do not attach
-it to a rfkill class.  The rfkill subsystem does not deal with data
-transmission, it deals with energy emission.  If the transmitter is emitting
-energy, it is not blocked in rfkill terms.
-
-4. It doesn't matter if the device has multiple rfkill input lines affecting
-the same transmitter, their combined state is to be exported as a single state
-per transmitter (see rule 1).
-
-This rule exists because users of the rfkill subsystem expect to get (and set,
-when possible) the overall transmitter rfkill state, not of a particular rfkill
-line.
-
-5. The wireless device driver MUST NOT leave the transmitter enabled during
-suspend and hibernation unless:
+The rfkill class is provided for kernel drivers to register their radio
+transmitter with the kernel, provide methods for turning it on and off and,
+optionally, letting the system know about hardware-disabled states that may
+be implemented on the device. This code is enabled with the CONFIG_RFKILL
+Kconfig option, which drivers can "select".
 
-        5.1. The transmitter has to be enabled for some sort of functionality
-        like wake-on-wireless-packet or autonomous packed forwarding in a mesh
-        network, and that functionality is enabled for this suspend/hibernation
-        cycle.
+The rfkill class code also notifies userspace of state changes, this is
+achieved via uevents. It also provides some sysfs files for userspace to
+check the status of radio transmitters. See the "Userspace support" section
+below.
 
-AND
 
-        5.2. The device was not on a user-requested BLOCKED state before
-        the suspend (i.e. the driver must NOT unblock a device, not even
-        to support wake-on-wireless-packet or remain in the mesh).
+The rfkill-input code implements a basic response to rfkill buttons -- it
+implements turning on/off all devices of a certain class (or all).
 
-In other words, there is absolutely no allowed scenario where a driver can
-automatically take action to unblock a rfkill controller (obviously, this deals
-with scenarios where soft-blocking or both soft and hard blocking is happening.
-Scenarios where hardware rfkill lines are the only ones blocking the
-transmitter are outside of this rule, since the wireless device driver does not
-control its input hardware rfkill lines in the first place).
+When the device is hard-blocked (either by a call to rfkill_set_hw_state()
+or from query_hw_block) set_block() will be invoked but drivers can well
+ignore the method call since they can use the return value of the function
+rfkill_set_hw_state() to sync the software state instead of keeping track
+of calls to set_block().
 
-6. During resume, rfkill will try to restore its previous state.
 
-7. After a rfkill class is suspended, it will *not* call rfkill->toggle_radio
-until it is resumed.
+The entire functionality is spread over more than one subsystem:
 
+ * The kernel input layer generates KEY_WWAN, KEY_WLAN etc. and
+   SW_RFKILL_ALL -- when the user presses a button. Drivers for radio
+   transmitters generally do not register to the input layer, unless the
+   device really provides an input device (i.e. a button that has no
+   effect other than generating a button press event)
 
-Example of a WLAN wireless driver connected to the rfkill subsystem:
---------------------------------------------------------------------
+ * The rfkill-input code hooks up to these events and switches the soft-block
+   of the various radio transmitters, depending on the button type.
 
-A certain WLAN card has one input pin that causes it to block the transmitter
-and makes the status of that input pin available (only for reading!) to the
-kernel driver.  This is a hard rfkill input line (it cannot be overridden by
-the kernel driver).
+ * The rfkill drivers turn off/on their transmitters as requested.
 
-The card also has one PCI register that, if manipulated by the driver, causes
-it to block the transmitter.  This is a soft rfkill input line.
+ * The rfkill class will generate userspace notifications (uevents) to tell
+   userspace what the current state is.
 
-It has also a thermal protection circuitry that shuts down its transmitter if
-the card overheats, and makes the status of that protection available (only for
-reading!) to the kernel driver.  This is also a hard rfkill input line.
 
-If either one of these rfkill lines are active, the transmitter is blocked by
-the hardware and forced offline.
 
-The driver should allocate and attach to its struct device *ONE* instance of
-the rfkill class (there is only one transmitter).
+3. Kernel driver guidelines
 
-It can implement the get_state() hook, and return RFKILL_STATE_HARD_BLOCKED if
-either one of its two hard rfkill input lines are active.  If the two hard
-rfkill lines are inactive, it must return RFKILL_STATE_SOFT_BLOCKED if its soft
-rfkill input line is active.  Only if none of the rfkill input lines are
-active, will it return RFKILL_STATE_UNBLOCKED.
 
-Since the device has a hardware rfkill line, it IS subject to state changes
-external to rfkill.  Therefore, the driver must make sure that it calls
-rfkill_force_state() to keep the status always up-to-date, and it must do a
-rfkill_force_state() on resume from sleep.
+Drivers for radio transmitters normally implement only the rfkill class.
+These drivers may not unblock the transmitter based on own decisions, they
+should act on information provided by the rfkill class only.
 
-Every time the driver gets a notification from the card that one of its rfkill
-lines changed state (polling might be needed on badly designed cards that don't
-generate interrupts for such events), it recomputes the rfkill state as per
-above, and calls rfkill_force_state() to update it.
+Platform drivers might implement input devices if the rfkill button is just
+that, a button. If that button influences the hardware then you need to
+implement an rfkill class instead. This also applies if the platform provides
+a way to turn on/off the transmitter(s).
 
-The driver should implement the toggle_radio() hook, that:
+During suspend/hibernation, transmitters should only be left enabled when
+wake-on wlan or similar functionality requires it and the device wasn't
+blocked before suspend/hibernate. Note that it may be necessary to update
+the rfkill subsystem's idea of what the current state is at resume time if
+the state may have changed over suspend.
 
-1. Returns an error if one of the hardware rfkill lines are active, and the
-caller asked for RFKILL_STATE_UNBLOCKED.
 
-2. Activates the soft rfkill line if the caller asked for state
-RFKILL_STATE_SOFT_BLOCKED.  It should do this even if one of the hard rfkill
-lines are active, effectively double-blocking the transmitter.
 
-3. Deactivates the soft rfkill line if none of the hardware rfkill lines are
-active and the caller asked for RFKILL_STATE_UNBLOCKED.
-
-===============================================================================
-4: Kernel API
+4. Kernel API
 
 To build a driver with rfkill subsystem support, the driver should depend on
-(or select) the Kconfig symbol RFKILL; it should _not_ depend on RKFILL_INPUT.
+(or select) the Kconfig symbol RFKILL.
 
 The hardware the driver talks to may be write-only (where the current state
 of the hardware is unknown), or read-write (where the hardware can be queried
 about its current state).
 
-The rfkill class will call the get_state hook of a device every time it needs
-to know the *real* current state of the hardware.  This can happen often, but
-it does not do any polling, so it is not enough on hardware that is subject
-to state changes outside of the rfkill subsystem.
-
-Therefore, calling rfkill_force_state() when a state change happens is
-mandatory when the device has a hardware rfkill line, or when something else
-like the firmware could cause its state to be changed without going through the
-rfkill class.
-
-Some hardware provides events when its status changes.  In these cases, it is
-best for the driver to not provide a get_state hook, and instead register the
-rfkill class *already* with the correct status, and keep it updated using
-rfkill_force_state() when it gets an event from the hardware.
-
-rfkill_force_state() must be used on the device resume handlers to update the
-rfkill status, should there be any chance of the device status changing during
-the sleep.
-
-There is no provision for a statically-allocated rfkill struct.  You must
-use rfkill_allocate() to allocate one.
-
-You should:
-        - rfkill_allocate()
-        - modify rfkill fields (flags, name)
-        - modify state to the current hardware state (THIS IS THE ONLY TIME
-          YOU CAN ACCESS state DIRECTLY)
-        - rfkill_register()
-
-The only way to set a device to the RFKILL_STATE_HARD_BLOCKED state is through
-a suitable return of get_state() or through rfkill_force_state().
+Calling rfkill_set_hw_state() when a state change happens is required from
+rfkill drivers that control devices that can be hard-blocked unless they also
+assign the poll_hw_block() callback (then the rfkill core will poll the
+device). Don't do this unless you cannot get the event in any other way.
 
-When a device is in the RFKILL_STATE_HARD_BLOCKED state, the only way to switch
-it to a different state is through a suitable return of get_state() or through
-rfkill_force_state().
 
-If toggle_radio() is called to set a device to state RFKILL_STATE_SOFT_BLOCKED
-when that device is already at the RFKILL_STATE_HARD_BLOCKED state, it should
-not return an error.  Instead, it should try to double-block the transmitter,
-so that its state will change from RFKILL_STATE_HARD_BLOCKED to
-RFKILL_STATE_SOFT_BLOCKED should the hardware blocking cease.
-
-Please refer to the source for more documentation.
-
-===============================================================================
-5: Userspace support
-
-rfkill devices issue uevents (with an action of "change"), with the following
-environment variables set:
-
-RFKILL_NAME
-RFKILL_STATE
-RFKILL_TYPE
 
-The ABI for these variables is defined by the sysfs attributes.  It is best
-to take a quick look at the source to make sure of the possible values.
+5. Userspace support
 
-It is expected that HAL will trap those, and bridge them to DBUS, etc.  These
-events CAN and SHOULD be used to give feedback to the user about the rfkill
-status of the system.
-
-Input devices may issue events that are related to rfkill.  These are the
-various KEY_* events and SW_* events supported by rfkill-input.c.
-
-Userspace may not change the state of an rfkill switch in response to an
-input event, it should refrain from changing states entirely.
-
-Userspace cannot assume it is the only source of control for rfkill switches.
-Their state can change due to firmware actions, direct user actions, and the
-rfkill-input EPO override for *_RFKILL_ALL.
-
-When rfkill-input is not active, userspace must initiate a rfkill status
-change by writing to the "state" attribute in order for anything to happen.
-
-Take particular care to implement EV_SW SW_RFKILL_ALL properly.  When that
-switch is set to OFF, *every* rfkill device *MUST* be immediately put into the
-RFKILL_STATE_SOFT_BLOCKED state, no questions asked.
-
-The following sysfs entries will be created:
+The following sysfs entries exist for every rfkill device:
 
         name: Name assigned by driver to this key (interface or driver name).
         type: Name of the key type ("wlan", "bluetooth", etc).
         state: Current state of the transmitter
                 0: RFKILL_STATE_SOFT_BLOCKED
-                        transmitter is forced off, but one can override it
-                        by a write to the state attribute;
+                        transmitter is turned off by software
                 1: RFKILL_STATE_UNBLOCKED
-                        transmiter is NOT forced off, and may operate if
-                        all other conditions for such operation are met
-                        (such as interface is up and configured, etc);
+                        transmitter is (potentially) active
                 2: RFKILL_STATE_HARD_BLOCKED
                         transmitter is forced off by something outside of
-                        the driver's control.  One cannot set a device to
-                        this state through writes to the state attribute;
-        claim: 1: Userspace handles events, 0: Kernel handles events
-
-Both the "state" and "claim" entries are also writable. For the "state" entry
-this means that when 1 or 0 is written, the device rfkill state (if not yet in
-the requested state), will be will be toggled accordingly.
-
-For the "claim" entry writing 1 to it means that the kernel no longer handles
-key events even though RFKILL_INPUT input was enabled. When "claim" has been
-set to 0, userspace should make sure that it listens for the input events or
-check the sysfs "state" entry regularly to correctly perform the required tasks
-when the rkfill key is pressed.
-
-A note about input devices and EV_SW events:
-
-In order to know the current state of an input device switch (like
-SW_RFKILL_ALL), you will need to use an IOCTL.  That information is not
-available through sysfs in a generic way at this time, and it is not available
-through the rfkill class AT ALL.
+                        the driver's control.
+        claim: 0: Kernel handles events (currently always reads that value)
+
+rfkill devices also issue uevents (with an action of "change"), with the
+following environment variables set:
+
+RFKILL_NAME
+RFKILL_STATE
+RFKILL_TYPE
+
+The contents of these variables corresponds to the "name", "state" and
+"type" sysfs files explained above.
+
+An alternative userspace interface exists as a misc device /dev/rfkill,
+which allows userspace to obtain and set the state of rfkill devices and
+sets of devices. It also notifies userspace about device addition and
+removal. The API is a simple read/write API that is defined in
+linux/rfkill.h.
diff --git a/MAINTAINERS b/MAINTAINERS
index e18baa410b50..2f6a8fcfb1f2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4753,9 +4753,9 @@ S:	Supported
 F:      fs/reiserfs/
 
 RFKILL
-P:      Ivo van Doorn
-M:      IvDoorn@gmail.com
-L:      netdev@vger.kernel.org
+P:      Johannes Berg
+M:      johannes@sipsolutions.net
+L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F       Documentation/rfkill.txt
 F:      net/rfkill/
diff --git a/arch/arm/mach-pxa/tosa-bt.c b/arch/arm/mach-pxa/tosa-bt.c
index bde42aa29374..c31e601eb49c 100644
--- a/arch/arm/mach-pxa/tosa-bt.c
+++ b/arch/arm/mach-pxa/tosa-bt.c
@@ -35,21 +35,25 @@ static void tosa_bt_off(struct tosa_bt_data *data)
         gpio_set_value(data->gpio_reset, 0);
 }
 
-static int tosa_bt_toggle_radio(void *data, enum rfkill_state state)
+static int tosa_bt_set_block(void *data, bool blocked)
 {
-        pr_info("BT_RADIO going: %s\n",
-                        state == RFKILL_STATE_UNBLOCKED ? "on" : "off");
+        pr_info("BT_RADIO going: %s\n", blocked ? "off" : "on");
 
-        if (state == RFKILL_STATE_UNBLOCKED) {
+        if (!blocked) {
                 pr_info("TOSA_BT: going ON\n");
                 tosa_bt_on(data);
         } else {
                 pr_info("TOSA_BT: going OFF\n");
                 tosa_bt_off(data);
         }
+
         return 0;
 }
 
+static const struct rfkill_ops tosa_bt_rfkill_ops = {
+        .set_block = tosa_bt_set_block,
+};
+
 static int tosa_bt_probe(struct platform_device *dev)
 {
         int rc;
@@ -70,18 +74,14 @@ static int tosa_bt_probe(struct platform_device *dev)
         if (rc)
                 goto err_pwr_dir;
 
-        rfk = rfkill_allocate(&dev->dev, RFKILL_TYPE_BLUETOOTH);
+        rfk = rfkill_alloc("tosa-bt", &dev->dev, RFKILL_TYPE_BLUETOOTH,
+                           &tosa_bt_rfkill_ops, data);
         if (!rfk) {
                 rc = -ENOMEM;
                 goto err_rfk_alloc;
         }
 
-        rfk->name = "tosa-bt";
-        rfk->toggle_radio = tosa_bt_toggle_radio;
-        rfk->data = data;
-#ifdef CONFIG_RFKILL_LEDS
-        rfk->led_trigger.name = "tosa-bt";
-#endif
+        rfkill_set_led_trigger_name(rfk, "tosa-bt");
 
         rc = rfkill_register(rfk);
         if (rc)
@@ -92,9 +92,7 @@ static int tosa_bt_probe(struct platform_device *dev)
         return 0;
 
 err_rfkill:
-        if (rfk)
-                rfkill_free(rfk);
-        rfk = NULL;
+        rfkill_destroy(rfk);
 err_rfk_alloc:
         tosa_bt_off(data);
 err_pwr_dir:
@@ -113,8 +111,10 @@ static int __devexit tosa_bt_remove(struct platform_device *dev)
 
         platform_set_drvdata(dev, NULL);
 
-        if (rfk)
+        if (rfk) {
                 rfkill_unregister(rfk);
+                rfkill_destroy(rfk);
+        }
         rfk = NULL;
 
         tosa_bt_off(data);
diff --git a/arch/arm/mach-pxa/tosa.c b/arch/arm/mach-pxa/tosa.c
index afac5b6d3d78..58ce807fe440 100644
--- a/arch/arm/mach-pxa/tosa.c
+++ b/arch/arm/mach-pxa/tosa.c
@@ -31,7 +31,6 @@
 #include <linux/input.h>
 #include <linux/gpio.h>
 #include <linux/pda_power.h>
-#include <linux/rfkill.h>
 #include <linux/spi/spi.h>
 
 #include <asm/setup.h>
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 837135f0390a..5ddd8c4f9019 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2481,10 +2481,10 @@ static int add_net_device(struct hso_device *hso_dev)
         return 0;
 }
 
-static int hso_radio_toggle(void *data, enum rfkill_state state)
+static int hso_rfkill_set_block(void *data, bool blocked)
 {
         struct hso_device *hso_dev = data;
-        int enabled = (state == RFKILL_STATE_UNBLOCKED);
+        int enabled = !blocked;
         int rv;
 
         mutex_lock(&hso_dev->mutex);
@@ -2498,6 +2498,10 @@ static int hso_radio_toggle(void *data, enum rfkill_state state)
         return rv;
 }
 
+static const struct rfkill_ops hso_rfkill_ops = {
+        .set_block = hso_rfkill_set_block,
+};
+
 /* Creates and sets up everything for rfkill */
 static void hso_create_rfkill(struct hso_device *hso_dev,
                              struct usb_interface *interface)
@@ -2506,29 +2510,25 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
         struct device *dev = &hso_net->net->dev;
         char *rfkn;
 
-        hso_net->rfkill = rfkill_allocate(&interface_to_usbdev(interface)->dev,
-                                 RFKILL_TYPE_WWAN);
-        if (!hso_net->rfkill) {
-                dev_err(dev, "%s - Out of memory\n", __func__);
-                return;
-        }
         rfkn = kzalloc(20, GFP_KERNEL);
-        if (!rfkn) {
-                rfkill_free(hso_net->rfkill);
-                hso_net->rfkill = NULL;
+        if (!rfkn)
                 dev_err(dev, "%s - Out of memory\n", __func__);
-                return;
-        }
+
         snprintf(rfkn, 20, "hso-%d",
                  interface->altsetting->desc.bInterfaceNumber);
-        hso_net->rfkill->name = rfkn;
-        hso_net->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        hso_net->rfkill->data = hso_dev;
-        hso_net->rfkill->toggle_radio = hso_radio_toggle;
+
+        hso_net->rfkill = rfkill_alloc(rfkn,
+                                       &interface_to_usbdev(interface)->dev,
+                                       RFKILL_TYPE_WWAN,
+                                       &hso_rfkill_ops, hso_dev);
+        if (!hso_net->rfkill) {
+                dev_err(dev, "%s - Out of memory\n", __func__);
+                kfree(rfkn);
+                return;
+        }
         if (rfkill_register(hso_net->rfkill) < 0) {
+                rfkill_destroy(hso_net->rfkill);
                 kfree(rfkn);
-                hso_net->rfkill->name = NULL;
-                rfkill_free(hso_net->rfkill);
                 hso_net->rfkill = NULL;
                 dev_err(dev, "%s - Failed to register rfkill\n", __func__);
                 return;
@@ -3165,8 +3165,10 @@ static void hso_free_interface(struct usb_interface *interface)
                         hso_stop_net_device(network_table[i]);
                         cancel_work_sync(&network_table[i]->async_put_intf);
                         cancel_work_sync(&network_table[i]->async_get_intf);
-                        if (rfk)
+                        if (rfk) {
                                 rfkill_unregister(rfk);
+                                rfkill_destroy(rfk);
+                        }
                         hso_free_net_device(network_table[i]);
                 }
         }
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index 867324163ca2..daf4c805be58 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -333,11 +333,11 @@ config USB_ZD1201
 config USB_NET_RNDIS_WLAN
         tristate "Wireless RNDIS USB support"
         depends on USB && WLAN_80211 && EXPERIMENTAL
+        depends on CFG80211
         select USB_USBNET
         select USB_NET_CDCETHER
         select USB_NET_RNDIS_HOST
         select WIRELESS_EXT
-        select CFG80211
         ---help---
           This is a driver for wireless RNDIS devices.
           These are USB based adapters found in devices such as:
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index 17bd3eaf3e03..c7cba66b63cb 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -91,6 +91,7 @@ struct ar9170_led {
         struct led_classdev l;
         char name[32];
         unsigned int toggled;
+        bool last_state;
         bool registered;
 };
 
@@ -101,7 +102,6 @@ enum ar9170_device_state {
         AR9170_STOPPED,
         AR9170_IDLE,
         AR9170_STARTED,
-        AR9170_ASSOCIATED,
 };
 
 struct ar9170_rxstream_mpdu_merge {
@@ -140,7 +140,7 @@ struct ar9170 {
         struct work_struct filter_config_work;
         u64 cur_mc_hash, want_mc_hash;
         u32 cur_filter, want_filter;
-        unsigned int filter_changed;
+        unsigned long filter_changed;
         unsigned int filter_state;
         bool sniffer_enabled;
 
@@ -195,7 +195,7 @@ struct ar9170_sta_info {
 #define IS_STARTED(a)           (a->state >= AR9170_STARTED)
 #define IS_ACCEPTING_CMD(a)     (a->state >= AR9170_IDLE)
 
-#define AR9170_FILTER_CHANGED_PROMISC           BIT(0)
+#define AR9170_FILTER_CHANGED_MODE              BIT(0)
 #define AR9170_FILTER_CHANGED_MULTICAST         BIT(1)
 #define AR9170_FILTER_CHANGED_FRAMEFILTER       BIT(2)
 
@@ -206,6 +206,7 @@ void ar9170_rx(struct ar9170 *ar, struct sk_buff *skb);
 void ar9170_unregister(struct ar9170 *ar);
 void ar9170_handle_tx_status(struct ar9170 *ar, struct sk_buff *skb,
                              bool update_statistics, u16 tx_status);
+void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len);
 
 /* MAC */
 int ar9170_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -215,6 +216,9 @@ int ar9170_update_multicast(struct ar9170 *ar);
 int ar9170_update_frame_filter(struct ar9170 *ar);
 int ar9170_set_operating_mode(struct ar9170 *ar);
 int ar9170_set_beacon_timers(struct ar9170 *ar);
+int ar9170_set_dyn_sifs_ack(struct ar9170 *ar);
+int ar9170_set_slot_time(struct ar9170 *ar);
+int ar9170_set_basic_rates(struct ar9170 *ar);
 int ar9170_set_hwretry_limit(struct ar9170 *ar, u32 max_retry);
 int ar9170_update_beacon(struct ar9170 *ar);
 void ar9170_new_beacon(struct work_struct *work);
diff --git a/drivers/net/wireless/ath/ar9170/hw.h b/drivers/net/wireless/ath/ar9170/hw.h
index 3293e0fb24fb..3c8004fb7307 100644
--- a/drivers/net/wireless/ath/ar9170/hw.h
+++ b/drivers/net/wireless/ath/ar9170/hw.h
@@ -207,7 +207,8 @@ enum ar9170_cmd {
 #define AR9170_MAC_REG_AC1_AC0_TXOP             (AR9170_MAC_REG_BASE + 0xB44)
 #define AR9170_MAC_REG_AC3_AC2_TXOP             (AR9170_MAC_REG_BASE + 0xB48)
 
-#define AR9170_MAC_REG_AMPDU_SET                (AR9170_MAC_REG_BASE + 0xba0)
+#define AR9170_MAC_REG_AMPDU_FACTOR             (AR9170_MAC_REG_BASE + 0xB9C)
+#define AR9170_MAC_REG_AMPDU_DENSITY            (AR9170_MAC_REG_BASE + 0xBA0)
 
 #define AR9170_MAC_REG_ACK_TABLE                (AR9170_MAC_REG_BASE + 0xC00)
 #define AR9170_MAC_REG_AMPDU_RX_THRESH          (AR9170_MAC_REG_BASE + 0xC50)
@@ -376,7 +377,6 @@ static inline u8 ar9170_get_decrypt_type(struct ar9170_rx_macstatus *t)
 #define AR9170_RX_ERROR_FATAL                   0x80
 
 struct ar9170_cmd_tx_status {
-        __le16 unkn;
         u8 dst[ETH_ALEN];
         __le32 rate;
         __le16 status;
@@ -394,6 +394,7 @@ struct ar9170_cmd_ba_failed_count {
 struct ar9170_cmd_response {
         u8 flag;
         u8 type;
+        __le16 padding;
 
         union {
                 struct ar9170_cmd_tx_status             tx_status;
diff --git a/drivers/net/wireless/ath/ar9170/led.c b/drivers/net/wireless/ath/ar9170/led.c
index 341cead7f606..63fda6cd2101 100644
--- a/drivers/net/wireless/ath/ar9170/led.c
+++ b/drivers/net/wireless/ath/ar9170/led.c
@@ -74,7 +74,7 @@ static void ar9170_update_leds(struct work_struct *work)
 
         mutex_lock(&ar->mutex);
         for (i = 0; i < AR9170_NUM_LEDS; i++)
-                if (ar->leds[i].toggled) {
+                if (ar->leds[i].registered && ar->leds[i].toggled) {
                         led_val |= 1 << i;
 
                         tmp = 70 + 200 / (ar->leds[i].toggled);
@@ -101,9 +101,15 @@ static void ar9170_led_brightness_set(struct led_classdev *led,
         struct ar9170_led *arl = container_of(led, struct ar9170_led, l);
         struct ar9170 *ar = arl->ar;
 
-        arl->toggled++;
+        if (unlikely(!arl->registered))
+                return ;
+
+        if (arl->last_state != !!brightness) {
+                arl->toggled++;
+                arl->last_state = !!brightness;
+        }
 
-        if (likely(IS_ACCEPTING_CMD(ar) && brightness))
+        if (likely(IS_ACCEPTING_CMD(ar) && arl->toggled))
                 queue_delayed_work(ar->hw->workqueue, &ar->led_work, HZ/10);
 }
 
@@ -136,13 +142,14 @@ void ar9170_unregister_leds(struct ar9170 *ar)
 {
         int i;
 
-        cancel_delayed_work_sync(&ar->led_work);
-
         for (i = 0; i < AR9170_NUM_LEDS; i++)
                 if (ar->leds[i].registered) {
                         led_classdev_unregister(&ar->leds[i].l);
                         ar->leds[i].registered = false;
+                        ar->leds[i].toggled = 0;
                 }
+
+        cancel_delayed_work_sync(&ar->led_work);
 }
 
 int ar9170_register_leds(struct ar9170 *ar)
diff --git a/drivers/net/wireless/ath/ar9170/mac.c b/drivers/net/wireless/ath/ar9170/mac.c
index 43aeb69685d3..d9f1f46de183 100644
--- a/drivers/net/wireless/ath/ar9170/mac.c
+++ b/drivers/net/wireless/ath/ar9170/mac.c
@@ -38,6 +38,55 @@
 #include "ar9170.h"
 #include "cmd.h"
 
+int ar9170_set_dyn_sifs_ack(struct ar9170 *ar)
+{
+        u32 val;
+
+        if (conf_is_ht40(&ar->hw->conf))
+                val = 0x010a;
+        else {
+                if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ)
+                        val = 0x105;
+                else
+                        val = 0x104;
+        }
+
+        return ar9170_write_reg(ar, AR9170_MAC_REG_DYNAMIC_SIFS_ACK, val);
+}
+
+int ar9170_set_slot_time(struct ar9170 *ar)
+{
+        u32 slottime = 20;
+
+        if (!ar->vif)
+                return 0;
+
+        if ((ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ) ||
+            ar->vif->bss_conf.use_short_slot)
+                slottime = 9;
+
+        return ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME, slottime << 10);
+}
+
+int ar9170_set_basic_rates(struct ar9170 *ar)
+{
+        u8 cck, ofdm;
+
+        if (!ar->vif)
+                return 0;
+
+        ofdm = ar->vif->bss_conf.basic_rates >> 4;
+
+        /* FIXME: is still necessary? */
+        if (ar->hw->conf.channel->band == IEEE80211_BAND_5GHZ)
+                cck = 0;
+        else
+                cck = ar->vif->bss_conf.basic_rates & 0xf;
+
+        return ar9170_write_reg(ar, AR9170_MAC_REG_BASIC_RATE,
+                                ofdm << 8 | cck);
+}
+
 int ar9170_set_qos(struct ar9170 *ar)
 {
         ar9170_regwrite_begin(ar);
@@ -84,7 +133,7 @@ static int ar9170_set_ampdu_density(struct ar9170 *ar, u8 mpdudensity)
         val = 0x140a00 | (mpdudensity ? (mpdudensity + 1) : 0);
 
         ar9170_regwrite_begin(ar);
-        ar9170_regwrite(AR9170_MAC_REG_AMPDU_SET, val);
+        ar9170_regwrite(AR9170_MAC_REG_AMPDU_DENSITY, val);
         ar9170_regwrite_finish();
 
         return ar9170_regwrite_result();
@@ -398,10 +447,10 @@ int ar9170_update_beacon(struct ar9170 *ar)
         /* XXX: use skb->cb info */
         if (ar->hw->conf.channel->band == IEEE80211_BAND_2GHZ)
                 ar9170_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + 4) << (3+16)) + 0x0400);
+                                ((skb->len + 4) << (3 + 16)) + 0x0400);
         else
                 ar9170_regwrite(AR9170_MAC_REG_BCN_PLCP,
-                                ((skb->len + 4) << (3+16)) + 0x0400);
+                                ((skb->len + 4) << 16) + 0x001b);
 
         ar9170_regwrite(AR9170_MAC_REG_BCN_LENGTH, skb->len + 4);
         ar9170_regwrite(AR9170_MAC_REG_BCN_ADDR, AR9170_BEACON_BUFFER_ADDRESS);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 99df9ddae9cb..b104d7efd676 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -146,7 +146,6 @@ static struct ieee80211_channel ar9170_5ghz_chantable[] = {
 {                                                                       \
         .ht_supported   = true,                                         \
         .cap            = IEEE80211_HT_CAP_MAX_AMSDU |                  \
-                          IEEE80211_HT_CAP_SM_PS |                      \
                           IEEE80211_HT_CAP_SUP_WIDTH_20_40 |            \
                           IEEE80211_HT_CAP_SGI_40 |                     \
                           IEEE80211_HT_CAP_DSSSCCK40 |                  \
@@ -344,7 +343,6 @@ static void ar9170_tx_status_janitor(struct work_struct *work)
         if (unlikely(!IS_STARTED(ar)))
                 return ;
 
-        mutex_lock(&ar->mutex);
         /* recycle the garbage back to mac80211... one by one. */
         while ((skb = skb_dequeue(&ar->global_tx_status_waste))) {
 #ifdef AR9170_QUEUE_DEBUG
@@ -370,12 +368,9 @@ static void ar9170_tx_status_janitor(struct work_struct *work)
         if (skb_queue_len(&ar->global_tx_status_waste) > 0)
                 queue_delayed_work(ar->hw->workqueue, &ar->tx_status_janitor,
                                    msecs_to_jiffies(100));
-
-        mutex_unlock(&ar->mutex);
 }
 
-static void ar9170_handle_command_response(struct ar9170 *ar,
-                                           void *buf, u32 len)
+void ar9170_handle_command_response(struct ar9170 *ar, void *buf, u32 len)
 {
         struct ar9170_cmd_response *cmd = (void *) buf;
 
@@ -957,6 +952,8 @@ static int ar9170_op_start(struct ieee80211_hw *hw)
 
         mutex_lock(&ar->mutex);
 
+        ar->filter_changed = 0;
+
         /* reinitialize queues statistics */
         memset(&ar->tx_stats, 0, sizeof(ar->tx_stats));
         for (i = 0; i < ARRAY_SIZE(ar->tx_stats); i++)
@@ -1012,10 +1009,10 @@ static void ar9170_op_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(ar->hw->workqueue);
 
-        mutex_lock(&ar->mutex);
         cancel_delayed_work_sync(&ar->tx_status_janitor);
         cancel_work_sync(&ar->filter_config_work);
         cancel_work_sync(&ar->beacon_work);
+        mutex_lock(&ar->mutex);
         skb_queue_purge(&ar->global_tx_status_waste);
         skb_queue_purge(&ar->global_tx_status);
 
@@ -1306,11 +1303,6 @@ static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&ar->mutex);
 
-        if (changed & IEEE80211_CONF_CHANGE_RADIO_ENABLED) {
-                /* TODO */
-                err = 0;
-        }
-
         if (changed & IEEE80211_CONF_CHANGE_LISTEN_INTERVAL) {
                 /* TODO */
                 err = 0;
@@ -1344,15 +1336,21 @@ static int ar9170_op_config(struct ieee80211_hw *hw, u32 changed)
         }
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
+
+                /* adjust slot time for 5 GHz */
+                err = ar9170_set_slot_time(ar);
+                if (err)
+                        goto out;
+
+                err = ar9170_set_dyn_sifs_ack(ar);
+                if (err)
+                        goto out;
+
                 err = ar9170_set_channel(ar, hw->conf.channel,
                                 AR9170_RFI_NONE,
                                 nl80211_to_ar9170(hw->conf.channel_type));
                 if (err)
                         goto out;
-                /* adjust slot time for 5 GHz */
-                if (hw->conf.channel->band == IEEE80211_BAND_5GHZ)
-                        err = ar9170_write_reg(ar, AR9170_MAC_REG_SLOT_TIME,
-                                               9 << 10);
         }
 
 out:
@@ -1370,20 +1368,26 @@ static void ar9170_set_filters(struct work_struct *work)
                 return ;
 
         mutex_lock(&ar->mutex);
-        if (ar->filter_changed & AR9170_FILTER_CHANGED_PROMISC) {
+        if (test_and_clear_bit(AR9170_FILTER_CHANGED_MODE,
+                               &ar->filter_changed)) {
                 err = ar9170_set_operating_mode(ar);
                 if (err)
                         goto unlock;
         }
 
-        if (ar->filter_changed & AR9170_FILTER_CHANGED_MULTICAST) {
+        if (test_and_clear_bit(AR9170_FILTER_CHANGED_MULTICAST,
+                               &ar->filter_changed)) {
                 err = ar9170_update_multicast(ar);
                 if (err)
                         goto unlock;
         }
 
-        if (ar->filter_changed & AR9170_FILTER_CHANGED_FRAMEFILTER)
+        if (test_and_clear_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
+                               &ar->filter_changed)) {
                 err = ar9170_update_frame_filter(ar);
+                if (err)
+                        goto unlock;
+        }
 
 unlock:
         mutex_unlock(&ar->mutex);
@@ -1413,7 +1417,7 @@ static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
                         int i;
 
                         /* always get broadcast frames */
-                        mchash = 1ULL << (0xff>>2);
+                        mchash = 1ULL << (0xff >> 2);
 
                         for (i = 0; i < mc_count; i++) {
                                 if (WARN_ON(!mclist))
@@ -1423,7 +1427,7 @@ static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
                         }
                 ar->want_mc_hash = mchash;
                 }
-                ar->filter_changed |= AR9170_FILTER_CHANGED_MULTICAST;
+                set_bit(AR9170_FILTER_CHANGED_MULTICAST, &ar->filter_changed);
         }
 
         if (changed_flags & FIF_CONTROL) {
@@ -1439,12 +1443,14 @@ static void ar9170_op_configure_filter(struct ieee80211_hw *hw,
                 else
                         ar->want_filter = ar->cur_filter & ~filter;
 
-                ar->filter_changed |= AR9170_FILTER_CHANGED_FRAMEFILTER;
+                set_bit(AR9170_FILTER_CHANGED_FRAMEFILTER,
+                        &ar->filter_changed);
         }
 
         if (changed_flags & FIF_PROMISC_IN_BSS) {
                 ar->sniffer_enabled = ((*new_flags) & FIF_PROMISC_IN_BSS) != 0;
-                ar->filter_changed |= AR9170_FILTER_CHANGED_PROMISC;
+                set_bit(AR9170_FILTER_CHANGED_MODE,
+                        &ar->filter_changed);
         }
 
         if (likely(IS_STARTED(ar)))
@@ -1464,27 +1470,32 @@ static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
         if (changed & BSS_CHANGED_BSSID) {
                 memcpy(ar->bssid, bss_conf->bssid, ETH_ALEN);
                 err = ar9170_set_operating_mode(ar);
+                if (err)
+                        goto out;
         }
 
         if (changed & (BSS_CHANGED_BEACON | BSS_CHANGED_BEACON_ENABLED)) {
                 err = ar9170_update_beacon(ar);
-                if (!err)
-                        ar9170_set_beacon_timers(ar);
-        }
+                if (err)
+                        goto out;
 
-        ar9170_regwrite_begin(ar);
+                err = ar9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
 
         if (changed & BSS_CHANGED_ASSOC) {
-                ar->state = bss_conf->assoc ? AR9170_ASSOCIATED : ar->state;
-
 #ifndef CONFIG_AR9170_LEDS
                 /* enable assoc LED. */
                 err = ar9170_set_leds_state(ar, bss_conf->assoc ? 2 : 0);
 #endif /* CONFIG_AR9170_LEDS */
         }
 
-        if (changed & BSS_CHANGED_BEACON_INT)
+        if (changed & BSS_CHANGED_BEACON_INT) {
                 err = ar9170_set_beacon_timers(ar);
+                if (err)
+                        goto out;
+        }
 
         if (changed & BSS_CHANGED_HT) {
                 /* TODO */
@@ -1492,31 +1503,18 @@ static void ar9170_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
-                u32 slottime = 20;
-
-                if (bss_conf->use_short_slot)
-                        slottime = 9;
-
-                ar9170_regwrite(AR9170_MAC_REG_SLOT_TIME, slottime << 10);
+                err = ar9170_set_slot_time(ar);
+                if (err)
+                        goto out;
         }
 
         if (changed & BSS_CHANGED_BASIC_RATES) {
-                u32 cck, ofdm;
-
-                if (hw->conf.channel->band == IEEE80211_BAND_5GHZ) {
-                        ofdm = bss_conf->basic_rates;
-                        cck = 0;
-                } else {
-                        /* four cck rates */
-                        cck = bss_conf->basic_rates & 0xf;
-                        ofdm = bss_conf->basic_rates >> 4;
-                }
-                ar9170_regwrite(AR9170_MAC_REG_BASIC_RATE,
-                                ofdm << 8 | cck);
+                err = ar9170_set_basic_rates(ar);
+                if (err)
+                        goto out;
         }
 
-        ar9170_regwrite_finish();
-        err = ar9170_regwrite_result();
+out:
         mutex_unlock(&ar->mutex);
 }
 
diff --git a/drivers/net/wireless/ath/ar9170/phy.c b/drivers/net/wireless/ath/ar9170/phy.c
index 6ce20754b8e7..df86f70cd817 100644
--- a/drivers/net/wireless/ath/ar9170/phy.c
+++ b/drivers/net/wireless/ath/ar9170/phy.c
@@ -401,7 +401,7 @@ int ar9170_init_phy(struct ar9170 *ar, enum ieee80211_band band)
         int i, err;
         u32 val;
         bool is_2ghz = band == IEEE80211_BAND_2GHZ;
-        bool is_40mhz = false; /* XXX: for now */
+        bool is_40mhz = conf_is_ht40(&ar->hw->conf);
 
         ar9170_regwrite_begin(ar);
 
@@ -1200,7 +1200,7 @@ int ar9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
                 return -ENOSYS;
         }
 
-        if (0 /* 2 streams capable */)
+        if (ar->eeprom.tx_mask != 1)
                 tmp |= 0x100;
 
         err = ar9170_write_reg(ar, 0x1c5804, tmp);
@@ -1214,7 +1214,7 @@ int ar9170_set_channel(struct ar9170 *ar, struct ieee80211_channel *channel,
         freqpar = ar9170_get_hw_dyn_params(channel, bw);
 
         vals[0] = cpu_to_le32(channel->center_freq * 1000);
-        vals[1] = cpu_to_le32(bw == AR9170_BW_20 ? 0 : 1);
+        vals[1] = cpu_to_le32(conf_is_ht40(&ar->hw->conf));
         vals[2] = cpu_to_le32(offs << 2 | 1);
         vals[3] = cpu_to_le32(freqpar->coeff_exp);
         vals[4] = cpu_to_le32(freqpar->coeff_man);
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index d7c13c0177ca..f752698669d2 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -51,9 +51,14 @@ MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
 MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Atheros AR9170 802.11n USB wireless");
+MODULE_FIRMWARE("ar9170.fw");
 MODULE_FIRMWARE("ar9170-1.fw");
 MODULE_FIRMWARE("ar9170-2.fw");
 
+enum ar9170_requirements {
+        AR9170_REQ_FW1_ONLY = 1,
+};
+
 static struct usb_device_id ar9170_usb_ids[] = {
         /* Atheros 9170 */
         { USB_DEVICE(0x0cf3, 0x9170) },
@@ -81,6 +86,10 @@ static struct usb_device_id ar9170_usb_ids[] = {
         { USB_DEVICE(0x2019, 0x5304) },
         /* IO-Data WNGDNUS2 */
         { USB_DEVICE(0x04bb, 0x093f) },
+        /* AVM FRITZ!WLAN USB Stick N */
+        { USB_DEVICE(0x057C, 0x8401) },
+        /* AVM FRITZ!WLAN USB Stick N 2.4 */
+        { USB_DEVICE(0x057C, 0x8402), .driver_info = AR9170_REQ_FW1_ONLY },
 
         /* terminate */
         {}
@@ -93,7 +102,7 @@ static void ar9170_usb_tx_urb_complete_free(struct urb *urb)
         struct ar9170_usb *aru = (struct ar9170_usb *)
               usb_get_intfdata(usb_ifnum_to_if(urb->dev, 0));
 
-        if (!aru) {
+        if (unlikely(!aru)) {
                 dev_kfree_skb_irq(skb);
                 return ;
         }
@@ -126,8 +135,8 @@ static void ar9170_usb_irq_completed(struct urb *urb)
                 goto resubmit;
         }
 
-        print_hex_dump_bytes("ar9170 irq: ", DUMP_PREFIX_OFFSET,
-                             urb->transfer_buffer, urb->actual_length);
+        ar9170_handle_command_response(&aru->common, urb->transfer_buffer,
+                                       urb->actual_length);
 
 resubmit:
         usb_anchor_urb(urb, &aru->rx_submitted);
@@ -177,16 +186,15 @@ resubmit:
 
         usb_anchor_urb(urb, &aru->rx_submitted);
         err = usb_submit_urb(urb, GFP_ATOMIC);
-        if (err) {
+        if (unlikely(err)) {
                 usb_unanchor_urb(urb);
-                dev_kfree_skb_irq(skb);
+                goto free;
         }
 
         return ;
 
 free:
         dev_kfree_skb_irq(skb);
-        return;
 }
 
 static int ar9170_usb_prep_rx_urb(struct ar9170_usb *aru,
@@ -337,7 +345,7 @@ static int ar9170_usb_exec_cmd(struct ar9170 *ar, enum ar9170_cmd cmd,
 
         usb_anchor_urb(urb, &aru->tx_submitted);
         err = usb_submit_urb(urb, GFP_ATOMIC);
-        if (err) {
+        if (unlikely(err)) {
                 usb_unanchor_urb(urb);
                 usb_free_urb(urb);
                 goto err_unbuf;
@@ -418,7 +426,7 @@ static void ar9170_usb_callback_cmd(struct ar9170 *ar, u32 len , void *buffer)
         unsigned long flags;
         u32 in, out;
 
-        if (!buffer)
+        if (unlikely(!buffer))
                 return ;
 
         in = le32_to_cpup((__le32 *)buffer);
@@ -504,17 +512,29 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
 {
         int err = 0;
 
-        err = request_firmware(&aru->init_values, "ar9170-1.fw",
+        err = request_firmware(&aru->firmware, "ar9170.fw",
                                &aru->udev->dev);
-        if (err) {
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
-                return err;
+        if (!err) {
+                aru->init_values = NULL;
+                return 0;
         }
 
+        if (aru->req_one_stage_fw) {
+                dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                        "not found and is required for this device\n");
+                return -EINVAL;
+        }
+
+        dev_err(&aru->udev->dev, "ar9170.fw firmware file "
+                "not found, trying old firmware...\n");
+
+        err = request_firmware(&aru->init_values, "ar9170-1.fw",
+                               &aru->udev->dev);
+
         err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
         if (err) {
                 release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "firmware file not found.\n");
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
                 return err;
         }
 
@@ -548,6 +568,9 @@ static int ar9170_usb_upload_firmware(struct ar9170_usb *aru)
 {
         int err;
 
+        if (!aru->init_values)
+                goto upload_fw_start;
+
         /* First, upload initial values to device RAM */
         err = ar9170_usb_upload(aru, aru->init_values->data,
                                 aru->init_values->size, 0x102800, false);
@@ -557,6 +580,8 @@ static int ar9170_usb_upload_firmware(struct ar9170_usb *aru)
                 return err;
         }
 
+upload_fw_start:
+
         /* Then, upload the firmware itself and start it */
         return ar9170_usb_upload(aru, aru->firmware->data, aru->firmware->size,
                                 0x200000, true);
@@ -656,6 +681,15 @@ err_out:
         return err;
 }
 
+static bool ar9170_requires_one_stage(const struct usb_device_id *id)
+{
+        if (!id->driver_info)
+                return false;
+        if (id->driver_info == AR9170_REQ_FW1_ONLY)
+                return true;
+        return false;
+}
+
 static int ar9170_usb_probe(struct usb_interface *intf,
                         const struct usb_device_id *id)
 {
@@ -676,6 +710,8 @@ static int ar9170_usb_probe(struct usb_interface *intf,
         aru->intf = intf;
         ar = &aru->common;
 
+        aru->req_one_stage_fw = ar9170_requires_one_stage(id);
+
         usb_set_intfdata(intf, aru);
         SET_IEEE80211_DEV(ar->hw, &udev->dev);
 
@@ -691,7 +727,7 @@ static int ar9170_usb_probe(struct usb_interface *intf,
 
 #ifdef CONFIG_PM
         udev->reset_resume = 1;
-#endif
+#endif /* CONFIG_PM */
         err = ar9170_usb_reset(aru);
         if (err)
                 goto err_freehw;
@@ -776,11 +812,6 @@ static int ar9170_resume(struct usb_interface *intf)
         usb_unpoison_anchored_urbs(&aru->rx_submitted);
         usb_unpoison_anchored_urbs(&aru->tx_submitted);
 
-        /*
-         * FIXME: firmware upload will fail on resume.
-         * but this is better than a hang!
-         */
-
         err = ar9170_usb_init_device(aru);
         if (err)
                 goto err_unrx;
diff --git a/drivers/net/wireless/ath/ar9170/usb.h b/drivers/net/wireless/ath/ar9170/usb.h
index ac42586495d8..69f4bceb0af3 100644
--- a/drivers/net/wireless/ath/ar9170/usb.h
+++ b/drivers/net/wireless/ath/ar9170/usb.h
@@ -62,6 +62,8 @@ struct ar9170_usb {
         struct usb_anchor rx_submitted;
         struct usb_anchor tx_submitted;
 
+        bool req_one_stage_fw;
+
         spinlock_t cmdlock;
         struct completion cmd_wait;
         int readlen;
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index fb5193764afa..85a00db4867d 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -2070,6 +2070,13 @@ err_unmap:
         return ret;
 }
 
+static void ath5k_beacon_disable(struct ath5k_softc *sc)
+{
+        sc->imask &= ~(AR5K_INT_BMISS | AR5K_INT_SWBA);
+        ath5k_hw_set_imr(sc->ah, sc->imask);
+        ath5k_hw_stop_tx_dma(sc->ah, sc->bhalq);
+}
+
 /*
  * Transmit a beacon frame at SWBA.  Dynamic updates to the
  * frame contents are done as needed and the slot time is
@@ -2757,6 +2764,7 @@ ath5k_remove_interface(struct ieee80211_hw *hw,
                 goto end;
 
         ath5k_hw_set_lladdr(sc->ah, mac);
+        ath5k_beacon_disable(sc);
         sc->vif = NULL;
 end:
         mutex_unlock(&sc->lock);
@@ -2775,11 +2783,9 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 
         mutex_lock(&sc->lock);
 
-        sc->bintval = conf->beacon_int;
-
         ret = ath5k_chan_set(sc, conf->channel);
         if (ret < 0)
-                return ret;
+                goto unlock;
 
         if ((changed & IEEE80211_CONF_CHANGE_POWER) &&
         (sc->power_level != conf->power_level)) {
@@ -2808,8 +2814,9 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
          */
         ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);
 
+unlock:
         mutex_unlock(&sc->lock);
-        return 0;
+        return ret;
 }
 
 #define SUPPORTED_FIF_FLAGS \
@@ -3061,7 +3068,14 @@ ath5k_beacon_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 {
         int ret;
         struct ath5k_softc *sc = hw->priv;
-        struct sk_buff *skb = ieee80211_beacon_get(hw, vif);
+        struct sk_buff *skb;
+
+        if (WARN_ON(!vif)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
+        skb = ieee80211_beacon_get(hw, vif);
 
         if (!skb) {
                 ret = -ENOMEM;
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 796a3adffea0..515880aa2116 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -460,12 +460,9 @@ struct ath_led {
         bool registered;
 };
 
-/* Rfkill */
-#define ATH_RFKILL_POLL_INTERVAL        2000 /* msecs */
-
 struct ath_rfkill {
         struct rfkill *rfkill;
-        struct delayed_work rfkill_poll;
+        struct rfkill_ops ops;
         char rfkill_name[32];
 };
 
@@ -509,8 +506,6 @@ struct ath_rfkill {
 #define SC_OP_RXFLUSH           BIT(7)
 #define SC_OP_LED_ASSOCIATED    BIT(8)
 #define SC_OP_RFKILL_REGISTERED BIT(9)
-#define SC_OP_RFKILL_SW_BLOCKED BIT(10)
-#define SC_OP_RFKILL_HW_BLOCKED BIT(11)
 #define SC_OP_WAIT_FOR_BEACON   BIT(12)
 #define SC_OP_LED_ON            BIT(13)
 #define SC_OP_SCANNING          BIT(14)
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index a21b21339fbc..3639a2e6987d 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -411,6 +411,7 @@ void ath_beacon_tasklet(unsigned long data)
                 } else if (sc->beacon.bmisscnt >= BSTUCK_THRESH) {
                         DPRINTF(sc, ATH_DBG_BEACON,
                                 "beacon is officially stuck\n");
+                        sc->sc_flags |= SC_OP_TSF_RESET;
                         ath_reset(sc, false);
                 }
 
@@ -673,6 +674,14 @@ static void ath_beacon_config_adhoc(struct ath_softc *sc,
 
         intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
 
+        /*
+         * It looks like mac80211 may end up using beacon interval of zero in
+         * some cases (at least for mesh point). Avoid getting into an
+         * infinite loop by using a bit safer value instead..
+         */
+        if (intval == 0)
+                intval = 100;
+
         /* Pull nexttbtt forward to reflect the current TSF */
 
         nexttbtt = TSF_TO_TU(sc->beacon.bc_tstamp >> 32, sc->beacon.bc_tstamp);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 97df20cbf528..6d20725d6451 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -44,6 +44,44 @@ static int ath9k_debugfs_open(struct inode *inode, struct file *file)
         return 0;
 }
 
+static ssize_t read_file_debug(struct file *file, char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = snprintf(buf, sizeof(buf), "0x%08x\n", sc->debug.debug_mask);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_debug(struct file *file, const char __user *user_buf,
+                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long mask;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EINVAL;
+
+        buf[len] = '\0';
+        if (strict_strtoul(buf, 0, &mask))
+                return -EINVAL;
+
+        sc->debug.debug_mask = mask;
+        return count;
+}
+
+static const struct file_operations fops_debug = {
+        .read = read_file_debug,
+        .write = write_file_debug,
+        .open = ath9k_debugfs_open,
+        .owner = THIS_MODULE
+};
+
 static ssize_t read_file_dma(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
@@ -224,111 +262,66 @@ static const struct file_operations fops_interrupt = {
         .owner = THIS_MODULE
 };
 
-static void ath_debug_stat_11n_rc(struct ath_softc *sc, struct sk_buff *skb)
-{
-        struct ath_tx_info_priv *tx_info_priv = NULL;
-        struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
-        struct ieee80211_tx_rate *rates = tx_info->status.rates;
-        int final_ts_idx, idx;
-
-        tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
-        final_ts_idx = tx_info_priv->tx.ts_rateindex;
-        idx = sc->cur_rate_table->info[rates[final_ts_idx].idx].dot11rate;
-
-        sc->debug.stats.n_rcstats[idx].success++;
-}
-
-static void ath_debug_stat_legacy_rc(struct ath_softc *sc, struct sk_buff *skb)
+void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb)
 {
         struct ath_tx_info_priv *tx_info_priv = NULL;
         struct ieee80211_tx_info *tx_info = IEEE80211_SKB_CB(skb);
         struct ieee80211_tx_rate *rates = tx_info->status.rates;
         int final_ts_idx, idx;
+        struct ath_rc_stats *stats;
 
         tx_info_priv = ATH_TX_INFO_PRIV(tx_info);
         final_ts_idx = tx_info_priv->tx.ts_rateindex;
         idx = rates[final_ts_idx].idx;
-
-        sc->debug.stats.legacy_rcstats[idx].success++;
-}
-
-void ath_debug_stat_rc(struct ath_softc *sc, struct sk_buff *skb)
-{
-        if (conf_is_ht(&sc->hw->conf))
-                ath_debug_stat_11n_rc(sc, skb);
-        else
-                ath_debug_stat_legacy_rc(sc, skb);
+        stats = &sc->debug.stats.rcstats[idx];
+        stats->success++;
 }
 
-/* FIXME: legacy rates, later on .. */
 void ath_debug_stat_retries(struct ath_softc *sc, int rix,
                             int xretries, int retries, u8 per)
 {
-        if (conf_is_ht(&sc->hw->conf)) {
-                int idx = sc->cur_rate_table->info[rix].dot11rate;
+        struct ath_rc_stats *stats = &sc->debug.stats.rcstats[rix];
 
-                sc->debug.stats.n_rcstats[idx].xretries += xretries;
-                sc->debug.stats.n_rcstats[idx].retries += retries;
-                sc->debug.stats.n_rcstats[idx].per = per;
-        }
+        stats->xretries += xretries;
+        stats->retries += retries;
+        stats->per = per;
 }
 
-static ssize_t ath_read_file_stat_11n_rc(struct file *file,
-                                         char __user *user_buf,
-                                         size_t count, loff_t *ppos)
+static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
-        char buf[1024];
-        unsigned int len = 0;
+        char *buf;
+        unsigned int len = 0, max;
         int i = 0;
+        ssize_t retval;
 
-        len += sprintf(buf, "%7s %13s %8s %8s %6s\n\n", "Rate", "Success",
-                       "Retries", "XRetries", "PER");
-
-        for (i = 0; i <= 15; i++) {
-                len += snprintf(buf + len, sizeof(buf) - len,
-                                "%5s%3d: %8u %8u %8u %8u\n", "MCS", i,
-                                sc->debug.stats.n_rcstats[i].success,
-                                sc->debug.stats.n_rcstats[i].retries,
-                                sc->debug.stats.n_rcstats[i].xretries,
-                                sc->debug.stats.n_rcstats[i].per);
-        }
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
+        if (sc->cur_rate_table == NULL)
+                return 0;
 
-static ssize_t ath_read_file_stat_legacy_rc(struct file *file,
-                                            char __user *user_buf,
-                                            size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[512];
-        unsigned int len = 0;
-        int i = 0;
+        max = 80 + sc->cur_rate_table->rate_cnt * 64;
+        buf = kmalloc(max + 1, GFP_KERNEL);
+        if (buf == NULL)
+                return 0;
+        buf[max] = 0;
 
-        len += sprintf(buf, "%7s %13s\n\n", "Rate", "Success");
+        len += sprintf(buf, "%5s %15s %8s %9s %3s\n\n", "Rate", "Success",
+                       "Retries", "XRetries", "PER");
 
         for (i = 0; i < sc->cur_rate_table->rate_cnt; i++) {
-                len += snprintf(buf + len, sizeof(buf) - len, "%5u: %12u\n",
-                                sc->cur_rate_table->info[i].ratekbps / 1000,
-                                sc->debug.stats.legacy_rcstats[i].success);
+                u32 ratekbps = sc->cur_rate_table->info[i].ratekbps;
+                struct ath_rc_stats *stats = &sc->debug.stats.rcstats[i];
+
+                len += snprintf(buf + len, max - len,
+                        "%3u.%d: %8u %8u %8u %8u\n", ratekbps / 1000,
+                        (ratekbps % 1000) / 100, stats->success,
+                        stats->retries, stats->xretries,
+                        stats->per);
         }
 
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t read_file_rcstat(struct file *file, char __user *user_buf,
-                                size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-
-        if (sc->cur_rate_table == NULL)
-                return 0;
-
-        if (conf_is_ht(&sc->hw->conf))
-                return ath_read_file_stat_11n_rc(file, user_buf, count, ppos);
-        else
-                return ath_read_file_stat_legacy_rc(file, user_buf, count ,ppos);
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+        return retval;
 }
 
 static const struct file_operations fops_rcstat = {
@@ -506,6 +499,11 @@ int ath9k_init_debug(struct ath_softc *sc)
         if (!sc->debug.debugfs_phy)
                 goto err;
 
+        sc->debug.debugfs_debug = debugfs_create_file("debug",
+                S_IRUGO | S_IWUSR, sc->debug.debugfs_phy, sc, &fops_debug);
+        if (!sc->debug.debugfs_debug)
+                goto err;
+
         sc->debug.debugfs_dma = debugfs_create_file("dma", S_IRUGO,
                                        sc->debug.debugfs_phy, sc, &fops_dma);
         if (!sc->debug.debugfs_dma)
@@ -543,6 +541,7 @@ void ath9k_exit_debug(struct ath_softc *sc)
         debugfs_remove(sc->debug.debugfs_rcstat);
         debugfs_remove(sc->debug.debugfs_interrupt);
         debugfs_remove(sc->debug.debugfs_dma);
+        debugfs_remove(sc->debug.debugfs_debug);
         debugfs_remove(sc->debug.debugfs_phy);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index db845cf960c9..edda15bf2c15 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -80,11 +80,7 @@ struct ath_interrupt_stats {
         u32 dtim;
 };
 
-struct ath_legacy_rc_stats {
-        u32 success;
-};
-
-struct ath_11n_rc_stats {
+struct ath_rc_stats {
         u32 success;
         u32 retries;
         u32 xretries;
@@ -93,13 +89,13 @@ struct ath_11n_rc_stats {
 
 struct ath_stats {
         struct ath_interrupt_stats istats;
-        struct ath_legacy_rc_stats legacy_rcstats[12];  /* max(11a,11b,11g) */
-        struct ath_11n_rc_stats n_rcstats[16];          /* 0..15 MCS rates */
+        struct ath_rc_stats rcstats[RATE_TABLE_SIZE];
 };
 
 struct ath9k_debug {
         int debug_mask;
         struct dentry *debugfs_phy;
+        struct dentry *debugfs_debug;
         struct dentry *debugfs_dma;
         struct dentry *debugfs_interrupt;
         struct dentry *debugfs_rcstat;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 61da08a1648c..f7baa406918b 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1192,120 +1192,69 @@ static bool ath_is_rfkill_set(struct ath_softc *sc)
                                   ah->rfkill_polarity;
 }
 
-/* h/w rfkill poll function */
-static void ath_rfkill_poll(struct work_struct *work)
+/* s/w rfkill handlers */
+static int ath_rfkill_set_block(void *data, bool blocked)
 {
-        struct ath_softc *sc = container_of(work, struct ath_softc,
-                                            rf_kill.rfkill_poll.work);
-        bool radio_on;
-
-        if (sc->sc_flags & SC_OP_INVALID)
-                return;
-
-        radio_on = !ath_is_rfkill_set(sc);
-
-        /*
-         * enable/disable radio only when there is a
-         * state change in RF switch
-         */
-        if (radio_on == !!(sc->sc_flags & SC_OP_RFKILL_HW_BLOCKED)) {
-                enum rfkill_state state;
-
-                if (sc->sc_flags & SC_OP_RFKILL_SW_BLOCKED) {
-                        state = radio_on ? RFKILL_STATE_SOFT_BLOCKED
-                                : RFKILL_STATE_HARD_BLOCKED;
-                } else if (radio_on) {
-                        ath_radio_enable(sc);
-                        state = RFKILL_STATE_UNBLOCKED;
-                } else {
-                        ath_radio_disable(sc);
-                        state = RFKILL_STATE_HARD_BLOCKED;
-                }
-
-                if (state == RFKILL_STATE_HARD_BLOCKED)
-                        sc->sc_flags |= SC_OP_RFKILL_HW_BLOCKED;
-                else
-                        sc->sc_flags &= ~SC_OP_RFKILL_HW_BLOCKED;
+        struct ath_softc *sc = data;
 
-                rfkill_force_state(sc->rf_kill.rfkill, state);
-        }
+        if (blocked)
+                ath_radio_disable(sc);
+        else
+                ath_radio_enable(sc);
 
