Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

Conflicts:
	drivers/net/wireless/ath/ath9k/debug.c
	net/mac80211/iface.c

206 files changed, 19923 insertions, 3391 deletions

diff --git a/Documentation/DocBook/80211.tmpl b/Documentation/DocBook/80211.tmpl
index 0f6a3edcd44b..ebe89694cf81 100644
--- a/Documentation/DocBook/80211.tmpl
+++ b/Documentation/DocBook/80211.tmpl
@@ -132,9 +132,7 @@
 !Finclude/net/cfg80211.h cfg80211_send_rx_assoc
 !Finclude/net/cfg80211.h cfg80211_send_assoc_timeout
 !Finclude/net/cfg80211.h cfg80211_send_deauth
-!Finclude/net/cfg80211.h __cfg80211_send_deauth
 !Finclude/net/cfg80211.h cfg80211_send_disassoc
-!Finclude/net/cfg80211.h __cfg80211_send_disassoc
 !Finclude/net/cfg80211.h cfg80211_ibss_joined
 !Finclude/net/cfg80211.h cfg80211_connect_result
 !Finclude/net/cfg80211.h cfg80211_roamed
diff --git a/MAINTAINERS b/MAINTAINERS
index f35a259a6564..0518ec49467b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2299,6 +2299,11 @@ M:	Jaya Kumar <jayakumar.alsa@gmail.com>
 S:      Maintained
 F:      sound/pci/cs5535audio/
 
+CW1200 WLAN driver
+M:     Solomon Peachy <pizza@shaftnet.org>
+S:     Maintained
+F:     drivers/net/wireless/cw1200/
+
 CX18 VIDEO4LINUX DRIVER
 M:      Andy Walls <awalls@md.metrocast.net>
 L:      ivtv-devel@ivtvdriver.org (moderated for non-subscribers)
diff --git a/drivers/bcma/sprom.c b/drivers/bcma/sprom.c
index 8934298a638d..de15b4f4b237 100644
--- a/drivers/bcma/sprom.c
+++ b/drivers/bcma/sprom.c
@@ -72,12 +72,12 @@ fail:
  * R/W ops.
  **************************************************/
 
-static void bcma_sprom_read(struct bcma_bus *bus, u16 offset, u16 *sprom)
+static void bcma_sprom_read(struct bcma_bus *bus, u16 offset, u16 *sprom,
+                            size_t words)
 {
         int i;
-        for (i = 0; i < SSB_SPROMSIZE_WORDS_R4; i++)
-                sprom[i] = bcma_read16(bus->drv_cc.core,
-                                       offset + (i * 2));
+        for (i = 0; i < words; i++)
+                sprom[i] = bcma_read16(bus->drv_cc.core, offset + (i * 2));
 }
 
 /**************************************************
@@ -124,29 +124,29 @@ static inline u8 bcma_crc8(u8 crc, u8 data)
         return t[crc ^ data];
 }
 
-static u8 bcma_sprom_crc(const u16 *sprom)
+static u8 bcma_sprom_crc(const u16 *sprom, size_t words)
 {
         int word;
         u8 crc = 0xFF;
 
-        for (word = 0; word < SSB_SPROMSIZE_WORDS_R4 - 1; word++) {
+        for (word = 0; word < words - 1; word++) {
                 crc = bcma_crc8(crc, sprom[word] & 0x00FF);
                 crc = bcma_crc8(crc, (sprom[word] & 0xFF00) >> 8);
         }
-        crc = bcma_crc8(crc, sprom[SSB_SPROMSIZE_WORDS_R4 - 1] & 0x00FF);
+        crc = bcma_crc8(crc, sprom[words - 1] & 0x00FF);
         crc ^= 0xFF;
 
         return crc;
 }
 
-static int bcma_sprom_check_crc(const u16 *sprom)
+static int bcma_sprom_check_crc(const u16 *sprom, size_t words)
 {
         u8 crc;
         u8 expected_crc;
         u16 tmp;
 
-        crc = bcma_sprom_crc(sprom);
-        tmp = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] & SSB_SPROM_REVISION_CRC;
+        crc = bcma_sprom_crc(sprom, words);
+        tmp = sprom[words - 1] & SSB_SPROM_REVISION_CRC;
         expected_crc = tmp >> SSB_SPROM_REVISION_CRC_SHIFT;
         if (crc != expected_crc)
                 return -EPROTO;
@@ -154,21 +154,25 @@ static int bcma_sprom_check_crc(const u16 *sprom)
         return 0;
 }
 
-static int bcma_sprom_valid(const u16 *sprom)
+static int bcma_sprom_valid(struct bcma_bus *bus, const u16 *sprom,
+                            size_t words)
 {
         u16 revision;
         int err;
 
-        err = bcma_sprom_check_crc(sprom);
+        err = bcma_sprom_check_crc(sprom, words);
         if (err)
                 return err;
 
-        revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] & SSB_SPROM_REVISION_REV;
-        if (revision != 8 && revision != 9) {
+        revision = sprom[words - 1] & SSB_SPROM_REVISION_REV;
+        if (revision != 8 && revision != 9 && revision != 10) {
                 pr_err("Unsupported SPROM revision: %d\n", revision);
                 return -ENOENT;
         }
 
+        bus->sprom.revision = revision;
+        bcma_debug(bus, "Found SPROM revision %d\n", revision);
+
         return 0;
 }
 
@@ -208,9 +212,6 @@ static void bcma_sprom_extract_r8(struct bcma_bus *bus, const u16 *sprom)
         BUILD_BUG_ON(ARRAY_SIZE(pwr_info_offset) !=
                         ARRAY_SIZE(bus->sprom.core_pwr_info));
 
-        bus->sprom.revision = sprom[SSB_SPROMSIZE_WORDS_R4 - 1] &
-                SSB_SPROM_REVISION_REV;
-
         for (i = 0; i < 3; i++) {
                 v = sprom[SPOFF(SSB_SPROM8_IL0MAC) + i];
                 *(((__be16 *)bus->sprom.il0mac) + i) = cpu_to_be16(v);
@@ -502,7 +503,6 @@ static bool bcma_sprom_onchip_available(struct bcma_bus *bus)
         case BCMA_CHIP_ID_BCM4331:
                 present = chip_status & BCMA_CC_CHIPST_4331_OTP_PRESENT;
                 break;
-
         case BCMA_CHIP_ID_BCM43224:
         case BCMA_CHIP_ID_BCM43225:
                 /* for these chips OTP is always available */
@@ -550,7 +550,9 @@ int bcma_sprom_get(struct bcma_bus *bus)
 {
         u16 offset = BCMA_CC_SPROM;
         u16 *sprom;
-        int err = 0;
+        size_t sprom_sizes[] = { SSB_SPROMSIZE_WORDS_R4,
+                                 SSB_SPROMSIZE_WORDS_R10, };
+        int i, err = 0;
 
         if (!bus->drv_cc.core)
                 return -EOPNOTSUPP;
@@ -579,32 +581,37 @@ int bcma_sprom_get(struct bcma_bus *bus)
                 }
         }
 
-        sprom = kcalloc(SSB_SPROMSIZE_WORDS_R4, sizeof(u16),
-                        GFP_KERNEL);
-        if (!sprom)
-                return -ENOMEM;
-
         if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
             bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, false);
 
         bcma_debug(bus, "SPROM offset 0x%x\n", offset);
-        bcma_sprom_read(bus, offset, sprom);
+        for (i = 0; i < ARRAY_SIZE(sprom_sizes); i++) {
+                size_t words = sprom_sizes[i];
+
+                sprom = kcalloc(words, sizeof(u16), GFP_KERNEL);
+                if (!sprom)
+                        return -ENOMEM;
+
+                bcma_sprom_read(bus, offset, sprom, words);
+                err = bcma_sprom_valid(bus, sprom, words);
+                if (!err)
+                        break;
+
+                kfree(sprom);
+        }
 
         if (bus->chipinfo.id == BCMA_CHIP_ID_BCM4331 ||
             bus->chipinfo.id == BCMA_CHIP_ID_BCM43431)
                 bcma_chipco_bcm4331_ext_pa_lines_ctl(&bus->drv_cc, true);
 
-        err = bcma_sprom_valid(sprom);
         if (err) {
-                bcma_warn(bus, "invalid sprom read from the PCIe card, try to use fallback sprom\n");
+                bcma_warn(bus, "Invalid SPROM read from the PCIe card, trying to use fallback SPROM\n");
                 err = bcma_fill_sprom_with_fallback(bus, &bus->sprom);
-                goto out;
+        } else {
+                bcma_sprom_extract_r8(bus, sprom);
+                kfree(sprom);
         }
 
-        bcma_sprom_extract_r8(bus, sprom);
-
-out:
-        kfree(sprom);
         return err;
 }
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index f8f0156dff4e..200020eb3005 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -280,5 +280,6 @@ source "drivers/net/wireless/rtlwifi/Kconfig"
 source "drivers/net/wireless/ti/Kconfig"
 source "drivers/net/wireless/zd1211rw/Kconfig"
 source "drivers/net/wireless/mwifiex/Kconfig"
+source "drivers/net/wireless/cw1200/Kconfig"
 
 endif # WLAN
diff --git a/drivers/net/wireless/Makefile b/drivers/net/wireless/Makefile
index 67156efe14c4..0fab227025be 100644
--- a/drivers/net/wireless/Makefile
+++ b/drivers/net/wireless/Makefile
@@ -57,3 +57,5 @@ obj-$(CONFIG_MWIFIEX)	+= mwifiex/
 
 obj-$(CONFIG_BRCMFMAC)  += brcm80211/
 obj-$(CONFIG_BRCMSMAC)  += brcm80211/
+
+obj-$(CONFIG_CW1200)    += cw1200/
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index f3dc124c60c7..3b078515b422 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -84,14 +84,6 @@ config ATH9K_DFS_CERTIFIED
           developed. At this point enabling this option won't do anything
           except increase code size.
 
-config ATH9K_MAC_DEBUG
-        bool "Atheros MAC statistics"
-        depends on ATH9K_DEBUGFS
-        default y
-        ---help---
-          This option enables collection of statistics for Rx/Tx status
-          data and some other MAC related statistics
-
 config ATH9K_RATE_CONTROL
         bool "Atheros ath9k rate control"
         depends on ATH9K
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index 7ecd40f07a74..e91725bf401c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -118,10 +118,10 @@ static void ath9k_ani_restart(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
-        if (!DO_ANI(ah))
+        if (!ah->curchan)
                 return;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
         aniState->listenTime = 0;
 
         ENABLE_REGWRITE_BUFFER(ah);
@@ -143,7 +143,7 @@ static void ath9k_ani_restart(struct ath_hw *ah)
 static void ath9k_hw_set_ofdm_nil(struct ath_hw *ah, u8 immunityLevel,
                                   bool scan)
 {
-        struct ar5416AniState *aniState = &ah->curchan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         struct ath_common *common = ath9k_hw_common(ah);
         const struct ani_ofdm_level_entry *entry_ofdm;
         const struct ani_cck_level_entry *entry_cck;
@@ -195,10 +195,10 @@ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
-        if (!DO_ANI(ah))
+        if (!ah->curchan)
                 return;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
 
         if (aniState->ofdmNoiseImmunityLevel < ATH9K_ANI_OFDM_MAX_LEVEL)
                 ath9k_hw_set_ofdm_nil(ah, aniState->ofdmNoiseImmunityLevel + 1, false);
@@ -210,7 +210,7 @@ static void ath9k_hw_ani_ofdm_err_trigger(struct ath_hw *ah)
 static void ath9k_hw_set_cck_nil(struct ath_hw *ah, u_int8_t immunityLevel,
                                  bool scan)
 {
-        struct ar5416AniState *aniState = &ah->curchan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         struct ath_common *common = ath9k_hw_common(ah);
         const struct ani_ofdm_level_entry *entry_ofdm;
         const struct ani_cck_level_entry *entry_cck;
@@ -251,10 +251,10 @@ static void ath9k_hw_ani_cck_err_trigger(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
-        if (!DO_ANI(ah))
+        if (!ah->curchan)
                 return;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
 
         if (aniState->cckNoiseImmunityLevel < ATH9K_ANI_CCK_MAX_LEVEL)
                 ath9k_hw_set_cck_nil(ah, aniState->cckNoiseImmunityLevel + 1,
@@ -269,7 +269,7 @@ static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
 {
         struct ar5416AniState *aniState;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
 
         /* lower OFDM noise immunity */
         if (aniState->ofdmNoiseImmunityLevel > 0 &&
@@ -292,12 +292,12 @@ static void ath9k_hw_ani_lower_immunity(struct ath_hw *ah)
  */
 void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
 {
-        struct ar5416AniState *aniState = &ah->curchan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         struct ath9k_channel *chan = ah->curchan;
         struct ath_common *common = ath9k_hw_common(ah);
         int ofdm_nil, cck_nil;
 
-        if (!DO_ANI(ah))
+        if (!ah->curchan)
                 return;
 
         BUG_ON(aniState == NULL);
@@ -380,7 +380,7 @@ void ath9k_ani_reset(struct ath_hw *ah, bool is_scanning)
 static bool ath9k_hw_ani_read_counters(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ar5416AniState *aniState = &ah->curchan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         u32 phyCnt1, phyCnt2;
         int32_t listenTime;
 
@@ -415,10 +415,10 @@ void ath9k_hw_ani_monitor(struct ath_hw *ah, struct ath9k_channel *chan)
         struct ath_common *common = ath9k_hw_common(ah);
         u32 ofdmPhyErrRate, cckPhyErrRate;
 
-        if (!DO_ANI(ah))
+        if (!ah->curchan)
                 return;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
         if (!ath9k_hw_ani_read_counters(ah))
                 return;
 
@@ -490,32 +490,22 @@ EXPORT_SYMBOL(ath9k_hw_disable_mib_counters);
 void ath9k_hw_ani_init(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
-        int i;
+        struct ar5416AniState *ani = &ah->ani;
 
         ath_dbg(common, ANI, "Initialize ANI\n");
 
         ah->config.ofdm_trig_high = ATH9K_ANI_OFDM_TRIG_HIGH;
         ah->config.ofdm_trig_low = ATH9K_ANI_OFDM_TRIG_LOW;
-
         ah->config.cck_trig_high = ATH9K_ANI_CCK_TRIG_HIGH;
         ah->config.cck_trig_low = ATH9K_ANI_CCK_TRIG_LOW;
 
-        for (i = 0; i < ARRAY_SIZE(ah->channels); i++) {
-                struct ath9k_channel *chan = &ah->channels[i];
-                struct ar5416AniState *ani = &chan->ani;
-
-                ani->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
-
-                ani->firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
-
-                ani->mrcCCK = AR_SREV_9300_20_OR_LATER(ah) ? true : false;
-
-                ani->ofdmsTurn = true;
-
-                ani->ofdmWeakSigDetect = ATH9K_ANI_USE_OFDM_WEAK_SIG;
-                ani->cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
-                ani->ofdmNoiseImmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
-        }
+        ani->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
+        ani->firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
+        ani->mrcCCK = AR_SREV_9300_20_OR_LATER(ah) ? true : false;
+        ani->ofdmsTurn = true;
+        ani->ofdmWeakSigDetect = true;
+        ani->cckNoiseImmunityLevel = ATH9K_ANI_CCK_DEF_LEVEL;
+        ani->ofdmNoiseImmunityLevel = ATH9K_ANI_OFDM_DEF_LEVEL;
 
         /*
          * since we expect some ongoing maintenance on the tables, let's sanity
@@ -524,9 +514,6 @@ void ath9k_hw_ani_init(struct ath_hw *ah)
         ah->aniperiod = ATH9K_ANI_PERIOD;
         ah->config.ani_poll_interval = ATH9K_ANI_POLLINTERVAL;
 
-        if (ah->config.enable_ani)
-                ah->proc_phyerr |= HAL_PROCESS_ANI;
-
         ath9k_ani_restart(ah);
         ath9k_enable_mib_counters(ah);
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.h b/drivers/net/wireless/ath/ath9k/ani.h
index dddb1361039a..78b9fa9f6455 100644
--- a/drivers/net/wireless/ath/ath9k/ani.h
+++ b/drivers/net/wireless/ath/ath9k/ani.h
@@ -17,10 +17,6 @@
 #ifndef ANI_H
 #define ANI_H
 
-#define HAL_PROCESS_ANI           0x00000001
-
-#define DO_ANI(ah) (((ah)->proc_phyerr & HAL_PROCESS_ANI) && ah->curchan)
-
 #define BEACON_RSSI(ahp) (ahp->stats.avgbrssi)
 
 /* units are errors per second */
@@ -38,11 +34,7 @@
 #define ATH9K_ANI_CCK_TRIG_LOW            300
 
 #define ATH9K_ANI_NOISE_IMMUNE_LVL        4
-#define ATH9K_ANI_USE_OFDM_WEAK_SIG       true
-#define ATH9K_ANI_CCK_WEAK_SIG_THR        false
-
 #define ATH9K_ANI_SPUR_IMMUNE_LVL         3
-
 #define ATH9K_ANI_FIRSTEP_LVL             2
 
 #define ATH9K_ANI_RSSI_THR_HIGH           40
@@ -111,7 +103,7 @@ struct ar5416AniState {
         u8 mrcCCK;
         u8 spurImmunityLevel;
         u8 firstepLevel;
-        u8 ofdmWeakSigDetect;
+        bool ofdmWeakSigDetect;
         u32 listenTime;
         u32 ofdmPhyErrCount;
         u32 cckPhyErrCount;
@@ -119,8 +111,6 @@ struct ar5416AniState {
 };
 
 struct ar5416Stats {
-        u32 ast_ani_niup;
-        u32 ast_ani_nidown;
         u32 ast_ani_spurup;
         u32 ast_ani_spurdown;
         u32 ast_ani_ofdmon;
diff --git a/drivers/net/wireless/ath/ath9k/ar5008_phy.c b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
index 391da5ad6a99..d1acfe98918a 100644
--- a/drivers/net/wireless/ath/ath9k/ar5008_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar5008_phy.c
@@ -931,7 +931,7 @@ static bool ar5008_hw_ani_control_new(struct ath_hw *ah,
 {
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
-        struct ar5416AniState *aniState = &chan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         s32 value, value2;
 
         switch (cmd & ah->ani_function) {
@@ -1207,7 +1207,7 @@ static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
-        struct ar5416AniState *aniState = &chan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         struct ath9k_ani_default *iniDef;
         u32 val;
 
@@ -1251,7 +1251,7 @@ static void ar5008_hw_ani_cache_ini_regs(struct ath_hw *ah)
         /* these levels just got reset to defaults by the INI */
         aniState->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
         aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
-        aniState->ofdmWeakSigDetect = ATH9K_ANI_USE_OFDM_WEAK_SIG;
+        aniState->ofdmWeakSigDetect = true;
         aniState->mrcCCK = false; /* not available on pre AR9003 */
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 830daa12feb6..8dc2d089cdef 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -38,10 +38,6 @@ static int ar9002_hw_init_mode_regs(struct ath_hw *ah)
         else
                 INIT_INI_ARRAY(&ah->iniPcieSerdes,
                            ar9280PciePhy_clkreq_always_on_L1_9280);
-#ifdef CONFIG_PM_SLEEP
-                INIT_INI_ARRAY(&ah->iniPcieSerdesWow,
-                               ar9280PciePhy_awow);
-#endif
 
         if (AR_SREV_9287_11_OR_LATER(ah)) {
                 INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_1);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_initvals.h b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
index beb6162cf97c..4d18c66a6790 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9002_initvals.h
@@ -925,20 +925,6 @@ static const u32 ar9280PciePhy_clkreq_always_on_L1_9280[][2] = {
         {0x00004044, 0x00000000},
 };
 
-static const u32 ar9280PciePhy_awow[][2] = {
-        /* Addr      allmodes  */
-        {0x00004040, 0x9248fd00},
-        {0x00004040, 0x24924924},
-        {0x00004040, 0xa8000019},
-        {0x00004040, 0x13160820},
-        {0x00004040, 0xe5980560},
-        {0x00004040, 0xc01dcffd},
-        {0x00004040, 0x1aaabe41},
-        {0x00004040, 0xbe105554},
-        {0x00004040, 0x00043007},
-        {0x00004044, 0x00000000},
-};
-
 static const u32 ar9285Modes_9285_1_2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index 301bf72c53bf..5163abd3937c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -469,6 +469,7 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
 
         rxs->rs_status = 0;
         rxs->rs_flags =  0;
+        rxs->flag =  0;
 
         rxs->rs_datalen = rxsp->status2 & AR_DataLen;
         rxs->rs_tstamp =  rxsp->status3;
@@ -493,8 +494,8 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
         rxs->rs_isaggr = (rxsp->status11 & AR_RxAggr) ? 1 : 0;
         rxs->rs_moreaggr = (rxsp->status11 & AR_RxMoreAggr) ? 1 : 0;
         rxs->rs_antenna = (MS(rxsp->status4, AR_RxAntenna) & 0x7);
-        rxs->rs_flags  = (rxsp->status4 & AR_GI) ? ATH9K_RX_GI : 0;
-        rxs->rs_flags  |= (rxsp->status4 & AR_2040) ? ATH9K_RX_2040 : 0;
+        rxs->flag  |= (rxsp->status4 & AR_GI) ? RX_FLAG_SHORT_GI : 0;
+        rxs->flag  |= (rxsp->status4 & AR_2040) ? RX_FLAG_40MHZ : 0;
 
         rxs->evm0 = rxsp->status6;
         rxs->evm1 = rxsp->status7;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
index 09c1f9da67a0..6343cc91953e 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
@@ -454,6 +454,8 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
                 if (accum_cnt <= thresh_accum_cnt)
                         continue;
 
+                max_index++;
+
                 /* sum(tx amplitude) */
                 accum_tx = ((data_L[i] >> 16) & 0xffff) |
                     ((data_U[i] & 0x7ff) << 16);
@@ -468,20 +470,21 @@ static bool create_pa_curve(u32 *data_L, u32 *data_U, u32 *pa_table, u16 *gain)
 
                 accum_tx <<= scale_factor;
                 accum_rx <<= scale_factor;
-                x_est[i + 1] = (((accum_tx + accum_cnt) / accum_cnt) + 32) >>
-                    scale_factor;
+                x_est[max_index] =
+                        (((accum_tx + accum_cnt) / accum_cnt) + 32) >>
+                        scale_factor;
 
-                Y[i + 1] = ((((accum_rx + accum_cnt) / accum_cnt) + 32) >>
+                Y[max_index] =
+                        ((((accum_rx + accum_cnt) / accum_cnt) + 32) >>
                             scale_factor) +
-                            (1 << scale_factor) * max_index + 16;
+                        (1 << scale_factor) * i + 16;
 
                 if (accum_ang >= (1 << 26))
                         accum_ang -= 1 << 27;
 
-                theta[i + 1] = ((accum_ang * (1 << scale_factor)) + accum_cnt) /
-                    accum_cnt;
-
-                max_index++;
+                theta[max_index] =
+                        ((accum_ang * (1 << scale_factor)) + accum_cnt) /
+                        accum_cnt;
         }
 
         /*
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index e1714d7c9eeb..83e03857c014 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -905,7 +905,7 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
 {
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_channel *chan = ah->curchan;
-        struct ar5416AniState *aniState = &chan->ani;
+        struct ar5416AniState *aniState = &ah->ani;
         s32 value, value2;
 
         switch (cmd & ah->ani_function) {
@@ -1173,7 +1173,7 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         struct ath9k_ani_default *iniDef;
         u32 val;
 
-        aniState = &ah->curchan->ani;
+        aniState = &ah->ani;
         iniDef = &aniState->iniDef;
 
         ath_dbg(common, ANI, "ver %d.%d opmode %u chan %d Mhz/0x%x\n",
@@ -1214,7 +1214,7 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
         /* these levels just got reset to defaults by the INI */
         aniState->spurImmunityLevel = ATH9K_ANI_SPUR_IMMUNE_LVL;
         aniState->firstepLevel = ATH9K_ANI_FIRSTEP_LVL;
-        aniState->ofdmWeakSigDetect = ATH9K_ANI_USE_OFDM_WEAK_SIG;
+        aniState->ofdmWeakSigDetect = true;
         aniState->mrcCCK = true;
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 42b03dc39d14..18fcee4e9d68 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -642,6 +642,7 @@ enum sc_op_flags {
         SC_OP_ANI_RUN,
         SC_OP_PRIM_STA_VIF,
         SC_OP_HW_RESET,
+        SC_OP_SCANNING,
 };
 
 /* Powersave flags */
@@ -755,7 +756,6 @@ struct ath_softc {
         struct rchan *rfs_chan_spec_scan;
         enum spectral_mode spectral_mode;
         struct ath_spec_scan spec_config;
-        int scanning;
 
 #ifdef CONFIG_PM_SLEEP
         atomic_t wow_got_bmiss_intr;
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 2ff570f7f8ff..fd1eebab8647 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -39,7 +39,8 @@ static void ath9k_beaconq_config(struct ath_softc *sc)
 
         ath9k_hw_get_txq_props(ah, sc->beacon.beaconq, &qi);
 
-        if (sc->sc_ah->opmode == NL80211_IFTYPE_AP) {
+        if (sc->sc_ah->opmode == NL80211_IFTYPE_AP ||
+            sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT) {
                 /* Always burst out beacon and CAB traffic. */
                 qi.tqi_aifs = 1;
                 qi.tqi_cwmin = 0;
@@ -273,7 +274,8 @@ static int ath9k_beacon_choose_slot(struct ath_softc *sc)
         u64 tsf;
         int slot;
 
-        if (sc->sc_ah->opmode != NL80211_IFTYPE_AP) {
+        if (sc->sc_ah->opmode != NL80211_IFTYPE_AP &&
+            sc->sc_ah->opmode != NL80211_IFTYPE_MESH_POINT) {
                 ath_dbg(common, BEACON, "slot 0, tsf: %llu\n",
                         ath9k_hw_gettsf64(sc->sc_ah));
                 return 0;
@@ -765,10 +767,10 @@ void ath9k_set_beacon(struct ath_softc *sc)
 
         switch (sc->sc_ah->opmode) {
         case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_MESH_POINT:
                 ath9k_beacon_config_ap(sc, cur_conf);
                 break;
         case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
                 ath9k_beacon_config_adhoc(sc, cur_conf);
                 break;
         case NL80211_IFTYPE_STATION:
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 51cc0fa5cd3e..87454f6c7b4f 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -173,25 +173,69 @@ static const struct file_operations fops_rx_chainmask = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_disable_ani(struct file *file, char __user *user_buf,
+static ssize_t read_file_ani(struct file *file, char __user *user_buf,
                              size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        char buf[32];
-        unsigned int len;
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned int len = 0, size = 1024;
+        ssize_t retval = 0;
+        char *buf;
 
-        len = sprintf(buf, "%d\n", common->disable_ani);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        if (common->disable_ani) {
+                len += snprintf(buf + len, size - len, "%s: %s\n",
+                                "ANI", "DISABLED");
+                goto exit;
+        }
+
+        len += snprintf(buf + len, size - len, "%15s: %s\n",
+                        "ANI", "ENABLED");
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "ANI RESET", ah->stats.ast_ani_reset);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "SPUR UP", ah->stats.ast_ani_spurup);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "SPUR DOWN", ah->stats.ast_ani_spurup);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "OFDM WS-DET ON", ah->stats.ast_ani_ofdmon);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "OFDM WS-DET OFF", ah->stats.ast_ani_ofdmoff);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "MRC-CCK ON", ah->stats.ast_ani_ccklow);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "MRC-CCK OFF", ah->stats.ast_ani_cckhigh);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "FIR-STEP UP", ah->stats.ast_ani_stepup);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "FIR-STEP DOWN", ah->stats.ast_ani_stepdown);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "INV LISTENTIME", ah->stats.ast_ani_lneg_or_lzero);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "OFDM ERRORS", ah->stats.ast_ani_ofdmerrs);
+        len += snprintf(buf + len, size - len, "%15s: %u\n",
+                        "CCK ERRORS", ah->stats.ast_ani_cckerrs);
+exit:
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
 }
 
-static ssize_t write_file_disable_ani(struct file *file,
-                                      const char __user *user_buf,
-                                      size_t count, loff_t *ppos)
+static ssize_t write_file_ani(struct file *file,
+                              const char __user *user_buf,
+                              size_t count, loff_t *ppos)
 {
         struct ath_softc *sc = file->private_data;
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        unsigned long disable_ani;
+        unsigned long ani;
         char buf[32];
         ssize_t len;
 
@@ -200,12 +244,15 @@ static ssize_t write_file_disable_ani(struct file *file,
                 return -EFAULT;
 
         buf[len] = '\0';
-        if (kstrtoul(buf, 0, &disable_ani))
+        if (kstrtoul(buf, 0, &ani))
                 return -EINVAL;
 
-        common->disable_ani = !!disable_ani;
+        if (ani < 0 || ani > 1)
+                return -EINVAL;
+
+        common->disable_ani = !ani;
 
-        if (disable_ani) {
+        if (common->disable_ani) {
                 clear_bit(SC_OP_ANI_RUN, &sc->sc_flags);
                 ath_stop_ani(sc);
         } else {
@@ -215,9 +262,9 @@ static ssize_t write_file_disable_ani(struct file *file,
         return count;
 }
 
-static const struct file_operations fops_disable_ani = {
-        .read = read_file_disable_ani,
-        .write = write_file_disable_ani,
+static const struct file_operations fops_ani = {
+        .read = read_file_ani,
+        .write = write_file_ani,
         .open = simple_open,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
@@ -738,8 +785,6 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                        struct ath_tx_status *ts, struct ath_txq *txq,
                        unsigned int flags)
 {
-#define TX_SAMP_DBG(c) (sc->debug.bb_mac_samp[sc->debug.sampidx].ts\
-                        [sc->debug.tsidx].c)
         int qnum = txq->axq_qnum;
 
         TX_STAT_INC(qnum, tx_pkts_all);
@@ -771,37 +816,6 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                 TX_STAT_INC(qnum, data_underrun);
         if (ts->ts_flags & ATH9K_TX_DELIM_UNDERRUN)
                 TX_STAT_INC(qnum, delim_underrun);
-
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-        spin_lock(&sc->debug.samp_lock);
-        TX_SAMP_DBG(jiffies) = jiffies;
-        TX_SAMP_DBG(rssi_ctl0) = ts->ts_rssi_ctl0;
-        TX_SAMP_DBG(rssi_ctl1) = ts->ts_rssi_ctl1;
-        TX_SAMP_DBG(rssi_ctl2) = ts->ts_rssi_ctl2;
-        TX_SAMP_DBG(rssi_ext0) = ts->ts_rssi_ext0;
-        TX_SAMP_DBG(rssi_ext1) = ts->ts_rssi_ext1;
-        TX_SAMP_DBG(rssi_ext2) = ts->ts_rssi_ext2;
-        TX_SAMP_DBG(rateindex) = ts->ts_rateindex;
-        TX_SAMP_DBG(isok) = !!(ts->ts_status & ATH9K_TXERR_MASK);
-        TX_SAMP_DBG(rts_fail_cnt) = ts->ts_shortretry;
-        TX_SAMP_DBG(data_fail_cnt) = ts->ts_longretry;
-        TX_SAMP_DBG(rssi) = ts->ts_rssi;
-        TX_SAMP_DBG(tid) = ts->tid;
-        TX_SAMP_DBG(qid) = ts->qid;
-
-        if (ts->ts_flags & ATH9K_TX_BA) {
-                TX_SAMP_DBG(ba_low) = ts->ba_low;
-                TX_SAMP_DBG(ba_high) = ts->ba_high;
-        } else {
-                TX_SAMP_DBG(ba_low) = 0;
-                TX_SAMP_DBG(ba_high) = 0;
-        }
-
-        sc->debug.tsidx = (sc->debug.tsidx + 1) % ATH_DBG_MAX_SAMPLES;
-        spin_unlock(&sc->debug.samp_lock);
-#endif
-
-#undef TX_SAMP_DBG
 }
 
 static const struct file_operations fops_xmit = {
@@ -915,8 +929,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
 {
 #define RX_PHY_ERR_INC(c) sc->debug.stats.rxstats.phy_err_stats[c]++
-#define RX_SAMP_DBG(c) (sc->debug.bb_mac_samp[sc->debug.sampidx].rs\
-                        [sc->debug.rsidx].c)
 
         RX_STAT_INC(rx_pkts_all);
         sc->debug.stats.rxstats.rx_bytes_all += rs->rs_datalen;
@@ -940,27 +952,7 @@ void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
                         RX_PHY_ERR_INC(rs->rs_phyerr);
         }
 
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-        spin_lock(&sc->debug.samp_lock);
-        RX_SAMP_DBG(jiffies) = jiffies;
-        RX_SAMP_DBG(rssi_ctl0) = rs->rs_rssi_ctl0;
-        RX_SAMP_DBG(rssi_ctl1) = rs->rs_rssi_ctl1;
-        RX_SAMP_DBG(rssi_ctl2) = rs->rs_rssi_ctl2;
-        RX_SAMP_DBG(rssi_ext0) = rs->rs_rssi_ext0;
-        RX_SAMP_DBG(rssi_ext1) = rs->rs_rssi_ext1;
-        RX_SAMP_DBG(rssi_ext2) = rs->rs_rssi_ext2;
-        RX_SAMP_DBG(antenna) = rs->rs_antenna;
-        RX_SAMP_DBG(rssi) = rs->rs_rssi;
-        RX_SAMP_DBG(rate) = rs->rs_rate;
-        RX_SAMP_DBG(is_mybeacon) = rs->is_mybeacon;
-
-        sc->debug.rsidx = (sc->debug.rsidx + 1) % ATH_DBG_MAX_SAMPLES;
-        spin_unlock(&sc->debug.samp_lock);
-
-#endif
-
 #undef RX_PHY_ERR_INC
-#undef RX_SAMP_DBG
 }
 
 static const struct file_operations fops_recv = {
@@ -1485,283 +1477,6 @@ static const struct file_operations fops_modal_eeprom = {
         .llseek = default_llseek,
 };
 
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-
-void ath9k_debug_samp_bb_mac(struct ath_softc *sc)
-{
-#define ATH_SAMP_DBG(c) (sc->debug.bb_mac_samp[sc->debug.sampidx].c)
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        unsigned long flags;
-        int i;
-
-        ath9k_ps_wakeup(sc);
-
-        spin_lock_bh(&sc->debug.samp_lock);
-
-        spin_lock_irqsave(&common->cc_lock, flags);
-        ath_hw_cycle_counters_update(common);
-
-        ATH_SAMP_DBG(cc.cycles) = common->cc_ani.cycles;
-        ATH_SAMP_DBG(cc.rx_busy) = common->cc_ani.rx_busy;
-        ATH_SAMP_DBG(cc.rx_frame) = common->cc_ani.rx_frame;
-        ATH_SAMP_DBG(cc.tx_frame) = common->cc_ani.tx_frame;
-        spin_unlock_irqrestore(&common->cc_lock, flags);
-
-        ATH_SAMP_DBG(noise) = ah->noise;
-
-        REG_WRITE_D(ah, AR_MACMISC,
-                  ((AR_MACMISC_DMA_OBS_LINE_8 << AR_MACMISC_DMA_OBS_S) |
-                   (AR_MACMISC_MISC_OBS_BUS_1 <<
-                    AR_MACMISC_MISC_OBS_BUS_MSB_S)));
-
-        for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++)
-                ATH_SAMP_DBG(dma_dbg_reg_vals[i]) = REG_READ_D(ah,
-                                AR_DMADBG_0 + (i * sizeof(u32)));
-
-        ATH_SAMP_DBG(pcu_obs) = REG_READ_D(ah, AR_OBS_BUS_1);
-        ATH_SAMP_DBG(pcu_cr) = REG_READ_D(ah, AR_CR);
-
-        memcpy(ATH_SAMP_DBG(nfCalHist), sc->caldata.nfCalHist,
-                        sizeof(ATH_SAMP_DBG(nfCalHist)));
-
-        sc->debug.sampidx = (sc->debug.sampidx + 1) % ATH_DBG_MAX_SAMPLES;
-        spin_unlock_bh(&sc->debug.samp_lock);
-        ath9k_ps_restore(sc);
-
-#undef ATH_SAMP_DBG
-}
-
-static int open_file_bb_mac_samps(struct inode *inode, struct file *file)
-{
-#define ATH_SAMP_DBG(c) bb_mac_samp[sampidx].c
-        struct ath_softc *sc = inode->i_private;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ieee80211_conf *conf = &common->hw->conf;
-        struct ath_dbg_bb_mac_samp *bb_mac_samp;
-        struct ath9k_nfcal_hist *h;
-        int i, j, qcuOffset = 0, dcuOffset = 0;
-        u32 *qcuBase, *dcuBase, size = 30000, len = 0;
-        u32 sampidx = 0;
-        u8 *buf;
-        u8 chainmask = (ah->rxchainmask << 3) | ah->rxchainmask;
-        u8 nread;
-
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags))
-                return -EAGAIN;
-
-        buf = vmalloc(size);
-        if (!buf)
-                return -ENOMEM;
-        bb_mac_samp = vmalloc(sizeof(*bb_mac_samp) * ATH_DBG_MAX_SAMPLES);
-        if (!bb_mac_samp) {
-                vfree(buf);
-                return -ENOMEM;
-        }
-        /* Account the current state too */
-        ath9k_debug_samp_bb_mac(sc);
-
-        spin_lock_bh(&sc->debug.samp_lock);
-        memcpy(bb_mac_samp, sc->debug.bb_mac_samp,
-                        sizeof(*bb_mac_samp) * ATH_DBG_MAX_SAMPLES);
-        len += snprintf(buf + len, size - len,
-                        "Current Sample Index: %d\n", sc->debug.sampidx);
-        spin_unlock_bh(&sc->debug.samp_lock);
-
-        len += snprintf(buf + len, size - len,
-                        "Raw DMA Debug Dump:\n");
-        len += snprintf(buf + len, size - len, "Sample |\t");
-        for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++)
-                len += snprintf(buf + len, size - len, " DMA Reg%d |\t", i);
-        len += snprintf(buf + len, size - len, "\n");
-
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                len += snprintf(buf + len, size - len, "%d\t", sampidx);
-
-                for (i = 0; i < ATH9K_NUM_DMA_DEBUG_REGS; i++)
-                        len += snprintf(buf + len, size - len, " %08x\t",
-                                        ATH_SAMP_DBG(dma_dbg_reg_vals[i]));
-                len += snprintf(buf + len, size - len, "\n");
-        }
-        len += snprintf(buf + len, size - len, "\n");
-
-        len += snprintf(buf + len, size - len,
-                        "Sample Num QCU: chain_st fsp_ok fsp_st DCU: chain_st\n");
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                qcuBase = &ATH_SAMP_DBG(dma_dbg_reg_vals[0]);
-                dcuBase = &ATH_SAMP_DBG(dma_dbg_reg_vals[4]);
-
-                for (i = 0; i < ATH9K_NUM_QUEUES; i++,
-                                qcuOffset += 4, dcuOffset += 5) {
-                        if (i == 8) {
-                                qcuOffset = 0;
-                                qcuBase++;
-                        }
-
-                        if (i == 6) {
-                                dcuOffset = 0;
-                                dcuBase++;
-                        }
-                        if (!sc->debug.stats.txstats[i].queued)
-                                continue;
-
-                        len += snprintf(buf + len, size - len,
-                                "%4d %7d    %2x      %1x     %2x         %2x\n",
-                                sampidx, i,
-                                (*qcuBase & (0x7 << qcuOffset)) >> qcuOffset,
-                                (*qcuBase & (0x8 << qcuOffset)) >>
-                                (qcuOffset + 3),
-                                ATH_SAMP_DBG(dma_dbg_reg_vals[2]) &
-                                (0x7 << (i * 3)) >> (i * 3),
-                                (*dcuBase & (0x1f << dcuOffset)) >> dcuOffset);
-                }
-                len += snprintf(buf + len, size - len, "\n");
-        }
-        len += snprintf(buf + len, size - len,
-                        "samp qcu_sh qcu_fh qcu_comp dcu_comp dcu_arb dcu_fp "
-                        "ch_idle_dur ch_idle_dur_val txfifo_val0 txfifo_val1 "
-                        "txfifo_dcu0 txfifo_dcu1 pcu_obs AR_CR\n");
-
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                qcuBase = &ATH_SAMP_DBG(dma_dbg_reg_vals[0]);
-                dcuBase = &ATH_SAMP_DBG(dma_dbg_reg_vals[4]);
-
-                len += snprintf(buf + len, size - len, "%4d %5x %5x ", sampidx,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[3]) & 0x003c0000) >> 18,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[3]) & 0x03c00000) >> 22);
-                len += snprintf(buf + len, size - len, "%7x %8x ",
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[3]) & 0x1c000000) >> 26,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x3));
-                len += snprintf(buf + len, size - len, "%7x %7x ",
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[5]) & 0x06000000) >> 25,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[5]) & 0x38000000) >> 27);
-                len += snprintf(buf + len, size - len, "%7d %12d ",
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x000003fc) >> 2,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x00000400) >> 10);
-                len += snprintf(buf + len, size - len, "%12d %12d ",
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x00000800) >> 11,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x00001000) >> 12);
-                len += snprintf(buf + len, size - len, "%12d %12d ",
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x0001e000) >> 13,
-                        (ATH_SAMP_DBG(dma_dbg_reg_vals[6]) & 0x001e0000) >> 17);
-                len += snprintf(buf + len, size - len, "0x%07x 0x%07x\n",
-                                ATH_SAMP_DBG(pcu_obs), ATH_SAMP_DBG(pcu_cr));
-        }
-
-        len += snprintf(buf + len, size - len,
-                        "Sample ChNoise Chain privNF #Reading Readings\n");
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                h = ATH_SAMP_DBG(nfCalHist);
-                if (!ATH_SAMP_DBG(noise))
-                        continue;
-
-                for (i = 0; i < NUM_NF_READINGS; i++) {
-                        if (!(chainmask & (1 << i)) ||
-                            ((i >= AR5416_MAX_CHAINS) && !conf_is_ht40(conf)))
-                                continue;
-
-                        nread = AR_PHY_CCA_FILTERWINDOW_LENGTH -
-                                h[i].invalidNFcount;
-                        len += snprintf(buf + len, size - len,
-                                        "%4d %5d %4d\t   %d\t %d\t",
-                                        sampidx, ATH_SAMP_DBG(noise),
-                                        i, h[i].privNF, nread);
-                        for (j = 0; j < nread; j++)
-                                len += snprintf(buf + len, size - len,
-                                        " %d", h[i].nfCalBuffer[j]);
-                        len += snprintf(buf + len, size - len, "\n");
-                }
-        }
-        len += snprintf(buf + len, size - len, "\nCycle counters:\n"
-                        "Sample Total    Rxbusy   Rxframes Txframes\n");
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                if (!ATH_SAMP_DBG(cc.cycles))
-                        continue;
-                len += snprintf(buf + len, size - len,
-                                "%4d %08x %08x %08x %08x\n",
-                                sampidx, ATH_SAMP_DBG(cc.cycles),
-                                ATH_SAMP_DBG(cc.rx_busy),
-                                ATH_SAMP_DBG(cc.rx_frame),
-                                ATH_SAMP_DBG(cc.tx_frame));
-        }
-
-        len += snprintf(buf + len, size - len, "Tx status Dump :\n");
-        len += snprintf(buf + len, size - len,
-                        "Sample rssi:- ctl0 ctl1 ctl2 ext0 ext1 ext2 comb "
-                        "isok rts_fail data_fail rate tid qid "
-                                        "ba_low  ba_high tx_before(ms)\n");
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                for (i = 0; i < ATH_DBG_MAX_SAMPLES; i++) {
-                        if (!ATH_SAMP_DBG(ts[i].jiffies))
-                                continue;
-                        len += snprintf(buf + len, size - len, "%-14d"
-                                "%-4d %-4d %-4d %-4d %-4d %-4d %-4d %-4d %-8d "
-                                "%-9d %-4d %-3d %-3d %08x %08x %-11d\n",
-                                sampidx,
-                                ATH_SAMP_DBG(ts[i].rssi_ctl0),
-                                ATH_SAMP_DBG(ts[i].rssi_ctl1),
-                                ATH_SAMP_DBG(ts[i].rssi_ctl2),
-                                ATH_SAMP_DBG(ts[i].rssi_ext0),
-                                ATH_SAMP_DBG(ts[i].rssi_ext1),
-                                ATH_SAMP_DBG(ts[i].rssi_ext2),
-                                ATH_SAMP_DBG(ts[i].rssi),
-                                ATH_SAMP_DBG(ts[i].isok),
-                                ATH_SAMP_DBG(ts[i].rts_fail_cnt),
-                                ATH_SAMP_DBG(ts[i].data_fail_cnt),
-                                ATH_SAMP_DBG(ts[i].rateindex),
-                                ATH_SAMP_DBG(ts[i].tid),
-                                ATH_SAMP_DBG(ts[i].qid),
-                                ATH_SAMP_DBG(ts[i].ba_low),
-                                ATH_SAMP_DBG(ts[i].ba_high),
-                                jiffies_to_msecs(jiffies -
-                                        ATH_SAMP_DBG(ts[i].jiffies)));
-                }
-        }
-
-        len += snprintf(buf + len, size - len, "Rx status Dump :\n");
-        len += snprintf(buf + len, size - len, "Sample rssi:- ctl0 ctl1 ctl2 "
-                        "ext0 ext1 ext2 comb beacon ant rate rx_before(ms)\n");
-        for (sampidx = 0; sampidx < ATH_DBG_MAX_SAMPLES; sampidx++) {
-                for (i = 0; i < ATH_DBG_MAX_SAMPLES; i++) {
-                        if (!ATH_SAMP_DBG(rs[i].jiffies))
-                                continue;
-                        len += snprintf(buf + len, size - len, "%-14d"
-                                "%-4d %-4d %-4d %-4d %-4d %-4d %-4d %-9s %-2d %02x %-13d\n",
-                                sampidx,
-                                ATH_SAMP_DBG(rs[i].rssi_ctl0),
-                                ATH_SAMP_DBG(rs[i].rssi_ctl1),
-                                ATH_SAMP_DBG(rs[i].rssi_ctl2),
-                                ATH_SAMP_DBG(rs[i].rssi_ext0),
-                                ATH_SAMP_DBG(rs[i].rssi_ext1),
-                                ATH_SAMP_DBG(rs[i].rssi_ext2),
-                                ATH_SAMP_DBG(rs[i].rssi),
-                                ATH_SAMP_DBG(rs[i].is_mybeacon) ?
-                                "True" : "False",
-                                ATH_SAMP_DBG(rs[i].antenna),
-                                ATH_SAMP_DBG(rs[i].rate),
-                                jiffies_to_msecs(jiffies -
-                                        ATH_SAMP_DBG(rs[i].jiffies)));
-                }
-        }
-
-        vfree(bb_mac_samp);
-        file->private_data = buf;
-
-        return 0;
-#undef ATH_SAMP_DBG
-}
-
-static const struct file_operations fops_samps = {
-        .open = open_file_bb_mac_samps,
-        .read = ath9k_debugfs_read_buf,
-        .release = ath9k_debugfs_release_buf,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-#endif
-
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
 static ssize_t read_file_btcoex(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
@@ -2059,8 +1774,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                             sc->debug.debugfs_phy, sc, &fops_rx_chainmask);
         debugfs_create_file("tx_chainmask", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc, &fops_tx_chainmask);
-        debugfs_create_file("disable_ani", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc, &fops_disable_ani);
+        debugfs_create_file("ani", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc, &fops_ani);
         debugfs_create_bool("paprd", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
                             &sc->sc_ah->config.enable_paprd);
         debugfs_create_file("regidx", S_IRUSR | S_IWUSR, sc->debug.debugfs_phy,
@@ -2095,11 +1810,6 @@ int ath9k_init_debug(struct ath_hw *ah)
         debugfs_create_file("spectral_fft_period", S_IRUSR | S_IWUSR,
                             sc->debug.debugfs_phy, sc,
                             &fops_spectral_fft_period);
-
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-        debugfs_create_file("samples", S_IRUSR, sc->debug.debugfs_phy, sc,
-                            &fops_samps);
-#endif
         debugfs_create_u32("gpio_mask", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 9d49aab8b989..fc679198a0f3 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -251,56 +251,10 @@ struct ath_stats {
         u32 reset[__RESET_TYPE_MAX];
 };
 
-#define ATH_DBG_MAX_SAMPLES     10
-struct ath_dbg_bb_mac_samp {
-        u32 dma_dbg_reg_vals[ATH9K_NUM_DMA_DEBUG_REGS];
-        u32 pcu_obs, pcu_cr, noise;
-        struct {
-                u64 jiffies;
-                int8_t rssi_ctl0;
-                int8_t rssi_ctl1;
-                int8_t rssi_ctl2;
-                int8_t rssi_ext0;
-                int8_t rssi_ext1;
-                int8_t rssi_ext2;
-                int8_t rssi;
-                bool isok;
-                u8 rts_fail_cnt;
-                u8 data_fail_cnt;
-                u8 rateindex;
-                u8 qid;
-                u8 tid;
-                u32 ba_low;
-                u32 ba_high;
-        } ts[ATH_DBG_MAX_SAMPLES];
-        struct {
-                u64 jiffies;
-                int8_t rssi_ctl0;
-                int8_t rssi_ctl1;
-                int8_t rssi_ctl2;
-                int8_t rssi_ext0;
-                int8_t rssi_ext1;
-                int8_t rssi_ext2;
-                int8_t rssi;
-                bool is_mybeacon;
-                u8 antenna;
-                u8 rate;
-        } rs[ATH_DBG_MAX_SAMPLES];
-        struct ath_cycle_counters cc;
-        struct ath9k_nfcal_hist nfCalHist[NUM_NF_READINGS];
-};
-
 struct ath9k_debug {
         struct dentry *debugfs_phy;
         u32 regidx;
         struct ath_stats stats;
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-        spinlock_t samp_lock;
-        struct ath_dbg_bb_mac_samp bb_mac_samp[ATH_DBG_MAX_SAMPLES];
-        u8 sampidx;
-        u8 tsidx;
-        u8 rsidx;
-#endif
 };
 
 int ath9k_init_debug(struct ath_hw *ah);
@@ -364,17 +318,4 @@ static inline void ath_debug_stat_rx(struct ath_softc *sc,
 
 #endif /* CONFIG_ATH9K_DEBUGFS */
 
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-
-void ath9k_debug_samp_bb_mac(struct ath_softc *sc);
-
-#else
-
-static inline void ath9k_debug_samp_bb_mac(struct ath_softc *sc)
-{
-}
-
-#endif
-
-
 #endif /* DEBUG_H */
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index d3b099d7898b..0085e643132f 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -208,6 +208,9 @@ struct ath9k_htc_target_rx_stats {
                 case NL80211_IFTYPE_AP:         \
                         _priv->num_ap_vif++;    \
                         break;                  \
+                case NL80211_IFTYPE_MESH_POINT: \
+                        _priv->num_mbss_vif++;  \
+                        break;                  \
                 default:                        \
                         break;                  \
                 }                               \
@@ -224,6 +227,9 @@ struct ath9k_htc_target_rx_stats {
                 case NL80211_IFTYPE_AP:         \
                         _priv->num_ap_vif--;    \
                         break;                  \
+                case NL80211_IFTYPE_MESH_POINT: \
+                        _priv->num_mbss_vif--;  \
+                        break;                  \
                 default:                        \
                         break;                  \
                 }                               \
@@ -450,6 +456,7 @@ struct ath9k_htc_priv {
         u8 sta_slot;
         u8 vif_sta_pos[ATH9K_HTC_MAX_VIF];
         u8 num_ibss_vif;
+        u8 num_mbss_vif;
         u8 num_sta_vif;
         u8 num_sta_assoc_vif;
         u8 num_ap_vif;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index f13f458dd656..e0c03bd64182 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -28,7 +28,8 @@ void ath9k_htc_beaconq_config(struct ath9k_htc_priv *priv)
 
         ath9k_hw_get_txq_props(ah, priv->beaconq, &qi);
 
-        if (priv->ah->opmode == NL80211_IFTYPE_AP) {
+        if (priv->ah->opmode == NL80211_IFTYPE_AP ||
+            priv->ah->opmode == NL80211_IFTYPE_MESH_POINT) {
                 qi.tqi_aifs = 1;
                 qi.tqi_cwmin = 0;
                 qi.tqi_cwmax = 0;
@@ -628,6 +629,7 @@ void ath9k_htc_beacon_config(struct ath9k_htc_priv *priv,
         case NL80211_IFTYPE_ADHOC:
                 ath9k_htc_beacon_config_adhoc(priv, cur_conf);
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 ath9k_htc_beacon_config_ap(priv, cur_conf);
                 break;
@@ -649,6 +651,7 @@ void ath9k_htc_beacon_reconfig(struct ath9k_htc_priv *priv)
         case NL80211_IFTYPE_ADHOC:
                 ath9k_htc_beacon_config_adhoc(priv, cur_conf);
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 ath9k_htc_beacon_config_ap(priv, cur_conf);
                 break;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index a47f5e05fc04..59f64367e8ca 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -698,7 +698,8 @@ static const struct ieee80211_iface_limit if_limits[] = {
         { .max = 2,     .types = BIT(NL80211_IFTYPE_STATION) |
                                  BIT(NL80211_IFTYPE_P2P_CLIENT) },
         { .max = 2,     .types = BIT(NL80211_IFTYPE_AP) |
-                                 BIT(NL80211_IFTYPE_P2P_GO) },
+                                 BIT(NL80211_IFTYPE_P2P_GO) |
+                                 BIT(NL80211_IFTYPE_MESH_POINT) },
 };
 
 static const struct ieee80211_iface_combination if_comb = {
@@ -721,6 +722,7 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_PS_NULLFUNC_STACK |
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+                IEEE80211_HW_MFP_CAPABLE |
                 IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING;
 
         hw->wiphy->interface_modes =
@@ -728,7 +730,8 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                 BIT(NL80211_IFTYPE_ADHOC) |
                 BIT(NL80211_IFTYPE_AP) |
                 BIT(NL80211_IFTYPE_P2P_GO) |
-                BIT(NL80211_IFTYPE_P2P_CLIENT);
+                BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                BIT(NL80211_IFTYPE_MESH_POINT);
 
         hw->wiphy->iface_combinations = &if_comb;
         hw->wiphy->n_iface_combinations = 1;
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 0743a47cef8f..34869c2405aa 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -113,7 +113,9 @@ static void ath9k_htc_vif_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
         struct ath9k_htc_priv *priv = data;
         struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
-        if ((vif->type == NL80211_IFTYPE_AP) && bss_conf->enable_beacon)
+        if ((vif->type == NL80211_IFTYPE_AP ||
+             vif->type == NL80211_IFTYPE_MESH_POINT) &&
+            bss_conf->enable_beacon)
                 priv->reconfig_beacon = true;
 
         if (bss_conf->assoc) {
@@ -180,6 +182,8 @@ static void ath9k_htc_set_opmode(struct ath9k_htc_priv *priv)
                 priv->ah->opmode = NL80211_IFTYPE_ADHOC;
         else if (priv->num_ap_vif)
                 priv->ah->opmode = NL80211_IFTYPE_AP;
+        else if (priv->num_mbss_vif)
+                priv->ah->opmode = NL80211_IFTYPE_MESH_POINT;
         else
                 priv->ah->opmode = NL80211_IFTYPE_STATION;
 
@@ -810,8 +814,7 @@ void ath9k_htc_ani_work(struct work_struct *work)
         }
 
         /* Verify whether we must check ANI */
-        if (ah->config.enable_ani &&
-            (timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
+        if ((timestamp - common->ani.checkani_timer) >= ATH_ANI_POLLINTERVAL) {
                 aniflag = true;
                 common->ani.checkani_timer = timestamp;
         }
@@ -841,8 +844,7 @@ set_timer:
         * short calibration and long calibration.
         */
         cal_interval = ATH_LONG_CALINTERVAL;
-        if (ah->config.enable_ani)
-                cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
+        cal_interval = min(cal_interval, (u32)ATH_ANI_POLLINTERVAL);
         if (!common->ani.caldone)
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
@@ -1052,6 +1054,9 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
         case NL80211_IFTYPE_AP:
                 hvif.opmode = HTC_M_HOSTAP;
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
+                hvif.opmode = HTC_M_WDS;        /* close enough */
+                break;
         default:
                 ath_err(common,
                         "Interface type %d not yet supported\n", vif->type);
@@ -1084,6 +1089,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
         INC_VIF(priv, vif->type);
 
         if ((vif->type == NL80211_IFTYPE_AP) ||
+            (vif->type == NL80211_IFTYPE_MESH_POINT) ||
             (vif->type == NL80211_IFTYPE_ADHOC))
                 ath9k_htc_assign_bslot(priv, vif);
 
@@ -1134,6 +1140,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
         DEC_VIF(priv, vif->type);
 
         if ((vif->type == NL80211_IFTYPE_AP) ||
+             vif->type == NL80211_IFTYPE_MESH_POINT ||
             (vif->type == NL80211_IFTYPE_ADHOC))
                 ath9k_htc_remove_bslot(priv, vif);
 
@@ -1525,9 +1532,10 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
         if ((changed & BSS_CHANGED_BEACON_ENABLED) && !bss_conf->enable_beacon) {
                 /*
                  * Disable SWBA interrupt only if there are no
-                 * AP/IBSS interfaces.
+                 * concurrent AP/mesh or IBSS interfaces.
                  */
-                if ((priv->num_ap_vif <= 1) || priv->num_ibss_vif) {
+                if ((priv->num_ap_vif + priv->num_mbss_vif <= 1) ||
+                     priv->num_ibss_vif) {
                         ath_dbg(common, CONFIG,
                                 "Beacon disabled for BSS: %pM\n",
                                 bss_conf->bssid);
@@ -1538,12 +1546,15 @@ static void ath9k_htc_bss_info_changed(struct ieee80211_hw *hw,
 
         if (changed & BSS_CHANGED_BEACON_INT) {
                 /*
-                 * Reset the HW TSF for the first AP interface.
+                 * Reset the HW TSF for the first AP or mesh interface.
                  */
-                if ((priv->ah->opmode == NL80211_IFTYPE_AP) &&
-                    (priv->nvifs == 1) &&
-                    (priv->num_ap_vif == 1) &&
-                    (vif->type == NL80211_IFTYPE_AP)) {
+                if (priv->nvifs == 1 &&
+                    ((priv->ah->opmode == NL80211_IFTYPE_AP &&
+                      vif->type == NL80211_IFTYPE_AP &&
+                      priv->num_ap_vif == 1) ||
+                    (priv->ah->opmode == NL80211_IFTYPE_MESH_POINT &&
+                      vif->type == NL80211_IFTYPE_MESH_POINT &&
+                      priv->num_mbss_vif == 1))) {
                         set_bit(OP_TSF_RESET, &priv->op_flags);
                 }
                 ath_dbg(common, CONFIG,
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 6bd0e92ea2aa..e602c9519709 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -887,7 +887,7 @@ u32 ath9k_htc_calcrxfilter(struct ath9k_htc_priv *priv)
         if (priv->rxfilter & FIF_PSPOLL)
                 rfilt |= ATH9K_RX_FILTER_PSPOLL;
 
-        if (priv->nvifs > 1)
+        if (priv->nvifs > 1 || priv->rxfilter & FIF_OTHER_BSS)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
 
         return rfilt;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 15dfefcf2d0f..d813ab8104d6 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -452,7 +452,6 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
         ah->config.pcie_clock_req = 0;
         ah->config.pcie_waen = 0;
         ah->config.analog_shiftreg = 1;
-        ah->config.enable_ani = true;
 
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
                 ah->config.spurchans[i][0] = AR_NO_SPUR;
@@ -549,8 +548,7 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
                 ah->eep_ops->get_eeprom_ver(ah),
                 ah->eep_ops->get_eeprom_rev(ah));
 
-        if (ah->config.enable_ani)
-                ath9k_hw_ani_init(ah);
+        ath9k_hw_ani_init(ah);
 
         return 0;
 }
@@ -1250,10 +1248,10 @@ static void ath9k_hw_set_operating_mode(struct ath_hw *ah, int opmode)
 
         switch (opmode) {
         case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
                 set |= AR_STA_ID1_ADHOC;
                 REG_SET_BIT(ah, AR_CFG, AR_CFG_AP_ADHOC_INDICATION);
                 break;
+        case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 set |= AR_STA_ID1_STA_AP;
                 /* fall through */
@@ -2255,12 +2253,12 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
 
         switch (ah->opmode) {
         case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_MESH_POINT:
                 REG_SET_BIT(ah, AR_TXCFG,
                             AR_TXCFG_ADHOC_BEACON_ATIM_TX_POLICY);
                 REG_WRITE(ah, AR_NEXT_NDP_TIMER, next_beacon +
                           TU_TO_USEC(ah->atim_window ? ah->atim_window : 1));
                 flags |= AR_NDP_TIMER_EN;
+        case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 REG_WRITE(ah, AR_NEXT_TBTT_TIMER, next_beacon);
                 REG_WRITE(ah, AR_NEXT_DMA_BEACON_ALERT, next_beacon -
@@ -2604,13 +2602,8 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
                         pCap->hw_caps |= ATH9K_HW_CAP_RTT;
         }
 
-        if (AR_SREV_9280_20_OR_LATER(ah)) {
-                pCap->hw_caps |= ATH9K_HW_WOW_DEVICE_CAPABLE |
-                                 ATH9K_HW_WOW_PATTERN_MATCH_EXACT;
-
-                if (AR_SREV_9280(ah))
-                        pCap->hw_caps |= ATH9K_HW_WOW_PATTERN_MATCH_DWORD;
-        }
+        if (AR_SREV_9462(ah))
+                pCap->hw_caps |= ATH9K_HW_WOW_DEVICE_CAPABLE;
 
         if (AR_SREV_9300_20_OR_LATER(ah) &&
             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index ae3034374bc4..7d259b7dc254 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -246,9 +246,7 @@ enum ath9k_hw_caps {
         ATH9K_HW_CAP_MCI                        = BIT(15),
         ATH9K_HW_CAP_DFS                        = BIT(16),
         ATH9K_HW_WOW_DEVICE_CAPABLE             = BIT(17),
-        ATH9K_HW_WOW_PATTERN_MATCH_EXACT        = BIT(18),
-        ATH9K_HW_WOW_PATTERN_MATCH_DWORD        = BIT(19),
-        ATH9K_HW_CAP_PAPRD                      = BIT(20),
+        ATH9K_HW_CAP_PAPRD                      = BIT(18),
 };
 
 /*
@@ -291,7 +289,6 @@ struct ath9k_ops_config {
         u32 ofdm_trig_high;
         u32 cck_trig_high;
         u32 cck_trig_low;
-        u32 enable_ani;
         u32 enable_paprd;
         int serialize_regmode;
         bool rx_intr_mitigation;
@@ -423,7 +420,6 @@ struct ath9k_hw_cal_data {
 
 struct ath9k_channel {
         struct ieee80211_channel *chan;
-        struct ar5416AniState ani;
         u16 channel;
         u32 channelFlags;
         u32 chanmode;
@@ -854,10 +850,10 @@ struct ath_hw {
         u32 globaltxtimeout;
 
         /* ANI */
-        u32 proc_phyerr;
         u32 aniperiod;
         enum ath9k_ani_cmd ani_function;
         u32 ani_skip_count;
+        struct ar5416AniState ani;
 
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
         struct ath_btcoex_hw btcoex_hw;
@@ -882,9 +878,6 @@ struct ath_hw {
         struct ar5416IniArray iniBank6;
         struct ar5416IniArray iniAddac;
         struct ar5416IniArray iniPcieSerdes;
-#ifdef CONFIG_PM_SLEEP
-        struct ar5416IniArray iniPcieSerdesWow;
-#endif
         struct ar5416IniArray iniPcieSerdesLowPower;
         struct ar5416IniArray iniModesFastClock;
         struct ar5416IniArray iniAdditional;
@@ -1165,8 +1158,6 @@ static inline void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
 }
 #endif
 
-
-
 #define ATH9K_CLOCK_RATE_CCK            22
 #define ATH9K_CLOCK_RATE_5GHZ_OFDM      40
 #define ATH9K_CLOCK_RATE_2GHZ_OFDM      44
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index aba415103f94..daba841808cf 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -21,6 +21,7 @@
 #include <linux/ath9k_platform.h>
 #include <linux/module.h>
 #include <linux/relay.h>
+#include <net/ieee80211_radiotap.h>
 
 #include "ath9k.h"
 
@@ -613,9 +614,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
         mutex_init(&sc->mutex);
-#ifdef CONFIG_ATH9K_MAC_DEBUG
-        spin_lock_init(&sc->debug.samp_lock);
-#endif
         tasklet_init(&sc->intr_tq, ath9k_tasklet, (unsigned long)sc);
         tasklet_init(&sc->bcon_tasklet, ath9k_beacon_tasklet,
                      (unsigned long)sc);
@@ -769,12 +767,19 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_REPORTS_TX_ACK_STATUS |
                 IEEE80211_HW_SUPPORTS_RC_TABLE;
 
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
-                 hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT) {
+                hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
+
+                if (AR_SREV_9280_20_OR_LATER(ah))
+                        hw->radiotap_mcs_details |=
+                                IEEE80211_RADIOTAP_MCS_HAVE_STBC;
+        }
 
         if (AR_SREV_9160_10_OR_LATER(sc->sc_ah) || ath9k_modparam_nohwcrypt)
                 hw->flags |= IEEE80211_HW_MFP_CAPABLE;
 
+        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+
         hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_P2P_GO) |
                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
@@ -795,21 +800,17 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
 #ifdef CONFIG_PM_SLEEP
-
         if ((ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
             device_can_wakeup(sc->dev)) {
-
                 hw->wiphy->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT |
                                           WIPHY_WOWLAN_DISCONNECT;
                 hw->wiphy->wowlan.n_patterns = MAX_NUM_USER_PATTERN;
                 hw->wiphy->wowlan.pattern_min_len = 1;
                 hw->wiphy->wowlan.pattern_max_len = MAX_PATTERN_SIZE;
-
         }
 
         atomic_set(&sc->wow_sleep_proc_intr, -1);
         atomic_set(&sc->wow_got_bmiss_intr, -1);
-
 #endif
 
         hw->queues = 4;
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index 849259b07370..fff5d3ccc663 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -390,9 +390,7 @@ void ath_ani_calibrate(unsigned long data)
         }
 
         /* Verify whether we must check ANI */
-        if (sc->sc_ah->config.enable_ani
-            && (timestamp - common->ani.checkani_timer) >=
-            ah->config.ani_poll_interval) {
+        if ((timestamp - common->ani.checkani_timer) >= ah->config.ani_poll_interval) {
                 aniflag = true;
                 common->ani.checkani_timer = timestamp;
         }
@@ -418,7 +416,6 @@ void ath_ani_calibrate(unsigned long data)
                 longcal ? "long" : "", shortcal ? "short" : "",
                 aniflag ? "ani" : "", common->ani.caldone ? "true" : "false");
 
-        ath9k_debug_samp_bb_mac(sc);
         ath9k_ps_restore(sc);
 
 set_timer:
@@ -428,9 +425,7 @@ set_timer:
         * short calibration and long calibration.
         */
         cal_interval = ATH_LONG_CALINTERVAL;
-        if (sc->sc_ah->config.enable_ani)
-                cal_interval = min(cal_interval,
-                                   (u32)ah->config.ani_poll_interval);
+        cal_interval = min(cal_interval, (u32)ah->config.ani_poll_interval);
         if (!common->ani.caldone)
                 cal_interval = min(cal_interval, (u32)short_cal_interval);
 
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 566109a40fb3..2ef05ebffbcf 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -547,6 +547,7 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 
         rs->rs_status = 0;
         rs->rs_flags = 0;
+        rs->flag = 0;
 
         rs->rs_datalen = ads.ds_rxstatus1 & AR_DataLen;
         rs->rs_tstamp = ads.AR_RcvTimestamp;
@@ -586,10 +587,17 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
         rs->rs_moreaggr =
                 (ads.ds_rxstatus8 & AR_RxMoreAggr) ? 1 : 0;
         rs->rs_antenna = MS(ads.ds_rxstatus3, AR_RxAntenna);
-        rs->rs_flags =
-                (ads.ds_rxstatus3 & AR_GI) ? ATH9K_RX_GI : 0;
-        rs->rs_flags |=
-                (ads.ds_rxstatus3 & AR_2040) ? ATH9K_RX_2040 : 0;
+
+        /* directly mapped flags for ieee80211_rx_status */
+        rs->flag |=
+                (ads.ds_rxstatus3 & AR_GI) ? RX_FLAG_SHORT_GI : 0;
+        rs->flag |=
+                (ads.ds_rxstatus3 & AR_2040) ? RX_FLAG_40MHZ : 0;
+        if (AR_SREV_9280_20_OR_LATER(ah))
+                rs->flag |=
+                        (ads.ds_rxstatus3 & AR_STBC) ?
+                                /* we can only Nss=1 STBC */
+                                (1 << RX_FLAG_STBC_SHIFT) : 0;
 
         if (ads.ds_rxstatus8 & AR_PreDelimCRCErr)
                 rs->rs_flags |= ATH9K_RX_DELIM_CRC_PRE;
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index 5865f92998e1..b02dfce964b4 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -149,6 +149,7 @@ struct ath_rx_status {
         u32 evm2;
         u32 evm3;
         u32 evm4;
+        u32 flag; /* see enum mac80211_rx_flags */
 };
 
 struct ath_htc_rx_status {
@@ -533,7 +534,8 @@ struct ar5416_desc {
 #define AR_2040             0x00000002
 #define AR_Parallel40       0x00000004
 #define AR_Parallel40_S     2
-#define AR_RxStatusRsvd30   0x000000f8
+#define AR_STBC             0x00000008 /* on ar9280 and later */
+#define AR_RxStatusRsvd30   0x000000f0
 #define AR_RxAntenna        0xffffff00
 #define AR_RxAntenna_S      8
 
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 5092ecae7706..e5b186b04b29 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -193,7 +193,6 @@ static bool ath_prepare_reset(struct ath_softc *sc)
         ath_stop_ani(sc);
         del_timer_sync(&sc->rx_poll_timer);
 
-        ath9k_debug_samp_bb_mac(sc);
         ath9k_hw_disable_interrupts(ah);
 
         if (!ath_drain_all_txq(sc))
@@ -1273,7 +1272,7 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
                                 curchan->center_freq);
                 } else {
                         /* perform spectral scan if requested. */
-                        if (sc->scanning &&
+                        if (test_bit(SC_OP_SCANNING, &sc->sc_flags) &&
                             sc->spectral_mode == SPECTRAL_CHANSCAN)
                                 ath9k_spectral_scan_trigger(hw);
                 }
@@ -1690,7 +1689,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
         bool flush = false;
         int ret = 0;
 
-        local_bh_disable();
+        mutex_lock(&sc->mutex);
 
         switch (action) {
         case IEEE80211_AMPDU_RX_START:
@@ -1723,7 +1722,7 @@ static int ath9k_ampdu_action(struct ieee80211_hw *hw,
                 ath_err(ath9k_hw_common(sc->sc_ah), "Unknown AMPDU action\n");
         }
 
-        local_bh_enable();
+        mutex_unlock(&sc->mutex);
 
         return ret;
 }
@@ -2007,7 +2006,6 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        struct ath9k_hw_capabilities *pcaps = &ah->caps;
         int pattern_count = 0;
         int i, byte_cnt;
         u8 dis_deauth_pattern[MAX_PATTERN_SIZE];
@@ -2077,36 +2075,9 @@ static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
 
         /* Create Disassociate pattern mask */
 
-        if (pcaps->hw_caps & ATH9K_HW_WOW_PATTERN_MATCH_EXACT) {
-
-                if (pcaps->hw_caps & ATH9K_HW_WOW_PATTERN_MATCH_DWORD) {
-                        /*
-                         * for AR9280, because of hardware limitation, the
-                         * first 4 bytes have to be matched for all patterns.
-                         * the mask for disassociation and de-auth pattern
-                         * matching need to enable the first 4 bytes.
-                         * also the duration field needs to be filled.
-                         */
-                        dis_deauth_mask[0] = 0xf0;
-
-                        /*
-                         * fill in duration field
-                         FIXME: what is the exact value ?
-                         */
-                        dis_deauth_pattern[2] = 0xff;
-                        dis_deauth_pattern[3] = 0xff;
-                } else {
-                        dis_deauth_mask[0] = 0xfe;
-                }
-
-                dis_deauth_mask[1] = 0x03;
-                dis_deauth_mask[2] = 0xc0;
-        } else {
-                dis_deauth_mask[0] = 0xef;
-                dis_deauth_mask[1] = 0x3f;
-                dis_deauth_mask[2] = 0x00;
-                dis_deauth_mask[3] = 0xfc;
-        }
+        dis_deauth_mask[0] = 0xfe;
+        dis_deauth_mask[1] = 0x03;
+        dis_deauth_mask[2] = 0xc0;
 
         ath_dbg(common, WOW, "Adding disassoc/deauth patterns for WoW\n");
 
@@ -2342,15 +2313,13 @@ static void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
-
-        sc->scanning = 1;
+        set_bit(SC_OP_SCANNING, &sc->sc_flags);
 }
 
 static void ath9k_sw_scan_complete(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
-
-        sc->scanning = 0;
+        clear_bit(SC_OP_SCANNING, &sc->sc_flags);
 }
 
 struct ieee80211_ops ath9k_ops = {
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 8be2b5d8c155..865e043e8aa6 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -868,10 +868,7 @@ static int ath9k_process_rate(struct ath_common *common,
         if (rx_stats->rs_rate & 0x80) {
                 /* HT rate */
                 rxs->flag |= RX_FLAG_HT;
-                if (rx_stats->rs_flags & ATH9K_RX_2040)
-                        rxs->flag |= RX_FLAG_40MHZ;
-                if (rx_stats->rs_flags & ATH9K_RX_GI)
-                        rxs->flag |= RX_FLAG_SHORT_GI;
+                rxs->flag |= rx_stats->flag;
                 rxs->rate_idx = rx_stats->rs_rate & 0x7f;
                 return 0;
         }
@@ -958,11 +955,11 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
         if (rx_stats->rs_more)
                 return 0;
 
-        ath9k_process_rssi(common, hw, hdr, rx_stats);
-
         if (ath9k_process_rate(common, hw, rx_stats, rx_status))
                 return -EINVAL;
 
+        ath9k_process_rssi(common, hw, hdr, rx_stats);
+
         rx_status->band = hw->conf.chandef.chan->band;
         rx_status->freq = hw->conf.chandef.chan->center_freq;
         rx_status->signal = ah->noise + rx_stats->rs_rssi;
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 9f8563091bea..81c88dd606dc 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -34,17 +34,6 @@ const char *ath9k_hw_wow_event_to_string(u32 wow_event)
 }
 EXPORT_SYMBOL(ath9k_hw_wow_event_to_string);
 
-static void ath9k_hw_config_serdes_wow_sleep(struct ath_hw *ah)
-{
-        int i;
-
-        for (i = 0; i < ah->iniPcieSerdesWow.ia_rows; i++)
-                REG_WRITE(ah, INI_RA(&ah->iniPcieSerdesWow, i, 0),
-                          INI_RA(&ah->iniPcieSerdesWow, i, 1));
-
-        usleep_range(1000, 1500);
-}
-
 static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -58,15 +47,8 @@ static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
                 ath_err(common, "Failed to stop Rx DMA in 10ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
                         REG_READ(ah, AR_CR), REG_READ(ah, AR_DIAG_SW));
                 return;
-        } else {
-                if (!AR_SREV_9300_20_OR_LATER(ah))
-                        REG_WRITE(ah, AR_RXDP, 0x0);
         }
 
-        /* AR9280 WoW has sleep issue, do not set it to sleep */
-        if (AR_SREV_9280_20(ah))
-                return;
-
         REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_ON_INT);
 }
 
@@ -84,27 +66,16 @@ static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
 
         /* set the transmit buffer */
         ctl[0] = (KAL_FRAME_LEN | (MAX_RATE_POWER << 16));
-
-        if (!(AR_SREV_9300_20_OR_LATER(ah)))
-                ctl[0] += (KAL_ANTENNA_MODE << 25);
-
         ctl[1] = 0;
         ctl[3] = 0xb;   /* OFDM_6M hardware value for this rate */
         ctl[4] = 0;
         ctl[7] = (ah->txchainmask) << 2;
-
-        if (AR_SREV_9300_20_OR_LATER(ah))
-                ctl[2] = 0xf << 16; /* tx_tries 0 */
-        else
-                ctl[2] = 0x7 << 16; /* tx_tries 0 */
-
+        ctl[2] = 0xf << 16; /* tx_tries 0 */
 
         for (i = 0; i < KAL_NUM_DESC_WORDS; i++)
                 REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
 
-        /* for AR9300 family 13 descriptor words */
-        if (AR_SREV_9300_20_OR_LATER(ah))
-                REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
+        REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
 
         data_word[0] = (KAL_FRAME_TYPE << 2) | (KAL_FRAME_SUB_TYPE << 4) |
                        (KAL_TO_DS << 8) | (KAL_DURATION_ID << 16);
@@ -183,9 +154,6 @@ void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
 
         ah->wow_event_mask |= BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
 
-        if (!AR_SREV_9285_12_OR_LATER(ah))
-                return;
-
         if (pattern_count < 4) {
                 /* Pattern 0-3 uses AR_WOW_LENGTH1 register */
                 set = (pattern_len & AR_WOW_LENGTH_MAX) <<
@@ -207,6 +175,7 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
 {
         u32 wow_status = 0;
         u32 val = 0, rval;
+
         /*
          * read the WoW status register to know
          * the wakeup reason
@@ -223,19 +192,14 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
         val &= ah->wow_event_mask;
 
         if (val) {
-
                 if (val & AR_WOW_MAGIC_PAT_FOUND)
                         wow_status |= AH_WOW_MAGIC_PATTERN_EN;
-
                 if (AR_WOW_PATTERN_FOUND(val))
                         wow_status |= AH_WOW_USER_PATTERN_EN;
-
                 if (val & AR_WOW_KEEP_ALIVE_FAIL)
                         wow_status |= AH_WOW_LINK_CHANGE;
-
                 if (val & AR_WOW_BEACON_FAIL)
                         wow_status |= AH_WOW_BEACON_MISS;
-
         }
 
         /*
@@ -255,17 +219,6 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
                   AR_WOW_CLEAR_EVENTS(REG_READ(ah, AR_WOW_PATTERN)));
 
         /*
-         * tie reset register for AR9002 family of chipsets
-         * NB: not tieing it back might have some repurcussions.
-         */
-
-        if (!AR_SREV_9300_20_OR_LATER(ah)) {
-                REG_SET_BIT(ah, AR_WA, AR_WA_UNTIE_RESET_EN |
-                            AR_WA_POR_SHORT | AR_WA_RESET_EN);
-        }
-
-
-        /*
          * restore the beacon threshold to init value
          */
         REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
@@ -277,8 +230,7 @@ u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
          * reset to our Chip's Power On Reset so that any PCI-E
          * reset from the bus will not reset our chip
          */
-
-        if (AR_SREV_9280_20_OR_LATER(ah) && ah->is_pciexpress)
+        if (ah->is_pciexpress)
                 ath9k_hw_configpcipowersave(ah, false);
 
         ah->wow_event_mask = 0;
@@ -298,7 +250,6 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
          * are from the 'pattern_enable' in this function and
          * 'pattern_count' of ath9k_hw_wow_apply_pattern()
          */
-
         wow_event_mask = ah->wow_event_mask;
 
         /*
@@ -306,50 +257,15 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
          * WOW sleep, we do want the Reset from the PCI-E to disturb
          * our hw state
          */
-
         if (ah->is_pciexpress) {
-
                 /*
                  * we need to untie the internal POR (power-on-reset)
                  * to the external PCI-E reset. We also need to tie
                  * the PCI-E Phy reset to the PCI-E reset.
                  */
-
-                if (AR_SREV_9300_20_OR_LATER(ah)) {
-                        set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
-                        clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
-                        REG_RMW(ah, AR_WA, set, clr);
-                } else {
-                        if (AR_SREV_9285(ah) || AR_SREV_9287(ah))
-                                set = AR9285_WA_DEFAULT;
-                        else
-                                set = AR9280_WA_DEFAULT;
-
-                        /*
-                         * In AR9280 and AR9285, bit 14 in WA register
-                         * (disable L1) should only be set when device
-                         * enters D3 state and be cleared when device
-                         * comes back to D0
-                         */
-
-                        if (ah->config.pcie_waen & AR_WA_D3_L1_DISABLE)
-                                set |= AR_WA_D3_L1_DISABLE;
-
-                        clr = AR_WA_UNTIE_RESET_EN;
-                        set |= AR_WA_RESET_EN | AR_WA_POR_SHORT;
-                        REG_RMW(ah, AR_WA, set, clr);
-
-                        /*
-                         * for WoW sleep, we reprogram the SerDes so that the
-                         * PLL and CLK REQ are both enabled. This uses more
-                         * power but otherwise WoW sleep is unstable and the
-                         * chip may disappear.
-                         */
-
-                        if (AR_SREV_9285_12_OR_LATER(ah))
-                                ath9k_hw_config_serdes_wow_sleep(ah);
-
-                }
+                set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
+                clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
+                REG_RMW(ah, AR_WA, set, clr);
         }
 
         /*
@@ -378,7 +294,6 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
          * Program default values for pattern backoff, aifs/slot/KAL count,
          * beacon miss timeout, KAL timeout, etc.
          */
-
         set = AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF);
         REG_SET_BIT(ah, AR_WOW_PATTERN, set);
 
@@ -398,7 +313,7 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
         /*
          * Keep alive timo in ms except AR9280
          */
-        if (!pattern_enable || AR_SREV_9280(ah))
+        if (!pattern_enable)
                 set = AR_WOW_KEEP_ALIVE_NEVER;
         else
                 set = KAL_TIMEOUT * 32;
@@ -420,7 +335,6 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
         /*
          * Configure MAC WoW Registers
          */
-
         set = 0;
         /* Send keep alive timeouts anyway */
         clr = AR_WOW_KEEP_ALIVE_AUTO_DIS;
@@ -430,16 +344,9 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
         else
                 set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
 
-        /*
-         * FIXME: For now disable keep alive frame
-         * failure. This seems to sometimes trigger
-         * unnecessary wake up with AR9485 chipsets.
-         */
         set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
-
         REG_RMW(ah, AR_WOW_KEEP_ALIVE, set, clr);
 
-
         /*
          * we are relying on a bmiss failure. ensure we have
          * enough threshold to prevent false positives
@@ -473,14 +380,8 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
         set |= AR_WOW_MAC_INTR_EN;
         REG_RMW(ah, AR_WOW_PATTERN, set, clr);
 
-        /*
-         * For AR9285 and later version of chipsets
-         * enable WoW pattern match for packets less
-         * than 256 bytes for all patterns
-         */
-        if (AR_SREV_9285_12_OR_LATER(ah))
-                REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
-                          AR_WOW_PATTERN_SUPPORTED);
+        REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
+                  AR_WOW_PATTERN_SUPPORTED);
 
         /*
          * Set the power states appropriately and enable PME
@@ -488,43 +389,32 @@ void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
         clr = 0;
         set = AR_PMCTRL_PWR_STATE_D1D3 | AR_PMCTRL_HOST_PME_EN |
               AR_PMCTRL_PWR_PM_CTRL_ENA;
-        /*
-         * This is needed for AR9300 chipsets to wake-up
-         * the host.
-         */
-        if (AR_SREV_9300_20_OR_LATER(ah))
-                clr = AR_PCIE_PM_CTRL_ENA;
 
+        clr = AR_PCIE_PM_CTRL_ENA;
         REG_RMW(ah, AR_PCIE_PM_CTRL, set, clr);
 
-        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
-                /*
-                 * this is needed to prevent the chip waking up
-                 * the host within 3-4 seconds with certain
-                 * platform/BIOS. The fix is to enable
-                 * D1 & D3 to match original definition and
-                 * also match the OTP value. Anyway this
-                 * is more related to SW WOW.
-                 */
-                clr = AR_PMCTRL_PWR_STATE_D1D3;
-                REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
-
-                set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
-                REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
-        }
-
+        /*
+         * this is needed to prevent the chip waking up
+         * the host within 3-4 seconds with certain
+         * platform/BIOS. The fix is to enable
+         * D1 & D3 to match original definition and
+         * also match the OTP value. Anyway this
+         * is more related to SW WOW.
+         */
+        clr = AR_PMCTRL_PWR_STATE_D1D3;
+        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
 
+        set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
+        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
 
         REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
 
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
-                /* to bring down WOW power low margin */
-                set = BIT(13);
-                REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
-                /* HW WoW */
-                clr = BIT(5);
-                REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
-        }
+        /* to bring down WOW power low margin */
+        set = BIT(13);
+        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
+        /* HW WoW */
+        clr = BIT(5);
+        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
 
         ath9k_hw_set_powermode_wow_sleep(ah);
         ah->wow_event_mask = wow_event_mask;
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
index bac3d98a0cfb..5644ac54facc 100644
--- a/drivers/net/wireless/ath/wil6210/Kconfig
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -27,3 +27,15 @@ config WIL6210_ISR_COR
           self-clear when accessed for debug purposes, it makes
           such monitoring impossible.
           Say y unless you debug interrupts
+
+config ATH6KL_TRACING
+        bool "wil6210 tracing support"
+        depends on WIL6210
+        depends on EVENT_TRACING
+        default y
+        ---help---
+          Say Y here to enable tracepoints for the wil6210 driver
+          using the kernel tracing infrastructure.  Select this
+          option if you are interested in debugging the driver.
+
+          If unsure, say Y to make it easier to debug problems.
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
index d288eea0a26a..f891d514d881 100644
--- a/drivers/net/wireless/ath/wil6210/Makefile
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -1,15 +1,20 @@
 obj-$(CONFIG_WIL6210) += wil6210.o
 
-wil6210-objs := main.o
-wil6210-objs += netdev.o
-wil6210-objs += cfg80211.o
-wil6210-objs += pcie_bus.o
-wil6210-objs += debugfs.o
-wil6210-objs += wmi.o
-wil6210-objs += interrupt.o
-wil6210-objs += txrx.o
+wil6210-y := main.o
+wil6210-y += netdev.o
+wil6210-y += cfg80211.o
+wil6210-y += pcie_bus.o
+wil6210-y += debugfs.o
+wil6210-y += wmi.o
+wil6210-y += interrupt.o
+wil6210-y += txrx.o
+wil6210-y += debug.o
+wil6210-$(CONFIG_WIL6210_TRACING) += trace.o
 
 ifeq (, $(findstring -W,$(EXTRA_CFLAGS)))
         subdir-ccflags-y += -Werror
 endif
+# for tracing framework to find trace.h
+CFLAGS_trace.o := -I$(src)
+
 subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index c5d4a87abaaf..4eb05d0818c3 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -322,12 +322,16 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
          * FW don't support scan after connection attempt
          */
         set_bit(wil_status_dontscan, &wil->status);
+        set_bit(wil_status_fwconnecting, &wil->status);
 
         rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
         if (rc == 0) {
                 /* Connect can take lots of time */
                 mod_timer(&wil->connect_timer,
                           jiffies + msecs_to_jiffies(2000));
+        } else {
+                clear_bit(wil_status_dontscan, &wil->status);
+                clear_bit(wil_status_fwconnecting, &wil->status);
         }
 
  out:
diff --git a/drivers/net/wireless/ath/wil6210/debug.c b/drivers/net/wireless/ath/wil6210/debug.c
new file mode 100644
index 000000000000..9eeabf4a5879
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/debug.c
@@ -0,0 +1,69 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "wil6210.h"
+#include "trace.h"
+
+int wil_err(struct wil6210_priv *wil, const char *fmt, ...)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = netdev_err(ndev, "%pV", &vaf);
+        trace_wil6210_log_err(&vaf);
+        va_end(args);
+
+        return ret;
+}
+
+int wil_info(struct wil6210_priv *wil, const char *fmt, ...)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = netdev_info(ndev, "%pV", &vaf);
+        trace_wil6210_log_info(&vaf);
+        va_end(args);
+
+        return ret;
+}
+
+int wil_dbg_trace(struct wil6210_priv *wil, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        trace_wil6210_log_dbg(&vaf);
+        va_end(args);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 727b1f53e6ad..e8308ec30970 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -418,9 +418,15 @@ static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
                 if (skb) {
                         unsigned char printbuf[16 * 3 + 2];
                         int i = 0;
-                        int len = skb_headlen(skb);
+                        int len = le16_to_cpu(d->dma.length);
                         void *p = skb->data;
 
+                        if (len != skb_headlen(skb)) {
+                                seq_printf(s, "!!! len: desc = %d skb = %d\n",
+                                           len, skb_headlen(skb));
+                                len = min_t(int, len, skb_headlen(skb));
+                        }
+
                         seq_printf(s, "    len = %d\n", len);
 
                         while (i < len) {
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index e3c1e7684f9c..8205d3e4ab66 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -17,6 +17,7 @@
 #include <linux/interrupt.h>
 
 #include "wil6210.h"
+#include "trace.h"
 
 /**
  * Theory of operation:
@@ -103,14 +104,14 @@ static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
         clear_bit(wil_status_irqen, &wil->status);
 }
 
-static void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
+void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
 {
         iowrite32(WIL6210_IMC_TX, wil->csr +
                   HOSTADDR(RGF_DMA_EP_TX_ICR) +
                   offsetof(struct RGF_ICR, IMC));
 }
 
-static void wil6210_unmask_irq_rx(struct wil6210_priv *wil)
+void wil6210_unmask_irq_rx(struct wil6210_priv *wil)
 {
         iowrite32(WIL6210_IMC_RX, wil->csr +
                   HOSTADDR(RGF_DMA_EP_RX_ICR) +
@@ -168,6 +169,7 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
                                          HOSTADDR(RGF_DMA_EP_RX_ICR) +
                                          offsetof(struct RGF_ICR, ICR));
 
+        trace_wil6210_irq_rx(isr);
         wil_dbg_irq(wil, "ISR RX 0x%08x\n", isr);
 
         if (!isr) {
@@ -180,13 +182,14 @@ static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
         if (isr & BIT_DMA_EP_RX_ICR_RX_DONE) {
                 wil_dbg_irq(wil, "RX done\n");
                 isr &= ~BIT_DMA_EP_RX_ICR_RX_DONE;
-                wil_rx_handle(wil);
+                wil_dbg_txrx(wil, "NAPI schedule\n");
+                napi_schedule(&wil->napi_rx);
         }
 
         if (isr)
                 wil_err(wil, "un-handled RX ISR bits 0x%08x\n", isr);
 
-        wil6210_unmask_irq_rx(wil);
+        /* Rx IRQ will be enabled when NAPI processing finished */
 
         return IRQ_HANDLED;
 }
@@ -198,6 +201,7 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
                                          HOSTADDR(RGF_DMA_EP_TX_ICR) +
                                          offsetof(struct RGF_ICR, ICR));
 
+        trace_wil6210_irq_tx(isr);
         wil_dbg_irq(wil, "ISR TX 0x%08x\n", isr);
 
         if (!isr) {
@@ -208,23 +212,17 @@ static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
         wil6210_mask_irq_tx(wil);
 
         if (isr & BIT_DMA_EP_TX_ICR_TX_DONE) {
-                uint i;
                 wil_dbg_irq(wil, "TX done\n");
+                napi_schedule(&wil->napi_tx);
                 isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
-                for (i = 0; i < 24; i++) {
-                        u32 mask = BIT_DMA_EP_TX_ICR_TX_DONE_N(i);
-                        if (isr & mask) {
-                                isr &= ~mask;
-                                wil_dbg_irq(wil, "TX done(%i)\n", i);
-                                wil_tx_complete(wil, i);
-                        }
-                }
+                /* clear also all VRING interrupts */
+                isr &= ~(BIT(25) - 1UL);
         }
 
         if (isr)
                 wil_err(wil, "un-handled TX ISR bits 0x%08x\n", isr);
 
-        wil6210_unmask_irq_tx(wil);
+        /* Tx IRQ will be enabled when NAPI processing finished */
 
         return IRQ_HANDLED;
 }
@@ -256,6 +254,7 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
                                          HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                                          offsetof(struct RGF_ICR, ICR));
 
+        trace_wil6210_irq_misc(isr);
         wil_dbg_irq(wil, "ISR MISC 0x%08x\n", isr);
 
         if (!isr) {
@@ -301,6 +300,7 @@ static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
         struct wil6210_priv *wil = cookie;
         u32 isr = wil->isr_misc;
 
+        trace_wil6210_irq_misc_thread(isr);
         wil_dbg_irq(wil, "Thread ISR MISC 0x%08x\n", isr);
 
         if (isr & ISR_MISC_FW_ERROR) {
@@ -408,6 +408,7 @@ static irqreturn_t wil6210_hardirq(int irq, void *cookie)
         if (wil6210_debug_irq_mask(wil, pseudo_cause))
                 return IRQ_NONE;
 
+        trace_wil6210_irq_pseudo(pseudo_cause);
         wil_dbg_irq(wil, "Pseudo IRQ 0x%08x\n", pseudo_cause);
 
         wil6210_mask_irq_pseudo(wil);
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index a0478e2f6868..c97b864667c5 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -56,27 +56,21 @@ static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
 {
         uint i;
         struct net_device *ndev = wil_to_ndev(wil);
-        struct wireless_dev *wdev = wil->wdev;
 
         wil_dbg_misc(wil, "%s()\n", __func__);
 
         wil_link_off(wil);
-        clear_bit(wil_status_fwconnected, &wil->status);
-
-        switch (wdev->sme_state) {
-        case CFG80211_SME_CONNECTED:
-                cfg80211_disconnected(ndev, WLAN_STATUS_UNSPECIFIED_FAILURE,
+        if (test_bit(wil_status_fwconnected, &wil->status)) {
+                clear_bit(wil_status_fwconnected, &wil->status);
+                cfg80211_disconnected(ndev,
+                                      WLAN_STATUS_UNSPECIFIED_FAILURE,
                                       NULL, 0, GFP_KERNEL);
-                break;
-        case CFG80211_SME_CONNECTING:
+        } else if (test_bit(wil_status_fwconnecting, &wil->status)) {
                 cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
                                         WLAN_STATUS_UNSPECIFIED_FAILURE,
                                         GFP_KERNEL);
-                break;
-        default:
-                break;
         }
-
+        clear_bit(wil_status_fwconnecting, &wil->status);
         for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++)
                 wil_vring_fini_tx(wil, i);
 
@@ -365,6 +359,9 @@ static int __wil_up(struct wil6210_priv *wil)
         /* Rx VRING. After MAC and beacon */
         wil_rx_init(wil);
 
+        napi_enable(&wil->napi_rx);
+        napi_enable(&wil->napi_tx);
+
         return 0;
 }
 
@@ -381,6 +378,9 @@ int wil_up(struct wil6210_priv *wil)
 
 static int __wil_down(struct wil6210_priv *wil)
 {
+        napi_disable(&wil->napi_rx);
+        napi_disable(&wil->napi_tx);
+
         if (wil->scan_request) {
                 cfg80211_scan_done(wil->scan_request, true);
                 wil->scan_request = NULL;
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 098a8ec6b841..29dd1e58cb17 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -40,6 +40,55 @@ static const struct net_device_ops wil_netdev_ops = {
         .ndo_validate_addr      = eth_validate_addr,
 };
 
+static int wil6210_netdev_poll_rx(struct napi_struct *napi, int budget)
+{
+        struct wil6210_priv *wil = container_of(napi, struct wil6210_priv,
+                                                napi_rx);
+        int quota = budget;
+        int done;
+
+        wil_rx_handle(wil, &quota);
+        done = budget - quota;
+
+        if (done <= 1) { /* burst ends - only one packet processed */
+                napi_complete(napi);
+                wil6210_unmask_irq_rx(wil);
+                wil_dbg_txrx(wil, "NAPI RX complete\n");
+        }
+
+        wil_dbg_txrx(wil, "NAPI RX poll(%d) done %d\n", budget, done);
+
+        return done;
+}
+
+static int wil6210_netdev_poll_tx(struct napi_struct *napi, int budget)
+{
+        struct wil6210_priv *wil = container_of(napi, struct wil6210_priv,
+                                                napi_tx);
+        int tx_done = 0;
+        uint i;
+
+        /* always process ALL Tx complete, regardless budget - it is fast */
+        for (i = 0; i < WIL6210_MAX_TX_RINGS; i++) {
+                struct vring *vring = &wil->vring_tx[i];
+
+                if (!vring->va)
+                        continue;
+
+                tx_done += wil_tx_complete(wil, i);
+        }
+
+        if (tx_done <= 1) { /* burst ends - only one packet processed */
+                napi_complete(napi);
+                wil6210_unmask_irq_tx(wil);
+                wil_dbg_txrx(wil, "NAPI TX complete\n");
+        }
+
+        wil_dbg_txrx(wil, "NAPI TX poll(%d) done %d\n", budget, tx_done);
+
+        return min(tx_done, budget);
+}
+
 void *wil_if_alloc(struct device *dev, void __iomem *csr)
 {
         struct net_device *ndev;
@@ -81,6 +130,11 @@ void *wil_if_alloc(struct device *dev, void __iomem *csr)
         SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
         wdev->netdev = ndev;
 
+        netif_napi_add(ndev, &wil->napi_rx, wil6210_netdev_poll_rx,
+                       WIL6210_NAPI_BUDGET);
+        netif_napi_add(ndev, &wil->napi_tx, wil6210_netdev_poll_tx,
+                       WIL6210_NAPI_BUDGET);
+
         wil_link_off(wil);
 
         return wil;
diff --git a/drivers/net/wireless/ath/wil6210/trace.c b/drivers/net/wireless/ath/wil6210/trace.c
new file mode 100644
index 000000000000..cd2534b9c5aa
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/trace.c
@@ -0,0 +1,20 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+
+#define CREATE_TRACE_POINTS
+#include "trace.h"
diff --git a/drivers/net/wireless/ath/wil6210/trace.h b/drivers/net/wireless/ath/wil6210/trace.h
new file mode 100644
index 000000000000..eff1239be53a
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/trace.h
@@ -0,0 +1,235 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM wil6210
+#if !defined(WIL6210_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+#define WIL6210_TRACE_H
+
+#include <linux/tracepoint.h>
+#include "wil6210.h"
+#include "txrx.h"
+
+/* create empty functions when tracing is disabled */
+#if !defined(CONFIG_WIL6210_TRACING) || defined(__CHECKER__)
+
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif /* !CONFIG_WIL6210_TRACING || defined(__CHECKER__) */
+
+DECLARE_EVENT_CLASS(wil6210_wmi,
+        TP_PROTO(u16 id, void *buf, u16 buf_len),
+
+        TP_ARGS(id, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(u16, id)
+                __field(u16, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->id = id;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "id 0x%04x len %d",
+                __entry->id, __entry->buf_len
+        )
+);
+
+DEFINE_EVENT(wil6210_wmi, wil6210_wmi_cmd,
+        TP_PROTO(u16 id, void *buf, u16 buf_len),
+        TP_ARGS(id, buf, buf_len)
+);
+
+DEFINE_EVENT(wil6210_wmi, wil6210_wmi_event,
+        TP_PROTO(u16 id, void *buf, u16 buf_len),
+        TP_ARGS(id, buf, buf_len)
+);
+
+#define WIL6210_MSG_MAX (200)
+
+DECLARE_EVENT_CLASS(wil6210_log_event,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf),
+        TP_STRUCT__entry(
+                __dynamic_array(char, msg, WIL6210_MSG_MAX)
+        ),
+        TP_fast_assign(
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       WIL6210_MSG_MAX,
+                                       vaf->fmt,
+                                       *vaf->va) >= WIL6210_MSG_MAX);
+        ),
+        TP_printk("%s", __get_str(msg))
+);
+
+DEFINE_EVENT(wil6210_log_event, wil6210_log_err,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(wil6210_log_event, wil6210_log_info,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(wil6210_log_event, wil6210_log_dbg,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf)
+);
+
+#define wil_pseudo_irq_cause(x) __print_flags(x, "|",   \
+        {BIT_DMA_PSEUDO_CAUSE_RX,       "Rx" },         \
+        {BIT_DMA_PSEUDO_CAUSE_TX,       "Tx" },         \
+        {BIT_DMA_PSEUDO_CAUSE_MISC,     "Misc" })
+
+TRACE_EVENT(wil6210_irq_pseudo,
+        TP_PROTO(u32 x),
+        TP_ARGS(x),
+        TP_STRUCT__entry(
+                __field(u32, x)
+        ),
+        TP_fast_assign(
+                __entry->x = x;
+        ),
+        TP_printk("cause 0x%08x : %s", __entry->x,
+                  wil_pseudo_irq_cause(__entry->x))
+);
+
+DECLARE_EVENT_CLASS(wil6210_irq,
+        TP_PROTO(u32 x),
+        TP_ARGS(x),
+        TP_STRUCT__entry(
+                __field(u32, x)
+        ),
+        TP_fast_assign(
+                __entry->x = x;
+        ),
+        TP_printk("cause 0x%08x", __entry->x)
+);
+
+DEFINE_EVENT(wil6210_irq, wil6210_irq_rx,
+        TP_PROTO(u32 x),
+        TP_ARGS(x)
+);
+
+DEFINE_EVENT(wil6210_irq, wil6210_irq_tx,
+        TP_PROTO(u32 x),
+        TP_ARGS(x)
+);
+
+DEFINE_EVENT(wil6210_irq, wil6210_irq_misc,
+        TP_PROTO(u32 x),
+        TP_ARGS(x)
+);
+
+DEFINE_EVENT(wil6210_irq, wil6210_irq_misc_thread,
+        TP_PROTO(u32 x),
+        TP_ARGS(x)
+);
+
+TRACE_EVENT(wil6210_rx,
+        TP_PROTO(u16 index, struct vring_rx_desc *d),
+        TP_ARGS(index, d),
+        TP_STRUCT__entry(
+                __field(u16, index)
+                __field(unsigned int, len)
+                __field(u8, mid)
+                __field(u8, cid)
+                __field(u8, tid)
+                __field(u8, type)
+                __field(u8, subtype)
+                __field(u16, seq)
+                __field(u8, mcs)
+        ),
+        TP_fast_assign(
+                __entry->index = index;
+                __entry->len = d->dma.length;
+                __entry->mid = wil_rxdesc_mid(d);
+                __entry->cid = wil_rxdesc_cid(d);
+                __entry->tid = wil_rxdesc_tid(d);
+                __entry->type = wil_rxdesc_ftype(d);
+                __entry->subtype = wil_rxdesc_subtype(d);
+                __entry->seq = wil_rxdesc_seq(d);
+                __entry->mcs = wil_rxdesc_mcs(d);
+        ),
+        TP_printk("index %d len %d mid %d cid %d tid %d mcs %d seq 0x%03x"
+                  " type 0x%1x subtype 0x%1x", __entry->index, __entry->len,
+                  __entry->mid, __entry->cid, __entry->tid, __entry->mcs,
+                  __entry->seq, __entry->type, __entry->subtype)
+);
+
+TRACE_EVENT(wil6210_tx,
+        TP_PROTO(u8 vring, u16 index, unsigned int len, u8 frags),
+        TP_ARGS(vring, index, len, frags),
+        TP_STRUCT__entry(
+                __field(u8, vring)
+                __field(u8, frags)
+                __field(u16, index)
+                __field(unsigned int, len)
+        ),
+        TP_fast_assign(
+                __entry->vring = vring;
+                __entry->frags = frags;
+                __entry->index = index;
+                __entry->len = len;
+        ),
+        TP_printk("vring %d index %d len %d frags %d",
+                  __entry->vring, __entry->index, __entry->len, __entry->frags)
+);
+
+TRACE_EVENT(wil6210_tx_done,
+        TP_PROTO(u8 vring, u16 index, unsigned int len, u8 err),
+        TP_ARGS(vring, index, len, err),
+        TP_STRUCT__entry(
+                __field(u8, vring)
+                __field(u8, err)
+                __field(u16, index)
+                __field(unsigned int, len)
+        ),
+        TP_fast_assign(
+                __entry->vring = vring;
+                __entry->index = index;
+                __entry->len = len;
+                __entry->err = err;
+        ),
+        TP_printk("vring %d index %d len %d err 0x%02x",
+                  __entry->vring, __entry->index, __entry->len,
+                  __entry->err)
+);
+
+#endif /* WIL6210_TRACE_H || TRACE_HEADER_MULTI_READ*/
+
+#if defined(CONFIG_WIL6210_TRACING) && !defined(__CHECKER__)
+/* we don't want to use include/trace/events */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
+#endif /* defined(CONFIG_WIL6210_TRACING) && !defined(__CHECKER__) */
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 797024507c71..00dffeda983e 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -22,6 +22,7 @@
 #include "wil6210.h"
 #include "wmi.h"
 #include "txrx.h"
+#include "trace.h"
 
 static bool rtap_include_phy_info;
 module_param(rtap_include_phy_info, bool, S_IRUGO);
@@ -89,8 +90,8 @@ static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
          * we can use any
          */
         for (i = 0; i < vring->size; i++) {
-                volatile struct vring_tx_desc *d = &(vring->va[i].tx);
-                d->dma.status = TX_DMA_STATUS_DU;
+                volatile struct vring_tx_desc *_d = &(vring->va[i].tx);
+                _d->dma.status = TX_DMA_STATUS_DU;
         }
 
         wil_dbg_misc(wil, "vring[%d] 0x%p:0x%016llx 0x%p\n", vring->size,
@@ -106,30 +107,39 @@ static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
         size_t sz = vring->size * sizeof(vring->va[0]);
 
         while (!wil_vring_is_empty(vring)) {
+                dma_addr_t pa;
+                struct sk_buff *skb;
+                u16 dmalen;
+
                 if (tx) {
-                        volatile struct vring_tx_desc *d =
+                        struct vring_tx_desc dd, *d = &dd;
+                        volatile struct vring_tx_desc *_d =
                                         &vring->va[vring->swtail].tx;
-                        dma_addr_t pa = d->dma.addr_low |
-                                        ((u64)d->dma.addr_high << 32);
-                        struct sk_buff *skb = vring->ctx[vring->swtail];
+
+                        *d = *_d;
+                        pa = wil_desc_addr(&d->dma.addr);
+                        dmalen = le16_to_cpu(d->dma.length);
+                        skb = vring->ctx[vring->swtail];
                         if (skb) {
-                                dma_unmap_single(dev, pa, d->dma.length,
+                                dma_unmap_single(dev, pa, dmalen,
                                                  DMA_TO_DEVICE);
                                 dev_kfree_skb_any(skb);
                                 vring->ctx[vring->swtail] = NULL;
                         } else {
-                                dma_unmap_page(dev, pa, d->dma.length,
+                                dma_unmap_page(dev, pa, dmalen,
                                                DMA_TO_DEVICE);
                         }
                         vring->swtail = wil_vring_next_tail(vring);
                 } else { /* rx */
-                        volatile struct vring_rx_desc *d =
+                        struct vring_rx_desc dd, *d = &dd;
+                        volatile struct vring_rx_desc *_d =
                                         &vring->va[vring->swtail].rx;
-                        dma_addr_t pa = d->dma.addr_low |
-                                        ((u64)d->dma.addr_high << 32);
-                        struct sk_buff *skb = vring->ctx[vring->swhead];
-                        dma_unmap_single(dev, pa, d->dma.length,
-                                         DMA_FROM_DEVICE);
+
+                        *d = *_d;
+                        pa = wil_desc_addr(&d->dma.addr);
+                        dmalen = le16_to_cpu(d->dma.length);
+                        skb = vring->ctx[vring->swhead];
+                        dma_unmap_single(dev, pa, dmalen, DMA_FROM_DEVICE);
                         kfree_skb(skb);
                         wil_vring_advance_head(vring, 1);
                 }
@@ -151,7 +161,8 @@ static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
 {
         struct device *dev = wil_to_dev(wil);
         unsigned int sz = RX_BUF_LEN;
-        volatile struct vring_rx_desc *d = &(vring->va[i].rx);
+        struct vring_rx_desc dd, *d = &dd;
+        volatile struct vring_rx_desc *_d = &(vring->va[i].rx);
         dma_addr_t pa;
 
         /* TODO align */
@@ -169,13 +180,13 @@ static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
         }
 
         d->dma.d0 = BIT(9) | RX_DMA_D0_CMD_DMA_IT;
-        d->dma.addr_low = lower_32_bits(pa);
-        d->dma.addr_high = (u16)upper_32_bits(pa);
+        wil_desc_addr_set(&d->dma.addr, pa);
         /* ip_length don't care */
         /* b11 don't care */
         /* error don't care */
         d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
-        d->dma.length = sz;
+        d->dma.length = cpu_to_le16(sz);
+        *_d = *d;
         vring->ctx[i] = skb;
 
         return 0;
@@ -321,11 +332,12 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
 {
         struct device *dev = wil_to_dev(wil);
         struct net_device *ndev = wil_to_ndev(wil);
-        volatile struct vring_rx_desc *d;
-        struct vring_rx_desc *d1;
+        volatile struct vring_rx_desc *_d;
+        struct vring_rx_desc *d;
         struct sk_buff *skb;
         dma_addr_t pa;
         unsigned int sz = RX_BUF_LEN;
+        u16 dmalen;
         u8 ftype;
         u8 ds_bits;
 
@@ -334,32 +346,44 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
         if (wil_vring_is_empty(vring))
                 return NULL;
 
-        d = &(vring->va[vring->swhead].rx);
-        if (!(d->dma.status & RX_DMA_STATUS_DU)) {
+        _d = &(vring->va[vring->swhead].rx);
+        if (!(_d->dma.status & RX_DMA_STATUS_DU)) {
                 /* it is not error, we just reached end of Rx done area */
                 return NULL;
         }
 
-        pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
         skb = vring->ctx[vring->swhead];
+        d = wil_skb_rxdesc(skb);
+        *d = *_d;
+        pa = wil_desc_addr(&d->dma.addr);
+        vring->ctx[vring->swhead] = NULL;
+        wil_vring_advance_head(vring, 1);
+
         dma_unmap_single(dev, pa, sz, DMA_FROM_DEVICE);
-        skb_trim(skb, d->dma.length);
+        dmalen = le16_to_cpu(d->dma.length);
 
-        d1 = wil_skb_rxdesc(skb);
-        *d1 = *d;
+        trace_wil6210_rx(vring->swhead, d);
+        wil_dbg_txrx(wil, "Rx[%3d] : %d bytes\n", vring->swhead, dmalen);
+        wil_hex_dump_txrx("Rx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
 
-        wil->stats.last_mcs_rx = wil_rxdesc_mcs(d1);
+        if (dmalen > sz) {
+                wil_err(wil, "Rx size too large: %d bytes!\n", dmalen);
+                kfree_skb(skb);
+                return NULL;
+        }
+        skb_trim(skb, dmalen);
+
+        wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
+                          skb->data, skb_headlen(skb), false);
+
+
+        wil->stats.last_mcs_rx = wil_rxdesc_mcs(d);
 
         /* use radiotap header only if required */
         if (ndev->type == ARPHRD_IEEE80211_RADIOTAP)
                 wil_rx_add_radiotap_header(wil, skb);
 
-        wil_dbg_txrx(wil, "Rx[%3d] : %d bytes\n", vring->swhead, d->dma.length);
-        wil_hex_dump_txrx("Rx ", DUMP_PREFIX_NONE, 32, 4,
-                          (const void *)d, sizeof(*d), false);
-
-        wil_vring_advance_head(vring, 1);
-
         /* no extra checks if in sniffer mode */
         if (ndev->type != ARPHRD_ETHER)
                 return skb;
@@ -368,7 +392,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
          * Driver should recognize it by frame type, that is found
          * in Rx descriptor. If type is not data, it is 802.11 frame as is
          */
-        ftype = wil_rxdesc_ftype(d1) << 2;
+        ftype = wil_rxdesc_ftype(d) << 2;
         if (ftype != IEEE80211_FTYPE_DATA) {
                 wil_dbg_txrx(wil, "Non-data frame ftype 0x%08x\n", ftype);
                 /* TODO: process it */
@@ -383,7 +407,7 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
                 return NULL;
         }
 
-        ds_bits = wil_rxdesc_ds_bits(d1);
+        ds_bits = wil_rxdesc_ds_bits(d);
         if (ds_bits == 1) {
                 /*
                  * HW bug - in ToDS mode, i.e. Rx on AP side,
@@ -425,6 +449,7 @@ static int wil_rx_refill(struct wil6210_priv *wil, int count)
 
 /*
  * Pass Rx packet to the netif. Update statistics.
+ * Called in softirq context (NAPI poll).
  */
 static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 {
@@ -433,10 +458,7 @@ static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 
         skb_orphan(skb);
 
-        if (in_interrupt())
-                rc = netif_rx(skb);
-        else
-                rc = netif_rx_ni(skb);
+        rc = netif_receive_skb(skb);
 
         if (likely(rc == NET_RX_SUCCESS)) {
                 ndev->stats.rx_packets++;
@@ -450,9 +472,9 @@ static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
 /**
  * Proceed all completed skb's from Rx VRING
  *
- * Safe to call from IRQ
+ * Safe to call from NAPI poll, i.e. softirq with interrupts enabled
  */
-void wil_rx_handle(struct wil6210_priv *wil)
+void wil_rx_handle(struct wil6210_priv *wil, int *quota)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct vring *v = &wil->vring_rx;
@@ -463,9 +485,8 @@ void wil_rx_handle(struct wil6210_priv *wil)
                 return;
         }
         wil_dbg_txrx(wil, "%s()\n", __func__);
-        while (NULL != (skb = wil_vring_reap_rx(wil, v))) {
-                wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
-                                  skb->data, skb_headlen(skb), false);
+        while ((*quota > 0) && (NULL != (skb = wil_vring_reap_rx(wil, v)))) {
+                (*quota)--;
 
                 if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
                         skb->dev = ndev;
@@ -600,17 +621,15 @@ static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
         return NULL;
 }
 
-static int wil_tx_desc_map(volatile struct vring_tx_desc *d,
-                           dma_addr_t pa, u32 len)
+static int wil_tx_desc_map(struct vring_tx_desc *d, dma_addr_t pa, u32 len)
 {
-        d->dma.addr_low = lower_32_bits(pa);
-        d->dma.addr_high = (u16)upper_32_bits(pa);
+        wil_desc_addr_set(&d->dma.addr, pa);
         d->dma.ip_length = 0;
         /* 0..6: mac_length; 7:ip_version 0-IP6 1-IP4*/
         d->dma.b11 = 0/*14 | BIT(7)*/;
         d->dma.error = 0;
         d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
-        d->dma.length = len;
+        d->dma.length = cpu_to_le16((u16)len);
         d->dma.d0 = 0;
         d->mac.d[0] = 0;
         d->mac.d[1] = 0;
@@ -630,7 +649,8 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                         struct sk_buff *skb)
 {
         struct device *dev = wil_to_dev(wil);
-        volatile struct vring_tx_desc *d;
+        struct vring_tx_desc dd, *d = &dd;
+        volatile struct vring_tx_desc *_d;
         u32 swhead = vring->swhead;
         int avail = wil_vring_avail_tx(vring);
         int nr_frags = skb_shinfo(skb)->nr_frags;
@@ -648,7 +668,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
                         1 + nr_frags);
                 return -ENOMEM;
         }
-        d = &(vring->va[i].tx);
+        _d = &(vring->va[i].tx);
 
         /* FIXME FW can accept only unicast frames for the peer */
         memcpy(skb->data, wil->dst_addr[vring_index], ETH_ALEN);
@@ -667,25 +687,30 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         wil_tx_desc_map(d, pa, skb_headlen(skb));
         d->mac.d[2] |= ((nr_frags + 1) <<
                        MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+        if (nr_frags)
+                *_d = *d;
+
         /* middle segments */
         for (f = 0; f < nr_frags; f++) {
                 const struct skb_frag_struct *frag =
                                 &skb_shinfo(skb)->frags[f];
                 int len = skb_frag_size(frag);
                 i = (swhead + f + 1) % vring->size;
-                d = &(vring->va[i].tx);
+                _d = &(vring->va[i].tx);
                 pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
                                 DMA_TO_DEVICE);
                 if (unlikely(dma_mapping_error(dev, pa)))
                         goto dma_error;
                 wil_tx_desc_map(d, pa, len);
                 vring->ctx[i] = NULL;
+                *_d = *d;
         }
         /* for the last seg only */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
         d->dma.d0 |= BIT(9); /* BUG: undocumented bit */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
         d->dma.d0 |= (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
+        *_d = *d;
 
         wil_hex_dump_txrx("Tx ", DUMP_PREFIX_NONE, 32, 4,
                           (const void *)d, sizeof(*d), false);
@@ -693,6 +718,7 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         /* advance swhead */
         wil_vring_advance_head(vring, nr_frags + 1);
         wil_dbg_txrx(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        trace_wil6210_tx(vring_index, swhead, skb->len, nr_frags);
         iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
         /* hold reference to skb
          * to prevent skb release before accounting
@@ -705,14 +731,18 @@ static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
         /* unmap what we have mapped */
         /* Note: increment @f to operate with positive index */
         for (f++; f > 0; f--) {
+                u16 dmalen;
+
                 i = (swhead + f) % vring->size;
-                d = &(vring->va[i].tx);
-                d->dma.status = TX_DMA_STATUS_DU;
-                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                _d = &(vring->va[i].tx);
+                *d = *_d;
+                _d->dma.status = TX_DMA_STATUS_DU;
+                pa = wil_desc_addr(&d->dma.addr);
+                dmalen = le16_to_cpu(d->dma.length);
                 if (vring->ctx[i])
-                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dma_unmap_single(dev, pa, dmalen, DMA_TO_DEVICE);
                 else
-                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dma_unmap_page(dev, pa, dmalen, DMA_TO_DEVICE);
         }
 
         return -EINVAL;
@@ -761,7 +791,6 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 break; /* goto drop; */
         }
  drop:
-        netif_tx_stop_all_queues(ndev);
         ndev->stats.tx_dropped++;
         dev_kfree_skb_any(skb);
 
@@ -771,41 +800,48 @@ netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 /**
  * Clean up transmitted skb's from the Tx VRING
  *
+ * Return number of descriptors cleared
+ *
  * Safe to call from IRQ
  */
-void wil_tx_complete(struct wil6210_priv *wil, int ringid)
+int wil_tx_complete(struct wil6210_priv *wil, int ringid)
 {
         struct net_device *ndev = wil_to_ndev(wil);
         struct device *dev = wil_to_dev(wil);
         struct vring *vring = &wil->vring_tx[ringid];
+        int done = 0;
 
         if (!vring->va) {
                 wil_err(wil, "Tx irq[%d]: vring not initialized\n", ringid);
-                return;
+                return 0;
         }
 
         wil_dbg_txrx(wil, "%s(%d)\n", __func__, ringid);
 
         while (!wil_vring_is_empty(vring)) {
-                volatile struct vring_tx_desc *d1 =
+                volatile struct vring_tx_desc *_d =
                                               &vring->va[vring->swtail].tx;
                 struct vring_tx_desc dd, *d = &dd;
                 dma_addr_t pa;
                 struct sk_buff *skb;
+                u16 dmalen;
 
-                dd = *d1;
+                *d = *_d;
 
                 if (!(d->dma.status & TX_DMA_STATUS_DU))
                         break;
 
+                dmalen = le16_to_cpu(d->dma.length);
+                trace_wil6210_tx_done(ringid, vring->swtail, dmalen,
+                                      d->dma.error);
                 wil_dbg_txrx(wil,
                              "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
-                             vring->swtail, d->dma.length, d->dma.status,
+                             vring->swtail, dmalen, d->dma.status,
                              d->dma.error);
                 wil_hex_dump_txrx("TxC ", DUMP_PREFIX_NONE, 32, 4,
                                   (const void *)d, sizeof(*d), false);
 
-                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                pa = wil_desc_addr(&d->dma.addr);
                 skb = vring->ctx[vring->swtail];
                 if (skb) {
                         if (d->dma.error == 0) {
@@ -815,18 +851,21 @@ void wil_tx_complete(struct wil6210_priv *wil, int ringid)
                                 ndev->stats.tx_errors++;
                         }
 
-                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dma_unmap_single(dev, pa, dmalen, DMA_TO_DEVICE);
                         dev_kfree_skb_any(skb);
                         vring->ctx[vring->swtail] = NULL;
                 } else {
-                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dma_unmap_page(dev, pa, dmalen, DMA_TO_DEVICE);
                 }
-                d->dma.addr_low = 0;
-                d->dma.addr_high = 0;
+                d->dma.addr.addr_low = 0;
+                d->dma.addr.addr_high = 0;
                 d->dma.length = 0;
                 d->dma.status = TX_DMA_STATUS_DU;
                 vring->swtail = wil_vring_next_tail(vring);
+                done++;
         }
         if (wil_vring_avail_tx(vring) > vring->size/4)
                 netif_tx_wake_all_queues(wil_to_ndev(wil));
+
+        return done;
 }
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
index adef12fb2aee..23c0781cdb93 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.h
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -27,6 +27,28 @@
 #define WIL6210_RTAP_SIZE (128)
 
 /* Tx/Rx path */
+
+/*
+ * Common representation of physical address in Vring
+ */
+struct vring_dma_addr {
+        __le32 addr_low;
+        __le16 addr_high;
+} __packed;
+
+static inline dma_addr_t wil_desc_addr(struct vring_dma_addr *addr)
+{
+        return le32_to_cpu(addr->addr_low) |
+                           ((u64)le16_to_cpu(addr->addr_high) << 32);
+}
+
+static inline void wil_desc_addr_set(struct vring_dma_addr *addr,
+                                     dma_addr_t pa)
+{
+        addr->addr_low = cpu_to_le32(lower_32_bits(pa));
+        addr->addr_high = cpu_to_le16((u16)upper_32_bits(pa));
+}
+
 /*
  * Tx descriptor - MAC part
  * [dword 0]
@@ -216,13 +238,12 @@ struct vring_tx_mac {
 
 struct vring_tx_dma {
         u32 d0;
-        u32 addr_low;
-        u16 addr_high;
+        struct vring_dma_addr addr;
         u8  ip_length;
         u8  b11;       /* 0..6: mac_length; 7:ip_version */
         u8  error;     /* 0..2: err; 3..7: reserved; */
         u8  status;    /* 0: used; 1..7; reserved */
-        u16 length;
+        __le16 length;
 } __packed;
 
 /*
@@ -315,13 +336,12 @@ struct vring_rx_mac {
 
 struct vring_rx_dma {
         u32 d0;
-        u32 addr_low;
-        u16 addr_high;
+        struct vring_dma_addr addr;
         u8  ip_length;
         u8  b11;
         u8  error;
         u8  status;
-        u16 length;
+        __le16 length;
 } __packed;
 
 struct vring_tx_desc {
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index 8f76ecd8a7e5..373cf656f5b0 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -34,9 +34,11 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 
 #define WIL6210_MEM_SIZE (2*1024*1024UL)
 
-#define WIL6210_RX_RING_SIZE (128)
-#define WIL6210_TX_RING_SIZE (128)
-#define WIL6210_MAX_TX_RINGS (24)
+#define WIL6210_RX_RING_SIZE    (128)
+#define WIL6210_TX_RING_SIZE    (128)
+#define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
+#define WIL6210_MAX_CID         (8) /* HW limit */
+#define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
 
 /* Hardware definitions begin */
 
@@ -184,6 +186,7 @@ struct vring {
 
 enum { /* for wil6210_priv.status */
         wil_status_fwready = 0,
+        wil_status_fwconnecting,
         wil_status_fwconnected,
         wil_status_dontscan,
         wil_status_reset_done,
@@ -239,6 +242,8 @@ struct wil6210_priv {
          * - consumed in thread by wmi_event_worker
          */
         spinlock_t wmi_ev_lock;
+        struct napi_struct napi_rx;
+        struct napi_struct napi_tx;
         /* DMA related */
         struct vring vring_rx;
         struct vring vring_tx[WIL6210_MAX_TX_RINGS];
@@ -267,9 +272,13 @@ struct wil6210_priv {
 #define wil_to_ndev(i) (wil_to_wdev(i)->netdev)
 #define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
 
-#define wil_dbg(wil, fmt, arg...) netdev_dbg(wil_to_ndev(wil), fmt, ##arg)
-#define wil_info(wil, fmt, arg...) netdev_info(wil_to_ndev(wil), fmt, ##arg)
-#define wil_err(wil, fmt, arg...) netdev_err(wil_to_ndev(wil), fmt, ##arg)
+int wil_dbg_trace(struct wil6210_priv *wil, const char *fmt, ...);
+int wil_err(struct wil6210_priv *wil, const char *fmt, ...);
+int wil_info(struct wil6210_priv *wil, const char *fmt, ...);
+#define wil_dbg(wil, fmt, arg...) do { \
+        netdev_dbg(wil_to_ndev(wil), fmt, ##arg); \
+        wil_dbg_trace(wil, fmt, ##arg); \
+} while (0)
 
 #define wil_dbg_irq(wil, fmt, arg...) wil_dbg(wil, "DBG[ IRQ]" fmt, ##arg)
 #define wil_dbg_txrx(wil, fmt, arg...) wil_dbg(wil, "DBG[TXRX]" fmt, ##arg)
@@ -356,10 +365,12 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
 void wil_vring_fini_tx(struct wil6210_priv *wil, int id);
 
 netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev);
-void wil_tx_complete(struct wil6210_priv *wil, int ringid);
+int wil_tx_complete(struct wil6210_priv *wil, int ringid);
+void wil6210_unmask_irq_tx(struct wil6210_priv *wil);
 
 /* RX API */
-void wil_rx_handle(struct wil6210_priv *wil);
+void wil_rx_handle(struct wil6210_priv *wil, int *quota);
+void wil6210_unmask_irq_rx(struct wil6210_priv *wil);
 
 int wil_iftype_nl2wmi(enum nl80211_iftype type);
 
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 45b04e383f9a..527ffb543821 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -20,6 +20,7 @@
 #include "wil6210.h"
 #include "txrx.h"
 #include "wmi.h"
+#include "trace.h"
 
 /**
  * WMI event receiving - theory of operations
@@ -246,6 +247,8 @@ static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
         iowrite32(r->head = next_head, wil->csr + HOST_MBOX +
                   offsetof(struct wil6210_mbox_ctl, tx.head));
 
+        trace_wil6210_wmi_cmd(cmdid, buf, len);
+
         /* interrupt to FW */
         iowrite32(SW_INT_MBOX, wil->csr + HOST_SW_INT);
 