-        queue_delayed_work(sc->hw->workqueue, &sc->rf_kill.rfkill_poll,
-                           msecs_to_jiffies(ATH_RFKILL_POLL_INTERVAL));
+        return 0;
 }
 
-/* s/w rfkill handler */
-static int ath_sw_toggle_radio(void *data, enum rfkill_state state)
+static void ath_rfkill_poll_state(struct rfkill *rfkill, void *data)
 {
         struct ath_softc *sc = data;
+        bool blocked = !!ath_is_rfkill_set(sc);
 
-        switch (state) {
-        case RFKILL_STATE_SOFT_BLOCKED:
-                if (!(sc->sc_flags & (SC_OP_RFKILL_HW_BLOCKED |
-                    SC_OP_RFKILL_SW_BLOCKED)))
-                        ath_radio_disable(sc);
-                sc->sc_flags |= SC_OP_RFKILL_SW_BLOCKED;
-                return 0;
-        case RFKILL_STATE_UNBLOCKED:
-                if ((sc->sc_flags & SC_OP_RFKILL_SW_BLOCKED)) {
-                        sc->sc_flags &= ~SC_OP_RFKILL_SW_BLOCKED;
-                        if (sc->sc_flags & SC_OP_RFKILL_HW_BLOCKED) {
-                                DPRINTF(sc, ATH_DBG_FATAL, "Can't turn on the"
-                                        "radio as it is disabled by h/w\n");
-                                return -EPERM;
-                        }
-                        ath_radio_enable(sc);
-                }
-                return 0;
-        default:
-                return -EINVAL;
-        }
+        if (rfkill_set_hw_state(rfkill, blocked))
+                ath_radio_disable(sc);
+        else
+                ath_radio_enable(sc);
 }
 
 /* Init s/w rfkill */
 static int ath_init_sw_rfkill(struct ath_softc *sc)
 {
-        sc->rf_kill.rfkill = rfkill_allocate(wiphy_dev(sc->hw->wiphy),
-                                             RFKILL_TYPE_WLAN);
+        sc->rf_kill.ops.set_block = ath_rfkill_set_block;
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
+                sc->rf_kill.ops.poll = ath_rfkill_poll_state;
+
+        snprintf(sc->rf_kill.rfkill_name, sizeof(sc->rf_kill.rfkill_name),
+                "ath9k-%s::rfkill", wiphy_name(sc->hw->wiphy));
+
+        sc->rf_kill.rfkill = rfkill_alloc(sc->rf_kill.rfkill_name,
+                                          wiphy_dev(sc->hw->wiphy),
+                                          RFKILL_TYPE_WLAN,
+                                          &sc->rf_kill.ops, sc);
         if (!sc->rf_kill.rfkill) {
                 DPRINTF(sc, ATH_DBG_FATAL, "Failed to allocate rfkill\n");
                 return -ENOMEM;
         }
 
-        snprintf(sc->rf_kill.rfkill_name, sizeof(sc->rf_kill.rfkill_name),
-                "ath9k-%s::rfkill", wiphy_name(sc->hw->wiphy));
-        sc->rf_kill.rfkill->name = sc->rf_kill.rfkill_name;
-        sc->rf_kill.rfkill->data = sc;
-        sc->rf_kill.rfkill->toggle_radio = ath_sw_toggle_radio;
-        sc->rf_kill.rfkill->state = RFKILL_STATE_UNBLOCKED;
-
         return 0;
 }
 
 /* Deinitialize rfkill */
 static void ath_deinit_rfkill(struct ath_softc *sc)
 {
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                cancel_delayed_work_sync(&sc->rf_kill.rfkill_poll);
-
         if (sc->sc_flags & SC_OP_RFKILL_REGISTERED) {
                 rfkill_unregister(sc->rf_kill.rfkill);
+                rfkill_destroy(sc->rf_kill.rfkill);
                 sc->sc_flags &= ~SC_OP_RFKILL_REGISTERED;
-                sc->rf_kill.rfkill = NULL;
         }
 }
 
 static int ath_start_rfkill_poll(struct ath_softc *sc)
 {
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                queue_delayed_work(sc->hw->workqueue,
-                                   &sc->rf_kill.rfkill_poll, 0);
-
         if (!(sc->sc_flags & SC_OP_RFKILL_REGISTERED)) {
                 if (rfkill_register(sc->rf_kill.rfkill)) {
                         DPRINTF(sc, ATH_DBG_FATAL,
                                 "Unable to register rfkill\n");
-                        rfkill_free(sc->rf_kill.rfkill);
+                        rfkill_destroy(sc->rf_kill.rfkill);
 
                         /* Deinitialize the device */
                         ath_cleanup(sc);
@@ -1678,10 +1627,6 @@ int ath_attach(u16 devid, struct ath_softc *sc)
                 goto error_attach;
 
 #if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
-        /* Initialze h/w Rfkill */
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                INIT_DELAYED_WORK(&sc->rf_kill.rfkill_poll, ath_rfkill_poll);
-
         /* Initialize s/w rfkill */
         error = ath_init_sw_rfkill(sc);
         if (error)
@@ -2214,10 +2159,8 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         } else
                 sc->rx.rxlink = NULL;
 
-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                cancel_delayed_work_sync(&sc->rf_kill.rfkill_poll);
-#endif
+        rfkill_pause_polling(sc->rf_kill.rfkill);
+
         /* disable HAL and put h/w to sleep */
         ath9k_hw_disable(sc->sc_ah);
         ath9k_hw_configpcipowersave(sc->sc_ah, 1);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 168411d322a2..ccdf20a2e9be 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -227,11 +227,6 @@ static int ath_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 
         ath9k_hw_set_gpio(sc->sc_ah, ATH_LED_PIN, 1);
 
-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                cancel_delayed_work_sync(&sc->rf_kill.rfkill_poll);
-#endif
-
         pci_save_state(pdev);
         pci_disable_device(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
@@ -256,16 +251,6 @@ static int ath_pci_resume(struct pci_dev *pdev)
                             AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
         ath9k_hw_set_gpio(sc->sc_ah, ATH_LED_PIN, 1);
 
-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
-        /*
-         * check the h/w rfkill state on resume
-         * and start the rfkill poll timer
-         */
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_RFSILENT)
-                queue_delayed_work(sc->hw->workqueue,
-                                   &sc->rf_kill.rfkill_poll, 0);
-#endif
-
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 7a89f9fac7d4..eef370bd1211 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -366,11 +366,17 @@ static bool ath_regd_is_eeprom_valid(struct ath_regulatory *reg)
         if (rd & COUNTRY_ERD_FLAG) {
                 /* EEPROM value is a country code */
                 u16 cc = rd & ~COUNTRY_ERD_FLAG;
+                printk(KERN_DEBUG
+                       "ath: EEPROM indicates we should expect "
+                        "a country code\n");
                 for (i = 0; i < ARRAY_SIZE(allCountries); i++)
                         if (allCountries[i].countryCode == cc)
                                 return true;
         } else {
                 /* EEPROM value is a regpair value */
+                if (rd != CTRY_DEFAULT)
+                        printk(KERN_DEBUG "ath: EEPROM indicates we "
+                               "should expect a direct regpair map\n");
                 for (i = 0; i < ARRAY_SIZE(regDomainPairs); i++)
                         if (regDomainPairs[i].regDmnEnum == rd)
                                 return true;
@@ -477,6 +483,11 @@ ath_regd_init(struct ath_regulatory *reg,
         struct country_code_to_enum_rd *country = NULL;
         u16 regdmn;
 
+        if (!reg)
+                return -EINVAL;
+
+        printk(KERN_DEBUG "ath: EEPROM regdomain: 0x%0x\n", reg->current_rd);
+
         if (!ath_regd_is_eeprom_valid(reg)) {
                 printk(KERN_ERR "ath: Invalid EEPROM contents\n");
                 return -EINVAL;
@@ -486,20 +497,30 @@ ath_regd_init(struct ath_regulatory *reg,
         reg->country_code = ath_regd_get_default_country(regdmn);
 
         if (reg->country_code == CTRY_DEFAULT &&
-            regdmn == CTRY_DEFAULT)
+            regdmn == CTRY_DEFAULT) {
+                printk(KERN_DEBUG "ath: EEPROM indicates default "
+                       "country code should be used\n");
                 reg->country_code = CTRY_UNITED_STATES;
+        }
 
         if (reg->country_code == CTRY_DEFAULT) {
                 country = NULL;
         } else {
+                printk(KERN_DEBUG "ath: doing EEPROM country->regdmn "
+                       "map search\n");
                 country = ath_regd_find_country(reg->country_code);
                 if (country == NULL) {
                         printk(KERN_DEBUG
-                                "ath: Country is NULL!!!!, cc= %d\n",
+                                "ath: no valid country maps found for "
+                                "country code: 0x%0x\n",
                                 reg->country_code);
                         return -EINVAL;
-                } else
+                } else {
                         regdmn = country->regDmnEnum;
+                        printk(KERN_DEBUG "ath: country maps to "
+                               "regdmn code: 0x%0x\n",
+                               regdmn);
+                }
         }
 
         reg->regpair = ath_get_regpair(regdmn);
@@ -523,7 +544,7 @@ ath_regd_init(struct ath_regulatory *reg,
 
         printk(KERN_DEBUG "ath: Country alpha2 being used: %c%c\n",
                 reg->alpha2[0], reg->alpha2[1]);
-        printk(KERN_DEBUG "ath: Regpair detected: 0x%0x\n",
+        printk(KERN_DEBUG "ath: Regpair used: 0x%0x\n",
                 reg->regpair->regDmnEnum);
 
         ath_regd_init_wiphy(reg, wiphy, reg_notifier);
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 21572e40b79d..07a99e3faf94 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -102,7 +102,7 @@ config B43_LEDS
 # if it's possible.
 config B43_RFKILL
         bool
-        depends on B43 && (RFKILL = y || RFKILL = B43) && RFKILL_INPUT && (INPUT_POLLDEV = y || INPUT_POLLDEV = B43)
+        depends on B43 && (RFKILL = y || RFKILL = B43)
         default y
 
 # This config option automatically enables b43 HW-RNG support,
diff --git a/drivers/net/wireless/b43/leds.c b/drivers/net/wireless/b43/leds.c
index 76f4c7bad8b8..9a498d3fc653 100644
--- a/drivers/net/wireless/b43/leds.c
+++ b/drivers/net/wireless/b43/leds.c
@@ -87,7 +87,7 @@ static void b43_led_brightness_set(struct led_classdev *led_dev,
 }
 
 static int b43_register_led(struct b43_wldev *dev, struct b43_led *led,
-                            const char *name, char *default_trigger,
+                            const char *name, const char *default_trigger,
                             u8 led_index, bool activelow)
 {
         int err;
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index cb4a8712946a..1d3e40095ada 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -3470,7 +3470,7 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
 
         if (!!conf->radio_enabled != phy->radio_on) {
                 if (conf->radio_enabled) {
-                        b43_software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
+                        b43_software_rfkill(dev, false);
                         b43info(dev->wl, "Radio turned on by software\n");
                         if (!dev->radio_hw_enable) {
                                 b43info(dev->wl, "The hardware RF-kill button "
@@ -3478,7 +3478,7 @@ static int b43_op_config(struct ieee80211_hw *hw, u32 changed)
                                         "Press the button to turn it on.\n");
                         }
                 } else {
-                        b43_software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
+                        b43_software_rfkill(dev, true);
                         b43info(dev->wl, "Radio turned off by software\n");
                 }
         }
diff --git a/drivers/net/wireless/b43/phy_a.c b/drivers/net/wireless/b43/phy_a.c
index c836c077d51d..816e028a2620 100644
--- a/drivers/net/wireless/b43/phy_a.c
+++ b/drivers/net/wireless/b43/phy_a.c
@@ -480,11 +480,11 @@ static bool b43_aphy_op_supports_hwpctl(struct b43_wldev *dev)
 }
 
 static void b43_aphy_op_software_rfkill(struct b43_wldev *dev,
-                                        enum rfkill_state state)
+                                        bool blocked)
 {
         struct b43_phy *phy = &dev->phy;
 
-        if (state == RFKILL_STATE_UNBLOCKED) {
+        if (!blocked) {
                 if (phy->radio_on)
                         return;
                 b43_radio_write16(dev, 0x0004, 0x00C0);
diff --git a/drivers/net/wireless/b43/phy_common.c b/drivers/net/wireless/b43/phy_common.c
index e176b6e0d9cf..6d241622210e 100644
--- a/drivers/net/wireless/b43/phy_common.c
+++ b/drivers/net/wireless/b43/phy_common.c
@@ -84,7 +84,7 @@ int b43_phy_init(struct b43_wldev *dev)
 
         phy->channel = ops->get_default_chan(dev);
 
-        ops->software_rfkill(dev, RFKILL_STATE_UNBLOCKED);
+        ops->software_rfkill(dev, false);
         err = ops->init(dev);
         if (err) {
                 b43err(dev->wl, "PHY init failed\n");
@@ -104,7 +104,7 @@ err_phy_exit:
         if (ops->exit)
                 ops->exit(dev);
 err_block_rf:
-        ops->software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
+        ops->software_rfkill(dev, true);
 
         return err;
 }
@@ -113,7 +113,7 @@ void b43_phy_exit(struct b43_wldev *dev)
 {
         const struct b43_phy_operations *ops = dev->phy.ops;
 
-        ops->software_rfkill(dev, RFKILL_STATE_SOFT_BLOCKED);
+        ops->software_rfkill(dev, true);
         if (ops->exit)
                 ops->exit(dev);
 }
@@ -295,18 +295,13 @@ err_restore_cookie:
         return err;
 }
 
-void b43_software_rfkill(struct b43_wldev *dev, enum rfkill_state state)
+void b43_software_rfkill(struct b43_wldev *dev, bool blocked)
 {
         struct b43_phy *phy = &dev->phy;
 
-        if (state == RFKILL_STATE_HARD_BLOCKED) {
-                /* We cannot hardware-block the device */
-                state = RFKILL_STATE_SOFT_BLOCKED;
-        }
-
         b43_mac_suspend(dev);
-        phy->ops->software_rfkill(dev, state);
-        phy->radio_on = (state == RFKILL_STATE_UNBLOCKED);
+        phy->ops->software_rfkill(dev, blocked);
+        phy->radio_on = !blocked;
         b43_mac_enable(dev);
 }
 
diff --git a/drivers/net/wireless/b43/phy_common.h b/drivers/net/wireless/b43/phy_common.h
index b2d99101947b..f4c2d79cbc89 100644
--- a/drivers/net/wireless/b43/phy_common.h
+++ b/drivers/net/wireless/b43/phy_common.h
@@ -159,7 +159,7 @@ struct b43_phy_operations {
 
         /* Radio */
         bool (*supports_hwpctl)(struct b43_wldev *dev);
-        void (*software_rfkill)(struct b43_wldev *dev, enum rfkill_state state);
+        void (*software_rfkill)(struct b43_wldev *dev, bool blocked);
         void (*switch_analog)(struct b43_wldev *dev, bool on);
         int (*switch_channel)(struct b43_wldev *dev, unsigned int new_channel);
         unsigned int (*get_default_chan)(struct b43_wldev *dev);
@@ -364,7 +364,7 @@ int b43_switch_channel(struct b43_wldev *dev, unsigned int new_channel);
 /**
  * b43_software_rfkill - Turn the radio ON or OFF in software.
  */
-void b43_software_rfkill(struct b43_wldev *dev, enum rfkill_state state);
+void b43_software_rfkill(struct b43_wldev *dev, bool blocked);
 
 /**
  * b43_phy_txpower_check - Check TX power output.
diff --git a/drivers/net/wireless/b43/phy_g.c b/drivers/net/wireless/b43/phy_g.c
index e7b98f013b0f..5300232449f6 100644
--- a/drivers/net/wireless/b43/phy_g.c
+++ b/drivers/net/wireless/b43/phy_g.c
@@ -2592,7 +2592,7 @@ static bool b43_gphy_op_supports_hwpctl(struct b43_wldev *dev)
 }
 
 static void b43_gphy_op_software_rfkill(struct b43_wldev *dev,
-                                        enum rfkill_state state)
+                                        bool blocked)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_g *gphy = phy->g;
@@ -2600,7 +2600,7 @@ static void b43_gphy_op_software_rfkill(struct b43_wldev *dev,
 
         might_sleep();
 
-        if (state == RFKILL_STATE_UNBLOCKED) {
+        if (!blocked) {
                 /* Turn radio ON */
                 if (phy->radio_on)
                         return;
diff --git a/drivers/net/wireless/b43/phy_lp.c b/drivers/net/wireless/b43/phy_lp.c
index 58e319d6b1ed..ea0d3a3a6a64 100644
--- a/drivers/net/wireless/b43/phy_lp.c
+++ b/drivers/net/wireless/b43/phy_lp.c
@@ -488,7 +488,7 @@ static void b43_lpphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
 }
 
 static void b43_lpphy_op_software_rfkill(struct b43_wldev *dev,
-                                         enum rfkill_state state)
+                                         bool blocked)
 {
         //TODO
 }
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 8bcfda5f3f07..be7b5604947b 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -579,7 +579,7 @@ static void b43_nphy_op_radio_write(struct b43_wldev *dev, u16 reg, u16 value)
 }
 
 static void b43_nphy_op_software_rfkill(struct b43_wldev *dev,
-                                        enum rfkill_state state)
+                                        bool blocked)
 {//TODO
 }
 
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 9e1d00bc24d3..96047843cd56 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -45,12 +45,11 @@ static bool b43_is_hw_radio_enabled(struct b43_wldev *dev)
 }
 
 /* The poll callback for the hardware button. */
-static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
+static void b43_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-        struct b43_wldev *dev = poll_dev->private;
+        struct b43_wldev *dev = data;
         struct b43_wl *wl = dev->wl;
         bool enabled;
-        bool report_change = 0;
 
         mutex_lock(&wl->mutex);
         if (unlikely(b43_status(dev) < B43_STAT_INITIALIZED)) {
@@ -60,68 +59,55 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
         enabled = b43_is_hw_radio_enabled(dev);
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
-                report_change = 1;
                 b43info(wl, "Radio hardware status changed to %s\n",
                         enabled ? "ENABLED" : "DISABLED");
+                enabled = !rfkill_set_hw_state(rfkill, !enabled);
+                if (enabled != dev->phy.radio_on)
+                        b43_software_rfkill(dev, !enabled);
         }
         mutex_unlock(&wl->mutex);
-
-        /* send the radio switch event to the system - note both a key press
-         * and a release are required */
-        if (unlikely(report_change)) {
-                input_report_key(poll_dev->input, KEY_WLAN, 1);
-                input_report_key(poll_dev->input, KEY_WLAN, 0);
-        }
 }
 
 /* Called when the RFKILL toggled in software. */
-static int b43_rfkill_soft_toggle(void *data, enum rfkill_state state)
+static int b43_rfkill_soft_set(void *data, bool blocked)
 {
         struct b43_wldev *dev = data;
         struct b43_wl *wl = dev->wl;
-        int err = -EBUSY;
+        int err = -EINVAL;
 
-        if (!wl->rfkill.registered)
-                return 0;
+        if (WARN_ON(!wl->rfkill.registered))
+                return -EINVAL;
 
         mutex_lock(&wl->mutex);
+
         if (b43_status(dev) < B43_STAT_INITIALIZED)
                 goto out_unlock;
+
+        if (!dev->radio_hw_enable)
+                goto out_unlock;
+
+        if (!blocked != dev->phy.radio_on)
+                b43_software_rfkill(dev, blocked);
         err = 0;
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (!dev->radio_hw_enable) {
-                        /* No luck. We can't toggle the hardware RF-kill
-                         * button from software. */
-                        err = -EBUSY;
-                        goto out_unlock;
-                }
-                if (!dev->phy.radio_on)
-                        b43_software_rfkill(dev, state);
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                if (dev->phy.radio_on)
-                        b43_software_rfkill(dev, state);
-                break;
-        default:
-                b43warn(wl, "Received unexpected rfkill state %d.\n", state);
-                break;
-        }
 out_unlock:
         mutex_unlock(&wl->mutex);
-
         return err;
 }
 
-char *b43_rfkill_led_name(struct b43_wldev *dev)
+const char *b43_rfkill_led_name(struct b43_wldev *dev)
 {
         struct b43_rfkill *rfk = &(dev->wl->rfkill);
 
         if (!rfk->registered)
                 return NULL;
-        return rfkill_get_led_name(rfk->rfkill);
+        return rfkill_get_led_trigger_name(rfk->rfkill);
 }
 
+static const struct rfkill_ops b43_rfkill_ops = {
+        .set_block = b43_rfkill_soft_set,
+        .poll = b43_rfkill_poll,
+};
+
 void b43_rfkill_init(struct b43_wldev *dev)
 {
         struct b43_wl *wl = dev->wl;
@@ -130,65 +116,26 @@ void b43_rfkill_init(struct b43_wldev *dev)
 
         rfk->registered = 0;
 
-        rfk->rfkill = rfkill_allocate(dev->dev->dev, RFKILL_TYPE_WLAN);
-        if (!rfk->rfkill)
-                goto out_error;
         snprintf(rfk->name, sizeof(rfk->name),
                  "b43-%s", wiphy_name(wl->hw->wiphy));
-        rfk->rfkill->name = rfk->name;
-        rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        rfk->rfkill->data = dev;
-        rfk->rfkill->toggle_radio = b43_rfkill_soft_toggle;
-
-        rfk->poll_dev = input_allocate_polled_device();
-        if (!rfk->poll_dev) {
-                rfkill_free(rfk->rfkill);
-                goto err_freed_rfk;
-        }
-
-        rfk->poll_dev->private = dev;
-        rfk->poll_dev->poll = b43_rfkill_poll;
-        rfk->poll_dev->poll_interval = 1000; /* msecs */
 
-        rfk->poll_dev->input->name = rfk->name;
-        rfk->poll_dev->input->id.bustype = BUS_HOST;
-        rfk->poll_dev->input->id.vendor = dev->dev->bus->boardinfo.vendor;
-        rfk->poll_dev->input->evbit[0] = BIT(EV_KEY);
-        set_bit(KEY_WLAN, rfk->poll_dev->input->keybit);
+        rfk->rfkill = rfkill_alloc(rfk->name,
+                                   dev->dev->dev,
+                                   RFKILL_TYPE_WLAN,
+                                   &b43_rfkill_ops, dev);
+        if (!rfk->rfkill)
+                goto out_error;
 
         err = rfkill_register(rfk->rfkill);
         if (err)
-                goto err_free_polldev;
-
-#ifdef CONFIG_RFKILL_INPUT_MODULE
-        /* B43 RF-kill isn't useful without the rfkill-input subsystem.
-         * Try to load the module. */
-        err = request_module("rfkill-input");
-        if (err)
-                b43warn(wl, "Failed to load the rfkill-input module. "
-                        "The built-in radio LED will not work.\n");
-#endif /* CONFIG_RFKILL_INPUT */
-
-#if !defined(CONFIG_RFKILL_INPUT) && !defined(CONFIG_RFKILL_INPUT_MODULE)
-        b43warn(wl, "The rfkill-input subsystem is not available. "
-                "The built-in radio LED will not work.\n");
-#endif
-
-        err = input_register_polled_device(rfk->poll_dev);
-        if (err)
-                goto err_unreg_rfk;
+                goto err_free;
 
         rfk->registered = 1;
 
         return;
-err_unreg_rfk:
-        rfkill_unregister(rfk->rfkill);
-err_free_polldev:
-        input_free_polled_device(rfk->poll_dev);
-        rfk->poll_dev = NULL;
-err_freed_rfk:
-        rfk->rfkill = NULL;
-out_error:
+ err_free:
+        rfkill_destroy(rfk->rfkill);
+ out_error:
         rfk->registered = 0;
         b43warn(wl, "RF-kill button init failed\n");
 }
@@ -201,9 +148,7 @@ void b43_rfkill_exit(struct b43_wldev *dev)
                 return;
         rfk->registered = 0;
 
-        input_unregister_polled_device(rfk->poll_dev);
         rfkill_unregister(rfk->rfkill);
-        input_free_polled_device(rfk->poll_dev);
-        rfk->poll_dev = NULL;
+        rfkill_destroy(rfk->rfkill);
         rfk->rfkill = NULL;
 }
diff --git a/drivers/net/wireless/b43/rfkill.h b/drivers/net/wireless/b43/rfkill.h
index adacf936d815..da497e01bbb1 100644
--- a/drivers/net/wireless/b43/rfkill.h
+++ b/drivers/net/wireless/b43/rfkill.h
@@ -7,14 +7,11 @@ struct b43_wldev;
 #ifdef CONFIG_B43_RFKILL
 
 #include <linux/rfkill.h>
-#include <linux/input-polldev.h>
 
 
 struct b43_rfkill {
         /* The RFKILL subsystem data structure */
         struct rfkill *rfkill;
-        /* The poll device for the RFKILL input button */
-        struct input_polled_dev *poll_dev;
         /* Did initialization succeed? Used for freeing. */
         bool registered;
         /* The unique name of this rfkill switch */
@@ -26,7 +23,7 @@ struct b43_rfkill {
 void b43_rfkill_init(struct b43_wldev *dev);
 void b43_rfkill_exit(struct b43_wldev *dev);
 
-char * b43_rfkill_led_name(struct b43_wldev *dev);
+const char *b43_rfkill_led_name(struct b43_wldev *dev);
 
 
 #else /* CONFIG_B43_RFKILL */
diff --git a/drivers/net/wireless/b43legacy/Kconfig b/drivers/net/wireless/b43legacy/Kconfig
index d4f628a74bbd..6893f439df70 100644
--- a/drivers/net/wireless/b43legacy/Kconfig
+++ b/drivers/net/wireless/b43legacy/Kconfig
@@ -47,7 +47,7 @@ config B43LEGACY_LEDS
 # if it's possible.
 config B43LEGACY_RFKILL
         bool
-        depends on B43LEGACY && (RFKILL = y || RFKILL = B43LEGACY) && RFKILL_INPUT && (INPUT_POLLDEV = y || INPUT_POLLDEV = B43LEGACY)
+        depends on B43LEGACY && (RFKILL = y || RFKILL = B43LEGACY)
         default y
 
 # This config option automatically enables b43 HW-RNG support,
diff --git a/drivers/net/wireless/b43legacy/leds.c b/drivers/net/wireless/b43legacy/leds.c
index 3ea55b18c700..538d3117594b 100644
--- a/drivers/net/wireless/b43legacy/leds.c
+++ b/drivers/net/wireless/b43legacy/leds.c
@@ -86,7 +86,8 @@ static void b43legacy_led_brightness_set(struct led_classdev *led_dev,
 
 static int b43legacy_register_led(struct b43legacy_wldev *dev,
                                   struct b43legacy_led *led,
-                                  const char *name, char *default_trigger,
+                                  const char *name,
+                                  const char *default_trigger,
                                   u8 led_index, bool activelow)
 {
         int err;
diff --git a/drivers/net/wireless/b43legacy/rfkill.c b/drivers/net/wireless/b43legacy/rfkill.c
index 4b0c7d27a51f..c6230a64505a 100644
--- a/drivers/net/wireless/b43legacy/rfkill.c
+++ b/drivers/net/wireless/b43legacy/rfkill.c
@@ -45,12 +45,11 @@ static bool b43legacy_is_hw_radio_enabled(struct b43legacy_wldev *dev)
 }
 
 /* The poll callback for the hardware button. */
-static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
+static void b43legacy_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-        struct b43legacy_wldev *dev = poll_dev->private;
+        struct b43legacy_wldev *dev = data;
         struct b43legacy_wl *wl = dev->wl;
         bool enabled;
-        bool report_change = 0;
 
         mutex_lock(&wl->mutex);
         if (unlikely(b43legacy_status(dev) < B43legacy_STAT_INITIALIZED)) {
@@ -60,71 +59,64 @@ static void b43legacy_rfkill_poll(struct input_polled_dev *poll_dev)
         enabled = b43legacy_is_hw_radio_enabled(dev);
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
-                report_change = 1;
                 b43legacyinfo(wl, "Radio hardware status changed to %s\n",
                         enabled ? "ENABLED" : "DISABLED");
+                enabled = !rfkill_set_hw_state(rfkill, !enabled);
+                if (enabled != dev->phy.radio_on) {
+                        if (enabled)
+                                b43legacy_radio_turn_on(dev);
+                        else
+                                b43legacy_radio_turn_off(dev, 0);
+                }
         }
         mutex_unlock(&wl->mutex);
-
-        /* send the radio switch event to the system - note both a key press
-         * and a release are required */
-        if (unlikely(report_change)) {
-                input_report_key(poll_dev->input, KEY_WLAN, 1);
-                input_report_key(poll_dev->input, KEY_WLAN, 0);
-        }
 }
 
 /* Called when the RFKILL toggled in software.
  * This is called without locking. */
-static int b43legacy_rfkill_soft_toggle(void *data, enum rfkill_state state)
+static int b43legacy_rfkill_soft_set(void *data, bool blocked)
 {
         struct b43legacy_wldev *dev = data;
         struct b43legacy_wl *wl = dev->wl;
-        int err = -EBUSY;
+        int ret = -EINVAL;
 
         if (!wl->rfkill.registered)
-                return 0;
+                return -EINVAL;
 
         mutex_lock(&wl->mutex);
         if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED)
                 goto out_unlock;
-        err = 0;
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (!dev->radio_hw_enable) {
-                        /* No luck. We can't toggle the hardware RF-kill
-                         * button from software. */
-                        err = -EBUSY;
-                        goto out_unlock;
-                }
-                if (!dev->phy.radio_on)
+
+        if (!dev->radio_hw_enable)
+                goto out_unlock;
+
+        if (!blocked != dev->phy.radio_on) {
+                if (!blocked)
                         b43legacy_radio_turn_on(dev);
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                if (dev->phy.radio_on)
+                else
                         b43legacy_radio_turn_off(dev, 0);
-                break;
-        default:
-                b43legacywarn(wl, "Received unexpected rfkill state %d.\n",
-                              state);
-                break;
         }
+        ret = 0;
 
 out_unlock:
         mutex_unlock(&wl->mutex);
-
-        return err;
+        return ret;
 }
 
-char *b43legacy_rfkill_led_name(struct b43legacy_wldev *dev)
+const char *b43legacy_rfkill_led_name(struct b43legacy_wldev *dev)
 {
         struct b43legacy_rfkill *rfk = &(dev->wl->rfkill);
 
         if (!rfk->registered)
                 return NULL;
-        return rfkill_get_led_name(rfk->rfkill);
+        return rfkill_get_led_trigger_name(rfk->rfkill);
 }
 
+static const struct rfkill_ops b43legacy_rfkill_ops = {
+        .set_block = b43legacy_rfkill_soft_set,
+        .poll = b43legacy_rfkill_poll,
+};
+
 void b43legacy_rfkill_init(struct b43legacy_wldev *dev)
 {
         struct b43legacy_wl *wl = dev->wl;
@@ -133,60 +125,25 @@ void b43legacy_rfkill_init(struct b43legacy_wldev *dev)
 
         rfk->registered = 0;
 
-        rfk->rfkill = rfkill_allocate(dev->dev->dev, RFKILL_TYPE_WLAN);
-        if (!rfk->rfkill)
-                goto out_error;
         snprintf(rfk->name, sizeof(rfk->name),
                  "b43legacy-%s", wiphy_name(wl->hw->wiphy));
-        rfk->rfkill->name = rfk->name;
-        rfk->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        rfk->rfkill->data = dev;
-        rfk->rfkill->toggle_radio = b43legacy_rfkill_soft_toggle;
-
-        rfk->poll_dev = input_allocate_polled_device();
-        if (!rfk->poll_dev) {
-                rfkill_free(rfk->rfkill);
-                goto err_freed_rfk;
-        }
-
-        rfk->poll_dev->private = dev;
-        rfk->poll_dev->poll = b43legacy_rfkill_poll;
-        rfk->poll_dev->poll_interval = 1000; /* msecs */
-
-        rfk->poll_dev->input->name = rfk->name;
-        rfk->poll_dev->input->id.bustype = BUS_HOST;
-        rfk->poll_dev->input->id.vendor = dev->dev->bus->boardinfo.vendor;
-        rfk->poll_dev->input->evbit[0] = BIT(EV_KEY);
-        set_bit(KEY_WLAN, rfk->poll_dev->input->keybit);
+        rfk->rfkill = rfkill_alloc(rfk->name,
+                                   dev->dev->dev,
+                                   RFKILL_TYPE_WLAN,
+                                   &b43legacy_rfkill_ops, dev);
+        if (!rfk->rfkill)
+                goto out_error;
 
         err = rfkill_register(rfk->rfkill);
         if (err)
-                goto err_free_polldev;
-
-#ifdef CONFIG_RFKILL_INPUT_MODULE
-        /* B43legacy RF-kill isn't useful without the rfkill-input subsystem.
-         * Try to load the module. */
-        err = request_module("rfkill-input");
-        if (err)
-                b43legacywarn(wl, "Failed to load the rfkill-input module."
-                        "The built-in radio LED will not work.\n");
-#endif /* CONFIG_RFKILL_INPUT */
-
-        err = input_register_polled_device(rfk->poll_dev);
-        if (err)
-                goto err_unreg_rfk;
+                goto err_free;
 
         rfk->registered = 1;
 
         return;
-err_unreg_rfk:
-        rfkill_unregister(rfk->rfkill);
-err_free_polldev:
-        input_free_polled_device(rfk->poll_dev);
-        rfk->poll_dev = NULL;
-err_freed_rfk:
-        rfk->rfkill = NULL;
-out_error:
+ err_free:
+        rfkill_destroy(rfk->rfkill);
+ out_error:
         rfk->registered = 0;
         b43legacywarn(wl, "RF-kill button init failed\n");
 }
@@ -199,10 +156,8 @@ void b43legacy_rfkill_exit(struct b43legacy_wldev *dev)
                 return;
         rfk->registered = 0;
 
-        input_unregister_polled_device(rfk->poll_dev);
         rfkill_unregister(rfk->rfkill);
-        input_free_polled_device(rfk->poll_dev);
-        rfk->poll_dev = NULL;
+        rfkill_destroy(rfk->rfkill);
         rfk->rfkill = NULL;
 }
 
diff --git a/drivers/net/wireless/b43legacy/rfkill.h b/drivers/net/wireless/b43legacy/rfkill.h
index 11150a8032f0..adffc503a6a1 100644
--- a/drivers/net/wireless/b43legacy/rfkill.h
+++ b/drivers/net/wireless/b43legacy/rfkill.h
@@ -6,16 +6,12 @@ struct b43legacy_wldev;
 #ifdef CONFIG_B43LEGACY_RFKILL
 
 #include <linux/rfkill.h>
-#include <linux/workqueue.h>
-#include <linux/input-polldev.h>
 
 
 
 struct b43legacy_rfkill {
         /* The RFKILL subsystem data structure */
         struct rfkill *rfkill;
-        /* The poll device for the RFKILL input button */
-        struct input_polled_dev *poll_dev;
         /* Did initialization succeed? Used for freeing. */
         bool registered;
         /* The unique name of this rfkill switch */
@@ -27,7 +23,7 @@ struct b43legacy_rfkill {
 void b43legacy_rfkill_init(struct b43legacy_wldev *dev);
 void b43legacy_rfkill_exit(struct b43legacy_wldev *dev);
 
-char *b43legacy_rfkill_led_name(struct b43legacy_wldev *dev);
+const char *b43legacy_rfkill_led_name(struct b43legacy_wldev *dev);
 
 
 #else /* CONFIG_B43LEGACY_RFKILL */
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 8304f6406a17..6fe259fcfb8f 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -5,15 +5,14 @@ config IWLWIFI
         select FW_LOADER
         select MAC80211_LEDS if IWLWIFI_LEDS
         select LEDS_CLASS if IWLWIFI_LEDS
-        select RFKILL if IWLWIFI_RFKILL
 
 config IWLWIFI_LEDS
         bool "Enable LED support in iwlagn and iwl3945 drivers"
         depends on IWLWIFI
 
 config IWLWIFI_RFKILL
-        bool "Enable RF kill support in iwlagn and iwl3945 drivers"
-        depends on IWLWIFI
+        def_bool y
+        depends on IWLWIFI && RFKILL
 
 config IWLWIFI_SPECTRUM_MEASUREMENT
         bool "Enable Spectrum Measurement in iwlagn driver"
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-led.c b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
index bd7e520d98c2..225e5f889346 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-led.c
@@ -167,10 +167,6 @@ static int iwl3945_led_disassociate(struct iwl_priv *priv, int led_id)
         IWL_DEBUG_LED(priv, "Disassociated\n");
 
         priv->allow_blinking = 0;
-        if (iwl_is_rfkill(priv))
-                iwl3945_led_off(priv, led_id);
-        else
-                iwl3945_led_on(priv, led_id);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index 814afaf6d10b..5eb538d18a80 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -38,6 +38,7 @@
 
 #include "iwl-commands.h"
 #include "iwl-3945.h"
+#include "iwl-sta.h"
 
 #define RS_NAME "iwl-3945-rs"
 
@@ -714,13 +715,13 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta,
 
         if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
             !rs_sta->ibss_sta_added) {
-                u8 sta_id = iwl3945_hw_find_station(priv, hdr->addr1);
+                u8 sta_id = iwl_find_station(priv, hdr->addr1);
 
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pm\n",
                                        hdr->addr1);
-                        sta_id = iwl3945_add_station(priv,
-                                    hdr->addr1, 0, CMD_ASYNC, NULL);
+                        sta_id = iwl_add_station(priv, hdr->addr1, false,
+                                CMD_ASYNC, NULL);
                 }
                 if (sta_id != IWL_INVALID_STATION)
                         rs_sta->ibss_sta_added = 1;
@@ -975,7 +976,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
 
         rcu_read_lock();
 
-        sta = ieee80211_find_sta(hw, priv->stations_39[sta_id].sta.sta.addr);
+        sta = ieee80211_find_sta(hw, priv->stations[sta_id].sta.sta.addr);
         if (!sta) {
                 rcu_read_unlock();
                 return;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index fd65e1c3e055..46288e724889 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -769,35 +769,6 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
         return ;
 }
 
-u8 iwl3945_hw_find_station(struct iwl_priv *priv, const u8 *addr)
-{
-        int i, start = IWL_AP_ID;
-        int ret = IWL_INVALID_STATION;
-        unsigned long flags;
-
-        if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) ||
-            (priv->iw_mode == NL80211_IFTYPE_AP))
-                start = IWL_STA_ID;
-
-        if (is_broadcast_ether_addr(addr))
-                return priv->hw_params.bcast_sta_id;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        for (i = start; i < priv->hw_params.max_stations; i++)
-                if ((priv->stations_39[i].used) &&
-                    (!compare_ether_addr
-                     (priv->stations_39[i].sta.sta.addr, addr))) {
-                        ret = i;
-                        goto out;
-                }
-
-        IWL_DEBUG_INFO(priv, "can not find STA %pM (total %d)\n",
-                       addr, priv->num_stations);
- out:
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return ret;
-}
-
 /**
  * iwl3945_hw_build_tx_cmd_rate - Add rate portion to TX_CMD:
  *
@@ -875,13 +846,13 @@ void iwl3945_hw_build_tx_cmd_rate(struct iwl_priv *priv, struct iwl_cmd *cmd,
 u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
 {
         unsigned long flags_spin;
-        struct iwl3945_station_entry *station;
+        struct iwl_station_entry *station;
 
         if (sta_id == IWL_INVALID_STATION)
                 return IWL_INVALID_STATION;
 
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
-        station = &priv->stations_39[sta_id];
+        station = &priv->stations[sta_id];
 
         station->sta.sta.modify_mask = STA_MODIFY_TX_RATE_MSK;
         station->sta.rate_n_flags = cpu_to_le16(tx_rate);
@@ -889,8 +860,7 @@ u8 iwl3945_sync_sta(struct iwl_priv *priv, int sta_id, u16 tx_rate, u8 flags)
 
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
-        iwl_send_add_sta(priv,
-                         (struct iwl_addsta_cmd *)&station->sta, flags);
+        iwl_send_add_sta(priv, &station->sta, flags);
         IWL_DEBUG_RATE(priv, "SCALE sync station %d to rate %d\n",
                         sta_id, tx_rate);
         return sta_id;
@@ -2029,7 +1999,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
 
         memcpy(active_rxon, staging_rxon, sizeof(*active_rxon));
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         /* If we issue a new RXON command which required a tune then we must
          * send a new TXPOWER command or we won't be able to Tx any frames */
@@ -2040,7 +2010,7 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
         }
 
         /* Add the broadcast address so we can send broadcast frames */
-        if (priv->cfg->ops->smgmt->add_station(priv, iwl_bcast_addr, 0, 0, NULL) ==
+        if (iwl_add_station(priv, iwl_bcast_addr, false, CMD_SYNC, NULL) ==
             IWL_INVALID_STATION) {
                 IWL_ERR(priv, "Error adding BROADCAST address for transmit.\n");
                 return -EIO;
@@ -2050,9 +2020,8 @@ static int iwl3945_commit_rxon(struct iwl_priv *priv)
          * add the IWL_AP_ID to the station rate table */
         if (iwl_is_associated(priv) &&
             (priv->iw_mode == NL80211_IFTYPE_STATION))
-                if (priv->cfg->ops->smgmt->add_station(priv,
-                                        priv->active_rxon.bssid_addr, 1, 0, NULL)
-                    == IWL_INVALID_STATION) {
+                if (iwl_add_station(priv, priv->active_rxon.bssid_addr,
+                                true, CMD_SYNC, NULL) == IWL_INVALID_STATION) {
                         IWL_ERR(priv, "Error adding AP address for transmit\n");
                         return -EIO;
                 }
@@ -2466,13 +2435,25 @@ static u16 iwl3945_get_hcmd_size(u8 cmd_id, u16 len)
         }
 }
 
+
 static u16 iwl3945_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
 {
-        u16 size = (u16)sizeof(struct iwl3945_addsta_cmd);
-        memcpy(data, cmd, size);
-        return size;
+        struct iwl3945_addsta_cmd *addsta = (struct iwl3945_addsta_cmd *)data;
+        addsta->mode = cmd->mode;
+        memcpy(&addsta->sta, &cmd->sta, sizeof(struct sta_id_modify));
+        memcpy(&addsta->key, &cmd->key, sizeof(struct iwl4965_keyinfo));
+        addsta->station_flags = cmd->station_flags;
+        addsta->station_flags_msk = cmd->station_flags_msk;
+        addsta->tid_disable_tx = cpu_to_le16(0);
+        addsta->rate_n_flags = cmd->rate_n_flags;
+        addsta->add_immediate_ba_tid = cmd->add_immediate_ba_tid;
+        addsta->remove_immediate_ba_tid = cmd->remove_immediate_ba_tid;
+        addsta->add_immediate_ba_ssn = cmd->add_immediate_ba_ssn;
+
+        return (u16)sizeof(struct iwl3945_addsta_cmd);
 }
 
+
 /**
  * iwl3945_init_hw_rate_table - Initialize the hardware rate fallback table
  */
@@ -2842,15 +2823,6 @@ static struct iwl_lib_ops iwl3945_lib = {
         .config_ap = iwl3945_config_ap,
 };
 
-static struct iwl_station_mgmt_ops iwl3945_station_mgmt = {
-        .add_station = iwl3945_add_station,
-#if 0
-        .remove_station = iwl3945_remove_station,
-#endif
-        .find_station = iwl3945_hw_find_station,
-        .clear_station_table = iwl3945_clear_stations_table,
-};
-
 static struct iwl_hcmd_utils_ops iwl3945_hcmd_utils = {
         .get_hcmd_size = iwl3945_get_hcmd_size,
         .build_addsta_hcmd = iwl3945_build_addsta_hcmd,
@@ -2860,7 +2832,6 @@ static struct iwl_ops iwl3945_ops = {
         .lib = &iwl3945_lib,
         .hcmd = &iwl3945_hcmd,
         .utils = &iwl3945_hcmd_utils,
-        .smgmt = &iwl3945_station_mgmt,
 };
 
 static struct iwl_cfg iwl3945_bg_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index da87528f355f..4d8a325ea9d8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -202,12 +202,6 @@ struct iwl3945_ibss_seq {
  * for use by iwl-*.c
  *
  *****************************************************************************/
-struct iwl3945_addsta_cmd;
-extern int iwl3945_send_add_station(struct iwl_priv *priv,
-                                struct iwl3945_addsta_cmd *sta, u8 flags);
-extern u8 iwl3945_add_station(struct iwl_priv *priv, const u8 *bssid,
-                          int is_ap, u8 flags, struct ieee80211_sta_ht_cap *ht_info);
-extern void iwl3945_clear_stations_table(struct iwl_priv *priv);
 extern int iwl3945_power_init_handle(struct iwl_priv *priv);
 extern int iwl3945_eeprom_init(struct iwl_priv *priv);
 extern int iwl3945_calc_db_from_ratio(int sig_ratio);
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index a0b29411a4b3..8f3d4bc6a03f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2221,13 +2221,6 @@ static void iwl4965_cancel_deferred_work(struct iwl_priv *priv)
         cancel_work_sync(&priv->txpower_work);
 }
 
-static struct iwl_station_mgmt_ops iwl4965_station_mgmt = {
-        .add_station = iwl_add_station_flags,
-        .remove_station = iwl_remove_station,
-        .find_station = iwl_find_station,
-        .clear_station_table = iwl_clear_stations_table,
-};
-
 static struct iwl_hcmd_ops iwl4965_hcmd = {
         .rxon_assoc = iwl4965_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
@@ -2297,7 +2290,6 @@ static struct iwl_ops iwl4965_ops = {
         .lib = &iwl4965_lib,
         .hcmd = &iwl4965_hcmd,
         .utils = &iwl4965_hcmd_utils,
-        .smgmt = &iwl4965_station_mgmt,
 };
 
 struct iwl_cfg iwl4965_agn_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index ab29aab6b2d5..b3c648ce8c7b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -651,7 +651,7 @@ static void iwl5000_init_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
         ret = priv->cfg->ops->lib->alive_notify(priv);
         if (ret) {
                 IWL_WARN(priv,
@@ -1049,7 +1049,10 @@ static int iwl5000_txq_agg_disable(struct iwl_priv *priv, u16 txq_id,
 u16 iwl5000_build_addsta_hcmd(const struct iwl_addsta_cmd *cmd, u8 *data)
 {
         u16 size = (u16)sizeof(struct iwl_addsta_cmd);
-        memcpy(data, cmd, size);
+        struct iwl_addsta_cmd *addsta = (struct iwl_addsta_cmd *)data;
+        memcpy(addsta, cmd, size);
+        /* resrved in 5000 */
+        addsta->rate_n_flags = cpu_to_le16(0);
         return size;
 }
 
@@ -1423,13 +1426,6 @@ int iwl5000_calc_rssi(struct iwl_priv *priv,
         return max_rssi - agc - IWL49_RSSI_OFFSET;
 }
 
-struct iwl_station_mgmt_ops iwl5000_station_mgmt = {
-        .add_station = iwl_add_station_flags,
-        .remove_station = iwl_remove_station,
-        .find_station = iwl_find_station,
-        .clear_station_table = iwl_clear_stations_table,
-};
-
 struct iwl_hcmd_ops iwl5000_hcmd = {
         .rxon_assoc = iwl5000_send_rxon_assoc,
         .commit_rxon = iwl_commit_rxon,
@@ -1549,14 +1545,12 @@ struct iwl_ops iwl5000_ops = {
         .lib = &iwl5000_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl5000_hcmd_utils,
-        .smgmt = &iwl5000_station_mgmt,
 };
 
 static struct iwl_ops iwl5150_ops = {
         .lib = &iwl5150_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl5000_hcmd_utils,
-        .smgmt = &iwl5000_station_mgmt,
 };
 
 struct iwl_mod_params iwl50_mod_params = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 7236382aeaa6..bd438d8acf55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -72,7 +72,6 @@ static struct iwl_ops iwl6000_ops = {
         .lib = &iwl5000_lib,
         .hcmd = &iwl5000_hcmd,
         .utils = &iwl6000_hcmd_utils,
-        .smgmt = &iwl5000_station_mgmt,
 };
 
 struct iwl_cfg iwl6000_2ag_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 23a58b00f180..ff20e5048a55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -2502,15 +2502,13 @@ static void rs_get_rate(void *priv_r, struct ieee80211_sta *sta, void *priv_sta,
 
         if ((priv->iw_mode == NL80211_IFTYPE_ADHOC) &&
             !lq_sta->ibss_sta_added) {
-                u8 sta_id = priv->cfg->ops->smgmt->find_station(priv,
-                                                   hdr->addr1);
+                u8 sta_id = iwl_find_station(priv, hdr->addr1);
 
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n",
                                        hdr->addr1);
-                        sta_id = priv->cfg->ops->smgmt->add_station(priv,
-                                                hdr->addr1, 0,
-                                                CMD_ASYNC, NULL);
+                        sta_id = iwl_add_station(priv, hdr->addr1,
+                                                false, CMD_ASYNC, NULL);
                 }
                 if ((sta_id != IWL_INVALID_STATION)) {
                         lq_sta->lq.sta_id = sta_id;
@@ -2598,7 +2596,7 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
 
         lq_sta->ibss_sta_added = 0;
         if (priv->iw_mode == NL80211_IFTYPE_AP) {
-                u8 sta_id = priv->cfg->ops->smgmt->find_station(priv,
+                u8 sta_id = iwl_find_station(priv,
                                                                 sta->addr);
 
                 /* for IBSS the call are from tasklet */
@@ -2606,9 +2604,8 @@ static void rs_rate_init(void *priv_r, struct ieee80211_supported_band *sband,
 
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_RATE(priv, "LQ: ADD station %pM\n", sta->addr);
-                        sta_id = priv->cfg->ops->smgmt->add_station(priv,
-                                                        sta->addr, 0,
-                                                        CMD_ASYNC, NULL);
+                        sta_id = iwl_add_station(priv, sta->addr, false,
+                                                CMD_ASYNC, NULL);
                 }
                 if ((sta_id != IWL_INVALID_STATION)) {
                         lq_sta->lq.sta_id = sta_id;
@@ -2790,9 +2787,10 @@ static void rs_fill_link_cmd(const struct iwl_priv *priv,
                 repeat_rate--;
         }
 
-        lq_cmd->agg_params.agg_frame_cnt_limit = 64;
-        lq_cmd->agg_params.agg_dis_start_th = 3;
-        lq_cmd->agg_params.agg_time_limit = cpu_to_le16(4000);
+        lq_cmd->agg_params.agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_MAX;
+        lq_cmd->agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        lq_cmd->agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0a5507cbeb3f..b77208de92ad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -188,7 +188,7 @@ int iwl_commit_rxon(struct iwl_priv *priv)
                 memcpy(active_rxon, &priv->staging_rxon, sizeof(*active_rxon));
         }
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         priv->start_calib = 0;
 
@@ -1617,7 +1617,7 @@ static void iwl_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
         ret = priv->cfg->ops->lib->alive_notify(priv);
         if (ret) {
                 IWL_WARN(priv,
@@ -1703,7 +1703,7 @@ static void __iwl_down(struct iwl_priv *priv)
 
         iwl_leds_unregister(priv);
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -1887,8 +1887,6 @@ static int __iwl_up(struct iwl_priv *priv)
 
         /* clear (again), then enable host interrupts */
         iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
-        /* enable dram interrupt */
-        iwl_reset_ict(priv);
         iwl_enable_interrupts(priv);
 
         /* really make sure rfkill handshake bits are cleared */
@@ -1903,7 +1901,7 @@ static int __iwl_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                priv->cfg->ops->smgmt->clear_station_table(priv);
+                iwl_clear_stations_table(priv);
 
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
@@ -1962,6 +1960,9 @@ static void iwl_bg_alive_start(struct work_struct *data)
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
+        /* enable dram interrupt */
+        iwl_reset_ict(priv);
+
         mutex_lock(&priv->mutex);
         iwl_alive_start(priv);
         mutex_unlock(&priv->mutex);
@@ -2348,7 +2349,7 @@ static int iwl_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 return -EOPNOTSUPP;
         }
         addr = sta ? sta->addr : iwl_bcast_addr;
-        sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                    addr);
@@ -3121,7 +3122,7 @@ static void __devexit iwl_pci_remove(struct pci_dev *pdev)
                 iwl_rx_queue_free(priv, &priv->rxq);
         iwl_hw_txq_ctx_free(priv);
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
         iwl_eeprom_free(priv);
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index e581dc323f0a..c87033bf3ad2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -1067,7 +1067,7 @@ struct iwl_addsta_cmd {
          * Set modify_mask bit STA_MODIFY_TID_DISABLE_TX to use this field. */
         __le16 tid_disable_tx;
 
-        __le16  reserved1;
+        __le16  rate_n_flags;           /* 3945 only */
 
         /* TID for which to add block-ack support.
          * Set modify_mask bit STA_MODIFY_ADDBA_TID_MSK to use this field. */
@@ -1913,6 +1913,18 @@ struct iwl_link_qual_general_params {
         u8 start_rate_index[LINK_QUAL_AC_NUM];
 } __attribute__ ((packed));
 
+#define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
+#define LINK_QUAL_AGG_TIME_LIMIT_MAX    (65535)
+#define LINK_QUAL_AGG_TIME_LIMIT_MIN    (0)
+
+#define LINK_QUAL_AGG_DISABLE_START_DEF (3)
+#define LINK_QUAL_AGG_DISABLE_START_MAX (255)
+#define LINK_QUAL_AGG_DISABLE_START_MIN (0)
+
+#define LINK_QUAL_AGG_FRAME_LIMIT_DEF   (31)
+#define LINK_QUAL_AGG_FRAME_LIMIT_MAX   (64)
+#define LINK_QUAL_AGG_FRAME_LIMIT_MIN   (0)
+
 /**
  * struct iwl_link_qual_agg_params
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index e93ddb74457e..51cae4ec26a5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -1389,7 +1389,7 @@ int iwl_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
 
         /* Clear the driver's (not device's) station table */
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
@@ -1704,8 +1704,9 @@ static irqreturn_t iwl_isr(int irq, void *data)
 {
         struct iwl_priv *priv = data;
         u32 inta, inta_mask;
+#ifdef CONFIG_IWLWIFI_DEBUG
         u32 inta_fh;
-
+#endif
         if (!priv)
                 return IRQ_NONE;
 
@@ -2679,19 +2680,12 @@ int iwl_set_mode(struct iwl_priv *priv, int mode)
 
         memcpy(priv->staging_rxon.node_addr, priv->mac_addr, ETH_ALEN);
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         /* dont commit rxon if rf-kill is on*/
         if (!iwl_is_ready_rf(priv))
                 return -EAGAIN;
 
-        cancel_delayed_work(&priv->scan_check);
-        if (iwl_scan_cancel_timeout(priv, 100)) {
-                IWL_WARN(priv, "Aborted scan still in progress after 100ms\n");
-                IWL_DEBUG_MAC80211(priv, "leaving - scan abort failed.\n");
-                return -EAGAIN;
-        }
-
         iwlcore_commit_rxon(priv);
 
         return 0;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 87df1b767941..b52d0fb16060 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -83,15 +83,6 @@ struct iwl_cmd;
 #define IWL_SKU_A       0x2
 #define IWL_SKU_N       0x8
 
-struct iwl_station_mgmt_ops {
-        u8 (*add_station)(struct iwl_priv *priv, const u8 *addr,
-                        int is_ap, u8 flags, struct ieee80211_sta_ht_cap *ht_info);
-        int (*remove_station)(struct iwl_priv *priv, const u8 *addr,
-                        int is_ap);
-        u8 (*find_station)(struct iwl_priv *priv, const u8 *addr);
-        void (*clear_station_table)(struct iwl_priv *priv);
-};
-
 struct iwl_hcmd_ops {
         int (*rxon_assoc)(struct iwl_priv *priv);
         int (*commit_rxon)(struct iwl_priv *priv);
@@ -183,7 +174,6 @@ struct iwl_ops {
         const struct iwl_lib_ops *lib;
         const struct iwl_hcmd_ops *hcmd;
         const struct iwl_hcmd_utils_ops *utils;
-        const struct iwl_station_mgmt_ops *smgmt;
 };
 
 struct iwl_mod_params {
@@ -192,7 +182,7 @@ struct iwl_mod_params {
         int disable_hw_scan;    /* def: 0 = use h/w scan */
         int num_of_queues;      /* def: HW dependent */
         int num_of_ampdu_queues;/* def: HW dependent */
-        int disable_11n;        /* def: 0 = disable 11n capabilities */
+        int disable_11n;        /* def: 0 = 11n capabilities enabled */
         int amsdu_size_8K;      /* def: 1 = enable 8K amsdu size */
         int antenna;            /* def: 0 = both antennas (use diversity) */
         int restart_fw;         /* def: 1 = restart firmware */
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 2dafc26fb6a8..28c39cf8b126 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -70,7 +70,6 @@ extern struct iwl_ops iwl5000_ops;
 extern struct iwl_lib_ops iwl5000_lib;
 extern struct iwl_hcmd_ops iwl5000_hcmd;
 extern struct iwl_hcmd_utils_ops iwl5000_hcmd_utils;
-extern struct iwl_station_mgmt_ops iwl5000_station_mgmt;
 
 /* shared functions from iwl-5000.c */
 extern u16 iwl5000_get_hcmd_size(u8 cmd_id, u16 len);
@@ -290,11 +289,11 @@ struct iwl_frame {
 #define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
 
 enum {
-        /* CMD_SIZE_NORMAL = 0, */
+        CMD_SYNC = 0,
+        CMD_SIZE_NORMAL = 0,
+        CMD_NO_SKB = 0,
         CMD_SIZE_HUGE = (1 << 0),
-        /* CMD_SYNC = 0, */
         CMD_ASYNC = (1 << 1),
-        /* CMD_NO_SKB = 0, */
         CMD_WANT_SKB = (1 << 2),
 };
 
@@ -1119,8 +1118,6 @@ struct iwl_priv {
 
         struct iwl3945_notif_statistics statistics_39;
 
-        struct iwl3945_station_entry stations_39[IWL_STATION_COUNT];
-
         u32 sta_supp_rates;
 }; /*iwl_priv */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
index cefa501e5971..7d7554a2f341 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -240,13 +240,11 @@ static int iwl_init_otp_access(struct iwl_priv *priv)
         if (ret < 0)
                 IWL_ERR(priv, "Time out access OTP\n");
         else {
-                if (!ret) {
-                        iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
-                                          APMG_PS_CTRL_VAL_RESET_REQ);
-                        udelay(5);
-                        iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
-                                            APMG_PS_CTRL_VAL_RESET_REQ);
-                }
+                iwl_set_bits_prph(priv, APMG_PS_CTRL_REG,
+                                  APMG_PS_CTRL_VAL_RESET_REQ);
+                udelay(5);
+                iwl_clear_bits_prph(priv, APMG_PS_CTRL_REG,
+                                    APMG_PS_CTRL_VAL_RESET_REQ);
         }
         return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-led.c b/drivers/net/wireless/iwlwifi/iwl-led.c
index 19680f72087f..5e64252f80f6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-led.c
+++ b/drivers/net/wireless/iwlwifi/iwl-led.c
@@ -176,10 +176,6 @@ static int iwl_led_associate(struct iwl_priv *priv, int led_id)
 static int iwl_led_disassociate(struct iwl_priv *priv, int led_id)
 {
         priv->allow_blinking = 0;
-        if (iwl_is_rfkill(priv))
-                iwl4965_led_off_reg(priv, led_id);
-        else
-                iwl4965_led_on_reg(priv, led_id);
 
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-rfkill.c b/drivers/net/wireless/iwlwifi/iwl-rfkill.c
index 65605ad44e4b..13149936fd26 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rfkill.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rfkill.c
@@ -36,42 +36,37 @@
 #include "iwl-core.h"
 
 /* software rf-kill from user */
-static int iwl_rfkill_soft_rf_kill(void *data, enum rfkill_state state)
+static int iwl_rfkill_soft_rf_kill(void *data, bool blocked)
 {
         struct iwl_priv *priv = data;
-        int err = 0;
 
         if (!priv->rfkill)
-                return 0;
+                return -EINVAL;
 
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return 0;
 
-        IWL_DEBUG_RF_KILL(priv, "we received soft RFKILL set to state %d\n", state);
+        IWL_DEBUG_RF_KILL(priv, "received soft RFKILL: block=%d\n", blocked);
+
         mutex_lock(&priv->mutex);
 
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (iwl_is_rfkill_hw(priv)) {
-                        err = -EBUSY;
-                        goto out_unlock;
-                }
+        if (iwl_is_rfkill_hw(priv))
+                goto out_unlock;
+
+        if (!blocked)
                 iwl_radio_kill_sw_enable_radio(priv);
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
+        else
                 iwl_radio_kill_sw_disable_radio(priv);
-                break;
-        default:
-                IWL_WARN(priv, "we received unexpected RFKILL state %d\n",
-                        state);
-                break;
-        }
+
 out_unlock:
         mutex_unlock(&priv->mutex);
-
-        return err;
+        return 0;
 }
 
+static const struct rfkill_ops iwl_rfkill_ops = {
+        .set_block = iwl_rfkill_soft_rf_kill,
+};
+
 int iwl_rfkill_init(struct iwl_priv *priv)
 {
         struct device *device = wiphy_dev(priv->hw->wiphy);
@@ -80,21 +75,16 @@ int iwl_rfkill_init(struct iwl_priv *priv)
         BUG_ON(device == NULL);
 
         IWL_DEBUG_RF_KILL(priv, "Initializing RFKILL.\n");
-        priv->rfkill = rfkill_allocate(device, RFKILL_TYPE_WLAN);
+        priv->rfkill = rfkill_alloc(priv->cfg->name,
+                                    device,
+                                    RFKILL_TYPE_WLAN,
+                                    &iwl_rfkill_ops, priv);
         if (!priv->rfkill) {
                 IWL_ERR(priv, "Unable to allocate RFKILL device.\n");
                 ret = -ENOMEM;
                 goto error;
         }
 
-        priv->rfkill->name = priv->cfg->name;
-        priv->rfkill->data = priv;
-        priv->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        priv->rfkill->toggle_radio = iwl_rfkill_soft_rf_kill;
-
-        priv->rfkill->dev.class->suspend = NULL;
-        priv->rfkill->dev.class->resume = NULL;
-
         ret = rfkill_register(priv->rfkill);
         if (ret) {
                 IWL_ERR(priv, "Unable to register RFKILL: %d\n", ret);
@@ -102,11 +92,10 @@ int iwl_rfkill_init(struct iwl_priv *priv)
         }
 
         IWL_DEBUG_RF_KILL(priv, "RFKILL initialization complete.\n");
-        return ret;
+        return 0;
 
 free_rfkill:
-        if (priv->rfkill != NULL)
-                rfkill_free(priv->rfkill);
+        rfkill_destroy(priv->rfkill);
         priv->rfkill = NULL;
 
 error:
@@ -118,8 +107,10 @@ EXPORT_SYMBOL(iwl_rfkill_init);
 void iwl_rfkill_unregister(struct iwl_priv *priv)
 {
 
-        if (priv->rfkill)
+        if (priv->rfkill) {
                 rfkill_unregister(priv->rfkill);
+                rfkill_destroy(priv->rfkill);
+        }
 
         priv->rfkill = NULL;
 }
@@ -131,14 +122,10 @@ void iwl_rfkill_set_hw_state(struct iwl_priv *priv)
         if (!priv->rfkill)
                 return;
 
-        if (iwl_is_rfkill_hw(priv)) {
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_HARD_BLOCKED);
-                return;
-        }
-
-        if (!iwl_is_rfkill_sw(priv))
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_UNBLOCKED);
+        if (rfkill_set_hw_state(priv->rfkill,
+                                !!iwl_is_rfkill_hw(priv)))
+                iwl_radio_kill_sw_disable_radio(priv);
         else
-                rfkill_force_state(priv->rfkill, RFKILL_STATE_SOFT_BLOCKED);
+                iwl_radio_kill_sw_enable_radio(priv);
 }
 EXPORT_SYMBOL(iwl_rfkill_set_hw_state);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 0eb939c40ac1..2addf735b193 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -75,7 +75,7 @@ int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
                 return IWL_AP_ID;
         } else {
                 u8 *da = ieee80211_get_DA(hdr);
-                return priv->cfg->ops->smgmt->find_station(priv, da);
+                return iwl_find_station(priv, da);
         }
 }
 EXPORT_SYMBOL(iwl_get_ra_sta_id);
@@ -86,8 +86,7 @@ static void iwl_sta_ucode_activate(struct iwl_priv *priv, u8 sta_id)
 
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE) &&
-            !(priv->stations_39[sta_id].used & IWL_STA_DRIVER_ACTIVE))
+        if (!(priv->stations[sta_id].used & IWL_STA_DRIVER_ACTIVE))
                 IWL_ERR(priv, "ACTIVATE a non DRIVER active station %d\n",
                         sta_id);
 
@@ -228,15 +227,16 @@ static void iwl_set_ht_add_station(struct iwl_priv *priv, u8 index,
 }
 
 /**
- * iwl_add_station_flags - Add station to tables in driver and device
+ * iwl_add_station - Add station to tables in driver and device
  */
-u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
-                         u8 flags, struct ieee80211_sta_ht_cap *ht_info)
+u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
+                struct ieee80211_sta_ht_cap *ht_info)
 {
-        int i;
-        int sta_id = IWL_INVALID_STATION;
         struct iwl_station_entry *station;
         unsigned long flags_spin;
+        int i;
+        int sta_id = IWL_INVALID_STATION;
+        u16 rate;
 
         spin_lock_irqsave(&priv->sta_lock, flags_spin);
         if (is_ap)
@@ -288,6 +288,12 @@ u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
             priv->iw_mode != NL80211_IFTYPE_ADHOC)
                 iwl_set_ht_add_station(priv, sta_id, ht_info);
 
+        /* 3945 only */
+        rate = (priv->band == IEEE80211_BAND_5GHZ) ?
+                IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP;
+        /* Turn on both antennas for the station... */
+        station->sta.rate_n_flags = cpu_to_le16(rate | RATE_MCS_ANT_AB_MSK);
+
         spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
 
         /* Add station to device's station table */
@@ -295,12 +301,12 @@ u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr, int is_ap,
         return sta_id;
 
 }
-EXPORT_SYMBOL(iwl_add_station_flags);
+EXPORT_SYMBOL(iwl_add_station);
 
 static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
 {
         unsigned long flags;
-        u8 sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        u8 sta_id = iwl_find_station(priv, addr);
 
         BUG_ON(sta_id == IWL_INVALID_STATION);
 
@@ -408,7 +414,7 @@ static int iwl_send_remove_station(struct iwl_priv *priv, const u8 *addr,
 /**
  * iwl_remove_station - Remove driver's knowledge of station.
  */
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
+int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         int sta_id = IWL_INVALID_STATION;
         int i, ret = -EINVAL;
@@ -767,7 +773,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
         unsigned long flags;
         int i;
 
-        sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                    addr);
@@ -946,7 +952,7 @@ EXPORT_SYMBOL(iwl_send_lq_cmd);
  *       calling this function (which runs REPLY_TX_LINK_QUALITY_CMD,
  *       which requires station table entry to exist).
  */
-static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
+static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         int i, r;
         struct iwl_link_quality_cmd link_cmd = {
@@ -979,8 +985,9 @@ static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
         link_cmd.general_params.single_stream_ant_msk =
                                 first_antenna(priv->hw_params.valid_tx_ant);
         link_cmd.general_params.dual_stream_ant_msk = 3;
-        link_cmd.agg_params.agg_dis_start_th = 3;
-        link_cmd.agg_params.agg_time_limit = cpu_to_le16(4000);
+        link_cmd.agg_params.agg_dis_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
+        link_cmd.agg_params.agg_time_limit =
+                cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
 
         /* Update the rate scaling for control frame Tx to AP */
         link_cmd.sta_id = is_ap ? IWL_AP_ID : priv->hw_params.bcast_sta_id;
@@ -995,7 +1002,7 @@ static void iwl_sta_init_lq(struct iwl_priv *priv, const u8 *addr, int is_ap)
  * there is only one AP station with id= IWL_AP_ID
  * NOTE: mutex must be held before calling this function
  */
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
+int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap)
 {
         struct ieee80211_sta *sta;
         struct ieee80211_sta_ht_cap ht_config;
@@ -1020,8 +1027,7 @@ int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
                 rcu_read_unlock();
         }
 
-        sta_id = priv->cfg->ops->smgmt->add_station(priv, addr, is_ap,
-                                       0, cur_ht_config);
+        sta_id = iwl_add_station(priv, addr, is_ap, CMD_SYNC, cur_ht_config);
 
         /* Set up default rate scaling table in device's station table */
         iwl_sta_init_lq(priv, addr, is_ap);
@@ -1054,7 +1060,7 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
 
         /* If we are an AP, then find the station, or use BCAST */
         case NL80211_IFTYPE_AP:
-                sta_id = priv->cfg->ops->smgmt->find_station(priv, hdr->addr1);
+                sta_id = iwl_find_station(priv, hdr->addr1);
                 if (sta_id != IWL_INVALID_STATION)
                         return sta_id;
                 return priv->hw_params.bcast_sta_id;
@@ -1062,13 +1068,13 @@ int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr)
         /* If this frame is going out to an IBSS network, find the station,
          * or create a new station table entry */
         case NL80211_IFTYPE_ADHOC:
-                sta_id = priv->cfg->ops->smgmt->find_station(priv, hdr->addr1);
+                sta_id = iwl_find_station(priv, hdr->addr1);
                 if (sta_id != IWL_INVALID_STATION)
                         return sta_id;
 
                 /* Create new station table entry */
-                sta_id = priv->cfg->ops->smgmt->add_station(priv, hdr->addr1,
-                                                   0, CMD_ASYNC, NULL);
+                sta_id = iwl_add_station(priv, hdr->addr1, false,
+                                        CMD_ASYNC, NULL);
 
                 if (sta_id != IWL_INVALID_STATION)
                         return sta_id;
@@ -1111,7 +1117,7 @@ int iwl_sta_rx_agg_start(struct iwl_priv *priv,
         unsigned long flags;
         int sta_id;
 
-        sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION)
                 return -ENXIO;
 
@@ -1133,7 +1139,7 @@ int iwl_sta_rx_agg_stop(struct iwl_priv *priv, const u8 *addr, int tid)
         unsigned long flags;
         int sta_id;
 
-        sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
                 IWL_ERR(priv, "Invalid station for AGG tid %d\n", tid);
                 return -ENXIO;
@@ -1168,7 +1174,7 @@ static void iwl_sta_modify_ps_wake(struct iwl_priv *priv, int sta_id)
 void iwl_update_ps_mode(struct iwl_priv *priv, u16 ps_bit, u8 *addr)
 {
         /* FIXME: need locking over ps_status ??? */
-        u8 sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+        u8 sta_id = iwl_find_station(priv, addr);
 
         if (sta_id != IWL_INVALID_STATION) {
                 u8 sta_awake = priv->stations[sta_id].
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.h b/drivers/net/wireless/iwlwifi/iwl-sta.h
index 59a586b6b56c..6deebade6361 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.h
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.h
@@ -51,16 +51,15 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                         struct ieee80211_key_conf *keyconf,
                         const u8 *addr, u32 iv32, u16 *phase1key);
 
-int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap);
-int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap);
+int iwl_rxon_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
+int iwl_remove_station(struct iwl_priv *priv, const u8 *addr, bool is_ap);
 void iwl_clear_stations_table(struct iwl_priv *priv);
 int iwl_get_free_ucode_key_index(struct iwl_priv *priv);
 int iwl_get_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_get_ra_sta_id(struct iwl_priv *priv, struct ieee80211_hdr *hdr);
 int iwl_send_add_sta(struct iwl_priv *priv,
                      struct iwl_addsta_cmd *sta, u8 flags);
-u8 iwl_add_station_flags(struct iwl_priv *priv, const u8 *addr,
-                        int is_ap, u8 flags,
+u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
                         struct ieee80211_sta_ht_cap *ht_info);
 void iwl_sta_tx_modify_enable_tid(struct iwl_priv *priv, int sta_id, int tid);
 int iwl_sta_rx_agg_start(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 5c10b87d0336..92fa1a39c446 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -95,144 +95,6 @@ struct iwl_mod_params iwl3945_mod_params = {
         /* the rest are 0 by default */
 };
 
-/*************** STATION TABLE MANAGEMENT ****
- * mac80211 should be examined to determine if sta_info is duplicating
- * the functionality provided here
- */
-
-/**************************************************************/
-#if 0 /* temporary disable till we add real remove station */
-/**
- * iwl3945_remove_station - Remove driver's knowledge of station.
- *
- * NOTE:  This does not remove station from device's station table.
- */
-static u8 iwl3945_remove_station(struct iwl_priv *priv, const u8 *addr, int is_ap)
-{
-        int index = IWL_INVALID_STATION;
-        int i;
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        if (is_ap)
-                index = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                index = priv->hw_params.bcast_sta_id;
-        else
-                for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++)
-                        if (priv->stations_39[i].used &&
-                            !compare_ether_addr(priv->stations_39[i].sta.sta.addr,
-                                                addr)) {
-                                index = i;
-                                break;
-                        }
-
-        if (unlikely(index == IWL_INVALID_STATION))
-                goto out;
-
-        if (priv->stations_39[index].used) {
-                priv->stations_39[index].used = 0;
-                priv->num_stations--;
-        }
-
-        BUG_ON(priv->num_stations < 0);
-
-out:
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-        return 0;
-}
-#endif
-
-/**
- * iwl3945_clear_stations_table - Clear the driver's station table
- *
- * NOTE:  This does not clear or otherwise alter the device's station table.
- */
-void iwl3945_clear_stations_table(struct iwl_priv *priv)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-
-        priv->num_stations = 0;
-        memset(priv->stations_39, 0, sizeof(priv->stations_39));
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-}
-
-/**
- * iwl3945_add_station - Add station to station tables in driver and device
- */
-u8 iwl3945_add_station(struct iwl_priv *priv, const u8 *addr, int is_ap, u8 flags, struct ieee80211_sta_ht_cap *ht_info)
-{
-        int i;
-        int index = IWL_INVALID_STATION;
-        struct iwl3945_station_entry *station;
-        unsigned long flags_spin;
-        u8 rate;
-
-        spin_lock_irqsave(&priv->sta_lock, flags_spin);
-        if (is_ap)
-                index = IWL_AP_ID;
-        else if (is_broadcast_ether_addr(addr))
-                index = priv->hw_params.bcast_sta_id;
-        else
-                for (i = IWL_STA_ID; i < priv->hw_params.max_stations; i++) {
-                        if (!compare_ether_addr(priv->stations_39[i].sta.sta.addr,
-                                                addr)) {
-                                index = i;
-                                break;
-                        }
-
-                        if (!priv->stations_39[i].used &&
-                            index == IWL_INVALID_STATION)
-                                index = i;
-                }
-
-        /* These two conditions has the same outcome but keep them separate
-          since they have different meaning */
-        if (unlikely(index == IWL_INVALID_STATION)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-                return index;
-        }
-
-        if (priv->stations_39[index].used &&
-           !compare_ether_addr(priv->stations_39[index].sta.sta.addr, addr)) {
-                spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-                return index;
-        }
-
-        IWL_DEBUG_ASSOC(priv, "Add STA ID %d: %pM\n", index, addr);
-        station = &priv->stations_39[index];
-        station->used = 1;
-        priv->num_stations++;
-
-        /* Set up the REPLY_ADD_STA command to send to device */
-        memset(&station->sta, 0, sizeof(struct iwl3945_addsta_cmd));
-        memcpy(station->sta.sta.addr, addr, ETH_ALEN);
-        station->sta.mode = 0;
-        station->sta.sta.sta_id = index;
-        station->sta.station_flags = 0;
-
-        if (priv->band == IEEE80211_BAND_5GHZ)
-                rate = IWL_RATE_6M_PLCP;
-        else
-                rate =  IWL_RATE_1M_PLCP;
-
-        /* Turn on both antennas for the station... */
-        station->sta.rate_n_flags =
-                        iwl3945_hw_set_rate_n_flags(rate, RATE_MCS_ANT_AB_MSK);
-
-        spin_unlock_irqrestore(&priv->sta_lock, flags_spin);
-
-        /* Add station to device's station table */
-        iwl_send_add_sta(priv,
-                         (struct iwl_addsta_cmd *)&station->sta, flags);
-        return index;
-
-}
-
 /**
  * iwl3945_get_antenna_flags - Get antenna flags for RXON command
  * @priv: eeprom and antenna fields are used to determine antenna flags
@@ -289,32 +151,31 @@ static int iwl3945_set_ccmp_dynamic_key_info(struct iwl_priv *priv,
         key_flags &= ~STA_KEY_FLG_INVALID;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        priv->stations_39[sta_id].keyinfo.alg = keyconf->alg;
-        priv->stations_39[sta_id].keyinfo.keylen = keyconf->keylen;
-        memcpy(priv->stations_39[sta_id].keyinfo.key, keyconf->key,
+        priv->stations[sta_id].keyinfo.alg = keyconf->alg;
+        priv->stations[sta_id].keyinfo.keylen = keyconf->keylen;
+        memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key,
                keyconf->keylen);
 
-        memcpy(priv->stations_39[sta_id].sta.key.key, keyconf->key,
+        memcpy(priv->stations[sta_id].sta.key.key, keyconf->key,
                keyconf->keylen);
 
-        if ((priv->stations_39[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
+        if ((priv->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_ENCRYPT_MSK)
                         == STA_KEY_FLG_NO_ENC)
-                priv->stations_39[sta_id].sta.key.key_offset =
+                priv->stations[sta_id].sta.key.key_offset =
                                  iwl_get_free_ucode_key_index(priv);
         /* else, we are overriding an existing key => no need to allocated room
         * in uCode. */
 
-        WARN(priv->stations_39[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
+        WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
-        priv->stations_39[sta_id].sta.key.key_flags = key_flags;
-        priv->stations_39[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations_39[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
 
         IWL_DEBUG_INFO(priv, "hwcrypto: modify ucode station key info\n");
 
-        ret = iwl_send_add_sta(priv,
-                (struct iwl_addsta_cmd *)&priv->stations_39[sta_id].sta, CMD_ASYNC);
+        ret = iwl_send_add_sta(priv, &priv->stations[sta_id].sta, CMD_ASYNC);
 
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
@@ -340,17 +201,16 @@ static int iwl3945_clear_sta_key_info(struct iwl_priv *priv, u8 sta_id)
         unsigned long flags;
 
         spin_lock_irqsave(&priv->sta_lock, flags);
-        memset(&priv->stations_39[sta_id].keyinfo, 0, sizeof(struct iwl_hw_key));
-        memset(&priv->stations_39[sta_id].sta.key, 0,
+        memset(&priv->stations[sta_id].keyinfo, 0, sizeof(struct iwl_hw_key));
+        memset(&priv->stations[sta_id].sta.key, 0,
                 sizeof(struct iwl4965_keyinfo));
-        priv->stations_39[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
-        priv->stations_39[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
-        priv->stations_39[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
+        priv->stations[sta_id].sta.key.key_flags = STA_KEY_FLG_NO_ENC;
+        priv->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
+        priv->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         IWL_DEBUG_INFO(priv, "hwcrypto: clear ucode station key info\n");
-        iwl_send_add_sta(priv,
-                (struct iwl_addsta_cmd *)&priv->stations_39[sta_id].sta, 0);
+        iwl_send_add_sta(priv, &priv->stations[sta_id].sta, 0);
         return 0;
 }
 
@@ -578,7 +438,7 @@ static void iwl3945_build_tx_cmd_hwcrypto(struct iwl_priv *priv,
                                       int sta_id)
 {
         struct iwl3945_tx_cmd *tx = (struct iwl3945_tx_cmd *)cmd->cmd.payload;
-        struct iwl_hw_key *keyinfo = &priv->stations_39[sta_id].keyinfo;
+        struct iwl_hw_key *keyinfo = &priv->stations[sta_id].keyinfo;
 
         switch (keyinfo->alg) {
         case ALG_CCMP:
@@ -753,7 +613,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (ieee80211_is_data_qos(fc)) {
                 qc = ieee80211_get_qos_ctl(hdr);
                 tid = qc[0] & IEEE80211_QOS_CTL_TID_MASK;
-                seq_number = priv->stations_39[sta_id].tid[tid].seq_number &
+                seq_number = priv->stations[sta_id].tid[tid].seq_number &
                                 IEEE80211_SCTL_SEQ;
                 hdr->seq_ctrl = cpu_to_le16(seq_number) |
                         (hdr->seq_ctrl &
@@ -813,7 +673,7 @@ static int iwl3945_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)
         if (!ieee80211_has_morefrags(hdr->frame_control)) {
                 txq->need_update = 1;
                 if (qc)
-                        priv->stations_39[sta_id].tid[tid].seq_number = seq_number;
+                        priv->stations[sta_id].tid[tid].seq_number = seq_number;
         } else {
                 wait_write_ptr = 1;
                 txq->need_update = 0;
@@ -1316,7 +1176,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
 
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
-        if ((write != (rxq->write & ~0x7))
+        if ((rxq->write_actual != (rxq->write & ~0x7))
             || (abs(rxq->write - rxq->read) > 7)) {
                 spin_lock_irqsave(&rxq->lock, flags);
                 rxq->need_update = 1;
@@ -1337,7 +1197,7 @@ static int iwl3945_rx_queue_restock(struct iwl_priv *priv)
  * Also restock the Rx queue via iwl3945_rx_queue_restock.
  * This is called as a scheduled work item (except for during initialization)
  */
-static void iwl3945_rx_allocate(struct iwl_priv *priv)
+static void iwl3945_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 {
         struct iwl_rx_queue *rxq = &priv->rxq;
         struct list_head *element;
@@ -1360,7 +1220,7 @@ static void iwl3945_rx_allocate(struct iwl_priv *priv)
                 /* Alloc a new receive buffer */
                 rxb->skb =
                     alloc_skb(priv->hw_params.rx_buf_size,
-                                GFP_KERNEL);
+                                priority);
                 if (!rxb->skb) {
                         if (net_ratelimit())
                                 IWL_CRIT(priv, ": Can not allocate SKB buffers\n");
@@ -1419,6 +1279,7 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
          * not restocked the Rx queue with fresh buffers */
         rxq->read = rxq->write = 0;
         rxq->free_count = 0;
+        rxq->write_actual = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
 
@@ -1427,13 +1288,21 @@ void iwl3945_rx_replenish(void *data)
         struct iwl_priv *priv = data;
         unsigned long flags;
 
-        iwl3945_rx_allocate(priv);
+        iwl3945_rx_allocate(priv, GFP_KERNEL);
 
         spin_lock_irqsave(&priv->lock, flags);
         iwl3945_rx_queue_restock(priv);
         spin_unlock_irqrestore(&priv->lock, flags);
 }
 
+static void iwl3945_rx_replenish_now(struct iwl_priv *priv)
+{
+        iwl3945_rx_allocate(priv, GFP_ATOMIC);
+
+        iwl3945_rx_queue_restock(priv);
+}
+
+
 /* Assumes that the skb field of the buffers in 'pool' is kept accurate.
  * If an SKB has been detached, the POOL needs to have its SKB set to NULL
  * This free routine walks the list of POOL entries and if SKB is set to
@@ -1556,13 +1425,19 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
         unsigned long flags;
         u8 fill_rx = 0;
         u32 count = 8;
+        int total_empty = 0;
 
         /* uCode's read index (stored in shared DRAM) indicates the last Rx
          * buffer that the driver may process (last buffer filled by ucode). */
         r = le16_to_cpu(rxq->rb_stts->closed_rb_num) &  0x0FFF;
         i = rxq->read;
 
-        if (iwl_rx_queue_space(rxq) > (RX_QUEUE_SIZE / 2))
+        /* calculate total frames need to be restock after handling RX */
+        total_empty = r - priv->rxq.write_actual;
+        if (total_empty < 0)
+                total_empty += RX_QUEUE_SIZE;
+
+        if (total_empty > (RX_QUEUE_SIZE / 2))
                 fill_rx = 1;
         /* Rx interrupt, but nothing sent from uCode */
         if (i == r)
@@ -1639,7 +1514,7 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
                         count++;
                         if (count >= 8) {
                                 priv->rxq.read = i;
-                                iwl3945_rx_queue_restock(priv);
+                                iwl3945_rx_replenish_now(priv);
                                 count = 0;
                         }
                 }
@@ -1647,7 +1522,10 @@ static void iwl3945_rx_handle(struct iwl_priv *priv)
 
         /* Backtrack one entry */
         priv->rxq.read = i;
-        iwl3945_rx_queue_restock(priv);
+        if (fill_rx)
+                iwl3945_rx_replenish_now(priv);
+        else
+                iwl3945_rx_queue_restock(priv);
 }
 
 /* call this function to flush any scheduled tasklet */
@@ -2589,7 +2467,7 @@ static void iwl3945_alive_start(struct iwl_priv *priv)
                 goto restart;
         }
 
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         rfkill = iwl_read_prph(priv, APMG_RFKILL_REG);
         IWL_DEBUG_INFO(priv, "RFKILL status: 0x%x\n", rfkill);
@@ -2681,7 +2559,7 @@ static void __iwl3945_down(struct iwl_priv *priv)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
         iwl3945_led_unregister(priv);
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         /* Unblock any waiting calls */
         wake_up_interruptible_all(&priv->wait_command_queue);
@@ -2833,7 +2711,7 @@ static int __iwl3945_up(struct iwl_priv *priv)
 
         for (i = 0; i < MAX_HW_RESTARTS; i++) {
 
-                priv->cfg->ops->smgmt->clear_station_table(priv);
+                iwl_clear_stations_table(priv);
 
                 /* load bootstrap state machine,
                  * load bootstrap program into processor's memory,
@@ -3247,7 +3125,7 @@ void iwl3945_post_associate(struct iwl_priv *priv)
         case NL80211_IFTYPE_ADHOC:
 
                 priv->assoc_id = 1;
-                priv->cfg->ops->smgmt->add_station(priv, priv->bssid, 0, 0, NULL);
+                iwl_add_station(priv, priv->bssid, 0, CMD_SYNC, NULL);
                 iwl3945_sync_sta(priv, IWL_STA_ID,
                                  (priv->band == IEEE80211_BAND_5GHZ) ?
                                  IWL_RATE_6M_PLCP : IWL_RATE_1M_PLCP,
@@ -3438,7 +3316,7 @@ void iwl3945_config_ap(struct iwl_priv *priv)
                 /* restore RXON assoc */
                 priv->staging_rxon.filter_flags |= RXON_FILTER_ASSOC_MSK;
                 iwlcore_commit_rxon(priv);
-                priv->cfg->ops->smgmt->add_station(priv, iwl_bcast_addr, 0, 0, NULL);
+                iwl_add_station(priv, iwl_bcast_addr, 0, CMD_SYNC, NULL);
         }
         iwl3945_send_beacon_cmd(priv);
 
@@ -3469,7 +3347,7 @@ static int iwl3945_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
         static_key = !iwl_is_associated(priv);
 
         if (!static_key) {
-                sta_id = priv->cfg->ops->smgmt->find_station(priv, addr);
+                sta_id = iwl_find_station(priv, addr);
                 if (sta_id == IWL_INVALID_STATION) {
                         IWL_DEBUG_MAC80211(priv, "leave - %pM not in station map.\n",
                                             addr);
@@ -4044,7 +3922,7 @@ static int iwl3945_init_drv(struct iwl_priv *priv)
         mutex_init(&priv->mutex);
 
         /* Clear the driver's (not device's) station table */
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         priv->data_retry_limit = -1;
         priv->ieee_channels = NULL;
@@ -4407,7 +4285,7 @@ static void __devexit iwl3945_pci_remove(struct pci_dev *pdev)
         iwl3945_hw_txq_ctx_free(priv);
 
         iwl3945_unset_hw_params(priv);
-        priv->cfg->ops->smgmt->clear_station_table(priv);
+        iwl_clear_stations_table(priv);
 
         /*netif_stop_queue(dev); */
         flush_workqueue(priv->workqueue);
diff --git a/drivers/net/wireless/iwmc3200wifi/Kconfig b/drivers/net/wireless/iwmc3200wifi/Kconfig
index 41bd4b2b5411..1eccb6df46dd 100644
--- a/drivers/net/wireless/iwmc3200wifi/Kconfig
+++ b/drivers/net/wireless/iwmc3200wifi/Kconfig
@@ -1,10 +1,9 @@
 config IWM
         tristate "Intel Wireless Multicomm 3200 WiFi driver"
         depends on MMC && WLAN_80211 && EXPERIMENTAL
+        depends on CFG80211
         select WIRELESS_EXT
-        select CFG80211
         select FW_LOADER
-        select RFKILL
 
 config IWM_DEBUG
         bool "Enable full debugging output in iwmc3200wifi"
diff --git a/drivers/net/wireless/iwmc3200wifi/Makefile b/drivers/net/wireless/iwmc3200wifi/Makefile
index 7cb415e5c11b..927f022545c1 100644
--- a/drivers/net/wireless/iwmc3200wifi/Makefile
+++ b/drivers/net/wireless/iwmc3200wifi/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_IWM) := iwmc3200wifi.o
 iwmc3200wifi-objs += main.o netdev.o rx.o tx.o sdio.o hal.o fw.o
-iwmc3200wifi-objs += commands.o wext.o cfg80211.o eeprom.o rfkill.o
+iwmc3200wifi-objs += commands.o wext.o cfg80211.o eeprom.o
 
 iwmc3200wifi-$(CONFIG_IWM_DEBUG) += debugfs.o
diff --git a/drivers/net/wireless/iwmc3200wifi/cfg80211.c b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
index 3256ad2c96ce..96f714e6e12b 100644
--- a/drivers/net/wireless/iwmc3200wifi/cfg80211.c
+++ b/drivers/net/wireless/iwmc3200wifi/cfg80211.c
@@ -268,7 +268,7 @@ static int iwm_cfg80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
 
                 iwm->conf.frag_threshold = wiphy->frag_threshold;
 
-                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_CFG_FIX,
+                ret = iwm_umac_set_config_fix(iwm, UMAC_PARAM_TBL_FA_CFG_FIX,
                                              CFG_FRAG_THRESHOLD,
                                              iwm->conf.frag_threshold);
                 if (ret < 0)
diff --git a/drivers/net/wireless/iwmc3200wifi/fw.c b/drivers/net/wireless/iwmc3200wifi/fw.c
index db4ba0864730..ec1a15a5a0e4 100644
--- a/drivers/net/wireless/iwmc3200wifi/fw.c
+++ b/drivers/net/wireless/iwmc3200wifi/fw.c
@@ -72,7 +72,7 @@ static int iwm_fw_op_offset(struct iwm_priv *iwm, const struct firmware *fw,
         }
 
         if (fw->size < IWM_HDR_LEN) {
-                IWM_ERR(iwm, "FW is too small (%d)\n", fw->size);
+                IWM_ERR(iwm, "FW is too small (%zu)\n", fw->size);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/iwmc3200wifi/iwm.h b/drivers/net/wireless/iwmc3200wifi/iwm.h
index 3b29681792bb..635c16ee6186 100644
--- a/drivers/net/wireless/iwmc3200wifi/iwm.h
+++ b/drivers/net/wireless/iwmc3200wifi/iwm.h
@@ -343,8 +343,4 @@ int iwm_rx_handle_resp(struct iwm_priv *iwm, u8 *buf, unsigned long buf_size,
                        struct iwm_wifi_cmd *cmd);
 void iwm_rx_free(struct iwm_priv *iwm);
 
-/* RF Kill API */
-int iwm_rfkill_init(struct iwm_priv *iwm);
-void iwm_rfkill_exit(struct iwm_priv *iwm);
-
 #endif
diff --git a/drivers/net/wireless/iwmc3200wifi/netdev.c b/drivers/net/wireless/iwmc3200wifi/netdev.c
index eec7201e91a8..68e2c3b6c7a1 100644
--- a/drivers/net/wireless/iwmc3200wifi/netdev.c
+++ b/drivers/net/wireless/iwmc3200wifi/netdev.c
@@ -136,17 +136,8 @@ void *iwm_if_alloc(int sizeof_bus, struct device *dev,
 
         wdev->netdev = ndev;
 
-        ret = iwm_rfkill_init(iwm);
-        if (ret) {
-                dev_err(dev, "Failed to init rfkill\n");
-                goto out_rfkill;
-        }
-
         return iwm;
 
- out_rfkill:
-        unregister_netdev(ndev);
-
  out_ndev:
         free_netdev(ndev);
 
@@ -162,7 +153,6 @@ void iwm_if_free(struct iwm_priv *iwm)
         if (!iwm_to_ndev(iwm))
                 return;
 
-        iwm_rfkill_exit(iwm);
         unregister_netdev(iwm_to_ndev(iwm));
         free_netdev(iwm_to_ndev(iwm));
         iwm_wdev_free(iwm);
diff --git a/drivers/net/wireless/iwmc3200wifi/rfkill.c b/drivers/net/wireless/iwmc3200wifi/rfkill.c
deleted file mode 100644
index 4ca8b495f82d..000000000000
--- a/drivers/net/wireless/iwmc3200wifi/rfkill.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Intel Wireless Multicomm 3200 WiFi driver
- *
- * Copyright (C) 2009 Intel Corporation <ilw@linux.intel.com>
- * Samuel Ortiz <samuel.ortiz@intel.com>
- * Zhu Yi <yi.zhu@intel.com>
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version
- * 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
- * 02110-1301, USA.
- *
- */
-
-#include <linux/rfkill.h>
-
-#include "iwm.h"
-
-static int iwm_rfkill_soft_toggle(void *data, enum rfkill_state state)
-{
-        struct iwm_priv *iwm = data;
-
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (test_bit(IWM_RADIO_RFKILL_HW, &iwm->radio))
-                        return -EBUSY;
-
-                if (test_and_clear_bit(IWM_RADIO_RFKILL_SW, &iwm->radio) &&
-                    (iwm_to_ndev(iwm)->flags & IFF_UP))
-                        iwm_up(iwm);
-
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                if (!test_and_set_bit(IWM_RADIO_RFKILL_SW, &iwm->radio))
-                        iwm_down(iwm);
-
-                break;
-        default:
-                break;
-        }
-
-        return 0;
-}
-
-int iwm_rfkill_init(struct iwm_priv *iwm)
-{
-        int ret;
-
-        iwm->rfkill = rfkill_allocate(iwm_to_dev(iwm), RFKILL_TYPE_WLAN);
-        if (!iwm->rfkill) {
-                IWM_ERR(iwm, "Unable to allocate rfkill device\n");
-                return -ENOMEM;
-        }
-
-        iwm->rfkill->name = KBUILD_MODNAME;
-        iwm->rfkill->data = iwm;
-        iwm->rfkill->state = RFKILL_STATE_UNBLOCKED;
-        iwm->rfkill->toggle_radio = iwm_rfkill_soft_toggle;
-
-        ret = rfkill_register(iwm->rfkill);
-        if (ret) {
-                IWM_ERR(iwm, "Failed to register rfkill device\n");
-                goto fail;
-        }
-
-        return 0;
- fail:
-        rfkill_free(iwm->rfkill);
-        return ret;
-}
-
-void iwm_rfkill_exit(struct iwm_priv *iwm)
-{
-        if (iwm->rfkill)
-                rfkill_unregister(iwm->rfkill);
-
-        rfkill_free(iwm->rfkill);
-        iwm->rfkill = NULL;
-}
diff --git a/drivers/net/wireless/iwmc3200wifi/sdio.c b/drivers/net/wireless/iwmc3200wifi/sdio.c
index edc0a0091058..b54da677b371 100644
--- a/drivers/net/wireless/iwmc3200wifi/sdio.c
+++ b/drivers/net/wireless/iwmc3200wifi/sdio.c
@@ -395,7 +395,7 @@ static struct iwm_if_ops if_sdio_ops = {
         .debugfs_init = if_sdio_debugfs_init,
         .debugfs_exit = if_sdio_debugfs_exit,
         .umac_name = "iwmc3200wifi-umac-sdio.bin",
-        .calib_lmac_name = "iwmc3200wifi-lmac-calib-sdio.bin",
+        .calib_lmac_name = "iwmc3200wifi-calib-sdio.bin",
         .lmac_name = "iwmc3200wifi-lmac-sdio.bin",
 };
 
diff --git a/drivers/net/wireless/libertas/11d.c b/drivers/net/wireless/libertas/11d.c
index 4bc46a60ae2f..9a5408e7d94a 100644
--- a/drivers/net/wireless/libertas/11d.c
+++ b/drivers/net/wireless/libertas/11d.c
@@ -207,7 +207,7 @@ static int generate_domain_info_11d(struct parsed_region_chan_11d
         lbs_deb_11d("nr_subband=%x\n", domaininfo->nr_subband);
         lbs_deb_hex(LBS_DEB_11D, "domaininfo", (char *)domaininfo,
                 COUNTRY_CODE_LEN + 1 +
-                sizeof(struct ieeetypes_subbandset) * nr_subband);
+                sizeof(struct ieee_subbandset) * nr_subband);
         return 0;
 }
 
@@ -302,11 +302,9 @@ done:
  *  @param parsed_region_chan   pointer to parsed_region_chan_11d
  *  @return                     0
 */
-static int parse_domain_info_11d(struct ieeetypes_countryinfofullset*
-                                 countryinfo,
+static int parse_domain_info_11d(struct ieee_ie_country_info_full_set *countryinfo,
                                  u8 band,
-                                 struct parsed_region_chan_11d *
-                                 parsed_region_chan)
+                                 struct parsed_region_chan_11d *parsed_region_chan)
 {
         u8 nr_subband, nrchan;
         u8 lastchan, firstchan;
@@ -331,7 +329,7 @@ static int parse_domain_info_11d(struct ieeetypes_countryinfofullset*
         lbs_deb_hex(LBS_DEB_11D, "countryinfo", (u8 *) countryinfo, 30);
 
         if ((*(countryinfo->countrycode)) == 0
-            || (countryinfo->len <= COUNTRY_CODE_LEN)) {
+            || (countryinfo->header.len <= COUNTRY_CODE_LEN)) {
                 /* No region Info or Wrong region info: treat as No 11D info */
                 goto done;
         }
@@ -349,8 +347,8 @@ static int parse_domain_info_11d(struct ieeetypes_countryinfofullset*
         memcpy(parsed_region_chan->countrycode, countryinfo->countrycode,
                COUNTRY_CODE_LEN);
 
-        nr_subband = (countryinfo->len - COUNTRY_CODE_LEN) /
-            sizeof(struct ieeetypes_subbandset);
+        nr_subband = (countryinfo->header.len - COUNTRY_CODE_LEN) /
+            sizeof(struct ieee_subbandset);
 
         for (j = 0, lastchan = 0; j < nr_subband; j++) {
 
@@ -502,7 +500,7 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
 {
         struct cmd_ds_802_11d_domain_info *pdomaininfo =
             &cmd->params.domaininfo;
-        struct mrvlietypes_domainparamset *domain = &pdomaininfo->domain;
+        struct mrvl_ie_domain_param_set *domain = &pdomaininfo->domain;
         u8 nr_subband = priv->domainreg.nr_subband;
 
         lbs_deb_enter(LBS_DEB_11D);
@@ -524,16 +522,16 @@ int lbs_cmd_802_11d_domain_info(struct lbs_private *priv,
                sizeof(domain->countrycode));
 
         domain->header.len =
-            cpu_to_le16(nr_subband * sizeof(struct ieeetypes_subbandset) +
+            cpu_to_le16(nr_subband * sizeof(struct ieee_subbandset) +
                              sizeof(domain->countrycode));
 
         if (nr_subband) {
                 memcpy(domain->subband, priv->domainreg.subband,
-                       nr_subband * sizeof(struct ieeetypes_subbandset));
+                       nr_subband * sizeof(struct ieee_subbandset));
 
                 cmd->size = cpu_to_le16(sizeof(pdomaininfo->action) +
                                              le16_to_cpu(domain->header.len) +
-                                             sizeof(struct mrvlietypesheader) +
+                                             sizeof(struct mrvl_ie_header) +
                                              S_DS_GEN);
         } else {
                 cmd->size =
@@ -556,7 +554,7 @@ done:
 int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp)
 {
         struct cmd_ds_802_11d_domain_info *domaininfo = &resp->params.domaininforesp;
-        struct mrvlietypes_domainparamset *domain = &domaininfo->domain;
+        struct mrvl_ie_domain_param_set *domain = &domaininfo->domain;
         u16 action = le16_to_cpu(domaininfo->action);
         s16 ret = 0;
         u8 nr_subband = 0;
@@ -567,7 +565,7 @@ int lbs_ret_802_11d_domain_info(struct cmd_ds_command *resp)
                 (int)le16_to_cpu(resp->size));
 
         nr_subband = (le16_to_cpu(domain->header.len) - COUNTRY_CODE_LEN) /
-                      sizeof(struct ieeetypes_subbandset);
+                      sizeof(struct ieee_subbandset);
 
         lbs_deb_11d("domain info resp: nr_subband %d\n", nr_subband);
 
diff --git a/drivers/net/wireless/libertas/11d.h b/drivers/net/wireless/libertas/11d.h
index 4f4f47f0f878..fb75d3e321a0 100644
--- a/drivers/net/wireless/libertas/11d.h
+++ b/drivers/net/wireless/libertas/11d.h
@@ -20,35 +20,36 @@
 struct cmd_ds_command;
 
 /** Data structure for Country IE*/
-struct ieeetypes_subbandset {
+struct ieee_subbandset {
         u8 firstchan;
         u8 nrchan;
         u8 maxtxpwr;
 } __attribute__ ((packed));
 
-struct ieeetypes_countryinfoset {
-        u8 element_id;
-        u8 len;
+struct ieee_ie_country_info_set {
+        struct ieee_ie_header header;
+
         u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieeetypes_subbandset subband[1];
+        struct ieee_subbandset subband[1];
 };
 
-struct ieeetypes_countryinfofullset {
-        u8 element_id;
-        u8 len;
+struct ieee_ie_country_info_full_set {
+        struct ieee_ie_header header;
+
         u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieeetypes_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
+        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
 } __attribute__ ((packed));
 
-struct mrvlietypes_domainparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_domain_param_set {
+        struct mrvl_ie_header header;
+
         u8 countrycode[COUNTRY_CODE_LEN];
-        struct ieeetypes_subbandset subband[1];
+        struct ieee_subbandset subband[1];
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11d_domain_info {
         __le16 action;
-        struct mrvlietypes_domainparamset domain;
+        struct mrvl_ie_domain_param_set domain;
 } __attribute__ ((packed));
 
 /** domain regulatory information */
@@ -57,7 +58,7 @@ struct lbs_802_11d_domain_reg {
         u8 countrycode[COUNTRY_CODE_LEN];
         /** No. of subband*/
         u8 nr_subband;
-        struct ieeetypes_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
+        struct ieee_subbandset subband[MRVDRV_MAX_SUBBAND_802_11D];
 };
 
 struct chan_power_11d {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index a0e440cd8967..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -12,15 +12,14 @@
 #include "scan.h"
 #include "cmd.h"
 
-static int lbs_adhoc_post(struct lbs_private *priv, struct cmd_header *resp);
-
 static const u8 bssid_any[ETH_ALEN]  __attribute__ ((aligned (2))) =
         { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 static const u8 bssid_off[ETH_ALEN]  __attribute__ ((aligned (2))) =
         { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 
-/* The firmware needs certain bits masked out of the beacon-derviced capability
- * field when associating/joining to BSSs.
+/* The firmware needs the following bits masked out of the beacon-derived
+ * capability field when associating/joining to a BSS:
+ *  9 (QoS), 11 (APSD), 12 (unused), 14 (unused), 15 (unused)
  */
 #define CAPINFO_MASK    (~(0xda00))
 
@@ -102,6 +101,295 @@ static void lbs_set_basic_rate_flags(u8 *rates, size_t len)
 }
 
 
+static u8 iw_auth_to_ieee_auth(u8 auth)
+{
+        if (auth == IW_AUTH_ALG_OPEN_SYSTEM)
+                return 0x00;
+        else if (auth == IW_AUTH_ALG_SHARED_KEY)
+                return 0x01;
+        else if (auth == IW_AUTH_ALG_LEAP)
+                return 0x80;
+
+        lbs_deb_join("%s: invalid auth alg 0x%X\n", __func__, auth);
+        return 0;
+}
+
+/**
+ *  @brief This function prepares the authenticate command.  AUTHENTICATE only
+ *  sets the authentication suite for future associations, as the firmware
+ *  handles authentication internally during the ASSOCIATE command.
+ *
+ *  @param priv      A pointer to struct lbs_private structure
+ *  @param bssid     The peer BSSID with which to authenticate
+ *  @param auth      The authentication mode to use (from wireless.h)
+ *
+ *  @return         0 or -1
+ */
+static int lbs_set_authentication(struct lbs_private *priv, u8 bssid[6], u8 auth)
+{
+        struct cmd_ds_802_11_authenticate cmd;
+        int ret = -1;
+        DECLARE_MAC_BUF(mac);
+
+        lbs_deb_enter(LBS_DEB_JOIN);
+
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
+        memcpy(cmd.bssid, bssid, ETH_ALEN);
+
+        cmd.authtype = iw_auth_to_ieee_auth(auth);
+
+        lbs_deb_join("AUTH_CMD: BSSID %s, auth 0x%x\n",
+                print_mac(mac, bssid), cmd.authtype);
+
+        ret = lbs_cmd_with_response(priv, CMD_802_11_AUTHENTICATE, &cmd);
+
+        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
+        return ret;
+}
+
+
+static int lbs_assoc_post(struct lbs_private *priv,
+                          struct cmd_ds_802_11_associate_response *resp)
+{
+        int ret = 0;
+        union iwreq_data wrqu;
+        struct bss_descriptor *bss;
+        u16 status_code;
+
+        lbs_deb_enter(LBS_DEB_ASSOC);
+
+        if (!priv->in_progress_assoc_req) {
+                lbs_deb_assoc("ASSOC_RESP: no in-progress assoc request\n");
+                ret = -1;
+                goto done;
+        }
+        bss = &priv->in_progress_assoc_req->bss;
+
+        /*
+         * Older FW versions map the IEEE 802.11 Status Code in the association
+         * response to the following values returned in resp->statuscode:
+         *
+         *    IEEE Status Code                Marvell Status Code
+         *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
+         *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
+         *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
+         *
+         * Other response codes:
+         *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
+         *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
+         *                                    association response from the AP)
+         */
+
+        status_code = le16_to_cpu(resp->statuscode);
+        if (priv->fwrelease < 0x09000000) {
+                switch (status_code) {
+                case 0x00:
+                        break;
+                case 0x01:
+                        lbs_deb_assoc("ASSOC_RESP: invalid parameters\n");
+                        break;
+                case 0x02:
+                        lbs_deb_assoc("ASSOC_RESP: internal timer "
+                                "expired while waiting for the AP\n");
+                        break;
+                case 0x03:
+                        lbs_deb_assoc("ASSOC_RESP: association "
+                                "refused by AP\n");
+                        break;
+                case 0x04:
+                        lbs_deb_assoc("ASSOC_RESP: authentication "
+                                "refused by AP\n");
+                        break;
+                default:
+                        lbs_deb_assoc("ASSOC_RESP: failure reason 0x%02x "
+                                " unknown\n", status_code);
+                        break;
+                }
+        } else {
+                /* v9+ returns the AP's association response */
+                lbs_deb_assoc("ASSOC_RESP: failure reason 0x%02x\n", status_code);
+        }
+
+        if (status_code) {
+                lbs_mac_event_disconnected(priv);
+                ret = -1;
+                goto done;
+        }
+
+        lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_RESP",
+                    (void *) (resp + sizeof (resp->hdr)),
+                    le16_to_cpu(resp->hdr.size) - sizeof (resp->hdr));
+
+        /* Send a Media Connected event, according to the Spec */
+        priv->connect_status = LBS_CONNECTED;
+
+        /* Update current SSID and BSSID */
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        priv->curbssparams.ssid_len = bss->ssid_len;
+        memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
+
+        priv->SNR[TYPE_RXPD][TYPE_AVG] = 0;
+        priv->NF[TYPE_RXPD][TYPE_AVG] = 0;
+
+        memset(priv->rawSNR, 0x00, sizeof(priv->rawSNR));
+        memset(priv->rawNF, 0x00, sizeof(priv->rawNF));
+        priv->nextSNRNF = 0;
+        priv->numSNRNF = 0;
+
+        netif_carrier_on(priv->dev);
+        if (!priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+
+done:
+        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
+        return ret;
+}
+
+/**
+ *  @brief This function prepares an association-class command.
+ *
+ *  @param priv      A pointer to struct lbs_private structure
+ *  @param assoc_req The association request describing the BSS to associate
+ *                   or reassociate with
+ *  @param command   The actual command, either CMD_802_11_ASSOCIATE or
+ *                   CMD_802_11_REASSOCIATE
+ *
+ *  @return         0 or -1
+ */
+static int lbs_associate(struct lbs_private *priv,
+                         struct assoc_request *assoc_req,
+                         u16 command)
+{
+        struct cmd_ds_802_11_associate cmd;
+        int ret = 0;
+        struct bss_descriptor *bss = &assoc_req->bss;
+        u8 *pos = &(cmd.iebuf[0]);
+        u16 tmpcap, tmplen, tmpauth;
+        struct mrvl_ie_ssid_param_set *ssid;
+        struct mrvl_ie_ds_param_set *ds;
+        struct mrvl_ie_cf_param_set *cf;
+        struct mrvl_ie_rates_param_set *rates;
+        struct mrvl_ie_rsn_param_set *rsn;
+        struct mrvl_ie_auth_type *auth;
+
+        lbs_deb_enter(LBS_DEB_ASSOC);
+
+        BUG_ON((command != CMD_802_11_ASSOCIATE) &&
+                (command != CMD_802_11_REASSOCIATE));
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.hdr.command = cpu_to_le16(command);
+
+        /* Fill in static fields */
+        memcpy(cmd.bssid, bss->bssid, ETH_ALEN);
+        cmd.listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
+
+        /* Capability info */
+        tmpcap = (bss->capability & CAPINFO_MASK);
+        if (bss->mode == IW_MODE_INFRA)
+                tmpcap |= WLAN_CAPABILITY_ESS;
+        cmd.capability = cpu_to_le16(tmpcap);
+        lbs_deb_assoc("ASSOC_CMD: capability 0x%04x\n", tmpcap);
+
+        /* SSID */
+        ssid = (struct mrvl_ie_ssid_param_set *) pos;
+        ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
+        tmplen = bss->ssid_len;
+        ssid->header.len = cpu_to_le16(tmplen);
+        memcpy(ssid->ssid, bss->ssid, tmplen);
+        pos += sizeof(ssid->header) + tmplen;
+
+        ds = (struct mrvl_ie_ds_param_set *) pos;
+        ds->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
+        ds->header.len = cpu_to_le16(1);
+        ds->channel = bss->phy.ds.channel;
+        pos += sizeof(ds->header) + 1;
+
+        cf = (struct mrvl_ie_cf_param_set *) pos;
+        cf->header.type = cpu_to_le16(TLV_TYPE_CF);
+        tmplen = sizeof(*cf) - sizeof (cf->header);
+        cf->header.len = cpu_to_le16(tmplen);
+        /* IE payload should be zeroed, firmware fills it in for us */
+        pos += sizeof(*cf);
+
+        rates = (struct mrvl_ie_rates_param_set *) pos;
+        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
+        memcpy(&rates->rates, &bss->rates, MAX_RATES);
+        tmplen = MAX_RATES;
+        if (get_common_rates(priv, rates->rates, &tmplen)) {
+                ret = -1;
+                goto done;
+        }
+        pos += sizeof(rates->header) + tmplen;
+        rates->header.len = cpu_to_le16(tmplen);
+        lbs_deb_assoc("ASSOC_CMD: num rates %u\n", tmplen);
+
+        /* Copy the infra. association rates into Current BSS state structure */
+        memset(&priv->curbssparams.rates, 0, sizeof(priv->curbssparams.rates));
+        memcpy(&priv->curbssparams.rates, &rates->rates, tmplen);
+
+        /* Set MSB on basic rates as the firmware requires, but _after_
+         * copying to current bss rates.
+         */
+        lbs_set_basic_rate_flags(rates->rates, tmplen);
+
+        /* Firmware v9+ indicate authentication suites as a TLV */
+        if (priv->fwrelease >= 0x09000000) {
+                DECLARE_MAC_BUF(mac);
+
+                auth = (struct mrvl_ie_auth_type *) pos;
+                auth->header.type = cpu_to_le16(TLV_TYPE_AUTH_TYPE);
+                auth->header.len = cpu_to_le16(2);
+                tmpauth = iw_auth_to_ieee_auth(priv->secinfo.auth_mode);
+                auth->auth = cpu_to_le16(tmpauth);
+                pos += sizeof(auth->header) + 2;
+
+                lbs_deb_join("AUTH_CMD: BSSID %s, auth 0x%x\n",
+                        print_mac(mac, bss->bssid), priv->secinfo.auth_mode);
+        }
+
+        /* WPA/WPA2 IEs */
+        if (assoc_req->secinfo.WPAenabled || assoc_req->secinfo.WPA2enabled) {
+                rsn = (struct mrvl_ie_rsn_param_set *) pos;
+                /* WPA_IE or WPA2_IE */
+                rsn->header.type = cpu_to_le16((u16) assoc_req->wpa_ie[0]);
+                tmplen = (u16) assoc_req->wpa_ie[1];
+                rsn->header.len = cpu_to_le16(tmplen);
+                memcpy(rsn->rsnie, &assoc_req->wpa_ie[2], tmplen);
+                lbs_deb_hex(LBS_DEB_JOIN, "ASSOC_CMD: WPA/RSN IE", (u8 *) rsn,
+                        sizeof(rsn->header) + tmplen);
+                pos += sizeof(rsn->header) + tmplen;
+        }
+
+        cmd.hdr.size = cpu_to_le16((sizeof(cmd) - sizeof(cmd.iebuf)) +
+                                   (u16)(pos - (u8 *) &cmd.iebuf));
+
+        /* update curbssparams */
+        priv->curbssparams.channel = bss->phy.ds.channel;
+
+        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
+                ret = -1;
+                goto done;
+        }
+
+        ret = lbs_cmd_with_response(priv, command, &cmd);
+        if (ret == 0) {
+                ret = lbs_assoc_post(priv,
+                        (struct cmd_ds_802_11_associate_response *) &cmd);
+        }
+
+done:
+        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
+        return ret;
+}
+
 /**
  *  @brief Associate to a specific BSS discovered in a scan
  *
@@ -110,7 +398,7 @@ static void lbs_set_basic_rate_flags(u8 *rates, size_t len)
  *
  *  @return          0-success, otherwise fail
  */
-static int lbs_associate(struct lbs_private *priv,
+static int lbs_try_associate(struct lbs_private *priv,
         struct assoc_request *assoc_req)
 {
         int ret;
@@ -118,11 +406,15 @@ static int lbs_associate(struct lbs_private *priv,
 
         lbs_deb_enter(LBS_DEB_ASSOC);
 
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_AUTHENTICATE,
-                                    0, CMD_OPTION_WAITFORRSP,
-                                    0, assoc_req->bss.bssid);
-        if (ret)
-                goto out;
+        /* FW v9 and higher indicate authentication suites as a TLV in the
+         * association command, not as a separate authentication command.
+         */
+        if (priv->fwrelease < 0x09000000) {
+                ret = lbs_set_authentication(priv, assoc_req->bss.bssid,
+                                             priv->secinfo.auth_mode);
+                if (ret)
+                        goto out;
+        }
 
         /* Use short preamble only when both the BSS and firmware support it */
         if ((priv->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
@@ -133,14 +425,78 @@ static int lbs_associate(struct lbs_private *priv,
         if (ret)
                 goto out;
 
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_ASSOCIATE,
-                                    0, CMD_OPTION_WAITFORRSP, 0, assoc_req);
+        ret = lbs_associate(priv, assoc_req, CMD_802_11_ASSOCIATE);
 
 out:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
         return ret;
 }
 
+static int lbs_adhoc_post(struct lbs_private *priv,
+                          struct cmd_ds_802_11_ad_hoc_result *resp)
+{
+        int ret = 0;
+        u16 command = le16_to_cpu(resp->hdr.command);
+        u16 result = le16_to_cpu(resp->hdr.result);
+        union iwreq_data wrqu;
+        struct bss_descriptor *bss;
+        DECLARE_SSID_BUF(ssid);
+
+        lbs_deb_enter(LBS_DEB_JOIN);
+
+        if (!priv->in_progress_assoc_req) {
+                lbs_deb_join("ADHOC_RESP: no in-progress association "
+                        "request\n");
+                ret = -1;
+                goto done;
+        }
+        bss = &priv->in_progress_assoc_req->bss;
+
+        /*
+         * Join result code 0 --> SUCCESS
+         */
+        if (result) {
+                lbs_deb_join("ADHOC_RESP: failed (result 0x%X)\n", result);
+                if (priv->connect_status == LBS_CONNECTED)
+                        lbs_mac_event_disconnected(priv);
+                ret = -1;
+                goto done;
+        }
+
+        /* Send a Media Connected event, according to the Spec */
+        priv->connect_status = LBS_CONNECTED;
+
+        if (command == CMD_RET(CMD_802_11_AD_HOC_START)) {
+                /* Update the created network descriptor with the new BSSID */
+                memcpy(bss->bssid, resp->bssid, ETH_ALEN);
+        }
+
+        /* Set the BSSID from the joined/started descriptor */
+        memcpy(&priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
+
+        /* Set the new SSID to current SSID */
+        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
+        priv->curbssparams.ssid_len = bss->ssid_len;
+
+        netif_carrier_on(priv->dev);
+        if (!priv->tx_pending_len)
+                netif_wake_queue(priv->dev);
+
+        memset(&wrqu, 0, sizeof(wrqu));
+        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
+
+        lbs_deb_join("ADHOC_RESP: Joined/started '%s', BSSID %pM, channel %d\n",
+                     print_ssid(ssid, bss->ssid, bss->ssid_len),
+                     priv->curbssparams.bssid,
+                     priv->curbssparams.channel);
+
+done:
+        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
+        return ret;
+}
+
 /**
  *  @brief Join an adhoc network found in a previous scan
  *
@@ -219,11 +575,10 @@ static int lbs_adhoc_join(struct lbs_private *priv,
         memcpy(&cmd.bss.bssid, &bss->bssid, ETH_ALEN);
         memcpy(&cmd.bss.ssid, &bss->ssid, bss->ssid_len);
 
-        memcpy(&cmd.bss.phyparamset, &bss->phyparamset,
-               sizeof(union ieeetypes_phyparamset));
+        memcpy(&cmd.bss.ds, &bss->phy.ds, sizeof(struct ieee_ie_ds_param_set));
 
-        memcpy(&cmd.bss.ssparamset, &bss->ssparamset,
-               sizeof(union IEEEtypes_ssparamset));
+        memcpy(&cmd.bss.ibss, &bss->ss.ibss,
+               sizeof(struct ieee_ie_ibss_param_set));
 
         cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK);
         lbs_deb_join("ADHOC_J_CMD: tmpcap=%4X CAPINFO_MASK=%4X\n",
@@ -260,7 +615,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
          */
         lbs_set_basic_rate_flags(cmd.bss.rates, ratesize);
 
-        cmd.bss.ssparamset.ibssparamset.atimwindow = cpu_to_le16(bss->atimwindow);
+        cmd.bss.ibss.atimwindow = bss->atimwindow;
 
         if (assoc_req->secinfo.wep_enabled) {
                 u16 tmp = le16_to_cpu(cmd.bss.capability);
@@ -287,8 +642,10 @@ static int lbs_adhoc_join(struct lbs_private *priv,
         }
 
         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd);
-        if (ret == 0)
-                ret = lbs_adhoc_post(priv, (struct cmd_header *) &cmd);
+        if (ret == 0) {
+                ret = lbs_adhoc_post(priv,
+                                     (struct cmd_ds_802_11_ad_hoc_result *)&cmd);
+        }
 
 out:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -343,22 +700,24 @@ static int lbs_adhoc_start(struct lbs_private *priv,
         WARN_ON(!assoc_req->channel);
 
         /* set Physical parameter set */
-        cmd.phyparamset.dsparamset.elementid = WLAN_EID_DS_PARAMS;
-        cmd.phyparamset.dsparamset.len = 1;
-        cmd.phyparamset.dsparamset.currentchan = assoc_req->channel;
+        cmd.ds.header.id = WLAN_EID_DS_PARAMS;
+        cmd.ds.header.len = 1;
+        cmd.ds.channel = assoc_req->channel;
 
         /* set IBSS parameter set */
-        cmd.ssparamset.ibssparamset.elementid = WLAN_EID_IBSS_PARAMS;
-        cmd.ssparamset.ibssparamset.len = 2;
-        cmd.ssparamset.ibssparamset.atimwindow = 0;
+        cmd.ibss.header.id = WLAN_EID_IBSS_PARAMS;
+        cmd.ibss.header.len = 2;
+        cmd.ibss.atimwindow = cpu_to_le16(0);
 