@@ -406,7 +409,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
         if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
             (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
-                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                if (!test_bit(wil_status_fwconnecting, &wil->status)) {
                         wil_err(wil, "Not in connecting state\n");
                         return;
                 }
@@ -430,6 +433,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
 
                 cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
         }
+        clear_bit(wil_status_fwconnecting, &wil->status);
         set_bit(wil_status_fwconnected, &wil->status);
 
         /* FIXME FW can transmit only ucast frames to peer */
@@ -635,8 +639,9 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
                             hdr.flags);
                 if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
                     (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
-                        wil_dbg_wmi(wil, "WMI event 0x%04x\n",
-                                    evt->event.wmi.id);
+                        u16 id = le16_to_cpu(evt->event.wmi.id);
+                        wil_dbg_wmi(wil, "WMI event 0x%04x\n", id);
+                        trace_wil6210_wmi_event(id, &evt->event.wmi, len);
                 }
                 wil_hex_dump_wmi("evt ", DUMP_PREFIX_OFFSET, 16, 1,
                                  &evt->event.hdr, sizeof(hdr) + len, true);
@@ -724,7 +729,7 @@ int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan)
                 .bcon_interval = cpu_to_le16(bi),
                 .network_type = wmi_nettype,
                 .disable_sec_offload = 1,
-                .channel = chan,
+                .channel = chan - 1,
         };
         struct {
                 struct wil6210_mbox_hdr_wmi wmi;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 44fa0cdbf97b..11400b39cf0b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -606,7 +606,8 @@ static int brcmf_sdio_pd_remove(struct platform_device *pdev)
 static struct platform_driver brcmf_sdio_pd = {
         .remove         = brcmf_sdio_pd_remove,
         .driver         = {
-                .name   = BRCMFMAC_SDIO_PDATA_NAME
+                .name   = BRCMFMAC_SDIO_PDATA_NAME,
+                .owner  = THIS_MODULE,
         }
 };
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
index 1585cc5bf866..bd982856d385 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/ampdu.c
@@ -900,7 +900,7 @@ brcms_c_ampdu_dotxstatus_complete(struct ampdu_info *ampdu, struct scb *scb,
                 if (supr_status) {
                         update_rate = false;
                         if (supr_status == TX_STATUS_SUPR_BADCH) {
-                                brcms_err(wlc->hw->d11core,
+                                brcms_dbg_ht(wlc->hw->d11core,
                                           "%s: Pkt tx suppressed, illegal channel possibly %d\n",
                                           __func__, CHSPEC_CHANNEL(
                                           wlc->default_bss->chanspec));
diff --git a/drivers/net/wireless/cw1200/Kconfig b/drivers/net/wireless/cw1200/Kconfig
new file mode 100644
index 000000000000..0880742eab17
--- /dev/null
+++ b/drivers/net/wireless/cw1200/Kconfig
@@ -0,0 +1,30 @@
+config CW1200
+        tristate "CW1200 WLAN support"
+        depends on MAC80211 && CFG80211
+        help
+          This is a driver for the ST-E CW1100 & CW1200 WLAN chipsets.
+          This option just enables the driver core, see below for
+          specific bus support.
+
+if CW1200
+
+config CW1200_WLAN_SDIO
+        tristate "Support SDIO platforms"
+        depends on CW1200 && MMC
+        help
+          Enable support for the CW1200 connected via an SDIO bus.
+          By default this driver only supports the Sagrad SG901-1091/1098 EVK
+          and similar designs that utilize a hardware reset circuit. To
+          support different CW1200 SDIO designs you will need to override
+          the default platform data by calling cw1200_sdio_set_platform_data()
+          in your board setup file.
+
+config CW1200_WLAN_SPI
+        tristate "Support SPI platforms"
+        depends on CW1200 && SPI
+        help
+          Enables support for the CW1200 connected via a SPI bus.  You will
+          need to add appropriate platform data glue in your board setup
+          file.
+
+endif
diff --git a/drivers/net/wireless/cw1200/Makefile b/drivers/net/wireless/cw1200/Makefile
new file mode 100644
index 000000000000..b086aac6547a
--- /dev/null
+++ b/drivers/net/wireless/cw1200/Makefile
@@ -0,0 +1,21 @@
+cw1200_core-y := \
+                fwio.o \
+                txrx.o \
+                main.o \
+                queue.o \
+                hwio.o \
+                bh.o \
+                wsm.o \
+                sta.o \
+                scan.o \
+                debug.o
+cw1200_core-$(CONFIG_PM)        += pm.o
+
+# CFLAGS_sta.o += -DDEBUG
+
+cw1200_wlan_sdio-y := cw1200_sdio.o
+cw1200_wlan_spi-y := cw1200_spi.o
+
+obj-$(CONFIG_CW1200) += cw1200_core.o
+obj-$(CONFIG_CW1200_WLAN_SDIO) += cw1200_wlan_sdio.o
+obj-$(CONFIG_CW1200_WLAN_SPI) += cw1200_wlan_spi.o
diff --git a/drivers/net/wireless/cw1200/bh.c b/drivers/net/wireless/cw1200/bh.c
new file mode 100644
index 000000000000..c1ec2a4dd8c0
--- /dev/null
+++ b/drivers/net/wireless/cw1200/bh.c
@@ -0,0 +1,619 @@
+/*
+ * Device handling thread implementation for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver, which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <net/mac80211.h>
+#include <linux/kthread.h>
+#include <linux/timer.h>
+
+#include "cw1200.h"
+#include "bh.h"
+#include "hwio.h"
+#include "wsm.h"
+#include "hwbus.h"
+#include "debug.h"
+#include "fwio.h"
+
+static int cw1200_bh(void *arg);
+
+#define DOWNLOAD_BLOCK_SIZE_WR  (0x1000 - 4)
+/* an SPI message cannot be bigger than (2"12-1)*2 bytes
+ * "*2" to cvt to bytes
+ */
+#define MAX_SZ_RD_WR_BUFFERS    (DOWNLOAD_BLOCK_SIZE_WR*2)
+#define PIGGYBACK_CTRL_REG      (2)
+#define EFFECTIVE_BUF_SIZE      (MAX_SZ_RD_WR_BUFFERS - PIGGYBACK_CTRL_REG)
+
+/* Suspend state privates */
+enum cw1200_bh_pm_state {
+        CW1200_BH_RESUMED = 0,
+        CW1200_BH_SUSPEND,
+        CW1200_BH_SUSPENDED,
+        CW1200_BH_RESUME,
+};
+
+typedef int (*cw1200_wsm_handler)(struct cw1200_common *priv,
+        u8 *data, size_t size);
+
+static void cw1200_bh_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+        container_of(work, struct cw1200_common, bh_work);
+        cw1200_bh(priv);
+}
+
+int cw1200_register_bh(struct cw1200_common *priv)
+{
+        int err = 0;
+        /* Realtime workqueue */
+        priv->bh_workqueue = alloc_workqueue("cw1200_bh",
+                                WQ_MEM_RECLAIM | WQ_HIGHPRI
+                                | WQ_CPU_INTENSIVE, 1);
+
+        if (!priv->bh_workqueue)
+                return -ENOMEM;
+
+        INIT_WORK(&priv->bh_work, cw1200_bh_work);
+
+        pr_debug("[BH] register.\n");
+
+        atomic_set(&priv->bh_rx, 0);
+        atomic_set(&priv->bh_tx, 0);
+        atomic_set(&priv->bh_term, 0);
+        atomic_set(&priv->bh_suspend, CW1200_BH_RESUMED);
+        priv->bh_error = 0;
+        priv->hw_bufs_used = 0;
+        priv->buf_id_tx = 0;
+        priv->buf_id_rx = 0;
+        init_waitqueue_head(&priv->bh_wq);
+        init_waitqueue_head(&priv->bh_evt_wq);
+
+        err = !queue_work(priv->bh_workqueue, &priv->bh_work);
+        WARN_ON(err);
+        return err;
+}
+
+void cw1200_unregister_bh(struct cw1200_common *priv)
+{
+        atomic_add(1, &priv->bh_term);
+        wake_up(&priv->bh_wq);
+
+        flush_workqueue(priv->bh_workqueue);
+
+        destroy_workqueue(priv->bh_workqueue);
+        priv->bh_workqueue = NULL;
+
+        pr_debug("[BH] unregistered.\n");
+}
+
+void cw1200_irq_handler(struct cw1200_common *priv)
+{
+        pr_debug("[BH] irq.\n");
+
+        /* Disable Interrupts! */
+        /* NOTE:  hwbus_ops->lock already held */
+        __cw1200_irq_enable(priv, 0);
+
+        if (/* WARN_ON */(priv->bh_error))
+                return;
+
+        if (atomic_add_return(1, &priv->bh_rx) == 1)
+                wake_up(&priv->bh_wq);
+}
+EXPORT_SYMBOL_GPL(cw1200_irq_handler);
+
+void cw1200_bh_wakeup(struct cw1200_common *priv)
+{
+        pr_debug("[BH] wakeup.\n");
+        if (priv->bh_error) {
+                pr_err("[BH] wakeup failed (BH error)\n");
+                return;
+        }
+
+        if (atomic_add_return(1, &priv->bh_tx) == 1)
+                wake_up(&priv->bh_wq);
+}
+
+int cw1200_bh_suspend(struct cw1200_common *priv)
+{
+        pr_debug("[BH] suspend.\n");
+        if (priv->bh_error) {
+                wiphy_warn(priv->hw->wiphy, "BH error -- can't suspend\n");
+                return -EINVAL;
+        }
+
+        atomic_set(&priv->bh_suspend, CW1200_BH_SUSPEND);
+        wake_up(&priv->bh_wq);
+        return wait_event_timeout(priv->bh_evt_wq, priv->bh_error ||
+                (CW1200_BH_SUSPENDED == atomic_read(&priv->bh_suspend)),
+                 1 * HZ) ? 0 : -ETIMEDOUT;
+}
+
+int cw1200_bh_resume(struct cw1200_common *priv)
+{
+        pr_debug("[BH] resume.\n");
+        if (priv->bh_error) {
+                wiphy_warn(priv->hw->wiphy, "BH error -- can't resume\n");
+                return -EINVAL;
+        }
+
+        atomic_set(&priv->bh_suspend, CW1200_BH_RESUME);
+        wake_up(&priv->bh_wq);
+        return wait_event_timeout(priv->bh_evt_wq, priv->bh_error ||
+                (CW1200_BH_RESUMED == atomic_read(&priv->bh_suspend)),
+                1 * HZ) ? 0 : -ETIMEDOUT;
+}
+
+static inline void wsm_alloc_tx_buffer(struct cw1200_common *priv)
+{
+        ++priv->hw_bufs_used;
+}
+
+int wsm_release_tx_buffer(struct cw1200_common *priv, int count)
+{
+        int ret = 0;
+        int hw_bufs_used = priv->hw_bufs_used;
+
+        priv->hw_bufs_used -= count;
+        if (WARN_ON(priv->hw_bufs_used < 0))
+                ret = -1;
+        else if (hw_bufs_used >= priv->wsm_caps.input_buffers)
+                ret = 1;
+        if (!priv->hw_bufs_used)
+                wake_up(&priv->bh_evt_wq);
+        return ret;
+}
+
+static int cw1200_bh_read_ctrl_reg(struct cw1200_common *priv,
+                                          u16 *ctrl_reg)
+{
+        int ret;
+
+        ret = cw1200_reg_read_16(priv,
+                        ST90TDS_CONTROL_REG_ID, ctrl_reg);
+        if (ret) {
+                ret = cw1200_reg_read_16(priv,
+                                ST90TDS_CONTROL_REG_ID, ctrl_reg);
+                if (ret)
+                        pr_err("[BH] Failed to read control register.\n");
+        }
+
+        return ret;
+}
+
+static int cw1200_device_wakeup(struct cw1200_common *priv)
+{
+        u16 ctrl_reg;
+        int ret;
+
+        pr_debug("[BH] Device wakeup.\n");
+
+        /* First, set the dpll register */
+        ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID,
+                                  cw1200_dpll_from_clk(priv->hw_refclk));
+        if (WARN_ON(ret))
+                return ret;
+
+        /* To force the device to be always-on, the host sets WLAN_UP to 1 */
+        ret = cw1200_reg_write_16(priv, ST90TDS_CONTROL_REG_ID,
+                        ST90TDS_CONT_WUP_BIT);
+        if (WARN_ON(ret))
+                return ret;
+
+        ret = cw1200_bh_read_ctrl_reg(priv, &ctrl_reg);
+        if (WARN_ON(ret))
+                return ret;
+
+        /* If the device returns WLAN_RDY as 1, the device is active and will
+         * remain active.
+         */
+        if (ctrl_reg & ST90TDS_CONT_RDY_BIT) {
+                pr_debug("[BH] Device awake.\n");
+                return 1;
+        }
+
+        return 0;
+}
+
+/* Must be called from BH thraed. */
+void cw1200_enable_powersave(struct cw1200_common *priv,
+                             bool enable)
+{
+        pr_debug("[BH] Powerave is %s.\n",
+                 enable ? "enabled" : "disabled");
+        priv->powersave_enabled = enable;
+}
+
+static int cw1200_bh_rx_helper(struct cw1200_common *priv,
+                               uint16_t *ctrl_reg,
+                               int *tx)
+{
+        size_t read_len = 0;
+        struct sk_buff *skb_rx = NULL;
+        struct wsm_hdr *wsm;
+        size_t wsm_len;
+        u16 wsm_id;
+        u8 wsm_seq;
+        int rx_resync = 1;
+
+        size_t alloc_len;
+        u8 *data;
+
+        read_len = (*ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK) * 2;
+        if (!read_len)
+                return 0; /* No more work */
+
+        if (WARN_ON((read_len < sizeof(struct wsm_hdr)) ||
+                    (read_len > EFFECTIVE_BUF_SIZE))) {
+                pr_debug("Invalid read len: %zu (%04x)",
+                         read_len, *ctrl_reg);
+                goto err;
+        }
+
+        /* Add SIZE of PIGGYBACK reg (CONTROL Reg)
+         * to the NEXT Message length + 2 Bytes for SKB
+         */
+        read_len = read_len + 2;
+
+        alloc_len = priv->hwbus_ops->align_size(
+                priv->hwbus_priv, read_len);
+
+        /* Check if not exceeding CW1200 capabilities */
+        if (WARN_ON_ONCE(alloc_len > EFFECTIVE_BUF_SIZE)) {
+                pr_debug("Read aligned len: %zu\n",
+                         alloc_len);
+        }
+
+        skb_rx = dev_alloc_skb(alloc_len);
+        if (WARN_ON(!skb_rx))
+                goto err;
+
+        skb_trim(skb_rx, 0);
+        skb_put(skb_rx, read_len);
+        data = skb_rx->data;
+        if (WARN_ON(!data))
+                goto err;
+
+        if (WARN_ON(cw1200_data_read(priv, data, alloc_len))) {
+                pr_err("rx blew up, len %zu\n", alloc_len);
+                goto err;
+        }
+
+        /* Piggyback */
+        *ctrl_reg = __le16_to_cpu(
+                ((__le16 *)data)[alloc_len / 2 - 1]);
+
+        wsm = (struct wsm_hdr *)data;
+        wsm_len = __le16_to_cpu(wsm->len);
+        if (WARN_ON(wsm_len > read_len))
+                goto err;
+
+        if (priv->wsm_enable_wsm_dumps)
+                print_hex_dump_bytes("<-- ",
+                                     DUMP_PREFIX_NONE,
+                                     data, wsm_len);
+
+        wsm_id  = __le16_to_cpu(wsm->id) & 0xFFF;
+        wsm_seq = (__le16_to_cpu(wsm->id) >> 13) & 7;
+
+        skb_trim(skb_rx, wsm_len);
+
+        if (wsm_id == 0x0800) {
+                wsm_handle_exception(priv,
+                                     &data[sizeof(*wsm)],
+                                     wsm_len - sizeof(*wsm));
+                goto err;
+        } else if (!rx_resync) {
+                if (WARN_ON(wsm_seq != priv->wsm_rx_seq))
+                        goto err;
+        }
+        priv->wsm_rx_seq = (wsm_seq + 1) & 7;
+        rx_resync = 0;
+
+        if (wsm_id & 0x0400) {
+                int rc = wsm_release_tx_buffer(priv, 1);
+                if (WARN_ON(rc < 0))
+                        return rc;
+                else if (rc > 0)
+                        *tx = 1;
+        }
+
+        /* cw1200_wsm_rx takes care on SKB livetime */
+        if (WARN_ON(wsm_handle_rx(priv, wsm_id, wsm, &skb_rx)))
+                goto err;
+
+        if (skb_rx) {
+                dev_kfree_skb(skb_rx);
+                skb_rx = NULL;
+        }
+
+        return 0;
+
+err:
+        if (skb_rx) {
+                dev_kfree_skb(skb_rx);
+                skb_rx = NULL;
+        }
+        return -1;
+}
+
+static int cw1200_bh_tx_helper(struct cw1200_common *priv,
+                               int *pending_tx,
+                               int *tx_burst)
+{
+        size_t tx_len;
+        u8 *data;
+        int ret;
+        struct wsm_hdr *wsm;
+
+        if (priv->device_can_sleep) {
+                ret = cw1200_device_wakeup(priv);
+                if (WARN_ON(ret < 0)) { /* Error in wakeup */
+                        *pending_tx = 1;
+                        return 0;
+                } else if (ret) { /* Woke up */
+                        priv->device_can_sleep = false;
+                } else { /* Did not awake */
+                        *pending_tx = 1;
+                        return 0;
+                }
+        }
+
+        wsm_alloc_tx_buffer(priv);
+        ret = wsm_get_tx(priv, &data, &tx_len, tx_burst);
+        if (ret <= 0) {
+                wsm_release_tx_buffer(priv, 1);
+                if (WARN_ON(ret < 0))
+                        return ret; /* Error */
+                return 0; /* No work */
+        }
+
+        wsm = (struct wsm_hdr *)data;
+        BUG_ON(tx_len < sizeof(*wsm));
+        BUG_ON(__le16_to_cpu(wsm->len) != tx_len);
+
+        atomic_add(1, &priv->bh_tx);
+
+        tx_len = priv->hwbus_ops->align_size(
+                priv->hwbus_priv, tx_len);
+
+        /* Check if not exceeding CW1200 capabilities */
+        if (WARN_ON_ONCE(tx_len > EFFECTIVE_BUF_SIZE))
+                pr_debug("Write aligned len: %zu\n", tx_len);
+
+        wsm->id &= __cpu_to_le16(0xffff ^ WSM_TX_SEQ(WSM_TX_SEQ_MAX));
+        wsm->id |= __cpu_to_le16(WSM_TX_SEQ(priv->wsm_tx_seq));
+
+        if (WARN_ON(cw1200_data_write(priv, data, tx_len))) {
+                pr_err("tx blew up, len %zu\n", tx_len);
+                wsm_release_tx_buffer(priv, 1);
+                return -1; /* Error */
+        }
+
+        if (priv->wsm_enable_wsm_dumps)
+                print_hex_dump_bytes("--> ",
+                                     DUMP_PREFIX_NONE,
+                                     data,
+                                     __le16_to_cpu(wsm->len));
+
+        wsm_txed(priv, data);
+        priv->wsm_tx_seq = (priv->wsm_tx_seq + 1) & WSM_TX_SEQ_MAX;
+
+        if (*tx_burst > 1) {
+                cw1200_debug_tx_burst(priv);
+                return 1; /* Work remains */
+        }
+
+        return 0;
+}
+
+static int cw1200_bh(void *arg)
+{
+        struct cw1200_common *priv = arg;
+        int rx, tx, term, suspend;
+        u16 ctrl_reg = 0;
+        int tx_allowed;
+        int pending_tx = 0;
+        int tx_burst;
+        long status;
+        u32 dummy;
+        int ret;
+
+        for (;;) {
+                if (!priv->hw_bufs_used &&
+                    priv->powersave_enabled &&
+                    !priv->device_can_sleep &&
+                    !atomic_read(&priv->recent_scan)) {
+                        status = 1 * HZ;
+                        pr_debug("[BH] Device wakedown. No data.\n");
+                        cw1200_reg_write_16(priv, ST90TDS_CONTROL_REG_ID, 0);
+                        priv->device_can_sleep = true;
+                } else if (priv->hw_bufs_used) {
+                        /* Interrupt loss detection */
+                        status = 1 * HZ;
+                } else {
+                        status = MAX_SCHEDULE_TIMEOUT;
+                }
+
+                /* Dummy Read for SDIO retry mechanism*/
+                if ((priv->hw_type != -1) &&
+                    (atomic_read(&priv->bh_rx) == 0) &&
+                    (atomic_read(&priv->bh_tx) == 0))
+                        cw1200_reg_read(priv, ST90TDS_CONFIG_REG_ID,
+                                        &dummy, sizeof(dummy));
+
+                pr_debug("[BH] waiting ...\n");
+                status = wait_event_interruptible_timeout(priv->bh_wq, ({
+                                rx = atomic_xchg(&priv->bh_rx, 0);
+                                tx = atomic_xchg(&priv->bh_tx, 0);
+                                term = atomic_xchg(&priv->bh_term, 0);
+                                suspend = pending_tx ?
+                                        0 : atomic_read(&priv->bh_suspend);
+                                (rx || tx || term || suspend || priv->bh_error);
+                        }), status);
+
+                pr_debug("[BH] - rx: %d, tx: %d, term: %d, suspend: %d, status: %ld\n",
+                         rx, tx, term, suspend, status);
+
+                /* Did an error occur? */
+                if ((status < 0 && status != -ERESTARTSYS) ||
+                    term || priv->bh_error) {
+                        break;
+                }
+                if (!status) {  /* wait_event timed out */
+                        unsigned long timestamp = jiffies;
+                        long timeout;
+                        int pending = 0;
+                        int i;
+
+                        /* Check to see if we have any outstanding frames */
+                        if (priv->hw_bufs_used && (!rx || !tx)) {
+                                wiphy_warn(priv->hw->wiphy,
+                                           "Missed interrupt? (%d frames outstanding)\n",
+                                           priv->hw_bufs_used);
+                                rx = 1;
+
+                                /* Get a timestamp of "oldest" frame */
+                                for (i = 0; i < 4; ++i)
+                                        pending += cw1200_queue_get_xmit_timestamp(
+                                                &priv->tx_queue[i],
+                                                &timestamp,
+                                                priv->pending_frame_id);
+
+                                /* Check if frame transmission is timed out.
+                                 * Add an extra second with respect to possible
+                                 * interrupt loss.
+                                 */
+                                timeout = timestamp +
+                                        WSM_CMD_LAST_CHANCE_TIMEOUT +
+                                        1 * HZ  -
+                                        jiffies;
+
+                                /* And terminate BH thread if the frame is "stuck" */
+                                if (pending && timeout < 0) {
+                                        wiphy_warn(priv->hw->wiphy,
+                                                   "Timeout waiting for TX confirm (%d/%d pending, %ld vs %lu).\n",
+                                                   priv->hw_bufs_used, pending,
+                                                   timestamp, jiffies);
+                                        break;
+                                }
+                        } else if (!priv->device_can_sleep &&
+                                   !atomic_read(&priv->recent_scan)) {
+                                pr_debug("[BH] Device wakedown. Timeout.\n");
+                                cw1200_reg_write_16(priv,
+                                                    ST90TDS_CONTROL_REG_ID, 0);
+                                priv->device_can_sleep = true;
+                        }
+                        goto done;
+                } else if (suspend) {
+                        pr_debug("[BH] Device suspend.\n");
+                        if (priv->powersave_enabled) {
+                                pr_debug("[BH] Device wakedown. Suspend.\n");
+                                cw1200_reg_write_16(priv,
+                                                    ST90TDS_CONTROL_REG_ID, 0);
+                                priv->device_can_sleep = true;
+                        }
+
+                        atomic_set(&priv->bh_suspend, CW1200_BH_SUSPENDED);
+                        wake_up(&priv->bh_evt_wq);
+                        status = wait_event_interruptible(priv->bh_wq,
+                                                          CW1200_BH_RESUME == atomic_read(&priv->bh_suspend));
+                        if (status < 0) {
+                                wiphy_err(priv->hw->wiphy,
+                                          "Failed to wait for resume: %ld.\n",
+                                          status);
+                                break;
+                        }
+                        pr_debug("[BH] Device resume.\n");
+                        atomic_set(&priv->bh_suspend, CW1200_BH_RESUMED);
+                        wake_up(&priv->bh_evt_wq);
+                        atomic_add(1, &priv->bh_rx);
+                        goto done;
+                }
+
+        rx:
+                tx += pending_tx;
+                pending_tx = 0;
+
+                if (cw1200_bh_read_ctrl_reg(priv, &ctrl_reg))
+                        break;
+
+                /* Don't bother trying to rx unless we have data to read */
+                if (ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK) {
+                        ret = cw1200_bh_rx_helper(priv, &ctrl_reg, &tx);
+                        if (ret < 0)
+                                break;
+                        /* Double up here if there's more data.. */
+                        if (ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK) {
+                                ret = cw1200_bh_rx_helper(priv, &ctrl_reg, &tx);
+                                if (ret < 0)
+                                        break;
+                        }
+                }
+
+        tx:
+                if (tx) {
+                        tx = 0;
+
+                        BUG_ON(priv->hw_bufs_used > priv->wsm_caps.input_buffers);
+                        tx_burst = priv->wsm_caps.input_buffers - priv->hw_bufs_used;
+                        tx_allowed = tx_burst > 0;
+
+                        if (!tx_allowed) {
+                                /* Buffers full.  Ensure we process tx
+                                 * after we handle rx..
+                                 */
+                                pending_tx = tx;
+                                goto done_rx;
+                        }
+                        ret = cw1200_bh_tx_helper(priv, &pending_tx, &tx_burst);
+                        if (ret < 0)
+                                break;
+                        if (ret > 0) /* More to transmit */
+                                tx = ret;
+
+                        /* Re-read ctrl reg */
+                        if (cw1200_bh_read_ctrl_reg(priv, &ctrl_reg))
+                                break;
+                }
+
+        done_rx:
+                if (priv->bh_error)
+                        break;
+                if (ctrl_reg & ST90TDS_CONT_NEXT_LEN_MASK)
+                        goto rx;
+                if (tx)
+                        goto tx;
+
+        done:
+                /* Re-enable device interrupts */
+                priv->hwbus_ops->lock(priv->hwbus_priv);
+                __cw1200_irq_enable(priv, 1);
+                priv->hwbus_ops->unlock(priv->hwbus_priv);
+        }
+
+        /* Explicitly disable device interrupts */
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        __cw1200_irq_enable(priv, 0);
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+
+        if (!term) {
+                pr_err("[BH] Fatal error, exiting.\n");
+                priv->bh_error = 1;
+                /* TODO: schedule_work(recovery) */
+        }
+        return 0;
+}
diff --git a/drivers/net/wireless/cw1200/bh.h b/drivers/net/wireless/cw1200/bh.h
new file mode 100644
index 000000000000..af6a4853728f
--- /dev/null
+++ b/drivers/net/wireless/cw1200/bh.h
@@ -0,0 +1,28 @@
+/*
+ * Device handling thread interface for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_BH_H
+#define CW1200_BH_H
+
+/* extern */ struct cw1200_common;
+
+int cw1200_register_bh(struct cw1200_common *priv);
+void cw1200_unregister_bh(struct cw1200_common *priv);
+void cw1200_irq_handler(struct cw1200_common *priv);
+void cw1200_bh_wakeup(struct cw1200_common *priv);
+int cw1200_bh_suspend(struct cw1200_common *priv);
+int cw1200_bh_resume(struct cw1200_common *priv);
+/* Must be called from BH thread. */
+void cw1200_enable_powersave(struct cw1200_common *priv,
+                             bool enable);
+int wsm_release_tx_buffer(struct cw1200_common *priv, int count);
+
+#endif /* CW1200_BH_H */
diff --git a/drivers/net/wireless/cw1200/cw1200.h b/drivers/net/wireless/cw1200/cw1200.h
new file mode 100644
index 000000000000..243e96353d13
--- /dev/null
+++ b/drivers/net/wireless/cw1200/cw1200.h
@@ -0,0 +1,323 @@
+/*
+ * Common private data for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on the mac80211 Prism54 code, which is
+ * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
+ *
+ * Based on the islsm (softmac prism54) driver, which is:
+ * Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_H
+#define CW1200_H
+
+#include <linux/wait.h>
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include <net/mac80211.h>
+
+#include "queue.h"
+#include "wsm.h"
+#include "scan.h"
+#include "txrx.h"
+#include "pm.h"
+
+/* Forward declarations */
+struct hwbus_ops;
+struct task_struct;
+struct cw1200_debug_priv;
+struct firmware;
+
+#define CW1200_MAX_CTRL_FRAME_LEN       (0x1000)
+
+#define CW1200_MAX_STA_IN_AP_MODE       (5)
+#define CW1200_LINK_ID_AFTER_DTIM       (CW1200_MAX_STA_IN_AP_MODE + 1)
+#define CW1200_LINK_ID_UAPSD            (CW1200_MAX_STA_IN_AP_MODE + 2)
+#define CW1200_LINK_ID_MAX              (CW1200_MAX_STA_IN_AP_MODE + 3)
+#define CW1200_MAX_REQUEUE_ATTEMPTS     (5)
+
+#define CW1200_MAX_TID                  (8)
+
+#define CW1200_BLOCK_ACK_CNT            (30)
+#define CW1200_BLOCK_ACK_THLD           (800)
+#define CW1200_BLOCK_ACK_HIST           (3)
+#define CW1200_BLOCK_ACK_INTERVAL       (1 * HZ / CW1200_BLOCK_ACK_HIST)
+
+#define CW1200_JOIN_TIMEOUT             (1 * HZ)
+#define CW1200_AUTH_TIMEOUT             (5 * HZ)
+
+struct cw1200_ht_info {
+        struct ieee80211_sta_ht_cap     ht_cap;
+        enum nl80211_channel_type       channel_type;
+        u16                             operation_mode;
+};
+
+/* Please keep order */
+enum cw1200_join_status {
+        CW1200_JOIN_STATUS_PASSIVE = 0,
+        CW1200_JOIN_STATUS_MONITOR,
+        CW1200_JOIN_STATUS_JOINING,
+        CW1200_JOIN_STATUS_PRE_STA,
+        CW1200_JOIN_STATUS_STA,
+        CW1200_JOIN_STATUS_IBSS,
+        CW1200_JOIN_STATUS_AP,
+};
+
+enum cw1200_link_status {
+        CW1200_LINK_OFF,
+        CW1200_LINK_RESERVE,
+        CW1200_LINK_SOFT,
+        CW1200_LINK_HARD,
+        CW1200_LINK_RESET,
+        CW1200_LINK_RESET_REMAP,
+};
+
+extern int cw1200_power_mode;
+extern const char * const cw1200_fw_types[];
+
+struct cw1200_link_entry {
+        unsigned long                   timestamp;
+        enum cw1200_link_status         status;
+        enum cw1200_link_status         prev_status;
+        u8                              mac[ETH_ALEN];
+        u8                              buffered[CW1200_MAX_TID];
+        struct sk_buff_head             rx_queue;
+};
+
+struct cw1200_common {
+        /* interfaces to the rest of the stack */
+        struct ieee80211_hw             *hw;
+        struct ieee80211_vif            *vif;
+        struct device                   *pdev;
+
+        /* Statistics */
+        struct ieee80211_low_level_stats stats;
+
+        /* Our macaddr */
+        u8 mac_addr[ETH_ALEN];
+
+        /* Hardware interface */
+        const struct hwbus_ops          *hwbus_ops;
+        struct hwbus_priv               *hwbus_priv;
+
+        /* Hardware information */
+        enum {
+                HIF_9000_SILICON_VERSATILE = 0,
+                HIF_8601_VERSATILE,
+                HIF_8601_SILICON,
+        } hw_type;
+        enum {
+                CW1200_HW_REV_CUT10 = 10,
+                CW1200_HW_REV_CUT11 = 11,
+                CW1200_HW_REV_CUT20 = 20,
+                CW1200_HW_REV_CUT22 = 22,
+                CW1X60_HW_REV       = 40,
+        } hw_revision;
+        int                             hw_refclk;
+        bool                            hw_have_5ghz;
+        const struct firmware           *sdd;
+        char                            *sdd_path;
+
+        struct cw1200_debug_priv        *debug;
+
+        struct workqueue_struct         *workqueue;
+        struct mutex                    conf_mutex;
+
+        struct cw1200_queue             tx_queue[4];
+        struct cw1200_queue_stats       tx_queue_stats;
+        int                             tx_burst_idx;
+
+        /* firmware/hardware info */
+        unsigned int tx_hdr_len;
+
+        /* Radio data */
+        int output_power;
+
+        /* BBP/MAC state */
+        struct ieee80211_rate           *rates;
+        struct ieee80211_rate           *mcs_rates;
+        struct ieee80211_channel        *channel;
+        struct wsm_edca_params          edca;
+        struct wsm_tx_queue_params      tx_queue_params;
+        struct wsm_mib_association_mode association_mode;
+        struct wsm_set_bss_params       bss_params;
+        struct cw1200_ht_info           ht_info;
+        struct wsm_set_pm               powersave_mode;
+        struct wsm_set_pm               firmware_ps_mode;
+        int                             cqm_rssi_thold;
+        unsigned                        cqm_rssi_hyst;
+        bool                            cqm_use_rssi;
+        int                             cqm_beacon_loss_count;
+        int                             channel_switch_in_progress;
+        wait_queue_head_t               channel_switch_done;
+        u8                              long_frame_max_tx_count;
+        u8                              short_frame_max_tx_count;
+        int                             mode;
+        bool                            enable_beacon;
+        int                             beacon_int;
+        bool                            listening;
+        struct wsm_rx_filter            rx_filter;
+        struct wsm_mib_multicast_filter multicast_filter;
+        bool                            has_multicast_subscription;
+        bool                            disable_beacon_filter;
+        struct work_struct              update_filtering_work;
+        struct work_struct              set_beacon_wakeup_period_work;
+
+        u8                              ba_rx_tid_mask;
+        u8                              ba_tx_tid_mask;
+
+        struct cw1200_pm_state          pm_state;
+
+        struct wsm_p2p_ps_modeinfo      p2p_ps_modeinfo;
+        struct wsm_uapsd_info           uapsd_info;
+        bool                            setbssparams_done;
+        bool                            bt_present;
+        u8                              conf_listen_interval;
+        u32                             listen_interval;
+        u32                             erp_info;
+        u32                             rts_threshold;
+
+        /* BH */
+        atomic_t                        bh_rx;
+        atomic_t                        bh_tx;
+        atomic_t                        bh_term;
+        atomic_t                        bh_suspend;
+
+        struct workqueue_struct         *bh_workqueue;
+        struct work_struct              bh_work;
+
+        int                             bh_error;
+        wait_queue_head_t               bh_wq;
+        wait_queue_head_t               bh_evt_wq;
+        u8                              buf_id_tx;
+        u8                              buf_id_rx;
+        u8                              wsm_rx_seq;
+        u8                              wsm_tx_seq;
+        int                             hw_bufs_used;
+        bool                            powersave_enabled;
+        bool                            device_can_sleep;
+
+        /* Scan status */
+        struct cw1200_scan scan;
+        /* Keep cw1200 awake (WUP = 1) 1 second after each scan to avoid
+         * FW issue with sleeping/waking up.
+         */
+        atomic_t                        recent_scan;
+        struct delayed_work             clear_recent_scan_work;
+
+        /* WSM */
+        struct wsm_startup_ind          wsm_caps;
+        struct mutex                    wsm_cmd_mux;
+        struct wsm_buf                  wsm_cmd_buf;
+        struct wsm_cmd                  wsm_cmd;
+        wait_queue_head_t               wsm_cmd_wq;
+        wait_queue_head_t               wsm_startup_done;
+        int                             firmware_ready;
+        atomic_t                        tx_lock;
+
+        /* WSM debug */
+        int                             wsm_enable_wsm_dumps;
+
+        /* WSM Join */
+        enum cw1200_join_status join_status;
+        u32                     pending_frame_id;
+        bool                    join_pending;
+        struct delayed_work     join_timeout;
+        struct work_struct      unjoin_work;
+        struct work_struct      join_complete_work;
+        int                     join_complete_status;
+        int                     join_dtim_period;
+        bool                    delayed_unjoin;
+
+        /* TX/RX and security */
+        s8                      wep_default_key_id;
+        struct work_struct      wep_key_work;
+        u32                     key_map;
+        struct wsm_add_key      keys[WSM_KEY_MAX_INDEX + 1];
+
+        /* AP powersave */
+        u32                     link_id_map;
+        struct cw1200_link_entry link_id_db[CW1200_MAX_STA_IN_AP_MODE];
+        struct work_struct      link_id_work;
+        struct delayed_work     link_id_gc_work;
+        u32                     sta_asleep_mask;
+        u32                     pspoll_mask;
+        bool                    aid0_bit_set;
+        spinlock_t              ps_state_lock; /* Protect power save state */
+        bool                    buffered_multicasts;
+        bool                    tx_multicast;
+        struct work_struct      set_tim_work;
+        struct work_struct      set_cts_work;
+        struct work_struct      multicast_start_work;
+        struct work_struct      multicast_stop_work;
+        struct timer_list       mcast_timeout;
+
+        /* WSM events and CQM implementation */
+        spinlock_t              event_queue_lock; /* Protect event queue */
+        struct list_head        event_queue;
+        struct work_struct      event_handler;
+
+        struct delayed_work     bss_loss_work;
+        spinlock_t              bss_loss_lock; /* Protect BSS loss state */
+        int                     bss_loss_state;
+        int                     bss_loss_confirm_id;
+        int                     delayed_link_loss;
+        struct work_struct      bss_params_work;
+
+        /* TX rate policy cache */
+        struct tx_policy_cache tx_policy_cache;
+        struct work_struct tx_policy_upload_work;
+
+        /* legacy PS mode switch in suspend */
+        int                     ps_mode_switch_in_progress;
+        wait_queue_head_t       ps_mode_switch_done;
+
+        /* Workaround for WFD testcase 6.1.10*/
+        struct work_struct      linkid_reset_work;
+        u8                      action_frame_sa[ETH_ALEN];
+        u8                      action_linkid;
+};
+
+struct cw1200_sta_priv {
+        int link_id;
+};
+
+/* interfaces for the drivers */
+int cw1200_core_probe(const struct hwbus_ops *hwbus_ops,
+                      struct hwbus_priv *hwbus,
+                      struct device *pdev,
+                      struct cw1200_common **pself,
+                      int ref_clk, const u8 *macaddr,
+                      const char *sdd_path, bool have_5ghz);
+void cw1200_core_release(struct cw1200_common *self);
+
+#define FWLOAD_BLOCK_SIZE (1024)
+
+static inline int cw1200_is_ht(const struct cw1200_ht_info *ht_info)
+{
+        return ht_info->channel_type != NL80211_CHAN_NO_HT;
+}
+
+static inline int cw1200_ht_greenfield(const struct cw1200_ht_info *ht_info)
+{
+        return cw1200_is_ht(ht_info) &&
+                (ht_info->ht_cap.cap & IEEE80211_HT_CAP_GRN_FLD) &&
+                !(ht_info->operation_mode &
+                  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT);
+}
+
+static inline int cw1200_ht_ampdu_density(const struct cw1200_ht_info *ht_info)
+{
+        if (!cw1200_is_ht(ht_info))
+                return 0;
+        return ht_info->ht_cap.ampdu_density;
+}
+
+#endif /* CW1200_H */
diff --git a/drivers/net/wireless/cw1200/cw1200_sdio.c b/drivers/net/wireless/cw1200/cw1200_sdio.c
new file mode 100644
index 000000000000..ebdcdf44f155
--- /dev/null
+++ b/drivers/net/wireless/cw1200/cw1200_sdio.c
@@ -0,0 +1,425 @@
+/*
+ * Mac80211 SDIO driver for ST-Ericsson CW1200 device
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio.h>
+#include <linux/delay.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/sdio_func.h>
+#include <linux/mmc/card.h>
+#include <linux/mmc/sdio.h>
+#include <net/mac80211.h>
+
+#include "cw1200.h"
+#include "hwbus.h"
+#include <linux/platform_data/net-cw1200.h>
+#include "hwio.h"
+
+MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>");
+MODULE_DESCRIPTION("mac80211 ST-Ericsson CW1200 SDIO driver");
+MODULE_LICENSE("GPL");
+
+#define SDIO_BLOCK_SIZE (512)
+
+/* Default platform data for Sagrad modules */
+static struct cw1200_platform_data_sdio sagrad_109x_evk_platform_data = {
+        .ref_clk = 38400,
+        .have_5ghz = false,
+        .sdd_file = "sdd_sagrad_1091_1098.bin",
+};
+
+/* Allow platform data to be overridden */
+static struct cw1200_platform_data_sdio *global_plat_data = &sagrad_109x_evk_platform_data;
+
+void __init cw1200_sdio_set_platform_data(struct cw1200_platform_data_sdio *pdata)
+{
+        global_plat_data = pdata;
+}
+
+struct hwbus_priv {
+        struct sdio_func        *func;
+        struct cw1200_common    *core;
+        const struct cw1200_platform_data_sdio *pdata;
+};
+
+#ifndef SDIO_VENDOR_ID_STE
+#define SDIO_VENDOR_ID_STE              0x0020
+#endif
+
+#ifndef SDIO_DEVICE_ID_STE_CW1200
+#define SDIO_DEVICE_ID_STE_CW1200       0x2280
+#endif
+
+static const struct sdio_device_id cw1200_sdio_ids[] = {
+        { SDIO_DEVICE(SDIO_VENDOR_ID_STE, SDIO_DEVICE_ID_STE_CW1200) },
+        { /* end: all zeroes */                 },
+};
+
+/* hwbus_ops implemetation */
+
+static int cw1200_sdio_memcpy_fromio(struct hwbus_priv *self,
+                                     unsigned int addr,
+                                     void *dst, int count)
+{
+        return sdio_memcpy_fromio(self->func, dst, addr, count);
+}
+
+static int cw1200_sdio_memcpy_toio(struct hwbus_priv *self,
+                                   unsigned int addr,
+                                   const void *src, int count)
+{
+        return sdio_memcpy_toio(self->func, addr, (void *)src, count);
+}
+
+static void cw1200_sdio_lock(struct hwbus_priv *self)
+{
+        sdio_claim_host(self->func);
+}
+
+static void cw1200_sdio_unlock(struct hwbus_priv *self)
+{
+        sdio_release_host(self->func);
+}
+
+static void cw1200_sdio_irq_handler(struct sdio_func *func)
+{
+        struct hwbus_priv *self = sdio_get_drvdata(func);
+
+        /* note:  sdio_host already claimed here. */
+        if (self->core)
+                cw1200_irq_handler(self->core);
+}
+
+static irqreturn_t cw1200_gpio_hardirq(int irq, void *dev_id)
+{
+        return IRQ_WAKE_THREAD;
+}
+
+static irqreturn_t cw1200_gpio_irq(int irq, void *dev_id)
+{
+        struct hwbus_priv *self = dev_id;
+
+        if (self->core) {
+                sdio_claim_host(self->func);
+                cw1200_irq_handler(self->core);
+                sdio_release_host(self->func);
+                return IRQ_HANDLED;
+        } else {
+                return IRQ_NONE;
+        }
+}
+
+static int cw1200_request_irq(struct hwbus_priv *self)
+{
+        int ret;
+        u8 cccr;
+
+        cccr = sdio_f0_readb(self->func, SDIO_CCCR_IENx, &ret);
+        if (WARN_ON(ret))
+                goto err;
+
+        /* Master interrupt enable ... */
+        cccr |= BIT(0);
+
+        /* ... for our function */
+        cccr |= BIT(self->func->num);
+
+        sdio_f0_writeb(self->func, cccr, SDIO_CCCR_IENx, &ret);
+        if (WARN_ON(ret))
+                goto err;
+
+        ret = enable_irq_wake(self->pdata->irq);
+        if (WARN_ON(ret))
+                goto err;
+
+        /* Request the IRQ */
+        ret =  request_threaded_irq(self->pdata->irq, cw1200_gpio_hardirq,
+                                    cw1200_gpio_irq,
+                                    IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+                                    "cw1200_wlan_irq", self);
+        if (WARN_ON(ret))
+                goto err;
+
+        return 0;
+
+err:
+        return ret;
+}
+
+static int cw1200_sdio_irq_subscribe(struct hwbus_priv *self)
+{
+        int ret = 0;
+
+        pr_debug("SW IRQ subscribe\n");
+        sdio_claim_host(self->func);
+        if (self->pdata->irq)
+                ret = cw1200_request_irq(self);
+        else
+                ret = sdio_claim_irq(self->func, cw1200_sdio_irq_handler);
+
+        sdio_release_host(self->func);
+        return ret;
+}
+
+static int cw1200_sdio_irq_unsubscribe(struct hwbus_priv *self)
+{
+        int ret = 0;
+
+        pr_debug("SW IRQ unsubscribe\n");
+
+        if (self->pdata->irq) {
+                disable_irq_wake(self->pdata->irq);
+                free_irq(self->pdata->irq, self);
+        } else {
+                sdio_claim_host(self->func);
+                ret = sdio_release_irq(self->func);
+                sdio_release_host(self->func);
+        }
+        return ret;
+}
+
+static int cw1200_sdio_off(const struct cw1200_platform_data_sdio *pdata)
+{
+        if (pdata->reset) {
+                gpio_set_value(pdata->reset, 0);
+                msleep(30); /* Min is 2 * CLK32K cycles */
+                gpio_free(pdata->reset);
+        }
+
+        if (pdata->power_ctrl)
+                pdata->power_ctrl(pdata, false);
+        if (pdata->clk_ctrl)
+                pdata->clk_ctrl(pdata, false);
+
+        return 0;
+}
+
+static int cw1200_sdio_on(const struct cw1200_platform_data_sdio *pdata)
+{
+        /* Ensure I/Os are pulled low */
+        if (pdata->reset) {
+                gpio_request(pdata->reset, "cw1200_wlan_reset");
+                gpio_direction_output(pdata->reset, 0);
+        }
+        if (pdata->powerup) {
+                gpio_request(pdata->powerup, "cw1200_wlan_powerup");
+                gpio_direction_output(pdata->powerup, 0);
+        }
+        if (pdata->reset || pdata->powerup)
+                msleep(10); /* Settle time? */
+
+        /* Enable 3v3 and 1v8 to hardware */
+        if (pdata->power_ctrl) {
+                if (pdata->power_ctrl(pdata, true)) {
+                        pr_err("power_ctrl() failed!\n");
+                        return -1;
+                }
+        }
+
+        /* Enable CLK32K */
+        if (pdata->clk_ctrl) {
+                if (pdata->clk_ctrl(pdata, true)) {
+                        pr_err("clk_ctrl() failed!\n");
+                        return -1;
+                }
+                msleep(10); /* Delay until clock is stable for 2 cycles */
+        }
+
+        /* Enable POWERUP signal */
+        if (pdata->powerup) {
+                gpio_set_value(pdata->powerup, 1);
+                msleep(250); /* or more..? */
+        }
+        /* Enable RSTn signal */
+        if (pdata->reset) {
+                gpio_set_value(pdata->reset, 1);
+                msleep(50); /* Or more..? */
+        }
+        return 0;
+}
+
+static size_t cw1200_sdio_align_size(struct hwbus_priv *self, size_t size)
+{
+        if (self->pdata->no_nptb)
+                size = round_up(size, SDIO_BLOCK_SIZE);
+        else
+                size = sdio_align_size(self->func, size);
+
+        return size;
+}
+
+static int cw1200_sdio_pm(struct hwbus_priv *self, bool suspend)
+{
+        int ret = 0;
+
+        if (self->pdata->irq)
+                ret = irq_set_irq_wake(self->pdata->irq, suspend);
+        return ret;
+}
+
+static struct hwbus_ops cw1200_sdio_hwbus_ops = {
+        .hwbus_memcpy_fromio    = cw1200_sdio_memcpy_fromio,
+        .hwbus_memcpy_toio      = cw1200_sdio_memcpy_toio,
+        .lock                   = cw1200_sdio_lock,
+        .unlock                 = cw1200_sdio_unlock,
+        .align_size             = cw1200_sdio_align_size,
+        .power_mgmt             = cw1200_sdio_pm,
+};
+
+/* Probe Function to be called by SDIO stack when device is discovered */
+static int cw1200_sdio_probe(struct sdio_func *func,
+                             const struct sdio_device_id *id)
+{
+        struct hwbus_priv *self;
+        int status;
+
+        pr_info("cw1200_wlan_sdio: Probe called\n");
+
+        /* We are only able to handle the wlan function */
+        if (func->num != 0x01)
+                return -ENODEV;
+
+        self = kzalloc(sizeof(*self), GFP_KERNEL);
+        if (!self) {
+                pr_err("Can't allocate SDIO hwbus_priv.\n");
+                return -ENOMEM;
+        }
+
+        func->card->quirks |= MMC_QUIRK_LENIENT_FN0;
+
+        self->pdata = global_plat_data; /* FIXME */
+        self->func = func;
+        sdio_set_drvdata(func, self);
+        sdio_claim_host(func);
+        sdio_enable_func(func);
+        sdio_release_host(func);
+
+        status = cw1200_sdio_irq_subscribe(self);
+
+        status = cw1200_core_probe(&cw1200_sdio_hwbus_ops,
+                                   self, &func->dev, &self->core,
+                                   self->pdata->ref_clk,
+                                   self->pdata->macaddr,
+                                   self->pdata->sdd_file,
+                                   self->pdata->have_5ghz);
+        if (status) {
+                cw1200_sdio_irq_unsubscribe(self);
+                sdio_claim_host(func);
+                sdio_disable_func(func);
+                sdio_release_host(func);
+                sdio_set_drvdata(func, NULL);
+                kfree(self);
+        }
+
+        return status;
+}
+
+/* Disconnect Function to be called by SDIO stack when
+ * device is disconnected
+ */
+static void cw1200_sdio_disconnect(struct sdio_func *func)
+{
+        struct hwbus_priv *self = sdio_get_drvdata(func);
+
+        if (self) {
+                cw1200_sdio_irq_unsubscribe(self);
+                if (self->core) {
+                        cw1200_core_release(self->core);
+                        self->core = NULL;
+                }
+                sdio_claim_host(func);
+                sdio_disable_func(func);
+                sdio_release_host(func);
+                sdio_set_drvdata(func, NULL);
+                kfree(self);
+        }
+}
+
+#ifdef CONFIG_PM
+static int cw1200_sdio_suspend(struct device *dev)
+{
+        int ret;
+        struct sdio_func *func = dev_to_sdio_func(dev);
+        struct hwbus_priv *self = sdio_get_drvdata(func);
+
+        if (!cw1200_can_suspend(self->core))
+                return -EAGAIN;
+
+        /* Notify SDIO that CW1200 will remain powered during suspend */
+        ret = sdio_set_host_pm_flags(func, MMC_PM_KEEP_POWER);
+        if (ret)
+                pr_err("Error setting SDIO pm flags: %i\n", ret);
+
+        return ret;
+}
+
+static int cw1200_sdio_resume(struct device *dev)
+{
+        return 0;
+}
+
+static const struct dev_pm_ops cw1200_pm_ops = {
+        .suspend = cw1200_sdio_suspend,
+        .resume = cw1200_sdio_resume,
+};
+#endif
+
+static struct sdio_driver sdio_driver = {
+        .name           = "cw1200_wlan_sdio",
+        .id_table       = cw1200_sdio_ids,
+        .probe          = cw1200_sdio_probe,
+        .remove         = cw1200_sdio_disconnect,
+#ifdef CONFIG_PM
+        .drv = {
+                .pm = &cw1200_pm_ops,
+        }
+#endif
+};
+
+/* Init Module function -> Called by insmod */
+static int __init cw1200_sdio_init(void)
+{
+        const struct cw1200_platform_data_sdio *pdata;
+        int ret;
+
+        /* FIXME -- this won't support multiple devices */
+        pdata = global_plat_data;
+
+        if (cw1200_sdio_on(pdata)) {
+                ret = -1;
+                goto err;
+        }
+
+        ret = sdio_register_driver(&sdio_driver);
+        if (ret)
+                goto err;
+
+        return 0;
+
+err:
+        cw1200_sdio_off(pdata);
+        return ret;
+}
+
+/* Called at Driver Unloading */
+static void __exit cw1200_sdio_exit(void)
+{
+        const struct cw1200_platform_data_sdio *pdata;
+
+        /* FIXME -- this won't support multiple devices */
+        pdata = global_plat_data;
+        sdio_unregister_driver(&sdio_driver);
+        cw1200_sdio_off(pdata);
+}
+
+
+module_init(cw1200_sdio_init);
+module_exit(cw1200_sdio_exit);
diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c
new file mode 100644
index 000000000000..953bd1904d3d
--- /dev/null
+++ b/drivers/net/wireless/cw1200/cw1200_spi.c
@@ -0,0 +1,463 @@
+/*
+ * Mac80211 SPI driver for ST-Ericsson CW1200 device
+ *
+ * Copyright (c) 2011, Sagrad Inc.
+ * Author:  Solomon Peachy <speachy@sagrad.com>
+ *
+ * Based on cw1200_sdio.c
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/gpio.h>
+#include <linux/delay.h>
+#include <linux/spinlock.h>
+#include <linux/interrupt.h>
+#include <net/mac80211.h>
+
+#include <linux/spi/spi.h>
+#include <linux/device.h>
+
+#include "cw1200.h"
+#include "hwbus.h"
+#include <linux/platform_data/net-cw1200.h>
+#include "hwio.h"
+
+MODULE_AUTHOR("Solomon Peachy <speachy@sagrad.com>");
+MODULE_DESCRIPTION("mac80211 ST-Ericsson CW1200 SPI driver");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("spi:cw1200_wlan_spi");
+
+/* #define SPI_DEBUG */
+
+struct hwbus_priv {
+        struct spi_device       *func;
+        struct cw1200_common    *core;
+        const struct cw1200_platform_data_spi *pdata;
+        spinlock_t              lock; /* Serialize all bus operations */
+        int claimed;
+};
+
+#define SDIO_TO_SPI_ADDR(addr) ((addr & 0x1f)>>2)
+#define SET_WRITE 0x7FFF /* usage: and operation */
+#define SET_READ 0x8000  /* usage: or operation */
+
+/* Notes on byte ordering:
+   LE:  B0 B1 B2 B3
+   BE:  B3 B2 B1 B0
+
+   Hardware expects 32-bit data to be written as 16-bit BE words:
+
+   B1 B0 B3 B2
+*/
+
+static int cw1200_spi_memcpy_fromio(struct hwbus_priv *self,
+                                     unsigned int addr,
+                                     void *dst, int count)
+{
+        int ret, i;
+        uint16_t regaddr;
+        struct spi_message      m;
+
+        struct spi_transfer     t_addr = {
+                .tx_buf         = &regaddr,
+                .len            = sizeof(regaddr),
+        };
+        struct spi_transfer     t_msg = {
+                .rx_buf         = dst,
+                .len            = count,
+        };
+
+        regaddr = (SDIO_TO_SPI_ADDR(addr))<<12;
+        regaddr |= SET_READ;
+        regaddr |= (count>>1);
+        regaddr = cpu_to_le16(regaddr);
+
+#ifdef SPI_DEBUG
+        pr_info("READ : %04d from 0x%02x (%04x)\n", count, addr,
+                le16_to_cpu(regaddr));
+#endif
+
+#if defined(__LITTLE_ENDIAN)
+        /* We have to byteswap if the SPI bus is limited to 8b operation */
+        if (self->func->bits_per_word == 8)
+#endif
+                regaddr = swab16(regaddr);
+
+        spi_message_init(&m);
+        spi_message_add_tail(&t_addr, &m);
+        spi_message_add_tail(&t_msg, &m);
+        ret = spi_sync(self->func, &m);
+
+#ifdef SPI_DEBUG
+        pr_info("READ : ");
+        for (i = 0; i < t_addr.len; i++)
+                printk("%02x ", ((u8 *)t_addr.tx_buf)[i]);
+        printk(" : ");
+        for (i = 0; i < t_msg.len; i++)
+                printk("%02x ", ((u8 *)t_msg.rx_buf)[i]);
+        printk("\n");
+#endif
+
+#if defined(__LITTLE_ENDIAN)
+        /* We have to byteswap if the SPI bus is limited to 8b operation */
+        if (self->func->bits_per_word == 8)
+#endif
+        {
+                uint16_t *buf = (uint16_t *)dst;
+                for (i = 0; i < ((count + 1) >> 1); i++)
+                        buf[i] = swab16(buf[i]);
+        }
+
+        return ret;
+}
+
+static int cw1200_spi_memcpy_toio(struct hwbus_priv *self,
+                                   unsigned int addr,
+                                   const void *src, int count)
+{
+        int rval, i;
+        uint16_t regaddr;
+        struct spi_transfer     t_addr = {
+                .tx_buf         = &regaddr,
+                .len            = sizeof(regaddr),
+        };
+        struct spi_transfer     t_msg = {
+                .tx_buf         = src,
+                .len            = count,
+        };
+        struct spi_message      m;
+
+        regaddr = (SDIO_TO_SPI_ADDR(addr))<<12;
+        regaddr &= SET_WRITE;
+        regaddr |= (count>>1);
+        regaddr = cpu_to_le16(regaddr);
+
+#ifdef SPI_DEBUG
+        pr_info("WRITE: %04d  to  0x%02x (%04x)\n", count, addr,
+                le16_to_cpu(regaddr));
+#endif
+
+#if defined(__LITTLE_ENDIAN)
+        /* We have to byteswap if the SPI bus is limited to 8b operation */
+        if (self->func->bits_per_word == 8)
+#endif
+        {
+                uint16_t *buf = (uint16_t *)src;
+                regaddr = swab16(regaddr);
+                for (i = 0; i < ((count + 1) >> 1); i++)
+                        buf[i] = swab16(buf[i]);
+        }
+
+#ifdef SPI_DEBUG
+        pr_info("WRITE: ");
+        for (i = 0; i < t_addr.len; i++)
+                printk("%02x ", ((u8 *)t_addr.tx_buf)[i]);
+        printk(" : ");
+        for (i = 0; i < t_msg.len; i++)
+                printk("%02x ", ((u8 *)t_msg.tx_buf)[i]);
+        printk("\n");
+#endif
+
+        spi_message_init(&m);
+        spi_message_add_tail(&t_addr, &m);
+        spi_message_add_tail(&t_msg, &m);
+        rval = spi_sync(self->func, &m);
+
+#ifdef SPI_DEBUG
+        pr_info("WROTE: %d\n", m.actual_length);
+#endif
+
+#if defined(__LITTLE_ENDIAN)
+        /* We have to byteswap if the SPI bus is limited to 8b operation */
+        if (self->func->bits_per_word == 8)
+#endif
+        {
+                uint16_t *buf = (uint16_t *)src;
+                for (i = 0; i < ((count + 1) >> 1); i++)
+                        buf[i] = swab16(buf[i]);
+        }
+        return rval;
+}
+
+static void cw1200_spi_lock(struct hwbus_priv *self)
+{
+        unsigned long flags;
+
+        might_sleep();
+
+        spin_lock_irqsave(&self->lock, flags);
+        while (1) {
+                set_current_state(TASK_UNINTERRUPTIBLE);
+                if (!self->claimed)
+                        break;
+                spin_unlock_irqrestore(&self->lock, flags);
+                schedule();
+                spin_lock_irqsave(&self->lock, flags);
+        }
+        set_current_state(TASK_RUNNING);
+        self->claimed = 1;
+        spin_unlock_irqrestore(&self->lock, flags);
+
+        return;
+}
+
+static void cw1200_spi_unlock(struct hwbus_priv *self)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&self->lock, flags);
+        self->claimed = 0;
+        spin_unlock_irqrestore(&self->lock, flags);
+        return;
+}
+
+static irqreturn_t cw1200_spi_irq_handler(int irq, void *dev_id)
+{
+        struct hwbus_priv *self = dev_id;
+
+        if (self->core) {
+                cw1200_irq_handler(self->core);
+                return IRQ_HANDLED;
+        } else {
+                return IRQ_NONE;
+        }
+}
+
+static int cw1200_spi_irq_subscribe(struct hwbus_priv *self)
+{
+        int ret;
+
+        pr_debug("SW IRQ subscribe\n");
+
+        ret = request_any_context_irq(self->func->irq, cw1200_spi_irq_handler,
+                                      IRQF_TRIGGER_HIGH,
+                                      "cw1200_wlan_irq", self);
+        if (WARN_ON(ret < 0))
+                goto exit;
+
+        ret = enable_irq_wake(self->func->irq);
+        if (WARN_ON(ret))
+                goto free_irq;
+
+        return 0;
+
+free_irq:
+        free_irq(self->func->irq, self);
+exit:
+        return ret;
+}
+
+static int cw1200_spi_irq_unsubscribe(struct hwbus_priv *self)
+{
+        int ret = 0;
+
+        pr_debug("SW IRQ unsubscribe\n");
+        disable_irq_wake(self->func->irq);
+        free_irq(self->func->irq, self);
+
+        return ret;
+}
+
+static int cw1200_spi_off(const struct cw1200_platform_data_spi *pdata)
+{
+        if (pdata->reset) {
+                gpio_set_value(pdata->reset, 0);
+                msleep(30); /* Min is 2 * CLK32K cycles */
+                gpio_free(pdata->reset);
+        }
+
+        if (pdata->power_ctrl)
+                pdata->power_ctrl(pdata, false);
+        if (pdata->clk_ctrl)
+                pdata->clk_ctrl(pdata, false);
+
+        return 0;
+}
+
+static int cw1200_spi_on(const struct cw1200_platform_data_spi *pdata)
+{
+        /* Ensure I/Os are pulled low */
+        if (pdata->reset) {
+                gpio_request(pdata->reset, "cw1200_wlan_reset");
+                gpio_direction_output(pdata->reset, 0);
+        }
+        if (pdata->powerup) {
+                gpio_request(pdata->powerup, "cw1200_wlan_powerup");
+                gpio_direction_output(pdata->powerup, 0);
+        }
+        if (pdata->reset || pdata->powerup)
+                msleep(10); /* Settle time? */
+
+        /* Enable 3v3 and 1v8 to hardware */
+        if (pdata->power_ctrl) {
+                if (pdata->power_ctrl(pdata, true)) {
+                        pr_err("power_ctrl() failed!\n");
+                        return -1;
+                }
+        }
+
+        /* Enable CLK32K */
+        if (pdata->clk_ctrl) {
+                if (pdata->clk_ctrl(pdata, true)) {
+                        pr_err("clk_ctrl() failed!\n");
+                        return -1;
+                }
+                msleep(10); /* Delay until clock is stable for 2 cycles */
+        }
+
+        /* Enable POWERUP signal */
+        if (pdata->powerup) {
+                gpio_set_value(pdata->powerup, 1);
+                msleep(250); /* or more..? */
+        }
+        /* Enable RSTn signal */
+        if (pdata->reset) {
+                gpio_set_value(pdata->reset, 1);
+                msleep(50); /* Or more..? */
+        }
+        return 0;
+}
+
+static size_t cw1200_spi_align_size(struct hwbus_priv *self, size_t size)
+{
+        return size & 1 ? size + 1 : size;
+}
+
+static int cw1200_spi_pm(struct hwbus_priv *self, bool suspend)
+{
+        return irq_set_irq_wake(self->func->irq, suspend);
+}
+
+static struct hwbus_ops cw1200_spi_hwbus_ops = {
+        .hwbus_memcpy_fromio    = cw1200_spi_memcpy_fromio,
+        .hwbus_memcpy_toio      = cw1200_spi_memcpy_toio,
+        .lock                   = cw1200_spi_lock,
+        .unlock                 = cw1200_spi_unlock,
+        .align_size             = cw1200_spi_align_size,
+        .power_mgmt             = cw1200_spi_pm,
+};
+
+/* Probe Function to be called by SPI stack when device is discovered */
+static int cw1200_spi_probe(struct spi_device *func)
+{
+        const struct cw1200_platform_data_spi *plat_data =
+                func->dev.platform_data;
+        struct hwbus_priv *self;
+        int status;
+
+        /* Sanity check speed */
+        if (func->max_speed_hz > 52000000)
+                func->max_speed_hz = 52000000;
+        if (func->max_speed_hz < 1000000)
+                func->max_speed_hz = 1000000;
+
+        /* Fix up transfer size */
+        if (plat_data->spi_bits_per_word)
+                func->bits_per_word = plat_data->spi_bits_per_word;
+        if (!func->bits_per_word)
+                func->bits_per_word = 16;
+
+        /* And finally.. */
+        func->mode = SPI_MODE_0;
+
+        pr_info("cw1200_wlan_spi: Probe called (CS %d M %d BPW %d CLK %d)\n",
+                func->chip_select, func->mode, func->bits_per_word,
+                func->max_speed_hz);
+
+        if (cw1200_spi_on(plat_data)) {
+                pr_err("spi_on() failed!\n");
+                return -1;
+        }
+
+        if (spi_setup(func)) {
+                pr_err("spi_setup() failed!\n");
+                return -1;
+        }
+
+        self = kzalloc(sizeof(*self), GFP_KERNEL);
+        if (!self) {
+                pr_err("Can't allocate SPI hwbus_priv.");
+                return -ENOMEM;
+        }
+
+        self->pdata = plat_data;
+        self->func = func;
+        spin_lock_init(&self->lock);
+
+        spi_set_drvdata(func, self);
+
+        status = cw1200_spi_irq_subscribe(self);
+
+        status = cw1200_core_probe(&cw1200_spi_hwbus_ops,
+                                   self, &func->dev, &self->core,
+                                   self->pdata->ref_clk,
+                                   self->pdata->macaddr,
+                                   self->pdata->sdd_file,
+                                   self->pdata->have_5ghz);
+
+        if (status) {
+                cw1200_spi_irq_unsubscribe(self);
+                cw1200_spi_off(plat_data);
+                kfree(self);
+        }
+
+        return status;
+}
+
+/* Disconnect Function to be called by SPI stack when device is disconnected */
+static int cw1200_spi_disconnect(struct spi_device *func)
+{
+        struct hwbus_priv *self = spi_get_drvdata(func);
+
+        if (self) {
+                cw1200_spi_irq_unsubscribe(self);
+                if (self->core) {
+                        cw1200_core_release(self->core);
+                        self->core = NULL;
+                }
+                kfree(self);
+        }
+        cw1200_spi_off(func->dev.platform_data);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int cw1200_spi_suspend(struct device *dev, pm_message_t state)
+{
+        struct hwbus_priv *self = spi_get_drvdata(to_spi_device(dev));
+
+        if (!cw1200_can_suspend(self->core))
+                return -EAGAIN;
+
+        /* XXX notify host that we have to keep CW1200 powered on? */
+        return 0;
+}
+
+static int cw1200_spi_resume(struct device *dev)
+{
+        return 0;
+}
+#endif
+
+static struct spi_driver spi_driver = {
+        .probe          = cw1200_spi_probe,
+        .remove         = cw1200_spi_disconnect,
+        .driver = {
+                .name           = "cw1200_wlan_spi",
+                .bus            = &spi_bus_type,
+                .owner          = THIS_MODULE,
+#ifdef CONFIG_PM
+                .suspend        = cw1200_spi_suspend,
+                .resume         = cw1200_spi_resume,
+#endif
+        },
+};
+
+module_spi_driver(spi_driver);
diff --git a/drivers/net/wireless/cw1200/debug.c b/drivers/net/wireless/cw1200/debug.c
new file mode 100644
index 000000000000..e323b4d54338
--- /dev/null
+++ b/drivers/net/wireless/cw1200/debug.c
@@ -0,0 +1,428 @@
+/*
+ * mac80211 glue code for mac80211 ST-Ericsson CW1200 drivers
+ * DebugFS code
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include "cw1200.h"
+#include "debug.h"
+#include "fwio.h"
+
+/* join_status */
+static const char * const cw1200_debug_join_status[] = {
+        "passive",
+        "monitor",
+        "station (joining)",
+        "station (not authenticated yet)",
+        "station",
+        "adhoc",
+        "access point",
+};
+
+/* WSM_JOIN_PREAMBLE_... */
+static const char * const cw1200_debug_preamble[] = {
+        "long",
+        "short",
+        "long on 1 and 2 Mbps",
+};
+
+
+static const char * const cw1200_debug_link_id[] = {
+        "OFF",
+        "REQ",
+        "SOFT",
+        "HARD",
+};
+
+static const char *cw1200_debug_mode(int mode)
+{
+        switch (mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
+                return "unspecified";
+        case NL80211_IFTYPE_MONITOR:
+                return "monitor";
+        case NL80211_IFTYPE_STATION:
+                return "station";
+        case NL80211_IFTYPE_ADHOC:
+                return "adhoc";
+        case NL80211_IFTYPE_MESH_POINT:
+                return "mesh point";
+        case NL80211_IFTYPE_AP:
+                return "access point";
+        case NL80211_IFTYPE_P2P_CLIENT:
+                return "p2p client";
+        case NL80211_IFTYPE_P2P_GO:
+                return "p2p go";
+        default:
+                return "unsupported";
+        }
+}
+
+static void cw1200_queue_status_show(struct seq_file *seq,
+                                     struct cw1200_queue *q)
+{
+        int i;
+        seq_printf(seq, "Queue       %d:\n", q->queue_id);
+        seq_printf(seq, "  capacity: %zu\n", q->capacity);
+        seq_printf(seq, "  queued:   %zu\n", q->num_queued);
+        seq_printf(seq, "  pending:  %zu\n", q->num_pending);
+        seq_printf(seq, "  sent:     %zu\n", q->num_sent);
+        seq_printf(seq, "  locked:   %s\n", q->tx_locked_cnt ? "yes" : "no");
+        seq_printf(seq, "  overfull: %s\n", q->overfull ? "yes" : "no");
+        seq_puts(seq,   "  link map: 0-> ");
+        for (i = 0; i < q->stats->map_capacity; ++i)
+                seq_printf(seq, "%.2d ", q->link_map_cache[i]);
+        seq_printf(seq, "<-%zu\n", q->stats->map_capacity);
+}
+
+static void cw1200_debug_print_map(struct seq_file *seq,
+                                   struct cw1200_common *priv,
+                                   const char *label,
+                                   u32 map)
+{
+        int i;
+        seq_printf(seq, "%s0-> ", label);
+        for (i = 0; i < priv->tx_queue_stats.map_capacity; ++i)
+                seq_printf(seq, "%s ", (map & BIT(i)) ? "**" : "..");
+        seq_printf(seq, "<-%zu\n", priv->tx_queue_stats.map_capacity - 1);
+}
+
+static int cw1200_status_show(struct seq_file *seq, void *v)
+{
+        int i;
+        struct list_head *item;
+        struct cw1200_common *priv = seq->private;
+        struct cw1200_debug_priv *d = priv->debug;
+
+        seq_puts(seq,   "CW1200 Wireless LAN driver status\n");
+        seq_printf(seq, "Hardware:   %d.%d\n",
+                   priv->wsm_caps.hw_id,
+                   priv->wsm_caps.hw_subid);
+        seq_printf(seq, "Firmware:   %s %d.%d\n",
+                   cw1200_fw_types[priv->wsm_caps.fw_type],
+                   priv->wsm_caps.fw_ver,
+                   priv->wsm_caps.fw_build);
+        seq_printf(seq, "FW API:     %d\n",
+                   priv->wsm_caps.fw_api);
+        seq_printf(seq, "FW caps:    0x%.4X\n",
+                   priv->wsm_caps.fw_cap);
+        seq_printf(seq, "FW label:  '%s'\n",
+                   priv->wsm_caps.fw_label);
+        seq_printf(seq, "Mode:       %s%s\n",
+                   cw1200_debug_mode(priv->mode),
+                   priv->listening ? " (listening)" : "");
+        seq_printf(seq, "Join state: %s\n",
+                   cw1200_debug_join_status[priv->join_status]);
+        if (priv->channel)
+                seq_printf(seq, "Channel:    %d%s\n",
+                           priv->channel->hw_value,
+                           priv->channel_switch_in_progress ?
+                           " (switching)" : "");
+        if (priv->rx_filter.promiscuous)
+                seq_puts(seq,   "Filter:     promisc\n");
+        else if (priv->rx_filter.fcs)
+                seq_puts(seq,   "Filter:     fcs\n");
+        if (priv->rx_filter.bssid)
+                seq_puts(seq,   "Filter:     bssid\n");
+        if (!priv->disable_beacon_filter)
+                seq_puts(seq,   "Filter:     beacons\n");
+
+        if (priv->enable_beacon ||
+            priv->mode == NL80211_IFTYPE_AP ||
+            priv->mode == NL80211_IFTYPE_ADHOC ||
+            priv->mode == NL80211_IFTYPE_MESH_POINT ||
+            priv->mode == NL80211_IFTYPE_P2P_GO)
+                seq_printf(seq, "Beaconing:  %s\n",
+                           priv->enable_beacon ?
+                           "enabled" : "disabled");
+
+        for (i = 0; i < 4; ++i)
+                seq_printf(seq, "EDCA(%d):    %d, %d, %d, %d, %d\n", i,
+                           priv->edca.params[i].cwmin,
+                           priv->edca.params[i].cwmax,
+                           priv->edca.params[i].aifns,
+                           priv->edca.params[i].txop_limit,
+                           priv->edca.params[i].max_rx_lifetime);
+
+        if (priv->join_status == CW1200_JOIN_STATUS_STA) {
+                static const char *pm_mode = "unknown";
+                switch (priv->powersave_mode.mode) {
+                case WSM_PSM_ACTIVE:
+                        pm_mode = "off";
+                        break;
+                case WSM_PSM_PS:
+                        pm_mode = "on";
+                        break;
+                case WSM_PSM_FAST_PS:
+                        pm_mode = "dynamic";
+                        break;
+                }
+                seq_printf(seq, "Preamble:   %s\n",
+                           cw1200_debug_preamble[priv->association_mode.preamble]);
+                seq_printf(seq, "AMPDU spcn: %d\n",
+                           priv->association_mode.mpdu_start_spacing);
+                seq_printf(seq, "Basic rate: 0x%.8X\n",
+                           le32_to_cpu(priv->association_mode.basic_rate_set));
+                seq_printf(seq, "Bss lost:   %d beacons\n",
+                           priv->bss_params.beacon_lost_count);
+                seq_printf(seq, "AID:        %d\n",
+                           priv->bss_params.aid);
+                seq_printf(seq, "Rates:      0x%.8X\n",
+                           priv->bss_params.operational_rate_set);
+                seq_printf(seq, "Powersave:  %s\n", pm_mode);
+        }
+        seq_printf(seq, "HT:         %s\n",
+                   cw1200_is_ht(&priv->ht_info) ? "on" : "off");
+        if (cw1200_is_ht(&priv->ht_info)) {
+                seq_printf(seq, "Greenfield: %s\n",
+                           cw1200_ht_greenfield(&priv->ht_info) ? "yes" : "no");
+                seq_printf(seq, "AMPDU dens: %d\n",
+                           cw1200_ht_ampdu_density(&priv->ht_info));
+        }
+        seq_printf(seq, "RSSI thold: %d\n",
+                   priv->cqm_rssi_thold);
+        seq_printf(seq, "RSSI hyst:  %d\n",
+                   priv->cqm_rssi_hyst);
+        seq_printf(seq, "Long retr:  %d\n",
+                   priv->long_frame_max_tx_count);
+        seq_printf(seq, "Short retr: %d\n",
+                   priv->short_frame_max_tx_count);
+        spin_lock_bh(&priv->tx_policy_cache.lock);
+        i = 0;
+        list_for_each(item, &priv->tx_policy_cache.used)
+                ++i;
+        spin_unlock_bh(&priv->tx_policy_cache.lock);
+        seq_printf(seq, "RC in use:  %d\n", i);
+
+        seq_puts(seq, "\n");
+        for (i = 0; i < 4; ++i) {
+                cw1200_queue_status_show(seq, &priv->tx_queue[i]);
+                seq_puts(seq, "\n");
+        }
+
+        cw1200_debug_print_map(seq, priv, "Link map:   ",
+                               priv->link_id_map);
+        cw1200_debug_print_map(seq, priv, "Asleep map: ",
+                               priv->sta_asleep_mask);
+        cw1200_debug_print_map(seq, priv, "PSPOLL map: ",
+                               priv->pspoll_mask);
+
+        seq_puts(seq, "\n");
+
+        for (i = 0; i < CW1200_MAX_STA_IN_AP_MODE; ++i) {
+                if (priv->link_id_db[i].status) {
+                        seq_printf(seq, "Link %d:     %s, %pM\n",
+                                   i + 1,
+                                   cw1200_debug_link_id[priv->link_id_db[i].status],
+                                   priv->link_id_db[i].mac);
+                }
+        }
+
+        seq_puts(seq, "\n");
+
+        seq_printf(seq, "BH status:  %s\n",
+                   atomic_read(&priv->bh_term) ? "terminated" : "alive");
+        seq_printf(seq, "Pending RX: %d\n",
+                   atomic_read(&priv->bh_rx));
+        seq_printf(seq, "Pending TX: %d\n",
+                   atomic_read(&priv->bh_tx));
+        if (priv->bh_error)
+                seq_printf(seq, "BH errcode: %d\n",
+                           priv->bh_error);
+        seq_printf(seq, "TX bufs:    %d x %d bytes\n",
+                   priv->wsm_caps.input_buffers,
+                   priv->wsm_caps.input_buffer_size);
+        seq_printf(seq, "Used bufs:  %d\n",
+                   priv->hw_bufs_used);
+        seq_printf(seq, "Powermgmt:  %s\n",
+                   priv->powersave_enabled ? "on" : "off");
+        seq_printf(seq, "Device:     %s\n",
+                   priv->device_can_sleep ? "asleep" : "awake");
+
+        spin_lock(&priv->wsm_cmd.lock);
+        seq_printf(seq, "WSM status: %s\n",
+                   priv->wsm_cmd.done ? "idle" : "active");
+        seq_printf(seq, "WSM cmd:    0x%.4X (%td bytes)\n",
+                   priv->wsm_cmd.cmd, priv->wsm_cmd.len);
+        seq_printf(seq, "WSM retval: %d\n",
+                   priv->wsm_cmd.ret);
+        spin_unlock(&priv->wsm_cmd.lock);
+
+        seq_printf(seq, "Datapath:   %s\n",
+                   atomic_read(&priv->tx_lock) ? "locked" : "unlocked");
+        if (atomic_read(&priv->tx_lock))
+                seq_printf(seq, "TXlock cnt: %d\n",
+                           atomic_read(&priv->tx_lock));
+
+        seq_printf(seq, "TXed:       %d\n",
+                   d->tx);
+        seq_printf(seq, "AGG TXed:   %d\n",
+                   d->tx_agg);
+        seq_printf(seq, "MULTI TXed: %d (%d)\n",
+                   d->tx_multi, d->tx_multi_frames);
+        seq_printf(seq, "RXed:       %d\n",
+                   d->rx);
+        seq_printf(seq, "AGG RXed:   %d\n",
+                   d->rx_agg);
+        seq_printf(seq, "TX miss:    %d\n",
+                   d->tx_cache_miss);
+        seq_printf(seq, "TX align:   %d\n",
+                   d->tx_align);
+        seq_printf(seq, "TX burst:   %d\n",
+                   d->tx_burst);
+        seq_printf(seq, "TX TTL:     %d\n",
+                   d->tx_ttl);
+        seq_printf(seq, "Scan:       %s\n",
+                   atomic_read(&priv->scan.in_progress) ? "active" : "idle");
+
+        return 0;
+}
+
+static int cw1200_status_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, &cw1200_status_show,
+                inode->i_private);
+}
+
+static const struct file_operations fops_status = {
+        .open = cw1200_status_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+static int cw1200_counters_show(struct seq_file *seq, void *v)
+{
+        int ret;
+        struct cw1200_common *priv = seq->private;
+        struct wsm_mib_counters_table counters;
+
+        ret = wsm_get_counters_table(priv, &counters);
+        if (ret)
+                return ret;
+
+#define PUT_COUNTER(tab, name) \
+        seq_printf(seq, "%s:" tab "%d\n", #name, \
+                __le32_to_cpu(counters.name))
+
+        PUT_COUNTER("\t\t", plcp_errors);
+        PUT_COUNTER("\t\t", fcs_errors);
+        PUT_COUNTER("\t\t", tx_packets);
+        PUT_COUNTER("\t\t", rx_packets);
+        PUT_COUNTER("\t\t", rx_packet_errors);
+        PUT_COUNTER("\t",   rx_decryption_failures);
+        PUT_COUNTER("\t\t", rx_mic_failures);
+        PUT_COUNTER("\t",   rx_no_key_failures);
+        PUT_COUNTER("\t",   tx_multicast_frames);
+        PUT_COUNTER("\t",   tx_frames_success);
+        PUT_COUNTER("\t",   tx_frame_failures);
+        PUT_COUNTER("\t",   tx_frames_retried);
+        PUT_COUNTER("\t",   tx_frames_multi_retried);
+        PUT_COUNTER("\t",   rx_frame_duplicates);
+        PUT_COUNTER("\t\t", rts_success);
+        PUT_COUNTER("\t\t", rts_failures);
+        PUT_COUNTER("\t\t", ack_failures);
+        PUT_COUNTER("\t",   rx_multicast_frames);
+        PUT_COUNTER("\t",   rx_frames_success);
+        PUT_COUNTER("\t",   rx_cmac_icv_errors);
+        PUT_COUNTER("\t\t", rx_cmac_replays);
+        PUT_COUNTER("\t",   rx_mgmt_ccmp_replays);
+
+#undef PUT_COUNTER
+
+        return 0;
+}
+
+static int cw1200_counters_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, &cw1200_counters_show,
+                inode->i_private);
+}
+
+static const struct file_operations fops_counters = {
+        .open = cw1200_counters_open,
+        .read = seq_read,
+        .llseek = seq_lseek,
+        .release = single_release,
+        .owner = THIS_MODULE,
+};
+
+static ssize_t cw1200_wsm_dumps(struct file *file,
+        const char __user *user_buf, size_t count, loff_t *ppos)
+{
+        struct cw1200_common *priv = file->private_data;
+        char buf[1];
+
+        if (!count)
+                return -EINVAL;
+        if (copy_from_user(buf, user_buf, 1))
+                return -EFAULT;
+
+        if (buf[0] == '1')
+                priv->wsm_enable_wsm_dumps = 1;
+        else
+                priv->wsm_enable_wsm_dumps = 0;
+
+        return count;
+}
+
+static const struct file_operations fops_wsm_dumps = {
+        .open = simple_open,
+        .write = cw1200_wsm_dumps,
+        .llseek = default_llseek,
+};
+
+int cw1200_debug_init(struct cw1200_common *priv)
+{
+        int ret = -ENOMEM;
+        struct cw1200_debug_priv *d = kzalloc(sizeof(struct cw1200_debug_priv),
+                        GFP_KERNEL);
+        priv->debug = d;
+        if (!d)
+                return ret;
+
+        d->debugfs_phy = debugfs_create_dir("cw1200",
+                                            priv->hw->wiphy->debugfsdir);
+        if (!d->debugfs_phy)
+                goto err;
+
+        if (!debugfs_create_file("status", S_IRUSR, d->debugfs_phy,
+                                 priv, &fops_status))
+                goto err;
+
+        if (!debugfs_create_file("counters", S_IRUSR, d->debugfs_phy,
+                                 priv, &fops_counters))
+                goto err;
+
+        if (!debugfs_create_file("wsm_dumps", S_IWUSR, d->debugfs_phy,
+                                 priv, &fops_wsm_dumps))
+                goto err;
+
+        return 0;
+
+err:
+        priv->debug = NULL;
+        debugfs_remove_recursive(d->debugfs_phy);
+        kfree(d);
+        return ret;
+}
+
+void cw1200_debug_release(struct cw1200_common *priv)
+{
+        struct cw1200_debug_priv *d = priv->debug;
+        if (d) {
+                debugfs_remove_recursive(d->debugfs_phy);
+                priv->debug = NULL;
+                kfree(d);
+        }
+}
diff --git a/drivers/net/wireless/cw1200/debug.h b/drivers/net/wireless/cw1200/debug.h
new file mode 100644
index 000000000000..b525aba53bfc
--- /dev/null
+++ b/drivers/net/wireless/cw1200/debug.h
@@ -0,0 +1,93 @@
+/*
+ * DebugFS code for ST-Ericsson CW1200 mac80211 driver
+ *
+ * Copyright (c) 2011, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_DEBUG_H_INCLUDED
+#define CW1200_DEBUG_H_INCLUDED
+
+struct cw1200_debug_priv {
+        struct dentry *debugfs_phy;
+        int tx;
+        int tx_agg;
+        int rx;
+        int rx_agg;
+        int tx_multi;
+        int tx_multi_frames;
+        int tx_cache_miss;
+        int tx_align;
+        int tx_ttl;
+        int tx_burst;
+        int ba_cnt;
+        int ba_acc;
+        int ba_cnt_rx;
+        int ba_acc_rx;
+};
+
+int cw1200_debug_init(struct cw1200_common *priv);
+void cw1200_debug_release(struct cw1200_common *priv);
+
+static inline void cw1200_debug_txed(struct cw1200_common *priv)
+{
+        ++priv->debug->tx;
+}
+
+static inline void cw1200_debug_txed_agg(struct cw1200_common *priv)
+{
+        ++priv->debug->tx_agg;
+}
+
+static inline void cw1200_debug_txed_multi(struct cw1200_common *priv,
+                                           int count)
+{
+        ++priv->debug->tx_multi;
+        priv->debug->tx_multi_frames += count;
+}
+
+static inline void cw1200_debug_rxed(struct cw1200_common *priv)
+{
+        ++priv->debug->rx;
+}
+
+static inline void cw1200_debug_rxed_agg(struct cw1200_common *priv)
+{
+        ++priv->debug->rx_agg;
+}
+
+static inline void cw1200_debug_tx_cache_miss(struct cw1200_common *priv)
+{
+        ++priv->debug->tx_cache_miss;
+}
+
+static inline void cw1200_debug_tx_align(struct cw1200_common *priv)
+{
+        ++priv->debug->tx_align;
+}
+
+static inline void cw1200_debug_tx_ttl(struct cw1200_common *priv)
+{
+        ++priv->debug->tx_ttl;
+}
+
+static inline void cw1200_debug_tx_burst(struct cw1200_common *priv)
+{
+        ++priv->debug->tx_burst;
+}
+
+static inline void cw1200_debug_ba(struct cw1200_common *priv,
+                                   int ba_cnt, int ba_acc,
+                                   int ba_cnt_rx, int ba_acc_rx)
+{
+        priv->debug->ba_cnt = ba_cnt;
+        priv->debug->ba_acc = ba_acc;
+        priv->debug->ba_cnt_rx = ba_cnt_rx;
+        priv->debug->ba_acc_rx = ba_acc_rx;
+}
+
+#endif /* CW1200_DEBUG_H_INCLUDED */
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
new file mode 100644
index 000000000000..acdff0f7f952
--- /dev/null
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -0,0 +1,520 @@
+/*
+ * Firmware I/O code for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/init.h>
+#include <linux/vmalloc.h>
+#include <linux/sched.h>
+#include <linux/firmware.h>
+
+#include "cw1200.h"
+#include "fwio.h"
+#include "hwio.h"
+#include "hwbus.h"
+#include "bh.h"
+
+static int cw1200_get_hw_type(u32 config_reg_val, int *major_revision)
+{
+        int hw_type = -1;
+        u32 silicon_type = (config_reg_val >> 24) & 0x7;
+        u32 silicon_vers = (config_reg_val >> 31) & 0x1;
+
+        switch (silicon_type) {
+        case 0x00:
+                *major_revision = 1;
+                hw_type = HIF_9000_SILICON_VERSATILE;
+                break;
+        case 0x01:
+        case 0x02: /* CW1x00 */
+        case 0x04: /* CW1x60 */
+                *major_revision = silicon_type;
+                if (silicon_vers)
+                        hw_type = HIF_8601_VERSATILE;
+                else
+                        hw_type = HIF_8601_SILICON;
+                break;
+        default:
+                break;
+        }
+
+        return hw_type;
+}
+
+static int cw1200_load_firmware_cw1200(struct cw1200_common *priv)
+{
+        int ret, block, num_blocks;
+        unsigned i;
+        u32 val32;
+        u32 put = 0, get = 0;
+        u8 *buf = NULL;
+        const char *fw_path;
+        const struct firmware *firmware = NULL;
+
+        /* Macroses are local. */
+#define APB_WRITE(reg, val) \
+        do { \
+                ret = cw1200_apb_write_32(priv, CW1200_APB(reg), (val)); \
+                if (ret < 0) \
+                        goto error; \
+        } while (0)
+#define APB_READ(reg, val) \
+        do { \
+                ret = cw1200_apb_read_32(priv, CW1200_APB(reg), &(val)); \
+                if (ret < 0) \
+                        goto error; \
+        } while (0)
+#define REG_WRITE(reg, val) \
+        do { \
+                ret = cw1200_reg_write_32(priv, (reg), (val)); \
+                if (ret < 0) \
+                        goto error; \
+        } while (0)
+#define REG_READ(reg, val) \
+        do { \
+                ret = cw1200_reg_read_32(priv, (reg), &(val)); \
+                if (ret < 0) \
+                        goto error; \
+        } while (0)
+
+        switch (priv->hw_revision) {
+        case CW1200_HW_REV_CUT10:
+                fw_path = FIRMWARE_CUT10;
+                if (!priv->sdd_path)
+                        priv->sdd_path = SDD_FILE_10;
+                break;
+        case CW1200_HW_REV_CUT11:
+                fw_path = FIRMWARE_CUT11;
+                if (!priv->sdd_path)
+                        priv->sdd_path = SDD_FILE_11;
+                break;
+        case CW1200_HW_REV_CUT20:
+                fw_path = FIRMWARE_CUT20;
+                if (!priv->sdd_path)
+                        priv->sdd_path = SDD_FILE_20;
+                break;
+        case CW1200_HW_REV_CUT22:
+                fw_path = FIRMWARE_CUT22;
+                if (!priv->sdd_path)
+                        priv->sdd_path = SDD_FILE_22;
+                break;
+        case CW1X60_HW_REV:
+                fw_path = FIRMWARE_CW1X60;
+                if (!priv->sdd_path)
+                        priv->sdd_path = SDD_FILE_CW1X60;
+                break;
+        default:
+                pr_err("Invalid silicon revision %d.\n", priv->hw_revision);
+                return -EINVAL;
+        }
+
+        /* Initialize common registers */
+        APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, DOWNLOAD_ARE_YOU_HERE);
+        APB_WRITE(DOWNLOAD_PUT_REG, 0);
+        APB_WRITE(DOWNLOAD_GET_REG, 0);
+        APB_WRITE(DOWNLOAD_STATUS_REG, DOWNLOAD_PENDING);
+        APB_WRITE(DOWNLOAD_FLAGS_REG, 0);
+
+        /* Write the NOP Instruction */
+        REG_WRITE(ST90TDS_SRAM_BASE_ADDR_REG_ID, 0xFFF20000);
+        REG_WRITE(ST90TDS_AHB_DPORT_REG_ID, 0xEAFFFFFE);
+
+        /* Release CPU from RESET */
+        REG_READ(ST90TDS_CONFIG_REG_ID, val32);
+        val32 &= ~ST90TDS_CONFIG_CPU_RESET_BIT;
+        REG_WRITE(ST90TDS_CONFIG_REG_ID, val32);
+
+        /* Enable Clock */
+        val32 &= ~ST90TDS_CONFIG_CPU_CLK_DIS_BIT;
+        REG_WRITE(ST90TDS_CONFIG_REG_ID, val32);
+
+        /* Load a firmware file */
+        ret = request_firmware(&firmware, fw_path, priv->pdev);
+        if (ret) {
+                pr_err("Can't load firmware file %s.\n", fw_path);
+                goto error;
+        }
+
+        buf = kmalloc(DOWNLOAD_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
+        if (!buf) {
+                pr_err("Can't allocate firmware load buffer.\n");
+                ret = -ENOMEM;
+                goto error;
+        }
+
+        /* Check if the bootloader is ready */
+        for (i = 0; i < 100; i += 1 + i / 2) {
+                APB_READ(DOWNLOAD_IMAGE_SIZE_REG, val32);
+                if (val32 == DOWNLOAD_I_AM_HERE)
+                        break;
+                mdelay(i);
+        } /* End of for loop */
+
+        if (val32 != DOWNLOAD_I_AM_HERE) {
+                pr_err("Bootloader is not ready.\n");
+                ret = -ETIMEDOUT;
+                goto error;
+        }
+
+        /* Calculcate number of download blocks */
+        num_blocks = (firmware->size - 1) / DOWNLOAD_BLOCK_SIZE + 1;
+
+        /* Updating the length in Download Ctrl Area */
+        val32 = firmware->size; /* Explicit cast from size_t to u32 */
+        APB_WRITE(DOWNLOAD_IMAGE_SIZE_REG, val32);
+
+        /* Firmware downloading loop */
+        for (block = 0; block < num_blocks; block++) {
+                size_t tx_size;
+                size_t block_size;
+
+                /* check the download status */
+                APB_READ(DOWNLOAD_STATUS_REG, val32);
+                if (val32 != DOWNLOAD_PENDING) {
+                        pr_err("Bootloader reported error %d.\n", val32);
+                        ret = -EIO;
+                        goto error;
+                }
+
+                /* loop until put - get <= 24K */
+                for (i = 0; i < 100; i++) {
+                        APB_READ(DOWNLOAD_GET_REG, get);
+                        if ((put - get) <=
+                            (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE))
+                                break;
+                        mdelay(i);
+                }
+
+                if ((put - get) > (DOWNLOAD_FIFO_SIZE - DOWNLOAD_BLOCK_SIZE)) {
+                        pr_err("Timeout waiting for FIFO.\n");
+                        ret = -ETIMEDOUT;
+                        goto error;
+                }
+
+                /* calculate the block size */
+                tx_size = block_size = min((size_t)(firmware->size - put),
+                        (size_t)DOWNLOAD_BLOCK_SIZE);
+
+                memcpy(buf, &firmware->data[put], block_size);
+                if (block_size < DOWNLOAD_BLOCK_SIZE) {
+                        memset(&buf[block_size], 0,
+                               DOWNLOAD_BLOCK_SIZE - block_size);
+                        tx_size = DOWNLOAD_BLOCK_SIZE;
+                }
+
+                /* send the block to sram */
+                ret = cw1200_apb_write(priv,
+                        CW1200_APB(DOWNLOAD_FIFO_OFFSET +
+                                   (put & (DOWNLOAD_FIFO_SIZE - 1))),
+                        buf, tx_size);
+                if (ret < 0) {
+                        pr_err("Can't write firmware block @ %d!\n",
+                               put & (DOWNLOAD_FIFO_SIZE - 1));
+                        goto error;
+                }
+
+                /* update the put register */
+                put += block_size;
+                APB_WRITE(DOWNLOAD_PUT_REG, put);
+        } /* End of firmware download loop */
+
+        /* Wait for the download completion */
+        for (i = 0; i < 300; i += 1 + i / 2) {
+                APB_READ(DOWNLOAD_STATUS_REG, val32);
+                if (val32 != DOWNLOAD_PENDING)
+                        break;
+                mdelay(i);
+        }
+        if (val32 != DOWNLOAD_SUCCESS) {
+                pr_err("Wait for download completion failed: 0x%.8X\n", val32);
+                ret = -ETIMEDOUT;
+                goto error;
+        } else {
+                pr_info("Firmware download completed.\n");
+                ret = 0;
+        }
+
+error:
+        kfree(buf);
+        if (firmware)
+                release_firmware(firmware);
+        return ret;
+
+#undef APB_WRITE
+#undef APB_READ
+#undef REG_WRITE
+#undef REG_READ
+}
+
+
+static int config_reg_read(struct cw1200_common *priv, u32 *val)
+{
+        switch (priv->hw_type) {
+        case HIF_9000_SILICON_VERSATILE: {
+                u16 val16;
+                int ret = cw1200_reg_read_16(priv,
+                                             ST90TDS_CONFIG_REG_ID,
+                                             &val16);
+                if (ret < 0)
+                        return ret;
+                *val = val16;
+                return 0;
+        }
+        case HIF_8601_VERSATILE:
+        case HIF_8601_SILICON:
+        default:
+                cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, val);
+                break;
+        }
+        return 0;
+}
+
+static int config_reg_write(struct cw1200_common *priv, u32 val)
+{
+        switch (priv->hw_type) {
+        case HIF_9000_SILICON_VERSATILE:
+                return cw1200_reg_write_16(priv,
+                                           ST90TDS_CONFIG_REG_ID,
+                                           (u16)val);
+        case HIF_8601_VERSATILE:
+        case HIF_8601_SILICON:
+        default:
+                return cw1200_reg_write_32(priv, ST90TDS_CONFIG_REG_ID, val);
+                break;
+        }
+        return 0;
+}
+
+int cw1200_load_firmware(struct cw1200_common *priv)
+{
+        int ret;
+        int i;
+        u32 val32;
+        u16 val16;
+        int major_revision = -1;
+
+        /* Read CONFIG Register */
+        ret = cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+        if (ret < 0) {
+                pr_err("Can't read config register.\n");
+                goto out;
+        }
+
+        if (val32 == 0 || val32 == 0xffffffff) {
+                pr_err("Bad config register value (0x%08x)\n", val32);
+                ret = -EIO;
+                goto out;
+        }
+
+        priv->hw_type = cw1200_get_hw_type(val32, &major_revision);
+        if (priv->hw_type < 0) {
+                pr_err("Can't deduce hardware type.\n");
+                ret = -ENOTSUPP;
+                goto out;
+        }
+
+        /* Set DPLL Reg value, and read back to confirm writes work */
+        ret = cw1200_reg_write_32(priv, ST90TDS_TSET_GEN_R_W_REG_ID,
+                                  cw1200_dpll_from_clk(priv->hw_refclk));
+        if (ret < 0) {
+                pr_err("Can't write DPLL register.\n");
+                goto out;
+        }
+
+        msleep(20);
+
+        ret = cw1200_reg_read_32(priv,
+                ST90TDS_TSET_GEN_R_W_REG_ID, &val32);
+        if (ret < 0) {
+                pr_err("Can't read DPLL register.\n");
+                goto out;
+        }
+
+        if (val32 != cw1200_dpll_from_clk(priv->hw_refclk)) {
+                pr_err("Unable to initialise DPLL register. Wrote 0x%.8X, Read 0x%.8X.\n",
+                       cw1200_dpll_from_clk(priv->hw_refclk), val32);
+                ret = -EIO;
+                goto out;
+        }
+
+        /* Set wakeup bit in device */
+        ret = cw1200_reg_read_16(priv, ST90TDS_CONTROL_REG_ID, &val16);
+        if (ret < 0) {
+                pr_err("set_wakeup: can't read control register.\n");
+                goto out;
+        }
+
+        ret = cw1200_reg_write_16(priv, ST90TDS_CONTROL_REG_ID,
+                val16 | ST90TDS_CONT_WUP_BIT);
+        if (ret < 0) {
+                pr_err("set_wakeup: can't write control register.\n");
+                goto out;
+        }
+
+        /* Wait for wakeup */
+        for (i = 0; i < 300; i += (1 + i / 2)) {
+                ret = cw1200_reg_read_16(priv,
+                        ST90TDS_CONTROL_REG_ID, &val16);
+                if (ret < 0) {
+                        pr_err("wait_for_wakeup: can't read control register.\n");
+                        goto out;
+                }
+
+                if (val16 & ST90TDS_CONT_RDY_BIT)
+                        break;
+
+                msleep(i);
+        }
+
+        if ((val16 & ST90TDS_CONT_RDY_BIT) == 0) {
+                pr_err("wait_for_wakeup: device is not responding.\n");
+                ret = -ETIMEDOUT;
+                goto out;
+        }
+
+        switch (major_revision) {
+        case 1:
+                /* CW1200 Hardware detection logic : Check for CUT1.1 */
+                ret = cw1200_ahb_read_32(priv, CW1200_CUT_ID_ADDR, &val32);
+                if (ret) {
+                        pr_err("HW detection: can't read CUT ID.\n");
+                        goto out;
+                }
+
+                switch (val32) {
+                case CW1200_CUT_11_ID_STR:
+                        pr_info("CW1x00 Cut 1.1 silicon detected.\n");
+                        priv->hw_revision = CW1200_HW_REV_CUT11;
+                        break;
+                default:
+                        pr_info("CW1x00 Cut 1.0 silicon detected.\n");
+                        priv->hw_revision = CW1200_HW_REV_CUT10;
+                        break;
+                }
+
+                /* According to ST-E, CUT<2.0 has busted BA TID0-3.
+                   Just disable it entirely...
+                */
+                priv->ba_rx_tid_mask = 0;
+                priv->ba_tx_tid_mask = 0;
+                break;
+        case 2: {
+                u32 ar1, ar2, ar3;
+                ret = cw1200_ahb_read_32(priv, CW1200_CUT2_ID_ADDR, &ar1);
+                if (ret) {
+                        pr_err("(1) HW detection: can't read CUT ID\n");
+                        goto out;
+                }
+                ret = cw1200_ahb_read_32(priv, CW1200_CUT2_ID_ADDR + 4, &ar2);
+                if (ret) {
+                        pr_err("(2) HW detection: can't read CUT ID.\n");
+                        goto out;
+                }
+
+                ret = cw1200_ahb_read_32(priv, CW1200_CUT2_ID_ADDR + 8, &ar3);
+                if (ret) {
+                        pr_err("(3) HW detection: can't read CUT ID.\n");
+                        goto out;
+                }
+
+                if (ar1 == CW1200_CUT_22_ID_STR1 &&
+                    ar2 == CW1200_CUT_22_ID_STR2 &&
+                    ar3 == CW1200_CUT_22_ID_STR3) {
+                        pr_info("CW1x00 Cut 2.2 silicon detected.\n");
+                        priv->hw_revision = CW1200_HW_REV_CUT22;
+                } else {
+                        pr_info("CW1x00 Cut 2.0 silicon detected.\n");
+                        priv->hw_revision = CW1200_HW_REV_CUT20;
+                }
+                break;
+        }
+        case 4:
+                pr_info("CW1x60 silicon detected.\n");
+                priv->hw_revision = CW1X60_HW_REV;
+                break;
+        default:
+                pr_err("Unsupported silicon major revision %d.\n",
+                       major_revision);
+                ret = -ENOTSUPP;
+                goto out;
+        }
+
+        /* Checking for access mode */
+        ret = config_reg_read(priv, &val32);
+        if (ret < 0) {
+                pr_err("Can't read config register.\n");
+                goto out;
+        }
+
+        if (!(val32 & ST90TDS_CONFIG_ACCESS_MODE_BIT)) {
+                pr_err("Device is already in QUEUE mode!\n");
+                        ret = -EINVAL;
+                        goto out;
+        }
+
+        switch (priv->hw_type)  {
+        case HIF_8601_SILICON:
+                if (priv->hw_revision == CW1X60_HW_REV) {
+                        pr_err("Can't handle CW1160/1260 firmware load yet.\n");
+                        ret = -ENOTSUPP;
+                        goto out;
+                }
+                ret = cw1200_load_firmware_cw1200(priv);
+                break;
+        default:
+                pr_err("Can't perform firmware load for hw type %d.\n",
+                       priv->hw_type);
+                ret = -ENOTSUPP;
+                goto out;
+        }
+        if (ret < 0) {
+                pr_err("Firmware load error.\n");
+                goto out;
+        }
+
+        /* Enable interrupt signalling */
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        ret = __cw1200_irq_enable(priv, 1);
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        if (ret < 0)
+                goto unsubscribe;
+
+        /* Configure device for MESSSAGE MODE */
+        ret = config_reg_read(priv, &val32);
+        if (ret < 0) {
+                pr_err("Can't read config register.\n");
+                goto unsubscribe;
+        }
+        ret = config_reg_write(priv, val32 & ~ST90TDS_CONFIG_ACCESS_MODE_BIT);
+        if (ret < 0) {
+                pr_err("Can't write config register.\n");
+                goto unsubscribe;
+        }
+
+        /* Unless we read the CONFIG Register we are
+         * not able to get an interrupt
+         */
+        mdelay(10);
+        config_reg_read(priv, &val32);
+
+out:
+        return ret;
+
+unsubscribe:
+        /* Disable interrupt signalling */
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        ret = __cw1200_irq_enable(priv, 0);
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
diff --git a/drivers/net/wireless/cw1200/fwio.h b/drivers/net/wireless/cw1200/fwio.h
new file mode 100644
index 000000000000..ea3099362cdf
--- /dev/null
+++ b/drivers/net/wireless/cw1200/fwio.h
@@ -0,0 +1,39 @@
+/*
+ * Firmware API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef FWIO_H_INCLUDED
+#define FWIO_H_INCLUDED
+
+#define BOOTLOADER_CW1X60       "boot_cw1x60.bin"
+#define FIRMWARE_CW1X60         "wsm_cw1x60.bin"
+#define FIRMWARE_CUT22          "wsm_22.bin"
+#define FIRMWARE_CUT20          "wsm_20.bin"
+#define FIRMWARE_CUT11          "wsm_11.bin"
+#define FIRMWARE_CUT10          "wsm_10.bin"
+#define SDD_FILE_CW1X60         "sdd_cw1x60.bin"
+#define SDD_FILE_22             "sdd_22.bin"
+#define SDD_FILE_20             "sdd_20.bin"
+#define SDD_FILE_11             "sdd_11.bin"
+#define SDD_FILE_10             "sdd_10.bin"
+
+int cw1200_load_firmware(struct cw1200_common *priv);
+
+/* SDD definitions */
+#define SDD_PTA_CFG_ELT_ID 0xEB
+#define SDD_REFERENCE_FREQUENCY_ELT_ID 0xc5
+u32 cw1200_dpll_from_clk(u16 clk);
+
+#endif
diff --git a/drivers/net/wireless/cw1200/hwbus.h b/drivers/net/wireless/cw1200/hwbus.h
new file mode 100644
index 000000000000..8b2fc831c3de
--- /dev/null
+++ b/drivers/net/wireless/cw1200/hwbus.h
@@ -0,0 +1,33 @@
+/*
+ * Common hwbus abstraction layer interface for cw1200 wireless driver
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_HWBUS_H
+#define CW1200_HWBUS_H
+
+struct hwbus_priv;
+
+void cw1200_irq_handler(struct cw1200_common *priv);
+
+/* This MUST be wrapped with hwbus_ops->lock/unlock! */
+int __cw1200_irq_enable(struct cw1200_common *priv, int enable);
+
+struct hwbus_ops {
+        int (*hwbus_memcpy_fromio)(struct hwbus_priv *self, unsigned int addr,
+                                        void *dst, int count);
+        int (*hwbus_memcpy_toio)(struct hwbus_priv *self, unsigned int addr,
+                                        const void *src, int count);
+        void (*lock)(struct hwbus_priv *self);
+        void (*unlock)(struct hwbus_priv *self);
+        size_t (*align_size)(struct hwbus_priv *self, size_t size);
+        int (*power_mgmt)(struct hwbus_priv *self, bool suspend);
+};
+
+#endif /* CW1200_HWBUS_H */
diff --git a/drivers/net/wireless/cw1200/hwio.c b/drivers/net/wireless/cw1200/hwio.c
new file mode 100644
index 000000000000..dad3fb331818
--- /dev/null
+++ b/drivers/net/wireless/cw1200/hwio.c
@@ -0,0 +1,310 @@
+/*
+ * Low-level device IO routines for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver, which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/types.h>
+
+#include "cw1200.h"
+#include "hwio.h"
+#include "hwbus.h"
+
+ /* Sdio addr is 4*spi_addr */
+#define SPI_REG_ADDR_TO_SDIO(spi_reg_addr) ((spi_reg_addr) << 2)
+#define SDIO_ADDR17BIT(buf_id, mpf, rfu, reg_id_ofs) \
+                                ((((buf_id)    & 0x1F) << 7) \
+                                | (((mpf)        & 1) << 6) \
+                                | (((rfu)        & 1) << 5) \
+                                | (((reg_id_ofs) & 0x1F) << 0))
+#define MAX_RETRY               3
+
+
+static int __cw1200_reg_read(struct cw1200_common *priv, u16 addr,
+                             void *buf, size_t buf_len, int buf_id)
+{
+        u16 addr_sdio;
+        u32 sdio_reg_addr_17bit;
+
+        /* Check if buffer is aligned to 4 byte boundary */
+        if (WARN_ON(((unsigned long)buf & 3) && (buf_len > 4))) {
+                pr_err("buffer is not aligned.\n");
+                return -EINVAL;
+        }
+
+        /* Convert to SDIO Register Address */
+        addr_sdio = SPI_REG_ADDR_TO_SDIO(addr);
+        sdio_reg_addr_17bit = SDIO_ADDR17BIT(buf_id, 0, 0, addr_sdio);
+
+        return priv->hwbus_ops->hwbus_memcpy_fromio(priv->hwbus_priv,
+                                                  sdio_reg_addr_17bit,
+                                                  buf, buf_len);
+}
+
+static int __cw1200_reg_write(struct cw1200_common *priv, u16 addr,
+                                const void *buf, size_t buf_len, int buf_id)
+{
+        u16 addr_sdio;
+        u32 sdio_reg_addr_17bit;
+
+        /* Convert to SDIO Register Address */
+        addr_sdio = SPI_REG_ADDR_TO_SDIO(addr);
+        sdio_reg_addr_17bit = SDIO_ADDR17BIT(buf_id, 0, 0, addr_sdio);
+
+        return priv->hwbus_ops->hwbus_memcpy_toio(priv->hwbus_priv,
+                                                sdio_reg_addr_17bit,
+                                                buf, buf_len);
+}
+
+static inline int __cw1200_reg_read_32(struct cw1200_common *priv,
+                                        u16 addr, u32 *val)
+{
+        int i = __cw1200_reg_read(priv, addr, val, sizeof(*val), 0);
+        *val = le32_to_cpu(*val);
+        return i;
+}
+
+static inline int __cw1200_reg_write_32(struct cw1200_common *priv,
+                                        u16 addr, u32 val)
+{
+        val = cpu_to_le32(val);
+        return __cw1200_reg_write(priv, addr, &val, sizeof(val), 0);
+}
+
+static inline int __cw1200_reg_read_16(struct cw1200_common *priv,
+                                        u16 addr, u16 *val)
+{
+        int i = __cw1200_reg_read(priv, addr, val, sizeof(*val), 0);
+        *val = le16_to_cpu(*val);
+        return i;
+}
+
+static inline int __cw1200_reg_write_16(struct cw1200_common *priv,
+                                        u16 addr, u16 val)
+{
+        val = cpu_to_le16(val);
+        return __cw1200_reg_write(priv, addr, &val, sizeof(val), 0);
+}
+
+int cw1200_reg_read(struct cw1200_common *priv, u16 addr, void *buf,
+                        size_t buf_len)
+{
+        int ret;
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        ret = __cw1200_reg_read(priv, addr, buf, buf_len, 0);
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int cw1200_reg_write(struct cw1200_common *priv, u16 addr, const void *buf,
+                        size_t buf_len)
+{
+        int ret;
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        ret = __cw1200_reg_write(priv, addr, buf, buf_len, 0);
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int cw1200_data_read(struct cw1200_common *priv, void *buf, size_t buf_len)
+{
+        int ret, retry = 1;
+        int buf_id_rx = priv->buf_id_rx;
+
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+
+        while (retry <= MAX_RETRY) {
+                ret = __cw1200_reg_read(priv,
+                                        ST90TDS_IN_OUT_QUEUE_REG_ID, buf,
+                                        buf_len, buf_id_rx + 1);
+                if (!ret) {
+                        buf_id_rx = (buf_id_rx + 1) & 3;
+                        priv->buf_id_rx = buf_id_rx;
+                        break;
+                } else {
+                        retry++;
+                        mdelay(1);
+                        pr_err("error :[%d]\n", ret);
+                }
+        }
+
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int cw1200_data_write(struct cw1200_common *priv, const void *buf,
+                        size_t buf_len)
+{
+        int ret, retry = 1;
+        int buf_id_tx = priv->buf_id_tx;
+
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+
+        while (retry <= MAX_RETRY) {
+                ret = __cw1200_reg_write(priv,
+                                         ST90TDS_IN_OUT_QUEUE_REG_ID, buf,
+                                         buf_len, buf_id_tx);
+                if (!ret) {
+                        buf_id_tx = (buf_id_tx + 1) & 31;
+                        priv->buf_id_tx = buf_id_tx;
+                        break;
+                } else {
+                        retry++;
+                        mdelay(1);
+                        pr_err("error :[%d]\n", ret);
+                }
+        }
+
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int cw1200_indirect_read(struct cw1200_common *priv, u32 addr, void *buf,
+                         size_t buf_len, u32 prefetch, u16 port_addr)
+{
+        u32 val32 = 0;
+        int i, ret;
+
+        if ((buf_len / 2) >= 0x1000) {
+                pr_err("Can't read more than 0xfff words.\n");
+                return -EINVAL;
+        }
+
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+        /* Write address */
+        ret = __cw1200_reg_write_32(priv, ST90TDS_SRAM_BASE_ADDR_REG_ID, addr);
+        if (ret < 0) {
+                pr_err("Can't write address register.\n");
+                goto out;
+        }
+
+        /* Read CONFIG Register Value - We will read 32 bits */
+        ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+        if (ret < 0) {
+                pr_err("Can't read config register.\n");
+                goto out;
+        }
+
+        /* Set PREFETCH bit */
+        ret = __cw1200_reg_write_32(priv, ST90TDS_CONFIG_REG_ID,
+                                        val32 | prefetch);
+        if (ret < 0) {
+                pr_err("Can't write prefetch bit.\n");
+                goto out;
+        }
+
+        /* Check for PRE-FETCH bit to be cleared */
+        for (i = 0; i < 20; i++) {
+                ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+                if (ret < 0) {
+                        pr_err("Can't check prefetch bit.\n");
+                        goto out;
+                }
+                if (!(val32 & prefetch))
+                        break;
+
+                mdelay(i);
+        }
+
+        if (val32 & prefetch) {
+                pr_err("Prefetch bit is not cleared.\n");
+                goto out;
+        }
+
+        /* Read data port */
+        ret = __cw1200_reg_read(priv, port_addr, buf, buf_len, 0);
+        if (ret < 0) {
+                pr_err("Can't read data port.\n");
+                goto out;
+        }
+
+out:
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int cw1200_apb_write(struct cw1200_common *priv, u32 addr, const void *buf,
+                        size_t buf_len)
+{
+        int ret;
+
+        if ((buf_len / 2) >= 0x1000) {
+                pr_err("Can't write more than 0xfff words.\n");
+                return -EINVAL;
+        }
+
+        priv->hwbus_ops->lock(priv->hwbus_priv);
+
+        /* Write address */
+        ret = __cw1200_reg_write_32(priv, ST90TDS_SRAM_BASE_ADDR_REG_ID, addr);
+        if (ret < 0) {
+                pr_err("Can't write address register.\n");
+                goto out;
+        }
+
+        /* Write data port */
+        ret = __cw1200_reg_write(priv, ST90TDS_SRAM_DPORT_REG_ID,
+                                        buf, buf_len, 0);
+        if (ret < 0) {
+                pr_err("Can't write data port.\n");
+                goto out;
+        }
+
+out:
+        priv->hwbus_ops->unlock(priv->hwbus_priv);
+        return ret;
+}
+
+int __cw1200_irq_enable(struct cw1200_common *priv, int enable)
+{
+        u32 val32;
+        u16 val16;
+        int ret;
+
+        if (HIF_8601_SILICON == priv->hw_type) {
+                ret = __cw1200_reg_read_32(priv, ST90TDS_CONFIG_REG_ID, &val32);
+                if (ret < 0) {
+                        pr_err("Can't read config register.\n");
+                        return ret;
+                }
+
+                if (enable)
+                        val32 |= ST90TDS_CONF_IRQ_RDY_ENABLE;
+                else
+                        val32 &= ~ST90TDS_CONF_IRQ_RDY_ENABLE;
+
+                ret = __cw1200_reg_write_32(priv, ST90TDS_CONFIG_REG_ID, val32);
+                if (ret < 0) {
+                        pr_err("Can't write config register.\n");
+                        return ret;
+                }
+        } else {
+                ret = __cw1200_reg_read_16(priv, ST90TDS_CONFIG_REG_ID, &val16);
+                if (ret < 0) {
+                        pr_err("Can't read control register.\n");
+                        return ret;
+                }
+
+                if (enable)
+                        val16 |= ST90TDS_CONT_IRQ_RDY_ENABLE;
+                else
+                        val16 &= ~ST90TDS_CONT_IRQ_RDY_ENABLE;
+
+                ret = __cw1200_reg_write_16(priv, ST90TDS_CONFIG_REG_ID, val16);
+                if (ret < 0) {
+                        pr_err("Can't write control register.\n");
+                        return ret;
+                }
+        }
+        return 0;
+}
diff --git a/drivers/net/wireless/cw1200/hwio.h b/drivers/net/wireless/cw1200/hwio.h
new file mode 100644
index 000000000000..563329cfead6
--- /dev/null
+++ b/drivers/net/wireless/cw1200/hwio.h
@@ -0,0 +1,246 @@
+/*
+ * Low-level API for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * ST-Ericsson UMAC CW1200 driver which is
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Ajitpal Singh <ajitpal.singh@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_HWIO_H_INCLUDED
+#define CW1200_HWIO_H_INCLUDED
+
+/* extern */ struct cw1200_common;
+
+#define CW1200_CUT_11_ID_STR            (0x302E3830)
+#define CW1200_CUT_22_ID_STR1           (0x302e3132)
+#define CW1200_CUT_22_ID_STR2           (0x32302e30)
+#define CW1200_CUT_22_ID_STR3           (0x3335)
+#define CW1200_CUT_ID_ADDR              (0xFFF17F90)
+#define CW1200_CUT2_ID_ADDR             (0xFFF1FF90)
+
+/* Download control area */
+/* boot loader start address in SRAM */
+#define DOWNLOAD_BOOT_LOADER_OFFSET     (0x00000000)
+/* 32K, 0x4000 to 0xDFFF */
+#define DOWNLOAD_FIFO_OFFSET            (0x00004000)
+/* 32K */
+#define DOWNLOAD_FIFO_SIZE              (0x00008000)
+/* 128 bytes, 0xFF80 to 0xFFFF */
+#define DOWNLOAD_CTRL_OFFSET            (0x0000FF80)
+#define DOWNLOAD_CTRL_DATA_DWORDS       (32-6)
+
+struct download_cntl_t {
+        /* size of whole firmware file (including Cheksum), host init */
+        u32 image_size;
+        /* downloading flags */
+        u32 flags;
+        /* No. of bytes put into the download, init & updated by host */
+        u32 put;
+        /* last traced program counter, last ARM reg_pc */
+        u32 trace_pc;
+        /* No. of bytes read from the download, host init, device updates */
+        u32 get;
+        /* r0, boot losader status, host init to pending, device updates */
+        u32 status;
+        /* Extra debug info, r1 to r14 if status=r0=DOWNLOAD_EXCEPTION */
+        u32 debug_data[DOWNLOAD_CTRL_DATA_DWORDS];
+};
+
+#define DOWNLOAD_IMAGE_SIZE_REG         \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, image_size))
+#define DOWNLOAD_FLAGS_REG              \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, flags))
+#define DOWNLOAD_PUT_REG                \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, put))
+#define DOWNLOAD_TRACE_PC_REG           \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, trace_pc))
+#define DOWNLOAD_GET_REG                \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, get))
+#define DOWNLOAD_STATUS_REG             \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, status))
+#define DOWNLOAD_DEBUG_DATA_REG         \
+        (DOWNLOAD_CTRL_OFFSET + offsetof(struct download_cntl_t, debug_data))
+#define DOWNLOAD_DEBUG_DATA_LEN         (108)
+
+#define DOWNLOAD_BLOCK_SIZE             (1024)
+
+/* For boot loader detection */
+#define DOWNLOAD_ARE_YOU_HERE           (0x87654321)
+#define DOWNLOAD_I_AM_HERE              (0x12345678)
+
+/* Download error code */
+#define DOWNLOAD_PENDING                (0xFFFFFFFF)
+#define DOWNLOAD_SUCCESS                (0)
+#define DOWNLOAD_EXCEPTION              (1)
+#define DOWNLOAD_ERR_MEM_1              (2)
+#define DOWNLOAD_ERR_MEM_2              (3)
+#define DOWNLOAD_ERR_SOFTWARE           (4)
+#define DOWNLOAD_ERR_FILE_SIZE          (5)
+#define DOWNLOAD_ERR_CHECKSUM           (6)
+#define DOWNLOAD_ERR_OVERFLOW           (7)
+#define DOWNLOAD_ERR_IMAGE              (8)
+#define DOWNLOAD_ERR_HOST               (9)
+#define DOWNLOAD_ERR_ABORT              (10)
+
+
+#define SYS_BASE_ADDR_SILICON           (0)
+#define PAC_BASE_ADDRESS_SILICON        (SYS_BASE_ADDR_SILICON + 0x09000000)
+#define PAC_SHARED_MEMORY_SILICON       (PAC_BASE_ADDRESS_SILICON)
+
+#define CW1200_APB(addr)                (PAC_SHARED_MEMORY_SILICON + (addr))
+
+/* Device register definitions */
+
+/* WBF - SPI Register Addresses */
+#define ST90TDS_ADDR_ID_BASE            (0x0000)
+/* 16/32 bits */
+#define ST90TDS_CONFIG_REG_ID           (0x0000)
+/* 16/32 bits */
+#define ST90TDS_CONTROL_REG_ID          (0x0001)
+/* 16 bits, Q mode W/R */
+#define ST90TDS_IN_OUT_QUEUE_REG_ID     (0x0002)
+/* 32 bits, AHB bus R/W */
+#define ST90TDS_AHB_DPORT_REG_ID        (0x0003)
+/* 16/32 bits */
+#define ST90TDS_SRAM_BASE_ADDR_REG_ID   (0x0004)
+/* 32 bits, APB bus R/W */
+#define ST90TDS_SRAM_DPORT_REG_ID       (0x0005)
+/* 32 bits, t_settle/general */
+#define ST90TDS_TSET_GEN_R_W_REG_ID     (0x0006)
+/* 16 bits, Q mode read, no length */
+#define ST90TDS_FRAME_OUT_REG_ID        (0x0007)
+#define ST90TDS_ADDR_ID_MAX             (ST90TDS_FRAME_OUT_REG_ID)
+
+/* WBF - Control register bit set */
+/* next o/p length, bit 11 to 0 */
+#define ST90TDS_CONT_NEXT_LEN_MASK      (0x0FFF)
+#define ST90TDS_CONT_WUP_BIT            (BIT(12))
+#define ST90TDS_CONT_RDY_BIT            (BIT(13))
+#define ST90TDS_CONT_IRQ_ENABLE         (BIT(14))
+#define ST90TDS_CONT_RDY_ENABLE         (BIT(15))
+#define ST90TDS_CONT_IRQ_RDY_ENABLE     (BIT(14)|BIT(15))
+
+/* SPI Config register bit set */
+#define ST90TDS_CONFIG_FRAME_BIT        (BIT(2))
+#define ST90TDS_CONFIG_WORD_MODE_BITS   (BIT(3)|BIT(4))
+#define ST90TDS_CONFIG_WORD_MODE_1      (BIT(3))
+#define ST90TDS_CONFIG_WORD_MODE_2      (BIT(4))
+#define ST90TDS_CONFIG_ERROR_0_BIT      (BIT(5))
+#define ST90TDS_CONFIG_ERROR_1_BIT      (BIT(6))
+#define ST90TDS_CONFIG_ERROR_2_BIT      (BIT(7))
+/* TBD: Sure??? */
+#define ST90TDS_CONFIG_CSN_FRAME_BIT    (BIT(7))
+#define ST90TDS_CONFIG_ERROR_3_BIT      (BIT(8))
+#define ST90TDS_CONFIG_ERROR_4_BIT      (BIT(9))
+/* QueueM */
+#define ST90TDS_CONFIG_ACCESS_MODE_BIT  (BIT(10))
+/* AHB bus */
+#define ST90TDS_CONFIG_AHB_PRFETCH_BIT  (BIT(11))
+#define ST90TDS_CONFIG_CPU_CLK_DIS_BIT  (BIT(12))
+/* APB bus */
+#define ST90TDS_CONFIG_PRFETCH_BIT      (BIT(13))
+/* cpu reset */
+#define ST90TDS_CONFIG_CPU_RESET_BIT    (BIT(14))
+#define ST90TDS_CONFIG_CLEAR_INT_BIT    (BIT(15))
+
+/* For CW1200 the IRQ Enable and Ready Bits are in CONFIG register */
+#define ST90TDS_CONF_IRQ_ENABLE         (BIT(16))
+#define ST90TDS_CONF_RDY_ENABLE         (BIT(17))
+#define ST90TDS_CONF_IRQ_RDY_ENABLE     (BIT(16)|BIT(17))
+
+int cw1200_data_read(struct cw1200_common *priv,
+                     void *buf, size_t buf_len);
+int cw1200_data_write(struct cw1200_common *priv,
+                      const void *buf, size_t buf_len);
+
+int cw1200_reg_read(struct cw1200_common *priv, u16 addr,
+                    void *buf, size_t buf_len);
+int cw1200_reg_write(struct cw1200_common *priv, u16 addr,
+                     const void *buf, size_t buf_len);
+
+static inline int cw1200_reg_read_16(struct cw1200_common *priv,
+                                     u16 addr, u16 *val)
+{
+        u32 tmp;
+        int i;
+        i = cw1200_reg_read(priv, addr, &tmp, sizeof(tmp));
+        tmp = le32_to_cpu(tmp);
+        *val = tmp & 0xffff;
+        return i;
+}
+
+static inline int cw1200_reg_write_16(struct cw1200_common *priv,
+                                      u16 addr, u16 val)
+{
+        u32 tmp = val;
+        tmp = cpu_to_le32(tmp);
+        return cw1200_reg_write(priv, addr, &tmp, sizeof(tmp));
+}
+
+static inline int cw1200_reg_read_32(struct cw1200_common *priv,
+                                     u16 addr, u32 *val)
+{
+        int i = cw1200_reg_read(priv, addr, val, sizeof(*val));
+        *val = le32_to_cpu(*val);
+        return i;
+}
+
+static inline int cw1200_reg_write_32(struct cw1200_common *priv,
+                                      u16 addr, u32 val)
+{
+        val = cpu_to_le32(val);
+        return cw1200_reg_write(priv, addr, &val, sizeof(val));
+}
+
+int cw1200_indirect_read(struct cw1200_common *priv, u32 addr, void *buf,
+                         size_t buf_len, u32 prefetch, u16 port_addr);
+int cw1200_apb_write(struct cw1200_common *priv, u32 addr, const void *buf,
+                     size_t buf_len);
+
+static inline int cw1200_apb_read(struct cw1200_common *priv, u32 addr,
+                                  void *buf, size_t buf_len)
+{
+        return cw1200_indirect_read(priv, addr, buf, buf_len,
+                                    ST90TDS_CONFIG_PRFETCH_BIT,
+                                    ST90TDS_SRAM_DPORT_REG_ID);
+}
+
+static inline int cw1200_ahb_read(struct cw1200_common *priv, u32 addr,
+                                  void *buf, size_t buf_len)
+{
+        return cw1200_indirect_read(priv, addr, buf, buf_len,
+                                    ST90TDS_CONFIG_AHB_PRFETCH_BIT,
+                                    ST90TDS_AHB_DPORT_REG_ID);
+}
+
+static inline int cw1200_apb_read_32(struct cw1200_common *priv,
+                                     u32 addr, u32 *val)
+{
+        int i = cw1200_apb_read(priv, addr, val, sizeof(*val));
+        *val = le32_to_cpu(*val);
+        return i;
+}
+
+static inline int cw1200_apb_write_32(struct cw1200_common *priv,
+                                      u32 addr, u32 val)
+{
+        val = cpu_to_le32(val);
+        return cw1200_apb_write(priv, addr, &val, sizeof(val));
+}
+static inline int cw1200_ahb_read_32(struct cw1200_common *priv,
+                                     u32 addr, u32 *val)
+{
+        int i = cw1200_ahb_read(priv, addr, val, sizeof(*val));
+        *val = le32_to_cpu(*val);
+        return i;
+}
+
+#endif /* CW1200_HWIO_H_INCLUDED */
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
new file mode 100644
index 000000000000..9f9adb4fbfb8
--- /dev/null
+++ b/drivers/net/wireless/cw1200/main.c
@@ -0,0 +1,600 @@
+/*
+ * mac80211 glue code for mac80211 ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on:
+ * Copyright (c) 2006, Michael Wu <flamingice@sourmilk.net>
+ * Copyright (c) 2007-2009, Christian Lamparter <chunkeey@web.de>
+ * Copyright 2008, Johannes Berg <johannes@sipsolutions.net>
+ *
+ * Based on:
+ * - the islsm (softmac prism54) driver, which is:
+ *   Copyright 2004-2006 Jean-Baptiste Note <jbnote@gmail.com>, et al.
+ * - stlc45xx driver
+ *   Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies).
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/firmware.h>
+#include <linux/etherdevice.h>
+#include <linux/vmalloc.h>
+#include <linux/random.h>
+#include <linux/sched.h>
+#include <net/mac80211.h>
+
+#include "cw1200.h"
+#include "txrx.h"
+#include "hwbus.h"
+#include "fwio.h"
+#include "hwio.h"
+#include "bh.h"
+#include "sta.h"
+#include "scan.h"
+#include "debug.h"
+#include "pm.h"
+
+MODULE_AUTHOR("Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>");
+MODULE_DESCRIPTION("Softmac ST-Ericsson CW1200 common code");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("cw1200_core");
+
+/* Accept MAC address of the form macaddr=0x00,0x80,0xE1,0x30,0x40,0x50 */
+static u8 cw1200_mac_template[ETH_ALEN] = {0x02, 0x80, 0xe1, 0x00, 0x00, 0x00};
+module_param_array_named(macaddr, cw1200_mac_template, byte, NULL, S_IRUGO);
+MODULE_PARM_DESC(macaddr, "Override platform_data MAC address");
+
+static char *cw1200_sdd_path;
+module_param(cw1200_sdd_path, charp, 0644);
+MODULE_PARM_DESC(cw1200_sdd_path, "Override platform_data SDD file");
+static int cw1200_refclk;
+module_param(cw1200_refclk, int, 0644);
+MODULE_PARM_DESC(cw1200_refclk, "Override platform_data reference clock");
+
+int cw1200_power_mode = wsm_power_mode_quiescent;
+module_param(cw1200_power_mode, int, 0644);
+MODULE_PARM_DESC(cw1200_power_mode, "WSM power mode.  0 == active, 1 == doze, 2 == quiescent (default)");
+
+#define RATETAB_ENT(_rate, _rateid, _flags)             \
+        {                                               \
+                .bitrate        = (_rate),              \
+                .hw_value       = (_rateid),            \
+                .flags          = (_flags),             \
+        }
+
+static struct ieee80211_rate cw1200_rates[] = {
+        RATETAB_ENT(10,  0,   0),
+        RATETAB_ENT(20,  1,   0),
+        RATETAB_ENT(55,  2,   0),
+        RATETAB_ENT(110, 3,   0),
+        RATETAB_ENT(60,  6,  0),
+        RATETAB_ENT(90,  7,  0),
+        RATETAB_ENT(120, 8,  0),
+        RATETAB_ENT(180, 9,  0),
+        RATETAB_ENT(240, 10, 0),
+        RATETAB_ENT(360, 11, 0),
+        RATETAB_ENT(480, 12, 0),
+        RATETAB_ENT(540, 13, 0),
+};
+
+static struct ieee80211_rate cw1200_mcs_rates[] = {
+        RATETAB_ENT(65,  14, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(130, 15, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(195, 16, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(260, 17, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(390, 18, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(520, 19, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(585, 20, IEEE80211_TX_RC_MCS),
+        RATETAB_ENT(650, 21, IEEE80211_TX_RC_MCS),
+};
+
+#define cw1200_a_rates          (cw1200_rates + 4)
+#define cw1200_a_rates_size     (ARRAY_SIZE(cw1200_rates) - 4)
+#define cw1200_g_rates          (cw1200_rates + 0)
+#define cw1200_g_rates_size     (ARRAY_SIZE(cw1200_rates))
+#define cw1200_n_rates          (cw1200_mcs_rates)
+#define cw1200_n_rates_size     (ARRAY_SIZE(cw1200_mcs_rates))
+
+
+#define CHAN2G(_channel, _freq, _flags) {                       \
+        .band                   = IEEE80211_BAND_2GHZ,          \
+        .center_freq            = (_freq),                      \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+#define CHAN5G(_channel, _flags) {                              \
+        .band                   = IEEE80211_BAND_5GHZ,          \
+        .center_freq    = 5000 + (5 * (_channel)),              \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 30,                           \
+}
+
+static struct ieee80211_channel cw1200_2ghz_chantable[] = {
+        CHAN2G(1, 2412, 0),
+        CHAN2G(2, 2417, 0),
+        CHAN2G(3, 2422, 0),
+        CHAN2G(4, 2427, 0),
+        CHAN2G(5, 2432, 0),
+        CHAN2G(6, 2437, 0),
+        CHAN2G(7, 2442, 0),
+        CHAN2G(8, 2447, 0),
+        CHAN2G(9, 2452, 0),
+        CHAN2G(10, 2457, 0),
+        CHAN2G(11, 2462, 0),
+        CHAN2G(12, 2467, 0),
+        CHAN2G(13, 2472, 0),
+        CHAN2G(14, 2484, 0),
+};
+
+static struct ieee80211_channel cw1200_5ghz_chantable[] = {
+        CHAN5G(34, 0),          CHAN5G(36, 0),
+        CHAN5G(38, 0),          CHAN5G(40, 0),
+        CHAN5G(42, 0),          CHAN5G(44, 0),
+        CHAN5G(46, 0),          CHAN5G(48, 0),
+        CHAN5G(52, 0),          CHAN5G(56, 0),
+        CHAN5G(60, 0),          CHAN5G(64, 0),
+        CHAN5G(100, 0),         CHAN5G(104, 0),
+        CHAN5G(108, 0),         CHAN5G(112, 0),
+        CHAN5G(116, 0),         CHAN5G(120, 0),
+        CHAN5G(124, 0),         CHAN5G(128, 0),
+        CHAN5G(132, 0),         CHAN5G(136, 0),
+        CHAN5G(140, 0),         CHAN5G(149, 0),
+        CHAN5G(153, 0),         CHAN5G(157, 0),
+        CHAN5G(161, 0),         CHAN5G(165, 0),
+        CHAN5G(184, 0),         CHAN5G(188, 0),
+        CHAN5G(192, 0),         CHAN5G(196, 0),
+        CHAN5G(200, 0),         CHAN5G(204, 0),
+        CHAN5G(208, 0),         CHAN5G(212, 0),
+        CHAN5G(216, 0),
+};
+
+static struct ieee80211_supported_band cw1200_band_2ghz = {
+        .channels = cw1200_2ghz_chantable,
+        .n_channels = ARRAY_SIZE(cw1200_2ghz_chantable),
+        .bitrates = cw1200_g_rates,
+        .n_bitrates = cw1200_g_rates_size,
+        .ht_cap = {
+                .cap = IEEE80211_HT_CAP_GRN_FLD |
+                        (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT) |
+                        IEEE80211_HT_CAP_MAX_AMSDU,
+                .ht_supported = 1,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE,
+                .mcs = {
+                        .rx_mask[0] = 0xFF,
+                        .rx_highest = __cpu_to_le16(0x41),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+        },
+};
+
+static struct ieee80211_supported_band cw1200_band_5ghz = {
+        .channels = cw1200_5ghz_chantable,
+        .n_channels = ARRAY_SIZE(cw1200_5ghz_chantable),
+        .bitrates = cw1200_a_rates,
+        .n_bitrates = cw1200_a_rates_size,
+        .ht_cap = {
+                .cap = IEEE80211_HT_CAP_GRN_FLD |
+                        (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT) |
+                        IEEE80211_HT_CAP_MAX_AMSDU,
+                .ht_supported = 1,
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_8K,
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_NONE,
+                .mcs = {
+                        .rx_mask[0] = 0xFF,
+                        .rx_highest = __cpu_to_le16(0x41),
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
+                },
+        },
+};
+
+static const unsigned long cw1200_ttl[] = {
+        1 * HZ, /* VO */
+        2 * HZ, /* VI */
+        5 * HZ, /* BE */
+        10 * HZ /* BK */
+};
+
+static const struct ieee80211_ops cw1200_ops = {
+        .start                  = cw1200_start,
+        .stop                   = cw1200_stop,
+        .add_interface          = cw1200_add_interface,
+        .remove_interface       = cw1200_remove_interface,
+        .change_interface       = cw1200_change_interface,
+        .tx                     = cw1200_tx,
+        .hw_scan                = cw1200_hw_scan,
+        .set_tim                = cw1200_set_tim,
+        .sta_notify             = cw1200_sta_notify,
+        .sta_add                = cw1200_sta_add,
+        .sta_remove             = cw1200_sta_remove,
+        .set_key                = cw1200_set_key,
+        .set_rts_threshold      = cw1200_set_rts_threshold,
+        .config                 = cw1200_config,
+        .bss_info_changed       = cw1200_bss_info_changed,
+        .prepare_multicast      = cw1200_prepare_multicast,
+        .configure_filter       = cw1200_configure_filter,
+        .conf_tx                = cw1200_conf_tx,
+        .get_stats              = cw1200_get_stats,
+        .ampdu_action           = cw1200_ampdu_action,
+        .flush                  = cw1200_flush,
+#ifdef CONFIG_PM
+        .suspend                = cw1200_wow_suspend,
+        .resume                 = cw1200_wow_resume,
+#endif
+        /* Intentionally not offloaded:                                 */
+        /*.channel_switch       = cw1200_channel_switch,                */
+        /*.remain_on_channel    = cw1200_remain_on_channel,             */
+        /*.cancel_remain_on_channel = cw1200_cancel_remain_on_channel,  */
+};
+
+int cw1200_ba_rx_tids = -1;
+int cw1200_ba_tx_tids = -1;
+module_param(cw1200_ba_rx_tids, int, 0644);
+module_param(cw1200_ba_tx_tids, int, 0644);
+MODULE_PARM_DESC(cw1200_ba_rx_tids, "Block ACK RX TIDs");
+MODULE_PARM_DESC(cw1200_ba_tx_tids, "Block ACK TX TIDs");
+
+static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
+                                                const bool have_5ghz)
+{
+        int i, band;
+        struct ieee80211_hw *hw;
+        struct cw1200_common *priv;
+
+        hw = ieee80211_alloc_hw(sizeof(struct cw1200_common), &cw1200_ops);
+        if (!hw)
+                return NULL;
+
+        priv = hw->priv;
+        priv->hw = hw;
+        priv->hw_type = -1;
+        priv->mode = NL80211_IFTYPE_UNSPECIFIED;
+        priv->rates = cw1200_rates; /* TODO: fetch from FW */
+        priv->mcs_rates = cw1200_n_rates;
+        if (cw1200_ba_rx_tids != -1)
+                priv->ba_rx_tid_mask = cw1200_ba_rx_tids;
+        else
+                priv->ba_rx_tid_mask = 0xFF; /* Enable RX BLKACK for all TIDs */
+        if (cw1200_ba_tx_tids != -1)
+                priv->ba_tx_tid_mask = cw1200_ba_tx_tids;
+        else
+                priv->ba_tx_tid_mask = 0xff; /* Enable TX BLKACK for all TIDs */
+
+        hw->flags = IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_SUPPORTS_PS |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
+                    IEEE80211_HW_REPORTS_TX_ACK_STATUS |
+                    IEEE80211_HW_SUPPORTS_UAPSD |
+                    IEEE80211_HW_CONNECTION_MONITOR |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_TX_AMPDU_SETUP_IN_HW |
+                    IEEE80211_HW_NEED_DTIM_BEFORE_ASSOC;
+
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                          BIT(NL80211_IFTYPE_ADHOC) |
+                                          BIT(NL80211_IFTYPE_AP) |
+                                          BIT(NL80211_IFTYPE_MESH_POINT) |
+                                          BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                                          BIT(NL80211_IFTYPE_P2P_GO);
+
+#ifdef CONFIG_PM
+        /* Support only for limited wowlan functionalities */
+        hw->wiphy->wowlan.flags = WIPHY_WOWLAN_ANY |
+                WIPHY_WOWLAN_DISCONNECT;
+        hw->wiphy->wowlan.n_patterns = 0;
+#endif
+
+        hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
+
+        hw->channel_change_time = 1000; /* TODO: find actual value */
+        hw->queues = 4;
+
+        priv->rts_threshold = -1;
+
+        hw->max_rates = 8;
+        hw->max_rate_tries = 15;
+        hw->extra_tx_headroom = WSM_TX_EXTRA_HEADROOM +
+                8;  /* TKIP IV */
+
+        hw->sta_data_size = sizeof(struct cw1200_sta_priv);
+
+        hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &cw1200_band_2ghz;
+        if (have_5ghz)
+                hw->wiphy->bands[IEEE80211_BAND_5GHZ] = &cw1200_band_5ghz;
+
+        /* Channel params have to be cleared before registering wiphy again */
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband = hw->wiphy->bands[band];
+                if (!sband)
+                        continue;
+                for (i = 0; i < sband->n_channels; i++) {
+                        sband->channels[i].flags = 0;
+                        sband->channels[i].max_antenna_gain = 0;
+                        sband->channels[i].max_power = 30;
+                }
+        }
+
+        hw->wiphy->max_scan_ssids = 2;
+        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+
+        if (macaddr)
+                SET_IEEE80211_PERM_ADDR(hw, (u8 *)macaddr);
+        else
+                SET_IEEE80211_PERM_ADDR(hw, cw1200_mac_template);
+
+        /* Fix up mac address if necessary */
+        if (hw->wiphy->perm_addr[3] == 0 &&
+            hw->wiphy->perm_addr[4] == 0 &&
+            hw->wiphy->perm_addr[5] == 0) {
+                get_random_bytes(&hw->wiphy->perm_addr[3], 3);
+        }
+
+        mutex_init(&priv->wsm_cmd_mux);
+        mutex_init(&priv->conf_mutex);
+        priv->workqueue = create_singlethread_workqueue("cw1200_wq");
+        sema_init(&priv->scan.lock, 1);
+        INIT_WORK(&priv->scan.work, cw1200_scan_work);
+        INIT_DELAYED_WORK(&priv->scan.probe_work, cw1200_probe_work);
+        INIT_DELAYED_WORK(&priv->scan.timeout, cw1200_scan_timeout);
+        INIT_DELAYED_WORK(&priv->clear_recent_scan_work,
+                          cw1200_clear_recent_scan_work);
+        INIT_DELAYED_WORK(&priv->join_timeout, cw1200_join_timeout);
+        INIT_WORK(&priv->unjoin_work, cw1200_unjoin_work);
+        INIT_WORK(&priv->join_complete_work, cw1200_join_complete_work);
+        INIT_WORK(&priv->wep_key_work, cw1200_wep_key_work);
+        INIT_WORK(&priv->tx_policy_upload_work, tx_policy_upload_work);
+        spin_lock_init(&priv->event_queue_lock);
+        INIT_LIST_HEAD(&priv->event_queue);
+        INIT_WORK(&priv->event_handler, cw1200_event_handler);
+        INIT_DELAYED_WORK(&priv->bss_loss_work, cw1200_bss_loss_work);
+        INIT_WORK(&priv->bss_params_work, cw1200_bss_params_work);
+        spin_lock_init(&priv->bss_loss_lock);
+        spin_lock_init(&priv->ps_state_lock);
+        INIT_WORK(&priv->set_cts_work, cw1200_set_cts_work);
+        INIT_WORK(&priv->set_tim_work, cw1200_set_tim_work);
+        INIT_WORK(&priv->multicast_start_work, cw1200_multicast_start_work);
+        INIT_WORK(&priv->multicast_stop_work, cw1200_multicast_stop_work);
+        INIT_WORK(&priv->link_id_work, cw1200_link_id_work);
+        INIT_DELAYED_WORK(&priv->link_id_gc_work, cw1200_link_id_gc_work);
+        INIT_WORK(&priv->linkid_reset_work, cw1200_link_id_reset);
+        INIT_WORK(&priv->update_filtering_work, cw1200_update_filtering_work);
+        INIT_WORK(&priv->set_beacon_wakeup_period_work,
+                  cw1200_set_beacon_wakeup_period_work);
+        init_timer(&priv->mcast_timeout);
+        priv->mcast_timeout.data = (unsigned long)priv;
+        priv->mcast_timeout.function = cw1200_mcast_timeout;
+
+        if (cw1200_queue_stats_init(&priv->tx_queue_stats,
+                                    CW1200_LINK_ID_MAX,
+                                    cw1200_skb_dtor,
+                                    priv)) {
+                ieee80211_free_hw(hw);
+                return NULL;
+        }
+
+        for (i = 0; i < 4; ++i) {
+                if (cw1200_queue_init(&priv->tx_queue[i],
+                                      &priv->tx_queue_stats, i, 16,
+                                      cw1200_ttl[i])) {
+                        for (; i > 0; i--)
+                                cw1200_queue_deinit(&priv->tx_queue[i - 1]);
+                        cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+                        ieee80211_free_hw(hw);
+                        return NULL;
+                }
+        }
+
+        init_waitqueue_head(&priv->channel_switch_done);
+        init_waitqueue_head(&priv->wsm_cmd_wq);
+        init_waitqueue_head(&priv->wsm_startup_done);
+        init_waitqueue_head(&priv->ps_mode_switch_done);
+        wsm_buf_init(&priv->wsm_cmd_buf);
+        spin_lock_init(&priv->wsm_cmd.lock);
+        priv->wsm_cmd.done = 1;
+        tx_policy_init(priv);
+
+        return hw;
+}
+
+static int cw1200_register_common(struct ieee80211_hw *dev)
+{
+        struct cw1200_common *priv = dev->priv;
+        int err;
+
+#ifdef CONFIG_PM
+        err = cw1200_pm_init(&priv->pm_state, priv);
+        if (err) {
+                pr_err("Cannot init PM. (%d).\n",
+                       err);
+                return err;
+        }
+#endif
+
+        err = ieee80211_register_hw(dev);
+        if (err) {
+                pr_err("Cannot register device (%d).\n",
+                       err);
+#ifdef CONFIG_PM
+                cw1200_pm_deinit(&priv->pm_state);
+#endif
+                return err;
+        }
+
+        cw1200_debug_init(priv);
+
+        pr_info("Registered as '%s'\n", wiphy_name(dev->wiphy));
+        return 0;
+}
+
+static void cw1200_free_common(struct ieee80211_hw *dev)
+{
+        ieee80211_free_hw(dev);
+}
+
+static void cw1200_unregister_common(struct ieee80211_hw *dev)
+{
+        struct cw1200_common *priv = dev->priv;
+        int i;
+
+        ieee80211_unregister_hw(dev);
+
+        del_timer_sync(&priv->mcast_timeout);
+        cw1200_unregister_bh(priv);
+
+        cw1200_debug_release(priv);
+
+        mutex_destroy(&priv->conf_mutex);
+
+        wsm_buf_deinit(&priv->wsm_cmd_buf);
+
+        destroy_workqueue(priv->workqueue);
+        priv->workqueue = NULL;
+
+        if (priv->sdd) {
+                release_firmware(priv->sdd);
+                priv->sdd = NULL;
+        }
+
+        for (i = 0; i < 4; ++i)
+                cw1200_queue_deinit(&priv->tx_queue[i]);
+
+        cw1200_queue_stats_deinit(&priv->tx_queue_stats);
+#ifdef CONFIG_PM
+        cw1200_pm_deinit(&priv->pm_state);
+#endif
+}
+
+/* Clock is in KHz */
+u32 cw1200_dpll_from_clk(u16 clk_khz)
+{
+        switch (clk_khz) {
+        case 0x32C8: /* 13000 KHz */
+                return 0x1D89D241;
+        case 0x3E80: /* 16000 KHz */
+                return 0x000001E1;
+        case 0x41A0: /* 16800 KHz */
+                return 0x124931C1;
+        case 0x4B00: /* 19200 KHz */
+                return 0x00000191;
+        case 0x5DC0: /* 24000 KHz */
+                return 0x00000141;
+        case 0x6590: /* 26000 KHz */
+                return 0x0EC4F121;
+        case 0x8340: /* 33600 KHz */
+                return 0x092490E1;
+        case 0x9600: /* 38400 KHz */
+                return 0x100010C1;
+        case 0x9C40: /* 40000 KHz */
+                return 0x000000C1;
+        case 0xBB80: /* 48000 KHz */
+                return 0x000000A1;
+        case 0xCB20: /* 52000 KHz */
+                return 0x07627091;
+        default:
+                pr_err("Unknown Refclk freq (0x%04x), using 2600KHz\n",
+                       clk_khz);
+                return 0x0EC4F121;
+        }
+}
+
+int cw1200_core_probe(const struct hwbus_ops *hwbus_ops,
+                      struct hwbus_priv *hwbus,
+                      struct device *pdev,
+                      struct cw1200_common **core,
+                      int ref_clk, const u8 *macaddr,
+                      const char *sdd_path, bool have_5ghz)
+{
+        int err = -EINVAL;
+        struct ieee80211_hw *dev;
+        struct cw1200_common *priv;
+        struct wsm_operational_mode mode = {
+                .power_mode = cw1200_power_mode,
+                .disable_more_flag_usage = true,
+        };
+
+        dev = cw1200_init_common(macaddr, have_5ghz);
+        if (!dev)
+                goto err;
+
+        priv = dev->priv;
+        priv->hw_refclk = ref_clk;
+        if (cw1200_refclk)
+                priv->hw_refclk = cw1200_refclk;
+
+        priv->sdd_path = (char *)sdd_path;
+        if (cw1200_sdd_path)
+                priv->sdd_path = cw1200_sdd_path;
+
+        priv->hwbus_ops = hwbus_ops;
+        priv->hwbus_priv = hwbus;
+        priv->pdev = pdev;
+        SET_IEEE80211_DEV(priv->hw, pdev);
+
+        /* Pass struct cw1200_common back up */
+        *core = priv;
+
+        err = cw1200_register_bh(priv);
+        if (err)
+                goto err1;
+
+        err = cw1200_load_firmware(priv);
+        if (err)
+                goto err2;
+
+        if (wait_event_interruptible_timeout(priv->wsm_startup_done,
+                                             priv->firmware_ready,
+                                             3*HZ) <= 0) {
+                /* TODO: Need to find how to reset device
+                   in QUEUE mode properly.
+                */
+                pr_err("Timeout waiting on device startup\n");
+                err = -ETIMEDOUT;
+                goto err2;
+        }
+
+        /* Set low-power mode. */
+        wsm_set_operational_mode(priv, &mode);
+
+        /* Enable multi-TX confirmation */
+        wsm_use_multi_tx_conf(priv, true);
+
+        err = cw1200_register_common(dev);
+        if (err)
+                goto err2;
+
+        return err;
+
+err2:
+        cw1200_unregister_bh(priv);
+err1:
+        cw1200_free_common(dev);
+err:
+        *core = NULL;
+        return err;
+}
+EXPORT_SYMBOL_GPL(cw1200_core_probe);
+
+void cw1200_core_release(struct cw1200_common *self)
+{
+        /* Disable device interrupts */
+        self->hwbus_ops->lock(self->hwbus_priv);
+        __cw1200_irq_enable(self, 0);
+        self->hwbus_ops->unlock(self->hwbus_priv);
+
+        /* And then clean up */
+        cw1200_unregister_common(self->hw);
+        cw1200_free_common(self->hw);
+        return;
+}
+EXPORT_SYMBOL_GPL(cw1200_core_release);
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
new file mode 100644
index 000000000000..b37abb9f0453
--- /dev/null
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -0,0 +1,367 @@
+/*
+ * Mac80211 power management API for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2011, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/module.h>
+#include <linux/if_ether.h>
+#include "cw1200.h"
+#include "pm.h"
+#include "sta.h"
+#include "bh.h"
+#include "hwbus.h"
+
+#define CW1200_BEACON_SKIPPING_MULTIPLIER 3
+
+struct cw1200_udp_port_filter {
+        struct wsm_udp_port_filter_hdr hdr;
+        /* Up to 4 filters are allowed. */
+        struct wsm_udp_port_filter filters[WSM_MAX_FILTER_ELEMENTS];
+} __packed;
+
+struct cw1200_ether_type_filter {
+        struct wsm_ether_type_filter_hdr hdr;
+        /* Up to 4 filters are allowed. */
+        struct wsm_ether_type_filter filters[WSM_MAX_FILTER_ELEMENTS];
+} __packed;
+
+static struct cw1200_udp_port_filter cw1200_udp_port_filter_on = {
+        .hdr.num = 2,
+        .filters = {
+                [0] = {
+                        .action = WSM_FILTER_ACTION_FILTER_OUT,
+                        .type = WSM_FILTER_PORT_TYPE_DST,
+                        .port = __cpu_to_le16(67), /* DHCP Bootps */
+                },
+                [1] = {
+                        .action = WSM_FILTER_ACTION_FILTER_OUT,
+                        .type = WSM_FILTER_PORT_TYPE_DST,
+                        .port = __cpu_to_le16(68), /* DHCP Bootpc */
+                },
+        }
+};
+
+static struct wsm_udp_port_filter_hdr cw1200_udp_port_filter_off = {
+        .num = 0,
+};
+
+#ifndef ETH_P_WAPI
+#define ETH_P_WAPI     0x88B4
+#endif
+
+static struct cw1200_ether_type_filter cw1200_ether_type_filter_on = {
+        .hdr.num = 4,
+        .filters = {
+                [0] = {
+                        .action = WSM_FILTER_ACTION_FILTER_IN,
+                        .type = __cpu_to_le16(ETH_P_IP),
+                },
+                [1] = {
+                        .action = WSM_FILTER_ACTION_FILTER_IN,
+                        .type = __cpu_to_le16(ETH_P_PAE),
+                },
+                [2] = {
+                        .action = WSM_FILTER_ACTION_FILTER_IN,
+                        .type = __cpu_to_le16(ETH_P_WAPI),
+                },
+                [3] = {
+                        .action = WSM_FILTER_ACTION_FILTER_IN,
+                        .type = __cpu_to_le16(ETH_P_ARP),
+                },
+        },
+};
+
+static struct wsm_ether_type_filter_hdr cw1200_ether_type_filter_off = {
+        .num = 0,
+};
+
+/* private */
+struct cw1200_suspend_state {
+        unsigned long bss_loss_tmo;
+        unsigned long join_tmo;
+        unsigned long direct_probe;
+        unsigned long link_id_gc;
+        bool beacon_skipping;
+        u8 prev_ps_mode;
+};
+
+static void cw1200_pm_stay_awake_tmo(unsigned long arg)
+{
+        /* XXX what's the point of this ? */
+}
+
+int cw1200_pm_init(struct cw1200_pm_state *pm,
+                   struct cw1200_common *priv)
+{
+        spin_lock_init(&pm->lock);
+
+        init_timer(&pm->stay_awake);
+        pm->stay_awake.data = (unsigned long)pm;
+        pm->stay_awake.function = cw1200_pm_stay_awake_tmo;
+
+        return 0;
+}
+
+void cw1200_pm_deinit(struct cw1200_pm_state *pm)
+{
+        del_timer_sync(&pm->stay_awake);
+}
+
+void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
+                          unsigned long tmo)
+{
+        long cur_tmo;
+        spin_lock_bh(&pm->lock);
+        cur_tmo = pm->stay_awake.expires - jiffies;
+        if (!timer_pending(&pm->stay_awake) || cur_tmo < (long)tmo)
+                mod_timer(&pm->stay_awake, jiffies + tmo);
+        spin_unlock_bh(&pm->lock);
+}
+
+static long cw1200_suspend_work(struct delayed_work *work)
+{
+        int ret = cancel_delayed_work(work);
+        long tmo;
+        if (ret > 0) {
+                /* Timer is pending */
+                tmo = work->timer.expires - jiffies;
+                if (tmo < 0)
+                        tmo = 0;
+        } else {
+                tmo = -1;
+        }
+        return tmo;
+}
+
+static int cw1200_resume_work(struct cw1200_common *priv,
+                               struct delayed_work *work,
+                               unsigned long tmo)
+{
+        if ((long)tmo < 0)
+                return 1;
+
+        return queue_delayed_work(priv->workqueue, work, tmo);
+}
+
+int cw1200_can_suspend(struct cw1200_common *priv)
+{
+        if (atomic_read(&priv->bh_rx)) {
+                wiphy_dbg(priv->hw->wiphy, "Suspend interrupted.\n");
+                return 0;
+        }
+        return 1;
+}
+EXPORT_SYMBOL_GPL(cw1200_can_suspend);
+
+int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+{
+        struct cw1200_common *priv = hw->priv;
+        struct cw1200_pm_state *pm_state = &priv->pm_state;
+        struct cw1200_suspend_state *state;
+        int ret;
+
+        spin_lock_bh(&pm_state->lock);
+        ret = timer_pending(&pm_state->stay_awake);
+        spin_unlock_bh(&pm_state->lock);
+        if (ret)
+                return -EAGAIN;
+
+        /* Do not suspend when datapath is not idle */
+        if (priv->tx_queue_stats.num_queued)
+                return -EBUSY;
+
+        /* Make sure there is no configuration requests in progress. */
+        if (!mutex_trylock(&priv->conf_mutex))
+                return -EBUSY;
+
+        /* Ensure pending operations are done.
+         * Note also that wow_suspend must return in ~2.5sec, before
+         * watchdog is triggered.
+         */
+        if (priv->channel_switch_in_progress)
+                goto revert1;
+
+        /* Do not suspend when join is pending */
+        if (priv->join_pending)
+                goto revert1;
+
+        /* Do not suspend when scanning */
+        if (down_trylock(&priv->scan.lock))
+                goto revert1;
+
+        /* Lock TX. */
+        wsm_lock_tx_async(priv);
+
+        /* Wait to avoid possible race with bh code.
+         * But do not wait too long...
+         */
+        if (wait_event_timeout(priv->bh_evt_wq,
+                               !priv->hw_bufs_used, HZ / 10) <= 0)
+                goto revert2;
+
+        /* Set UDP filter */
+        wsm_set_udp_port_filter(priv, &cw1200_udp_port_filter_on.hdr);
+
+        /* Set ethernet frame type filter */
+        wsm_set_ether_type_filter(priv, &cw1200_ether_type_filter_on.hdr);
+
+        /* Allocate state */
+        state = kzalloc(sizeof(struct cw1200_suspend_state), GFP_KERNEL);
+        if (!state)
+                goto revert3;
+
+        /* Change to legacy PS while going to suspend */
+        if (!priv->vif->p2p &&
+            priv->join_status == CW1200_JOIN_STATUS_STA &&
+            priv->powersave_mode.mode != WSM_PSM_PS) {
+                state->prev_ps_mode = priv->powersave_mode.mode;
+                priv->powersave_mode.mode = WSM_PSM_PS;
+                cw1200_set_pm(priv, &priv->powersave_mode);
+                if (wait_event_interruptible_timeout(priv->ps_mode_switch_done,
+                                                     !priv->ps_mode_switch_in_progress, 1*HZ) <= 0) {
+                        goto revert3;
+                }
+        }
+
+        /* Store delayed work states. */
+        state->bss_loss_tmo =
+                cw1200_suspend_work(&priv->bss_loss_work);
+        state->join_tmo =
+                cw1200_suspend_work(&priv->join_timeout);
+        state->direct_probe =
+                cw1200_suspend_work(&priv->scan.probe_work);
+        state->link_id_gc =
+                cw1200_suspend_work(&priv->link_id_gc_work);
+
+        cancel_delayed_work_sync(&priv->clear_recent_scan_work);
+        atomic_set(&priv->recent_scan, 0);
+
+        /* Enable beacon skipping */
+        if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+            priv->join_dtim_period &&
+            !priv->has_multicast_subscription) {
+                state->beacon_skipping = true;
+                wsm_set_beacon_wakeup_period(priv,
+                                             priv->join_dtim_period,
+                                             CW1200_BEACON_SKIPPING_MULTIPLIER * priv->join_dtim_period);
+        }
+
+        /* Stop serving thread */
+        if (cw1200_bh_suspend(priv))
+                goto revert4;
+
+        ret = timer_pending(&priv->mcast_timeout);
+        if (ret)
+                goto revert5;
+
+        /* Store suspend state */
+        pm_state->suspend_state = state;
+
+        /* Enable IRQ wake */
+        ret = priv->hwbus_ops->power_mgmt(priv->hwbus_priv, true);
+        if (ret) {
+                wiphy_err(priv->hw->wiphy,
+                          "PM request failed: %d. WoW is disabled.\n", ret);
+                cw1200_wow_resume(hw);
+                return -EBUSY;
+        }
+
+        /* Force resume if event is coming from the device. */
+        if (atomic_read(&priv->bh_rx)) {
+                cw1200_wow_resume(hw);
+                return -EAGAIN;
+        }
+
+        return 0;
+
+revert5:
+        WARN_ON(cw1200_bh_resume(priv));
+revert4:
+        cw1200_resume_work(priv, &priv->bss_loss_work,
+                           state->bss_loss_tmo);
+        cw1200_resume_work(priv, &priv->join_timeout,
+                           state->join_tmo);
+        cw1200_resume_work(priv, &priv->scan.probe_work,
+                           state->direct_probe);
+        cw1200_resume_work(priv, &priv->link_id_gc_work,
+                           state->link_id_gc);
+        kfree(state);
+revert3:
+        wsm_set_udp_port_filter(priv, &cw1200_udp_port_filter_off);
+        wsm_set_ether_type_filter(priv, &cw1200_ether_type_filter_off);
+revert2:
+        wsm_unlock_tx(priv);
+        up(&priv->scan.lock);
+revert1:
+        mutex_unlock(&priv->conf_mutex);
+        return -EBUSY;
+}
+
+int cw1200_wow_resume(struct ieee80211_hw *hw)
+{
+        struct cw1200_common *priv = hw->priv;
+        struct cw1200_pm_state *pm_state = &priv->pm_state;
+        struct cw1200_suspend_state *state;
+
+        state = pm_state->suspend_state;
+        pm_state->suspend_state = NULL;
+
+        /* Disable IRQ wake */
+        priv->hwbus_ops->power_mgmt(priv->hwbus_priv, false);
+
+        /* Scan.lock must be released before BH is resumed other way
+         * in case when BSS_LOST command arrived the processing of the
+         * command will be delayed.
+         */
+        up(&priv->scan.lock);
+
+        /* Resume BH thread */
+        WARN_ON(cw1200_bh_resume(priv));
+
+        /* Restores previous PS mode */
+        if (!priv->vif->p2p && priv->join_status == CW1200_JOIN_STATUS_STA) {
+                priv->powersave_mode.mode = state->prev_ps_mode;
+                cw1200_set_pm(priv, &priv->powersave_mode);
+        }
+
+        if (state->beacon_skipping) {
+                wsm_set_beacon_wakeup_period(priv, priv->beacon_int *
+                                             priv->join_dtim_period >
+                                             MAX_BEACON_SKIP_TIME_MS ? 1 :
+                                             priv->join_dtim_period, 0);
+                state->beacon_skipping = false;
+        }
+
+        /* Resume delayed work */
+        cw1200_resume_work(priv, &priv->bss_loss_work,
+                           state->bss_loss_tmo);
+        cw1200_resume_work(priv, &priv->join_timeout,
+                           state->join_tmo);
+        cw1200_resume_work(priv, &priv->scan.probe_work,
+                           state->direct_probe);
+        cw1200_resume_work(priv, &priv->link_id_gc_work,
+                           state->link_id_gc);
+
+        /* Remove UDP port filter */
+        wsm_set_udp_port_filter(priv, &cw1200_udp_port_filter_off);
+
+        /* Remove ethernet frame type filter */
+        wsm_set_ether_type_filter(priv, &cw1200_ether_type_filter_off);
+
+        /* Unlock datapath */
+        wsm_unlock_tx(priv);
+
+        /* Unlock configuration mutex */
+        mutex_unlock(&priv->conf_mutex);
+
+        /* Free memory */
+        kfree(state);
+
+        return 0;
+}
diff --git a/drivers/net/wireless/cw1200/pm.h b/drivers/net/wireless/cw1200/pm.h
new file mode 100644
index 000000000000..3ed90ff22bb8
--- /dev/null
+++ b/drivers/net/wireless/cw1200/pm.h
@@ -0,0 +1,43 @@
+/*
+ * Mac80211 power management interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2011, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef PM_H_INCLUDED
+#define PM_H_INCLUDED
+
+/* ******************************************************************** */
+/* mac80211 API                                                         */
+
+/* extern */  struct cw1200_common;
+/* private */ struct cw1200_suspend_state;
+
+struct cw1200_pm_state {
+        struct cw1200_suspend_state *suspend_state;
+        struct timer_list stay_awake;
+        struct platform_device *pm_dev;
+        spinlock_t lock; /* Protect access */
+};
+
+#ifdef CONFIG_PM
+int cw1200_pm_init(struct cw1200_pm_state *pm,
+                    struct cw1200_common *priv);
+void cw1200_pm_deinit(struct cw1200_pm_state *pm);
+int cw1200_wow_suspend(struct ieee80211_hw *hw,
+                       struct cfg80211_wowlan *wowlan);
+int cw1200_wow_resume(struct ieee80211_hw *hw);
+int cw1200_can_suspend(struct cw1200_common *priv);
+void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
+                          unsigned long tmo);
+#else
+static inline void cw1200_pm_stay_awake(struct cw1200_pm_state *pm,
+                                        unsigned long tmo) {
+}
+#endif
+#endif
diff --git a/drivers/net/wireless/cw1200/queue.c b/drivers/net/wireless/cw1200/queue.c
new file mode 100644
index 000000000000..8510454d5db1
--- /dev/null
+++ b/drivers/net/wireless/cw1200/queue.c
@@ -0,0 +1,583 @@
+/*
+ * O(1) TX queue with built-in allocator for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/mac80211.h>
+#include <linux/sched.h>
+#include "queue.h"
+#include "cw1200.h"
+#include "debug.h"
+
+/* private */ struct cw1200_queue_item
+{
+        struct list_head        head;
+        struct sk_buff          *skb;
+        u32                     packet_id;
+        unsigned long           queue_timestamp;
+        unsigned long           xmit_timestamp;
+        struct cw1200_txpriv    txpriv;
+        u8                      generation;
+};
+
+static inline void __cw1200_queue_lock(struct cw1200_queue *queue)
+{
+        struct cw1200_queue_stats *stats = queue->stats;
+        if (queue->tx_locked_cnt++ == 0) {
+                pr_debug("[TX] Queue %d is locked.\n",
+                         queue->queue_id);
+                ieee80211_stop_queue(stats->priv->hw, queue->queue_id);
+        }
+}
+