         /* set capability info */
         tmpcap = WLAN_CAPABILITY_IBSS;
-        if (assoc_req->secinfo.wep_enabled) {
-                lbs_deb_join("ADHOC_START: WEP enabled, setting privacy on\n");
+        if (assoc_req->secinfo.wep_enabled ||
+            assoc_req->secinfo.WPAenabled ||
+            assoc_req->secinfo.WPA2enabled) {
+                lbs_deb_join("ADHOC_START: WEP/WPA enabled, privacy on\n");
                 tmpcap |= WLAN_CAPABILITY_PRIVACY;
         } else
-                lbs_deb_join("ADHOC_START: WEP disabled, setting privacy off\n");
+                lbs_deb_join("ADHOC_START: WEP disabled, privacy off\n");
 
         cmd.capability = cpu_to_le16(tmpcap);
 
@@ -395,7 +754,8 @@ static int lbs_adhoc_start(struct lbs_private *priv,
 
         ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_START, &cmd);
         if (ret == 0)
-                ret = lbs_adhoc_post(priv, (struct cmd_header *) &cmd);
+                ret = lbs_adhoc_post(priv,
+                                     (struct cmd_ds_802_11_ad_hoc_result *)&cmd);
 
 out:
         lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
@@ -720,7 +1080,7 @@ static int assoc_helper_essid(struct lbs_private *priv,
                                 assoc_req->ssid_len, NULL, IW_MODE_INFRA, channel);
                 if (bss != NULL) {
                         memcpy(&assoc_req->bss, bss, sizeof(struct bss_descriptor));
-                        ret = lbs_associate(priv, assoc_req);
+                        ret = lbs_try_associate(priv, assoc_req);
                 } else {
                         lbs_deb_assoc("SSID not found; cannot associate\n");
                 }
@@ -772,8 +1132,9 @@ static int assoc_helper_bssid(struct lbs_private *priv,
 
         memcpy(&assoc_req->bss, bss, sizeof(struct bss_descriptor));
         if (assoc_req->mode == IW_MODE_INFRA) {
-                ret = lbs_associate(priv, assoc_req);
-                lbs_deb_assoc("ASSOC: lbs_associate(bssid) returned %d\n", ret);
+                ret = lbs_try_associate(priv, assoc_req);
+                lbs_deb_assoc("ASSOC: lbs_try_associate(bssid) returned %d\n",
+                              ret);
         } else if (assoc_req->mode == IW_MODE_ADHOC) {
                 lbs_adhoc_join(priv, assoc_req);
         }
@@ -1467,57 +1828,6 @@ struct assoc_request *lbs_get_association_request(struct lbs_private *priv)
 
 
 /**
- *  @brief This function prepares command of authenticate.
- *
- *  @param priv      A pointer to struct lbs_private structure
- *  @param cmd       A pointer to cmd_ds_command structure
- *  @param pdata_buf Void cast of pointer to a BSSID to authenticate with
- *
- *  @return         0 or -1
- */
-int lbs_cmd_80211_authenticate(struct lbs_private *priv,
-                                 struct cmd_ds_command *cmd,
-                                 void *pdata_buf)
-{
-        struct cmd_ds_802_11_authenticate *pauthenticate = &cmd->params.auth;
-        int ret = -1;
-        u8 *bssid = pdata_buf;
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        cmd->command = cpu_to_le16(CMD_802_11_AUTHENTICATE);
-        cmd->size = cpu_to_le16(sizeof(struct cmd_ds_802_11_authenticate)
-                        + S_DS_GEN);
-
-        /* translate auth mode to 802.11 defined wire value */
-        switch (priv->secinfo.auth_mode) {
-        case IW_AUTH_ALG_OPEN_SYSTEM:
-                pauthenticate->authtype = 0x00;
-                break;
-        case IW_AUTH_ALG_SHARED_KEY:
-                pauthenticate->authtype = 0x01;
-                break;
-        case IW_AUTH_ALG_LEAP:
-                pauthenticate->authtype = 0x80;
-                break;
-        default:
-                lbs_deb_join("AUTH_CMD: invalid auth alg 0x%X\n",
-                        priv->secinfo.auth_mode);
-                goto out;
-        }
-
-        memcpy(pauthenticate->macaddr, bssid, ETH_ALEN);
-
-        lbs_deb_join("AUTH_CMD: BSSID %pM, auth 0x%x\n",
-                bssid, pauthenticate->authtype);
-        ret = 0;
-
-out:
-        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
-        return ret;
-}
-
-/**
  *  @brief Deauthenticate from a specific BSS
  *
  *  @param priv        A pointer to struct lbs_private structure
@@ -1550,285 +1860,3 @@ int lbs_cmd_80211_deauthenticate(struct lbs_private *priv, u8 bssid[ETH_ALEN],
         return ret;
 }
 
-int lbs_cmd_80211_associate(struct lbs_private *priv,
-                              struct cmd_ds_command *cmd, void *pdata_buf)
-{
-        struct cmd_ds_802_11_associate *passo = &cmd->params.associate;
-        int ret = 0;
-        struct assoc_request *assoc_req = pdata_buf;
-        struct bss_descriptor *bss = &assoc_req->bss;
-        u8 *pos;
-        u16 tmpcap, tmplen;
-        struct mrvlietypes_ssidparamset *ssid;
-        struct mrvlietypes_phyparamset *phy;
-        struct mrvlietypes_ssparamset *ss;
-        struct mrvlietypes_ratesparamset *rates;
-        struct mrvlietypes_rsnparamset *rsn;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        pos = (u8 *) passo;
-
-        if (!priv) {
-                ret = -1;
-                goto done;
-        }
-
-        cmd->command = cpu_to_le16(CMD_802_11_ASSOCIATE);
-
-        memcpy(passo->peerstaaddr, bss->bssid, sizeof(passo->peerstaaddr));
-        pos += sizeof(passo->peerstaaddr);
-
-        /* set the listen interval */
-        passo->listeninterval = cpu_to_le16(MRVDRV_DEFAULT_LISTEN_INTERVAL);
-
-        pos += sizeof(passo->capability);
-        pos += sizeof(passo->listeninterval);
-        pos += sizeof(passo->bcnperiod);
-        pos += sizeof(passo->dtimperiod);
-
-        ssid = (struct mrvlietypes_ssidparamset *) pos;
-        ssid->header.type = cpu_to_le16(TLV_TYPE_SSID);
-        tmplen = bss->ssid_len;
-        ssid->header.len = cpu_to_le16(tmplen);
-        memcpy(ssid->ssid, bss->ssid, tmplen);
-        pos += sizeof(ssid->header) + tmplen;
-
-        phy = (struct mrvlietypes_phyparamset *) pos;
-        phy->header.type = cpu_to_le16(TLV_TYPE_PHY_DS);
-        tmplen = sizeof(phy->fh_ds.dsparamset);
-        phy->header.len = cpu_to_le16(tmplen);
-        memcpy(&phy->fh_ds.dsparamset,
-               &bss->phyparamset.dsparamset.currentchan,
-               tmplen);
-        pos += sizeof(phy->header) + tmplen;
-
-        ss = (struct mrvlietypes_ssparamset *) pos;
-        ss->header.type = cpu_to_le16(TLV_TYPE_CF);
-        tmplen = sizeof(ss->cf_ibss.cfparamset);
-        ss->header.len = cpu_to_le16(tmplen);
-        pos += sizeof(ss->header) + tmplen;
-
-        rates = (struct mrvlietypes_ratesparamset *) pos;
-        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
-        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = MAX_RATES;
-        if (get_common_rates(priv, rates->rates, &tmplen)) {
-                ret = -1;
-                goto done;
-        }
-        pos += sizeof(rates->header) + tmplen;
-        rates->header.len = cpu_to_le16(tmplen);
-        lbs_deb_assoc("ASSOC_CMD: num rates %u\n", tmplen);
-
-        /* Copy the infra. association rates into Current BSS state structure */
-        memset(&priv->curbssparams.rates, 0, sizeof(priv->curbssparams.rates));
-        memcpy(&priv->curbssparams.rates, &rates->rates, tmplen);
-
-        /* Set MSB on basic rates as the firmware requires, but _after_
-         * copying to current bss rates.
-         */
-        lbs_set_basic_rate_flags(rates->rates, tmplen);
-
-        if (assoc_req->secinfo.WPAenabled || assoc_req->secinfo.WPA2enabled) {
-                rsn = (struct mrvlietypes_rsnparamset *) pos;
-                /* WPA_IE or WPA2_IE */
-                rsn->header.type = cpu_to_le16((u16) assoc_req->wpa_ie[0]);
-                tmplen = (u16) assoc_req->wpa_ie[1];
-                rsn->header.len = cpu_to_le16(tmplen);
-                memcpy(rsn->rsnie, &assoc_req->wpa_ie[2], tmplen);
-                lbs_deb_hex(LBS_DEB_JOIN, "ASSOC_CMD: RSN IE", (u8 *) rsn,
-                        sizeof(rsn->header) + tmplen);
-                pos += sizeof(rsn->header) + tmplen;
-        }
-
-        /* update curbssparams */
-        priv->curbssparams.channel = bss->phyparamset.dsparamset.currentchan;
-
-        if (lbs_parse_dnld_countryinfo_11d(priv, bss)) {
-                ret = -1;
-                goto done;
-        }
-
-        cmd->size = cpu_to_le16((u16) (pos - (u8 *) passo) + S_DS_GEN);
-
-        /* set the capability info */
-        tmpcap = (bss->capability & CAPINFO_MASK);
-        if (bss->mode == IW_MODE_INFRA)
-                tmpcap |= WLAN_CAPABILITY_ESS;
-        passo->capability = cpu_to_le16(tmpcap);
-        lbs_deb_assoc("ASSOC_CMD: capability 0x%04x\n", tmpcap);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-int lbs_ret_80211_associate(struct lbs_private *priv,
-                              struct cmd_ds_command *resp)
-{
-        int ret = 0;
-        union iwreq_data wrqu;
-        struct ieeetypes_assocrsp *passocrsp;
-        struct bss_descriptor *bss;
-        u16 status_code;
-
-        lbs_deb_enter(LBS_DEB_ASSOC);
-
-        if (!priv->in_progress_assoc_req) {
-                lbs_deb_assoc("ASSOC_RESP: no in-progress assoc request\n");
-                ret = -1;
-                goto done;
-        }
-        bss = &priv->in_progress_assoc_req->bss;
-
-        passocrsp = (struct ieeetypes_assocrsp *) &resp->params;
-
-        /*
-         * Older FW versions map the IEEE 802.11 Status Code in the association
-         * response to the following values returned in passocrsp->statuscode:
-         *
-         *    IEEE Status Code                Marvell Status Code
-         *    0                       ->      0x0000 ASSOC_RESULT_SUCCESS
-         *    13                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    14                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    15                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    16                      ->      0x0004 ASSOC_RESULT_AUTH_REFUSED
-         *    others                  ->      0x0003 ASSOC_RESULT_REFUSED
-         *
-         * Other response codes:
-         *    0x0001 -> ASSOC_RESULT_INVALID_PARAMETERS (unused)
-         *    0x0002 -> ASSOC_RESULT_TIMEOUT (internal timer expired waiting for
-         *                                    association response from the AP)
-         */
-
-        status_code = le16_to_cpu(passocrsp->statuscode);
-        switch (status_code) {
-        case 0x00:
-                break;
-        case 0x01:
-                lbs_deb_assoc("ASSOC_RESP: invalid parameters\n");
-                break;
-        case 0x02:
-                lbs_deb_assoc("ASSOC_RESP: internal timer "
-                        "expired while waiting for the AP\n");
-                break;
-        case 0x03:
-                lbs_deb_assoc("ASSOC_RESP: association "
-                        "refused by AP\n");
-                break;
-        case 0x04:
-                lbs_deb_assoc("ASSOC_RESP: authentication "
-                        "refused by AP\n");
-                break;
-        default:
-                lbs_deb_assoc("ASSOC_RESP: failure reason 0x%02x "
-                        " unknown\n", status_code);
-                break;
-        }
-
-        if (status_code) {
-                lbs_mac_event_disconnected(priv);
-                ret = -1;
-                goto done;
-        }
-
-        lbs_deb_hex(LBS_DEB_ASSOC, "ASSOC_RESP", (void *)&resp->params,
-                le16_to_cpu(resp->size) - S_DS_GEN);
-
-        /* Send a Media Connected event, according to the Spec */
-        priv->connect_status = LBS_CONNECTED;
-
-        /* Update current SSID and BSSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
-        priv->curbssparams.ssid_len = bss->ssid_len;
-        memcpy(priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
-
-        priv->SNR[TYPE_RXPD][TYPE_AVG] = 0;
-        priv->NF[TYPE_RXPD][TYPE_AVG] = 0;
-
-        memset(priv->rawSNR, 0x00, sizeof(priv->rawSNR));
-        memset(priv->rawNF, 0x00, sizeof(priv->rawNF));
-        priv->nextSNRNF = 0;
-        priv->numSNRNF = 0;
-
-        netif_carrier_on(priv->dev);
-        if (!priv->tx_pending_len)
-                netif_wake_queue(priv->dev);
-
-        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_ASSOC, "ret %d", ret);
-        return ret;
-}
-
-static int lbs_adhoc_post(struct lbs_private *priv, struct cmd_header *resp)
-{
-        int ret = 0;
-        u16 command = le16_to_cpu(resp->command);
-        u16 result = le16_to_cpu(resp->result);
-        struct cmd_ds_802_11_ad_hoc_result *adhoc_resp;
-        union iwreq_data wrqu;
-        struct bss_descriptor *bss;
-        DECLARE_SSID_BUF(ssid);
-
-        lbs_deb_enter(LBS_DEB_JOIN);
-
-        adhoc_resp = (struct cmd_ds_802_11_ad_hoc_result *) resp;
-
-        if (!priv->in_progress_assoc_req) {
-                lbs_deb_join("ADHOC_RESP: no in-progress association "
-                        "request\n");
-                ret = -1;
-                goto done;
-        }
-        bss = &priv->in_progress_assoc_req->bss;
-
-        /*
-         * Join result code 0 --> SUCCESS
-         */
-        if (result) {
-                lbs_deb_join("ADHOC_RESP: failed (result 0x%X)\n", result);
-                if (priv->connect_status == LBS_CONNECTED)
-                        lbs_mac_event_disconnected(priv);
-                ret = -1;
-                goto done;
-        }
-
-        /* Send a Media Connected event, according to the Spec */
-        priv->connect_status = LBS_CONNECTED;
-
-        if (command == CMD_RET(CMD_802_11_AD_HOC_START)) {
-                /* Update the created network descriptor with the new BSSID */
-                memcpy(bss->bssid, adhoc_resp->bssid, ETH_ALEN);
-        }
-
-        /* Set the BSSID from the joined/started descriptor */
-        memcpy(&priv->curbssparams.bssid, bss->bssid, ETH_ALEN);
-
-        /* Set the new SSID to current SSID */
-        memcpy(&priv->curbssparams.ssid, &bss->ssid, IW_ESSID_MAX_SIZE);
-        priv->curbssparams.ssid_len = bss->ssid_len;
-
-        netif_carrier_on(priv->dev);
-        if (!priv->tx_pending_len)
-                netif_wake_queue(priv->dev);
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        memcpy(wrqu.ap_addr.sa_data, priv->curbssparams.bssid, ETH_ALEN);
-        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-        wireless_send_event(priv->dev, SIOCGIWAP, &wrqu, NULL);
-
-        lbs_deb_join("ADHOC_RESP: Joined/started '%s', BSSID %pM, channel %d\n",
-                     print_ssid(ssid, bss->ssid, bss->ssid_len),
-                     priv->curbssparams.bssid,
-                     priv->curbssparams.channel);
-
-done:
-        lbs_deb_leave_args(LBS_DEB_JOIN, "ret %d", ret);
-        return ret;
-}
-
diff --git a/drivers/net/wireless/libertas/assoc.h b/drivers/net/wireless/libertas/assoc.h
index 8b7336dd02a3..6e765e9f91a3 100644
--- a/drivers/net/wireless/libertas/assoc.h
+++ b/drivers/net/wireless/libertas/assoc.h
@@ -8,22 +8,9 @@
 void lbs_association_worker(struct work_struct *work);
 struct assoc_request *lbs_get_association_request(struct lbs_private *priv);
 
-struct cmd_ds_command;
-int lbs_cmd_80211_authenticate(struct lbs_private *priv,
-                                        struct cmd_ds_command *cmd,
-                                        void *pdata_buf);
-
 int lbs_adhoc_stop(struct lbs_private *priv);
 
 int lbs_cmd_80211_deauthenticate(struct lbs_private *priv,
                                  u8 bssid[ETH_ALEN], u16 reason);
-int lbs_cmd_80211_associate(struct lbs_private *priv,
-                                     struct cmd_ds_command *cmd,
-                                     void *pdata_buf);
-
-int lbs_ret_80211_ad_hoc_start(struct lbs_private *priv,
-                                        struct cmd_ds_command *resp);
-int lbs_ret_80211_associate(struct lbs_private *priv,
-                                     struct cmd_ds_command *resp);
 
 #endif /* _LBS_ASSOC_H */
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index c455b9abbfc0..01db705a38ec 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -1220,8 +1220,7 @@ static void lbs_submit_command(struct lbs_private *priv,
         command = le16_to_cpu(cmd->command);
 
         /* These commands take longer */
-        if (command == CMD_802_11_SCAN || command == CMD_802_11_ASSOCIATE ||
-            command == CMD_802_11_AUTHENTICATE)
+        if (command == CMD_802_11_SCAN || command == CMD_802_11_ASSOCIATE)
                 timeo = 5 * HZ;
 
         lbs_deb_cmd("DNLD_CMD: command 0x%04x, seq %d, size %d\n",
@@ -1415,15 +1414,6 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = lbs_cmd_802_11_ps_mode(cmdptr, cmd_action);
                 break;
 
-        case CMD_802_11_ASSOCIATE:
-        case CMD_802_11_REASSOCIATE:
-                ret = lbs_cmd_80211_associate(priv, cmdptr, pdata_buf);
-                break;
-
-        case CMD_802_11_AUTHENTICATE:
-                ret = lbs_cmd_80211_authenticate(priv, cmdptr, pdata_buf);
-                break;
-
         case CMD_MAC_REG_ACCESS:
         case CMD_BBP_REG_ACCESS:
         case CMD_RF_REG_ACCESS:
@@ -1470,8 +1460,8 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 break;
         case CMD_802_11_LED_GPIO_CTRL:
                 {
-                        struct mrvlietypes_ledgpio *gpio =
-                            (struct mrvlietypes_ledgpio*)
+                        struct mrvl_ie_ledgpio *gpio =
+                            (struct mrvl_ie_ledgpio*)
                             cmdptr->params.ledgpio.data;
 
                         memmove(&cmdptr->params.ledgpio,
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index bcf2a9756fb6..c42d3faa2660 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -5,7 +5,7 @@
 #include <linux/delay.h>
 #include <linux/if_arp.h>
 #include <linux/netdevice.h>
-
+#include <asm/unaligned.h>
 #include <net/iw_handler.h>
 
 #include "host.h"
@@ -154,11 +154,11 @@ static int lbs_ret_802_11_rssi(struct lbs_private *priv,
         lbs_deb_enter(LBS_DEB_CMD);
 
         /* store the non average value */
-        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = le16_to_cpu(rssirsp->SNR);
-        priv->NF[TYPE_BEACON][TYPE_NOAVG] = le16_to_cpu(rssirsp->noisefloor);
+        priv->SNR[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->SNR);
+        priv->NF[TYPE_BEACON][TYPE_NOAVG] = get_unaligned_le16(&rssirsp->noisefloor);
 
-        priv->SNR[TYPE_BEACON][TYPE_AVG] = le16_to_cpu(rssirsp->avgSNR);
-        priv->NF[TYPE_BEACON][TYPE_AVG] = le16_to_cpu(rssirsp->avgnoisefloor);
+        priv->SNR[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgSNR);
+        priv->NF[TYPE_BEACON][TYPE_AVG] = get_unaligned_le16(&rssirsp->avgnoisefloor);
 
         priv->RSSI[TYPE_BEACON][TYPE_NOAVG] =
             CAL_RSSI(priv->SNR[TYPE_BEACON][TYPE_NOAVG],
@@ -210,12 +210,6 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_reg_access(priv, respcmd, resp);
                 break;
 
-        case CMD_RET_802_11_ASSOCIATE:
-        case CMD_RET(CMD_802_11_ASSOCIATE):
-        case CMD_RET(CMD_802_11_REASSOCIATE):
-                ret = lbs_ret_80211_associate(priv, resp);
-                break;
-
         case CMD_RET(CMD_802_11_SET_AFC):
         case CMD_RET(CMD_802_11_GET_AFC):
                 spin_lock_irqsave(&priv->driver_lock, flags);
@@ -225,7 +219,6 @@ static inline int handle_cmd_response(struct lbs_private *priv,
 
                 break;
 
-        case CMD_RET(CMD_802_11_AUTHENTICATE):
         case CMD_RET(CMD_802_11_BEACON_STOP):
                 break;
 
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c
index 50e28a0cdfee..811ffc3ef414 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -183,12 +183,12 @@ out_unlock:
  */
 static void *lbs_tlv_find(uint16_t tlv_type, const uint8_t *tlv, uint16_t size)
 {
-        struct mrvlietypesheader *tlv_h;
+        struct mrvl_ie_header *tlv_h;
         uint16_t length;
         ssize_t pos = 0;
 
         while (pos < size) {
-                tlv_h = (struct mrvlietypesheader *) tlv;
+                tlv_h = (struct mrvl_ie_header *) tlv;
                 if (!tlv_h->len)
                         return NULL;
                 if (tlv_h->type == cpu_to_le16(tlv_type))
@@ -206,7 +206,7 @@ static ssize_t lbs_threshold_read(uint16_t tlv_type, uint16_t event_mask,
                                   size_t count, loff_t *ppos)
 {
         struct cmd_ds_802_11_subscribe_event *subscribed;
-        struct mrvlietypes_thresholds *got;
+        struct mrvl_ie_thresholds *got;
         struct lbs_private *priv = file->private_data;
         ssize_t ret = 0;
         size_t pos = 0;
@@ -259,7 +259,7 @@ static ssize_t lbs_threshold_write(uint16_t tlv_type, uint16_t event_mask,
                                    loff_t *ppos)
 {
         struct cmd_ds_802_11_subscribe_event *events;
-        struct mrvlietypes_thresholds *tlv;
+        struct mrvl_ie_thresholds *tlv;
         struct lbs_private *priv = file->private_data;
         ssize_t buf_size;
         int value, freq, new_mask;
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index a4455ec7c354..f9ec69e04734 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -321,8 +321,6 @@ struct lbs_private {
 
         u32 monitormode;
         u8 fw_ready;
-        u8 fn_init_required;
-        u8 fn_shutdown_required;
 };
 
 extern struct cmd_confirm_sleep confirm_sleep;
@@ -340,7 +338,7 @@ struct bss_descriptor {
         u32 rssi;
         u32 channel;
         u16 beaconperiod;
-        u32 atimwindow;
+        __le16 atimwindow;
 
         /* IW_MODE_AUTO, IW_MODE_ADHOC, IW_MODE_INFRA */
         u8 mode;
@@ -350,10 +348,10 @@ struct bss_descriptor {
 
         unsigned long last_scanned;
 
-        union ieeetypes_phyparamset phyparamset;
-        union IEEEtypes_ssparamset ssparamset;
+        union ieee_phy_param_set phy;
+        union ieee_ss_param_set ss;
 
-        struct ieeetypes_countryinfofullset countryinfo;
+        struct ieee_ie_country_info_full_set countryinfo;
 
         u8 wpa_ie[MAX_WPA_IE_LEN];
         size_t wpa_ie_len;
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 391c54ab2b09..0a2e29140add 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -250,7 +250,9 @@ struct cmd_ds_gspi_bus_config {
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_authenticate {
-        u8 macaddr[ETH_ALEN];
+        struct cmd_header hdr;
+
+        u8 bssid[ETH_ALEN];
         u8 authtype;
         u8 reserved[10];
 } __attribute__ ((packed));
@@ -263,22 +265,23 @@ struct cmd_ds_802_11_deauthenticate {
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_associate {
-        u8 peerstaaddr[6];
+        struct cmd_header hdr;
+
+        u8 bssid[6];
         __le16 capability;
         __le16 listeninterval;
         __le16 bcnperiod;
         u8 dtimperiod;
-
-#if 0
-        mrvlietypes_ssidparamset_t ssidParamSet;
-        mrvlietypes_phyparamset_t phyparamset;
-        mrvlietypes_ssparamset_t ssparamset;
-        mrvlietypes_ratesparamset_t ratesParamSet;
-#endif
+        u8 iebuf[512];    /* Enough for required and most optional IEs */
 } __attribute__ ((packed));
 
-struct cmd_ds_802_11_associate_rsp {
-        struct ieeetypes_assocrsp assocRsp;
+struct cmd_ds_802_11_associate_response {
+        struct cmd_header hdr;
+
+        __le16 capability;
+        __le16 statuscode;
+        __le16 aid;
+        u8 iebuf[512];
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_set_wep {
@@ -535,9 +538,11 @@ struct cmd_ds_802_11_ad_hoc_start {
         u8 bsstype;
         __le16 beaconperiod;
         u8 dtimperiod;   /* Reserved on v9 and later */
-        union IEEEtypes_ssparamset ssparamset;
-        union ieeetypes_phyparamset phyparamset;
-        __le16 probedelay;
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved1[4];
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved2[4];
+        __le16 probedelay;  /* Reserved on v9 and later */
         __le16 capability;
         u8 rates[MAX_RATES];
         u8 tlv_memory_size_pad[100];
@@ -558,8 +563,10 @@ struct adhoc_bssdesc {
         u8 dtimperiod;
         __le64 timestamp;
         __le64 localtime;
-        union ieeetypes_phyparamset phyparamset;
-        union IEEEtypes_ssparamset ssparamset;
+        struct ieee_ie_ds_param_set ds;
+        u8 reserved1[4];
+        struct ieee_ie_ibss_param_set ibss;
+        u8 reserved2[4];
         __le16 capability;
         u8 rates[MAX_RATES];
 
@@ -765,8 +772,6 @@ struct cmd_ds_command {
         /* command Body */
         union {
                 struct cmd_ds_802_11_ps_mode psmode;
-                struct cmd_ds_802_11_associate associate;
-                struct cmd_ds_802_11_authenticate auth;
                 struct cmd_ds_802_11_get_stat gstat;
                 struct cmd_ds_802_3_get_stat gstat_8023;
                 struct cmd_ds_802_11_rf_antenna rant;
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index a7e3fc119b70..8cdb88c6ca28 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -39,8 +39,24 @@
 #include "decl.h"
 #include "defs.h"
 #include "dev.h"
+#include "cmd.h"
 #include "if_sdio.h"
 
+/* The if_sdio_remove() callback function is called when
+ * user removes this module from kernel space or ejects
+ * the card from the slot. The driver handles these 2 cases
+ * differently for SD8688 combo chip.
+ * If the user is removing the module, the FUNC_SHUTDOWN
+ * command for SD8688 is sent to the firmware.
+ * If the card is removed, there is no need to send this command.
+ *
+ * The variable 'user_rmmod' is used to distinguish these two
+ * scenarios. This flag is initialized as FALSE in case the card
+ * is removed, and will be set to TRUE for module removal when
+ * module_exit function is called.
+ */
+static u8 user_rmmod;
+
 static char *lbs_helper_name = NULL;
 module_param_named(helper_name, lbs_helper_name, charp, 0644);
 
@@ -61,7 +77,6 @@ struct if_sdio_model {
         int model;
         const char *helper;
         const char *firmware;
-        struct if_sdio_card *card;
 };
 
 static struct if_sdio_model if_sdio_models[] = {
@@ -70,21 +85,18 @@ static struct if_sdio_model if_sdio_models[] = {
                 .model = IF_SDIO_MODEL_8385,
                 .helper = "sd8385_helper.bin",
                 .firmware = "sd8385.bin",
-                .card = NULL,
         },
         {
                 /* 8686 */
                 .model = IF_SDIO_MODEL_8686,
                 .helper = "sd8686_helper.bin",
                 .firmware = "sd8686.bin",
-                .card = NULL,
         },
         {
                 /* 8688 */
                 .model = IF_SDIO_MODEL_8688,
                 .helper = "sd8688_helper.bin",
                 .firmware = "sd8688.bin",
-                .card = NULL,
         },
 };
 
@@ -927,8 +939,6 @@ static int if_sdio_probe(struct sdio_func *func,
                 goto free;
         }
 
-        if_sdio_models[i].card = card;
-
         card->helper = if_sdio_models[i].helper;
         card->firmware = if_sdio_models[i].firmware;
 
@@ -1014,8 +1024,16 @@ static int if_sdio_probe(struct sdio_func *func,
         /*
          * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
          */
-        priv->fn_init_required =
-                (card->model == IF_SDIO_MODEL_8688) ? 1 : 0;
+        if (card->model == IF_SDIO_MODEL_8688) {
+                struct cmd_header cmd;
+
+                memset(&cmd, 0, sizeof(cmd));
+
+                lbs_deb_sdio("send function INIT command\n");
+                if (__lbs_cmd(priv, CMD_FUNC_INIT, &cmd, sizeof(cmd),
+                                lbs_cmd_copyback, (unsigned long) &cmd))
+                        lbs_pr_alert("CMD_FUNC_INIT cmd failed\n");
+        }
 
         ret = lbs_start_card(priv);
         if (ret)
@@ -1057,30 +1075,39 @@ static void if_sdio_remove(struct sdio_func *func)
 {
         struct if_sdio_card *card;
         struct if_sdio_packet *packet;
-        int ret;
 
         lbs_deb_enter(LBS_DEB_SDIO);
 
         card = sdio_get_drvdata(func);
 
-        lbs_stop_card(card->priv);
+        if (user_rmmod && (card->model == IF_SDIO_MODEL_8688)) {
+                /*
+                 * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
+                 * multiple functions
+                 */
+                struct cmd_header cmd;
+
+                memset(&cmd, 0, sizeof(cmd));
+
+                lbs_deb_sdio("send function SHUTDOWN command\n");
+                if (__lbs_cmd(card->priv, CMD_FUNC_SHUTDOWN,
+                                &cmd, sizeof(cmd), lbs_cmd_copyback,
+                                (unsigned long) &cmd))
+                        lbs_pr_alert("CMD_FUNC_SHUTDOWN cmd failed\n");
+        }
 
         card->priv->surpriseremoved = 1;
 
         lbs_deb_sdio("call remove card\n");
+        lbs_stop_card(card->priv);
         lbs_remove_card(card->priv);
 
         flush_workqueue(card->workqueue);
         destroy_workqueue(card->workqueue);
 
         sdio_claim_host(func);
-
-        /* Disable interrupts */
-        sdio_writeb(func, 0x00, IF_SDIO_H_INT_MASK, &ret);
-
         sdio_release_irq(func);
         sdio_disable_func(func);
-
         sdio_release_host(func);
 
         while (card->packets) {
@@ -1116,6 +1143,9 @@ static int __init if_sdio_init_module(void)
 
         ret = sdio_register_driver(&if_sdio_driver);
 
+        /* Clear the flag in case user removes the card. */
+        user_rmmod = 0;
+
         lbs_deb_leave_args(LBS_DEB_SDIO, "ret %d", ret);
 
         return ret;
@@ -1123,22 +1153,10 @@ static int __init if_sdio_init_module(void)
 
 static void __exit if_sdio_exit_module(void)
 {
-        int i;
-        struct if_sdio_card *card;
-
         lbs_deb_enter(LBS_DEB_SDIO);
 
-        for (i = 0; i < ARRAY_SIZE(if_sdio_models); i++) {
-                card = if_sdio_models[i].card;
-
-                /*
-                 * FUNC_SHUTDOWN is required for SD8688 WLAN/BT
-                 * multiple functions
-                 */
-                if (card && card->priv)
-                        card->priv->fn_shutdown_required =
-                                (card->model == IF_SDIO_MODEL_8688) ? 1 : 0;
-        }
+        /* Set the flag as user is removing this module. */
+        user_rmmod = 1;
 
         sdio_unregister_driver(&if_sdio_driver);
 
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 5fa55fe1f860..ea23c5de1420 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -119,9 +119,6 @@ static struct chip_ident chip_id_to_device_name[] = {
  * First we have to put a SPU register name on the bus. Then we can
  * either read from or write to that register.
  *
- * For 16-bit transactions, byte order on the bus is big-endian.
- * We don't have to worry about that here, though.
- * The translation takes place in the SPI routines.
  */
 
 static void spu_transaction_init(struct if_spi_card *card)
@@ -147,7 +144,7 @@ static void spu_transaction_finish(struct if_spi_card *card)
 static int spu_write(struct if_spi_card *card, u16 reg, const u8 *buf, int len)
 {
         int err = 0;
-        u16 reg_out = reg | IF_SPI_WRITE_OPERATION_MASK;
+        u16 reg_out = cpu_to_le16(reg | IF_SPI_WRITE_OPERATION_MASK);
 
         /* You must give an even number of bytes to the SPU, even if it
          * doesn't care about the last one.  */
@@ -169,16 +166,10 @@ out:
 
 static inline int spu_write_u16(struct if_spi_card *card, u16 reg, u16 val)
 {
-        return spu_write(card, reg, (u8 *)&val, sizeof(u16));
-}
+        u16 buff;
 
-static inline int spu_write_u32(struct if_spi_card *card, u16 reg, u32 val)
-{
-        /* The lower 16 bits are written first. */
-        u16 out[2];
-        out[0] = val & 0xffff;
-        out[1] = (val & 0xffff0000) >> 16;
-        return spu_write(card, reg, (u8 *)&out, sizeof(u32));
+        buff = cpu_to_le16(val);
+        return spu_write(card, reg, (u8 *)&buff, sizeof(u16));
 }
 
 static inline int spu_reg_is_port_reg(u16 reg)
@@ -198,7 +189,7 @@ static int spu_read(struct if_spi_card *card, u16 reg, u8 *buf, int len)
         unsigned int i, delay;
         int err = 0;
         u16 zero = 0;
-        u16 reg_out = reg | IF_SPI_READ_OPERATION_MASK;
+        u16 reg_out = cpu_to_le16(reg | IF_SPI_READ_OPERATION_MASK);
 
         /* You must take an even number of bytes from the SPU, even if you
          * don't care about the last one.  */
@@ -236,18 +227,25 @@ out:
 /* Read 16 bits from an SPI register */
 static inline int spu_read_u16(struct if_spi_card *card, u16 reg, u16 *val)
 {
-        return spu_read(card, reg, (u8 *)val, sizeof(u16));
+        u16 buf;
+        int ret;
+
+        ret = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
+        if (ret == 0)
+                *val = le16_to_cpup(&buf);
+        return ret;
 }
 
 /* Read 32 bits from an SPI register.
  * The low 16 bits are read first. */
 static int spu_read_u32(struct if_spi_card *card, u16 reg, u32 *val)
 {
-        u16 buf[2];
+        u32 buf;
         int err;
-        err = spu_read(card, reg, (u8 *)buf, sizeof(u32));
+
+        err = spu_read(card, reg, (u8 *)&buf, sizeof(buf));
         if (!err)
-                *val = buf[0] | (buf[1] << 16);
+                *val = le32_to_cpup(&buf);
         return err;
 }
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index a58a12352672..89575e448015 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -1002,17 +1002,9 @@ static int lbs_setup_firmware(struct lbs_private *priv)
 {
         int ret = -1;
         s16 curlevel = 0, minlevel = 0, maxlevel = 0;
-        struct cmd_header cmd;
 
         lbs_deb_enter(LBS_DEB_FW);
 
-        if (priv->fn_init_required) {
-                memset(&cmd, 0, sizeof(cmd));
-                if (__lbs_cmd(priv, CMD_FUNC_INIT, &cmd, sizeof(cmd),
-                                lbs_cmd_copyback, (unsigned long) &cmd))
-                        lbs_pr_alert("CMD_FUNC_INIT command failed\n");
-        }
-
         /* Read MAC address from firmware */
         memset(priv->current_addr, 0xff, ETH_ALEN);
         ret = lbs_update_hw_spec(priv);
@@ -1200,9 +1192,6 @@ struct lbs_private *lbs_add_card(void *card, struct device *dmdev)
         priv->mesh_open = 0;
         priv->infra_open = 0;
 
-        priv->fn_init_required = 0;
-        priv->fn_shutdown_required = 0;
-
         /* Setup the OS Interface to our functions */
         dev->netdev_ops = &lbs_netdev_ops;
         dev->watchdog_timeo = 5 * HZ;
@@ -1384,20 +1373,11 @@ void lbs_stop_card(struct lbs_private *priv)
         struct net_device *dev;
         struct cmd_ctrl_node *cmdnode;
         unsigned long flags;
-        struct cmd_header cmd;
 
         lbs_deb_enter(LBS_DEB_MAIN);
 
         if (!priv)
                 goto out;
-
-        if (priv->fn_shutdown_required) {
-                memset(&cmd, 0, sizeof(cmd));
-                if (__lbs_cmd(priv, CMD_FUNC_SHUTDOWN, &cmd, sizeof(cmd),
-                                lbs_cmd_copyback, (unsigned long) &cmd))
-                        lbs_pr_alert("CMD_FUNC_SHUTDOWN command failed\n");
-        }
-
         dev = priv->dev;
 
         netif_stop_queue(dev);
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 8124db36aaff..601b54249677 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -27,12 +27,12 @@
                              + 40)      /* 40 for WPAIE */
 
 //! Memory needed to store a max sized channel List TLV for a firmware scan
-#define CHAN_TLV_MAX_SIZE  (sizeof(struct mrvlietypesheader)    \
+#define CHAN_TLV_MAX_SIZE  (sizeof(struct mrvl_ie_header)    \
                             + (MRVDRV_MAX_CHANNELS_PER_SCAN     \
                                * sizeof(struct chanscanparamset)))
 
 //! Memory needed to store a max number/size SSID TLV for a firmware scan
-#define SSID_TLV_MAX_SIZE  (1 * sizeof(struct mrvlietypes_ssidparamset))
+#define SSID_TLV_MAX_SIZE  (1 * sizeof(struct mrvl_ie_ssid_param_set))
 
 //! Maximum memory needed for a cmd_ds_802_11_scan with all TLVs at max
 #define MAX_SCAN_CFG_ALLOC (sizeof(struct cmd_ds_802_11_scan)   \
@@ -211,7 +211,7 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
  */
 static int lbs_scan_add_ssid_tlv(struct lbs_private *priv, u8 *tlv)
 {
-        struct mrvlietypes_ssidparamset *ssid_tlv = (void *)tlv;
+        struct mrvl_ie_ssid_param_set *ssid_tlv = (void *)tlv;
 
         ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
         ssid_tlv->header.len = cpu_to_le16(priv->scan_ssid_len);
@@ -249,7 +249,7 @@ static int lbs_scan_add_chanlist_tlv(uint8_t *tlv,
                                      int chan_count)
 {
         size_t size = sizeof(struct chanscanparamset) *chan_count;
-        struct mrvlietypes_chanlistparamset *chan_tlv = (void *)tlv;
+        struct mrvl_ie_chanlist_param_set *chan_tlv = (void *)tlv;
 
         chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
         memcpy(chan_tlv->chanscanparam, chan_list, size);
@@ -270,7 +270,7 @@ static int lbs_scan_add_chanlist_tlv(uint8_t *tlv,
 static int lbs_scan_add_rates_tlv(uint8_t *tlv)
 {
         int i;
-        struct mrvlietypes_ratesparamset *rate_tlv = (void *)tlv;
+        struct mrvl_ie_rates_param_set *rate_tlv = (void *)tlv;
 
         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
         tlv += sizeof(rate_tlv->header);
@@ -513,12 +513,12 @@ void lbs_scan_worker(struct work_struct *work)
 static int lbs_process_bss(struct bss_descriptor *bss,
                            uint8_t **pbeaconinfo, int *bytesleft)
 {
-        struct ieeetypes_fhparamset *pFH;
-        struct ieeetypes_dsparamset *pDS;
-        struct ieeetypes_cfparamset *pCF;
-        struct ieeetypes_ibssparamset *pibss;
+        struct ieee_ie_fh_param_set *fh;
+        struct ieee_ie_ds_param_set *ds;
+        struct ieee_ie_cf_param_set *cf;
+        struct ieee_ie_ibss_param_set *ibss;
         DECLARE_SSID_BUF(ssid);
-        struct ieeetypes_countryinfoset *pcountryinfo;
+        struct ieee_ie_country_info_set *pcountryinfo;
         uint8_t *pos, *end, *p;
         uint8_t n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
         uint16_t beaconsize = 0;
@@ -616,50 +616,49 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         break;
 
                 case WLAN_EID_FH_PARAMS:
-                        pFH = (struct ieeetypes_fhparamset *) pos;
-                        memmove(&bss->phyparamset.fhparamset, pFH,
-                                sizeof(struct ieeetypes_fhparamset));
+                        fh = (struct ieee_ie_fh_param_set *) pos;
+                        memcpy(&bss->phy.fh, fh, sizeof(*fh));
                         lbs_deb_scan("got FH IE\n");
                         break;
 
                 case WLAN_EID_DS_PARAMS:
-                        pDS = (struct ieeetypes_dsparamset *) pos;
-                        bss->channel = pDS->currentchan;
-                        memcpy(&bss->phyparamset.dsparamset, pDS,
-                               sizeof(struct ieeetypes_dsparamset));
+                        ds = (struct ieee_ie_ds_param_set *) pos;
+                        bss->channel = ds->channel;
+                        memcpy(&bss->phy.ds, ds, sizeof(*ds));
                         lbs_deb_scan("got DS IE, channel %d\n", bss->channel);
                         break;
 
                 case WLAN_EID_CF_PARAMS:
-                        pCF = (struct ieeetypes_cfparamset *) pos;
-                        memcpy(&bss->ssparamset.cfparamset, pCF,
-                               sizeof(struct ieeetypes_cfparamset));
+                        cf = (struct ieee_ie_cf_param_set *) pos;
+                        memcpy(&bss->ss.cf, cf, sizeof(*cf));
                         lbs_deb_scan("got CF IE\n");
                         break;
 
                 case WLAN_EID_IBSS_PARAMS:
-                        pibss = (struct ieeetypes_ibssparamset *) pos;
-                        bss->atimwindow = le16_to_cpu(pibss->atimwindow);
-                        memmove(&bss->ssparamset.ibssparamset, pibss,
-                                sizeof(struct ieeetypes_ibssparamset));
+                        ibss = (struct ieee_ie_ibss_param_set *) pos;
+                        bss->atimwindow = ibss->atimwindow;
+                        memcpy(&bss->ss.ibss, ibss, sizeof(*ibss));
                         lbs_deb_scan("got IBSS IE\n");
                         break;
 
                 case WLAN_EID_COUNTRY:
-                        pcountryinfo = (struct ieeetypes_countryinfoset *) pos;
+                        pcountryinfo = (struct ieee_ie_country_info_set *) pos;
                         lbs_deb_scan("got COUNTRY IE\n");
-                        if (pcountryinfo->len < sizeof(pcountryinfo->countrycode)
-                            || pcountryinfo->len > 254) {
-                                lbs_deb_scan("process_bss: 11D- Err CountryInfo len %d, min %zd, max 254\n",
-                                             pcountryinfo->len, sizeof(pcountryinfo->countrycode));
+                        if (pcountryinfo->header.len < sizeof(pcountryinfo->countrycode)
+                            || pcountryinfo->header.len > 254) {
+                                lbs_deb_scan("%s: 11D- Err CountryInfo len %d, min %zd, max 254\n",
+                                             __func__,
+                                             pcountryinfo->header.len,
+                                             sizeof(pcountryinfo->countrycode));
                                 ret = -1;
                                 goto done;
                         }
 
-                        memcpy(&bss->countryinfo, pcountryinfo, pcountryinfo->len + 2);
+                        memcpy(&bss->countryinfo, pcountryinfo,
+                                pcountryinfo->header.len + 2);
                         lbs_deb_hex(LBS_DEB_SCAN, "process_bss: 11d countryinfo",
                                     (uint8_t *) pcountryinfo,
-                                    (int) (pcountryinfo->len + 2));
+                                    (int) (pcountryinfo->header.len + 2));
                         break;
 
                 case WLAN_EID_EXT_SUPP_RATES:
@@ -1130,7 +1129,7 @@ static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
                 goto done;
         }
 
-        bytesleft = le16_to_cpu(scanresp->bssdescriptsize);
+        bytesleft = get_unaligned_le16(&scanresp->bssdescriptsize);
         lbs_deb_scan("SCAN_RESP: bssdescriptsize %d\n", bytesleft);
 
         scanrespsize = le16_to_cpu(resp->size);
diff --git a/drivers/net/wireless/libertas/types.h b/drivers/net/wireless/libertas/types.h
index de03b9c9c204..99905df65b25 100644
--- a/drivers/net/wireless/libertas/types.h
+++ b/drivers/net/wireless/libertas/types.h
@@ -8,9 +8,14 @@
 #include <asm/byteorder.h>
 #include <linux/wireless.h>
 
-struct ieeetypes_cfparamset {
-        u8 elementid;
+struct ieee_ie_header {
+        u8 id;
         u8 len;
+} __attribute__ ((packed));
+
+struct ieee_ie_cf_param_set {
+        struct ieee_ie_header header;
+
         u8 cfpcnt;
         u8 cfpperiod;
         __le16 cfpmaxduration;
@@ -18,42 +23,35 @@ struct ieeetypes_cfparamset {
 } __attribute__ ((packed));
 
 
-struct ieeetypes_ibssparamset {
-        u8 elementid;
-        u8 len;
+struct ieee_ie_ibss_param_set {
+        struct ieee_ie_header header;
+
         __le16 atimwindow;
 } __attribute__ ((packed));
 
-union IEEEtypes_ssparamset {
-        struct ieeetypes_cfparamset cfparamset;
-        struct ieeetypes_ibssparamset ibssparamset;
+union ieee_ss_param_set {
+        struct ieee_ie_cf_param_set cf;
+        struct ieee_ie_ibss_param_set ibss;
 } __attribute__ ((packed));
 
-struct ieeetypes_fhparamset {
-        u8 elementid;
-        u8 len;
+struct ieee_ie_fh_param_set {
+        struct ieee_ie_header header;
+
         __le16 dwelltime;
         u8 hopset;
         u8 hoppattern;
         u8 hopindex;
 } __attribute__ ((packed));
 
-struct ieeetypes_dsparamset {
-        u8 elementid;
-        u8 len;
-        u8 currentchan;
-} __attribute__ ((packed));
+struct ieee_ie_ds_param_set {
+        struct ieee_ie_header header;
 
-union ieeetypes_phyparamset {
-        struct ieeetypes_fhparamset fhparamset;
-        struct ieeetypes_dsparamset dsparamset;
+        u8 channel;
 } __attribute__ ((packed));
 
-struct ieeetypes_assocrsp {
-        __le16 capability;
-        __le16 statuscode;
-        __le16 aid;
-        u8 iebuffer[1];
+union ieee_phy_param_set {
+        struct ieee_ie_fh_param_set fh;
+        struct ieee_ie_ds_param_set ds;
 } __attribute__ ((packed));
 
 /** TLV  type ID definition */
@@ -94,32 +92,33 @@ struct ieeetypes_assocrsp {
 #define TLV_TYPE_TSFTIMESTAMP       (PROPRIETARY_TLV_BASE_ID + 19)
 #define TLV_TYPE_RSSI_HIGH          (PROPRIETARY_TLV_BASE_ID + 22)
 #define TLV_TYPE_SNR_HIGH           (PROPRIETARY_TLV_BASE_ID + 23)
+#define TLV_TYPE_AUTH_TYPE          (PROPRIETARY_TLV_BASE_ID + 31)
 #define TLV_TYPE_MESH_ID            (PROPRIETARY_TLV_BASE_ID + 37)
 #define TLV_TYPE_OLD_MESH_ID        (PROPRIETARY_TLV_BASE_ID + 291)
 
 /** TLV related data structures*/
-struct mrvlietypesheader {
+struct mrvl_ie_header {
         __le16 type;
         __le16 len;
 } __attribute__ ((packed));
 
-struct mrvlietypes_data {
-        struct mrvlietypesheader header;
+struct mrvl_ie_data {
+        struct mrvl_ie_header header;
         u8 Data[1];
 } __attribute__ ((packed));
 
-struct mrvlietypes_ratesparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_rates_param_set {
+        struct mrvl_ie_header header;
         u8 rates[1];
 } __attribute__ ((packed));
 
-struct mrvlietypes_ssidparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_ssid_param_set {
+        struct mrvl_ie_header header;
         u8 ssid[1];
 } __attribute__ ((packed));
 
-struct mrvlietypes_wildcardssidparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_wildcard_ssid_param_set {
+        struct mrvl_ie_header header;
         u8 MaxSsidlength;
         u8 ssid[1];
 } __attribute__ ((packed));
@@ -144,91 +143,72 @@ struct chanscanparamset {
         __le16 maxscantime;
 } __attribute__ ((packed));
 
-struct mrvlietypes_chanlistparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_chanlist_param_set {
+        struct mrvl_ie_header header;
         struct chanscanparamset chanscanparam[1];
 } __attribute__ ((packed));
 
-struct cfparamset {
+struct mrvl_ie_cf_param_set {
+        struct mrvl_ie_header header;
         u8 cfpcnt;
         u8 cfpperiod;
         __le16 cfpmaxduration;
         __le16 cfpdurationremaining;
 } __attribute__ ((packed));
 
-struct ibssparamset {
-        __le16 atimwindow;
-} __attribute__ ((packed));
-
-struct mrvlietypes_ssparamset {
-        struct mrvlietypesheader header;
-        union {
-                struct cfparamset cfparamset[1];
-                struct ibssparamset ibssparamset[1];
-        } cf_ibss;
+struct mrvl_ie_ds_param_set {
+        struct mrvl_ie_header header;
+        u8 channel;
 } __attribute__ ((packed));
 
-struct fhparamset {
-        __le16 dwelltime;
-        u8 hopset;
-        u8 hoppattern;
-        u8 hopindex;
-} __attribute__ ((packed));
-
-struct dsparamset {
-        u8 currentchan;
-} __attribute__ ((packed));
-
-struct mrvlietypes_phyparamset {
-        struct mrvlietypesheader header;
-        union {
-                struct fhparamset fhparamset[1];
-                struct dsparamset dsparamset[1];
-        } fh_ds;
-} __attribute__ ((packed));
-
-struct mrvlietypes_rsnparamset {
-        struct mrvlietypesheader header;
+struct mrvl_ie_rsn_param_set {
+        struct mrvl_ie_header header;
         u8 rsnie[1];
 } __attribute__ ((packed));
 
-struct mrvlietypes_tsftimestamp {
-        struct mrvlietypesheader header;
+struct mrvl_ie_tsf_timestamp {
+        struct mrvl_ie_header header;
         __le64 tsftable[1];
 } __attribute__ ((packed));
 
+/* v9 and later firmware only */
+struct mrvl_ie_auth_type {
+        struct mrvl_ie_header header;
+        __le16 auth;
+} __attribute__ ((packed));
+
 /**  Local Power capability */
-struct mrvlietypes_powercapability {
-        struct mrvlietypesheader header;
+struct mrvl_ie_power_capability {
+        struct mrvl_ie_header header;
         s8 minpower;
         s8 maxpower;
 } __attribute__ ((packed));
 
 /* used in CMD_802_11_SUBSCRIBE_EVENT for SNR, RSSI and Failure */
-struct mrvlietypes_thresholds {
-        struct mrvlietypesheader header;
+struct mrvl_ie_thresholds {
+        struct mrvl_ie_header header;
         u8 value;
         u8 freq;
 } __attribute__ ((packed));
 
-struct mrvlietypes_beaconsmissed {
-        struct mrvlietypesheader header;
+struct mrvl_ie_beacons_missed {
+        struct mrvl_ie_header header;
         u8 beaconmissed;
         u8 reserved;
 } __attribute__ ((packed));
 
-struct mrvlietypes_numprobes {
-        struct mrvlietypesheader header;
+struct mrvl_ie_num_probes {
+        struct mrvl_ie_header header;
         __le16 numprobes;
 } __attribute__ ((packed));
 
-struct mrvlietypes_bcastprobe {
-        struct mrvlietypesheader header;
+struct mrvl_ie_bcast_probe {
+        struct mrvl_ie_header header;
         __le16 bcastprobe;
 } __attribute__ ((packed));
 
-struct mrvlietypes_numssidprobe {
-        struct mrvlietypesheader header;
+struct mrvl_ie_num_ssid_probe {
+        struct mrvl_ie_header header;
         __le16 numssidprobe;
 } __attribute__ ((packed));
 
@@ -237,8 +217,8 @@ struct led_pin {
         u8 pin;
 } __attribute__ ((packed));
 
-struct mrvlietypes_ledgpio {
-        struct mrvlietypesheader header;
+struct mrvl_ie_ledgpio {
+        struct mrvl_ie_header header;
         struct led_pin ledpin[1];
 } __attribute__ ((packed));
 
@@ -250,8 +230,8 @@ struct led_bhv {
 } __attribute__ ((packed));
 
 
-struct mrvlietypes_ledbhv {
-        struct mrvlietypesheader header;
+struct mrvl_ie_ledbhv {
+        struct mrvl_ie_header header;
         struct led_bhv ledbhv[1];
 } __attribute__ ((packed));
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 574b8bb121e1..e789c6e9938c 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -280,7 +280,6 @@ struct mac80211_hwsim_data {
         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
 
         struct ieee80211_channel *channel;
-        int radio_enabled;
         unsigned long beacon_int; /* in jiffies unit */
         unsigned int rx_filter;
         int started;
@@ -418,8 +417,7 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
                 if (data == data2)
                         continue;
 
-                if (!data2->started || !data2->radio_enabled ||
-                    !hwsim_ps_rx_ok(data2, skb) ||
+                if (!data2->started || !hwsim_ps_rx_ok(data2, skb) ||
                     data->channel->center_freq != data2->channel->center_freq ||
                     !(data->group & data2->group))
                         continue;
@@ -441,7 +439,6 @@ static bool mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 
 static int mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
 {
-        struct mac80211_hwsim_data *data = hw->priv;
         bool ack;
         struct ieee80211_tx_info *txi;
 
@@ -453,13 +450,6 @@ static int mac80211_hwsim_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return NETDEV_TX_OK;
         }
 
-        if (!data->radio_enabled) {
-                printk(KERN_DEBUG "%s: dropped TX frame since radio "
-                       "disabled\n", wiphy_name(hw->wiphy));
-                dev_kfree_skb(skb);
-                return NETDEV_TX_OK;
-        }
-
         ack = mac80211_hwsim_tx_frame(hw, skb);
 
         txi = IEEE80211_SKB_CB(skb);
@@ -546,7 +536,7 @@ static void mac80211_hwsim_beacon(unsigned long arg)
         struct ieee80211_hw *hw = (struct ieee80211_hw *) arg;
         struct mac80211_hwsim_data *data = hw->priv;
 
-        if (!data->started || !data->radio_enabled)
+        if (!data->started)
                 return;
 
         ieee80211_iterate_active_interfaces_atomic(
@@ -562,15 +552,14 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
         struct mac80211_hwsim_data *data = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
 
-        printk(KERN_DEBUG "%s:%s (freq=%d radio_enabled=%d idle=%d ps=%d)\n",
+        printk(KERN_DEBUG "%s:%s (freq=%d idle=%d ps=%d)\n",
                wiphy_name(hw->wiphy), __func__,
-               conf->channel->center_freq, conf->radio_enabled,
+               conf->channel->center_freq,
                !!(conf->flags & IEEE80211_CONF_IDLE),
                !!(conf->flags & IEEE80211_CONF_PS));
 
         data->channel = conf->channel;
-        data->radio_enabled = conf->radio_enabled;
-        if (!data->started || !data->radio_enabled || !data->beacon_int)
+        if (!data->started || !data->beacon_int)
                 del_timer(&data->beacon_timer);
         else
                 mod_timer(&data->beacon_timer, jiffies + data->beacon_int);
@@ -787,8 +776,7 @@ static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
         pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
         memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
         memcpy(pspoll->ta, mac, ETH_ALEN);
-        if (data->radio_enabled &&
-            !mac80211_hwsim_tx_frame(data->hw, skb))
+        if (!mac80211_hwsim_tx_frame(data->hw, skb))
                 printk(KERN_DEBUG "%s: PS-Poll frame not ack'ed\n", __func__);
         dev_kfree_skb(skb);
 }
@@ -819,8 +807,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
         memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
         memcpy(hdr->addr2, mac, ETH_ALEN);
         memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
-        if (data->radio_enabled &&
-            !mac80211_hwsim_tx_frame(data->hw, skb))
+        if (!mac80211_hwsim_tx_frame(data->hw, skb))
                 printk(KERN_DEBUG "%s: nullfunc frame not ack'ed\n", __func__);
         dev_kfree_skb(skb);
 }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index f40c0f468b27..0e877a104a89 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -84,8 +84,8 @@ MODULE_DEVICE_TABLE(usb, p54u_table);
 static const struct {
         u32 intf;
         enum p54u_hw_type type;
-        char fw[FIRMWARE_NAME_MAX];
-        char fw_legacy[FIRMWARE_NAME_MAX];
+        const char *fw;
+        const char *fw_legacy;
         char hw[20];
 } p54u_fwlist[__NUM_P54U_HWTYPES] = {
         {
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 0197531bd88c..435f945fe64d 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -520,7 +520,7 @@ static void rt2400pci_config_ps(struct rt2x00_dev *rt2x00dev,
         if (state == STATE_SLEEP) {
                 rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_DELAY_AFTER_TBCN,
-                                   (libconf->conf->beacon_int - 20) * 16);
+                                   (rt2x00dev->beacon_int - 20) * 16);
                 rt2x00_set_field32(&reg, CSR20_TBCN_BEFORE_WAKEUP,
                                    libconf->conf->listen_interval - 1);
 
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index f95cb646f85a..08b30d01e67d 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -569,7 +569,7 @@ static void rt2500pci_config_ps(struct rt2x00_dev *rt2x00dev,
         if (state == STATE_SLEEP) {
                 rt2x00pci_register_read(rt2x00dev, CSR20, &reg);
                 rt2x00_set_field32(&reg, CSR20_DELAY_AFTER_TBCN,
-                                   (libconf->conf->beacon_int - 20) * 16);
+                                   (rt2x00dev->beacon_int - 20) * 16);
                 rt2x00_set_field32(&reg, CSR20_TBCN_BEFORE_WAKEUP,
                                    libconf->conf->listen_interval - 1);
 
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 69f966f1ce54..66daf68ff0ee 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -647,7 +647,7 @@ static void rt2500usb_config_ps(struct rt2x00_dev *rt2x00dev,
         if (state == STATE_SLEEP) {
                 rt2500usb_register_read(rt2x00dev, MAC_CSR18, &reg);
                 rt2x00_set_field16(&reg, MAC_CSR18_DELAY_AFTER_BEACON,
-                                   libconf->conf->beacon_int - 20);
+                                   rt2x00dev->beacon_int - 20);
                 rt2x00_set_field16(&reg, MAC_CSR18_BEACONS_BEFORE_WAKEUP,
                                    libconf->conf->listen_interval - 1);
 
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 142ad34fdc49..37561667925b 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -2927,12 +2927,17 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c09), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c0a), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c0b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0d), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0e), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x07d1, 0x3c0f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c11), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x07d1, 0x3c13), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Edimax */
         { USB_DEVICE(0x7392, 0x7711), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7717), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x7392, 0x7718), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* Encore */
+        { USB_DEVICE(0x203d, 0x1480), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* EnGenius */
         { USB_DEVICE(0X1740, 0x9701), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x9702), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -2951,6 +2956,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0e66, 0x0003), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x0009), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0e66, 0x000b), USB_DEVICE_DATA(&rt2800usb_ops) },
+        /* I-O DATA */
+        { USB_DEVICE(0x04bb, 0x0945), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* LevelOne */
         { USB_DEVICE(0x1740, 0x0605), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1740, 0x0615), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -2970,6 +2977,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Pegatron */
         { USB_DEVICE(0x1d4d, 0x0002), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x1d4d, 0x000c), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x1d4d, 0x000e), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Philips */
         { USB_DEVICE(0x0471, 0x200f), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Planex */
@@ -2981,6 +2989,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Quanta */
         { USB_DEVICE(0x1a32, 0x0304), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Ralink */
+        { USB_DEVICE(0x0db0, 0x3820), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0db0, 0x6899), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2070), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x148f, 0x2770), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -3005,6 +3014,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x0df6, 0x003e), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x003f), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0df6, 0x0040), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x0df6, 0x0042), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* SMC */
         { USB_DEVICE(0x083a, 0x6618), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x083a, 0x7511), USB_DEVICE_DATA(&rt2800usb_ops) },
@@ -3029,6 +3039,8 @@ static struct usb_device_id rt2800usb_device_table[] = {
         /* Zinwell */
         { USB_DEVICE(0x5a57, 0x0280), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x5a57, 0x0282), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x5a57, 0x0283), USB_DEVICE_DATA(&rt2800usb_ops) },
+        { USB_DEVICE(0x5a57, 0x5257), USB_DEVICE_DATA(&rt2800usb_ops) },
         /* Zyxel */
         { USB_DEVICE(0x0586, 0x3416), USB_DEVICE_DATA(&rt2800usb_ops) },
         { USB_DEVICE(0x0586, 0x341a), USB_DEVICE_DATA(&rt2800usb_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 2b64a6198698..a498dde024e1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -802,6 +802,11 @@ struct rt2x00_dev {
         u8 calibration[2];
 
         /*
+         * Beacon interval.
+         */
+        u16 beacon_int;
+
+        /*
          * Low level statistics which will have
          * to be kept up to date while device is running.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index c5bbf0b6e207..3e019a12df2e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -108,6 +108,9 @@ void rt2x00lib_config_erp(struct rt2x00_dev *rt2x00dev,
         erp.basic_rates = bss_conf->basic_rates;
         erp.beacon_int = bss_conf->beacon_int;
 
+        /* Update global beacon interval time, this is needed for PS support */
+        rt2x00dev->beacon_int = bss_conf->beacon_int;
+
         rt2x00dev->ops->lib->config_erp(rt2x00dev, &erp);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index a8bf5c432858..49b29ff90c47 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -956,7 +956,7 @@ static void rt61pci_config_ps(struct rt2x00_dev *rt2x00dev,
         if (state == STATE_SLEEP) {
                 rt2x00pci_register_read(rt2x00dev, MAC_CSR11, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN,
-                                   libconf->conf->beacon_int - 10);
+                                   rt2x00dev->beacon_int - 10);
                 rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP,
                                    libconf->conf->listen_interval - 1);
                 rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 5);
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 211a3d6bc054..c18848836f2d 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -852,7 +852,7 @@ static void rt73usb_config_ps(struct rt2x00_dev *rt2x00dev,
         if (state == STATE_SLEEP) {
                 rt2x00usb_register_read(rt2x00dev, MAC_CSR11, &reg);
                 rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN,
-                                   libconf->conf->beacon_int - 10);
+                                   rt2x00dev->beacon_int - 10);
                 rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP,
                                    libconf->conf->listen_interval - 1);
                 rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 5);
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 284ebaca6e45..c682ac536415 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -21,7 +21,7 @@ config ACER_WMI
         depends on NEW_LEDS
         depends on BACKLIGHT_CLASS_DEVICE
         depends on SERIO_I8042
-        depends on RFKILL
+        depends on RFKILL || RFKILL = n
         select ACPI_WMI
         ---help---
           This is a driver for newer Acer (and Wistron) laptops. It adds
@@ -60,7 +60,7 @@ config DELL_LAPTOP
         depends on DCDBAS
         depends on EXPERIMENTAL
         depends on BACKLIGHT_CLASS_DEVICE
-        depends on RFKILL
+        depends on RFKILL || RFKILL = n
         depends on POWER_SUPPLY
         default n
         ---help---
@@ -117,7 +117,7 @@ config HP_WMI
         tristate "HP WMI extras"
         depends on ACPI_WMI
         depends on INPUT
-        depends on RFKILL
+        depends on RFKILL || RFKILL = n
         help
          Say Y here if you want to support WMI-based hotkeys on HP laptops and
          to read data from WMI such as docking or ambient light sensor state.
@@ -196,14 +196,13 @@ config THINKPAD_ACPI
         tristate "ThinkPad ACPI Laptop Extras"
         depends on ACPI
         depends on INPUT
+        depends on RFKILL || RFKILL = n
         select BACKLIGHT_LCD_SUPPORT
         select BACKLIGHT_CLASS_DEVICE
         select HWMON
         select NVRAM
         select NEW_LEDS
         select LEDS_CLASS
-        select NET
-        select RFKILL
         ---help---
           This is a driver for the IBM and Lenovo ThinkPad laptops. It adds
           support for Fn-Fx key combinations, Bluetooth control, video
@@ -338,9 +337,9 @@ config EEEPC_LAPTOP
         depends on ACPI
         depends on INPUT
         depends on EXPERIMENTAL
+        depends on RFKILL || RFKILL = n
         select BACKLIGHT_CLASS_DEVICE
         select HWMON
-        select RFKILL
         ---help---
           This driver supports the Fn-Fx keys on Eee PC laptops.
           It also adds the ability to switch camera/wlan on/off.
@@ -405,9 +404,8 @@ config ACPI_TOSHIBA
         tristate "Toshiba Laptop Extras"
         depends on ACPI
         depends on INPUT
+        depends on RFKILL || RFKILL = n
         select INPUT_POLLDEV
-        select NET
-        select RFKILL
         select BACKLIGHT_CLASS_DEVICE
         ---help---
           This driver adds support for access to certain system settings
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 62d02b3c998e..b618fa51db2d 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -958,58 +958,50 @@ static void acer_rfkill_update(struct work_struct *ignored)
 
         status = get_u32(&state, ACER_CAP_WIRELESS);
         if (ACPI_SUCCESS(status))
-                rfkill_force_state(wireless_rfkill, state ?
-                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED);
+                rfkill_set_sw_state(wireless_rfkill, !!state);
 
         if (has_cap(ACER_CAP_BLUETOOTH)) {
                 status = get_u32(&state, ACER_CAP_BLUETOOTH);
                 if (ACPI_SUCCESS(status))
-                        rfkill_force_state(bluetooth_rfkill, state ?
-                                RFKILL_STATE_UNBLOCKED :
-                                RFKILL_STATE_SOFT_BLOCKED);
+                        rfkill_set_sw_state(bluetooth_rfkill, !!state);
         }
 
         schedule_delayed_work(&acer_rfkill_work, round_jiffies_relative(HZ));
 }
 
-static int acer_rfkill_set(void *data, enum rfkill_state state)
+static int acer_rfkill_set(void *data, bool blocked)
 {
         acpi_status status;
-        u32 *cap = data;
-        status = set_u32((u32) (state == RFKILL_STATE_UNBLOCKED), *cap);
+        u32 cap = (unsigned long)data;
+        status = set_u32(!!blocked, cap);
         if (ACPI_FAILURE(status))
                 return -ENODEV;
         return 0;
 }
 
-static struct rfkill * acer_rfkill_register(struct device *dev,
-enum rfkill_type type, char *name, u32 cap)
+static const struct rfkill_ops acer_rfkill_ops = {
+        .set_block = acer_rfkill_set,
+};
+
+static struct rfkill *acer_rfkill_register(struct device *dev,
+                                           enum rfkill_type type,
+                                           char *name, u32 cap)
 {
         int err;
         u32 state;
-        u32 *data;
         struct rfkill *rfkill_dev;
 
-        rfkill_dev = rfkill_allocate(dev, type);
+        rfkill_dev = rfkill_alloc(name, dev, type,
+                                  &acer_rfkill_ops,
+                                  (void *)(unsigned long)cap);
         if (!rfkill_dev)
                 return ERR_PTR(-ENOMEM);
-        rfkill_dev->name = name;
         get_u32(&state, cap);
-        rfkill_dev->state = state ? RFKILL_STATE_UNBLOCKED :
-                RFKILL_STATE_SOFT_BLOCKED;
-        data = kzalloc(sizeof(u32), GFP_KERNEL);
-        if (!data) {
-                rfkill_free(rfkill_dev);
-                return ERR_PTR(-ENOMEM);
-        }
-        *data = cap;
-        rfkill_dev->data = data;
-        rfkill_dev->toggle_radio = acer_rfkill_set;
+        rfkill_set_sw_state(rfkill_dev, !state);
 
         err = rfkill_register(rfkill_dev);
         if (err) {
-                kfree(rfkill_dev->data);
-                rfkill_free(rfkill_dev);
+                rfkill_destroy(rfkill_dev);
                 return ERR_PTR(err);
         }
         return rfkill_dev;
@@ -1027,8 +1019,8 @@ static int acer_rfkill_init(struct device *dev)
                         RFKILL_TYPE_BLUETOOTH, "acer-bluetooth",
                         ACER_CAP_BLUETOOTH);
                 if (IS_ERR(bluetooth_rfkill)) {
-                        kfree(wireless_rfkill->data);
                         rfkill_unregister(wireless_rfkill);
+                        rfkill_destroy(wireless_rfkill);
                         return PTR_ERR(bluetooth_rfkill);
                 }
         }
@@ -1041,11 +1033,13 @@ static int acer_rfkill_init(struct device *dev)
 static void acer_rfkill_exit(void)
 {
         cancel_delayed_work_sync(&acer_rfkill_work);
-        kfree(wireless_rfkill->data);
+
         rfkill_unregister(wireless_rfkill);
+        rfkill_destroy(wireless_rfkill);
+
         if (has_cap(ACER_CAP_BLUETOOTH)) {
-                kfree(bluetooth_rfkill->data);
                 rfkill_unregister(bluetooth_rfkill);
+                rfkill_destroy(bluetooth_rfkill);
         }
         return;
 }
diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
index af9f43021172..2faf0e14f05a 100644
--- a/drivers/platform/x86/dell-laptop.c
+++ b/drivers/platform/x86/dell-laptop.c
@@ -174,10 +174,11 @@ dell_send_request(struct calling_interface_buffer *buffer, int class,
    result[3]: NVRAM format version number
 */
 
-static int dell_rfkill_set(int radio, enum rfkill_state state)
+static int dell_rfkill_set(void *data, bool blocked)
 {
         struct calling_interface_buffer buffer;
-        int disable = (state == RFKILL_STATE_UNBLOCKED) ? 0 : 1;
+        int disable = blocked ? 0 : 1;
+        unsigned long radio = (unsigned long)data;
 
         memset(&buffer, 0, sizeof(struct calling_interface_buffer));
         buffer.input[0] = (1 | (radio<<8) | (disable << 16));
@@ -186,56 +187,24 @@ static int dell_rfkill_set(int radio, enum rfkill_state state)
         return 0;
 }
 
-static int dell_wifi_set(void *data, enum rfkill_state state)
-{
-        return dell_rfkill_set(1, state);
-}
-
-static int dell_bluetooth_set(void *data, enum rfkill_state state)
-{
-        return dell_rfkill_set(2, state);
-}
-
-static int dell_wwan_set(void *data, enum rfkill_state state)
-{
-        return dell_rfkill_set(3, state);
-}
-
-static int dell_rfkill_get(int bit, enum rfkill_state *state)
+static void dell_rfkill_query(struct rfkill *rfkill, void *data)
 {
         struct calling_interface_buffer buffer;
         int status;
-        int new_state = RFKILL_STATE_HARD_BLOCKED;
+        int bit = (unsigned long)data + 16;
 
         memset(&buffer, 0, sizeof(struct calling_interface_buffer));
         dell_send_request(&buffer, 17, 11);
         status = buffer.output[1];
 
-        if (status & (1<<16))
-                new_state = RFKILL_STATE_SOFT_BLOCKED;
-
-        if (status & (1<<bit))
-                *state = new_state;
-        else
-                *state = RFKILL_STATE_UNBLOCKED;
-
-        return 0;
-}
-
-static int dell_wifi_get(void *data, enum rfkill_state *state)
-{
-        return dell_rfkill_get(17, state);
-}
-
-static int dell_bluetooth_get(void *data, enum rfkill_state *state)
-{
-        return dell_rfkill_get(18, state);
+        if (status & BIT(bit))
+                rfkill_set_hw_state(rfkill, !!(status & BIT(16)));
 }
 
-static int dell_wwan_get(void *data, enum rfkill_state *state)
-{
-        return dell_rfkill_get(19, state);
-}
+static const struct rfkill_ops dell_rfkill_ops = {
+        .set_block = dell_rfkill_set,
+        .query = dell_rfkill_query,
+};
 
 static int dell_setup_rfkill(void)
 {
@@ -248,36 +217,37 @@ static int dell_setup_rfkill(void)
         status = buffer.output[1];
 
         if ((status & (1<<2|1<<8)) == (1<<2|1<<8)) {
-                wifi_rfkill = rfkill_allocate(NULL, RFKILL_TYPE_WLAN);
-                if (!wifi_rfkill)
+                wifi_rfkill = rfkill_alloc("dell-wifi", NULL, RFKILL_TYPE_WLAN,
+                                           &dell_rfkill_ops, (void *) 1);
+                if (!wifi_rfkill) {
+                        ret = -ENOMEM;
                         goto err_wifi;
-                wifi_rfkill->name = "dell-wifi";
-                wifi_rfkill->toggle_radio = dell_wifi_set;
-                wifi_rfkill->get_state = dell_wifi_get;
+                }
                 ret = rfkill_register(wifi_rfkill);
                 if (ret)
                         goto err_wifi;
         }
 
         if ((status & (1<<3|1<<9)) == (1<<3|1<<9)) {
-                bluetooth_rfkill = rfkill_allocate(NULL, RFKILL_TYPE_BLUETOOTH);
-                if (!bluetooth_rfkill)
+                bluetooth_rfkill = rfkill_alloc("dell-bluetooth", NULL,
+                                                RFKILL_TYPE_BLUETOOTH,
+                                                &dell_rfkill_ops, (void *) 2);
+                if (!bluetooth_rfkill) {
+                        ret = -ENOMEM;
                         goto err_bluetooth;
-                bluetooth_rfkill->name = "dell-bluetooth";
-                bluetooth_rfkill->toggle_radio = dell_bluetooth_set;
-                bluetooth_rfkill->get_state = dell_bluetooth_get;
+                }
                 ret = rfkill_register(bluetooth_rfkill);
                 if (ret)
                         goto err_bluetooth;
         }
 
         if ((status & (1<<4|1<<10)) == (1<<4|1<<10)) {
-                wwan_rfkill = rfkill_allocate(NULL, RFKILL_TYPE_WWAN);
-                if (!wwan_rfkill)
+                wwan_rfkill = rfkill_alloc("dell-wwan", NULL, RFKILL_TYPE_WWAN,
+                                           &dell_rfkill_ops, (void *) 3);
+                if (!wwan_rfkill) {
+                        ret = -ENOMEM;
                         goto err_wwan;
-                wwan_rfkill->name = "dell-wwan";
-                wwan_rfkill->toggle_radio = dell_wwan_set;
-                wwan_rfkill->get_state = dell_wwan_get;
+                }
                 ret = rfkill_register(wwan_rfkill);
                 if (ret)
                         goto err_wwan;
@@ -285,22 +255,15 @@ static int dell_setup_rfkill(void)
 
         return 0;
 err_wwan:
-        if (wwan_rfkill)
-                rfkill_free(wwan_rfkill);
-        if (bluetooth_rfkill) {
+        rfkill_destroy(wwan_rfkill);
+        if (bluetooth_rfkill)
                 rfkill_unregister(bluetooth_rfkill);
-                bluetooth_rfkill = NULL;
-        }
 err_bluetooth:
-        if (bluetooth_rfkill)
-                rfkill_free(bluetooth_rfkill);
-        if (wifi_rfkill) {
+        rfkill_destroy(bluetooth_rfkill);
+        if (wifi_rfkill)
                 rfkill_unregister(wifi_rfkill);
-                wifi_rfkill = NULL;
-        }
 err_wifi:
-        if (wifi_rfkill)
-                rfkill_free(wifi_rfkill);
+        rfkill_destroy(wifi_rfkill);
 
         return ret;
 }
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 353a898c3693..1208d0cedd15 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -299,39 +299,22 @@ static int update_bl_status(struct backlight_device *bd)
  * Rfkill helpers
  */
 
-static int eeepc_wlan_rfkill_set(void *data, enum rfkill_state state)
-{
-        if (state == RFKILL_STATE_SOFT_BLOCKED)
-                return set_acpi(CM_ASL_WLAN, 0);
-        else
-                return set_acpi(CM_ASL_WLAN, 1);
-}
-
-static int eeepc_wlan_rfkill_state(void *data, enum rfkill_state *state)
+static bool eeepc_wlan_rfkill_blocked(void)
 {
         if (get_acpi(CM_ASL_WLAN) == 1)
-                *state = RFKILL_STATE_UNBLOCKED;
-        else
-                *state = RFKILL_STATE_SOFT_BLOCKED;
-        return 0;
+                return false;
+        return true;
 }
 
-static int eeepc_bluetooth_rfkill_set(void *data, enum rfkill_state state)
+static int eeepc_rfkill_set(void *data, bool blocked)
 {
-        if (state == RFKILL_STATE_SOFT_BLOCKED)
-                return set_acpi(CM_ASL_BLUETOOTH, 0);
-        else
-                return set_acpi(CM_ASL_BLUETOOTH, 1);
+        unsigned long asl = (unsigned long)data;
+        return set_acpi(asl, !blocked);
 }
 
-static int eeepc_bluetooth_rfkill_state(void *data, enum rfkill_state *state)
-{
-        if (get_acpi(CM_ASL_BLUETOOTH) == 1)
-                *state = RFKILL_STATE_UNBLOCKED;
-        else
-                *state = RFKILL_STATE_SOFT_BLOCKED;
-        return 0;
-}
+static const struct rfkill_ops eeepc_rfkill_ops = {
+        .set_block = eeepc_rfkill_set,
+};
 
 /*
  * Sys helpers
@@ -531,9 +514,9 @@ static int notify_brn(void)
 
 static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
 {
-        enum rfkill_state state;
         struct pci_dev *dev;
         struct pci_bus *bus = pci_find_bus(0, 1);
+        bool blocked;
 
         if (event != ACPI_NOTIFY_BUS_CHECK)
                 return;
@@ -543,9 +526,8 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
                 return;
         }
 
-        eeepc_wlan_rfkill_state(ehotk->eeepc_wlan_rfkill, &state);
-
-        if (state == RFKILL_STATE_UNBLOCKED) {
+        blocked = eeepc_wlan_rfkill_blocked();
+        if (!blocked) {
                 dev = pci_get_slot(bus, 0);
                 if (dev) {
                         /* Device already present */
@@ -566,7 +548,7 @@ static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
                 }
         }
 
-        rfkill_force_state(ehotk->eeepc_wlan_rfkill, state);
+        rfkill_set_sw_state(ehotk->eeepc_wlan_rfkill, blocked);
 }
 
 static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
@@ -684,26 +666,17 @@ static int eeepc_hotk_add(struct acpi_device *device)
         eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
 
         if (get_acpi(CM_ASL_WLAN) != -1) {
-                ehotk->eeepc_wlan_rfkill = rfkill_allocate(&device->dev,
-                                                           RFKILL_TYPE_WLAN);
+                ehotk->eeepc_wlan_rfkill = rfkill_alloc("eeepc-wlan",
+                                                        &device->dev,
+                                                        RFKILL_TYPE_WLAN,
+                                                        &eeepc_rfkill_ops,
+                                                        (void *)CM_ASL_WLAN);
 
                 if (!ehotk->eeepc_wlan_rfkill)
                         goto wlan_fail;
 
-                ehotk->eeepc_wlan_rfkill->name = "eeepc-wlan";
-                ehotk->eeepc_wlan_rfkill->toggle_radio = eeepc_wlan_rfkill_set;
-                ehotk->eeepc_wlan_rfkill->get_state = eeepc_wlan_rfkill_state;
-                if (get_acpi(CM_ASL_WLAN) == 1) {
-                        ehotk->eeepc_wlan_rfkill->state =
-                                RFKILL_STATE_UNBLOCKED;
-                        rfkill_set_default(RFKILL_TYPE_WLAN,
-                                           RFKILL_STATE_UNBLOCKED);
-                } else {
-                        ehotk->eeepc_wlan_rfkill->state =
-                                RFKILL_STATE_SOFT_BLOCKED;
-                        rfkill_set_default(RFKILL_TYPE_WLAN,
-                                           RFKILL_STATE_SOFT_BLOCKED);
-                }
+                rfkill_set_global_sw_state(RFKILL_TYPE_WLAN,
+                                           get_acpi(CM_ASL_WLAN) != 1);
                 result = rfkill_register(ehotk->eeepc_wlan_rfkill);
                 if (result)
                         goto wlan_fail;
@@ -711,28 +684,17 @@ static int eeepc_hotk_add(struct acpi_device *device)
 
         if (get_acpi(CM_ASL_BLUETOOTH) != -1) {
                 ehotk->eeepc_bluetooth_rfkill =
-                        rfkill_allocate(&device->dev, RFKILL_TYPE_BLUETOOTH);
+                        rfkill_alloc("eeepc-bluetooth",
+                                     &device->dev,
+                                     RFKILL_TYPE_BLUETOOTH,
+                                     &eeepc_rfkill_ops,
+                                     (void *)CM_ASL_BLUETOOTH);
 
                 if (!ehotk->eeepc_bluetooth_rfkill)
                         goto bluetooth_fail;
 
-                ehotk->eeepc_bluetooth_rfkill->name = "eeepc-bluetooth";
-                ehotk->eeepc_bluetooth_rfkill->toggle_radio =
-                        eeepc_bluetooth_rfkill_set;
-                ehotk->eeepc_bluetooth_rfkill->get_state =
-                        eeepc_bluetooth_rfkill_state;
-                if (get_acpi(CM_ASL_BLUETOOTH) == 1) {
-                        ehotk->eeepc_bluetooth_rfkill->state =
-                                RFKILL_STATE_UNBLOCKED;
-                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
-                                           RFKILL_STATE_UNBLOCKED);
-                } else {
-                        ehotk->eeepc_bluetooth_rfkill->state =
-                                RFKILL_STATE_SOFT_BLOCKED;
-                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
-                                           RFKILL_STATE_SOFT_BLOCKED);
-                }
-
+                rfkill_set_global_sw_state(RFKILL_TYPE_BLUETOOTH,
+                                           get_acpi(CM_ASL_BLUETOOTH) != 1);
                 result = rfkill_register(ehotk->eeepc_bluetooth_rfkill);
                 if (result)
                         goto bluetooth_fail;
@@ -741,13 +703,10 @@ static int eeepc_hotk_add(struct acpi_device *device)
         return 0;
 
  bluetooth_fail:
-        if (ehotk->eeepc_bluetooth_rfkill)
-                rfkill_free(ehotk->eeepc_bluetooth_rfkill);
+        rfkill_destroy(ehotk->eeepc_bluetooth_rfkill);
         rfkill_unregister(ehotk->eeepc_wlan_rfkill);
-        ehotk->eeepc_wlan_rfkill = NULL;
  wlan_fail:
-        if (ehotk->eeepc_wlan_rfkill)
-                rfkill_free(ehotk->eeepc_wlan_rfkill);
+        rfkill_destroy(ehotk->eeepc_wlan_rfkill);
         eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
         eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
  ehotk_fail:
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index fe171fad12cf..8d931145cbfa 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -154,58 +154,46 @@ static int hp_wmi_dock_state(void)
         return hp_wmi_perform_query(HPWMI_DOCK_QUERY, 0, 0);
 }
 
-static int hp_wmi_wifi_set(void *data, enum rfkill_state state)
+static int hp_wmi_set_block(void *data, bool blocked)
 {
-        if (state)
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x101);
-        else
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x100);
-}
+        unsigned long b = (unsigned long) data;
+        int query = BIT(b + 8) | ((!!blocked) << b);
 
-static int hp_wmi_bluetooth_set(void *data, enum rfkill_state state)
-{
-        if (state)
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x202);
-        else
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x200);
+        return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, query);
 }
 
-static int hp_wmi_wwan_set(void *data, enum rfkill_state state)
-{
-        if (state)
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x404);
-        else
-                return hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, 0x400);
-}
+static const struct rfkill_ops hp_wmi_rfkill_ops = {
+        .set_block = hp_wmi_set_block,
+};
 
-static int hp_wmi_wifi_state(void)
+static bool hp_wmi_wifi_state(void)
 {
         int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
 
         if (wireless & 0x100)
-                return RFKILL_STATE_UNBLOCKED;
+                return false;
         else
-                return RFKILL_STATE_SOFT_BLOCKED;
+                return true;
 }
 
-static int hp_wmi_bluetooth_state(void)
+static bool hp_wmi_bluetooth_state(void)
 {
         int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
 
         if (wireless & 0x10000)
-                return RFKILL_STATE_UNBLOCKED;
+                return false;
         else
-                return RFKILL_STATE_SOFT_BLOCKED;
+                return true;
 }
 
-static int hp_wmi_wwan_state(void)
+static bool hp_wmi_wwan_state(void)
 {
         int wireless = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 0, 0);
 
         if (wireless & 0x1000000)
-                return RFKILL_STATE_UNBLOCKED;
+                return false;
         else
-                return RFKILL_STATE_SOFT_BLOCKED;
+                return true;
 }
 
 static ssize_t show_display(struct device *dev, struct device_attribute *attr,
@@ -347,14 +335,14 @@ static void hp_wmi_notify(u32 value, void *context)
                         }
                 } else if (eventcode == 0x5) {
                         if (wifi_rfkill)
-                                rfkill_force_state(wifi_rfkill,
-                                                   hp_wmi_wifi_state());
+                                rfkill_set_sw_state(wifi_rfkill,
+                                                    hp_wmi_wifi_state());
                         if (bluetooth_rfkill)
-                                rfkill_force_state(bluetooth_rfkill,
-                                                   hp_wmi_bluetooth_state());
+                                rfkill_set_sw_state(bluetooth_rfkill,
+                                                    hp_wmi_bluetooth_state());
                         if (wwan_rfkill)
-                                rfkill_force_state(wwan_rfkill,
-                                                   hp_wmi_wwan_state());
+                                rfkill_set_sw_state(wwan_rfkill,
+                                                    hp_wmi_wwan_state());
                 } else
                         printk(KERN_INFO "HP WMI: Unknown key pressed - %x\n",
                                eventcode);
@@ -430,31 +418,34 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
                 goto add_sysfs_error;
 
         if (wireless & 0x1) {
-                wifi_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WLAN);
-                wifi_rfkill->name = "hp-wifi";
-                wifi_rfkill->state = hp_wmi_wifi_state();
-                wifi_rfkill->toggle_radio = hp_wmi_wifi_set;
+                wifi_rfkill = rfkill_alloc("hp-wifi", &device->dev,
+                                           RFKILL_TYPE_WLAN,
+                                           &hp_wmi_rfkill_ops,
+                                           (void *) 0);
+                rfkill_set_sw_state(wifi_rfkill, hp_wmi_wifi_state());
                 err = rfkill_register(wifi_rfkill);
                 if (err)
-                        goto add_sysfs_error;
+                        goto register_wifi_error;
         }
 
         if (wireless & 0x2) {
-                bluetooth_rfkill = rfkill_allocate(&device->dev,
-                                                   RFKILL_TYPE_BLUETOOTH);
-                bluetooth_rfkill->name = "hp-bluetooth";
-                bluetooth_rfkill->state = hp_wmi_bluetooth_state();
-                bluetooth_rfkill->toggle_radio = hp_wmi_bluetooth_set;
+                bluetooth_rfkill = rfkill_alloc("hp-bluetooth", &device->dev,
+                                                RFKILL_TYPE_BLUETOOTH,
+                                                &hp_wmi_rfkill_ops,
+                                                (void *) 1);
+                rfkill_set_sw_state(bluetooth_rfkill,
+                                    hp_wmi_bluetooth_state());
                 err = rfkill_register(bluetooth_rfkill);
                 if (err)
                         goto register_bluetooth_error;
         }
 
         if (wireless & 0x4) {
-                wwan_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WWAN);
-                wwan_rfkill->name = "hp-wwan";
-                wwan_rfkill->state = hp_wmi_wwan_state();
-                wwan_rfkill->toggle_radio = hp_wmi_wwan_set;
+                wwan_rfkill = rfkill_alloc("hp-wwan", &device->dev,
+                                           RFKILL_TYPE_WWAN,
+                                           &hp_wmi_rfkill_ops,
+                                           (void *) 2);
+                rfkill_set_sw_state(wwan_rfkill, hp_wmi_wwan_state());
                 err = rfkill_register(wwan_rfkill);
                 if (err)
                         goto register_wwan_err;
@@ -462,11 +453,15 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 
         return 0;
 register_wwan_err:
+        rfkill_destroy(wwan_rfkill);
         if (bluetooth_rfkill)
                 rfkill_unregister(bluetooth_rfkill);
 register_bluetooth_error:
+        rfkill_destroy(bluetooth_rfkill);
         if (wifi_rfkill)
                 rfkill_unregister(wifi_rfkill);
+register_wifi_error:
+        rfkill_destroy(wifi_rfkill);
 add_sysfs_error:
         cleanup_sysfs(device);
         return err;
@@ -476,12 +471,18 @@ static int __exit hp_wmi_bios_remove(struct platform_device *device)
 {
         cleanup_sysfs(device);
 
-        if (wifi_rfkill)
+        if (wifi_rfkill) {
                 rfkill_unregister(wifi_rfkill);
-        if (bluetooth_rfkill)
+                rfkill_destroy(wifi_rfkill);
+        }
+        if (bluetooth_rfkill) {
                 rfkill_unregister(bluetooth_rfkill);
-        if (wwan_rfkill)
+                rfkill_destroy(wifi_rfkill);
+        }
+        if (wwan_rfkill) {
                 rfkill_unregister(wwan_rfkill);
+                rfkill_destroy(wwan_rfkill);
+        }
 
         return 0;
 }
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index f1963b05175b..aec0b27fd774 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -128,11 +128,11 @@ enum sony_nc_rfkill {
         SONY_BLUETOOTH,
         SONY_WWAN,
         SONY_WIMAX,
-        SONY_RFKILL_MAX,
+        N_SONY_RFKILL,
 };
 
-static struct rfkill *sony_rfkill_devices[SONY_RFKILL_MAX];
-static int sony_rfkill_address[SONY_RFKILL_MAX] = {0x300, 0x500, 0x700, 0x900};
+static struct rfkill *sony_rfkill_devices[N_SONY_RFKILL];
+static int sony_rfkill_address[N_SONY_RFKILL] = {0x300, 0x500, 0x700, 0x900};
 static void sony_nc_rfkill_update(void);
 
 /*********** Input Devices ***********/
@@ -1051,147 +1051,98 @@ static void sony_nc_rfkill_cleanup(void)
 {
         int i;
 
-        for (i = 0; i < SONY_RFKILL_MAX; i++) {
-                if (sony_rfkill_devices[i])
+        for (i = 0; i < N_SONY_RFKILL; i++) {
+                if (sony_rfkill_devices[i]) {
                         rfkill_unregister(sony_rfkill_devices[i]);
+                        rfkill_destroy(sony_rfkill_devices[i]);
+                }
         }
 }
 
-static int sony_nc_rfkill_get(void *data, enum rfkill_state *state)
-{
-        int result;
-        int argument = sony_rfkill_address[(long) data];
-
-        sony_call_snc_handle(0x124, 0x200, &result);
-        if (result & 0x1) {
-                sony_call_snc_handle(0x124, argument, &result);
-                if (result & 0xf)
-                        *state = RFKILL_STATE_UNBLOCKED;
-                else
-                        *state = RFKILL_STATE_SOFT_BLOCKED;
-        } else {
-                *state = RFKILL_STATE_HARD_BLOCKED;
-        }
-
-        return 0;
-}
-
-static int sony_nc_rfkill_set(void *data, enum rfkill_state state)
+static int sony_nc_rfkill_set(void *data, bool blocked)
 {
         int result;
         int argument = sony_rfkill_address[(long) data] + 0x100;
 
-        if (state == RFKILL_STATE_UNBLOCKED)
+        if (!blocked)
                 argument |= 0xff0000;
 
         return sony_call_snc_handle(0x124, argument, &result);
 }
 
-static int sony_nc_setup_wifi_rfkill(struct acpi_device *device)
-{
-        int err = 0;
-        struct rfkill *sony_wifi_rfkill;
-
-        sony_wifi_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WLAN);
-        if (!sony_wifi_rfkill)
-                return -1;
-        sony_wifi_rfkill->name = "sony-wifi";
-        sony_wifi_rfkill->toggle_radio = sony_nc_rfkill_set;
-        sony_wifi_rfkill->get_state = sony_nc_rfkill_get;
-        sony_wifi_rfkill->data = (void *)SONY_WIFI;
-        err = rfkill_register(sony_wifi_rfkill);
-        if (err)
-                rfkill_free(sony_wifi_rfkill);
-        else {
-                sony_rfkill_devices[SONY_WIFI] = sony_wifi_rfkill;
-                sony_nc_rfkill_set(sony_wifi_rfkill->data,
-                                RFKILL_STATE_UNBLOCKED);
-        }
-        return err;
-}
+static const struct rfkill_ops sony_rfkill_ops = {
+        .set_block = sony_nc_rfkill_set,
+};
 
-static int sony_nc_setup_bluetooth_rfkill(struct acpi_device *device)
+static int sony_nc_setup_rfkill(struct acpi_device *device,
+                                enum sony_nc_rfkill nc_type)
 {
         int err = 0;
-        struct rfkill *sony_bluetooth_rfkill;
-
-        sony_bluetooth_rfkill = rfkill_allocate(&device->dev,
-                                                RFKILL_TYPE_BLUETOOTH);
-        if (!sony_bluetooth_rfkill)
-                return -1;
-        sony_bluetooth_rfkill->name = "sony-bluetooth";
-        sony_bluetooth_rfkill->toggle_radio = sony_nc_rfkill_set;
-        sony_bluetooth_rfkill->get_state = sony_nc_rfkill_get;
-        sony_bluetooth_rfkill->data = (void *)SONY_BLUETOOTH;
-        err = rfkill_register(sony_bluetooth_rfkill);
-        if (err)
-                rfkill_free(sony_bluetooth_rfkill);
-        else {
-                sony_rfkill_devices[SONY_BLUETOOTH] = sony_bluetooth_rfkill;
-                sony_nc_rfkill_set(sony_bluetooth_rfkill->data,
-                                RFKILL_STATE_UNBLOCKED);
+        struct rfkill *rfk;
+        enum rfkill_type type;
+        const char *name;
+
+        switch (nc_type) {
+        case SONY_WIFI:
+                type = RFKILL_TYPE_WLAN;
+                name = "sony-wifi";
+                break;
+        case SONY_BLUETOOTH:
+                type = RFKILL_TYPE_BLUETOOTH;
+                name = "sony-bluetooth";
+                break;
+        case SONY_WWAN:
+                type = RFKILL_TYPE_WWAN;
+                name = "sony-wwan";
+                break;
+        case SONY_WIMAX:
+                type = RFKILL_TYPE_WIMAX;
+                name = "sony-wimax";
+                break;
+        default:
+                return -EINVAL;
         }
-        return err;
-}
 
-static int sony_nc_setup_wwan_rfkill(struct acpi_device *device)
-{
-        int err = 0;
-        struct rfkill *sony_wwan_rfkill;
+        rfk = rfkill_alloc(name, &device->dev, type,
+                           &sony_rfkill_ops, (void *)nc_type);
+        if (!rfk)
+                return -ENOMEM;
 
-        sony_wwan_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WWAN);
-        if (!sony_wwan_rfkill)
-                return -1;
-        sony_wwan_rfkill->name = "sony-wwan";
-        sony_wwan_rfkill->toggle_radio = sony_nc_rfkill_set;
-        sony_wwan_rfkill->get_state = sony_nc_rfkill_get;
-        sony_wwan_rfkill->data = (void *)SONY_WWAN;
-        err = rfkill_register(sony_wwan_rfkill);
-        if (err)
-                rfkill_free(sony_wwan_rfkill);
-        else {
-                sony_rfkill_devices[SONY_WWAN] = sony_wwan_rfkill;
-                sony_nc_rfkill_set(sony_wwan_rfkill->data,
-                                RFKILL_STATE_UNBLOCKED);
+        err = rfkill_register(rfk);
+        if (err) {
+                rfkill_destroy(rfk);
+                return err;
         }
+        sony_rfkill_devices[nc_type] = rfk;
+        sony_nc_rfkill_set((void *)nc_type, false);
         return err;
 }
 
-static int sony_nc_setup_wimax_rfkill(struct acpi_device *device)
+static void sony_nc_rfkill_update()
 {
-        int err = 0;
-        struct rfkill *sony_wimax_rfkill;
+        enum sony_nc_rfkill i;
+        int result;
+        bool hwblock;
 
-        sony_wimax_rfkill = rfkill_allocate(&device->dev, RFKILL_TYPE_WIMAX);
-        if (!sony_wimax_rfkill)
-                return -1;
-        sony_wimax_rfkill->name = "sony-wimax";
-        sony_wimax_rfkill->toggle_radio = sony_nc_rfkill_set;
-        sony_wimax_rfkill->get_state = sony_nc_rfkill_get;
-        sony_wimax_rfkill->data = (void *)SONY_WIMAX;
-        err = rfkill_register(sony_wimax_rfkill);
-        if (err)
-                rfkill_free(sony_wimax_rfkill);
-        else {
-                sony_rfkill_devices[SONY_WIMAX] = sony_wimax_rfkill;
-                sony_nc_rfkill_set(sony_wimax_rfkill->data,
-                                RFKILL_STATE_UNBLOCKED);
-        }
-        return err;
-}
+        sony_call_snc_handle(0x124, 0x200, &result);
+        hwblock = !(result & 0x1);
 
-static void sony_nc_rfkill_update()
-{
-        int i;
-        enum rfkill_state state;
+        for (i = 0; i < N_SONY_RFKILL; i++) {
+                int argument = sony_rfkill_address[i];
 
-        for (i = 0; i < SONY_RFKILL_MAX; i++) {
-                if (sony_rfkill_devices[i]) {
-                        sony_rfkill_devices[i]->
-                                get_state(sony_rfkill_devices[i]->data,
-                                          &state);
-                        rfkill_force_state(sony_rfkill_devices[i], state);
+                if (!sony_rfkill_devices[i])
+                        continue;
+
+                if (hwblock) {
+                        if (rfkill_set_hw_state(sony_rfkill_devices[i], true))
+                                sony_nc_rfkill_set(sony_rfkill_devices[i],
+                                                   true);
+                        continue;
                 }
+
+                sony_call_snc_handle(0x124, argument, &result);
+                rfkill_set_states(sony_rfkill_devices[i],
+                                  !(result & 0xf), false);
         }
 }
 
@@ -1210,13 +1161,13 @@ static int sony_nc_rfkill_setup(struct acpi_device *device)
         }
 
         if (result & 0x1)
-                sony_nc_setup_wifi_rfkill(device);
+                sony_nc_setup_rfkill(device, SONY_WIFI);
         if (result & 0x2)
-                sony_nc_setup_bluetooth_rfkill(device);
+                sony_nc_setup_rfkill(device, SONY_BLUETOOTH);
         if (result & 0x1c)
-                sony_nc_setup_wwan_rfkill(device);
+                sony_nc_setup_rfkill(device, SONY_WWAN);
         if (result & 0x20)
-                sony_nc_setup_wimax_rfkill(device);
+                sony_nc_setup_rfkill(device, SONY_WIMAX);
 
         return 0;
 }
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index 912be65b6261..cfcafa4e9473 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -166,13 +166,6 @@ enum {
 
 #define TPACPI_MAX_ACPI_ARGS 3
 
-/* rfkill switches */
-enum {
-        TPACPI_RFK_BLUETOOTH_SW_ID = 0,
-        TPACPI_RFK_WWAN_SW_ID,
-        TPACPI_RFK_UWB_SW_ID,
-};
-
 /* printk headers */
 #define TPACPI_LOG TPACPI_FILE ": "
 #define TPACPI_EMERG    KERN_EMERG      TPACPI_LOG
@@ -1005,67 +998,237 @@ static int __init tpacpi_check_std_acpi_brightness_support(void)
         return 0;
 }
 
-static int __init tpacpi_new_rfkill(const unsigned int id,
-                        struct rfkill **rfk,
+static void printk_deprecated_attribute(const char * const what,
+                                        const char * const details)
+{
+        tpacpi_log_usertask("deprecated sysfs attribute");
+        printk(TPACPI_WARN "WARNING: sysfs attribute %s is deprecated and "
+                "will be removed. %s\n",
+                what, details);
+}
+
+/*************************************************************************
+ * rfkill and radio control support helpers
+ */
+
+/*
+ * ThinkPad-ACPI firmware handling model:
+ *
+ * WLSW (master wireless switch) is event-driven, and is common to all
+ * firmware-controlled radios.  It cannot be controlled, just monitored,
+ * as expected.  It overrides all radio state in firmware
+ *
+ * The kernel, a masked-off hotkey, and WLSW can change the radio state
+ * (TODO: verify how WLSW interacts with the returned radio state).
+ *
+ * The only time there are shadow radio state changes, is when
+ * masked-off hotkeys are used.
+ */
+
+/*
+ * Internal driver API for radio state:
+ *
+ * int: < 0 = error, otherwise enum tpacpi_rfkill_state
+ * bool: true means radio blocked (off)
+ */
+enum tpacpi_rfkill_state {
+        TPACPI_RFK_RADIO_OFF = 0,
+        TPACPI_RFK_RADIO_ON
+};
+
+/* rfkill switches */
+enum tpacpi_rfk_id {
+        TPACPI_RFK_BLUETOOTH_SW_ID = 0,
+        TPACPI_RFK_WWAN_SW_ID,
+        TPACPI_RFK_UWB_SW_ID,
+        TPACPI_RFK_SW_MAX
+};
+
+static const char *tpacpi_rfkill_names[] = {
+        [TPACPI_RFK_BLUETOOTH_SW_ID] = "bluetooth",
+        [TPACPI_RFK_WWAN_SW_ID] = "wwan",
+        [TPACPI_RFK_UWB_SW_ID] = "uwb",
+        [TPACPI_RFK_SW_MAX] = NULL
+};
+
+/* ThinkPad-ACPI rfkill subdriver */
+struct tpacpi_rfk {
+        struct rfkill *rfkill;
+        enum tpacpi_rfk_id id;
+        const struct tpacpi_rfk_ops *ops;
+};
+
+struct tpacpi_rfk_ops {
+        /* firmware interface */
+        int (*get_status)(void);
+        int (*set_status)(const enum tpacpi_rfkill_state);
+};
+
+static struct tpacpi_rfk *tpacpi_rfkill_switches[TPACPI_RFK_SW_MAX];
+
+/* Query FW and update rfkill sw state for a given rfkill switch */
+static int tpacpi_rfk_update_swstate(const struct tpacpi_rfk *tp_rfk)
+{
+        int status;
+
+        if (!tp_rfk)
+                return -ENODEV;
+
+        status = (tp_rfk->ops->get_status)();
+        if (status < 0)
+                return status;
+
+        rfkill_set_sw_state(tp_rfk->rfkill,
+                            (status == TPACPI_RFK_RADIO_OFF));
+
+        return status;
+}
+
+/* Query FW and update rfkill sw state for all rfkill switches */
+static void tpacpi_rfk_update_swstate_all(void)
+{
+        unsigned int i;
+
+        for (i = 0; i < TPACPI_RFK_SW_MAX; i++)
+                tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[i]);
+}
+
+/*
+ * Sync the HW-blocking state of all rfkill switches,
+ * do notice it causes the rfkill core to schedule uevents
+ */
+static void tpacpi_rfk_update_hwblock_state(bool blocked)
+{
+        unsigned int i;
+        struct tpacpi_rfk *tp_rfk;
+
+        for (i = 0; i < TPACPI_RFK_SW_MAX; i++) {
+                tp_rfk = tpacpi_rfkill_switches[i];
+                if (tp_rfk) {
+                        if (rfkill_set_hw_state(tp_rfk->rfkill,
+                                                blocked)) {
+                                /* ignore -- we track sw block */
+                        }
+                }
+        }
+}
+
+/* Call to get the WLSW state from the firmware */
+static int hotkey_get_wlsw(void);
+
+/* Call to query WLSW state and update all rfkill switches */
+static bool tpacpi_rfk_check_hwblock_state(void)
+{
+        int res = hotkey_get_wlsw();
+        int hw_blocked;
+
+        /* When unknown or unsupported, we have to assume it is unblocked */
+        if (res < 0)
+                return false;
+
+        hw_blocked = (res == TPACPI_RFK_RADIO_OFF);
+        tpacpi_rfk_update_hwblock_state(hw_blocked);
+
+        return hw_blocked;
+}
+
+static int tpacpi_rfk_hook_set_block(void *data, bool blocked)
+{
+        struct tpacpi_rfk *tp_rfk = data;
+        int res;
+
+        dbg_printk(TPACPI_DBG_RFKILL,
+                   "request to change radio state to %s\n",
+                   blocked ? "blocked" : "unblocked");
+
+        /* try to set radio state */
+        res = (tp_rfk->ops->set_status)(blocked ?
+                                TPACPI_RFK_RADIO_OFF : TPACPI_RFK_RADIO_ON);
+
+        /* and update the rfkill core with whatever the FW really did */
+        tpacpi_rfk_update_swstate(tp_rfk);
+
+        return (res < 0) ? res : 0;
+}
+
+static const struct rfkill_ops tpacpi_rfk_rfkill_ops = {
+        .set_block = tpacpi_rfk_hook_set_block,
+};
+
+static int __init tpacpi_new_rfkill(const enum tpacpi_rfk_id id,
+                        const struct tpacpi_rfk_ops *tp_rfkops,
                         const enum rfkill_type rfktype,
                         const char *name,
-                        const bool set_default,
-                        int (*toggle_radio)(void *, enum rfkill_state),
-                        int (*get_state)(void *, enum rfkill_state *))
+                        const bool set_default)
 {
+        struct tpacpi_rfk *atp_rfk;
         int res;
-        enum rfkill_state initial_state = RFKILL_STATE_SOFT_BLOCKED;
+        bool initial_sw_state = false;
+        int initial_sw_status;
 
-        res = get_state(NULL, &initial_state);
-        if (res < 0) {
+        BUG_ON(id >= TPACPI_RFK_SW_MAX || tpacpi_rfkill_switches[id]);
+
+        initial_sw_status = (tp_rfkops->get_status)();
+        if (initial_sw_status < 0) {
                 printk(TPACPI_ERR
                         "failed to read initial state for %s, error %d; "
-                        "will turn radio off\n", name, res);
-        } else if (set_default) {
-                /* try to set the initial state as the default for the rfkill
-                 * type, since we ask the firmware to preserve it across S5 in
-                 * NVRAM */
-                if (rfkill_set_default(rfktype,
-                                (initial_state == RFKILL_STATE_UNBLOCKED) ?
-                                        RFKILL_STATE_UNBLOCKED :
-                                        RFKILL_STATE_SOFT_BLOCKED) == -EPERM)
-                        vdbg_printk(TPACPI_DBG_RFKILL,
-                                    "Default state for %s cannot be changed\n",
-                                    name);
-        }
-
-        *rfk = rfkill_allocate(&tpacpi_pdev->dev, rfktype);
-        if (!*rfk) {
+                        "will turn radio off\n", name, initial_sw_status);
+        } else {
+                initial_sw_state = (initial_sw_status == TPACPI_RFK_RADIO_OFF);
+                if (set_default) {
+                        /* try to set the initial state as the default for the
+                         * rfkill type, since we ask the firmware to preserve
+                         * it across S5 in NVRAM */
+                        rfkill_set_global_sw_state(rfktype, initial_sw_state);
+                }
+        }
+
+        atp_rfk = kzalloc(sizeof(struct tpacpi_rfk), GFP_KERNEL);
+        if (atp_rfk)
+                atp_rfk->rfkill = rfkill_alloc(name,
+                                                &tpacpi_pdev->dev,
+                                                rfktype,
+                                                &tpacpi_rfk_rfkill_ops,
+                                                atp_rfk);
+        if (!atp_rfk || !atp_rfk->rfkill) {
                 printk(TPACPI_ERR
                         "failed to allocate memory for rfkill class\n");
+                kfree(atp_rfk);
                 return -ENOMEM;
         }
 
-        (*rfk)->name = name;
-        (*rfk)->get_state = get_state;
-        (*rfk)->toggle_radio = toggle_radio;
-        (*rfk)->state = initial_state;
+        atp_rfk->id = id;
+        atp_rfk->ops = tp_rfkops;
+
+        rfkill_set_states(atp_rfk->rfkill, initial_sw_state,
+                                tpacpi_rfk_check_hwblock_state());
 
-        res = rfkill_register(*rfk);
+        res = rfkill_register(atp_rfk->rfkill);
         if (res < 0) {
                 printk(TPACPI_ERR
                         "failed to register %s rfkill switch: %d\n",
                         name, res);
-                rfkill_free(*rfk);
-                *rfk = NULL;
+                rfkill_destroy(atp_rfk->rfkill);
+                kfree(atp_rfk);
                 return res;
         }
 
+        tpacpi_rfkill_switches[id] = atp_rfk;
         return 0;
 }
 
-static void printk_deprecated_attribute(const char * const what,
-                                        const char * const details)
+static void tpacpi_destroy_rfkill(const enum tpacpi_rfk_id id)
 {
-        tpacpi_log_usertask("deprecated sysfs attribute");
-        printk(TPACPI_WARN "WARNING: sysfs attribute %s is deprecated and "
-                "will be removed. %s\n",
-                what, details);
+        struct tpacpi_rfk *tp_rfk;
+
+        BUG_ON(id >= TPACPI_RFK_SW_MAX);
+
+        tp_rfk = tpacpi_rfkill_switches[id];
+        if (tp_rfk) {
+                rfkill_unregister(tp_rfk->rfkill);
+                tpacpi_rfkill_switches[id] = NULL;
+                kfree(tp_rfk);
+        }
 }
 
 static void printk_deprecated_rfkill_attribute(const char * const what)
@@ -1074,6 +1237,112 @@ static void printk_deprecated_rfkill_attribute(const char * const what)
                         "Please switch to generic rfkill before year 2010");
 }
 
+/* sysfs <radio> enable ------------------------------------------------ */
+static ssize_t tpacpi_rfk_sysfs_enable_show(const enum tpacpi_rfk_id id,
+                                            struct device_attribute *attr,
+                                            char *buf)
+{
+        int status;
+
+        printk_deprecated_rfkill_attribute(attr->attr.name);
+
+        /* This is in the ABI... */
+        if (tpacpi_rfk_check_hwblock_state()) {
+                status = TPACPI_RFK_RADIO_OFF;
+        } else {
+                status = tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[id]);
+                if (status < 0)
+                        return status;
+        }
+
+        return snprintf(buf, PAGE_SIZE, "%d\n",
+                        (status == TPACPI_RFK_RADIO_ON) ? 1 : 0);
+}
+
+static ssize_t tpacpi_rfk_sysfs_enable_store(const enum tpacpi_rfk_id id,
+                            struct device_attribute *attr,
+                            const char *buf, size_t count)
+{
+        unsigned long t;
+        int res;
+
+        printk_deprecated_rfkill_attribute(attr->attr.name);
+
+        if (parse_strtoul(buf, 1, &t))
+                return -EINVAL;
+
+        tpacpi_disclose_usertask(attr->attr.name, "set to %ld\n", t);
+
+        /* This is in the ABI... */
+        if (tpacpi_rfk_check_hwblock_state() && !!t)
+                return -EPERM;
+
+        res = tpacpi_rfkill_switches[id]->ops->set_status((!!t) ?
+                                TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF);
+        tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[id]);
+
+        return (res < 0) ? res : count;
+}
+
+/* procfs -------------------------------------------------------------- */
+static int tpacpi_rfk_procfs_read(const enum tpacpi_rfk_id id, char *p)
+{
+        int len = 0;
+
+        if (id >= TPACPI_RFK_SW_MAX)
+                len += sprintf(p + len, "status:\t\tnot supported\n");
+        else {
+                int status;
+
+                /* This is in the ABI... */
+                if (tpacpi_rfk_check_hwblock_state()) {
+                        status = TPACPI_RFK_RADIO_OFF;
+                } else {
+                        status = tpacpi_rfk_update_swstate(
+                                                tpacpi_rfkill_switches[id]);
+                        if (status < 0)
+                                return status;
+                }
+
+                len += sprintf(p + len, "status:\t\t%s\n",
+                                (status == TPACPI_RFK_RADIO_ON) ?
+                                        "enabled" : "disabled");
+                len += sprintf(p + len, "commands:\tenable, disable\n");
+        }
+
+        return len;
+}
+
+static int tpacpi_rfk_procfs_write(const enum tpacpi_rfk_id id, char *buf)
+{
+        char *cmd;
+        int status = -1;
+        int res = 0;
+
+        if (id >= TPACPI_RFK_SW_MAX)
+                return -ENODEV;
+
+        while ((cmd = next_cmd(&buf))) {
+                if (strlencmp(cmd, "enable") == 0)
+                        status = TPACPI_RFK_RADIO_ON;
+                else if (strlencmp(cmd, "disable") == 0)
+                        status = TPACPI_RFK_RADIO_OFF;
+                else
+                        return -EINVAL;
+        }
+
+        if (status != -1) {
+                tpacpi_disclose_usertask("procfs", "attempt to %s %s\n",
+                                (status == TPACPI_RFK_RADIO_ON) ?
+                                                "enable" : "disable",
+                                tpacpi_rfkill_names[id]);
+                res = (tpacpi_rfkill_switches[id]->ops->set_status)(status);
+                tpacpi_rfk_update_swstate(tpacpi_rfkill_switches[id]);
+        }
+
+        return res;
+}
+
 /*************************************************************************
  * thinkpad-acpi driver attributes
  */
@@ -1127,8 +1396,6 @@ static DRIVER_ATTR(version, S_IRUGO,
 
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
 
-static void tpacpi_send_radiosw_update(void);
-
 /* wlsw_emulstate ------------------------------------------------------ */
 static ssize_t tpacpi_driver_wlsw_emulstate_show(struct device_driver *drv,
                                                 char *buf)
@@ -1144,11 +1411,10 @@ static ssize_t tpacpi_driver_wlsw_emulstate_store(struct device_driver *drv,
         if (parse_strtoul(buf, 1, &t))
                 return -EINVAL;
 
-        if (tpacpi_wlsw_emulstate != t) {
-                tpacpi_wlsw_emulstate = !!t;
-                tpacpi_send_radiosw_update();
-        } else
+        if (tpacpi_wlsw_emulstate != !!t) {
                 tpacpi_wlsw_emulstate = !!t;
+                tpacpi_rfk_update_hwblock_state(!t);    /* negative logic */
+        }
 
         return count;
 }
@@ -1463,17 +1729,23 @@ static struct attribute_set *hotkey_dev_attributes;
 /* HKEY.MHKG() return bits */
 #define TP_HOTKEY_TABLET_MASK (1 << 3)
 
-static int hotkey_get_wlsw(int *status)
+static int hotkey_get_wlsw(void)
 {
+        int status;
+
+        if (!tp_features.hotkey_wlsw)
+                return -ENODEV;
+
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
-        if (dbg_wlswemul) {
-                *status = !!tpacpi_wlsw_emulstate;
-                return 0;
-        }
+        if (dbg_wlswemul)
+                return (tpacpi_wlsw_emulstate) ?
+                                TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 #endif
-        if (!acpi_evalf(hkey_handle, status, "WLSW", "d"))
+
+        if (!acpi_evalf(hkey_handle, &status, "WLSW", "d"))
                 return -EIO;
-        return 0;
+
+        return (status) ? TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 }
 
 static int hotkey_get_tablet_mode(int *status)
@@ -2107,12 +2379,16 @@ static ssize_t hotkey_radio_sw_show(struct device *dev,
                            struct device_attribute *attr,
                            char *buf)
 {
-        int res, s;
-        res = hotkey_get_wlsw(&s);
+        int res;
+        res = hotkey_get_wlsw();
         if (res < 0)
                 return res;
 
-        return snprintf(buf, PAGE_SIZE, "%d\n", !!s);
+        /* Opportunistic update */
+        tpacpi_rfk_update_hwblock_state((res == TPACPI_RFK_RADIO_OFF));
+
+        return snprintf(buf, PAGE_SIZE, "%d\n",
+                        (res == TPACPI_RFK_RADIO_OFF) ? 0 : 1);
 }
 
 static struct device_attribute dev_attr_hotkey_radio_sw =
@@ -2223,30 +2499,52 @@ static struct attribute *hotkey_mask_attributes[] __initdata = {
         &dev_attr_hotkey_wakeup_hotunplug_complete.attr,
 };
 
-static void bluetooth_update_rfk(void);
-static void wan_update_rfk(void);
-static void uwb_update_rfk(void);
+/*
+ * Sync both the hw and sw blocking state of all switches
+ */
 static void tpacpi_send_radiosw_update(void)
 {
         int wlsw;
 
-        /* Sync these BEFORE sending any rfkill events */
-        if (tp_features.bluetooth)
-                bluetooth_update_rfk();
-        if (tp_features.wan)
-                wan_update_rfk();
-        if (tp_features.uwb)
-                uwb_update_rfk();
+        /*
+         * We must sync all rfkill controllers *before* issuing any
+         * rfkill input events, or we will race the rfkill core input
+         * handler.
+         *
+         * tpacpi_inputdev_send_mutex works as a syncronization point
+         * for the above.
+         *
+         * We optimize to avoid numerous calls to hotkey_get_wlsw.
+         */
 
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&wlsw)) {
+        wlsw = hotkey_get_wlsw();
+
+        /* Sync hw blocking state first if it is hw-blocked */
+        if (wlsw == TPACPI_RFK_RADIO_OFF)
+                tpacpi_rfk_update_hwblock_state(true);
+
+        /* Sync sw blocking state */
+        tpacpi_rfk_update_swstate_all();
+
+        /* Sync hw blocking state last if it is hw-unblocked */
+        if (wlsw == TPACPI_RFK_RADIO_ON)
+                tpacpi_rfk_update_hwblock_state(false);
+
+        /* Issue rfkill input event for WLSW switch */
+        if (!(wlsw < 0)) {
                 mutex_lock(&tpacpi_inputdev_send_mutex);
 
                 input_report_switch(tpacpi_inputdev,
-                                    SW_RFKILL_ALL, !!wlsw);
+                                    SW_RFKILL_ALL, (wlsw > 0));
                 input_sync(tpacpi_inputdev);
 
                 mutex_unlock(&tpacpi_inputdev_send_mutex);
         }
+
+        /*
+         * this can be unconditional, as we will poll state again
+         * if userspace uses the notify to read data
+         */
         hotkey_radio_sw_notify_change();
 }
 
@@ -3056,8 +3354,6 @@ enum {
 
 #define TPACPI_RFK_BLUETOOTH_SW_NAME    "tpacpi_bluetooth_sw"
 
-static struct rfkill *tpacpi_bluetooth_rfkill;
-
 static void bluetooth_suspend(pm_message_t state)
 {
         /* Try to make sure radio will resume powered off */
@@ -3067,83 +3363,47 @@ static void bluetooth_suspend(pm_message_t state)
                         "bluetooth power down on resume request failed\n");
 }
 
-static int bluetooth_get_radiosw(void)
+static int bluetooth_get_status(void)
 {
         int status;
 
-        if (!tp_features.bluetooth)
-                return -ENODEV;
-
-        /* WLSW overrides bluetooth in firmware/hardware, reflect that */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status)
-                return RFKILL_STATE_HARD_BLOCKED;
-
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_bluetoothemul)
                 return (tpacpi_bluetooth_emulstate) ?
-                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+                       TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 #endif
 
         if (!acpi_evalf(hkey_handle, &status, "GBDC", "d"))
                 return -EIO;
 
         return ((status & TP_ACPI_BLUETOOTH_RADIOSSW) != 0) ?
-                RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+                        TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 }
 
-static void bluetooth_update_rfk(void)
+static int bluetooth_set_status(enum tpacpi_rfkill_state state)
 {
         int status;
 
-        if (!tpacpi_bluetooth_rfkill)
-                return;
-
-        status = bluetooth_get_radiosw();
-        if (status < 0)
-                return;
-        rfkill_force_state(tpacpi_bluetooth_rfkill, status);
-
         vdbg_printk(TPACPI_DBG_RFKILL,
-                "forced rfkill state to %d\n",
-                status);
-}
-
-static int bluetooth_set_radiosw(int radio_on, int update_rfk)
-{
-        int status;
-
-        if (!tp_features.bluetooth)
-                return -ENODEV;
-
-        /* WLSW overrides bluetooth in firmware/hardware, but there is no
-         * reason to risk weird behaviour. */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status
-            && radio_on)
-                return -EPERM;
-
-        vdbg_printk(TPACPI_DBG_RFKILL,
-                "will %s bluetooth\n", radio_on ? "enable" : "disable");
+                "will attempt to %s bluetooth\n",
+                (state == TPACPI_RFK_RADIO_ON) ? "enable" : "disable");
 