+static inline void __cw1200_queue_unlock(struct cw1200_queue *queue)
+{
+        struct cw1200_queue_stats *stats = queue->stats;
+        BUG_ON(!queue->tx_locked_cnt);
+        if (--queue->tx_locked_cnt == 0) {
+                pr_debug("[TX] Queue %d is unlocked.\n",
+                         queue->queue_id);
+                ieee80211_wake_queue(stats->priv->hw, queue->queue_id);
+        }
+}
+
+static inline void cw1200_queue_parse_id(u32 packet_id, u8 *queue_generation,
+                                         u8 *queue_id, u8 *item_generation,
+                                         u8 *item_id)
+{
+        *item_id                = (packet_id >>  0) & 0xFF;
+        *item_generation        = (packet_id >>  8) & 0xFF;
+        *queue_id               = (packet_id >> 16) & 0xFF;
+        *queue_generation       = (packet_id >> 24) & 0xFF;
+}
+
+static inline u32 cw1200_queue_mk_packet_id(u8 queue_generation, u8 queue_id,
+                                            u8 item_generation, u8 item_id)
+{
+        return ((u32)item_id << 0) |
+                ((u32)item_generation << 8) |
+                ((u32)queue_id << 16) |
+                ((u32)queue_generation << 24);
+}
+
+static void cw1200_queue_post_gc(struct cw1200_queue_stats *stats,
+                                 struct list_head *gc_list)
+{
+        struct cw1200_queue_item *item, *tmp;
+
+        list_for_each_entry_safe(item, tmp, gc_list, head) {
+                list_del(&item->head);
+                stats->skb_dtor(stats->priv, item->skb, &item->txpriv);
+                kfree(item);
+        }
+}
+
+static void cw1200_queue_register_post_gc(struct list_head *gc_list,
+                                          struct cw1200_queue_item *item)
+{
+        struct cw1200_queue_item *gc_item;
+        gc_item = kmalloc(sizeof(struct cw1200_queue_item),
+                        GFP_ATOMIC);
+        BUG_ON(!gc_item);
+        memcpy(gc_item, item, sizeof(struct cw1200_queue_item));
+        list_add_tail(&gc_item->head, gc_list);
+}
+
+static void __cw1200_queue_gc(struct cw1200_queue *queue,
+                              struct list_head *head,
+                              bool unlock)
+{
+        struct cw1200_queue_stats *stats = queue->stats;
+        struct cw1200_queue_item *item = NULL, *tmp;
+        bool wakeup_stats = false;
+
+        list_for_each_entry_safe(item, tmp, &queue->queue, head) {
+                if (jiffies - item->queue_timestamp < queue->ttl)
+                        break;
+                --queue->num_queued;
+                --queue->link_map_cache[item->txpriv.link_id];
+                spin_lock_bh(&stats->lock);
+                --stats->num_queued;
+                if (!--stats->link_map_cache[item->txpriv.link_id])
+                        wakeup_stats = true;
+                spin_unlock_bh(&stats->lock);
+                cw1200_debug_tx_ttl(stats->priv);
+                cw1200_queue_register_post_gc(head, item);
+                item->skb = NULL;
+                list_move_tail(&item->head, &queue->free_pool);
+        }
+
+        if (wakeup_stats)
+                wake_up(&stats->wait_link_id_empty);
+
+        if (queue->overfull) {
+                if (queue->num_queued <= (queue->capacity >> 1)) {
+                        queue->overfull = false;
+                        if (unlock)
+                                __cw1200_queue_unlock(queue);
+                } else if (item) {
+                        unsigned long tmo = item->queue_timestamp + queue->ttl;
+                        mod_timer(&queue->gc, tmo);
+                        cw1200_pm_stay_awake(&stats->priv->pm_state,
+                                             tmo - jiffies);
+                }
+        }
+}
+
+static void cw1200_queue_gc(unsigned long arg)
+{
+        LIST_HEAD(list);
+        struct cw1200_queue *queue =
+                (struct cw1200_queue *)arg;
+
+        spin_lock_bh(&queue->lock);
+        __cw1200_queue_gc(queue, &list, true);
+        spin_unlock_bh(&queue->lock);
+        cw1200_queue_post_gc(queue->stats, &list);
+}
+
+int cw1200_queue_stats_init(struct cw1200_queue_stats *stats,
+                            size_t map_capacity,
+                            cw1200_queue_skb_dtor_t skb_dtor,
+                            struct cw1200_common *priv)
+{
+        memset(stats, 0, sizeof(*stats));
+        stats->map_capacity = map_capacity;
+        stats->skb_dtor = skb_dtor;
+        stats->priv = priv;
+        spin_lock_init(&stats->lock);
+        init_waitqueue_head(&stats->wait_link_id_empty);
+
+        stats->link_map_cache = kzalloc(sizeof(int) * map_capacity,
+                                        GFP_KERNEL);
+        if (!stats->link_map_cache)
+                return -ENOMEM;
+
+        return 0;
+}
+
+int cw1200_queue_init(struct cw1200_queue *queue,
+                      struct cw1200_queue_stats *stats,
+                      u8 queue_id,
+                      size_t capacity,
+                      unsigned long ttl)
+{
+        size_t i;
+
+        memset(queue, 0, sizeof(*queue));
+        queue->stats = stats;
+        queue->capacity = capacity;
+        queue->queue_id = queue_id;
+        queue->ttl = ttl;
+        INIT_LIST_HEAD(&queue->queue);
+        INIT_LIST_HEAD(&queue->pending);
+        INIT_LIST_HEAD(&queue->free_pool);
+        spin_lock_init(&queue->lock);
+        init_timer(&queue->gc);
+        queue->gc.data = (unsigned long)queue;
+        queue->gc.function = cw1200_queue_gc;
+
+        queue->pool = kzalloc(sizeof(struct cw1200_queue_item) * capacity,
+                        GFP_KERNEL);
+        if (!queue->pool)
+                return -ENOMEM;
+
+        queue->link_map_cache = kzalloc(sizeof(int) * stats->map_capacity,
+                        GFP_KERNEL);
+        if (!queue->link_map_cache) {
+                kfree(queue->pool);
+                queue->pool = NULL;
+                return -ENOMEM;
+        }
+
+        for (i = 0; i < capacity; ++i)
+                list_add_tail(&queue->pool[i].head, &queue->free_pool);
+
+        return 0;
+}
+
+int cw1200_queue_clear(struct cw1200_queue *queue)
+{
+        int i;
+        LIST_HEAD(gc_list);
+        struct cw1200_queue_stats *stats = queue->stats;
+        struct cw1200_queue_item *item, *tmp;
+
+        spin_lock_bh(&queue->lock);
+        queue->generation++;
+        list_splice_tail_init(&queue->queue, &queue->pending);
+        list_for_each_entry_safe(item, tmp, &queue->pending, head) {
+                WARN_ON(!item->skb);
+                cw1200_queue_register_post_gc(&gc_list, item);
+                item->skb = NULL;
+                list_move_tail(&item->head, &queue->free_pool);
+        }
+        queue->num_queued = 0;
+        queue->num_pending = 0;
+
+        spin_lock_bh(&stats->lock);
+        for (i = 0; i < stats->map_capacity; ++i) {
+                stats->num_queued -= queue->link_map_cache[i];
+                stats->link_map_cache[i] -= queue->link_map_cache[i];
+                queue->link_map_cache[i] = 0;
+        }
+        spin_unlock_bh(&stats->lock);
+        if (queue->overfull) {
+                queue->overfull = false;
+                __cw1200_queue_unlock(queue);
+        }
+        spin_unlock_bh(&queue->lock);
+        wake_up(&stats->wait_link_id_empty);
+        cw1200_queue_post_gc(stats, &gc_list);
+        return 0;
+}
+
+void cw1200_queue_stats_deinit(struct cw1200_queue_stats *stats)
+{
+        kfree(stats->link_map_cache);
+        stats->link_map_cache = NULL;
+}
+
+void cw1200_queue_deinit(struct cw1200_queue *queue)
+{
+        cw1200_queue_clear(queue);
+        del_timer_sync(&queue->gc);
+        INIT_LIST_HEAD(&queue->free_pool);
+        kfree(queue->pool);
+        kfree(queue->link_map_cache);
+        queue->pool = NULL;
+        queue->link_map_cache = NULL;
+        queue->capacity = 0;
+}
+
+size_t cw1200_queue_get_num_queued(struct cw1200_queue *queue,
+                                   u32 link_id_map)
+{
+        size_t ret;
+        int i, bit;
+        size_t map_capacity = queue->stats->map_capacity;
+
+        if (!link_id_map)
+                return 0;
+
+        spin_lock_bh(&queue->lock);
+        if (link_id_map == (u32)-1) {
+                ret = queue->num_queued - queue->num_pending;
+        } else {
+                ret = 0;
+                for (i = 0, bit = 1; i < map_capacity; ++i, bit <<= 1) {
+                        if (link_id_map & bit)
+                                ret += queue->link_map_cache[i];
+                }
+        }
+        spin_unlock_bh(&queue->lock);
+        return ret;
+}
+
+int cw1200_queue_put(struct cw1200_queue *queue,
+                     struct sk_buff *skb,
+                     struct cw1200_txpriv *txpriv)
+{
+        int ret = 0;
+        LIST_HEAD(gc_list);
+        struct cw1200_queue_stats *stats = queue->stats;
+
+        if (txpriv->link_id >= queue->stats->map_capacity)
+                return -EINVAL;
+
+        spin_lock_bh(&queue->lock);
+        if (!WARN_ON(list_empty(&queue->free_pool))) {
+                struct cw1200_queue_item *item = list_first_entry(
+                        &queue->free_pool, struct cw1200_queue_item, head);
+                BUG_ON(item->skb);
+
+                list_move_tail(&item->head, &queue->queue);
+                item->skb = skb;
+                item->txpriv = *txpriv;
+                item->generation = 0;
+                item->packet_id = cw1200_queue_mk_packet_id(queue->generation,
+                                                            queue->queue_id,
+                                                            item->generation,
+                                                            item - queue->pool);
+                item->queue_timestamp = jiffies;
+
+                ++queue->num_queued;
+                ++queue->link_map_cache[txpriv->link_id];
+
+                spin_lock_bh(&stats->lock);
+                ++stats->num_queued;
+                ++stats->link_map_cache[txpriv->link_id];
+                spin_unlock_bh(&stats->lock);
+
+                /* TX may happen in parallel sometimes.
+                 * Leave extra queue slots so we don't overflow.
+                 */
+                if (queue->overfull == false &&
+                    queue->num_queued >=
+                    (queue->capacity - (num_present_cpus() - 1))) {
+                        queue->overfull = true;
+                        __cw1200_queue_lock(queue);
+                        mod_timer(&queue->gc, jiffies);
+                }
+        } else {
+                ret = -ENOENT;
+        }
+        spin_unlock_bh(&queue->lock);
+        return ret;
+}
+
+int cw1200_queue_get(struct cw1200_queue *queue,
+                     u32 link_id_map,
+                     struct wsm_tx **tx,
+                     struct ieee80211_tx_info **tx_info,
+                     const struct cw1200_txpriv **txpriv)
+{
+        int ret = -ENOENT;
+        struct cw1200_queue_item *item;
+        struct cw1200_queue_stats *stats = queue->stats;
+        bool wakeup_stats = false;
+
+        spin_lock_bh(&queue->lock);
+        list_for_each_entry(item, &queue->queue, head) {
+                if (link_id_map & BIT(item->txpriv.link_id)) {
+                        ret = 0;
+                        break;
+                }
+        }
+
+        if (!WARN_ON(ret)) {
+                *tx = (struct wsm_tx *)item->skb->data;
+                *tx_info = IEEE80211_SKB_CB(item->skb);
+                *txpriv = &item->txpriv;
+                (*tx)->packet_id = __cpu_to_le32(item->packet_id);
+                list_move_tail(&item->head, &queue->pending);
+                ++queue->num_pending;
+                --queue->link_map_cache[item->txpriv.link_id];
+                item->xmit_timestamp = jiffies;
+
+                spin_lock_bh(&stats->lock);
+                --stats->num_queued;
+                if (!--stats->link_map_cache[item->txpriv.link_id])
+                        wakeup_stats = true;
+                spin_unlock_bh(&stats->lock);
+        }
+        spin_unlock_bh(&queue->lock);
+        if (wakeup_stats)
+                wake_up(&stats->wait_link_id_empty);
+        return ret;
+}
+
+int cw1200_queue_requeue(struct cw1200_queue *queue, u32 packet_id)
+{
+        int ret = 0;
+        u8 queue_generation, queue_id, item_generation, item_id;
+        struct cw1200_queue_item *item;
+        struct cw1200_queue_stats *stats = queue->stats;
+
+        cw1200_queue_parse_id(packet_id, &queue_generation, &queue_id,
+                              &item_generation, &item_id);
+
+        item = &queue->pool[item_id];
+
+        spin_lock_bh(&queue->lock);
+        BUG_ON(queue_id != queue->queue_id);
+        if (queue_generation != queue->generation) {
+                ret = -ENOENT;
+        } else if (item_id >= (unsigned) queue->capacity) {
+                WARN_ON(1);
+                ret = -EINVAL;
+        } else if (item->generation != item_generation) {
+                WARN_ON(1);
+                ret = -ENOENT;
+        } else {
+                --queue->num_pending;
+                ++queue->link_map_cache[item->txpriv.link_id];
+
+                spin_lock_bh(&stats->lock);
+                ++stats->num_queued;
+                ++stats->link_map_cache[item->txpriv.link_id];
+                spin_unlock_bh(&stats->lock);
+
+                item->generation = ++item_generation;
+                item->packet_id = cw1200_queue_mk_packet_id(queue_generation,
+                                                            queue_id,
+                                                            item_generation,
+                                                            item_id);
+                list_move(&item->head, &queue->queue);
+        }
+        spin_unlock_bh(&queue->lock);
+        return ret;
+}
+
+int cw1200_queue_requeue_all(struct cw1200_queue *queue)
+{
+        struct cw1200_queue_item *item, *tmp;
+        struct cw1200_queue_stats *stats = queue->stats;
+        spin_lock_bh(&queue->lock);
+
+        list_for_each_entry_safe_reverse(item, tmp, &queue->pending, head) {
+                --queue->num_pending;
+                ++queue->link_map_cache[item->txpriv.link_id];
+
+                spin_lock_bh(&stats->lock);
+                ++stats->num_queued;
+                ++stats->link_map_cache[item->txpriv.link_id];
+                spin_unlock_bh(&stats->lock);
+
+                ++item->generation;
+                item->packet_id = cw1200_queue_mk_packet_id(queue->generation,
+                                                            queue->queue_id,
+                                                            item->generation,
+                                                            item - queue->pool);
+                list_move(&item->head, &queue->queue);
+        }
+        spin_unlock_bh(&queue->lock);
+
+        return 0;
+}
+
+int cw1200_queue_remove(struct cw1200_queue *queue, u32 packet_id)
+{
+        int ret = 0;
+        u8 queue_generation, queue_id, item_generation, item_id;
+        struct cw1200_queue_item *item;
+        struct cw1200_queue_stats *stats = queue->stats;
+        struct sk_buff *gc_skb = NULL;
+        struct cw1200_txpriv gc_txpriv;
+
+        cw1200_queue_parse_id(packet_id, &queue_generation, &queue_id,
+                              &item_generation, &item_id);
+
+        item = &queue->pool[item_id];
+
+        spin_lock_bh(&queue->lock);
+        BUG_ON(queue_id != queue->queue_id);
+        if (queue_generation != queue->generation) {
+                ret = -ENOENT;
+        } else if (item_id >= (unsigned) queue->capacity) {
+                WARN_ON(1);
+                ret = -EINVAL;
+        } else if (item->generation != item_generation) {
+                WARN_ON(1);
+                ret = -ENOENT;
+        } else {
+                gc_txpriv = item->txpriv;
+                gc_skb = item->skb;
+                item->skb = NULL;
+                --queue->num_pending;
+                --queue->num_queued;
+                ++queue->num_sent;
+                ++item->generation;
+                /* Do not use list_move_tail here, but list_move:
+                 * try to utilize cache row.
+                 */
+                list_move(&item->head, &queue->free_pool);
+
+                if (queue->overfull &&
+                    (queue->num_queued <= (queue->capacity >> 1))) {
+                        queue->overfull = false;
+                        __cw1200_queue_unlock(queue);
+                }
+        }
+        spin_unlock_bh(&queue->lock);
+
+        if (gc_skb)
+                stats->skb_dtor(stats->priv, gc_skb, &gc_txpriv);
+
+        return ret;
+}
+
+int cw1200_queue_get_skb(struct cw1200_queue *queue, u32 packet_id,
+                         struct sk_buff **skb,
+                         const struct cw1200_txpriv **txpriv)
+{
+        int ret = 0;
+        u8 queue_generation, queue_id, item_generation, item_id;
+        struct cw1200_queue_item *item;
+        cw1200_queue_parse_id(packet_id, &queue_generation, &queue_id,
+                              &item_generation, &item_id);
+
+        item = &queue->pool[item_id];
+
+        spin_lock_bh(&queue->lock);
+        BUG_ON(queue_id != queue->queue_id);
+        if (queue_generation != queue->generation) {
+                ret = -ENOENT;
+        } else if (item_id >= (unsigned) queue->capacity) {
+                WARN_ON(1);
+                ret = -EINVAL;
+        } else if (item->generation != item_generation) {
+                WARN_ON(1);
+                ret = -ENOENT;
+        } else {
+                *skb = item->skb;
+                *txpriv = &item->txpriv;
+        }
+        spin_unlock_bh(&queue->lock);
+        return ret;
+}
+
+void cw1200_queue_lock(struct cw1200_queue *queue)
+{
+        spin_lock_bh(&queue->lock);
+        __cw1200_queue_lock(queue);
+        spin_unlock_bh(&queue->lock);
+}
+
+void cw1200_queue_unlock(struct cw1200_queue *queue)
+{
+        spin_lock_bh(&queue->lock);
+        __cw1200_queue_unlock(queue);
+        spin_unlock_bh(&queue->lock);
+}
+
+bool cw1200_queue_get_xmit_timestamp(struct cw1200_queue *queue,
+                                     unsigned long *timestamp,
+                                     u32 pending_frame_id)
+{
+        struct cw1200_queue_item *item;
+        bool ret;
+
+        spin_lock_bh(&queue->lock);
+        ret = !list_empty(&queue->pending);
+        if (ret) {
+                list_for_each_entry(item, &queue->pending, head) {
+                        if (item->packet_id != pending_frame_id)
+                                if (time_before(item->xmit_timestamp,
+                                                *timestamp))
+                                        *timestamp = item->xmit_timestamp;
+                }
+        }
+        spin_unlock_bh(&queue->lock);
+        return ret;
+}
+
+bool cw1200_queue_stats_is_empty(struct cw1200_queue_stats *stats,
+                                 u32 link_id_map)
+{
+        bool empty = true;
+
+        spin_lock_bh(&stats->lock);
+        if (link_id_map == (u32)-1) {
+                empty = stats->num_queued == 0;
+        } else {
+                int i;
+                for (i = 0; i < stats->map_capacity; ++i) {
+                        if (link_id_map & BIT(i)) {
+                                if (stats->link_map_cache[i]) {
+                                        empty = false;
+                                        break;
+                                }
+                        }
+                }
+        }
+        spin_unlock_bh(&stats->lock);
+
+        return empty;
+}
diff --git a/drivers/net/wireless/cw1200/queue.h b/drivers/net/wireless/cw1200/queue.h
new file mode 100644
index 000000000000..119f9c79c14e
--- /dev/null
+++ b/drivers/net/wireless/cw1200/queue.h
@@ -0,0 +1,116 @@
+/*
+ * O(1) TX queue with built-in allocator for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_QUEUE_H_INCLUDED
+#define CW1200_QUEUE_H_INCLUDED
+
+/* private */ struct cw1200_queue_item;
+
+/* extern */ struct sk_buff;
+/* extern */ struct wsm_tx;
+/* extern */ struct cw1200_common;
+/* extern */ struct ieee80211_tx_queue_stats;
+/* extern */ struct cw1200_txpriv;
+
+/* forward */ struct cw1200_queue_stats;
+
+typedef void (*cw1200_queue_skb_dtor_t)(struct cw1200_common *priv,
+                                        struct sk_buff *skb,
+                                        const struct cw1200_txpriv *txpriv);
+
+struct cw1200_queue {
+        struct cw1200_queue_stats *stats;
+        size_t                  capacity;
+        size_t                  num_queued;
+        size_t                  num_pending;
+        size_t                  num_sent;
+        struct cw1200_queue_item *pool;
+        struct list_head        queue;
+        struct list_head        free_pool;
+        struct list_head        pending;
+        int                     tx_locked_cnt;
+        int                     *link_map_cache;
+        bool                    overfull;
+        spinlock_t              lock; /* Protect queue entry */
+        u8                      queue_id;
+        u8                      generation;
+        struct timer_list       gc;
+        unsigned long           ttl;
+};
+
+struct cw1200_queue_stats {
+        spinlock_t              lock; /* Protect stats entry */
+        int                     *link_map_cache;
+        int                     num_queued;
+        size_t                  map_capacity;
+        wait_queue_head_t       wait_link_id_empty;
+        cw1200_queue_skb_dtor_t skb_dtor;
+        struct cw1200_common    *priv;
+};
+
+struct cw1200_txpriv {
+        u8 link_id;
+        u8 raw_link_id;
+        u8 tid;
+        u8 rate_id;
+        u8 offset;
+};
+
+int cw1200_queue_stats_init(struct cw1200_queue_stats *stats,
+                            size_t map_capacity,
+                            cw1200_queue_skb_dtor_t skb_dtor,
+                            struct cw1200_common *priv);
+int cw1200_queue_init(struct cw1200_queue *queue,
+                      struct cw1200_queue_stats *stats,
+                      u8 queue_id,
+                      size_t capacity,
+                      unsigned long ttl);
+int cw1200_queue_clear(struct cw1200_queue *queue);
+void cw1200_queue_stats_deinit(struct cw1200_queue_stats *stats);
+void cw1200_queue_deinit(struct cw1200_queue *queue);
+
+size_t cw1200_queue_get_num_queued(struct cw1200_queue *queue,
+                                   u32 link_id_map);
+int cw1200_queue_put(struct cw1200_queue *queue,
+                     struct sk_buff *skb,
+                     struct cw1200_txpriv *txpriv);
+int cw1200_queue_get(struct cw1200_queue *queue,
+                     u32 link_id_map,
+                     struct wsm_tx **tx,
+                     struct ieee80211_tx_info **tx_info,
+                     const struct cw1200_txpriv **txpriv);
+int cw1200_queue_requeue(struct cw1200_queue *queue, u32 packet_id);
+int cw1200_queue_requeue_all(struct cw1200_queue *queue);
+int cw1200_queue_remove(struct cw1200_queue *queue,
+                        u32 packet_id);
+int cw1200_queue_get_skb(struct cw1200_queue *queue, u32 packet_id,
+                         struct sk_buff **skb,
+                         const struct cw1200_txpriv **txpriv);
+void cw1200_queue_lock(struct cw1200_queue *queue);
+void cw1200_queue_unlock(struct cw1200_queue *queue);
+bool cw1200_queue_get_xmit_timestamp(struct cw1200_queue *queue,
+                                     unsigned long *timestamp,
+                                     u32 pending_frame_id);
+
+bool cw1200_queue_stats_is_empty(struct cw1200_queue_stats *stats,
+                                 u32 link_id_map);
+
+static inline u8 cw1200_queue_get_queue_id(u32 packet_id)
+{
+        return (packet_id >> 16) & 0xFF;
+}
+
+static inline u8 cw1200_queue_get_generation(u32 packet_id)
+{
+        return (packet_id >>  8) & 0xFF;
+}
+
+#endif /* CW1200_QUEUE_H_INCLUDED */
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
new file mode 100644
index 000000000000..ee3c19037aac
--- /dev/null
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -0,0 +1,461 @@
+/*
+ * Scan implementation for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/sched.h>
+#include "cw1200.h"
+#include "scan.h"
+#include "sta.h"
+#include "pm.h"
+
+static void cw1200_scan_restart_delayed(struct cw1200_common *priv);
+
+static int cw1200_scan_start(struct cw1200_common *priv, struct wsm_scan *scan)
+{
+        int ret, i;
+        int tmo = 2000;
+
+        switch (priv->join_status) {
+        case CW1200_JOIN_STATUS_PRE_STA:
+        case CW1200_JOIN_STATUS_JOINING:
+                return -EBUSY;
+        default:
+                break;
+        }
+
+        wiphy_dbg(priv->hw->wiphy, "[SCAN] hw req, type %d, %d channels, flags: 0x%x.\n",
+                  scan->type, scan->num_channels, scan->flags);
+
+        for (i = 0; i < scan->num_channels; ++i)
+                tmo += scan->ch[i].max_chan_time + 10;
+
+        cancel_delayed_work_sync(&priv->clear_recent_scan_work);
+        atomic_set(&priv->scan.in_progress, 1);
+        atomic_set(&priv->recent_scan, 1);
+        cw1200_pm_stay_awake(&priv->pm_state, tmo * HZ / 1000);
+        queue_delayed_work(priv->workqueue, &priv->scan.timeout,
+                           tmo * HZ / 1000);
+        ret = wsm_scan(priv, scan);
+        if (ret) {
+                atomic_set(&priv->scan.in_progress, 0);
+                cancel_delayed_work_sync(&priv->scan.timeout);
+                cw1200_scan_restart_delayed(priv);
+        }
+        return ret;
+}
+
+int cw1200_hw_scan(struct ieee80211_hw *hw,
+                   struct ieee80211_vif *vif,
+                   struct cfg80211_scan_request *req)
+{
+        struct cw1200_common *priv = hw->priv;
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_PROBE_REQUEST,
+        };
+        int i, ret;
+
+        if (!priv->vif)
+                return -EINVAL;
+
+        /* Scan when P2P_GO corrupt firmware MiniAP mode */
+        if (priv->join_status == CW1200_JOIN_STATUS_AP)
+                return -EOPNOTSUPP;
+
+        if (req->n_ssids == 1 && !req->ssids[0].ssid_len)
+                req->n_ssids = 0;
+
+        wiphy_dbg(hw->wiphy, "[SCAN] Scan request for %d SSIDs.\n",
+                  req->n_ssids);
+
+        if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS)
+                return -EINVAL;
+
+        frame.skb = ieee80211_probereq_get(hw, priv->vif, NULL, 0,
+                req->ie_len);
+        if (!frame.skb)
+                return -ENOMEM;
+
+        if (req->ie_len)
+                memcpy(skb_put(frame.skb, req->ie_len), req->ie, req->ie_len);
+
+        /* will be unlocked in cw1200_scan_work() */
+        down(&priv->scan.lock);
+        mutex_lock(&priv->conf_mutex);
+
+        ret = wsm_set_template_frame(priv, &frame);
+        if (!ret) {
+                /* Host want to be the probe responder. */
+                ret = wsm_set_probe_responder(priv, true);
+        }
+        if (ret) {
+                mutex_unlock(&priv->conf_mutex);
+                up(&priv->scan.lock);
+                dev_kfree_skb(frame.skb);
+                return ret;
+        }
+
+        wsm_lock_tx(priv);
+
+        BUG_ON(priv->scan.req);
+        priv->scan.req = req;
+        priv->scan.n_ssids = 0;
+        priv->scan.status = 0;
+        priv->scan.begin = &req->channels[0];
+        priv->scan.curr = priv->scan.begin;
+        priv->scan.end = &req->channels[req->n_channels];
+        priv->scan.output_power = priv->output_power;
+
+        for (i = 0; i < req->n_ssids; ++i) {
+                struct wsm_ssid *dst = &priv->scan.ssids[priv->scan.n_ssids];
+                memcpy(&dst->ssid[0], req->ssids[i].ssid, sizeof(dst->ssid));
+                dst->length = req->ssids[i].ssid_len;
+                ++priv->scan.n_ssids;
+        }
+
+        mutex_unlock(&priv->conf_mutex);
+
+        if (frame.skb)
+                dev_kfree_skb(frame.skb);
+        queue_work(priv->workqueue, &priv->scan.work);
+        return 0;
+}
+
+void cw1200_scan_work(struct work_struct *work)
+{
+        struct cw1200_common *priv = container_of(work, struct cw1200_common,
+                                                        scan.work);
+        struct ieee80211_channel **it;
+        struct wsm_scan scan = {
+                .type = WSM_SCAN_TYPE_FOREGROUND,
+                .flags = WSM_SCAN_FLAG_SPLIT_METHOD,
+        };
+        bool first_run = (priv->scan.begin == priv->scan.curr &&
+                          priv->scan.begin != priv->scan.end);
+        int i;
+
+        if (first_run) {
+                /* Firmware gets crazy if scan request is sent
+                 * when STA is joined but not yet associated.
+                 * Force unjoin in this case.
+                 */
+                if (cancel_delayed_work_sync(&priv->join_timeout) > 0)
+                        cw1200_join_timeout(&priv->join_timeout.work);
+        }
+
+        mutex_lock(&priv->conf_mutex);
+
+        if (first_run) {
+                if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+                    !(priv->powersave_mode.mode & WSM_PSM_PS)) {
+                        struct wsm_set_pm pm = priv->powersave_mode;
+                        pm.mode = WSM_PSM_PS;
+                        cw1200_set_pm(priv, &pm);
+                } else if (priv->join_status == CW1200_JOIN_STATUS_MONITOR) {
+                        /* FW bug: driver has to restart p2p-dev mode
+                         * after scan
+                         */
+                        cw1200_disable_listening(priv);
+                }
+        }
+
+        if (!priv->scan.req || (priv->scan.curr == priv->scan.end)) {
+                if (priv->scan.output_power != priv->output_power)
+                        wsm_set_output_power(priv, priv->output_power * 10);
+                if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+                    !(priv->powersave_mode.mode & WSM_PSM_PS))
+                        cw1200_set_pm(priv, &priv->powersave_mode);
+
+                if (priv->scan.status < 0)
+                        wiphy_dbg(priv->hw->wiphy, "[SCAN] Scan failed (%d).\n",
+                                  priv->scan.status);
+                else if (priv->scan.req)
+                        wiphy_dbg(priv->hw->wiphy,
+                                  "[SCAN] Scan completed.\n");
+                else
+                        wiphy_dbg(priv->hw->wiphy,
+                                  "[SCAN] Scan canceled.\n");
+
+                priv->scan.req = NULL;
+                cw1200_scan_restart_delayed(priv);
+                wsm_unlock_tx(priv);
+                mutex_unlock(&priv->conf_mutex);
+                ieee80211_scan_completed(priv->hw, priv->scan.status ? 1 : 0);
+                up(&priv->scan.lock);
+                return;
+        } else {
+                struct ieee80211_channel *first = *priv->scan.curr;
+                for (it = priv->scan.curr + 1, i = 1;
+                     it != priv->scan.end && i < WSM_SCAN_MAX_NUM_OF_CHANNELS;
+                     ++it, ++i) {
+                        if ((*it)->band != first->band)
+                                break;
+                        if (((*it)->flags ^ first->flags) &
+                                        IEEE80211_CHAN_PASSIVE_SCAN)
+                                break;
+                        if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                            (*it)->max_power != first->max_power)
+                                break;
+                }
+                scan.band = first->band;
+
+                if (priv->scan.req->no_cck)
+                        scan.max_tx_rate = WSM_TRANSMIT_RATE_6;
+                else
+                        scan.max_tx_rate = WSM_TRANSMIT_RATE_1;
+                scan.num_probes =
+                        (first->flags & IEEE80211_CHAN_PASSIVE_SCAN) ? 0 : 2;
+                scan.num_ssids = priv->scan.n_ssids;
+                scan.ssids = &priv->scan.ssids[0];
+                scan.num_channels = it - priv->scan.curr;
+                /* TODO: Is it optimal? */
+                scan.probe_delay = 100;
+                /* It is not stated in WSM specification, however
+                 * FW team says that driver may not use FG scan
+                 * when joined.
+                 */
+                if (priv->join_status == CW1200_JOIN_STATUS_STA) {
+                        scan.type = WSM_SCAN_TYPE_BACKGROUND;
+                        scan.flags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
+                }
+                scan.ch = kzalloc(
+                        sizeof(struct wsm_scan_ch) * (it - priv->scan.curr),
+                        GFP_KERNEL);
+                if (!scan.ch) {
+                        priv->scan.status = -ENOMEM;
+                        goto fail;
+                }
+                for (i = 0; i < scan.num_channels; ++i) {
+                        scan.ch[i].number = priv->scan.curr[i]->hw_value;
+                        if (priv->scan.curr[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+                                scan.ch[i].min_chan_time = 50;
+                                scan.ch[i].max_chan_time = 100;
+                        } else {
+                                scan.ch[i].min_chan_time = 10;
+                                scan.ch[i].max_chan_time = 25;
+                        }
+                }
+                if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                    priv->scan.output_power != first->max_power) {
+                        priv->scan.output_power = first->max_power;
+                        wsm_set_output_power(priv,
+                                             priv->scan.output_power * 10);
+                }
+                priv->scan.status = cw1200_scan_start(priv, &scan);
+                kfree(scan.ch);
+                if (priv->scan.status)
+                        goto fail;
+                priv->scan.curr = it;
+        }
+        mutex_unlock(&priv->conf_mutex);
+        return;
+
+fail:
+        priv->scan.curr = priv->scan.end;
+        mutex_unlock(&priv->conf_mutex);
+        queue_work(priv->workqueue, &priv->scan.work);
+        return;
+}
+
+static void cw1200_scan_restart_delayed(struct cw1200_common *priv)
+{
+        /* FW bug: driver has to restart p2p-dev mode after scan. */
+        if (priv->join_status == CW1200_JOIN_STATUS_MONITOR) {
+                cw1200_enable_listening(priv);
+                cw1200_update_filtering(priv);
+        }
+
+        if (priv->delayed_unjoin) {
+                priv->delayed_unjoin = false;
+                if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                        wsm_unlock_tx(priv);
+        } else if (priv->delayed_link_loss) {
+                        wiphy_dbg(priv->hw->wiphy, "[CQM] Requeue BSS loss.\n");
+                        priv->delayed_link_loss = 0;
+                        cw1200_cqm_bssloss_sm(priv, 1, 0, 0);
+        }
+}
+
+static void cw1200_scan_complete(struct cw1200_common *priv)
+{
+        queue_delayed_work(priv->workqueue, &priv->clear_recent_scan_work, HZ);
+        if (priv->scan.direct_probe) {
+                wiphy_dbg(priv->hw->wiphy, "[SCAN] Direct probe complete.\n");
+                cw1200_scan_restart_delayed(priv);
+                priv->scan.direct_probe = 0;
+                up(&priv->scan.lock);
+                wsm_unlock_tx(priv);
+        } else {
+                cw1200_scan_work(&priv->scan.work);
+        }
+}
+
+void cw1200_scan_failed_cb(struct cw1200_common *priv)
+{
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+                /* STA is stopped. */
+                return;
+
+        if (cancel_delayed_work_sync(&priv->scan.timeout) > 0) {
+                priv->scan.status = -EIO;
+                queue_delayed_work(priv->workqueue, &priv->scan.timeout, 0);
+        }
+}
+
+
+void cw1200_scan_complete_cb(struct cw1200_common *priv,
+                                struct wsm_scan_complete *arg)
+{
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+                /* STA is stopped. */
+                return;
+
+        if (cancel_delayed_work_sync(&priv->scan.timeout) > 0) {
+                priv->scan.status = 1;
+                queue_delayed_work(priv->workqueue, &priv->scan.timeout, 0);
+        }
+}
+
+void cw1200_clear_recent_scan_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common,
+                             clear_recent_scan_work.work);
+        atomic_xchg(&priv->recent_scan, 0);
+}
+
+void cw1200_scan_timeout(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, scan.timeout.work);
+        if (atomic_xchg(&priv->scan.in_progress, 0)) {
+                if (priv->scan.status > 0) {
+                        priv->scan.status = 0;
+                } else if (!priv->scan.status) {
+                        wiphy_warn(priv->hw->wiphy,
+                                   "Timeout waiting for scan complete notification.\n");
+                        priv->scan.status = -ETIMEDOUT;
+                        priv->scan.curr = priv->scan.end;
+                        wsm_stop_scan(priv);
+                }
+                cw1200_scan_complete(priv);
+        }
+}
+
+void cw1200_probe_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, scan.probe_work.work);
+        u8 queue_id = cw1200_queue_get_queue_id(priv->pending_frame_id);
+        struct cw1200_queue *queue = &priv->tx_queue[queue_id];
+        const struct cw1200_txpriv *txpriv;
+        struct wsm_tx *wsm;
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_PROBE_REQUEST,
+        };
+        struct wsm_ssid ssids[1] = {{
+                .length = 0,
+        } };
+        struct wsm_scan_ch ch[1] = {{
+                .min_chan_time = 0,
+                .max_chan_time = 10,
+        } };
+        struct wsm_scan scan = {
+                .type = WSM_SCAN_TYPE_FOREGROUND,
+                .num_probes = 1,
+                .probe_delay = 0,
+                .num_channels = 1,
+                .ssids = ssids,
+                .ch = ch,
+        };
+        u8 *ies;
+        size_t ies_len;
+        int ret;
+
+        wiphy_dbg(priv->hw->wiphy, "[SCAN] Direct probe work.\n");
+
+        mutex_lock(&priv->conf_mutex);
+        if (down_trylock(&priv->scan.lock)) {
+                /* Scan is already in progress. Requeue self. */
+                schedule();
+                queue_delayed_work(priv->workqueue,
+                                   &priv->scan.probe_work, HZ / 10);
+                mutex_unlock(&priv->conf_mutex);
+                return;
+        }
+
+        /* Make sure we still have a pending probe req */
+        if (cw1200_queue_get_skb(queue, priv->pending_frame_id,
+                                 &frame.skb, &txpriv)) {
+                up(&priv->scan.lock);
+                mutex_unlock(&priv->conf_mutex);
+                wsm_unlock_tx(priv);
+                return;
+        }
+        wsm = (struct wsm_tx *)frame.skb->data;
+        scan.max_tx_rate = wsm->max_tx_rate;
+        scan.band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+                WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G;
+        if (priv->join_status == CW1200_JOIN_STATUS_STA ||
+            priv->join_status == CW1200_JOIN_STATUS_IBSS) {
+                scan.type = WSM_SCAN_TYPE_BACKGROUND;
+                scan.flags = WSM_SCAN_FLAG_FORCE_BACKGROUND;
+        }
+        ch[0].number = priv->channel->hw_value;
+
+        skb_pull(frame.skb, txpriv->offset);
+
+        ies = &frame.skb->data[sizeof(struct ieee80211_hdr_3addr)];
+        ies_len = frame.skb->len - sizeof(struct ieee80211_hdr_3addr);
+
+        if (ies_len) {
+                u8 *ssidie =
+                        (u8 *)cfg80211_find_ie(WLAN_EID_SSID, ies, ies_len);
+                if (ssidie && ssidie[1] && ssidie[1] <= sizeof(ssids[0].ssid)) {
+                        u8 *nextie = &ssidie[2 + ssidie[1]];
+                        /* Remove SSID from the IE list. It has to be provided
+                         * as a separate argument in cw1200_scan_start call
+                         */
+
+                        /* Store SSID localy */
+                        ssids[0].length = ssidie[1];
+                        memcpy(ssids[0].ssid, &ssidie[2], ssids[0].length);
+                        scan.num_ssids = 1;
+
+                        /* Remove SSID from IE list */
+                        ssidie[1] = 0;
+                        memmove(&ssidie[2], nextie, &ies[ies_len] - nextie);
+                        skb_trim(frame.skb, frame.skb->len - ssids[0].length);
+                }
+        }
+
+        /* FW bug: driver has to restart p2p-dev mode after scan */
+        if (priv->join_status == CW1200_JOIN_STATUS_MONITOR)
+                cw1200_disable_listening(priv);
+        ret = wsm_set_template_frame(priv, &frame);
+        priv->scan.direct_probe = 1;
+        if (!ret) {
+                wsm_flush_tx(priv);
+                ret = cw1200_scan_start(priv, &scan);
+        }
+        mutex_unlock(&priv->conf_mutex);
+
+        skb_push(frame.skb, txpriv->offset);
+        if (!ret)
+                IEEE80211_SKB_CB(frame.skb)->flags |= IEEE80211_TX_STAT_ACK;
+        BUG_ON(cw1200_queue_remove(queue, priv->pending_frame_id));
+
+        if (ret) {
+                priv->scan.direct_probe = 0;
+                up(&priv->scan.lock);
+                wsm_unlock_tx(priv);
+        }
+
+        return;
+}
diff --git a/drivers/net/wireless/cw1200/scan.h b/drivers/net/wireless/cw1200/scan.h
new file mode 100644
index 000000000000..5a8296ccfa82
--- /dev/null
+++ b/drivers/net/wireless/cw1200/scan.h
@@ -0,0 +1,56 @@
+/*
+ * Scan interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef SCAN_H_INCLUDED
+#define SCAN_H_INCLUDED
+
+#include <linux/semaphore.h>
+#include "wsm.h"
+
+/* external */ struct sk_buff;
+/* external */ struct cfg80211_scan_request;
+/* external */ struct ieee80211_channel;
+/* external */ struct ieee80211_hw;
+/* external */ struct work_struct;
+
+struct cw1200_scan {
+        struct semaphore lock;
+        struct work_struct work;
+        struct delayed_work timeout;
+        struct cfg80211_scan_request *req;
+        struct ieee80211_channel **begin;
+        struct ieee80211_channel **curr;
+        struct ieee80211_channel **end;
+        struct wsm_ssid ssids[WSM_SCAN_MAX_NUM_OF_SSIDS];
+        int output_power;
+        int n_ssids;
+        int status;
+        atomic_t in_progress;
+        /* Direct probe requests workaround */
+        struct delayed_work probe_work;
+        int direct_probe;
+};
+
+int cw1200_hw_scan(struct ieee80211_hw *hw,
+                   struct ieee80211_vif *vif,
+                   struct cfg80211_scan_request *req);
+void cw1200_scan_work(struct work_struct *work);
+void cw1200_scan_timeout(struct work_struct *work);
+void cw1200_clear_recent_scan_work(struct work_struct *work);
+void cw1200_scan_complete_cb(struct cw1200_common *priv,
+                             struct wsm_scan_complete *arg);
+void cw1200_scan_failed_cb(struct cw1200_common *priv);
+
+/* ******************************************************************** */
+/* Raw probe requests TX workaround                                     */
+void cw1200_probe_work(struct work_struct *work);
+
+#endif
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
new file mode 100644
index 000000000000..4cd0352b508d
--- /dev/null
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -0,0 +1,2404 @@
+/*
+ * Mac80211 STA API for ST-Ericsson CW1200 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/vmalloc.h>
+#include <linux/sched.h>
+#include <linux/firmware.h>
+#include <linux/module.h>
+
+#include "cw1200.h"
+#include "sta.h"
+#include "fwio.h"
+#include "bh.h"
+#include "debug.h"
+
+#ifndef ERP_INFO_BYTE_OFFSET
+#define ERP_INFO_BYTE_OFFSET 2
+#endif
+
+static void cw1200_do_join(struct cw1200_common *priv);
+static void cw1200_do_unjoin(struct cw1200_common *priv);
+
+static int cw1200_upload_beacon(struct cw1200_common *priv);
+static int cw1200_upload_pspoll(struct cw1200_common *priv);
+static int cw1200_upload_null(struct cw1200_common *priv);
+static int cw1200_upload_qosnull(struct cw1200_common *priv);
+static int cw1200_start_ap(struct cw1200_common *priv);
+static int cw1200_update_beaconing(struct cw1200_common *priv);
+static int cw1200_enable_beaconing(struct cw1200_common *priv,
+                                   bool enable);
+static void __cw1200_sta_notify(struct ieee80211_hw *dev,
+                                struct ieee80211_vif *vif,
+                                enum sta_notify_cmd notify_cmd,
+                                int link_id);
+static int __cw1200_flush(struct cw1200_common *priv, bool drop);
+
+static inline void __cw1200_free_event_queue(struct list_head *list)
+{
+        struct cw1200_wsm_event *event, *tmp;
+        list_for_each_entry_safe(event, tmp, list, link) {
+                list_del(&event->link);
+                kfree(event);
+        }
+}
+
+/* ******************************************************************** */
+/* STA API                                                              */
+
+int cw1200_start(struct ieee80211_hw *dev)
+{
+        struct cw1200_common *priv = dev->priv;
+        int ret = 0;
+
+        cw1200_pm_stay_awake(&priv->pm_state, HZ);
+
+        mutex_lock(&priv->conf_mutex);
+
+        /* default EDCA */
+        WSM_EDCA_SET(&priv->edca, 0, 0x0002, 0x0003, 0x0007, 47, 0xc8, false);
+        WSM_EDCA_SET(&priv->edca, 1, 0x0002, 0x0007, 0x000f, 94, 0xc8, false);
+        WSM_EDCA_SET(&priv->edca, 2, 0x0003, 0x000f, 0x03ff, 0, 0xc8, false);
+        WSM_EDCA_SET(&priv->edca, 3, 0x0007, 0x000f, 0x03ff, 0, 0xc8, false);
+        ret = wsm_set_edca_params(priv, &priv->edca);
+        if (ret)
+                goto out;
+
+        ret = cw1200_set_uapsd_param(priv, &priv->edca);
+        if (ret)
+                goto out;
+
+        priv->setbssparams_done = false;
+
+        memcpy(priv->mac_addr, dev->wiphy->perm_addr, ETH_ALEN);
+        priv->mode = NL80211_IFTYPE_MONITOR;
+        priv->wep_default_key_id = -1;
+
+        priv->cqm_beacon_loss_count = 10;
+
+        ret = cw1200_setup_mac(priv);
+        if (ret)
+                goto out;
+
+out:
+        mutex_unlock(&priv->conf_mutex);
+        return ret;
+}
+
+void cw1200_stop(struct ieee80211_hw *dev)
+{
+        struct cw1200_common *priv = dev->priv;
+        LIST_HEAD(list);
+        int i;
+
+        wsm_lock_tx(priv);
+
+        while (down_trylock(&priv->scan.lock)) {
+                /* Scan is in progress. Force it to stop. */
+                priv->scan.req = NULL;
+                schedule();
+        }
+        up(&priv->scan.lock);
+
+        cancel_delayed_work_sync(&priv->scan.probe_work);
+        cancel_delayed_work_sync(&priv->scan.timeout);
+        cancel_delayed_work_sync(&priv->clear_recent_scan_work);
+        cancel_delayed_work_sync(&priv->join_timeout);
+        cw1200_cqm_bssloss_sm(priv, 0, 0, 0);
+        cancel_work_sync(&priv->unjoin_work);
+        cancel_delayed_work_sync(&priv->link_id_gc_work);
+        flush_workqueue(priv->workqueue);
+        del_timer_sync(&priv->mcast_timeout);
+        mutex_lock(&priv->conf_mutex);
+        priv->mode = NL80211_IFTYPE_UNSPECIFIED;
+        priv->listening = false;
+
+        spin_lock(&priv->event_queue_lock);
+        list_splice_init(&priv->event_queue, &list);
+        spin_unlock(&priv->event_queue_lock);
+        __cw1200_free_event_queue(&list);
+
+
+        priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+        priv->join_pending = false;
+
+        for (i = 0; i < 4; i++)
+                cw1200_queue_clear(&priv->tx_queue[i]);
+        mutex_unlock(&priv->conf_mutex);
+        tx_policy_clean(priv);
+
+        /* HACK! */
+        if (atomic_xchg(&priv->tx_lock, 1) != 1)
+                pr_debug("[STA] TX is force-unlocked due to stop request.\n");
+
+        wsm_unlock_tx(priv);
+        atomic_xchg(&priv->tx_lock, 0); /* for recovery to work */
+}
+
+static int cw1200_bssloss_mitigation = 1;
+module_param(cw1200_bssloss_mitigation, int, 0644);
+MODULE_PARM_DESC(cw1200_bssloss_mitigation, "BSS Loss mitigation. 0 == disabled, 1 == enabled (default)");
+
+
+void __cw1200_cqm_bssloss_sm(struct cw1200_common *priv,
+                             int init, int good, int bad)
+{
+        int tx = 0;
+
+        priv->delayed_link_loss = 0;
+        cancel_work_sync(&priv->bss_params_work);
+
+        pr_debug("[STA] CQM BSSLOSS_SM: state: %d init %d good %d bad: %d txlock: %d uj: %d\n",
+                 priv->bss_loss_state,
+                 init, good, bad,
+                 atomic_read(&priv->tx_lock),
+                 priv->delayed_unjoin);
+
+        /* If we have a pending unjoin */
+        if (priv->delayed_unjoin)
+                return;
+
+        if (init) {
+                queue_delayed_work(priv->workqueue,
+                                   &priv->bss_loss_work,
+                                   HZ);
+                priv->bss_loss_state = 0;
+
+                /* Skip the confimration procedure in P2P case */
+                if (!priv->vif->p2p && !atomic_read(&priv->tx_lock))
+                        tx = 1;
+        } else if (good) {
+                cancel_delayed_work_sync(&priv->bss_loss_work);
+                priv->bss_loss_state = 0;
+                queue_work(priv->workqueue, &priv->bss_params_work);
+        } else if (bad) {
+                /* XXX Should we just keep going until we time out? */
+                if (priv->bss_loss_state < 3)
+                        tx = 1;
+        } else {
+                cancel_delayed_work_sync(&priv->bss_loss_work);
+                priv->bss_loss_state = 0;
+        }
+
+        /* Bypass mitigation if it's disabled */
+        if (!cw1200_bssloss_mitigation)
+                tx = 0;
+
+        /* Spit out a NULL packet to our AP if necessary */
+        if (tx) {
+                struct sk_buff *skb;
+
+                priv->bss_loss_state++;
+
+                skb = ieee80211_nullfunc_get(priv->hw, priv->vif);
+                WARN_ON(!skb);
+                if (skb)
+                        cw1200_tx(priv->hw, NULL, skb);
+        }
+}
+
+int cw1200_add_interface(struct ieee80211_hw *dev,
+                         struct ieee80211_vif *vif)
+{
+        int ret;
+        struct cw1200_common *priv = dev->priv;
+        /* __le32 auto_calibration_mode = __cpu_to_le32(1); */
+
+        vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER |
+                             IEEE80211_VIF_SUPPORTS_CQM_RSSI;
+
+        mutex_lock(&priv->conf_mutex);
+
+        if (priv->mode != NL80211_IFTYPE_MONITOR) {
+                mutex_unlock(&priv->conf_mutex);
+                return -EOPNOTSUPP;
+        }
+
+        switch (vif->type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_ADHOC:
+        case NL80211_IFTYPE_MESH_POINT:
+        case NL80211_IFTYPE_AP:
+                priv->mode = vif->type;
+                break;
+        default:
+                mutex_unlock(&priv->conf_mutex);
+                return -EOPNOTSUPP;
+        }
+
+        priv->vif = vif;
+        memcpy(priv->mac_addr, vif->addr, ETH_ALEN);
+        ret = cw1200_setup_mac(priv);
+        /* Enable auto-calibration */
+        /* Exception in subsequent channel switch; disabled.
+         *  wsm_write_mib(priv, WSM_MIB_ID_SET_AUTO_CALIBRATION_MODE,
+         *      &auto_calibration_mode, sizeof(auto_calibration_mode));
+        */
+
+        mutex_unlock(&priv->conf_mutex);
+        return ret;
+}
+
+void cw1200_remove_interface(struct ieee80211_hw *dev,
+                             struct ieee80211_vif *vif)
+{
+        struct cw1200_common *priv = dev->priv;
+        struct wsm_reset reset = {
+                .reset_statistics = true,
+        };
+        int i;
+
+        mutex_lock(&priv->conf_mutex);
+        switch (priv->join_status) {
+        case CW1200_JOIN_STATUS_JOINING:
+        case CW1200_JOIN_STATUS_PRE_STA:
+        case CW1200_JOIN_STATUS_STA:
+        case CW1200_JOIN_STATUS_IBSS:
+                wsm_lock_tx(priv);
+                if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                        wsm_unlock_tx(priv);
+                break;
+        case CW1200_JOIN_STATUS_AP:
+                for (i = 0; priv->link_id_map; ++i) {
+                        if (priv->link_id_map & BIT(i)) {
+                                reset.link_id = i;
+                                wsm_reset(priv, &reset);
+                                priv->link_id_map &= ~BIT(i);
+                        }
+                }
+                memset(priv->link_id_db, 0, sizeof(priv->link_id_db));
+                priv->sta_asleep_mask = 0;
+                priv->enable_beacon = false;
+                priv->tx_multicast = false;
+                priv->aid0_bit_set = false;
+                priv->buffered_multicasts = false;
+                priv->pspoll_mask = 0;
+                reset.link_id = 0;
+                wsm_reset(priv, &reset);
+                break;
+        case CW1200_JOIN_STATUS_MONITOR:
+                cw1200_update_listening(priv, false);
+                break;
+        default:
+                break;
+        }
+        priv->vif = NULL;
+        priv->mode = NL80211_IFTYPE_MONITOR;
+        memset(priv->mac_addr, 0, ETH_ALEN);
+        memset(&priv->p2p_ps_modeinfo, 0, sizeof(priv->p2p_ps_modeinfo));
+        cw1200_free_keys(priv);
+        cw1200_setup_mac(priv);
+        priv->listening = false;
+        priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+        if (!__cw1200_flush(priv, true))
+                wsm_unlock_tx(priv);
+
+        mutex_unlock(&priv->conf_mutex);
+}
+
+int cw1200_change_interface(struct ieee80211_hw *dev,
+                            struct ieee80211_vif *vif,
+                            enum nl80211_iftype new_type,
+                            bool p2p)
+{
+        int ret = 0;
+        pr_debug("change_interface new: %d (%d), old: %d (%d)\n", new_type,
+                 p2p, vif->type, vif->p2p);
+
+        if (new_type != vif->type || vif->p2p != p2p) {
+                cw1200_remove_interface(dev, vif);
+                vif->type = new_type;
+                vif->p2p = p2p;
+                ret = cw1200_add_interface(dev, vif);
+        }
+
+        return ret;
+}
+
+int cw1200_config(struct ieee80211_hw *dev, u32 changed)
+{
+        int ret = 0;
+        struct cw1200_common *priv = dev->priv;
+        struct ieee80211_conf *conf = &dev->conf;
+
+        pr_debug("CONFIG CHANGED:  %08x\n", changed);
+
+        down(&priv->scan.lock);
+        mutex_lock(&priv->conf_mutex);
+        /* TODO: IEEE80211_CONF_CHANGE_QOS */
+        /* TODO: IEEE80211_CONF_CHANGE_LISTEN_INTERVAL */
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                priv->output_power = conf->power_level;
+                pr_debug("[STA] TX power: %d\n", priv->output_power);
+                wsm_set_output_power(priv, priv->output_power * 10);
+        }
+
+        if ((changed & IEEE80211_CONF_CHANGE_CHANNEL) &&
+            (priv->channel != conf->chandef.chan)) {
+                struct ieee80211_channel *ch = conf->chandef.chan;
+                struct wsm_switch_channel channel = {
+                        .channel_number = ch->hw_value,
+                };
+                pr_debug("[STA] Freq %d (wsm ch: %d).\n",
+                         ch->center_freq, ch->hw_value);
+
+                /* __cw1200_flush() implicitly locks tx, if successful */
+                if (!__cw1200_flush(priv, false)) {
+                        if (!wsm_switch_channel(priv, &channel)) {
+                                ret = wait_event_timeout(priv->channel_switch_done,
+                                                         !priv->channel_switch_in_progress,
+                                                         3 * HZ);
+                                if (ret) {
+                                        /* Already unlocks if successful */
+                                        priv->channel = ch;
+                                        ret = 0;
+                                } else {
+                                        ret = -ETIMEDOUT;
+                                }
+                        } else {
+                                /* Unlock if switch channel fails */
+                                wsm_unlock_tx(priv);
+                        }
+                }
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_PS) {
+                if (!(conf->flags & IEEE80211_CONF_PS))
+                        priv->powersave_mode.mode = WSM_PSM_ACTIVE;
+                else if (conf->dynamic_ps_timeout <= 0)
+                        priv->powersave_mode.mode = WSM_PSM_PS;
+                else
+                        priv->powersave_mode.mode = WSM_PSM_FAST_PS;
+
+                /* Firmware requires that value for this 1-byte field must
+                 * be specified in units of 500us. Values above the 128ms
+                 * threshold are not supported.
+                 */
+                if (conf->dynamic_ps_timeout >= 0x80)
+                        priv->powersave_mode.fast_psm_idle_period = 0xFF;
+                else
+                        priv->powersave_mode.fast_psm_idle_period =
+                                        conf->dynamic_ps_timeout << 1;
+
+                if (priv->join_status == CW1200_JOIN_STATUS_STA &&
+                    priv->bss_params.aid)
+                        cw1200_set_pm(priv, &priv->powersave_mode);
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+                /* TBD: It looks like it's transparent
+                 * there's a monitor interface present -- use this
+                 * to determine for example whether to calculate
+                 * timestamps for packets or not, do not use instead
+                 * of filter flags!
+                 */
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_IDLE) {
+                struct wsm_operational_mode mode = {
+                        .power_mode = cw1200_power_mode,
+                        .disable_more_flag_usage = true,
+                };
+
+                wsm_lock_tx(priv);
+                /* Disable p2p-dev mode forced by TX request */
+                if ((priv->join_status == CW1200_JOIN_STATUS_MONITOR) &&
+                    (conf->flags & IEEE80211_CONF_IDLE) &&
+                    !priv->listening) {
+                        cw1200_disable_listening(priv);
+                        priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+                }
+                wsm_set_operational_mode(priv, &mode);
+                wsm_unlock_tx(priv);
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_RETRY_LIMITS) {
+                pr_debug("[STA] Retry limits: %d (long), %d (short).\n",
+                         conf->long_frame_max_tx_count,
+                         conf->short_frame_max_tx_count);
+                spin_lock_bh(&priv->tx_policy_cache.lock);
+                priv->long_frame_max_tx_count = conf->long_frame_max_tx_count;
+                priv->short_frame_max_tx_count =
+                        (conf->short_frame_max_tx_count < 0x0F) ?
+                        conf->short_frame_max_tx_count : 0x0F;
+                priv->hw->max_rate_tries = priv->short_frame_max_tx_count;
+                spin_unlock_bh(&priv->tx_policy_cache.lock);
+        }
+        mutex_unlock(&priv->conf_mutex);
+        up(&priv->scan.lock);
+        return ret;
+}
+
+void cw1200_update_filtering(struct cw1200_common *priv)
+{
+        int ret;
+        bool bssid_filtering = !priv->rx_filter.bssid;
+        bool is_p2p = priv->vif && priv->vif->p2p;
+        bool is_sta = priv->vif && NL80211_IFTYPE_STATION == priv->vif->type;
+
+        static struct wsm_beacon_filter_control bf_ctrl;
+        static struct wsm_mib_beacon_filter_table bf_tbl = {
+                .entry[0].ie_id = WLAN_EID_VENDOR_SPECIFIC,
+                .entry[0].flags = WSM_BEACON_FILTER_IE_HAS_CHANGED |
+                                        WSM_BEACON_FILTER_IE_NO_LONGER_PRESENT |
+                                        WSM_BEACON_FILTER_IE_HAS_APPEARED,
+                .entry[0].oui[0] = 0x50,
+                .entry[0].oui[1] = 0x6F,
+                .entry[0].oui[2] = 0x9A,
+                .entry[1].ie_id = WLAN_EID_HT_OPERATION,
+                .entry[1].flags = WSM_BEACON_FILTER_IE_HAS_CHANGED |
+                                        WSM_BEACON_FILTER_IE_NO_LONGER_PRESENT |
+                                        WSM_BEACON_FILTER_IE_HAS_APPEARED,
+                .entry[2].ie_id = WLAN_EID_ERP_INFO,
+                .entry[2].flags = WSM_BEACON_FILTER_IE_HAS_CHANGED |
+                                        WSM_BEACON_FILTER_IE_NO_LONGER_PRESENT |
+                                        WSM_BEACON_FILTER_IE_HAS_APPEARED,
+        };
+
+        if (priv->join_status == CW1200_JOIN_STATUS_PASSIVE)
+                return;
+        else if (priv->join_status == CW1200_JOIN_STATUS_MONITOR)
+                bssid_filtering = false;
+
+        if (priv->disable_beacon_filter) {
+                bf_ctrl.enabled = 0;
+                bf_ctrl.bcn_count = 1;
+                bf_tbl.num = __cpu_to_le32(0);
+        } else if (is_p2p || !is_sta) {
+                bf_ctrl.enabled = WSM_BEACON_FILTER_ENABLE |
+                        WSM_BEACON_FILTER_AUTO_ERP;
+                bf_ctrl.bcn_count = 0;
+                bf_tbl.num = __cpu_to_le32(2);
+        } else {
+                bf_ctrl.enabled = WSM_BEACON_FILTER_ENABLE;
+                bf_ctrl.bcn_count = 0;
+                bf_tbl.num = __cpu_to_le32(3);
+        }
+
+        /* When acting as p2p client being connected to p2p GO, in order to
+         * receive frames from a different p2p device, turn off bssid filter.
+         *
+         * WARNING: FW dependency!
+         * This can only be used with FW WSM371 and its successors.
+         * In that FW version even with bssid filter turned off,
+         * device will block most of the unwanted frames.
+         */
+        if (is_p2p)
+                bssid_filtering = false;
+
+        ret = wsm_set_rx_filter(priv, &priv->rx_filter);
+        if (!ret)
+                ret = wsm_set_beacon_filter_table(priv, &bf_tbl);
+        if (!ret)
+                ret = wsm_beacon_filter_control(priv, &bf_ctrl);
+        if (!ret)
+                ret = wsm_set_bssid_filtering(priv, bssid_filtering);
+        if (!ret)
+                ret = wsm_set_multicast_filter(priv, &priv->multicast_filter);
+        if (ret)
+                wiphy_err(priv->hw->wiphy,
+                          "Update filtering failed: %d.\n", ret);
+        return;
+}
+
+void cw1200_update_filtering_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common,
+                             update_filtering_work);
+
+        cw1200_update_filtering(priv);
+}
+
+void cw1200_set_beacon_wakeup_period_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common,
+                             set_beacon_wakeup_period_work);
+
+        wsm_set_beacon_wakeup_period(priv,
+                                     priv->beacon_int * priv->join_dtim_period >
+                                     MAX_BEACON_SKIP_TIME_MS ? 1 :
+                                     priv->join_dtim_period, 0);
+}
+
+u64 cw1200_prepare_multicast(struct ieee80211_hw *hw,
+                             struct netdev_hw_addr_list *mc_list)
+{
+        static u8 broadcast_ipv6[ETH_ALEN] = {
+                0x33, 0x33, 0x00, 0x00, 0x00, 0x01
+        };
+        static u8 broadcast_ipv4[ETH_ALEN] = {
+                0x01, 0x00, 0x5e, 0x00, 0x00, 0x01
+        };
+        struct cw1200_common *priv = hw->priv;
+        struct netdev_hw_addr *ha;
+        int count = 0;
+
+        /* Disable multicast filtering */
+        priv->has_multicast_subscription = false;
+        memset(&priv->multicast_filter, 0x00, sizeof(priv->multicast_filter));
+
+        if (netdev_hw_addr_list_count(mc_list) > WSM_MAX_GRP_ADDRTABLE_ENTRIES)
+                return 0;
+
+        /* Enable if requested */
+        netdev_hw_addr_list_for_each(ha, mc_list) {
+                pr_debug("[STA] multicast: %pM\n", ha->addr);
+                memcpy(&priv->multicast_filter.macaddrs[count],
+                       ha->addr, ETH_ALEN);
+                if (memcmp(ha->addr, broadcast_ipv4, ETH_ALEN) &&
+                    memcmp(ha->addr, broadcast_ipv6, ETH_ALEN))
+                        priv->has_multicast_subscription = true;
+                count++;
+        }
+
+        if (count) {
+                priv->multicast_filter.enable = __cpu_to_le32(1);
+                priv->multicast_filter.num_addrs = __cpu_to_le32(count);
+        }
+
+        return netdev_hw_addr_list_count(mc_list);
+}
+
+void cw1200_configure_filter(struct ieee80211_hw *dev,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast)
+{
+        struct cw1200_common *priv = dev->priv;
+        bool listening = !!(*total_flags &
+                            (FIF_PROMISC_IN_BSS |
+                             FIF_OTHER_BSS |
+                             FIF_BCN_PRBRESP_PROMISC |
+                             FIF_PROBE_REQ));
+
+        *total_flags &= FIF_PROMISC_IN_BSS |
+                        FIF_OTHER_BSS |
+                        FIF_FCSFAIL |
+                        FIF_BCN_PRBRESP_PROMISC |
+                        FIF_PROBE_REQ;
+
+        down(&priv->scan.lock);
+        mutex_lock(&priv->conf_mutex);
+
+        priv->rx_filter.promiscuous = (*total_flags & FIF_PROMISC_IN_BSS)
+                        ? 1 : 0;
+        priv->rx_filter.bssid = (*total_flags & (FIF_OTHER_BSS |
+                        FIF_PROBE_REQ)) ? 1 : 0;
+        priv->rx_filter.fcs = (*total_flags & FIF_FCSFAIL) ? 1 : 0;
+        priv->disable_beacon_filter = !(*total_flags &
+                                        (FIF_BCN_PRBRESP_PROMISC |
+                                         FIF_PROMISC_IN_BSS |
+                                         FIF_PROBE_REQ));
+        if (priv->listening != listening) {
+                priv->listening = listening;
+                wsm_lock_tx(priv);
+                cw1200_update_listening(priv, listening);
+                wsm_unlock_tx(priv);
+        }
+        cw1200_update_filtering(priv);
+        mutex_unlock(&priv->conf_mutex);
+        up(&priv->scan.lock);
+}
+
+int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+                   u16 queue, const struct ieee80211_tx_queue_params *params)
+{
+        struct cw1200_common *priv = dev->priv;
+        int ret = 0;
+        /* To prevent re-applying PM request OID again and again*/
+        bool old_uapsd_flags;
+
+        mutex_lock(&priv->conf_mutex);
+
+        if (queue < dev->queues) {
+                old_uapsd_flags = priv->uapsd_info.uapsd_flags;
+
+                WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0);
+                ret = wsm_set_tx_queue_params(priv,
+                                              &priv->tx_queue_params.params[queue], queue);
+                if (ret) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                WSM_EDCA_SET(&priv->edca, queue, params->aifs,
+                             params->cw_min, params->cw_max,
+                             params->txop, 0xc8,
+                             params->uapsd);
+                ret = wsm_set_edca_params(priv, &priv->edca);
+                if (ret) {
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                if (priv->mode == NL80211_IFTYPE_STATION) {
+                        ret = cw1200_set_uapsd_param(priv, &priv->edca);
+                        if (!ret && priv->setbssparams_done &&
+                            (priv->join_status == CW1200_JOIN_STATUS_STA) &&
+                            (old_uapsd_flags != priv->uapsd_info.uapsd_flags))
+                                ret = cw1200_set_pm(priv, &priv->powersave_mode);
+                }
+        } else {
+                ret = -EINVAL;
+        }
+
+out:
+        mutex_unlock(&priv->conf_mutex);
+        return ret;
+}
+
+int cw1200_get_stats(struct ieee80211_hw *dev,
+                     struct ieee80211_low_level_stats *stats)
+{
+        struct cw1200_common *priv = dev->priv;
+
+        memcpy(stats, &priv->stats, sizeof(*stats));
+        return 0;
+}
+
+int cw1200_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg)
+{
+        struct wsm_set_pm pm = *arg;
+
+        if (priv->uapsd_info.uapsd_flags != 0)
+                pm.mode &= ~WSM_PSM_FAST_PS_FLAG;
+
+        if (memcmp(&pm, &priv->firmware_ps_mode,
+                   sizeof(struct wsm_set_pm))) {
+                priv->firmware_ps_mode = pm;
+                return wsm_set_pm(priv, &pm);
+        } else {
+                return 0;
+        }
+}
+
+int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
+                   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                   struct ieee80211_key_conf *key)
+{
+        int ret = -EOPNOTSUPP;
+        struct cw1200_common *priv = dev->priv;
+        struct ieee80211_key_seq seq;
+
+        mutex_lock(&priv->conf_mutex);
+
+        if (cmd == SET_KEY) {
+                u8 *peer_addr = NULL;
+                int pairwise = (key->flags & IEEE80211_KEY_FLAG_PAIRWISE) ?
+                        1 : 0;
+                int idx = cw1200_alloc_key(priv);
+                struct wsm_add_key *wsm_key = &priv->keys[idx];
+
+                if (idx < 0) {
+                        ret = -EINVAL;
+                        goto finally;
+                }
+
+                if (sta)
+                        peer_addr = sta->addr;
+
+                key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
+
+                switch (key->cipher) {
+                case WLAN_CIPHER_SUITE_WEP40:
+                case WLAN_CIPHER_SUITE_WEP104:
+                        if (key->keylen > 16) {
+                                cw1200_free_key(priv, idx);
+                                ret = -EINVAL;
+                                goto finally;
+                        }
+
+                        if (pairwise) {
+                                wsm_key->type = WSM_KEY_TYPE_WEP_PAIRWISE;
+                                memcpy(wsm_key->wep_pairwise.peer,
+                                       peer_addr, ETH_ALEN);
+                                memcpy(wsm_key->wep_pairwise.keydata,
+                                       &key->key[0], key->keylen);
+                                wsm_key->wep_pairwise.keylen = key->keylen;
+                        } else {
+                                wsm_key->type = WSM_KEY_TYPE_WEP_DEFAULT;
+                                memcpy(wsm_key->wep_group.keydata,
+                                       &key->key[0], key->keylen);
+                                wsm_key->wep_group.keylen = key->keylen;
+                                wsm_key->wep_group.keyid = key->keyidx;
+                        }
+                        break;
+                case WLAN_CIPHER_SUITE_TKIP:
+                        ieee80211_get_key_rx_seq(key, 0, &seq);
+                        if (pairwise) {
+                                wsm_key->type = WSM_KEY_TYPE_TKIP_PAIRWISE;
+                                memcpy(wsm_key->tkip_pairwise.peer,
+                                       peer_addr, ETH_ALEN);
+                                memcpy(wsm_key->tkip_pairwise.keydata,
+                                       &key->key[0], 16);
+                                memcpy(wsm_key->tkip_pairwise.tx_mic_key,
+                                       &key->key[16], 8);
+                                memcpy(wsm_key->tkip_pairwise.rx_mic_key,
+                                       &key->key[24], 8);
+                        } else {
+                                size_t mic_offset =
+                                        (priv->mode == NL80211_IFTYPE_AP) ?
+                                        16 : 24;
+                                wsm_key->type = WSM_KEY_TYPE_TKIP_GROUP;
+                                memcpy(wsm_key->tkip_group.keydata,
+                                       &key->key[0], 16);
+                                memcpy(wsm_key->tkip_group.rx_mic_key,
+                                       &key->key[mic_offset], 8);
+
+                                wsm_key->tkip_group.rx_seqnum[0] = seq.tkip.iv16 & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[1] = (seq.tkip.iv16 >> 8) & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[2] = seq.tkip.iv32 & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[3] = (seq.tkip.iv32 >> 8) & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[4] = (seq.tkip.iv32 >> 16) & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[5] = (seq.tkip.iv32 >> 24) & 0xff;
+                                wsm_key->tkip_group.rx_seqnum[6] = 0;
+                                wsm_key->tkip_group.rx_seqnum[7] = 0;
+
+                                wsm_key->tkip_group.keyid = key->keyidx;
+                        }
+                        break;
+                case WLAN_CIPHER_SUITE_CCMP:
+                        ieee80211_get_key_rx_seq(key, 0, &seq);
+                        if (pairwise) {
+                                wsm_key->type = WSM_KEY_TYPE_AES_PAIRWISE;
+                                memcpy(wsm_key->aes_pairwise.peer,
+                                       peer_addr, ETH_ALEN);
+                                memcpy(wsm_key->aes_pairwise.keydata,
+                                       &key->key[0], 16);
+                        } else {
+                                wsm_key->type = WSM_KEY_TYPE_AES_GROUP;
+                                memcpy(wsm_key->aes_group.keydata,
+                                       &key->key[0], 16);
+
+                                wsm_key->aes_group.rx_seqnum[0] = seq.ccmp.pn[5];
+                                wsm_key->aes_group.rx_seqnum[1] = seq.ccmp.pn[4];
+                                wsm_key->aes_group.rx_seqnum[2] = seq.ccmp.pn[3];
+                                wsm_key->aes_group.rx_seqnum[3] = seq.ccmp.pn[2];
+                                wsm_key->aes_group.rx_seqnum[4] = seq.ccmp.pn[1];
+                                wsm_key->aes_group.rx_seqnum[5] = seq.ccmp.pn[0];
+                                wsm_key->aes_group.rx_seqnum[6] = 0;
+                                wsm_key->aes_group.rx_seqnum[7] = 0;
+                                wsm_key->aes_group.keyid = key->keyidx;
+                        }
+                        break;
+                case WLAN_CIPHER_SUITE_SMS4:
+                        if (pairwise) {
+                                wsm_key->type = WSM_KEY_TYPE_WAPI_PAIRWISE;
+                                memcpy(wsm_key->wapi_pairwise.peer,
+                                       peer_addr, ETH_ALEN);
+                                memcpy(wsm_key->wapi_pairwise.keydata,
+                                       &key->key[0], 16);
+                                memcpy(wsm_key->wapi_pairwise.mic_key,
+                                       &key->key[16], 16);
+                                wsm_key->wapi_pairwise.keyid = key->keyidx;
+                        } else {
+                                wsm_key->type = WSM_KEY_TYPE_WAPI_GROUP;
+                                memcpy(wsm_key->wapi_group.keydata,
+                                       &key->key[0],  16);
+                                memcpy(wsm_key->wapi_group.mic_key,
+                                       &key->key[16], 16);
+                                wsm_key->wapi_group.keyid = key->keyidx;
+                        }
+                        break;
+                default:
+                        pr_warn("Unhandled key type %d\n", key->cipher);
+                        cw1200_free_key(priv, idx);
+                        ret = -EOPNOTSUPP;
+                        goto finally;
+                }
+                ret = wsm_add_key(priv, wsm_key);
+                if (!ret)
+                        key->hw_key_idx = idx;
+                else
+                        cw1200_free_key(priv, idx);
+        } else if (cmd == DISABLE_KEY) {
+                struct wsm_remove_key wsm_key = {
+                        .index = key->hw_key_idx,
+                };
+
+                if (wsm_key.index > WSM_KEY_MAX_INDEX) {
+                        ret = -EINVAL;
+                        goto finally;
+                }
+
+                cw1200_free_key(priv, wsm_key.index);
+                ret = wsm_remove_key(priv, &wsm_key);
+        } else {
+                pr_warn("Unhandled key command %d\n", cmd);
+        }
+
+finally:
+        mutex_unlock(&priv->conf_mutex);
+        return ret;
+}
+
+void cw1200_wep_key_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, wep_key_work);
+        u8 queue_id = cw1200_queue_get_queue_id(priv->pending_frame_id);
+        struct cw1200_queue *queue = &priv->tx_queue[queue_id];
+        __le32 wep_default_key_id = __cpu_to_le32(
+                priv->wep_default_key_id);
+
+        pr_debug("[STA] Setting default WEP key: %d\n",
+                 priv->wep_default_key_id);
+        wsm_flush_tx(priv);
+        wsm_write_mib(priv, WSM_MIB_ID_DOT11_WEP_DEFAULT_KEY_ID,
+                      &wep_default_key_id, sizeof(wep_default_key_id));
+        cw1200_queue_requeue(queue, priv->pending_frame_id);
+        wsm_unlock_tx(priv);
+}
+
+int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
+{
+        int ret = 0;
+        __le32 val32;
+        struct cw1200_common *priv = hw->priv;
+
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+                return 0;
+
+        if (value != (u32) -1)
+                val32 = __cpu_to_le32(value);
+        else
+                val32 = 0; /* disabled */
+
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED) {
+                /* device is down, can _not_ set threshold */
+                ret = -ENODEV;
+                goto out;
+        }
+
+        if (priv->rts_threshold == value)
+                goto out;
+
+        pr_debug("[STA] Setting RTS threshold: %d\n",
+                 priv->rts_threshold);
+
+        /* mutex_lock(&priv->conf_mutex); */
+        ret = wsm_write_mib(priv, WSM_MIB_ID_DOT11_RTS_THRESHOLD,
+                            &val32, sizeof(val32));
+        if (!ret)
+                priv->rts_threshold = value;
+        /* mutex_unlock(&priv->conf_mutex); */
+
+out:
+        return ret;
+}
+
+/* If successful, LOCKS the TX queue! */
+static int __cw1200_flush(struct cw1200_common *priv, bool drop)
+{
+        int i, ret;
+
+        for (;;) {
+                /* TODO: correct flush handling is required when dev_stop.
+                 * Temporary workaround: 2s
+                 */
+                if (drop) {
+                        for (i = 0; i < 4; ++i)
+                                cw1200_queue_clear(&priv->tx_queue[i]);
+                } else {
+                        ret = wait_event_timeout(
+                                priv->tx_queue_stats.wait_link_id_empty,
+                                cw1200_queue_stats_is_empty(
+                                        &priv->tx_queue_stats, -1),
+                                2 * HZ);
+                }
+
+                if (!drop && ret <= 0) {
+                        ret = -ETIMEDOUT;
+                        break;
+                } else {
+                        ret = 0;
+                }
+
+                wsm_lock_tx(priv);
+                if (!cw1200_queue_stats_is_empty(&priv->tx_queue_stats, -1)) {
+                        /* Highly unlikely: WSM requeued frames. */
+                        wsm_unlock_tx(priv);
+                        continue;
+                }
+                break;
+        }
+        return ret;
+}
+
+void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
+{
+        struct cw1200_common *priv = hw->priv;
+
+        switch (priv->mode) {
+        case NL80211_IFTYPE_MONITOR:
+                drop = true;
+                break;
+        case NL80211_IFTYPE_AP:
+                if (!priv->enable_beacon)
+                        drop = true;
+                break;
+        }
+
+        if (!__cw1200_flush(priv, drop))
+                wsm_unlock_tx(priv);
+
+        return;
+}
+
+/* ******************************************************************** */
+/* WSM callbacks                                                        */
+
+void cw1200_free_event_queue(struct cw1200_common *priv)
+{
+        LIST_HEAD(list);
+
+        spin_lock(&priv->event_queue_lock);
+        list_splice_init(&priv->event_queue, &list);
+        spin_unlock(&priv->event_queue_lock);
+
+        __cw1200_free_event_queue(&list);
+}
+
+void cw1200_event_handler(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, event_handler);
+        struct cw1200_wsm_event *event;
+        LIST_HEAD(list);
+
+        spin_lock(&priv->event_queue_lock);
+        list_splice_init(&priv->event_queue, &list);
+        spin_unlock(&priv->event_queue_lock);
+
+        list_for_each_entry(event, &list, link) {
+                switch (event->evt.id) {
+                case WSM_EVENT_ERROR:
+                        pr_err("Unhandled WSM Error from LMAC\n");
+                        break;
+                case WSM_EVENT_BSS_LOST:
+                        pr_debug("[CQM] BSS lost.\n");
+                        cancel_work_sync(&priv->unjoin_work);
+                        if (!down_trylock(&priv->scan.lock)) {
+                                cw1200_cqm_bssloss_sm(priv, 1, 0, 0);
+                                up(&priv->scan.lock);
+                        } else {
+                                /* Scan is in progress. Delay reporting.
+                                 * Scan complete will trigger bss_loss_work
+                                 */
+                                priv->delayed_link_loss = 1;
+                                /* Also start a watchdog. */
+                                queue_delayed_work(priv->workqueue,
+                                                   &priv->bss_loss_work, 5*HZ);
+                        }
+                        break;
+                case WSM_EVENT_BSS_REGAINED:
+                        pr_debug("[CQM] BSS regained.\n");
+                        cw1200_cqm_bssloss_sm(priv, 0, 0, 0);
+                        cancel_work_sync(&priv->unjoin_work);
+                        break;
+                case WSM_EVENT_RADAR_DETECTED:
+                        wiphy_info(priv->hw->wiphy, "radar pulse detected\n");
+                        break;
+                case WSM_EVENT_RCPI_RSSI:
+                {
+                        /* RSSI: signed Q8.0, RCPI: unsigned Q7.1
+                         * RSSI = RCPI / 2 - 110
+                         */
+                        int rcpi_rssi = (int)(event->evt.data & 0xFF);
+                        int cqm_evt;
+                        if (priv->cqm_use_rssi)
+                                rcpi_rssi = (s8)rcpi_rssi;
+                        else
+                                rcpi_rssi =  rcpi_rssi / 2 - 110;
+
+                        cqm_evt = (rcpi_rssi <= priv->cqm_rssi_thold) ?
+                                NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW :
+                                NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH;
+                        pr_debug("[CQM] RSSI event: %d.\n", rcpi_rssi);
+                        ieee80211_cqm_rssi_notify(priv->vif, cqm_evt,
+                                                  GFP_KERNEL);
+                        break;
+                }
+                case WSM_EVENT_BT_INACTIVE:
+                        pr_warn("Unhandled BT INACTIVE from LMAC\n");
+                        break;
+                case WSM_EVENT_BT_ACTIVE:
+                        pr_warn("Unhandled BT ACTIVE from LMAC\n");
+                        break;
+                }
+        }
+        __cw1200_free_event_queue(&list);
+}
+
+void cw1200_bss_loss_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, bss_loss_work.work);
+
+        pr_debug("[CQM] Reporting connection loss.\n");
+        wsm_lock_tx(priv);
+        if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                wsm_unlock_tx(priv);
+}
+
+void cw1200_bss_params_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, bss_params_work);
+        mutex_lock(&priv->conf_mutex);
+
+        priv->bss_params.reset_beacon_loss = 1;
+        wsm_set_bss_params(priv, &priv->bss_params);
+        priv->bss_params.reset_beacon_loss = 0;
+
+        mutex_unlock(&priv->conf_mutex);
+}
+
+/* ******************************************************************** */
+/* Internal API                                                         */
+
+/* This function is called to Parse the SDD file
+ * to extract listen_interval and PTA related information
+ * sdd is a TLV: u8 id, u8 len, u8 data[]
+ */
+static int cw1200_parse_sdd_file(struct cw1200_common *priv)
+{
+        const u8 *p = priv->sdd->data;
+        int ret = 0;
+
+        while (p + 2 <= priv->sdd->data + priv->sdd->size) {
+                if (p + p[1] + 2 > priv->sdd->data + priv->sdd->size) {
+                        pr_warn("Malformed sdd structure\n");
+                        return -1;
+                }
+                switch (p[0]) {
+                case SDD_PTA_CFG_ELT_ID: {
+                        u16 v;
+                        if (p[1] < 4) {
+                                pr_warn("SDD_PTA_CFG_ELT_ID malformed\n");
+                                ret = -1;
+                                break;
+                        }
+                        v = le16_to_cpu(*((u16 *)(p + 2)));
+                        if (!v)  /* non-zero means this is enabled */
+                                break;
+
+                        v = le16_to_cpu(*((u16 *)(p + 4)));
+                        priv->conf_listen_interval = (v >> 7) & 0x1F;
+                        pr_debug("PTA found; Listen Interval %d\n",
+                                 priv->conf_listen_interval);
+                        break;
+                }
+                case SDD_REFERENCE_FREQUENCY_ELT_ID: {
+                        u16 clk = le16_to_cpu(*((u16 *)(p + 2)));
+                        if (clk != priv->hw_refclk)
+                                pr_warn("SDD file doesn't match configured refclk (%d vs %d)\n",
+                                        clk, priv->hw_refclk);
+                        break;
+                }
+                default:
+                        break;
+                }
+                p += p[1] + 2;
+        }
+
+        if (!priv->bt_present) {
+                pr_debug("PTA element NOT found.\n");
+                priv->conf_listen_interval = 0;
+        }
+        return ret;
+}
+
+int cw1200_setup_mac(struct cw1200_common *priv)
+{
+        int ret = 0;
+
+        /* NOTE: There is a bug in FW: it reports signal
+         * as RSSI if RSSI subscription is enabled.
+         * It's not enough to set WSM_RCPI_RSSI_USE_RSSI.
+         *
+         * NOTE2: RSSI based reports have been switched to RCPI, since
+         * FW has a bug and RSSI reported values are not stable,
+         * what can leads to signal level oscilations in user-end applications
+         */
+        struct wsm_rcpi_rssi_threshold threshold = {
+                .rssiRcpiMode = WSM_RCPI_RSSI_THRESHOLD_ENABLE |
+                WSM_RCPI_RSSI_DONT_USE_UPPER |
+                WSM_RCPI_RSSI_DONT_USE_LOWER,
+                .rollingAverageCount = 16,
+        };
+
+        struct wsm_configuration cfg = {
+                .dot11StationId = &priv->mac_addr[0],
+        };
+
+        /* Remember the decission here to make sure, we will handle
+         * the RCPI/RSSI value correctly on WSM_EVENT_RCPI_RSS
+         */
+        if (threshold.rssiRcpiMode & WSM_RCPI_RSSI_USE_RSSI)
+                priv->cqm_use_rssi = true;
+
+        if (!priv->sdd) {
+                ret = request_firmware(&priv->sdd, priv->sdd_path, priv->pdev);
+                if (ret) {
+                        pr_err("Can't load sdd file %s.\n", priv->sdd_path);
+                        return ret;
+                }
+                cw1200_parse_sdd_file(priv);
+        }
+
+        cfg.dpdData = priv->sdd->data;
+        cfg.dpdData_size = priv->sdd->size;
+        ret = wsm_configuration(priv, &cfg);
+        if (ret)
+                return ret;
+
+        /* Configure RSSI/SCPI reporting as RSSI. */
+        wsm_set_rcpi_rssi_threshold(priv, &threshold);
+
+        return 0;
+}
+
+static void cw1200_join_complete(struct cw1200_common *priv)
+{
+        pr_debug("[STA] Join complete (%d)\n", priv->join_complete_status);
+
+        priv->join_pending = false;
+        if (priv->join_complete_status) {
+                priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+                cw1200_update_listening(priv, priv->listening);
+                cw1200_do_unjoin(priv);
+                ieee80211_connection_loss(priv->vif);
+        } else {
+                if (priv->mode == NL80211_IFTYPE_ADHOC)
+                        priv->join_status = CW1200_JOIN_STATUS_IBSS;
+                else
+                        priv->join_status = CW1200_JOIN_STATUS_PRE_STA;
+        }
+        wsm_unlock_tx(priv); /* Clearing the lock held before do_join() */
+}
+
+void cw1200_join_complete_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, join_complete_work);
+        mutex_lock(&priv->conf_mutex);
+        cw1200_join_complete(priv);
+        mutex_unlock(&priv->conf_mutex);
+}
+
+void cw1200_join_complete_cb(struct cw1200_common *priv,
+                             struct wsm_join_complete *arg)
+{
+        pr_debug("[STA] cw1200_join_complete_cb called, status=%d.\n",
+                 arg->status);
+
+        if (cancel_delayed_work(&priv->join_timeout)) {
+                priv->join_complete_status = arg->status;
+                queue_work(priv->workqueue, &priv->join_complete_work);
+        }
+}
+
+/* MUST be called with tx_lock held!  It will be unlocked for us. */
+static void cw1200_do_join(struct cw1200_common *priv)
+{
+        const u8 *bssid;
+        struct ieee80211_bss_conf *conf = &priv->vif->bss_conf;
+        struct cfg80211_bss *bss = NULL;
+        struct wsm_protected_mgmt_policy mgmt_policy;
+        struct wsm_join join = {
+                .mode = conf->ibss_joined ?
+                                WSM_JOIN_MODE_IBSS : WSM_JOIN_MODE_BSS,
+                .preamble_type = WSM_JOIN_PREAMBLE_LONG,
+                .probe_for_join = 1,
+                .atim_window = 0,
+                .basic_rate_set = cw1200_rate_mask_to_wsm(priv,
+                                                          conf->basic_rates),
+        };
+        if (delayed_work_pending(&priv->join_timeout)) {
+                pr_warn("[STA] - Join request already pending, skipping..\n");
+                wsm_unlock_tx(priv);
+                return;
+        }
+
+        if (priv->join_status)
+                cw1200_do_unjoin(priv);
+
+        bssid = priv->vif->bss_conf.bssid;
+
+        bss = cfg80211_get_bss(priv->hw->wiphy, priv->channel,
+                        bssid, NULL, 0, 0, 0);
+
+        if (!bss && !conf->ibss_joined) {
+                wsm_unlock_tx(priv);
+                return;
+        }
+
+        mutex_lock(&priv->conf_mutex);
+
+        /* Under the conf lock: check scan status and
+         * bail out if it is in progress.
+         */
+        if (atomic_read(&priv->scan.in_progress)) {
+                wsm_unlock_tx(priv);
+                goto done_put;
+        }
+
+        priv->join_pending = true;
+
+        /* Sanity check basic rates */
+        if (!join.basic_rate_set)
+                join.basic_rate_set = 7;
+
+        /* Sanity check beacon interval */
+        if (!priv->beacon_int)
+                priv->beacon_int = 1;
+
+        join.beacon_interval = priv->beacon_int;
+
+        /* BT Coex related changes */
+        if (priv->bt_present) {
+                if (((priv->conf_listen_interval * 100) %
+                     priv->beacon_int) == 0)
+                        priv->listen_interval =
+                                ((priv->conf_listen_interval * 100) /
+                                 priv->beacon_int);
+                else
+                        priv->listen_interval =
+                                ((priv->conf_listen_interval * 100) /
+                                 priv->beacon_int + 1);
+        }
+
+        if (priv->hw->conf.ps_dtim_period)
+                priv->join_dtim_period = priv->hw->conf.ps_dtim_period;
+        join.dtim_period = priv->join_dtim_period;
+
+        join.channel_number = priv->channel->hw_value;
+        join.band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+                WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G;
+
+        memcpy(join.bssid, bssid, sizeof(join.bssid));
+
+        pr_debug("[STA] Join BSSID: %pM DTIM: %d, interval: %d\n",
+                 join.bssid,
+                 join.dtim_period, priv->beacon_int);
+
+        if (!conf->ibss_joined) {
+                const u8 *ssidie;
+                rcu_read_lock();
+                ssidie = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
+                if (ssidie) {
+                        join.ssid_len = ssidie[1];
+                        memcpy(join.ssid, &ssidie[2], join.ssid_len);
+                }
+                rcu_read_unlock();
+        }
+
+        if (priv->vif->p2p) {
+                join.flags |= WSM_JOIN_FLAGS_P2P_GO;
+                join.basic_rate_set =
+                        cw1200_rate_mask_to_wsm(priv, 0xFF0);
+        }
+
+        /* Enable asynchronous join calls */
+        if (!conf->ibss_joined) {
+                join.flags |= WSM_JOIN_FLAGS_FORCE;
+                join.flags |= WSM_JOIN_FLAGS_FORCE_WITH_COMPLETE_IND;
+        }
+
+        wsm_flush_tx(priv);
+
+        /* Stay Awake for Join and Auth Timeouts and a bit more */
+        cw1200_pm_stay_awake(&priv->pm_state,
+                             CW1200_JOIN_TIMEOUT + CW1200_AUTH_TIMEOUT);
+
+        cw1200_update_listening(priv, false);
+
+        /* Turn on Block ACKs */
+        wsm_set_block_ack_policy(priv, priv->ba_tx_tid_mask,
+                                 priv->ba_rx_tid_mask);
+
+        /* Set up timeout */
+        if (join.flags & WSM_JOIN_FLAGS_FORCE_WITH_COMPLETE_IND) {
+                priv->join_status = CW1200_JOIN_STATUS_JOINING;
+                queue_delayed_work(priv->workqueue,
+                                   &priv->join_timeout,
+                                   CW1200_JOIN_TIMEOUT);
+        }
+
+        /* 802.11w protected mgmt frames */
+        mgmt_policy.protectedMgmtEnable = 0;
+        mgmt_policy.unprotectedMgmtFramesAllowed = 1;
+        mgmt_policy.encryptionForAuthFrame = 1;
+        wsm_set_protected_mgmt_policy(priv, &mgmt_policy);
+
+        /* Perform actual join */
+        if (wsm_join(priv, &join)) {
+                pr_err("[STA] cw1200_join_work: wsm_join failed!\n");
+                cancel_delayed_work_sync(&priv->join_timeout);
+                cw1200_update_listening(priv, priv->listening);
+                /* Tx lock still held, unjoin will clear it. */
+                if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                        wsm_unlock_tx(priv);
+        } else {
+                if (!(join.flags & WSM_JOIN_FLAGS_FORCE_WITH_COMPLETE_IND))
+                        cw1200_join_complete(priv); /* Will clear tx_lock */
+
+                /* Upload keys */
+                cw1200_upload_keys(priv);
+
+                /* Due to beacon filtering it is possible that the
+                 * AP's beacon is not known for the mac80211 stack.
+                 * Disable filtering temporary to make sure the stack
+                 * receives at least one
+                 */
+                priv->disable_beacon_filter = true;
+        }
+        cw1200_update_filtering(priv);
+
+done_put:
+        mutex_unlock(&priv->conf_mutex);
+        if (bss)
+                cfg80211_put_bss(priv->hw->wiphy, bss);
+}
+
+void cw1200_join_timeout(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, join_timeout.work);
+        pr_debug("[WSM] Join timed out.\n");
+        wsm_lock_tx(priv);
+        if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                wsm_unlock_tx(priv);
+}
+
+static void cw1200_do_unjoin(struct cw1200_common *priv)
+{
+        struct wsm_reset reset = {
+                .reset_statistics = true,
+        };
+
+        cancel_delayed_work_sync(&priv->join_timeout);
+
+        mutex_lock(&priv->conf_mutex);
+        priv->join_pending = false;
+
+        if (atomic_read(&priv->scan.in_progress)) {
+                if (priv->delayed_unjoin)
+                        wiphy_dbg(priv->hw->wiphy, "Delayed unjoin is already scheduled.\n");
+                else
+                        priv->delayed_unjoin = true;
+                goto done;
+        }
+
+        priv->delayed_link_loss = false;
+
+        if (!priv->join_status)
+                goto done;
+
+        if (priv->join_status > CW1200_JOIN_STATUS_IBSS) {
+                wiphy_err(priv->hw->wiphy, "Unexpected: join status: %d\n",
+                          priv->join_status);
+                BUG_ON(1);
+        }
+
+        cancel_work_sync(&priv->update_filtering_work);
+        cancel_work_sync(&priv->set_beacon_wakeup_period_work);
+        priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+
+        /* Unjoin is a reset. */
+        wsm_flush_tx(priv);
+        wsm_keep_alive_period(priv, 0);
+        wsm_reset(priv, &reset);
+        wsm_set_output_power(priv, priv->output_power * 10);
+        priv->join_dtim_period = 0;
+        cw1200_setup_mac(priv);
+        cw1200_free_event_queue(priv);
+        cancel_work_sync(&priv->event_handler);
+        cw1200_update_listening(priv, priv->listening);
+        cw1200_cqm_bssloss_sm(priv, 0, 0, 0);
+
+        /* Disable Block ACKs */
+        wsm_set_block_ack_policy(priv, 0, 0);
+
+        priv->disable_beacon_filter = false;
+        cw1200_update_filtering(priv);
+        memset(&priv->association_mode, 0,
+               sizeof(priv->association_mode));
+        memset(&priv->bss_params, 0, sizeof(priv->bss_params));
+        priv->setbssparams_done = false;
+        memset(&priv->firmware_ps_mode, 0,
+               sizeof(priv->firmware_ps_mode));
+
+        pr_debug("[STA] Unjoin completed.\n");
+
+done:
+        mutex_unlock(&priv->conf_mutex);
+}
+
+void cw1200_unjoin_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, unjoin_work);
+
+        cw1200_do_unjoin(priv);
+
+        /* Tell the stack we're dead */
+        ieee80211_connection_loss(priv->vif);
+
+        wsm_unlock_tx(priv);
+}
+
+int cw1200_enable_listening(struct cw1200_common *priv)
+{
+        struct wsm_start start = {
+                .mode = WSM_START_MODE_P2P_DEV,
+                .band = WSM_PHY_BAND_2_4G,
+                .beacon_interval = 100,
+                .dtim_period = 1,
+                .probe_delay = 0,
+                .basic_rate_set = 0x0F,
+        };
+
+        if (priv->channel) {
+                start.band = priv->channel->band == IEEE80211_BAND_5GHZ ?
+                             WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G;
+                start.channel_number = priv->channel->hw_value;
+        } else {
+                start.band = WSM_PHY_BAND_2_4G;
+                start.channel_number = 1;
+        }
+
+        return wsm_start(priv, &start);
+}
+
+int cw1200_disable_listening(struct cw1200_common *priv)
+{
+        int ret;
+        struct wsm_reset reset = {
+                .reset_statistics = true,
+        };
+        ret = wsm_reset(priv, &reset);
+        return ret;
+}
+
+void cw1200_update_listening(struct cw1200_common *priv, bool enabled)
+{
+        if (enabled) {
+                if (priv->join_status == CW1200_JOIN_STATUS_PASSIVE) {
+                        if (!cw1200_enable_listening(priv))
+                                priv->join_status = CW1200_JOIN_STATUS_MONITOR;
+                        wsm_set_probe_responder(priv, true);
+                }
+        } else {
+                if (priv->join_status == CW1200_JOIN_STATUS_MONITOR) {
+                        if (!cw1200_disable_listening(priv))
+                                priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+                        wsm_set_probe_responder(priv, false);
+                }
+        }
+}
+
+int cw1200_set_uapsd_param(struct cw1200_common *priv,
+                           const struct wsm_edca_params *arg)
+{
+        int ret;
+        u16 uapsd_flags = 0;
+
+        /* Here's the mapping AC [queue, bit]
+         *  VO [0,3], VI [1, 2], BE [2, 1], BK [3, 0]
+         */
+
+        if (arg->uapsd_enable[0])
+                uapsd_flags |= 1 << 3;
+
+        if (arg->uapsd_enable[1])
+                uapsd_flags |= 1 << 2;
+
+        if (arg->uapsd_enable[2])
+                uapsd_flags |= 1 << 1;
+
+        if (arg->uapsd_enable[3])
+                uapsd_flags |= 1;
+
+        /* Currently pseudo U-APSD operation is not supported, so setting
+         * MinAutoTriggerInterval, MaxAutoTriggerInterval and
+         * AutoTriggerStep to 0
+         */
+
+        priv->uapsd_info.uapsd_flags = cpu_to_le16(uapsd_flags);
+        priv->uapsd_info.min_auto_trigger_interval = 0;
+        priv->uapsd_info.max_auto_trigger_interval = 0;
+        priv->uapsd_info.auto_trigger_step = 0;
+
+        ret = wsm_set_uapsd_info(priv, &priv->uapsd_info);
+        return ret;
+}
+
+/* ******************************************************************** */
+/* AP API                                                               */
+
+int cw1200_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   struct ieee80211_sta *sta)
+{
+        struct cw1200_common *priv = hw->priv;
+        struct cw1200_sta_priv *sta_priv =
+                        (struct cw1200_sta_priv *)&sta->drv_priv;
+        struct cw1200_link_entry *entry;
+        struct sk_buff *skb;
+
+        if (priv->mode != NL80211_IFTYPE_AP)
+                return 0;
+
+        sta_priv->link_id = cw1200_find_link_id(priv, sta->addr);
+        if (WARN_ON(!sta_priv->link_id)) {
+                wiphy_info(priv->hw->wiphy,
+                           "[AP] No more link IDs available.\n");
+                return -ENOENT;
+        }
+
+        entry = &priv->link_id_db[sta_priv->link_id - 1];
+        spin_lock_bh(&priv->ps_state_lock);
+        if ((sta->uapsd_queues & IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK) ==
+                                        IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
+                priv->sta_asleep_mask |= BIT(sta_priv->link_id);
+        entry->status = CW1200_LINK_HARD;
+        while ((skb = skb_dequeue(&entry->rx_queue)))
+                ieee80211_rx_irqsafe(priv->hw, skb);
+        spin_unlock_bh(&priv->ps_state_lock);
+        return 0;
+}
+
+int cw1200_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                      struct ieee80211_sta *sta)
+{
+        struct cw1200_common *priv = hw->priv;
+        struct cw1200_sta_priv *sta_priv =
+                        (struct cw1200_sta_priv *)&sta->drv_priv;
+        struct cw1200_link_entry *entry;
+
+        if (priv->mode != NL80211_IFTYPE_AP || !sta_priv->link_id)
+                return 0;
+
+        entry = &priv->link_id_db[sta_priv->link_id - 1];
+        spin_lock_bh(&priv->ps_state_lock);
+        entry->status = CW1200_LINK_RESERVE;
+        entry->timestamp = jiffies;
+        wsm_lock_tx_async(priv);
+        if (queue_work(priv->workqueue, &priv->link_id_work) <= 0)
+                wsm_unlock_tx(priv);
+        spin_unlock_bh(&priv->ps_state_lock);
+        flush_workqueue(priv->workqueue);
+        return 0;
+}
+
+static void __cw1200_sta_notify(struct ieee80211_hw *dev,
+                                struct ieee80211_vif *vif,
+                                enum sta_notify_cmd notify_cmd,
+                                int link_id)
+{
+        struct cw1200_common *priv = dev->priv;
+        u32 bit, prev;
+
+        /* Zero link id means "for all link IDs" */
+        if (link_id)
+                bit = BIT(link_id);
+        else if (WARN_ON_ONCE(notify_cmd != STA_NOTIFY_AWAKE))
+                bit = 0;
+        else
+                bit = priv->link_id_map;
+        prev = priv->sta_asleep_mask & bit;
+
+        switch (notify_cmd) {
+        case STA_NOTIFY_SLEEP:
+                if (!prev) {
+                        if (priv->buffered_multicasts &&
+                            !priv->sta_asleep_mask)
+                                queue_work(priv->workqueue,
+                                           &priv->multicast_start_work);
+                        priv->sta_asleep_mask |= bit;
+                }
+                break;
+        case STA_NOTIFY_AWAKE:
+                if (prev) {
+                        priv->sta_asleep_mask &= ~bit;
+                        priv->pspoll_mask &= ~bit;
+                        if (priv->tx_multicast && link_id &&
+                            !priv->sta_asleep_mask)
+                                queue_work(priv->workqueue,
+                                           &priv->multicast_stop_work);
+                        cw1200_bh_wakeup(priv);
+                }
+                break;
+        }
+}
+
+void cw1200_sta_notify(struct ieee80211_hw *dev,
+                       struct ieee80211_vif *vif,
+                       enum sta_notify_cmd notify_cmd,
+                       struct ieee80211_sta *sta)
+{
+        struct cw1200_common *priv = dev->priv;
+        struct cw1200_sta_priv *sta_priv =
+                (struct cw1200_sta_priv *)&sta->drv_priv;
+
+        spin_lock_bh(&priv->ps_state_lock);
+        __cw1200_sta_notify(dev, vif, notify_cmd, sta_priv->link_id);
+        spin_unlock_bh(&priv->ps_state_lock);
+}
+
+static void cw1200_ps_notify(struct cw1200_common *priv,
+                      int link_id, bool ps)
+{
+        if (link_id > CW1200_MAX_STA_IN_AP_MODE)
+                return;
+
+        pr_debug("%s for LinkId: %d. STAs asleep: %.8X\n",
+                 ps ? "Stop" : "Start",
+                 link_id, priv->sta_asleep_mask);
+
+        __cw1200_sta_notify(priv->hw, priv->vif,
+                            ps ? STA_NOTIFY_SLEEP : STA_NOTIFY_AWAKE, link_id);
+}
+
+static int cw1200_set_tim_impl(struct cw1200_common *priv, bool aid0_bit_set)
+{
+        struct sk_buff *skb;
+        struct wsm_update_ie update_ie = {
+                .what = WSM_UPDATE_IE_BEACON,
+                .count = 1,
+        };
+        u16 tim_offset, tim_length;
+
+        pr_debug("[AP] mcast: %s.\n", aid0_bit_set ? "ena" : "dis");
+
+        skb = ieee80211_beacon_get_tim(priv->hw, priv->vif,
+                        &tim_offset, &tim_length);
+        if (!skb) {
+                if (!__cw1200_flush(priv, true))
+                        wsm_unlock_tx(priv);
+                return -ENOENT;
+        }
+
+        if (tim_offset && tim_length >= 6) {
+                /* Ignore DTIM count from mac80211:
+                 * firmware handles DTIM internally.
+                 */
+                skb->data[tim_offset + 2] = 0;
+
+                /* Set/reset aid0 bit */
+                if (aid0_bit_set)
+                        skb->data[tim_offset + 4] |= 1;
+                else
+                        skb->data[tim_offset + 4] &= ~1;
+        }
+
+        update_ie.ies = &skb->data[tim_offset];
+        update_ie.length = tim_length;
+        wsm_update_ie(priv, &update_ie);
+
+        dev_kfree_skb(skb);
+
+        return 0;
+}
+
+void cw1200_set_tim_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, set_tim_work);
+        (void)cw1200_set_tim_impl(priv, priv->aid0_bit_set);
+}
+
+int cw1200_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
+                   bool set)
+{
+        struct cw1200_common *priv = dev->priv;
+        queue_work(priv->workqueue, &priv->set_tim_work);
+        return 0;
+}
+
+void cw1200_set_cts_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, set_cts_work);
+
+        u8 erp_ie[3] = {WLAN_EID_ERP_INFO, 0x1, 0};
+        struct wsm_update_ie update_ie = {
+                .what = WSM_UPDATE_IE_BEACON,
+                .count = 1,
+                .ies = erp_ie,
+                .length = 3,
+        };
+        u32 erp_info;
+        __le32 use_cts_prot;
+        mutex_lock(&priv->conf_mutex);
+        erp_info = priv->erp_info;
+        mutex_unlock(&priv->conf_mutex);
+        use_cts_prot =
+                erp_info & WLAN_ERP_USE_PROTECTION ?
+                __cpu_to_le32(1) : 0;
+
+        erp_ie[ERP_INFO_BYTE_OFFSET] = erp_info;
+
+        pr_debug("[STA] ERP information 0x%x\n", erp_info);
+
+        wsm_write_mib(priv, WSM_MIB_ID_NON_ERP_PROTECTION,
+                      &use_cts_prot, sizeof(use_cts_prot));
+        wsm_update_ie(priv, &update_ie);
+
+        return;
+}
+
+static int cw1200_set_btcoexinfo(struct cw1200_common *priv)
+{
+        struct wsm_override_internal_txrate arg;
+        int ret = 0;
+
+        if (priv->mode == NL80211_IFTYPE_STATION) {
+                /* Plumb PSPOLL and NULL template */
+                cw1200_upload_pspoll(priv);
+                cw1200_upload_null(priv);
+                cw1200_upload_qosnull(priv);
+        } else {
+                return 0;
+        }
+
+        memset(&arg, 0, sizeof(struct wsm_override_internal_txrate));
+
+        if (!priv->vif->p2p) {
+                /* STATION mode */
+                if (priv->bss_params.operational_rate_set & ~0xF) {
+                        pr_debug("[STA] STA has ERP rates\n");
+                        /* G or BG mode */
+                        arg.internalTxRate = (__ffs(
+                        priv->bss_params.operational_rate_set & ~0xF));
+                } else {
+                        pr_debug("[STA] STA has non ERP rates\n");
+                        /* B only mode */
+                        arg.internalTxRate = (__ffs(priv->association_mode.basic_rate_set));
+                }
+                arg.nonErpInternalTxRate = (__ffs(priv->association_mode.basic_rate_set));
+        } else {
+                /* P2P mode */
+                arg.internalTxRate = (__ffs(priv->bss_params.operational_rate_set & ~0xF));
+                arg.nonErpInternalTxRate = (__ffs(priv->bss_params.operational_rate_set & ~0xF));
+        }
+
+        pr_debug("[STA] BTCOEX_INFO MODE %d, internalTxRate : %x, nonErpInternalTxRate: %x\n",
+                 priv->mode,
+                 arg.internalTxRate,
+                 arg.nonErpInternalTxRate);
+
+        ret = wsm_write_mib(priv, WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE,
+                            &arg, sizeof(arg));
+
+        return ret;
+}
+
+void cw1200_bss_info_changed(struct ieee80211_hw *dev,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_bss_conf *info,
+                             u32 changed)
+{
+        struct cw1200_common *priv = dev->priv;
+        bool do_join = false;
+
+        mutex_lock(&priv->conf_mutex);
+
+        pr_debug("BSS CHANGED:  %08x\n", changed);
+
+        /* TODO: BSS_CHANGED_QOS */
+        /* TODO: BSS_CHANGED_TXPOWER */
+
+        if (changed & BSS_CHANGED_ARP_FILTER) {
+                struct wsm_mib_arp_ipv4_filter filter = {0};
+                int i;
+
+                pr_debug("[STA] BSS_CHANGED_ARP_FILTER cnt: %d\n",
+                         info->arp_addr_cnt);
+
+                /* Currently only one IP address is supported by firmware.
+                 * In case of more IPs arp filtering will be disabled.
+                 */
+                if (info->arp_addr_cnt > 0 &&
+                    info->arp_addr_cnt <= WSM_MAX_ARP_IP_ADDRTABLE_ENTRIES) {
+                        for (i = 0; i < info->arp_addr_cnt; i++) {
+                                filter.ipv4addrs[i] = info->arp_addr_list[i];
+                                pr_debug("[STA] addr[%d]: 0x%X\n",
+                                         i, filter.ipv4addrs[i]);
+                        }
+                        filter.enable = __cpu_to_le32(1);
+                }
+
+                pr_debug("[STA] arp ip filter enable: %d\n",
+                         __le32_to_cpu(filter.enable));
+
+                wsm_set_arp_ipv4_filter(priv, &filter);
+        }
+
+        if (changed &
+            (BSS_CHANGED_BEACON |
+             BSS_CHANGED_AP_PROBE_RESP |
+             BSS_CHANGED_BSSID |
+             BSS_CHANGED_SSID |
+             BSS_CHANGED_IBSS)) {
+                pr_debug("BSS_CHANGED_BEACON\n");
+                priv->beacon_int = info->beacon_int;
+                cw1200_update_beaconing(priv);
+                cw1200_upload_beacon(priv);
+        }
+
+        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+                pr_debug("BSS_CHANGED_BEACON_ENABLED (%d)\n", info->enable_beacon);
+
+                if (priv->enable_beacon != info->enable_beacon) {
+                        cw1200_enable_beaconing(priv, info->enable_beacon);
+                        priv->enable_beacon = info->enable_beacon;
+                }
+        }
+
+        if (changed & BSS_CHANGED_BEACON_INT) {
+                pr_debug("CHANGED_BEACON_INT\n");
+                if (info->ibss_joined)
+                        do_join = true;
+                else if (priv->join_status == CW1200_JOIN_STATUS_AP)
+                        cw1200_update_beaconing(priv);
+        }
+
+        /* assoc/disassoc, or maybe AID changed */
+        if (changed & BSS_CHANGED_ASSOC) {
+                wsm_lock_tx(priv);
+                priv->wep_default_key_id = -1;
+                wsm_unlock_tx(priv);
+        }
+
+        if (changed & BSS_CHANGED_BSSID) {
+                pr_debug("BSS_CHANGED_BSSID\n");
+                do_join = true;
+        }
+
+        if (changed &
+            (BSS_CHANGED_ASSOC |
+             BSS_CHANGED_BSSID |
+             BSS_CHANGED_IBSS |
+             BSS_CHANGED_BASIC_RATES |
+             BSS_CHANGED_HT)) {
+                pr_debug("BSS_CHANGED_ASSOC\n");
+                if (info->assoc) {
+                        if (priv->join_status < CW1200_JOIN_STATUS_PRE_STA) {
+                                ieee80211_connection_loss(vif);
+                                mutex_unlock(&priv->conf_mutex);
+                                return;
+                        } else if (priv->join_status == CW1200_JOIN_STATUS_PRE_STA) {
+                                priv->join_status = CW1200_JOIN_STATUS_STA;
+                        }
+                } else {
+                        do_join = true;
+                }
+
+                if (info->assoc || info->ibss_joined) {
+                        struct ieee80211_sta *sta = NULL;
+                        u32 val = 0;
+
+                        if (info->dtim_period)
+                                priv->join_dtim_period = info->dtim_period;
+                        priv->beacon_int = info->beacon_int;
+
+                        rcu_read_lock();
+
+                        if (info->bssid && !info->ibss_joined)
+                                sta = ieee80211_find_sta(vif, info->bssid);
+                        if (sta) {
+                                priv->ht_info.ht_cap = sta->ht_cap;
+                                priv->bss_params.operational_rate_set =
+                                        cw1200_rate_mask_to_wsm(priv,
+                                                                sta->supp_rates[priv->channel->band]);
+                                priv->ht_info.channel_type = cfg80211_get_chandef_type(&dev->conf.chandef);
+                                priv->ht_info.operation_mode = info->ht_operation_mode;
+                        } else {
+                                memset(&priv->ht_info, 0,
+                                       sizeof(priv->ht_info));
+                                priv->bss_params.operational_rate_set = -1;
+                        }
+                        rcu_read_unlock();
+
+                        /* Non Greenfield stations present */
+                        if (priv->ht_info.operation_mode &
+                            IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT)
+                                val |= WSM_NON_GREENFIELD_STA_PRESENT;
+
+                        /* Set HT protection method */
+                        val |= (priv->ht_info.operation_mode & IEEE80211_HT_OP_MODE_PROTECTION) << 2;
+
+                        /* TODO:
+                         * STBC_param.dual_cts
+                         *  STBC_param.LSIG_TXOP_FILL
+                         */
+
+                        val = cpu_to_le32(val);
+                        wsm_write_mib(priv, WSM_MIB_ID_SET_HT_PROTECTION,
+                                      &val, sizeof(val));
+
+                        priv->association_mode.greenfield =
+                                cw1200_ht_greenfield(&priv->ht_info);
+                        priv->association_mode.flags =
+                                WSM_ASSOCIATION_MODE_SNOOP_ASSOC_FRAMES |
+                                WSM_ASSOCIATION_MODE_USE_PREAMBLE_TYPE |
+                                WSM_ASSOCIATION_MODE_USE_HT_MODE |
+                                WSM_ASSOCIATION_MODE_USE_BASIC_RATE_SET |
+                                WSM_ASSOCIATION_MODE_USE_MPDU_START_SPACING;
+                        priv->association_mode.preamble =
+                                info->use_short_preamble ?
+                                WSM_JOIN_PREAMBLE_SHORT :
+                                WSM_JOIN_PREAMBLE_LONG;
+                        priv->association_mode.basic_rate_set = __cpu_to_le32(
+                                cw1200_rate_mask_to_wsm(priv,
+                                                        info->basic_rates));
+                        priv->association_mode.mpdu_start_spacing =
+                                cw1200_ht_ampdu_density(&priv->ht_info);
+
+                        cw1200_cqm_bssloss_sm(priv, 0, 0, 0);
+                        cancel_work_sync(&priv->unjoin_work);
+
+                        priv->bss_params.beacon_lost_count = priv->cqm_beacon_loss_count;
+                        priv->bss_params.aid = info->aid;
+
+                        if (priv->join_dtim_period < 1)
+                                priv->join_dtim_period = 1;
+
+                        pr_debug("[STA] DTIM %d, interval: %d\n",
+                                 priv->join_dtim_period, priv->beacon_int);
+                        pr_debug("[STA] Preamble: %d, Greenfield: %d, Aid: %d, Rates: 0x%.8X, Basic: 0x%.8X\n",
+                                 priv->association_mode.preamble,
+                                 priv->association_mode.greenfield,
+                                 priv->bss_params.aid,
+                                 priv->bss_params.operational_rate_set,
+                                 priv->association_mode.basic_rate_set);
+                        wsm_set_association_mode(priv, &priv->association_mode);
+
+                        if (!info->ibss_joined) {
+                                wsm_keep_alive_period(priv, 30 /* sec */);
+                                wsm_set_bss_params(priv, &priv->bss_params);
+                                priv->setbssparams_done = true;
+                                cw1200_set_beacon_wakeup_period_work(&priv->set_beacon_wakeup_period_work);
+                                cw1200_set_pm(priv, &priv->powersave_mode);
+                        }
+                        if (priv->vif->p2p) {
+                                pr_debug("[STA] Setting p2p powersave configuration.\n");
+                                wsm_set_p2p_ps_modeinfo(priv,
+                                                        &priv->p2p_ps_modeinfo);
+                        }
+                        if (priv->bt_present)
+                                cw1200_set_btcoexinfo(priv);
+                } else {
+                        memset(&priv->association_mode, 0,
+                               sizeof(priv->association_mode));
+                        memset(&priv->bss_params, 0, sizeof(priv->bss_params));
+                }
+        }
+
+        /* ERP Protection */
+        if (changed & (BSS_CHANGED_ASSOC |
+                       BSS_CHANGED_ERP_CTS_PROT |
+                       BSS_CHANGED_ERP_PREAMBLE)) {
+                u32 prev_erp_info = priv->erp_info;
+                if (info->use_cts_prot)
+                        priv->erp_info |= WLAN_ERP_USE_PROTECTION;
+                else if (!(prev_erp_info & WLAN_ERP_NON_ERP_PRESENT))
+                        priv->erp_info &= ~WLAN_ERP_USE_PROTECTION;
+
+                if (info->use_short_preamble)
+                        priv->erp_info |= WLAN_ERP_BARKER_PREAMBLE;
+                else
+                        priv->erp_info &= ~WLAN_ERP_BARKER_PREAMBLE;
+
+                pr_debug("[STA] ERP Protection: %x\n", priv->erp_info);
+
+                if (prev_erp_info != priv->erp_info)
+                        queue_work(priv->workqueue, &priv->set_cts_work);
+        }
+
+        /* ERP Slottime */
+        if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_ERP_SLOT)) {
+                __le32 slot_time = info->use_short_slot ?
+                        __cpu_to_le32(9) : __cpu_to_le32(20);
+                pr_debug("[STA] Slot time: %d us.\n",
+                         __le32_to_cpu(slot_time));
+                wsm_write_mib(priv, WSM_MIB_ID_DOT11_SLOT_TIME,
+                              &slot_time, sizeof(slot_time));
+        }
+
+        if (changed & (BSS_CHANGED_ASSOC | BSS_CHANGED_CQM)) {
+                struct wsm_rcpi_rssi_threshold threshold = {
+                        .rollingAverageCount = 8,
+                };
+                pr_debug("[CQM] RSSI threshold subscribe: %d +- %d\n",
+                         info->cqm_rssi_thold, info->cqm_rssi_hyst);
+                priv->cqm_rssi_thold = info->cqm_rssi_thold;
+                priv->cqm_rssi_hyst = info->cqm_rssi_hyst;
+
+                if (info->cqm_rssi_thold || info->cqm_rssi_hyst) {
+                        /* RSSI subscription enabled */
+                        /* TODO: It's not a correct way of setting threshold.
+                         * Upper and lower must be set equal here and adjusted
+                         * in callback. However current implementation is much
+                         * more relaible and stable.
+                         */
+
+                        /* RSSI: signed Q8.0, RCPI: unsigned Q7.1
+                         * RSSI = RCPI / 2 - 110
+                         */
+                        if (priv->cqm_use_rssi) {
+                                threshold.upperThreshold =
+                                        info->cqm_rssi_thold + info->cqm_rssi_hyst;
+                                threshold.lowerThreshold =
+                                        info->cqm_rssi_thold;
+                                threshold.rssiRcpiMode |= WSM_RCPI_RSSI_USE_RSSI;
+                        } else {
+                                threshold.upperThreshold = (info->cqm_rssi_thold + info->cqm_rssi_hyst + 110) * 2;
+                                threshold.lowerThreshold = (info->cqm_rssi_thold + 110) * 2;
+                        }
+                        threshold.rssiRcpiMode |= WSM_RCPI_RSSI_THRESHOLD_ENABLE;
+                } else {
+                        /* There is a bug in FW, see sta.c. We have to enable
+                         * dummy subscription to get correct RSSI values.
+                         */
+                        threshold.rssiRcpiMode |=
+                                WSM_RCPI_RSSI_THRESHOLD_ENABLE |
+                                WSM_RCPI_RSSI_DONT_USE_UPPER |
+                                WSM_RCPI_RSSI_DONT_USE_LOWER;
+                        if (priv->cqm_use_rssi)
+                                threshold.rssiRcpiMode |= WSM_RCPI_RSSI_USE_RSSI;
+                }
+                wsm_set_rcpi_rssi_threshold(priv, &threshold);
+        }
+        mutex_unlock(&priv->conf_mutex);
+
+        if (do_join) {
+                wsm_lock_tx(priv);
+                cw1200_do_join(priv); /* Will unlock it for us */
+        }
+}
+
+void cw1200_multicast_start_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, multicast_start_work);
+        long tmo = priv->join_dtim_period *
+                        (priv->beacon_int + 20) * HZ / 1024;
+
+        cancel_work_sync(&priv->multicast_stop_work);
+
+        if (!priv->aid0_bit_set) {
+                wsm_lock_tx(priv);
+                cw1200_set_tim_impl(priv, true);
+                priv->aid0_bit_set = true;
+                mod_timer(&priv->mcast_timeout, jiffies + tmo);
+                wsm_unlock_tx(priv);
+        }
+}
+
+void cw1200_multicast_stop_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, multicast_stop_work);
+
+        if (priv->aid0_bit_set) {
+                del_timer_sync(&priv->mcast_timeout);
+                wsm_lock_tx(priv);
+                priv->aid0_bit_set = false;
+                cw1200_set_tim_impl(priv, false);
+                wsm_unlock_tx(priv);
+        }
+}
+
+void cw1200_mcast_timeout(unsigned long arg)
+{
+        struct cw1200_common *priv =
+                (struct cw1200_common *)arg;
+
+        wiphy_warn(priv->hw->wiphy,
+                   "Multicast delivery timeout.\n");
+        spin_lock_bh(&priv->ps_state_lock);
+        priv->tx_multicast = priv->aid0_bit_set &&
+                        priv->buffered_multicasts;
+        if (priv->tx_multicast)
+                cw1200_bh_wakeup(priv);
+        spin_unlock_bh(&priv->ps_state_lock);
+}
+
+int cw1200_ampdu_action(struct ieee80211_hw *hw,
+                        struct ieee80211_vif *vif,
+                        enum ieee80211_ampdu_mlme_action action,
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                        u8 buf_size)
+{
+        /* Aggregation is implemented fully in firmware,
+         * including block ack negotiation. Do not allow
+         * mac80211 stack to do anything: it interferes with
+         * the firmware.
+         */
+
+        /* Note that we still need this function stubbed. */
+        return -ENOTSUPP;
+}
+
+/* ******************************************************************** */
+/* WSM callback                                                         */
+void cw1200_suspend_resume(struct cw1200_common *priv,
+                          struct wsm_suspend_resume *arg)
+{
+        pr_debug("[AP] %s: %s\n",
+                 arg->stop ? "stop" : "start",
+                 arg->multicast ? "broadcast" : "unicast");
+
+        if (arg->multicast) {
+                bool cancel_tmo = false;
+                spin_lock_bh(&priv->ps_state_lock);
+                if (arg->stop) {
+                        priv->tx_multicast = false;
+                } else {
+                        /* Firmware sends this indication every DTIM if there
+                         * is a STA in powersave connected. There is no reason
+                         * to suspend, following wakeup will consume much more
+                         * power than it could be saved.
+                         */
+                        cw1200_pm_stay_awake(&priv->pm_state,
+                                             priv->join_dtim_period *
+                                             (priv->beacon_int + 20) * HZ / 1024);
+                        priv->tx_multicast = (priv->aid0_bit_set &&
+                                              priv->buffered_multicasts);
+                        if (priv->tx_multicast) {
+                                cancel_tmo = true;
+                                cw1200_bh_wakeup(priv);
+                        }
+                }
+                spin_unlock_bh(&priv->ps_state_lock);
+                if (cancel_tmo)
+                        del_timer_sync(&priv->mcast_timeout);
+        } else {
+                spin_lock_bh(&priv->ps_state_lock);
+                cw1200_ps_notify(priv, arg->link_id, arg->stop);
+                spin_unlock_bh(&priv->ps_state_lock);
+                if (!arg->stop)
+                        cw1200_bh_wakeup(priv);
+        }
+        return;
+}
+
+/* ******************************************************************** */
+/* AP privates                                                          */
+
+static int cw1200_upload_beacon(struct cw1200_common *priv)
+{
+        int ret = 0;
+        struct ieee80211_mgmt *mgmt;
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_BEACON,
+        };
+
+        u16 tim_offset;
+        u16 tim_len;
+
+        if (priv->mode == NL80211_IFTYPE_STATION ||
+            priv->mode == NL80211_IFTYPE_MONITOR ||
+            priv->mode == NL80211_IFTYPE_UNSPECIFIED)
+                goto done;
+
+        if (priv->vif->p2p)
+                frame.rate = WSM_TRANSMIT_RATE_6;
+
+        frame.skb = ieee80211_beacon_get_tim(priv->hw, priv->vif,
+                                             &tim_offset, &tim_len);
+        if (!frame.skb)
+                return -ENOMEM;
+
+        ret = wsm_set_template_frame(priv, &frame);
+
+        if (ret)
+                goto done;
+
+        /* TODO: Distill probe resp; remove TIM
+         * and any other beacon-specific IEs
+         */
+        mgmt = (void *)frame.skb->data;
+        mgmt->frame_control =
+                __cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                              IEEE80211_STYPE_PROBE_RESP);
+
+        frame.frame_type = WSM_FRAME_TYPE_PROBE_RESPONSE;
+        if (priv->vif->p2p) {
+                ret = wsm_set_probe_responder(priv, true);
+        } else {
+                ret = wsm_set_template_frame(priv, &frame);
+                wsm_set_probe_responder(priv, false);
+        }
+
+done:
+        dev_kfree_skb(frame.skb);
+
+        return ret;
+}
+
+static int cw1200_upload_pspoll(struct cw1200_common *priv)
+{
+        int ret = 0;
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_PS_POLL,
+                .rate = 0xFF,
+        };
+
+
+        frame.skb = ieee80211_pspoll_get(priv->hw, priv->vif);
+        if (!frame.skb)
+                return -ENOMEM;
+
+        ret = wsm_set_template_frame(priv, &frame);
+
+        dev_kfree_skb(frame.skb);
+
+        return ret;
+}
+
+static int cw1200_upload_null(struct cw1200_common *priv)
+{
+        int ret = 0;
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_NULL,
+                .rate = 0xFF,
+        };
+
+        frame.skb = ieee80211_nullfunc_get(priv->hw, priv->vif);
+        if (!frame.skb)
+                return -ENOMEM;
+
+        ret = wsm_set_template_frame(priv, &frame);
+
+        dev_kfree_skb(frame.skb);
+
+        return ret;
+}
+
+static int cw1200_upload_qosnull(struct cw1200_common *priv)
+{
+        int ret = 0;
+        /* TODO:  This needs to be implemented
+
+        struct wsm_template_frame frame = {
+                .frame_type = WSM_FRAME_TYPE_QOS_NULL,
+                .rate = 0xFF,
+        };
+
+        frame.skb = ieee80211_qosnullfunc_get(priv->hw, priv->vif);
+        if (!frame.skb)
+                return -ENOMEM;
+
+        ret = wsm_set_template_frame(priv, &frame);
+
+        dev_kfree_skb(frame.skb);
+
+        */
+        return ret;
+}
+
+static int cw1200_enable_beaconing(struct cw1200_common *priv,
+                                   bool enable)
+{
+        struct wsm_beacon_transmit transmit = {
+                .enable_beaconing = enable,
+        };
+
+        return wsm_beacon_transmit(priv, &transmit);
+}
+
+static int cw1200_start_ap(struct cw1200_common *priv)
+{
+        int ret;
+        struct ieee80211_bss_conf *conf = &priv->vif->bss_conf;
+        struct wsm_start start = {
+                .mode = priv->vif->p2p ?
+                                WSM_START_MODE_P2P_GO : WSM_START_MODE_AP,
+                .band = (priv->channel->band == IEEE80211_BAND_5GHZ) ?
+                                WSM_PHY_BAND_5G : WSM_PHY_BAND_2_4G,
+                .channel_number = priv->channel->hw_value,
+                .beacon_interval = conf->beacon_int,
+                .dtim_period = conf->dtim_period,
+                .preamble = conf->use_short_preamble ?
+                                WSM_JOIN_PREAMBLE_SHORT :
+                                WSM_JOIN_PREAMBLE_LONG,
+                .probe_delay = 100,
+                .basic_rate_set = cw1200_rate_mask_to_wsm(priv,
+                                conf->basic_rates),
+        };
+        struct wsm_operational_mode mode = {
+                .power_mode = cw1200_power_mode,
+                .disable_more_flag_usage = true,
+        };
+
+        memset(start.ssid, 0, sizeof(start.ssid));
+        if (!conf->hidden_ssid) {
+                start.ssid_len = conf->ssid_len;
+                memcpy(start.ssid, conf->ssid, start.ssid_len);
+        }
+
+        priv->beacon_int = conf->beacon_int;
+        priv->join_dtim_period = conf->dtim_period;
+
+        memset(&priv->link_id_db, 0, sizeof(priv->link_id_db));
+
+        pr_debug("[AP] ch: %d(%d), bcn: %d(%d), brt: 0x%.8X, ssid: %.*s.\n",
+                 start.channel_number, start.band,
+                 start.beacon_interval, start.dtim_period,
+                 start.basic_rate_set,
+                 start.ssid_len, start.ssid);
+        ret = wsm_start(priv, &start);
+        if (!ret)
+                ret = cw1200_upload_keys(priv);
+        if (!ret && priv->vif->p2p) {
+                pr_debug("[AP] Setting p2p powersave configuration.\n");
+                wsm_set_p2p_ps_modeinfo(priv, &priv->p2p_ps_modeinfo);
+        }
+        if (!ret) {
+                wsm_set_block_ack_policy(priv, 0, 0);
+                priv->join_status = CW1200_JOIN_STATUS_AP;
+                cw1200_update_filtering(priv);
+        }
+        wsm_set_operational_mode(priv, &mode);
+        return ret;
+}
+
+static int cw1200_update_beaconing(struct cw1200_common *priv)
+{
+        struct ieee80211_bss_conf *conf = &priv->vif->bss_conf;
+        struct wsm_reset reset = {
+                .link_id = 0,
+                .reset_statistics = true,
+        };
+
+        if (priv->mode == NL80211_IFTYPE_AP) {
+                /* TODO: check if changed channel, band */
+                if (priv->join_status != CW1200_JOIN_STATUS_AP ||
+                    priv->beacon_int != conf->beacon_int) {
+                        pr_debug("ap restarting\n");
+                        wsm_lock_tx(priv);
+                        if (priv->join_status != CW1200_JOIN_STATUS_PASSIVE)
+                                wsm_reset(priv, &reset);
+                        priv->join_status = CW1200_JOIN_STATUS_PASSIVE;
+                        cw1200_start_ap(priv);
+                        wsm_unlock_tx(priv);
+                } else
+                        pr_debug("ap started join_status: %d\n",
+                                 priv->join_status);
+        }
+        return 0;
+}
diff --git a/drivers/net/wireless/cw1200/sta.h b/drivers/net/wireless/cw1200/sta.h
new file mode 100644
index 000000000000..35babb62cc6a
--- /dev/null
+++ b/drivers/net/wireless/cw1200/sta.h
@@ -0,0 +1,123 @@
+/*
+ * Mac80211 STA interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef STA_H_INCLUDED
+#define STA_H_INCLUDED
+
+/* ******************************************************************** */
+/* mac80211 API                                                         */
+
+int cw1200_start(struct ieee80211_hw *dev);
+void cw1200_stop(struct ieee80211_hw *dev);
+int cw1200_add_interface(struct ieee80211_hw *dev,
+                         struct ieee80211_vif *vif);
+void cw1200_remove_interface(struct ieee80211_hw *dev,
+                             struct ieee80211_vif *vif);
+int cw1200_change_interface(struct ieee80211_hw *dev,
+                            struct ieee80211_vif *vif,
+                            enum nl80211_iftype new_type,
+                            bool p2p);
+int cw1200_config(struct ieee80211_hw *dev, u32 changed);
+void cw1200_configure_filter(struct ieee80211_hw *dev,
+                             unsigned int changed_flags,
+                             unsigned int *total_flags,
+                             u64 multicast);
+int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+                   u16 queue, const struct ieee80211_tx_queue_params *params);
+int cw1200_get_stats(struct ieee80211_hw *dev,
+                     struct ieee80211_low_level_stats *stats);
+int cw1200_set_key(struct ieee80211_hw *dev, enum set_key_cmd cmd,
+                   struct ieee80211_vif *vif, struct ieee80211_sta *sta,
+                   struct ieee80211_key_conf *key);
+
+int cw1200_set_rts_threshold(struct ieee80211_hw *hw, u32 value);
+
+void cw1200_flush(struct ieee80211_hw *hw, u32 queues, bool drop);
+
+u64 cw1200_prepare_multicast(struct ieee80211_hw *hw,
+                             struct netdev_hw_addr_list *mc_list);
+
+int cw1200_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg);
+
+/* ******************************************************************** */
+/* WSM callbacks                                                        */
+
+void cw1200_join_complete_cb(struct cw1200_common *priv,
+                                struct wsm_join_complete *arg);
+
+/* ******************************************************************** */
+/* WSM events                                                           */
+
+void cw1200_free_event_queue(struct cw1200_common *priv);
+void cw1200_event_handler(struct work_struct *work);
+void cw1200_bss_loss_work(struct work_struct *work);
+void cw1200_bss_params_work(struct work_struct *work);
+void cw1200_keep_alive_work(struct work_struct *work);
+void cw1200_tx_failure_work(struct work_struct *work);
+
+void __cw1200_cqm_bssloss_sm(struct cw1200_common *priv, int init, int good,
+                             int bad);
+static inline void cw1200_cqm_bssloss_sm(struct cw1200_common *priv,
+                                         int init, int good, int bad)
+{
+        spin_lock(&priv->bss_loss_lock);
+        __cw1200_cqm_bssloss_sm(priv, init, good, bad);
+        spin_unlock(&priv->bss_loss_lock);
+}
+
+/* ******************************************************************** */
+/* Internal API                                                         */
+
+int cw1200_setup_mac(struct cw1200_common *priv);
+void cw1200_join_timeout(struct work_struct *work);
+void cw1200_unjoin_work(struct work_struct *work);
+void cw1200_join_complete_work(struct work_struct *work);
+void cw1200_wep_key_work(struct work_struct *work);
+void cw1200_update_listening(struct cw1200_common *priv, bool enabled);
+void cw1200_update_filtering(struct cw1200_common *priv);
+void cw1200_update_filtering_work(struct work_struct *work);
+void cw1200_set_beacon_wakeup_period_work(struct work_struct *work);
+int cw1200_enable_listening(struct cw1200_common *priv);
+int cw1200_disable_listening(struct cw1200_common *priv);
+int cw1200_set_uapsd_param(struct cw1200_common *priv,
+                                const struct wsm_edca_params *arg);
+void cw1200_ba_work(struct work_struct *work);
+void cw1200_ba_timer(unsigned long arg);
+
+/* AP stuffs */
+int cw1200_set_tim(struct ieee80211_hw *dev, struct ieee80211_sta *sta,
+                   bool set);
+int cw1200_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                   struct ieee80211_sta *sta);
+int cw1200_sta_remove(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
+                      struct ieee80211_sta *sta);
+void cw1200_sta_notify(struct ieee80211_hw *dev, struct ieee80211_vif *vif,
+                       enum sta_notify_cmd notify_cmd,
+                       struct ieee80211_sta *sta);
+void cw1200_bss_info_changed(struct ieee80211_hw *dev,
+                             struct ieee80211_vif *vif,
+                             struct ieee80211_bss_conf *info,
+                             u32 changed);
+int cw1200_ampdu_action(struct ieee80211_hw *hw,
+                        struct ieee80211_vif *vif,
+                        enum ieee80211_ampdu_mlme_action action,
+                        struct ieee80211_sta *sta, u16 tid, u16 *ssn,
+                        u8 buf_size);
+
+void cw1200_suspend_resume(struct cw1200_common *priv,
+                          struct wsm_suspend_resume *arg);
+void cw1200_set_tim_work(struct work_struct *work);
+void cw1200_set_cts_work(struct work_struct *work);
+void cw1200_multicast_start_work(struct work_struct *work);
+void cw1200_multicast_stop_work(struct work_struct *work);
+void cw1200_mcast_timeout(unsigned long arg);
+
+#endif
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
new file mode 100644
index 000000000000..44ca10cb0d39
--- /dev/null
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -0,0 +1,1474 @@
+/*
+ * Datapath implementation for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <net/mac80211.h>
+#include <linux/etherdevice.h>
+#include <linux/skbuff.h>
+
+#include "cw1200.h"
+#include "wsm.h"
+#include "bh.h"
+#include "sta.h"
+#include "debug.h"
+
+#define CW1200_INVALID_RATE_ID (0xFF)
+
+static int cw1200_handle_action_rx(struct cw1200_common *priv,
+                                   struct sk_buff *skb);
+static const struct ieee80211_rate *
+cw1200_get_tx_rate(const struct cw1200_common *priv,
+                   const struct ieee80211_tx_rate *rate);
+
+/* ******************************************************************** */
+/* TX queue lock / unlock                                               */
+
+static inline void cw1200_tx_queues_lock(struct cw1200_common *priv)
+{
+        int i;
+        for (i = 0; i < 4; ++i)
+                cw1200_queue_lock(&priv->tx_queue[i]);
+}
+
+static inline void cw1200_tx_queues_unlock(struct cw1200_common *priv)
+{
+        int i;
+        for (i = 0; i < 4; ++i)
+                cw1200_queue_unlock(&priv->tx_queue[i]);
+}
+
+/* ******************************************************************** */
+/* TX policy cache implementation                                       */
+
+static void tx_policy_dump(struct tx_policy *policy)
+{
+        pr_debug("[TX policy] %.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X %.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X %.1X%.1X%.1X%.1X%.1X%.1X%.1X%.1X: %d\n",
+                 policy->raw[0] & 0x0F,  policy->raw[0] >> 4,
+                 policy->raw[1] & 0x0F,  policy->raw[1] >> 4,
+                 policy->raw[2] & 0x0F,  policy->raw[2] >> 4,
+                 policy->raw[3] & 0x0F,  policy->raw[3] >> 4,
+                 policy->raw[4] & 0x0F,  policy->raw[4] >> 4,
+                 policy->raw[5] & 0x0F,  policy->raw[5] >> 4,
+                 policy->raw[6] & 0x0F,  policy->raw[6] >> 4,
+                 policy->raw[7] & 0x0F,  policy->raw[7] >> 4,
+                 policy->raw[8] & 0x0F,  policy->raw[8] >> 4,
+                 policy->raw[9] & 0x0F,  policy->raw[9] >> 4,
+                 policy->raw[10] & 0x0F,  policy->raw[10] >> 4,
+                 policy->raw[11] & 0x0F,  policy->raw[11] >> 4,
+                 policy->defined);
+}
+
+static void tx_policy_build(const struct cw1200_common *priv,
+        /* [out] */ struct tx_policy *policy,
+        struct ieee80211_tx_rate *rates, size_t count)
+{
+        int i, j;
+        unsigned limit = priv->short_frame_max_tx_count;
+        unsigned total = 0;
+        BUG_ON(rates[0].idx < 0);
+        memset(policy, 0, sizeof(*policy));
+
+        /* Sort rates in descending order. */
+        for (i = 1; i < count; ++i) {
+                if (rates[i].idx < 0) {
+                        count = i;
+                        break;
+                }
+                if (rates[i].idx > rates[i - 1].idx) {
+                        struct ieee80211_tx_rate tmp = rates[i - 1];
+                        rates[i - 1] = rates[i];
+                        rates[i] = tmp;
+                }
+        }
+
+        /* Eliminate duplicates. */
+        total = rates[0].count;
+        for (i = 0, j = 1; j < count; ++j) {
+                if (rates[j].idx == rates[i].idx) {
+                        rates[i].count += rates[j].count;
+                } else if (rates[j].idx > rates[i].idx) {
+                        break;
+                } else {
+                        ++i;
+                        if (i != j)
+                                rates[i] = rates[j];
+                }
+                total += rates[j].count;
+        }
+        count = i + 1;
+
+        /* Re-fill policy trying to keep every requested rate and with
+         * respect to the global max tx retransmission count.
+         */
+        if (limit < count)
+                limit = count;
+        if (total > limit) {
+                for (i = 0; i < count; ++i) {
+                        int left = count - i - 1;
+                        if (rates[i].count > limit - left)
+                                rates[i].count = limit - left;
+                        limit -= rates[i].count;
+                }
+        }
+
+        /* HACK!!! Device has problems (at least) switching from
+         * 54Mbps CTS to 1Mbps. This switch takes enormous amount
+         * of time (100-200 ms), leading to valuable throughput drop.
+         * As a workaround, additional g-rates are injected to the
+         * policy.
+         */
+        if (count == 2 && !(rates[0].flags & IEEE80211_TX_RC_MCS) &&
+            rates[0].idx > 4 && rates[0].count > 2 &&
+            rates[1].idx < 2) {
+                int mid_rate = (rates[0].idx + 4) >> 1;
+
+                /* Decrease number of retries for the initial rate */
+                rates[0].count -= 2;
+
+                if (mid_rate != 4) {
+                        /* Keep fallback rate at 1Mbps. */
+                        rates[3] = rates[1];
+
+                        /* Inject 1 transmission on lowest g-rate */
+                        rates[2].idx = 4;
+                        rates[2].count = 1;
+                        rates[2].flags = rates[1].flags;
+
+                        /* Inject 1 transmission on mid-rate */
+                        rates[1].idx = mid_rate;
+                        rates[1].count = 1;
+
+                        /* Fallback to 1 Mbps is a really bad thing,
+                         * so let's try to increase probability of
+                         * successful transmission on the lowest g rate
+                         * even more
+                         */
+                        if (rates[0].count >= 3) {
+                                --rates[0].count;
+                                ++rates[2].count;
+                        }
+
+                        /* Adjust amount of rates defined */
+                        count += 2;
+                } else {
+                        /* Keep fallback rate at 1Mbps. */
+                        rates[2] = rates[1];
+
+                        /* Inject 2 transmissions on lowest g-rate */
+                        rates[1].idx = 4;
+                        rates[1].count = 2;
+
+                        /* Adjust amount of rates defined */
+                        count += 1;
+                }
+        }
+
+        policy->defined = cw1200_get_tx_rate(priv, &rates[0])->hw_value + 1;
+
+        for (i = 0; i < count; ++i) {
+                register unsigned rateid, off, shift, retries;
+
+                rateid = cw1200_get_tx_rate(priv, &rates[i])->hw_value;
+                off = rateid >> 3;              /* eq. rateid / 8 */
+                shift = (rateid & 0x07) << 2;   /* eq. (rateid % 8) * 4 */
+
+                retries = rates[i].count;
+                if (retries > 0x0F) {
+                        rates[i].count = 0x0f;
+                        retries = 0x0F;
+                }
+                policy->tbl[off] |= __cpu_to_le32(retries << shift);
+                policy->retry_count += retries;
+        }
+
+        pr_debug("[TX policy] Policy (%zu): %d:%d, %d:%d, %d:%d, %d:%d\n",
+                 count,
+                 rates[0].idx, rates[0].count,
+                 rates[1].idx, rates[1].count,
+                 rates[2].idx, rates[2].count,
+                 rates[3].idx, rates[3].count);
+}
+
+static inline bool tx_policy_is_equal(const struct tx_policy *wanted,
+                                        const struct tx_policy *cached)
+{
+        size_t count = wanted->defined >> 1;
+        if (wanted->defined > cached->defined)
+                return false;
+        if (count) {
+                if (memcmp(wanted->raw, cached->raw, count))
+                        return false;
+        }
+        if (wanted->defined & 1) {
+                if ((wanted->raw[count] & 0x0F) != (cached->raw[count] & 0x0F))
+                        return false;
+        }
+        return true;
+}
+
+static int tx_policy_find(struct tx_policy_cache *cache,
+                                const struct tx_policy *wanted)
+{
+        /* O(n) complexity. Not so good, but there's only 8 entries in
+         * the cache.
+         * Also lru helps to reduce search time.
+         */
+        struct tx_policy_cache_entry *it;
+        /* First search for policy in "used" list */
+        list_for_each_entry(it, &cache->used, link) {
+                if (tx_policy_is_equal(wanted, &it->policy))
+                        return it - cache->cache;
+        }
+        /* Then - in "free list" */
+        list_for_each_entry(it, &cache->free, link) {
+                if (tx_policy_is_equal(wanted, &it->policy))
+                        return it - cache->cache;
+        }
+        return -1;
+}
+
+static inline void tx_policy_use(struct tx_policy_cache *cache,
+                                 struct tx_policy_cache_entry *entry)
+{
+        ++entry->policy.usage_count;
+        list_move(&entry->link, &cache->used);
+}
+
+static inline int tx_policy_release(struct tx_policy_cache *cache,
+                                    struct tx_policy_cache_entry *entry)
+{
+        int ret = --entry->policy.usage_count;
+        if (!ret)
+                list_move(&entry->link, &cache->free);
+        return ret;
+}
+
+void tx_policy_clean(struct cw1200_common *priv)
+{
+        int idx, locked;
+        struct tx_policy_cache *cache = &priv->tx_policy_cache;
+        struct tx_policy_cache_entry *entry;
+
+        cw1200_tx_queues_lock(priv);
+        spin_lock_bh(&cache->lock);
+        locked = list_empty(&cache->free);
+
+        for (idx = 0; idx < TX_POLICY_CACHE_SIZE; idx++) {
+                entry = &cache->cache[idx];
+                /* Policy usage count should be 0 at this time as all queues
+                   should be empty
+                 */
+                if (WARN_ON(entry->policy.usage_count)) {
+                        entry->policy.usage_count = 0;
+                        list_move(&entry->link, &cache->free);
+                }
+                memset(&entry->policy, 0, sizeof(entry->policy));
+        }
+        if (locked)
+                cw1200_tx_queues_unlock(priv);
+
+        cw1200_tx_queues_unlock(priv);
+        spin_unlock_bh(&cache->lock);
+}
+
+/* ******************************************************************** */
+/* External TX policy cache API                                         */
+
+void tx_policy_init(struct cw1200_common *priv)
+{
+        struct tx_policy_cache *cache = &priv->tx_policy_cache;
+        int i;
+
+        memset(cache, 0, sizeof(*cache));
+
+        spin_lock_init(&cache->lock);
+        INIT_LIST_HEAD(&cache->used);
+        INIT_LIST_HEAD(&cache->free);
+
+        for (i = 0; i < TX_POLICY_CACHE_SIZE; ++i)
+                list_add(&cache->cache[i].link, &cache->free);
+}
+
+static int tx_policy_get(struct cw1200_common *priv,
+                  struct ieee80211_tx_rate *rates,
+                  size_t count, bool *renew)
+{
+        int idx;
+        struct tx_policy_cache *cache = &priv->tx_policy_cache;
+        struct tx_policy wanted;
+
+        tx_policy_build(priv, &wanted, rates, count);
+
+        spin_lock_bh(&cache->lock);
+        if (WARN_ON_ONCE(list_empty(&cache->free))) {
+                spin_unlock_bh(&cache->lock);
+                return CW1200_INVALID_RATE_ID;
+        }
+        idx = tx_policy_find(cache, &wanted);
+        if (idx >= 0) {
+                pr_debug("[TX policy] Used TX policy: %d\n", idx);
+                *renew = false;
+        } else {
+                struct tx_policy_cache_entry *entry;
+                *renew = true;
+                /* If policy is not found create a new one
+                 * using the oldest entry in "free" list
+                 */
+                entry = list_entry(cache->free.prev,
+                        struct tx_policy_cache_entry, link);
+                entry->policy = wanted;
+                idx = entry - cache->cache;
+                pr_debug("[TX policy] New TX policy: %d\n", idx);
+                tx_policy_dump(&entry->policy);
+        }
+        tx_policy_use(cache, &cache->cache[idx]);
+        if (list_empty(&cache->free)) {
+                /* Lock TX queues. */
+                cw1200_tx_queues_lock(priv);
+        }
+        spin_unlock_bh(&cache->lock);
+        return idx;
+}
+
+static void tx_policy_put(struct cw1200_common *priv, int idx)
+{
+        int usage, locked;
+        struct tx_policy_cache *cache = &priv->tx_policy_cache;
+
+        spin_lock_bh(&cache->lock);
+        locked = list_empty(&cache->free);
+        usage = tx_policy_release(cache, &cache->cache[idx]);
+        if (locked && !usage) {
+                /* Unlock TX queues. */
+                cw1200_tx_queues_unlock(priv);
+        }
+        spin_unlock_bh(&cache->lock);
+}
+
+static int tx_policy_upload(struct cw1200_common *priv)
+{
+        struct tx_policy_cache *cache = &priv->tx_policy_cache;
+        int i;
+        struct wsm_set_tx_rate_retry_policy arg = {
+                .num = 0,
+        };
+        spin_lock_bh(&cache->lock);
+
+        /* Upload only modified entries. */
+        for (i = 0; i < TX_POLICY_CACHE_SIZE; ++i) {
+                struct tx_policy *src = &cache->cache[i].policy;
+                if (src->retry_count && !src->uploaded) {
+                        struct wsm_tx_rate_retry_policy *dst =
+                                &arg.tbl[arg.num];
+                        dst->index = i;
+                        dst->short_retries = priv->short_frame_max_tx_count;
+                        dst->long_retries = priv->long_frame_max_tx_count;
+
+                        dst->flags = WSM_TX_RATE_POLICY_FLAG_TERMINATE_WHEN_FINISHED |
+                                WSM_TX_RATE_POLICY_FLAG_COUNT_INITIAL_TRANSMIT;
+                        memcpy(dst->rate_count_indices, src->tbl,
+                               sizeof(dst->rate_count_indices));
+                        src->uploaded = 1;
+                        ++arg.num;
+                }
+        }
+        spin_unlock_bh(&cache->lock);
+        cw1200_debug_tx_cache_miss(priv);
+        pr_debug("[TX policy] Upload %d policies\n", arg.num);
+        return wsm_set_tx_rate_retry_policy(priv, &arg);
+}
+
+void tx_policy_upload_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, tx_policy_upload_work);
+
+        pr_debug("[TX] TX policy upload.\n");
+        tx_policy_upload(priv);
+
+        wsm_unlock_tx(priv);
+        cw1200_tx_queues_unlock(priv);
+}
+
+/* ******************************************************************** */
+/* cw1200 TX implementation                                             */
+
+struct cw1200_txinfo {
+        struct sk_buff *skb;
+        unsigned queue;
+        struct ieee80211_tx_info *tx_info;
+        const struct ieee80211_rate *rate;
+        struct ieee80211_hdr *hdr;
+        size_t hdrlen;
+        const u8 *da;
+        struct cw1200_sta_priv *sta_priv;
+        struct ieee80211_sta *sta;
+        struct cw1200_txpriv txpriv;
+};
+
+u32 cw1200_rate_mask_to_wsm(struct cw1200_common *priv, u32 rates)
+{
+        u32 ret = 0;
+        int i;
+        for (i = 0; i < 32; ++i) {
+                if (rates & BIT(i))
+                        ret |= BIT(priv->rates[i].hw_value);
+        }
+        return ret;
+}
+
+static const struct ieee80211_rate *
+cw1200_get_tx_rate(const struct cw1200_common *priv,
+                   const struct ieee80211_tx_rate *rate)
+{
+        if (rate->idx < 0)
+                return NULL;
+        if (rate->flags & IEEE80211_TX_RC_MCS)
+                return &priv->mcs_rates[rate->idx];
+        return &priv->hw->wiphy->bands[priv->channel->band]->
+                bitrates[rate->idx];
+}
+
+static int
+cw1200_tx_h_calc_link_ids(struct cw1200_common *priv,
+                          struct cw1200_txinfo *t)
+{
+        if (t->sta && t->sta_priv->link_id)
+                t->txpriv.raw_link_id =
+                                t->txpriv.link_id =
+                                t->sta_priv->link_id;
+        else if (priv->mode != NL80211_IFTYPE_AP)
+                t->txpriv.raw_link_id =
+                                t->txpriv.link_id = 0;
+        else if (is_multicast_ether_addr(t->da)) {
+                if (priv->enable_beacon) {
+                        t->txpriv.raw_link_id = 0;
+                        t->txpriv.link_id = CW1200_LINK_ID_AFTER_DTIM;
+                } else {
+                        t->txpriv.raw_link_id = 0;
+                        t->txpriv.link_id = 0;
+                }
+        } else {
+                t->txpriv.link_id = cw1200_find_link_id(priv, t->da);
+                if (!t->txpriv.link_id)
+                        t->txpriv.link_id = cw1200_alloc_link_id(priv, t->da);
+                if (!t->txpriv.link_id) {
+                        wiphy_err(priv->hw->wiphy,
+                                  "No more link IDs available.\n");
+                        return -ENOENT;
+                }
+                t->txpriv.raw_link_id = t->txpriv.link_id;
+        }
+        if (t->txpriv.raw_link_id)
+                priv->link_id_db[t->txpriv.raw_link_id - 1].timestamp =
+                                jiffies;
+        if (t->sta && (t->sta->uapsd_queues & BIT(t->queue)))
+                t->txpriv.link_id = CW1200_LINK_ID_UAPSD;
+        return 0;
+}
+
+static void
+cw1200_tx_h_pm(struct cw1200_common *priv,
+               struct cw1200_txinfo *t)
+{
+        if (ieee80211_is_auth(t->hdr->frame_control)) {
+                u32 mask = ~BIT(t->txpriv.raw_link_id);
+                spin_lock_bh(&priv->ps_state_lock);
+                priv->sta_asleep_mask &= mask;
+                priv->pspoll_mask &= mask;
+                spin_unlock_bh(&priv->ps_state_lock);
+        }
+}
+
+static void
+cw1200_tx_h_calc_tid(struct cw1200_common *priv,
+                     struct cw1200_txinfo *t)
+{
+        if (ieee80211_is_data_qos(t->hdr->frame_control)) {
+                u8 *qos = ieee80211_get_qos_ctl(t->hdr);
+                t->txpriv.tid = qos[0] & IEEE80211_QOS_CTL_TID_MASK;
+        } else if (ieee80211_is_data(t->hdr->frame_control)) {
+                t->txpriv.tid = 0;
+        }
+}
+
+static int
+cw1200_tx_h_crypt(struct cw1200_common *priv,
+                  struct cw1200_txinfo *t)
+{
+        if (!t->tx_info->control.hw_key ||
+            !ieee80211_has_protected(t->hdr->frame_control))
+                return 0;
+
+        t->hdrlen += t->tx_info->control.hw_key->iv_len;