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_bluetoothemul) {
-                tpacpi_bluetooth_emulstate = !!radio_on;
-                if (update_rfk)
-                        bluetooth_update_rfk();
+                tpacpi_bluetooth_emulstate = (state == TPACPI_RFK_RADIO_ON);
                 return 0;
         }
 #endif
 
         /* We make sure to keep TP_ACPI_BLUETOOTH_RESUMECTRL off */
-        if (radio_on)
+        if (state == TPACPI_RFK_RADIO_ON)
                 status = TP_ACPI_BLUETOOTH_RADIOSSW;
         else
                 status = 0;
+
         if (!acpi_evalf(hkey_handle, NULL, "SBDC", "vd", status))
                 return -EIO;
 
-        if (update_rfk)
-                bluetooth_update_rfk();
-
         return 0;
 }
 
@@ -3152,35 +3412,16 @@ static ssize_t bluetooth_enable_show(struct device *dev,
                            struct device_attribute *attr,
                            char *buf)
 {
-        int status;
-
-        printk_deprecated_rfkill_attribute("bluetooth_enable");
-
-        status = bluetooth_get_radiosw();
-        if (status < 0)
-                return status;
-
-        return snprintf(buf, PAGE_SIZE, "%d\n",
-                        (status == RFKILL_STATE_UNBLOCKED) ? 1 : 0);
+        return tpacpi_rfk_sysfs_enable_show(TPACPI_RFK_BLUETOOTH_SW_ID,
+                        attr, buf);
 }
 
 static ssize_t bluetooth_enable_store(struct device *dev,
                             struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        unsigned long t;
-        int res;
-
-        printk_deprecated_rfkill_attribute("bluetooth_enable");
-
-        if (parse_strtoul(buf, 1, &t))
-                return -EINVAL;
-
-        tpacpi_disclose_usertask("bluetooth_enable", "set to %ld\n", t);
-
-        res = bluetooth_set_radiosw(t, 1);
-
-        return (res) ? res : count;
+        return tpacpi_rfk_sysfs_enable_store(TPACPI_RFK_BLUETOOTH_SW_ID,
+                                attr, buf, count);
 }
 
 static struct device_attribute dev_attr_bluetooth_enable =
@@ -3198,23 +3439,10 @@ static const struct attribute_group bluetooth_attr_group = {
         .attrs = bluetooth_attributes,
 };
 
-static int tpacpi_bluetooth_rfk_get(void *data, enum rfkill_state *state)
-{
-        int bts = bluetooth_get_radiosw();
-
-        if (bts < 0)
-                return bts;
-
-        *state = bts;
-        return 0;
-}
-
-static int tpacpi_bluetooth_rfk_set(void *data, enum rfkill_state state)
-{
-        dbg_printk(TPACPI_DBG_RFKILL,
-                   "request to change radio state to %d\n", state);
-        return bluetooth_set_radiosw((state == RFKILL_STATE_UNBLOCKED), 0);
-}
+static const struct tpacpi_rfk_ops bluetooth_tprfk_ops = {
+        .get_status = bluetooth_get_status,
+        .set_status = bluetooth_set_status,
+};
 
 static void bluetooth_shutdown(void)
 {
@@ -3230,13 +3458,12 @@ static void bluetooth_shutdown(void)
 
 static void bluetooth_exit(void)
 {
-        bluetooth_shutdown();
-
-        if (tpacpi_bluetooth_rfkill)
-                rfkill_unregister(tpacpi_bluetooth_rfkill);
-
         sysfs_remove_group(&tpacpi_pdev->dev.kobj,
                         &bluetooth_attr_group);
+
+        tpacpi_destroy_rfkill(TPACPI_RFK_BLUETOOTH_SW_ID);
+
+        bluetooth_shutdown();
 }
 
 static int __init bluetooth_init(struct ibm_init_struct *iibm)
@@ -3277,20 +3504,18 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
         if (!tp_features.bluetooth)
                 return 1;
 
-        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
-                                &bluetooth_attr_group);
-        if (res)
-                return res;
-
         res = tpacpi_new_rfkill(TPACPI_RFK_BLUETOOTH_SW_ID,
-                                &tpacpi_bluetooth_rfkill,
+                                &bluetooth_tprfk_ops,
                                 RFKILL_TYPE_BLUETOOTH,
                                 TPACPI_RFK_BLUETOOTH_SW_NAME,
-                                true,
-                                tpacpi_bluetooth_rfk_set,
-                                tpacpi_bluetooth_rfk_get);
+                                true);
+        if (res)
+                return res;
+
+        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
+                                &bluetooth_attr_group);
         if (res) {
-                bluetooth_exit();
+                tpacpi_destroy_rfkill(TPACPI_RFK_BLUETOOTH_SW_ID);
                 return res;
         }
 
@@ -3300,46 +3525,12 @@ static int __init bluetooth_init(struct ibm_init_struct *iibm)
 /* procfs -------------------------------------------------------------- */
 static int bluetooth_read(char *p)
 {
-        int len = 0;
-        int status = bluetooth_get_radiosw();
-
-        if (!tp_features.bluetooth)
-                len += sprintf(p + len, "status:\t\tnot supported\n");
-        else {
-                len += sprintf(p + len, "status:\t\t%s\n",
-                                (status == RFKILL_STATE_UNBLOCKED) ?
-                                        "enabled" : "disabled");
-                len += sprintf(p + len, "commands:\tenable, disable\n");
-        }
-
-        return len;
+        return tpacpi_rfk_procfs_read(TPACPI_RFK_BLUETOOTH_SW_ID, p);
 }
 
 static int bluetooth_write(char *buf)
 {
-        char *cmd;
-        int state = -1;
-
-        if (!tp_features.bluetooth)
-                return -ENODEV;
-
-        while ((cmd = next_cmd(&buf))) {
-                if (strlencmp(cmd, "enable") == 0) {
-                        state = 1;
-                } else if (strlencmp(cmd, "disable") == 0) {
-                        state = 0;
-                } else
-                        return -EINVAL;
-        }
-
-        if (state != -1) {
-                tpacpi_disclose_usertask("procfs bluetooth",
-                        "attempt to %s\n",
-                        state ? "enable" : "disable");
-                bluetooth_set_radiosw(state, 1);
-        }
-
-        return 0;
+        return tpacpi_rfk_procfs_write(TPACPI_RFK_BLUETOOTH_SW_ID, buf);
 }
 
 static struct ibm_struct bluetooth_driver_data = {
@@ -3365,8 +3556,6 @@ enum {
 
 #define TPACPI_RFK_WWAN_SW_NAME         "tpacpi_wwan_sw"
 
-static struct rfkill *tpacpi_wan_rfkill;
-
 static void wan_suspend(pm_message_t state)
 {
         /* Try to make sure radio will resume powered off */
@@ -3376,83 +3565,47 @@ static void wan_suspend(pm_message_t state)
                         "WWAN power down on resume request failed\n");
 }
 
-static int wan_get_radiosw(void)
+static int wan_get_status(void)
 {
         int status;
 
-        if (!tp_features.wan)
-                return -ENODEV;
-
-        /* WLSW overrides WWAN in firmware/hardware, reflect that */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status)
-                return RFKILL_STATE_HARD_BLOCKED;
-
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_wwanemul)
                 return (tpacpi_wwan_emulstate) ?
-                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+                       TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 #endif
 
         if (!acpi_evalf(hkey_handle, &status, "GWAN", "d"))
                 return -EIO;
 
         return ((status & TP_ACPI_WANCARD_RADIOSSW) != 0) ?
-                RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
-}
-
-static void wan_update_rfk(void)
-{
-        int status;
-
-        if (!tpacpi_wan_rfkill)
-                return;
-
-        status = wan_get_radiosw();
-        if (status < 0)
-                return;
-        rfkill_force_state(tpacpi_wan_rfkill, status);
-
-        vdbg_printk(TPACPI_DBG_RFKILL,
-                "forced rfkill state to %d\n",
-                status);
+                        TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 }
 
-static int wan_set_radiosw(int radio_on, int update_rfk)
+static int wan_set_status(enum tpacpi_rfkill_state state)
 {
         int status;
 
-        if (!tp_features.wan)
-                return -ENODEV;
-
-        /* WLSW overrides bluetooth in firmware/hardware, but there is no
-         * reason to risk weird behaviour. */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status
-            && radio_on)
-                return -EPERM;
-
         vdbg_printk(TPACPI_DBG_RFKILL,
-                "will %s WWAN\n", radio_on ? "enable" : "disable");
+                "will attempt to %s wwan\n",
+                (state == TPACPI_RFK_RADIO_ON) ? "enable" : "disable");
 
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_wwanemul) {
-                tpacpi_wwan_emulstate = !!radio_on;
-                if (update_rfk)
-                        wan_update_rfk();
+                tpacpi_wwan_emulstate = (state == TPACPI_RFK_RADIO_ON);
                 return 0;
         }
 #endif
 
         /* We make sure to keep TP_ACPI_WANCARD_RESUMECTRL off */
-        if (radio_on)
+        if (state == TPACPI_RFK_RADIO_ON)
                 status = TP_ACPI_WANCARD_RADIOSSW;
         else
                 status = 0;
+
         if (!acpi_evalf(hkey_handle, NULL, "SWAN", "vd", status))
                 return -EIO;
 
-        if (update_rfk)
-                wan_update_rfk();
-
         return 0;
 }
 
@@ -3461,35 +3614,16 @@ static ssize_t wan_enable_show(struct device *dev,
                            struct device_attribute *attr,
                            char *buf)
 {
-        int status;
-
-        printk_deprecated_rfkill_attribute("wwan_enable");
-
-        status = wan_get_radiosw();
-        if (status < 0)
-                return status;
-
-        return snprintf(buf, PAGE_SIZE, "%d\n",
-                        (status == RFKILL_STATE_UNBLOCKED) ? 1 : 0);
+        return tpacpi_rfk_sysfs_enable_show(TPACPI_RFK_WWAN_SW_ID,
+                        attr, buf);
 }
 
 static ssize_t wan_enable_store(struct device *dev,
                             struct device_attribute *attr,
                             const char *buf, size_t count)
 {
-        unsigned long t;
-        int res;
-
-        printk_deprecated_rfkill_attribute("wwan_enable");
-
-        if (parse_strtoul(buf, 1, &t))
-                return -EINVAL;
-
-        tpacpi_disclose_usertask("wwan_enable", "set to %ld\n", t);
-
-        res = wan_set_radiosw(t, 1);
-
-        return (res) ? res : count;
+        return tpacpi_rfk_sysfs_enable_store(TPACPI_RFK_WWAN_SW_ID,
+                        attr, buf, count);
 }
 
 static struct device_attribute dev_attr_wan_enable =
@@ -3507,23 +3641,10 @@ static const struct attribute_group wan_attr_group = {
         .attrs = wan_attributes,
 };
 
-static int tpacpi_wan_rfk_get(void *data, enum rfkill_state *state)
-{
-        int wans = wan_get_radiosw();
-
-        if (wans < 0)
-                return wans;
-
-        *state = wans;
-        return 0;
-}
-
-static int tpacpi_wan_rfk_set(void *data, enum rfkill_state state)
-{
-        dbg_printk(TPACPI_DBG_RFKILL,
-                   "request to change radio state to %d\n", state);
-        return wan_set_radiosw((state == RFKILL_STATE_UNBLOCKED), 0);
-}
+static const struct tpacpi_rfk_ops wan_tprfk_ops = {
+        .get_status = wan_get_status,
+        .set_status = wan_set_status,
+};
 
 static void wan_shutdown(void)
 {
@@ -3539,13 +3660,12 @@ static void wan_shutdown(void)
 
 static void wan_exit(void)
 {
-        wan_shutdown();
-
-        if (tpacpi_wan_rfkill)
-                rfkill_unregister(tpacpi_wan_rfkill);
-
         sysfs_remove_group(&tpacpi_pdev->dev.kobj,
                 &wan_attr_group);
+
+        tpacpi_destroy_rfkill(TPACPI_RFK_WWAN_SW_ID);
+
+        wan_shutdown();
 }
 
 static int __init wan_init(struct ibm_init_struct *iibm)
@@ -3584,20 +3704,19 @@ static int __init wan_init(struct ibm_init_struct *iibm)
         if (!tp_features.wan)
                 return 1;
 
-        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
-                                &wan_attr_group);
-        if (res)
-                return res;
-
         res = tpacpi_new_rfkill(TPACPI_RFK_WWAN_SW_ID,
-                                &tpacpi_wan_rfkill,
+                                &wan_tprfk_ops,
                                 RFKILL_TYPE_WWAN,
                                 TPACPI_RFK_WWAN_SW_NAME,
-                                true,
-                                tpacpi_wan_rfk_set,
-                                tpacpi_wan_rfk_get);
+                                true);
+        if (res)
+                return res;
+
+        res = sysfs_create_group(&tpacpi_pdev->dev.kobj,
+                                &wan_attr_group);
+
         if (res) {
-                wan_exit();
+                tpacpi_destroy_rfkill(TPACPI_RFK_WWAN_SW_ID);
                 return res;
         }
 
@@ -3607,48 +3726,12 @@ static int __init wan_init(struct ibm_init_struct *iibm)
 /* procfs -------------------------------------------------------------- */
 static int wan_read(char *p)
 {
-        int len = 0;
-        int status = wan_get_radiosw();
-
-        tpacpi_disclose_usertask("procfs wan", "read");
-
-        if (!tp_features.wan)
-                len += sprintf(p + len, "status:\t\tnot supported\n");
-        else {
-                len += sprintf(p + len, "status:\t\t%s\n",
-                                (status == RFKILL_STATE_UNBLOCKED) ?
-                                        "enabled" : "disabled");
-                len += sprintf(p + len, "commands:\tenable, disable\n");
-        }
-
-        return len;
+        return tpacpi_rfk_procfs_read(TPACPI_RFK_WWAN_SW_ID, p);
 }
 
 static int wan_write(char *buf)
 {
-        char *cmd;
-        int state = -1;
-
-        if (!tp_features.wan)
-                return -ENODEV;
-
-        while ((cmd = next_cmd(&buf))) {
-                if (strlencmp(cmd, "enable") == 0) {
-                        state = 1;
-                } else if (strlencmp(cmd, "disable") == 0) {
-                        state = 0;
-                } else
-                        return -EINVAL;
-        }
-
-        if (state != -1) {
-                tpacpi_disclose_usertask("procfs wan",
-                        "attempt to %s\n",
-                        state ? "enable" : "disable");
-                wan_set_radiosw(state, 1);
-        }
-
-        return 0;
+        return tpacpi_rfk_procfs_write(TPACPI_RFK_WWAN_SW_ID, buf);
 }
 
 static struct ibm_struct wan_driver_data = {
@@ -3672,108 +3755,59 @@ enum {
 
 #define TPACPI_RFK_UWB_SW_NAME  "tpacpi_uwb_sw"
 
-static struct rfkill *tpacpi_uwb_rfkill;
-
-static int uwb_get_radiosw(void)
+static int uwb_get_status(void)
 {
         int status;
 
-        if (!tp_features.uwb)
-                return -ENODEV;
-
-        /* WLSW overrides UWB in firmware/hardware, reflect that */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status)
-                return RFKILL_STATE_HARD_BLOCKED;
-
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_uwbemul)
                 return (tpacpi_uwb_emulstate) ?
-                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+                       TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 #endif
 
         if (!acpi_evalf(hkey_handle, &status, "GUWB", "d"))
                 return -EIO;
 
         return ((status & TP_ACPI_UWB_RADIOSSW) != 0) ?
-                RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
+                        TPACPI_RFK_RADIO_ON : TPACPI_RFK_RADIO_OFF;
 }
 
-static void uwb_update_rfk(void)
+static int uwb_set_status(enum tpacpi_rfkill_state state)
 {
         int status;
 
-        if (!tpacpi_uwb_rfkill)
-                return;
-
-        status = uwb_get_radiosw();
-        if (status < 0)
-                return;
-        rfkill_force_state(tpacpi_uwb_rfkill, status);
-
         vdbg_printk(TPACPI_DBG_RFKILL,
-                "forced rfkill state to %d\n",
-                status);
-}
-
-static int uwb_set_radiosw(int radio_on, int update_rfk)
-{
-        int status;
-
-        if (!tp_features.uwb)
-                return -ENODEV;
-
-        /* WLSW overrides UWB in firmware/hardware, but there is no
-         * reason to risk weird behaviour. */
-        if (tp_features.hotkey_wlsw && !hotkey_get_wlsw(&status) && !status
-            && radio_on)
-                return -EPERM;
-
-        vdbg_printk(TPACPI_DBG_RFKILL,
-                        "will %s UWB\n", radio_on ? "enable" : "disable");
+                "will attempt to %s UWB\n",
+                (state == TPACPI_RFK_RADIO_ON) ? "enable" : "disable");
 
 #ifdef CONFIG_THINKPAD_ACPI_DEBUGFACILITIES
         if (dbg_uwbemul) {
-                tpacpi_uwb_emulstate = !!radio_on;
-                if (update_rfk)
-                        uwb_update_rfk();
+                tpacpi_uwb_emulstate = (state == TPACPI_RFK_RADIO_ON);
                 return 0;
         }
 #endif
 
-        status = (radio_on) ? TP_ACPI_UWB_RADIOSSW : 0;
+        if (state == TPACPI_RFK_RADIO_ON)
+                status = TP_ACPI_UWB_RADIOSSW;
+        else
+                status = 0;
+
         if (!acpi_evalf(hkey_handle, NULL, "SUWB", "vd", status))
                 return -EIO;
 
-        if (update_rfk)
-                uwb_update_rfk();
-
         return 0;
 }
 
 /* --------------------------------------------------------------------- */
 
-static int tpacpi_uwb_rfk_get(void *data, enum rfkill_state *state)
-{
-        int uwbs = uwb_get_radiosw();
-
-        if (uwbs < 0)
-                return uwbs;
-
-        *state = uwbs;
-        return 0;
-}
-
-static int tpacpi_uwb_rfk_set(void *data, enum rfkill_state state)
-{
-        dbg_printk(TPACPI_DBG_RFKILL,
-                   "request to change radio state to %d\n", state);
-        return uwb_set_radiosw((state == RFKILL_STATE_UNBLOCKED), 0);
-}
+static const struct tpacpi_rfk_ops uwb_tprfk_ops = {
+        .get_status = uwb_get_status,
+        .set_status = uwb_set_status,
+};
 
 static void uwb_exit(void)
 {
-        if (tpacpi_uwb_rfkill)
-                rfkill_unregister(tpacpi_uwb_rfkill);
+        tpacpi_destroy_rfkill(TPACPI_RFK_UWB_SW_ID);
 }
 
 static int __init uwb_init(struct ibm_init_struct *iibm)
@@ -3813,13 +3847,10 @@ static int __init uwb_init(struct ibm_init_struct *iibm)
                 return 1;
 
         res = tpacpi_new_rfkill(TPACPI_RFK_UWB_SW_ID,
-                                &tpacpi_uwb_rfkill,
+                                &uwb_tprfk_ops,
                                 RFKILL_TYPE_UWB,
                                 TPACPI_RFK_UWB_SW_NAME,
-                                false,
-                                tpacpi_uwb_rfk_set,
-                                tpacpi_uwb_rfk_get);
-
+                                false);
         return res;
 }
 
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 4345089f5171..81d31ea507d1 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -45,7 +45,6 @@
 #include <linux/backlight.h>
 #include <linux/platform_device.h>
 #include <linux/rfkill.h>
-#include <linux/input-polldev.h>
 
 #include <asm/uaccess.h>
 
@@ -250,21 +249,15 @@ static acpi_status hci_read2(u32 reg, u32 *out1, u32 *out2, u32 *result)
 
 struct toshiba_acpi_dev {
         struct platform_device *p_dev;
-        struct rfkill *rfk_dev;
-        struct input_polled_dev *poll_dev;
+        struct rfkill *bt_rfk;
 
         const char *bt_name;
-        const char *rfk_name;
-
-        bool last_rfk_state;
 
         struct mutex mutex;
 };
 
 static struct toshiba_acpi_dev toshiba_acpi = {
         .bt_name = "Toshiba Bluetooth",
-        .rfk_name = "Toshiba RFKill Switch",
-        .last_rfk_state = false,
 };
 
 /* Bluetooth rfkill handlers */
@@ -283,21 +276,6 @@ static u32 hci_get_bt_present(bool *present)
         return hci_result;
 }
 
-static u32 hci_get_bt_on(bool *on)
-{
-        u32 hci_result;
-        u32 value, value2;
-
-        value = 0;
-        value2 = 0x0001;
-        hci_read2(HCI_WIRELESS, &value, &value2, &hci_result);
-        if (hci_result == HCI_SUCCESS)
-                *on = (value & HCI_WIRELESS_BT_POWER) &&
-                      (value & HCI_WIRELESS_BT_ATTACH);
-
-        return hci_result;
-}
-
 static u32 hci_get_radio_state(bool *radio_state)
 {
         u32 hci_result;
@@ -311,70 +289,67 @@ static u32 hci_get_radio_state(bool *radio_state)
         return hci_result;
 }
 
-static int bt_rfkill_toggle_radio(void *data, enum rfkill_state state)
+static int bt_rfkill_set_block(void *data, bool blocked)
 {
+        struct toshiba_acpi_dev *dev = data;
         u32 result1, result2;
         u32 value;
+        int err;
         bool radio_state;
-        struct toshiba_acpi_dev *dev = data;
 
-        value = (state == RFKILL_STATE_UNBLOCKED);
+        value = (blocked == false);
 
-        if (hci_get_radio_state(&radio_state) != HCI_SUCCESS)
-                return -EFAULT;
+        mutex_lock(&dev->mutex);
+        if (hci_get_radio_state(&radio_state) != HCI_SUCCESS) {
+                err = -EBUSY;
+                goto out;
+        }
 
-        switch (state) {
-        case RFKILL_STATE_UNBLOCKED:
-                if (!radio_state)
-                        return -EPERM;
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                break;
-        default:
-                return -EINVAL;
+        if (!radio_state) {
+                err = 0;
+                goto out;
         }
 
-        mutex_lock(&dev->mutex);
         hci_write2(HCI_WIRELESS, value, HCI_WIRELESS_BT_POWER, &result1);
         hci_write2(HCI_WIRELESS, value, HCI_WIRELESS_BT_ATTACH, &result2);
-        mutex_unlock(&dev->mutex);
 
         if (result1 != HCI_SUCCESS || result2 != HCI_SUCCESS)
-                return -EFAULT;
-
-        return 0;
+                err = -EBUSY;
+        else
+                err = 0;
+ out:
+        mutex_unlock(&dev->mutex);
+        return err;
 }
 
-static void bt_poll_rfkill(struct input_polled_dev *poll_dev)
+static void bt_rfkill_poll(struct rfkill *rfkill, void *data)
 {
-        bool state_changed;
         bool new_rfk_state;
         bool value;
         u32 hci_result;
-        struct toshiba_acpi_dev *dev = poll_dev->private;
+        struct toshiba_acpi_dev *dev = data;
+
+        mutex_lock(&dev->mutex);
 
         hci_result = hci_get_radio_state(&value);
-        if (hci_result != HCI_SUCCESS)
-                return; /* Can't do anything useful */
+        if (hci_result != HCI_SUCCESS) {
+                /* Can't do anything useful */
+                mutex_unlock(&dev->mutex);
+        }
 
         new_rfk_state = value;
 
-        mutex_lock(&dev->mutex);
-        state_changed = new_rfk_state != dev->last_rfk_state;
-        dev->last_rfk_state = new_rfk_state;
         mutex_unlock(&dev->mutex);
 
-        if (unlikely(state_changed)) {
-                rfkill_force_state(dev->rfk_dev,
-                                   new_rfk_state ?
-                                   RFKILL_STATE_SOFT_BLOCKED :
-                                   RFKILL_STATE_HARD_BLOCKED);
-                input_report_switch(poll_dev->input, SW_RFKILL_ALL,
-                                    new_rfk_state);
-                input_sync(poll_dev->input);
-        }
+        if (rfkill_set_hw_state(rfkill, !new_rfk_state))
+                bt_rfkill_set_block(data, true);
 }
 
+static const struct rfkill_ops toshiba_rfk_ops = {
+        .set_block = bt_rfkill_set_block,
+        .poll = bt_rfkill_poll,
+};
+
 static struct proc_dir_entry *toshiba_proc_dir /*= 0*/ ;
 static struct backlight_device *toshiba_backlight_device;
 static int force_fan;
@@ -702,14 +677,11 @@ static struct backlight_ops toshiba_backlight_data = {
 
 static void toshiba_acpi_exit(void)
 {
-        if (toshiba_acpi.poll_dev) {
-                input_unregister_polled_device(toshiba_acpi.poll_dev);
-                input_free_polled_device(toshiba_acpi.poll_dev);
+        if (toshiba_acpi.bt_rfk) {
+                rfkill_unregister(toshiba_acpi.bt_rfk);
+                rfkill_destroy(toshiba_acpi.bt_rfk);
         }
 
-        if (toshiba_acpi.rfk_dev)
-                rfkill_unregister(toshiba_acpi.rfk_dev);
-
         if (toshiba_backlight_device)
                 backlight_device_unregister(toshiba_backlight_device);
 
@@ -728,8 +700,6 @@ static int __init toshiba_acpi_init(void)
         acpi_status status = AE_OK;
         u32 hci_result;
         bool bt_present;
-        bool bt_on;
-        bool radio_on;
         int ret = 0;
 
         if (acpi_disabled)
@@ -793,60 +763,21 @@ static int __init toshiba_acpi_init(void)
 
         /* Register rfkill switch for Bluetooth */
         if (hci_get_bt_present(&bt_present) == HCI_SUCCESS && bt_present) {
-                toshiba_acpi.rfk_dev = rfkill_allocate(&toshiba_acpi.p_dev->dev,
-                                                        RFKILL_TYPE_BLUETOOTH);
-                if (!toshiba_acpi.rfk_dev) {
+                toshiba_acpi.bt_rfk = rfkill_alloc(toshiba_acpi.bt_name,
+                                                   &toshiba_acpi.p_dev->dev,
+                                                   RFKILL_TYPE_BLUETOOTH,
+                                                   &toshiba_rfk_ops,
+                                                   &toshiba_acpi);
+                if (!toshiba_acpi.bt_rfk) {
                         printk(MY_ERR "unable to allocate rfkill device\n");
                         toshiba_acpi_exit();
                         return -ENOMEM;
                 }
 
-                toshiba_acpi.rfk_dev->name = toshiba_acpi.bt_name;
-                toshiba_acpi.rfk_dev->toggle_radio = bt_rfkill_toggle_radio;
-                toshiba_acpi.rfk_dev->data = &toshiba_acpi;
-
-                if (hci_get_bt_on(&bt_on) == HCI_SUCCESS && bt_on) {
-                        toshiba_acpi.rfk_dev->state = RFKILL_STATE_UNBLOCKED;
-                } else if (hci_get_radio_state(&radio_on) == HCI_SUCCESS &&
-                           radio_on) {
-                        toshiba_acpi.rfk_dev->state = RFKILL_STATE_SOFT_BLOCKED;
-                } else {
-                        toshiba_acpi.rfk_dev->state = RFKILL_STATE_HARD_BLOCKED;
-                }
-
-                ret = rfkill_register(toshiba_acpi.rfk_dev);
+                ret = rfkill_register(toshiba_acpi.bt_rfk);
                 if (ret) {
                         printk(MY_ERR "unable to register rfkill device\n");
-                        toshiba_acpi_exit();
-                        return -ENOMEM;
-                }
-
-                /* Register input device for kill switch */
-                toshiba_acpi.poll_dev = input_allocate_polled_device();
-                if (!toshiba_acpi.poll_dev) {
-                        printk(MY_ERR
-                               "unable to allocate kill-switch input device\n");
-                        toshiba_acpi_exit();
-                        return -ENOMEM;
-                }
-                toshiba_acpi.poll_dev->private = &toshiba_acpi;
-                toshiba_acpi.poll_dev->poll = bt_poll_rfkill;
-                toshiba_acpi.poll_dev->poll_interval = 1000; /* msecs */
-
-                toshiba_acpi.poll_dev->input->name = toshiba_acpi.rfk_name;
-                toshiba_acpi.poll_dev->input->id.bustype = BUS_HOST;
-                /* Toshiba USB ID */
-                toshiba_acpi.poll_dev->input->id.vendor = 0x0930;
-                set_bit(EV_SW, toshiba_acpi.poll_dev->input->evbit);
-                set_bit(SW_RFKILL_ALL, toshiba_acpi.poll_dev->input->swbit);
-                input_report_switch(toshiba_acpi.poll_dev->input,
-                                    SW_RFKILL_ALL, TRUE);
-                input_sync(toshiba_acpi.poll_dev->input);
-
-                ret = input_register_polled_device(toshiba_acpi.poll_dev);
-                if (ret) {
-                        printk(MY_ERR
-                               "unable to register kill-switch input device\n");
+                        rfkill_destroy(toshiba_acpi.bt_rfk);
                         toshiba_acpi_exit();
                         return ret;
                 }
diff --git a/include/asm-generic/errno.h b/include/asm-generic/errno.h
index e8852c092fea..28cc03bf19e6 100644
--- a/include/asm-generic/errno.h
+++ b/include/asm-generic/errno.h
@@ -106,4 +106,6 @@
 #define EOWNERDEAD      130     /* Owner died */
 #define ENOTRECOVERABLE 131     /* State not recoverable */
 
+#define ERFKILL         132     /* Operation not possible due to RF-kill */
+
 #endif
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 3f0eaa397ef5..7e09c5c1ed02 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -311,6 +311,7 @@ unifdef-y += ptrace.h
 unifdef-y += qnx4_fs.h
 unifdef-y += quota.h
 unifdef-y += random.h
+unifdef-y += rfkill.h
 unifdef-y += irqnr.h
 unifdef-y += reboot.h
 unifdef-y += reiserfs_fs.h
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 34de8b21f6d4..a9173d5434d1 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1092,6 +1092,7 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_WEP104 = 13,
         WLAN_KEY_LEN_CCMP = 16,
         WLAN_KEY_LEN_TKIP = 32,
+        WLAN_KEY_LEN_AES_CMAC = 16,
 };
 
 /*
diff --git a/include/linux/notifier.h b/include/linux/notifier.h
index b86fa2ffca0c..81bc252dc8ac 100644
--- a/include/linux/notifier.h
+++ b/include/linux/notifier.h
@@ -198,6 +198,7 @@ static inline int notifier_to_errno(int ret)
 #define NETDEV_CHANGENAME       0x000A
 #define NETDEV_FEAT_CHANGE      0x000B
 #define NETDEV_BONDING_FAILOVER 0x000C
+#define NETDEV_PRE_UP           0x000D
 
 #define SYS_DOWN        0x0001  /* Notify of system down */
 #define SYS_RESTART     SYS_DOWN
diff --git a/include/linux/rfkill.h b/include/linux/rfkill.h
index de18ef227e00..ee3eddea8568 100644
--- a/include/linux/rfkill.h
+++ b/include/linux/rfkill.h
@@ -4,6 +4,7 @@
 /*
  * Copyright (C) 2006 - 2007 Ivo van Doorn
  * Copyright (C) 2007 Dmitry Torokhov
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -22,117 +23,341 @@
  */
 
 #include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/mutex.h>
-#include <linux/device.h>
-#include <linux/leds.h>
+
+/* define userspace visible states */
+#define RFKILL_STATE_SOFT_BLOCKED       0
+#define RFKILL_STATE_UNBLOCKED          1
+#define RFKILL_STATE_HARD_BLOCKED       2
 
 /**
  * enum rfkill_type - type of rfkill switch.
- * RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
- * RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
- * RFKILL_TYPE_UWB: switch is on a ultra wideband device.
- * RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
- * RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ *
+ * @RFKILL_TYPE_ALL: toggles all switches (userspace only)
+ * @RFKILL_TYPE_WLAN: switch is on a 802.11 wireless network device.
+ * @RFKILL_TYPE_BLUETOOTH: switch is on a bluetooth device.
+ * @RFKILL_TYPE_UWB: switch is on a ultra wideband device.
+ * @RFKILL_TYPE_WIMAX: switch is on a WiMAX device.
+ * @RFKILL_TYPE_WWAN: switch is on a wireless WAN device.
+ * @NUM_RFKILL_TYPES: number of defined rfkill types
  */
 enum rfkill_type {
-        RFKILL_TYPE_WLAN ,
+        RFKILL_TYPE_ALL = 0,
+        RFKILL_TYPE_WLAN,
         RFKILL_TYPE_BLUETOOTH,
         RFKILL_TYPE_UWB,
         RFKILL_TYPE_WIMAX,
         RFKILL_TYPE_WWAN,
-        RFKILL_TYPE_MAX,
+        NUM_RFKILL_TYPES,
 };
 
-enum rfkill_state {
-        RFKILL_STATE_SOFT_BLOCKED = 0,  /* Radio output blocked */
-        RFKILL_STATE_UNBLOCKED    = 1,  /* Radio output allowed */
-        RFKILL_STATE_HARD_BLOCKED = 2,  /* Output blocked, non-overrideable */
-        RFKILL_STATE_MAX,               /* marker for last valid state */
+/**
+ * enum rfkill_operation - operation types
+ * @RFKILL_OP_ADD: a device was added
+ * @RFKILL_OP_DEL: a device was removed
+ * @RFKILL_OP_CHANGE: a device's state changed -- userspace changes one device
+ * @RFKILL_OP_CHANGE_ALL: userspace changes all devices (of a type, or all)
+ */
+enum rfkill_operation {
+        RFKILL_OP_ADD = 0,
+        RFKILL_OP_DEL,
+        RFKILL_OP_CHANGE,
+        RFKILL_OP_CHANGE_ALL,
 };
 
 /**
- * struct rfkill - rfkill control structure.
- * @name: Name of the switch.
- * @type: Radio type which the button controls, the value stored
- *      here should be a value from enum rfkill_type.
- * @state: State of the switch, "UNBLOCKED" means radio can operate.
- * @mutex: Guards switch state transitions.  It serializes callbacks
- *      and also protects the state.
- * @data: Pointer to the RF button drivers private data which will be
- *      passed along when toggling radio state.
- * @toggle_radio(): Mandatory handler to control state of the radio.
- *      only RFKILL_STATE_SOFT_BLOCKED and RFKILL_STATE_UNBLOCKED are
- *      valid parameters.
- * @get_state(): handler to read current radio state from hardware,
- *      may be called from atomic context, should return 0 on success.
- *      Either this handler OR judicious use of rfkill_force_state() is
- *      MANDATORY for any driver capable of RFKILL_STATE_HARD_BLOCKED.
- * @led_trigger: A LED trigger for this button's LED.
- * @dev: Device structure integrating the switch into device tree.
- * @node: Used to place switch into list of all switches known to the
- *      the system.
- *
- * This structure represents a RF switch located on a network device.
- */
-struct rfkill {
-        const char *name;
-        enum rfkill_type type;
-
-        /* the mutex serializes callbacks and also protects
-         * the state */
-        struct mutex mutex;
-        enum rfkill_state state;
-        void *data;
-        int (*toggle_radio)(void *data, enum rfkill_state state);
-        int (*get_state)(void *data, enum rfkill_state *state);
+ * struct rfkill_event - events for userspace on /dev/rfkill
+ * @idx: index of dev rfkill
+ * @type: type of the rfkill struct
+ * @op: operation code
+ * @hard: hard state (0/1)
+ * @soft: soft state (0/1)
+ *
+ * Structure used for userspace communication on /dev/rfkill,
+ * used for events from the kernel and control to the kernel.
+ */
+struct rfkill_event {
+        __u32 idx;
+        __u8  type;
+        __u8  op;
+        __u8  soft, hard;
+} __packed;
 
-#ifdef CONFIG_RFKILL_LEDS
-        struct led_trigger led_trigger;
-#endif
+/* ioctl for turning off rfkill-input (if present) */
+#define RFKILL_IOC_MAGIC        'R'
+#define RFKILL_IOC_NOINPUT      1
+#define RFKILL_IOCTL_NOINPUT    _IO(RFKILL_IOC_MAGIC, RFKILL_IOC_NOINPUT)
 
-        struct device dev;
-        struct list_head node;
-        enum rfkill_state state_for_resume;
+/* and that's all userspace gets */
+#ifdef __KERNEL__
+/* don't allow anyone to use these in the kernel */
+enum rfkill_user_states {
+        RFKILL_USER_STATE_SOFT_BLOCKED  = RFKILL_STATE_SOFT_BLOCKED,
+        RFKILL_USER_STATE_UNBLOCKED     = RFKILL_STATE_UNBLOCKED,
+        RFKILL_USER_STATE_HARD_BLOCKED  = RFKILL_STATE_HARD_BLOCKED,
 };
-#define to_rfkill(d)    container_of(d, struct rfkill, dev)
+#undef RFKILL_STATE_SOFT_BLOCKED
+#undef RFKILL_STATE_UNBLOCKED
+#undef RFKILL_STATE_HARD_BLOCKED
+
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/leds.h>
+
+/* this is opaque */
+struct rfkill;
+
+/**
+ * struct rfkill_ops - rfkill driver methods
+ *
+ * @poll: poll the rfkill block state(s) -- only assign this method
+ *      when you need polling. When called, simply call one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. If the hw
+ *      is getting unblocked you need to take into account the return
+ *      value of those functions to make sure the software block is
+ *      properly used.
+ * @query: query the rfkill block state(s) and call exactly one of the
+ *      rfkill_set{,_hw,_sw}_state family of functions. Assign this
+ *      method if input events can cause hardware state changes to make
+ *      the rfkill core query your driver before setting a requested
+ *      block.
+ * @set_block: turn the transmitter on (blocked == false) or off
+ *      (blocked == true) -- ignore and return 0 when hard blocked.
+ *      This callback must be assigned.
+ */
+struct rfkill_ops {
+        void    (*poll)(struct rfkill *rfkill, void *data);
+        void    (*query)(struct rfkill *rfkill, void *data);
+        int     (*set_block)(void *data, bool blocked);
+};
+
+#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
+/**
+ * rfkill_alloc - allocate rfkill structure
+ * @name: name of the struct -- the string is not copied internally
+ * @parent: device that has rf switch on it
+ * @type: type of the switch (RFKILL_TYPE_*)
+ * @ops: rfkill methods
+ * @ops_data: data passed to each method
+ *
+ * This function should be called by the transmitter driver to allocate an
+ * rfkill structure. Returns %NULL on failure.
+ */
+struct rfkill * __must_check rfkill_alloc(const char *name,
+                                          struct device *parent,
+                                          const enum rfkill_type type,
+                                          const struct rfkill_ops *ops,
+                                          void *ops_data);
 
-struct rfkill * __must_check rfkill_allocate(struct device *parent,
-                                             enum rfkill_type type);
-void rfkill_free(struct rfkill *rfkill);
+/**
+ * rfkill_register - Register a rfkill structure.
+ * @rfkill: rfkill structure to be registered
+ *
+ * This function should be called by the transmitter driver to register
+ * the rfkill structure needs to be registered. Before calling this function
+ * the driver needs to be ready to service method calls from rfkill.
+ */
 int __must_check rfkill_register(struct rfkill *rfkill);
+
+/**
+ * rfkill_pause_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_pause_polling(struct rfkill *rfkill);
+
+/**
+ * rfkill_resume_polling(struct rfkill *rfkill)
+ *
+ * Pause polling -- say transmitter is off for other reasons.
+ * NOTE: not necessary for suspend/resume -- in that case the
+ * core stops polling anyway
+ */
+void rfkill_resume_polling(struct rfkill *rfkill);
+
+
+/**
+ * rfkill_unregister - Unregister a rfkill structure.
+ * @rfkill: rfkill structure to be unregistered
+ *
+ * This function should be called by the network driver during device
+ * teardown to destroy rfkill structure. Until it returns, the driver
+ * needs to be able to service method calls.
+ */
 void rfkill_unregister(struct rfkill *rfkill);
 
-int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state);
-int rfkill_set_default(enum rfkill_type type, enum rfkill_state state);
+/**
+ * rfkill_destroy - free rfkill structure
+ * @rfkill: rfkill structure to be destroyed
+ *
+ * Destroys the rfkill structure.
+ */
+void rfkill_destroy(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_hw_state - Set the internal rfkill hardware block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current hardware block state to set
+ *
+ * rfkill drivers that get events when the hard-blocked state changes
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state -- they should also use this after
+ * resume if the state could have changed.
+ *
+ * You need not (but may) call this function if poll_state is assigned.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked) so that drivers need not keep track of the soft
+ * block state -- which they might not be able to.
+ */
+bool __must_check rfkill_set_hw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_sw_state - Set the internal rfkill software block state
+ * @rfkill: pointer to the rfkill class to modify.
+ * @state: the current software block state to set
+ *
+ * rfkill drivers that get events when the soft-blocked state changes
+ * (yes, some platforms directly act on input but allow changing again)
+ * use this function to notify the rfkill core (and through that also
+ * userspace) of the current state -- they should also use this after
+ * resume if the state could have changed.
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ *
+ * The function returns the combined block state (true if transmitter
+ * should be blocked).
+ */
+bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked);
+
+/**
+ * rfkill_set_states - Set the internal rfkill block states
+ * @rfkill: pointer to the rfkill class to modify.
+ * @sw: the current software block state to set
+ * @hw: the current hardware block state to set
+ *
+ * This function can be called in any context, even from within rfkill
+ * callbacks.
+ */
+void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw);
 
 /**
- * rfkill_state_complement - return complementar state
- * @state: state to return the complement of
+ * rfkill_set_global_sw_state - set global sw block default
+ * @type: rfkill type to set default for
+ * @blocked: default to set
  *
- * Returns RFKILL_STATE_SOFT_BLOCKED if @state is RFKILL_STATE_UNBLOCKED,
- * returns RFKILL_STATE_UNBLOCKED otherwise.
+ * This function sets the global default -- use at boot if your platform has
+ * an rfkill switch. If not early enough this call may be ignored.
+ *
+ * XXX: instead of ignoring -- how about just updating all currently
+ *      registered drivers?
  */
-static inline enum rfkill_state rfkill_state_complement(enum rfkill_state state)
+void rfkill_set_global_sw_state(const enum rfkill_type type, bool blocked);
+
+/**
+ * rfkill_blocked - query rfkill block
+ *
+ * @rfkill: rfkill struct to query
+ */
+bool rfkill_blocked(struct rfkill *rfkill);
+#else /* !RFKILL */
+static inline struct rfkill * __must_check
+rfkill_alloc(const char *name,
+             struct device *parent,
+             const enum rfkill_type type,
+             const struct rfkill_ops *ops,
+             void *ops_data)
+{
+        return ERR_PTR(-ENODEV);
+}
+
+static inline int __must_check rfkill_register(struct rfkill *rfkill)
+{
+        if (rfkill == ERR_PTR(-ENODEV))
+                return 0;
+        return -EINVAL;
+}
+
+static inline void rfkill_pause_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_resume_polling(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_unregister(struct rfkill *rfkill)
+{
+}
+
+static inline void rfkill_destroy(struct rfkill *rfkill)
+{
+}
+
+static inline bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked)
+{
+        return blocked;
+}
+
+static inline bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked)
+{
+        return blocked;
+}
+
+static inline void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
 {
-        return (state == RFKILL_STATE_UNBLOCKED) ?
-                RFKILL_STATE_SOFT_BLOCKED : RFKILL_STATE_UNBLOCKED;
 }
 
+static inline void rfkill_set_global_sw_state(const enum rfkill_type type,
+                                              bool blocked)
+{
+}
+
+static inline bool rfkill_blocked(struct rfkill *rfkill)
+{
+        return false;
+}
+#endif /* RFKILL || RFKILL_MODULE */
+
+
+#ifdef CONFIG_RFKILL_LEDS
 /**
- * rfkill_get_led_name - Get the LED trigger name for the button's LED.
+ * rfkill_get_led_trigger_name - Get the LED trigger name for the button's LED.
  * This function might return a NULL pointer if registering of the
- * LED trigger failed.
- * Use this as "default_trigger" for the LED.
+ * LED trigger failed. Use this as "default_trigger" for the LED.
  */
-static inline char *rfkill_get_led_name(struct rfkill *rfkill)
-{
-#ifdef CONFIG_RFKILL_LEDS
-        return (char *)(rfkill->led_trigger.name);
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill);
+
+/**
+ * rfkill_set_led_trigger_name -- set the LED trigger name
+ * @rfkill: rfkill struct
+ * @name: LED trigger name
+ *
+ * This function sets the LED trigger name of the radio LED
+ * trigger that rfkill creates. It is optional, but if called
+ * must be called before rfkill_register() to be effective.
+ */
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name);
 #else
+static inline const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
         return NULL;
-#endif
 }
 
+static inline void
+rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+}
+#endif
+
+#endif /* __KERNEL__ */
+
 #endif /* RFKILL_H */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index f20da7d63b1e..1a21895b732b 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -752,6 +752,19 @@ enum wiphy_params_flags {
 };
 
 /**
+ * enum tx_power_setting - TX power adjustment
+ *
+ * @TX_POWER_AUTOMATIC: the dbm parameter is ignored
+ * @TX_POWER_LIMITED: limit TX power by the dbm parameter
+ * @TX_POWER_FIXED: fix TX power to the dbm parameter
+ */
+enum tx_power_setting {
+        TX_POWER_AUTOMATIC,
+        TX_POWER_LIMITED,
+        TX_POWER_FIXED,
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -837,6 +850,13 @@ enum wiphy_params_flags {
  *      @changed bitfield (see &enum wiphy_params_flags) describes which values
  *      have changed. The actual parameter values are available in
  *      struct wiphy. If returning an error, no value should be changed.
+ *
+ * @set_tx_power: set the transmit power according to the parameters
+ * @get_tx_power: store the current TX power into the dbm variable;
+ *      return 0 if successful
+ *
+ * @rfkill_poll: polls the hw rfkill line, use cfg80211 reporting
+ *      functions to adjust rfkill hw state
  */
 struct cfg80211_ops {
         int     (*suspend)(struct wiphy *wiphy);
@@ -928,6 +948,12 @@ struct cfg80211_ops {
         int     (*leave_ibss)(struct wiphy *wiphy, struct net_device *dev);
 
         int     (*set_wiphy_params)(struct wiphy *wiphy, u32 changed);
+
+        int     (*set_tx_power)(struct wiphy *wiphy,
+                                enum tx_power_setting type, int dbm);
+        int     (*get_tx_power)(struct wiphy *wiphy, int *dbm);
+
+        void    (*rfkill_poll)(struct wiphy *wiphy);
 };
 
 /*
@@ -1451,6 +1477,12 @@ int cfg80211_wext_siwencode(struct net_device *dev,
 int cfg80211_wext_giwencode(struct net_device *dev,
                             struct iw_request_info *info,
                             struct iw_point *erq, char *keybuf);
+int cfg80211_wext_siwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
+int cfg80211_wext_giwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *keybuf);
 
 /*
  * callbacks for asynchronous cfg80211 methods, notification
@@ -1636,4 +1668,23 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  */
 void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp);
 
+/**
+ * wiphy_rfkill_set_hw_state - notify cfg80211 about hw block state
+ * @wiphy: the wiphy
+ * @blocked: block status
+ */
+void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked);
+
+/**
+ * wiphy_rfkill_start_polling - start polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_start_polling(struct wiphy *wiphy);
+
+/**
+ * wiphy_rfkill_stop_polling - stop polling rfkill
+ * @wiphy: the wiphy
+ */
+void wiphy_rfkill_stop_polling(struct wiphy *wiphy);
+
 #endif /* __NET_CFG80211_H */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index d72346ff3247..17d61d19d912 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -526,8 +526,7 @@ enum ieee80211_conf_flags {
 /**
  * enum ieee80211_conf_changed - denotes which configuration changed
  *
- * @IEEE80211_CONF_CHANGE_RADIO_ENABLED: the value of radio_enabled changed
- * @_IEEE80211_CONF_CHANGE_BEACON_INTERVAL: DEPRECATED
+ * @_IEEE80211_CONF_CHANGE_RADIO_ENABLED: DEPRECATED
  * @IEEE80211_CONF_CHANGE_LISTEN_INTERVAL: the listen interval changed
  * @IEEE80211_CONF_CHANGE_RADIOTAP: the radiotap flag changed
  * @IEEE80211_CONF_CHANGE_PS: the PS flag or dynamic PS timeout changed
@@ -537,8 +536,7 @@ enum ieee80211_conf_flags {
  * @IEEE80211_CONF_CHANGE_IDLE: Idle flag changed
  */
 enum ieee80211_conf_changed {
-        IEEE80211_CONF_CHANGE_RADIO_ENABLED     = BIT(0),
-        _IEEE80211_CONF_CHANGE_BEACON_INTERVAL  = BIT(1),
+        _IEEE80211_CONF_CHANGE_RADIO_ENABLED    = BIT(0),
         IEEE80211_CONF_CHANGE_LISTEN_INTERVAL   = BIT(2),
         IEEE80211_CONF_CHANGE_RADIOTAP          = BIT(3),
         IEEE80211_CONF_CHANGE_PS                = BIT(4),
@@ -549,12 +547,12 @@ enum ieee80211_conf_changed {
 };
 
 static inline __deprecated enum ieee80211_conf_changed
-__IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
+__IEEE80211_CONF_CHANGE_RADIO_ENABLED(void)
 {
-        return _IEEE80211_CONF_CHANGE_BEACON_INTERVAL;
+        return _IEEE80211_CONF_CHANGE_RADIO_ENABLED;
 }
-#define IEEE80211_CONF_CHANGE_BEACON_INTERVAL \
-        __IEEE80211_CONF_CHANGE_BEACON_INTERVAL()
+#define IEEE80211_CONF_CHANGE_RADIO_ENABLED \
+        __IEEE80211_CONF_CHANGE_RADIO_ENABLED()
 
 /**
  * struct ieee80211_conf - configuration of the device
@@ -564,7 +562,7 @@ __IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
  * @flags: configuration flags defined above
  *
  * @radio_enabled: when zero, driver is required to switch off the radio.
- * @beacon_int: beacon interval (TODO make interface config)
+ * @beacon_int: DEPRECATED, DO NOT USE
  *
  * @listen_interval: listen interval in units of beacon interval
  * @max_sleep_period: the maximum number of beacon intervals to sleep for
@@ -589,13 +587,13 @@ __IEEE80211_CONF_CHANGE_BEACON_INTERVAL(void)
  *    number of transmissions not the number of retries
  */
 struct ieee80211_conf {
-        int beacon_int;
+        int __deprecated beacon_int;
         u32 flags;
         int power_level, dynamic_ps_timeout;
         int max_sleep_period;
 
         u16 listen_interval;
-        bool radio_enabled;
+        bool __deprecated radio_enabled;
 
         u8 long_frame_max_tx_count, short_frame_max_tx_count;
 
@@ -1406,6 +1404,10 @@ enum ieee80211_ampdu_mlme_action {
  *      is the first frame we expect to perform the action on. Notice
  *      that TX/RX_STOP can pass NULL for this parameter.
  *      Returns a negative error code on failure.
+ *
+ * @rfkill_poll: Poll rfkill hardware state. If you need this, you also
+ *      need to set wiphy->rfkill_poll to %true before registration,
+ *      and need to call wiphy_rfkill_set_hw_state() in the callback.
  */
 struct ieee80211_ops {
         int (*tx)(struct ieee80211_hw *hw, struct sk_buff *skb);
@@ -1454,6 +1456,8 @@ struct ieee80211_ops {
         int (*ampdu_action)(struct ieee80211_hw *hw,
                             enum ieee80211_ampdu_mlme_action action,
                             struct ieee80211_sta *sta, u16 tid, u16 *ssn);
+
+        void (*rfkill_poll)(struct ieee80211_hw *hw);
 };
 
 /**
diff --git a/include/net/wimax.h b/include/net/wimax.h
index 6b3824edb39e..2af7bf839f23 100644
--- a/include/net/wimax.h
+++ b/include/net/wimax.h
@@ -253,7 +253,6 @@
 struct net_device;
 struct genl_info;
 struct wimax_dev;
-struct input_dev;
 
 /**
  * struct wimax_dev - Generic WiMAX device
@@ -293,8 +292,8 @@ struct input_dev;
  *     See wimax_reset()'s documentation.
  *
  * @name: [fill] A way to identify this device. We need to register a
- *     name with many subsystems (input for RFKILL, workqueue
- *     creation, etc). We can't use the network device name as that
+ *     name with many subsystems (rfkill, workqueue creation, etc).
+ *     We can't use the network device name as that
  *     might change and in some instances we don't know it yet (until
  *     we don't call register_netdev()). So we generate an unique one
  *     using the driver name and device bus id, place it here and use
@@ -316,9 +315,6 @@ struct input_dev;
  *
  * @rfkill: [private] integration into the RF-Kill infrastructure.
  *
- * @rfkill_input: [private] virtual input device to process the
- *     hardware RF Kill switches.
- *
  * @rf_sw: [private] State of the software radio switch (OFF/ON)
  *
  * @rf_hw: [private] State of the hardware radio switch (OFF/ON)
diff --git a/net/core/dev.c b/net/core/dev.c
index 34b49a6a22fd..1f38401fc028 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1048,7 +1048,7 @@ void dev_load(struct net *net, const char *name)
 int dev_open(struct net_device *dev)
 {
         const struct net_device_ops *ops = dev->netdev_ops;
-        int ret = 0;
+        int ret;
 
         ASSERT_RTNL();
 
@@ -1065,6 +1065,11 @@ int dev_open(struct net_device *dev)
         if (!netif_device_present(dev))
                 return -ENODEV;
 
+        ret = call_netdevice_notifiers(NETDEV_PRE_UP, dev);
+        ret = notifier_to_errno(ret);
+        if (ret)
+                return ret;
+
         /*
          *      Call device private open method
          */
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 9cbf545e95a2..ba2643a43c73 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -1,16 +1,19 @@
 config MAC80211
         tristate "Generic IEEE 802.11 Networking Stack (mac80211)"
+        depends on CFG80211
         select CRYPTO
         select CRYPTO_ECB
         select CRYPTO_ARC4
         select CRYPTO_AES
         select CRC32
         select WIRELESS_EXT
-        select CFG80211
         ---help---
           This option enables the hardware independent IEEE 802.11
           networking stack.
 
+comment "CFG80211 needs to be enabled for MAC80211"
+        depends on CFG80211=n
+
 config MAC80211_DEFAULT_PS
         bool "enable powersave by default"
         depends on MAC80211
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 77e9ff5ec4f3..a9211cc183cb 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -664,18 +664,19 @@ static void sta_apply_parameters(struct ieee80211_local *local,
         spin_unlock_bh(&sta->lock);
 
         /*
+         * cfg80211 validates this (1-2007) and allows setting the AID
+         * only when creating a new station entry
+         */
+        if (params->aid)
+                sta->sta.aid = params->aid;
+
+        /*
          * FIXME: updating the following information is racy when this
          *        function is called from ieee80211_change_station().
          *        However, all this information should be static so
          *        maybe we should just reject attemps to change it.
          */
 
-        if (params->aid) {
-                sta->sta.aid = params->aid;
-                if (sta->sta.aid > IEEE80211_MAX_AID)
-                        sta->sta.aid = 0; /* XXX: should this be an error? */
-        }
-
         if (params->listen_interval >= 0)
                 sta->listen_interval = params->listen_interval;
 
@@ -1255,7 +1256,7 @@ static int ieee80211_assoc(struct wiphy *wiphy, struct net_device *dev,
                 sdata->u.mgd.flags |= IEEE80211_STA_AUTO_SSID_SEL;
 
         ret = ieee80211_sta_set_extra_ie(sdata, req->ie, req->ie_len);
-        if (ret)
+        if (ret && ret != -EALREADY)
                 return ret;
 
         if (req->use_mfp) {
@@ -1333,6 +1334,53 @@ static int ieee80211_set_wiphy_params(struct wiphy *wiphy, u32 changed)
         return 0;
 }
 
+static int ieee80211_set_tx_power(struct wiphy *wiphy,
+                                  enum tx_power_setting type, int dbm)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+        struct ieee80211_channel *chan = local->hw.conf.channel;
+        u32 changes = 0;
+
+        switch (type) {
+        case TX_POWER_AUTOMATIC:
+                local->user_power_level = -1;
+                break;
+        case TX_POWER_LIMITED:
+                if (dbm < 0)
+                        return -EINVAL;
+                local->user_power_level = dbm;
+                break;
+        case TX_POWER_FIXED:
+                if (dbm < 0)
+                        return -EINVAL;
+                /* TODO: move to cfg80211 when it knows the channel */
+                if (dbm > chan->max_power)
+                        return -EINVAL;
+                local->user_power_level = dbm;
+                break;
+        }
+
+        ieee80211_hw_config(local, changes);
+
+        return 0;
+}
+
+static int ieee80211_get_tx_power(struct wiphy *wiphy, int *dbm)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        *dbm = local->hw.conf.power_level;
+
+        return 0;
+}
+
+static void ieee80211_rfkill_poll(struct wiphy *wiphy)
+{
+        struct ieee80211_local *local = wiphy_priv(wiphy);
+
+        drv_rfkill_poll(local);
+}
+
 struct cfg80211_ops mac80211_config_ops = {
         .add_virtual_intf = ieee80211_add_iface,
         .del_virtual_intf = ieee80211_del_iface,
@@ -1372,4 +1420,7 @@ struct cfg80211_ops mac80211_config_ops = {
         .join_ibss = ieee80211_join_ibss,
         .leave_ibss = ieee80211_leave_ibss,
         .set_wiphy_params = ieee80211_set_wiphy_params,
+        .set_tx_power = ieee80211_set_tx_power,
+        .get_tx_power = ieee80211_get_tx_power,
+        .rfkill_poll = ieee80211_rfkill_poll,
 };
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 3912b5334b9c..b13446afd48f 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -181,4 +181,11 @@ static inline int drv_ampdu_action(struct ieee80211_local *local,
                                                 sta, tid, ssn);
         return -EOPNOTSUPP;
 }
+
+
+static inline void drv_rfkill_poll(struct ieee80211_local *local)
+{
+        if (local->ops->rfkill_poll)
+                local->ops->rfkill_poll(&local->hw);
+}
 #endif /* __MAC80211_DRIVER_OPS */
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 8c9f1c722cdb..b7c8a4484298 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -170,7 +170,7 @@ static int ieee80211_open(struct net_device *dev)
                         goto err_del_bss;
                 /* we're brought up, everything changes */
                 hw_reconf_flags = ~0;
-                ieee80211_led_radio(local, local->hw.conf.radio_enabled);
+                ieee80211_led_radio(local, true);
         }
 
         /*
@@ -560,7 +560,7 @@ static int ieee80211_stop(struct net_device *dev)
 
                 drv_stop(local);
 
-                ieee80211_led_radio(local, 0);
+                ieee80211_led_radio(local, false);
 
                 flush_workqueue(local->hw.workqueue);
 
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index e37770ced53c..2683df918073 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -289,16 +289,8 @@ void ieee80211_bss_info_change_notify(struct ieee80211_sub_if_data *sdata,
         drv_bss_info_changed(local, &sdata->vif,
                              &sdata->vif.bss_conf, changed);
 
-        /*
-         * DEPRECATED
-         *
-         * ~changed is just there to not do this at resume time
-         */
-        if (changed & BSS_CHANGED_BEACON_INT && ~changed) {
-                local->hw.conf.beacon_int = sdata->vif.bss_conf.beacon_int;
-                ieee80211_hw_config(local,
-                                    _IEEE80211_CONF_CHANGE_BEACON_INTERVAL);
-        }
+        /* DEPRECATED */
+        local->hw.conf.beacon_int = sdata->vif.bss_conf.beacon_int;
 }
 
 u32 ieee80211_reset_erp_info(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index d5611d8fd0d6..a360bceeba59 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -44,6 +44,15 @@
  * When the insertion fails (sta_info_insert()) returns non-zero), the
  * structure will have been freed by sta_info_insert()!
  *
+ * sta entries are added by mac80211 when you establish a link with a
+ * peer. This means different things for the different type of interfaces
+ * we support. For a regular station this mean we add the AP sta when we
+ * receive an assocation response from the AP. For IBSS this occurs when
+ * we receive a probe response or a beacon from target IBSS network. For
+ * WDS we add the sta for the peer imediately upon device open. When using
+ * AP mode we add stations for each respective station upon request from
+ * userspace through nl80211.
+ *
  * Because there are debugfs entries for each station, and adding those
  * must be able to sleep, it is also possible to "pin" a station entry,
  * that means it can be removed from the hash table but not be freed.
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index a910148b8228..1436f747531a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1238,7 +1238,6 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                          bool txpending)
 {
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct sta_info *sta;
         struct ieee80211_tx_data tx;
         ieee80211_tx_result res_prepare;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
@@ -1270,7 +1269,6 @@ static void ieee80211_tx(struct net_device *dev, struct sk_buff *skb,
                 return;
         }
 
-        sta = tx.sta;
         tx.channel = local->hw.conf.channel;
         info->band = tx.channel->band;
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 949d857debd8..22f63815fb36 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -657,15 +657,15 @@ void ieee80211_set_wmm_default(struct ieee80211_sub_if_data *sdata)
 
                 switch (queue) {
                 case 3: /* AC_BK */
-                        qparam.cw_max = aCWmin;
-                        qparam.cw_min = aCWmax;
+                        qparam.cw_max = aCWmax;
+                        qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 7;
                         break;
                 default: /* never happens but let's not leave undefined */
                 case 2: /* AC_BE */
-                        qparam.cw_max = aCWmin;
-                        qparam.cw_min = aCWmax;
+                        qparam.cw_max = aCWmax;
+                        qparam.cw_min = aCWmin;
                         qparam.txop = 0;
                         qparam.aifs = 3;
                         break;
@@ -973,7 +973,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         if (local->open_count) {
                 res = drv_start(local);
 
-                ieee80211_led_radio(local, hw->conf.radio_enabled);
+                ieee80211_led_radio(local, true);
         }
 
         /* add interfaces */
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index a01154e127f0..d2d81b103341 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -306,82 +306,6 @@ static int ieee80211_ioctl_giwrate(struct net_device *dev,
         return 0;
 }
 
-static int ieee80211_ioctl_siwtxpower(struct net_device *dev,
-                                      struct iw_request_info *info,
-                                      union iwreq_data *data, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-        struct ieee80211_channel* chan = local->hw.conf.channel;
-        bool reconf = false;
-        u32 reconf_flags = 0;
-        int new_power_level;
-
-        if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
-                return -EINVAL;
-        if (data->txpower.flags & IW_TXPOW_RANGE)
-                return -EINVAL;
-        if (!chan)
-                return -EINVAL;
-
-        /* only change when not disabling */
-        if (!data->txpower.disabled) {
-                if (data->txpower.fixed) {
-                        if (data->txpower.value < 0)
-                                return -EINVAL;
-                        new_power_level = data->txpower.value;
-                        /*
-                         * Debatable, but we cannot do a fixed power
-                         * level above the regulatory constraint.
-                         * Use "iwconfig wlan0 txpower 15dBm" instead.
-                         */
-                        if (new_power_level > chan->max_power)
-                                return -EINVAL;
-                } else {
-                        /*
-                         * Automatic power level setting, max being the value
-                         * passed in from userland.
-                         */
-                        if (data->txpower.value < 0)
-                                new_power_level = -1;
-                        else
-                                new_power_level = data->txpower.value;
-                }
-
-                reconf = true;
-
-                /*
-                 * ieee80211_hw_config() will limit to the channel's
-                 * max power and possibly power constraint from AP.
-                 */
-                local->user_power_level = new_power_level;
-        }
-
-        if (local->hw.conf.radio_enabled != !(data->txpower.disabled)) {
-                local->hw.conf.radio_enabled = !(data->txpower.disabled);
-                reconf_flags |= IEEE80211_CONF_CHANGE_RADIO_ENABLED;
-                ieee80211_led_radio(local, local->hw.conf.radio_enabled);
-        }
-
-        if (reconf || reconf_flags)
-                ieee80211_hw_config(local, reconf_flags);
-
-        return 0;
-}
-
-static int ieee80211_ioctl_giwtxpower(struct net_device *dev,
-                                   struct iw_request_info *info,
-                                   union iwreq_data *data, char *extra)
-{
-        struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
-
-        data->txpower.fixed = 1;
-        data->txpower.disabled = !(local->hw.conf.radio_enabled);
-        data->txpower.value = local->hw.conf.power_level;
-        data->txpower.flags = IW_TXPOW_DBM;
-
-        return 0;
-}
-
 static int ieee80211_ioctl_siwpower(struct net_device *dev,
                                     struct iw_request_info *info,
                                     struct iw_param *wrq,
@@ -658,8 +582,8 @@ static const iw_handler ieee80211_handler[] =
         (iw_handler) cfg80211_wext_giwrts,              /* SIOCGIWRTS */
         (iw_handler) cfg80211_wext_siwfrag,             /* SIOCSIWFRAG */
         (iw_handler) cfg80211_wext_giwfrag,             /* SIOCGIWFRAG */
-        (iw_handler) ieee80211_ioctl_siwtxpower,        /* SIOCSIWTXPOW */
-        (iw_handler) ieee80211_ioctl_giwtxpower,        /* SIOCGIWTXPOW */
+        (iw_handler) cfg80211_wext_siwtxpower,          /* SIOCSIWTXPOW */
+        (iw_handler) cfg80211_wext_giwtxpower,          /* SIOCGIWTXPOW */
         (iw_handler) cfg80211_wext_siwretry,            /* SIOCSIWRETRY */
         (iw_handler) cfg80211_wext_giwretry,            /* SIOCGIWRETRY */
         (iw_handler) cfg80211_wext_siwencode,           /* SIOCSIWENCODE */
diff --git a/net/rfkill/Kconfig b/net/rfkill/Kconfig
index 7f807b30cfbb..fd7600d8ab14 100644
--- a/net/rfkill/Kconfig
+++ b/net/rfkill/Kconfig
@@ -10,22 +10,15 @@ menuconfig RFKILL
           To compile this driver as a module, choose M here: the
           module will be called rfkill.
 
-config RFKILL_INPUT
-        tristate "Input layer to RF switch connector"
-        depends on RFKILL && INPUT
-        help
-          Say Y here if you want kernel automatically toggle state
-          of RF switches on and off when user presses appropriate
-          button or a key on the keyboard. Without this module you
-          need a some kind of userspace application to control
-          state of the switches.
-
-          To compile this driver as a module, choose M here: the
-          module will be called rfkill-input.
-
 # LED trigger support
 config RFKILL_LEDS
         bool
-        depends on RFKILL && LEDS_TRIGGERS
+        depends on RFKILL
+        depends on LEDS_TRIGGERS = y || RFKILL = LEDS_TRIGGERS
         default y
 
+config RFKILL_INPUT
+        bool "RF switch input support"
+        depends on RFKILL
+        depends on INPUT = y || RFKILL = INPUT
+        default y if !EMBEDDED
diff --git a/net/rfkill/Makefile b/net/rfkill/Makefile
index b38c430be057..662105352691 100644
--- a/net/rfkill/Makefile
+++ b/net/rfkill/Makefile
@@ -2,5 +2,6 @@
 # Makefile for the RF switch subsystem.
 #
 
-obj-$(CONFIG_RFKILL)                    += rfkill.o
-obj-$(CONFIG_RFKILL_INPUT)              += rfkill-input.o
+rfkill-y                        += core.o
+rfkill-$(CONFIG_RFKILL_INPUT)   += input.o
+obj-$(CONFIG_RFKILL)            += rfkill.o
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
new file mode 100644
index 000000000000..11b7314723df
--- /dev/null
+++ b/net/rfkill/core.c
@@ -0,0 +1,1228 @@
+/*
+ * Copyright (C) 2006 - 2007 Ivo van Doorn
+ * Copyright (C) 2007 Dmitry Torokhov
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the
+ * Free Software Foundation, Inc.,
+ * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/workqueue.h>
+#include <linux/capability.h>
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/rfkill.h>
+#include <linux/spinlock.h>
+#include <linux/miscdevice.h>
+#include <linux/wait.h>
+#include <linux/poll.h>
+#include <linux/fs.h>
+
+#include "rfkill.h"
+
+#define POLL_INTERVAL           (5 * HZ)
+
+#define RFKILL_BLOCK_HW         BIT(0)
+#define RFKILL_BLOCK_SW         BIT(1)
+#define RFKILL_BLOCK_SW_PREV    BIT(2)
+#define RFKILL_BLOCK_ANY        (RFKILL_BLOCK_HW |\
+                                 RFKILL_BLOCK_SW |\
+                                 RFKILL_BLOCK_SW_PREV)
+#define RFKILL_BLOCK_SW_SETCALL BIT(31)
+
+struct rfkill {
+        spinlock_t              lock;
+
+        const char              *name;
+        enum rfkill_type        type;
+
+        unsigned long           state;
+
+        u32                     idx;
+
+        bool                    registered;
+        bool                    suspended;
+
+        const struct rfkill_ops *ops;
+        void                    *data;
+
+#ifdef CONFIG_RFKILL_LEDS
+        struct led_trigger      led_trigger;
+        const char              *ledtrigname;
+#endif
+
+        struct device           dev;
+        struct list_head        node;
+
+        struct delayed_work     poll_work;
+        struct work_struct      uevent_work;
+        struct work_struct      sync_work;
+};
+#define to_rfkill(d)    container_of(d, struct rfkill, dev)
+
+struct rfkill_int_event {
+        struct list_head        list;
+        struct rfkill_event     ev;
+};
+
+struct rfkill_data {
+        struct list_head        list;
+        struct list_head        events;
+        struct mutex            mtx;
+        wait_queue_head_t       read_wait;
+        bool                    input_handler;
+};
+
+
+MODULE_AUTHOR("Ivo van Doorn <IvDoorn@gmail.com>");
+MODULE_AUTHOR("Johannes Berg <johannes@sipsolutions.net>");
+MODULE_DESCRIPTION("RF switch support");
+MODULE_LICENSE("GPL");
+
+
+/*
+ * The locking here should be made much smarter, we currently have
+ * a bit of a stupid situation because drivers might want to register
+ * the rfkill struct under their own lock, and take this lock during
+ * rfkill method calls -- which will cause an AB-BA deadlock situation.
+ *
+ * To fix that, we need to rework this code here to be mostly lock-free
+ * and only use the mutex for list manipulations, not to protect the
+ * various other global variables. Then we can avoid holding the mutex
+ * around driver operations, and all is happy.
+ */
+static LIST_HEAD(rfkill_list);  /* list of registered rf switches */
+static DEFINE_MUTEX(rfkill_global_mutex);
+static LIST_HEAD(rfkill_fds);   /* list of open fds of /dev/rfkill */
+
+static unsigned int rfkill_default_state = 1;
+module_param_named(default_state, rfkill_default_state, uint, 0444);
+MODULE_PARM_DESC(default_state,
+                 "Default initial state for all radio types, 0 = radio off");
+
+static struct {
+        bool cur, def;
+} rfkill_global_states[NUM_RFKILL_TYPES];
+
+static unsigned long rfkill_states_default_locked;
+
+static bool rfkill_epo_lock_active;
+
+
+#ifdef CONFIG_RFKILL_LEDS
+static void rfkill_led_trigger_event(struct rfkill *rfkill)
+{
+        struct led_trigger *trigger;
+
+        if (!rfkill->registered)
+                return;
+
+        trigger = &rfkill->led_trigger;
+
+        if (rfkill->state & RFKILL_BLOCK_ANY)
+                led_trigger_event(trigger, LED_OFF);
+        else
+                led_trigger_event(trigger, LED_FULL);
+}
+
+static void rfkill_led_trigger_activate(struct led_classdev *led)
+{
+        struct rfkill *rfkill;
+
+        rfkill = container_of(led->trigger, struct rfkill, led_trigger);
+
+        rfkill_led_trigger_event(rfkill);
+}
+
+const char *rfkill_get_led_trigger_name(struct rfkill *rfkill)
+{
+        return rfkill->led_trigger.name;
+}
+EXPORT_SYMBOL(rfkill_get_led_trigger_name);
+
+void rfkill_set_led_trigger_name(struct rfkill *rfkill, const char *name)
+{
+        BUG_ON(!rfkill);
+
+        rfkill->ledtrigname = name;
+}
+EXPORT_SYMBOL(rfkill_set_led_trigger_name);
+
+static int rfkill_led_trigger_register(struct rfkill *rfkill)
+{
+        rfkill->led_trigger.name = rfkill->ledtrigname
+                                        ? : dev_name(&rfkill->dev);
+        rfkill->led_trigger.activate = rfkill_led_trigger_activate;
+        return led_trigger_register(&rfkill->led_trigger);
+}
+
+static void rfkill_led_trigger_unregister(struct rfkill *rfkill)
+{
+        led_trigger_unregister(&rfkill->led_trigger);
+}
+#else
+static void rfkill_led_trigger_event(struct rfkill *rfkill)
+{
+}
+
+static inline int rfkill_led_trigger_register(struct rfkill *rfkill)
+{
+        return 0;
+}
+
+static inline void rfkill_led_trigger_unregister(struct rfkill *rfkill)
+{
+}
+#endif /* CONFIG_RFKILL_LEDS */
+
+static void rfkill_fill_event(struct rfkill_event *ev, struct rfkill *rfkill,
+                              enum rfkill_operation op)
+{
+        unsigned long flags;
+
+        ev->idx = rfkill->idx;
+        ev->type = rfkill->type;
+        ev->op = op;
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        ev->hard = !!(rfkill->state & RFKILL_BLOCK_HW);
+        ev->soft = !!(rfkill->state & (RFKILL_BLOCK_SW |
+                                        RFKILL_BLOCK_SW_PREV));
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+}
+
+static void rfkill_send_events(struct rfkill *rfkill, enum rfkill_operation op)
+{
+        struct rfkill_data *data;
+        struct rfkill_int_event *ev;
+
+        list_for_each_entry(data, &rfkill_fds, list) {
+                ev = kzalloc(sizeof(*ev), GFP_KERNEL);
+                if (!ev)
+                        continue;
+                rfkill_fill_event(&ev->ev, rfkill, op);
+                mutex_lock(&data->mtx);
+                list_add_tail(&ev->list, &data->events);
+                mutex_unlock(&data->mtx);
+                wake_up_interruptible(&data->read_wait);
+        }
+}
+
+static void rfkill_event(struct rfkill *rfkill)
+{
+        if (!rfkill->registered || rfkill->suspended)
+                return;
+
+        kobject_uevent(&rfkill->dev.kobj, KOBJ_CHANGE);
+
+        /* also send event to /dev/rfkill */
+        rfkill_send_events(rfkill, RFKILL_OP_CHANGE);
+}
+
+static bool __rfkill_set_hw_state(struct rfkill *rfkill,
+                                  bool blocked, bool *change)
+{
+        unsigned long flags;
+        bool prev, any;
+
+        BUG_ON(!rfkill);
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        prev = !!(rfkill->state & RFKILL_BLOCK_HW);
+        if (blocked)
+                rfkill->state |= RFKILL_BLOCK_HW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_HW;
+        *change = prev != blocked;
+        any = rfkill->state & RFKILL_BLOCK_ANY;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        rfkill_led_trigger_event(rfkill);
+
+        return any;
+}
+
+/**
+ * rfkill_set_block - wrapper for set_block method
+ *
+ * @rfkill: the rfkill struct to use
+ * @blocked: the new software state
+ *
+ * Calls the set_block method (when applicable) and handles notifications
+ * etc. as well.
+ */
+static void rfkill_set_block(struct rfkill *rfkill, bool blocked)
+{
+        unsigned long flags;
+        int err;
+
+        /*
+         * Some platforms (...!) generate input events which affect the
+         * _hard_ kill state -- whenever something tries to change the
+         * current software state query the hardware state too.
+         */
+        if (rfkill->ops->query)
+                rfkill->ops->query(rfkill, rfkill->data);
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        if (rfkill->state & RFKILL_BLOCK_SW)
+                rfkill->state |= RFKILL_BLOCK_SW_PREV;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_SW_PREV;
+
+        if (blocked)
+                rfkill->state |= RFKILL_BLOCK_SW;
+        else
+                rfkill->state &= ~RFKILL_BLOCK_SW;
+
+        rfkill->state |= RFKILL_BLOCK_SW_SETCALL;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
+                return;
+
+        err = rfkill->ops->set_block(rfkill->data, blocked);
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        if (err) {
+                /*
+                 * Failed -- reset status to _prev, this may be different
+                 * from what set set _PREV to earlier in this function
+                 * if rfkill_set_sw_state was invoked.
+                 */
+                if (rfkill->state & RFKILL_BLOCK_SW_PREV)
+                        rfkill->state |= RFKILL_BLOCK_SW;
+                else
+                        rfkill->state &= ~RFKILL_BLOCK_SW;
+        }
+        rfkill->state &= ~RFKILL_BLOCK_SW_SETCALL;
+        rfkill->state &= ~RFKILL_BLOCK_SW_PREV;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        rfkill_led_trigger_event(rfkill);
+        rfkill_event(rfkill);
+}
+
+#ifdef CONFIG_RFKILL_INPUT
+static atomic_t rfkill_input_disabled = ATOMIC_INIT(0);
+
+/**
+ * __rfkill_switch_all - Toggle state of all switches of given type
+ * @type: type of interfaces to be affected
+ * @state: the new state
+ *
+ * This function sets the state of all switches of given type,
+ * unless a specific switch is claimed by userspace (in which case,
+ * that switch is left alone) or suspended.
+ *
+ * Caller must have acquired rfkill_global_mutex.
+ */
+static void __rfkill_switch_all(const enum rfkill_type type, bool blocked)
+{
+        struct rfkill *rfkill;
+
+        rfkill_global_states[type].cur = blocked;
+        list_for_each_entry(rfkill, &rfkill_list, node) {
+                if (rfkill->type != type)
+                        continue;
+
+                rfkill_set_block(rfkill, blocked);
+        }
+}
+
+/**
+ * rfkill_switch_all - Toggle state of all switches of given type
+ * @type: type of interfaces to be affected
+ * @state: the new state
+ *
+ * Acquires rfkill_global_mutex and calls __rfkill_switch_all(@type, @state).
+ * Please refer to __rfkill_switch_all() for details.
+ *
+ * Does nothing if the EPO lock is active.
+ */
+void rfkill_switch_all(enum rfkill_type type, bool blocked)
+{
+        if (atomic_read(&rfkill_input_disabled))
+                return;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        if (!rfkill_epo_lock_active)
+                __rfkill_switch_all(type, blocked);
+
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+/**
+ * rfkill_epo - emergency power off all transmitters
+ *
+ * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
+ * ignoring everything in its path but rfkill_global_mutex and rfkill->mutex.
+ *
+ * The global state before the EPO is saved and can be restored later
+ * using rfkill_restore_states().
+ */
+void rfkill_epo(void)
+{
+        struct rfkill *rfkill;
+        int i;
+
+        if (atomic_read(&rfkill_input_disabled))
+                return;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        rfkill_epo_lock_active = true;
+        list_for_each_entry(rfkill, &rfkill_list, node)
+                rfkill_set_block(rfkill, true);
+
+        for (i = 0; i < NUM_RFKILL_TYPES; i++) {
+                rfkill_global_states[i].def = rfkill_global_states[i].cur;
+                rfkill_global_states[i].cur = true;
+        }
+
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+/**
+ * rfkill_restore_states - restore global states
+ *
+ * Restore (and sync switches to) the global state from the
+ * states in rfkill_default_states.  This can undo the effects of
+ * a call to rfkill_epo().
+ */
+void rfkill_restore_states(void)
+{
+        int i;
+
+        if (atomic_read(&rfkill_input_disabled))
+                return;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        rfkill_epo_lock_active = false;
+        for (i = 0; i < NUM_RFKILL_TYPES; i++)
+                __rfkill_switch_all(i, rfkill_global_states[i].def);
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+/**
+ * rfkill_remove_epo_lock - unlock state changes
+ *
+ * Used by rfkill-input manually unlock state changes, when
+ * the EPO switch is deactivated.
+ */
+void rfkill_remove_epo_lock(void)
+{
+        if (atomic_read(&rfkill_input_disabled))
+                return;
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_epo_lock_active = false;
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+/**
+ * rfkill_is_epo_lock_active - returns true EPO is active
+ *
+ * Returns 0 (false) if there is NOT an active EPO contidion,
+ * and 1 (true) if there is an active EPO contition, which
+ * locks all radios in one of the BLOCKED states.
+ *
+ * Can be called in atomic context.
+ */
+bool rfkill_is_epo_lock_active(void)
+{
+        return rfkill_epo_lock_active;
+}
+
+/**
+ * rfkill_get_global_sw_state - returns global state for a type
+ * @type: the type to get the global state of
+ *
+ * Returns the current global state for a given wireless
+ * device type.
+ */
+bool rfkill_get_global_sw_state(const enum rfkill_type type)
+{
+        return rfkill_global_states[type].cur;
+}
+#endif
+
+void rfkill_set_global_sw_state(const enum rfkill_type type, bool blocked)
+{
+        BUG_ON(type == RFKILL_TYPE_ALL);
+
+        mutex_lock(&rfkill_global_mutex);
+
+        /* don't allow unblock when epo */
+        if (rfkill_epo_lock_active && !blocked)
+                goto out;
+
+        /* too late */
+        if (rfkill_states_default_locked & BIT(type))
+                goto out;
+
+        rfkill_states_default_locked |= BIT(type);
+
+        rfkill_global_states[type].cur = blocked;
+        rfkill_global_states[type].def = blocked;
+ out:
+        mutex_unlock(&rfkill_global_mutex);
+}
+EXPORT_SYMBOL(rfkill_set_global_sw_state);
+
+
+bool rfkill_set_hw_state(struct rfkill *rfkill, bool blocked)
+{
+        bool ret, change;
+
+        ret = __rfkill_set_hw_state(rfkill, blocked, &change);
+
+        if (!rfkill->registered)
+                return ret;
+
+        if (change)
+                schedule_work(&rfkill->uevent_work);
+
+        return ret;
+}
+EXPORT_SYMBOL(rfkill_set_hw_state);
+
+static void __rfkill_set_sw_state(struct rfkill *rfkill, bool blocked)
+{
+        u32 bit = RFKILL_BLOCK_SW;
+
+        /* if in a ops->set_block right now, use other bit */
+        if (rfkill->state & RFKILL_BLOCK_SW_SETCALL)
+                bit = RFKILL_BLOCK_SW_PREV;
+
+        if (blocked)
+                rfkill->state |= bit;
+        else
+                rfkill->state &= ~bit;
+}
+
+bool rfkill_set_sw_state(struct rfkill *rfkill, bool blocked)
+{
+        unsigned long flags;
+        bool prev, hwblock;
+
+        BUG_ON(!rfkill);
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        prev = !!(rfkill->state & RFKILL_BLOCK_SW);
+        __rfkill_set_sw_state(rfkill, blocked);
+        hwblock = !!(rfkill->state & RFKILL_BLOCK_HW);
+        blocked = blocked || hwblock;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        if (!rfkill->registered)
+                return blocked;
+
+        if (prev != blocked && !hwblock)
+                schedule_work(&rfkill->uevent_work);
+
+        rfkill_led_trigger_event(rfkill);
+
+        return blocked;
+}
+EXPORT_SYMBOL(rfkill_set_sw_state);
+
+void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
+{
+        unsigned long flags;
+        bool swprev, hwprev;
+
+        BUG_ON(!rfkill);
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+
+        /*
+         * No need to care about prev/setblock ... this is for uevent only
+         * and that will get triggered by rfkill_set_block anyway.
+         */
+        swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
+        hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
+        __rfkill_set_sw_state(rfkill, sw);
+
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        if (!rfkill->registered)
+                return;
+
+        if (swprev != sw || hwprev != hw)
+                schedule_work(&rfkill->uevent_work);
+
+        rfkill_led_trigger_event(rfkill);
+}
+EXPORT_SYMBOL(rfkill_set_states);
+
+static ssize_t rfkill_name_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        return sprintf(buf, "%s\n", rfkill->name);
+}
+
+static const char *rfkill_get_type_str(enum rfkill_type type)
+{
+        switch (type) {
+        case RFKILL_TYPE_WLAN:
+                return "wlan";
+        case RFKILL_TYPE_BLUETOOTH:
+                return "bluetooth";
+        case RFKILL_TYPE_UWB:
+                return "ultrawideband";
+        case RFKILL_TYPE_WIMAX:
+                return "wimax";
+        case RFKILL_TYPE_WWAN:
+                return "wwan";
+        default:
+                BUG();
+        }
+
+        BUILD_BUG_ON(NUM_RFKILL_TYPES != RFKILL_TYPE_WWAN + 1);
+}
+
+static ssize_t rfkill_type_show(struct device *dev,
+                                struct device_attribute *attr,
+                                char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        return sprintf(buf, "%s\n", rfkill_get_type_str(rfkill->type));
+}
+
+static ssize_t rfkill_idx_show(struct device *dev,
+                               struct device_attribute *attr,
+                               char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        return sprintf(buf, "%d\n", rfkill->idx);
+}
+
+static u8 user_state_from_blocked(unsigned long state)
+{
+        if (state & RFKILL_BLOCK_HW)
+                return RFKILL_USER_STATE_HARD_BLOCKED;
+        if (state & RFKILL_BLOCK_SW)
+                return RFKILL_USER_STATE_SOFT_BLOCKED;
+
+        return RFKILL_USER_STATE_UNBLOCKED;
+}
+
+static ssize_t rfkill_state_show(struct device *dev,
+                                 struct device_attribute *attr,
+                                 char *buf)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long flags;
+        u32 state;
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        state = rfkill->state;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        return sprintf(buf, "%d\n", user_state_from_blocked(state));
+}
+
+static ssize_t rfkill_state_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t count)
+{
+        /*
+         * The intention was that userspace can only take control over
+         * a given device when/if rfkill-input doesn't control it due
+         * to user_claim. Since user_claim is currently unsupported,
+         * we never support changing the state from userspace -- this
+         * can be implemented again later.
+         */
+
+        return -EPERM;
+}
+
+static ssize_t rfkill_claim_show(struct device *dev,
+                                 struct device_attribute *attr,
+                                 char *buf)
+{
+        return sprintf(buf, "%d\n", 0);
+}
+
+static ssize_t rfkill_claim_store(struct device *dev,
+                                  struct device_attribute *attr,
+                                  const char *buf, size_t count)
+{
+        return -EOPNOTSUPP;
+}
+
+static struct device_attribute rfkill_dev_attrs[] = {
+        __ATTR(name, S_IRUGO, rfkill_name_show, NULL),
+        __ATTR(type, S_IRUGO, rfkill_type_show, NULL),
+        __ATTR(index, S_IRUGO, rfkill_idx_show, NULL),
+        __ATTR(state, S_IRUGO|S_IWUSR, rfkill_state_show, rfkill_state_store),
+        __ATTR(claim, S_IRUGO|S_IWUSR, rfkill_claim_show, rfkill_claim_store),
+        __ATTR_NULL
+};
+
+static void rfkill_release(struct device *dev)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        kfree(rfkill);
+}
+
+static int rfkill_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+        unsigned long flags;
+        u32 state;
+        int error;
+
+        error = add_uevent_var(env, "RFKILL_NAME=%s", rfkill->name);
+        if (error)
+                return error;
+        error = add_uevent_var(env, "RFKILL_TYPE=%s",
+                               rfkill_get_type_str(rfkill->type));
+        if (error)
+                return error;
+        spin_lock_irqsave(&rfkill->lock, flags);
+        state = rfkill->state;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+        error = add_uevent_var(env, "RFKILL_STATE=%d",
+                               user_state_from_blocked(state));
+        return error;
+}
+
+void rfkill_pause_polling(struct rfkill *rfkill)
+{
+        BUG_ON(!rfkill);
+
+        if (!rfkill->ops->poll)
+                return;
+
+        cancel_delayed_work_sync(&rfkill->poll_work);
+}
+EXPORT_SYMBOL(rfkill_pause_polling);
+
+void rfkill_resume_polling(struct rfkill *rfkill)
+{
+        BUG_ON(!rfkill);
+
+        if (!rfkill->ops->poll)
+                return;
+
+        schedule_work(&rfkill->poll_work.work);
+}
+EXPORT_SYMBOL(rfkill_resume_polling);
+
+static int rfkill_suspend(struct device *dev, pm_message_t state)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+
+        rfkill_pause_polling(rfkill);
+
+        rfkill->suspended = true;
+
+        return 0;
+}
+
+static int rfkill_resume(struct device *dev)
+{
+        struct rfkill *rfkill = to_rfkill(dev);
+        bool cur;
+
+        mutex_lock(&rfkill_global_mutex);
+        cur = rfkill_global_states[rfkill->type].cur;
+        rfkill_set_block(rfkill, cur);
+        mutex_unlock(&rfkill_global_mutex);
+
+        rfkill->suspended = false;
+
+        schedule_work(&rfkill->uevent_work);
+
+        rfkill_resume_polling(rfkill);
+
+        return 0;
+}
+
+static struct class rfkill_class = {
+        .name           = "rfkill",
+        .dev_release    = rfkill_release,
+        .dev_attrs      = rfkill_dev_attrs,
+        .dev_uevent     = rfkill_dev_uevent,
+        .suspend        = rfkill_suspend,
+        .resume         = rfkill_resume,
+};
+
+bool rfkill_blocked(struct rfkill *rfkill)
+{
+        unsigned long flags;
+        u32 state;
+
+        spin_lock_irqsave(&rfkill->lock, flags);
+        state = rfkill->state;
+        spin_unlock_irqrestore(&rfkill->lock, flags);
+
+        return !!(state & RFKILL_BLOCK_ANY);
+}
+EXPORT_SYMBOL(rfkill_blocked);
+
+
+struct rfkill * __must_check rfkill_alloc(const char *name,
+                                          struct device *parent,
+                                          const enum rfkill_type type,
+                                          const struct rfkill_ops *ops,
+                                          void *ops_data)
+{
+        struct rfkill *rfkill;
+        struct device *dev;
+
+        if (WARN_ON(!ops))
+                return NULL;
+
+        if (WARN_ON(!ops->set_block))
+                return NULL;
+
+        if (WARN_ON(!name))
+                return NULL;
+
+        if (WARN_ON(type == RFKILL_TYPE_ALL || type >= NUM_RFKILL_TYPES))
+                return NULL;
+
+        rfkill = kzalloc(sizeof(*rfkill), GFP_KERNEL);
+        if (!rfkill)
+                return NULL;
+
+        spin_lock_init(&rfkill->lock);
+        INIT_LIST_HEAD(&rfkill->node);
+        rfkill->type = type;
+        rfkill->name = name;
+        rfkill->ops = ops;
+        rfkill->data = ops_data;
+
+        dev = &rfkill->dev;
+        dev->class = &rfkill_class;
+        dev->parent = parent;
+        device_initialize(dev);
+
+        return rfkill;
+}
+EXPORT_SYMBOL(rfkill_alloc);
+
+static void rfkill_poll(struct work_struct *work)
+{
+        struct rfkill *rfkill;
+
+        rfkill = container_of(work, struct rfkill, poll_work.work);
+
+        /*
+         * Poll hardware state -- driver will use one of the
+         * rfkill_set{,_hw,_sw}_state functions and use its
+         * return value to update the current status.
+         */
+        rfkill->ops->poll(rfkill, rfkill->data);
+
+        schedule_delayed_work(&rfkill->poll_work,
+                round_jiffies_relative(POLL_INTERVAL));
+}
+
+static void rfkill_uevent_work(struct work_struct *work)
+{
+        struct rfkill *rfkill;
+
+        rfkill = container_of(work, struct rfkill, uevent_work);
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_event(rfkill);
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+static void rfkill_sync_work(struct work_struct *work)
+{
+        struct rfkill *rfkill;
+        bool cur;
+
+        rfkill = container_of(work, struct rfkill, sync_work);
+
+        mutex_lock(&rfkill_global_mutex);
+        cur = rfkill_global_states[rfkill->type].cur;
+        rfkill_set_block(rfkill, cur);
+        mutex_unlock(&rfkill_global_mutex);
+}
+
+int __must_check rfkill_register(struct rfkill *rfkill)
+{
+        static unsigned long rfkill_no;
+        struct device *dev = &rfkill->dev;
+        int error;
+
+        BUG_ON(!rfkill);
+
+        mutex_lock(&rfkill_global_mutex);
+
+        if (rfkill->registered) {
+                error = -EALREADY;
+                goto unlock;
+        }
+
+        rfkill->idx = rfkill_no;
+        dev_set_name(dev, "rfkill%lu", rfkill_no);
+        rfkill_no++;
+
+        if (!(rfkill_states_default_locked & BIT(rfkill->type))) {
+                /* first of its kind */
+                BUILD_BUG_ON(NUM_RFKILL_TYPES >
+                        sizeof(rfkill_states_default_locked) * 8);
+                rfkill_states_default_locked |= BIT(rfkill->type);
+                rfkill_global_states[rfkill->type].cur =
+                        rfkill_global_states[rfkill->type].def;
+        }
+
+        list_add_tail(&rfkill->node, &rfkill_list);
+
+        error = device_add(dev);
+        if (error)
+                goto remove;
+
+        error = rfkill_led_trigger_register(rfkill);
+        if (error)
+                goto devdel;
+
+        rfkill->registered = true;
+
+        INIT_DELAYED_WORK(&rfkill->poll_work, rfkill_poll);
+        INIT_WORK(&rfkill->uevent_work, rfkill_uevent_work);
+        INIT_WORK(&rfkill->sync_work, rfkill_sync_work);
+
+        if (rfkill->ops->poll)
+                schedule_delayed_work(&rfkill->poll_work,
+                        round_jiffies_relative(POLL_INTERVAL));
+        schedule_work(&rfkill->sync_work);
+
+        rfkill_send_events(rfkill, RFKILL_OP_ADD);
+
+        mutex_unlock(&rfkill_global_mutex);
+        return 0;
+
+ devdel:
+        device_del(&rfkill->dev);
+ remove:
+        list_del_init(&rfkill->node);
+ unlock:
+        mutex_unlock(&rfkill_global_mutex);
+        return error;
+}
+EXPORT_SYMBOL(rfkill_register);
+
+void rfkill_unregister(struct rfkill *rfkill)
+{
+        BUG_ON(!rfkill);
+
+        if (rfkill->ops->poll)
+                cancel_delayed_work_sync(&rfkill->poll_work);
+
+        cancel_work_sync(&rfkill->uevent_work);
+        cancel_work_sync(&rfkill->sync_work);
+
+        rfkill->registered = false;
+
+        device_del(&rfkill->dev);
+
+        mutex_lock(&rfkill_global_mutex);
+        rfkill_send_events(rfkill, RFKILL_OP_DEL);
+        list_del_init(&rfkill->node);
+        mutex_unlock(&rfkill_global_mutex);
+
+        rfkill_led_trigger_unregister(rfkill);
+}
+EXPORT_SYMBOL(rfkill_unregister);
+
+void rfkill_destroy(struct rfkill *rfkill)
+{
+        if (rfkill)
+                put_device(&rfkill->dev);
+}
+EXPORT_SYMBOL(rfkill_destroy);
+
+static int rfkill_fop_open(struct inode *inode, struct file *file)
+{
+        struct rfkill_data *data;
+        struct rfkill *rfkill;
+        struct rfkill_int_event *ev, *tmp;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        INIT_LIST_HEAD(&data->events);
+        mutex_init(&data->mtx);
+        init_waitqueue_head(&data->read_wait);
+
+        mutex_lock(&rfkill_global_mutex);
+        mutex_lock(&data->mtx);
+        /*
+         * start getting events from elsewhere but hold mtx to get
+         * startup events added first
+         */
+        list_add(&data->list, &rfkill_fds);
+
+        list_for_each_entry(rfkill, &rfkill_list, node) {
+                ev = kzalloc(sizeof(*ev), GFP_KERNEL);
+                if (!ev)
+                        goto free;
+                rfkill_fill_event(&ev->ev, rfkill, RFKILL_OP_ADD);
+                list_add_tail(&ev->list, &data->events);
+        }
+        mutex_unlock(&data->mtx);
+        mutex_unlock(&rfkill_global_mutex);
+
+        file->private_data = data;
+
+        return nonseekable_open(inode, file);
+
+ free:
+        mutex_unlock(&data->mtx);
+        mutex_unlock(&rfkill_global_mutex);
+        mutex_destroy(&data->mtx);
+        list_for_each_entry_safe(ev, tmp, &data->events, list)
+                kfree(ev);
+        kfree(data);
+        return -ENOMEM;
+}
+
+static unsigned int rfkill_fop_poll(struct file *file, poll_table *wait)
+{
+        struct rfkill_data *data = file->private_data;
+        unsigned int res = POLLOUT | POLLWRNORM;
+
+        poll_wait(file, &data->read_wait, wait);
+
+        mutex_lock(&data->mtx);
+        if (!list_empty(&data->events))
+                res = POLLIN | POLLRDNORM;
+        mutex_unlock(&data->mtx);
+
+        return res;
+}
+
+static bool rfkill_readable(struct rfkill_data *data)
+{
+        bool r;
+
+        mutex_lock(&data->mtx);
+        r = !list_empty(&data->events);
+        mutex_unlock(&data->mtx);
+
+        return r;
+}
+
+static ssize_t rfkill_fop_read(struct file *file, char __user *buf,
+                               size_t count, loff_t *pos)
+{
+        struct rfkill_data *data = file->private_data;
+        struct rfkill_int_event *ev;
+        unsigned long sz;
+        int ret;
+
+        mutex_lock(&data->mtx);
+
+        while (list_empty(&data->events)) {
+                if (file->f_flags & O_NONBLOCK) {
+                        ret = -EAGAIN;
+                        goto out;
+                }
+                mutex_unlock(&data->mtx);
+                ret = wait_event_interruptible(data->read_wait,
+                                               rfkill_readable(data));
+                mutex_lock(&data->mtx);
+
+                if (ret)
+                        goto out;
+        }
+
+        ev = list_first_entry(&data->events, struct rfkill_int_event,
+                                list);
+
+        sz = min_t(unsigned long, sizeof(ev->ev), count);
+        ret = sz;
+        if (copy_to_user(buf, &ev->ev, sz))
+                ret = -EFAULT;
+
+        list_del(&ev->list);
+        kfree(ev);
+ out:
+        mutex_unlock(&data->mtx);
+        return ret;
+}
+
+static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
+                                size_t count, loff_t *pos)
+{
+        struct rfkill *rfkill;
+        struct rfkill_event ev;
+
+        /* we don't need the 'hard' variable but accept it */
+        if (count < sizeof(ev) - 1)
+                return -EINVAL;
+
+        if (copy_from_user(&ev, buf, sizeof(ev) - 1))
+                return -EFAULT;
+
+        if (ev.op != RFKILL_OP_CHANGE && ev.op != RFKILL_OP_CHANGE_ALL)
+                return -EINVAL;
+
+        if (ev.type >= NUM_RFKILL_TYPES)
+                return -EINVAL;
+
+        mutex_lock(&rfkill_global_mutex);
+
+        if (ev.op == RFKILL_OP_CHANGE_ALL) {
+                if (ev.type == RFKILL_TYPE_ALL) {
+                        enum rfkill_type i;
+                        for (i = 0; i < NUM_RFKILL_TYPES; i++)
+                                rfkill_global_states[i].cur = ev.soft;
+                } else {
+                        rfkill_global_states[ev.type].cur = ev.soft;
+                }
+        }
+
+        list_for_each_entry(rfkill, &rfkill_list, node) {
+                if (rfkill->idx != ev.idx && ev.op != RFKILL_OP_CHANGE_ALL)
+                        continue;
+
+                if (rfkill->type != ev.type && ev.type != RFKILL_TYPE_ALL)
+                        continue;
+
+                rfkill_set_block(rfkill, ev.soft);
+        }
+        mutex_unlock(&rfkill_global_mutex);
+
+        return count;
+}
+
+static int rfkill_fop_release(struct inode *inode, struct file *file)
+{
+        struct rfkill_data *data = file->private_data;
+        struct rfkill_int_event *ev, *tmp;
+
+        mutex_lock(&rfkill_global_mutex);
+        list_del(&data->list);
+        mutex_unlock(&rfkill_global_mutex);
+
+        mutex_destroy(&data->mtx);
+        list_for_each_entry_safe(ev, tmp, &data->events, list)
+                kfree(ev);
+
+#ifdef CONFIG_RFKILL_INPUT
+        if (data->input_handler)
+                atomic_dec(&rfkill_input_disabled);
+#endif
+
+        kfree(data);
+
+        return 0;
+}
+
+#ifdef CONFIG_RFKILL_INPUT
+static long rfkill_fop_ioctl(struct file *file, unsigned int cmd,
+                             unsigned long arg)
+{
+        struct rfkill_data *data = file->private_data;
+
+        if (_IOC_TYPE(cmd) != RFKILL_IOC_MAGIC)
+                return -ENOSYS;
+
+        if (_IOC_NR(cmd) != RFKILL_IOC_NOINPUT)
+                return -ENOSYS;
+
+        mutex_lock(&data->mtx);
+
+        if (!data->input_handler) {
+                atomic_inc(&rfkill_input_disabled);
+                data->input_handler = true;
+        }
+
+        mutex_unlock(&data->mtx);
+
+        return 0;
+}
+#endif
+
+static const struct file_operations rfkill_fops = {
+        .open           = rfkill_fop_open,
+        .read           = rfkill_fop_read,
+        .write          = rfkill_fop_write,
+        .poll           = rfkill_fop_poll,
+        .release        = rfkill_fop_release,
+#ifdef CONFIG_RFKILL_INPUT
+        .unlocked_ioctl = rfkill_fop_ioctl,
+        .compat_ioctl   = rfkill_fop_ioctl,
+#endif
+};
+
+static struct miscdevice rfkill_miscdev = {
+        .name   = "rfkill",
+        .fops   = &rfkill_fops,
+        .minor  = MISC_DYNAMIC_MINOR,
+};
+
+static int __init rfkill_init(void)
+{
+        int error;
+        int i;
+
+        for (i = 0; i < NUM_RFKILL_TYPES; i++)
+                rfkill_global_states[i].def = !rfkill_default_state;
+
+        error = class_register(&rfkill_class);
+        if (error)
+                goto out;
+
+        error = misc_register(&rfkill_miscdev);
+        if (error) {
+                class_unregister(&rfkill_class);
+                goto out;
+        }
+
+#ifdef CONFIG_RFKILL_INPUT
+        error = rfkill_handler_init();
+        if (error) {
+                misc_deregister(&rfkill_miscdev);
+                class_unregister(&rfkill_class);
+                goto out;
+        }
+#endif
+
+ out:
+        return error;
+}
+subsys_initcall(rfkill_init);
+
+static void __exit rfkill_exit(void)
+{
+#ifdef CONFIG_RFKILL_INPUT
+        rfkill_handler_exit();
+#endif
+        misc_deregister(&rfkill_miscdev);
+        class_unregister(&rfkill_class);
+}
+module_exit(rfkill_exit);
diff --git a/net/rfkill/input.c b/net/rfkill/input.c
new file mode 100644
index 000000000000..a7295ad5f9cb
--- /dev/null
+++ b/net/rfkill/input.c
@@ -0,0 +1,342 @@
+/*
+ * Input layer to RF Kill interface connector
+ *
+ * Copyright (c) 2007 Dmitry Torokhov
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation.
+ *
+ * If you ever run into a situation in which you have a SW_ type rfkill
+ * input device, then you can revive code that was removed in the patch
+ * "rfkill-input: remove unused code".
+ */
+
+#include <linux/input.h>
+#include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <linux/init.h>
+#include <linux/rfkill.h>
+#include <linux/sched.h>
+
+#include "rfkill.h"
+
+enum rfkill_input_master_mode {
+        RFKILL_INPUT_MASTER_UNLOCK = 0,
+        RFKILL_INPUT_MASTER_RESTORE = 1,
+        RFKILL_INPUT_MASTER_UNBLOCKALL = 2,
+        NUM_RFKILL_INPUT_MASTER_MODES
+};
+
+/* Delay (in ms) between consecutive switch ops */
+#define RFKILL_OPS_DELAY 200
+
+static enum rfkill_input_master_mode rfkill_master_switch_mode =
+                                        RFKILL_INPUT_MASTER_UNBLOCKALL;
+module_param_named(master_switch_mode, rfkill_master_switch_mode, uint, 0);
+MODULE_PARM_DESC(master_switch_mode,
+        "SW_RFKILL_ALL ON should: 0=do nothing (only unlock); 1=restore; 2=unblock all");
+
+static spinlock_t rfkill_op_lock;
+static bool rfkill_op_pending;
+static unsigned long rfkill_sw_pending[BITS_TO_LONGS(NUM_RFKILL_TYPES)];
+static unsigned long rfkill_sw_state[BITS_TO_LONGS(NUM_RFKILL_TYPES)];
+
+enum rfkill_sched_op {
+        RFKILL_GLOBAL_OP_EPO = 0,
+        RFKILL_GLOBAL_OP_RESTORE,
+        RFKILL_GLOBAL_OP_UNLOCK,
+        RFKILL_GLOBAL_OP_UNBLOCK,
+};
+
+static enum rfkill_sched_op rfkill_master_switch_op;
+static enum rfkill_sched_op rfkill_op;
+
+static void __rfkill_handle_global_op(enum rfkill_sched_op op)
+{
+        unsigned int i;
+
+        switch (op) {
+        case RFKILL_GLOBAL_OP_EPO:
+                rfkill_epo();
+                break;
+        case RFKILL_GLOBAL_OP_RESTORE:
+                rfkill_restore_states();
+                break;
+        case RFKILL_GLOBAL_OP_UNLOCK:
+                rfkill_remove_epo_lock();
+                break;
+        case RFKILL_GLOBAL_OP_UNBLOCK:
+                rfkill_remove_epo_lock();
+                for (i = 0; i < NUM_RFKILL_TYPES; i++)
+                        rfkill_switch_all(i, false);
+                break;
+        default:
+                /* memory corruption or bug, fail safely */
+                rfkill_epo();
+                WARN(1, "Unknown requested operation %d! "
+                        "rfkill Emergency Power Off activated\n",
+                        op);
+        }
+}
+
+static void __rfkill_handle_normal_op(const enum rfkill_type type,
+                                      const bool complement)
+{
+        bool blocked;
+
+        blocked = rfkill_get_global_sw_state(type);
+        if (complement)
+                blocked = !blocked;
+
+        rfkill_switch_all(type, blocked);
+}
+
+static void rfkill_op_handler(struct work_struct *work)
+{
+        unsigned int i;
+        bool c;
+
+        spin_lock_irq(&rfkill_op_lock);
+        do {
+                if (rfkill_op_pending) {
+                        enum rfkill_sched_op op = rfkill_op;
+                        rfkill_op_pending = false;
+                        memset(rfkill_sw_pending, 0,
+                                sizeof(rfkill_sw_pending));
+                        spin_unlock_irq(&rfkill_op_lock);
+
+                        __rfkill_handle_global_op(op);
+
+                        spin_lock_irq(&rfkill_op_lock);
+
+                        /*
+                         * handle global ops first -- during unlocked period
+                         * we might have gotten a new global op.
+                         */
+                        if (rfkill_op_pending)
+                                continue;
+                }
+
+                if (rfkill_is_epo_lock_active())
+                        continue;
+
+                for (i = 0; i < NUM_RFKILL_TYPES; i++) {
+                        if (__test_and_clear_bit(i, rfkill_sw_pending)) {
+                                c = __test_and_clear_bit(i, rfkill_sw_state);
+                                spin_unlock_irq(&rfkill_op_lock);
+
+                                __rfkill_handle_normal_op(i, c);
+
+                                spin_lock_irq(&rfkill_op_lock);
+                        }
+                }
+        } while (rfkill_op_pending);
+        spin_unlock_irq(&rfkill_op_lock);
+}
+
+static DECLARE_DELAYED_WORK(rfkill_op_work, rfkill_op_handler);
+static unsigned long rfkill_last_scheduled;
+
+static unsigned long rfkill_ratelimit(const unsigned long last)
+{
+        const unsigned long delay = msecs_to_jiffies(RFKILL_OPS_DELAY);
+        return (time_after(jiffies, last + delay)) ? 0 : delay;
+}
+
+static void rfkill_schedule_ratelimited(void)
+{
+        if (delayed_work_pending(&rfkill_op_work))
+                return;
+        schedule_delayed_work(&rfkill_op_work,
+                              rfkill_ratelimit(rfkill_last_scheduled));
+        rfkill_last_scheduled = jiffies;
+}
+
+static void rfkill_schedule_global_op(enum rfkill_sched_op op)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&rfkill_op_lock, flags);
+        rfkill_op = op;
+        rfkill_op_pending = true;
+        if (op == RFKILL_GLOBAL_OP_EPO && !rfkill_is_epo_lock_active()) {
+                /* bypass the limiter for EPO */
+                cancel_delayed_work(&rfkill_op_work);
+                schedule_delayed_work(&rfkill_op_work, 0);
+                rfkill_last_scheduled = jiffies;
+        } else
+                rfkill_schedule_ratelimited();
+        spin_unlock_irqrestore(&rfkill_op_lock, flags);
+}
+
+static void rfkill_schedule_toggle(enum rfkill_type type)
+{
+        unsigned long flags;
+
+        if (rfkill_is_epo_lock_active())
+                return;
+
+        spin_lock_irqsave(&rfkill_op_lock, flags);
+        if (!rfkill_op_pending) {
+                __set_bit(type, rfkill_sw_pending);
+                __change_bit(type, rfkill_sw_state);
+                rfkill_schedule_ratelimited();
+        }
+        spin_unlock_irqrestore(&rfkill_op_lock, flags);
+}
+
+static void rfkill_schedule_evsw_rfkillall(int state)
+{
+        if (state)
+                rfkill_schedule_global_op(rfkill_master_switch_op);
+        else
+                rfkill_schedule_global_op(RFKILL_GLOBAL_OP_EPO);
+}
+
+static void rfkill_event(struct input_handle *handle, unsigned int type,
+                        unsigned int code, int data)
+{
+        if (type == EV_KEY && data == 1) {
+                switch (code) {
+                case KEY_WLAN:
+                        rfkill_schedule_toggle(RFKILL_TYPE_WLAN);
+                        break;
+                case KEY_BLUETOOTH:
+                        rfkill_schedule_toggle(RFKILL_TYPE_BLUETOOTH);
+                        break;
+                case KEY_UWB:
+                        rfkill_schedule_toggle(RFKILL_TYPE_UWB);
+                        break;
+                case KEY_WIMAX:
+                        rfkill_schedule_toggle(RFKILL_TYPE_WIMAX);
+                        break;
+                }
+        } else if (type == EV_SW && code == SW_RFKILL_ALL)
+                rfkill_schedule_evsw_rfkillall(data);
+}
+
+static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
+                          const struct input_device_id *id)
+{
+        struct input_handle *handle;
+        int error;
+
+        handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
+        if (!handle)
+                return -ENOMEM;
+
+        handle->dev = dev;
+        handle->handler = handler;
+        handle->name = "rfkill";
+
+        /* causes rfkill_start() to be called */
+        error = input_register_handle(handle);
+        if (error)
+                goto err_free_handle;
+
+        error = input_open_device(handle);
+        if (error)
+                goto err_unregister_handle;
+
+        return 0;
+
+ err_unregister_handle:
+        input_unregister_handle(handle);
+ err_free_handle:
+        kfree(handle);
+        return error;
+}
+
+static void rfkill_start(struct input_handle *handle)
+{
+        /*
+         * Take event_lock to guard against configuration changes, we
+         * should be able to deal with concurrency with rfkill_event()
+         * just fine (which event_lock will also avoid).
+         */
+        spin_lock_irq(&handle->dev->event_lock);
+
+        if (test_bit(EV_SW, handle->dev->evbit) &&
+            test_bit(SW_RFKILL_ALL, handle->dev->swbit))
+                rfkill_schedule_evsw_rfkillall(test_bit(SW_RFKILL_ALL,
+                                                        handle->dev->sw));
+
+        spin_unlock_irq(&handle->dev->event_lock);
+}
+
+static void rfkill_disconnect(struct input_handle *handle)
+{
+        input_close_device(handle);
+        input_unregister_handle(handle);
+        kfree(handle);
+}
+
+static const struct input_device_id rfkill_ids[] = {
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_WLAN)] = BIT_MASK(KEY_WLAN) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_BLUETOOTH)] = BIT_MASK(KEY_BLUETOOTH) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_UWB)] = BIT_MASK(KEY_UWB) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(KEY_WIMAX)] = BIT_MASK(KEY_WIMAX) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT,
+                .evbit = { BIT(EV_SW) },
+                .swbit = { [BIT_WORD(SW_RFKILL_ALL)] = BIT_MASK(SW_RFKILL_ALL) },
+        },
+        { }
+};
+
+static struct input_handler rfkill_handler = {
+        .name = "rfkill",
+        .event = rfkill_event,
+        .connect = rfkill_connect,
+        .start = rfkill_start,
+        .disconnect = rfkill_disconnect,
+        .id_table = rfkill_ids,
+};
+
+int __init rfkill_handler_init(void)
+{
+        switch (rfkill_master_switch_mode) {
+        case RFKILL_INPUT_MASTER_UNBLOCKALL:
+                rfkill_master_switch_op = RFKILL_GLOBAL_OP_UNBLOCK;
+                break;
+        case RFKILL_INPUT_MASTER_RESTORE:
+                rfkill_master_switch_op = RFKILL_GLOBAL_OP_RESTORE;
+                break;
+        case RFKILL_INPUT_MASTER_UNLOCK:
+                rfkill_master_switch_op = RFKILL_GLOBAL_OP_UNLOCK;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        spin_lock_init(&rfkill_op_lock);
+
+        /* Avoid delay at first schedule */
+        rfkill_last_scheduled =
+                        jiffies - msecs_to_jiffies(RFKILL_OPS_DELAY) - 1;
+        return input_register_handler(&rfkill_handler);
+}
+
+void __exit rfkill_handler_exit(void)
+{
+        input_unregister_handler(&rfkill_handler);
+        cancel_delayed_work_sync(&rfkill_op_work);
+}
diff --git a/net/rfkill/rfkill-input.c b/net/rfkill/rfkill-input.c
deleted file mode 100644
index 60a34f3b5f65..000000000000
--- a/net/rfkill/rfkill-input.c
+++ /dev/null
@@ -1,390 +0,0 @@
-/*
- * Input layer to RF Kill interface connector
- *
- * Copyright (c) 2007 Dmitry Torokhov
- */
-
-/*
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 as published
- * by the Free Software Foundation.
- */
-
-#include <linux/module.h>
-#include <linux/input.h>
-#include <linux/slab.h>
-#include <linux/workqueue.h>
-#include <linux/init.h>
-#include <linux/rfkill.h>
-#include <linux/sched.h>
-
-#include "rfkill-input.h"
-
-MODULE_AUTHOR("Dmitry Torokhov <dtor@mail.ru>");
-MODULE_DESCRIPTION("Input layer to RF switch connector");
-MODULE_LICENSE("GPL");
-
-enum rfkill_input_master_mode {
-        RFKILL_INPUT_MASTER_DONOTHING = 0,
-        RFKILL_INPUT_MASTER_RESTORE = 1,
-        RFKILL_INPUT_MASTER_UNBLOCKALL = 2,
-        RFKILL_INPUT_MASTER_MAX,        /* marker */
-};
-
-/* Delay (in ms) between consecutive switch ops */
-#define RFKILL_OPS_DELAY 200
-
-static enum rfkill_input_master_mode rfkill_master_switch_mode =
-                                        RFKILL_INPUT_MASTER_UNBLOCKALL;
-module_param_named(master_switch_mode, rfkill_master_switch_mode, uint, 0);
-MODULE_PARM_DESC(master_switch_mode,
-        "SW_RFKILL_ALL ON should: 0=do nothing; 1=restore; 2=unblock all");
-
-enum rfkill_global_sched_op {
-        RFKILL_GLOBAL_OP_EPO = 0,
-        RFKILL_GLOBAL_OP_RESTORE,
-        RFKILL_GLOBAL_OP_UNLOCK,
-        RFKILL_GLOBAL_OP_UNBLOCK,
-};
-
-struct rfkill_task {
-        struct delayed_work dwork;
-
-        /* ensures that task is serialized */
-        struct mutex mutex;
-
-        /* protects everything below */
-        spinlock_t lock;
-
-        /* pending regular switch operations (1=pending) */
-        unsigned long sw_pending[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-
-        /* should the state be complemented (1=yes) */
-        unsigned long sw_togglestate[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-
-        bool global_op_pending;
-        enum rfkill_global_sched_op op;
-
-        /* last time it was scheduled */
-        unsigned long last_scheduled;
-};
-
-static void __rfkill_handle_global_op(enum rfkill_global_sched_op op)
-{
-        unsigned int i;
-
-        switch (op) {
-        case RFKILL_GLOBAL_OP_EPO:
-                rfkill_epo();
-                break;
-        case RFKILL_GLOBAL_OP_RESTORE:
-                rfkill_restore_states();
-                break;
-        case RFKILL_GLOBAL_OP_UNLOCK:
-                rfkill_remove_epo_lock();
-                break;
-        case RFKILL_GLOBAL_OP_UNBLOCK:
-                rfkill_remove_epo_lock();
-                for (i = 0; i < RFKILL_TYPE_MAX; i++)
-                        rfkill_switch_all(i, RFKILL_STATE_UNBLOCKED);
-                break;
-        default:
-                /* memory corruption or bug, fail safely */
-                rfkill_epo();
-                WARN(1, "Unknown requested operation %d! "
-                        "rfkill Emergency Power Off activated\n",
-                        op);
-        }
-}
-
-static void __rfkill_handle_normal_op(const enum rfkill_type type,
-                        const bool c)
-{
-        enum rfkill_state state;
-
-        state = rfkill_get_global_state(type);
-        if (c)
-                state = rfkill_state_complement(state);
-
-        rfkill_switch_all(type, state);
-}
-
-static void rfkill_task_handler(struct work_struct *work)
-{
-        struct rfkill_task *task = container_of(work,
-                                        struct rfkill_task, dwork.work);
-        bool doit = true;
-
-        mutex_lock(&task->mutex);
-
-        spin_lock_irq(&task->lock);
-        while (doit) {
-                if (task->global_op_pending) {
-                        enum rfkill_global_sched_op op = task->op;
-                        task->global_op_pending = false;
-                        memset(task->sw_pending, 0, sizeof(task->sw_pending));
-                        spin_unlock_irq(&task->lock);
-
-                        __rfkill_handle_global_op(op);
-
-                        /* make sure we do at least one pass with
-                         * !task->global_op_pending */
-                        spin_lock_irq(&task->lock);
-                        continue;
-                } else if (!rfkill_is_epo_lock_active()) {
-                        unsigned int i = 0;
-
-                        while (!task->global_op_pending &&
-                                                i < RFKILL_TYPE_MAX) {
-                                if (test_and_clear_bit(i, task->sw_pending)) {
-                                        bool c;
-                                        c = test_and_clear_bit(i,
-                                                        task->sw_togglestate);
-                                        spin_unlock_irq(&task->lock);
-
-                                        __rfkill_handle_normal_op(i, c);
-
-                                        spin_lock_irq(&task->lock);
-                                }
-                                i++;
-                        }
-                }
-                doit = task->global_op_pending;
-        }
-        spin_unlock_irq(&task->lock);
-
-        mutex_unlock(&task->mutex);
-}
-
-static struct rfkill_task rfkill_task = {
-        .dwork = __DELAYED_WORK_INITIALIZER(rfkill_task.dwork,
-                                rfkill_task_handler),
-        .mutex = __MUTEX_INITIALIZER(rfkill_task.mutex),
-        .lock = __SPIN_LOCK_UNLOCKED(rfkill_task.lock),
-};
-
-static unsigned long rfkill_ratelimit(const unsigned long last)
-{
-        const unsigned long delay = msecs_to_jiffies(RFKILL_OPS_DELAY);
-        return (time_after(jiffies, last + delay)) ? 0 : delay;
-}
-
-static void rfkill_schedule_ratelimited(void)
-{
-        if (!delayed_work_pending(&rfkill_task.dwork)) {
-                schedule_delayed_work(&rfkill_task.dwork,
-                                rfkill_ratelimit(rfkill_task.last_scheduled));
-                rfkill_task.last_scheduled = jiffies;
-        }
-}
-
-static void rfkill_schedule_global_op(enum rfkill_global_sched_op op)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&rfkill_task.lock, flags);
-        rfkill_task.op = op;
-        rfkill_task.global_op_pending = true;
-        if (op == RFKILL_GLOBAL_OP_EPO && !rfkill_is_epo_lock_active()) {
-                /* bypass the limiter for EPO */
-                cancel_delayed_work(&rfkill_task.dwork);
-                schedule_delayed_work(&rfkill_task.dwork, 0);
-                rfkill_task.last_scheduled = jiffies;
-        } else
-                rfkill_schedule_ratelimited();
-        spin_unlock_irqrestore(&rfkill_task.lock, flags);
-}
-
-static void rfkill_schedule_toggle(enum rfkill_type type)
-{
-        unsigned long flags;
-
-        if (rfkill_is_epo_lock_active())
-                return;
-
-        spin_lock_irqsave(&rfkill_task.lock, flags);
-        if (!rfkill_task.global_op_pending) {
-                set_bit(type, rfkill_task.sw_pending);
-                change_bit(type, rfkill_task.sw_togglestate);
-                rfkill_schedule_ratelimited();
-        }
-        spin_unlock_irqrestore(&rfkill_task.lock, flags);
-}
-
-static void rfkill_schedule_evsw_rfkillall(int state)
-{
-        if (state) {
-                switch (rfkill_master_switch_mode) {
-                case RFKILL_INPUT_MASTER_UNBLOCKALL:
-                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_UNBLOCK);
-                        break;
-                case RFKILL_INPUT_MASTER_RESTORE:
-                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_RESTORE);
-                        break;
-                case RFKILL_INPUT_MASTER_DONOTHING:
-                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_UNLOCK);
-                        break;
-                default:
-                        /* memory corruption or driver bug! fail safely */
-                        rfkill_schedule_global_op(RFKILL_GLOBAL_OP_EPO);
-                        WARN(1, "Unknown rfkill_master_switch_mode (%d), "
-                                "driver bug or memory corruption detected!\n",
-                                rfkill_master_switch_mode);
-                        break;
-                }
-        } else
-                rfkill_schedule_global_op(RFKILL_GLOBAL_OP_EPO);
-}
-
-static void rfkill_event(struct input_handle *handle, unsigned int type,
-                        unsigned int code, int data)
-{
-        if (type == EV_KEY && data == 1) {
-                enum rfkill_type t;
-
-                switch (code) {
-                case KEY_WLAN:
-                        t = RFKILL_TYPE_WLAN;
-                        break;
-                case KEY_BLUETOOTH:
-                        t = RFKILL_TYPE_BLUETOOTH;
-                        break;
-                case KEY_UWB:
-                        t = RFKILL_TYPE_UWB;
-                        break;
-                case KEY_WIMAX:
-                        t = RFKILL_TYPE_WIMAX;
-                        break;
-                default:
-                        return;
-                }
-                rfkill_schedule_toggle(t);
-                return;
-        } else if (type == EV_SW) {
-                switch (code) {
-                case SW_RFKILL_ALL:
-                        rfkill_schedule_evsw_rfkillall(data);
-                        return;
-                default:
-                        return;
-                }
-        }
-}
-
-static int rfkill_connect(struct input_handler *handler, struct input_dev *dev,
-                          const struct input_device_id *id)
-{
-        struct input_handle *handle;
-        int error;
-
-        handle = kzalloc(sizeof(struct input_handle), GFP_KERNEL);
-        if (!handle)
-                return -ENOMEM;
-
-        handle->dev = dev;
-        handle->handler = handler;
-        handle->name = "rfkill";
-
-        /* causes rfkill_start() to be called */
-        error = input_register_handle(handle);
-        if (error)
-                goto err_free_handle;
-
-        error = input_open_device(handle);
-        if (error)
-                goto err_unregister_handle;
-
-        return 0;
-
- err_unregister_handle:
-        input_unregister_handle(handle);
- err_free_handle:
-        kfree(handle);
-        return error;
-}
-
-static void rfkill_start(struct input_handle *handle)
-{
-        /* Take event_lock to guard against configuration changes, we
-         * should be able to deal with concurrency with rfkill_event()
-         * just fine (which event_lock will also avoid). */
-        spin_lock_irq(&handle->dev->event_lock);
-
-        if (test_bit(EV_SW, handle->dev->evbit)) {
-                if (test_bit(SW_RFKILL_ALL, handle->dev->swbit))
-                        rfkill_schedule_evsw_rfkillall(test_bit(SW_RFKILL_ALL,
-                                                        handle->dev->sw));
-                /* add resync for further EV_SW events here */
-        }
-
-        spin_unlock_irq(&handle->dev->event_lock);
-}
-
-static void rfkill_disconnect(struct input_handle *handle)
-{
-        input_close_device(handle);
-        input_unregister_handle(handle);
-        kfree(handle);
-}
-
-static const struct input_device_id rfkill_ids[] = {
-        {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
-                .evbit = { BIT_MASK(EV_KEY) },
-                .keybit = { [BIT_WORD(KEY_WLAN)] = BIT_MASK(KEY_WLAN) },
-        },
-        {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
-                .evbit = { BIT_MASK(EV_KEY) },
-                .keybit = { [BIT_WORD(KEY_BLUETOOTH)] = BIT_MASK(KEY_BLUETOOTH) },
-        },
-        {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
-                .evbit = { BIT_MASK(EV_KEY) },
-                .keybit = { [BIT_WORD(KEY_UWB)] = BIT_MASK(KEY_UWB) },
-        },
-        {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_KEYBIT,
-                .evbit = { BIT_MASK(EV_KEY) },
-                .keybit = { [BIT_WORD(KEY_WIMAX)] = BIT_MASK(KEY_WIMAX) },
-        },
-        {
-                .flags = INPUT_DEVICE_ID_MATCH_EVBIT | INPUT_DEVICE_ID_MATCH_SWBIT,
-                .evbit = { BIT(EV_SW) },
-                .swbit = { [BIT_WORD(SW_RFKILL_ALL)] = BIT_MASK(SW_RFKILL_ALL) },
-        },
-        { }
-};
-
-static struct input_handler rfkill_handler = {
-        .event =        rfkill_event,
-        .connect =      rfkill_connect,
-        .disconnect =   rfkill_disconnect,
-        .start =        rfkill_start,
-        .name =         "rfkill",
-        .id_table =     rfkill_ids,
-};
-
-static int __init rfkill_handler_init(void)
-{
-        if (rfkill_master_switch_mode >= RFKILL_INPUT_MASTER_MAX)
-                return -EINVAL;
-
-        /*
-         * The penalty to not doing this is a possible RFKILL_OPS_DELAY delay
-         * at the first use.  Acceptable, but if we can avoid it, why not?
-         */
-        rfkill_task.last_scheduled =
-                        jiffies - msecs_to_jiffies(RFKILL_OPS_DELAY) - 1;
-        return input_register_handler(&rfkill_handler);
-}
-
-static void __exit rfkill_handler_exit(void)
-{
-        input_unregister_handler(&rfkill_handler);
-        cancel_delayed_work_sync(&rfkill_task.dwork);
-        rfkill_remove_epo_lock();
-}
-
-module_init(rfkill_handler_init);
-module_exit(rfkill_handler_exit);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
deleted file mode 100644
index 4f5a83183c95..000000000000
--- a/net/rfkill/rfkill.c
+++ /dev/null
@@ -1,855 +0,0 @@
-/*
- * Copyright (C) 2006 - 2007 Ivo van Doorn
- * Copyright (C) 2007 Dmitry Torokhov
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the
- * Free Software Foundation, Inc.,
- * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
- */
-
-#include <linux/kernel.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/workqueue.h>
-#include <linux/capability.h>
-#include <linux/list.h>
-#include <linux/mutex.h>
-#include <linux/rfkill.h>
-
-/* Get declaration of rfkill_switch_all() to shut up sparse. */
-#include "rfkill-input.h"
-
-
-MODULE_AUTHOR("Ivo van Doorn <IvDoorn@gmail.com>");
-MODULE_VERSION("1.0");
-MODULE_DESCRIPTION("RF switch support");
-MODULE_LICENSE("GPL");
-
-static LIST_HEAD(rfkill_list);  /* list of registered rf switches */
-static DEFINE_MUTEX(rfkill_global_mutex);
-
-static unsigned int rfkill_default_state = RFKILL_STATE_UNBLOCKED;
-module_param_named(default_state, rfkill_default_state, uint, 0444);
-MODULE_PARM_DESC(default_state,
-                 "Default initial state for all radio types, 0 = radio off");
-
-struct rfkill_gsw_state {
-        enum rfkill_state current_state;
-        enum rfkill_state default_state;
-};
-
-static struct rfkill_gsw_state rfkill_global_states[RFKILL_TYPE_MAX];
-static unsigned long rfkill_states_lockdflt[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-static bool rfkill_epo_lock_active;
-
-
-#ifdef CONFIG_RFKILL_LEDS
-static void rfkill_led_trigger(struct rfkill *rfkill,
-                               enum rfkill_state state)
-{
-        struct led_trigger *led = &rfkill->led_trigger;
-
-        if (!led->name)
-                return;
-        if (state != RFKILL_STATE_UNBLOCKED)
-                led_trigger_event(led, LED_OFF);
-        else
-                led_trigger_event(led, LED_FULL);
-}
-
-static void rfkill_led_trigger_activate(struct led_classdev *led)
-{
-        struct rfkill *rfkill = container_of(led->trigger,
-                        struct rfkill, led_trigger);
-
-        rfkill_led_trigger(rfkill, rfkill->state);
-}
-#else
-static inline void rfkill_led_trigger(struct rfkill *rfkill,
-                                        enum rfkill_state state)
-{
-}
-#endif /* CONFIG_RFKILL_LEDS */
-
-static void rfkill_uevent(struct rfkill *rfkill)
-{
-        kobject_uevent(&rfkill->dev.kobj, KOBJ_CHANGE);
-}
-
-static void update_rfkill_state(struct rfkill *rfkill)
-{
-        enum rfkill_state newstate, oldstate;
-
-        if (rfkill->get_state) {
-                mutex_lock(&rfkill->mutex);
-                if (!rfkill->get_state(rfkill->data, &newstate)) {
-                        oldstate = rfkill->state;
-                        rfkill->state = newstate;
-                        if (oldstate != newstate)
-                                rfkill_uevent(rfkill);
-                }
-                mutex_unlock(&rfkill->mutex);
-        }
-        rfkill_led_trigger(rfkill, rfkill->state);
-}
-
-/**
- * rfkill_toggle_radio - wrapper for toggle_radio hook
- * @rfkill: the rfkill struct to use
- * @force: calls toggle_radio even if cache says it is not needed,
- *      and also makes sure notifications of the state will be
- *      sent even if it didn't change
- * @state: the new state to call toggle_radio() with
- *
- * Calls rfkill->toggle_radio, enforcing the API for toggle_radio
- * calls and handling all the red tape such as issuing notifications
- * if the call is successful.
- *
- * Suspended devices are not touched at all, and -EAGAIN is returned.
- *
- * Note that the @force parameter cannot override a (possibly cached)
- * state of RFKILL_STATE_HARD_BLOCKED.  Any device making use of
- * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
- * rfkill_force_state(), so the cache either is bypassed or valid.
- *
- * Note that we do call toggle_radio for RFKILL_STATE_SOFT_BLOCKED
- * even if the radio is in RFKILL_STATE_HARD_BLOCKED state, so as to
- * give the driver a hint that it should double-BLOCK the transmitter.
- *
- * Caller must have acquired rfkill->mutex.
- */
-static int rfkill_toggle_radio(struct rfkill *rfkill,
-                                enum rfkill_state state,
-                                int force)
-{
-        int retval = 0;
-        enum rfkill_state oldstate, newstate;
-
-        if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
-                return -EBUSY;
-
-        oldstate = rfkill->state;
-
-        if (rfkill->get_state && !force &&
-            !rfkill->get_state(rfkill->data, &newstate)) {
-                rfkill->state = newstate;
-        }
-
-        switch (state) {
-        case RFKILL_STATE_HARD_BLOCKED:
-                /* typically happens when refreshing hardware state,
-                 * such as on resume */
-                state = RFKILL_STATE_SOFT_BLOCKED;
-                break;
-        case RFKILL_STATE_UNBLOCKED:
-                /* force can't override this, only rfkill_force_state() can */
-                if (rfkill->state == RFKILL_STATE_HARD_BLOCKED)
-                        return -EPERM;
-                break;
-        case RFKILL_STATE_SOFT_BLOCKED:
-                /* nothing to do, we want to give drivers the hint to double
-                 * BLOCK even a transmitter that is already in state
-                 * RFKILL_STATE_HARD_BLOCKED */
-                break;
-        default:
-                WARN(1, KERN_WARNING
-                        "rfkill: illegal state %d passed as parameter "
-                        "to rfkill_toggle_radio\n", state);
-                return -EINVAL;
-        }
-
-        if (force || state != rfkill->state) {
-                retval = rfkill->toggle_radio(rfkill->data, state);
-                /* never allow a HARD->SOFT downgrade! */
-                if (!retval && rfkill->state != RFKILL_STATE_HARD_BLOCKED)
-                        rfkill->state = state;
-        }
-
-        if (force || rfkill->state != oldstate)
-                rfkill_uevent(rfkill);
-
-        rfkill_led_trigger(rfkill, rfkill->state);
-        return retval;
-}
-
-/**
- * __rfkill_switch_all - Toggle state of all switches of given type
- * @type: type of interfaces to be affected
- * @state: the new state
- *
- * This function toggles the state of all switches of given type,
- * unless a specific switch is claimed by userspace (in which case,
- * that switch is left alone) or suspended.
- *
- * Caller must have acquired rfkill_global_mutex.
- */
-static void __rfkill_switch_all(const enum rfkill_type type,
-                                const enum rfkill_state state)
-{
-        struct rfkill *rfkill;
-
-        if (WARN((state >= RFKILL_STATE_MAX || type >= RFKILL_TYPE_MAX),
-                        KERN_WARNING
-                        "rfkill: illegal state %d or type %d "
-                        "passed as parameter to __rfkill_switch_all\n",
-                        state, type))
-                return;
-
-        rfkill_global_states[type].current_state = state;
-        list_for_each_entry(rfkill, &rfkill_list, node) {
-                if (rfkill->type == type) {
-                        mutex_lock(&rfkill->mutex);
-                        rfkill_toggle_radio(rfkill, state, 0);
-                        mutex_unlock(&rfkill->mutex);
-                        rfkill_led_trigger(rfkill, rfkill->state);
-                }
-        }
-}
-
-/**
- * rfkill_switch_all - Toggle state of all switches of given type
- * @type: type of interfaces to be affected
- * @state: the new state
- *
- * Acquires rfkill_global_mutex and calls __rfkill_switch_all(@type, @state).
- * Please refer to __rfkill_switch_all() for details.
- *
- * Does nothing if the EPO lock is active.
- */
-void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
-{
-        mutex_lock(&rfkill_global_mutex);
-        if (!rfkill_epo_lock_active)
-                __rfkill_switch_all(type, state);
-        mutex_unlock(&rfkill_global_mutex);
-}
-EXPORT_SYMBOL(rfkill_switch_all);
-
-/**
- * rfkill_epo - emergency power off all transmitters
- *
- * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
- * ignoring everything in its path but rfkill_global_mutex and rfkill->mutex.
- *
- * The global state before the EPO is saved and can be restored later
- * using rfkill_restore_states().
- */
-void rfkill_epo(void)
-{
-        struct rfkill *rfkill;
-        int i;
-
-        mutex_lock(&rfkill_global_mutex);
-
-        rfkill_epo_lock_active = true;
-        list_for_each_entry(rfkill, &rfkill_list, node) {
-                mutex_lock(&rfkill->mutex);
-                rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
-                mutex_unlock(&rfkill->mutex);
-        }
-        for (i = 0; i < RFKILL_TYPE_MAX; i++) {
-                rfkill_global_states[i].default_state =
-                                rfkill_global_states[i].current_state;
-                rfkill_global_states[i].current_state =
-                                RFKILL_STATE_SOFT_BLOCKED;
-        }
-        mutex_unlock(&rfkill_global_mutex);
-        rfkill_led_trigger(rfkill, rfkill->state);
-}
-EXPORT_SYMBOL_GPL(rfkill_epo);
-
-/**
- * rfkill_restore_states - restore global states
- *
- * Restore (and sync switches to) the global state from the
- * states in rfkill_default_states.  This can undo the effects of
- * a call to rfkill_epo().
- */
-void rfkill_restore_states(void)
-{
-        int i;
-
-        mutex_lock(&rfkill_global_mutex);
-
-        rfkill_epo_lock_active = false;
-        for (i = 0; i < RFKILL_TYPE_MAX; i++)
-                __rfkill_switch_all(i, rfkill_global_states[i].default_state);
-        mutex_unlock(&rfkill_global_mutex);
-}
-EXPORT_SYMBOL_GPL(rfkill_restore_states);
-
-/**
- * rfkill_remove_epo_lock - unlock state changes
- *
- * Used by rfkill-input manually unlock state changes, when
- * the EPO switch is deactivated.
- */
-void rfkill_remove_epo_lock(void)
-{
-        mutex_lock(&rfkill_global_mutex);
-        rfkill_epo_lock_active = false;
-        mutex_unlock(&rfkill_global_mutex);
-}
-EXPORT_SYMBOL_GPL(rfkill_remove_epo_lock);
-
-/**
- * rfkill_is_epo_lock_active - returns true EPO is active
- *
- * Returns 0 (false) if there is NOT an active EPO contidion,
- * and 1 (true) if there is an active EPO contition, which
- * locks all radios in one of the BLOCKED states.
- *
- * Can be called in atomic context.
- */
-bool rfkill_is_epo_lock_active(void)
-{
-        return rfkill_epo_lock_active;
-}
-EXPORT_SYMBOL_GPL(rfkill_is_epo_lock_active);
-
-/**
- * rfkill_get_global_state - returns global state for a type
- * @type: the type to get the global state of
- *
- * Returns the current global state for a given wireless
- * device type.
- */
-enum rfkill_state rfkill_get_global_state(const enum rfkill_type type)
-{
-        return rfkill_global_states[type].current_state;
-}
-EXPORT_SYMBOL_GPL(rfkill_get_global_state);
-
-/**
- * rfkill_force_state - Force the internal rfkill radio state
- * @rfkill: pointer to the rfkill class to modify.
- * @state: the current radio state the class should be forced to.
- *
- * This function updates the internal state of the radio cached
- * by the rfkill class.  It should be used when the driver gets
- * a notification by the firmware/hardware of the current *real*
- * state of the radio rfkill switch.
- *
- * Devices which are subject to external changes on their rfkill
- * state (such as those caused by a hardware rfkill line) MUST
- * have their driver arrange to call rfkill_force_state() as soon
- * as possible after such a change.
- *
- * This function may not be called from an atomic context.
- */
-int rfkill_force_state(struct rfkill *rfkill, enum rfkill_state state)
-{
-        enum rfkill_state oldstate;
-
-        BUG_ON(!rfkill);
-        if (WARN((state >= RFKILL_STATE_MAX),
-                        KERN_WARNING
-                        "rfkill: illegal state %d passed as parameter "
-                        "to rfkill_force_state\n", state))
-                return -EINVAL;
-
-        mutex_lock(&rfkill->mutex);
-
-        oldstate = rfkill->state;
-        rfkill->state = state;
-
-        if (state != oldstate)
-                rfkill_uevent(rfkill);
-
-        mutex_unlock(&rfkill->mutex);
-        rfkill_led_trigger(rfkill, rfkill->state);
-
-        return 0;
-}
-EXPORT_SYMBOL(rfkill_force_state);
-
-static ssize_t rfkill_name_show(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        return sprintf(buf, "%s\n", rfkill->name);
-}
-
-static const char *rfkill_get_type_str(enum rfkill_type type)
-{
-        switch (type) {
-        case RFKILL_TYPE_WLAN:
-                return "wlan";
-        case RFKILL_TYPE_BLUETOOTH:
-                return "bluetooth";
-        case RFKILL_TYPE_UWB:
-                return "ultrawideband";
-        case RFKILL_TYPE_WIMAX:
-                return "wimax";
-        case RFKILL_TYPE_WWAN:
-                return "wwan";
-        default:
-                BUG();
-        }
-}
-
-static ssize_t rfkill_type_show(struct device *dev,
-                                struct device_attribute *attr,
-                                char *buf)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        return sprintf(buf, "%s\n", rfkill_get_type_str(rfkill->type));
-}
-
-static ssize_t rfkill_state_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        update_rfkill_state(rfkill);
-        return sprintf(buf, "%d\n", rfkill->state);
-}
-
-static ssize_t rfkill_state_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-        unsigned long state;
-        int error;
-
-        if (!capable(CAP_NET_ADMIN))
-                return -EPERM;
-
-        error = strict_strtoul(buf, 0, &state);
-        if (error)
-                return error;
-
-        /* RFKILL_STATE_HARD_BLOCKED is illegal here... */
-        if (state != RFKILL_STATE_UNBLOCKED &&
-            state != RFKILL_STATE_SOFT_BLOCKED)
-                return -EINVAL;
-
-        error = mutex_lock_killable(&rfkill->mutex);
-        if (error)
-                return error;
-
-        if (!rfkill_epo_lock_active)
-                error = rfkill_toggle_radio(rfkill, state, 0);
-        else
-                error = -EPERM;
-
-        mutex_unlock(&rfkill->mutex);
-
-        return error ? error : count;
-}
-
-static ssize_t rfkill_claim_show(struct device *dev,
-                                 struct device_attribute *attr,
-                                 char *buf)
-{
-        return sprintf(buf, "%d\n", 0);
-}
-
-static ssize_t rfkill_claim_store(struct device *dev,
-                                  struct device_attribute *attr,
-                                  const char *buf, size_t count)
-{
-        return -EOPNOTSUPP;
-}
-
-static struct device_attribute rfkill_dev_attrs[] = {
-        __ATTR(name, S_IRUGO, rfkill_name_show, NULL),
-        __ATTR(type, S_IRUGO, rfkill_type_show, NULL),
-        __ATTR(state, S_IRUGO|S_IWUSR, rfkill_state_show, rfkill_state_store),
-        __ATTR(claim, S_IRUGO|S_IWUSR, rfkill_claim_show, rfkill_claim_store),
-        __ATTR_NULL
-};
-
-static void rfkill_release(struct device *dev)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        kfree(rfkill);
-        module_put(THIS_MODULE);
-}
-
-#ifdef CONFIG_PM
-static int rfkill_suspend(struct device *dev, pm_message_t state)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-
-        /* mark class device as suspended */
-        if (dev->power.power_state.event != state.event)
-                dev->power.power_state = state;
-
-        /* store state for the resume handler */
-        rfkill->state_for_resume = rfkill->state;
-
-        return 0;
-}
-
-static int rfkill_resume(struct device *dev)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-        enum rfkill_state newstate;
-
-        if (dev->power.power_state.event != PM_EVENT_ON) {
-                mutex_lock(&rfkill->mutex);
-
-                dev->power.power_state.event = PM_EVENT_ON;
-
-                /*
-                 * rfkill->state could have been modified before we got
-                 * called, and won't be updated by rfkill_toggle_radio()
-                 * in force mode.  Sync it FIRST.
-                 */
-                if (rfkill->get_state &&
-                    !rfkill->get_state(rfkill->data, &newstate))
-                        rfkill->state = newstate;
-
-                /*
-                 * If we are under EPO, kick transmitter offline,
-                 * otherwise restore to pre-suspend state.
-                 *
-                 * Issue a notification in any case
-                 */
-                rfkill_toggle_radio(rfkill,
-                                rfkill_epo_lock_active ?
-                                        RFKILL_STATE_SOFT_BLOCKED :
-                                        rfkill->state_for_resume,
-                                1);
-
-                mutex_unlock(&rfkill->mutex);
-                rfkill_led_trigger(rfkill, rfkill->state);
-        }
-
-        return 0;
-}
-#else
-#define rfkill_suspend NULL
-#define rfkill_resume NULL
-#endif
-
-static int rfkill_dev_uevent(struct device *dev, struct kobj_uevent_env *env)
-{
-        struct rfkill *rfkill = to_rfkill(dev);
-        int error;
-
-        error = add_uevent_var(env, "RFKILL_NAME=%s", rfkill->name);
-        if (error)
-                return error;
-        error = add_uevent_var(env, "RFKILL_TYPE=%s",
-                                rfkill_get_type_str(rfkill->type));
-        if (error)
-                return error;
-        error = add_uevent_var(env, "RFKILL_STATE=%d", rfkill->state);
-        return error;
-}
-
-static struct class rfkill_class = {
-        .name           = "rfkill",
-        .dev_release    = rfkill_release,
-        .dev_attrs      = rfkill_dev_attrs,
-        .suspend        = rfkill_suspend,
-        .resume         = rfkill_resume,
-        .dev_uevent     = rfkill_dev_uevent,
-};
-
-static int rfkill_check_duplicity(const struct rfkill *rfkill)
-{
-        struct rfkill *p;
-        unsigned long seen[BITS_TO_LONGS(RFKILL_TYPE_MAX)];
-
-        memset(seen, 0, sizeof(seen));
-
-        list_for_each_entry(p, &rfkill_list, node) {
-                if (WARN((p == rfkill), KERN_WARNING
-                                "rfkill: illegal attempt to register "
-                                "an already registered rfkill struct\n"))
-                        return -EEXIST;
-                set_bit(p->type, seen);
-        }
-
-        /* 0: first switch of its kind */
-        return (test_bit(rfkill->type, seen)) ? 1 : 0;
-}
-
-static int rfkill_add_switch(struct rfkill *rfkill)
-{
-        int error;
-
-        mutex_lock(&rfkill_global_mutex);
-
-        error = rfkill_check_duplicity(rfkill);
-        if (error < 0)
-                goto unlock_out;
-
-        if (!error) {
-                /* lock default after first use */
-                set_bit(rfkill->type, rfkill_states_lockdflt);
-                rfkill_global_states[rfkill->type].current_state =
-                        rfkill_global_states[rfkill->type].default_state;
-        }
-
-        rfkill_toggle_radio(rfkill,
-                            rfkill_global_states[rfkill->type].current_state,
-                            0);
-
-        list_add_tail(&rfkill->node, &rfkill_list);
-
-        error = 0;
-unlock_out:
-        mutex_unlock(&rfkill_global_mutex);
-
-        return error;
-}
-
-static void rfkill_remove_switch(struct rfkill *rfkill)
-{
-        mutex_lock(&rfkill_global_mutex);
-        list_del_init(&rfkill->node);
-        mutex_unlock(&rfkill_global_mutex);
-
-        mutex_lock(&rfkill->mutex);
-        rfkill_toggle_radio(rfkill, RFKILL_STATE_SOFT_BLOCKED, 1);
-        mutex_unlock(&rfkill->mutex);
-}
-
-/**
- * rfkill_allocate - allocate memory for rfkill structure.
- * @parent: device that has rf switch on it
- * @type: type of the switch (RFKILL_TYPE_*)
- *
- * This function should be called by the network driver when it needs
- * rfkill structure.  Once the structure is allocated the driver should
- * finish its initialization by setting the name, private data, enable_radio
- * and disable_radio methods and then register it with rfkill_register().
- *
- * NOTE: If registration fails the structure shoudl be freed by calling
- * rfkill_free() otherwise rfkill_unregister() should be used.
- */
-struct rfkill * __must_check rfkill_allocate(struct device *parent,
-                                             enum rfkill_type type)
-{
-        struct rfkill *rfkill;
-        struct device *dev;
-
-        if (WARN((type >= RFKILL_TYPE_MAX),
-                        KERN_WARNING
-                        "rfkill: illegal type %d passed as parameter "
-                        "to rfkill_allocate\n", type))
-                return NULL;
-
-        rfkill = kzalloc(sizeof(struct rfkill), GFP_KERNEL);
-        if (!rfkill)
-                return NULL;
-
-        mutex_init(&rfkill->mutex);
-        INIT_LIST_HEAD(&rfkill->node);
-        rfkill->type = type;
-
-        dev = &rfkill->dev;
-        dev->class = &rfkill_class;
-        dev->parent = parent;
-        device_initialize(dev);
-
-        __module_get(THIS_MODULE);
-
-        return rfkill;
-}
-EXPORT_SYMBOL(rfkill_allocate);
-
-/**
- * rfkill_free - Mark rfkill structure for deletion
- * @rfkill: rfkill structure to be destroyed
- *
- * Decrements reference count of the rfkill structure so it is destroyed.
- * Note that rfkill_free() should _not_ be called after rfkill_unregister().
- */
-void rfkill_free(struct rfkill *rfkill)
-{
-        if (rfkill)
-                put_device(&rfkill->dev);
-}
-EXPORT_SYMBOL(rfkill_free);
-
-static void rfkill_led_trigger_register(struct rfkill *rfkill)
-{
-#ifdef CONFIG_RFKILL_LEDS
-        int error;
-
-        if (!rfkill->led_trigger.name)
-                rfkill->led_trigger.name = dev_name(&rfkill->dev);
-        if (!rfkill->led_trigger.activate)
-                rfkill->led_trigger.activate = rfkill_led_trigger_activate;
-        error = led_trigger_register(&rfkill->led_trigger);
-        if (error)
-                rfkill->led_trigger.name = NULL;
-#endif /* CONFIG_RFKILL_LEDS */
-}
-
-static void rfkill_led_trigger_unregister(struct rfkill *rfkill)
-{
-#ifdef CONFIG_RFKILL_LEDS
-        if (rfkill->led_trigger.name) {
-                led_trigger_unregister(&rfkill->led_trigger);
-                rfkill->led_trigger.name = NULL;
-        }
-#endif
-}
-
-/**
- * rfkill_register - Register a rfkill structure.
- * @rfkill: rfkill structure to be registered
- *
- * This function should be called by the network driver when the rfkill
- * structure needs to be registered. Immediately from registration the
- * switch driver should be able to service calls to toggle_radio.
- */
-int __must_check rfkill_register(struct rfkill *rfkill)
-{
-        static atomic_t rfkill_no = ATOMIC_INIT(0);
-        struct device *dev = &rfkill->dev;
-        int error;
-
-        if (WARN((!rfkill || !rfkill->toggle_radio ||
-                        rfkill->type >= RFKILL_TYPE_MAX ||
-                        rfkill->state >= RFKILL_STATE_MAX),
-                        KERN_WARNING
-                        "rfkill: attempt to register a "
-                        "badly initialized rfkill struct\n"))
-                return -EINVAL;
-
-        dev_set_name(dev, "rfkill%ld", (long)atomic_inc_return(&rfkill_no) - 1);
-
-        rfkill_led_trigger_register(rfkill);
-
-        error = rfkill_add_switch(rfkill);
-        if (error) {
-                rfkill_led_trigger_unregister(rfkill);
-                return error;
-        }
-
-        error = device_add(dev);
-        if (error) {
-                rfkill_remove_switch(rfkill);
-                rfkill_led_trigger_unregister(rfkill);
-                return error;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(rfkill_register);
-
-/**
- * rfkill_unregister - Unregister a rfkill structure.
- * @rfkill: rfkill structure to be unregistered
- *
- * This function should be called by the network driver during device
- * teardown to destroy rfkill structure. Note that rfkill_free() should
- * _not_ be called after rfkill_unregister().
- */
-void rfkill_unregister(struct rfkill *rfkill)
-{
-        BUG_ON(!rfkill);
-        device_del(&rfkill->dev);
-        rfkill_remove_switch(rfkill);
-        rfkill_led_trigger_unregister(rfkill);
-        put_device(&rfkill->dev);
-}
-EXPORT_SYMBOL(rfkill_unregister);
-
-/**
- * rfkill_set_default - set initial value for a switch type
- * @type - the type of switch to set the default state of
- * @state - the new default state for that group of switches
- *
- * Sets the initial state rfkill should use for a given type.
- * The following initial states are allowed: RFKILL_STATE_SOFT_BLOCKED
- * and RFKILL_STATE_UNBLOCKED.
- *
- * This function is meant to be used by platform drivers for platforms
- * that can save switch state across power down/reboot.
- *
- * The default state for each switch type can be changed exactly once.
- * After a switch of that type is registered, the default state cannot
- * be changed anymore.  This guards against multiple drivers it the
- * same platform trying to set the initial switch default state, which
- * is not allowed.
- *
- * Returns -EPERM if the state has already been set once or is in use,
- * so drivers likely want to either ignore or at most printk(KERN_NOTICE)
- * if this function returns -EPERM.
- *
- * Returns 0 if the new default state was set, or an error if it
- * could not be set.
- */
-int rfkill_set_default(enum rfkill_type type, enum rfkill_state state)
-{
-        int error;
-
-        if (WARN((type >= RFKILL_TYPE_MAX ||
-                        (state != RFKILL_STATE_SOFT_BLOCKED &&
-                         state != RFKILL_STATE_UNBLOCKED)),
-                        KERN_WARNING
-                        "rfkill: illegal state %d or type %d passed as "
-                        "parameter to rfkill_set_default\n", state, type))
-                return -EINVAL;
-
-        mutex_lock(&rfkill_global_mutex);
-
-        if (!test_and_set_bit(type, rfkill_states_lockdflt)) {
-                rfkill_global_states[type].default_state = state;
-                rfkill_global_states[type].current_state = state;
-                error = 0;
-        } else
-                error = -EPERM;
-
-        mutex_unlock(&rfkill_global_mutex);
-        return error;
-}
-EXPORT_SYMBOL_GPL(rfkill_set_default);
-
-/*
- * Rfkill module initialization/deinitialization.
- */
-static int __init rfkill_init(void)
-{
-        int error;
-        int i;
-
-        /* RFKILL_STATE_HARD_BLOCKED is illegal here... */
-        if (rfkill_default_state != RFKILL_STATE_SOFT_BLOCKED &&
-            rfkill_default_state != RFKILL_STATE_UNBLOCKED)
-                return -EINVAL;
-
-        for (i = 0; i < RFKILL_TYPE_MAX; i++)
-                rfkill_global_states[i].default_state = rfkill_default_state;
-
-        error = class_register(&rfkill_class);
-        if (error) {
-                printk(KERN_ERR "rfkill: unable to register rfkill class\n");
-                return error;
-        }
-
-        return 0;
-}
-
-static void __exit rfkill_exit(void)
-{
-        class_unregister(&rfkill_class);
-}
-
-subsys_initcall(rfkill_init);
-module_exit(rfkill_exit);
diff --git a/net/rfkill/rfkill-input.h b/net/rfkill/rfkill.h
index fe8df6b5b935..d1117cb6e4de 100644
--- a/net/rfkill/rfkill-input.h
+++ b/net/rfkill/rfkill.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Ivo van Doorn
+ * Copyright 2009 Johannes Berg <johannes@sipsolutions.net>
  */
 