+        skb_put(t->skb, t->tx_info->control.hw_key->icv_len);
+
+        if (t->tx_info->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                skb_put(t->skb, 8); /* MIC space */
+
+        return 0;
+}
+
+static int
+cw1200_tx_h_align(struct cw1200_common *priv,
+                  struct cw1200_txinfo *t,
+                  u8 *flags)
+{
+        size_t offset = (size_t)t->skb->data & 3;
+
+        if (!offset)
+                return 0;
+
+        if (offset & 1) {
+                wiphy_err(priv->hw->wiphy,
+                          "Bug: attempt to transmit a frame with wrong alignment: %zu\n",
+                          offset);
+                return -EINVAL;
+        }
+
+        if (skb_headroom(t->skb) < offset) {
+                wiphy_err(priv->hw->wiphy,
+                          "Bug: no space allocated for DMA alignment. headroom: %d\n",
+                          skb_headroom(t->skb));
+                return -ENOMEM;
+        }
+        skb_push(t->skb, offset);
+        t->hdrlen += offset;
+        t->txpriv.offset += offset;
+        *flags |= WSM_TX_2BYTES_SHIFT;
+        cw1200_debug_tx_align(priv);
+        return 0;
+}
+
+static int
+cw1200_tx_h_action(struct cw1200_common *priv,
+                   struct cw1200_txinfo *t)
+{
+        struct ieee80211_mgmt *mgmt =
+                (struct ieee80211_mgmt *)t->hdr;
+        if (ieee80211_is_action(t->hdr->frame_control) &&
+            mgmt->u.action.category == WLAN_CATEGORY_BACK)
+                return 1;
+        else
+                return 0;
+}
+
+/* Add WSM header */
+static struct wsm_tx *
+cw1200_tx_h_wsm(struct cw1200_common *priv,
+                struct cw1200_txinfo *t)
+{
+        struct wsm_tx *wsm;
+
+        if (skb_headroom(t->skb) < sizeof(struct wsm_tx)) {
+                wiphy_err(priv->hw->wiphy,
+                          "Bug: no space allocated for WSM header. headroom: %d\n",
+                          skb_headroom(t->skb));
+                return NULL;
+        }
+
+        wsm = (struct wsm_tx *)skb_push(t->skb, sizeof(struct wsm_tx));
+        t->txpriv.offset += sizeof(struct wsm_tx);
+        memset(wsm, 0, sizeof(*wsm));
+        wsm->hdr.len = __cpu_to_le16(t->skb->len);
+        wsm->hdr.id = __cpu_to_le16(0x0004);
+        wsm->queue_id = wsm_queue_id_to_wsm(t->queue);
+        return wsm;
+}
+
+/* BT Coex specific handling */
+static void
+cw1200_tx_h_bt(struct cw1200_common *priv,
+               struct cw1200_txinfo *t,
+               struct wsm_tx *wsm)
+{
+        u8 priority = 0;
+
+        if (!priv->bt_present)
+                return;
+
+        if (ieee80211_is_nullfunc(t->hdr->frame_control)) {
+                priority = WSM_EPTA_PRIORITY_MGT;
+        } else if (ieee80211_is_data(t->hdr->frame_control)) {
+                /* Skip LLC SNAP header (+6) */
+                u8 *payload = &t->skb->data[t->hdrlen];
+                u16 *ethertype = (u16 *)&payload[6];
+                if (*ethertype == __be16_to_cpu(ETH_P_PAE))
+                        priority = WSM_EPTA_PRIORITY_EAPOL;
+        } else if (ieee80211_is_assoc_req(t->hdr->frame_control) ||
+                ieee80211_is_reassoc_req(t->hdr->frame_control)) {
+                struct ieee80211_mgmt *mgt_frame =
+                                (struct ieee80211_mgmt *)t->hdr;
+
+                if (mgt_frame->u.assoc_req.listen_interval <
+                                                priv->listen_interval) {
+                        pr_debug("Modified Listen Interval to %d from %d\n",
+                                 priv->listen_interval,
+                                 mgt_frame->u.assoc_req.listen_interval);
+                        /* Replace listen interval derieved from
+                         * the one read from SDD
+                         */
+                        mgt_frame->u.assoc_req.listen_interval =
+                                priv->listen_interval;
+                }
+        }
+
+        if (!priority) {
+                if (ieee80211_is_action(t->hdr->frame_control))
+                        priority = WSM_EPTA_PRIORITY_ACTION;
+                else if (ieee80211_is_mgmt(t->hdr->frame_control))
+                        priority = WSM_EPTA_PRIORITY_MGT;
+                else if ((wsm->queue_id == WSM_QUEUE_VOICE))
+                        priority = WSM_EPTA_PRIORITY_VOICE;
+                else if ((wsm->queue_id == WSM_QUEUE_VIDEO))
+                        priority = WSM_EPTA_PRIORITY_VIDEO;
+                else
+                        priority = WSM_EPTA_PRIORITY_DATA;
+        }
+
+        pr_debug("[TX] EPTA priority %d.\n", priority);
+
+        wsm->flags |= priority << 1;
+}
+
+static int
+cw1200_tx_h_rate_policy(struct cw1200_common *priv,
+                        struct cw1200_txinfo *t,
+                        struct wsm_tx *wsm)
+{
+        bool tx_policy_renew = false;
+
+        t->txpriv.rate_id = tx_policy_get(priv,
+                t->tx_info->control.rates, IEEE80211_TX_MAX_RATES,
+                &tx_policy_renew);
+        if (t->txpriv.rate_id == CW1200_INVALID_RATE_ID)
+                return -EFAULT;
+
+        wsm->flags |= t->txpriv.rate_id << 4;
+
+        t->rate = cw1200_get_tx_rate(priv,
+                &t->tx_info->control.rates[0]),
+        wsm->max_tx_rate = t->rate->hw_value;
+        if (t->rate->flags & IEEE80211_TX_RC_MCS) {
+                if (cw1200_ht_greenfield(&priv->ht_info))
+                        wsm->ht_tx_parameters |=
+                                __cpu_to_le32(WSM_HT_TX_GREENFIELD);
+                else
+                        wsm->ht_tx_parameters |=
+                                __cpu_to_le32(WSM_HT_TX_MIXED);
+        }
+
+        if (tx_policy_renew) {
+                pr_debug("[TX] TX policy renew.\n");
+                /* It's not so optimal to stop TX queues every now and then.
+                 * Better to reimplement task scheduling with
+                 * a counter. TODO.
+                 */
+                wsm_lock_tx_async(priv);
+                cw1200_tx_queues_lock(priv);
+                if (queue_work(priv->workqueue,
+                               &priv->tx_policy_upload_work) <= 0) {
+                        cw1200_tx_queues_unlock(priv);
+                        wsm_unlock_tx(priv);
+                }
+        }
+        return 0;
+}
+
+static bool
+cw1200_tx_h_pm_state(struct cw1200_common *priv,
+                     struct cw1200_txinfo *t)
+{
+        int was_buffered = 1;
+
+        if (t->txpriv.link_id == CW1200_LINK_ID_AFTER_DTIM &&
+            !priv->buffered_multicasts) {
+                priv->buffered_multicasts = true;
+                if (priv->sta_asleep_mask)
+                        queue_work(priv->workqueue,
+                                   &priv->multicast_start_work);
+        }
+
+        if (t->txpriv.raw_link_id && t->txpriv.tid < CW1200_MAX_TID)
+                was_buffered = priv->link_id_db[t->txpriv.raw_link_id - 1].buffered[t->txpriv.tid]++;
+
+        return !was_buffered;
+}
+
+/* ******************************************************************** */
+
+void cw1200_tx(struct ieee80211_hw *dev,
+               struct ieee80211_tx_control *control,
+               struct sk_buff *skb)
+{
+        struct cw1200_common *priv = dev->priv;
+        struct cw1200_txinfo t = {
+                .skb = skb,
+                .queue = skb_get_queue_mapping(skb),
+                .tx_info = IEEE80211_SKB_CB(skb),
+                .hdr = (struct ieee80211_hdr *)skb->data,
+                .txpriv.tid = CW1200_MAX_TID,
+                .txpriv.rate_id = CW1200_INVALID_RATE_ID,
+        };
+        struct ieee80211_sta *sta;
+        struct wsm_tx *wsm;
+        bool tid_update = 0;
+        u8 flags = 0;
+        int ret;
+
+        if (priv->bh_error)
+                goto drop;
+
+        t.hdrlen = ieee80211_hdrlen(t.hdr->frame_control);
+        t.da = ieee80211_get_DA(t.hdr);
+        if (control) {
+                t.sta = control->sta;
+                t.sta_priv = (struct cw1200_sta_priv *)&t.sta->drv_priv;
+        }
+
+        if (WARN_ON(t.queue >= 4))
+                goto drop;
+
+        ret = cw1200_tx_h_calc_link_ids(priv, &t);
+        if (ret)
+                goto drop;
+
+        pr_debug("[TX] TX %d bytes (queue: %d, link_id: %d (%d)).\n",
+                 skb->len, t.queue, t.txpriv.link_id,
+                 t.txpriv.raw_link_id);
+
+        cw1200_tx_h_pm(priv, &t);
+        cw1200_tx_h_calc_tid(priv, &t);
+        ret = cw1200_tx_h_crypt(priv, &t);
+        if (ret)
+                goto drop;
+        ret = cw1200_tx_h_align(priv, &t, &flags);
+        if (ret)
+                goto drop;
+        ret = cw1200_tx_h_action(priv, &t);
+        if (ret)
+                goto drop;
+        wsm = cw1200_tx_h_wsm(priv, &t);
+        if (!wsm) {
+                ret = -ENOMEM;
+                goto drop;
+        }
+        wsm->flags |= flags;
+        cw1200_tx_h_bt(priv, &t, wsm);
+        ret = cw1200_tx_h_rate_policy(priv, &t, wsm);
+        if (ret)
+                goto drop;
+
+        rcu_read_lock();
+        sta = rcu_dereference(t.sta);
+
+        spin_lock_bh(&priv->ps_state_lock);
+        {
+                tid_update = cw1200_tx_h_pm_state(priv, &t);
+                BUG_ON(cw1200_queue_put(&priv->tx_queue[t.queue],
+                                        t.skb, &t.txpriv));
+        }
+        spin_unlock_bh(&priv->ps_state_lock);
+
+        if (tid_update && sta)
+                ieee80211_sta_set_buffered(sta, t.txpriv.tid, true);
+
+        rcu_read_unlock();
+
+        cw1200_bh_wakeup(priv);
+
+        return;
+
+drop:
+        cw1200_skb_dtor(priv, skb, &t.txpriv);
+        return;
+}
+
+/* ******************************************************************** */
+
+static int cw1200_handle_action_rx(struct cw1200_common *priv,
+                                   struct sk_buff *skb)
+{
+        struct ieee80211_mgmt *mgmt = (void *)skb->data;
+
+        /* Filter block ACK negotiation: fully controlled by firmware */
+        if (mgmt->u.action.category == WLAN_CATEGORY_BACK)
+                return 1;
+
+        return 0;
+}
+
+static int cw1200_handle_pspoll(struct cw1200_common *priv,
+                                struct sk_buff *skb)
+{
+        struct ieee80211_sta *sta;
+        struct ieee80211_pspoll *pspoll = (struct ieee80211_pspoll *)skb->data;
+        int link_id = 0;
+        u32 pspoll_mask = 0;
+        int drop = 1;
+        int i;
+
+        if (priv->join_status != CW1200_JOIN_STATUS_AP)
+                goto done;
+        if (memcmp(priv->vif->addr, pspoll->bssid, ETH_ALEN))
+                goto done;
+
+        rcu_read_lock();
+        sta = ieee80211_find_sta(priv->vif, pspoll->ta);
+        if (sta) {
+                struct cw1200_sta_priv *sta_priv;
+                sta_priv = (struct cw1200_sta_priv *)&sta->drv_priv;
+                link_id = sta_priv->link_id;
+                pspoll_mask = BIT(sta_priv->link_id);
+        }
+        rcu_read_unlock();
+        if (!link_id)
+                goto done;
+
+        priv->pspoll_mask |= pspoll_mask;
+        drop = 0;
+
+        /* Do not report pspols if data for given link id is queued already. */
+        for (i = 0; i < 4; ++i) {
+                if (cw1200_queue_get_num_queued(&priv->tx_queue[i],
+                                                pspoll_mask)) {
+                        cw1200_bh_wakeup(priv);
+                        drop = 1;
+                        break;
+                }
+        }
+        pr_debug("[RX] PSPOLL: %s\n", drop ? "local" : "fwd");
+done:
+        return drop;
+}
+
+/* ******************************************************************** */
+
+void cw1200_tx_confirm_cb(struct cw1200_common *priv,
+                          int link_id,
+                          struct wsm_tx_confirm *arg)
+{
+        u8 queue_id = cw1200_queue_get_queue_id(arg->packet_id);
+        struct cw1200_queue *queue = &priv->tx_queue[queue_id];
+        struct sk_buff *skb;
+        const struct cw1200_txpriv *txpriv;
+
+        pr_debug("[TX] TX confirm: %d, %d.\n",
+                 arg->status, arg->ack_failures);
+
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED) {
+                /* STA is stopped. */
+                return;
+        }
+
+        if (WARN_ON(queue_id >= 4))
+                return;
+
+        if (arg->status)
+                pr_debug("TX failed: %d.\n", arg->status);
+
+        if ((arg->status == WSM_REQUEUE) &&
+            (arg->flags & WSM_TX_STATUS_REQUEUE)) {
+                /* "Requeue" means "implicit suspend" */
+                struct wsm_suspend_resume suspend = {
+                        .link_id = link_id,
+                        .stop = 1,
+                        .multicast = !link_id,
+                };
+                cw1200_suspend_resume(priv, &suspend);
+                wiphy_warn(priv->hw->wiphy, "Requeue for link_id %d (try %d). STAs asleep: 0x%.8X\n",
+                           link_id,
+                           cw1200_queue_get_generation(arg->packet_id) + 1,
+                           priv->sta_asleep_mask);
+                cw1200_queue_requeue(queue, arg->packet_id);
+                spin_lock_bh(&priv->ps_state_lock);
+                if (!link_id) {
+                        priv->buffered_multicasts = true;
+                        if (priv->sta_asleep_mask) {
+                                queue_work(priv->workqueue,
+                                           &priv->multicast_start_work);
+                        }
+                }
+                spin_unlock_bh(&priv->ps_state_lock);
+        } else if (!cw1200_queue_get_skb(queue, arg->packet_id,
+                                         &skb, &txpriv)) {
+                struct ieee80211_tx_info *tx = IEEE80211_SKB_CB(skb);
+                int tx_count = arg->ack_failures;
+                u8 ht_flags = 0;
+                int i;
+
+                if (cw1200_ht_greenfield(&priv->ht_info))
+                        ht_flags |= IEEE80211_TX_RC_GREEN_FIELD;
+
+                spin_lock(&priv->bss_loss_lock);
+                if (priv->bss_loss_state &&
+                    arg->packet_id == priv->bss_loss_confirm_id) {
+                        if (arg->status) {
+                                /* Recovery failed */
+                                __cw1200_cqm_bssloss_sm(priv, 0, 0, 1);
+                        } else {
+                                /* Recovery succeeded */
+                                __cw1200_cqm_bssloss_sm(priv, 0, 1, 0);
+                        }
+                }
+                spin_unlock(&priv->bss_loss_lock);
+
+                if (!arg->status) {
+                        tx->flags |= IEEE80211_TX_STAT_ACK;
+                        ++tx_count;
+                        cw1200_debug_txed(priv);
+                        if (arg->flags & WSM_TX_STATUS_AGGREGATION) {
+                                /* Do not report aggregation to mac80211:
+                                 * it confuses minstrel a lot.
+                                 */
+                                /* tx->flags |= IEEE80211_TX_STAT_AMPDU; */
+                                cw1200_debug_txed_agg(priv);
+                        }
+                } else {
+                        if (tx_count)
+                                ++tx_count;
+                }
+
+                for (i = 0; i < IEEE80211_TX_MAX_RATES; ++i) {
+                        if (tx->status.rates[i].count >= tx_count) {
+                                tx->status.rates[i].count = tx_count;
+                                break;
+                        }
+                        tx_count -= tx->status.rates[i].count;
+                        if (tx->status.rates[i].flags & IEEE80211_TX_RC_MCS)
+                                tx->status.rates[i].flags |= ht_flags;
+                }
+
+                for (++i; i < IEEE80211_TX_MAX_RATES; ++i) {
+                        tx->status.rates[i].count = 0;
+                        tx->status.rates[i].idx = -1;
+                }
+
+                /* Pull off any crypto trailers that we added on */
+                if (tx->control.hw_key) {
+                        skb_trim(skb, skb->len - tx->control.hw_key->icv_len);
+                        if (tx->control.hw_key->cipher == WLAN_CIPHER_SUITE_TKIP)
+                                skb_trim(skb, skb->len - 8); /* MIC space */
+                }
+                cw1200_queue_remove(queue, arg->packet_id);
+        }
+        /* XXX TODO:  Only wake if there are pending transmits.. */
+        cw1200_bh_wakeup(priv);
+}
+
+static void cw1200_notify_buffered_tx(struct cw1200_common *priv,
+                               struct sk_buff *skb, int link_id, int tid)
+{
+        struct ieee80211_sta *sta;
+        struct ieee80211_hdr *hdr;
+        u8 *buffered;
+        u8 still_buffered = 0;
+
+        if (link_id && tid < CW1200_MAX_TID) {
+                buffered = priv->link_id_db
+                                [link_id - 1].buffered;
+
+                spin_lock_bh(&priv->ps_state_lock);
+                if (!WARN_ON(!buffered[tid]))
+                        still_buffered = --buffered[tid];
+                spin_unlock_bh(&priv->ps_state_lock);
+
+                if (!still_buffered && tid < CW1200_MAX_TID) {
+                        hdr = (struct ieee80211_hdr *)skb->data;
+                        rcu_read_lock();
+                        sta = ieee80211_find_sta(priv->vif, hdr->addr1);
+                        if (sta)
+                                ieee80211_sta_set_buffered(sta, tid, false);
+                        rcu_read_unlock();
+                }
+        }
+}
+
+void cw1200_skb_dtor(struct cw1200_common *priv,
+                     struct sk_buff *skb,
+                     const struct cw1200_txpriv *txpriv)
+{
+        skb_pull(skb, txpriv->offset);
+        if (txpriv->rate_id != CW1200_INVALID_RATE_ID) {
+                cw1200_notify_buffered_tx(priv, skb,
+                                          txpriv->raw_link_id, txpriv->tid);
+                tx_policy_put(priv, txpriv->rate_id);
+        }
+        ieee80211_tx_status(priv->hw, skb);
+}
+
+void cw1200_rx_cb(struct cw1200_common *priv,
+                  struct wsm_rx *arg,
+                  int link_id,
+                  struct sk_buff **skb_p)
+{
+        struct sk_buff *skb = *skb_p;
+        struct ieee80211_rx_status *hdr = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_hdr *frame = (struct ieee80211_hdr *)skb->data;
+        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
+        struct cw1200_link_entry *entry = NULL;
+        unsigned long grace_period;
+
+        bool early_data = false;
+        bool p2p = priv->vif && priv->vif->p2p;
+        size_t hdrlen;
+        hdr->flag = 0;
+
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED) {
+                /* STA is stopped. */
+                goto drop;
+        }
+
+        if (link_id && link_id <= CW1200_MAX_STA_IN_AP_MODE) {
+                entry = &priv->link_id_db[link_id - 1];
+                if (entry->status == CW1200_LINK_SOFT &&
+                    ieee80211_is_data(frame->frame_control))
+                        early_data = true;
+                entry->timestamp = jiffies;
+        } else if (p2p &&
+                   ieee80211_is_action(frame->frame_control) &&
+                   (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)) {
+                pr_debug("[RX] Going to MAP&RESET link ID\n");
+                WARN_ON(work_pending(&priv->linkid_reset_work));
+                memcpy(&priv->action_frame_sa[0],
+                       ieee80211_get_SA(frame), ETH_ALEN);
+                priv->action_linkid = 0;
+                schedule_work(&priv->linkid_reset_work);
+        }
+
+        if (link_id && p2p &&
+            ieee80211_is_action(frame->frame_control) &&
+            (mgmt->u.action.category == WLAN_CATEGORY_PUBLIC)) {
+                /* Link ID already exists for the ACTION frame.
+                 * Reset and Remap
+                 */
+                WARN_ON(work_pending(&priv->linkid_reset_work));
+                memcpy(&priv->action_frame_sa[0],
+                       ieee80211_get_SA(frame), ETH_ALEN);
+                priv->action_linkid = link_id;
+                schedule_work(&priv->linkid_reset_work);
+        }
+        if (arg->status) {
+                if (arg->status == WSM_STATUS_MICFAILURE) {
+                        pr_debug("[RX] MIC failure.\n");
+                        hdr->flag |= RX_FLAG_MMIC_ERROR;
+                } else if (arg->status == WSM_STATUS_NO_KEY_FOUND) {
+                        pr_debug("[RX] No key found.\n");
+                        goto drop;
+                } else {
+                        pr_debug("[RX] Receive failure: %d.\n",
+                                 arg->status);
+                        goto drop;
+                }
+        }
+
+        if (skb->len < sizeof(struct ieee80211_pspoll)) {
+                wiphy_warn(priv->hw->wiphy, "Mailformed SDU rx'ed. Size is lesser than IEEE header.\n");
+                goto drop;
+        }
+
+        if (ieee80211_is_pspoll(frame->frame_control))
+                if (cw1200_handle_pspoll(priv, skb))
+                        goto drop;
+
+        hdr->band = ((arg->channel_number & 0xff00) ||
+                     (arg->channel_number > 14)) ?
+                        IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ;
+        hdr->freq = ieee80211_channel_to_frequency(
+                        arg->channel_number,
+                        hdr->band);
+
+        if (arg->rx_rate >= 14) {
+                hdr->flag |= RX_FLAG_HT;
+                hdr->rate_idx = arg->rx_rate - 14;
+        } else if (arg->rx_rate >= 4) {
+                hdr->rate_idx = arg->rx_rate - 2;
+        } else {
+                hdr->rate_idx = arg->rx_rate;
+        }
+
+        hdr->signal = (s8)arg->rcpi_rssi;
+        hdr->antenna = 0;
+
+        hdrlen = ieee80211_hdrlen(frame->frame_control);
+
+        if (WSM_RX_STATUS_ENCRYPTION(arg->flags)) {
+                size_t iv_len = 0, icv_len = 0;
+
+                hdr->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED;
+
+                /* Oops... There is no fast way to ask mac80211 about
+                 * IV/ICV lengths. Even defineas are not exposed.
+                 */
+                switch (WSM_RX_STATUS_ENCRYPTION(arg->flags)) {
+                case WSM_RX_STATUS_WEP:
+                        iv_len = 4 /* WEP_IV_LEN */;
+                        icv_len = 4 /* WEP_ICV_LEN */;
+                        break;
+                case WSM_RX_STATUS_TKIP:
+                        iv_len = 8 /* TKIP_IV_LEN */;
+                        icv_len = 4 /* TKIP_ICV_LEN */
+                                + 8 /*MICHAEL_MIC_LEN*/;
+                        hdr->flag |= RX_FLAG_MMIC_STRIPPED;
+                        break;
+                case WSM_RX_STATUS_AES:
+                        iv_len = 8 /* CCMP_HDR_LEN */;
+                        icv_len = 8 /* CCMP_MIC_LEN */;
+                        break;
+                case WSM_RX_STATUS_WAPI:
+                        iv_len = 18 /* WAPI_HDR_LEN */;
+                        icv_len = 16 /* WAPI_MIC_LEN */;
+                        break;
+                default:
+                        pr_warn("Unknown encryption type %d\n",
+                                WSM_RX_STATUS_ENCRYPTION(arg->flags));
+                        goto drop;
+                }
+
+                /* Firmware strips ICV in case of MIC failure. */
+                if (arg->status == WSM_STATUS_MICFAILURE)
+                        icv_len = 0;
+
+                if (skb->len < hdrlen + iv_len + icv_len) {
+                        wiphy_warn(priv->hw->wiphy, "Malformed SDU rx'ed. Size is lesser than crypto headers.\n");
+                        goto drop;
+                }
+
+                /* Remove IV, ICV and MIC */
+                skb_trim(skb, skb->len - icv_len);
+                memmove(skb->data + iv_len, skb->data, hdrlen);
+                skb_pull(skb, iv_len);
+        }
+
+        /* Remove TSF from the end of frame */
+        if (arg->flags & WSM_RX_STATUS_TSF_INCLUDED) {
+                memcpy(&hdr->mactime, skb->data + skb->len - 8, 8);
+                hdr->mactime = le64_to_cpu(hdr->mactime);
+                if (skb->len >= 8)
+                        skb_trim(skb, skb->len - 8);
+        } else {
+                hdr->mactime = 0;
+        }
+
+        cw1200_debug_rxed(priv);
+        if (arg->flags & WSM_RX_STATUS_AGGREGATE)
+                cw1200_debug_rxed_agg(priv);
+
+        if (ieee80211_is_action(frame->frame_control) &&
+            (arg->flags & WSM_RX_STATUS_ADDRESS1)) {
+                if (cw1200_handle_action_rx(priv, skb))
+                        return;
+        } else if (ieee80211_is_beacon(frame->frame_control) &&
+                   !arg->status &&
+                   !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
+                           ETH_ALEN)) {
+                const u8 *tim_ie;
+                u8 *ies = ((struct ieee80211_mgmt *)
+                          (skb->data))->u.beacon.variable;
+                size_t ies_len = skb->len - (ies - (u8 *)(skb->data));
+
+                tim_ie = cfg80211_find_ie(WLAN_EID_TIM, ies, ies_len);
+                if (tim_ie) {
+                        struct ieee80211_tim_ie *tim =
+                                (struct ieee80211_tim_ie *)&tim_ie[2];
+
+                        if (priv->join_dtim_period != tim->dtim_period) {
+                                priv->join_dtim_period = tim->dtim_period;
+                                queue_work(priv->workqueue,
+                                           &priv->set_beacon_wakeup_period_work);
+                        }
+                }
+
+                /* Disable beacon filter once we're associated... */
+                if (priv->disable_beacon_filter &&
+                    (priv->vif->bss_conf.assoc ||
+                     priv->vif->bss_conf.ibss_joined)) {
+                        priv->disable_beacon_filter = false;
+                        queue_work(priv->workqueue,
+                                   &priv->update_filtering_work);
+                }
+        }
+
+        /* Stay awake after frame is received to give
+         * userspace chance to react and acquire appropriate
+         * wakelock.
+         */
+        if (ieee80211_is_auth(frame->frame_control))
+                grace_period = 5 * HZ;
+        else if (ieee80211_is_deauth(frame->frame_control))
+                grace_period = 5 * HZ;
+        else
+                grace_period = 1 * HZ;
+        cw1200_pm_stay_awake(&priv->pm_state, grace_period);
+
+        if (early_data) {
+                spin_lock_bh(&priv->ps_state_lock);
+                /* Double-check status with lock held */
+                if (entry->status == CW1200_LINK_SOFT)
+                        skb_queue_tail(&entry->rx_queue, skb);
+                else
+                        ieee80211_rx_irqsafe(priv->hw, skb);
+                spin_unlock_bh(&priv->ps_state_lock);
+        } else {
+                ieee80211_rx_irqsafe(priv->hw, skb);
+        }
+        *skb_p = NULL;
+
+        return;
+
+drop:
+        /* TODO: update failure counters */
+        return;
+}
+
+/* ******************************************************************** */
+/* Security                                                             */
+
+int cw1200_alloc_key(struct cw1200_common *priv)
+{
+        int idx;
+
+        idx = ffs(~priv->key_map) - 1;
+        if (idx < 0 || idx > WSM_KEY_MAX_INDEX)
+                return -1;
+
+        priv->key_map |= BIT(idx);
+        priv->keys[idx].index = idx;
+        return idx;
+}
+
+void cw1200_free_key(struct cw1200_common *priv, int idx)
+{
+        BUG_ON(!(priv->key_map & BIT(idx)));
+        memset(&priv->keys[idx], 0, sizeof(priv->keys[idx]));
+        priv->key_map &= ~BIT(idx);
+}
+
+void cw1200_free_keys(struct cw1200_common *priv)
+{
+        memset(&priv->keys, 0, sizeof(priv->keys));
+        priv->key_map = 0;
+}
+
+int cw1200_upload_keys(struct cw1200_common *priv)
+{
+        int idx, ret = 0;
+        for (idx = 0; idx <= WSM_KEY_MAX_INDEX; ++idx)
+                if (priv->key_map & BIT(idx)) {
+                        ret = wsm_add_key(priv, &priv->keys[idx]);
+                        if (ret < 0)
+                                break;
+                }
+        return ret;
+}
+
+/* Workaround for WFD test case 6.1.10 */
+void cw1200_link_id_reset(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, linkid_reset_work);
+        int temp_linkid;
+
+        if (!priv->action_linkid) {
+                /* In GO mode we can receive ACTION frames without a linkID */
+                temp_linkid = cw1200_alloc_link_id(priv,
+                                &priv->action_frame_sa[0]);
+                WARN_ON(!temp_linkid);
+                if (temp_linkid) {
+                        /* Make sure we execute the WQ */
+                        flush_workqueue(priv->workqueue);
+                        /* Release the link ID */
+                        spin_lock_bh(&priv->ps_state_lock);
+                        priv->link_id_db[temp_linkid - 1].prev_status =
+                                priv->link_id_db[temp_linkid - 1].status;
+                        priv->link_id_db[temp_linkid - 1].status =
+                                CW1200_LINK_RESET;
+                        spin_unlock_bh(&priv->ps_state_lock);
+                        wsm_lock_tx_async(priv);
+                        if (queue_work(priv->workqueue,
+                                       &priv->link_id_work) <= 0)
+                                wsm_unlock_tx(priv);
+                }
+        } else {
+                spin_lock_bh(&priv->ps_state_lock);
+                priv->link_id_db[priv->action_linkid - 1].prev_status =
+                        priv->link_id_db[priv->action_linkid - 1].status;
+                priv->link_id_db[priv->action_linkid - 1].status =
+                        CW1200_LINK_RESET_REMAP;
+                spin_unlock_bh(&priv->ps_state_lock);
+                wsm_lock_tx_async(priv);
+                if (queue_work(priv->workqueue, &priv->link_id_work) <= 0)
+                        wsm_unlock_tx(priv);
+                flush_workqueue(priv->workqueue);
+        }
+}
+
+int cw1200_find_link_id(struct cw1200_common *priv, const u8 *mac)
+{
+        int i, ret = 0;
+        spin_lock_bh(&priv->ps_state_lock);
+        for (i = 0; i < CW1200_MAX_STA_IN_AP_MODE; ++i) {
+                if (!memcmp(mac, priv->link_id_db[i].mac, ETH_ALEN) &&
+                    priv->link_id_db[i].status) {
+                        priv->link_id_db[i].timestamp = jiffies;
+                        ret = i + 1;
+                        break;
+                }
+        }
+        spin_unlock_bh(&priv->ps_state_lock);
+        return ret;
+}
+
+int cw1200_alloc_link_id(struct cw1200_common *priv, const u8 *mac)
+{
+        int i, ret = 0;
+        unsigned long max_inactivity = 0;
+        unsigned long now = jiffies;
+
+        spin_lock_bh(&priv->ps_state_lock);
+        for (i = 0; i < CW1200_MAX_STA_IN_AP_MODE; ++i) {
+                if (!priv->link_id_db[i].status) {
+                        ret = i + 1;
+                        break;
+                } else if (priv->link_id_db[i].status != CW1200_LINK_HARD &&
+                           !priv->tx_queue_stats.link_map_cache[i + 1]) {
+                        unsigned long inactivity =
+                                now - priv->link_id_db[i].timestamp;
+                        if (inactivity < max_inactivity)
+                                continue;
+                        max_inactivity = inactivity;
+                        ret = i + 1;
+                }
+        }
+        if (ret) {
+                struct cw1200_link_entry *entry = &priv->link_id_db[ret - 1];
+                pr_debug("[AP] STA added, link_id: %d\n", ret);
+                entry->status = CW1200_LINK_RESERVE;
+                memcpy(&entry->mac, mac, ETH_ALEN);
+                memset(&entry->buffered, 0, CW1200_MAX_TID);
+                skb_queue_head_init(&entry->rx_queue);
+                wsm_lock_tx_async(priv);
+                if (queue_work(priv->workqueue, &priv->link_id_work) <= 0)
+                        wsm_unlock_tx(priv);
+        } else {
+                wiphy_info(priv->hw->wiphy,
+                           "[AP] Early: no more link IDs available.\n");
+        }
+
+        spin_unlock_bh(&priv->ps_state_lock);
+        return ret;
+}
+
+void cw1200_link_id_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, link_id_work);
+        wsm_flush_tx(priv);
+        cw1200_link_id_gc_work(&priv->link_id_gc_work.work);
+        wsm_unlock_tx(priv);
+}
+
+void cw1200_link_id_gc_work(struct work_struct *work)
+{
+        struct cw1200_common *priv =
+                container_of(work, struct cw1200_common, link_id_gc_work.work);
+        struct wsm_reset reset = {
+                .reset_statistics = false,
+        };
+        struct wsm_map_link map_link = {
+                .link_id = 0,
+        };
+        unsigned long now = jiffies;
+        unsigned long next_gc = -1;
+        long ttl;
+        bool need_reset;
+        u32 mask;
+        int i;
+
+        if (priv->join_status != CW1200_JOIN_STATUS_AP)
+                return;
+
+        wsm_lock_tx(priv);
+        spin_lock_bh(&priv->ps_state_lock);
+        for (i = 0; i < CW1200_MAX_STA_IN_AP_MODE; ++i) {
+                need_reset = false;
+                mask = BIT(i + 1);
+                if (priv->link_id_db[i].status == CW1200_LINK_RESERVE ||
+                    (priv->link_id_db[i].status == CW1200_LINK_HARD &&
+                     !(priv->link_id_map & mask))) {
+                        if (priv->link_id_map & mask) {
+                                priv->sta_asleep_mask &= ~mask;
+                                priv->pspoll_mask &= ~mask;
+                                need_reset = true;
+                        }
+                        priv->link_id_map |= mask;
+                        if (priv->link_id_db[i].status != CW1200_LINK_HARD)
+                                priv->link_id_db[i].status = CW1200_LINK_SOFT;
+                        memcpy(map_link.mac_addr, priv->link_id_db[i].mac,
+                               ETH_ALEN);
+                        spin_unlock_bh(&priv->ps_state_lock);
+                        if (need_reset) {
+                                reset.link_id = i + 1;
+                                wsm_reset(priv, &reset);
+                        }
+                        map_link.link_id = i + 1;
+                        wsm_map_link(priv, &map_link);
+                        next_gc = min(next_gc, CW1200_LINK_ID_GC_TIMEOUT);
+                        spin_lock_bh(&priv->ps_state_lock);
+                } else if (priv->link_id_db[i].status == CW1200_LINK_SOFT) {
+                        ttl = priv->link_id_db[i].timestamp - now +
+                                        CW1200_LINK_ID_GC_TIMEOUT;
+                        if (ttl <= 0) {
+                                need_reset = true;
+                                priv->link_id_db[i].status = CW1200_LINK_OFF;
+                                priv->link_id_map &= ~mask;
+                                priv->sta_asleep_mask &= ~mask;
+                                priv->pspoll_mask &= ~mask;
+                                memset(map_link.mac_addr, 0, ETH_ALEN);
+                                spin_unlock_bh(&priv->ps_state_lock);
+                                reset.link_id = i + 1;
+                                wsm_reset(priv, &reset);
+                                spin_lock_bh(&priv->ps_state_lock);
+                        } else {
+                                next_gc = min_t(unsigned long, next_gc, ttl);
+                        }
+                } else if (priv->link_id_db[i].status == CW1200_LINK_RESET ||
+                                priv->link_id_db[i].status ==
+                                CW1200_LINK_RESET_REMAP) {
+                        int status = priv->link_id_db[i].status;
+                        priv->link_id_db[i].status =
+                                        priv->link_id_db[i].prev_status;
+                        priv->link_id_db[i].timestamp = now;
+                        reset.link_id = i + 1;
+                        spin_unlock_bh(&priv->ps_state_lock);
+                        wsm_reset(priv, &reset);
+                        if (status == CW1200_LINK_RESET_REMAP) {
+                                memcpy(map_link.mac_addr,
+                                       priv->link_id_db[i].mac,
+                                       ETH_ALEN);
+                                map_link.link_id = i + 1;
+                                wsm_map_link(priv, &map_link);
+                                next_gc = min(next_gc,
+                                                CW1200_LINK_ID_GC_TIMEOUT);
+                        }
+                        spin_lock_bh(&priv->ps_state_lock);
+                }
+                if (need_reset) {
+                        skb_queue_purge(&priv->link_id_db[i].rx_queue);
+                        pr_debug("[AP] STA removed, link_id: %d\n",
+                                 reset.link_id);
+                }
+        }
+        spin_unlock_bh(&priv->ps_state_lock);
+        if (next_gc != -1)
+                queue_delayed_work(priv->workqueue,
+                                   &priv->link_id_gc_work, next_gc);
+        wsm_unlock_tx(priv);
+}
diff --git a/drivers/net/wireless/cw1200/txrx.h b/drivers/net/wireless/cw1200/txrx.h
new file mode 100644
index 000000000000..492a4e14213b
--- /dev/null
+++ b/drivers/net/wireless/cw1200/txrx.h
@@ -0,0 +1,106 @@
+/*
+ * Datapath interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_TXRX_H
+#define CW1200_TXRX_H
+
+#include <linux/list.h>
+
+/* extern */ struct ieee80211_hw;
+/* extern */ struct sk_buff;
+/* extern */ struct wsm_tx;
+/* extern */ struct wsm_rx;
+/* extern */ struct wsm_tx_confirm;
+/* extern */ struct cw1200_txpriv;
+
+struct tx_policy {
+        union {
+                __le32 tbl[3];
+                u8 raw[12];
+        };
+        u8  defined;
+        u8  usage_count;
+        u8  retry_count;
+        u8  uploaded;
+};
+
+struct tx_policy_cache_entry {
+        struct tx_policy policy;
+        struct list_head link;
+};
+
+#define TX_POLICY_CACHE_SIZE    (8)
+struct tx_policy_cache {
+        struct tx_policy_cache_entry cache[TX_POLICY_CACHE_SIZE];
+        struct list_head used;
+        struct list_head free;
+        spinlock_t lock; /* Protect policy cache */
+};
+
+/* ******************************************************************** */
+/* TX policy cache                                                      */
+/* Intention of TX policy cache is an overcomplicated WSM API.
+ * Device does not accept per-PDU tx retry sequence.
+ * It uses "tx retry policy id" instead, so driver code has to sync
+ * linux tx retry sequences with a retry policy table in the device.
+ */
+void tx_policy_init(struct cw1200_common *priv);
+void tx_policy_upload_work(struct work_struct *work);
+void tx_policy_clean(struct cw1200_common *priv);
+
+/* ******************************************************************** */
+/* TX implementation                                                    */
+
+u32 cw1200_rate_mask_to_wsm(struct cw1200_common *priv,
+                               u32 rates);
+void cw1200_tx(struct ieee80211_hw *dev,
+               struct ieee80211_tx_control *control,
+               struct sk_buff *skb);
+void cw1200_skb_dtor(struct cw1200_common *priv,
+                     struct sk_buff *skb,
+                     const struct cw1200_txpriv *txpriv);
+
+/* ******************************************************************** */
+/* WSM callbacks                                                        */
+
+void cw1200_tx_confirm_cb(struct cw1200_common *priv,
+                          int link_id,
+                          struct wsm_tx_confirm *arg);
+void cw1200_rx_cb(struct cw1200_common *priv,
+                  struct wsm_rx *arg,
+                  int link_id,
+                  struct sk_buff **skb_p);
+
+/* ******************************************************************** */
+/* Timeout                                                              */
+
+void cw1200_tx_timeout(struct work_struct *work);
+
+/* ******************************************************************** */
+/* Security                                                             */
+int cw1200_alloc_key(struct cw1200_common *priv);
+void cw1200_free_key(struct cw1200_common *priv, int idx);
+void cw1200_free_keys(struct cw1200_common *priv);
+int cw1200_upload_keys(struct cw1200_common *priv);
+
+/* ******************************************************************** */
+/* Workaround for WFD test case 6.1.10                                  */
+void cw1200_link_id_reset(struct work_struct *work);
+
+#define CW1200_LINK_ID_GC_TIMEOUT ((unsigned long)(10 * HZ))
+
+int cw1200_find_link_id(struct cw1200_common *priv, const u8 *mac);
+int cw1200_alloc_link_id(struct cw1200_common *priv, const u8 *mac);
+void cw1200_link_id_work(struct work_struct *work);
+void cw1200_link_id_gc_work(struct work_struct *work);
+
+
+#endif /* CW1200_TXRX_H */
diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c
new file mode 100644
index 000000000000..d95094fdcc50
--- /dev/null
+++ b/drivers/net/wireless/cw1200/wsm.c
@@ -0,0 +1,1823 @@
+/*
+ * WSM host interface (HI) implementation for
+ * ST-Ericsson CW1200 mac80211 drivers.
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/skbuff.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/sched.h>
+#include <linux/random.h>
+
+#include "cw1200.h"
+#include "wsm.h"
+#include "bh.h"
+#include "sta.h"
+#include "debug.h"
+
+#define WSM_CMD_TIMEOUT         (2 * HZ) /* With respect to interrupt loss */
+#define WSM_CMD_START_TIMEOUT   (7 * HZ)
+#define WSM_CMD_RESET_TIMEOUT   (3 * HZ) /* 2 sec. timeout was observed.   */
+#define WSM_CMD_MAX_TIMEOUT     (3 * HZ)
+
+#define WSM_SKIP(buf, size)                                             \
+        do {                                                            \
+                if ((buf)->data + size > (buf)->end)                    \
+                        goto underflow;                                 \
+                (buf)->data += size;                                    \
+        } while (0)
+
+#define WSM_GET(buf, ptr, size)                                         \
+        do {                                                            \
+                if ((buf)->data + size > (buf)->end)                    \
+                        goto underflow;                                 \
+                memcpy(ptr, (buf)->data, size);                         \
+                (buf)->data += size;                                    \
+        } while (0)
+
+#define __WSM_GET(buf, type, cvt)                                       \
+        ({                                                              \
+                type val;                                               \
+                if ((buf)->data + sizeof(type) > (buf)->end)            \
+                        goto underflow;                                 \
+                val = cvt(*(type *)(buf)->data);                        \
+                (buf)->data += sizeof(type);                            \
+                val;                                                    \
+        })
+
+#define WSM_GET8(buf)  __WSM_GET(buf, u8, (u8))
+#define WSM_GET16(buf) __WSM_GET(buf, u16, __le16_to_cpu)
+#define WSM_GET32(buf) __WSM_GET(buf, u32, __le32_to_cpu)
+
+#define WSM_PUT(buf, ptr, size)                                         \
+        do {                                                            \
+                if ((buf)->data + size > (buf)->end)            \
+                        if (wsm_buf_reserve((buf), size))       \
+                                goto nomem;                             \
+                memcpy((buf)->data, ptr, size);                         \
+                (buf)->data += size;                                    \
+        } while (0)
+
+#define __WSM_PUT(buf, val, type, cvt)                                  \
+        do {                                                            \
+                if ((buf)->data + sizeof(type) > (buf)->end)            \
+                        if (wsm_buf_reserve((buf), sizeof(type))) \
+                                goto nomem;                             \
+                *(type *)(buf)->data = cvt(val);                        \
+                (buf)->data += sizeof(type);                            \
+        } while (0)
+
+#define WSM_PUT8(buf, val)  __WSM_PUT(buf, val, u8, (u8))
+#define WSM_PUT16(buf, val) __WSM_PUT(buf, val, u16, __cpu_to_le16)
+#define WSM_PUT32(buf, val) __WSM_PUT(buf, val, u32, __cpu_to_le32)
+
+static void wsm_buf_reset(struct wsm_buf *buf);
+static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size);
+
+static int wsm_cmd_send(struct cw1200_common *priv,
+                        struct wsm_buf *buf,
+                        void *arg, u16 cmd, long tmo);
+
+#define wsm_cmd_lock(__priv) mutex_lock(&((__priv)->wsm_cmd_mux))
+#define wsm_cmd_unlock(__priv) mutex_unlock(&((__priv)->wsm_cmd_mux))
+
+/* ******************************************************************** */
+/* WSM API implementation                                               */
+
+static int wsm_generic_confirm(struct cw1200_common *priv,
+                             void *arg,
+                             struct wsm_buf *buf)
+{
+        u32 status = WSM_GET32(buf);
+        if (status != WSM_STATUS_SUCCESS)
+                return -EINVAL;
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+int wsm_configuration(struct cw1200_common *priv, struct wsm_configuration *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT32(buf, arg->dot11MaxTransmitMsduLifeTime);
+        WSM_PUT32(buf, arg->dot11MaxReceiveLifeTime);
+        WSM_PUT32(buf, arg->dot11RtsThreshold);
+
+        /* DPD block. */
+        WSM_PUT16(buf, arg->dpdData_size + 12);
+        WSM_PUT16(buf, 1); /* DPD version */
+        WSM_PUT(buf, arg->dot11StationId, ETH_ALEN);
+        WSM_PUT16(buf, 5); /* DPD flags */
+        WSM_PUT(buf, arg->dpdData, arg->dpdData_size);
+
+        ret = wsm_cmd_send(priv, buf, arg,
+                           WSM_CONFIGURATION_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+static int wsm_configuration_confirm(struct cw1200_common *priv,
+                                     struct wsm_configuration *arg,
+                                     struct wsm_buf *buf)
+{
+        int i;
+        int status;
+
+        status = WSM_GET32(buf);
+        if (WARN_ON(status != WSM_STATUS_SUCCESS))
+                return -EINVAL;
+
+        WSM_GET(buf, arg->dot11StationId, ETH_ALEN);
+        arg->dot11FrequencyBandsSupported = WSM_GET8(buf);
+        WSM_SKIP(buf, 1);
+        arg->supportedRateMask = WSM_GET32(buf);
+        for (i = 0; i < 2; ++i) {
+                arg->txPowerRange[i].min_power_level = WSM_GET32(buf);
+                arg->txPowerRange[i].max_power_level = WSM_GET32(buf);
+                arg->txPowerRange[i].stepping = WSM_GET32(buf);
+        }
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+int wsm_reset(struct cw1200_common *priv, const struct wsm_reset *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        u16 cmd = WSM_RESET_REQ_ID | WSM_TX_LINK_ID(arg->link_id);
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT32(buf, arg->reset_statistics ? 0 : 1);
+        ret = wsm_cmd_send(priv, buf, NULL, cmd, WSM_CMD_RESET_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+struct wsm_mib {
+        u16 mib_id;
+        void *buf;
+        size_t buf_size;
+};
+
+int wsm_read_mib(struct cw1200_common *priv, u16 mib_id, void *_buf,
+                        size_t buf_size)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        struct wsm_mib mib_buf = {
+                .mib_id = mib_id,
+                .buf = _buf,
+                .buf_size = buf_size,
+        };
+        wsm_cmd_lock(priv);
+
+        WSM_PUT16(buf, mib_id);
+        WSM_PUT16(buf, 0);
+
+        ret = wsm_cmd_send(priv, buf, &mib_buf,
+                           WSM_READ_MIB_REQ_ID, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+static int wsm_read_mib_confirm(struct cw1200_common *priv,
+                                struct wsm_mib *arg,
+                                struct wsm_buf *buf)
+{
+        u16 size;
+        if (WARN_ON(WSM_GET32(buf) != WSM_STATUS_SUCCESS))
+                return -EINVAL;
+
+        if (WARN_ON(WSM_GET16(buf) != arg->mib_id))
+                return -EINVAL;
+
+        size = WSM_GET16(buf);
+        if (size > arg->buf_size)
+                size = arg->buf_size;
+
+        WSM_GET(buf, arg->buf, size);
+        arg->buf_size = size;
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+int wsm_write_mib(struct cw1200_common *priv, u16 mib_id, void *_buf,
+                        size_t buf_size)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        struct wsm_mib mib_buf = {
+                .mib_id = mib_id,
+                .buf = _buf,
+                .buf_size = buf_size,
+        };
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT16(buf, mib_id);
+        WSM_PUT16(buf, buf_size);
+        WSM_PUT(buf, _buf, buf_size);
+
+        ret = wsm_cmd_send(priv, buf, &mib_buf,
+                           WSM_WRITE_MIB_REQ_ID, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+static int wsm_write_mib_confirm(struct cw1200_common *priv,
+                                struct wsm_mib *arg,
+                                struct wsm_buf *buf)
+{
+        int ret;
+
+        ret = wsm_generic_confirm(priv, arg, buf);
+        if (ret)
+                return ret;
+
+        if (arg->mib_id == WSM_MIB_ID_OPERATIONAL_POWER_MODE) {
+                /* OperationalMode: update PM status. */
+                const char *p = arg->buf;
+                cw1200_enable_powersave(priv, (p[0] & 0x0F) ? true : false);
+        }
+        return 0;
+}
+
+/* ******************************************************************** */
+
+int wsm_scan(struct cw1200_common *priv, const struct wsm_scan *arg)
+{
+        int i;
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        if (arg->num_channels > 48)
+                return -EINVAL;
+
+        if (arg->num_ssids > 2)
+                return -EINVAL;
+
+        if (arg->band > 1)
+                return -EINVAL;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->band);
+        WSM_PUT8(buf, arg->type);
+        WSM_PUT8(buf, arg->flags);
+        WSM_PUT8(buf, arg->max_tx_rate);
+        WSM_PUT32(buf, arg->auto_scan_interval);
+        WSM_PUT8(buf, arg->num_probes);
+        WSM_PUT8(buf, arg->num_channels);
+        WSM_PUT8(buf, arg->num_ssids);
+        WSM_PUT8(buf, arg->probe_delay);
+
+        for (i = 0; i < arg->num_channels; ++i) {
+                WSM_PUT16(buf, arg->ch[i].number);
+                WSM_PUT16(buf, 0);
+                WSM_PUT32(buf, arg->ch[i].min_chan_time);
+                WSM_PUT32(buf, arg->ch[i].max_chan_time);
+                WSM_PUT32(buf, 0);
+        }
+
+        for (i = 0; i < arg->num_ssids; ++i) {
+                WSM_PUT32(buf, arg->ssids[i].length);
+                WSM_PUT(buf, &arg->ssids[i].ssid[0],
+                        sizeof(arg->ssids[i].ssid));
+        }
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_START_SCAN_REQ_ID, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_stop_scan(struct cw1200_common *priv)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        wsm_cmd_lock(priv);
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_STOP_SCAN_REQ_ID, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+}
+
+
+static int wsm_tx_confirm(struct cw1200_common *priv,
+                          struct wsm_buf *buf,
+                          int link_id)
+{
+        struct wsm_tx_confirm tx_confirm;
+
+        tx_confirm.packet_id = WSM_GET32(buf);
+        tx_confirm.status = WSM_GET32(buf);
+        tx_confirm.tx_rate = WSM_GET8(buf);
+        tx_confirm.ack_failures = WSM_GET8(buf);
+        tx_confirm.flags = WSM_GET16(buf);
+        tx_confirm.media_delay = WSM_GET32(buf);
+        tx_confirm.tx_queue_delay = WSM_GET32(buf);
+
+        cw1200_tx_confirm_cb(priv, link_id, &tx_confirm);
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+static int wsm_multi_tx_confirm(struct cw1200_common *priv,
+                                struct wsm_buf *buf, int link_id)
+{
+        int ret;
+        int count;
+        int i;
+
+        count = WSM_GET32(buf);
+        if (WARN_ON(count <= 0))
+                return -EINVAL;
+
+        if (count > 1) {
+                /* We already released one buffer, now for the rest */
+                ret = wsm_release_tx_buffer(priv, count - 1);
+                if (ret < 0)
+                        return ret;
+                else if (ret > 0)
+                        cw1200_bh_wakeup(priv);
+        }
+
+        cw1200_debug_txed_multi(priv, count);
+        for (i = 0; i < count; ++i) {
+                ret = wsm_tx_confirm(priv, buf, link_id);
+                if (ret)
+                        return ret;
+        }
+        return ret;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+/* ******************************************************************** */
+
+static int wsm_join_confirm(struct cw1200_common *priv,
+                            struct wsm_join_cnf *arg,
+                            struct wsm_buf *buf)
+{
+        arg->status = WSM_GET32(buf);
+        if (WARN_ON(arg->status) != WSM_STATUS_SUCCESS)
+                return -EINVAL;
+
+        arg->min_power_level = WSM_GET32(buf);
+        arg->max_power_level = WSM_GET32(buf);
+
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+int wsm_join(struct cw1200_common *priv, struct wsm_join *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        struct wsm_join_cnf resp;
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->mode);
+        WSM_PUT8(buf, arg->band);
+        WSM_PUT16(buf, arg->channel_number);
+        WSM_PUT(buf, &arg->bssid[0], sizeof(arg->bssid));
+        WSM_PUT16(buf, arg->atim_window);
+        WSM_PUT8(buf, arg->preamble_type);
+        WSM_PUT8(buf, arg->probe_for_join);
+        WSM_PUT8(buf, arg->dtim_period);
+        WSM_PUT8(buf, arg->flags);
+        WSM_PUT32(buf, arg->ssid_len);
+        WSM_PUT(buf, &arg->ssid[0], sizeof(arg->ssid));
+        WSM_PUT32(buf, arg->beacon_interval);
+        WSM_PUT32(buf, arg->basic_rate_set);
+
+        priv->tx_burst_idx = -1;
+        ret = wsm_cmd_send(priv, buf, &resp,
+                           WSM_JOIN_REQ_ID, WSM_CMD_TIMEOUT);
+        /* TODO:  Update state based on resp.min|max_power_level */
+
+        priv->join_complete_status = resp.status;
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_bss_params(struct cw1200_common *priv,
+                       const struct wsm_set_bss_params *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, (arg->reset_beacon_loss ?  0x1 : 0));
+        WSM_PUT8(buf, arg->beacon_lost_count);
+        WSM_PUT16(buf, arg->aid);
+        WSM_PUT32(buf, arg->operational_rate_set);
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_SET_BSS_PARAMS_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_add_key(struct cw1200_common *priv, const struct wsm_add_key *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT(buf, arg, sizeof(*arg));
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_ADD_KEY_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_remove_key(struct cw1200_common *priv, const struct wsm_remove_key *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->index);
+        WSM_PUT8(buf, 0);
+        WSM_PUT16(buf, 0);
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_REMOVE_KEY_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_tx_queue_params(struct cw1200_common *priv,
+                const struct wsm_set_tx_queue_params *arg, u8 id)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        u8 queue_id_to_wmm_aci[] = {3, 2, 0, 1};
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, queue_id_to_wmm_aci[id]);
+        WSM_PUT8(buf, 0);
+        WSM_PUT8(buf, arg->ackPolicy);
+        WSM_PUT8(buf, 0);
+        WSM_PUT32(buf, arg->maxTransmitLifetime);
+        WSM_PUT16(buf, arg->allowedMediumTime);
+        WSM_PUT16(buf, 0);
+
+        ret = wsm_cmd_send(priv, buf, NULL, 0x0012, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_edca_params(struct cw1200_common *priv,
+                                const struct wsm_edca_params *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        /* Implemented according to specification. */
+
+        WSM_PUT16(buf, arg->params[3].cwmin);
+        WSM_PUT16(buf, arg->params[2].cwmin);
+        WSM_PUT16(buf, arg->params[1].cwmin);
+        WSM_PUT16(buf, arg->params[0].cwmin);
+
+        WSM_PUT16(buf, arg->params[3].cwmax);
+        WSM_PUT16(buf, arg->params[2].cwmax);
+        WSM_PUT16(buf, arg->params[1].cwmax);
+        WSM_PUT16(buf, arg->params[0].cwmax);
+
+        WSM_PUT8(buf, arg->params[3].aifns);
+        WSM_PUT8(buf, arg->params[2].aifns);
+        WSM_PUT8(buf, arg->params[1].aifns);
+        WSM_PUT8(buf, arg->params[0].aifns);
+
+        WSM_PUT16(buf, arg->params[3].txop_limit);
+        WSM_PUT16(buf, arg->params[2].txop_limit);
+        WSM_PUT16(buf, arg->params[1].txop_limit);
+        WSM_PUT16(buf, arg->params[0].txop_limit);
+
+        WSM_PUT32(buf, arg->params[3].max_rx_lifetime);
+        WSM_PUT32(buf, arg->params[2].max_rx_lifetime);
+        WSM_PUT32(buf, arg->params[1].max_rx_lifetime);
+        WSM_PUT32(buf, arg->params[0].max_rx_lifetime);
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_EDCA_PARAMS_REQ_ID, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_switch_channel(struct cw1200_common *priv,
+                        const struct wsm_switch_channel *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->mode);
+        WSM_PUT8(buf, arg->switch_count);
+        WSM_PUT16(buf, arg->channel_number);
+
+        priv->channel_switch_in_progress = 1;
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_SWITCH_CHANNEL_REQ_ID, WSM_CMD_TIMEOUT);
+        if (ret)
+                priv->channel_switch_in_progress = 0;
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        priv->ps_mode_switch_in_progress = 1;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->mode);
+        WSM_PUT8(buf, arg->fast_psm_idle_period);
+        WSM_PUT8(buf, arg->ap_psm_change_period);
+        WSM_PUT8(buf, arg->min_auto_pspoll_period);
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_SET_PM_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_start(struct cw1200_common *priv, const struct wsm_start *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT8(buf, arg->mode);
+        WSM_PUT8(buf, arg->band);
+        WSM_PUT16(buf, arg->channel_number);
+        WSM_PUT32(buf, arg->ct_window);
+        WSM_PUT32(buf, arg->beacon_interval);
+        WSM_PUT8(buf, arg->dtim_period);
+        WSM_PUT8(buf, arg->preamble);
+        WSM_PUT8(buf, arg->probe_delay);
+        WSM_PUT8(buf, arg->ssid_len);
+        WSM_PUT(buf, arg->ssid, sizeof(arg->ssid));
+        WSM_PUT32(buf, arg->basic_rate_set);
+
+        priv->tx_burst_idx = -1;
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_START_REQ_ID, WSM_CMD_START_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_beacon_transmit(struct cw1200_common *priv,
+                        const struct wsm_beacon_transmit *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT32(buf, arg->enable_beaconing ? 1 : 0);
+
+        ret = wsm_cmd_send(priv, buf, NULL,
+                           WSM_BEACON_TRANSMIT_REQ_ID, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_start_find(struct cw1200_common *priv)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+        ret = wsm_cmd_send(priv, buf, NULL, 0x0019, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+}
+
+/* ******************************************************************** */
+
+int wsm_stop_find(struct cw1200_common *priv)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+        ret = wsm_cmd_send(priv, buf, NULL, 0x001A, WSM_CMD_TIMEOUT);
+        wsm_cmd_unlock(priv);
+        return ret;
+}
+
+/* ******************************************************************** */
+
+int wsm_map_link(struct cw1200_common *priv, const struct wsm_map_link *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+        u16 cmd = 0x001C | WSM_TX_LINK_ID(arg->link_id);
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT(buf, &arg->mac_addr[0], sizeof(arg->mac_addr));
+        WSM_PUT16(buf, 0);
+
+        ret = wsm_cmd_send(priv, buf, NULL, cmd, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+
+int wsm_update_ie(struct cw1200_common *priv,
+                  const struct wsm_update_ie *arg)
+{
+        int ret;
+        struct wsm_buf *buf = &priv->wsm_cmd_buf;
+
+        wsm_cmd_lock(priv);
+
+        WSM_PUT16(buf, arg->what);
+        WSM_PUT16(buf, arg->count);
+        WSM_PUT(buf, arg->ies, arg->length);
+
+        ret = wsm_cmd_send(priv, buf, NULL, 0x001B, WSM_CMD_TIMEOUT);
+
+        wsm_cmd_unlock(priv);
+        return ret;
+
+nomem:
+        wsm_cmd_unlock(priv);
+        return -ENOMEM;
+}
+
+/* ******************************************************************** */
+int wsm_set_probe_responder(struct cw1200_common *priv, bool enable)
+{
+        priv->rx_filter.probeResponder = enable;
+        return wsm_set_rx_filter(priv, &priv->rx_filter);
+}
+
+/* ******************************************************************** */
+/* WSM indication events implementation                                 */
+const char * const cw1200_fw_types[] = {
+        "ETF",
+        "WFM",
+        "WSM",
+        "HI test",
+        "Platform test"
+};
+
+static int wsm_startup_indication(struct cw1200_common *priv,
+                                        struct wsm_buf *buf)
+{
+        priv->wsm_caps.input_buffers     = WSM_GET16(buf);
+        priv->wsm_caps.input_buffer_size = WSM_GET16(buf);
+        priv->wsm_caps.hw_id      = WSM_GET16(buf);
+        priv->wsm_caps.hw_subid   = WSM_GET16(buf);
+        priv->wsm_caps.status     = WSM_GET16(buf);
+        priv->wsm_caps.fw_cap     = WSM_GET16(buf);
+        priv->wsm_caps.fw_type    = WSM_GET16(buf);
+        priv->wsm_caps.fw_api     = WSM_GET16(buf);
+        priv->wsm_caps.fw_build   = WSM_GET16(buf);
+        priv->wsm_caps.fw_ver     = WSM_GET16(buf);
+        WSM_GET(buf, priv->wsm_caps.fw_label, sizeof(priv->wsm_caps.fw_label));
+        priv->wsm_caps.fw_label[sizeof(priv->wsm_caps.fw_label) - 1] = 0; /* Do not trust FW too much... */
+
+        if (WARN_ON(priv->wsm_caps.status))
+                return -EINVAL;
+
+        if (WARN_ON(priv->wsm_caps.fw_type > 4))
+                return -EINVAL;
+
+        pr_info("CW1200 WSM init done.\n"
+                "   Input buffers: %d x %d bytes\n"
+                "   Hardware: %d.%d\n"
+                "   %s firmware [%s], ver: %d, build: %d,"
+                "   api: %d, cap: 0x%.4X\n",
+                priv->wsm_caps.input_buffers,
+                priv->wsm_caps.input_buffer_size,
+                priv->wsm_caps.hw_id, priv->wsm_caps.hw_subid,
+                cw1200_fw_types[priv->wsm_caps.fw_type],
+                priv->wsm_caps.fw_label, priv->wsm_caps.fw_ver,
+                priv->wsm_caps.fw_build,
+                priv->wsm_caps.fw_api, priv->wsm_caps.fw_cap);
+
+        /* Disable unsupported frequency bands */
+        if (!(priv->wsm_caps.fw_cap & 0x1))
+                priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = NULL;
+        if (!(priv->wsm_caps.fw_cap & 0x2))
+                priv->hw->wiphy->bands[IEEE80211_BAND_5GHZ] = NULL;
+
+        priv->firmware_ready = 1;
+        wake_up(&priv->wsm_startup_done);
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+static int wsm_receive_indication(struct cw1200_common *priv,
+                                  int link_id,
+                                  struct wsm_buf *buf,
+                                  struct sk_buff **skb_p)
+{
+        struct wsm_rx rx;
+        struct ieee80211_hdr *hdr;
+        size_t hdr_len;
+        __le16 fctl;
+
+        rx.status = WSM_GET32(buf);
+        rx.channel_number = WSM_GET16(buf);
+        rx.rx_rate = WSM_GET8(buf);
+        rx.rcpi_rssi = WSM_GET8(buf);
+        rx.flags = WSM_GET32(buf);
+
+        /* FW Workaround: Drop probe resp or
+           beacon when RSSI is 0
+        */
+        hdr = (struct ieee80211_hdr *)(*skb_p)->data;
+
+        if (!rx.rcpi_rssi &&
+            (ieee80211_is_probe_resp(hdr->frame_control) ||
+             ieee80211_is_beacon(hdr->frame_control)))
+                return 0;
+
+        /* If no RSSI subscription has been made,
+         * convert RCPI to RSSI here
+         */
+        if (!priv->cqm_use_rssi)
+                rx.rcpi_rssi = rx.rcpi_rssi / 2 - 110;
+
+        fctl = *(__le16 *)buf->data;
+        hdr_len = buf->data - buf->begin;
+        skb_pull(*skb_p, hdr_len);
+        if (!rx.status && ieee80211_is_deauth(fctl)) {
+                if (priv->join_status == CW1200_JOIN_STATUS_STA) {
+                        /* Shedule unjoin work */
+                        pr_debug("[WSM] Issue unjoin command (RX).\n");
+                        wsm_lock_tx_async(priv);
+                        if (queue_work(priv->workqueue,
+                                       &priv->unjoin_work) <= 0)
+                                wsm_unlock_tx(priv);
+                }
+        }
+        cw1200_rx_cb(priv, &rx, link_id, skb_p);
+        if (*skb_p)
+                skb_push(*skb_p, hdr_len);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+static int wsm_event_indication(struct cw1200_common *priv, struct wsm_buf *buf)
+{
+        int first;
+        struct cw1200_wsm_event *event;
+
+        if (priv->mode == NL80211_IFTYPE_UNSPECIFIED) {
+                /* STA is stopped. */
+                return 0;
+        }
+
+        event = kzalloc(sizeof(struct cw1200_wsm_event), GFP_KERNEL);
+        if (!event)
+                return -ENOMEM;
+
+        event->evt.id = __le32_to_cpu(WSM_GET32(buf));
+        event->evt.data = __le32_to_cpu(WSM_GET32(buf));
+
+        pr_debug("[WSM] Event: %d(%d)\n",
+                 event->evt.id, event->evt.data);
+
+        spin_lock(&priv->event_queue_lock);
+        first = list_empty(&priv->event_queue);
+        list_add_tail(&event->link, &priv->event_queue);
+        spin_unlock(&priv->event_queue_lock);
+
+        if (first)
+                queue_work(priv->workqueue, &priv->event_handler);
+
+        return 0;
+
+underflow:
+        kfree(event);
+        return -EINVAL;
+}
+
+static int wsm_channel_switch_indication(struct cw1200_common *priv,
+                                         struct wsm_buf *buf)
+{
+        WARN_ON(WSM_GET32(buf));
+
+        priv->channel_switch_in_progress = 0;
+        wake_up(&priv->channel_switch_done);
+
+        wsm_unlock_tx(priv);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+static int wsm_set_pm_indication(struct cw1200_common *priv,
+                                 struct wsm_buf *buf)
+{
+        /* TODO:  Check buf (struct wsm_set_pm_complete) for validity */
+        if (priv->ps_mode_switch_in_progress) {
+                priv->ps_mode_switch_in_progress = 0;
+                wake_up(&priv->ps_mode_switch_done);
+        }
+        return 0;
+}
+
+static int wsm_scan_started(struct cw1200_common *priv, void *arg,
+                            struct wsm_buf *buf)
+{
+        u32 status = WSM_GET32(buf);
+        if (status != WSM_STATUS_SUCCESS) {
+                cw1200_scan_failed_cb(priv);
+                return -EINVAL;
+        }
+        return 0;
+
+underflow:
+        WARN_ON(1);
+        return -EINVAL;
+}
+
+static int wsm_scan_complete_indication(struct cw1200_common *priv,
+                                        struct wsm_buf *buf)
+{
+        struct wsm_scan_complete arg;
+        arg.status = WSM_GET32(buf);
+        arg.psm = WSM_GET8(buf);
+        arg.num_channels = WSM_GET8(buf);
+        cw1200_scan_complete_cb(priv, &arg);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+static int wsm_join_complete_indication(struct cw1200_common *priv,
+                                        struct wsm_buf *buf)
+{
+        struct wsm_join_complete arg;
+        arg.status = WSM_GET32(buf);
+        pr_debug("[WSM] Join complete indication, status: %d\n", arg.status);
+        cw1200_join_complete_cb(priv, &arg);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+static int wsm_find_complete_indication(struct cw1200_common *priv,
+                                        struct wsm_buf *buf)
+{
+        pr_warn("Implement find_complete_indication\n");
+        return 0;
+}
+
+static int wsm_ba_timeout_indication(struct cw1200_common *priv,
+                                     struct wsm_buf *buf)
+{
+        u32 dummy;
+        u8 tid;
+        u8 dummy2;
+        u8 addr[ETH_ALEN];
+
+        dummy = WSM_GET32(buf);
+        tid = WSM_GET8(buf);
+        dummy2 = WSM_GET8(buf);
+        WSM_GET(buf, addr, ETH_ALEN);
+
+        pr_info("BlockACK timeout, tid %d, addr %pM\n",
+                tid, addr);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+static int wsm_suspend_resume_indication(struct cw1200_common *priv,
+                                         int link_id, struct wsm_buf *buf)
+{
+        u32 flags;
+        struct wsm_suspend_resume arg;
+
+        flags = WSM_GET32(buf);
+        arg.link_id = link_id;
+        arg.stop = !(flags & 1);
+        arg.multicast = !!(flags & 8);
+        arg.queue = (flags >> 1) & 3;
+
+        cw1200_suspend_resume(priv, &arg);
+
+        return 0;
+
+underflow:
+        return -EINVAL;
+}
+
+
+/* ******************************************************************** */
+/* WSM TX                                                               */
+
+static int wsm_cmd_send(struct cw1200_common *priv,
+                        struct wsm_buf *buf,
+                        void *arg, u16 cmd, long tmo)
+{
+        size_t buf_len = buf->data - buf->begin;
+        int ret;
+
+        /* Don't bother if we're dead. */
+        if (priv->bh_error) {
+                ret = 0;
+                goto done;
+        }
+
+        /* Block until the cmd buffer is completed.  Tortuous. */
+        spin_lock(&priv->wsm_cmd.lock);
+        while (!priv->wsm_cmd.done) {
+                spin_unlock(&priv->wsm_cmd.lock);
+                spin_lock(&priv->wsm_cmd.lock);
+        }
+        priv->wsm_cmd.done = 0;
+        spin_unlock(&priv->wsm_cmd.lock);
+
+        if (cmd == WSM_WRITE_MIB_REQ_ID ||
+            cmd == WSM_READ_MIB_REQ_ID)
+                pr_debug("[WSM] >>> 0x%.4X [MIB: 0x%.4X] (%zu)\n",
+                         cmd, __le16_to_cpu(((__le16 *)buf->begin)[2]),
+                         buf_len);
+        else
+                pr_debug("[WSM] >>> 0x%.4X (%zu)\n", cmd, buf_len);
+
+        /* Due to buggy SPI on CW1200, we need to
+         * pad the message by a few bytes to ensure
+         * that it's completely received.
+         */
+        buf_len += 4;
+
+        /* Fill HI message header */
+        /* BH will add sequence number */
+        ((__le16 *)buf->begin)[0] = __cpu_to_le16(buf_len);
+        ((__le16 *)buf->begin)[1] = __cpu_to_le16(cmd);
+
+        spin_lock(&priv->wsm_cmd.lock);
+        BUG_ON(priv->wsm_cmd.ptr);
+        priv->wsm_cmd.ptr = buf->begin;
+        priv->wsm_cmd.len = buf_len;
+        priv->wsm_cmd.arg = arg;
+        priv->wsm_cmd.cmd = cmd;
+        spin_unlock(&priv->wsm_cmd.lock);
+
+        cw1200_bh_wakeup(priv);
+
+        /* Wait for command completion */
+        ret = wait_event_timeout(priv->wsm_cmd_wq,
+                                 priv->wsm_cmd.done, tmo);
+
+        if (!ret && !priv->wsm_cmd.done) {
+                spin_lock(&priv->wsm_cmd.lock);
+                priv->wsm_cmd.done = 1;
+                priv->wsm_cmd.ptr = NULL;
+                spin_unlock(&priv->wsm_cmd.lock);
+                if (priv->bh_error) {
+                        /* Return ok to help system cleanup */
+                        ret = 0;
+                } else {
+                        pr_err("CMD req (0x%04x) stuck in firmware, killing BH\n", priv->wsm_cmd.cmd);
+                        print_hex_dump_bytes("REQDUMP: ", DUMP_PREFIX_NONE,
+                                             buf->begin, buf_len);
+                        pr_err("Outstanding outgoing frames:  %d\n", priv->hw_bufs_used);
+
+                        /* Kill BH thread to report the error to the top layer. */
+                        atomic_add(1, &priv->bh_term);
+                        wake_up(&priv->bh_wq);
+                        ret = -ETIMEDOUT;
+                }
+        } else {
+                spin_lock(&priv->wsm_cmd.lock);
+                BUG_ON(!priv->wsm_cmd.done);
+                ret = priv->wsm_cmd.ret;
+                spin_unlock(&priv->wsm_cmd.lock);
+        }
+done:
+        wsm_buf_reset(buf);
+        return ret;
+}
+
+/* ******************************************************************** */
+/* WSM TX port control                                                  */
+
+void wsm_lock_tx(struct cw1200_common *priv)
+{
+        wsm_cmd_lock(priv);
+        if (atomic_add_return(1, &priv->tx_lock) == 1) {
+                if (wsm_flush_tx(priv))
+                        pr_debug("[WSM] TX is locked.\n");
+        }
+        wsm_cmd_unlock(priv);
+}
+
+void wsm_lock_tx_async(struct cw1200_common *priv)
+{
+        if (atomic_add_return(1, &priv->tx_lock) == 1)
+                pr_debug("[WSM] TX is locked (async).\n");
+}
+
+bool wsm_flush_tx(struct cw1200_common *priv)
+{
+        unsigned long timestamp = jiffies;
+        bool pending = false;
+        long timeout;
+        int i;
+
+        /* Flush must be called with TX lock held. */
+        BUG_ON(!atomic_read(&priv->tx_lock));
+
+        /* First check if we really need to do something.
+         * It is safe to use unprotected access, as hw_bufs_used
+         * can only decrements.
+         */
+        if (!priv->hw_bufs_used)
+                return true;
+
+        if (priv->bh_error) {
+                /* In case of failure do not wait for magic. */
+                pr_err("[WSM] Fatal error occured, will not flush TX.\n");
+                return false;
+        } else {
+                /* Get a timestamp of "oldest" frame */
+                for (i = 0; i < 4; ++i)
+                        pending |= cw1200_queue_get_xmit_timestamp(
+                                        &priv->tx_queue[i],
+                                        &timestamp, 0xffffffff);
+                /* If there's nothing pending, we're good */
+                if (!pending)
+                        return true;
+
+                timeout = timestamp + WSM_CMD_LAST_CHANCE_TIMEOUT - jiffies;
+                if (timeout < 0 || wait_event_timeout(priv->bh_evt_wq,
+                                                      !priv->hw_bufs_used,
+                                                      timeout) <= 0) {
+                        /* Hmmm... Not good. Frame had stuck in firmware. */
+                        priv->bh_error = 1;
+                        wiphy_err(priv->hw->wiphy, "[WSM] TX Frames (%d) stuck in firmware, killing BH\n", priv->hw_bufs_used);
+                        wake_up(&priv->bh_wq);
+                        return false;
+                }
+
+                /* Ok, everything is flushed. */
+                return true;
+        }
+}
+
+void wsm_unlock_tx(struct cw1200_common *priv)
+{
+        int tx_lock;
+        tx_lock = atomic_sub_return(1, &priv->tx_lock);
+        BUG_ON(tx_lock < 0);
+
+        if (tx_lock == 0) {
+                if (!priv->bh_error)
+                        cw1200_bh_wakeup(priv);
+                pr_debug("[WSM] TX is unlocked.\n");
+        }
+}
+
+/* ******************************************************************** */
+/* WSM RX                                                               */
+
+int wsm_handle_exception(struct cw1200_common *priv, u8 *data, size_t len)
+{
+        struct wsm_buf buf;
+        u32 reason;
+        u32 reg[18];
+        char fname[48];
+        unsigned int i;
+
+        static const char * const reason_str[] = {
+                "undefined instruction",
+                "prefetch abort",
+                "data abort",
+                "unknown error",
+        };
+
+        buf.begin = buf.data = data;
+        buf.end = &buf.begin[len];
+
+        reason = WSM_GET32(&buf);
+        for (i = 0; i < ARRAY_SIZE(reg); ++i)
+                reg[i] = WSM_GET32(&buf);
+        WSM_GET(&buf, fname, sizeof(fname));
+
+        if (reason < 4)
+                wiphy_err(priv->hw->wiphy,
+                          "Firmware exception: %s.\n",
+                          reason_str[reason]);
+        else
+                wiphy_err(priv->hw->wiphy,
+                          "Firmware assert at %.*s, line %d\n",
+                          (int) sizeof(fname), fname, reg[1]);
+
+        for (i = 0; i < 12; i += 4)
+                wiphy_err(priv->hw->wiphy,
+                          "R%d: 0x%.8X, R%d: 0x%.8X, R%d: 0x%.8X, R%d: 0x%.8X,\n",
+                          i + 0, reg[i + 0], i + 1, reg[i + 1],
+                          i + 2, reg[i + 2], i + 3, reg[i + 3]);
+        wiphy_err(priv->hw->wiphy,
+                  "R12: 0x%.8X, SP: 0x%.8X, LR: 0x%.8X, PC: 0x%.8X,\n",
+                  reg[i + 0], reg[i + 1], reg[i + 2], reg[i + 3]);
+        i += 4;
+        wiphy_err(priv->hw->wiphy,
+                  "CPSR: 0x%.8X, SPSR: 0x%.8X\n",
+                  reg[i + 0], reg[i + 1]);
+
+        print_hex_dump_bytes("R1: ", DUMP_PREFIX_NONE,
+                             fname, sizeof(fname));
+        return 0;
+
+underflow:
+        wiphy_err(priv->hw->wiphy, "Firmware exception.\n");
+        print_hex_dump_bytes("Exception: ", DUMP_PREFIX_NONE,
+                             data, len);
+        return -EINVAL;
+}
+
+int wsm_handle_rx(struct cw1200_common *priv, u16 id,
+                  struct wsm_hdr *wsm, struct sk_buff **skb_p)
+{
+        int ret = 0;
+        struct wsm_buf wsm_buf;
+        int link_id = (id >> 6) & 0x0F;
+
+        /* Strip link id. */
+        id &= ~WSM_TX_LINK_ID(WSM_TX_LINK_ID_MAX);
+
+        wsm_buf.begin = (u8 *)&wsm[0];
+        wsm_buf.data = (u8 *)&wsm[1];
+        wsm_buf.end = &wsm_buf.begin[__le32_to_cpu(wsm->len)];
+
+        pr_debug("[WSM] <<< 0x%.4X (%td)\n", id,
+                 wsm_buf.end - wsm_buf.begin);
+
+        if (id == WSM_TX_CONFIRM_IND_ID) {
+                ret = wsm_tx_confirm(priv, &wsm_buf, link_id);
+        } else if (id == WSM_MULTI_TX_CONFIRM_ID) {
+                ret = wsm_multi_tx_confirm(priv, &wsm_buf, link_id);
+        } else if (id & 0x0400) {
+                void *wsm_arg;
+                u16 wsm_cmd;
+
+                /* Do not trust FW too much. Protection against repeated
+                 * response and race condition removal (see above).
+                 */
+                spin_lock(&priv->wsm_cmd.lock);
+                wsm_arg = priv->wsm_cmd.arg;
+                wsm_cmd = priv->wsm_cmd.cmd &
+                                ~WSM_TX_LINK_ID(WSM_TX_LINK_ID_MAX);
+                priv->wsm_cmd.cmd = 0xFFFF;
+                spin_unlock(&priv->wsm_cmd.lock);
+
+                if (WARN_ON((id & ~0x0400) != wsm_cmd)) {
+                        /* Note that any non-zero is a fatal retcode. */
+                        ret = -EINVAL;
+                        goto out;
+                }
+
+                /* Note that wsm_arg can be NULL in case of timeout in
+                 * wsm_cmd_send().
+                 */
+
+                switch (id) {
+                case WSM_READ_MIB_RESP_ID:
+                        if (wsm_arg)
+                                ret = wsm_read_mib_confirm(priv, wsm_arg,
+                                                                &wsm_buf);
+                        break;
+                case WSM_WRITE_MIB_RESP_ID:
+                        if (wsm_arg)
+                                ret = wsm_write_mib_confirm(priv, wsm_arg,
+                                                            &wsm_buf);
+                        break;
+                case WSM_START_SCAN_RESP_ID:
+                        if (wsm_arg)
+                                ret = wsm_scan_started(priv, wsm_arg, &wsm_buf);
+                        break;
+                case WSM_CONFIGURATION_RESP_ID:
+                        if (wsm_arg)
+                                ret = wsm_configuration_confirm(priv, wsm_arg,
+                                                                &wsm_buf);
+                        break;
+                case WSM_JOIN_RESP_ID:
+                        if (wsm_arg)
+                                ret = wsm_join_confirm(priv, wsm_arg, &wsm_buf);
+                        break;
+                case WSM_STOP_SCAN_RESP_ID:
+                case WSM_RESET_RESP_ID:
+                case WSM_ADD_KEY_RESP_ID:
+                case WSM_REMOVE_KEY_RESP_ID:
+                case WSM_SET_PM_RESP_ID:
+                case WSM_SET_BSS_PARAMS_RESP_ID:
+                case 0x0412: /* set_tx_queue_params */
+                case WSM_EDCA_PARAMS_RESP_ID:
+                case WSM_SWITCH_CHANNEL_RESP_ID:
+                case WSM_START_RESP_ID:
+                case WSM_BEACON_TRANSMIT_RESP_ID:
+                case 0x0419: /* start_find */
+                case 0x041A: /* stop_find */
+                case 0x041B: /* update_ie */
+                case 0x041C: /* map_link */
+                        WARN_ON(wsm_arg != NULL);
+                        ret = wsm_generic_confirm(priv, wsm_arg, &wsm_buf);
+                        if (ret) {
+                                wiphy_warn(priv->hw->wiphy,
+                                           "wsm_generic_confirm failed for request 0x%04x.\n",
+                                           id & ~0x0400);
+
+                                /* often 0x407 and 0x410 occur, this means we're dead.. */
+                                if (priv->join_status >= CW1200_JOIN_STATUS_JOINING) {
+                                        wsm_lock_tx(priv);
+                                        if (queue_work(priv->workqueue, &priv->unjoin_work) <= 0)
+                                                wsm_unlock_tx(priv);
+                                }
+                        }
+                        break;
+                default:
+                        wiphy_warn(priv->hw->wiphy,
+                                   "Unrecognized confirmation 0x%04x\n",
+                                   id & ~0x0400);
+                }
+
+                spin_lock(&priv->wsm_cmd.lock);
+                priv->wsm_cmd.ret = ret;
+                priv->wsm_cmd.done = 1;
+                spin_unlock(&priv->wsm_cmd.lock);
+
+                ret = 0; /* Error response from device should ne stop BH. */
+
+                wake_up(&priv->wsm_cmd_wq);
+        } else if (id & 0x0800) {
+                switch (id) {
+                case WSM_STARTUP_IND_ID:
+                        ret = wsm_startup_indication(priv, &wsm_buf);
+                        break;
+                case WSM_RECEIVE_IND_ID:
+                        ret = wsm_receive_indication(priv, link_id,
+                                                     &wsm_buf, skb_p);
+                        break;
+                case 0x0805:
+                        ret = wsm_event_indication(priv, &wsm_buf);
+                        break;
+                case WSM_SCAN_COMPLETE_IND_ID:
+                        ret = wsm_scan_complete_indication(priv, &wsm_buf);
+                        break;
+                case 0x0808:
+                        ret = wsm_ba_timeout_indication(priv, &wsm_buf);
+                        break;
+                case 0x0809:
+                        ret = wsm_set_pm_indication(priv, &wsm_buf);
+                        break;
+                case 0x080A:
+                        ret = wsm_channel_switch_indication(priv, &wsm_buf);
+                        break;
+                case 0x080B:
+                        ret = wsm_find_complete_indication(priv, &wsm_buf);
+                        break;
+                case 0x080C:
+                        ret = wsm_suspend_resume_indication(priv,
+                                        link_id, &wsm_buf);
+                        break;
+                case 0x080F:
+                        ret = wsm_join_complete_indication(priv, &wsm_buf);
+                        break;
+                default:
+                        pr_warn("Unrecognised WSM ID %04x\n", id);
+                }
+        } else {
+                WARN_ON(1);
+                ret = -EINVAL;
+        }
+out:
+        return ret;
+}
+
+static bool wsm_handle_tx_data(struct cw1200_common *priv,
+                               struct wsm_tx *wsm,
+                               const struct ieee80211_tx_info *tx_info,
+                               const struct cw1200_txpriv *txpriv,
+                               struct cw1200_queue *queue)
+{
+        bool handled = false;
+        const struct ieee80211_hdr *frame =
+                (struct ieee80211_hdr *)&((u8 *)wsm)[txpriv->offset];
+        __le16 fctl = frame->frame_control;
+        enum {
+                do_probe,
+                do_drop,
+                do_wep,
+                do_tx,
+        } action = do_tx;
+
+        switch (priv->mode) {
+        case NL80211_IFTYPE_STATION:
+                if (priv->join_status == CW1200_JOIN_STATUS_MONITOR)
+                        action = do_tx;
+                else if (priv->join_status < CW1200_JOIN_STATUS_PRE_STA)
+                        action = do_drop;
+                break;
+        case NL80211_IFTYPE_AP:
+                if (!priv->join_status) {
+                        action = do_drop;
+                } else if (!(BIT(txpriv->raw_link_id) &
+                             (BIT(0) | priv->link_id_map))) {
+                        wiphy_warn(priv->hw->wiphy,
+                                   "A frame with expired link id is dropped.\n");
+                        action = do_drop;
+                }
+                if (cw1200_queue_get_generation(wsm->packet_id) >
+                                CW1200_MAX_REQUEUE_ATTEMPTS) {
+                        /* HACK!!! WSM324 firmware has tendency to requeue
+                         * multicast frames in a loop, causing performance
+                         * drop and high power consumption of the driver.
+                         * In this situation it is better just to drop
+                         * the problematic frame.
+                         */
+                        wiphy_warn(priv->hw->wiphy,
+                                   "Too many attempts to requeue a frame; dropped.\n");
+                        action = do_drop;
+                }
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                if (priv->join_status != CW1200_JOIN_STATUS_IBSS)
+                        action = do_drop;
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                action = do_tx; /* TODO:  Test me! */
+                break;
+        case NL80211_IFTYPE_MONITOR:
+        default:
+                action = do_drop;
+                break;
+        }
+
+        if (action == do_tx) {
+                if (ieee80211_is_nullfunc(fctl)) {
+                        spin_lock(&priv->bss_loss_lock);
+                        if (priv->bss_loss_state) {
+                                priv->bss_loss_confirm_id = wsm->packet_id;
+                                wsm->queue_id = WSM_QUEUE_VOICE;
+                        }
+                        spin_unlock(&priv->bss_loss_lock);
+                } else if (ieee80211_is_probe_req(fctl)) {
+                        action = do_probe;
+                } else if (ieee80211_is_deauth(fctl) &&
+                           priv->mode != NL80211_IFTYPE_AP) {
+                        pr_debug("[WSM] Issue unjoin command due to tx deauth.\n");
+                        wsm_lock_tx_async(priv);
+                        if (queue_work(priv->workqueue,
+                                       &priv->unjoin_work) <= 0)
+                                wsm_unlock_tx(priv);
+                } else if (ieee80211_has_protected(fctl) &&
+                           tx_info->control.hw_key &&
+                           tx_info->control.hw_key->keyidx != priv->wep_default_key_id &&
+                           (tx_info->control.hw_key->cipher == WLAN_CIPHER_SUITE_WEP40 ||
+                            tx_info->control.hw_key->cipher == WLAN_CIPHER_SUITE_WEP104)) {
+                        action = do_wep;
+                }
+        }
+
+        switch (action) {
+        case do_probe:
+                /* An interesting FW "feature". Device filters probe responses.
+                 * The easiest way to get it back is to convert
+                 * probe request into WSM start_scan command.
+                 */
+                pr_debug("[WSM] Convert probe request to scan.\n");
+                wsm_lock_tx_async(priv);
+                priv->pending_frame_id = __le32_to_cpu(wsm->packet_id);
+                if (queue_delayed_work(priv->workqueue,
+                                       &priv->scan.probe_work, 0) <= 0)
+                        wsm_unlock_tx(priv);
+                handled = true;
+                break;
+        case do_drop:
+                pr_debug("[WSM] Drop frame (0x%.4X).\n", fctl);
+                BUG_ON(cw1200_queue_remove(queue,
+                                           __le32_to_cpu(wsm->packet_id)));
+                handled = true;
+                break;
+        case do_wep:
+                pr_debug("[WSM] Issue set_default_wep_key.\n");
+                wsm_lock_tx_async(priv);
+                priv->wep_default_key_id = tx_info->control.hw_key->keyidx;
+                priv->pending_frame_id = __le32_to_cpu(wsm->packet_id);
+                if (queue_work(priv->workqueue, &priv->wep_key_work) <= 0)
+                        wsm_unlock_tx(priv);
+                handled = true;
+                break;
+        case do_tx:
+                pr_debug("[WSM] Transmit frame.\n");
+                break;
+        default:
+                /* Do nothing */
+                break;
+        }
+        return handled;
+}
+
+static int cw1200_get_prio_queue(struct cw1200_common *priv,
+                                 u32 link_id_map, int *total)
+{
+        static const int urgent = BIT(CW1200_LINK_ID_AFTER_DTIM) |
+                BIT(CW1200_LINK_ID_UAPSD);
+        struct wsm_edca_queue_params *edca;
+        unsigned score, best = -1;
+        int winner = -1;
+        int queued;
+        int i;
+
+        /* search for a winner using edca params */
+        for (i = 0; i < 4; ++i) {
+                queued = cw1200_queue_get_num_queued(&priv->tx_queue[i],
+                                link_id_map);
+                if (!queued)
+                        continue;
+                *total += queued;
+                edca = &priv->edca.params[i];
+                score = ((edca->aifns + edca->cwmin) << 16) +
+                        ((edca->cwmax - edca->cwmin) *
+                         (get_random_int() & 0xFFFF));
+                if (score < best && (winner < 0 || i != 3)) {
+                        best = score;
+                        winner = i;
+                }
+        }
+
+        /* override winner if bursting */
+        if (winner >= 0 && priv->tx_burst_idx >= 0 &&
+            winner != priv->tx_burst_idx &&
+            !cw1200_queue_get_num_queued(
+                    &priv->tx_queue[winner],
+                    link_id_map & urgent) &&
+            cw1200_queue_get_num_queued(
+                    &priv->tx_queue[priv->tx_burst_idx],
+                    link_id_map))
+                winner = priv->tx_burst_idx;
+
+        return winner;
+}
+
+static int wsm_get_tx_queue_and_mask(struct cw1200_common *priv,
+                                     struct cw1200_queue **queue_p,
+                                     u32 *tx_allowed_mask_p,
+                                     bool *more)
+{
+        int idx;
+        u32 tx_allowed_mask;
+        int total = 0;
+
+        /* Search for a queue with multicast frames buffered */
+        if (priv->tx_multicast) {
+                tx_allowed_mask = BIT(CW1200_LINK_ID_AFTER_DTIM);
+                idx = cw1200_get_prio_queue(priv,
+                                tx_allowed_mask, &total);
+                if (idx >= 0) {
+                        *more = total > 1;
+                        goto found;
+                }
+        }
+
+        /* Search for unicast traffic */
+        tx_allowed_mask = ~priv->sta_asleep_mask;
+        tx_allowed_mask |= BIT(CW1200_LINK_ID_UAPSD);
+        if (priv->sta_asleep_mask) {
+                tx_allowed_mask |= priv->pspoll_mask;
+                tx_allowed_mask &= ~BIT(CW1200_LINK_ID_AFTER_DTIM);
+        } else {
+                tx_allowed_mask |= BIT(CW1200_LINK_ID_AFTER_DTIM);
+        }
+        idx = cw1200_get_prio_queue(priv,
+                        tx_allowed_mask, &total);
+        if (idx < 0)
+                return -ENOENT;
+
+found:
+        *queue_p = &priv->tx_queue[idx];
+        *tx_allowed_mask_p = tx_allowed_mask;
+        return 0;
+}
+
+int wsm_get_tx(struct cw1200_common *priv, u8 **data,
+               size_t *tx_len, int *burst)
+{
+        struct wsm_tx *wsm = NULL;
+        struct ieee80211_tx_info *tx_info;
+        struct cw1200_queue *queue = NULL;
+        int queue_num;
+        u32 tx_allowed_mask = 0;
+        const struct cw1200_txpriv *txpriv = NULL;
+        int count = 0;
+
+        /* More is used only for broadcasts. */
+        bool more = false;
+
+        if (priv->wsm_cmd.ptr) { /* CMD request */
+                ++count;
+                spin_lock(&priv->wsm_cmd.lock);
+                BUG_ON(!priv->wsm_cmd.ptr);
+                *data = priv->wsm_cmd.ptr;
+                *tx_len = priv->wsm_cmd.len;
+                *burst = 1;
+                spin_unlock(&priv->wsm_cmd.lock);
+        } else {
+                for (;;) {
+                        int ret;
+
+                        if (atomic_add_return(0, &priv->tx_lock))
+                                break;
+
+                        spin_lock_bh(&priv->ps_state_lock);
+
+                        ret = wsm_get_tx_queue_and_mask(priv, &queue,
+                                                        &tx_allowed_mask, &more);
+                        queue_num = queue - priv->tx_queue;
+
+                        if (priv->buffered_multicasts &&
+                            (ret || !more) &&
+                            (priv->tx_multicast || !priv->sta_asleep_mask)) {
+                                priv->buffered_multicasts = false;
+                                if (priv->tx_multicast) {
+                                        priv->tx_multicast = false;
+                                        queue_work(priv->workqueue,
+                                                   &priv->multicast_stop_work);
+                                }
+                        }
+
+                        spin_unlock_bh(&priv->ps_state_lock);
+
+                        if (ret)
+                                break;
+
+                        if (cw1200_queue_get(queue,
+                                             tx_allowed_mask,
+                                             &wsm, &tx_info, &txpriv))
+                                continue;
+
+                        if (wsm_handle_tx_data(priv, wsm,
+                                               tx_info, txpriv, queue))
+                                continue;  /* Handled by WSM */
+
+                        wsm->hdr.id &= __cpu_to_le16(
+                                ~WSM_TX_LINK_ID(WSM_TX_LINK_ID_MAX));
+                        wsm->hdr.id |= cpu_to_le16(
+                                WSM_TX_LINK_ID(txpriv->raw_link_id));
+                        priv->pspoll_mask &= ~BIT(txpriv->raw_link_id);
+
+                        *data = (u8 *)wsm;
+                        *tx_len = __le16_to_cpu(wsm->hdr.len);
+
+                        /* allow bursting if txop is set */
+                        if (priv->edca.params[queue_num].txop_limit)
+                                *burst = min(*burst,
+                                             (int)cw1200_queue_get_num_queued(queue, tx_allowed_mask) + 1);
+                        else
+                                *burst = 1;
+
+                        /* store index of bursting queue */
+                        if (*burst > 1)
+                                priv->tx_burst_idx = queue_num;
+                        else
+                                priv->tx_burst_idx = -1;
+
+                        if (more) {
+                                struct ieee80211_hdr *hdr =
+                                        (struct ieee80211_hdr *)
+                                        &((u8 *)wsm)[txpriv->offset];
+                                /* more buffered multicast/broadcast frames
+                                 *  ==> set MoreData flag in IEEE 802.11 header
+                                 *  to inform PS STAs
+                                 */
+                                hdr->frame_control |=
+                                        cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                        }
+
+                        pr_debug("[WSM] >>> 0x%.4X (%zu) %p %c\n",
+                                 0x0004, *tx_len, *data,
+                                 wsm->more ? 'M' : ' ');
+                        ++count;
+                        break;
+                }
+        }
+
+        return count;
+}
+
+void wsm_txed(struct cw1200_common *priv, u8 *data)
+{
+        if (data == priv->wsm_cmd.ptr) {
+                spin_lock(&priv->wsm_cmd.lock);
+                priv->wsm_cmd.ptr = NULL;
+                spin_unlock(&priv->wsm_cmd.lock);
+        }
+}
+
+/* ******************************************************************** */
+/* WSM buffer                                                           */
+
+void wsm_buf_init(struct wsm_buf *buf)
+{
+        BUG_ON(buf->begin);
+        buf->begin = kmalloc(FWLOAD_BLOCK_SIZE, GFP_KERNEL | GFP_DMA);
+        buf->end = buf->begin ? &buf->begin[FWLOAD_BLOCK_SIZE] : buf->begin;
+        wsm_buf_reset(buf);
+}
+
+void wsm_buf_deinit(struct wsm_buf *buf)
+{
+        kfree(buf->begin);
+        buf->begin = buf->data = buf->end = NULL;
+}
+
+static void wsm_buf_reset(struct wsm_buf *buf)
+{
+        if (buf->begin) {
+                buf->data = &buf->begin[4];
+                *(u32 *)buf->begin = 0;
+        } else {
+                buf->data = buf->begin;
+        }
+}
+
+static int wsm_buf_reserve(struct wsm_buf *buf, size_t extra_size)
+{
+        size_t pos = buf->data - buf->begin;
+        size_t size = pos + extra_size;
+
+        size = round_up(size, FWLOAD_BLOCK_SIZE);
+
+        buf->begin = krealloc(buf->begin, size, GFP_KERNEL | GFP_DMA);
+        if (buf->begin) {
+                buf->data = &buf->begin[pos];
+                buf->end = &buf->begin[size];
+                return 0;
+        } else {
+                buf->end = buf->data = buf->begin;
+                return -ENOMEM;
+        }
+}
diff --git a/drivers/net/wireless/cw1200/wsm.h b/drivers/net/wireless/cw1200/wsm.h
new file mode 100644
index 000000000000..2816171f7a1d
--- /dev/null
+++ b/drivers/net/wireless/cw1200/wsm.h
@@ -0,0 +1,1873 @@
+/*
+ * WSM host interface (HI) interface for ST-Ericsson CW1200 mac80211 drivers
+ *
+ * Copyright (c) 2010, ST-Ericsson
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@lockless.no>
+ *
+ * Based on CW1200 UMAC WSM API, which is
+ * Copyright (C) ST-Ericsson SA 2010
+ * Author: Stewart Mathers <stewart.mathers@stericsson.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef CW1200_WSM_H_INCLUDED
+#define CW1200_WSM_H_INCLUDED
+
+#include <linux/spinlock.h>
+
+struct cw1200_common;
+
+/* Bands */
+/* Radio band 2.412 -2.484 GHz. */
+#define WSM_PHY_BAND_2_4G               (0)
+
+/* Radio band 4.9375-5.8250 GHz. */
+#define WSM_PHY_BAND_5G                 (1)
+
+/* Transmit rates */
+/* 1   Mbps            ERP-DSSS */
+#define WSM_TRANSMIT_RATE_1             (0)
+
+/* 2   Mbps            ERP-DSSS */
+#define WSM_TRANSMIT_RATE_2             (1)
+
+/* 5.5 Mbps            ERP-CCK */
+#define WSM_TRANSMIT_RATE_5             (2)
+
+/* 11  Mbps            ERP-CCK */
+#define WSM_TRANSMIT_RATE_11            (3)
+
+/* 22  Mbps            ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_22         (4) */
+
+/* 33  Mbps            ERP-PBCC (Not supported) */
+/* #define WSM_TRANSMIT_RATE_33         (5) */
+
+/* 6   Mbps   (3 Mbps) ERP-OFDM, BPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_6             (6)
+
+/* 9   Mbps (4.5 Mbps) ERP-OFDM, BPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_9             (7)
+
+/* 12  Mbps  (6 Mbps)  ERP-OFDM, QPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_12            (8)
+
+/* 18  Mbps  (9 Mbps)  ERP-OFDM, QPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_18            (9)
+
+/* 24  Mbps (12 Mbps)  ERP-OFDM, 16QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_24            (10)
+
+/* 36  Mbps (18 Mbps)  ERP-OFDM, 16QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_36            (11)
+
+/* 48  Mbps (24 Mbps)  ERP-OFDM, 64QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_48            (12)
+
+/* 54  Mbps (27 Mbps)  ERP-OFDM, 64QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_54            (13)
+
+/* 6.5 Mbps            HT-OFDM, BPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_6          (14)
+
+/* 13  Mbps            HT-OFDM, QPSK coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_13         (15)
+
+/* 19.5 Mbps           HT-OFDM, QPSK coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_19         (16)
+
+/* 26  Mbps            HT-OFDM, 16QAM coding rate 1/2 */
+#define WSM_TRANSMIT_RATE_HT_26         (17)
+
+/* 39  Mbps            HT-OFDM, 16QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_39         (18)
+
+/* 52  Mbps            HT-OFDM, 64QAM coding rate 2/3 */
+#define WSM_TRANSMIT_RATE_HT_52         (19)
+
+/* 58.5 Mbps           HT-OFDM, 64QAM coding rate 3/4 */
+#define WSM_TRANSMIT_RATE_HT_58         (20)
+
+/* 65  Mbps            HT-OFDM, 64QAM coding rate 5/6 */
+#define WSM_TRANSMIT_RATE_HT_65         (21)
+
+/* Scan types */
+/* Foreground scan */
+#define WSM_SCAN_TYPE_FOREGROUND        (0)
+
+/* Background scan */
+#define WSM_SCAN_TYPE_BACKGROUND        (1)
+
+/* Auto scan */
+#define WSM_SCAN_TYPE_AUTO              (2)
+
+/* Scan flags */
+/* Forced background scan means if the station cannot */
+/* enter the power-save mode, it shall force to perform a */
+/* background scan. Only valid when ScanType is */
+/* background scan. */
+#define WSM_SCAN_FLAG_FORCE_BACKGROUND  (BIT(0))
+
+/* The WLAN device scans one channel at a time so */
+/* that disturbance to the data traffic is minimized. */
+#define WSM_SCAN_FLAG_SPLIT_METHOD      (BIT(1))
+
+/* Preamble Type. Long if not set. */
+#define WSM_SCAN_FLAG_SHORT_PREAMBLE    (BIT(2))
+
+/* 11n Tx Mode. Mixed if not set. */
+#define WSM_SCAN_FLAG_11N_GREENFIELD    (BIT(3))
+
+/* Scan constraints */
+/* Maximum number of channels to be scanned. */
+#define WSM_SCAN_MAX_NUM_OF_CHANNELS    (48)
+
+/* The maximum number of SSIDs that the device can scan for. */
+#define WSM_SCAN_MAX_NUM_OF_SSIDS       (2)
+
+/* Power management modes */
+/* 802.11 Active mode */
+#define WSM_PSM_ACTIVE                  (0)
+
+/* 802.11 PS mode */
+#define WSM_PSM_PS                      BIT(0)
+
+/* Fast Power Save bit */
+#define WSM_PSM_FAST_PS_FLAG            BIT(7)
+
+/* Dynamic aka Fast power save */
+#define WSM_PSM_FAST_PS                 (BIT(0) | BIT(7))
+
+/* Undetermined */
+/* Note : Undetermined status is reported when the */
+/* NULL data frame used to advertise the PM mode to */
+/* the AP at Pre or Post Background Scan is not Acknowledged */
+#define WSM_PSM_UNKNOWN                 BIT(1)
+
+/* Queue IDs */
+/* best effort/legacy */
+#define WSM_QUEUE_BEST_EFFORT           (0)
+
+/* background */
+#define WSM_QUEUE_BACKGROUND            (1)
+
+/* video */
+#define WSM_QUEUE_VIDEO                 (2)
+
+/* voice */
+#define WSM_QUEUE_VOICE                 (3)
+
+/* HT TX parameters */
+/* Non-HT */
+#define WSM_HT_TX_NON_HT                (0)
+
+/* Mixed format */
+#define WSM_HT_TX_MIXED                 (1)
+
+/* Greenfield format */
+#define WSM_HT_TX_GREENFIELD            (2)
+
+/* STBC allowed */
+#define WSM_HT_TX_STBC                  (BIT(7))
+
+/* EPTA prioirty flags for BT Coex */
+/* default epta priority */
+#define WSM_EPTA_PRIORITY_DEFAULT       4
+/* use for normal data */
+#define WSM_EPTA_PRIORITY_DATA          4
+/* use for connect/disconnect/roaming*/
+#define WSM_EPTA_PRIORITY_MGT           5
+/* use for action frames */
+#define WSM_EPTA_PRIORITY_ACTION        5
+/* use for AC_VI data */
+#define WSM_EPTA_PRIORITY_VIDEO         5
+/* use for AC_VO data */
+#define WSM_EPTA_PRIORITY_VOICE         6
+/* use for EAPOL exchange */
+#define WSM_EPTA_PRIORITY_EAPOL         7
+
+/* TX status */
+/* Frame was sent aggregated */
+/* Only valid for WSM_SUCCESS status. */
+#define WSM_TX_STATUS_AGGREGATION       (BIT(0))
+
+/* Host should requeue this frame later. */
+/* Valid only when status is WSM_REQUEUE. */
+#define WSM_TX_STATUS_REQUEUE           (BIT(1))
+
+/* Normal Ack */
+#define WSM_TX_STATUS_NORMAL_ACK        (0<<2)
+
+/* No Ack */
+#define WSM_TX_STATUS_NO_ACK            (1<<2)
+
+/* No explicit acknowledgement */
+#define WSM_TX_STATUS_NO_EXPLICIT_ACK   (2<<2)
+
+/* Block Ack */
+/* Only valid for WSM_SUCCESS status. */
+#define WSM_TX_STATUS_BLOCK_ACK         (3<<2)
+
+/* RX status */
+/* Unencrypted */
+#define WSM_RX_STATUS_UNENCRYPTED       (0<<0)
+
+/* WEP */
+#define WSM_RX_STATUS_WEP               (1<<0)
+
+/* TKIP */
+#define WSM_RX_STATUS_TKIP              (2<<0)
+
+/* AES */
+#define WSM_RX_STATUS_AES               (3<<0)
+
+/* WAPI */
+#define WSM_RX_STATUS_WAPI              (4<<0)
+
+/* Macro to fetch encryption subfield. */
+#define WSM_RX_STATUS_ENCRYPTION(status) ((status) & 0x07)
+
+/* Frame was part of an aggregation */
+#define WSM_RX_STATUS_AGGREGATE         (BIT(3))
+
+/* Frame was first in the aggregation */
+#define WSM_RX_STATUS_AGGREGATE_FIRST   (BIT(4))
+
+/* Frame was last in the aggregation */
+#define WSM_RX_STATUS_AGGREGATE_LAST    (BIT(5))
+
+/* Indicates a defragmented frame */
+#define WSM_RX_STATUS_DEFRAGMENTED      (BIT(6))
+
+/* Indicates a Beacon frame */
+#define WSM_RX_STATUS_BEACON            (BIT(7))
+
+/* Indicates STA bit beacon TIM field */
+#define WSM_RX_STATUS_TIM               (BIT(8))
+
+/* Indicates Beacon frame's virtual bitmap contains multicast bit */
+#define WSM_RX_STATUS_MULTICAST         (BIT(9))
+
+/* Indicates frame contains a matching SSID */
+#define WSM_RX_STATUS_MATCHING_SSID     (BIT(10))
+
+/* Indicates frame contains a matching BSSI */
+#define WSM_RX_STATUS_MATCHING_BSSI     (BIT(11))
+
+/* Indicates More bit set in Framectl field */
+#define WSM_RX_STATUS_MORE_DATA         (BIT(12))
+
+/* Indicates frame received during a measurement process */
+#define WSM_RX_STATUS_MEASUREMENT       (BIT(13))
+
+/* Indicates frame received as an HT packet */
+#define WSM_RX_STATUS_HT                (BIT(14))
+
+/* Indicates frame received with STBC */
+#define WSM_RX_STATUS_STBC              (BIT(15))
+
+/* Indicates Address 1 field matches dot11StationId */
+#define WSM_RX_STATUS_ADDRESS1          (BIT(16))
+
+/* Indicates Group address present in the Address 1 field */
+#define WSM_RX_STATUS_GROUP             (BIT(17))
+
+/* Indicates Broadcast address present in the Address 1 field */
+#define WSM_RX_STATUS_BROADCAST         (BIT(18))
+
+/* Indicates group key used with encrypted frames */
+#define WSM_RX_STATUS_GROUP_KEY         (BIT(19))
+
+/* Macro to fetch encryption key index. */
+#define WSM_RX_STATUS_KEY_IDX(status)   (((status >> 20)) & 0x0F)
+
+/* Indicates TSF inclusion after 802.11 frame body */
+#define WSM_RX_STATUS_TSF_INCLUDED      (BIT(24))
+
+/* Frame Control field starts at Frame offset + 2 */
+#define WSM_TX_2BYTES_SHIFT             (BIT(7))
+
+/* Join mode */
+/* IBSS */
+#define WSM_JOIN_MODE_IBSS              (0)
+
+/* BSS */
+#define WSM_JOIN_MODE_BSS               (1)
+
+/* PLCP preamble type */
+/* For long preamble */
+#define WSM_JOIN_PREAMBLE_LONG          (0)
+
+/* For short preamble (Long for 1Mbps) */
+#define WSM_JOIN_PREAMBLE_SHORT         (1)
+
+/* For short preamble (Long for 1 and 2Mbps) */
+#define WSM_JOIN_PREAMBLE_SHORT_2       (2)
+
+/* Join flags */
+/* Unsynchronized */
+#define WSM_JOIN_FLAGS_UNSYNCRONIZED    BIT(0)
+/* The BSS owner is a P2P GO */
+#define WSM_JOIN_FLAGS_P2P_GO           BIT(1)
+/* Force to join BSS with the BSSID and the
+ * SSID specified without waiting for beacons. The
+ * ProbeForJoin parameter is ignored.
+ */
+#define WSM_JOIN_FLAGS_FORCE            BIT(2)
+/* Give probe request/response higher
+ * priority over the BT traffic
+ */
+#define WSM_JOIN_FLAGS_PRIO             BIT(3)
+/* Issue immediate join confirmation and use
+ * join complete to notify about completion
+ */
+#define WSM_JOIN_FLAGS_FORCE_WITH_COMPLETE_IND BIT(5)
+
+/* Key types */
+#define WSM_KEY_TYPE_WEP_DEFAULT        (0)
+#define WSM_KEY_TYPE_WEP_PAIRWISE       (1)
+#define WSM_KEY_TYPE_TKIP_GROUP         (2)
+#define WSM_KEY_TYPE_TKIP_PAIRWISE      (3)
+#define WSM_KEY_TYPE_AES_GROUP          (4)
+#define WSM_KEY_TYPE_AES_PAIRWISE       (5)
+#define WSM_KEY_TYPE_WAPI_GROUP         (6)
+#define WSM_KEY_TYPE_WAPI_PAIRWISE      (7)
+
+/* Key indexes */
+#define WSM_KEY_MAX_INDEX               (10)
+
+/* ACK policy */
+#define WSM_ACK_POLICY_NORMAL           (0)
+#define WSM_ACK_POLICY_NO_ACK           (1)
+
+/* Start modes */
+#define WSM_START_MODE_AP               (0)     /* Mini AP */
+#define WSM_START_MODE_P2P_GO           (1)     /* P2P GO */
+#define WSM_START_MODE_P2P_DEV          (2)     /* P2P device */
+
+/* SetAssociationMode MIB flags */
+#define WSM_ASSOCIATION_MODE_USE_PREAMBLE_TYPE          (BIT(0))
+#define WSM_ASSOCIATION_MODE_USE_HT_MODE                (BIT(1))
+#define WSM_ASSOCIATION_MODE_USE_BASIC_RATE_SET         (BIT(2))
+#define WSM_ASSOCIATION_MODE_USE_MPDU_START_SPACING     (BIT(3))
+#define WSM_ASSOCIATION_MODE_SNOOP_ASSOC_FRAMES         (BIT(4))
+
+/* RcpiRssiThreshold MIB flags */
+#define WSM_RCPI_RSSI_THRESHOLD_ENABLE  (BIT(0))
+#define WSM_RCPI_RSSI_USE_RSSI          (BIT(1))
+#define WSM_RCPI_RSSI_DONT_USE_UPPER    (BIT(2))
+#define WSM_RCPI_RSSI_DONT_USE_LOWER    (BIT(3))
+
+/* Update-ie constants */
+#define WSM_UPDATE_IE_BEACON            (BIT(0))
+#define WSM_UPDATE_IE_PROBE_RESP        (BIT(1))
+#define WSM_UPDATE_IE_PROBE_REQ         (BIT(2))
+
+/* WSM events */
+/* Error */
+#define WSM_EVENT_ERROR                 (0)
+
+/* BSS lost */
+#define WSM_EVENT_BSS_LOST              (1)
+
+/* BSS regained */
+#define WSM_EVENT_BSS_REGAINED          (2)
+
+/* Radar detected */
+#define WSM_EVENT_RADAR_DETECTED        (3)
+
+/* RCPI or RSSI threshold triggered */
+#define WSM_EVENT_RCPI_RSSI             (4)
+
+/* BT inactive */
+#define WSM_EVENT_BT_INACTIVE           (5)
+
+/* BT active */
+#define WSM_EVENT_BT_ACTIVE             (6)
+
+/* MIB IDs */
+/* 4.1  dot11StationId */
+#define WSM_MIB_ID_DOT11_STATION_ID             0x0000
+
+/* 4.2  dot11MaxtransmitMsduLifeTime */
+#define WSM_MIB_ID_DOT11_MAX_TRANSMIT_LIFTIME   0x0001
+
+/* 4.3  dot11MaxReceiveLifeTime */
+#define WSM_MIB_ID_DOT11_MAX_RECEIVE_LIFETIME   0x0002
+
+/* 4.4  dot11SlotTime */
+#define WSM_MIB_ID_DOT11_SLOT_TIME              0x0003
+
+/* 4.5  dot11GroupAddressesTable */
+#define WSM_MIB_ID_DOT11_GROUP_ADDRESSES_TABLE  0x0004
+#define WSM_MAX_GRP_ADDRTABLE_ENTRIES           8
+
+/* 4.6  dot11WepDefaultKeyId */
+#define WSM_MIB_ID_DOT11_WEP_DEFAULT_KEY_ID     0x0005
+
+/* 4.7  dot11CurrentTxPowerLevel */
+#define WSM_MIB_ID_DOT11_CURRENT_TX_POWER_LEVEL 0x0006
+
+/* 4.8  dot11RTSThreshold */
+#define WSM_MIB_ID_DOT11_RTS_THRESHOLD          0x0007
+
+/* 4.9  NonErpProtection */
+#define WSM_MIB_ID_NON_ERP_PROTECTION           0x1000
+
+/* 4.10 ArpIpAddressesTable */
+#define WSM_MIB_ID_ARP_IP_ADDRESSES_TABLE       0x1001
+#define WSM_MAX_ARP_IP_ADDRTABLE_ENTRIES        1
+
+/* 4.11 TemplateFrame */
+#define WSM_MIB_ID_TEMPLATE_FRAME               0x1002
+
+/* 4.12 RxFilter */
+#define WSM_MIB_ID_RX_FILTER                    0x1003
+
+/* 4.13 BeaconFilterTable */
+#define WSM_MIB_ID_BEACON_FILTER_TABLE          0x1004
+
+/* 4.14 BeaconFilterEnable */
+#define WSM_MIB_ID_BEACON_FILTER_ENABLE         0x1005
+
+/* 4.15 OperationalPowerMode */
+#define WSM_MIB_ID_OPERATIONAL_POWER_MODE       0x1006
+
+/* 4.16 BeaconWakeUpPeriod */
+#define WSM_MIB_ID_BEACON_WAKEUP_PERIOD         0x1007
+
+/* 4.17 RcpiRssiThreshold */
+#define WSM_MIB_ID_RCPI_RSSI_THRESHOLD          0x1009
+
+/* 4.18 StatisticsTable */
+#define WSM_MIB_ID_STATISTICS_TABLE             0x100A
+
+/* 4.19 IbssPsConfig */
+#define WSM_MIB_ID_IBSS_PS_CONFIG               0x100B
+
+/* 4.20 CountersTable */
+#define WSM_MIB_ID_COUNTERS_TABLE               0x100C
+
+/* 4.21 BlockAckPolicy */
+#define WSM_MIB_ID_BLOCK_ACK_POLICY             0x100E
+
+/* 4.22 OverrideInternalTxRate */
+#define WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE    0x100F
+
+/* 4.23 SetAssociationMode */
+#define WSM_MIB_ID_SET_ASSOCIATION_MODE         0x1010
+
+/* 4.24 UpdateEptaConfigData */
+#define WSM_MIB_ID_UPDATE_EPTA_CONFIG_DATA      0x1011
+
+/* 4.25 SelectCcaMethod */
+#define WSM_MIB_ID_SELECT_CCA_METHOD            0x1012
+
+/* 4.26 SetUpasdInformation */
+#define WSM_MIB_ID_SET_UAPSD_INFORMATION        0x1013
+
+/* 4.27 SetAutoCalibrationMode  WBF00004073 */
+#define WSM_MIB_ID_SET_AUTO_CALIBRATION_MODE    0x1015
+
+/* 4.28 SetTxRateRetryPolicy */
+#define WSM_MIB_ID_SET_TX_RATE_RETRY_POLICY     0x1016
+
+/* 4.29 SetHostMessageTypeFilter */
+#define WSM_MIB_ID_SET_HOST_MSG_TYPE_FILTER     0x1017
+
+/* 4.30 P2PFindInfo */
+#define WSM_MIB_ID_P2P_FIND_INFO                0x1018
+
+/* 4.31 P2PPsModeInfo */
+#define WSM_MIB_ID_P2P_PS_MODE_INFO             0x1019
+
+/* 4.32 SetEtherTypeDataFrameFilter */
+#define WSM_MIB_ID_SET_ETHERTYPE_DATAFRAME_FILTER 0x101A
+
+/* 4.33 SetUDPPortDataFrameFilter */
+#define WSM_MIB_ID_SET_UDPPORT_DATAFRAME_FILTER 0x101B
+
+/* 4.34 SetMagicDataFrameFilter */
+#define WSM_MIB_ID_SET_MAGIC_DATAFRAME_FILTER   0x101C
+
+/* 4.35 P2PDeviceInfo */
+#define WSM_MIB_ID_P2P_DEVICE_INFO              0x101D
+
+/* 4.36 SetWCDMABand */
+#define WSM_MIB_ID_SET_WCDMA_BAND               0x101E
+
+/* 4.37 GroupTxSequenceCounter */
+#define WSM_MIB_ID_GRP_SEQ_COUNTER              0x101F
+
+/* 4.38 ProtectedMgmtPolicy */
+#define WSM_MIB_ID_PROTECTED_MGMT_POLICY        0x1020
+
+/* 4.39 SetHtProtection */
+#define WSM_MIB_ID_SET_HT_PROTECTION            0x1021
+
+/* 4.40 GPIO Command */
+#define WSM_MIB_ID_GPIO_COMMAND                 0x1022
+
+/* 4.41 TSF Counter Value */
+#define WSM_MIB_ID_TSF_COUNTER                  0x1023
+
+/* Test Purposes Only */
+#define WSM_MIB_ID_BLOCK_ACK_INFO               0x100D
+
+/* 4.42 UseMultiTxConfMessage */
+#define WSM_MIB_USE_MULTI_TX_CONF               0x1024
+
+/* 4.43 Keep-alive period */
+#define WSM_MIB_ID_KEEP_ALIVE_PERIOD            0x1025
+
+/* 4.44 Disable BSSID filter */
+#define WSM_MIB_ID_DISABLE_BSSID_FILTER         0x1026
+
+/* Frame template types */
+#define WSM_FRAME_TYPE_PROBE_REQUEST    (0)
+#define WSM_FRAME_TYPE_BEACON           (1)
+#define WSM_FRAME_TYPE_NULL             (2)
+#define WSM_FRAME_TYPE_QOS_NULL         (3)
+#define WSM_FRAME_TYPE_PS_POLL          (4)
+#define WSM_FRAME_TYPE_PROBE_RESPONSE   (5)
+
+#define WSM_FRAME_GREENFIELD            (0x80)  /* See 4.11 */
+
+/* Status */
+/* The WSM firmware has completed a request */
+/* successfully. */
+#define WSM_STATUS_SUCCESS              (0)
+
+/* This is a generic failure code if other error codes do */
+/* not apply. */
+#define WSM_STATUS_FAILURE              (1)
+
+/* A request contains one or more invalid parameters. */
+#define WSM_INVALID_PARAMETER           (2)
+
+/* The request cannot perform because the device is in */
+/* an inappropriate mode. */
+#define WSM_ACCESS_DENIED               (3)
+
+/* The frame received includes a decryption error. */
+#define WSM_STATUS_DECRYPTFAILURE       (4)
+
+/* A MIC failure is detected in the received packets. */
+#define WSM_STATUS_MICFAILURE           (5)
+
+/* The transmit request failed due to retry limit being */
+/* exceeded. */
+#define WSM_STATUS_RETRY_EXCEEDED       (6)
+
+/* The transmit request failed due to MSDU life time */
+/* being exceeded. */
+#define WSM_STATUS_TX_LIFETIME_EXCEEDED (7)
+
+/* The link to the AP is lost. */
+#define WSM_STATUS_LINK_LOST            (8)
+
+/* No key was found for the encrypted frame */
+#define WSM_STATUS_NO_KEY_FOUND         (9)
+
+/* Jammer was detected when transmitting this frame */
+#define WSM_STATUS_JAMMER_DETECTED      (10)
+
+/* The message should be requeued later. */
+/* This is applicable only to Transmit */
+#define WSM_REQUEUE                     (11)
+
+/* Advanced filtering options */
+#define WSM_MAX_FILTER_ELEMENTS         (4)
+
+#define WSM_FILTER_ACTION_IGNORE        (0)
+#define WSM_FILTER_ACTION_FILTER_IN     (1)
+#define WSM_FILTER_ACTION_FILTER_OUT    (2)
+
+#define WSM_FILTER_PORT_TYPE_DST        (0)
+#define WSM_FILTER_PORT_TYPE_SRC        (1)
+
+/* Actual header of WSM messages */
+struct wsm_hdr {
+        __le16 len;
+        __le16 id;
+};
+
+#define WSM_TX_SEQ_MAX                  (7)
+#define WSM_TX_SEQ(seq)                 \
+                ((seq & WSM_TX_SEQ_MAX) << 13)
+#define WSM_TX_LINK_ID_MAX              (0x0F)
+#define WSM_TX_LINK_ID(link_id)         \
+                ((link_id & WSM_TX_LINK_ID_MAX) << 6)
+
+#define MAX_BEACON_SKIP_TIME_MS 1000
+
+#define WSM_CMD_LAST_CHANCE_TIMEOUT (HZ * 3 / 2)
+
+/* ******************************************************************** */
+/* WSM capability                                                       */
+
+#define WSM_STARTUP_IND_ID 0x0801
+
+struct wsm_startup_ind {
+        u16 input_buffers;
+        u16 input_buffer_size;
+        u16 status;
+        u16 hw_id;
+        u16 hw_subid;
+        u16 fw_cap;
+        u16 fw_type;
+        u16 fw_api;
+        u16 fw_build;
+        u16 fw_ver;
+        char fw_label[128];
+        u32 config[4];
+};
+
+/* ******************************************************************** */
+/* WSM commands                                                         */
+
+/* 3.1 */
+#define WSM_CONFIGURATION_REQ_ID 0x0009
+#define WSM_CONFIGURATION_RESP_ID 0x0409
+
+struct wsm_tx_power_range {
+        int min_power_level;
+        int max_power_level;
+        u32 stepping;
+};
+
+struct wsm_configuration {
+        /* [in] */ u32 dot11MaxTransmitMsduLifeTime;
+        /* [in] */ u32 dot11MaxReceiveLifeTime;
+        /* [in] */ u32 dot11RtsThreshold;
+        /* [in, out] */ u8 *dot11StationId;
+        /* [in] */ const void *dpdData;
+        /* [in] */ size_t dpdData_size;
+        /* [out] */ u8 dot11FrequencyBandsSupported;
+        /* [out] */ u32 supportedRateMask;
+        /* [out] */ struct wsm_tx_power_range txPowerRange[2];
+};
+
+int wsm_configuration(struct cw1200_common *priv,
+                      struct wsm_configuration *arg);
+
+/* 3.3 */
+#define WSM_RESET_REQ_ID 0x000A
+#define WSM_RESET_RESP_ID 0x040A
+struct wsm_reset {
+        /* [in] */ int link_id;
+        /* [in] */ bool reset_statistics;
+};
+
+int wsm_reset(struct cw1200_common *priv, const struct wsm_reset *arg);
+
+/* 3.5 */
+#define WSM_READ_MIB_REQ_ID 0x0005
+#define WSM_READ_MIB_RESP_ID 0x0405
+int wsm_read_mib(struct cw1200_common *priv, u16 mib_id, void *buf,
+                 size_t buf_size);
+
+/* 3.7 */
+#define WSM_WRITE_MIB_REQ_ID 0x0006
+#define WSM_WRITE_MIB_RESP_ID 0x0406
+int wsm_write_mib(struct cw1200_common *priv, u16 mib_id, void *buf,
+                  size_t buf_size);
+
+/* 3.9 */
+#define WSM_START_SCAN_REQ_ID 0x0007
+#define WSM_START_SCAN_RESP_ID 0x0407
+
+struct wsm_ssid {
+        u8 ssid[32];
+        u32 length;
+};
+
+struct wsm_scan_ch {
+        u16 number;
+        u32 min_chan_time;
+        u32 max_chan_time;
+        u32 tx_power_level;
+};
+
+struct wsm_scan {
+        /* WSM_PHY_BAND_... */
+        u8 band;
+
+        /* WSM_SCAN_TYPE_... */
+        u8 type;
+
+        /* WSM_SCAN_FLAG_... */
+        u8 flags;
+
+        /* WSM_TRANSMIT_RATE_... */
+        u8 max_tx_rate;
+
+        /* Interval period in TUs that the device shall the re- */
+        /* execute the requested scan. Max value supported by the device */
+        /* is 256s. */
+        u32 auto_scan_interval;
+
+        /* Number of probe requests (per SSID) sent to one (1) */
+        /* channel. Zero (0) means that none is send, which */
+        /* means that a passive scan is to be done. Value */
+        /* greater than zero (0) means that an active scan is to */
+        /* be done. */
+        u32 num_probes;
+
+        /* Number of channels to be scanned. */
+        /* Maximum value is WSM_SCAN_MAX_NUM_OF_CHANNELS. */
+        u8 num_channels;
+
+        /* Number of SSID provided in the scan command (this */
+        /* is zero (0) in broadcast scan) */
+        /* The maximum number of SSIDs is WSM_SCAN_MAX_NUM_OF_SSIDS. */
+        u8 num_ssids;
+
+        /* The delay time (in microseconds) period */
+        /* before sending a probe-request. */
+        u8 probe_delay;
+
+        /* SSIDs to be scanned [numOfSSIDs]; */
+        struct wsm_ssid *ssids;
+
+        /* Channels to be scanned [numOfChannels]; */
+        struct wsm_scan_ch *ch;
+};
+
+int wsm_scan(struct cw1200_common *priv, const struct wsm_scan *arg);
+
+/* 3.11 */
+#define WSM_STOP_SCAN_REQ_ID 0x0008
+#define WSM_STOP_SCAN_RESP_ID 0x0408
+int wsm_stop_scan(struct cw1200_common *priv);
+
+/* 3.13 */
+#define WSM_SCAN_COMPLETE_IND_ID 0x0806
+struct wsm_scan_complete {
+        /* WSM_STATUS_... */
+        u32 status;
+
+        /* WSM_PSM_... */
+        u8 psm;
+
+        /* Number of channels that the scan operation completed. */
+        u8 num_channels;
+};
+
+/* 3.14 */
+#define WSM_TX_CONFIRM_IND_ID 0x0404
+#define WSM_MULTI_TX_CONFIRM_ID 0x041E
+
+struct wsm_tx_confirm {
+        /* Packet identifier used in wsm_tx. */
+        u32 packet_id;
+
+        /* WSM_STATUS_... */
+        u32 status;
+
+        /* WSM_TRANSMIT_RATE_... */
+        u8 tx_rate;
+
+        /* The number of times the frame was transmitted */
+        /* without receiving an acknowledgement. */
+        u8 ack_failures;
+
+        /* WSM_TX_STATUS_... */
+        u16 flags;
+
+        /* The total time in microseconds that the frame spent in */
+        /* the WLAN device before transmission as completed. */
+        u32 media_delay;
+
+        /* The total time in microseconds that the frame spent in */
+        /* the WLAN device before transmission was started. */
+        u32 tx_queue_delay;
+};
+
+/* 3.15 */
+typedef void (*wsm_tx_confirm_cb) (struct cw1200_common *priv,
+                                   struct wsm_tx_confirm *arg);
+
+/* Note that ideology of wsm_tx struct is different against the rest of
+ * WSM API. wsm_hdr is /not/ a caller-adapted struct to be used as an input
+ * argument for WSM call, but a prepared bytestream to be sent to firmware.
+ * It is filled partly in cw1200_tx, partly in low-level WSM code.
+ * Please pay attention once again: ideology is different.
+ *
+ * Legend:
+ * - [in]: cw1200_tx must fill this field.
+ * - [wsm]: the field is filled by low-level WSM.
+ */
+struct wsm_tx {
+        /* common WSM header */
+        struct wsm_hdr hdr;
+
+        /* Packet identifier that meant to be used in completion. */
+        __le32 packet_id;
+
+        /* WSM_TRANSMIT_RATE_... */
+        u8 max_tx_rate;
+
+        /* WSM_QUEUE_... */
+        u8 queue_id;
+
+        /* True: another packet is pending on the host for transmission. */
+        u8 more;
+
+        /* Bit 0 = 0 - Start expiry time from first Tx attempt (default) */
+        /* Bit 0 = 1 - Start expiry time from receipt of Tx Request */
+        /* Bits 3:1  - PTA Priority */
+        /* Bits 6:4  - Tx Rate Retry Policy */
+        /* Bit 7 - Reserved */
+        u8 flags;
+
+        /* Should be 0. */
+        __le32 reserved;
+
+        /* The elapsed time in TUs, after the initial transmission */
+        /* of an MSDU, after which further attempts to transmit */
+        /* the MSDU shall be terminated. Overrides the global */
+        /* dot11MaxTransmitMsduLifeTime setting [optional] */
+        /* Device will set the default value if this is 0. */
+        __le32 expire_time;
+
+        /* WSM_HT_TX_... */
+        __le32 ht_tx_parameters;
+};
+
+/* = sizeof(generic hi hdr) + sizeof(wsm hdr) + sizeof(alignment) */
+#define WSM_TX_EXTRA_HEADROOM (28)
+
+/* 3.16 */
+#define WSM_RECEIVE_IND_ID 0x0804
+
+struct wsm_rx {
+        /* WSM_STATUS_... */
+        __le32 status;
+
+        /* Specifies the channel of the received packet. */
+        __le16 channel_number;
+
+        /* WSM_TRANSMIT_RATE_... */
+        u8 rx_rate;
+
+        /* This value is expressed in signed Q8.0 format for */
+        /* RSSI and unsigned Q7.1 format for RCPI. */
+        u8 rcpi_rssi;
+
+        /* WSM_RX_STATUS_... */
+        __le32 flags;
+
+        /* Payload */
+        u8 data[0];
+} __packed;
+
+/* = sizeof(generic hi hdr) + sizeof(wsm hdr) */
+#define WSM_RX_EXTRA_HEADROOM (16)
+
+typedef void (*wsm_rx_cb) (struct cw1200_common *priv, struct wsm_rx *arg,
+                           struct sk_buff **skb_p);
+
+/* 3.17 */
+struct wsm_event {
+        /* WSM_STATUS_... */
+        /* [out] */ u32 id;
+
+        /* Indication parameters. */
+        /* For error indication, this shall be a 32-bit WSM status. */
+        /* For RCPI or RSSI indication, this should be an 8-bit */
+        /* RCPI or RSSI value. */
+        /* [out] */ u32 data;
+};
+
+struct cw1200_wsm_event {
+        struct list_head link;
+        struct wsm_event evt;
+};
+
+/* 3.18 - 3.22 */
+/* Measurement. Skipped for now. Irrelevent. */
+
+typedef void (*wsm_event_cb) (struct cw1200_common *priv,
+                              struct wsm_event *arg);
+
+/* 3.23 */
+#define WSM_JOIN_REQ_ID 0x000B
+#define WSM_JOIN_RESP_ID 0x040B
+
+struct wsm_join {
+        /* WSM_JOIN_MODE_... */
+        u8 mode;
+
+        /* WSM_PHY_BAND_... */
+        u8 band;
+
+        /* Specifies the channel number to join. The channel */
+        /* number will be mapped to an actual frequency */
+        /* according to the band */
+        u16 channel_number;
+
+        /* Specifies the BSSID of the BSS or IBSS to be joined */
+        /* or the IBSS to be started. */
+        u8 bssid[6];
+
+        /* ATIM window of IBSS */
+        /* When ATIM window is zero the initiated IBSS does */
+        /* not support power saving. */
+        u16 atim_window;
+
+        /* WSM_JOIN_PREAMBLE_... */
+        u8 preamble_type;
+
+        /* Specifies if a probe request should be send with the */
+        /* specified SSID when joining to the network. */
+        u8 probe_for_join;
+
+        /* DTIM Period (In multiples of beacon interval) */
+        u8 dtim_period;
+
+        /* WSM_JOIN_FLAGS_... */
+        u8 flags;
+
+        /* Length of the SSID */
+        u32 ssid_len;
+
+        /* Specifies the SSID of the IBSS to join or start */
+        u8 ssid[32];
+
+        /* Specifies the time between TBTTs in TUs */
+        u32 beacon_interval;
+
+        /* A bit mask that defines the BSS basic rate set. */
+        u32 basic_rate_set;
+};
+
+struct wsm_join_cnf {
+        u32 status;
+
+        /* Minimum transmission power level in units of 0.1dBm */
+        u32 min_power_level;
+
+        /* Maximum transmission power level in units of 0.1dBm */
+        u32 max_power_level;
+};
+
+int wsm_join(struct cw1200_common *priv, struct wsm_join *arg);
+
+/* 3.24 */
+struct wsm_join_complete {
+        /* WSM_STATUS_... */
+        u32 status;
+};
+
+/* 3.25 */
+#define WSM_SET_PM_REQ_ID 0x0010
+#define WSM_SET_PM_RESP_ID 0x0410
+struct wsm_set_pm {
+        /* WSM_PSM_... */
+        u8 mode;
+
+        /* in unit of 500us; 0 to use default */
+        u8 fast_psm_idle_period;
+
+        /* in unit of 500us; 0 to use default */
+        u8 ap_psm_change_period;
+
+        /* in unit of 500us; 0 to disable auto-pspoll */
+        u8 min_auto_pspoll_period;
+};
+
+int wsm_set_pm(struct cw1200_common *priv, const struct wsm_set_pm *arg);
+
+/* 3.27 */
+struct wsm_set_pm_complete {
+        u8 psm;                 /* WSM_PSM_... */
+};
+
+/* 3.28 */
+#define WSM_SET_BSS_PARAMS_REQ_ID 0x0011
+#define WSM_SET_BSS_PARAMS_RESP_ID 0x0411
+struct wsm_set_bss_params {
+        /* This resets the beacon loss counters only */
+        u8 reset_beacon_loss;
+
+        /* The number of lost consecutive beacons after which */
+        /* the WLAN device should indicate the BSS-Lost event */
+        /* to the WLAN host driver. */
+        u8 beacon_lost_count;
+
+        /* The AID received during the association process. */
+        u16 aid;
+
+        /* The operational rate set mask */
+        u32 operational_rate_set;
+};
+
+int wsm_set_bss_params(struct cw1200_common *priv,
+                       const struct wsm_set_bss_params *arg);
+
+/* 3.30 */
+#define WSM_ADD_KEY_REQ_ID         0x000C
+#define WSM_ADD_KEY_RESP_ID        0x040C
+struct wsm_add_key {
+        u8 type;                /* WSM_KEY_TYPE_... */
+        u8 index;               /* Key entry index: 0 -- WSM_KEY_MAX_INDEX */
+        u16 reserved;
+        union {
+                struct {
+                        u8 peer[6];     /* MAC address of the peer station */
+                        u8 reserved;
+                        u8 keylen;              /* Key length in bytes */
+                        u8 keydata[16];         /* Key data */
+                } __packed wep_pairwise;
+                struct {
+                        u8 keyid;       /* Unique per key identifier (0..3) */
+                        u8 keylen;              /* Key length in bytes */
+                        u16 reserved;
+                        u8 keydata[16];         /* Key data */
+                } __packed wep_group;
+                struct {
+                        u8 peer[6];     /* MAC address of the peer station */
+                        u16 reserved;
+                        u8 keydata[16]; /* TKIP key data */
+                        u8 rx_mic_key[8];               /* Rx MIC key */
+                        u8 tx_mic_key[8];               /* Tx MIC key */
+                } __packed tkip_pairwise;
+                struct {
+                        u8 keydata[16]; /* TKIP key data */
+                        u8 rx_mic_key[8];               /* Rx MIC key */
+                        u8 keyid;               /* Key ID */
+                        u8 reserved[3];
+                        u8 rx_seqnum[8];        /* Receive Sequence Counter */
+                } __packed tkip_group;
+                struct {
+                        u8 peer[6];     /* MAC address of the peer station */
+                        u16 reserved;
+                        u8 keydata[16]; /* AES key data */
+                } __packed aes_pairwise;
+                struct {
+                        u8 keydata[16]; /* AES key data */
+                        u8 keyid;               /* Key ID */
+                        u8 reserved[3];
+                        u8 rx_seqnum[8];        /* Receive Sequence Counter */
+                } __packed aes_group;
+                struct {
+                        u8 peer[6];     /* MAC address of the peer station */
+                        u8 keyid;               /* Key ID */
+                        u8 reserved;
+                        u8 keydata[16]; /* WAPI key data */
+                        u8 mic_key[16]; /* MIC key data */
+                } __packed wapi_pairwise;
+                struct {
+                        u8 keydata[16]; /* WAPI key data */
+                        u8 mic_key[16]; /* MIC key data */
+                        u8 keyid;               /* Key ID */
+                        u8 reserved[3];
+                } __packed wapi_group;
+        } __packed;
+} __packed;
+
+int wsm_add_key(struct cw1200_common *priv, const struct wsm_add_key *arg);
+
+/* 3.32 */
+#define WSM_REMOVE_KEY_REQ_ID         0x000D
+#define WSM_REMOVE_KEY_RESP_ID        0x040D
+struct wsm_remove_key {
+        u8 index; /* Key entry index : 0-10 */
+};
+
+int wsm_remove_key(struct cw1200_common *priv,
+                   const struct wsm_remove_key *arg);
+
+/* 3.34 */
+struct wsm_set_tx_queue_params {
+        /* WSM_ACK_POLICY_... */
+        u8 ackPolicy;
+
+        /* Medium Time of TSPEC (in 32us units) allowed per */
+        /* One Second Averaging Period for this queue. */
+        u16 allowedMediumTime;
+
+        /* dot11MaxTransmitMsduLifetime to be used for the */
+        /* specified queue. */
+        u32 maxTransmitLifetime;
+};
+
+struct wsm_tx_queue_params {
+        /* NOTE: index is a linux queue id. */
+        struct wsm_set_tx_queue_params params[4];
+};
+
+
+#define WSM_TX_QUEUE_SET(queue_params, queue, ack_policy, allowed_time,\
+                max_life_time)  \
+do {                                                    \
+        struct wsm_set_tx_queue_params *p = &(queue_params)->params[queue]; \
+        p->ackPolicy = (ack_policy);                            \
+        p->allowedMediumTime = (allowed_time);                          \
+        p->maxTransmitLifetime = (max_life_time);                       \
+} while (0)
+
+int wsm_set_tx_queue_params(struct cw1200_common *priv,
+                            const struct wsm_set_tx_queue_params *arg, u8 id);
+
+/* 3.36 */
+#define WSM_EDCA_PARAMS_REQ_ID 0x0013
+#define WSM_EDCA_PARAMS_RESP_ID 0x0413
+struct wsm_edca_queue_params {
+        /* CWmin (in slots) for the access class. */
+        __le16 cwmin;
+
+        /* CWmax (in slots) for the access class. */
+        __le16 cwmax;
+
+        /* AIFS (in slots) for the access class. */
+        __le16 aifns;
+
+        /* TX OP Limit (in microseconds) for the access class. */
+        __le16 txop_limit;
+
+        /* dot11MaxReceiveLifetime to be used for the specified */
+        /* the access class. Overrides the global */
+        /* dot11MaxReceiveLifetime value */
+        __le32 max_rx_lifetime;
+} __packed;
+
+struct wsm_edca_params {
+        /* NOTE: index is a linux queue id. */
+        struct wsm_edca_queue_params params[4];
+        bool uapsd_enable[4];
+};
+
+#define TXOP_UNIT 32
+#define WSM_EDCA_SET(__edca, __queue, __aifs, __cw_min, __cw_max, __txop, __lifetime,\
+                     __uapsd) \
+        do {                                                    \
+                struct wsm_edca_queue_params *p = &(__edca)->params[__queue]; \
+                p->cwmin = (__cw_min);                          \
+                p->cwmax = (__cw_max);                          \
+                p->aifns = (__aifs);                            \
+                p->txop_limit = ((__txop) * TXOP_UNIT);         \
+                p->max_rx_lifetime = (__lifetime);              \
+                (__edca)->uapsd_enable[__queue] = (__uapsd);    \
+        } while (0)
+
+int wsm_set_edca_params(struct cw1200_common *priv,
+                        const struct wsm_edca_params *arg);
+
+int wsm_set_uapsd_param(struct cw1200_common *priv,
+                        const struct wsm_edca_params *arg);
+
+/* 3.38 */
+/* Set-System info. Skipped for now. Irrelevent. */
+
+/* 3.40 */
+#define WSM_SWITCH_CHANNEL_REQ_ID 0x0016
+#define WSM_SWITCH_CHANNEL_RESP_ID 0x0416
+
+struct wsm_switch_channel {
+        /* 1 - means the STA shall not transmit any further */
+        /* frames until the channel switch has completed */
+        u8 mode;
+
+        /* Number of TBTTs until channel switch occurs. */
+        /* 0 - indicates switch shall occur at any time */
+        /* 1 - occurs immediately before the next TBTT */
+        u8 switch_count;
+
+        /* The new channel number to switch to. */
+        /* Note this is defined as per section 2.7. */
+        u16 channel_number;
+};
+
+int wsm_switch_channel(struct cw1200_common *priv,
+                       const struct wsm_switch_channel *arg);
+
+typedef void (*wsm_channel_switch_cb) (struct cw1200_common *priv);
+
+#define WSM_START_REQ_ID 0x0017
+#define WSM_START_RESP_ID 0x0417
+
+struct wsm_start {
+        /* WSM_START_MODE_... */
+        /* [in] */ u8 mode;
+
+        /* WSM_PHY_BAND_... */
+        /* [in] */ u8 band;
+
+        /* Channel number */
+        /* [in] */ u16 channel_number;
+
+        /* Client Traffic window in units of TU */
+        /* Valid only when mode == ..._P2P */
+        /* [in] */ u32 ct_window;
+
+        /* Interval between two consecutive */
+        /* beacon transmissions in TU. */
+        /* [in] */ u32 beacon_interval;
+
+        /* DTIM period in terms of beacon intervals */
+        /* [in] */ u8 dtim_period;
+
+        /* WSM_JOIN_PREAMBLE_... */
+        /* [in] */ u8 preamble;
+
+        /* The delay time (in microseconds) period */
+        /* before sending a probe-request. */
+        /* [in] */ u8 probe_delay;
+
+        /* Length of the SSID */
+        /* [in] */ u8 ssid_len;
+
+        /* SSID of the BSS or P2P_GO to be started now. */
+        /* [in] */ u8 ssid[32];
+
+        /* The basic supported rates for the MiniAP. */
+        /* [in] */ u32 basic_rate_set;
+};
+
+int wsm_start(struct cw1200_common *priv, const struct wsm_start *arg);
+
+#define WSM_BEACON_TRANSMIT_REQ_ID 0x0018
+#define WSM_BEACON_TRANSMIT_RESP_ID 0x0418
+
+struct wsm_beacon_transmit {
+        /* 1: enable; 0: disable */
+        /* [in] */ u8 enable_beaconing;
+};
+
+int wsm_beacon_transmit(struct cw1200_common *priv,
+                        const struct wsm_beacon_transmit *arg);
+
+int wsm_start_find(struct cw1200_common *priv);
+
+int wsm_stop_find(struct cw1200_common *priv);
+
+typedef void (*wsm_find_complete_cb) (struct cw1200_common *priv, u32 status);
+
+struct wsm_suspend_resume {
+        /* See 3.52 */
+        /* Link ID */
+        /* [out] */ int link_id;
+        /* Stop sending further Tx requests down to device for this link */
+        /* [out] */ bool stop;
+        /* Transmit multicast Frames */
+        /* [out] */ bool multicast;
+        /* The AC on which Tx to be suspended /resumed. */
+        /* This is applicable only for U-APSD */
+        /* WSM_QUEUE_... */
+        /* [out] */ int queue;
+};
+
+typedef void (*wsm_suspend_resume_cb) (struct cw1200_common *priv,
+                                       struct wsm_suspend_resume *arg);
+
+/* 3.54 Update-IE request. */
+struct wsm_update_ie {
+        /* WSM_UPDATE_IE_... */
+        /* [in] */ u16 what;
+        /* [in] */ u16 count;
+        /* [in] */ u8 *ies;
+        /* [in] */ size_t length;
+};
+
+int wsm_update_ie(struct cw1200_common *priv,
+                  const struct wsm_update_ie *arg);
+
+/* 3.56 */
+struct wsm_map_link {
+        /* MAC address of the remote device */
+        /* [in] */ u8 mac_addr[6];
+        /* [in] */ u8 link_id;
+};
+
+int wsm_map_link(struct cw1200_common *priv, const struct wsm_map_link *arg);
+
+/* ******************************************************************** */
+/* MIB shortcats                                                        */
+
+static inline int wsm_set_output_power(struct cw1200_common *priv,
+                                       int power_level)
+{
+        __le32 val = __cpu_to_le32(power_level);
+        return wsm_write_mib(priv, WSM_MIB_ID_DOT11_CURRENT_TX_POWER_LEVEL,
+                             &val, sizeof(val));
+}
+
+static inline int wsm_set_beacon_wakeup_period(struct cw1200_common *priv,
+                                               unsigned dtim_interval,
+                                               unsigned listen_interval)
+{
+        struct {
+                u8 numBeaconPeriods;
+                u8 reserved;
+                __le16 listenInterval;
+        } val = {
+                dtim_interval, 0, __cpu_to_le16(listen_interval)
+        };
+
+        if (dtim_interval > 0xFF || listen_interval > 0xFFFF)
+                return -EINVAL;
+        else
+                return wsm_write_mib(priv, WSM_MIB_ID_BEACON_WAKEUP_PERIOD,
+                                     &val, sizeof(val));
+}
+
+struct wsm_rcpi_rssi_threshold {
+        u8 rssiRcpiMode;        /* WSM_RCPI_RSSI_... */
+        u8 lowerThreshold;
+        u8 upperThreshold;
+        u8 rollingAverageCount;
+};
+
+static inline int wsm_set_rcpi_rssi_threshold(struct cw1200_common *priv,
+                                        struct wsm_rcpi_rssi_threshold *arg)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_RCPI_RSSI_THRESHOLD, arg,
+                             sizeof(*arg));
+}
+
+struct wsm_mib_counters_table {
+        __le32 plcp_errors;
+        __le32 fcs_errors;
+        __le32 tx_packets;
+        __le32 rx_packets;
+        __le32 rx_packet_errors;
+        __le32 rx_decryption_failures;
+        __le32 rx_mic_failures;
+        __le32 rx_no_key_failures;
+        __le32 tx_multicast_frames;
+        __le32 tx_frames_success;
+        __le32 tx_frame_failures;
+        __le32 tx_frames_retried;
+        __le32 tx_frames_multi_retried;
+        __le32 rx_frame_duplicates;
+        __le32 rts_success;
+        __le32 rts_failures;
+        __le32 ack_failures;
+        __le32 rx_multicast_frames;
+        __le32 rx_frames_success;
+        __le32 rx_cmac_icv_errors;
+        __le32 rx_cmac_replays;
+        __le32 rx_mgmt_ccmp_replays;
+} __packed;
+
+static inline int wsm_get_counters_table(struct cw1200_common *priv,
+                                         struct wsm_mib_counters_table *arg)
+{
+        return wsm_read_mib(priv, WSM_MIB_ID_COUNTERS_TABLE,
+                            arg, sizeof(*arg));
+}
+
+static inline int wsm_get_station_id(struct cw1200_common *priv, u8 *mac)
+{
+        return wsm_read_mib(priv, WSM_MIB_ID_DOT11_STATION_ID, mac, ETH_ALEN);
+}
+
+struct wsm_rx_filter {
+        bool promiscuous;
+        bool bssid;
+        bool fcs;
+        bool probeResponder;
+};
+
+static inline int wsm_set_rx_filter(struct cw1200_common *priv,
+                                    const struct wsm_rx_filter *arg)
+{
+        __le32 val = 0;
+        if (arg->promiscuous)
+                val |= __cpu_to_le32(BIT(0));
+        if (arg->bssid)
+                val |= __cpu_to_le32(BIT(1));
+        if (arg->fcs)
+                val |= __cpu_to_le32(BIT(2));
+        if (arg->probeResponder)
+                val |= __cpu_to_le32(BIT(3));
+        return wsm_write_mib(priv, WSM_MIB_ID_RX_FILTER, &val, sizeof(val));
+}
+
+int wsm_set_probe_responder(struct cw1200_common *priv, bool enable);
+
+#define WSM_BEACON_FILTER_IE_HAS_CHANGED        BIT(0)
+#define WSM_BEACON_FILTER_IE_NO_LONGER_PRESENT  BIT(1)
+#define WSM_BEACON_FILTER_IE_HAS_APPEARED       BIT(2)
+
+struct wsm_beacon_filter_table_entry {
+        u8      ie_id;
+        u8      flags;
+        u8      oui[3];
+        u8      match_data[3];
+} __packed;
+
+struct wsm_mib_beacon_filter_table {
+        __le32 num;
+        struct wsm_beacon_filter_table_entry entry[10];
+} __packed;
+
+static inline int wsm_set_beacon_filter_table(struct cw1200_common *priv,
+                                              struct wsm_mib_beacon_filter_table *ft)
+{
+        size_t size = __le32_to_cpu(ft->num) *
+                     sizeof(struct wsm_beacon_filter_table_entry) +
+                     sizeof(__le32);
+
+        return wsm_write_mib(priv, WSM_MIB_ID_BEACON_FILTER_TABLE, ft, size);
+}
+
+#define WSM_BEACON_FILTER_ENABLE        BIT(0) /* Enable/disable beacon filtering */
+#define WSM_BEACON_FILTER_AUTO_ERP      BIT(1) /* If 1 FW will handle ERP IE changes internally */
+
+struct wsm_beacon_filter_control {
+        int enabled;
+        int bcn_count;
+};
+
+static inline int wsm_beacon_filter_control(struct cw1200_common *priv,
+                                        struct wsm_beacon_filter_control *arg)
+{
+        struct {
+                __le32 enabled;
+                __le32 bcn_count;
+        } val;
+        val.enabled = __cpu_to_le32(arg->enabled);
+        val.bcn_count = __cpu_to_le32(arg->bcn_count);
+        return wsm_write_mib(priv, WSM_MIB_ID_BEACON_FILTER_ENABLE, &val,
+                             sizeof(val));
+}
+
+enum wsm_power_mode {
+        wsm_power_mode_active = 0,
+        wsm_power_mode_doze = 1,
+        wsm_power_mode_quiescent = 2,
+};
+
+struct wsm_operational_mode {
+        enum wsm_power_mode power_mode;
+        int disable_more_flag_usage;
+        int perform_ant_diversity;
+};
+
+static inline int wsm_set_operational_mode(struct cw1200_common *priv,
+                                        const struct wsm_operational_mode *arg)
+{
+        u8 val = arg->power_mode;
+        if (arg->disable_more_flag_usage)
+                val |= BIT(4);
+        if (arg->perform_ant_diversity)
+                val |= BIT(5);
+        return wsm_write_mib(priv, WSM_MIB_ID_OPERATIONAL_POWER_MODE, &val,
+                             sizeof(val));
+}
+
+struct wsm_template_frame {
+        u8 frame_type;
+        u8 rate;
+        struct sk_buff *skb;
+};
+
+static inline int wsm_set_template_frame(struct cw1200_common *priv,
+                                         struct wsm_template_frame *arg)
+{
+        int ret;
+        u8 *p = skb_push(arg->skb, 4);
+        p[0] = arg->frame_type;
+        p[1] = arg->rate;
+        ((u16 *)p)[1] = __cpu_to_le16(arg->skb->len - 4);
+        ret = wsm_write_mib(priv, WSM_MIB_ID_TEMPLATE_FRAME, p, arg->skb->len);
+        skb_pull(arg->skb, 4);
+        return ret;
+}
+
+
+struct wsm_protected_mgmt_policy {
+        bool protectedMgmtEnable;
+        bool unprotectedMgmtFramesAllowed;
+        bool encryptionForAuthFrame;
+};
+
+static inline int wsm_set_protected_mgmt_policy(struct cw1200_common *priv,
+                struct wsm_protected_mgmt_policy *arg)
+{
+        __le32 val = 0;
+        int ret;
+        if (arg->protectedMgmtEnable)
+                val |= __cpu_to_le32(BIT(0));
+        if (arg->unprotectedMgmtFramesAllowed)
+                val |= __cpu_to_le32(BIT(1));
+        if (arg->encryptionForAuthFrame)
+                val |= __cpu_to_le32(BIT(2));
+        ret = wsm_write_mib(priv, WSM_MIB_ID_PROTECTED_MGMT_POLICY,
+                        &val, sizeof(val));
+        return ret;
+}
+
+struct wsm_mib_block_ack_policy {
+        u8 tx_tid;
+        u8 reserved1;
+        u8 rx_tid;
+        u8 reserved2;
+} __packed;
+
+static inline int wsm_set_block_ack_policy(struct cw1200_common *priv,
+                                           u8 tx_tid_policy,
+                                           u8 rx_tid_policy)
+{
+        struct wsm_mib_block_ack_policy val = {
+                .tx_tid = tx_tid_policy,
+                .rx_tid = rx_tid_policy,
+        };
+        return wsm_write_mib(priv, WSM_MIB_ID_BLOCK_ACK_POLICY, &val,
+                             sizeof(val));
+}
+
+struct wsm_mib_association_mode {
+        u8 flags;               /* WSM_ASSOCIATION_MODE_... */
+        u8 preamble;    /* WSM_JOIN_PREAMBLE_... */
+        u8 greenfield;  /* 1 for greenfield */
+        u8 mpdu_start_spacing;
+        __le32 basic_rate_set;
+} __packed;
+
+static inline int wsm_set_association_mode(struct cw1200_common *priv,
+                                           struct wsm_mib_association_mode *arg)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_SET_ASSOCIATION_MODE, arg,
+                             sizeof(*arg));
+}
+
+#define WSM_TX_RATE_POLICY_FLAG_TERMINATE_WHEN_FINISHED BIT(2)
+#define WSM_TX_RATE_POLICY_FLAG_COUNT_INITIAL_TRANSMIT BIT(3)
+struct wsm_tx_rate_retry_policy {
+        u8 index;
+        u8 short_retries;
+        u8 long_retries;
+        /* BIT(2) - Terminate retries when Tx rate retry policy
+         *          finishes.
+         * BIT(3) - Count initial frame transmission as part of
+         *          rate retry counting but not as a retry
+         *          attempt
+         */
+        u8 flags;
+        u8 rate_recoveries;
+        u8 reserved[3];
+        __le32 rate_count_indices[3];
+} __packed;
+
+struct wsm_set_tx_rate_retry_policy {
+        u8 num;
+        u8 reserved[3];
+        struct wsm_tx_rate_retry_policy tbl[8];
+} __packed;
+
+static inline int wsm_set_tx_rate_retry_policy(struct cw1200_common *priv,
+                                struct wsm_set_tx_rate_retry_policy *arg)
+{
+        size_t size = 4 + arg->num * sizeof(struct wsm_tx_rate_retry_policy);
+        return wsm_write_mib(priv, WSM_MIB_ID_SET_TX_RATE_RETRY_POLICY, arg,
+                             size);
+}
+
+/* 4.32 SetEtherTypeDataFrameFilter */
+struct wsm_ether_type_filter_hdr {
+        u8 num;         /* Up to WSM_MAX_FILTER_ELEMENTS */
+        u8 reserved[3];
+} __packed;
+
+struct wsm_ether_type_filter {
+        u8 action;      /* WSM_FILTER_ACTION_XXX */
+        u8 reserved;
+        __le16 type;    /* Type of ethernet frame */
+} __packed;
+
+static inline int wsm_set_ether_type_filter(struct cw1200_common *priv,
+                                struct wsm_ether_type_filter_hdr *arg)
+{
+        size_t size = sizeof(struct wsm_ether_type_filter_hdr) +
+                arg->num * sizeof(struct wsm_ether_type_filter);
+        return wsm_write_mib(priv, WSM_MIB_ID_SET_ETHERTYPE_DATAFRAME_FILTER,
+                arg, size);
+}
+
+/* 4.33 SetUDPPortDataFrameFilter */
+struct wsm_udp_port_filter_hdr {
+        u8 num;         /* Up to WSM_MAX_FILTER_ELEMENTS */
+        u8 reserved[3];
+} __packed;
+
+struct wsm_udp_port_filter {
+        u8 action;      /* WSM_FILTER_ACTION_XXX */
+        u8 type;                /* WSM_FILTER_PORT_TYPE_XXX */
+        __le16 port;            /* Port number */
+} __packed;
+
+static inline int wsm_set_udp_port_filter(struct cw1200_common *priv,
+                                struct wsm_udp_port_filter_hdr *arg)
+{
+        size_t size = sizeof(struct wsm_udp_port_filter_hdr) +
+                arg->num * sizeof(struct wsm_udp_port_filter);
+        return wsm_write_mib(priv, WSM_MIB_ID_SET_UDPPORT_DATAFRAME_FILTER,
+                arg, size);
+}
+
+/* Undocumented MIBs: */
+/* 4.35 P2PDeviceInfo */
+#define D11_MAX_SSID_LEN                (32)
+
+struct wsm_p2p_device_type {
+        __le16 category_id;
+        u8 oui[4];
+        __le16 subcategory_id;
+} __packed;
+
+struct wsm_p2p_device_info {
+        struct wsm_p2p_device_type primaryDevice;
+        u8 reserved1[3];
+        u8 devname_size;
+        u8 local_devname[D11_MAX_SSID_LEN];
+        u8 reserved2[3];
+        u8 num_secdev_supported;
+        struct wsm_p2p_device_type secdevs[0];
+} __packed;
+
+/* 4.36 SetWCDMABand - WO */
+struct wsm_cdma_band {
+        u8 wcdma_band;
+        u8 reserved[3];
+} __packed;
+
+/* 4.37 GroupTxSequenceCounter - RO */
+struct wsm_group_tx_seq {
+        __le32 bits_47_16;
+        __le16 bits_15_00;
+        __le16 reserved;
+} __packed;
+
+/* 4.39 SetHtProtection - WO */
+#define WSM_DUAL_CTS_PROT_ENB           (1 << 0)
+#define WSM_NON_GREENFIELD_STA_PRESENT  (1 << 1)
+#define WSM_HT_PROT_MODE__NO_PROT       (0 << 2)
+#define WSM_HT_PROT_MODE__NON_MEMBER    (1 << 2)
+#define WSM_HT_PROT_MODE__20_MHZ        (2 << 2)
+#define WSM_HT_PROT_MODE__NON_HT_MIXED  (3 << 2)
+#define WSM_LSIG_TXOP_PROT_FULL         (1 << 4)
+#define WSM_LARGE_L_LENGTH_PROT         (1 << 5)
+
+struct wsm_ht_protection {
+        __le32 flags;
+} __packed;
+
+/* 4.40 GPIO Command - R/W */
+#define WSM_GPIO_COMMAND_SETUP  0
+#define WSM_GPIO_COMMAND_READ   1
+#define WSM_GPIO_COMMAND_WRITE  2
+#define WSM_GPIO_COMMAND_RESET  3
+#define WSM_GPIO_ALL_PINS       0xFF
+
+struct wsm_gpio_command {
+        u8 command;
+        u8 pin;
+        __le16 config;
+} __packed;
+
+/* 4.41 TSFCounter - RO */
+struct wsm_tsf_counter {
+        __le64 tsf_counter;
+} __packed;
+
+/* 4.43 Keep alive period */
+struct wsm_keep_alive_period {
+        __le16 period;
+        u8 reserved[2];
+} __packed;
+
+static inline int wsm_keep_alive_period(struct cw1200_common *priv,
+                                        int period)
+{
+        struct wsm_keep_alive_period arg = {
+                .period = __cpu_to_le16(period),
+        };
+        return wsm_write_mib(priv, WSM_MIB_ID_KEEP_ALIVE_PERIOD,
+                        &arg, sizeof(arg));
+};
+
+/* BSSID filtering */
+struct wsm_set_bssid_filtering {
+        u8 filter;
+        u8 reserved[3];
+} __packed;
+
+static inline int wsm_set_bssid_filtering(struct cw1200_common *priv,
+                                          bool enabled)
+{
+        struct wsm_set_bssid_filtering arg = {
+                .filter = !enabled,
+        };
+        return wsm_write_mib(priv, WSM_MIB_ID_DISABLE_BSSID_FILTER,
+                        &arg, sizeof(arg));
+}
+
+/* Multicast filtering - 4.5 */
+struct wsm_mib_multicast_filter {
+        __le32 enable;
+        __le32 num_addrs;
+        u8 macaddrs[WSM_MAX_GRP_ADDRTABLE_ENTRIES][ETH_ALEN];
+} __packed;
+
+static inline int wsm_set_multicast_filter(struct cw1200_common *priv,
+                                           struct wsm_mib_multicast_filter *fp)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_DOT11_GROUP_ADDRESSES_TABLE,
+                             fp, sizeof(*fp));
+}
+
+/* ARP IPv4 filtering - 4.10 */
+struct wsm_mib_arp_ipv4_filter {
+        __le32 enable;
+        __be32 ipv4addrs[WSM_MAX_ARP_IP_ADDRTABLE_ENTRIES];
+} __packed;
+
+static inline int wsm_set_arp_ipv4_filter(struct cw1200_common *priv,
+                                          struct wsm_mib_arp_ipv4_filter *fp)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_ARP_IP_ADDRESSES_TABLE,
+                            fp, sizeof(*fp));
+}
+
+/* P2P Power Save Mode Info - 4.31 */
+struct wsm_p2p_ps_modeinfo {
+        u8      opp_ps_ct_window;
+        u8      count;
+        u8      reserved;
+        u8      dtim_count;
+        __le32  duration;
+        __le32  interval;
+        __le32  start_time;
+} __packed;
+
+static inline int wsm_set_p2p_ps_modeinfo(struct cw1200_common *priv,
+                                          struct wsm_p2p_ps_modeinfo *mi)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_P2P_PS_MODE_INFO,
+                             mi, sizeof(*mi));
+}
+
+static inline int wsm_get_p2p_ps_modeinfo(struct cw1200_common *priv,
+                                          struct wsm_p2p_ps_modeinfo *mi)
+{
+        return wsm_read_mib(priv, WSM_MIB_ID_P2P_PS_MODE_INFO,
+                            mi, sizeof(*mi));
+}
+
+/* UseMultiTxConfMessage */
+
+static inline int wsm_use_multi_tx_conf(struct cw1200_common *priv,
+                                        bool enabled)
+{
+        __le32 arg = enabled ? __cpu_to_le32(1) : 0;
+
+        return wsm_write_mib(priv, WSM_MIB_USE_MULTI_TX_CONF,
+                        &arg, sizeof(arg));
+}
+
+
+/* 4.26 SetUpasdInformation */
+struct wsm_uapsd_info {
+        __le16 uapsd_flags;
+        __le16 min_auto_trigger_interval;
+        __le16 max_auto_trigger_interval;
+        __le16 auto_trigger_step;
+};
+
+static inline int wsm_set_uapsd_info(struct cw1200_common *priv,
+                                     struct wsm_uapsd_info *arg)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_SET_UAPSD_INFORMATION,
+                                arg, sizeof(*arg));
+}
+
+/* 4.22 OverrideInternalTxRate */
+struct wsm_override_internal_txrate {
+        u8 internalTxRate;
+        u8 nonErpInternalTxRate;
+        u8 reserved[2];
+} __packed;
+
+static inline int wsm_set_override_internal_txrate(struct cw1200_common *priv,
+                                     struct wsm_override_internal_txrate *arg)
+{
+        return wsm_write_mib(priv, WSM_MIB_ID_OVERRIDE_INTERNAL_TX_RATE,
+                                arg, sizeof(*arg));
+}
+
+/* ******************************************************************** */
+/* WSM TX port control                                                  */
+
+void wsm_lock_tx(struct cw1200_common *priv);
+void wsm_lock_tx_async(struct cw1200_common *priv);
+bool wsm_flush_tx(struct cw1200_common *priv);
+void wsm_unlock_tx(struct cw1200_common *priv);
+
+/* ******************************************************************** */
+/* WSM / BH API                                                         */
+
+int wsm_handle_exception(struct cw1200_common *priv, u8 *data, size_t len);
+int wsm_handle_rx(struct cw1200_common *priv, u16 id, struct wsm_hdr *wsm,
+                  struct sk_buff **skb_p);
+
+/* ******************************************************************** */
+/* wsm_buf API                                                          */
+
+struct wsm_buf {
+        u8 *begin;
+        u8 *data;
+        u8 *end;
+};
+
+void wsm_buf_init(struct wsm_buf *buf);
+void wsm_buf_deinit(struct wsm_buf *buf);
+
+/* ******************************************************************** */
+/* wsm_cmd API                                                          */
+
+struct wsm_cmd {
+        spinlock_t lock; /* Protect structure from multiple access */
+        int done;
+        u8 *ptr;
+        size_t len;
+        void *arg;
+        int ret;
+        u16 cmd;
+};
+
+/* ******************************************************************** */
+/* WSM TX buffer access                                                 */
+
+int wsm_get_tx(struct cw1200_common *priv, u8 **data,
+               size_t *tx_len, int *burst);
+void wsm_txed(struct cw1200_common *priv, u8 *data);
+
+/* ******************************************************************** */
+/* Queue mapping: WSM <---> linux                                       */
+/* Linux: VO VI BE BK                                                   */
+/* WSM:   BE BK VI VO                                                   */
+
+static inline u8 wsm_queue_id_to_linux(u8 queue_id)
+{
+        static const u8 queue_mapping[] = {
+                2, 3, 1, 0
+        };
+        return queue_mapping[queue_id];
+}
+
+static inline u8 wsm_queue_id_to_wsm(u8 queue_id)
+{
+        static const u8 queue_mapping[] = {
+                3, 2, 0, 1
+        };
+        return queue_mapping[queue_id];
+}
+
+#endif /* CW1200_HWIO_H_INCLUDED */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index 15920aaa5dd6..f8ab193009cd 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -6242,8 +6242,6 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
         if ((val & 0x0000ff00) != 0)
                 pci_write_config_dword(pci_dev, 0x40, val & 0xffff00ff);
 
-        pci_set_power_state(pci_dev, PCI_D0);
-
         if (!ipw2100_hw_is_adapter_in_system(dev)) {
                 printk(KERN_WARNING DRV_NAME
                        "Device not found via register read.\n");
diff --git a/drivers/net/wireless/iwlegacy/commands.h b/drivers/net/wireless/iwlegacy/commands.h
index 3b6c99400892..048421511988 100644
--- a/drivers/net/wireless/iwlegacy/commands.h
+++ b/drivers/net/wireless/iwlegacy/commands.h
@@ -1348,14 +1348,6 @@ struct il_rx_mpdu_res_start {
 #define TX_CMD_SEC_KEY128       0x08
 
 /*
- * security overhead sizes
- */
-#define WEP_IV_LEN 4
-#define WEP_ICV_LEN 4
-#define CCMP_MIC_LEN 8
-#define TKIP_ICV_LEN 4
-
-/*
  * C_TX = 0x1c (command)
  */
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 48545ab00311..de2c9514bef6 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -76,13 +76,16 @@
 #define IWL_INVALID_STATION     255
 
 /* device operations */
-extern struct iwl_lib_ops iwl1000_lib;
-extern struct iwl_lib_ops iwl2000_lib;
-extern struct iwl_lib_ops iwl2030_lib;
-extern struct iwl_lib_ops iwl5000_lib;
-extern struct iwl_lib_ops iwl5150_lib;
-extern struct iwl_lib_ops iwl6000_lib;
-extern struct iwl_lib_ops iwl6030_lib;
+extern const struct iwl_dvm_cfg iwl_dvm_1000_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_2000_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_105_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_2030_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_5000_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_5150_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_6000_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_6005_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_6050_cfg;
+extern const struct iwl_dvm_cfg iwl_dvm_6030_cfg;
 
 
 #define TIME_UNIT               1024
@@ -291,8 +294,8 @@ void iwlagn_bt_adjust_rssi_monitor(struct iwl_priv *priv, bool rssi_ena);
 
 static inline bool iwl_advanced_bt_coexist(struct iwl_priv *priv)
 {
-        return priv->cfg->bt_params &&
-               priv->cfg->bt_params->advanced_bt_coexist;
+        return priv->lib->bt_params &&
+               priv->lib->bt_params->advanced_bt_coexist;
 }
 
 #ifdef CONFIG_IWLWIFI_DEBUG
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index d6c4cf2ad7c5..1b0f0d502568 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -521,7 +521,7 @@ static int iwl_enhance_sensitivity_write(struct iwl_priv *priv)
 
         iwl_prepare_legacy_sensitivity_tbl(priv, data, &cmd.enhance_table[0]);
 
-        if (priv->cfg->base_params->hd_v2) {
+        if (priv->lib->hd_v2) {
                 cmd.enhance_table[HD_INA_NON_SQUARE_DET_OFDM_INDEX] =
                         HD_INA_NON_SQUARE_DET_OFDM_DATA_V2;
                 cmd.enhance_table[HD_INA_NON_SQUARE_DET_CCK_INDEX] =
@@ -895,7 +895,7 @@ static void iwlagn_gain_computation(struct iwl_priv *priv,
                         continue;
                 }
 
-                delta_g = (priv->cfg->base_params->chain_noise_scale *
+                delta_g = (priv->lib->chain_noise_scale *
                         ((s32)average_noise[default_chain] -
                         (s32)average_noise[i])) / 1500;
 
@@ -1051,8 +1051,8 @@ void iwl_chain_noise_calibration(struct iwl_priv *priv)
                 return;
 
         /* Analyze signal for disconnected antenna */
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 /* Disable disconnected antenna algorithm for advanced
                    bt coex, assuming valid antennas are connected */
                 data->active_chains = priv->nvm_data->valid_rx_ant;
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index 95ca026ecc9d..ebdac909f0cd 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -838,10 +838,6 @@ struct iwl_qosparam_cmd {
 #define STA_MODIFY_DELBA_TID_MSK        0x10
 #define STA_MODIFY_SLEEP_TX_COUNT_MSK   0x20
 
-/* Receiver address (actually, Rx station's index into station table),
- * combined with Traffic ID (QOS priority), in format used by Tx Scheduler */
-#define BUILD_RAxTID(sta_id, tid)       (((sta_id) << 4) + (tid))
-
 /* agn */
 struct iwl_keyinfo {
         __le16 key_flags;
@@ -1225,14 +1221,6 @@ struct iwl_rx_mpdu_res_start {
 #define TX_CMD_SEC_KEY128       0x08
 
 /*
- * security overhead sizes
- */
-#define WEP_IV_LEN 4
-#define WEP_ICV_LEN 4
-#define CCMP_MIC_LEN 8
-#define TKIP_ICV_LEN 4
-
-/*
  * REPLY_TX = 0x1c (command)
  */
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 71ea77576d22..f1b8df16dbba 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -568,16 +568,61 @@ struct iwl_hw_params {
         const struct iwl_sensitivity_ranges *sens;
 };
 
-struct iwl_lib_ops {
-        /* set hw dependent parameters */
+/**
+ * struct iwl_dvm_bt_params - DVM specific BT (coex) parameters
+ * @advanced_bt_coexist: support advanced bt coexist
+ * @bt_init_traffic_load: specify initial bt traffic load
+ * @bt_prio_boost: default bt priority boost value
+ * @agg_time_limit: maximum number of uSec in aggregation
+ * @bt_sco_disable: uCode should not response to BT in SCO/ESCO mode
+ */
+struct iwl_dvm_bt_params {
+        bool advanced_bt_coexist;
+        u8 bt_init_traffic_load;
+        u32 bt_prio_boost;
+        u16 agg_time_limit;
+        bool bt_sco_disable;
+        bool bt_session_2;
+};
+
+/**
+ * struct iwl_dvm_cfg - DVM firmware specific device configuration
+ * @set_hw_params: set hardware parameters
+ * @set_channel_switch: send channel switch command
+ * @nic_config: apply device specific configuration
+ * @temperature: read temperature
+ * @adv_thermal_throttle: support advance thermal throttle
+ * @support_ct_kill_exit: support ct kill exit condition
+ * @plcp_delta_threshold: plcp error rate threshold used to trigger
+ *      radio tuning when there is a high receiving plcp error rate
+ * @chain_noise_scale: default chain noise scale used for gain computation
+ * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
+ * @no_idle_support: do not support idle mode
+ * @bt_params: pointer to BT parameters
+ * @need_temp_offset_calib: need to perform temperature offset calibration
+ * @no_xtal_calib: some devices do not need crystal calibration data,
+ *      don't send it to those
+ * @temp_offset_v2: support v2 of temperature offset calibration
+ * @adv_pm: advanced power management
+ */
+struct iwl_dvm_cfg {
         void (*set_hw_params)(struct iwl_priv *priv);
         int (*set_channel_switch)(struct iwl_priv *priv,
                                   struct ieee80211_channel_switch *ch_switch);
-        /* device specific configuration */
         void (*nic_config)(struct iwl_priv *priv);
-
-        /* temperature */
         void (*temperature)(struct iwl_priv *priv);
+
+        const struct iwl_dvm_bt_params *bt_params;
+        s32 chain_noise_scale;
+        u8 plcp_delta_threshold;
+        bool adv_thermal_throttle;
+        bool support_ct_kill_exit;
+        bool hd_v2;
+        bool no_idle_support;
+        bool need_temp_offset_calib;
+        bool no_xtal_calib;
+        bool temp_offset_v2;
+        bool adv_pm;
 };
 
 struct iwl_wipan_noa_data {
@@ -610,7 +655,7 @@ struct iwl_priv {
         struct device *dev;             /* for debug prints only */
         const struct iwl_cfg *cfg;
         const struct iwl_fw *fw;
-        const struct iwl_lib_ops *lib;
+        const struct iwl_dvm_cfg *lib;
         unsigned long status;
 
         spinlock_t sta_lock;
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index c48907c8ab43..352c6cb7b4f1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -174,10 +174,13 @@ static void iwl1000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.sens = &iwl1000_sensitivity;
 }
 
-struct iwl_lib_ops iwl1000_lib = {
+const struct iwl_dvm_cfg iwl_dvm_1000_cfg = {
         .set_hw_params = iwl1000_hw_set_hw_params,
         .nic_config = iwl1000_nic_config,
         .temperature = iwlagn_temperature,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 
@@ -232,16 +235,56 @@ static void iwl2000_hw_set_hw_params(struct iwl_priv *priv)
         priv->hw_params.sens = &iwl2000_sensitivity;
 }
 
-struct iwl_lib_ops iwl2000_lib = {
+const struct iwl_dvm_cfg iwl_dvm_2000_cfg = {
         .set_hw_params = iwl2000_hw_set_hw_params,
         .nic_config = iwl2000_nic_config,
         .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .hd_v2 = true,
+        .need_temp_offset_calib = true,
+        .temp_offset_v2 = true,
 };
 
-struct iwl_lib_ops iwl2030_lib = {
+const struct iwl_dvm_cfg iwl_dvm_105_cfg = {
         .set_hw_params = iwl2000_hw_set_hw_params,
         .nic_config = iwl2000_nic_config,
         .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .hd_v2 = true,
+        .need_temp_offset_calib = true,
+        .temp_offset_v2 = true,
+        .adv_pm = true,
+};
+
+static const struct iwl_dvm_bt_params iwl2030_bt_params = {
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .advanced_bt_coexist = true,
+        .agg_time_limit = BT_AGG_THRESHOLD_DEF,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT32,
+        .bt_sco_disable = true,
+        .bt_session_2 = true,
+};
+
+const struct iwl_dvm_cfg iwl_dvm_2030_cfg = {
+        .set_hw_params = iwl2000_hw_set_hw_params,
+        .nic_config = iwl2000_nic_config,
+        .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .hd_v2 = true,
+        .bt_params = &iwl2030_bt_params,
+        .need_temp_offset_calib = true,
+        .temp_offset_v2 = true,
+        .adv_pm = true,
 };
 
 /*
@@ -420,16 +463,23 @@ static int iwl5000_hw_channel_switch(struct iwl_priv *priv,
         return iwl_dvm_send_cmd(priv, &hcmd);
 }
 
-struct iwl_lib_ops iwl5000_lib = {
+const struct iwl_dvm_cfg iwl_dvm_5000_cfg = {
         .set_hw_params = iwl5000_hw_set_hw_params,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .temperature = iwlagn_temperature,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .no_idle_support = true,
 };
 
-struct iwl_lib_ops iwl5150_lib = {
+const struct iwl_dvm_cfg iwl_dvm_5150_cfg = {
         .set_hw_params = iwl5150_hw_set_hw_params,
         .set_channel_switch = iwl5000_hw_channel_switch,
         .temperature = iwl5150_temperature,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .no_idle_support = true,
+        .no_xtal_calib = true,
 };
 
 
@@ -584,16 +634,59 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv,
         return err;
 }
 
-struct iwl_lib_ops iwl6000_lib = {
+const struct iwl_dvm_cfg iwl_dvm_6000_cfg = {
         .set_hw_params = iwl6000_hw_set_hw_params,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .nic_config = iwl6000_nic_config,
         .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+};
+
+const struct iwl_dvm_cfg iwl_dvm_6005_cfg = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .nic_config = iwl6000_nic_config,
+        .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .need_temp_offset_calib = true,
+};
+
+const struct iwl_dvm_cfg iwl_dvm_6050_cfg = {
+        .set_hw_params = iwl6000_hw_set_hw_params,
+        .set_channel_switch = iwl6000_hw_channel_switch,
+        .nic_config = iwl6000_nic_config,
+        .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
+};
+
+static const struct iwl_dvm_bt_params iwl6000_bt_params = {
+        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
+        .advanced_bt_coexist = true,
+        .agg_time_limit = BT_AGG_THRESHOLD_DEF,
+        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
+        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
+        .bt_sco_disable = true,
 };
 
-struct iwl_lib_ops iwl6030_lib = {
+const struct iwl_dvm_cfg iwl_dvm_6030_cfg = {
         .set_hw_params = iwl6000_hw_set_hw_params,
         .set_channel_switch = iwl6000_hw_channel_switch,
         .nic_config = iwl6000_nic_config,
         .temperature = iwlagn_temperature,
+        .adv_thermal_throttle = true,
+        .support_ct_kill_exit = true,
+        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
+        .bt_params = &iwl6000_bt_params,
+        .need_temp_offset_calib = true,
+        .adv_pm = true,
 };
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 54f553380aa8..9879550a0fea 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -254,23 +254,23 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
         BUILD_BUG_ON(sizeof(iwlagn_def_3w_lookup) !=
                         sizeof(basic.bt3_lookup_table));
 
-        if (priv->cfg->bt_params) {
+        if (priv->lib->bt_params) {
                 /*
                  * newer generation of devices (2000 series and newer)
                  * use the version 2 of the bt command
                  * we need to make sure sending the host command
                  * with correct data structure to avoid uCode assert
                  */
-                if (priv->cfg->bt_params->bt_session_2) {
+                if (priv->lib->bt_params->bt_session_2) {
                         bt_cmd_v2.prio_boost = cpu_to_le32(
-                                priv->cfg->bt_params->bt_prio_boost);
+                                priv->lib->bt_params->bt_prio_boost);
                         bt_cmd_v2.tx_prio_boost = 0;
                         bt_cmd_v2.rx_prio_boost = 0;
                 } else {
                         /* older version only has 8 bits */
-                        WARN_ON(priv->cfg->bt_params->bt_prio_boost & ~0xFF);
+                        WARN_ON(priv->lib->bt_params->bt_prio_boost & ~0xFF);
                         bt_cmd_v1.prio_boost =
-                                priv->cfg->bt_params->bt_prio_boost;
+                                priv->lib->bt_params->bt_prio_boost;
                         bt_cmd_v1.tx_prio_boost = 0;
                         bt_cmd_v1.rx_prio_boost = 0;
                 }
@@ -330,7 +330,7 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
                        priv->bt_full_concurrent ?
                        "full concurrency" : "3-wire");
 
-        if (priv->cfg->bt_params->bt_session_2) {
+        if (priv->lib->bt_params->bt_session_2) {
                 memcpy(&bt_cmd_v2.basic, &basic,
                         sizeof(basic));
                 ret = iwl_dvm_send_cmd_pdu(priv, REPLY_BT_CONFIG,
@@ -758,8 +758,8 @@ static bool is_single_rx_stream(struct iwl_priv *priv)
  */
 static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 {
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist &&
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist &&
             (priv->bt_full_concurrent ||
              priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
                 /*
@@ -830,8 +830,8 @@ void iwlagn_set_rxon_chain(struct iwl_priv *priv, struct iwl_rxon_context *ctx)
         else
                 active_chains = priv->nvm_data->valid_rx_ant;
 
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist &&
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist &&
             (priv->bt_full_concurrent ||
              priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)) {
                 /*
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index cab23af0be9e..c0039a992909 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -426,7 +426,11 @@ static int iwlagn_mac_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto error;
 
-        iwl_trans_d3_suspend(priv->trans);
+        /* let the ucode operate on its own */
+        iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_SET,
+                    CSR_UCODE_DRV_GP1_BIT_D3_CFG_COMPLETE);
+
+        iwl_trans_d3_suspend(priv->trans, false);
 
         goto out;
 
@@ -500,7 +504,7 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
         /* we'll clear ctx->vif during iwlagn_prepare_restart() */
         vif = ctx->vif;
 
-        ret = iwl_trans_d3_resume(priv->trans, &d3_status);
+        ret = iwl_trans_d3_resume(priv->trans, &d3_status, false);
         if (ret)
                 goto out_unlock;
 
@@ -509,6 +513,10 @@ static int iwlagn_mac_resume(struct ieee80211_hw *hw)
                 goto out_unlock;
         }
 
+        /* uCode is no longer operating by itself */
+        iwl_write32(priv->trans, CSR_UCODE_DRV_GP1_CLR,
+                    CSR_UCODE_DRV_GP1_BIT_D3_CFG_COMPLETE);
+
         base = priv->device_pointers.error_event_table;
         if (!iwlagn_hw_valid_rtc_data_addr(base)) {
                 IWL_WARN(priv, "Invalid error table during resume!\n");
@@ -1276,8 +1284,8 @@ static void iwlagn_mac_rssi_callback(struct ieee80211_hw *hw,
         IWL_DEBUG_MAC80211(priv, "enter\n");
         mutex_lock(&priv->mutex);
 
-        if (priv->cfg->bt_params &&
-                        priv->cfg->bt_params->advanced_bt_coexist) {
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 if (rssi_event == RSSI_EVENT_LOW)
                         priv->bt_enable_pspoll = true;
                 else if (rssi_event == RSSI_EVENT_HIGH)
@@ -1387,7 +1395,7 @@ static int iwl_setup_interface(struct iwl_priv *priv,
                 return err;
         }
 