 /*
@@ -11,11 +12,16 @@
 #ifndef __RFKILL_INPUT_H
 #define __RFKILL_INPUT_H
 
-void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state);
+/* core code */
+void rfkill_switch_all(const enum rfkill_type type, bool blocked);
 void rfkill_epo(void);
 void rfkill_restore_states(void);
 void rfkill_remove_epo_lock(void);
 bool rfkill_is_epo_lock_active(void);
-enum rfkill_state rfkill_get_global_state(const enum rfkill_type type);
+bool rfkill_get_global_sw_state(const enum rfkill_type type);
+
+/* input handler */
+int rfkill_handler_init(void);
+void rfkill_handler_exit(void);
 
 #endif /* __RFKILL_INPUT_H */
diff --git a/net/wimax/Kconfig b/net/wimax/Kconfig
index 1b46747a5f5a..e4d97ab476d5 100644
--- a/net/wimax/Kconfig
+++ b/net/wimax/Kconfig
@@ -1,23 +1,10 @@
 #
 # WiMAX LAN device configuration
 #
-# Note the ugly 'depends on' on WIMAX: that disallows RFKILL to be a
-# module if WIMAX is to be linked in. The WiMAX code is done in such a
-# way that it doesn't require and explicit dependency on RFKILL in
-# case an embedded system wants to rip it out.
-#
-# As well, enablement of the RFKILL code means we need the INPUT layer
-# support to inject events coming from hw rfkill switches. That
-# dependency could be killed if input.h provided appropriate means to
-# work when input is disabled.
-
-comment "WiMAX Wireless Broadband support requires CONFIG_INPUT enabled"
-        depends on INPUT = n && RFKILL != n
 
 menuconfig WIMAX
         tristate "WiMAX Wireless Broadband support"
-        depends on (y && RFKILL != m) || m
-        depends on (INPUT && RFKILL != n) || RFKILL = n
+        depends on RFKILL || !RFKILL
         help
 
           Select to configure support for devices that provide
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index a3616e2ccb8a..bb102e4aa3e9 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -29,8 +29,8 @@
  * A non-polled generic rfkill device is embedded into the WiMAX
  * subsystem's representation of a device.
  *
- * FIXME: Need polled support? use a timer or add the implementation
- *     to the stack.
+ * FIXME: Need polled support? Let drivers provide a poll routine
+ *        and hand it to rfkill ops then?
  *
  * All device drivers have to do is after wimax_dev_init(), call
  * wimax_report_rfkill_hw() and wimax_report_rfkill_sw() to update
@@ -43,7 +43,7 @@
  *   wimax_rfkill()             Kernel calling wimax_rfkill()
  *     __wimax_rf_toggle_radio()
  *
- * wimax_rfkill_toggle_radio()  RF-Kill subsytem calling
+ * wimax_rfkill_set_radio_block()  RF-Kill subsytem calling
  *   __wimax_rf_toggle_radio()
  *
  * __wimax_rf_toggle_radio()
@@ -65,15 +65,11 @@
 #include <linux/wimax.h>
 #include <linux/security.h>
 #include <linux/rfkill.h>
-#include <linux/input.h>
 #include "wimax-internal.h"
 
 #define D_SUBMODULE op_rfkill
 #include "debug-levels.h"
 
-#if defined(CONFIG_RFKILL) || defined(CONFIG_RFKILL_MODULE)
-
-
 /**
  * wimax_report_rfkill_hw - Reports changes in the hardware RF switch
  *
@@ -99,7 +95,6 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
         int result;
         struct device *dev = wimax_dev_to_dev(wimax_dev);
         enum wimax_st wimax_state;
-        enum rfkill_state rfkill_state;
 
         d_fnstart(3, dev, "(wimax_dev %p state %u)\n", wimax_dev, state);
         BUG_ON(state == WIMAX_RF_QUERY);
@@ -112,16 +107,15 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
 
         if (state != wimax_dev->rf_hw) {
                 wimax_dev->rf_hw = state;
-                rfkill_state = state == WIMAX_RF_ON ?
-                        RFKILL_STATE_UNBLOCKED : RFKILL_STATE_SOFT_BLOCKED;
                 if (wimax_dev->rf_hw == WIMAX_RF_ON
                     && wimax_dev->rf_sw == WIMAX_RF_ON)
                         wimax_state = WIMAX_ST_READY;
                 else
                         wimax_state = WIMAX_ST_RADIO_OFF;
+
+                rfkill_set_hw_state(wimax_dev->rfkill, state == WIMAX_RF_OFF);
+
                 __wimax_state_change(wimax_dev, wimax_state);
-                input_report_key(wimax_dev->rfkill_input, KEY_WIMAX,
-                                 rfkill_state);
         }
 error_not_ready:
         mutex_unlock(&wimax_dev->mutex);
@@ -174,6 +168,7 @@ void wimax_report_rfkill_sw(struct wimax_dev *wimax_dev,
                 else
                         wimax_state = WIMAX_ST_RADIO_OFF;
                 __wimax_state_change(wimax_dev, wimax_state);
+                rfkill_set_sw_state(wimax_dev->rfkill, state == WIMAX_RF_OFF);
         }
 error_not_ready:
         mutex_unlock(&wimax_dev->mutex);
@@ -249,36 +244,31 @@ out_no_change:
  *
  * NOTE: This call will block until the operation is completed.
  */
-static
-int wimax_rfkill_toggle_radio(void *data, enum rfkill_state state)
+static int wimax_rfkill_set_radio_block(void *data, bool blocked)
 {
         int result;
         struct wimax_dev *wimax_dev = data;
         struct device *dev = wimax_dev_to_dev(wimax_dev);
         enum wimax_rf_state rf_state;
 
-        d_fnstart(3, dev, "(wimax_dev %p state %u)\n", wimax_dev, state);
-        switch (state) {
-        case RFKILL_STATE_SOFT_BLOCKED:
+        d_fnstart(3, dev, "(wimax_dev %p blocked %u)\n", wimax_dev, blocked);
+        rf_state = WIMAX_RF_ON;
+        if (blocked)
                 rf_state = WIMAX_RF_OFF;
-                break;
-        case RFKILL_STATE_UNBLOCKED:
-                rf_state = WIMAX_RF_ON;
-                break;
-        default:
-                BUG();
-        }
         mutex_lock(&wimax_dev->mutex);
         if (wimax_dev->state <= __WIMAX_ST_QUIESCING)
-                result = 0;     /* just pretend it didn't happen */
+                result = 0;
         else
                 result = __wimax_rf_toggle_radio(wimax_dev, rf_state);
         mutex_unlock(&wimax_dev->mutex);
-        d_fnend(3, dev, "(wimax_dev %p state %u) = %d\n",
-                wimax_dev, state, result);
+        d_fnend(3, dev, "(wimax_dev %p blocked %u) = %d\n",
+                wimax_dev, blocked, result);
         return result;
 }
 
+static const struct rfkill_ops wimax_rfkill_ops = {
+        .set_block = wimax_rfkill_set_radio_block,
+};
 
 /**
  * wimax_rfkill - Set the software RF switch state for a WiMAX device
@@ -322,6 +312,7 @@ int wimax_rfkill(struct wimax_dev *wimax_dev, enum wimax_rf_state state)
                 result = __wimax_rf_toggle_radio(wimax_dev, state);
                 if (result < 0)
                         goto error;
+                rfkill_set_sw_state(wimax_dev->rfkill, state == WIMAX_RF_OFF);
                 break;
         case WIMAX_RF_QUERY:
                 break;
@@ -349,40 +340,20 @@ int wimax_rfkill_add(struct wimax_dev *wimax_dev)
 {
         int result;
         struct rfkill *rfkill;
-        struct input_dev *input_dev;
         struct device *dev = wimax_dev_to_dev(wimax_dev);
 
         d_fnstart(3, dev, "(wimax_dev %p)\n", wimax_dev);
         /* Initialize RF Kill */
         result = -ENOMEM;
-        rfkill = rfkill_allocate(dev, RFKILL_TYPE_WIMAX);
+        rfkill = rfkill_alloc(wimax_dev->name, dev, RFKILL_TYPE_WIMAX,
+                              &wimax_rfkill_ops, wimax_dev);
         if (rfkill == NULL)
                 goto error_rfkill_allocate;
+
+        d_printf(1, dev, "rfkill %p\n", rfkill);
+
         wimax_dev->rfkill = rfkill;
 
-        rfkill->name = wimax_dev->name;
-        rfkill->state = RFKILL_STATE_UNBLOCKED;
-        rfkill->data = wimax_dev;
-        rfkill->toggle_radio = wimax_rfkill_toggle_radio;
-
-        /* Initialize the input device for the hw key */
-        input_dev = input_allocate_device();
-        if (input_dev == NULL)
-                goto error_input_allocate;
-        wimax_dev->rfkill_input = input_dev;
-        d_printf(1, dev, "rfkill %p input %p\n", rfkill, input_dev);
-
-        input_dev->name = wimax_dev->name;
-        /* FIXME: get a real device bus ID and stuff? do we care? */
-        input_dev->id.bustype = BUS_HOST;
-        input_dev->id.vendor = 0xffff;
-        input_dev->evbit[0] = BIT(EV_KEY);
-        set_bit(KEY_WIMAX, input_dev->keybit);
-
-        /* Register both */
-        result = input_register_device(wimax_dev->rfkill_input);
-        if (result < 0)
-                goto error_input_register;
         result = rfkill_register(wimax_dev->rfkill);
         if (result < 0)
                 goto error_rfkill_register;
@@ -394,17 +365,8 @@ int wimax_rfkill_add(struct wimax_dev *wimax_dev)
         d_fnend(3, dev, "(wimax_dev %p) = 0\n", wimax_dev);
         return 0;
 
-        /* if rfkill_register() suceeds, can't use rfkill_free() any
-         * more, only rfkill_unregister() [it owns the refcount]; with
-         * the input device we have the same issue--hence the if. */
 error_rfkill_register:
-        input_unregister_device(wimax_dev->rfkill_input);
-        wimax_dev->rfkill_input = NULL;
-error_input_register:
-        if (wimax_dev->rfkill_input)
-                input_free_device(wimax_dev->rfkill_input);
-error_input_allocate:
-        rfkill_free(wimax_dev->rfkill);
+        rfkill_destroy(wimax_dev->rfkill);
 error_rfkill_allocate:
         d_fnend(3, dev, "(wimax_dev %p) = %d\n", wimax_dev, result);
         return result;
@@ -423,45 +385,12 @@ void wimax_rfkill_rm(struct wimax_dev *wimax_dev)
 {
         struct device *dev = wimax_dev_to_dev(wimax_dev);
         d_fnstart(3, dev, "(wimax_dev %p)\n", wimax_dev);
-        rfkill_unregister(wimax_dev->rfkill);   /* frees */
-        input_unregister_device(wimax_dev->rfkill_input);
+        rfkill_unregister(wimax_dev->rfkill);
+        rfkill_destroy(wimax_dev->rfkill);
         d_fnend(3, dev, "(wimax_dev %p)\n", wimax_dev);
 }
 
 
-#else /* #ifdef CONFIG_RFKILL */
-
-void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
-                            enum wimax_rf_state state)
-{
-}
-EXPORT_SYMBOL_GPL(wimax_report_rfkill_hw);
-
-void wimax_report_rfkill_sw(struct wimax_dev *wimax_dev,
-                            enum wimax_rf_state state)
-{
-}
-EXPORT_SYMBOL_GPL(wimax_report_rfkill_sw);
-
-int wimax_rfkill(struct wimax_dev *wimax_dev,
-                 enum wimax_rf_state state)
-{
-        return WIMAX_RF_ON << 1 | WIMAX_RF_ON;
-}
-EXPORT_SYMBOL_GPL(wimax_rfkill);
-
-int wimax_rfkill_add(struct wimax_dev *wimax_dev)
-{
-        return 0;
-}
-
-void wimax_rfkill_rm(struct wimax_dev *wimax_dev)
-{
-}
-
-#endif /* #ifdef CONFIG_RFKILL */
-
-
 /*
  * Exporting to user space over generic netlink
  *
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index 45005497c634..4428dd5e911d 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -1,5 +1,6 @@
 config CFG80211
-        tristate "Improved wireless configuration API"
+        tristate "Improved wireless configuration API"
+        depends on RFKILL || !RFKILL
 
 config CFG80211_REG_DEBUG
         bool "cfg80211 regulatory debugging"
diff --git a/net/wireless/core.c b/net/wireless/core.c
index a5dbea1da476..3b74b88e10a3 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -12,6 +12,7 @@
 #include <linux/debugfs.h>
 #include <linux/notifier.h>
 #include <linux/device.h>
+#include <linux/rtnetlink.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "nl80211.h"
@@ -227,6 +228,41 @@ int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
+static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
+{
+        struct cfg80211_registered_device *drv = data;
+
+        drv->ops->rfkill_poll(&drv->wiphy);
+}
+
+static int cfg80211_rfkill_set_block(void *data, bool blocked)
+{
+        struct cfg80211_registered_device *drv = data;
+        struct wireless_dev *wdev;
+
+        if (!blocked)
+                return 0;
+
+        rtnl_lock();
+        mutex_lock(&drv->devlist_mtx);
+
+        list_for_each_entry(wdev, &drv->netdev_list, list)
+                dev_close(wdev->netdev);
+
+        mutex_unlock(&drv->devlist_mtx);
+        rtnl_unlock();
+
+        return 0;
+}
+
+static void cfg80211_rfkill_sync_work(struct work_struct *work)
+{
+        struct cfg80211_registered_device *drv;
+
+        drv = container_of(work, struct cfg80211_registered_device, rfkill_sync);
+        cfg80211_rfkill_set_block(drv, rfkill_blocked(drv->rfkill));
+}
+
 /* exported functions */
 
 struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
@@ -274,6 +310,18 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         drv->wiphy.dev.class = &ieee80211_class;
         drv->wiphy.dev.platform_data = drv;
 
+        drv->rfkill_ops.set_block = cfg80211_rfkill_set_block;
+        drv->rfkill = rfkill_alloc(dev_name(&drv->wiphy.dev),
+                                   &drv->wiphy.dev, RFKILL_TYPE_WLAN,
+                                   &drv->rfkill_ops, drv);
+
+        if (!drv->rfkill) {
+                kfree(drv);
+                return NULL;
+        }
+
+        INIT_WORK(&drv->rfkill_sync, cfg80211_rfkill_sync_work);
+
         /*
          * Initialize wiphy parameters to IEEE 802.11 MIB default values.
          * Fragmentation and RTS threshold are disabled by default with the
@@ -356,6 +404,10 @@ int wiphy_register(struct wiphy *wiphy)
         if (res)
                 goto out_unlock;
 
+        res = rfkill_register(drv->rfkill);
+        if (res)
+                goto out_rm_dev;
+
         list_add(&drv->list, &cfg80211_drv_list);
 
         /* add to debugfs */
@@ -379,16 +431,41 @@ int wiphy_register(struct wiphy *wiphy)
         cfg80211_debugfs_drv_add(drv);
 
         res = 0;
-out_unlock:
+        goto out_unlock;
+
+ out_rm_dev:
+        device_del(&drv->wiphy.dev);
+ out_unlock:
         mutex_unlock(&cfg80211_mutex);
         return res;
 }
 EXPORT_SYMBOL(wiphy_register);
 
+void wiphy_rfkill_start_polling(struct wiphy *wiphy)
+{
+        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+
+        if (!drv->ops->rfkill_poll)
+                return;
+        drv->rfkill_ops.poll = cfg80211_rfkill_poll;
+        rfkill_resume_polling(drv->rfkill);
+}
+EXPORT_SYMBOL(wiphy_rfkill_start_polling);
+
+void wiphy_rfkill_stop_polling(struct wiphy *wiphy)
+{
+        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+
+        rfkill_pause_polling(drv->rfkill);
+}
+EXPORT_SYMBOL(wiphy_rfkill_stop_polling);
+
 void wiphy_unregister(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
 
+        rfkill_unregister(drv->rfkill);
+
         /* protect the device list */
         mutex_lock(&cfg80211_mutex);
 
@@ -425,6 +502,7 @@ EXPORT_SYMBOL(wiphy_unregister);
 void cfg80211_dev_free(struct cfg80211_registered_device *drv)
 {
         struct cfg80211_internal_bss *scan, *tmp;
+        rfkill_destroy(drv->rfkill);
         mutex_destroy(&drv->mtx);
         mutex_destroy(&drv->devlist_mtx);
         list_for_each_entry_safe(scan, tmp, &drv->bss_list, list)
@@ -438,6 +516,15 @@ void wiphy_free(struct wiphy *wiphy)
 }
 EXPORT_SYMBOL(wiphy_free);
 
+void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
+{
+        struct cfg80211_registered_device *drv = wiphy_to_dev(wiphy);
+
+        if (rfkill_set_hw_state(drv->rfkill, blocked))
+                schedule_work(&drv->rfkill_sync);
+}
+EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
+
 static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                                          unsigned long state,
                                          void *ndev)
@@ -446,7 +533,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
         struct cfg80211_registered_device *rdev;
 
         if (!dev->ieee80211_ptr)
-                return 0;
+                return NOTIFY_DONE;
 
         rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
 
@@ -492,9 +579,13 @@ static int cfg80211_netdev_notifier_call(struct notifier_block * nb,
                 }
                 mutex_unlock(&rdev->devlist_mtx);
                 break;
+        case NETDEV_PRE_UP:
+                if (rfkill_blocked(rdev->rfkill))
+                        return notifier_from_errno(-ERFKILL);
+                break;
         }
 
-        return 0;
+        return NOTIFY_DONE;
 }
 
 static struct notifier_block cfg80211_netdev_notifier = {
diff --git a/net/wireless/core.h b/net/wireless/core.h
index ab512bcd8153..bfa340c7abb5 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -11,6 +11,8 @@
 #include <linux/kref.h>
 #include <linux/rbtree.h>
 #include <linux/debugfs.h>
+#include <linux/rfkill.h>
+#include <linux/workqueue.h>
 #include <net/genetlink.h>
 #include <net/cfg80211.h>
 #include "reg.h"
@@ -24,6 +26,11 @@ struct cfg80211_registered_device {
          * any call is in progress */
         struct mutex mtx;
 
+        /* rfkill support */
+        struct rfkill_ops rfkill_ops;
+        struct rfkill *rfkill;
+        struct work_struct rfkill_sync;
+
         /* ISO / IEC 3166 alpha2 for which this device is receiving
          * country IEs on, this can help disregard country IEs from APs
          * on the same alpha2 quickly. The alpha2 may differ from
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4b4d3c8a1aed..24168560ebae 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1687,6 +1687,12 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         if (err)
                 goto out_rtnl;
 
+        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN) {
+                err = -EINVAL;
+                goto out;
+        }
+
         err = get_vlan(info->attrs[NL80211_ATTR_STA_VLAN], drv, &params.vlan);
         if (err)
                 goto out;
@@ -1738,7 +1744,11 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
+
         params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (!params.aid || params.aid > IEEE80211_MAX_AID)
+                return -EINVAL;
+
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params.ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
@@ -3559,11 +3569,43 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
         genlmsg_multicast(msg, 0, nl80211_config_mcgrp.id, GFP_KERNEL);
 }
 
+static int nl80211_add_scan_req(struct sk_buff *msg,
+                                struct cfg80211_registered_device *rdev)
+{
+        struct cfg80211_scan_request *req = rdev->scan_req;
+        struct nlattr *nest;
+        int i;
+
+        if (WARN_ON(!req))
+                return 0;
+
+        nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
+        if (!nest)
+                goto nla_put_failure;
+        for (i = 0; i < req->n_ssids; i++)
+                NLA_PUT(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid);
+        nla_nest_end(msg, nest);
+
+        nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
+        if (!nest)
+                goto nla_put_failure;
+        for (i = 0; i < req->n_channels; i++)
+                NLA_PUT_U32(msg, i, req->channels[i]->center_freq);
+        nla_nest_end(msg, nest);
+
+        if (req->ie)
+                NLA_PUT(msg, NL80211_ATTR_IE, req->ie_len, req->ie);
+
+        return 0;
+ nla_put_failure:
+        return -ENOBUFS;
+}
+
 static int nl80211_send_scan_donemsg(struct sk_buff *msg,
-                                    struct cfg80211_registered_device *rdev,
-                                    struct net_device *netdev,
-                                    u32 pid, u32 seq, int flags,
-                                    u32 cmd)
+                                     struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev,
+                                     u32 pid, u32 seq, int flags,
+                                     u32 cmd)
 {
         void *hdr;
 
@@ -3574,7 +3616,8 @@ static int nl80211_send_scan_donemsg(struct sk_buff *msg,
         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
 
-        /* XXX: we should probably bounce back the request? */
+        /* ignore errors and send incomplete event anyway */
+        nl80211_add_scan_req(msg, rdev);
 
         return genlmsg_end(msg, hdr);
 
@@ -3828,7 +3871,7 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
         struct sk_buff *msg;
         void *hdr;
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
         if (!msg)
                 return;
 
@@ -3852,7 +3895,7 @@ void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                 return;
         }
 
-        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_KERNEL);
+        genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, GFP_ATOMIC);
         return;
 
  nla_put_failure:
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index f87ac1df2df5..ea4c299fbe3b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -2171,7 +2171,13 @@ static int __set_regdom(const struct ieee80211_regdomain *rd)
          * the country IE rd with what CRDA believes that country should have
          */
 
-        BUG_ON(!country_ie_regdomain);
+        /*
+         * Userspace could have sent two replies with only
+         * one kernel request. By the second reply we would have
+         * already processed and consumed the country_ie_regdomain.
+         */
+        if (!country_ie_regdomain)
+                return -EALREADY;
         BUG_ON(rd == country_ie_regdomain);
 
         /*
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index df59440290e5..e95b638b919f 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -29,13 +29,14 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
                 goto out;
 
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
-        wiphy_to_dev(request->wiphy)->scan_req = NULL;
 
         if (aborted)
                 nl80211_send_scan_aborted(wiphy_to_dev(request->wiphy), dev);
         else
                 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
 
+        wiphy_to_dev(request->wiphy)->scan_req = NULL;
+
 #ifdef CONFIG_WIRELESS_EXT
         if (!aborted) {
                 memset(&wrqu, 0, sizeof(wrqu));
diff --git a/net/wireless/util.c b/net/wireless/util.c
index d072bff463aa..25550692dda6 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -157,26 +157,25 @@ int cfg80211_validate_key_settings(struct key_params *params, int key_idx,
             params->cipher != WLAN_CIPHER_SUITE_WEP104)
                 return -EINVAL;
 
-        /* TODO: add definitions for the lengths to linux/ieee80211.h */
         switch (params->cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
-                if (params->key_len != 5)
+                if (params->key_len != WLAN_KEY_LEN_WEP40)
                         return -EINVAL;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
-                if (params->key_len != 32)
+                if (params->key_len != WLAN_KEY_LEN_TKIP)
                         return -EINVAL;
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                if (params->key_len != 16)
+                if (params->key_len != WLAN_KEY_LEN_CCMP)
                         return -EINVAL;
                 break;
         case WLAN_CIPHER_SUITE_WEP104:
-                if (params->key_len != 13)
+                if (params->key_len != WLAN_KEY_LEN_WEP104)
                         return -EINVAL;
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
-                if (params->key_len != 16)
+                if (params->key_len != WLAN_KEY_LEN_AES_CMAC)
                         return -EINVAL;
                 break;
         default:
@@ -259,7 +258,7 @@ unsigned int ieee80211_get_hdrlen_from_skb(const struct sk_buff *skb)
 }
 EXPORT_SYMBOL(ieee80211_get_hdrlen_from_skb);
 
-int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
+static int ieee80211_get_mesh_hdrlen(struct ieee80211s_hdr *meshhdr)
 {
         int ae = meshhdr->flags & MESH_FLAGS_AE;
         /* 7.1.3.5a.2 */
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index 711e00a0c9b5..d030c5315672 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -744,3 +744,86 @@ int cfg80211_wext_giwencode(struct net_device *dev,
         return err;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwencode);
+
+int cfg80211_wext_siwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        enum tx_power_setting type;
+        int dbm = 0;
+
+        if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
+                return -EINVAL;
+        if (data->txpower.flags & IW_TXPOW_RANGE)
+                return -EINVAL;
+
+        if (!rdev->ops->set_tx_power)
+                return -EOPNOTSUPP;
+
+        /* only change when not disabling */
+        if (!data->txpower.disabled) {
+                rfkill_set_sw_state(rdev->rfkill, false);
+
+                if (data->txpower.fixed) {
+                        /*
+                         * wext doesn't support negative values, see
+                         * below where it's for automatic
+                         */
+                        if (data->txpower.value < 0)
+                                return -EINVAL;
+                        dbm = data->txpower.value;
+                        type = TX_POWER_FIXED;
+                        /* TODO: do regulatory check! */
+                } else {
+                        /*
+                         * Automatic power level setting, max being the value
+                         * passed in from userland.
+                         */
+                        if (data->txpower.value < 0) {
+                                type = TX_POWER_AUTOMATIC;
+                        } else {
+                                dbm = data->txpower.value;
+                                type = TX_POWER_LIMITED;
+                        }
+                }
+        } else {
+                rfkill_set_sw_state(rdev->rfkill, true);
+                schedule_work(&rdev->rfkill_sync);
+                return 0;
+        }
+
+        return rdev->ops->set_tx_power(wdev->wiphy, type, dbm);;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_siwtxpower);
+
+int cfg80211_wext_giwtxpower(struct net_device *dev,
+                             struct iw_request_info *info,
+                             union iwreq_data *data, char *extra)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
+        int err, val;
+
+        if ((data->txpower.flags & IW_TXPOW_TYPE) != IW_TXPOW_DBM)
+                return -EINVAL;
+        if (data->txpower.flags & IW_TXPOW_RANGE)
+                return -EINVAL;
+
+        if (!rdev->ops->get_tx_power)
+                return -EOPNOTSUPP;
+
+        err = rdev->ops->get_tx_power(wdev->wiphy, &val);
+        if (err)
+                return err;
+
+        /* well... oh well */
+        data->txpower.fixed = 1;
+        data->txpower.disabled = rfkill_blocked(rdev->rfkill);
+        data->txpower.value = val;
+        data->txpower.flags = IW_TXPOW_DBM;
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfg80211_wext_giwtxpower);