-        if (priv->cfg->bt_params && priv->cfg->bt_params->advanced_bt_coexist &&
+        if (priv->lib->bt_params && priv->lib->bt_params->advanced_bt_coexist &&
             vif->type == NL80211_IFTYPE_ADHOC) {
                 /*
                  * pretend to have high BT traffic as long as we
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 74d7572e7091..68f754659570 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -615,7 +615,7 @@ static void iwl_rf_kill_ct_config(struct iwl_priv *priv)
 
         priv->thermal_throttle.ct_kill_toggle = false;
 
-        if (priv->cfg->base_params->support_ct_kill_exit) {
+        if (priv->lib->support_ct_kill_exit) {
                 adv_cmd.critical_temperature_enter =
                         cpu_to_le32(priv->hw_params.ct_kill_threshold);
                 adv_cmd.critical_temperature_exit =
@@ -732,10 +732,10 @@ int iwl_alive_start(struct iwl_priv *priv)
         }
 
         /* download priority table before any calibration request */
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 /* Configure Bluetooth device coexistence support */
-                if (priv->cfg->bt_params->bt_sco_disable)
+                if (priv->lib->bt_params->bt_sco_disable)
                         priv->bt_enable_pspoll = false;
                 else
                         priv->bt_enable_pspoll = true;
@@ -873,9 +873,9 @@ void iwl_down(struct iwl_priv *priv)
         priv->bt_status = 0;
         priv->cur_rssi_ctx = NULL;
         priv->bt_is_sco = 0;
-        if (priv->cfg->bt_params)
+        if (priv->lib->bt_params)
                 priv->bt_traffic_load =
-                         priv->cfg->bt_params->bt_init_traffic_load;
+                         priv->lib->bt_params->bt_init_traffic_load;
         else
                 priv->bt_traffic_load = 0;
         priv->bt_full_concurrent = false;
@@ -1058,7 +1058,7 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
 
         iwl_setup_scan_deferred_work(priv);
 
-        if (priv->cfg->bt_params)
+        if (priv->lib->bt_params)
                 iwlagn_bt_setup_deferred_work(priv);
 
         init_timer(&priv->statistics_periodic);
@@ -1072,7 +1072,7 @@ static void iwl_setup_deferred_work(struct iwl_priv *priv)
 
 void iwl_cancel_deferred_work(struct iwl_priv *priv)
 {
-        if (priv->cfg->bt_params)
+        if (priv->lib->bt_params)
                 iwlagn_bt_cancel_deferred_work(priv);
 
         cancel_work_sync(&priv->run_time_calib_work);
@@ -1098,8 +1098,7 @@ static int iwl_init_drv(struct iwl_priv *priv)
 
         priv->band = IEEE80211_BAND_2GHZ;
 
-        priv->plcp_delta_threshold =
-                priv->cfg->base_params->plcp_delta_threshold;
+        priv->plcp_delta_threshold = priv->lib->plcp_delta_threshold;
 
         priv->iw_mode = NL80211_IFTYPE_STATION;
         priv->current_ht_config.smps = IEEE80211_SMPS_STATIC;
@@ -1116,8 +1115,8 @@ static int iwl_init_drv(struct iwl_priv *priv)
         iwl_init_scan_params(priv);
 
         /* init bt coex */
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 priv->kill_ack_mask = IWLAGN_BT_KILL_ACK_MASK_DEFAULT;
                 priv->kill_cts_mask = IWLAGN_BT_KILL_CTS_MASK_DEFAULT;
                 priv->bt_valid = IWLAGN_BT_ALL_VALID_MSK;
@@ -1264,31 +1263,37 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         switch (priv->cfg->device_family) {
         case IWL_DEVICE_FAMILY_1000:
         case IWL_DEVICE_FAMILY_100:
-                priv->lib = &iwl1000_lib;
+                priv->lib = &iwl_dvm_1000_cfg;
                 break;
         case IWL_DEVICE_FAMILY_2000:
+                priv->lib = &iwl_dvm_2000_cfg;
+                break;
         case IWL_DEVICE_FAMILY_105:
-                priv->lib = &iwl2000_lib;
+                priv->lib = &iwl_dvm_105_cfg;
                 break;
         case IWL_DEVICE_FAMILY_2030:
         case IWL_DEVICE_FAMILY_135:
-                priv->lib = &iwl2030_lib;
+                priv->lib = &iwl_dvm_2030_cfg;
                 break;
         case IWL_DEVICE_FAMILY_5000:
-                priv->lib = &iwl5000_lib;
+                priv->lib = &iwl_dvm_5000_cfg;
                 break;
         case IWL_DEVICE_FAMILY_5150:
-                priv->lib = &iwl5150_lib;
+                priv->lib = &iwl_dvm_5150_cfg;
                 break;
         case IWL_DEVICE_FAMILY_6000:
-        case IWL_DEVICE_FAMILY_6005:
         case IWL_DEVICE_FAMILY_6000i:
+                priv->lib = &iwl_dvm_6000_cfg;
+                break;
+        case IWL_DEVICE_FAMILY_6005:
+                priv->lib = &iwl_dvm_6005_cfg;
+                break;
         case IWL_DEVICE_FAMILY_6050:
         case IWL_DEVICE_FAMILY_6150:
-                priv->lib = &iwl6000_lib;
+                priv->lib = &iwl_dvm_6050_cfg;
                 break;
         case IWL_DEVICE_FAMILY_6030:
-                priv->lib = &iwl6030_lib;
+                priv->lib = &iwl_dvm_6030_cfg;
                 break;
         default:
                 break;
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index bd69018d07a9..77cb59712235 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -163,7 +163,7 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
         u8 skip;
         u32 slp_itrvl;
 
-        if (priv->cfg->adv_pm) {
+        if (priv->lib->adv_pm) {
                 table = apm_range_2;
                 if (period <= IWL_DTIM_RANGE_1_MAX)
                         table = apm_range_1;
@@ -217,7 +217,7 @@ static void iwl_static_sleep_cmd(struct iwl_priv *priv,
                 cmd->flags &= ~IWL_POWER_SHADOW_REG_ENA;
 
         if (iwl_advanced_bt_coexist(priv)) {
-                if (!priv->cfg->bt_params->bt_sco_disable)
+                if (!priv->lib->bt_params->bt_sco_disable)
                         cmd->flags |= IWL_POWER_BT_SCO_ENA;
                 else
                         cmd->flags &= ~IWL_POWER_BT_SCO_ENA;
@@ -293,7 +293,7 @@ static void iwl_power_build_cmd(struct iwl_priv *priv,
 
         if (priv->wowlan)
                 iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_5, dtimper);
-        else if (!priv->cfg->base_params->no_idle_support &&
+        else if (!priv->lib->no_idle_support &&
                  priv->hw->conf.flags & IEEE80211_CONF_IDLE)
                 iwl_static_sleep_cmd(priv, cmd, IWL_POWER_INDEX_5, 20);
         else if (iwl_tt_is_low_power_state(priv)) {
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index 907bd6e50aad..94314a8e1029 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1088,7 +1088,7 @@ done:
             (priv->tm_fixed_rate != lq_sta->dbg_fixed_rate))
                 rs_program_fix_rate(priv, lq_sta);
 #endif
-        if (priv->cfg->bt_params && priv->cfg->bt_params->advanced_bt_coexist)
+        if (priv->lib->bt_params && priv->lib->bt_params->advanced_bt_coexist)
                 rs_bt_update_lq(priv, ctx, lq_sta);
 }
 
@@ -3064,11 +3064,11 @@ static void rs_fill_link_cmd(struct iwl_priv *priv,
          * overwrite if needed, pass aggregation time limit
          * to uCode in uSec
          */
-        if (priv && priv->cfg->bt_params &&
-            priv->cfg->bt_params->agg_time_limit &&
+        if (priv && priv->lib->bt_params &&
+            priv->lib->bt_params->agg_time_limit &&
             priv->bt_traffic_load >= IWL_BT_COEX_TRAFFIC_LOAD_HIGH)
                 lq_cmd->agg_params.agg_time_limit =
-                        cpu_to_le16(priv->cfg->bt_params->agg_time_limit);
+                        cpu_to_le16(priv->lib->bt_params->agg_time_limit);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index a4eed2055fdb..2f3fd160ab44 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -1102,7 +1102,7 @@ void iwl_setup_rx_handlers(struct iwl_priv *priv)
         iwl_notification_wait_init(&priv->notif_wait);
 
         /* Set up BT Rx handlers */
-        if (priv->cfg->bt_params)
+        if (priv->lib->bt_params)
                 iwlagn_bt_rx_handler_setup(priv);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index d69b55866714..8c686a5b90ac 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -801,8 +801,8 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
                  * Internal scans are passive, so we can indiscriminately set
                  * the BT ignore flag on 2.4 GHz since it applies to TX only.
                  */
-                if (priv->cfg->bt_params &&
-                    priv->cfg->bt_params->advanced_bt_coexist)
+                if (priv->lib->bt_params &&
+                    priv->lib->bt_params->advanced_bt_coexist)
                         scan->tx_cmd.tx_flags |= TX_CMD_FLG_IGNORE_BT;
                 break;
         case IEEE80211_BAND_5GHZ:
@@ -844,8 +844,8 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
         band = priv->scan_band;
 
         if (band == IEEE80211_BAND_2GHZ &&
-            priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+            priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 /* transmit 2.4 GHz probes only on first antenna */
                 scan_tx_antennas = first_antenna(scan_tx_antennas);
         }
@@ -873,8 +873,8 @@ static int iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 
                 rx_ant = first_antenna(active_chains);
         }
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist &&
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist &&
             priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 rx_ant = first_antenna(rx_ant);
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index 03f9bc01c0cc..fbeee081ee2f 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -627,7 +627,7 @@ void iwl_tt_initialize(struct iwl_priv *priv)
         INIT_WORK(&priv->ct_enter, iwl_bg_ct_enter);
         INIT_WORK(&priv->ct_exit, iwl_bg_ct_exit);
 
-        if (priv->cfg->base_params->adv_thermal_throttle) {
+        if (priv->lib->adv_thermal_throttle) {
                 IWL_DEBUG_TEMP(priv, "Advanced Thermal Throttling\n");
                 tt->restriction = kcalloc(IWL_TI_STATE_MAX,
                                           sizeof(struct iwl_tt_restriction),
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index a900aaf47790..353a053b4eb1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -83,8 +83,8 @@ static void iwlagn_tx_cmd_build_basic(struct iwl_priv *priv,
         else if (ieee80211_is_back_req(fc))
                 tx_flags |= TX_CMD_FLG_ACK_MSK | TX_CMD_FLG_IMM_BA_RSP_MASK;
         else if (info->band == IEEE80211_BAND_2GHZ &&
-                 priv->cfg->bt_params &&
-                 priv->cfg->bt_params->advanced_bt_coexist &&
+                 priv->lib->bt_params &&
+                 priv->lib->bt_params->advanced_bt_coexist &&
                  (ieee80211_is_auth(fc) || ieee80211_is_assoc_req(fc) ||
                  ieee80211_is_reassoc_req(fc) ||
                  skb->protocol == cpu_to_be16(ETH_P_PAE)))
@@ -202,8 +202,8 @@ static void iwlagn_tx_cmd_build_rate(struct iwl_priv *priv,
                 rate_flags |= RATE_MCS_CCK_MSK;
 
         /* Set up antennas */
-         if (priv->cfg->bt_params &&
-             priv->cfg->bt_params->advanced_bt_coexist &&
+         if (priv->lib->bt_params &&
+             priv->lib->bt_params->advanced_bt_coexist &&
              priv->bt_full_concurrent) {
                 /* operated as 1x1 in full concurrency mode */
                 priv->mgmt_tx_ant = iwl_toggle_tx_ant(priv, priv->mgmt_tx_ant,
@@ -986,8 +986,8 @@ static void iwl_rx_reply_tx_agg(struct iwl_priv *priv,
          * notification again.
          */
         if (tx_resp->bt_kill_count && tx_resp->frame_count == 1 &&
-            priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+            priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 IWL_DEBUG_COEX(priv, "receive reply tx w/ bt_kill\n");
         }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 0a1cdc5e856b..86270b69cd02 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -132,8 +132,8 @@ int iwl_init_alive_start(struct iwl_priv *priv)
 {
         int ret;
 
-        if (priv->cfg->bt_params &&
-            priv->cfg->bt_params->advanced_bt_coexist) {
+        if (priv->lib->bt_params &&
+            priv->lib->bt_params->advanced_bt_coexist) {
                 /*
                  * Tell uCode we are ready to perform calibration
                  * need to perform this before any calibration
@@ -155,8 +155,8 @@ int iwl_init_alive_start(struct iwl_priv *priv)
          * temperature offset calibration is only needed for runtime ucode,
          * so prepare the value now.
          */
-        if (priv->cfg->need_temp_offset_calib) {
-                if (priv->cfg->temp_offset_v2)
+        if (priv->lib->need_temp_offset_calib) {
+                if (priv->lib->temp_offset_v2)
                         return iwl_set_temperature_offset_calib_v2(priv);
                 else
                         return iwl_set_temperature_offset_calib(priv);
@@ -277,7 +277,7 @@ static int iwl_alive_notify(struct iwl_priv *priv)
         if (ret)
                 return ret;
 
-        if (!priv->cfg->no_xtal_calib) {
+        if (!priv->lib->no_xtal_calib) {
                 ret = iwl_set_Xtal_calib(priv);
                 if (ret)
                         return ret;
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index c080ae3070b2..0d2afe098afc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -60,9 +60,6 @@ static const struct iwl_base_params iwl1000_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_1000,
         .shadow_ram_support = false,
         .led_compensation = 51,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_EXT_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 128,
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index a6ddd2f9fba0..c727ec7c90a6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -72,14 +72,9 @@ static const struct iwl_base_params iwl2000_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_2x00,
         .shadow_ram_support = true,
         .led_compensation = 51,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
-        .hd_v2 = true,
 };
 
 
@@ -90,14 +85,9 @@ static const struct iwl_base_params iwl2030_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_2x00,
         .shadow_ram_support = true,
         .led_compensation = 57,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
-        .hd_v2 = true,
 };
 
 static const struct iwl_ht_params iwl2000_ht_params = {
@@ -106,16 +96,6 @@ static const struct iwl_ht_params iwl2000_ht_params = {
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ),
 };
 
-static const struct iwl_bt_params iwl2030_bt_params = {
-        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
-        .advanced_bt_coexist = true,
-        .agg_time_limit = BT_AGG_THRESHOLD_DEF,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT32,
-        .bt_sco_disable = true,
-        .bt_session_2 = true,
-};
-
 static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
         .regulatory_bands = {
                 EEPROM_REG_BAND_1_CHANNELS,
@@ -137,12 +117,10 @@ static const struct iwl_eeprom_params iwl20x0_eeprom_params = {
         .device_family = IWL_DEVICE_FAMILY_2000,                \
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
-        .nvm_ver = EEPROM_2000_EEPROM_VERSION,          \
-        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
+        .nvm_ver = EEPROM_2000_EEPROM_VERSION,                  \
+        .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,          \
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE
 
 const struct iwl_cfg iwl2000_2bgn_cfg = {
@@ -168,12 +146,8 @@ const struct iwl_cfg iwl2000_2bgn_d_cfg = {
         .nvm_ver = EEPROM_2000_EEPROM_VERSION,          \
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2030_base_params,                    \
-        .bt_params = &iwl2030_bt_params,                        \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .temp_offset_v2 = true,                                 \
-        .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true
+        .led_mode = IWL_LED_RF_STATE
 
 const struct iwl_cfg iwl2030_2bgn_cfg = {
         .name = "Intel(R) Centrino(R) Wireless-N 2230 BGN",
@@ -193,10 +167,7 @@ const struct iwl_cfg iwl2030_2bgn_cfg = {
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2000_base_params,                    \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true,                                         \
         .rx_with_siso_diversity = true
 
 const struct iwl_cfg iwl105_bgn_cfg = {
@@ -222,12 +193,8 @@ const struct iwl_cfg iwl105_bgn_d_cfg = {
         .nvm_ver = EEPROM_2000_EEPROM_VERSION,          \
         .nvm_calib_ver = EEPROM_2000_TX_POWER_VERSION,  \
         .base_params = &iwl2030_base_params,                    \
-        .bt_params = &iwl2030_bt_params,                        \
         .eeprom_params = &iwl20x0_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .temp_offset_v2 = true,                                 \
         .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true,                                         \
         .rx_with_siso_diversity = true
 
 const struct iwl_cfg iwl135_bgn_cfg = {
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 403f3f224bf6..ecc01e1a61a1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -59,11 +59,8 @@ static const struct iwl_base_params iwl5000_base_params = {
         .num_of_queues = IWLAGN_NUM_QUEUES,
         .pll_cfg_val = CSR50_ANA_PLL_CFG_VAL,
         .led_compensation = 51,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_WATCHDOG_DISABLED,
         .max_event_log_size = 512,
-        .no_idle_support = true,
 };
 
 static const struct iwl_ht_params iwl5000_ht_params = {
@@ -159,7 +156,6 @@ const struct iwl_cfg iwl5350_agn_cfg = {
         .nvm_calib_ver = EEPROM_5050_TX_POWER_VERSION,  \
         .base_params = &iwl5000_base_params,                    \
         .eeprom_params = &iwl5000_eeprom_params,                \
-        .no_xtal_calib = true,                                  \
         .led_mode = IWL_LED_BLINK,                              \
         .internal_wimax_coex = true
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index b5ab8d1bcac0..30d45e2fc193 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -82,10 +82,6 @@ static const struct iwl_base_params iwl6000_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .led_compensation = 51,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
@@ -98,10 +94,6 @@ static const struct iwl_base_params iwl6050_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_6x50,
         .shadow_ram_support = true,
         .led_compensation = 51,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1500,
         .wd_timeout = IWL_DEF_WD_TIMEOUT,
         .max_event_log_size = 1024,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
@@ -114,10 +106,6 @@ static const struct iwl_base_params iwl6000_g2_base_params = {
         .max_ll_items = OTP_MAX_LL_ITEMS_6x00,
         .shadow_ram_support = true,
         .led_compensation = 57,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
         .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
@@ -129,15 +117,6 @@ static const struct iwl_ht_params iwl6000_ht_params = {
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
 
-static const struct iwl_bt_params iwl6000_bt_params = {
-        /* Due to bluetooth, we transmit 2.4 GHz probes only on antenna A */
-        .advanced_bt_coexist = true,
-        .agg_time_limit = BT_AGG_THRESHOLD_DEF,
-        .bt_init_traffic_load = IWL_BT_COEX_TRAFFIC_LOAD_NONE,
-        .bt_prio_boost = IWLAGN_BT_PRIO_BOOST_DEFAULT,
-        .bt_sco_disable = true,
-};
-
 static const struct iwl_eeprom_params iwl6000_eeprom_params = {
         .regulatory_bands = {
                 EEPROM_REG_BAND_1_CHANNELS,
@@ -163,7 +142,6 @@ static const struct iwl_eeprom_params iwl6000_eeprom_params = {
         .nvm_calib_ver = EEPROM_6005_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
         .led_mode = IWL_LED_RF_STATE
 
 const struct iwl_cfg iwl6005_2agn_cfg = {
@@ -217,11 +195,8 @@ const struct iwl_cfg iwl6005_2agn_mow2_cfg = {
         .nvm_ver = EEPROM_6030_EEPROM_VERSION,          \
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
-        .bt_params = &iwl6000_bt_params,                        \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true                                          \
+        .led_mode = IWL_LED_RF_STATE
 
 const struct iwl_cfg iwl6030_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6230 AGN",
@@ -256,11 +231,8 @@ const struct iwl_cfg iwl6030_2bg_cfg = {
         .nvm_ver = EEPROM_6030_EEPROM_VERSION,          \
         .nvm_calib_ver = EEPROM_6030_TX_POWER_VERSION,  \
         .base_params = &iwl6000_g2_base_params,                 \
-        .bt_params = &iwl6000_bt_params,                        \
         .eeprom_params = &iwl6000_eeprom_params,                \
-        .need_temp_offset_calib = true,                         \
-        .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true
+        .led_mode = IWL_LED_RF_STATE
 
 const struct iwl_cfg iwl6035_2agn_cfg = {
         .name = "Intel(R) Centrino(R) Advanced-N 6235 AGN",
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 50263e87fe15..d4f3b4864ab1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -96,13 +96,9 @@ static const struct iwl_base_params iwl7000_base_params = {
         .pll_cfg_val = 0,
         .shadow_ram_support = true,
         .led_compensation = 57,
-        .adv_thermal_throttle = true,
-        .support_ct_kill_exit = true,
-        .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
-        .chain_noise_scale = 1000,
         .wd_timeout = IWL_LONG_WD_TIMEOUT,
         .max_event_log_size = 512,
-        .shadow_reg_enable = false, /* TODO: fix bugs using this feature */
+        .shadow_reg_enable = true,
 };
 
 static const struct iwl_ht_params iwl7000_ht_params = {
@@ -118,14 +114,11 @@ static const struct iwl_ht_params iwl7000_ht_params = {
         .max_inst_size = IWL60_RTC_INST_SIZE,                   \
         .max_data_size = IWL60_RTC_DATA_SIZE,                   \
         .base_params = &iwl7000_base_params,                    \
-        /* TODO: .bt_params? */                                 \
-        .need_temp_offset_calib = true,                         \
-        .led_mode = IWL_LED_RF_STATE,                           \
-        .adv_pm = true                                          \
+        .led_mode = IWL_LED_RF_STATE
 
 
 const struct iwl_cfg iwl7260_2ac_cfg = {
-        .name = "Intel(R) Dual Band Wireless AC7260",
+        .name = "Intel(R) Dual Band Wireless AC 7260",
         .fw_name_pre = IWL7260_FW_PRE,
         IWL_DEVICE_7000,
         .ht_params = &iwl7000_ht_params,
@@ -133,8 +126,44 @@ const struct iwl_cfg iwl7260_2ac_cfg = {
         .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
 };
 
-const struct iwl_cfg iwl3160_ac_cfg = {
-        .name = "Intel(R) Dual Band Wireless AC3160",
+const struct iwl_cfg iwl7260_2n_cfg = {
+        .name = "Intel(R) Dual Band Wireless N 7260",
+        .fw_name_pre = IWL7260_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7260_NVM_VERSION,
+        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl7260_n_cfg = {
+        .name = "Intel(R) Wireless N 7260",
+        .fw_name_pre = IWL7260_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL7260_NVM_VERSION,
+        .nvm_calib_ver = IWL7260_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl3160_2ac_cfg = {
+        .name = "Intel(R) Dual Band Wireless AC 3160",
+        .fw_name_pre = IWL3160_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL3160_NVM_VERSION,
+        .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl3160_2n_cfg = {
+        .name = "Intel(R) Dual Band Wireless N 3160",
+        .fw_name_pre = IWL3160_FW_PRE,
+        IWL_DEVICE_7000,
+        .ht_params = &iwl7000_ht_params,
+        .nvm_ver = IWL3160_NVM_VERSION,
+        .nvm_calib_ver = IWL3160_TX_POWER_VERSION,
+};
+
+const struct iwl_cfg iwl3160_n_cfg = {
+        .name = "Intel(R) Wireless N 3160",
         .fw_name_pre = IWL3160_FW_PRE,
         IWL_DEVICE_7000,
         .ht_params = &iwl7000_ht_params,
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index c38aa8f77554..a193832fc790 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -136,17 +136,9 @@ enum iwl_led_mode {
  * @led_compensation: compensate on the led on/off time per HW according
  *      to the deviation to achieve the desired led frequency.
  *      The detail algorithm is described in iwl-led.c
- * @chain_noise_num_beacons: number of beacons used to compute chain noise
- * @adv_thermal_throttle: support advance thermal throttle
- * @support_ct_kill_exit: support ct kill exit condition
- * @plcp_delta_threshold: plcp error rate threshold used to trigger
- *      radio tuning when there is a high receiving plcp error rate
- * @chain_noise_scale: default chain noise scale used for gain computation
  * @wd_timeout: TX queues watchdog timeout
  * @max_event_log_size: size of event log buffer size for ucode event logging
  * @shadow_reg_enable: HW shadow register support
- * @hd_v2: v2 of enhanced sensitivity value, used for 2000 series and up
- * @no_idle_support: do not support idle mode
  */
 struct iwl_base_params {
         int eeprom_size;
@@ -157,31 +149,9 @@ struct iwl_base_params {
         const u16 max_ll_items;
         const bool shadow_ram_support;
         u16 led_compensation;
-        bool adv_thermal_throttle;
-        bool support_ct_kill_exit;
-        u8 plcp_delta_threshold;
-        s32 chain_noise_scale;
         unsigned int wd_timeout;
         u32 max_event_log_size;
         const bool shadow_reg_enable;
-        const bool hd_v2;
-        const bool no_idle_support;
-};
-
-/*
- * @advanced_bt_coexist: support advanced bt coexist
- * @bt_init_traffic_load: specify initial bt traffic load
- * @bt_prio_boost: default bt priority boost value
- * @agg_time_limit: maximum number of uSec in aggregation
- * @bt_sco_disable: uCode should not response to BT in SCO/ESCO mode
- */
-struct iwl_bt_params {
-        bool advanced_bt_coexist;
-        u8 bt_init_traffic_load;
-        u32 bt_prio_boost;
-        u16 agg_time_limit;
-        bool bt_sco_disable;
-        bool bt_session_2;
 };
 
 /*
@@ -231,16 +201,10 @@ struct iwl_eeprom_params {
  * @nvm_calib_ver: NVM calibration version
  * @lib: pointer to the lib ops
  * @base_params: pointer to basic parameters
- * @ht_params: point to ht patameters
- * @bt_params: pointer to bt parameters
- * @need_temp_offset_calib: need to perform temperature offset calibration
- * @no_xtal_calib: some devices do not need crystal calibration data,
- *      don't send it to those
+ * @ht_params: point to ht parameters
  * @led_mode: 0=blinking, 1=On(RF On)/Off(RF Off)
- * @adv_pm: advance power management
  * @rx_with_siso_diversity: 1x1 device with rx antenna diversity
  * @internal_wimax_coex: internal wifi/wimax combo device
- * @temp_offset_v2: support v2 of temperature offset calibration
  *
  * We enable the driver to be backward compatible wrt. hardware features.
  * API differences in uCode shouldn't be handled here but through TLVs
@@ -264,15 +228,10 @@ struct iwl_cfg {
         const struct iwl_base_params *base_params;
         /* params likely to change within a device family */
         const struct iwl_ht_params *ht_params;
-        const struct iwl_bt_params *bt_params;
         const struct iwl_eeprom_params *eeprom_params;
-        const bool need_temp_offset_calib; /* if used set to true */
-        const bool no_xtal_calib;
         enum iwl_led_mode led_mode;
-        const bool adv_pm;
         const bool rx_with_siso_diversity;
         const bool internal_wimax_coex;
-        const bool temp_offset_v2;
 };
 
 /*
@@ -320,6 +279,10 @@ extern const struct iwl_cfg iwl105_bgn_cfg;
 extern const struct iwl_cfg iwl105_bgn_d_cfg;
 extern const struct iwl_cfg iwl135_bgn_cfg;
 extern const struct iwl_cfg iwl7260_2ac_cfg;
-extern const struct iwl_cfg iwl3160_ac_cfg;
+extern const struct iwl_cfg iwl7260_2n_cfg;
+extern const struct iwl_cfg iwl7260_n_cfg;
+extern const struct iwl_cfg iwl3160_2ac_cfg;
+extern const struct iwl_cfg iwl3160_2n_cfg;
+extern const struct iwl_cfg iwl3160_n_cfg;
 
 #endif /* __IWL_CONFIG_H__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index 20e845d4da04..a276af476e2d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -472,4 +472,23 @@
 #define IWL_HOST_INT_CALIB_TIMEOUT_DEF  (0x10)
 #define IWL_HOST_INT_CALIB_TIMEOUT_MIN  (0x0)
 
+/*****************************************************************************
+ *                        7000/3000 series SHR DTS addresses                 *
+ *****************************************************************************/
+
+/* Diode Results Register Structure: */
+enum dtd_diode_reg {
+        DTS_DIODE_REG_DIG_VAL                   = 0x000000FF, /* bits [7:0] */
+        DTS_DIODE_REG_VREF_LOW                  = 0x0000FF00, /* bits [15:8] */
+        DTS_DIODE_REG_VREF_HIGH                 = 0x00FF0000, /* bits [23:16] */
+        DTS_DIODE_REG_VREF_ID                   = 0x03000000, /* bits [25:24] */
+        DTS_DIODE_REG_PASS_ONCE                 = 0x80000000, /* bits [31:31] */
+        DTS_DIODE_REG_FLAGS_MSK                 = 0xFF000000, /* bits [31:24] */
+/* Those are the masks INSIDE the flags bit-field: */
+        DTS_DIODE_REG_FLAGS_VREFS_ID_POS        = 0,
+        DTS_DIODE_REG_FLAGS_VREFS_ID            = 0x00000003, /* bits [1:0] */
+        DTS_DIODE_REG_FLAGS_PASS_ONCE_POS       = 7,
+        DTS_DIODE_REG_FLAGS_PASS_ONCE           = 0x00000080, /* bits [7:7] */
+};
+
 #endif /* !__iwl_csr_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 39aad9893e0b..4f886133639a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -1234,6 +1234,9 @@ MODULE_PARM_DESC(wd_disable,
                 "Disable stuck queue watchdog timer 0=system default, "
                 "1=disable, 2=enable (default: 0)");
 
+module_param_named(nvm_file, iwlwifi_mod_params.nvm_file, charp, S_IRUGO);
+MODULE_PARM_DESC(nvm_file, "NVM file name");
+
 /*
  * set bt_coex_active to true, uCode will do kill/defer
  * every time the priority line is asserted (BT is sending signals on the
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 600c9fdd7f71..4c887f365908 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -732,17 +732,16 @@ int iwl_init_sband_channels(struct iwl_nvm_data *data,
 void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
                           struct iwl_nvm_data *data,
                           struct ieee80211_sta_ht_cap *ht_info,
-                          enum ieee80211_band band)
+                          enum ieee80211_band band,
+                          u8 tx_chains, u8 rx_chains)
 {
         int max_bit_rate = 0;
-        u8 rx_chains;
-        u8 tx_chains;
 
-        tx_chains = hweight8(data->valid_tx_ant);
+        tx_chains = hweight8(tx_chains);
         if (cfg->rx_with_siso_diversity)
                 rx_chains = 1;
         else
-                rx_chains = hweight8(data->valid_rx_ant);
+                rx_chains = hweight8(rx_chains);
 
         if (!(data->sku_cap_11n_enable) || !cfg->ht_params) {
                 ht_info->ht_supported = false;
@@ -806,7 +805,8 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         sband->n_bitrates = N_RATES_24;
         n_used += iwl_init_sband_channels(data, sband, n_channels,
                                           IEEE80211_BAND_2GHZ);
-        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_2GHZ);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_2GHZ,
+                             data->valid_tx_ant, data->valid_rx_ant);
 
         sband = &data->bands[IEEE80211_BAND_5GHZ];
         sband->band = IEEE80211_BAND_5GHZ;
@@ -814,7 +814,8 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         sband->n_bitrates = N_RATES_52;
         n_used += iwl_init_sband_channels(data, sband, n_channels,
                                           IEEE80211_BAND_5GHZ);
-        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ,
+                             data->valid_tx_ant, data->valid_rx_ant);
 
         if (n_channels != n_used)
                 IWL_ERR_DEV(dev, "EEPROM: used only %d of %d channels\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
index 37f115390b19..d73304a23ec2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -133,6 +133,7 @@ int iwl_init_sband_channels(struct iwl_nvm_data *data,
 void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
                           struct iwl_nvm_data *data,
                           struct ieee80211_sta_ht_cap *ht_info,
-                          enum ieee80211_band band);
+                          enum ieee80211_band band,
+                          u8 tx_chains, u8 rx_chains);
 
 #endif /* __iwl_eeprom_parse_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index c4c446d41eb0..f844d5c748c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -106,11 +106,14 @@ enum iwl_ucode_type {
 
 /*
  * enumeration of ucode section.
- * This enumeration is used for legacy tlv style (before 16.0 uCode).
+ * This enumeration is used directly for older firmware (before 16.0).
+ * For new firmware, there can be up to 4 sections (see below) but the
+ * first one packaged into the firmware file is the DATA section and
+ * some debugging code accesses that.
  */
 enum iwl_ucode_sec {
-        IWL_UCODE_SECTION_INST,
         IWL_UCODE_SECTION_DATA,
+        IWL_UCODE_SECTION_INST,
 };
 /*
  * For 16.0 uCode and above, there is no differentiation between sections,
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index d6f6c37c09fd..36dfe0919f6b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -119,6 +119,7 @@ struct iwl_mod_params {
         int ant_coupling;
         bool bt_ch_announce;
         bool auto_agg;
+        char *nvm_file;
 };
 
 #endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 6199a0a597a6..acd2665afb8c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -89,6 +89,7 @@ enum nvm_sku_bits {
         NVM_SKU_CAP_BAND_24GHZ  = BIT(0),
         NVM_SKU_CAP_BAND_52GHZ  = BIT(1),
         NVM_SKU_CAP_11N_ENABLE  = BIT(2),
+        NVM_SKU_CAP_11AC_ENABLE = BIT(3),
 };
 
 /* radio config bits (actual values from NVM definition) */
@@ -258,8 +259,6 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                                   struct iwl_nvm_data *data,
                                   struct ieee80211_sta_vht_cap *vht_cap)
 {
-        /* For now, assume new devices with NVM are VHT capable */
-
         vht_cap->vht_supported = true;
 
         vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
@@ -292,7 +291,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
 }
 
 static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
-                            struct iwl_nvm_data *data, const __le16 *nvm_sw)
+                            struct iwl_nvm_data *data, const __le16 *nvm_sw,
+                            bool enable_vht, u8 tx_chains, u8 rx_chains)
 {
         int n_channels = iwl_init_channel_map(dev, cfg, data,
                         &nvm_sw[NVM_CHANNELS]);
@@ -305,7 +305,8 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         sband->n_bitrates = N_RATES_24;
         n_used += iwl_init_sband_channels(data, sband, n_channels,
                                           IEEE80211_BAND_2GHZ);
-        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_2GHZ);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_2GHZ,
+                             tx_chains, rx_chains);
 
         sband = &data->bands[IEEE80211_BAND_5GHZ];
         sband->band = IEEE80211_BAND_5GHZ;
@@ -313,8 +314,10 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
         sband->n_bitrates = N_RATES_52;
         n_used += iwl_init_sband_channels(data, sband, n_channels,
                                           IEEE80211_BAND_5GHZ);
-        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ);
-        iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap);
+        iwl_init_ht_hw_capab(cfg, data, &sband->ht_cap, IEEE80211_BAND_5GHZ,
+                             tx_chains, rx_chains);
+        if (enable_vht)
+                iwl_init_vht_hw_capab(cfg, data, &sband->vht_cap);
 
         if (n_channels != n_used)
                 IWL_ERR_DEV(dev, "NVM: used only %d of %d channels\n",
@@ -324,7 +327,7 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                    const __le16 *nvm_hw, const __le16 *nvm_sw,
-                   const __le16 *nvm_calib)
+                   const __le16 *nvm_calib, u8 tx_chains, u8 rx_chains)
 {
         struct iwl_nvm_data *data;
         u8 hw_addr[ETH_ALEN];
@@ -380,7 +383,8 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
         data->hw_addr[4] = hw_addr[5];
         data->hw_addr[5] = hw_addr[4];
 
-        iwl_init_sbands(dev, cfg, data, nvm_sw);
+        iwl_init_sbands(dev, cfg, data, nvm_sw, sku & NVM_SKU_CAP_11AC_ENABLE,
+                        tx_chains, rx_chains);
 
         data->calib_version = 255;   /* TODO:
                                         this value will prevent some checks from
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
index e57fb989661e..3325059c52d4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
@@ -75,6 +75,6 @@
 struct iwl_nvm_data *
 iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg,
                    const __le16 *nvm_hw, const __le16 *nvm_sw,
-                   const __le16 *nvm_calib);
+                   const __le16 *nvm_calib, u8 tx_chains, u8 rx_chains);
 
 #endif /* __iwl_nvm_parse_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index 386f2a7c87cb..ff8cc75c189d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -100,6 +100,18 @@
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
 
+/*****************************************************************************
+ *                        7000/3000 series SHR DTS addresses                 *
+ *****************************************************************************/
+
+#define SHR_MISC_WFM_DTS_EN     (0x00a10024)
+#define DTSC_CFG_MODE           (0x00a10604)
+#define DTSC_VREF_AVG           (0x00a10648)
+#define DTSC_VREF5_AVG          (0x00a1064c)
+#define DTSC_CFG_MODE_PERIODIC  (0x2)
+#define DTSC_PTAT_AVG           (0x00a10650)
+
+
 /**
  * Tx Scheduler
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 7a13790b5bfe..be4b2ac3dbbf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -189,7 +189,8 @@ enum CMD_MODE {
         CMD_SYNC                = 0,
         CMD_ASYNC               = BIT(0),
         CMD_WANT_SKB            = BIT(1),
-        CMD_ON_DEMAND           = BIT(2),
+        CMD_SEND_IN_RFKILL      = BIT(2),
+        CMD_ON_DEMAND           = BIT(3),
 };
 
 #define DEF_CMD_PAYLOAD_SIZE 320
@@ -427,8 +428,9 @@ struct iwl_trans_ops {
         void (*fw_alive)(struct iwl_trans *trans, u32 scd_addr);
         void (*stop_device)(struct iwl_trans *trans);
 
-        void (*d3_suspend)(struct iwl_trans *trans);
-        int (*d3_resume)(struct iwl_trans *trans, enum iwl_d3_status *status);
+        void (*d3_suspend)(struct iwl_trans *trans, bool test);
+        int (*d3_resume)(struct iwl_trans *trans, enum iwl_d3_status *status,
+                         bool test);
 
         int (*send_cmd)(struct iwl_trans *trans, struct iwl_host_cmd *cmd);
 
@@ -455,7 +457,7 @@ struct iwl_trans_ops {
         int (*read_mem)(struct iwl_trans *trans, u32 addr,
                         void *buf, int dwords);
         int (*write_mem)(struct iwl_trans *trans, u32 addr,
-                         void *buf, int dwords);
+                         const void *buf, int dwords);
         void (*configure)(struct iwl_trans *trans,
                           const struct iwl_trans_config *trans_cfg);
         void (*set_pmi)(struct iwl_trans *trans, bool state);
@@ -587,17 +589,18 @@ static inline void iwl_trans_stop_device(struct iwl_trans *trans)
         trans->state = IWL_TRANS_NO_FW;
 }
 
-static inline void iwl_trans_d3_suspend(struct iwl_trans *trans)
+static inline void iwl_trans_d3_suspend(struct iwl_trans *trans, bool test)
 {
         might_sleep();
-        trans->ops->d3_suspend(trans);
+        trans->ops->d3_suspend(trans, test);
 }
 
 static inline int iwl_trans_d3_resume(struct iwl_trans *trans,
-                                      enum iwl_d3_status *status)
+                                      enum iwl_d3_status *status,
+                                      bool test)
 {
         might_sleep();
-        return trans->ops->d3_resume(trans, status);
+        return trans->ops->d3_resume(trans, status, test);
 }
 
 static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
@@ -761,7 +764,7 @@ static inline u32 iwl_trans_read_mem32(struct iwl_trans *trans, u32 addr)
 }
 
 static inline int iwl_trans_write_mem(struct iwl_trans *trans, u32 addr,
-                                      void *buf, int dwords)
+                                      const void *buf, int dwords)
 {
         return trans->ops->write_mem(trans, addr, buf, dwords);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index 2acc44b40986..ff856e543ae8 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -3,7 +3,7 @@ iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
 iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o
 iwlmvm-y += scan.o time-event.o rs.o
 iwlmvm-y += power.o bt-coex.o
-iwlmvm-y += led.o
+iwlmvm-y += led.o tt.o
 iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 810bfa5f6de0..9a4d94a1f90d 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -174,7 +174,7 @@ static const __le32 iwl_tight_lookup[BT_COEX_LUT_SIZE] = {
 static const __le32 iwl_loose_lookup[BT_COEX_LUT_SIZE] = {
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaaaaaaaa),
-        cpu_to_le32(0xaeaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xcc00ff28),
         cpu_to_le32(0x0000aaaa),
@@ -351,6 +351,7 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         enum ieee80211_band band;
         int ave_rssi;
 
+        lockdep_assert_held(&mvm->mutex);
         if (vif->type != NL80211_IFTYPE_STATION)
                 return;
 
@@ -365,7 +366,8 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
         smps_mode = IEEE80211_SMPS_AUTOMATIC;
 
         if (band != IEEE80211_BAND_2GHZ) {
-                ieee80211_request_smps(vif, smps_mode);
+                iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX,
+                                    smps_mode);
                 return;
         }
 
@@ -380,7 +382,7 @@ static void iwl_mvm_bt_notif_iterator(void *_data, u8 *mac,
                        mvmvif->id,  data->notif->bt_status,
                        data->notif->bt_traffic_load, smps_mode);
 
-        ieee80211_request_smps(vif, smps_mode);
+        iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_BT_COEX, smps_mode);
 
         /* don't reduce the Tx power if in loose scheme */
         if (is_loose_coex())
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index 16bbdcc8627a..7a2ef3f013fd 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -63,6 +63,7 @@
 
 #include <linux/etherdevice.h>
 #include <linux/ip.h>
+#include <linux/fs.h>
 #include <net/cfg80211.h>
 #include <net/ipv6.h>
 #include <net/tcp.h>
@@ -756,7 +757,9 @@ static int iwl_mvm_d3_reprogram(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         return 0;
 }
 
-int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
+                             struct cfg80211_wowlan *wowlan,
+                             bool test)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         struct iwl_d3_iter_data suspend_iter_data = {
@@ -769,7 +772,7 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         struct iwl_wowlan_config_cmd wowlan_config_cmd = {};
         struct iwl_wowlan_kek_kck_material_cmd kek_kck_cmd = {};
         struct iwl_wowlan_tkip_params_cmd tkip_cmd = {};
-        struct iwl_d3_manager_config d3_cfg_cmd = {
+        struct iwl_d3_manager_config d3_cfg_cmd_data = {
                 /*
                  * Program the minimum sleep time to 10 seconds, as many
                  * platforms have issues processing a wakeup signal while
@@ -777,17 +780,30 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                  */
                 .min_sleep_time = cpu_to_le32(10 * 1000 * 1000),
         };
+        struct iwl_host_cmd d3_cfg_cmd = {
+                .id = D3_CONFIG_CMD,
+                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .data[0] = &d3_cfg_cmd_data,
+                .len[0] = sizeof(d3_cfg_cmd_data),
+        };
         struct wowlan_key_data key_data = {
                 .use_rsc_tsc = false,
                 .tkip = &tkip_cmd,
                 .use_tkip = false,
         };
         int ret, i;
+        int len __maybe_unused;
         u16 seq;
         u8 old_aux_sta_id, old_ap_sta_id = IWL_MVM_STATION_COUNT;
 
-        if (WARN_ON(!wowlan))
+        if (!wowlan) {
+                /*
+                 * mac80211 shouldn't get here, but for D3 test
+                 * it doesn't warrant a warning
+                 */
+                WARN_ON(!test);
                 return -EINVAL;
+        }
 
         key_data.rsc_tsc = kzalloc(sizeof(*key_data.rsc_tsc), GFP_KERNEL);
         if (!key_data.rsc_tsc)
@@ -1007,15 +1023,31 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         if (ret)
                 goto out;
 
+        ret = iwl_mvm_power_update_mode(mvm, vif);
+        if (ret)
+                goto out;
+
         /* must be last -- this switches firmware state */
-        ret = iwl_mvm_send_cmd_pdu(mvm, D3_CONFIG_CMD, CMD_SYNC,
-                                   sizeof(d3_cfg_cmd), &d3_cfg_cmd);
+        ret = iwl_mvm_send_cmd(mvm, &d3_cfg_cmd);
         if (ret)
                 goto out;
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        len = le32_to_cpu(d3_cfg_cmd.resp_pkt->len_n_flags) &
+                FH_RSCSR_FRAME_SIZE_MSK;
+        if (len >= sizeof(u32) * 2) {
+                mvm->d3_test_pme_ptr =
+                        le32_to_cpup((__le32 *)d3_cfg_cmd.resp_pkt->data);
+        } else if (test) {
+                /* in test mode we require the pointer */
+                ret = -EIO;
+                goto out;
+        }
+#endif
+        iwl_free_resp(&d3_cfg_cmd);
 
         clear_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status);
 
-        iwl_trans_d3_suspend(mvm->trans);
+        iwl_trans_d3_suspend(mvm->trans, test);
  out:
         mvm->aux_sta.sta_id = old_aux_sta_id;
         mvm_ap_sta->sta_id = old_ap_sta_id;
@@ -1030,6 +1062,11 @@ int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
         return ret;
 }
 
+int iwl_mvm_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
+{
+        return __iwl_mvm_suspend(hw, wowlan, false);
+}
+
 static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                                          struct ieee80211_vif *vif)
 {
@@ -1214,9 +1251,28 @@ static void iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         iwl_free_resp(&cmd);
 }
 
-int iwl_mvm_resume(struct ieee80211_hw *hw)
+static void iwl_mvm_read_d3_sram(struct iwl_mvm *mvm)
+{
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        const struct fw_img *img = &mvm->fw->img[IWL_UCODE_WOWLAN];
+        u32 len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        u32 offs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+
+        if (!mvm->store_d3_resume_sram)
+                return;
+
+        if (!mvm->d3_resume_sram) {
+                mvm->d3_resume_sram = kzalloc(len, GFP_KERNEL);
+                if (!mvm->d3_resume_sram)
+                        return;
+        }
+
+        iwl_trans_read_mem_bytes(mvm->trans, offs, mvm->d3_resume_sram, len);
+#endif
+}
+
+static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
 {
-        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         struct iwl_d3_iter_data resume_iter_data = {
                 .mvm = mvm,
         };
@@ -1236,7 +1292,7 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
 
         vif = resume_iter_data.vif;
 
-        ret = iwl_trans_d3_resume(mvm->trans, &d3_status);
+        ret = iwl_trans_d3_resume(mvm->trans, &d3_status, test);
         if (ret)
                 goto out_unlock;
 
@@ -1245,12 +1301,15 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
                 goto out_unlock;
         }
 
+        /* query SRAM first in case we want event logging */
+        iwl_mvm_read_d3_sram(mvm);
+
         iwl_mvm_query_wakeup_reasons(mvm, vif);
 
  out_unlock:
         mutex_unlock(&mvm->mutex);
 
-        if (vif)
+        if (!test && vif)
                 ieee80211_resume_disconnect(vif);
 
         /* return 1 to reconfigure the device */
@@ -1258,9 +1317,106 @@ int iwl_mvm_resume(struct ieee80211_hw *hw)
         return 1;
 }
 
+int iwl_mvm_resume(struct ieee80211_hw *hw)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        return __iwl_mvm_resume(mvm, false);
+}
+
 void iwl_mvm_set_wakeup(struct ieee80211_hw *hw, bool enabled)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
         device_set_wakeup_enable(mvm->trans->dev, enabled);
 }
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+static int iwl_mvm_d3_test_open(struct inode *inode, struct file *file)
+{
+        struct iwl_mvm *mvm = inode->i_private;
+        int err;
+
+        if (mvm->d3_test_active)
+                return -EBUSY;
+
+        file->private_data = inode->i_private;
+
+        ieee80211_stop_queues(mvm->hw);
+        synchronize_net();
+
+        /* start pseudo D3 */
+        rtnl_lock();
+        err = __iwl_mvm_suspend(mvm->hw, mvm->hw->wiphy->wowlan_config, true);
+        rtnl_unlock();
+        if (err > 0)
+                err = -EINVAL;
+        if (err) {
+                ieee80211_wake_queues(mvm->hw);
+                return err;
+        }
+        mvm->d3_test_active = true;
+        return 0;
+}
+
+static ssize_t iwl_mvm_d3_test_read(struct file *file, char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        u32 pme_asserted;
+
+        while (true) {
+                pme_asserted = iwl_trans_read_mem32(mvm->trans,
+                                                    mvm->d3_test_pme_ptr);
+                if (pme_asserted)
+                        break;
+                if (msleep_interruptible(100))
+                        break;
+        }
+
+        return 0;
+}
+
+static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac,
+                                              struct ieee80211_vif *vif)
+{
+        if (vif->type == NL80211_IFTYPE_STATION)
+                ieee80211_connection_loss(vif);
+}
+
+static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
+{
+        struct iwl_mvm *mvm = inode->i_private;
+        int remaining_time = 10;
+
+        mvm->d3_test_active = false;
+        __iwl_mvm_resume(mvm, true);
+        iwl_abort_notification_waits(&mvm->notif_wait);
+        ieee80211_restart_hw(mvm->hw);
+
+        /* wait for restart and disconnect all interfaces */
+        while (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
+               remaining_time > 0) {
+                remaining_time--;
+                msleep(1000);
+        }
+
+        if (remaining_time == 0)
+                IWL_ERR(mvm, "Timed out waiting for HW restart to finish!\n");
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_d3_test_disconn_work_iter, NULL);
+
+        ieee80211_wake_queues(mvm->hw);
+
+        return 0;
+}
+
+const struct file_operations iwl_dbgfs_d3_test_ops = {
+        .llseek = no_llseek,
+        .open = iwl_mvm_d3_test_open,
+        .read = iwl_mvm_d3_test_read,
+        .release = iwl_mvm_d3_test_release,
+};
+#endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 2053dccefcd6..b7643c16201f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -145,15 +145,18 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
         char *buf;
         u8 *ptr;
 
+        if (!mvm->ucode_loaded)
+                return -EINVAL;
+
         /* default is to dump the entire data segment */
         if (!mvm->dbgfs_sram_offset && !mvm->dbgfs_sram_len) {
-                mvm->dbgfs_sram_offset = 0x800000;
-                if (!mvm->ucode_loaded)
-                        return -EINVAL;
                 img = &mvm->fw->img[mvm->cur_ucode];
-                mvm->dbgfs_sram_len = img->sec[IWL_UCODE_SECTION_DATA].len;
+                ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+                len = img->sec[IWL_UCODE_SECTION_DATA].len;
+        } else {
+                ofs = mvm->dbgfs_sram_offset;
+                len = mvm->dbgfs_sram_len;
         }
-        len = mvm->dbgfs_sram_len;
 
         bufsz = len * 4 + 256;
         buf = kzalloc(bufsz, GFP_KERNEL);
@@ -167,12 +170,9 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
         }
 
         pos += scnprintf(buf + pos, bufsz - pos, "sram_len: 0x%x\n", len);
-        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n",
-                         mvm->dbgfs_sram_offset);
+        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n", ofs);
 
-        iwl_trans_read_mem_bytes(mvm->trans,
-                                 mvm->dbgfs_sram_offset,
-                                 ptr, len);
+        iwl_trans_read_mem_bytes(mvm->trans, ofs, ptr, len);
         for (ofs = 0; ofs < len; ofs += 16) {
                 pos += scnprintf(buf + pos, bufsz - pos, "0x%.4x ", ofs);
                 hex_dump_to_buffer(ptr + ofs, 16, 16, 1, buf + pos,
@@ -300,6 +300,146 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file,
         return count;
 }
 
+static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
+                                 enum iwl_dbgfs_pm_mask param, int val)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_dbgfs_pm *dbgfs_pm = &mvmvif->dbgfs_pm;
+
+        dbgfs_pm->mask |= param;
+
+        switch (param) {
+        case MVM_DEBUGFS_PM_KEEP_ALIVE: {
+                struct ieee80211_hw *hw = mvm->hw;
+                int dtimper = hw->conf.ps_dtim_period ?: 1;
+                int dtimper_msec = dtimper * vif->bss_conf.beacon_int;
+
+                IWL_DEBUG_POWER(mvm, "debugfs: set keep_alive= %d sec\n", val);
+                if (val * MSEC_PER_SEC < 3 * dtimper_msec) {
+                        IWL_WARN(mvm,
+                                 "debugfs: keep alive period (%ld msec) is less than minimum required (%d msec)\n",
+                                 val * MSEC_PER_SEC, 3 * dtimper_msec);
+                }
+                dbgfs_pm->keep_alive_seconds = val;
+                break;
+        }
+        case MVM_DEBUGFS_PM_SKIP_OVER_DTIM:
+                IWL_DEBUG_POWER(mvm, "skip_over_dtim %s\n",
+                                val ? "enabled" : "disabled");
+                dbgfs_pm->skip_over_dtim = val;
+                break;
+        case MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS:
+                IWL_DEBUG_POWER(mvm, "skip_dtim_periods=%d\n", val);
+                dbgfs_pm->skip_dtim_periods = val;
+                break;
+        case MVM_DEBUGFS_PM_RX_DATA_TIMEOUT:
+                IWL_DEBUG_POWER(mvm, "rx_data_timeout=%d\n", val);
+                dbgfs_pm->rx_data_timeout = val;
+                break;
+        case MVM_DEBUGFS_PM_TX_DATA_TIMEOUT:
+                IWL_DEBUG_POWER(mvm, "tx_data_timeout=%d\n", val);
+                dbgfs_pm->tx_data_timeout = val;
+                break;
+        case MVM_DEBUGFS_PM_DISABLE_POWER_OFF:
+                IWL_DEBUG_POWER(mvm, "disable_power_off=%d\n", val);
+                dbgfs_pm->disable_power_off = val;
+                break;
+        }
+}
+
+static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
+        enum iwl_dbgfs_pm_mask param;
+        char buf[32] = {};
+        int val;
+        int ret;
+
+        if (copy_from_user(buf, user_buf, sizeof(buf)))
+                return -EFAULT;
+
+        if (!strncmp("keep_alive=", buf, 11)) {
+                if (sscanf(buf + 11, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_KEEP_ALIVE;
+        } else if (!strncmp("skip_over_dtim=", buf, 15)) {
+                if (sscanf(buf + 15, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SKIP_OVER_DTIM;
+        } else if (!strncmp("skip_dtim_periods=", buf, 18)) {
+                if (sscanf(buf + 18, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS;
+        } else if (!strncmp("rx_data_timeout=", buf, 16)) {
+                if (sscanf(buf + 16, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_RX_DATA_TIMEOUT;
+        } else if (!strncmp("tx_data_timeout=", buf, 16)) {
+                if (sscanf(buf + 16, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_TX_DATA_TIMEOUT;
+        } else if (!strncmp("disable_power_off=", buf, 18)) {
+                if (sscanf(buf + 18, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_DISABLE_POWER_OFF;
+        } else {
+                return -EINVAL;
+        }
+
+        mutex_lock(&mvm->mutex);
+        iwl_dbgfs_update_pm(mvm, vif, param, val);
+        ret = iwl_mvm_power_update_mode(mvm, vif);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
+        struct iwl_powertable_cmd cmd = {};
+        char buf[256];
+        int bufsz = sizeof(buf);
+        int pos = 0;
+
+        iwl_mvm_power_build_cmd(mvm, vif, &cmd);
+
+        pos += scnprintf(buf+pos, bufsz-pos, "disable_power_off = %d\n",
+                         (cmd.flags &
+                         cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK)) ?
+                         0 : 1);
+        pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
+                         le32_to_cpu(cmd.skip_dtim_periods));
+        pos += scnprintf(buf+pos, bufsz-pos, "power_scheme = %d\n",
+                         iwlmvm_mod_params.power_scheme);
+        pos += scnprintf(buf+pos, bufsz-pos, "flags = %d\n",
+                         le16_to_cpu(cmd.flags));
+        pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
+                         cmd.keep_alive_seconds);
+
+        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
+                pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
+                                 (cmd.flags &
+                                 cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
+                                 1 : 0);
+                pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.rx_data_timeout));
+                pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.tx_data_timeout));
+        }
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
 static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
                                          char __user *user_buf,
                                          size_t count, loff_t *ppos)
@@ -481,6 +621,255 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
         return count;
 }
 
+static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
+                                enum iwl_dbgfs_bf_mask param, int value)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_dbgfs_bf *dbgfs_bf = &mvmvif->dbgfs_bf;
+
+        dbgfs_bf->mask |= param;
+
+        switch (param) {
+        case MVM_DEBUGFS_BF_ENERGY_DELTA:
+                dbgfs_bf->bf_energy_delta = value;
+                break;
+        case MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA:
+                dbgfs_bf->bf_roaming_energy_delta = value;
+                break;
+        case MVM_DEBUGFS_BF_ROAMING_STATE:
+                dbgfs_bf->bf_roaming_state = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMPERATURE_DELTA:
+                dbgfs_bf->bf_temperature_delta = value;
+                break;
+        case MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER:
+                dbgfs_bf->bf_enable_beacon_filter = value;
+                break;
+        case MVM_DEBUGFS_BF_DEBUG_FLAG:
+                dbgfs_bf->bf_debug_flag = value;
+                break;
+        case MVM_DEBUGFS_BF_ESCAPE_TIMER:
+                dbgfs_bf->bf_escape_timer = value;
+                break;
+        case MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT:
+                dbgfs_bf->ba_enable_beacon_abort = value;
+                break;
+        case MVM_DEBUGFS_BA_ESCAPE_TIMER:
+                dbgfs_bf->ba_escape_timer = value;
+                break;
+        }
+}
+
+static ssize_t iwl_dbgfs_bf_params_write(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
+        enum iwl_dbgfs_bf_mask param;
+        char buf[256];
+        int buf_size;
+        int value;
+        int ret = 0;
+
+        memset(buf, 0, sizeof(buf));
+        buf_size = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, buf_size))
+                return -EFAULT;
+
+        if (!strncmp("bf_energy_delta=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ENERGY_DELTA_MIN ||
+                    value > IWL_BF_ENERGY_DELTA_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ENERGY_DELTA;
+        } else if (!strncmp("bf_roaming_energy_delta=", buf, 24)) {
+                if (sscanf(buf+24, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ROAMING_ENERGY_DELTA_MIN ||
+                    value > IWL_BF_ROAMING_ENERGY_DELTA_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA;
+        } else if (!strncmp("bf_roaming_state=", buf, 17)) {
+                if (sscanf(buf+17, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ROAMING_STATE_MIN ||
+                    value > IWL_BF_ROAMING_STATE_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ROAMING_STATE;
+        } else if (!strncmp("bf_temperature_delta=", buf, 21)) {
+                if (sscanf(buf+21, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMPERATURE_DELTA_MIN ||
+                    value > IWL_BF_TEMPERATURE_DELTA_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMPERATURE_DELTA;
+        } else if (!strncmp("bf_enable_beacon_filter=", buf, 24)) {
+                if (sscanf(buf+24, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER;
+        } else if (!strncmp("bf_debug_flag=", buf, 14)) {
+                if (sscanf(buf+14, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_DEBUG_FLAG;
+        } else if (!strncmp("bf_escape_timer=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ESCAPE_TIMER_MIN ||
+                    value > IWL_BF_ESCAPE_TIMER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ESCAPE_TIMER;
+        } else if (!strncmp("ba_escape_timer=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BA_ESCAPE_TIMER_MIN ||
+                    value > IWL_BA_ESCAPE_TIMER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BA_ESCAPE_TIMER;
+        } else if (!strncmp("ba_enable_beacon_abort=", buf, 23)) {
+                if (sscanf(buf+23, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT;
+        } else {
+                return -EINVAL;
+        }
+
+        mutex_lock(&mvm->mutex);
+        iwl_dbgfs_update_bf(vif, param, value);
+        if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value) {
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+        } else {
+                if (mvmvif->bf_enabled)
+                        ret = iwl_mvm_enable_beacon_filter(mvm, vif);
+                else
+                        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+        }
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_bf_params_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[256];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+        struct iwl_beacon_filter_cmd cmd = {
+                .bf_energy_delta = IWL_BF_ENERGY_DELTA_DEFAULT,
+                .bf_roaming_energy_delta = IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT,
+                .bf_roaming_state = IWL_BF_ROAMING_STATE_DEFAULT,
+                .bf_temperature_delta = IWL_BF_TEMPERATURE_DELTA_DEFAULT,
+                .bf_enable_beacon_filter = IWL_BF_ENABLE_BEACON_FILTER_DEFAULT,
+                .bf_debug_flag = IWL_BF_DEBUG_FLAG_DEFAULT,
+                .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER_DEFAULT),
+                .ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_DEFAULT),
+                .ba_enable_beacon_abort = IWL_BA_ENABLE_BEACON_ABORT_DEFAULT,
+        };
+
+        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
+        if (mvmvif->bf_enabled)
+                cmd.bf_enable_beacon_filter = 1;
+        else
+                cmd.bf_enable_beacon_filter = 0;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_energy_delta = %d\n",
+                         cmd.bf_energy_delta);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_energy_delta = %d\n",
+                         cmd.bf_roaming_energy_delta);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_state = %d\n",
+                         cmd.bf_roaming_state);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temperature_delta = %d\n",
+                         cmd.bf_temperature_delta);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_enable_beacon_filter = %d\n",
+                         cmd.bf_enable_beacon_filter);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_debug_flag = %d\n",
+                         cmd.bf_debug_flag);
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_escape_timer = %d\n",
+                         cmd.bf_escape_timer);
+        pos += scnprintf(buf+pos, bufsz-pos, "ba_escape_timer = %d\n",
+                         cmd.ba_escape_timer);
+        pos += scnprintf(buf+pos, bufsz-pos, "ba_enable_beacon_abort = %d\n",
+                         cmd.ba_enable_beacon_abort);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+#ifdef CONFIG_PM_SLEEP
+static ssize_t iwl_dbgfs_d3_sram_write(struct file *file,
+                                       const char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        char buf[8] = {};
+        int store;
+
+        if (copy_from_user(buf, user_buf, sizeof(buf)))
+                return -EFAULT;
+
+        if (sscanf(buf, "%d", &store) != 1)
+                return -EINVAL;
+
+        mvm->store_d3_resume_sram = store;
+
+        return count;
+}
+
+static ssize_t iwl_dbgfs_d3_sram_read(struct file *file, char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct iwl_mvm *mvm = file->private_data;
+        const struct fw_img *img;
+        int ofs, len, pos = 0;
+        size_t bufsz, ret;
+        char *buf;
+        u8 *ptr = mvm->d3_resume_sram;
+
+        img = &mvm->fw->img[IWL_UCODE_WOWLAN];
+        len = img->sec[IWL_UCODE_SECTION_DATA].len;
+
+        bufsz = len * 4 + 256;
+        buf = kzalloc(bufsz, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        pos += scnprintf(buf, bufsz, "D3 SRAM capture: %sabled\n",
+                         mvm->store_d3_resume_sram ? "en" : "dis");
+
+        if (ptr) {
+                for (ofs = 0; ofs < len; ofs += 16) {
+                        pos += scnprintf(buf + pos, bufsz - pos,
+                                         "0x%.4x ", ofs);
+                        hex_dump_to_buffer(ptr + ofs, 16, 16, 1, buf + pos,
+                                           bufsz - pos, false);
+                        pos += strlen(buf + pos);
+                        if (bufsz - pos > 0)
+                                buf[pos++] = '\n';
+                }
+        } else {
+                pos += scnprintf(buf + pos, bufsz - pos,
+                                 "(no data captured)\n");
+        }
+
+        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+
+        kfree(buf);
+
+        return ret;
+}
+#endif
+
 #define MVM_DEBUGFS_READ_FILE_OPS(name)                                 \
 static const struct file_operations iwl_dbgfs_##name##_ops = {  \
         .read = iwl_dbgfs_##name##_read,                                \
@@ -524,9 +913,14 @@ MVM_DEBUGFS_READ_FILE_OPS(bt_notif);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_allow);
 MVM_DEBUGFS_WRITE_FILE_OPS(power_down_d3_allow);
 MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart);
+#ifdef CONFIG_PM_SLEEP
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram);
+#endif
 
 /* Interface specific debugfs entries */
 MVM_DEBUGFS_READ_FILE_OPS(mac_params);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params);
 
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
 {
@@ -542,6 +936,10 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
         MVM_DEBUGFS_ADD_FILE(power_down_allow, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(power_down_d3_allow, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
+#ifdef CONFIG_PM_SLEEP
+        MVM_DEBUGFS_ADD_FILE(d3_sram, mvm->debugfs_dir, S_IRUSR | S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(d3_test, mvm->debugfs_dir, S_IRUSR);
+#endif
 
         /*
          * Create a symlink with mac80211. It will be removed when mac80211
@@ -577,9 +975,19 @@ void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 return;
         }
 
+        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
+            vif->type == NL80211_IFTYPE_STATION && !vif->p2p)
+                MVM_DEBUGFS_ADD_FILE_VIF(pm_params, mvmvif->dbgfs_dir, S_IWUSR |
+                                         S_IRUSR);
+
         MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir,
                                  S_IRUSR);
 
+        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
+            mvmvif == mvm->bf_allowed_vif)
+                MVM_DEBUGFS_ADD_FILE_VIF(bf_params, mvmvif->dbgfs_dir,
+                                         S_IRUSR | S_IWUSR);
+
         /*
          * Create symlink for convenience pointing to interface specific
          * debugfs entries for the driver. For example, under
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 51e015d1dfb2..6f8b2c16ae17 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -75,13 +75,15 @@ enum iwl_d3_wakeup_flags {
  * struct iwl_d3_manager_config - D3 manager configuration command
  * @min_sleep_time: minimum sleep time (in usec)
  * @wakeup_flags: wakeup flags, see &enum iwl_d3_wakeup_flags
+ * @wakeup_host_timer: force wakeup after this many seconds
  *
  * The structure is used for the D3_CONFIG_CMD command.
  */
 struct iwl_d3_manager_config {
         __le32 min_sleep_time;
         __le32 wakeup_flags;
-} __packed; /* D3_MANAGER_CONFIG_CMD_S_VER_3 */
+        __le32 wakeup_host_timer;
+} __packed; /* D3_MANAGER_CONFIG_CMD_S_VER_4 */
 
 
 /* TODO: OFFLOADS_QUERY_API_S_VER_1 */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
index d68640ea41d4..98b1feb43d38 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
@@ -71,7 +71,13 @@
 #define MAC_INDEX_MIN_DRIVER    0
 #define NUM_MAC_INDEX_DRIVER    MAC_INDEX_AUX
 
-#define AC_NUM  4 /* Number of access categories */
+enum iwl_ac {
+        AC_BK,
+        AC_BE,
+        AC_VI,
+        AC_VO,
+        AC_NUM,
+};
 
 /**
  * enum iwl_mac_protection_flags - MAC context flags
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 81fe45f46be7..d8e19290b0f3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -101,20 +101,107 @@ enum iwl_power_flags {
  * @tx_data_timeout:    Minimum time (usec) from last Tx packet for AM to
  *                      PSM transition - legacy PM
  * @sleep_interval:     not in use
- * @keep_alive_beacons: not in use
+ * @skip_dtim_periods:  Number of DTIM periods to skip if Skip over DTIM flag
+ *                      is set. For example, if it is required to skip over
+ *                      one DTIM, this value need to be set to 2 (DTIM periods).
  * @lprx_rssi_threshold: Signal strength up to which LP RX can be enabled.
  *                      Default: 80dbm
  */
 struct iwl_powertable_cmd {
-        /* PM_POWER_TABLE_CMD_API_S_VER_5 */
+        /* PM_POWER_TABLE_CMD_API_S_VER_6 */
         __le16 flags;
         u8 keep_alive_seconds;
         u8 debug_flags;
         __le32 rx_data_timeout;
         __le32 tx_data_timeout;
         __le32 sleep_interval[IWL_POWER_VEC_SIZE];
-        __le32 keep_alive_beacons;
+        __le32 skip_dtim_periods;
         __le32 lprx_rssi_threshold;
 } __packed;
 
+/**
+ * struct iwl_beacon_filter_cmd
+ * REPLY_BEACON_FILTERING_CMD = 0xd2 (command)
+ * @id_and_color: MAC contex identifier
+ * @bf_energy_delta: Used for RSSI filtering, if in 'normal' state. Send beacon
+ *      to driver if delta in Energy values calculated for this and last
+ *      passed beacon is greater than this threshold. Zero value means that
+ *      the Energy change is ignored for beacon filtering, and beacon will
+ *      not be forced to be sent to driver regardless of this delta. Typical
+ *      energy delta 5dB.
+ * @bf_roaming_energy_delta: Used for RSSI filtering, if in 'roaming' state.
+ *      Send beacon to driver if delta in Energy values calculated for this
+ *      and last passed beacon is greater than this threshold. Zero value
+ *      means that the Energy change is ignored for beacon filtering while in
+ *      Roaming state, typical energy delta 1dB.
+ * @bf_roaming_state: Used for RSSI filtering. If absolute Energy values
+ *      calculated for current beacon is less than the threshold, use
+ *      Roaming Energy Delta Threshold, otherwise use normal Energy Delta
+ *      Threshold. Typical energy threshold is -72dBm.
+ * @bf_temperature_delta: Send Beacon to driver if delta in temperature values
+ *      calculated for this and the last passed beacon is greater than  this
+ *      threshold. Zero value means that the temperature changeis ignored for
+ *      beacon filtering; beacons will not be  forced to be sent to driver
+ *      regardless of whether its temerature has been changed.
+ * @bf_enable_beacon_filter: 1, beacon filtering is enabled; 0, disabled.
+ * @bf_filter_escape_timer: Send beacons to to driver if no beacons were passed
+ *      for a specific period of time. Units: Beacons.
+ * @ba_escape_timer: Fully receive and parse beacon if no beacons were passed
+ *      for a longer period of time then this escape-timeout. Units: Beacons.
+ * @ba_enable_beacon_abort: 1, beacon abort is enabled; 0, disabled.
+ */
+struct iwl_beacon_filter_cmd {
+        u8 bf_energy_delta;
+        u8 bf_roaming_energy_delta;
+        u8 bf_roaming_state;
+        u8 bf_temperature_delta;
+        u8 bf_enable_beacon_filter;
+        u8 bf_debug_flag;
+        __le16 reserved1;
+        __le32 bf_escape_timer;
+        __le32 ba_escape_timer;
+        u8 ba_enable_beacon_abort;
+        u8 reserved2[3];
+} __packed;
+
+/* Beacon filtering and beacon abort */
+#define IWL_BF_ENERGY_DELTA_DEFAULT 5
+#define IWL_BF_ENERGY_DELTA_MAX 255
+#define IWL_BF_ENERGY_DELTA_MIN 0
+
+#define IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT 1
+#define IWL_BF_ROAMING_ENERGY_DELTA_MAX 255
+#define IWL_BF_ROAMING_ENERGY_DELTA_MIN 0
+
+#define IWL_BF_ROAMING_STATE_DEFAULT 72
+#define IWL_BF_ROAMING_STATE_MAX 255
+#define IWL_BF_ROAMING_STATE_MIN 0
+
+#define IWL_BF_TEMPERATURE_DELTA_DEFAULT 5
+#define IWL_BF_TEMPERATURE_DELTA_MAX 255
+#define IWL_BF_TEMPERATURE_DELTA_MIN 0
+
+#define IWL_BF_ENABLE_BEACON_FILTER_DEFAULT 1
+
+#define IWL_BF_DEBUG_FLAG_DEFAULT 0
+
+#define IWL_BF_ESCAPE_TIMER_DEFAULT 50
+#define IWL_BF_ESCAPE_TIMER_MAX 1024
+#define IWL_BF_ESCAPE_TIMER_MIN 0
+
+#define IWL_BA_ESCAPE_TIMER_DEFAULT 3
+#define IWL_BA_ESCAPE_TIMER_MAX 1024
+#define IWL_BA_ESCAPE_TIMER_MIN 0
+
+#define IWL_BA_ENABLE_BEACON_ABORT_DEFAULT 1
+
+#define IWL_BF_CMD_CONFIG_DEFAULTS                                      \
+        .bf_energy_delta = IWL_BF_ENERGY_DELTA_DEFAULT,                 \
+        .bf_roaming_energy_delta = IWL_BF_ROAMING_ENERGY_DELTA_DEFAULT, \
+        .bf_roaming_state = IWL_BF_ROAMING_STATE_DEFAULT,               \
+        .bf_temperature_delta = IWL_BF_TEMPERATURE_DELTA_DEFAULT,       \
+        .bf_debug_flag = IWL_BF_DEBUG_FLAG_DEFAULT,                     \
+        .bf_escape_timer = cpu_to_le32(IWL_BF_ESCAPE_TIMER_DEFAULT),    \
+        .ba_escape_timer = cpu_to_le32(IWL_BA_ESCAPE_TIMER_DEFAULT)
+
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index 007a93b25bd7..6994232f5726 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -134,6 +134,7 @@ enum iwl_tx_flags {
 #define TX_CMD_SEC_WEP                  0x01
 #define TX_CMD_SEC_CCM                  0x02
 #define TX_CMD_SEC_TKIP                 0x03
+#define TX_CMD_SEC_MSK                  0x07
 #define TX_CMD_SEC_WEP_KEY_IDX_POS      6
 #define TX_CMD_SEC_WEP_KEY_IDX_MSK      0xc0
 #define TX_CMD_SEC_KEY128               0x08
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index c6384555aab4..cbfb3beae783 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -139,6 +139,9 @@ enum {
         /* Power */
         POWER_TABLE_CMD = 0x77,
 
+        /* Thermal Throttling*/
+        REPLY_THERMAL_MNG_BACKOFF = 0x7e,
+
         /* Scanning */
         SCAN_REQUEST_CMD = 0x80,
         SCAN_ABORT_CMD = 0x81,
@@ -161,6 +164,8 @@ enum {
         CARD_STATE_CMD = 0xa0,
         CARD_STATE_NOTIFICATION = 0xa1,
 
+        MISSED_BEACONS_NOTIFICATION = 0xa2,
+
         REPLY_RX_PHY_CMD = 0xc0,
         REPLY_RX_MPDU_CMD = 0xc1,
         BA_NOTIF = 0xc5,
@@ -170,6 +175,8 @@ enum {
         BT_COEX_PROT_ENV = 0xcd,
         BT_PROFILE_NOTIFICATION = 0xce,
 
+        REPLY_BEACON_FILTERING_CMD = 0xd2,
+
         REPLY_DEBUG_CMD = 0xf0,
         DEBUG_LOG_MSG = 0xf7,
 
@@ -938,6 +945,24 @@ struct iwl_card_state_notif {
 } __packed; /* CARD_STATE_NTFY_API_S_VER_1 */
 
 /**
+ * struct iwl_missed_beacons_notif - information on missed beacons
+ * ( MISSED_BEACONS_NOTIFICATION = 0xa2 )
+ * @mac_id: interface ID
+ * @consec_missed_beacons_since_last_rx: number of consecutive missed
+ *      beacons since last RX.
+ * @consec_missed_beacons: number of consecutive missed beacons
+ * @num_expected_beacons:
+ * @num_recvd_beacons:
+ */
+struct iwl_missed_beacons_notif {
+        __le32 mac_id;
+        __le32 consec_missed_beacons_since_last_rx;
+        __le32 consec_missed_beacons;
+        __le32 num_expected_beacons;
+        __le32 num_recvd_beacons;
+} __packed; /* MISSED_BEACON_NTFY_API_S_VER_3 */
+
+/**
  * struct iwl_set_calib_default_cmd - set default value for calibration.
  * ( SET_CALIB_DEFAULT_CMD = 0x8e )
  * @calib_index: the calibration to set value for
@@ -975,4 +1000,212 @@ struct iwl_mcast_filter_cmd {
         u8 addr_list[0];
 } __packed; /* MCAST_FILTERING_CMD_API_S_VER_1 */
 
+struct mvm_statistics_dbg {
+        __le32 burst_check;
+        __le32 burst_count;
+        __le32 wait_for_silence_timeout_cnt;
+        __le32 reserved[3];
+} __packed; /* STATISTICS_DEBUG_API_S_VER_2 */
+
+struct mvm_statistics_div {
+        __le32 tx_on_a;
+        __le32 tx_on_b;
+        __le32 exec_time;
+        __le32 probe_time;
+        __le32 rssi_ant;
+        __le32 reserved2;
+} __packed; /* STATISTICS_SLOW_DIV_API_S_VER_2 */
+
+struct mvm_statistics_general_common {
+        __le32 temperature;   /* radio temperature */
+        __le32 temperature_m; /* radio voltage */
+        struct mvm_statistics_dbg dbg;
+        __le32 sleep_time;
+        __le32 slots_out;
+        __le32 slots_idle;
+        __le32 ttl_timestamp;
+        struct mvm_statistics_div div;
+        __le32 rx_enable_counter;
+        /*
+         * num_of_sos_states:
+         *  count the number of times we have to re-tune
+         *  in order to get out of bad PHY status
+         */
+        __le32 num_of_sos_states;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
+
+struct mvm_statistics_rx_non_phy {
+        __le32 bogus_cts;       /* CTS received when not expecting CTS */
+        __le32 bogus_ack;       /* ACK received when not expecting ACK */
+        __le32 non_bssid_frames;        /* number of frames with BSSID that
+                                         * doesn't belong to the STA BSSID */
+        __le32 filtered_frames; /* count frames that were dumped in the
+                                 * filtering process */
+        __le32 non_channel_beacons;     /* beacons with our bss id but not on
+                                         * our serving channel */
+        __le32 channel_beacons; /* beacons with our bss id and in our
+                                 * serving channel */
+        __le32 num_missed_bcon; /* number of missed beacons */
+        __le32 adc_rx_saturation_time;  /* count in 0.8us units the time the
+                                         * ADC was in saturation */
+        __le32 ina_detection_search_time;/* total time (in 0.8us) searched
+                                          * for INA */
+        __le32 beacon_silence_rssi_a;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_b;   /* RSSI silence after beacon frame */
+        __le32 beacon_silence_rssi_c;   /* RSSI silence after beacon frame */
+        __le32 interference_data_flag;  /* flag for interference data
+                                         * availability. 1 when data is
+                                         * available. */
+        __le32 channel_load;            /* counts RX Enable time in uSec */
+        __le32 dsp_false_alarms;        /* DSP false alarm (both OFDM
+                                         * and CCK) counter */
+        __le32 beacon_rssi_a;
+        __le32 beacon_rssi_b;
+        __le32 beacon_rssi_c;
+        __le32 beacon_energy_a;
+        __le32 beacon_energy_b;
+        __le32 beacon_energy_c;
+        __le32 num_bt_kills;
+        __le32 mac_id;
+        __le32 directed_data_mpdu;
+} __packed; /* STATISTICS_RX_NON_PHY_API_S_VER_3 */
+
+struct mvm_statistics_rx_phy {
+        __le32 ina_cnt;
+        __le32 fina_cnt;
+        __le32 plcp_err;
+        __le32 crc32_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 false_alarm_cnt;
+        __le32 fina_sync_err_cnt;
+        __le32 sfd_timeout;
+        __le32 fina_timeout;
+        __le32 unresponded_rts;
+        __le32 rxe_frame_limit_overrun;
+        __le32 sent_ack_cnt;
+        __le32 sent_cts_cnt;
+        __le32 sent_ba_rsp_cnt;
+        __le32 dsp_self_kill;
+        __le32 mh_format_err;
+        __le32 re_acq_main_rssi_sum;
+        __le32 reserved;
+} __packed; /* STATISTICS_RX_PHY_API_S_VER_2 */
+
+struct mvm_statistics_rx_ht_phy {
+        __le32 plcp_err;
+        __le32 overrun_err;
+        __le32 early_overrun_err;
+        __le32 crc32_good;
+        __le32 crc32_err;
+        __le32 mh_format_err;
+        __le32 agg_crc32_good;
+        __le32 agg_mpdu_cnt;
+        __le32 agg_cnt;
+        __le32 unsupport_mcs;
+} __packed;  /* STATISTICS_HT_RX_PHY_API_S_VER_1 */
+
+#define MAX_CHAINS 3
+
+struct mvm_statistics_tx_non_phy_agg {
+        __le32 ba_timeout;
+        __le32 ba_reschedule_frames;
+        __le32 scd_query_agg_frame_cnt;
+        __le32 scd_query_no_agg;
+        __le32 scd_query_agg;
+        __le32 scd_query_mismatch;
+        __le32 frame_not_ready;
+        __le32 underrun;
+        __le32 bt_prio_kill;
+        __le32 rx_ba_rsp_cnt;
+        __s8 txpower[MAX_CHAINS];
+        __s8 reserved;
+        __le32 reserved2;
+} __packed; /* STATISTICS_TX_NON_PHY_AGG_API_S_VER_1 */
+
+struct mvm_statistics_tx_channel_width {
+        __le32 ext_cca_narrow_ch20[1];
+        __le32 ext_cca_narrow_ch40[2];
+        __le32 ext_cca_narrow_ch80[3];
+        __le32 ext_cca_narrow_ch160[4];
+        __le32 last_tx_ch_width_indx;
+        __le32 rx_detected_per_ch_width[4];
+        __le32 success_per_ch_width[4];
+        __le32 fail_per_ch_width[4];
+}; /* STATISTICS_TX_CHANNEL_WIDTH_API_S_VER_1 */
+
+struct mvm_statistics_tx {
+        __le32 preamble_cnt;
+        __le32 rx_detected_cnt;
+        __le32 bt_prio_defer_cnt;
+        __le32 bt_prio_kill_cnt;
+        __le32 few_bytes_cnt;
+        __le32 cts_timeout;
+        __le32 ack_timeout;
+        __le32 expected_ack_cnt;
+        __le32 actual_ack_cnt;
+        __le32 dump_msdu_cnt;
+        __le32 burst_abort_next_frame_mismatch_cnt;
+        __le32 burst_abort_missing_next_frame_cnt;
+        __le32 cts_timeout_collision;
+        __le32 ack_or_ba_timeout_collision;
+        struct mvm_statistics_tx_non_phy_agg agg;
+        struct mvm_statistics_tx_channel_width channel_width;
+} __packed; /* STATISTICS_TX_API_S_VER_4 */
+
+
+struct mvm_statistics_bt_activity {
+        __le32 hi_priority_tx_req_cnt;
+        __le32 hi_priority_tx_denied_cnt;
+        __le32 lo_priority_tx_req_cnt;
+        __le32 lo_priority_tx_denied_cnt;
+        __le32 hi_priority_rx_req_cnt;
+        __le32 hi_priority_rx_denied_cnt;
+        __le32 lo_priority_rx_req_cnt;
+        __le32 lo_priority_rx_denied_cnt;
+} __packed;  /* STATISTICS_BT_ACTIVITY_API_S_VER_1 */
+
+struct mvm_statistics_general {
+        struct mvm_statistics_general_common common;
+        __le32 beacon_filtered;
+        __le32 missed_beacons;
+        __s8 beacon_filter_everage_energy;
+        __s8 beacon_filter_reason;
+        __s8 beacon_filter_current_energy;
+        __s8 beacon_filter_reserved;
+        __le32 beacon_filter_delta_time;
+        struct mvm_statistics_bt_activity bt_activity;
+} __packed; /* STATISTICS_GENERAL_API_S_VER_5 */
+
+struct mvm_statistics_rx {
+        struct mvm_statistics_rx_phy ofdm;
+        struct mvm_statistics_rx_phy cck;
+        struct mvm_statistics_rx_non_phy general;
+        struct mvm_statistics_rx_ht_phy ofdm_ht;
+} __packed; /* STATISTICS_RX_API_S_VER_3 */
+
+/*
+ * STATISTICS_NOTIFICATION = 0x9d (notification only, not a command)
+ *
+ * By default, uCode issues this notification after receiving a beacon
+ * while associated.  To disable this behavior, set DISABLE_NOTIF flag in the
+ * REPLY_STATISTICS_CMD 0x9c, above.
+ *
+ * Statistics counters continue to increment beacon after beacon, but are
+ * cleared when changing channels or when driver issues REPLY_STATISTICS_CMD
+ * 0x9c with CLEAR_STATS bit set (see above).
+ *
+ * uCode also issues this notification during scans.  uCode clears statistics
+ * appropriately so that each notification contains statistics for only the
+ * one channel that has just been scanned.
+ */
+
+struct iwl_notif_statistics { /* STATISTICS_NTFY_API_S_VER_8 */
+        __le32 flag;
+        struct mvm_statistics_rx rx;
+        struct mvm_statistics_tx tx;
+        struct mvm_statistics_general general;
+} __packed;
+
 #endif /* __fw_api_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index e18c92dd60ec..cd7c0032cc58 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -326,6 +326,17 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
         ret = iwl_nvm_check_version(mvm->nvm_data, mvm->trans);
         WARN_ON(ret);
 
+        /*
+         * abort after reading the nvm in case RF Kill is on, we will complete
+         * the init seq later when RF kill will switch to off
+         */
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_RF_KILL(mvm,
+                                  "jump over all phy activities due to RF kill\n");
+                iwl_remove_notification(&mvm->notif_wait, &calib_wait);
+                return 1;
+        }
+
         /* Send TX valid antennas before triggering calibrations */
         ret = iwl_send_tx_ant_cfg(mvm, iwl_fw_valid_tx_ant(mvm->fw));
         if (ret)
@@ -388,6 +399,8 @@ out:
 int iwl_mvm_up(struct iwl_mvm *mvm)
 {
         int ret, i;
+        struct ieee80211_channel *chan;
+        struct cfg80211_chan_def chandef;
 
         lockdep_assert_held(&mvm->mutex);
 
@@ -400,8 +413,16 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 ret = iwl_run_init_mvm_ucode(mvm, false);
                 if (ret && !iwlmvm_mod_params.init_dbg) {
                         IWL_ERR(mvm, "Failed to run INIT ucode: %d\n", ret);
+                        /* this can't happen */
+                        if (WARN_ON(ret > 0))
+                                ret = -ERFKILL;
                         goto error;
                 }
+                /* should stop & start HW since that INIT image just loaded */
+                iwl_trans_stop_hw(mvm->trans, false);
+                ret = iwl_trans_start_hw(mvm->trans);
+                if (ret)
+                        return ret;
         }
 
         if (iwlmvm_mod_params.init_dbg)
@@ -443,8 +464,22 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
         if (ret)
                 goto error;
 
-        IWL_DEBUG_INFO(mvm, "RT uCode started.\n");
+        /* Add all the PHY contexts */
+        chan = &mvm->hw->wiphy->bands[IEEE80211_BAND_2GHZ]->channels[0];
+        cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_NO_HT);
+        for (i = 0; i < NUM_PHY_CTX; i++) {
+                /*
+                 * The channel used here isn't relevant as it's
+                 * going to be overwritten in the other flows.
+                 * For now use the first channel we have.
+                 */
+                ret = iwl_mvm_phy_ctxt_add(mvm, &mvm->phy_ctxts[i],
+                                           &chandef, 1, 1);
+                if (ret)
+                        goto error;
+        }
 
+        IWL_DEBUG_INFO(mvm, "RT uCode started.\n");
         return 0;
  error:
         iwl_trans_stop_device(mvm->trans);
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index b2cc3d98e0f7..46c7c0507c25 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -227,7 +227,7 @@ static int iwl_mvm_mac_ctxt_allocate_resources(struct iwl_mvm *mvm,
                 .found_vif = false,
         };
         u32 ac;
-        int ret;
+        int ret, i;
 
         /*
          * Allocate a MAC ID and a TSF for this MAC, along with the queues
@@ -335,6 +335,9 @@ static int iwl_mvm_mac_ctxt_allocate_resources(struct iwl_mvm *mvm,
         mvmvif->bcast_sta.sta_id = IWL_MVM_STATION_COUNT;
         mvmvif->ap_sta_id = IWL_MVM_STATION_COUNT;
 
+        for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++)
+                mvmvif->smps_requests[i] = IEEE80211_SMPS_AUTOMATIC;
+
         return 0;
 
 exit_fail:
@@ -362,7 +365,7 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
                 break;
         case NL80211_IFTYPE_AP:
                 iwl_trans_ac_txq_enable(mvm->trans, vif->cab_queue,
-                                        IWL_MVM_TX_FIFO_VO);
+                                        IWL_MVM_TX_FIFO_MCAST);
                 /* fall through */
         default:
                 for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
@@ -550,6 +553,10 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                 cmd->ac[i].fifos_mask = BIT(iwl_mvm_ac_to_tx_fifo[i]);
         }
 
+        /* in AP mode, the MCAST FIFO takes the EDCA params from VO */
+        if (vif->type == NL80211_IFTYPE_AP)
+                cmd->ac[AC_VO].fifos_mask |= BIT(IWL_MVM_TX_FIFO_MCAST);
+
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
 
@@ -1047,3 +1054,28 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
                      rate);
         return 0;
 }
+
+static void iwl_mvm_beacon_loss_iterator(void *_data, u8 *mac,
+                                         struct ieee80211_vif *vif)
+{
+        u16 *id = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (mvmvif->id == *id)
+                ieee80211_beacon_loss(vif);
+}
+
+int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
+                                    struct iwl_rx_cmd_buffer *rxb,
+                                    struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_missed_beacons_notif *missed_beacons = (void *)pkt->data;
+        u16 id = (u16)le32_to_cpu(missed_beacons->mac_id);
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   iwl_mvm_beacon_loss_iterator,
+                                                   &id);
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index a5eb8c82f16a..2ed296caeb28 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -127,6 +127,17 @@ static const struct wiphy_wowlan_tcp_support iwl_mvm_wowlan_tcp_support = {
 };
 #endif
 
+static void iwl_mvm_reset_phy_ctxts(struct iwl_mvm *mvm)
+{
+        int i;
+
+        memset(mvm->phy_ctxts, 0, sizeof(mvm->phy_ctxts));
+        for (i = 0; i < NUM_PHY_CTX; i++) {
+                mvm->phy_ctxts[i].id = i;
+                mvm->phy_ctxts[i].ref = 0;
+        }
+}
+
 int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 {
         struct ieee80211_hw *hw = mvm->hw;
@@ -141,7 +152,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                     IEEE80211_HW_SUPPORTS_PS |
                     IEEE80211_HW_SUPPORTS_DYNAMIC_PS |
                     IEEE80211_HW_AMPDU_AGGREGATION |
-                    IEEE80211_HW_TIMING_BEACON_ONLY;
+                    IEEE80211_HW_TIMING_BEACON_ONLY |
+                    IEEE80211_HW_CONNECTION_MONITOR;
 
         hw->queues = IWL_MVM_FIRST_AGG_QUEUE;
         hw->offchannel_tx_hw_queue = IWL_MVM_OFFCHANNEL_QUEUE;
@@ -158,7 +170,7 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
 
         hw->sta_data_size = sizeof(struct iwl_mvm_sta);
         hw->vif_data_size = sizeof(struct iwl_mvm_vif);
-        hw->chanctx_data_size = sizeof(struct iwl_mvm_phy_ctxt);
+        hw->chanctx_data_size = sizeof(u16);
 
         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
@@ -193,6 +205,8 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
                 hw->wiphy->n_addresses++;
         }
 
+        iwl_mvm_reset_phy_ctxts(mvm);
+
         /* we create the 802.11 header and a max-length SSID element */
         hw->wiphy->max_scan_ie_len =
                 mvm->fw->ucode_capa.max_probe_length - 24 - 34;
@@ -252,8 +266,8 @@ static void iwl_mvm_mac_tx(struct ieee80211_hw *hw,
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
 
-        if (test_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status)) {
-                IWL_DEBUG_DROP(mvm, "Dropping - RF KILL\n");
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                IWL_DEBUG_DROP(mvm, "Dropping - RF/CT KILL\n");
                 goto drop;
         }
 
@@ -345,8 +359,7 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
         iwl_mvm_te_clear_data(mvm, &mvmvif->time_event_data);
         spin_unlock_bh(&mvm->time_event_lock);
 
-        if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
-                mvmvif->phy_ctxt = NULL;
+        mvmvif->phy_ctxt = NULL;
 }
 
 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
@@ -363,6 +376,9 @@ static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
                 mvm->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
                 iwl_mvm_cleanup_iterator, mvm);
 
+        mvm->p2p_device_vif = NULL;
+
+        iwl_mvm_reset_phy_ctxts(mvm);
         memset(mvm->fw_key_table, 0, sizeof(mvm->fw_key_table));
         memset(mvm->sta_drained, 0, sizeof(mvm->sta_drained));
 
@@ -456,6 +472,20 @@ static void iwl_mvm_power_update_iterator(void *data, u8 *mac,
         iwl_mvm_power_update_mode(mvm, vif);
 }
 
+static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
+{
+        u16 i;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        for (i = 0; i < NUM_PHY_CTX; i++)
+                if (!mvm->phy_ctxts[i].ref)
+                        return &mvm->phy_ctxts[i];
+
+        IWL_ERR(mvm, "No available PHY context\n");
+        return NULL;
+}
+
 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif)
 {
@@ -530,32 +560,34 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
          */
         iwl_mvm_power_update_mode(mvm, vif);
 
+        /* beacon filtering */
+        if (!mvm->bf_allowed_vif &&
+            vif->type == NL80211_IFTYPE_STATION && !vif->p2p){
+                mvm->bf_allowed_vif = mvmvif;
+                vif->driver_flags |= IEEE80211_VIF_BEACON_FILTER;
+        }
+
+        ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+        if (ret)
+                goto out_release;
+
         /*
          * P2P_DEVICE interface does not have a channel context assigned to it,
          * so a dedicated PHY context is allocated to it and the corresponding
          * MAC context is bound to it at this stage.
          */
         if (vif->type == NL80211_IFTYPE_P2P_DEVICE) {
-                struct ieee80211_channel *chan;
-                struct cfg80211_chan_def chandef;
 
-                mvmvif->phy_ctxt = &mvm->phy_ctxt_roc;
-
-                /*
-                 * The channel used here isn't relevant as it's
-                 * going to be overwritten as part of the ROC flow.
-                 * For now use the first channel we have.
-                 */
-                chan = &mvm->hw->wiphy->bands[IEEE80211_BAND_2GHZ]->channels[0];
-                cfg80211_chandef_create(&chandef, chan, NL80211_CHAN_NO_HT);
-                ret = iwl_mvm_phy_ctxt_add(mvm, mvmvif->phy_ctxt,
-                                           &chandef, 1, 1);
-                if (ret)
+                mvmvif->phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
+                if (!mvmvif->phy_ctxt) {
+                        ret = -ENOSPC;
                         goto out_remove_mac;
+                }
 
+                iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
                 ret = iwl_mvm_binding_add_vif(mvm, vif);
                 if (ret)
-                        goto out_remove_phy;
+                        goto out_unref_phy;
 
                 ret = iwl_mvm_add_bcast_sta(mvm, vif, &mvmvif->bcast_sta);
                 if (ret)
@@ -571,27 +603,17 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
 
  out_unbind:
         iwl_mvm_binding_remove_vif(mvm, vif);
- out_remove_phy:
-        iwl_mvm_phy_ctxt_remove(mvm, mvmvif->phy_ctxt);
+ out_unref_phy:
+        iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
  out_remove_mac:
         mvmvif->phy_ctxt = NULL;
         iwl_mvm_mac_ctxt_remove(mvm, vif);
  out_release:
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * Check if only one additional interface remains after releasing
-         * current one. Update power mode on the remaining interface.
-         */
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
-        IWL_DEBUG_MAC80211(mvm, "Currently %d interfaces active\n",
-                           mvm->vif_count);
-        if (mvm->vif_count == 1) {
-                ieee80211_iterate_active_interfaces(
-                                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
-                                        iwl_mvm_power_update_iterator, mvm);
-        }
+        ieee80211_iterate_active_interfaces(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_power_update_iterator, mvm);
         iwl_mvm_mac_ctxt_release(mvm, vif);
  out_unlock:
         mutex_unlock(&mvm->mutex);
@@ -646,6 +668,11 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
 
         mutex_lock(&mvm->mutex);
 
+        if (mvm->bf_allowed_vif == mvmvif) {
+                mvm->bf_allowed_vif = NULL;
+                vif->driver_flags &= ~IEEE80211_VIF_BEACON_FILTER;
+        }
+
         iwl_mvm_vif_dbgfs_clean(mvm, vif);
 
         /*
@@ -661,7 +688,7 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                 mvm->p2p_device_vif = NULL;
                 iwl_mvm_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
                 iwl_mvm_binding_remove_vif(mvm, vif);
-                iwl_mvm_phy_ctxt_remove(mvm, mvmvif->phy_ctxt);
+                iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
                 mvmvif->phy_ctxt = NULL;
         }
 
@@ -748,6 +775,9 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                         if (ret)
                                 IWL_ERR(mvm, "failed to update quotas\n");
                 }
+                ret = iwl_mvm_power_update_mode(mvm, vif);
+                if (ret)
+                        IWL_ERR(mvm, "failed to update power mode\n");
         } else if (changes & BSS_CHANGED_DTIM_PERIOD) {
                 /*
                  * We received a beacon _after_ association so
@@ -756,19 +786,9 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
         } else if (changes & BSS_CHANGED_PS) {
-                /*
-                 * TODO: remove this temporary code.
-                 * Currently MVM FW supports power management only on single
-                 * MAC. Avoid power mode update if more than one interface
-                 * is active.
-                 */
-                IWL_DEBUG_MAC80211(mvm, "Currently %d interfaces active\n",
-                                   mvm->vif_count);
-                if (mvm->vif_count == 1) {
-                        ret = iwl_mvm_power_update_mode(mvm, vif);
-                        if (ret)
-                                IWL_ERR(mvm, "failed to update power mode\n");
-                }
+                ret = iwl_mvm_power_update_mode(mvm, vif);
+                if (ret)
+                        IWL_ERR(mvm, "failed to update power mode\n");
         }
 }
 
@@ -999,9 +1019,13 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                              mvmvif->phy_ctxt->channel->band);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
+                /* enable beacon filtering */
+                WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_AUTHORIZED &&
                    new_state == IEEE80211_STA_ASSOC) {
+                /* disable beacon filtering */
+                WARN_ON(iwl_mvm_disable_beacon_filter(mvm, vif));
                 ret = 0;
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTH) {
@@ -1167,29 +1191,107 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
                        enum ieee80211_roc_type type)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct cfg80211_chan_def chandef;
-        int ret;
+        struct iwl_mvm_phy_ctxt *phy_ctxt;
+        int ret, i;
+
+        IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
+                           duration, type);
 
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE) {
                 IWL_ERR(mvm, "vif isn't a P2P_DEVICE: %d\n", vif->type);
                 return -EINVAL;
         }
 
-        IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
-                           duration, type);
-
         mutex_lock(&mvm->mutex);
 
+        for (i = 0; i < NUM_PHY_CTX; i++) {
+                phy_ctxt = &mvm->phy_ctxts[i];
+                if (phy_ctxt->ref == 0 || mvmvif->phy_ctxt == phy_ctxt)
+                        continue;
+
+                if (phy_ctxt->ref && channel == phy_ctxt->channel) {
+                        /*
+                         * Unbind the P2P_DEVICE from the current PHY context,
+                         * and if the PHY context is not used remove it.
+                         */
+                        ret = iwl_mvm_binding_remove_vif(mvm, vif);
+                        if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
+                                goto out_unlock;
+
+                        iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
+
+                        /* Bind the P2P_DEVICE to the current PHY Context */
+                        mvmvif->phy_ctxt = phy_ctxt;
+
+                        ret = iwl_mvm_binding_add_vif(mvm, vif);
+                        if (WARN(ret, "Failed binding P2P_DEVICE\n"))
+                                goto out_unlock;
+
+                        iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
+                        goto schedule_time_event;
+                }
+        }
+
+        /* Need to update the PHY context only if the ROC channel changed */
+        if (channel == mvmvif->phy_ctxt->channel)
+                goto schedule_time_event;
+
         cfg80211_chandef_create(&chandef, channel, NL80211_CHAN_NO_HT);
-        ret = iwl_mvm_phy_ctxt_changed(mvm, &mvm->phy_ctxt_roc,
-                                       &chandef, 1, 1);
 
+        /*
+         * Change the PHY context configuration as it is currently referenced
+         * only by the P2P Device MAC
+         */
+        if (mvmvif->phy_ctxt->ref == 1) {
+                ret = iwl_mvm_phy_ctxt_changed(mvm, mvmvif->phy_ctxt,
+                                               &chandef, 1, 1);
+                if (ret)
+                        goto out_unlock;
+        } else {
+                /*
+                 * The PHY context is shared with other MACs. Need to remove the
+                 * P2P Device from the binding, allocate an new PHY context and
+                 * create a new binding
+                 */
+                phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
+                if (!phy_ctxt) {
+                        ret = -ENOSPC;
+                        goto out_unlock;
+                }
+
+                ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &chandef,
+                                               1, 1);
+                if (ret) {
+                        IWL_ERR(mvm, "Failed to change PHY context\n");
+                        goto out_unlock;
+                }
+
+                /* Unbind the P2P_DEVICE from the current PHY context */
+                ret = iwl_mvm_binding_remove_vif(mvm, vif);
+                if (WARN(ret, "Failed unbinding P2P_DEVICE\n"))
+                        goto out_unlock;
+
+                iwl_mvm_phy_ctxt_unref(mvm, mvmvif->phy_ctxt);
+
+                /* Bind the P2P_DEVICE to the new allocated PHY context */
+                mvmvif->phy_ctxt = phy_ctxt;
+
+                ret = iwl_mvm_binding_add_vif(mvm, vif);
+                if (WARN(ret, "Failed binding P2P_DEVICE\n"))
+                        goto out_unlock;
+
+                iwl_mvm_phy_ctxt_ref(mvm, mvmvif->phy_ctxt);
+        }
+
+schedule_time_event:
         /* Schedule the time events */
         ret = iwl_mvm_start_p2p_roc(mvm, vif, duration, type);
 
+out_unlock:
         mutex_unlock(&mvm->mutex);
         IWL_DEBUG_MAC80211(mvm, "leave\n");
-
         return ret;
 }
 
@@ -1211,15 +1313,30 @@ static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
                                struct ieee80211_chanctx_conf *ctx)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_phy_ctxt *phy_ctxt = (void *)ctx->drv_priv;
+        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
+        struct iwl_mvm_phy_ctxt *phy_ctxt;
         int ret;
 
+        IWL_DEBUG_MAC80211(mvm, "Add channel context\n");
+
         mutex_lock(&mvm->mutex);
+        phy_ctxt = iwl_mvm_get_free_phy_ctxt(mvm);
+        if (!phy_ctxt) {
+                ret = -ENOSPC;
+                goto out;
+        }
 
-        IWL_DEBUG_MAC80211(mvm, "Add PHY context\n");
-        ret = iwl_mvm_phy_ctxt_add(mvm, phy_ctxt, &ctx->def,
-                                   ctx->rx_chains_static,
-                                   ctx->rx_chains_dynamic);
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->def,
+                                       ctx->rx_chains_static,
+                                       ctx->rx_chains_dynamic);
+        if (ret) {
+                IWL_ERR(mvm, "Failed to add PHY context\n");
+                goto out;
+        }
+
+        iwl_mvm_phy_ctxt_ref(mvm, phy_ctxt);
+        *phy_ctxt_id = phy_ctxt->id;
+out:
         mutex_unlock(&mvm->mutex);
         return ret;
 }
@@ -1228,10 +1345,11 @@ static void iwl_mvm_remove_chanctx(struct ieee80211_hw *hw,
                                    struct ieee80211_chanctx_conf *ctx)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_phy_ctxt *phy_ctxt = (void *)ctx->drv_priv;
+        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
+        struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
 
         mutex_lock(&mvm->mutex);
-        iwl_mvm_phy_ctxt_remove(mvm, phy_ctxt);
+        iwl_mvm_phy_ctxt_unref(mvm, phy_ctxt);
         mutex_unlock(&mvm->mutex);
 }
 
@@ -1240,7 +1358,16 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
                                    u32 changed)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_phy_ctxt *phy_ctxt = (void *)ctx->drv_priv;
+        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
+        struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
+
+        if (WARN_ONCE((phy_ctxt->ref > 1) &&
+                      (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
+                                   IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
+                                   IEEE80211_CHANCTX_CHANGE_RADAR)),
+                      "Cannot change PHY. Ref=%d, changed=0x%X\n",
+                      phy_ctxt->ref, changed))
+                return;
 
         mutex_lock(&mvm->mutex);
         iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->def,
@@ -1254,13 +1381,14 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
                                       struct ieee80211_chanctx_conf *ctx)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_phy_ctxt *phyctx = (void *)ctx->drv_priv;
+        u16 *phy_ctxt_id = (u16 *)ctx->drv_priv;
+        struct iwl_mvm_phy_ctxt *phy_ctxt = &mvm->phy_ctxts[*phy_ctxt_id];
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
         mutex_lock(&mvm->mutex);
 
-        mvmvif->phy_ctxt = phyctx;
+        mvmvif->phy_ctxt = phy_ctxt;
 
         switch (vif->type) {
         case NL80211_IFTYPE_AP:
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index 9f46b23801bc..4e10aae71038 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -88,6 +88,7 @@ enum iwl_mvm_tx_fifo {
         IWL_MVM_TX_FIFO_BE,
         IWL_MVM_TX_FIFO_VI,
         IWL_MVM_TX_FIFO_VO,
+        IWL_MVM_TX_FIFO_MCAST = 5,
 };
 
 extern struct ieee80211_ops iwl_mvm_hw_ops;
@@ -109,6 +110,7 @@ extern struct iwl_mvm_mod_params iwlmvm_mod_params;
 struct iwl_mvm_phy_ctxt {
         u16 id;
         u16 color;
+        u32 ref;
 
         /*
          * TODO: This should probably be removed. Currently here only for rate
@@ -149,6 +151,60 @@ enum iwl_power_scheme {
 
 #define IWL_CONN_MAX_LISTEN_INTERVAL    70
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+enum iwl_dbgfs_pm_mask {
+        MVM_DEBUGFS_PM_KEEP_ALIVE = BIT(0),
+        MVM_DEBUGFS_PM_SKIP_OVER_DTIM = BIT(1),
+        MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS = BIT(2),
+        MVM_DEBUGFS_PM_RX_DATA_TIMEOUT = BIT(3),
+        MVM_DEBUGFS_PM_TX_DATA_TIMEOUT = BIT(4),
+        MVM_DEBUGFS_PM_DISABLE_POWER_OFF = BIT(5),
+};
+
+struct iwl_dbgfs_pm {
+        u8 keep_alive_seconds;
+        u32 rx_data_timeout;
+        u32 tx_data_timeout;
+        bool skip_over_dtim;
+        u8 skip_dtim_periods;
+        bool disable_power_off;
+        int mask;
+};
+
+/* beacon filtering */
+
+enum iwl_dbgfs_bf_mask {
+        MVM_DEBUGFS_BF_ENERGY_DELTA = BIT(0),
+        MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA = BIT(1),
+        MVM_DEBUGFS_BF_ROAMING_STATE = BIT(2),
+        MVM_DEBUGFS_BF_TEMPERATURE_DELTA = BIT(3),
+        MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER = BIT(4),
+        MVM_DEBUGFS_BF_DEBUG_FLAG = BIT(5),
+        MVM_DEBUGFS_BF_ESCAPE_TIMER = BIT(6),
+        MVM_DEBUGFS_BA_ESCAPE_TIMER = BIT(7),
+        MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT = BIT(8),
+};
+
+struct iwl_dbgfs_bf {
+        u8 bf_energy_delta;
+        u8 bf_roaming_energy_delta;
+        u8 bf_roaming_state;
+        u8 bf_temperature_delta;
+        u8 bf_enable_beacon_filter;
+        u8 bf_debug_flag;
+        u32 bf_escape_timer;
+        u32 ba_escape_timer;
+        u8 ba_enable_beacon_abort;
+        int mask;
+};
+#endif
+
+enum iwl_mvm_smps_type_request {
+        IWL_MVM_SMPS_REQ_BT_COEX,
+        IWL_MVM_SMPS_REQ_TT,
+        NUM_IWL_MVM_SMPS_REQ,
+};
+
 /**
  * struct iwl_mvm_vif - data per Virtual Interface, it is a MAC context
  * @id: between 0 and 3
@@ -163,6 +219,8 @@ enum iwl_power_scheme {
  * @bcast_sta: station used for broadcast packets. Used by the following
  *  vifs: P2P_DEVICE, GO and AP.
  * @beacon_skb: the skb used to hold the AP/GO beacon template
+ * @smps_requests: the requests of of differents parts of the driver, regard
+        the desired smps mode.
  */
 struct iwl_mvm_vif {
         u16 id;
@@ -172,6 +230,8 @@ struct iwl_mvm_vif {
         bool uploaded;
         bool ap_active;
         bool monitor_active;
+        /* indicate whether beacon filtering is enabled */
+        bool bf_enabled;
 
         u32 ap_beacon_time;
 
@@ -214,7 +274,11 @@ struct iwl_mvm_vif {
         struct dentry *dbgfs_dir;
         struct dentry *dbgfs_slink;
         void *dbgfs_data;
+        struct iwl_dbgfs_pm dbgfs_pm;
+        struct iwl_dbgfs_bf dbgfs_bf;
 #endif
+
+        enum ieee80211_smps_mode smps_requests[NUM_IWL_MVM_SMPS_REQ];
 };
 
 static inline struct iwl_mvm_vif *
@@ -223,12 +287,6 @@ iwl_mvm_vif_from_mac80211(struct ieee80211_vif *vif)
         return (void *)vif->drv_priv;
 }
 
-enum iwl_mvm_status {
-        IWL_MVM_STATUS_HW_RFKILL,
-        IWL_MVM_STATUS_ROC_RUNNING,
-        IWL_MVM_STATUS_IN_HW_RESTART,
-};
-
 enum iwl_scan_status {
         IWL_MVM_SCAN_NONE,
         IWL_MVM_SCAN_OS,
@@ -246,6 +304,63 @@ struct iwl_nvm_section {
         const u8 *data;
 };
 
+/*
+ * Tx-backoff threshold
+ * @temperature: The threshold in Celsius
+ * @backoff: The tx-backoff in uSec
+ */
+struct iwl_tt_tx_backoff {
+        s32 temperature;
+        u32 backoff;
+};
+
+#define TT_TX_BACKOFF_SIZE 6
+
+/**
+ * struct iwl_tt_params - thermal throttling parameters
+ * @ct_kill_entry: CT Kill entry threshold
+ * @ct_kill_exit: CT Kill exit threshold
+ * @ct_kill_duration: The time  intervals (in uSec) in which the driver needs
+ *      to checks whether to exit CT Kill.
+ * @dynamic_smps_entry: Dynamic SMPS entry threshold
+ * @dynamic_smps_exit: Dynamic SMPS exit threshold
+ * @tx_protection_entry: TX protection entry threshold
+ * @tx_protection_exit: TX protection exit threshold
+ * @tx_backoff: Array of thresholds for tx-backoff , in ascending order.
+ * @support_ct_kill: Support CT Kill?
+ * @support_dynamic_smps: Support dynamic SMPS?
+ * @support_tx_protection: Support tx protection?
+ * @support_tx_backoff: Support tx-backoff?
+ */
+struct iwl_tt_params {
+        s32 ct_kill_entry;
+        s32 ct_kill_exit;
+        u32 ct_kill_duration;
+        s32 dynamic_smps_entry;
+        s32 dynamic_smps_exit;
+        s32 tx_protection_entry;
+        s32 tx_protection_exit;
+        struct iwl_tt_tx_backoff tx_backoff[TT_TX_BACKOFF_SIZE];
+        bool support_ct_kill;
+        bool support_dynamic_smps;
+        bool support_tx_protection;
+        bool support_tx_backoff;
+};
+
+/**
+ * struct iwl_mvm_tt_mgnt - Thermal Throttling Management structure
+ * @ct_kill_exit: worker to exit thermal kill
+ * @dynamic_smps: Is thermal throttling enabled dynamic_smps?
+ * @tx_backoff: The current thremal throttling tx backoff in uSec.
+ * @params: Parameters to configure the thermal throttling algorithm.
+ */
+struct iwl_mvm_tt_mgmt {
+        struct delayed_work ct_kill_exit;
+        bool dynamic_smps;
+        u32 tx_backoff;
+        const struct iwl_tt_params *params;
+};
+
 struct iwl_mvm {
         /* for logger access */
         struct device *dev;
@@ -266,6 +381,12 @@ struct iwl_mvm {
 
         unsigned long status;
 
+        /*
+         * for beacon filtering -
+         * currently only one interface can be supported
+         */
+        struct iwl_mvm_vif *bf_allowed_vif;
+
         enum iwl_ucode_type cur_ucode;
         bool ucode_loaded;
         bool init_ucode_run;
@@ -313,7 +434,7 @@ struct iwl_mvm {
         bool prevent_power_down_d3;
 #endif
 
-        struct iwl_mvm_phy_ctxt phy_ctxt_roc;
+        struct iwl_mvm_phy_ctxt phy_ctxts[NUM_PHY_CTX];
 
         struct list_head time_event_list;
         spinlock_t time_event_lock;
@@ -338,11 +459,21 @@ struct iwl_mvm {
 
 #ifdef CONFIG_PM_SLEEP
         int gtk_ivlen, gtk_icvlen, ptk_ivlen, ptk_icvlen;
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        bool d3_test_active;
+        bool store_d3_resume_sram;
+        void *d3_resume_sram;
+        u32 d3_test_pme_ptr;
+#endif
 #endif
 
         /* BT-Coex */
         u8 bt_kill_msk;
         struct iwl_bt_coex_profile_notif last_bt_notif;
+
+        /* Thermal Throttling and CTkill */
+        struct iwl_mvm_tt_mgmt thermal_throttle;
+        s32 temperature;        /* Celsius */
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -352,6 +483,19 @@ struct iwl_mvm {
 #define IWL_MAC80211_GET_MVM(_hw)                       \
         IWL_OP_MODE_GET_MVM((struct iwl_op_mode *)((_hw)->priv))
 
+enum iwl_mvm_status {
+        IWL_MVM_STATUS_HW_RFKILL,
+        IWL_MVM_STATUS_HW_CTKILL,
+        IWL_MVM_STATUS_ROC_RUNNING,
+        IWL_MVM_STATUS_IN_HW_RESTART,
+};
+
+static inline bool iwl_mvm_is_radio_killed(struct iwl_mvm *mvm)
+{
+        return test_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status) ||
+               test_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status);
+}
+
 extern const u8 iwl_mvm_ac_to_tx_fifo[];
 
 struct iwl_rate_info {
@@ -443,8 +587,10 @@ int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
 int iwl_mvm_phy_ctxt_changed(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                              struct cfg80211_chan_def *chandef,
                              u8 chains_static, u8 chains_dynamic);
-void iwl_mvm_phy_ctxt_remove(struct iwl_mvm *mvm,
-                             struct iwl_mvm_phy_ctxt *ctxt);
+void iwl_mvm_phy_ctxt_ref(struct iwl_mvm *mvm,
+                          struct iwl_mvm_phy_ctxt *ctxt);
+void iwl_mvm_phy_ctxt_unref(struct iwl_mvm *mvm,
+                            struct iwl_mvm_phy_ctxt *ctxt);
 
 /* MAC (virtual interface) programming */
 int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
@@ -459,6 +605,9 @@ int iwl_mvm_mac_ctxt_beacon_changed(struct iwl_mvm *mvm,
 int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
                             struct iwl_rx_cmd_buffer *rxb,
                             struct iwl_device_cmd *cmd);
+int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
+                                    struct iwl_rx_cmd_buffer *rxb,
+                                    struct iwl_device_cmd *cmd);
 
 /* Bindings */
 int iwl_mvm_binding_add_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
@@ -523,6 +672,7 @@ void iwl_mvm_ipv6_addr_change(struct ieee80211_hw *hw,
                               struct inet6_dev *idev);
 void iwl_mvm_set_default_unicast_key(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif, int idx);
+extern const struct file_operations iwl_dbgfs_d3_test_ops;
 
 /* BT Coex */
 int iwl_send_bt_prio_tbl(struct iwl_mvm *mvm);
@@ -534,4 +684,36 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                            enum ieee80211_rssi_event rssi_event);
 void iwl_mvm_bt_coex_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
 
+/* beacon filtering */
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+void
+iwl_mvm_beacon_filter_debugfs_parameters(struct ieee80211_vif *vif,
+                                         struct iwl_beacon_filter_cmd *cmd);
+int iwl_mvm_dbgfs_set_fw_dbg_log(struct iwl_mvm *mvm);
+#else
+static inline void
+iwl_mvm_beacon_filter_debugfs_parameters(struct ieee80211_vif *vif,
+                                         struct iwl_beacon_filter_cmd *cmd)
+{}
+static inline int iwl_mvm_dbgfs_set_fw_dbg_log(struct iwl_mvm *mvm)
+{
+        return 0;
+}
+#endif
+int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif);
+int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif);
+
+/* SMPS */
+void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                enum iwl_mvm_smps_type_request req_type,
+                                enum ieee80211_smps_mode smps_request);
+
+/* Thermal management and CT-kill */
+void iwl_mvm_tt_handler(struct iwl_mvm *mvm);
+void iwl_mvm_tt_initialize(struct iwl_mvm *mvm);
+void iwl_mvm_tt_exit(struct iwl_mvm *mvm);
+void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index b8ec02f89acc..edb94ea31654 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -60,6 +60,7 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  *****************************************************************************/
+#include <linux/firmware.h>
 #include "iwl-trans.h"
 #include "mvm.h"
 #include "iwl-eeprom-parse.h"
@@ -75,31 +76,56 @@ static const int nvm_to_read[] = {
 };
 
 /* Default NVM size to read */
-#define IWL_NVM_DEFAULT_CHUNK_SIZE (2*1024);
+#define IWL_NVM_DEFAULT_CHUNK_SIZE (2*1024)
+#define IWL_MAX_NVM_SECTION_SIZE 6000
 
-static inline void iwl_nvm_fill_read(struct iwl_nvm_access_cmd *cmd,
-                                     u16 offset, u16 length, u16 section)
+#define NVM_WRITE_OPCODE 1
+#define NVM_READ_OPCODE 0
+
+/*
+ * prepare the NVM host command w/ the pointers to the nvm buffer
+ * and send it to fw
+ */
+static int iwl_nvm_write_chunk(struct iwl_mvm *mvm, u16 section,
+                               u16 offset, u16 length, const u8 *data)
 {
-        cmd->offset = cpu_to_le16(offset);
-        cmd->length = cpu_to_le16(length);
-        cmd->type = cpu_to_le16(section);
+        struct iwl_nvm_access_cmd nvm_access_cmd = {
+                .offset = cpu_to_le16(offset),
+                .length = cpu_to_le16(length),
+                .type = cpu_to_le16(section),
+                .op_code = NVM_WRITE_OPCODE,
+        };
+        struct iwl_host_cmd cmd = {
+                .id = NVM_ACCESS_CMD,
+                .len = { sizeof(struct iwl_nvm_access_cmd), length },
+                .flags = CMD_SYNC | CMD_SEND_IN_RFKILL,
+                .data = { &nvm_access_cmd, data },
+                /* data may come from vmalloc, so use _DUP */
+                .dataflags = { 0, IWL_HCMD_DFL_DUP },
+        };
+
+        return iwl_mvm_send_cmd(mvm, &cmd);
 }
 
 static int iwl_nvm_read_chunk(struct iwl_mvm *mvm, u16 section,
                               u16 offset, u16 length, u8 *data)
 {
-        struct iwl_nvm_access_cmd nvm_access_cmd = {};
+        struct iwl_nvm_access_cmd nvm_access_cmd = {
+                .offset = cpu_to_le16(offset),
+                .length = cpu_to_le16(length),
+                .type = cpu_to_le16(section),
+                .op_code = NVM_READ_OPCODE,
+        };
         struct iwl_nvm_access_resp *nvm_resp;
         struct iwl_rx_packet *pkt;
         struct iwl_host_cmd cmd = {
                 .id = NVM_ACCESS_CMD,
-                .flags = CMD_SYNC | CMD_WANT_SKB,
+                .flags = CMD_SYNC | CMD_WANT_SKB | CMD_SEND_IN_RFKILL,
                 .data = { &nvm_access_cmd, },
         };
         int ret, bytes_read, offset_read;
         u8 *resp_data;
 
-        iwl_nvm_fill_read(&nvm_access_cmd, offset, length, section);
         cmd.len[0] = sizeof(struct iwl_nvm_access_cmd);
 
         ret = iwl_mvm_send_cmd(mvm, &cmd);
@@ -144,6 +170,30 @@ exit:
         return ret;
 }
 
+static int iwl_nvm_write_section(struct iwl_mvm *mvm, u16 section,
+                                 const u8 *data, u16 length)
+{
+        int offset = 0;
+
+        /* copy data in chunks of 2k (and remainder if any) */
+
+        while (offset < length) {
+                int chunk_size, ret;
+
+                chunk_size = min(IWL_NVM_DEFAULT_CHUNK_SIZE,
+                                 length - offset);
+
+                ret = iwl_nvm_write_chunk(mvm, section, offset,
+                                          chunk_size, data + offset);
+                if (ret < 0)
+                        return ret;
+
+                offset += chunk_size;
+        }
+
+        return 0;
+}
+
 /*
  * Reads an NVM section completely.
  * NICs prior to 7000 family doesn't have a real NVM, but just read
@@ -177,7 +227,8 @@ static int iwl_nvm_read_section(struct iwl_mvm *mvm, u16 section,
                 offset += ret;
         }
 
-        IWL_INFO(mvm, "NVM section %d read completed\n", section);
+        IWL_DEBUG_EEPROM(mvm->trans->dev,
+                         "NVM section %d read completed\n", section);
         return offset;
 }
 
@@ -200,7 +251,130 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)
         hw = (const __le16 *)sections[NVM_SECTION_TYPE_HW].data;
         sw = (const __le16 *)sections[NVM_SECTION_TYPE_SW].data;
         calib = (const __le16 *)sections[NVM_SECTION_TYPE_CALIBRATION].data;
-        return iwl_parse_nvm_data(mvm->trans->dev, mvm->cfg, hw, sw, calib);
+        return iwl_parse_nvm_data(mvm->trans->dev, mvm->cfg, hw, sw, calib,
+                                  iwl_fw_valid_tx_ant(mvm->fw),
+                                  iwl_fw_valid_rx_ant(mvm->fw));
+}
+
+#define MAX_NVM_FILE_LEN        16384
+
+/*
+ * HOW TO CREATE THE NVM FILE FORMAT:
+ * ------------------------------
+ * 1. create hex file, format:
+ *      3800 -> header
+ *      0000 -> header
+ *      5a40 -> data
+ *
+ *   rev - 6 bit (word1)
+ *   len - 10 bit (word1)
+ *   id - 4 bit (word2)
+ *   rsv - 12 bit (word2)
+ *
+ * 2. flip 8bits with 8 bits per line to get the right NVM file format
+ *
+ * 3. create binary file from the hex file
+ *
+ * 4. save as "iNVM_xxx.bin" under /lib/firmware
+ */
+static int iwl_mvm_load_external_nvm(struct iwl_mvm *mvm)
+{
+        int ret, section_id, section_size;
+        const struct firmware *fw_entry;
+        const struct {
+                __le16 word1;
+                __le16 word2;
+                u8 data[];
+        } *file_sec;
+        const u8 *eof;
+
+#define NVM_WORD1_LEN(x) (8 * (x & 0x03FF))
+#define NVM_WORD2_ID(x) (x >> 12)
+
+        /*
+         * Obtain NVM image via request_firmware. Since we already used
+         * request_firmware_nowait() for the firmware binary load and only
+         * get here after that we assume the NVM request can be satisfied
+         * synchronously.
+         */
+        ret = request_firmware(&fw_entry, iwlwifi_mod_params.nvm_file,
+                               mvm->trans->dev);
+        if (ret) {
+                IWL_ERR(mvm, "ERROR: %s isn't available %d\n",
+                        iwlwifi_mod_params.nvm_file, ret);
+                return ret;
+        }
+
+        IWL_INFO(mvm, "Loaded NVM file %s (%zu bytes)\n",
+                 iwlwifi_mod_params.nvm_file, fw_entry->size);
+
+        if (fw_entry->size < sizeof(*file_sec)) {
+                IWL_ERR(mvm, "NVM file too small\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        if (fw_entry->size > MAX_NVM_FILE_LEN) {
+                IWL_ERR(mvm, "NVM file too large\n");
+                ret = -EINVAL;
+                goto out;
+        }
+
+        eof = fw_entry->data + fw_entry->size;
+
+        file_sec = (void *)fw_entry->data;
+
+        while (true) {
+                if (file_sec->data > eof) {
+                        IWL_ERR(mvm,
+                                "ERROR - NVM file too short for section header\n");
+                        ret = -EINVAL;
+                        break;
+                }
+
+                /* check for EOF marker */
+                if (!file_sec->word1 && !file_sec->word2) {
+                        ret = 0;
+                        break;
+                }
+
+                section_size = 2 * NVM_WORD1_LEN(le16_to_cpu(file_sec->word1));
+                section_id = NVM_WORD2_ID(le16_to_cpu(file_sec->word2));
+
+                if (section_size > IWL_MAX_NVM_SECTION_SIZE) {
+                        IWL_ERR(mvm, "ERROR - section too large (%d)\n",
+                                section_size);
+                        ret = -EINVAL;
+                        break;
+                }
+
+                if (!section_size) {
+                        IWL_ERR(mvm, "ERROR - section empty\n");
+                        ret = -EINVAL;
+                        break;
+                }
+
+                if (file_sec->data + section_size > eof) {
+                        IWL_ERR(mvm,
+                                "ERROR - NVM file too short for section (%d bytes)\n",
+                                section_size);
+                        ret = -EINVAL;
+                        break;
+                }
+
+                ret = iwl_nvm_write_section(mvm, section_id, file_sec->data,
+                                            section_size);
+                if (ret < 0) {
+                        IWL_ERR(mvm, "iwl_mvm_send_cmd failed: %d\n", ret);
+                        break;
+                }
+
+                /* advance to the next section */
+                file_sec = (void *)(file_sec->data + section_size);
+        }
+out:
+        release_firmware(fw_entry);
+        return ret;
 }
 
 int iwl_nvm_init(struct iwl_mvm *mvm)
@@ -208,6 +382,17 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
         int ret, i, section;
         u8 *nvm_buffer, *temp;
 
+        /* load external NVM if configured */
+        if (iwlwifi_mod_params.nvm_file) {
+                /* move to External NVM flow */
+                ret = iwl_mvm_load_external_nvm(mvm);
+                if (ret)
+                        return ret;
+        }
+
+        /* Read From FW NVM */
+        IWL_DEBUG_EEPROM(mvm->trans->dev, "Read from NVM\n");
+
         /* TODO: find correct NVM max size for a section */
         nvm_buffer = kmalloc(mvm->cfg->base_params->eeprom_size,
                              GFP_KERNEL);
@@ -231,8 +416,9 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
         if (ret < 0)
                 return ret;
 
-        ret = 0;
         mvm->nvm_data = iwl_parse_nvm_sections(mvm);
+        if (!mvm->nvm_data)
+                return -ENODATA;
 
-        return ret;
+        return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index b29c31a41594..af79a14063a9 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -215,17 +215,22 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
         RX_HANDLER(REPLY_RX_PHY_CMD, iwl_mvm_rx_rx_phy_cmd, false),
         RX_HANDLER(TX_CMD, iwl_mvm_rx_tx_cmd, false),
         RX_HANDLER(BA_NOTIF, iwl_mvm_rx_ba_notif, false),
+
+        RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
+        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
+        RX_HANDLER(STATISTICS_NOTIFICATION, iwl_mvm_rx_statistics, true),
+
         RX_HANDLER(TIME_EVENT_NOTIFICATION, iwl_mvm_rx_time_event_notif, false),
 
         RX_HANDLER(SCAN_REQUEST_CMD, iwl_mvm_rx_scan_response, false),
         RX_HANDLER(SCAN_COMPLETE_NOTIFICATION, iwl_mvm_rx_scan_complete, false),
 
-        RX_HANDLER(BT_PROFILE_NOTIFICATION, iwl_mvm_rx_bt_coex_notif, true),
-        RX_HANDLER(BEACON_NOTIFICATION, iwl_mvm_rx_beacon_notif, false),
-
         RX_HANDLER(RADIO_VERSION_NOTIFICATION, iwl_mvm_rx_radio_ver, false),
         RX_HANDLER(CARD_STATE_NOTIFICATION, iwl_mvm_rx_card_state_notif, false),
 
+        RX_HANDLER(MISSED_BEACONS_NOTIFICATION, iwl_mvm_rx_missed_beacons_notif,
+                   false),
+
         RX_HANDLER(REPLY_ERROR, iwl_mvm_rx_fw_error, false),
 };
 #undef RX_HANDLER
@@ -288,11 +293,14 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(NET_DETECT_HOTSPOTS_CMD),
         CMD(NET_DETECT_HOTSPOTS_QUERY_CMD),
         CMD(CARD_STATE_NOTIFICATION),
+        CMD(MISSED_BEACONS_NOTIFICATION),
         CMD(BT_COEX_PRIO_TABLE),
         CMD(BT_COEX_PROT_ENV),
         CMD(BT_PROFILE_NOTIFICATION),
         CMD(BT_CONFIG),
         CMD(MCAST_FILTER_CMD),
+        CMD(REPLY_BEACON_FILTERING_CMD),
+        CMD(REPLY_THERMAL_MNG_BACKOFF),
 };
 #undef CMD
 
@@ -393,10 +401,13 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
         if (err)
                 goto out_free;
 
+        iwl_mvm_tt_initialize(mvm);
+
         mutex_lock(&mvm->mutex);
         err = iwl_run_init_mvm_ucode(mvm, true);
         mutex_unlock(&mvm->mutex);
-        if (err && !iwlmvm_mod_params.init_dbg) {
+        /* returns 0 if successful, 1 if success but in rfkill */
+        if (err < 0 && !iwlmvm_mod_params.init_dbg) {
                 IWL_ERR(mvm, "Failed to run INIT ucode: %d\n", err);
                 goto out_free;
         }
@@ -439,10 +450,16 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
 
         iwl_mvm_leds_exit(mvm);
 
+        iwl_mvm_tt_exit(mvm);
+
         ieee80211_unregister_hw(mvm->hw);
 
         kfree(mvm->scan_cmd);
 
+#if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
+        kfree(mvm->d3_resume_sram);
+#endif
+
         iwl_trans_stop_hw(mvm->trans, true);
 
         iwl_phy_db_free(mvm->phy_db);
@@ -589,6 +606,16 @@ static void iwl_mvm_wake_sw_queue(struct iwl_op_mode *op_mode, int queue)
         ieee80211_wake_queue(mvm->hw, mq);
 }
 
+void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state)
+{
+        if (state)
+                set_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status);
+        else
+                clear_bit(IWL_MVM_STATUS_HW_CTKILL, &mvm->status);
+
+        wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
+}
+
 static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
 {
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
@@ -598,7 +625,7 @@ static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         else
                 clear_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
 
-        wiphy_rfkill_set_hw_state(mvm->hw->wiphy, state);
+        wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 }
 
 static void iwl_mvm_free_skb(struct iwl_op_mode *op_mode, struct sk_buff *skb)
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index a28a1d1f23eb..a8652ddd6bed 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -195,21 +195,6 @@ static int iwl_mvm_phy_ctxt_apply(struct iwl_mvm *mvm,
         return ret;
 }
 
-
-struct phy_ctx_used_data {
-        unsigned long used[BITS_TO_LONGS(NUM_PHY_CTX)];
-};
-
-static void iwl_mvm_phy_ctx_used_iter(struct ieee80211_hw *hw,
-                                      struct ieee80211_chanctx_conf *ctx,
-                                      void *_data)
-{
-        struct phy_ctx_used_data *data = _data;
-        struct iwl_mvm_phy_ctxt *phy_ctxt = (void *)ctx->drv_priv;
-
-        __set_bit(phy_ctxt->id, data->used);
-}
-
 /*
  * Send a command to add a PHY context based on the current HW configuration.
  */
@@ -217,34 +202,28 @@ int iwl_mvm_phy_ctxt_add(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                          struct cfg80211_chan_def *chandef,
                          u8 chains_static, u8 chains_dynamic)
 {
-        struct phy_ctx_used_data data = {
-                .used = { },
-        };
-
-        /*
-         * If this is a regular PHY context (not the ROC one)
-         * skip the ROC PHY context's ID.
-         */
-        if (ctxt != &mvm->phy_ctxt_roc)
-                __set_bit(mvm->phy_ctxt_roc.id, data.used);
+        int ret;
 
+        WARN_ON(!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) &&
+                ctxt->ref);
         lockdep_assert_held(&mvm->mutex);
-        ctxt->color++;
 
-        if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) {
-                ieee80211_iter_chan_contexts_atomic(
-                        mvm->hw, iwl_mvm_phy_ctx_used_iter, &data);
+        ctxt->channel = chandef->chan;
+        ret = iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
+                                     chains_static, chains_dynamic,
+                                     FW_CTXT_ACTION_ADD, 0);
 
-                ctxt->id = find_first_zero_bit(data.used, NUM_PHY_CTX);
-                if (WARN_ONCE(ctxt->id == NUM_PHY_CTX,
-                              "Failed to init PHY context - no free ID!\n"))
-                        return -EIO;
-        }
+        return ret;
+}
 
-        ctxt->channel = chandef->chan;
-        return iwl_mvm_phy_ctxt_apply(mvm, ctxt, chandef,
-                                      chains_static, chains_dynamic,
-                                      FW_CTXT_ACTION_ADD, 0);
+/*
+ * Update the number of references to the given PHY context. This is valid only
+ * in case the PHY context was already created, i.e., its reference count > 0.
+ */
+void iwl_mvm_phy_ctxt_ref(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt)
+{
+        lockdep_assert_held(&mvm->mutex);
+        ctxt->ref++;
 }
 
 /*
@@ -264,23 +243,12 @@ int iwl_mvm_phy_ctxt_changed(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt,
                                       FW_CTXT_ACTION_MODIFY, 0);
 }
 
-/*
- * Send a command to the FW to remove the given phy context.
- * Once the command is sent, regardless of success or failure, the context is
- * marked as invalid
- */
-void iwl_mvm_phy_ctxt_remove(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt)
+void iwl_mvm_phy_ctxt_unref(struct iwl_mvm *mvm, struct iwl_mvm_phy_ctxt *ctxt)
 {
-        struct iwl_phy_context_cmd cmd;
-        int ret;
-
         lockdep_assert_held(&mvm->mutex);
 
-        iwl_mvm_phy_ctxt_cmd_hdr(ctxt, &cmd, FW_CTXT_ACTION_REMOVE, 0);
-        ret = iwl_mvm_send_cmd_pdu(mvm, PHY_CONTEXT_CMD, CMD_SYNC,
-                                   sizeof(struct iwl_phy_context_cmd),
-                                   &cmd);
-        if (ret)
-                IWL_ERR(mvm, "Failed to send PHY remove: ctxt id=%d\n",
-                        ctxt->id);
+        if (WARN_ON_ONCE(!ctxt))
+                return;
+
+        ctxt->ref--;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index ed77e437aac4..3760a33ca3a4 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -75,6 +75,54 @@
 
 #define POWER_KEEP_ALIVE_PERIOD_SEC    25
 
+static int iwl_mvm_beacon_filter_send_cmd(struct iwl_mvm *mvm,
+                                          struct iwl_beacon_filter_cmd *cmd)
+{
+        int ret;
+
+        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_BEACON_FILTERING_CMD, CMD_SYNC,
+                                   sizeof(struct iwl_beacon_filter_cmd), cmd);
+
+        if (!ret) {
+                IWL_DEBUG_POWER(mvm, "ba_enable_beacon_abort is: %d\n",
+                                cmd->ba_enable_beacon_abort);
+                IWL_DEBUG_POWER(mvm, "ba_escape_timer is: %d\n",
+                                cmd->ba_escape_timer);
+                IWL_DEBUG_POWER(mvm, "bf_debug_flag is: %d\n",
+                                cmd->bf_debug_flag);
+                IWL_DEBUG_POWER(mvm, "bf_enable_beacon_filter is: %d\n",
+                                cmd->bf_enable_beacon_filter);
+                IWL_DEBUG_POWER(mvm, "bf_energy_delta is: %d\n",
+                                cmd->bf_energy_delta);
+                IWL_DEBUG_POWER(mvm, "bf_escape_timer is: %d\n",
+                                cmd->bf_escape_timer);
+                IWL_DEBUG_POWER(mvm, "bf_roaming_energy_delta is: %d\n",
+                                cmd->bf_roaming_energy_delta);
+                IWL_DEBUG_POWER(mvm, "bf_roaming_state is: %d\n",
+                                cmd->bf_roaming_state);
+                IWL_DEBUG_POWER(mvm, "bf_temperature_delta is: %d\n",
+                                cmd->bf_temperature_delta);
+        }
+        return ret;
+}
+
+static int iwl_mvm_update_beacon_abort(struct iwl_mvm *mvm,
+                                       struct ieee80211_vif *vif, bool enable)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_beacon_filter_cmd cmd = {
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter = 1,
+                .ba_enable_beacon_abort = enable,
+        };
+
+        if (!mvmvif->bf_enabled)
+                return 0;
+
+        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
+        return iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
+}
+
 static void iwl_mvm_power_log(struct iwl_mvm *mvm,
                               struct iwl_powertable_cmd *cmd)
 {
@@ -91,6 +139,9 @@ static void iwl_mvm_power_log(struct iwl_mvm *mvm,
                                 le32_to_cpu(cmd->tx_data_timeout));
                 IWL_DEBUG_POWER(mvm, "LP RX RSSI threshold = %u\n",
                                 cmd->lprx_rssi_threshold);
+                if (cmd->flags & cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK))
+                        IWL_DEBUG_POWER(mvm, "DTIM periods to skip = %u\n",
+                                        le32_to_cpu(cmd->skip_dtim_periods));
         }
 }
 
@@ -103,6 +154,8 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         int dtimper, dtimper_msec;
         int keep_alive;
         bool radar_detect = false;
+        struct iwl_mvm_vif *mvmvif __maybe_unused =
+                iwl_mvm_vif_from_mac80211(vif);
 
         /*
          * Regardless of power management state the driver must set
@@ -115,7 +168,14 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
+        if (!vif->bss_conf.assoc)
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
+            mvmvif->dbgfs_pm.disable_power_off)
+                cmd->flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
+#endif
         if (!vif->bss_conf.ps)
                 return;
 
@@ -135,8 +195,11 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         /* Check skip over DTIM conditions */
         if (!radar_detect && (dtimper <= 10) &&
-            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP))
+            (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_LP ||
+             mvm->cur_ucode == IWL_UCODE_WOWLAN)) {
                 cmd->flags |= cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+                cmd->skip_dtim_periods = cpu_to_le32(3);
+        }
 
         /* Check that keep alive period is at least 3 * DTIM */
         dtimper_msec = dtimper * vif->bss_conf.beacon_int;
@@ -145,27 +208,76 @@ void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
         cmd->keep_alive_seconds = keep_alive;
 
-        cmd->rx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
-        cmd->tx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+        if (mvm->cur_ucode != IWL_UCODE_WOWLAN) {
+                cmd->rx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(100 * USEC_PER_MSEC);
+        } else {
+                cmd->rx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+                cmd->tx_data_timeout = cpu_to_le32(10 * USEC_PER_MSEC);
+        }
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_KEEP_ALIVE)
+                cmd->keep_alive_seconds = mvmvif->dbgfs_pm.keep_alive_seconds;
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_OVER_DTIM) {
+                if (mvmvif->dbgfs_pm.skip_over_dtim)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+                else
+                        cmd->flags &=
+                                cpu_to_le16(~POWER_FLAGS_SKIP_OVER_DTIM_MSK);
+        }
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_RX_DATA_TIMEOUT)
+                cmd->rx_data_timeout =
+                        cpu_to_le32(mvmvif->dbgfs_pm.rx_data_timeout);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_TX_DATA_TIMEOUT)
+                cmd->tx_data_timeout =
+                        cpu_to_le32(mvmvif->dbgfs_pm.tx_data_timeout);
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS)
+                cmd->skip_dtim_periods =
+                        cpu_to_le32(mvmvif->dbgfs_pm.skip_dtim_periods);
+#endif /* CONFIG_IWLWIFI_DEBUGFS */
 }
 
 int iwl_mvm_power_update_mode(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
+        int ret;
+        bool ba_enable;
         struct iwl_powertable_cmd cmd = {};
 
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
 
+        /*
+         * TODO: The following vif_count verification is temporary condition.
+         * Avoid power mode update if more than one interface is currently
+         * active. Remove this condition when FW will support power management
+         * on multiple MACs.
+         */
+        IWL_DEBUG_POWER(mvm, "Currently %d interfaces active\n",
+                        mvm->vif_count);
+        if (mvm->vif_count > 1)
+                return 0;
+
         iwl_mvm_power_build_cmd(mvm, vif, &cmd);
         iwl_mvm_power_log(mvm, &cmd);
 
-        return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
-                                    sizeof(cmd), &cmd);
+        ret = iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_SYNC,
+                                   sizeof(cmd), &cmd);
+        if (ret)
+                return ret;
+
+        ba_enable = !!(cmd.flags &
+                       cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK));
+
+        return iwl_mvm_update_beacon_abort(mvm, vif, ba_enable);
 }
 
 int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_powertable_cmd cmd = {};
+        struct iwl_mvm_vif *mvmvif __maybe_unused =
+                iwl_mvm_vif_from_mac80211(vif);
 
         if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
                 return 0;
@@ -173,8 +285,82 @@ int iwl_mvm_power_disable(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM)
                 cmd.flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
 
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_DISABLE_POWER_OFF &&
+            mvmvif->dbgfs_pm.disable_power_off)
+                cmd.flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
+#endif
         iwl_mvm_power_log(mvm, &cmd);
 
         return iwl_mvm_send_cmd_pdu(mvm, POWER_TABLE_CMD, CMD_ASYNC,
                                     sizeof(cmd), &cmd);
 }
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+void
+iwl_mvm_beacon_filter_debugfs_parameters(struct ieee80211_vif *vif,
+                                         struct iwl_beacon_filter_cmd *cmd)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_dbgfs_bf *dbgfs_bf = &mvmvif->dbgfs_bf;
+
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ENERGY_DELTA)
+                cmd->bf_energy_delta = dbgfs_bf->bf_energy_delta;
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA)
+                cmd->bf_roaming_energy_delta =
+                                 dbgfs_bf->bf_roaming_energy_delta;
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ROAMING_STATE)
+                cmd->bf_roaming_state = dbgfs_bf->bf_roaming_state;
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_TEMPERATURE_DELTA)
+                cmd->bf_temperature_delta = dbgfs_bf->bf_temperature_delta;
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_DEBUG_FLAG)
+                cmd->bf_debug_flag = dbgfs_bf->bf_debug_flag;
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BF_ESCAPE_TIMER)
+                cmd->bf_escape_timer = cpu_to_le32(dbgfs_bf->bf_escape_timer);
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BA_ESCAPE_TIMER)
+                cmd->ba_escape_timer = cpu_to_le32(dbgfs_bf->ba_escape_timer);
+        if (dbgfs_bf->mask & MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT)
+                cmd->ba_enable_beacon_abort = dbgfs_bf->ba_enable_beacon_abort;
+}
+#endif
+
+int iwl_mvm_enable_beacon_filter(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_beacon_filter_cmd cmd = {
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter = 1,
+        };
+        int ret;
+
+        if (mvmvif != mvm->bf_allowed_vif ||
+            vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+                return 0;
+
+        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
+        ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
+
+        if (!ret)
+                mvmvif->bf_enabled = true;
+
+        return ret;
+}
+
+int iwl_mvm_disable_beacon_filter(struct iwl_mvm *mvm,
+                                  struct ieee80211_vif *vif)
+{
+        struct iwl_beacon_filter_cmd cmd = {};
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        int ret;
+
+        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+                return 0;
+
+        ret = iwl_mvm_beacon_filter_send_cmd(mvm, &cmd);
+
+        if (!ret)
+                mvmvif->bf_enabled = false;
+
+        return ret;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index a1e3e923ea3e..29d49cf0fdb2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -169,27 +169,34 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                         num_active_bindings++;
         }
 
-        if (!num_active_bindings)
-                goto send_cmd;
-
-        quota = IWL_MVM_MAX_QUOTA / num_active_bindings;
-        quota_rem = IWL_MVM_MAX_QUOTA % num_active_bindings;
+        quota = 0;
+        quota_rem = 0;
+        if (num_active_bindings) {
+                quota = IWL_MVM_MAX_QUOTA / num_active_bindings;
+                quota_rem = IWL_MVM_MAX_QUOTA % num_active_bindings;
+        }
 
         for (idx = 0, i = 0; i < MAX_BINDINGS; i++) {
-                if (data.n_interfaces[i] <= 0)
+                if (data.colors[i] < 0)
                         continue;
 
                 cmd.quotas[idx].id_and_color =
                         cpu_to_le32(FW_CMD_ID_AND_COLOR(i, data.colors[i]));
-                cmd.quotas[idx].quota = cpu_to_le32(quota);
-                cmd.quotas[idx].max_duration = cpu_to_le32(IWL_MVM_MAX_QUOTA);
+
+                if (data.n_interfaces[i] <= 0) {
+                        cmd.quotas[idx].quota = cpu_to_le32(0);
+                        cmd.quotas[idx].max_duration = cpu_to_le32(0);
+                } else {
+                        cmd.quotas[idx].quota = cpu_to_le32(quota);
+                        cmd.quotas[idx].max_duration =
+                                cpu_to_le32(IWL_MVM_MAX_QUOTA);
+                }
                 idx++;
         }
 
         /* Give the remainder of the session to the first binding */
         le32_add_cpu(&cmd.quotas[0].quota, quota_rem);
 
-send_cmd:
         ret = iwl_mvm_send_cmd_pdu(mvm, TIME_QUOTA_CMD, CMD_SYNC,
                                    sizeof(cmd), &cmd);
         if (ret)
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index 55334d542e26..d6beec765d65 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -401,6 +401,17 @@ static int rs_tl_turn_on_agg_for_tid(struct iwl_mvm *mvm,
 
         load = rs_tl_get_load(lq_data, tid);
 
+        /*
+         * Don't create TX aggregation sessions when in high
+         * BT traffic, as they would just be disrupted by BT.
+         */
+        if (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >= 2) {
+                IWL_DEBUG_COEX(mvm, "BT traffic (%d), no aggregation allowed\n",
+                               BT_MBOX_MSG(&mvm->last_bt_notif,
+                                           3, TRAFFIC_LOAD));
+                return ret;
+        }
+
         if ((iwlwifi_mod_params.auto_agg) || (load > IWL_AGG_LOAD_THRESHOLD)) {
                 IWL_DEBUG_HT(mvm, "Starting Tx agg: STA: %pM tid: %d\n",
                              sta->addr, tid);
@@ -1519,6 +1530,29 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
         u8 update_search_tbl_counter = 0;
         int ret;
 
+        switch (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                if (tbl->action == IWL_SISO_SWITCH_ANTENNA2)
+                        tbl->action = IWL_SISO_SWITCH_MIMO2_AB;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                valid_tx_ant =
+                        first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
+                if (tbl->action != IWL_SISO_SWITCH_ANTENNA1)
+                        tbl->action = IWL_SISO_SWITCH_ANTENNA1;
+                break;
+        default:
+                IWL_ERR(mvm, "Invalid BT load %d",
+                        BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD));
+                break;
+        }
+
         start_action = tbl->action;
         while (1) {
                 lq_sta->action_counter++;
@@ -1532,7 +1566,9 @@ static int rs_move_siso_to_other(struct iwl_mvm *mvm,
                              tx_chains_num <= 2))
                                 break;
 
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
+                        if (window->success_ratio >= IWL_RS_GOOD_RATIO &&
+                            BT_MBOX_MSG(&mvm->last_bt_notif, 3,
+                                        TRAFFIC_LOAD) == 0)
                                 break;
 
                         memcpy(search_tbl, tbl, sz);
@@ -1654,6 +1690,28 @@ static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
         u8 update_search_tbl_counter = 0;
         int ret;
 
+        switch (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                if (tbl->action != IWL_MIMO2_SWITCH_SISO_A)
+                        tbl->action = IWL_MIMO2_SWITCH_SISO_A;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                if (tbl->action == IWL_MIMO2_SWITCH_SISO_B ||
+                    tbl->action == IWL_MIMO2_SWITCH_SISO_C)
+                        tbl->action = IWL_MIMO2_SWITCH_SISO_A;
+                break;
+        default:
+                IWL_ERR(mvm, "Invalid BT load %d",
+                        BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD));
+                break;
+        }
+
         start_action = tbl->action;
         while (1) {
                 lq_sta->action_counter++;
@@ -1791,6 +1849,28 @@ static int rs_move_mimo3_to_other(struct iwl_mvm *mvm,
         int ret;
         u8 update_search_tbl_counter = 0;
 
+        switch (BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
+        case IWL_BT_COEX_TRAFFIC_LOAD_NONE:
+                /* nothing */
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_HIGH:
+        case IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS:
+                /* avoid antenna B and MIMO */
+                if (tbl->action != IWL_MIMO3_SWITCH_SISO_A)
+                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
+                break;
+        case IWL_BT_COEX_TRAFFIC_LOAD_LOW:
+                /* avoid antenna B unless MIMO */
+                if (tbl->action == IWL_MIMO3_SWITCH_SISO_B ||
+                    tbl->action == IWL_MIMO3_SWITCH_SISO_C)
+                        tbl->action = IWL_MIMO3_SWITCH_SISO_A;
+                break;
+        default:
+                IWL_ERR(mvm, "Invalid BT load %d",
+                        BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD));
+                break;
+        }
+
         start_action = tbl->action;
         while (1) {
                 lq_sta->action_counter++;
@@ -2302,6 +2382,32 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
              (current_tpt > (100 * tbl->expected_tpt[low]))))
                 scale_action = 0;
 
+        if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
+             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+                if (lq_sta->last_bt_traffic >
+                    BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
+                        /*
+                         * don't set scale_action, don't want to scale up if
+                         * the rate scale doesn't otherwise think that is a
+                         * good idea.
+                         */
+                } else if (lq_sta->last_bt_traffic <=
+                           BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD)) {
+                        scale_action = -1;
+                }
+        }
+        lq_sta->last_bt_traffic =
+                BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD);
+
+        if ((BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >=
+             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) &&
+             (is_mimo2(tbl->lq_type) || is_mimo3(tbl->lq_type))) {
+                /* search for a new modulation */
+                rs_stay_in_table(lq_sta, true);
+                goto lq_update;
+        }
+
         switch (scale_action) {
         case -1:
                 /* Decrease starting rate, update uCode's rate table */
@@ -2782,6 +2888,13 @@ static void rs_fill_link_cmd(struct iwl_mvm *mvm,
 
         lq_cmd->agg_time_limit =
                 cpu_to_le16(LINK_QUAL_AGG_TIME_LIMIT_DEF);
+
+        /*
+         * overwrite if needed, pass aggregation time limit
+         * to uCode in uSec - This is racy - but heh, at least it helps...
+         */
+        if (mvm && BT_MBOX_MSG(&mvm->last_bt_notif, 3, TRAFFIC_LOAD) >= 2)
+                lq_cmd->agg_time_limit = cpu_to_le16(1200);
 }
 
 static void *rs_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
@@ -3080,3 +3193,29 @@ void iwl_mvm_rate_control_unregister(void)
 {
         ieee80211_rate_control_unregister(&rs_mvm_ops);
 }
+
+/**
+ * iwl_mvm_tx_protection - Gets LQ command, change it to enable/disable
+ * Tx protection, according to this rquest and previous requests,
+ * and send the LQ command.
+ * @lq: The LQ command
+ * @mvmsta: The station
+ * @enable: Enable Tx protection?
+ */
+int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
+                          struct iwl_mvm_sta *mvmsta, bool enable)
+{
+        lockdep_assert_held(&mvm->mutex);
+
+        if (enable) {
+                if (mvmsta->tx_protection == 0)
+                        lq->flags |= LQ_FLAG_SET_STA_TLC_RTS_MSK;
+                mvmsta->tx_protection++;
+        } else {
+                mvmsta->tx_protection--;
+                if (mvmsta->tx_protection == 0)
+                        lq->flags &= ~LQ_FLAG_SET_STA_TLC_RTS_MSK;
+        }
+
+        return iwl_mvm_send_lq_cmd(mvm, lq, CMD_ASYNC, false);
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 219c6857cc0f..cff4f6da7733 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -358,6 +358,18 @@ struct iwl_lq_sta {
         u8 last_bt_traffic;
 };
 
+enum iwl_bt_coex_profile_traffic_load {
+        IWL_BT_COEX_TRAFFIC_LOAD_NONE           = 0,
+        IWL_BT_COEX_TRAFFIC_LOAD_LOW            = 1,
+        IWL_BT_COEX_TRAFFIC_LOAD_HIGH           = 2,
+        IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS     = 3,
+/*
+ * There are no more even though below is a u8, the
+ * indication from the BT device only has two bits.
+ */
+};
+
+
 static inline u8 num_of_ant(u8 mask)
 {
         return  !!((mask) & ANT_A) +
@@ -390,4 +402,9 @@ extern int iwl_mvm_rate_control_register(void);
  */
 extern void iwl_mvm_rate_control_unregister(void);
 
+struct iwl_mvm_sta;
+
+int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
+                          struct iwl_mvm_sta *mvmsta, bool enable);
+
 #endif /* __rs__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 4dfc21a3e83e..e4930d5027d2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -363,3 +363,25 @@ int iwl_mvm_rx_rx_mpdu(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                                         rxb, &rx_status);
         return 0;
 }
+
+/*
+ * iwl_mvm_rx_statistics - STATISTICS_NOTIFICATION handler
+ *
+ * TODO: This handler is implemented partially.
+ * It only gets the NIC's temperature.
+ */
+int iwl_mvm_rx_statistics(struct iwl_mvm *mvm,
+                          struct iwl_rx_cmd_buffer *rxb,
+                          struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_notif_statistics *stats = (void *)&pkt->data;
+        struct mvm_statistics_general_common *common = &stats->general.common;
+
+        if (mvm->temperature != le32_to_cpu(common->temperature)) {
+                mvm->temperature = le32_to_cpu(common->temperature);
+                iwl_mvm_tt_handler(mvm);
+        }
+
+        return 0;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index 2476e43799d5..2157b0f8ced5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -298,12 +298,6 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
         else
                 cmd->type = cpu_to_le32(SCAN_TYPE_FORCED);
 
-        /*
-         * TODO: This is a WA due to a bug in the FW AUX framework that does not
-         * properly handle time events that fail to be scheduled
-         */
-        cmd->type = cpu_to_le32(SCAN_TYPE_FORCED);
-
         cmd->repeats = cpu_to_le32(1);
 
         /*
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 5c664ed54400..2278858d5658 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -64,6 +64,7 @@
 
 #include "mvm.h"
 #include "sta.h"
+#include "rs.h"
 
 static int iwl_mvm_find_free_sta_id(struct iwl_mvm *mvm)
 {
@@ -217,6 +218,8 @@ int iwl_mvm_add_sta(struct iwl_mvm *mvm,
                                                       mvmvif->color);
         mvm_sta->vif = vif;
         mvm_sta->max_agg_bufsize = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
+        mvm_sta->tx_protection = 0;
+        mvm_sta->tt_tx_protection = false;
 
         /* HW restart, don't assume the memory has been zeroed */
         atomic_set(&mvm->pending_frames[sta_id], 0);
@@ -798,21 +801,23 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                 min(mvmsta->max_agg_bufsize, buf_size);
         mvmsta->lq_sta.lq.agg_frame_cnt_limit = mvmsta->max_agg_bufsize;
 
+        IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
+                     sta->addr, tid);
+
         if (mvm->cfg->ht_params->use_rts_for_aggregation) {
                 /*
                  * switch to RTS/CTS if it is the prefer protection
                  * method for HT traffic
+                 * this function also sends the LQ command
                  */
-                mvmsta->lq_sta.lq.flags |= LQ_FLAG_SET_STA_TLC_RTS_MSK;
+                return iwl_mvm_tx_protection(mvm, &mvmsta->lq_sta.lq,
+                                             mvmsta, true);
                 /*
                  * TODO: remove the TLC_RTS flag when we tear down the last
                  * AGG session (agg_tids_count in DVM)
                  */
         }
 
-        IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
-                     sta->addr, tid);
-
         return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.lq, CMD_ASYNC, false);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index a4ddce77aaae..3efa0a0cc987 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -275,6 +275,8 @@ struct iwl_mvm_tid_data {
  * @lock: lock to protect the whole struct. Since %tid_data is access from Tx
  * and from Tx response flow, it needs a spinlock.
  * @tid_data: per tid data. Look at %iwl_mvm_tid_data.
+ * @tx_protection: reference counter for controlling the Tx protection.
+ * @tt_tx_protection: is thermal throttling enable Tx protection?
  *
  * When mac80211 creates a station it reserves some space (hw->sta_data_size)
  * in the structure for use by driver. This structure is placed in that
@@ -296,6 +298,10 @@ struct iwl_mvm_sta {
 #ifdef CONFIG_PM_SLEEP
         u16 last_seq_ctl;
 #endif
+
+        /* Temporary, until the new TLC will control the Tx protection */
+        s8 tx_protection;
+        bool tt_tx_protection;
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
new file mode 100644
index 000000000000..a7e3b8ddf22b
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -0,0 +1,512 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#include "mvm.h"
+#include "iwl-config.h"
+#include "iwl-io.h"
+#include "iwl-csr.h"
+#include "iwl-prph.h"
+
+#define OTP_DTS_DIODE_DEVIATION 96 /*in words*/
+/* VBG - Voltage Band Gap error data (temperature offset) */
+#define OTP_WP_DTS_VBG                  (OTP_DTS_DIODE_DEVIATION + 2)
+#define MEAS_VBG_MIN_VAL                2300
+#define MEAS_VBG_MAX_VAL                3000
+#define MEAS_VBG_DEFAULT_VAL            2700
+#define DTS_DIODE_VALID(flags)          (flags & DTS_DIODE_REG_FLAGS_PASS_ONCE)
+#define MIN_TEMPERATURE                 0
+#define MAX_TEMPERATURE                 125
+#define TEMPERATURE_ERROR               (MAX_TEMPERATURE + 1)
+#define PTAT_DIGITAL_VALUE_MIN_VALUE    0
+#define PTAT_DIGITAL_VALUE_MAX_VALUE    0xFF
+#define DTS_VREFS_NUM                   5
+static inline u32 DTS_DIODE_GET_VREFS_ID(u32 flags)
+{
+        return (flags & DTS_DIODE_REG_FLAGS_VREFS_ID) >>
+                                        DTS_DIODE_REG_FLAGS_VREFS_ID_POS;
+}
+
+#define CALC_VREFS_MIN_DIFF     43
+#define CALC_VREFS_MAX_DIFF     51
+#define CALC_LUT_SIZE           (1 + CALC_VREFS_MAX_DIFF - CALC_VREFS_MIN_DIFF)
+#define CALC_LUT_INDEX_OFFSET   CALC_VREFS_MIN_DIFF
+#define CALC_TEMPERATURE_RESULT_SHIFT_OFFSET    23
+
+/*
+ * @digital_value: The diode's digital-value sampled (temperature/voltage)
+ * @vref_low: The lower voltage-reference (the vref just below the diode's
+ *      sampled digital-value)
+ * @vref_high: The higher voltage-reference (the vref just above the diode's
+ *      sampled digital-value)
+ * @flags: bits[1:0]: The ID of the Vrefs pair (lowVref,highVref)
+ *      bits[6:2]: Reserved.
+ *      bits[7:7]: Indicates completion of at least 1 successful sample
+ *      since last DTS reset.
+ */
+struct iwl_mvm_dts_diode_bits {
+        u8 digital_value;
+        u8 vref_low;
+        u8 vref_high;
+        u8 flags;
+} __packed;
+
+union dts_diode_results {
+        u32 reg_value;
+        struct iwl_mvm_dts_diode_bits bits;
+} __packed;
+
+static s16 iwl_mvm_dts_get_volt_band_gap(struct iwl_mvm *mvm)
+{
+        struct iwl_nvm_section calib_sec;
+        const __le16 *calib;
+        u16 vbg;
+
+        /* TODO: move parsing to NVM code */
+        calib_sec = mvm->nvm_sections[NVM_SECTION_TYPE_CALIBRATION];
+        calib = (__le16 *)calib_sec.data;
+
+        vbg = le16_to_cpu(calib[OTP_WP_DTS_VBG]);
+
+        if (vbg < MEAS_VBG_MIN_VAL || vbg > MEAS_VBG_MAX_VAL)
+                vbg = MEAS_VBG_DEFAULT_VAL;
+
+        return vbg;
+}
+
+static u16 iwl_mvm_dts_get_ptat_deviation_offset(struct iwl_mvm *mvm)
+{
+        const u8 *calib;
+        u8 ptat, pa1, pa2, median;
+
+        /* TODO: move parsing to NVM code */
+        calib = mvm->nvm_sections[NVM_SECTION_TYPE_CALIBRATION].data;
+        ptat = calib[OTP_DTS_DIODE_DEVIATION];
+        pa1 = calib[OTP_DTS_DIODE_DEVIATION + 1];
+        pa2 = calib[OTP_DTS_DIODE_DEVIATION + 2];
+
+        /* get the median: */
+        if (ptat > pa1) {
+                if (ptat > pa2)
+                        median = (pa1 > pa2) ? pa1 : pa2;
+                else
+                        median = ptat;
+        } else {
+                if (pa1 > pa2)
+                        median = (ptat > pa2) ? ptat : pa2;
+                else
+                        median = pa1;
+        }
+
+        return ptat - median;
+}
+
+static u8 iwl_mvm_dts_calibrate_ptat_deviation(struct iwl_mvm *mvm, u8 value)
+{
+        /* Calibrate the PTAT digital value, based on PTAT deviation data: */
+        s16 new_val = value - iwl_mvm_dts_get_ptat_deviation_offset(mvm);
+
+        if (new_val > PTAT_DIGITAL_VALUE_MAX_VALUE)
+                new_val = PTAT_DIGITAL_VALUE_MAX_VALUE;
+        else if (new_val < PTAT_DIGITAL_VALUE_MIN_VALUE)
+                new_val = PTAT_DIGITAL_VALUE_MIN_VALUE;
+
+        return new_val;
+}
+
+static bool dts_get_adjacent_vrefs(struct iwl_mvm *mvm,
+                                   union dts_diode_results *avg_ptat)
+{
+        u8 vrefs_results[DTS_VREFS_NUM];
+        u8 low_vref_index = 0, flags;
+        u32 reg;
+
+        reg = iwl_read_prph(mvm->trans, DTSC_VREF_AVG);
+        memcpy(vrefs_results, &reg, sizeof(reg));
+        reg = iwl_read_prph(mvm->trans, DTSC_VREF5_AVG);
+        vrefs_results[4] = reg & 0xff;
+
+        if (avg_ptat->bits.digital_value < vrefs_results[0] ||
+            avg_ptat->bits.digital_value > vrefs_results[4])
+                return false;
+
+        if (avg_ptat->bits.digital_value > vrefs_results[3])
+                low_vref_index = 3;
+        else if (avg_ptat->bits.digital_value > vrefs_results[2])
+                low_vref_index = 2;
+        else if (avg_ptat->bits.digital_value > vrefs_results[1])
+                low_vref_index = 1;
+
+        avg_ptat->bits.vref_low  = vrefs_results[low_vref_index];
+        avg_ptat->bits.vref_high = vrefs_results[low_vref_index + 1];
+        flags = avg_ptat->bits.flags;
+        avg_ptat->bits.flags =
+                (flags & ~DTS_DIODE_REG_FLAGS_VREFS_ID) |
+                (low_vref_index & DTS_DIODE_REG_FLAGS_VREFS_ID);
+        return true;
+}
+
+/*
+ * return true it the results are valid, and false otherwise.
+ */
+static bool dts_read_ptat_avg_results(struct iwl_mvm *mvm,
+                                      union dts_diode_results *avg_ptat)
+{
+        u32 reg;
+        u8 tmp;
+
+        /* fill the diode value and pass_once with avg-reg results */
+        reg = iwl_read_prph(mvm->trans, DTSC_PTAT_AVG);
+        reg &= DTS_DIODE_REG_DIG_VAL | DTS_DIODE_REG_PASS_ONCE;
+        avg_ptat->reg_value = reg;
+
+        /* calibrate the PTAT digital value */
+        tmp = avg_ptat->bits.digital_value;
+        tmp = iwl_mvm_dts_calibrate_ptat_deviation(mvm, tmp);
+        avg_ptat->bits.digital_value = tmp;
+
+        /*
+         * fill vrefs fields, based on the avgVrefs results
+         * and the diode value
+         */
+        return dts_get_adjacent_vrefs(mvm, avg_ptat) &&
+                DTS_DIODE_VALID(avg_ptat->bits.flags);
+}
+
+static s32 calculate_nic_temperature(union dts_diode_results avg_ptat,
+                                     u16 volt_band_gap)
+{
+        u32 tmp_result;
+        u8 vrefs_diff;
+        /*
+         * For temperature calculation (at the end, shift right by 23)
+         * LUT[(D2-D1)] = ROUND{ 2^23 / ((D2-D1)*9*10) }
+         * (D2-D1) ==   43    44    45    46    47    48    49    50    51
+         */
+        static const u16 calc_lut[CALC_LUT_SIZE] = {
+                2168, 2118, 2071, 2026, 1983, 1942, 1902, 1864, 1828,
+        };
+
+        /*
+         * The diff between the high and low voltage-references is assumed
+         * to be strictly be in range of [60,68]
+         */
+        vrefs_diff = avg_ptat.bits.vref_high - avg_ptat.bits.vref_low;
+
+        if (vrefs_diff < CALC_VREFS_MIN_DIFF ||
+            vrefs_diff > CALC_VREFS_MAX_DIFF)
+                return TEMPERATURE_ERROR;
+
+        /* calculate the result: */
+        tmp_result =
+                vrefs_diff * (DTS_DIODE_GET_VREFS_ID(avg_ptat.bits.flags) + 9);
+        tmp_result += avg_ptat.bits.digital_value;
+        tmp_result -= avg_ptat.bits.vref_high;
+
+        /* multiply by the LUT value (based on the diff) */
+        tmp_result *= calc_lut[vrefs_diff - CALC_LUT_INDEX_OFFSET];
+
+        /*
+         * Get the BandGap (the voltage refereces source) error data
+         * (temperature offset)
+         */
+        tmp_result *= volt_band_gap;
+
+        /*
+         * here, tmp_result value can be up to 32-bits. We want to right-shift
+         * it *without* sign-extend.
+         */
+        tmp_result = tmp_result >> CALC_TEMPERATURE_RESULT_SHIFT_OFFSET;
+
+        /*
+         * at this point, tmp_result should be in the range:
+         * 200 <= tmp_result <= 365
+         */
+        return (s16)tmp_result - 240;
+}
+
+static s32 check_nic_temperature(struct iwl_mvm *mvm)
+{
+        u16 volt_band_gap;
+        union dts_diode_results avg_ptat;
+
+        volt_band_gap = iwl_mvm_dts_get_volt_band_gap(mvm);
+
+        /* disable DTS */
+        iwl_write_prph(mvm->trans, SHR_MISC_WFM_DTS_EN, 0);
+
+        /* SV initialization */
+        iwl_write_prph(mvm->trans, SHR_MISC_WFM_DTS_EN, 1);
+        iwl_write_prph(mvm->trans, DTSC_CFG_MODE,
+                       DTSC_CFG_MODE_PERIODIC);
+
+        /* wait for results */
+        msleep(100);
+        if (!dts_read_ptat_avg_results(mvm, &avg_ptat))
+                return TEMPERATURE_ERROR;
+
+        /* disable DTS */
+        iwl_write_prph(mvm->trans, SHR_MISC_WFM_DTS_EN, 0);
+
+        return calculate_nic_temperature(avg_ptat, volt_band_gap);
+}
+
+static void iwl_mvm_enter_ctkill(struct iwl_mvm *mvm)
+{
+        u32 duration = mvm->thermal_throttle.params->ct_kill_duration;
+
+        IWL_ERR(mvm, "Enter CT Kill\n");
+        iwl_mvm_set_hw_ctkill_state(mvm, true);
+        schedule_delayed_work(&mvm->thermal_throttle.ct_kill_exit,
+                              round_jiffies_relative(duration * HZ));
+}
+
+static void iwl_mvm_exit_ctkill(struct iwl_mvm *mvm)
+{
+        IWL_ERR(mvm, "Exit CT Kill\n");
+        iwl_mvm_set_hw_ctkill_state(mvm, false);
+}
+
+static void check_exit_ctkill(struct work_struct *work)
+{
+        struct iwl_mvm_tt_mgmt *tt;
+        struct iwl_mvm *mvm;
+        u32 duration;
+        s32 temp;
+
+        tt = container_of(work, struct iwl_mvm_tt_mgmt, ct_kill_exit.work);
+        mvm = container_of(tt, struct iwl_mvm, thermal_throttle);
+
+        duration = tt->params->ct_kill_duration;
+
+        iwl_trans_start_hw(mvm->trans);
+        temp = check_nic_temperature(mvm);
+        iwl_trans_stop_hw(mvm->trans, false);
+
+        if (temp < MIN_TEMPERATURE || temp > MAX_TEMPERATURE) {
+                IWL_DEBUG_TEMP(mvm, "Failed to measure NIC temperature\n");
+                goto reschedule;
+        }
+        IWL_DEBUG_TEMP(mvm, "NIC temperature: %d\n", temp);
+
+        if (temp <= tt->params->ct_kill_exit) {
+                iwl_mvm_exit_ctkill(mvm);
+                return;
+        }
+
+reschedule:
+        schedule_delayed_work(&mvm->thermal_throttle.ct_kill_exit,
+                              round_jiffies(duration * HZ));
+}
+
+static void iwl_mvm_tt_smps_iterator(void *_data, u8 *mac,
+                                     struct ieee80211_vif *vif)
+{
+        struct iwl_mvm *mvm = _data;
+        enum ieee80211_smps_mode smps_mode;
+
+        lockdep_assert_held(&mvm->mutex);
+
+        if (mvm->thermal_throttle.dynamic_smps)
+                smps_mode = IEEE80211_SMPS_DYNAMIC;
+        else
+                smps_mode = IEEE80211_SMPS_AUTOMATIC;
+
+        if (vif->type != NL80211_IFTYPE_STATION)
+                return;
+
+        iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT, smps_mode);
+}
+
+static void iwl_mvm_tt_tx_protection(struct iwl_mvm *mvm, bool enable)
+{
+        struct ieee80211_sta *sta;
+        struct iwl_mvm_sta *mvmsta;
+        int i, err;
+
+        for (i = 0; i < IWL_MVM_STATION_COUNT; i++) {
+                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[i],
+                                                lockdep_is_held(&mvm->mutex));
+                if (IS_ERR_OR_NULL(sta))
+                        continue;
+                mvmsta = (void *)sta->drv_priv;
+                if (enable == mvmsta->tt_tx_protection)
+                        continue;
+                err = iwl_mvm_tx_protection(mvm, &mvmsta->lq_sta.lq,
+                                            mvmsta, enable);
+                if (err) {
+                        IWL_ERR(mvm, "Failed to %s Tx protection\n",
+                                enable ? "enable" : "disable");
+                } else {
+                        IWL_DEBUG_TEMP(mvm, "%s Tx protection\n",
+                                       enable ? "Enable" : "Disable");
+                        mvmsta->tt_tx_protection = enable;
+                }
+        }
+}
+
+static void iwl_mvm_tt_tx_backoff(struct iwl_mvm *mvm, u32 backoff)
+{
+        struct iwl_host_cmd cmd = {
+                .id = REPLY_THERMAL_MNG_BACKOFF,
+                .len = { sizeof(u32), },
+                .data = { &backoff, },
+                .flags = CMD_SYNC,
+        };
+
+        if (iwl_mvm_send_cmd(mvm, &cmd) == 0) {
+                IWL_DEBUG_TEMP(mvm, "Set Thermal Tx backoff to: %u\n",
+                               backoff);
+                mvm->thermal_throttle.tx_backoff = backoff;
+        } else {
+                IWL_ERR(mvm, "Failed to change Thermal Tx backoff\n");
+        }
+}
+
+void iwl_mvm_tt_handler(struct iwl_mvm *mvm)
+{
+        const struct iwl_tt_params *params = mvm->thermal_throttle.params;
+        struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
+        s32 temperature = mvm->temperature;
+        int i;
+        u32 tx_backoff;
+
+        IWL_DEBUG_TEMP(mvm, "NIC temperature: %d\n", mvm->temperature);
+
+        if (params->support_ct_kill && temperature >= params->ct_kill_entry) {
+                iwl_mvm_enter_ctkill(mvm);
+                return;
+        }
+
+        if (params->support_dynamic_smps) {
+                if (!tt->dynamic_smps &&
+                    temperature >= params->dynamic_smps_entry) {
+                        IWL_DEBUG_TEMP(mvm, "Enable dynamic SMPS\n");
+                        tt->dynamic_smps = true;
+                        ieee80211_iterate_active_interfaces_atomic(
+                                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                                        iwl_mvm_tt_smps_iterator, mvm);
+                } else if (tt->dynamic_smps &&
+                           temperature <= params->dynamic_smps_exit) {
+                        IWL_DEBUG_TEMP(mvm, "Disable dynamic SMPS\n");
+                        tt->dynamic_smps = false;
+                        ieee80211_iterate_active_interfaces_atomic(
+                                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                                        iwl_mvm_tt_smps_iterator, mvm);
+                }
+        }
+
+        if (params->support_tx_protection) {
+                if (temperature >= params->tx_protection_entry)
+                        iwl_mvm_tt_tx_protection(mvm, true);
+                else if (temperature <= params->tx_protection_exit)
+                        iwl_mvm_tt_tx_protection(mvm, false);
+        }
+
+        if (params->support_tx_backoff) {
+                tx_backoff = 0;
+                for (i = 0; i < TT_TX_BACKOFF_SIZE; i++) {
+                        if (temperature < params->tx_backoff[i].temperature)
+                                break;
+                        tx_backoff = params->tx_backoff[i].backoff;
+                }
+                if (tt->tx_backoff != tx_backoff)
+                        iwl_mvm_tt_tx_backoff(mvm, tx_backoff);
+        }
+}
+
+static const struct iwl_tt_params iwl7000_tt_params = {
+        .ct_kill_entry = 118,
+        .ct_kill_exit = 96,
+        .ct_kill_duration = 5,
+        .dynamic_smps_entry = 114,
+        .dynamic_smps_exit = 110,
+        .tx_protection_entry = 114,
+        .tx_protection_exit = 108,
+        .tx_backoff = {
+                {.temperature = 112, .backoff = 200},
+                {.temperature = 113, .backoff = 600},
+                {.temperature = 114, .backoff = 1200},
+                {.temperature = 115, .backoff = 2000},
+                {.temperature = 116, .backoff = 4000},
+                {.temperature = 117, .backoff = 10000},
+        },
+        .support_ct_kill = true,
+        .support_dynamic_smps = true,
+        .support_tx_protection = true,
+        .support_tx_backoff = true,
+};
+
+void iwl_mvm_tt_initialize(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_tt_mgmt *tt = &mvm->thermal_throttle;
+
+        IWL_DEBUG_TEMP(mvm, "Initialize Thermal Throttling\n");
+        tt->params = &iwl7000_tt_params;
+        INIT_DELAYED_WORK(&tt->ct_kill_exit, check_exit_ctkill);
+}
+
+void iwl_mvm_tt_exit(struct iwl_mvm *mvm)
+{
+        cancel_delayed_work_sync(&mvm->thermal_throttle.ct_kill_exit);
+        IWL_DEBUG_TEMP(mvm, "Exit Thermal Throttling\n");
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index f212f16502ff..a830eb6cc411 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -175,7 +175,7 @@ static void iwl_mvm_set_tx_cmd_rate(struct iwl_mvm *mvm,
          * table is controlled by LINK_QUALITY commands
          */
 
-        if (ieee80211_is_data(fc)) {
+        if (ieee80211_is_data(fc) && sta) {
                 tx_cmd->initial_rate_index = 0;
                 tx_cmd->tx_flags |= cpu_to_le32(TX_CMD_FLG_STA_RATE);
                 return;
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 687b34e387ac..1e1332839e4a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -76,6 +76,11 @@ int iwl_mvm_send_cmd(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd)
 {
         int ret;
 
+#if defined(CONFIG_IWLWIFI_DEBUGFS) && defined(CONFIG_PM_SLEEP)
+        if (WARN_ON(mvm->d3_test_active))
+                return -EIO;
+#endif
+
         /*
          * Synchronous commands from this op-mode must hold
          * the mutex, this ensures we don't try to send two
@@ -125,6 +130,11 @@ int iwl_mvm_send_cmd_status(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd,
 
         lockdep_assert_held(&mvm->mutex);
 
+#if defined(CONFIG_IWLWIFI_DEBUGFS) && defined(CONFIG_PM_SLEEP)
+        if (WARN_ON(mvm->d3_test_active))
+                return -EIO;
+#endif
+
         /*
          * Only synchronous commands can wait for status,
          * we use WANT_SKB so the caller can't.
@@ -471,3 +481,34 @@ int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
 
         return iwl_mvm_send_cmd(mvm, &cmd);
 }
+
+/**
+ * iwl_mvm_update_smps - Get a requst to change the SMPS mode
+ * @req_type: The part of the driver who call for a change.
+ * @smps_requests: The request to change the SMPS mode.
+ *
+ * Get a requst to change the SMPS mode,
+ * and change it according to all other requests in the driver.
+ */
+void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                         enum iwl_mvm_smps_type_request req_type,
+                         enum ieee80211_smps_mode smps_request)
+{
+        struct iwl_mvm_vif *mvmvif;
+        enum ieee80211_smps_mode smps_mode = IEEE80211_SMPS_AUTOMATIC;
+        int i;
+
+        lockdep_assert_held(&mvm->mutex);
+        mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        mvmvif->smps_requests[req_type] = smps_request;
+        for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) {
+                if (mvmvif->smps_requests[i] == IEEE80211_SMPS_STATIC) {
+                        smps_mode = IEEE80211_SMPS_STATIC;
+                        break;
+                }
+                if (mvmvif->smps_requests[i] == IEEE80211_SMPS_DYNAMIC)
+                        smps_mode = IEEE80211_SMPS_DYNAMIC;
+        }
+
+        ieee80211_request_smps(vif, smps_mode);
+}
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 8cb53ec2b77b..db7bdd35a9c5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -256,10 +256,54 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
 
 /* 7000 Series */
         {IWL_PCI_DEVICE(0x08B1, 0x4070, iwl7260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4170, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4160, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4062, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4162, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4262, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4460, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4462, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4870, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x486E, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4A70, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4A6E, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4A6C, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x4420, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0xC070, iwl7260_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_ac_cfg)},
-        {IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC170, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC060, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC160, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC062, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC162, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC270, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC260, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC262, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC470, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC460, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC462, iwl7260_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC020, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B2, 0xC220, iwl7260_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0xC420, iwl7260_2n_cfg)},
+
+/* 3160 Series */
+        {IWL_PCI_DEVICE(0x08B3, 0x0070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0060, iwl3160_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0062, iwl3160_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x0270, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x0470, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8170, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8060, iwl3160_2n_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8062, iwl3160_n_cfg)},
+        {IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
 
         {0}
 };
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 50ba0a468f94..197dbe0a868c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -405,20 +405,27 @@ static int iwl_pcie_load_section(struct iwl_trans *trans, u8 section_num,
 {
         u8 *v_addr;
         dma_addr_t p_addr;
-        u32 offset;
+        u32 offset, chunk_sz = section->len;
         int ret = 0;
 
         IWL_DEBUG_FW(trans, "[%d] uCode section being loaded...\n",
                      section_num);
 
-        v_addr = dma_alloc_coherent(trans->dev, PAGE_SIZE, &p_addr, GFP_KERNEL);
-        if (!v_addr)
-                return -ENOMEM;
+        v_addr = dma_alloc_coherent(trans->dev, chunk_sz, &p_addr,
+                                    GFP_KERNEL | __GFP_NOWARN);
+        if (!v_addr) {
+                IWL_DEBUG_INFO(trans, "Falling back to small chunks of DMA\n");
+                chunk_sz = PAGE_SIZE;
+                v_addr = dma_alloc_coherent(trans->dev, chunk_sz,
+                                            &p_addr, GFP_KERNEL);
+                if (!v_addr)
+                        return -ENOMEM;
+        }
 
-        for (offset = 0; offset < section->len; offset += PAGE_SIZE) {
+        for (offset = 0; offset < section->len; offset += chunk_sz) {
                 u32 copy_size;
 
-                copy_size = min_t(u32, PAGE_SIZE, section->len - offset);
+                copy_size = min_t(u32, chunk_sz, section->len - offset);
 
                 memcpy(v_addr, (u8 *)section->data + offset, copy_size);
                 ret = iwl_pcie_load_firmware_chunk(trans,
@@ -432,7 +439,7 @@ static int iwl_pcie_load_section(struct iwl_trans *trans, u8 section_num,
                 }
         }
 
-        dma_free_coherent(trans->dev, PAGE_SIZE, v_addr, p_addr);
+        dma_free_coherent(trans->dev, chunk_sz, v_addr, p_addr);
         return ret;
 }
 
@@ -571,13 +578,17 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         clear_bit(STATUS_RFKILL, &trans_pcie->status);
 }
 
-static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans)
+static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test)
 {
-        /* let the ucode operate on its own */
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_SET,
-                    CSR_UCODE_DRV_GP1_BIT_D3_CFG_COMPLETE);
-
         iwl_disable_interrupts(trans);
+
+        /*
+         * in testing mode, the host stays awake and the
+         * hardware won't be reset (not even partially)
+         */
+        if (test)
+                return;
+
         iwl_pcie_disable_ict(trans);
 
         iwl_clear_bit(trans, CSR_GP_CNTRL,
@@ -596,11 +607,18 @@ static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans)
 }
 
 static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
-                                    enum iwl_d3_status *status)
+                                    enum iwl_d3_status *status,
+                                    bool test)
 {
         u32 val;
         int ret;
 
+        if (test) {
+                iwl_enable_interrupts(trans);
+                *status = IWL_D3_STATUS_ALIVE;
+                return 0;
+        }
+
         iwl_pcie_set_pwr(trans, false);
 
         val = iwl_read32(trans, CSR_RESET);
@@ -636,9 +654,6 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
                 return ret;
         }
 
-        iwl_write32(trans, CSR_UCODE_DRV_GP1_CLR,
-                    CSR_UCODE_DRV_GP1_BIT_D3_CFG_COMPLETE);
-
         *status = IWL_D3_STATUS_ALIVE;
         return 0;
 }
@@ -917,11 +932,11 @@ static int iwl_trans_pcie_read_mem(struct iwl_trans *trans, u32 addr,
 }
 
 static int iwl_trans_pcie_write_mem(struct iwl_trans *trans, u32 addr,
-                                    void *buf, int dwords)
+                                    const void *buf, int dwords)
 {
         unsigned long flags;
         int offs, ret = 0;
-        u32 *vals = buf;
+        const u32 *vals = buf;
 
         if (iwl_trans_grab_nic_access(trans, false, &flags)) {
                 iwl_write32(trans, HBUS_TARG_MEM_WADDR, addr);
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index c5e30294c5ac..f65da1984d91 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -224,13 +224,13 @@ static void iwl_pcie_txq_update_byte_cnt_tbl(struct iwl_trans *trans,
 
         switch (sec_ctl & TX_CMD_SEC_MSK) {
         case TX_CMD_SEC_CCM:
-                len += CCMP_MIC_LEN;
+                len += IEEE80211_CCMP_MIC_LEN;
                 break;
         case TX_CMD_SEC_TKIP:
-                len += TKIP_ICV_LEN;
+                len += IEEE80211_TKIP_ICV_LEN;
                 break;
         case TX_CMD_SEC_WEP:
-                len += WEP_IV_LEN + WEP_ICV_LEN;
+                len += IEEE80211_WEP_IV_LEN + IEEE80211_WEP_ICV_LEN;
                 break;
         }
 
@@ -1045,6 +1045,10 @@ static inline void iwl_pcie_txq_set_inactive(struct iwl_trans *trans,
                 (1 << SCD_QUEUE_STTS_REG_POS_SCD_ACT_EN));
 }
 
+/* Receiver address (actually, Rx station's index into station table),
+ * combined with Traffic ID (QOS priority), in format used by Tx Scheduler */
+#define BUILD_RAxTID(sta_id, tid)       (((sta_id) << 4) + (tid))
+
 void iwl_trans_pcie_txq_enable(struct iwl_trans *trans, int txq_id, int fifo,
                                int sta_id, int tid, int frame_limit, u16 ssn)
 {
@@ -1518,11 +1522,13 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
         if (test_bit(STATUS_FW_ERROR, &trans_pcie->status)) {
                 IWL_ERR(trans, "FW error in SYNC CMD %s\n",
                         get_cmd_string(trans_pcie, cmd->id));
+                dump_stack();
                 ret = -EIO;
                 goto cancel;
         }
 
-        if (test_bit(STATUS_RFKILL, &trans_pcie->status)) {
+        if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
+            test_bit(STATUS_RFKILL, &trans_pcie->status)) {
                 IWL_DEBUG_RF_KILL(trans, "RFKILL in SYNC CMD... no rsp\n");
                 ret = -ERFKILL;
                 goto cancel;
@@ -1564,7 +1570,8 @@ int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
         if (test_bit(STATUS_FW_ERROR, &trans_pcie->status))
                 return -EIO;
 
-        if (test_bit(STATUS_RFKILL, &trans_pcie->status)) {
+        if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
+            test_bit(STATUS_RFKILL, &trans_pcie->status)) {
                 IWL_DEBUG_RF_KILL(trans, "Dropping CMD 0x%x: RF KILL\n",
                                   cmd->id);
                 return -ERFKILL;
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index 4f614aad9ded..f7ff4725506a 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -3,13 +3,13 @@ config MWIFIEX
         depends on CFG80211
         ---help---
           This adds support for wireless adapters based on Marvell
-          802.11n chipsets.
+          802.11n/ac chipsets.
 
           If you choose to build it as a module, it will be called
           mwifiex.
 
 config MWIFIEX_SDIO
-        tristate "Marvell WiFi-Ex Driver for SD8786/SD8787/SD8797"
+        tristate "Marvell WiFi-Ex Driver for SD8786/SD8787/SD8797/SD8897"
         depends on MWIFIEX && MMC
         select FW_LOADER
         ---help---
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index e42b266a023a..00a82817eb6b 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1231,6 +1231,51 @@ static int mwifiex_cfg80211_change_beacon(struct wiphy *wiphy,
         return 0;
 }
 
+/* cfg80211 operation handler for del_station.
+ * Function deauthenticates station which value is provided in mac parameter.
+ * If mac is NULL/broadcast, all stations in associated station list are
+ * deauthenticated. If bss is not started or there are no stations in
+ * associated stations list, no action is taken.
+ */
+static int
+mwifiex_cfg80211_del_station(struct wiphy *wiphy, struct net_device *dev,
+                             u8 *mac)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        struct mwifiex_sta_node *sta_node;
+        unsigned long flags;
+
+        if (list_empty(&priv->sta_list) || !priv->bss_started)
+                return 0;
+
+        if (!mac || is_broadcast_ether_addr(mac)) {
+                wiphy_dbg(wiphy, "%s: NULL/broadcast mac address\n", __func__);
+                list_for_each_entry(sta_node, &priv->sta_list, list) {
+                        if (mwifiex_send_cmd_sync(priv,
+                                                  HostCmd_CMD_UAP_STA_DEAUTH,
+                                                  HostCmd_ACT_GEN_SET, 0,
+                                                  sta_node->mac_addr))
+                                return -1;
+                        mwifiex_uap_del_sta_data(priv, sta_node);
+                }
+        } else {
+                wiphy_dbg(wiphy, "%s: mac address %pM\n", __func__, mac);
+                spin_lock_irqsave(&priv->sta_list_spinlock, flags);
+                sta_node = mwifiex_get_sta_entry(priv, mac);
+                spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
+                if (sta_node) {
+                        if (mwifiex_send_cmd_sync(priv,
+                                                  HostCmd_CMD_UAP_STA_DEAUTH,
+                                                  HostCmd_ACT_GEN_SET, 0,
+                                                  sta_node->mac_addr))
+                                return -1;
+                        mwifiex_uap_del_sta_data(priv, sta_node);
+                }
+        }
+
+        return 0;
+}
+
 static int
 mwifiex_cfg80211_set_antenna(struct wiphy *wiphy, u32 tx_ant, u32 rx_ant)
 {
@@ -1859,6 +1904,7 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
         int i, offset, ret;
         struct ieee80211_channel *chan;
         struct ieee_types_header *ie;
+        struct mwifiex_user_scan_cfg *user_scan_cfg;
 
         wiphy_dbg(wiphy, "info: received scan request on %s\n", dev->name);
 
@@ -1869,20 +1915,22 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 return -EBUSY;
         }
 
-        if (priv->user_scan_cfg) {
+        /* Block scan request if scan operation or scan cleanup when interface
+         * is disabled is in process
+         */
+        if (priv->scan_request || priv->scan_aborting) {
                 dev_err(priv->adapter->dev, "cmd: Scan already in process..\n");
                 return -EBUSY;
         }
 
-        priv->user_scan_cfg = kzalloc(sizeof(struct mwifiex_user_scan_cfg),
-                                      GFP_KERNEL);
-        if (!priv->user_scan_cfg)
+        user_scan_cfg = kzalloc(sizeof(*user_scan_cfg), GFP_KERNEL);
+        if (!user_scan_cfg)
                 return -ENOMEM;
 
         priv->scan_request = request;
 
-        priv->user_scan_cfg->num_ssids = request->n_ssids;
-        priv->user_scan_cfg->ssid_list = request->ssids;
+        user_scan_cfg->num_ssids = request->n_ssids;
+        user_scan_cfg->ssid_list = request->ssids;
 
         if (request->ie && request->ie_len) {
                 offset = 0;
@@ -1902,25 +1950,25 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
         for (i = 0; i < min_t(u32, request->n_channels,
                               MWIFIEX_USER_SCAN_CHAN_MAX); i++) {
                 chan = request->channels[i];
-                priv->user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
-                priv->user_scan_cfg->chan_list[i].radio_type = chan->band;
+                user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
+                user_scan_cfg->chan_list[i].radio_type = chan->band;
 
                 if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        priv->user_scan_cfg->chan_list[i].scan_type =
+                        user_scan_cfg->chan_list[i].scan_type =
                                                 MWIFIEX_SCAN_TYPE_PASSIVE;
                 else
-                        priv->user_scan_cfg->chan_list[i].scan_type =
+                        user_scan_cfg->chan_list[i].scan_type =
                                                 MWIFIEX_SCAN_TYPE_ACTIVE;
 
-                priv->user_scan_cfg->chan_list[i].scan_time = 0;
+                user_scan_cfg->chan_list[i].scan_time = 0;
         }
 
-        ret = mwifiex_scan_networks(priv, priv->user_scan_cfg);
+        ret = mwifiex_scan_networks(priv, user_scan_cfg);
+        kfree(user_scan_cfg);
         if (ret) {
                 dev_err(priv->adapter->dev, "scan failed: %d\n", ret);
+                priv->scan_aborting = false;
                 priv->scan_request = NULL;
-                kfree(priv->user_scan_cfg);
-                priv->user_scan_cfg = NULL;
                 return ret;
         }
 
@@ -2419,6 +2467,7 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .change_beacon = mwifiex_cfg80211_change_beacon,
         .set_cqm_rssi_config = mwifiex_cfg80211_set_cqm_rssi_config,
         .set_antenna = mwifiex_cfg80211_set_antenna,
+        .del_station = mwifiex_cfg80211_del_station,
 #ifdef CONFIG_PM
         .suspend = mwifiex_cfg80211_suspend,
         .resume = mwifiex_cfg80211_resume,
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 26755d9acb55..2d761477d15e 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -570,6 +570,7 @@ int mwifiex_send_cmd_async(struct mwifiex_private *priv, uint16_t cmd_no,
                 case HostCmd_CMD_UAP_SYS_CONFIG:
                 case HostCmd_CMD_UAP_BSS_START:
                 case HostCmd_CMD_UAP_BSS_STOP:
+                case HostCmd_CMD_UAP_STA_DEAUTH:
                         ret = mwifiex_uap_prepare_cmd(priv, cmd_no, cmd_action,
                                                       cmd_oid, data_buf,
                                                       cmd_ptr);
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 1f7578d553ec..d6ada7354c14 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -271,6 +271,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_802_11_SUBSCRIBE_EVENT            0x0075
 #define HostCmd_CMD_802_11_TX_RATE_QUERY              0x007f
 #define HostCmd_CMD_802_11_IBSS_COALESCING_STATUS     0x0083
+#define HostCmd_CMD_CFG_DATA                          0x008f
 #define HostCmd_CMD_VERSION_EXT                       0x0097
 #define HostCmd_CMD_MEF_CFG                           0x009a
 #define HostCmd_CMD_RSSI_INFO                         0x00a4
@@ -279,6 +280,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_UAP_SYS_CONFIG                    0x00b0
 #define HostCmd_CMD_UAP_BSS_START                     0x00b1
 #define HostCmd_CMD_UAP_BSS_STOP                      0x00b2
+#define HostCmd_CMD_UAP_STA_DEAUTH                    0x00b5
 #define HostCmd_CMD_11N_CFG                           0x00cd
 #define HostCmd_CMD_11N_ADDBA_REQ                     0x00ce
 #define HostCmd_CMD_11N_ADDBA_RSP                     0x00cf
@@ -464,6 +466,8 @@ enum P2P_MODES {
 #define MWIFIEX_CRITERIA_UNICAST        BIT(1)
 #define MWIFIEX_CRITERIA_MULTICAST      BIT(3)
 
+#define CFG_DATA_TYPE_CAL               2
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1197,6 +1201,11 @@ struct host_cmd_ds_amsdu_aggr_ctrl {
         __le16 curr_buf_size;
 } __packed;
 
+struct host_cmd_ds_sta_deauth {
+        u8 mac[ETH_ALEN];
+        __le16 reason;
+} __packed;
+
 struct mwifiex_ie_types_wmm_param_set {
         struct mwifiex_ie_types_header header;
         u8 wmm_ie[1];
@@ -1573,6 +1582,12 @@ struct mwifiex_ie_list {
         struct mwifiex_ie ie_list[MAX_MGMT_IE_INDEX];
 } __packed;
 
+struct host_cmd_ds_802_11_cfg_data {
+        __le16 action;
+        __le16 type;
+        __le16 data_len;
+} __packed;
+
 struct host_cmd_ds_command {
         __le16 command;
         __le16 size;
@@ -1630,7 +1645,9 @@ struct host_cmd_ds_command {
                 struct host_cmd_ds_802_11_eeprom_access eeprom;
                 struct host_cmd_ds_802_11_subsc_evt subsc_evt;
                 struct host_cmd_ds_sys_config uap_sys_config;
+                struct host_cmd_ds_sta_deauth sta_deauth;
                 struct host_cmd_11ac_vht_cfg vht_cfg;
+                struct host_cmd_ds_802_11_cfg_data cfg_data;
         } params;
 } __packed;
 
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 9f44fda19db9..c7f11c0c3bb7 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -59,6 +59,9 @@ static void scan_delay_timer_fn(unsigned long data)
         struct cmd_ctrl_node *cmd_node, *tmp_node;
         unsigned long flags;
 
+        if (adapter->surprise_removed)
+                return;
+
         if (adapter->scan_delay_cnt == MWIFIEX_MAX_SCAN_DELAY_CNT) {
                 /*
                  * Abort scan operation by cancelling all pending scan
@@ -78,19 +81,13 @@ static void scan_delay_timer_fn(unsigned long data)
                 adapter->empty_tx_q_cnt = 0;
                 spin_unlock_irqrestore(&adapter->mwifiex_cmd_lock, flags);
 
-                if (priv->user_scan_cfg) {
-                        if (priv->scan_request) {
-                                dev_dbg(priv->adapter->dev,
-                                        "info: aborting scan\n");
-                                cfg80211_scan_done(priv->scan_request, 1);
-                                priv->scan_request = NULL;
-                        } else {
-                                dev_dbg(priv->adapter->dev,
-                                        "info: scan already aborted\n");
-                        }
-
-                        kfree(priv->user_scan_cfg);
-                        priv->user_scan_cfg = NULL;
+                if (priv->scan_request) {
+                        dev_dbg(adapter->dev, "info: aborting scan\n");
+                        cfg80211_scan_done(priv->scan_request, 1);
+                        priv->scan_request = NULL;
+                } else {
+                        priv->scan_aborting = false;
+                        dev_dbg(adapter->dev, "info: scan already aborted\n");
                 }
                 goto done;
         }
@@ -447,23 +444,29 @@ static void mwifiex_free_lock_list(struct mwifiex_adapter *adapter)
 }
 
 /*
- * This function frees the adapter structure.
+ * This function performs cleanup for adapter structure.
  *
- * The freeing operation is done recursively, by canceling all
- * pending commands, freeing the member buffers previously
- * allocated (command buffers, scan table buffer, sleep confirm
- * command buffer), stopping the timers and calling the cleanup
- * routines for every interface, before the actual adapter
- * structure is freed.
+ * The cleanup is done recursively, by canceling all pending
+ * commands, freeing the member buffers previously allocated
+ * (command buffers, scan table buffer, sleep confirm command
+ * buffer), stopping the timers and calling the cleanup routines
+ * for every interface.
  */
 static void
-mwifiex_free_adapter(struct mwifiex_adapter *adapter)
+mwifiex_adapter_cleanup(struct mwifiex_adapter *adapter)
 {
+        int i;
+
         if (!adapter) {
                 pr_err("%s: adapter is NULL\n", __func__);
                 return;
         }
 
+        for (i = 0; i < adapter->priv_num; i++) {
+                if (adapter->priv[i])
+                        del_timer_sync(&adapter->priv[i]->scan_delay_timer);
+        }
+
         mwifiex_cancel_all_pending_cmd(adapter);
 
         /* Free lock variables */
@@ -684,7 +687,6 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
         int ret = -EINPROGRESS;
         struct mwifiex_private *priv;
         s32 i;
-        unsigned long flags;
         struct sk_buff *skb;
 
         /* mwifiex already shutdown */
@@ -719,7 +721,7 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 }
         }
 
-        spin_lock_irqsave(&adapter->mwifiex_lock, flags);
+        spin_lock(&adapter->mwifiex_lock);
 
         if (adapter->if_ops.data_complete) {
                 while ((skb = skb_dequeue(&adapter->usb_rx_data_q))) {
@@ -733,10 +735,9 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                 }
         }
 
-        /* Free adapter structure */
-        mwifiex_free_adapter(adapter);
+        mwifiex_adapter_cleanup(adapter);
 
-        spin_unlock_irqrestore(&adapter->mwifiex_lock, flags);
+        spin_unlock(&adapter->mwifiex_lock);
 
         /* Notify completion */
         ret = mwifiex_shutdown_fw_complete(adapter);
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 6bcb66e6e97c..122175af18c6 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -919,9 +919,8 @@ mwifiex_cmd_802_11_ad_hoc_start(struct mwifiex_private *priv,
         memcpy(&priv->curr_bss_params.data_rates,
                &adhoc_start->data_rate, priv->curr_bss_params.num_of_rates);
 
-        dev_dbg(adapter->dev, "info: ADHOC_S_CMD: rates=%02x %02x %02x %02x\n",
-                adhoc_start->data_rate[0], adhoc_start->data_rate[1],
-                adhoc_start->data_rate[2], adhoc_start->data_rate[3]);
+        dev_dbg(adapter->dev, "info: ADHOC_S_CMD: rates=%4ph\n",
+                adhoc_start->data_rate);
 
         dev_dbg(adapter->dev, "info: ADHOC_S_CMD: AD-HOC Start command is ready\n");
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 2eb88ea9acf7..5bc7ef8d04d6 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -25,6 +25,8 @@
 #define VERSION "1.0"
 
 const char driver_version[] = "mwifiex " VERSION " (%s) ";
+static char *cal_data_cfg;
+module_param(cal_data_cfg, charp, 0);
 
 /*
  * This function registers the device and performs all the necessary
@@ -336,6 +338,13 @@ static void mwifiex_fw_dpc(const struct firmware *firmware, void *context)
 
         dev_notice(adapter->dev, "WLAN FW is active\n");
 
+        if (cal_data_cfg) {
+                if ((request_firmware(&adapter->cal_data, cal_data_cfg,
+                                      adapter->dev)) < 0)
+                        dev_err(adapter->dev,
+                                "Cal data request_firmware() failed\n");
+        }
+
         adapter->init_wait_q_woken = false;
         ret = mwifiex_init_fw(adapter);
         if (ret == -1) {
@@ -390,6 +399,10 @@ err_init_fw:
         pr_debug("info: %s: unregister device\n", __func__);
         adapter->if_ops.unregister_dev(adapter);
 done:
+        if (adapter->cal_data) {
+                release_firmware(adapter->cal_data);
+                adapter->cal_data = NULL;
+        }
         release_firmware(adapter->firmware);
         complete(&adapter->fw_load);
         return;
@@ -436,6 +449,7 @@ mwifiex_close(struct net_device *dev)
                 dev_dbg(priv->adapter->dev, "aborting scan on ndo_stop\n");
                 cfg80211_scan_done(priv->scan_request, 1);
                 priv->scan_request = NULL;
+                priv->scan_aborting = true;
         }
 
         return 0;
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 4ef67fca06d3..0832c2437daf 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -492,7 +492,6 @@ struct mwifiex_private {
         struct semaphore async_sem;
         u8 report_scan_result;
         struct cfg80211_scan_request *scan_request;
-        struct mwifiex_user_scan_cfg *user_scan_cfg;
         u8 cfg_bssid[6];
         struct wps wps;
         u8 scan_block;
@@ -510,6 +509,7 @@ struct mwifiex_private {
         u8 ap_11ac_enabled;
         u32 mgmt_frame_mask;
         struct mwifiex_roc_cfg roc_cfg;
+        bool scan_aborting;
 };
 
 enum mwifiex_ba_status {
@@ -730,6 +730,7 @@ struct mwifiex_adapter {
         u16 max_mgmt_ie_index;
         u8 scan_delay_cnt;
         u8 empty_tx_q_cnt;
+        const struct firmware *cal_data;
 
         /* 11AC */
         u32 is_hw_11ac_capable;
@@ -1115,6 +1116,8 @@ int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                          struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
+void mwifiex_uap_del_sta_data(struct mwifiex_private *priv,
+                              struct mwifiex_sta_node *node);
 
 extern const struct ethtool_ops mwifiex_ethtool_ops;
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9cf5d8f07df8..801b6b728379 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1784,22 +1784,17 @@ check_next_scan:
                 if (priv->report_scan_result)
                         priv->report_scan_result = false;
 
-                if (priv->user_scan_cfg) {
-                        if (priv->scan_request) {
-                                dev_dbg(priv->adapter->dev,
-                                        "info: notifying scan done\n");
-                                cfg80211_scan_done(priv->scan_request, 0);
-                                priv->scan_request = NULL;
-                        } else {
-                                dev_dbg(priv->adapter->dev,
-                                        "info: scan already aborted\n");
-                        }
-
-                        kfree(priv->user_scan_cfg);
-                        priv->user_scan_cfg = NULL;
+                if (priv->scan_request) {
+                        dev_dbg(adapter->dev, "info: notifying scan done\n");
+                        cfg80211_scan_done(priv->scan_request, 0);
+                        priv->scan_request = NULL;
+                } else {
+                        priv->scan_aborting = false;
+                        dev_dbg(adapter->dev, "info: scan already aborted\n");
                 }
         } else {
-                if (priv->user_scan_cfg && !priv->scan_request) {
+                if ((priv->scan_aborting && !priv->scan_request) ||
+                    priv->scan_block) {
                         spin_unlock_irqrestore(&adapter->scan_pending_q_lock,
                                                flags);
                         adapter->scan_delay_cnt = MWIFIEX_MAX_SCAN_DELAY_CNT;
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 363ba31b58bf..5ee5ed02eccd 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -77,6 +77,17 @@ mwifiex_sdio_probe(struct sdio_func *func, const struct sdio_device_id *id)
 
         func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
 
+        if (id->driver_data) {
+                struct mwifiex_sdio_device *data = (void *)id->driver_data;
+
+                card->firmware = data->firmware;
+                card->reg = data->reg;
+                card->max_ports = data->max_ports;
+                card->mp_agg_pkt_limit = data->mp_agg_pkt_limit;
+                card->supports_sdio_new_mode = data->supports_sdio_new_mode;
+                card->has_control_mask = data->has_control_mask;
+        }
+
         sdio_claim_host(func);
         ret = sdio_enable_func(func);
         sdio_release_host(func);
@@ -251,12 +262,19 @@ static int mwifiex_sdio_resume(struct device *dev)
 #define SDIO_DEVICE_ID_MARVELL_8787   (0x9119)
 /* Device ID for SD8797 */
 #define SDIO_DEVICE_ID_MARVELL_8797   (0x9129)
+/* Device ID for SD8897 */
+#define SDIO_DEVICE_ID_MARVELL_8897   (0x912d)
 
 /* WLAN IDs */
 static const struct sdio_device_id mwifiex_ids[] = {
-        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8786)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8787)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8797)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8786),
+                .driver_data = (unsigned long) &mwifiex_sdio_sd8786},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8787),
+                .driver_data = (unsigned long) &mwifiex_sdio_sd8787},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8797),
+                .driver_data = (unsigned long) &mwifiex_sdio_sd8797},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8897),
+                .driver_data = (unsigned long) &mwifiex_sdio_sd8897},
         {},
 };
 
@@ -282,13 +300,13 @@ static struct sdio_driver mwifiex_sdio = {
  * This function writes data into SDIO card register.
  */
 static int
-mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u32 data)
+mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u8 data)
 {
         struct sdio_mmc_card *card = adapter->card;
         int ret = -1;
 
         sdio_claim_host(card->func);
-        sdio_writeb(card->func, (u8) data, reg, &ret);
+        sdio_writeb(card->func, data, reg, &ret);
         sdio_release_host(card->func);
 
         return ret;
@@ -298,7 +316,7 @@ mwifiex_write_reg(struct mwifiex_adapter *adapter, u32 reg, u32 data)
  * This function reads data from SDIO card register.
  */
 static int
-mwifiex_read_reg(struct mwifiex_adapter *adapter, u32 reg, u32 *data)
+mwifiex_read_reg(struct mwifiex_adapter *adapter, u32 reg, u8 *data)
 {
         struct sdio_mmc_card *card = adapter->card;
         int ret = -1;
@@ -400,7 +418,40 @@ static int mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
 }
 
 /*
- * This function initializes the IO ports.
+ * This function is used to initialize IO ports for the
+ * chipsets supporting SDIO new mode eg SD8897.
+ */
+static int mwifiex_init_sdio_new_mode(struct mwifiex_adapter *adapter)
+{
+        u8 reg;
+
+        adapter->ioport = MEM_PORT;
+
+        /* enable sdio new mode */
+        if (mwifiex_read_reg(adapter, CARD_CONFIG_2_1_REG, &reg))
+                return -1;
+        if (mwifiex_write_reg(adapter, CARD_CONFIG_2_1_REG,
+                              reg | CMD53_NEW_MODE))
+                return -1;
+
+        /* Configure cmd port and enable reading rx length from the register */
+        if (mwifiex_read_reg(adapter, CMD_CONFIG_0, &reg))
+                return -1;
+        if (mwifiex_write_reg(adapter, CMD_CONFIG_0, reg | CMD_PORT_RD_LEN_EN))
+                return -1;
+
+        /* Enable Dnld/Upld ready auto reset for cmd port after cmd53 is
+         * completed
+         */
+        if (mwifiex_read_reg(adapter, CMD_CONFIG_1, &reg))
+                return -1;
+        if (mwifiex_write_reg(adapter, CMD_CONFIG_1, reg | CMD_PORT_AUTO_EN))
+                return -1;
+
+        return 0;
+}
+
+/* This function initializes the IO ports.
  *
  * The following operations are performed -
  *      - Read the IO ports (0, 1 and 2)
@@ -409,10 +460,17 @@ static int mwifiex_pm_wakeup_card_complete(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_init_sdio_ioport(struct mwifiex_adapter *adapter)
 {
-        u32 reg;
+        u8 reg;
+        struct sdio_mmc_card *card = adapter->card;
 
         adapter->ioport = 0;
 
+        if (card->supports_sdio_new_mode) {
+                if (mwifiex_init_sdio_new_mode(adapter))
+                        return -1;
+                goto cont;
+        }
+
         /* Read the IO port */
         if (!mwifiex_read_reg(adapter, IO_PORT_0_REG, &reg))
                 adapter->ioport |= (reg & 0xff);
@@ -428,19 +486,19 @@ static int mwifiex_init_sdio_ioport(struct mwifiex_adapter *adapter)
                 adapter->ioport |= ((reg & 0xff) << 16);
         else
                 return -1;
-
+cont:
         pr_debug("info: SDIO FUNC1 IO port: %#x\n", adapter->ioport);
 
         /* Set Host interrupt reset to read to clear */
         if (!mwifiex_read_reg(adapter, HOST_INT_RSR_REG, &reg))
                 mwifiex_write_reg(adapter, HOST_INT_RSR_REG,
-                                  reg | SDIO_INT_MASK);
+                                  reg | card->reg->sdio_int_mask);
         else
                 return -1;
 
         /* Dnld/Upld ready set to auto reset */
-        if (!mwifiex_read_reg(adapter, CARD_MISC_CFG_REG, &reg))
-                mwifiex_write_reg(adapter, CARD_MISC_CFG_REG,
+        if (!mwifiex_read_reg(adapter, card->reg->card_misc_cfg_reg, &reg))
+                mwifiex_write_reg(adapter, card->reg->card_misc_cfg_reg,
                                   reg | AUTO_RE_ENABLE_INT);
         else
                 return -1;
@@ -486,34 +544,42 @@ static int mwifiex_write_data_to_card(struct mwifiex_adapter *adapter,
 static int mwifiex_get_rd_port(struct mwifiex_adapter *adapter, u8 *port)
 {
         struct sdio_mmc_card *card = adapter->card;
-        u16 rd_bitmap = card->mp_rd_bitmap;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
+        u32 rd_bitmap = card->mp_rd_bitmap;
 
-        dev_dbg(adapter->dev, "data: mp_rd_bitmap=0x%04x\n", rd_bitmap);
+        dev_dbg(adapter->dev, "data: mp_rd_bitmap=0x%08x\n", rd_bitmap);
 
-        if (!(rd_bitmap & (CTRL_PORT_MASK | DATA_PORT_MASK)))
-                return -1;
+        if (card->supports_sdio_new_mode) {
+                if (!(rd_bitmap & reg->data_port_mask))
+                        return -1;
+        } else {
+                if (!(rd_bitmap & (CTRL_PORT_MASK | reg->data_port_mask)))
+                        return -1;
+        }
 
-        if (card->mp_rd_bitmap & CTRL_PORT_MASK) {
-                card->mp_rd_bitmap &= (u16) (~CTRL_PORT_MASK);
+        if ((card->has_control_mask) &&
+            (card->mp_rd_bitmap & CTRL_PORT_MASK)) {
+                card->mp_rd_bitmap &= (u32) (~CTRL_PORT_MASK);
                 *port = CTRL_PORT;
-                dev_dbg(adapter->dev, "data: port=%d mp_rd_bitmap=0x%04x\n",
+                dev_dbg(adapter->dev, "data: port=%d mp_rd_bitmap=0x%08x\n",
                         *port, card->mp_rd_bitmap);
-        } else {
-                if (card->mp_rd_bitmap & (1 << card->curr_rd_port)) {
-                        card->mp_rd_bitmap &= (u16)
-                                                (~(1 << card->curr_rd_port));
-                        *port = card->curr_rd_port;
+                return 0;
+        }
 
-                        if (++card->curr_rd_port == MAX_PORT)
-                                card->curr_rd_port = 1;
-                } else {
-                        return -1;
-                }
+        if (!(card->mp_rd_bitmap & (1 << card->curr_rd_port)))
+                return -1;
+
+        /* We are now handling the SDIO data ports */
+        card->mp_rd_bitmap &= (u32)(~(1 << card->curr_rd_port));
+        *port = card->curr_rd_port;
+
+        if (++card->curr_rd_port == card->max_ports)
+                card->curr_rd_port = reg->start_rd_port;
+
+        dev_dbg(adapter->dev,
+                "data: port=%d mp_rd_bitmap=0x%08x -> 0x%08x\n",
+                *port, rd_bitmap, card->mp_rd_bitmap);
 
-                dev_dbg(adapter->dev,
-                        "data: port=%d mp_rd_bitmap=0x%04x -> 0x%04x\n",
-                        *port, rd_bitmap, card->mp_rd_bitmap);
-        }
         return 0;
 }
 
@@ -524,35 +590,45 @@ static int mwifiex_get_rd_port(struct mwifiex_adapter *adapter, u8 *port)
  * increased (provided it does not reach the maximum limit, in which
  * case it is reset to 1)
  */
-static int mwifiex_get_wr_port_data(struct mwifiex_adapter *adapter, u8 *port)
+static int mwifiex_get_wr_port_data(struct mwifiex_adapter *adapter, u32 *port)
 {
         struct sdio_mmc_card *card = adapter->card;
-        u16 wr_bitmap = card->mp_wr_bitmap;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
+        u32 wr_bitmap = card->mp_wr_bitmap;
 
-        dev_dbg(adapter->dev, "data: mp_wr_bitmap=0x%04x\n", wr_bitmap);
+        dev_dbg(adapter->dev, "data: mp_wr_bitmap=0x%08x\n", wr_bitmap);
 
-        if (!(wr_bitmap & card->mp_data_port_mask))
+        if (card->supports_sdio_new_mode &&
+            !(wr_bitmap & reg->data_port_mask)) {
+                adapter->data_sent = true;
+                return -EBUSY;
+        } else if (!card->supports_sdio_new_mode &&
+                   !(wr_bitmap & card->mp_data_port_mask)) {
                 return -1;
+        }
 
         if (card->mp_wr_bitmap & (1 << card->curr_wr_port)) {
-                card->mp_wr_bitmap &= (u16) (~(1 << card->curr_wr_port));
+                card->mp_wr_bitmap &= (u32) (~(1 << card->curr_wr_port));
                 *port = card->curr_wr_port;
-                if (++card->curr_wr_port == card->mp_end_port)
-                        card->curr_wr_port = 1;
+                if (((card->supports_sdio_new_mode) &&
+                     (++card->curr_wr_port == card->max_ports)) ||
+                    ((!card->supports_sdio_new_mode) &&
+                     (++card->curr_wr_port == card->mp_end_port)))
+                        card->curr_wr_port = reg->start_wr_port;
         } else {
                 adapter->data_sent = true;
                 return -EBUSY;
         }
 
-        if (*port == CTRL_PORT) {
-                dev_err(adapter->dev, "invalid data port=%d cur port=%d"
-                        " mp_wr_bitmap=0x%04x -> 0x%04x\n",
+        if ((card->has_control_mask) && (*port == CTRL_PORT)) {
+                dev_err(adapter->dev,
+                        "invalid data port=%d cur port=%d mp_wr_bitmap=0x%08x -> 0x%08x\n",
                         *port, card->curr_wr_port, wr_bitmap,
                         card->mp_wr_bitmap);
                 return -1;
         }
 
-        dev_dbg(adapter->dev, "data: port=%d mp_wr_bitmap=0x%04x -> 0x%04x\n",
+        dev_dbg(adapter->dev, "data: port=%d mp_wr_bitmap=0x%08x -> 0x%08x\n",
                 *port, wr_bitmap, card->mp_wr_bitmap);
 
         return 0;
@@ -564,11 +640,12 @@ static int mwifiex_get_wr_port_data(struct mwifiex_adapter *adapter, u8 *port)
 static int
 mwifiex_sdio_poll_card_status(struct mwifiex_adapter *adapter, u8 bits)
 {
+        struct sdio_mmc_card *card = adapter->card;
         u32 tries;
-        u32 cs;
+        u8 cs;
 
         for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-                if (mwifiex_read_reg(adapter, CARD_STATUS_REG, &cs))
+                if (mwifiex_read_reg(adapter, card->reg->poll_reg, &cs))
                         break;
                 else if ((cs & bits) == bits)
                         return 0;
@@ -587,12 +664,14 @@ mwifiex_sdio_poll_card_status(struct mwifiex_adapter *adapter, u8 bits)
 static int
 mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
 {
-        u32 fws0, fws1;
+        struct sdio_mmc_card *card = adapter->card;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
+        u8 fws0, fws1;
 
-        if (mwifiex_read_reg(adapter, CARD_FW_STATUS0_REG, &fws0))
+        if (mwifiex_read_reg(adapter, reg->status_reg_0, &fws0))
                 return -1;
 
-        if (mwifiex_read_reg(adapter, CARD_FW_STATUS1_REG, &fws1))
+        if (mwifiex_read_reg(adapter, reg->status_reg_1, &fws1))
                 return -1;
 
         *dat = (u16) ((fws1 << 8) | fws0);
@@ -608,14 +687,14 @@ mwifiex_sdio_read_fw_status(struct mwifiex_adapter *adapter, u16 *dat)
  */
 static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
 {
-        u32 host_int_mask;
+        u8 host_int_mask, host_int_disable = HOST_INT_DISABLE;
 
         /* Read back the host_int_mask register */
         if (mwifiex_read_reg(adapter, HOST_INT_MASK_REG, &host_int_mask))
                 return -1;
 
         /* Update with the mask and write back to the register */
-        host_int_mask &= ~HOST_INT_DISABLE;
+        host_int_mask &= ~host_int_disable;
 
         if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, host_int_mask)) {
                 dev_err(adapter->dev, "disable host interrupt failed\n");
@@ -633,8 +712,11 @@ static int mwifiex_sdio_disable_host_int(struct mwifiex_adapter *adapter)
  */
 static int mwifiex_sdio_enable_host_int(struct mwifiex_adapter *adapter)
 {
+        struct sdio_mmc_card *card = adapter->card;
+
         /* Simply write the mask to the register */
-        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG, HOST_INT_ENABLE)) {
+        if (mwifiex_write_reg(adapter, HOST_INT_MASK_REG,
+                              card->reg->host_int_enable)) {
                 dev_err(adapter->dev, "enable host interrupt failed\n");
                 return -1;
         }
@@ -686,11 +768,13 @@ static int mwifiex_sdio_card_to_host(struct mwifiex_adapter *adapter,
 static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                     struct mwifiex_fw_image *fw)
 {
+        struct sdio_mmc_card *card = adapter->card;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
         int ret;
         u8 *firmware = fw->fw_buf;
         u32 firmware_len = fw->fw_len;
         u32 offset = 0;
-        u32 base0, base1;
+        u8 base0, base1;
         u8 *fwbuf;
         u16 len = 0;
         u32 txlen, tx_blocks = 0, tries;
@@ -727,7 +811,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                         break;
 
                 for (tries = 0; tries < MAX_POLL_TRIES; tries++) {
-                        ret = mwifiex_read_reg(adapter, HOST_F1_RD_BASE_0,
+                        ret = mwifiex_read_reg(adapter, reg->base_0_reg,
                                                &base0);
                         if (ret) {
                                 dev_err(adapter->dev,
@@ -736,7 +820,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                         base0, base0);
                                 goto done;
                         }
-                        ret = mwifiex_read_reg(adapter, HOST_F1_RD_BASE_1,
+                        ret = mwifiex_read_reg(adapter, reg->base_1_reg,
                                                &base1);
                         if (ret) {
                                 dev_err(adapter->dev,
@@ -828,10 +912,11 @@ done:
 static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter,
                                    u32 poll_num)
 {
+        struct sdio_mmc_card *card = adapter->card;
         int ret = 0;
         u16 firmware_stat;
         u32 tries;
-        u32 winner_status;
+        u8 winner_status;
 
         /* Wait for firmware initialization event */
         for (tries = 0; tries < poll_num; tries++) {
@@ -849,7 +934,7 @@ static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter,
 
         if (ret) {
                 if (mwifiex_read_reg
-                    (adapter, CARD_FW_STATUS0_REG, &winner_status))
+                    (adapter, card->reg->status_reg_0, &winner_status))
                         winner_status = 0;
 
                 if (winner_status)
@@ -866,12 +951,12 @@ static int mwifiex_check_fw_status(struct mwifiex_adapter *adapter,
 static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
-        u32 sdio_ireg;
+        u8 sdio_ireg;
         unsigned long flags;
 
-        if (mwifiex_read_data_sync(adapter, card->mp_regs, MAX_MP_REGS,
-                                   REG_PORT | MWIFIEX_SDIO_BYTE_MODE_MASK,
-                                   0)) {
+        if (mwifiex_read_data_sync(adapter, card->mp_regs,
+                                   card->reg->max_mp_regs,
+                                   REG_PORT | MWIFIEX_SDIO_BYTE_MODE_MASK, 0)) {
                 dev_err(adapter->dev, "read mp_regs failed\n");
                 return;
         }
@@ -880,6 +965,9 @@ static void mwifiex_interrupt_status(struct mwifiex_adapter *adapter)
         if (sdio_ireg) {
                 /*
                  * DN_LD_HOST_INT_STATUS and/or UP_LD_HOST_INT_STATUS
+                 * For SDIO new mode CMD port interrupts
+                 *      DN_LD_CMD_PORT_HOST_INT_STATUS and/or
+                 *      UP_LD_CMD_PORT_HOST_INT_STATUS
                  * Clear the interrupt status register
                  */
                 dev_dbg(adapter->dev, "int: sdio_ireg = %#x\n", sdio_ireg);
@@ -1003,11 +1091,11 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
         s32 f_aggr_cur = 0;
         struct sk_buff *skb_deaggr;
         u32 pind;
-        u32 pkt_len, pkt_type = 0;
+        u32 pkt_len, pkt_type, mport;
         u8 *curr_ptr;
         u32 rx_len = skb->len;
 
-        if (port == CTRL_PORT) {
+        if ((card->has_control_mask) && (port == CTRL_PORT)) {
                 /* Read the command Resp without aggr */
                 dev_dbg(adapter->dev, "info: %s: no aggregation for cmd "
                         "response\n", __func__);
@@ -1024,7 +1112,10 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
                 goto rx_curr_single;
         }
 
-        if (card->mp_rd_bitmap & (~((u16) CTRL_PORT_MASK))) {
+        if ((!card->has_control_mask && (card->mp_rd_bitmap &
+                                         card->reg->data_port_mask)) ||
+            (card->has_control_mask && (card->mp_rd_bitmap &
+                                        (~((u32) CTRL_PORT_MASK))))) {
                 /* Some more data RX pending */
                 dev_dbg(adapter->dev, "info: %s: not last packet\n", __func__);
 
@@ -1060,10 +1151,10 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
         if (f_aggr_cur) {
                 dev_dbg(adapter->dev, "info: current packet aggregation\n");
                 /* Curr pkt can be aggregated */
-                MP_RX_AGGR_SETUP(card, skb, port);
+                mp_rx_aggr_setup(card, skb, port);
 
                 if (MP_RX_AGGR_PKT_LIMIT_REACHED(card) ||
-                    MP_RX_AGGR_PORT_LIMIT_REACHED(card)) {
+                    mp_rx_aggr_port_limit_reached(card)) {
                         dev_dbg(adapter->dev, "info: %s: aggregated packet "
                                 "limit reached\n", __func__);
                         /* No more pkts allowed in Aggr buf, rx it */
@@ -1076,11 +1167,28 @@ static int mwifiex_sdio_card_to_host_mp_aggr(struct mwifiex_adapter *adapter,
                 dev_dbg(adapter->dev, "info: do_rx_aggr: num of packets: %d\n",
                         card->mpa_rx.pkt_cnt);
 
+                if (card->supports_sdio_new_mode) {
+                        int i;
+                        u32 port_count;
+
+                        for (i = 0, port_count = 0; i < card->max_ports; i++)
+                                if (card->mpa_rx.ports & BIT(i))
+                                        port_count++;
+
+                        /* Reading data from "start_port + 0" to "start_port +
+                         * port_count -1", so decrease the count by 1
+                         */
+                        port_count--;
+                        mport = (adapter->ioport | SDIO_MPA_ADDR_BASE |
+                                 (port_count << 8)) + card->mpa_rx.start_port;
+                } else {
+                        mport = (adapter->ioport | SDIO_MPA_ADDR_BASE |
+                                 (card->mpa_rx.ports << 4)) +
+                                 card->mpa_rx.start_port;
+                }
+
                 if (mwifiex_read_data_sync(adapter, card->mpa_rx.buf,
-                                           card->mpa_rx.buf_len,
-                                           (adapter->ioport | 0x1000 |
-                                            (card->mpa_rx.ports << 4)) +
-                                           card->mpa_rx.start_port, 1))
+                                           card->mpa_rx.buf_len, mport, 1))
                         goto error;
 
                 curr_ptr = card->mpa_rx.buf;
@@ -1167,6 +1275,7 @@ error:
 static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
         int ret = 0;
         u8 sdio_ireg;
         struct sk_buff *skb;
@@ -1175,6 +1284,8 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
         u32 rx_blocks;
         u16 rx_len;
         unsigned long flags;
+        u32 bitmap;
+        u8 cr;
 
         spin_lock_irqsave(&adapter->int_lock, flags);
         sdio_ireg = adapter->int_status;
@@ -1184,10 +1295,60 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
         if (!sdio_ireg)
                 return ret;
 
+        /* Following interrupt is only for SDIO new mode */
+        if (sdio_ireg & DN_LD_CMD_PORT_HOST_INT_STATUS && adapter->cmd_sent)
+                adapter->cmd_sent = false;
+
+        /* Following interrupt is only for SDIO new mode */
+        if (sdio_ireg & UP_LD_CMD_PORT_HOST_INT_STATUS) {
+                u32 pkt_type;
+
+                /* read the len of control packet */
+                rx_len = card->mp_regs[CMD_RD_LEN_1] << 8;
+                rx_len |= (u16) card->mp_regs[CMD_RD_LEN_0];
+                rx_blocks = DIV_ROUND_UP(rx_len, MWIFIEX_SDIO_BLOCK_SIZE);
+                if (rx_len <= INTF_HEADER_LEN ||
+                    (rx_blocks * MWIFIEX_SDIO_BLOCK_SIZE) >
+                     MWIFIEX_RX_DATA_BUF_SIZE)
+                        return -1;
+                rx_len = (u16) (rx_blocks * MWIFIEX_SDIO_BLOCK_SIZE);
+
+                skb = dev_alloc_skb(rx_len);
+                if (!skb)
+                        return -1;
+
+                skb_put(skb, rx_len);
+
+                if (mwifiex_sdio_card_to_host(adapter, &pkt_type, skb->data,
+                                              skb->len, adapter->ioport |
+                                                        CMD_PORT_SLCT)) {
+                        dev_err(adapter->dev,
+                                "%s: failed to card_to_host", __func__);
+                        dev_kfree_skb_any(skb);
+                        goto term_cmd;
+                }
+
+                if ((pkt_type != MWIFIEX_TYPE_CMD) &&
+                    (pkt_type != MWIFIEX_TYPE_EVENT))
+                        dev_err(adapter->dev,
+                                "%s:Received wrong packet on cmd port",
+                                __func__);
+
+                mwifiex_decode_rx_packet(adapter, skb, pkt_type);
+        }
+
         if (sdio_ireg & DN_LD_HOST_INT_STATUS) {
-                card->mp_wr_bitmap = ((u16) card->mp_regs[WR_BITMAP_U]) << 8;
-                card->mp_wr_bitmap |= (u16) card->mp_regs[WR_BITMAP_L];
-                dev_dbg(adapter->dev, "int: DNLD: wr_bitmap=0x%04x\n",
+                bitmap = (u32) card->mp_regs[reg->wr_bitmap_l];
+                bitmap |= ((u32) card->mp_regs[reg->wr_bitmap_u]) << 8;
+                if (card->supports_sdio_new_mode) {
+                        bitmap |=
+                                ((u32) card->mp_regs[reg->wr_bitmap_1l]) << 16;
+                        bitmap |=
+                                ((u32) card->mp_regs[reg->wr_bitmap_1u]) << 24;
+                }
+                card->mp_wr_bitmap = bitmap;
+
+                dev_dbg(adapter->dev, "int: DNLD: wr_bitmap=0x%x\n",
                         card->mp_wr_bitmap);
                 if (adapter->data_sent &&
                     (card->mp_wr_bitmap & card->mp_data_port_mask)) {
@@ -1200,11 +1361,11 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
         /* As firmware will not generate download ready interrupt if the port
            updated is command port only, cmd_sent should be done for any SDIO
            interrupt. */
-        if (adapter->cmd_sent) {
+        if (card->has_control_mask && adapter->cmd_sent) {
                 /* Check if firmware has attach buffer at command port and
                    update just that in wr_bit_map. */
                 card->mp_wr_bitmap |=
-                        (u16) card->mp_regs[WR_BITMAP_L] & CTRL_PORT_MASK;
+                        (u32) card->mp_regs[reg->wr_bitmap_l] & CTRL_PORT_MASK;
                 if (card->mp_wr_bitmap & CTRL_PORT_MASK)
                         adapter->cmd_sent = false;
         }
@@ -1212,9 +1373,16 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
         dev_dbg(adapter->dev, "info: cmd_sent=%d data_sent=%d\n",
                 adapter->cmd_sent, adapter->data_sent);
         if (sdio_ireg & UP_LD_HOST_INT_STATUS) {
-                card->mp_rd_bitmap = ((u16) card->mp_regs[RD_BITMAP_U]) << 8;
-                card->mp_rd_bitmap |= (u16) card->mp_regs[RD_BITMAP_L];
-                dev_dbg(adapter->dev, "int: UPLD: rd_bitmap=0x%04x\n",
+                bitmap = (u32) card->mp_regs[reg->rd_bitmap_l];
+                bitmap |= ((u32) card->mp_regs[reg->rd_bitmap_u]) << 8;
+                if (card->supports_sdio_new_mode) {
+                        bitmap |=
+                                ((u32) card->mp_regs[reg->rd_bitmap_1l]) << 16;
+                        bitmap |=
+                                ((u32) card->mp_regs[reg->rd_bitmap_1u]) << 24;
+                }
+                card->mp_rd_bitmap = bitmap;
+                dev_dbg(adapter->dev, "int: UPLD: rd_bitmap=0x%x\n",
                         card->mp_rd_bitmap);
 
                 while (true) {
@@ -1224,8 +1392,8 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
                                         "info: no more rd_port available\n");
                                 break;
                         }
-                        len_reg_l = RD_LEN_P0_L + (port << 1);
-                        len_reg_u = RD_LEN_P0_U + (port << 1);
+                        len_reg_l = reg->rd_len_p0_l + (port << 1);
+                        len_reg_u = reg->rd_len_p0_u + (port << 1);
                         rx_len = ((u16) card->mp_regs[len_reg_u]) << 8;
                         rx_len |= (u16) card->mp_regs[len_reg_l];
                         dev_dbg(adapter->dev, "info: RX: port=%d rx_len=%u\n",
@@ -1257,37 +1425,33 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
 
                         if (mwifiex_sdio_card_to_host_mp_aggr(adapter, skb,
                                                               port)) {
-                                u32 cr = 0;
-
                                 dev_err(adapter->dev, "card_to_host_mpa failed:"
                                         " int status=%#x\n", sdio_ireg);
-                                if (mwifiex_read_reg(adapter,
-                                                     CONFIGURATION_REG, &cr))
-                                        dev_err(adapter->dev,
-                                                "read CFG reg failed\n");
-
-                                dev_dbg(adapter->dev,
-                                        "info: CFG reg val = %d\n", cr);
-                                if (mwifiex_write_reg(adapter,
-                                                      CONFIGURATION_REG,
-                                                      (cr | 0x04)))
-                                        dev_err(adapter->dev,
-                                                "write CFG reg failed\n");
-
-                                dev_dbg(adapter->dev, "info: write success\n");
-                                if (mwifiex_read_reg(adapter,
-                                                     CONFIGURATION_REG, &cr))
-                                        dev_err(adapter->dev,
-                                                "read CFG reg failed\n");
-
-                                dev_dbg(adapter->dev,
-                                        "info: CFG reg val =%x\n", cr);
-                                return -1;
+                                goto term_cmd;
                         }
                 }
         }
 
         return 0;
+
+term_cmd:
+        /* terminate cmd */
+        if (mwifiex_read_reg(adapter, CONFIGURATION_REG, &cr))
+                dev_err(adapter->dev, "read CFG reg failed\n");
+        else
+                dev_dbg(adapter->dev, "info: CFG reg val = %d\n", cr);
+
+        if (mwifiex_write_reg(adapter, CONFIGURATION_REG, (cr | 0x04)))
+                dev_err(adapter->dev, "write CFG reg failed\n");
+        else
+                dev_dbg(adapter->dev, "info: write success\n");
+
+        if (mwifiex_read_reg(adapter, CONFIGURATION_REG, &cr))
+                dev_err(adapter->dev, "read CFG reg failed\n");
+        else
+                dev_dbg(adapter->dev, "info: CFG reg val =%x\n", cr);
+
+        return -1;
 }
 
 /*
@@ -1305,7 +1469,7 @@ static int mwifiex_process_int_status(struct mwifiex_adapter *adapter)
  * and return.
  */
 static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
-                                        u8 *payload, u32 pkt_len, u8 port,
+                                        u8 *payload, u32 pkt_len, u32 port,
                                         u32 next_pkt_len)
 {
         struct sdio_mmc_card *card = adapter->card;
@@ -1314,8 +1478,11 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
         s32 f_send_cur_buf = 0;
         s32 f_precopy_cur_buf = 0;
         s32 f_postcopy_cur_buf = 0;
+        u32 mport;
 
-        if ((!card->mpa_tx.enabled) || (port == CTRL_PORT)) {
+        if (!card->mpa_tx.enabled ||
+            (card->has_control_mask && (port == CTRL_PORT)) ||
+            (card->supports_sdio_new_mode && (port == CMD_PORT_SLCT))) {
                 dev_dbg(adapter->dev, "info: %s: tx aggregation disabled\n",
                         __func__);
 
@@ -1329,7 +1496,7 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
                         __func__);
 
                 if (MP_TX_AGGR_IN_PROGRESS(card)) {
-                        if (!MP_TX_AGGR_PORT_LIMIT_REACHED(card) &&
+                        if (!mp_tx_aggr_port_limit_reached(card) &&
                             MP_TX_AGGR_BUF_HAS_ROOM(card, pkt_len)) {
                                 f_precopy_cur_buf = 1;
 
@@ -1342,7 +1509,7 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
                                 /* No room in Aggr buf, send it */
                                 f_send_aggr_buf = 1;
 
-                                if (MP_TX_AGGR_PORT_LIMIT_REACHED(card) ||
+                                if (mp_tx_aggr_port_limit_reached(card) ||
                                     !(card->mp_wr_bitmap &
                                       (1 << card->curr_wr_port)))
                                         f_send_cur_buf = 1;
@@ -1381,7 +1548,7 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
                 MP_TX_AGGR_BUF_PUT(card, payload, pkt_len, port);
 
                 if (MP_TX_AGGR_PKT_LIMIT_REACHED(card) ||
-                    MP_TX_AGGR_PORT_LIMIT_REACHED(card))
+                    mp_tx_aggr_port_limit_reached(card))
                         /* No more pkts allowed in Aggr buf, send it */
                         f_send_aggr_buf = 1;
         }
@@ -1390,11 +1557,28 @@ static int mwifiex_host_to_card_mp_aggr(struct mwifiex_adapter *adapter,
                 dev_dbg(adapter->dev, "data: %s: send aggr buffer: %d %d\n",
                         __func__,
                                 card->mpa_tx.start_port, card->mpa_tx.ports);
+                if (card->supports_sdio_new_mode) {
+                        u32 port_count;
+                        int i;
+
+                        for (i = 0, port_count = 0; i < card->max_ports; i++)
+                                if (card->mpa_tx.ports & BIT(i))
+                                        port_count++;
+
+                        /* Writing data from "start_port + 0" to "start_port +
+                         * port_count -1", so decrease the count by 1
+                         */
+                        port_count--;
+                        mport = (adapter->ioport | SDIO_MPA_ADDR_BASE |
+                                 (port_count << 8)) + card->mpa_tx.start_port;
+                } else {
+                        mport = (adapter->ioport | SDIO_MPA_ADDR_BASE |
+                                 (card->mpa_tx.ports << 4)) +
+                                 card->mpa_tx.start_port;
+                }
+
                 ret = mwifiex_write_data_to_card(adapter, card->mpa_tx.buf,
-                                                 card->mpa_tx.buf_len,
-                                                 (adapter->ioport | 0x1000 |
-                                                 (card->mpa_tx.ports << 4)) +
-                                                  card->mpa_tx.start_port);
+                                                 card->mpa_tx.buf_len, mport);
 
                 MP_TX_AGGR_BUF_RESET(card);
         }
@@ -1434,7 +1618,7 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
         int ret;
         u32 buf_block_len;
         u32 blk_size;
-        u8 port = CTRL_PORT;
+        u32 port = CTRL_PORT;
         u8 *payload = (u8 *)skb->data;
         u32 pkt_len = skb->len;
 
@@ -1465,6 +1649,9 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
                     pkt_len > MWIFIEX_UPLD_SIZE)
                         dev_err(adapter->dev, "%s: payload=%p, nb=%d\n",
                                 __func__, payload, pkt_len);
+
+                if (card->supports_sdio_new_mode)
+                        port = CMD_PORT_SLCT;
         }
 
         /* Transfer data to card */
@@ -1586,18 +1773,7 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         adapter->dev = &func->dev;
 
-        switch (func->device) {
-        case SDIO_DEVICE_ID_MARVELL_8786:
-                strcpy(adapter->fw_name, SD8786_DEFAULT_FW_NAME);
-                break;
-        case SDIO_DEVICE_ID_MARVELL_8797:
-                strcpy(adapter->fw_name, SD8797_DEFAULT_FW_NAME);
-                break;
-        case SDIO_DEVICE_ID_MARVELL_8787:
-        default:
-                strcpy(adapter->fw_name, SD8787_DEFAULT_FW_NAME);
-                break;
-        }
+        strcpy(adapter->fw_name, card->firmware);
 
         return 0;
 
@@ -1626,8 +1802,9 @@ disable_func:
 static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
         int ret;
-        u32 sdio_ireg;
+        u8 sdio_ireg;
 
         /*
          * Read the HOST_INT_STATUS_REG for ACK the first interrupt got
@@ -1645,30 +1822,35 @@ static int mwifiex_init_sdio(struct mwifiex_adapter *adapter)
         /* Initialize SDIO variables in card */
         card->mp_rd_bitmap = 0;
         card->mp_wr_bitmap = 0;
-        card->curr_rd_port = 1;
-        card->curr_wr_port = 1;
+        card->curr_rd_port = reg->start_rd_port;
+        card->curr_wr_port = reg->start_wr_port;
 
-        card->mp_data_port_mask = DATA_PORT_MASK;
+        card->mp_data_port_mask = reg->data_port_mask;
 
         card->mpa_tx.buf_len = 0;
         card->mpa_tx.pkt_cnt = 0;
         card->mpa_tx.start_port = 0;
 
         card->mpa_tx.enabled = 1;
-        card->mpa_tx.pkt_aggr_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+        card->mpa_tx.pkt_aggr_limit = card->mp_agg_pkt_limit;
 
         card->mpa_rx.buf_len = 0;
         card->mpa_rx.pkt_cnt = 0;
         card->mpa_rx.start_port = 0;
 
         card->mpa_rx.enabled = 1;
-        card->mpa_rx.pkt_aggr_limit = SDIO_MP_AGGR_DEF_PKT_LIMIT;
+        card->mpa_rx.pkt_aggr_limit = card->mp_agg_pkt_limit;
 
         /* Allocate buffers for SDIO MP-A */
-        card->mp_regs = kzalloc(MAX_MP_REGS, GFP_KERNEL);
+        card->mp_regs = kzalloc(reg->max_mp_regs, GFP_KERNEL);
         if (!card->mp_regs)
                 return -ENOMEM;
 
+        /* Allocate skb pointer buffers */
+        card->mpa_rx.skb_arr = kzalloc((sizeof(void *)) *
+                                       card->mp_agg_pkt_limit, GFP_KERNEL);
+        card->mpa_rx.len_arr = kzalloc(sizeof(*card->mpa_rx.len_arr) *
+                                       card->mp_agg_pkt_limit, GFP_KERNEL);
         ret = mwifiex_alloc_sdio_mpa_buffers(adapter,
                                              SDIO_MP_TX_AGGR_DEF_BUF_SIZE,
                                              SDIO_MP_RX_AGGR_DEF_BUF_SIZE);
@@ -1705,6 +1887,8 @@ static void mwifiex_cleanup_sdio(struct mwifiex_adapter *adapter)
         struct sdio_mmc_card *card = adapter->card;
 
         kfree(card->mp_regs);
+        kfree(card->mpa_rx.skb_arr);
+        kfree(card->mpa_rx.len_arr);
         kfree(card->mpa_tx.buf);
         kfree(card->mpa_rx.buf);
 }
@@ -1716,16 +1900,20 @@ static void
 mwifiex_update_mp_end_port(struct mwifiex_adapter *adapter, u16 port)
 {
         struct sdio_mmc_card *card = adapter->card;
+        const struct mwifiex_sdio_card_reg *reg = card->reg;
         int i;
 
         card->mp_end_port = port;
 
-        card->mp_data_port_mask = DATA_PORT_MASK;
+        card->mp_data_port_mask = reg->data_port_mask;
 
-        for (i = 1; i <= MAX_PORT - card->mp_end_port; i++)
-                card->mp_data_port_mask &= ~(1 << (MAX_PORT - i));
+        if (reg->start_wr_port) {
+                for (i = 1; i <= card->max_ports - card->mp_end_port; i++)
+                        card->mp_data_port_mask &=
+                                        ~(1 << (card->max_ports - i));
+        }
 
-        card->curr_wr_port = 1;
+        card->curr_wr_port = reg->start_wr_port;
 
         dev_dbg(adapter->dev, "cmd: mp_end_port %d, data port mask 0x%x\n",
                 port, card->mp_data_port_mask);
@@ -1831,3 +2019,4 @@ MODULE_LICENSE("GPL v2");
 MODULE_FIRMWARE(SD8786_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(SD8787_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(SD8797_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(SD8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 8cc5468654b4..6d51dfdd8251 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -32,30 +32,37 @@
 #define SD8786_DEFAULT_FW_NAME "mrvl/sd8786_uapsta.bin"
 #define SD8787_DEFAULT_FW_NAME "mrvl/sd8787_uapsta.bin"
 #define SD8797_DEFAULT_FW_NAME "mrvl/sd8797_uapsta.bin"
+#define SD8897_DEFAULT_FW_NAME "mrvl/sd8897_uapsta.bin"
 
 #define BLOCK_MODE      1
 #define BYTE_MODE       0
 
 #define REG_PORT                        0
-#define RD_BITMAP_L                     0x04
-#define RD_BITMAP_U                     0x05
-#define WR_BITMAP_L                     0x06
-#define WR_BITMAP_U                     0x07
-#define RD_LEN_P0_L                     0x08
-#define RD_LEN_P0_U                     0x09
 
 #define MWIFIEX_SDIO_IO_PORT_MASK               0xfffff
 
 #define MWIFIEX_SDIO_BYTE_MODE_MASK     0x80000000
 
+#define SDIO_MPA_ADDR_BASE              0x1000
 #define CTRL_PORT                       0
 #define CTRL_PORT_MASK                  0x0001
-#define DATA_PORT_MASK                  0xfffe
 
-#define MAX_MP_REGS                     64
-#define MAX_PORT                        16
-
-#define SDIO_MP_AGGR_DEF_PKT_LIMIT      8
+#define CMD_PORT_UPLD_INT_MASK          (0x1U<<6)
+#define CMD_PORT_DNLD_INT_MASK          (0x1U<<7)
+#define HOST_TERM_CMD53                 (0x1U << 2)
+#define REG_PORT                        0
+#define MEM_PORT                        0x10000
+#define CMD_RD_LEN_0                    0xB4
+#define CMD_RD_LEN_1                    0xB5
+#define CARD_CONFIG_2_1_REG             0xCD
+#define CMD53_NEW_MODE                  (0x1U << 0)
+#define CMD_CONFIG_0                    0xB8
+#define CMD_PORT_RD_LEN_EN              (0x1U << 2)
+#define CMD_CONFIG_1                    0xB9
+#define CMD_PORT_AUTO_EN                (0x1U << 0)
+#define CMD_PORT_SLCT                   0x8000
+#define UP_LD_CMD_PORT_HOST_INT_STATUS  (0x40U)
+#define DN_LD_CMD_PORT_HOST_INT_STATUS  (0x80U)
 
 #define SDIO_MP_TX_AGGR_DEF_BUF_SIZE        (8192)      /* 8K */
 
@@ -75,14 +82,8 @@
 
 /* Host Control Registers : Configuration */
 #define CONFIGURATION_REG               0x00
-/* Host Control Registers : Host without Command 53 finish host*/
-#define HOST_TO_CARD_EVENT       (0x1U << 3)
-/* Host Control Registers : Host without Command 53 finish host */
-#define HOST_WO_CMD53_FINISH_HOST       (0x1U << 2)
 /* Host Control Registers : Host power up */
 #define HOST_POWER_UP                   (0x1U << 1)
-/* Host Control Registers : Host power down */
-#define HOST_POWER_DOWN                 (0x1U << 0)
 
 /* Host Control Registers : Host interrupt mask */
 #define HOST_INT_MASK_REG               0x02
@@ -90,8 +91,7 @@
 #define UP_LD_HOST_INT_MASK             (0x1U)
 /* Host Control Registers : Download host interrupt mask */
 #define DN_LD_HOST_INT_MASK             (0x2U)
-/* Enable Host interrupt mask */
-#define HOST_INT_ENABLE (UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK)
+
 /* Disable Host interrupt mask */
 #define HOST_INT_DISABLE                0xff
 
@@ -104,74 +104,15 @@
 
 /* Host Control Registers : Host interrupt RSR */
 #define HOST_INT_RSR_REG                0x01
-/* Host Control Registers : Upload host interrupt RSR */
-#define UP_LD_HOST_INT_RSR              (0x1U)
-#define SDIO_INT_MASK                   0x3F
 
 /* Host Control Registers : Host interrupt status */
 #define HOST_INT_STATUS_REG             0x28
-/* Host Control Registers : Upload CRC error */
-#define UP_LD_CRC_ERR                   (0x1U << 2)
-/* Host Control Registers : Upload restart */
-#define UP_LD_RESTART                   (0x1U << 1)
-/* Host Control Registers : Download restart */
-#define DN_LD_RESTART                   (0x1U << 0)
-
-/* Card Control Registers : Card status register */
-#define CARD_STATUS_REG                 0x30
+
 /* Card Control Registers : Card I/O ready */
 #define CARD_IO_READY                   (0x1U << 3)
-/* Card Control Registers : CIS card ready */
-#define CIS_CARD_RDY                    (0x1U << 2)
-/* Card Control Registers : Upload card ready */
-#define UP_LD_CARD_RDY                  (0x1U << 1)
 /* Card Control Registers : Download card ready */
 #define DN_LD_CARD_RDY                  (0x1U << 0)
 
-/* Card Control Registers : Host interrupt mask register */
-#define HOST_INTERRUPT_MASK_REG         0x34
-/* Card Control Registers : Host power interrupt mask */
-#define HOST_POWER_INT_MASK             (0x1U << 3)
-/* Card Control Registers : Abort card interrupt mask */
-#define ABORT_CARD_INT_MASK             (0x1U << 2)
-/* Card Control Registers : Upload card interrupt mask */
-#define UP_LD_CARD_INT_MASK             (0x1U << 1)
-/* Card Control Registers : Download card interrupt mask */
-#define DN_LD_CARD_INT_MASK             (0x1U << 0)
-
-/* Card Control Registers : Card interrupt status register */
-#define CARD_INTERRUPT_STATUS_REG       0x38
-/* Card Control Registers : Power up interrupt */
-#define POWER_UP_INT                    (0x1U << 4)
-/* Card Control Registers : Power down interrupt */
-#define POWER_DOWN_INT                  (0x1U << 3)
-
-/* Card Control Registers : Card interrupt RSR register */
-#define CARD_INTERRUPT_RSR_REG          0x3c
-/* Card Control Registers : Power up RSR */
-#define POWER_UP_RSR                    (0x1U << 4)
-/* Card Control Registers : Power down RSR */
-#define POWER_DOWN_RSR                  (0x1U << 3)
-
-/* Card Control Registers : Miscellaneous Configuration Register */
-#define CARD_MISC_CFG_REG               0x6C
-
-/* Host F1 read base 0 */
-#define HOST_F1_RD_BASE_0               0x0040
-/* Host F1 read base 1 */
-#define HOST_F1_RD_BASE_1               0x0041
-/* Host F1 card ready */
-#define HOST_F1_CARD_RDY                0x0020
-
-/* Firmware status 0 register */
-#define CARD_FW_STATUS0_REG             0x60
-/* Firmware status 1 register */
-#define CARD_FW_STATUS1_REG             0x61
-/* Rx length register */
-#define CARD_RX_LEN_REG                 0x62
-/* Rx unit register */
-#define CARD_RX_UNIT_REG                0x63
-
 /* Max retry number of CMD53 write */
 #define MAX_WRITE_IOMEM_RETRY           2
 
@@ -192,7 +133,8 @@
         if (a->mpa_tx.start_port <= port)                               \
                 a->mpa_tx.ports |= (1<<(a->mpa_tx.pkt_cnt));            \
         else                                                            \
-                a->mpa_tx.ports |= (1<<(a->mpa_tx.pkt_cnt+1+(MAX_PORT - \
+                a->mpa_tx.ports |= (1<<(a->mpa_tx.pkt_cnt+1+            \
+                                                (a->max_ports - \
                                                 a->mp_end_port)));      \
         a->mpa_tx.pkt_cnt++;                                            \
 } while (0)
@@ -201,12 +143,6 @@
 #define MP_TX_AGGR_PKT_LIMIT_REACHED(a)                                 \
                         (a->mpa_tx.pkt_cnt == a->mpa_tx.pkt_aggr_limit)
 
-/* SDIO Tx aggregation port limit ? */
-#define MP_TX_AGGR_PORT_LIMIT_REACHED(a) ((a->curr_wr_port <            \
-                        a->mpa_tx.start_port) && (((MAX_PORT -          \
-                        a->mpa_tx.start_port) + a->curr_wr_port) >=     \
-                                SDIO_MP_AGGR_DEF_PKT_LIMIT))
-
 /* Reset SDIO Tx aggregation buffer parameters */
 #define MP_TX_AGGR_BUF_RESET(a) do {                                    \
         a->mpa_tx.pkt_cnt = 0;                                          \
@@ -219,12 +155,6 @@
 #define MP_RX_AGGR_PKT_LIMIT_REACHED(a)                                 \
                         (a->mpa_rx.pkt_cnt == a->mpa_rx.pkt_aggr_limit)
 
-/* SDIO Tx aggregation port limit ? */
-#define MP_RX_AGGR_PORT_LIMIT_REACHED(a) ((a->curr_rd_port <            \
-                        a->mpa_rx.start_port) && (((MAX_PORT -          \
-                        a->mpa_rx.start_port) + a->curr_rd_port) >=     \
-                        SDIO_MP_AGGR_DEF_PKT_LIMIT))
-
 /* SDIO Rx aggregation in progress ? */
 #define MP_RX_AGGR_IN_PROGRESS(a) (a->mpa_rx.pkt_cnt > 0)
 
@@ -232,20 +162,6 @@
 #define MP_RX_AGGR_BUF_HAS_ROOM(a, rx_len)                              \
                         ((a->mpa_rx.buf_len+rx_len) <= a->mpa_rx.buf_size)
 
-/* Prepare to copy current packet from card to SDIO Rx aggregation buffer */
-#define MP_RX_AGGR_SETUP(a, skb, port) do {                             \
-        a->mpa_rx.buf_len += skb->len;                                  \
-        if (!a->mpa_rx.pkt_cnt)                                         \
-                a->mpa_rx.start_port = port;                            \
-        if (a->mpa_rx.start_port <= port)                               \
-                a->mpa_rx.ports |= (1<<(a->mpa_rx.pkt_cnt));            \
-        else                                                            \
-                a->mpa_rx.ports |= (1<<(a->mpa_rx.pkt_cnt+1));          \
-        a->mpa_rx.skb_arr[a->mpa_rx.pkt_cnt] = skb;                     \
-        a->mpa_rx.len_arr[a->mpa_rx.pkt_cnt] = skb->len;                \
-        a->mpa_rx.pkt_cnt++;                                            \
-} while (0)
-
 /* Reset SDIO Rx aggregation buffer parameters */
 #define MP_RX_AGGR_BUF_RESET(a) do {                                    \
         a->mpa_rx.pkt_cnt = 0;                                          \
@@ -254,14 +170,13 @@
         a->mpa_rx.start_port = 0;                                       \
 } while (0)
 
-
 /* data structure for SDIO MPA TX */
 struct mwifiex_sdio_mpa_tx {
         /* multiport tx aggregation buffer pointer */
         u8 *buf;
         u32 buf_len;
         u32 pkt_cnt;
-        u16 ports;
+        u32 ports;
         u16 start_port;
         u8 enabled;
         u32 buf_size;
@@ -272,11 +187,11 @@ struct mwifiex_sdio_mpa_rx {
         u8 *buf;
         u32 buf_len;
         u32 pkt_cnt;
-        u16 ports;
+        u32 ports;
         u16 start_port;
 
-        struct sk_buff *skb_arr[SDIO_MP_AGGR_DEF_PKT_LIMIT];
-        u32 len_arr[SDIO_MP_AGGR_DEF_PKT_LIMIT];
+        struct sk_buff **skb_arr;
+        u32 *len_arr;
 
         u8 enabled;
         u32 buf_size;
@@ -286,15 +201,47 @@ struct mwifiex_sdio_mpa_rx {
 int mwifiex_bus_register(void);
 void mwifiex_bus_unregister(void);
 
+struct mwifiex_sdio_card_reg {
+        u8 start_rd_port;
+        u8 start_wr_port;
+        u8 base_0_reg;
+        u8 base_1_reg;
+        u8 poll_reg;
+        u8 host_int_enable;
+        u8 status_reg_0;
+        u8 status_reg_1;
+        u8 sdio_int_mask;
+        u32 data_port_mask;
+        u8 max_mp_regs;
+        u8 rd_bitmap_l;
+        u8 rd_bitmap_u;
+        u8 rd_bitmap_1l;
+        u8 rd_bitmap_1u;
+        u8 wr_bitmap_l;
+        u8 wr_bitmap_u;
+        u8 wr_bitmap_1l;
+        u8 wr_bitmap_1u;
+        u8 rd_len_p0_l;
+        u8 rd_len_p0_u;
+        u8 card_misc_cfg_reg;
+};
+
 struct sdio_mmc_card {
         struct sdio_func *func;
         struct mwifiex_adapter *adapter;
 
-        u16 mp_rd_bitmap;
-        u16 mp_wr_bitmap;
+        const char *firmware;
+        const struct mwifiex_sdio_card_reg *reg;
+        u8 max_ports;
+        u8 mp_agg_pkt_limit;
+        bool supports_sdio_new_mode;
+        bool has_control_mask;
+
+        u32 mp_rd_bitmap;
+        u32 mp_wr_bitmap;
 
         u16 mp_end_port;
-        u16 mp_data_port_mask;
+        u32 mp_data_port_mask;
 
         u8 curr_rd_port;
         u8 curr_wr_port;
@@ -305,6 +252,98 @@ struct sdio_mmc_card {
         struct mwifiex_sdio_mpa_rx mpa_rx;
 };
 
+struct mwifiex_sdio_device {
+        const char *firmware;
+        const struct mwifiex_sdio_card_reg *reg;
+        u8 max_ports;
+        u8 mp_agg_pkt_limit;
+        bool supports_sdio_new_mode;
+        bool has_control_mask;
+};
+
+static const struct mwifiex_sdio_card_reg mwifiex_reg_sd87xx = {
+        .start_rd_port = 1,
+        .start_wr_port = 1,
+        .base_0_reg = 0x0040,
+        .base_1_reg = 0x0041,
+        .poll_reg = 0x30,
+        .host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK,
+        .status_reg_0 = 0x60,
+        .status_reg_1 = 0x61,
+        .sdio_int_mask = 0x3f,
+        .data_port_mask = 0x0000fffe,
+        .max_mp_regs = 64,
+        .rd_bitmap_l = 0x04,
+        .rd_bitmap_u = 0x05,
+        .wr_bitmap_l = 0x06,
+        .wr_bitmap_u = 0x07,
+        .rd_len_p0_l = 0x08,
+        .rd_len_p0_u = 0x09,
+        .card_misc_cfg_reg = 0x6c,
+};
+
+static const struct mwifiex_sdio_card_reg mwifiex_reg_sd8897 = {
+        .start_rd_port = 0,
+        .start_wr_port = 0,
+        .base_0_reg = 0x60,
+        .base_1_reg = 0x61,
+        .poll_reg = 0x50,
+        .host_int_enable = UP_LD_HOST_INT_MASK | DN_LD_HOST_INT_MASK |
+                        CMD_PORT_UPLD_INT_MASK | CMD_PORT_DNLD_INT_MASK,
+        .status_reg_0 = 0xc0,
+        .status_reg_1 = 0xc1,
+        .sdio_int_mask = 0xff,
+        .data_port_mask = 0xffffffff,
+        .max_mp_regs = 184,
+        .rd_bitmap_l = 0x04,
+        .rd_bitmap_u = 0x05,
+        .rd_bitmap_1l = 0x06,
+        .rd_bitmap_1u = 0x07,
+        .wr_bitmap_l = 0x08,
+        .wr_bitmap_u = 0x09,
+        .wr_bitmap_1l = 0x0a,
+        .wr_bitmap_1u = 0x0b,
+        .rd_len_p0_l = 0x0c,
+        .rd_len_p0_u = 0x0d,
+        .card_misc_cfg_reg = 0xcc,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8786 = {
+        .firmware = SD8786_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd87xx,
+        .max_ports = 16,
+        .mp_agg_pkt_limit = 8,
+        .supports_sdio_new_mode = false,
+        .has_control_mask = true,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8787 = {
+        .firmware = SD8787_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd87xx,
+        .max_ports = 16,
+        .mp_agg_pkt_limit = 8,
+        .supports_sdio_new_mode = false,
+        .has_control_mask = true,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8797 = {
+        .firmware = SD8797_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd87xx,
+        .max_ports = 16,
+        .mp_agg_pkt_limit = 8,
+        .supports_sdio_new_mode = false,
+        .has_control_mask = true,
+};
+
+static const struct mwifiex_sdio_device mwifiex_sdio_sd8897 = {
+        .firmware = SD8897_DEFAULT_FW_NAME,
+        .reg = &mwifiex_reg_sd8897,
+        .max_ports = 32,
+        .mp_agg_pkt_limit = 16,
+        .supports_sdio_new_mode = true,
+        .has_control_mask = false,
+};
+
 /*
  * .cmdrsp_complete handler
  */
@@ -325,4 +364,77 @@ static inline int mwifiex_sdio_event_complete(struct mwifiex_adapter *adapter,
         return 0;
 }
 
+static inline bool
+mp_rx_aggr_port_limit_reached(struct sdio_mmc_card *card)
+{
+        u8 tmp;
+
+        if (card->curr_rd_port < card->mpa_rx.start_port) {
+                if (card->supports_sdio_new_mode)
+                        tmp = card->mp_end_port >> 1;
+                else
+                        tmp = card->mp_agg_pkt_limit;
+
+                if (((card->max_ports - card->mpa_rx.start_port) +
+                    card->curr_rd_port) >= tmp)
+                        return true;
+        }
+
+        if (!card->supports_sdio_new_mode)
+                return false;
+
+        if ((card->curr_rd_port - card->mpa_rx.start_port) >=
+            (card->mp_end_port >> 1))
+                return true;
+
+        return false;
+}
+
+static inline bool
+mp_tx_aggr_port_limit_reached(struct sdio_mmc_card *card)
+{
+        u16 tmp;
+
+        if (card->curr_wr_port < card->mpa_tx.start_port) {
+                if (card->supports_sdio_new_mode)
+                        tmp = card->mp_end_port >> 1;
+                else
+                        tmp = card->mp_agg_pkt_limit;
+
+                if (((card->max_ports - card->mpa_tx.start_port) +
+                    card->curr_wr_port) >= tmp)
+                        return true;
+        }
+
+        if (!card->supports_sdio_new_mode)
+                return false;
+
+        if ((card->curr_wr_port - card->mpa_tx.start_port) >=
+            (card->mp_end_port >> 1))
+                return true;
+
+        return false;
+}
+
+/* Prepare to copy current packet from card to SDIO Rx aggregation buffer */
+static inline void mp_rx_aggr_setup(struct sdio_mmc_card *card,
+                                    struct sk_buff *skb, u8 port)
+{
+        card->mpa_rx.buf_len += skb->len;
+
+        if (!card->mpa_rx.pkt_cnt)
+                card->mpa_rx.start_port = port;
+
+        if (card->supports_sdio_new_mode) {
+                card->mpa_rx.ports |= (1 << port);
+        } else {
+                if (card->mpa_rx.start_port <= port)
+                        card->mpa_rx.ports |= 1 << (card->mpa_rx.pkt_cnt);
+                else
+                        card->mpa_rx.ports |= 1 << (card->mpa_rx.pkt_cnt + 1);
+        }
+        card->mpa_rx.skb_arr[card->mpa_rx.pkt_cnt] = skb;
+        card->mpa_rx.len_arr[card->mpa_rx.pkt_cnt] = skb->len;
+        card->mpa_rx.pkt_cnt++;
+}
 #endif /* _MWIFIEX_SDIO_H */
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index b193e25977d2..8ece48580642 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -1134,6 +1134,55 @@ mwifiex_cmd_mef_cfg(struct mwifiex_private *priv,
         return 0;
 }
 
+/* This function parse cal data from ASCII to hex */
+static u32 mwifiex_parse_cal_cfg(u8 *src, size_t len, u8 *dst)
+{
+        u8 *s = src, *d = dst;
+
+        while (s - src < len) {
+                if (*s && (isspace(*s) || *s == '\t')) {
+                        s++;
+                        continue;
+                }
+                if (isxdigit(*s)) {
+                        *d++ = simple_strtol(s, NULL, 16);
+                        s += 2;
+                } else {
+                        s++;
+                }
+        }
+
+        return d - dst;
+}
+
+/* This function prepares command of set_cfg_data. */
+static int mwifiex_cmd_cfg_data(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *cmd,
+                                u16 cmd_action)
+{
+        struct host_cmd_ds_802_11_cfg_data *cfg_data = &cmd->params.cfg_data;
+        struct mwifiex_adapter *adapter = priv->adapter;
+        u32 len, cal_data_offset;
+        u8 *tmp_cmd = (u8 *)cmd;
+
+        cal_data_offset = S_DS_GEN + sizeof(*cfg_data);
+        if ((adapter->cal_data->data) && (adapter->cal_data->size > 0))
+                len = mwifiex_parse_cal_cfg((u8 *)adapter->cal_data->data,
+                                            adapter->cal_data->size,
+                                            (u8 *)(tmp_cmd + cal_data_offset));
+        else
+                return -1;
+
+        cfg_data->action = cpu_to_le16(cmd_action);
+        cfg_data->type = cpu_to_le16(CFG_DATA_TYPE_CAL);
+        cfg_data->data_len = cpu_to_le16(len);
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_CFG_DATA);
+        cmd->size = cpu_to_le16(S_DS_GEN + sizeof(*cfg_data) + len);
+
+        return 0;
+}
+
 /*
  * This function prepares the commands before sending them to the firmware.
  *
@@ -1152,6 +1201,9 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         case HostCmd_CMD_GET_HW_SPEC:
                 ret = mwifiex_cmd_get_hw_spec(priv, cmd_ptr);
                 break;
+        case HostCmd_CMD_CFG_DATA:
+                ret = mwifiex_cmd_cfg_data(priv, cmd_ptr, cmd_action);
+                break;
         case HostCmd_CMD_MAC_CONTROL:
                 ret = mwifiex_cmd_mac_control(priv, cmd_ptr, cmd_action,
                                               data_buf);
@@ -1384,6 +1436,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
  */
 int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
 {
+        struct mwifiex_adapter *adapter = priv->adapter;
         int ret;
         u16 enable = true;
         struct mwifiex_ds_11n_amsdu_aggr_ctrl amsdu_aggr_ctrl;
@@ -1404,6 +1457,15 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
                                             HostCmd_ACT_GEN_SET, 0, NULL);
                 if (ret)
                         return -1;
+
+                /* Download calibration data to firmware */
+                if (adapter->cal_data) {
+                        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_CFG_DATA,
+                                                HostCmd_ACT_GEN_SET, 0, NULL);
+                        if (ret)
+                                return -1;
+                }
+
                 /* Read MAC address from HW */
                 ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_GET_HW_SPEC,
                                             HostCmd_ACT_GEN_GET, 0, NULL);
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 9f990e14966e..d85df158cc6c 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -818,6 +818,18 @@ static int mwifiex_ret_subsc_evt(struct mwifiex_private *priv,
         return 0;
 }
 
+/* This function handles the command response of set_cfg_data */
+static int mwifiex_ret_cfg_data(struct mwifiex_private *priv,
+                                struct host_cmd_ds_command *resp)
+{
+        if (resp->result != HostCmd_RESULT_OK) {
+                dev_err(priv->adapter->dev, "Cal data cmd resp failed\n");
+                return -1;
+        }
+
+        return 0;
+}
+
 /*
  * This function handles the command responses.
  *
@@ -841,6 +853,9 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_GET_HW_SPEC:
                 ret = mwifiex_ret_get_hw_spec(priv, resp);
                 break;
+        case HostCmd_CMD_CFG_DATA:
+                ret = mwifiex_ret_cfg_data(priv, resp);
+                break;
         case HostCmd_CMD_MAC_CONTROL:
                 break;
         case HostCmd_CMD_802_11_MAC_ADDRESS:
@@ -978,6 +993,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_UAP_BSS_STOP:
                 priv->bss_started = 0;
                 break;
+        case HostCmd_CMD_UAP_STA_DEAUTH:
+                break;
         case HostCmd_CMD_MEF_CFG:
                 break;
         default:
diff --git a/drivers/net/wireless/mwifiex/uap_cmd.c b/drivers/net/wireless/mwifiex/uap_cmd.c
index b04b1db29100..2de882dead0f 100644
--- a/drivers/net/wireless/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/mwifiex/uap_cmd.c
@@ -689,6 +689,23 @@ mwifiex_cmd_uap_sys_config(struct host_cmd_ds_command *cmd, u16 cmd_action,
         return 0;
 }
 
+/* This function prepares AP specific deauth command with mac supplied in
+ * function parameter.
+ */
+static int mwifiex_cmd_uap_sta_deauth(struct mwifiex_private *priv,
+                                      struct host_cmd_ds_command *cmd, u8 *mac)
+{
+        struct host_cmd_ds_sta_deauth *sta_deauth = &cmd->params.sta_deauth;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_UAP_STA_DEAUTH);
+        memcpy(sta_deauth->mac, mac, ETH_ALEN);
+        sta_deauth->reason = cpu_to_le16(WLAN_REASON_DEAUTH_LEAVING);
+
+        cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_sta_deauth) +
+                                S_DS_GEN);
+        return 0;
+}
+
 /* This function prepares the AP specific commands before sending them
  * to the firmware.
  * This is a generic function which calls specific command preparation
@@ -710,6 +727,10 @@ int mwifiex_uap_prepare_cmd(struct mwifiex_private *priv, u16 cmd_no,
                 cmd->command = cpu_to_le16(cmd_no);
                 cmd->size = cpu_to_le16(S_DS_GEN);
                 break;
+        case HostCmd_CMD_UAP_STA_DEAUTH:
+                if (mwifiex_cmd_uap_sta_deauth(priv, cmd, data_buf))
+                        return -1;
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd %#x\n", cmd_no);
diff --git a/drivers/net/wireless/mwifiex/uap_event.c b/drivers/net/wireless/mwifiex/uap_event.c
index 21c640d3b579..718066577c6c 100644
--- a/drivers/net/wireless/mwifiex/uap_event.c
+++ b/drivers/net/wireless/mwifiex/uap_event.c
@@ -107,18 +107,15 @@ mwifiex_set_sta_ht_cap(struct mwifiex_private *priv, const u8 *ies,
  */
 static void mwifiex_del_sta_entry(struct mwifiex_private *priv, u8 *mac)
 {
-        struct mwifiex_sta_node *node, *tmp;
+        struct mwifiex_sta_node *node;
         unsigned long flags;
 
         spin_lock_irqsave(&priv->sta_list_spinlock, flags);
 
         node = mwifiex_get_sta_entry(priv, mac);
         if (node) {
-                list_for_each_entry_safe(node, tmp, &priv->sta_list,
-                                         list) {
-                        list_del(&node->list);
-                        kfree(node);
-                }
+                list_del(&node->list);
+                kfree(node);
         }
 
         spin_unlock_irqrestore(&priv->sta_list_spinlock, flags);
@@ -295,3 +292,19 @@ int mwifiex_process_uap_event(struct mwifiex_private *priv)
 
         return 0;
 }
+
+/* This function deletes station entry from associated station list.
+ * Also if both AP and STA are 11n enabled, RxReorder tables and TxBA stream
+ * tables created for this station are deleted.
+ */
+void mwifiex_uap_del_sta_data(struct mwifiex_private *priv,
+                              struct mwifiex_sta_node *node)
+{
+        if (priv->ap_11n_enabled && node->is_11n_enabled) {
+                mwifiex_11n_del_rx_reorder_tbl_by_ta(priv, node->mac_addr);
+                mwifiex_del_tx_ba_stream_tbl_by_ra(priv, node->mac_addr);
+        }
+        mwifiex_del_sta_entry(priv, node->mac_addr);
+
+        return;
+}
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 6820fce4016b..a3707fd4ef62 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -1548,7 +1548,7 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
         if (!priv->pending_tx_pkts)
                 return 0;
 
-        retry = 0;
+        retry = 1;
         rc = 0;
 
         spin_lock_bh(&priv->tx_lock);
@@ -1572,13 +1572,19 @@ static int mwl8k_tx_wait_empty(struct ieee80211_hw *hw)
 
                 spin_lock_bh(&priv->tx_lock);
 
-                if (timeout) {
+                if (timeout || !priv->pending_tx_pkts) {
                         WARN_ON(priv->pending_tx_pkts);
                         if (retry)
                                 wiphy_notice(hw->wiphy, "tx rings drained\n");
                         break;
                 }
 
+                if (retry) {
+                        mwl8k_tx_start(priv);
+                        retry = 0;
+                        continue;
+                }
+
                 if (priv->pending_tx_pkts < oldcount) {
                         wiphy_notice(hw->wiphy,
                                      "waiting for tx rings to drain (%d -> %d pkts)\n",
@@ -2055,6 +2061,7 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw,
                                 mwl8k_remove_stream(hw, stream);
                                 spin_unlock(&priv->stream_lock);
                         }
+                        mwl8k_tx_start(priv);
                         spin_unlock_bh(&priv->tx_lock);
                         pci_unmap_single(priv->pdev, dma, skb->len,
                                          PCI_DMA_TODEVICE);
diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c
index 978e7eb26567..7fc46f26cf2b 100644
--- a/drivers/net/wireless/p54/p54spi.c
+++ b/drivers/net/wireless/p54/p54spi.c
@@ -42,8 +42,7 @@
 
 MODULE_FIRMWARE("3826.arm");
 
-/*
- * gpios should be handled in board files and provided via platform data,
+/* gpios should be handled in board files and provided via platform data,
  * but because it's currently impossible for p54spi to have a header file
  * in include/linux, let's use module paramaters for now
  */
@@ -191,8 +190,7 @@ static int p54spi_request_eeprom(struct ieee80211_hw *dev)
         const struct firmware *eeprom;
         int ret;
 
-        /*
-         * allow users to customize their eeprom.
+        /* allow users to customize their eeprom.
          */
 
         ret = request_firmware(&eeprom, "3826.eeprom", &priv->spi->dev);
@@ -285,8 +283,7 @@ static void p54spi_power_on(struct p54s_priv *priv)
         gpio_set_value(p54spi_gpio_power, 1);
         enable_irq(gpio_to_irq(p54spi_gpio_irq));
 
-        /*
-         * need to wait a while before device can be accessed, the length
+        /* need to wait a while before device can be accessed, the length
          * is just a guess
          */
         msleep(10);
@@ -365,7 +362,8 @@ static int p54spi_rx(struct p54s_priv *priv)
         /* Firmware may insert up to 4 padding bytes after the lmac header,
          * but it does not amend the size of SPI data transfer.
          * Such packets has correct data size in header, thus referencing
-         * past the end of allocated skb. Reserve extra 4 bytes for this case */
+         * past the end of allocated skb. Reserve extra 4 bytes for this case
+         */
         skb = dev_alloc_skb(len + 4);
         if (!skb) {
                 p54spi_sleep(priv);
@@ -383,7 +381,8 @@ static int p54spi_rx(struct p54s_priv *priv)
         }
         p54spi_sleep(priv);
         /* Put additional bytes to compensate for the possible
-         * alignment-caused truncation */
+         * alignment-caused truncation
+         */
         skb_put(skb, 4);
 
         if (p54_rx(priv->hw, skb) == 0)
@@ -713,27 +712,7 @@ static struct spi_driver p54spi_driver = {
         .remove         = p54spi_remove,
 };
 
-static int __init p54spi_init(void)
-{
-        int ret;
-
-        ret = spi_register_driver(&p54spi_driver);
-        if (ret < 0) {
-                printk(KERN_ERR "failed to register SPI driver: %d", ret);
-                goto out;
-        }
-
-out:
-        return ret;
-}
-
-static void __exit p54spi_exit(void)
-{
-        spi_unregister_driver(&p54spi_driver);
-}
-
-module_init(p54spi_init);
-module_exit(p54spi_exit);
+module_spi_driver(p54spi_driver);
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Christian Lamparter <chunkeey@web.de>");
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index b52d70c75e1a..ead3a3e746a2 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -840,7 +840,7 @@ static inline void rt2800_clear_beacon_register(struct rt2x00_dev *rt2x00dev,
                                                 unsigned int beacon_base)
 {
         int i;
-        const int txwi_desc_size = rt2x00dev->ops->bcn->winfo_size;
+        const int txwi_desc_size = rt2x00dev->bcn->winfo_size;
 
         /*
          * For the Beacon base registers we only need to clear
@@ -3953,379 +3953,577 @@ static void rt2800_init_bbp_early(struct rt2x00_dev *rt2x00dev)
         rt2800_bbp_write(rt2x00dev, 106, 0x35);
 }
 
-static void rt2800_init_bbp_5592(struct rt2x00_dev *rt2x00dev)
+static void rt2800_disable_unused_dac_adc(struct rt2x00_dev *rt2x00dev)
 {
-        int ant, div_mode;
         u16 eeprom;
         u8 value;
 
-        rt2800_init_bbp_early(rt2x00dev);
+        rt2800_bbp_read(rt2x00dev, 138, &value);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF0, &eeprom);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_TXPATH) == 1)
+                value |= 0x20;
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RXPATH) == 1)
+                value &= ~0x02;
+        rt2800_bbp_write(rt2x00dev, 138, value);
+}
 
-        rt2800_bbp_read(rt2x00dev, 105, &value);
-        rt2x00_set_field8(&value, BBP105_MLD,
-                          rt2x00dev->default_ant.rx_chain_num == 2);
-        rt2800_bbp_write(rt2x00dev, 105, value);
+static void rt2800_init_bbp_305x_soc(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
+
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
+
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
+        rt2800_bbp_write(rt2x00dev, 78, 0x0e);
+        rt2800_bbp_write(rt2x00dev, 80, 0x08);
+
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x01);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+}
+
+static void rt2800_init_bbp_28xx(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+
+        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C)) {
+                rt2800_bbp_write(rt2x00dev, 69, 0x16);
+                rt2800_bbp_write(rt2x00dev, 73, 0x12);
+        } else {
+                rt2800_bbp_write(rt2x00dev, 69, 0x12);
+                rt2800_bbp_write(rt2x00dev, 73, 0x10);
+        }
+
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
+        rt2800_bbp_write(rt2x00dev, 81, 0x37);
+
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
+                rt2800_bbp_write(rt2x00dev, 84, 0x19);
+        else
+                rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 103, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+}
+
+static void rt2800_init_bbp_30xx(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
+
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
+        rt2800_bbp_write(rt2x00dev, 79, 0x13);
+        rt2800_bbp_write(rt2x00dev, 80, 0x05);
+        rt2800_bbp_write(rt2x00dev, 81, 0x33);
+
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT3070, REV_RT3070F) ||
+            rt2x00_rt_rev_gte(rt2x00dev, RT3071, REV_RT3071E) ||
+            rt2x00_rt_rev_gte(rt2x00dev, RT3090, REV_RT3090E))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+        else
+                rt2800_bbp_write(rt2x00dev, 103, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+
+        if (rt2x00_rt(rt2x00dev, RT3071) ||
+            rt2x00_rt(rt2x00dev, RT3090))
+                rt2800_disable_unused_dac_adc(rt2x00dev);
+}
+
+static void rt2800_init_bbp_3290(struct rt2x00_dev *rt2x00dev)
+{
+        u8 value;
 
         rt2800_bbp4_mac_if_ctrl(rt2x00dev);
 
-        rt2800_bbp_write(rt2x00dev, 20, 0x06);
         rt2800_bbp_write(rt2x00dev, 31, 0x08);
-        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
-        rt2800_bbp_write(rt2x00dev, 68, 0xDD);
-        rt2800_bbp_write(rt2x00dev, 69, 0x1A);
-        rt2800_bbp_write(rt2x00dev, 70, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+
+        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
+
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
         rt2800_bbp_write(rt2x00dev, 73, 0x13);
-        rt2800_bbp_write(rt2x00dev, 74, 0x0F);
-        rt2800_bbp_write(rt2x00dev, 75, 0x4F);
+        rt2800_bbp_write(rt2x00dev, 75, 0x46);
         rt2800_bbp_write(rt2x00dev, 76, 0x28);
+
+        rt2800_bbp_write(rt2x00dev, 77, 0x58);
+
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
+        rt2800_bbp_write(rt2x00dev, 74, 0x0b);
+        rt2800_bbp_write(rt2x00dev, 79, 0x18);
+        rt2800_bbp_write(rt2x00dev, 80, 0x09);
+        rt2800_bbp_write(rt2x00dev, 81, 0x33);
+
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x7a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x9a);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x38);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x02);
+
+        rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
+        rt2800_bbp_write(rt2x00dev, 104, 0x92);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x1c);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x03);
+
+        rt2800_bbp_write(rt2x00dev, 128, 0x12);
+
+        rt2800_bbp_write(rt2x00dev, 67, 0x24);
+        rt2800_bbp_write(rt2x00dev, 143, 0x04);
+        rt2800_bbp_write(rt2x00dev, 142, 0x99);
+        rt2800_bbp_write(rt2x00dev, 150, 0x30);
+        rt2800_bbp_write(rt2x00dev, 151, 0x2e);
+        rt2800_bbp_write(rt2x00dev, 152, 0x20);
+        rt2800_bbp_write(rt2x00dev, 153, 0x34);
+        rt2800_bbp_write(rt2x00dev, 154, 0x40);
+        rt2800_bbp_write(rt2x00dev, 155, 0x3b);
+        rt2800_bbp_write(rt2x00dev, 253, 0x04);
+
+        rt2800_bbp_read(rt2x00dev, 47, &value);
+        rt2x00_set_field8(&value, BBP47_TSSI_ADC6, 1);
+        rt2800_bbp_write(rt2x00dev, 47, value);
+
+        /* Use 5-bit ADC for Acquisition and 8-bit ADC for data */
+        rt2800_bbp_read(rt2x00dev, 3, &value);
+        rt2x00_set_field8(&value, BBP3_ADC_MODE_SWITCH, 1);
+        rt2x00_set_field8(&value, BBP3_ADC_INIT_MODE, 1);
+        rt2800_bbp_write(rt2x00dev, 3, value);
+}
+
+static void rt2800_init_bbp_3352(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 3, 0x00);
+        rt2800_bbp_write(rt2x00dev, 4, 0x50);
+
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
+
+        rt2800_bbp_write(rt2x00dev, 47, 0x48);
+
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+
+        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
+
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x13);
+        rt2800_bbp_write(rt2x00dev, 75, 0x46);
+        rt2800_bbp_write(rt2x00dev, 76, 0x28);
+
         rt2800_bbp_write(rt2x00dev, 77, 0x59);
-        rt2800_bbp_write(rt2x00dev, 84, 0x9A);
+
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+
+        rt2800_bbp_write(rt2x00dev, 78, 0x0e);
+        rt2800_bbp_write(rt2x00dev, 80, 0x08);
+        rt2800_bbp_write(rt2x00dev, 81, 0x37);
+
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
         rt2800_bbp_write(rt2x00dev, 86, 0x38);
+
         rt2800_bbp_write(rt2x00dev, 88, 0x90);
+
         rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
         rt2800_bbp_write(rt2x00dev, 92, 0x02);
-        rt2800_bbp_write(rt2x00dev, 95, 0x9a);
-        rt2800_bbp_write(rt2x00dev, 98, 0x12);
-        rt2800_bbp_write(rt2x00dev, 103, 0xC0);
+
+        rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
         rt2800_bbp_write(rt2x00dev, 104, 0x92);
-        /* FIXME BBP105 owerwrite */
-        rt2800_bbp_write(rt2x00dev, 105, 0x3C);
-        rt2800_bbp_write(rt2x00dev, 106, 0x35);
-        rt2800_bbp_write(rt2x00dev, 128, 0x12);
-        rt2800_bbp_write(rt2x00dev, 134, 0xD0);
-        rt2800_bbp_write(rt2x00dev, 135, 0xF6);
-        rt2800_bbp_write(rt2x00dev, 137, 0x0F);
 
-        /* Initialize GLRT (Generalized Likehood Radio Test) */
-        rt2800_init_bbp_5592_glrt(rt2x00dev);
+        rt2800_bbp_write(rt2x00dev, 105, 0x34);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 120, 0x50);
+
+        rt2800_bbp_write(rt2x00dev, 137, 0x0f);
+
+        rt2800_bbp_write(rt2x00dev, 163, 0xbd);
+        /* Set ITxBF timeout to 0x9c40=1000msec */
+        rt2800_bbp_write(rt2x00dev, 179, 0x02);
+        rt2800_bbp_write(rt2x00dev, 180, 0x00);
+        rt2800_bbp_write(rt2x00dev, 182, 0x40);
+        rt2800_bbp_write(rt2x00dev, 180, 0x01);
+        rt2800_bbp_write(rt2x00dev, 182, 0x9c);
+        rt2800_bbp_write(rt2x00dev, 179, 0x00);
+        /* Reprogram the inband interface to put right values in RXWI */
+        rt2800_bbp_write(rt2x00dev, 142, 0x04);
+        rt2800_bbp_write(rt2x00dev, 143, 0x3b);
+        rt2800_bbp_write(rt2x00dev, 142, 0x06);
+        rt2800_bbp_write(rt2x00dev, 143, 0xa0);
+        rt2800_bbp_write(rt2x00dev, 142, 0x07);
+        rt2800_bbp_write(rt2x00dev, 143, 0xa1);
+        rt2800_bbp_write(rt2x00dev, 142, 0x08);
+        rt2800_bbp_write(rt2x00dev, 143, 0xa2);
+
+        rt2800_bbp_write(rt2x00dev, 148, 0xc8);
+}
 
-        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+static void rt2800_init_bbp_3390(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
 
-        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
-        div_mode = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_ANT_DIVERSITY);
-        ant = (div_mode == 3) ? 1 : 0;
-        rt2800_bbp_read(rt2x00dev, 152, &value);
-        if (ant == 0) {
-                /* Main antenna */
-                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
-        } else {
-                /* Auxiliary antenna */
-                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
-        }
-        rt2800_bbp_write(rt2x00dev, 152, value);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
 
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C)) {
-                rt2800_bbp_read(rt2x00dev, 254, &value);
-                rt2x00_set_field8(&value, BBP254_BIT7, 1);
-                rt2800_bbp_write(rt2x00dev, 254, value);
-        }
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
 
-        rt2800_init_freq_calibration(rt2x00dev);
+        rt2800_bbp_write(rt2x00dev, 79, 0x13);
+        rt2800_bbp_write(rt2x00dev, 80, 0x05);
+        rt2800_bbp_write(rt2x00dev, 81, 0x33);
 
-        rt2800_bbp_write(rt2x00dev, 84, 0x19);
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT3390, REV_RT3390E))
                 rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+        else
+                rt2800_bbp_write(rt2x00dev, 103, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+
+        rt2800_disable_unused_dac_adc(rt2x00dev);
 }
 
-static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+static void rt2800_init_bbp_3572(struct rt2x00_dev *rt2x00dev)
 {
-        unsigned int i;
-        u16 eeprom;
-        u8 reg_id;
-        u8 value;
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
 
-        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
-                     rt2800_wait_bbp_ready(rt2x00dev)))
-                return -EACCES;
+        rt2800_bbp_write(rt2x00dev, 65, 0x2c);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
 
-        if (rt2x00_rt(rt2x00dev, RT5592)) {
-                rt2800_init_bbp_5592(rt2x00dev);
-                return 0;
-        }
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
 
-        if (rt2x00_rt(rt2x00dev, RT3352)) {
-                rt2800_bbp_write(rt2x00dev, 3, 0x00);
-                rt2800_bbp_write(rt2x00dev, 4, 0x50);
-        }
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+        rt2800_bbp_write(rt2x00dev, 79, 0x13);
+        rt2800_bbp_write(rt2x00dev, 80, 0x05);
+        rt2800_bbp_write(rt2x00dev, 81, 0x33);
 
-        if (rt2800_is_305x_soc(rt2x00dev) ||
-            rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT3572) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 31, 0x08);
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
 
-        if (rt2x00_rt(rt2x00dev, RT3352))
-                rt2800_bbp_write(rt2x00dev, 47, 0x48);
+        rt2800_bbp_write(rt2x00dev, 83, 0x6a);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+
+        rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+
+        rt2800_disable_unused_dac_adc(rt2x00dev);
+}
+
+static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
+{
+        int ant, div_mode;
+        u16 eeprom;
+        u8 value;
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
 
         rt2800_bbp_write(rt2x00dev, 65, 0x2c);
         rt2800_bbp_write(rt2x00dev, 66, 0x38);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 68, 0x0b);
+        rt2800_bbp_write(rt2x00dev, 68, 0x0b);
 
-        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C)) {
-                rt2800_bbp_write(rt2x00dev, 69, 0x16);
-                rt2800_bbp_write(rt2x00dev, 73, 0x12);
-        } else if (rt2x00_rt(rt2x00dev, RT3290) ||
-                   rt2x00_rt(rt2x00dev, RT3352) ||
-                   rt2x00_rt(rt2x00dev, RT5390) ||
-                   rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_bbp_write(rt2x00dev, 69, 0x12);
-                rt2800_bbp_write(rt2x00dev, 73, 0x13);
-                rt2800_bbp_write(rt2x00dev, 75, 0x46);
-                rt2800_bbp_write(rt2x00dev, 76, 0x28);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 73, 0x13);
+        rt2800_bbp_write(rt2x00dev, 75, 0x46);
+        rt2800_bbp_write(rt2x00dev, 76, 0x28);
 
-                if (rt2x00_rt(rt2x00dev, RT3290))
-                        rt2800_bbp_write(rt2x00dev, 77, 0x58);
-                else
-                        rt2800_bbp_write(rt2x00dev, 77, 0x59);
-        } else {
-                rt2800_bbp_write(rt2x00dev, 69, 0x12);
-                rt2800_bbp_write(rt2x00dev, 73, 0x10);
-        }
+        rt2800_bbp_write(rt2x00dev, 77, 0x59);
 
         rt2800_bbp_write(rt2x00dev, 70, 0x0a);
 
-        if (rt2x00_rt(rt2x00dev, RT3070) ||
-            rt2x00_rt(rt2x00dev, RT3071) ||
-            rt2x00_rt(rt2x00dev, RT3090) ||
-            rt2x00_rt(rt2x00dev, RT3390) ||
-            rt2x00_rt(rt2x00dev, RT3572) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_bbp_write(rt2x00dev, 79, 0x13);
-                rt2800_bbp_write(rt2x00dev, 80, 0x05);
-                rt2800_bbp_write(rt2x00dev, 81, 0x33);
-        } else if (rt2800_is_305x_soc(rt2x00dev)) {
-                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
-                rt2800_bbp_write(rt2x00dev, 80, 0x08);
-        } else if (rt2x00_rt(rt2x00dev, RT3290)) {
-                rt2800_bbp_write(rt2x00dev, 74, 0x0b);
-                rt2800_bbp_write(rt2x00dev, 79, 0x18);
-                rt2800_bbp_write(rt2x00dev, 80, 0x09);
-                rt2800_bbp_write(rt2x00dev, 81, 0x33);
-        } else if (rt2x00_rt(rt2x00dev, RT3352)) {
-                rt2800_bbp_write(rt2x00dev, 78, 0x0e);
-                rt2800_bbp_write(rt2x00dev, 80, 0x08);
-                rt2800_bbp_write(rt2x00dev, 81, 0x37);
-        } else {
-                rt2800_bbp_write(rt2x00dev, 81, 0x37);
-        }
+        rt2800_bbp_write(rt2x00dev, 79, 0x13);
+        rt2800_bbp_write(rt2x00dev, 80, 0x05);
+        rt2800_bbp_write(rt2x00dev, 81, 0x33);
 
         rt2800_bbp_write(rt2x00dev, 82, 0x62);
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 83, 0x7a);
-        else
-                rt2800_bbp_write(rt2x00dev, 83, 0x6a);
 
-        if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860D))
-                rt2800_bbp_write(rt2x00dev, 84, 0x19);
-        else if (rt2x00_rt(rt2x00dev, RT3290) ||
-                 rt2x00_rt(rt2x00dev, RT5390) ||
-                 rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 84, 0x9a);
-        else
-                rt2800_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800_bbp_write(rt2x00dev, 83, 0x7a);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 86, 0x38);
-        else
-                rt2800_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800_bbp_write(rt2x00dev, 84, 0x9a);
 
-        if (rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT5392))
+        rt2800_bbp_write(rt2x00dev, 86, 0x38);
+
+        if (rt2x00_rt(rt2x00dev, RT5392))
                 rt2800_bbp_write(rt2x00dev, 88, 0x90);
 
         rt2800_bbp_write(rt2x00dev, 91, 0x04);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 92, 0x02);
-        else
-                rt2800_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800_bbp_write(rt2x00dev, 92, 0x02);
 
         if (rt2x00_rt(rt2x00dev, RT5392)) {
                 rt2800_bbp_write(rt2x00dev, 95, 0x9a);
                 rt2800_bbp_write(rt2x00dev, 98, 0x12);
         }
 
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT3070, REV_RT3070F) ||
-            rt2x00_rt_rev_gte(rt2x00dev, RT3071, REV_RT3071E) ||
-            rt2x00_rt_rev_gte(rt2x00dev, RT3090, REV_RT3090E) ||
-            rt2x00_rt_rev_gte(rt2x00dev, RT3390, REV_RT3390E) ||
-            rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT3572) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392) ||
-            rt2800_is_305x_soc(rt2x00dev))
-                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
-        else
-                rt2800_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800_bbp_write(rt2x00dev, 103, 0xc0);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT3352) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 104, 0x92);
+        rt2800_bbp_write(rt2x00dev, 104, 0x92);
 
-        if (rt2800_is_305x_soc(rt2x00dev))
-                rt2800_bbp_write(rt2x00dev, 105, 0x01);
-        else if (rt2x00_rt(rt2x00dev, RT3290))
-                rt2800_bbp_write(rt2x00dev, 105, 0x1c);
-        else if (rt2x00_rt(rt2x00dev, RT3352))
-                rt2800_bbp_write(rt2x00dev, 105, 0x34);
-        else if (rt2x00_rt(rt2x00dev, RT5390) ||
-                 rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 105, 0x3c);
-        else
-                rt2800_bbp_write(rt2x00dev, 105, 0x05);
+        rt2800_bbp_write(rt2x00dev, 105, 0x3c);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT5390))
+        if (rt2x00_rt(rt2x00dev, RT5390))
                 rt2800_bbp_write(rt2x00dev, 106, 0x03);
-        else if (rt2x00_rt(rt2x00dev, RT3352))
-                rt2800_bbp_write(rt2x00dev, 106, 0x05);
         else if (rt2x00_rt(rt2x00dev, RT5392))
                 rt2800_bbp_write(rt2x00dev, 106, 0x12);
         else
-                rt2800_bbp_write(rt2x00dev, 106, 0x35);
-
-        if (rt2x00_rt(rt2x00dev, RT3352))
-                rt2800_bbp_write(rt2x00dev, 120, 0x50);
+                WARN_ON(1);
 
-        if (rt2x00_rt(rt2x00dev, RT3290) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392))
-                rt2800_bbp_write(rt2x00dev, 128, 0x12);
+        rt2800_bbp_write(rt2x00dev, 128, 0x12);
 
         if (rt2x00_rt(rt2x00dev, RT5392)) {
                 rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                 rt2800_bbp_write(rt2x00dev, 135, 0xf6);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3352))
-                rt2800_bbp_write(rt2x00dev, 137, 0x0f);
+        rt2800_disable_unused_dac_adc(rt2x00dev);
 
-        if (rt2x00_rt(rt2x00dev, RT3071) ||
-            rt2x00_rt(rt2x00dev, RT3090) ||
-            rt2x00_rt(rt2x00dev, RT3390) ||
-            rt2x00_rt(rt2x00dev, RT3572) ||
-            rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_bbp_read(rt2x00dev, 138, &value);
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
+        div_mode = rt2x00_get_field16(eeprom,
+                                      EEPROM_NIC_CONF1_ANT_DIVERSITY);
+        ant = (div_mode == 3) ? 1 : 0;
 
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF0, &eeprom);
-                if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_TXPATH) == 1)
-                        value |= 0x20;
-                if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RXPATH) == 1)
-                        value &= ~0x02;
+        /* check if this is a Bluetooth combo card */
+        if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
+                u32 reg;
 
-                rt2800_bbp_write(rt2x00dev, 138, value);
+                rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
+                rt2x00_set_field32(&reg, GPIO_CTRL_DIR3, 0);
+                rt2x00_set_field32(&reg, GPIO_CTRL_DIR6, 0);
+                rt2x00_set_field32(&reg, GPIO_CTRL_VAL3, 0);
+                rt2x00_set_field32(&reg, GPIO_CTRL_VAL6, 0);
+                if (ant == 0)
+                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL3, 1);
+                else if (ant == 1)
+                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL6, 1);
+                rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3290)) {
-                rt2800_bbp_write(rt2x00dev, 67, 0x24);
-                rt2800_bbp_write(rt2x00dev, 143, 0x04);
-                rt2800_bbp_write(rt2x00dev, 142, 0x99);
-                rt2800_bbp_write(rt2x00dev, 150, 0x30);
-                rt2800_bbp_write(rt2x00dev, 151, 0x2e);
-                rt2800_bbp_write(rt2x00dev, 152, 0x20);
-                rt2800_bbp_write(rt2x00dev, 153, 0x34);
-                rt2800_bbp_write(rt2x00dev, 154, 0x40);
-                rt2800_bbp_write(rt2x00dev, 155, 0x3b);
-                rt2800_bbp_write(rt2x00dev, 253, 0x04);
-
-                rt2800_bbp_read(rt2x00dev, 47, &value);
-                rt2x00_set_field8(&value, BBP47_TSSI_ADC6, 1);
-                rt2800_bbp_write(rt2x00dev, 47, value);
-
-                /* Use 5-bit ADC for Acquisition and 8-bit ADC for data */
-                rt2800_bbp_read(rt2x00dev, 3, &value);
-                rt2x00_set_field8(&value, BBP3_ADC_MODE_SWITCH, 1);
-                rt2x00_set_field8(&value, BBP3_ADC_INIT_MODE, 1);
-                rt2800_bbp_write(rt2x00dev, 3, value);
+        /* This chip has hardware antenna diversity*/
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390R)) {
+                rt2800_bbp_write(rt2x00dev, 150, 0); /* Disable Antenna Software OFDM */
+                rt2800_bbp_write(rt2x00dev, 151, 0); /* Disable Antenna Software CCK */
+                rt2800_bbp_write(rt2x00dev, 154, 0); /* Clear previously selected antenna */
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3352)) {
-                rt2800_bbp_write(rt2x00dev, 163, 0xbd);
-                /* Set ITxBF timeout to 0x9c40=1000msec */
-                rt2800_bbp_write(rt2x00dev, 179, 0x02);
-                rt2800_bbp_write(rt2x00dev, 180, 0x00);
-                rt2800_bbp_write(rt2x00dev, 182, 0x40);
-                rt2800_bbp_write(rt2x00dev, 180, 0x01);
-                rt2800_bbp_write(rt2x00dev, 182, 0x9c);
-                rt2800_bbp_write(rt2x00dev, 179, 0x00);
-                /* Reprogram the inband interface to put right values in RXWI */
-                rt2800_bbp_write(rt2x00dev, 142, 0x04);
-                rt2800_bbp_write(rt2x00dev, 143, 0x3b);
-                rt2800_bbp_write(rt2x00dev, 142, 0x06);
-                rt2800_bbp_write(rt2x00dev, 143, 0xa0);
-                rt2800_bbp_write(rt2x00dev, 142, 0x07);
-                rt2800_bbp_write(rt2x00dev, 143, 0xa1);
-                rt2800_bbp_write(rt2x00dev, 142, 0x08);
-                rt2800_bbp_write(rt2x00dev, 143, 0xa2);
-
-                rt2800_bbp_write(rt2x00dev, 148, 0xc8);
+        rt2800_bbp_read(rt2x00dev, 152, &value);
+        if (ant == 0)
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
+        else
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
+        rt2800_bbp_write(rt2x00dev, 152, value);
+
+        rt2800_init_freq_calibration(rt2x00dev);
+}
+
+static void rt2800_init_bbp_5592(struct rt2x00_dev *rt2x00dev)
+{
+        int ant, div_mode;
+        u16 eeprom;
+        u8 value;
+
+        rt2800_init_bbp_early(rt2x00dev);
+
+        rt2800_bbp_read(rt2x00dev, 105, &value);
+        rt2x00_set_field8(&value, BBP105_MLD,
+                          rt2x00dev->default_ant.rx_chain_num == 2);
+        rt2800_bbp_write(rt2x00dev, 105, value);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 20, 0x06);
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
+        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
+        rt2800_bbp_write(rt2x00dev, 68, 0xDD);
+        rt2800_bbp_write(rt2x00dev, 69, 0x1A);
+        rt2800_bbp_write(rt2x00dev, 70, 0x05);
+        rt2800_bbp_write(rt2x00dev, 73, 0x13);
+        rt2800_bbp_write(rt2x00dev, 74, 0x0F);
+        rt2800_bbp_write(rt2x00dev, 75, 0x4F);
+        rt2800_bbp_write(rt2x00dev, 76, 0x28);
+        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 84, 0x9A);
+        rt2800_bbp_write(rt2x00dev, 86, 0x38);
+        rt2800_bbp_write(rt2x00dev, 88, 0x90);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x02);
+        rt2800_bbp_write(rt2x00dev, 95, 0x9a);
+        rt2800_bbp_write(rt2x00dev, 98, 0x12);
+        rt2800_bbp_write(rt2x00dev, 103, 0xC0);
+        rt2800_bbp_write(rt2x00dev, 104, 0x92);
+        /* FIXME BBP105 owerwrite */
+        rt2800_bbp_write(rt2x00dev, 105, 0x3C);
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+        rt2800_bbp_write(rt2x00dev, 128, 0x12);
+        rt2800_bbp_write(rt2x00dev, 134, 0xD0);
+        rt2800_bbp_write(rt2x00dev, 135, 0xF6);
+        rt2800_bbp_write(rt2x00dev, 137, 0x0F);
+
+        /* Initialize GLRT (Generalized Likehood Radio Test) */
+        rt2800_init_bbp_5592_glrt(rt2x00dev);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
+        div_mode = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_ANT_DIVERSITY);
+        ant = (div_mode == 3) ? 1 : 0;
+        rt2800_bbp_read(rt2x00dev, 152, &value);
+        if (ant == 0) {
+                /* Main antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
+        } else {
+                /* Auxiliary antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
         }
+        rt2800_bbp_write(rt2x00dev, 152, value);
 
-        if (rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
-                int ant, div_mode;
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C)) {
+                rt2800_bbp_read(rt2x00dev, 254, &value);
+                rt2x00_set_field8(&value, BBP254_BIT7, 1);
+                rt2800_bbp_write(rt2x00dev, 254, value);
+        }
 
-                rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
-                div_mode = rt2x00_get_field16(eeprom,
-                                              EEPROM_NIC_CONF1_ANT_DIVERSITY);
-                ant = (div_mode == 3) ? 1 : 0;
+        rt2800_init_freq_calibration(rt2x00dev);
 
-                /* check if this is a Bluetooth combo card */
-                if (test_bit(CAPABILITY_BT_COEXIST, &rt2x00dev->cap_flags)) {
-                        u32 reg;
-
-                        rt2800_register_read(rt2x00dev, GPIO_CTRL, &reg);
-                        rt2x00_set_field32(&reg, GPIO_CTRL_DIR3, 0);
-                        rt2x00_set_field32(&reg, GPIO_CTRL_DIR6, 0);
-                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL3, 0);
-                        rt2x00_set_field32(&reg, GPIO_CTRL_VAL6, 0);
-                        if (ant == 0)
-                                rt2x00_set_field32(&reg, GPIO_CTRL_VAL3, 1);
-                        else if (ant == 1)
-                                rt2x00_set_field32(&reg, GPIO_CTRL_VAL6, 1);
-                        rt2800_register_write(rt2x00dev, GPIO_CTRL, reg);
-                }
+        rt2800_bbp_write(rt2x00dev, 84, 0x19);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+}
 
-                /* This chip has hardware antenna diversity*/
-                if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390R)) {
-                        rt2800_bbp_write(rt2x00dev, 150, 0); /* Disable Antenna Software OFDM */
-                        rt2800_bbp_write(rt2x00dev, 151, 0); /* Disable Antenna Software CCK */
-                        rt2800_bbp_write(rt2x00dev, 154, 0); /* Clear previously selected antenna */
-                }
+static void rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
+{
+        unsigned int i;
+        u16 eeprom;
+        u8 reg_id;
+        u8 value;
 
-                rt2800_bbp_read(rt2x00dev, 152, &value);
-                if (ant == 0)
-                        rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
-                else
-                        rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
-                rt2800_bbp_write(rt2x00dev, 152, value);
+        if (rt2800_is_305x_soc(rt2x00dev))
+                rt2800_init_bbp_305x_soc(rt2x00dev);
 
-                rt2800_init_freq_calibration(rt2x00dev);
+        switch (rt2x00dev->chip.rt) {
+        case RT2860:
+        case RT2872:
+        case RT2883:
+                rt2800_init_bbp_28xx(rt2x00dev);
+                break;
+        case RT3070:
+        case RT3071:
+        case RT3090:
+                rt2800_init_bbp_30xx(rt2x00dev);
+                break;
+        case RT3290:
+                rt2800_init_bbp_3290(rt2x00dev);
+                break;
+        case RT3352:
+                rt2800_init_bbp_3352(rt2x00dev);
+                break;
+        case RT3390:
+                rt2800_init_bbp_3390(rt2x00dev);
+                break;
+        case RT3572:
+                rt2800_init_bbp_3572(rt2x00dev);
+                break;
+        case RT5390:
+        case RT5392:
+                rt2800_init_bbp_53xx(rt2x00dev);
+                break;
+        case RT5592:
+                rt2800_init_bbp_5592(rt2x00dev);
+                return;
         }
 
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
@@ -4337,8 +4535,6 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                         rt2800_bbp_write(rt2x00dev, reg_id, value);
                 }
         }
-
-        return 0;
 }
 
 static void rt2800_led_open_drain_enable(struct rt2x00_dev *rt2x00dev)
@@ -5189,9 +5385,11 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
         }
         msleep(1);
 
-        if (unlikely(rt2800_init_bbp(rt2x00dev)))
+        if (unlikely(rt2800_wait_bbp_rf_ready(rt2x00dev) ||
+                     rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EIO;
 
+        rt2800_init_bbp(rt2x00dev);
         rt2800_init_rfcsr(rt2x00dev);
 
         if (rt2x00_is_usb(rt2x00dev) &&
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 6f4a861af336..330f1d25726d 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -1014,7 +1014,7 @@ static void rt2800pci_txstatus_interrupt(struct rt2x00_dev *rt2x00dev)
          * Since we have only one producer and one consumer we don't
          * need to lock the kfifo.
          */
-        for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
+        for (i = 0; i < rt2x00dev->tx->limit; i++) {
                 rt2x00mmio_register_read(rt2x00dev, TX_STA_FIFO, &status);
 
                 if (!rt2x00_get_field32(status, TX_STA_FIFO_VALID))
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index ac854d75bd6c..c71a48da9a31 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -327,7 +327,7 @@ static int rt2800usb_enable_radio(struct rt2x00_dev *rt2x00dev)
          * this limit so reduce the number to prevent errors.
          */
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_AGG_LIMIT,
-                           ((rt2x00dev->ops->rx->entry_num * DATA_FRAME_SIZE)
+                           ((rt2x00dev->rx->limit * DATA_FRAME_SIZE)
                             / 1024) - 3);
         rt2x00_set_field32(&reg, USB_DMA_CFG_RX_BULK_EN, 1);
         rt2x00_set_field32(&reg, USB_DMA_CFG_TX_BULK_EN, 1);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 90dc14336980..6a201725bc50 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1077,7 +1077,7 @@ static int rt2x00lib_probe_hw(struct rt2x00_dev *rt2x00dev)
                  */
                 int kfifo_size =
                         roundup_pow_of_two(rt2x00dev->ops->tx_queues *
-                                           rt2x00dev->ops->tx->entry_num *
+                                           rt2x00dev->tx->limit *
                                            sizeof(u32));
 
                 status = kfifo_alloc(&rt2x00dev->txstatus_fifo, kfifo_size,
@@ -1301,23 +1301,6 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                 (rt2x00dev->ops->max_ap_intf - 1);
 
         /*
-         * Determine which operating modes are supported, all modes
-         * which require beaconing, depend on the availability of
-         * beacon entries.
-         */
-        rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
-        if (rt2x00dev->ops->bcn->entry_num > 0)
-                rt2x00dev->hw->wiphy->interface_modes |=
-                    BIT(NL80211_IFTYPE_ADHOC) |
-                    BIT(NL80211_IFTYPE_AP) |
-#ifdef CONFIG_MAC80211_MESH
-                    BIT(NL80211_IFTYPE_MESH_POINT) |
-#endif
-                    BIT(NL80211_IFTYPE_WDS);
-
-        rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
-
-        /*
          * Initialize work.
          */
         rt2x00dev->workqueue =
@@ -1348,6 +1331,23 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                 goto exit;
 
         /*
+         * Determine which operating modes are supported, all modes
+         * which require beaconing, depend on the availability of
+         * beacon entries.
+         */
+        rt2x00dev->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
+        if (rt2x00dev->ops->bcn->entry_num > 0)
+                rt2x00dev->hw->wiphy->interface_modes |=
+                    BIT(NL80211_IFTYPE_ADHOC) |
+                    BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
+                    BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                    BIT(NL80211_IFTYPE_WDS);
+
+        rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+
+        /*
          * Initialize ieee80211 structure.
          */
         retval = rt2x00lib_probe_hw(rt2x00dev);
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index dc49e525ae5e..76d95deb274b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -105,11 +105,13 @@ int rt2x00pci_probe(struct pci_dev *pci_dev, const struct rt2x00_ops *ops)
                 goto exit_release_regions;
         }
 
+        pci_enable_msi(pci_dev);
+
         hw = ieee80211_alloc_hw(sizeof(struct rt2x00_dev), ops->hw);
         if (!hw) {
                 rt2x00_probe_err("Failed to allocate hardware\n");
                 retval = -ENOMEM;
-                goto exit_release_regions;
+                goto exit_disable_msi;
         }
 
         pci_set_drvdata(pci_dev, hw);
@@ -150,6 +152,9 @@ exit_free_reg:
 exit_free_device:
         ieee80211_free_hw(hw);
 
+exit_disable_msi:
+        pci_disable_msi(pci_dev);
+
 exit_release_regions:
         pci_release_regions(pci_dev);
 
@@ -174,6 +179,8 @@ void rt2x00pci_remove(struct pci_dev *pci_dev)
         rt2x00pci_free_reg(rt2x00dev);
         ieee80211_free_hw(hw);
 
+        pci_disable_msi(pci_dev);
+
         /*
          * Free the PCI device data.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 2c12311467a9..5efbbbdca701 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -1170,12 +1170,6 @@ static int rt2x00queue_alloc_entries(struct data_queue *queue,
 
         rt2x00queue_reset(queue);
 
-        queue->limit = qdesc->entry_num;
-        queue->threshold = DIV_ROUND_UP(qdesc->entry_num, 10);
-        queue->data_size = qdesc->data_size;
-        queue->desc_size = qdesc->desc_size;
-        queue->winfo_size = qdesc->winfo_size;
-
         /*
          * Allocate all queue entries.
          */
@@ -1284,9 +1278,38 @@ void rt2x00queue_uninitialize(struct rt2x00_dev *rt2x00dev)
         }
 }
 
+static const struct data_queue_desc *
+rt2x00queue_get_qdesc_by_qid(struct rt2x00_dev *rt2x00dev,
+                             enum data_queue_qid qid)
+{
+        switch (qid) {
+        case QID_RX:
+                return rt2x00dev->ops->rx;
+
+        case QID_AC_BE:
+        case QID_AC_BK:
+        case QID_AC_VO:
+        case QID_AC_VI:
+                return rt2x00dev->ops->tx;
+
+        case QID_BEACON:
+                return rt2x00dev->ops->bcn;
+
+        case QID_ATIM:
+                return rt2x00dev->ops->atim;
+
+        default:
+                break;
+        }
+
+        return NULL;
+}
+
 static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
                              struct data_queue *queue, enum data_queue_qid qid)
 {
+        const struct data_queue_desc *qdesc;
+
         mutex_init(&queue->status_lock);
         spin_lock_init(&queue->tx_lock);
         spin_lock_init(&queue->index_lock);
@@ -1297,6 +1320,15 @@ static void rt2x00queue_init(struct rt2x00_dev *rt2x00dev,
         queue->aifs = 2;
         queue->cw_min = 5;
         queue->cw_max = 10;
+
+        qdesc = rt2x00queue_get_qdesc_by_qid(rt2x00dev, qid);
+        BUG_ON(!qdesc);
+
+        queue->limit = qdesc->entry_num;
+        queue->threshold = DIV_ROUND_UP(qdesc->entry_num, 10);
+        queue->data_size = qdesc->data_size;
+        queue->desc_size = qdesc->desc_size;
+        queue->winfo_size = qdesc->winfo_size;
 }
 
 int rt2x00queue_allocate(struct rt2x00_dev *rt2x00dev)
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 0dc8180e251b..7e1759b3e49a 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2175,7 +2175,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
          * that the TX_STA_FIFO stack has a size of 16. We stick to our
          * tx ring size for now.
          */
-        for (i = 0; i < rt2x00dev->ops->tx->entry_num; i++) {
+        for (i = 0; i < rt2x00dev->tx->limit; i++) {
                 rt2x00mmio_register_read(rt2x00dev, STA_CSR4, &reg);
                 if (!rt2x00_get_field32(reg, STA_CSR4_VALID))
                         break;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
index 19a765532603..47875ba09ff8 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/dm.c
@@ -842,7 +842,7 @@ static void rtl92d_dm_txpower_tracking_callback_thermalmeter(
         long val_y, ele_c = 0;
         u8 ofdm_index[2];
         s8 cck_index = 0;
-        u8 ofdm_index_old[2];
+        u8 ofdm_index_old[2] = {0, 0};
         s8 cck_index_old = 0;
         u8 index;
         int i;
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 06b0ed0154a4..d826e5a84af0 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1829,6 +1829,15 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_AES_CMAC = 16,
 };
 
+#define IEEE80211_WEP_IV_LEN            4
+#define IEEE80211_WEP_ICV_LEN           4
+#define IEEE80211_CCMP_HDR_LEN          8
+#define IEEE80211_CCMP_MIC_LEN          8
+#define IEEE80211_CCMP_PN_LEN           6
+#define IEEE80211_TKIP_IV_LEN           8
+#define IEEE80211_TKIP_ICV_LEN          4
+#define IEEE80211_CMAC_PN_LEN           6
+
 /* Public action codes */
 enum ieee80211_pub_actioncode {
         WLAN_PUB_ACTION_EXT_CHANSW_ANN = 4,
diff --git a/include/linux/platform_data/net-cw1200.h b/include/linux/platform_data/net-cw1200.h
new file mode 100644
index 000000000000..c6fbc3ce4ab0
--- /dev/null
+++ b/include/linux/platform_data/net-cw1200.h
@@ -0,0 +1,81 @@
+/*
+ * Copyright (C) ST-Ericsson SA 2011
+ *
+ * Author: Dmitry Tarnyagin <dmitry.tarnyagin@stericsson.com>
+ * License terms: GNU General Public License (GPL) version 2
+ */
+
+#ifndef CW1200_PLAT_H_INCLUDED
+#define CW1200_PLAT_H_INCLUDED
+
+struct cw1200_platform_data_spi {
+        u8 spi_bits_per_word;           /* REQUIRED */
+        u16 ref_clk;                    /* REQUIRED (in KHz) */
+
+        /* All others are optional */
+        bool have_5ghz;
+        int reset;                     /* GPIO to RSTn signal (0 disables) */
+        int powerup;                   /* GPIO to POWERUP signal (0 disables) */
+        int (*power_ctrl)(const struct cw1200_platform_data_spi *pdata,
+                          bool enable); /* Control 3v3 / 1v8 supply */
+        int (*clk_ctrl)(const struct cw1200_platform_data_spi *pdata,
+                        bool enable); /* Control CLK32K */
+        const u8 *macaddr;  /* if NULL, use cw1200_mac_template module parameter */
+        const char *sdd_file;  /* if NULL, will use default for detected hw type */
+};
+
+struct cw1200_platform_data_sdio {
+        u16 ref_clk;                    /* REQUIRED (in KHz) */
+
+        /* All others are optional */
+        bool have_5ghz;
+        bool no_nptb;       /* SDIO hardware does not support non-power-of-2-blocksizes */
+        int reset;          /* GPIO to RSTn signal (0 disables) */
+        int powerup;        /* GPIO to POWERUP signal (0 disables) */
+        int irq;            /* IRQ line or 0 to use SDIO IRQ */
+        int (*power_ctrl)(const struct cw1200_platform_data_sdio *pdata,
+                          bool enable); /* Control 3v3 / 1v8 supply */
+        int (*clk_ctrl)(const struct cw1200_platform_data_sdio *pdata,
+                        bool enable); /* Control CLK32K */
+        const u8 *macaddr;  /* if NULL, use cw1200_mac_template module parameter */
+        const char *sdd_file;  /* if NULL, will use default for detected hw type */
+};
+
+
+/* An example of SPI support in your board setup file:
+
+   static struct cw1200_platform_data_spi cw1200_platform_data = {
+       .ref_clk = 38400,
+       .spi_bits_per_word = 16,
+       .reset = GPIO_RF_RESET,
+       .powerup = GPIO_RF_POWERUP,
+       .macaddr = wifi_mac_addr,
+       .sdd_file = "sdd_sagrad_1091_1098.bin",
+  };
+  static struct spi_board_info myboard_spi_devices[] __initdata = {
+       {
+               .modalias = "cw1200_wlan_spi",
+               .max_speed_hz = 52000000,
+               .bus_num = 0,
+               .irq = WIFI_IRQ,
+               .platform_data = &cw1200_platform_data,
+               .chip_select = 0,
+       },
+  };
+
+ */
+
+/* An example of SDIO support in your board setup file:
+
+  static struct cw1200_platform_data_sdio my_cw1200_platform_data = {
+        .ref_clk = 38400,
+        .have_5ghz = false,
+        .sdd_file = "sdd_myplatform.bin",
+  };
+  cw1200_sdio_set_platform_data(&my_cw1200_platform_data);
+
+ */
+
+void __init cw1200_sdio_set_platform_data(struct cw1200_platform_data_sdio *pdata);
+
+#endif /* CW1200_PLAT_H_INCLUDED */
diff --git a/include/linux/ssb/ssb_regs.h b/include/linux/ssb/ssb_regs.h
index 3a7256955b10..f9f931c89e3e 100644
--- a/include/linux/ssb/ssb_regs.h
+++ b/include/linux/ssb/ssb_regs.h
@@ -172,6 +172,7 @@
 #define SSB_SPROMSIZE_WORDS_R4          220
 #define SSB_SPROMSIZE_BYTES_R123        (SSB_SPROMSIZE_WORDS_R123 * sizeof(u16))
 #define SSB_SPROMSIZE_BYTES_R4          (SSB_SPROMSIZE_WORDS_R4 * sizeof(u16))
+#define SSB_SPROMSIZE_WORDS_R10         230
 #define SSB_SPROM_BASE1                 0x1000
 #define SSB_SPROM_BASE31                0x0800
 #define SSB_SPROM_REVISION              0x007E
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 26b5b692c22b..6dd19593e333 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -753,6 +753,8 @@ int cfg80211_check_station_change(struct wiphy *wiphy,
  * @STATION_INFO_LOCAL_PM: @local_pm filled
  * @STATION_INFO_PEER_PM: @peer_pm filled
  * @STATION_INFO_NONPEER_PM: @nonpeer_pm filled
+ * @STATION_INFO_CHAIN_SIGNAL: @chain_signal filled
+ * @STATION_INFO_CHAIN_SIGNAL_AVG: @chain_signal_avg filled
  */
 enum station_info_flags {
         STATION_INFO_INACTIVE_TIME      = 1<<0,
@@ -781,6 +783,8 @@ enum station_info_flags {
         STATION_INFO_NONPEER_PM         = 1<<23,
         STATION_INFO_RX_BYTES64         = 1<<24,
         STATION_INFO_TX_BYTES64         = 1<<25,
+        STATION_INFO_CHAIN_SIGNAL       = 1<<26,
+        STATION_INFO_CHAIN_SIGNAL_AVG   = 1<<27,
 };
 
 /**
@@ -857,6 +861,8 @@ struct sta_bss_parameters {
         u16 beacon_interval;
 };
 
+#define IEEE80211_MAX_CHAINS    4
+
 /**
  * struct station_info - station information
  *
@@ -874,6 +880,9 @@ struct sta_bss_parameters {
  *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
  * @signal_avg: Average signal strength, type depends on the wiphy's signal_type.
  *      For CFG80211_SIGNAL_TYPE_MBM, value is expressed in _dBm_.
+ * @chains: bitmask for filled values in @chain_signal, @chain_signal_avg
+ * @chain_signal: per-chain signal strength of last received packet in dBm
+ * @chain_signal_avg: per-chain signal strength average in dBm
  * @txrate: current unicast bitrate from this station
  * @rxrate: current unicast bitrate to this station
  * @rx_packets: packets received from this station
@@ -909,6 +918,11 @@ struct station_info {
         u8 plink_state;
         s8 signal;
         s8 signal_avg;
+
+        u8 chains;
+        s8 chain_signal[IEEE80211_MAX_CHAINS];
+        s8 chain_signal_avg[IEEE80211_MAX_CHAINS];
+
         struct rate_info txrate;
         struct rate_info rxrate;
         u32 rx_packets;
@@ -947,6 +961,7 @@ struct station_info {
  * @MONITOR_FLAG_CONTROL: pass control frames
  * @MONITOR_FLAG_OTHER_BSS: disable BSSID filtering
  * @MONITOR_FLAG_COOK_FRAMES: report frames after processing
+ * @MONITOR_FLAG_ACTIVE: active monitor, ACKs frames on its MAC address
  */
 enum monitor_flags {
         MONITOR_FLAG_FCSFAIL            = 1<<NL80211_MNTR_FLAG_FCSFAIL,
@@ -954,6 +969,7 @@ enum monitor_flags {
         MONITOR_FLAG_CONTROL            = 1<<NL80211_MNTR_FLAG_CONTROL,
         MONITOR_FLAG_OTHER_BSS          = 1<<NL80211_MNTR_FLAG_OTHER_BSS,
         MONITOR_FLAG_COOK_FRAMES        = 1<<NL80211_MNTR_FLAG_COOK_FRAMES,
+        MONITOR_FLAG_ACTIVE             = 1<<NL80211_MNTR_FLAG_ACTIVE,
 };
 
 /**
@@ -1147,6 +1163,7 @@ struct mesh_config {
  * @sync_method: which synchronization method to use
  * @path_sel_proto: which path selection protocol to use
  * @path_metric: which metric to use
+ * @auth_id: which authentication method this mesh is using
  * @ie: vendor information elements (optional)
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
@@ -1165,6 +1182,7 @@ struct mesh_setup {
         u8 sync_method;
         u8 path_sel_proto;
         u8 path_metric;
+        u8 auth_id;
         const u8 *ie;
         u8 ie_len;
         bool is_authenticated;
@@ -1241,6 +1259,7 @@ struct cfg80211_ssid {
  * @scan_start: time (in jiffies) when the scan started
  * @wdev: the wireless device to scan for
  * @aborted: (internal) scan request was notified as aborted
+ * @notified: (internal) scan request was notified as done or aborted
  * @no_cck: used to send probe requests at non CCK rate in 2GHz band
  */
 struct cfg80211_scan_request {
@@ -1258,7 +1277,7 @@ struct cfg80211_scan_request {
         /* internal */
         struct wiphy *wiphy;
         unsigned long scan_start;
-        bool aborted;
+        bool aborted, notified;
         bool no_cck;
 
         /* keep last */
@@ -1850,7 +1869,9 @@ struct cfg80211_update_ft_ies_params {
  * @get_mpath: get a mesh path for the given parameters
  * @dump_mpath: dump mesh path callback -- resume dump at index @idx
  * @join_mesh: join the mesh network with the specified parameters
+ *      (invoked with the wireless_dev mutex held)
  * @leave_mesh: leave the current mesh network
+ *      (invoked with the wireless_dev mutex held)
  *
  * @get_mesh_config: Get the current mesh configuration
  *
@@ -1877,20 +1898,28 @@ struct cfg80211_update_ft_ies_params {
  *      the scan/scan_done bracket too.
  *
  * @auth: Request to authenticate with the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @assoc: Request to (re)associate with the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @deauth: Request to deauthenticate from the specified peer
+ *      (invoked with the wireless_dev mutex held)
  * @disassoc: Request to disassociate from the specified peer
+ *      (invoked with the wireless_dev mutex held)
  *
  * @connect: Connect to the ESS with the specified parameters. When connected,
  *      call cfg80211_connect_result() with status code %WLAN_STATUS_SUCCESS.
  *      If the connection fails for some reason, call cfg80211_connect_result()
  *      with the status from the AP.
+ *      (invoked with the wireless_dev mutex held)
  * @disconnect: Disconnect from the BSS/ESS.
+ *      (invoked with the wireless_dev mutex held)
  *
  * @join_ibss: Join the specified IBSS (or create if necessary). Once done, call
  *      cfg80211_ibss_joined(), also call that function when changing BSSID due
  *      to a merge.
+ *      (invoked with the wireless_dev mutex held)
  * @leave_ibss: Leave the IBSS.
+ *      (invoked with the wireless_dev mutex held)
  *
  * @set_mcast_rate: Set the specified multicast rate (only if vif is in ADHOC or
  *      MESH mode)
@@ -2556,6 +2585,9 @@ struct wiphy_wowlan_support {
  *      may request, if implemented.
  *
  * @wowlan: WoWLAN support information
+ * @wowlan_config: current WoWLAN configuration; this should usually not be
+ *      used since access to it is necessarily racy, use the parameter passed
+ *      to the suspend() operation instead.
  *
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
@@ -2623,6 +2655,7 @@ struct wiphy {
 
 #ifdef CONFIG_PM
         struct wiphy_wowlan_support wowlan;
+        struct cfg80211_wowlan *wowlan_config;
 #endif
 
         u16 max_remain_on_channel_duration;
@@ -2834,8 +2867,8 @@ struct cfg80211_cached_keys;
  *      by cfg80211 on change_interface
  * @mgmt_registrations: list of registrations for management frames
  * @mgmt_registrations_lock: lock for the list
- * @mtx: mutex used to lock data in this struct
- * @cleanup_work: work struct used for cleanup that can't be done directly
+ * @mtx: mutex used to lock data in this struct, may be used by drivers
+ *      and some API functions require it held
  * @beacon_interval: beacon interval used on this device for transmitting
  *      beacons, 0 when not valid
  * @address: The address for this device, valid only if @netdev is %NULL
@@ -2858,8 +2891,6 @@ struct wireless_dev {
 
         struct mutex mtx;
 
-        struct work_struct cleanup_work;
-
         bool use_4addr, p2p_started;
 
         u8 address[ETH_ALEN] __aligned(sizeof(u16));
@@ -2989,6 +3020,15 @@ struct ieee80211_rate *
 ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
                             u32 basic_rates, int bitrate);
 
+/**
+ * ieee80211_mandatory_rates - get mandatory rates for a given band
+ * @sband: the band to look for rates in
+ *
+ * This function returns a bitmap of the mandatory rates for the given
+ * band, bits are set according to the rate position in the bitrates array.
+ */
+u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband);
+
 /*
  * Radiotap parsing functions -- for controlled injection support
  *
@@ -3400,7 +3440,8 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *bss);
  * This function is called whenever an authentication has been processed in
  * station mode. The driver is required to call either this function or
  * cfg80211_send_auth_timeout() to indicate the result of cfg80211_ops::auth()
- * call. This function may sleep.
+ * call. This function may sleep. The caller must hold the corresponding wdev's
+ * mutex.
  */
 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
 
@@ -3409,7 +3450,8 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len);
  * @dev: network device
  * @addr: The MAC address of the device with which the authentication timed out
  *
- * This function may sleep.
+ * This function may sleep. The caller must hold the corresponding wdev's
+ * mutex.
  */
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
 
@@ -3424,7 +3466,8 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr);
  * This function is called whenever a (re)association response has been
  * processed in station mode. The driver is required to call either this
  * function or cfg80211_send_assoc_timeout() to indicate the result of
- * cfg80211_ops::assoc() call. This function may sleep.
+ * cfg80211_ops::assoc() call. This function may sleep. The caller must hold
+ * the corresponding wdev's mutex.
  */
 void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
                             const u8 *buf, size_t len);
@@ -3434,7 +3477,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
  * @dev: network device
  * @addr: The MAC address of the device with which the association timed out
  *
- * This function may sleep.
+ * This function may sleep. The caller must hold the corresponding wdev's mutex.
  */
 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
 
@@ -3446,21 +3489,12 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr);
  *
  * This function is called whenever deauthentication has been processed in
  * station mode. This includes both received deauthentication frames and
- * locally generated ones. This function may sleep.
+ * locally generated ones. This function may sleep. The caller must hold the
+ * corresponding wdev's mutex.
  */
 void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * __cfg80211_send_deauth - notification of processed deauthentication
- * @dev: network device
- * @buf: deauthentication frame (header + body)
- * @len: length of the frame data
- *
- * Like cfg80211_send_deauth(), but doesn't take the wdev lock.
- */
-void __cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
-
-/**
  * cfg80211_send_disassoc - notification of processed disassociation
  * @dev: network device
  * @buf: disassociation response frame (header + body)
@@ -3468,22 +3502,12 @@ void __cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len);
  *
  * This function is called whenever disassociation has been processed in
  * station mode. This includes both received disassociation frames and locally
- * generated ones. This function may sleep.
+ * generated ones. This function may sleep. The caller must hold the
+ * corresponding wdev's mutex.
  */
 void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len);
 
 /**
- * __cfg80211_send_disassoc - notification of processed disassociation
- * @dev: network device
- * @buf: disassociation response frame (header + body)
- * @len: length of the frame data
- *
- * Like cfg80211_send_disassoc(), but doesn't take the wdev lock.
- */
-void __cfg80211_send_disassoc(struct net_device *dev, const u8 *buf,
-        size_t len);
-
-/**
  * cfg80211_send_unprot_deauth - notification of unprotected deauthentication
  * @dev: network device
  * @buf: deauthentication frame (header + body)
@@ -4153,6 +4177,7 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
  * cfg80211_crit_proto_stopped() - indicate critical protocol stopped by driver.
  *
  * @wdev: the wireless device for which critical protocol is stopped.
+ * @gfp: allocation flags
  *
  * This function can be called by the driver to indicate it has reverted
  * operation back to normal. One reason could be that the duration given
diff --git a/include/net/ieee80211_radiotap.h b/include/net/ieee80211_radiotap.h
index c3999632e616..c6d07cb074bc 100644
--- a/include/net/ieee80211_radiotap.h
+++ b/include/net/ieee80211_radiotap.h
@@ -269,6 +269,7 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_MCS_HAVE_GI          0x04
 #define IEEE80211_RADIOTAP_MCS_HAVE_FMT         0x08
 #define IEEE80211_RADIOTAP_MCS_HAVE_FEC         0x10
+#define IEEE80211_RADIOTAP_MCS_HAVE_STBC        0x20
 
 #define IEEE80211_RADIOTAP_MCS_BW_MASK          0x03
 #define         IEEE80211_RADIOTAP_MCS_BW_20    0
@@ -278,6 +279,12 @@ enum ieee80211_radiotap_type {
 #define IEEE80211_RADIOTAP_MCS_SGI              0x04
 #define IEEE80211_RADIOTAP_MCS_FMT_GF           0x08
 #define IEEE80211_RADIOTAP_MCS_FEC_LDPC         0x10
+#define IEEE80211_RADIOTAP_MCS_STBC_MASK        0x60
+#define         IEEE80211_RADIOTAP_MCS_STBC_1   1
+#define         IEEE80211_RADIOTAP_MCS_STBC_2   2
+#define         IEEE80211_RADIOTAP_MCS_STBC_3   3
+
+#define IEEE80211_RADIOTAP_MCS_STBC_SHIFT       5
 
 /* For IEEE80211_RADIOTAP_AMPDU_STATUS */
 #define IEEE80211_RADIOTAP_AMPDU_REPORT_ZEROLEN         0x0001
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 885898a40d13..1f0014bd4d87 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -805,6 +805,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
  *      on this subframe
  * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC
  *      is stored in the @ampdu_delimiter_crc field)
+ * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3
  */
 enum mac80211_rx_flags {
         RX_FLAG_MMIC_ERROR              = BIT(0),
@@ -832,8 +833,11 @@ enum mac80211_rx_flags {
         RX_FLAG_80MHZ                   = BIT(23),
         RX_FLAG_80P80MHZ                = BIT(24),
         RX_FLAG_160MHZ                  = BIT(25),
+        RX_FLAG_STBC_MASK               = BIT(26) | BIT(27),
 };
 
+#define RX_FLAG_STBC_SHIFT              26
+
 /**
  * struct ieee80211_rx_status - receive status
  *
@@ -850,6 +854,10 @@ enum mac80211_rx_flags {
  * @signal: signal strength when receiving this frame, either in dBm, in dB or
  *      unspecified depending on the hardware capabilities flags
  *      @IEEE80211_HW_SIGNAL_*
+ * @chains: bitmask of receive chains for which separate signal strength
+ *      values were filled.
+ * @chain_signal: per-chain signal strength, in dBm (unlike @signal, doesn't
+ *      support dB or unspecified units)
  * @antenna: antenna used
  * @rate_idx: index of data rate into band's supported rates or MCS index if
  *      HT or VHT is used (%RX_FLAG_HT/%RX_FLAG_VHT)
@@ -881,6 +889,8 @@ struct ieee80211_rx_status {
         u8 band;
         u8 antenna;
         s8 signal;
+        u8 chains;
+        s8 chain_signal[IEEE80211_MAX_CHAINS];
         u8 ampdu_delimiter_crc;
         u8 vendor_radiotap_align;
         u8 vendor_radiotap_oui[3];
@@ -1235,7 +1245,7 @@ enum ieee80211_sta_rx_bandwidth {
  * struct ieee80211_sta_rates - station rate selection table
  *
  * @rcu_head: RCU head used for freeing the table on update
- * @rates: transmit rates/flags to be used by default.
+ * @rate: transmit rates/flags to be used by default.
  *      Overriding entries per-packet is possible by using cb tx control.
  */
 struct ieee80211_sta_rates {
@@ -1276,7 +1286,7 @@ struct ieee80211_sta_rates {
  *      notifications and capabilities. The value is only valid after
  *      the station moves to associated state.
  * @smps_mode: current SMPS mode (off, static or dynamic)
- * @tx_rates: rate control selection table
+ * @rates: rate control selection table
  */
 struct ieee80211_sta {
         u32 supp_rates[IEEE80211_NUM_BANDS];
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index d1e48b5e348f..5920715278c2 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -27,6 +27,8 @@
 
 #include <linux/types.h>
 
+#define NL80211_GENL_NAME "nl80211"
+
 /**
  * DOC: Station handling
  *
@@ -1429,6 +1431,11 @@ enum nl80211_commands {
  * @NL80211_ATTR_MAX_CRIT_PROT_DURATION: duration in milliseconds in which
  *      the connection should have increased reliability (u16).
  *
+ * @NL80211_ATTR_PEER_AID: Association ID for the peer TDLS station (u16).
+ *      This is similar to @NL80211_ATTR_STA_AID but with a difference of being
+ *      allowed to be used with the first @NL80211_CMD_SET_STATION command to
+ *      update a TDLS peer STA entry.
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1727,6 +1734,8 @@ enum nl80211_attrs {
         NL80211_ATTR_CRIT_PROT_ID,
         NL80211_ATTR_MAX_CRIT_PROT_DURATION,
 
+        NL80211_ATTR_PEER_AID,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -1991,6 +2000,10 @@ enum nl80211_sta_bss_param {
  * @NL80211_STA_INFO_PEER_PM: peer mesh STA link-specific power mode
  * @NL80211_STA_INFO_NONPEER_PM: neighbor mesh STA power save mode towards
  *      non-peer STA
+ * @NL80211_STA_INFO_CHAIN_SIGNAL: per-chain signal strength of last PPDU
+ *      Contains a nested array of signal strength attributes (u8, dBm)
+ * @NL80211_STA_INFO_CHAIN_SIGNAL_AVG: per-chain signal strength average
+ *      Same format as NL80211_STA_INFO_CHAIN_SIGNAL.
  * @__NL80211_STA_INFO_AFTER_LAST: internal
  * @NL80211_STA_INFO_MAX: highest possible station info attribute
  */
@@ -2020,6 +2033,8 @@ enum nl80211_sta_info {
         NL80211_STA_INFO_NONPEER_PM,
         NL80211_STA_INFO_RX_BYTES64,
         NL80211_STA_INFO_TX_BYTES64,
+        NL80211_STA_INFO_CHAIN_SIGNAL,
+        NL80211_STA_INFO_CHAIN_SIGNAL_AVG,
 
         /* keep last */
         __NL80211_STA_INFO_AFTER_LAST,
@@ -2413,6 +2428,8 @@ enum nl80211_survey_info {
  * @NL80211_MNTR_FLAG_OTHER_BSS: disable BSSID filtering
  * @NL80211_MNTR_FLAG_COOK_FRAMES: report frames after processing.
  *      overrides all other flags.
+ * @NL80211_MNTR_FLAG_ACTIVE: use the configured MAC address
+ *      and ACK incoming unicast packets.
  *
  * @__NL80211_MNTR_FLAG_AFTER_LAST: internal use
  * @NL80211_MNTR_FLAG_MAX: highest possible monitor flag
@@ -2424,6 +2441,7 @@ enum nl80211_mntr_flags {
         NL80211_MNTR_FLAG_CONTROL,
         NL80211_MNTR_FLAG_OTHER_BSS,
         NL80211_MNTR_FLAG_COOK_FRAMES,
+        NL80211_MNTR_FLAG_ACTIVE,
 
         /* keep last */
         __NL80211_MNTR_FLAG_AFTER_LAST,
@@ -2637,6 +2655,10 @@ enum nl80211_meshconf_params {
  * @NL80211_MESH_SETUP_USERSPACE_MPM: Enable this option if userspace will
  *      implement an MPM which handles peer allocation and state.
  *
+ * @NL80211_MESH_SETUP_AUTH_PROTOCOL: Inform the kernel of the authentication
+ *      method (u8, as defined in IEEE 8.4.2.100.6, e.g. 0x1 for SAE).
+ *      Default is no authentication method required.
+ *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  *
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -2650,6 +2672,7 @@ enum nl80211_mesh_setup_params {
         NL80211_MESH_SETUP_USERSPACE_AMPE,
         NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC,
         NL80211_MESH_SETUP_USERSPACE_MPM,
+        NL80211_MESH_SETUP_AUTH_PROTOCOL,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
@@ -3575,6 +3598,7 @@ enum nl80211_feature_flags {
         NL80211_FEATURE_ADVERTISE_CHAN_LIMITS           = 1 << 14,
         NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
         NL80211_FEATURE_USERSPACE_MPM                   = 1 << 16,
+        NL80211_FEATURE_ACTIVE_MONITOR                  = 1 << 17,
 };
 
 /**
diff --git a/net/mac80211/aes_ccm.c b/net/mac80211/aes_ccm.c
index 0785e95c9924..be7614b9ed27 100644
--- a/net/mac80211/aes_ccm.c
+++ b/net/mac80211/aes_ccm.c
@@ -85,7 +85,7 @@ void ieee80211_aes_ccm_encrypt(struct crypto_cipher *tfm, u8 *scratch,
                         *cpos++ = *pos++ ^ e[i];
         }
 
-        for (i = 0; i < CCMP_MIC_LEN; i++)
+        for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++)
                 mic[i] = b[i] ^ s_0[i];
 }
 
@@ -123,7 +123,7 @@ int ieee80211_aes_ccm_decrypt(struct crypto_cipher *tfm, u8 *scratch,
                 crypto_cipher_encrypt_one(tfm, a, a);
         }
 
-        for (i = 0; i < CCMP_MIC_LEN; i++) {
+        for (i = 0; i < IEEE80211_CCMP_MIC_LEN; i++) {
                 if ((mic[i] ^ s_0[i]) != a[i])
                         return -1;
         }
@@ -138,7 +138,7 @@ struct crypto_cipher *ieee80211_aes_key_setup_encrypt(const u8 key[])
 
         tfm = crypto_alloc_cipher("aes", 0, CRYPTO_ALG_ASYNC);
         if (!IS_ERR(tfm))
-                crypto_cipher_setkey(tfm, key, ALG_CCMP_KEY_LEN);
+                crypto_cipher_setkey(tfm, key, WLAN_KEY_LEN_CCMP);
 
         return tfm;
 }
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 1a89c80e6407..30622101d3b5 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -73,16 +73,19 @@ static int ieee80211_change_iface(struct wiphy *wiphy,
                 struct ieee80211_local *local = sdata->local;
 
                 if (ieee80211_sdata_running(sdata)) {
+                        u32 mask = MONITOR_FLAG_COOK_FRAMES |
+                                   MONITOR_FLAG_ACTIVE;
+
                         /*
-                         * Prohibit MONITOR_FLAG_COOK_FRAMES to be
-                         * changed while the interface is up.
+                         * Prohibit MONITOR_FLAG_COOK_FRAMES and
+                         * MONITOR_FLAG_ACTIVE to be changed while the
+                         * interface is up.
                          * Else we would need to add a lot of cruft
                          * to update everything:
                          *      cooked_mntrs, monitor and all fif_* counters
                          *      reconfigure hardware
                          */
-                        if ((*flags & MONITOR_FLAG_COOK_FRAMES) !=
-                            (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES))
+                        if ((*flags & mask) != (sdata->u.mntr_flags & mask))
                                 return -EBUSY;
 
                         ieee80211_adjust_monitor_flags(sdata, -1);
@@ -444,7 +447,7 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
         struct ieee80211_local *local = sdata->local;
         struct timespec uptime;
         u64 packets = 0;
-        int ac;
+        int i, ac;
 
         sinfo->generation = sdata->local->sta_generation;
 
@@ -488,6 +491,17 @@ static void sta_set_sinfo(struct sta_info *sta, struct station_info *sinfo)
                         sinfo->signal = (s8)sta->last_signal;
                 sinfo->signal_avg = (s8) -ewma_read(&sta->avg_signal);
         }
+        if (sta->chains) {
+                sinfo->filled |= STATION_INFO_CHAIN_SIGNAL |
+                                 STATION_INFO_CHAIN_SIGNAL_AVG;
+
+                sinfo->chains = sta->chains;
+                for (i = 0; i < ARRAY_SIZE(sinfo->chain_signal); i++) {
+                        sinfo->chain_signal[i] = sta->chain_signal_last[i];
+                        sinfo->chain_signal_avg[i] =
+                                (s8) -ewma_read(&sta->chain_signal_avg[i]);
+                }
+        }
 
         sta_set_rate_info_tx(sta, &sta->last_tx_rate, &sinfo->txrate);
         sta_set_rate_info_rx(sta, &sinfo->rxrate);
@@ -728,7 +742,7 @@ static void ieee80211_get_et_strings(struct wiphy *wiphy,
 
         if (sset == ETH_SS_STATS) {
                 sz_sta_stats = sizeof(ieee80211_gstrings_sta_stats);
-                memcpy(data, *ieee80211_gstrings_sta_stats, sz_sta_stats);
+                memcpy(data, ieee80211_gstrings_sta_stats, sz_sta_stats);
         }
         drv_get_et_strings(sdata, sset, &(data[sz_sta_stats]));
 }
@@ -1735,6 +1749,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
         ifmsh->user_mpm = setup->user_mpm;
+        ifmsh->mesh_auth_id = setup->auth_id;
         ifmsh->security = IEEE80211_MESH_SEC_NONE;
         if (setup->is_authenticated)
                 ifmsh->security |= IEEE80211_MESH_SEC_AUTHED;
@@ -2306,7 +2321,7 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
         enum ieee80211_smps_mode old_req;
         int err;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        lockdep_assert_held(&sdata->wdev.mtx);
 
         old_req = sdata->u.mgd.req_smps;
         sdata->u.mgd.req_smps = smps_mode;
@@ -2363,9 +2378,9 @@ static int ieee80211_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
         local->dynamic_ps_forced_timeout = timeout;
 
         /* no change, but if automatic follow powersave */
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         __ieee80211_request_smps(sdata, sdata->u.mgd.req_smps);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 
         if (local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_PS)
                 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_PS);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 14abcf44f974..cafe614ef93d 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -228,9 +228,9 @@ static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
         if (sdata->vif.type != NL80211_IFTYPE_STATION)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         err = __ieee80211_request_smps(sdata, smps_mode);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 
         return err;
 }
@@ -313,16 +313,16 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
         case NL80211_IFTYPE_STATION:
                 fc |= cpu_to_le16(IEEE80211_FCTL_TODS);
                 /* BSSID SA DA */
-                mutex_lock(&sdata->u.mgd.mtx);
+                sdata_lock(sdata);
                 if (!sdata->u.mgd.associated) {
-                        mutex_unlock(&sdata->u.mgd.mtx);
+                        sdata_unlock(sdata);
                         dev_kfree_skb(skb);
                         return -ENOTCONN;
                 }
                 memcpy(hdr->addr1, sdata->u.mgd.associated->bssid, ETH_ALEN);
                 memcpy(hdr->addr2, sdata->vif.addr, ETH_ALEN);
                 memcpy(hdr->addr3, addr, ETH_ALEN);
-                mutex_unlock(&sdata->u.mgd.mtx);
+                sdata_unlock(sdata);
                 break;
         default:
                 dev_kfree_skb(skb);
@@ -471,6 +471,8 @@ __IEEE80211_IF_FILE_W(tsf);
 IEEE80211_IF_FILE(peer, u.wds.remote_addr, MAC);
 
 #ifdef CONFIG_MAC80211_MESH
+IEEE80211_IF_FILE(estab_plinks, u.mesh.estab_plinks, ATOMIC);
+
 /* Mesh stats attributes */
 IEEE80211_IF_FILE(fwded_mcast, u.mesh.mshstats.fwded_mcast, DEC);
 IEEE80211_IF_FILE(fwded_unicast, u.mesh.mshstats.fwded_unicast, DEC);
@@ -480,7 +482,6 @@ IEEE80211_IF_FILE(dropped_frames_congestion,
                   u.mesh.mshstats.dropped_frames_congestion, DEC);
 IEEE80211_IF_FILE(dropped_frames_no_route,
                   u.mesh.mshstats.dropped_frames_no_route, DEC);
-IEEE80211_IF_FILE(estab_plinks, u.mesh.estab_plinks, ATOMIC);
 
 /* Mesh parameters */
 IEEE80211_IF_FILE(dot11MeshMaxRetries,
@@ -583,6 +584,7 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 static void add_mesh_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD_MODE(tsf, 0600);
+        DEBUGFS_ADD_MODE(estab_plinks, 0400);
 }
 
 static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
@@ -598,7 +600,6 @@ static void add_mesh_stats(struct ieee80211_sub_if_data *sdata)
         MESHSTATS_ADD(dropped_frames_ttl);
         MESHSTATS_ADD(dropped_frames_no_route);
         MESHSTATS_ADD(dropped_frames_congestion);
-        MESHSTATS_ADD(estab_plinks);
 #undef MESHSTATS_ADD
 }
 
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index 169664c122e2..b931c96a596f 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -146,7 +146,8 @@ static inline int drv_add_interface(struct ieee80211_local *local,
 
         if (WARN_ON(sdata->vif.type == NL80211_IFTYPE_AP_VLAN ||
                     (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
-                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF))))
+                     !(local->hw.flags & IEEE80211_HW_WANT_MONITOR_VIF) &&
+                     !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))))
                 return -EINVAL;
 
         trace_drv_add_interface(local, sdata);
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index af8cee06e4f3..75dff338f581 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -429,9 +429,9 @@ void ieee80211_request_smps_work(struct work_struct *work)
                 container_of(work, struct ieee80211_sub_if_data,
                              u.mgd.request_smps_work);
 
-        mutex_lock(&sdata->u.mgd.mtx);
+        sdata_lock(sdata);
         __ieee80211_request_smps(sdata, sdata->u.mgd.driver_smps_mode);
-        mutex_unlock(&sdata->u.mgd.mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_request_smps(struct ieee80211_vif *vif,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 170f9a7fa319..caa4b4f7f6e4 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -54,7 +54,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         int frame_len;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         /* Reset own TSF to allow time synchronization work. */
         drv_reset_tsf(local, sdata);
@@ -74,7 +74,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         }
 
         presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&ifibss->mtx));
+                                          lockdep_is_held(&sdata->wdev.mtx));
         rcu_assign_pointer(ifibss->presp, NULL);
         if (presp)
                 kfree_rcu(presp, rcu_head);
@@ -263,7 +263,7 @@ static void ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
         const struct cfg80211_bss_ies *ies;
         u64 tsf;
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         if (beacon_int < 10)
                 beacon_int = 10;
@@ -341,6 +341,7 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
         int band;
 
         /*
@@ -380,8 +381,9 @@ ieee80211_ibss_add_sta(struct ieee80211_sub_if_data *sdata,
         sta->last_rx = jiffies;
 
         /* make sure mandatory rates are always added */
+        sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
+                        ieee80211_mandatory_rates(sband);
 
         return ieee80211_ibss_finish_sta(sta, auth);
 }
@@ -408,7 +410,7 @@ static void ieee80211_rx_mgmt_auth_ibss(struct ieee80211_sub_if_data *sdata,
         struct sta_info *sta;
         u8 deauth_frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 6)
                 return;
@@ -492,7 +494,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
                                 prev_rates = sta->sta.supp_rates[band];
                                 /* make sure mandatory rates are always added */
                                 sta->sta.supp_rates[band] = supp_rates |
-                                        ieee80211_mandatory_rates(local, band);
+                                        ieee80211_mandatory_rates(sband);
 
                                 if (sta->sta.supp_rates[band] != prev_rates) {
                                         ibss_dbg(sdata,
@@ -624,6 +626,7 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         struct sta_info *sta;
         struct ieee80211_chanctx_conf *chanctx_conf;
+        struct ieee80211_supported_band *sband;
         int band;
 
         /*
@@ -658,8 +661,9 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
         sta->last_rx = jiffies;
 
         /* make sure mandatory rates are always added */
+        sband = local->hw.wiphy->bands[band];
         sta->sta.supp_rates[band] = supp_rates |
-                        ieee80211_mandatory_rates(local, band);
+                        ieee80211_mandatory_rates(sband);
 
         spin_lock(&ifibss->incomplete_lock);
         list_add(&sta->list, &ifibss->incomplete_stations);
@@ -673,7 +677,7 @@ static int ieee80211_sta_active_ibss(struct ieee80211_sub_if_data *sdata)
         int active = 0;
         struct sta_info *sta;
 
-        lockdep_assert_held(&sdata->u.ibss.mtx);
+        sdata_assert_lock(sdata);
 
         rcu_read_lock();
 
@@ -699,7 +703,7 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         mod_timer(&ifibss->timer,
                   round_jiffies(jiffies + IEEE80211_IBSS_MERGE_INTERVAL));
@@ -730,7 +734,7 @@ static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
         u16 capability;
         int i;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         if (ifibss->fixed_bssid) {
                 memcpy(bssid, ifibss->bssid, ETH_ALEN);
@@ -773,7 +777,7 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
         int active_ibss;
         u16 capability;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         active_ibss = ieee80211_sta_active_ibss(sdata);
         ibss_dbg(sdata, "sta_find_ibss (active_ibss=%d)\n", active_ibss);
@@ -843,10 +847,10 @@ static void ieee80211_rx_mgmt_probe_req(struct ieee80211_sub_if_data *sdata,
         struct beacon_data *presp;
         u8 *pos, *end;
 
-        lockdep_assert_held(&ifibss->mtx);
+        sdata_assert_lock(sdata);
 
         presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&ifibss->mtx));
+                                          lockdep_is_held(&sdata->wdev.mtx));
 
         if (ifibss->state != IEEE80211_IBSS_MLME_JOINED ||
             len < 24 + 2 || !presp)
@@ -930,7 +934,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        mutex_lock(&sdata->u.ibss.mtx);
+        sdata_lock(sdata);
 
         if (!sdata->u.ibss.ssid_len)
                 goto mgmt_out; /* not ready to merge yet */
@@ -953,7 +957,7 @@ void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         }
 
  mgmt_out:
-        mutex_unlock(&sdata->u.ibss.mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
@@ -961,7 +965,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
         struct sta_info *sta;
 
-        mutex_lock(&ifibss->mtx);
+        sdata_lock(sdata);
 
         /*
          * Work could be scheduled after scan or similar
@@ -997,7 +1001,7 @@ void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata)
         }
 
  out:
-        mutex_unlock(&ifibss->mtx);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_ibss_timer(unsigned long data)
@@ -1014,7 +1018,6 @@ void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 
         setup_timer(&ifibss->timer, ieee80211_ibss_timer,
                     (unsigned long) sdata);
-        mutex_init(&ifibss->mtx);
         INIT_LIST_HEAD(&ifibss->incomplete_stations);
         spin_lock_init(&ifibss->incomplete_lock);
 }
@@ -1041,8 +1044,6 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
 {
         u32 changed = 0;
 
-        mutex_lock(&sdata->u.ibss.mtx);
-
         if (params->bssid) {
                 memcpy(sdata->u.ibss.bssid, params->bssid, ETH_ALEN);
                 sdata->u.ibss.fixed_bssid = true;
@@ -1075,8 +1076,6 @@ int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
         memcpy(sdata->u.ibss.ssid, params->ssid, params->ssid_len);
         sdata->u.ibss.ssid_len = params->ssid_len;
 
-        mutex_unlock(&sdata->u.ibss.mtx);
-
         /*
          * 802.11n-2009 9.13.3.1: In an IBSS, the HT Protection field is
          * reserved, but an HT STA shall protect HT transmissions as though
@@ -1112,8 +1111,6 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         struct sta_info *sta;
         struct beacon_data *presp;
 
-        mutex_lock(&sdata->u.ibss.mtx);
-
         active_ibss = ieee80211_sta_active_ibss(sdata);
 
         if (!active_ibss && !is_zero_ether_addr(ifibss->bssid)) {
@@ -1157,7 +1154,7 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
         /* remove beacon */
         kfree(sdata->u.ibss.ie);
         presp = rcu_dereference_protected(ifibss->presp,
-                                          lockdep_is_held(&sdata->u.ibss.mtx));
+                                          lockdep_is_held(&sdata->wdev.mtx));
         RCU_INIT_POINTER(sdata->u.ibss.presp, NULL);
         sdata->vif.bss_conf.ibss_joined = false;
         sdata->vif.bss_conf.ibss_creator = false;
@@ -1173,7 +1170,5 @@ int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata)
 
         del_timer_sync(&sdata->u.ibss.timer);
 
-        mutex_unlock(&sdata->u.ibss.mtx);
-
         return 0;
 }
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 44be28cfc6c4..9eed6f1d1614 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -394,7 +394,6 @@ struct ieee80211_if_managed {
         bool nullfunc_failed;
         bool connection_loss;
 
-        struct mutex mtx;
         struct cfg80211_bss *associated;
         struct ieee80211_mgd_auth_data *auth_data;
         struct ieee80211_mgd_assoc_data *assoc_data;
@@ -488,8 +487,6 @@ struct ieee80211_if_managed {
 struct ieee80211_if_ibss {
         struct timer_list timer;
 
-        struct mutex mtx;
-
         unsigned long last_scan_completed;
 
         u32 basic_rates;
@@ -580,8 +577,6 @@ struct ieee80211_if_mesh {
         bool accepting_plinks;
         int num_gates;
         struct beacon_data __rcu *beacon;
-        /* just protects beacon updates for now */
-        struct mutex mtx;
         const u8 *ie;
         u8 ie_len;
         enum {
@@ -778,6 +773,26 @@ struct ieee80211_sub_if_data *vif_to_sdata(struct ieee80211_vif *p)
         return container_of(p, struct ieee80211_sub_if_data, vif);
 }
 
+static inline void sdata_lock(struct ieee80211_sub_if_data *sdata)
+        __acquires(&sdata->wdev.mtx)
+{
+        mutex_lock(&sdata->wdev.mtx);
+        __acquire(&sdata->wdev.mtx);
+}
+
+static inline void sdata_unlock(struct ieee80211_sub_if_data *sdata)
+        __releases(&sdata->wdev.mtx)
+{
+        mutex_unlock(&sdata->wdev.mtx);
+        __release(&sdata->wdev.mtx);
+}
+
+static inline void
+sdata_assert_lock(struct ieee80211_sub_if_data *sdata)
+{
+        lockdep_assert_held(&sdata->wdev.mtx);
+}
+
 static inline enum ieee80211_band
 ieee80211_get_sdata_band(struct ieee80211_sub_if_data *sdata)
 {
@@ -1506,9 +1521,6 @@ static inline void ieee802_11_parse_elems(u8 *start, size_t len, bool action,
         ieee802_11_parse_elems_crc(start, len, action, elems, 0, 0);
 }
 
-u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
-                              enum ieee80211_band band);
-
 void ieee80211_dynamic_ps_enable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_disable_work(struct work_struct *work);
 void ieee80211_dynamic_ps_timer(unsigned long data);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 7c3ba8628d4e..cc117591f678 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -159,7 +159,8 @@ static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
-static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr)
+static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr,
+                                bool check_dup)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_sub_if_data *iter;
@@ -180,13 +181,16 @@ static int ieee80211_verify_mac(struct ieee80211_sub_if_data *sdata, u8 *addr)
                 ((u64)m[2] << 3*8) | ((u64)m[3] << 2*8) |
                 ((u64)m[4] << 1*8) | ((u64)m[5] << 0*8);
 
+        if (!check_dup)
+                return ret;
 
         mutex_lock(&local->iflist_mtx);
         list_for_each_entry(iter, &local->interfaces, list) {
                 if (iter == sdata)
                         continue;
 
-                if (iter->vif.type == NL80211_IFTYPE_MONITOR)
+                if (iter->vif.type == NL80211_IFTYPE_MONITOR &&
+                    !(iter->u.mntr_flags & MONITOR_FLAG_ACTIVE))
                         continue;
 
                 m = iter->vif.addr;
@@ -208,12 +212,17 @@ static int ieee80211_change_mac(struct net_device *dev, void *addr)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct sockaddr *sa = addr;
+        bool check_dup = true;
         int ret;
 
         if (ieee80211_sdata_running(sdata))
                 return -EBUSY;
 
-        ret = ieee80211_verify_mac(sdata, sa->sa_data);
+        if (sdata->vif.type == NL80211_IFTYPE_MONITOR &&
+            !(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                check_dup = false;
+
+        ret = ieee80211_verify_mac(sdata, sa->sa_data, check_dup);
         if (ret)
                 return ret;
 
@@ -545,7 +554,11 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                         break;
                 }
 
-                if (local->monitors == 0 && local->open_count == 0) {
+                if (sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE) {
+                        res = drv_add_interface(local, sdata);
+                        if (res)
+                                goto err_stop;
+                } else if (local->monitors == 0 && local->open_count == 0) {
                         res = ieee80211_add_virtual_monitor(local);
                         if (res)
                                 goto err_stop;
@@ -923,7 +936,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 mutex_lock(&local->mtx);
                 ieee80211_recalc_idle(local);
                 mutex_unlock(&local->mtx);
-                break;
+
+                if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                        break;
+
+                /* fall through */
         default:
                 if (going_down)
                         drv_remove_interface(local, sdata);
@@ -1072,7 +1089,7 @@ static const struct net_device_ops ieee80211_monitorif_ops = {
         .ndo_start_xmit         = ieee80211_monitor_start_xmit,
         .ndo_set_rx_mode        = ieee80211_set_multicast_list,
         .ndo_change_mtu         = ieee80211_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_set_mac_address    = ieee80211_change_mac,
         .ndo_select_queue       = ieee80211_monitor_select_queue,
 };
 
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index 67059b88fea5..e39cc91d0cf1 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -335,12 +335,12 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
         switch (cipher) {
         case WLAN_CIPHER_SUITE_WEP40:
         case WLAN_CIPHER_SUITE_WEP104:
-                key->conf.iv_len = WEP_IV_LEN;
-                key->conf.icv_len = WEP_ICV_LEN;
+                key->conf.iv_len = IEEE80211_WEP_IV_LEN;
+                key->conf.icv_len = IEEE80211_WEP_ICV_LEN;
                 break;
         case WLAN_CIPHER_SUITE_TKIP:
-                key->conf.iv_len = TKIP_IV_LEN;
-                key->conf.icv_len = TKIP_ICV_LEN;
+                key->conf.iv_len = IEEE80211_TKIP_IV_LEN;
+                key->conf.icv_len = IEEE80211_TKIP_ICV_LEN;
                 if (seq) {
                         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
                                 key->u.tkip.rx[i].iv32 =
@@ -352,13 +352,13 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 spin_lock_init(&key->u.tkip.txlock);
                 break;
         case WLAN_CIPHER_SUITE_CCMP:
-                key->conf.iv_len = CCMP_HDR_LEN;
-                key->conf.icv_len = CCMP_MIC_LEN;
+                key->conf.iv_len = IEEE80211_CCMP_HDR_LEN;
+                key->conf.icv_len = IEEE80211_CCMP_MIC_LEN;
                 if (seq) {
                         for (i = 0; i < IEEE80211_NUM_TIDS + 1; i++)
-                                for (j = 0; j < CCMP_PN_LEN; j++)
+                                for (j = 0; j < IEEE80211_CCMP_PN_LEN; j++)
                                         key->u.ccmp.rx_pn[i][j] =
-                                                seq[CCMP_PN_LEN - j - 1];
+                                                seq[IEEE80211_CCMP_PN_LEN - j - 1];
                 }
                 /*
                  * Initialize AES key state here as an optimization so that
@@ -375,9 +375,9 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
                 key->conf.iv_len = 0;
                 key->conf.icv_len = sizeof(struct ieee80211_mmie);
                 if (seq)
-                        for (j = 0; j < CMAC_PN_LEN; j++)
+                        for (j = 0; j < IEEE80211_CMAC_PN_LEN; j++)
                                 key->u.aes_cmac.rx_pn[j] =
-                                        seq[CMAC_PN_LEN - j - 1];
+                                        seq[IEEE80211_CMAC_PN_LEN - j - 1];
                 /*
                  * Initialize AES key state here as an optimization so that
                  * it does not need to be initialized for every packet.
@@ -740,13 +740,13 @@ void ieee80211_get_key_rx_seq(struct ieee80211_key_conf *keyconf,
                         pn = key->u.ccmp.rx_pn[IEEE80211_NUM_TIDS];
                 else
                         pn = key->u.ccmp.rx_pn[tid];
-                memcpy(seq->ccmp.pn, pn, CCMP_PN_LEN);
+                memcpy(seq->ccmp.pn, pn, IEEE80211_CCMP_PN_LEN);
                 break;
         case WLAN_CIPHER_SUITE_AES_CMAC:
                 if (WARN_ON(tid != 0))
                         return;
                 pn = key->u.aes_cmac.rx_pn;
-                memcpy(seq->aes_cmac.pn, pn, CMAC_PN_LEN);
+                memcpy(seq->aes_cmac.pn, pn, IEEE80211_CMAC_PN_LEN);
                 break;
         }
 }
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index e8de3e6d7804..036d57e76a5e 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -19,17 +19,6 @@
 #define NUM_DEFAULT_KEYS 4
 #define NUM_DEFAULT_MGMT_KEYS 2
 
-#define WEP_IV_LEN              4
-#define WEP_ICV_LEN             4
-#define ALG_CCMP_KEY_LEN        16
-#define CCMP_HDR_LEN            8
-#define CCMP_MIC_LEN            8
-#define CCMP_TK_LEN             16
-#define CCMP_PN_LEN             6
-#define TKIP_IV_LEN             8
-#define TKIP_ICV_LEN            4
-#define CMAC_PN_LEN             6
-
 struct ieee80211_local;
 struct ieee80211_sub_if_data;
 struct sta_info;
@@ -93,13 +82,13 @@ struct ieee80211_key {
                          * frames and the last counter is used with Robust
                          * Management frames.
                          */
-                        u8 rx_pn[IEEE80211_NUM_TIDS + 1][CCMP_PN_LEN];
+                        u8 rx_pn[IEEE80211_NUM_TIDS + 1][IEEE80211_CCMP_PN_LEN];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCCMPReplays */
                 } ccmp;
                 struct {
                         atomic64_t tx_pn;
-                        u8 rx_pn[CMAC_PN_LEN];
+                        u8 rx_pn[IEEE80211_CMAC_PN_LEN];
                         struct crypto_cipher *tfm;
                         u32 replays; /* dot11RSNAStatsCMACReplays */
                         u32 icverrors; /* dot11RSNAStatsCMACICVErrors */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 8a7bfc47d577..1998f1475267 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -331,7 +331,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
                 return NOTIFY_DONE;
 
         ifmgd = &sdata->u.mgd;
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         /* Copy the addresses to the bss_conf list */
         ifa = idev->ifa_list;
@@ -349,7 +349,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
                 ieee80211_bss_info_change_notify(sdata,
                                                  BSS_CHANGED_ARP_FILTER);
 
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 
         return NOTIFY_DONE;
 }
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 6952760881c8..b3d1fdd46368 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -161,8 +161,11 @@ void mesh_sta_cleanup(struct sta_info *sta)
                 del_timer_sync(&sta->plink_timer);
         }
 
-        if (changed)
+        if (changed) {
+                sdata_lock(sdata);
                 ieee80211_mbss_info_change_notify(sdata, changed);
+                sdata_unlock(sdata);
+        }
 }
 
 int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
@@ -577,7 +580,9 @@ static void ieee80211_mesh_housekeeping(struct ieee80211_sub_if_data *sdata)
         mesh_path_expire(sdata);
 
         changed = mesh_accept_plinks_update(sdata);
+        sdata_lock(sdata);
         ieee80211_mbss_info_change_notify(sdata, changed);
+        sdata_unlock(sdata);
 
         mod_timer(&ifmsh->housekeeping_timer,
                   round_jiffies(jiffies +
@@ -697,25 +702,21 @@ out_free:
 }
 
 static int
-ieee80211_mesh_rebuild_beacon(struct ieee80211_if_mesh *ifmsh)
+ieee80211_mesh_rebuild_beacon(struct ieee80211_sub_if_data *sdata)
 {
         struct beacon_data *old_bcn;
         int ret;
 
-        mutex_lock(&ifmsh->mtx);
-
-        old_bcn = rcu_dereference_protected(ifmsh->beacon,
-                                            lockdep_is_held(&ifmsh->mtx));
-        ret = ieee80211_mesh_build_beacon(ifmsh);
+        old_bcn = rcu_dereference_protected(sdata->u.mesh.beacon,
+                                            lockdep_is_held(&sdata->wdev.mtx));
+        ret = ieee80211_mesh_build_beacon(&sdata->u.mesh);
         if (ret)
                 /* just reuse old beacon */
-                goto out;
+                return ret;
 
         if (old_bcn)
                 kfree_rcu(old_bcn, rcu_head);
-out:
-        mutex_unlock(&ifmsh->mtx);
-        return ret;
+        return 0;
 }
 
 void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
@@ -726,7 +727,7 @@ void ieee80211_mbss_info_change_notify(struct ieee80211_sub_if_data *sdata,
                         BSS_CHANGED_HT |
                         BSS_CHANGED_BASIC_RATES |
                         BSS_CHANGED_BEACON_INT)))
-                if (ieee80211_mesh_rebuild_beacon(&sdata->u.mesh))
+                if (ieee80211_mesh_rebuild_beacon(sdata))
                         return;
         ieee80211_bss_info_change_notify(sdata, changed);
 }
@@ -741,6 +742,8 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
                       BSS_CHANGED_BASIC_RATES |
                       BSS_CHANGED_BEACON_INT;
         enum ieee80211_band band = ieee80211_get_sdata_band(sdata);
+        struct ieee80211_supported_band *sband =
+                                        sdata->local->hw.wiphy->bands[band];
 
         local->fif_other_bss++;
         /* mesh ifaces must set allmulti to forward mcast traffic */
@@ -748,7 +751,6 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         ieee80211_configure_filter(local);
 
         ifmsh->mesh_cc_id = 0;  /* Disabled */
-        ifmsh->mesh_auth_id = 0;        /* Disabled */
         /* register sync ops from extensible synchronization framework */
         ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id);
         ifmsh->adjusting_tbtt = false;
@@ -759,8 +761,7 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.ht_operation_mode =
                                 ifmsh->mshcfg.ht_opmode;
         sdata->vif.bss_conf.enable_beacon = true;
-        sdata->vif.bss_conf.basic_rates =
-                ieee80211_mandatory_rates(local, band);
+        sdata->vif.bss_conf.basic_rates = ieee80211_mandatory_rates(sband);
 
         changed |= ieee80211_mps_local_status_update(sdata);
 
@@ -788,12 +789,12 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
-        mutex_lock(&ifmsh->mtx);
+        sdata_lock(sdata);
         bcn = rcu_dereference_protected(ifmsh->beacon,
-                                        lockdep_is_held(&ifmsh->mtx));
+                                        lockdep_is_held(&sdata->wdev.mtx));
         rcu_assign_pointer(ifmsh->beacon, NULL);
         kfree_rcu(bcn, rcu_head);
-        mutex_unlock(&ifmsh->mtx);
+        sdata_unlock(sdata);
 
         /* flush STAs and mpaths on this iface */
         sta_info_flush(sdata);
@@ -1041,7 +1042,6 @@ void ieee80211_mesh_init_sdata(struct ieee80211_sub_if_data *sdata)
         spin_lock_init(&ifmsh->mesh_preq_queue_lock);
         spin_lock_init(&ifmsh->sync_offset_lock);
         RCU_INIT_POINTER(ifmsh->beacon, NULL);
-        mutex_init(&ifmsh->mtx);
 
         sdata->vif.bss_conf.bssid = zero_addr;
 }
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 09bebed99416..6c4da99bc4fb 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -517,7 +517,9 @@ void mesh_neighbour_update(struct ieee80211_sub_if_data *sdata,
         ieee80211_mps_frame_release(sta, elems);
 out:
         rcu_read_unlock();
+        sdata_lock(sdata);
         ieee80211_mbss_info_change_notify(sdata, changed);
+        sdata_unlock(sdata);
 }
 
 static void mesh_plink_timer(unsigned long data)
@@ -1068,6 +1070,9 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
 
         rcu_read_unlock();
 
-        if (changed)
+        if (changed) {
+                sdata_lock(sdata);
                 ieee80211_mbss_info_change_notify(sdata, changed);
+                sdata_unlock(sdata);
+        }
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a8c2130c8ba4..f44f4caa69ee 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -91,41 +91,6 @@ MODULE_PARM_DESC(probe_wait_ms,
 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
 
 /*
- * All cfg80211 functions have to be called outside a locked
- * section so that they can acquire a lock themselves... This
- * is much simpler than queuing up things in cfg80211, but we
- * do need some indirection for that here.
- */
-enum rx_mgmt_action {
-        /* no action required */
-        RX_MGMT_NONE,
-
-        /* caller must call cfg80211_send_deauth() */
-        RX_MGMT_CFG80211_DEAUTH,
-
-        /* caller must call cfg80211_send_disassoc() */
-        RX_MGMT_CFG80211_DISASSOC,
-
-        /* caller must call cfg80211_send_rx_auth() */
-        RX_MGMT_CFG80211_RX_AUTH,
-
-        /* caller must call cfg80211_send_rx_assoc() */
-        RX_MGMT_CFG80211_RX_ASSOC,
-
-        /* caller must call cfg80211_send_assoc_timeout() */
-        RX_MGMT_CFG80211_ASSOC_TIMEOUT,
-
-        /* used when a processed beacon causes a deauth */
-        RX_MGMT_CFG80211_TX_DEAUTH,
-};
-
-/* utils */
-static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
-{
-        lockdep_assert_held(&ifmgd->mtx);
-}
-
-/*
  * We can have multiple work items (and connection probing)
  * scheduling this timer, but we need to take care to only
  * reschedule it when it should fire _earlier_ than it was
@@ -135,13 +100,14 @@ static inline void ASSERT_MGD_MTX(struct ieee80211_if_managed *ifmgd)
  * has happened -- the work that runs from this timer will
  * do that.
  */
-static void run_again(struct ieee80211_if_managed *ifmgd, unsigned long timeout)
+static void run_again(struct ieee80211_sub_if_data *sdata,
+                      unsigned long timeout)
 {
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
-        if (!timer_pending(&ifmgd->timer) ||
-            time_before(timeout, ifmgd->timer.expires))
-                mod_timer(&ifmgd->timer, timeout);
+        if (!timer_pending(&sdata->u.mgd.timer) ||
+            time_before(timeout, sdata->u.mgd.timer.expires))
+                mod_timer(&sdata->u.mgd.timer, timeout);
 }
 
 void ieee80211_sta_reset_beacon_monitor(struct ieee80211_sub_if_data *sdata)
@@ -652,7 +618,7 @@ static void ieee80211_send_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_channel *chan;
         u32 rates = 0;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
@@ -962,7 +928,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated)
                 goto out;
 
@@ -985,7 +951,7 @@ static void ieee80211_chswitch_work(struct work_struct *work)
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
  out:
         ifmgd->flags &= ~IEEE80211_STA_CSA_RECEIVED;
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_chswitch_done(struct ieee80211_vif *vif, bool success)
@@ -1036,7 +1002,7 @@ ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
         const struct ieee80211_ht_operation *ht_oper;
         int secondary_channel_offset = -1;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (!cbss)
                 return;
@@ -1390,6 +1356,9 @@ static bool ieee80211_powersave_allowed(struct ieee80211_sub_if_data *sdata)
                           IEEE80211_STA_CONNECTION_POLL))
                 return false;
 
+        if (!sdata->vif.bss_conf.dtim_period)
+                return false;
+
         rcu_read_lock();
         sta = sta_info_get(sdata, mgd->bssid);
         if (sta)
@@ -1842,7 +1811,7 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_local *local = sdata->local;
         u32 changed = 0;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (WARN_ON_ONCE(tx && !frame_buf))
                 return;
@@ -2051,7 +2020,7 @@ static void ieee80211_mgd_probe_ap_send(struct ieee80211_sub_if_data *sdata)
         }
 
         ifmgd->probe_timeout = jiffies + msecs_to_jiffies(probe_wait_ms);
-        run_again(ifmgd, ifmgd->probe_timeout);
+        run_again(sdata, ifmgd->probe_timeout);
         if (sdata->local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)
                 ieee80211_flush_queues(sdata->local, sdata);
 }
@@ -2065,7 +2034,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         if (!ieee80211_sdata_running(sdata))
                 return;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         if (!ifmgd->associated)
                 goto out;
@@ -2119,7 +2088,7 @@ static void ieee80211_mgd_probe_ap(struct ieee80211_sub_if_data *sdata,
         ifmgd->probe_send_count = 0;
         ieee80211_mgd_probe_ap_send(sdata);
  out:
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
@@ -2135,7 +2104,7 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
         if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_STATION))
                 return NULL;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (ifmgd->associated)
                 cbss = ifmgd->associated;
@@ -2168,9 +2137,9 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
 
@@ -2181,13 +2150,9 @@ static void __ieee80211_disconnect(struct ieee80211_sub_if_data *sdata)
         ieee80211_wake_queues_by_reason(&sdata->local->hw,
                                         IEEE80211_MAX_QUEUE_MAP,
                                         IEEE80211_QUEUE_STOP_REASON_CSA);
-        mutex_unlock(&ifmgd->mtx);
 
-        /*
-         * must be outside lock due to cfg80211,
-         * but that's not a problem.
-         */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_beacon_connection_loss_work(struct work_struct *work)
@@ -2254,7 +2219,7 @@ static void ieee80211_destroy_auth_data(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_mgd_auth_data *auth_data = sdata->u.mgd.auth_data;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc) {
                 sta_info_destroy_addr(sdata, auth_data->bss->bssid);
@@ -2295,27 +2260,26 @@ static void ieee80211_auth_challenge(struct ieee80211_sub_if_data *sdata,
                             auth_data->key_idx, tx_flags);
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
-                       struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 bssid[ETH_ALEN];
         u16 auth_alg, auth_transaction, status_code;
         struct sta_info *sta;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 6)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->auth_data || ifmgd->auth_data->done)
-                return RX_MGMT_NONE;
+                return;
 
         memcpy(bssid, ifmgd->auth_data->bss->bssid, ETH_ALEN);
 
         if (!ether_addr_equal(bssid, mgmt->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         auth_alg = le16_to_cpu(mgmt->u.auth.auth_alg);
         auth_transaction = le16_to_cpu(mgmt->u.auth.auth_transaction);
@@ -2327,14 +2291,15 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                            mgmt->sa, auth_alg, ifmgd->auth_data->algorithm,
                            auth_transaction,
                            ifmgd->auth_data->expected_transaction);
-                return RX_MGMT_NONE;
+                return;
         }
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 sdata_info(sdata, "%pM denied authentication (status %d)\n",
                            mgmt->sa, status_code);
                 ieee80211_destroy_auth_data(sdata, false);
-                return RX_MGMT_CFG80211_RX_AUTH;
+                cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, len);
+                return;
         }
 
         switch (ifmgd->auth_data->algorithm) {
@@ -2347,20 +2312,20 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                 if (ifmgd->auth_data->expected_transaction != 4) {
                         ieee80211_auth_challenge(sdata, mgmt, len);
                         /* need another frame */
-                        return RX_MGMT_NONE;
+                        return;
                 }
                 break;
         default:
                 WARN_ONCE(1, "invalid auth alg %d",
                           ifmgd->auth_data->algorithm);
-                return RX_MGMT_NONE;
+                return;
         }
 
         sdata_info(sdata, "authenticated\n");
         ifmgd->auth_data->done = true;
         ifmgd->auth_data->timeout = jiffies + IEEE80211_AUTH_WAIT_ASSOC;
         ifmgd->auth_data->timeout_started = true;
-        run_again(ifmgd, ifmgd->auth_data->timeout);
+        run_again(sdata, ifmgd->auth_data->timeout);
 
         if (ifmgd->auth_data->algorithm == WLAN_AUTH_SAE &&
             ifmgd->auth_data->expected_transaction != 2) {
@@ -2368,7 +2333,8 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
                  * Report auth frame to user space for processing since another
                  * round of Authentication frames is still needed.
                  */
-                return RX_MGMT_CFG80211_RX_AUTH;
+                cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, len);
+                return;
         }
 
         /* move station state to auth */
@@ -2384,30 +2350,29 @@ ieee80211_rx_mgmt_auth(struct ieee80211_sub_if_data *sdata,
         }
         mutex_unlock(&sdata->local->sta_mtx);
 
-        return RX_MGMT_CFG80211_RX_AUTH;
+        cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, len);
+        return;
  out_err:
         mutex_unlock(&sdata->local->sta_mtx);
         /* ignore frame -- wait for timeout */
-        return RX_MGMT_NONE;
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         const u8 *bssid = NULL;
         u16 reason_code;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 2)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         bssid = ifmgd->associated->bssid;
 
@@ -2418,25 +2383,24 @@ ieee80211_rx_mgmt_deauth(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        return RX_MGMT_CFG80211_DEAUTH;
+        cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, len);
 }
 
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
-                           struct ieee80211_mgmt *mgmt, size_t len)
+static void ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
+                                       struct ieee80211_mgmt *mgmt, size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u16 reason_code;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (len < 24 + 2)
-                return RX_MGMT_NONE;
+                return;
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
@@ -2445,7 +2409,7 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_set_disassoc(sdata, 0, 0, false, NULL);
 
-        return RX_MGMT_CFG80211_DISASSOC;
+        cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, len);
 }
 
 static void ieee80211_get_rates(struct ieee80211_supported_band *sband,
@@ -2495,7 +2459,7 @@ static void ieee80211_destroy_assoc_data(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc) {
                 sta_info_destroy_addr(sdata, assoc_data->bss->bssid);
@@ -2676,10 +2640,9 @@ static bool ieee80211_assoc_success(struct ieee80211_sub_if_data *sdata,
         return true;
 }
 
-static enum rx_mgmt_action __must_check
-ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
-                             struct ieee80211_mgmt *mgmt, size_t len,
-                             struct cfg80211_bss **bss)
+static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
+                                         struct ieee80211_mgmt *mgmt,
+                                         size_t len)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_mgd_assoc_data *assoc_data = ifmgd->assoc_data;
@@ -2687,13 +2650,14 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
         struct ieee802_11_elems elems;
         u8 *pos;
         bool reassoc;
+        struct cfg80211_bss *bss;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (!assoc_data)
-                return RX_MGMT_NONE;
+                return;
         if (!ether_addr_equal(assoc_data->bss->bssid, mgmt->bssid))
-                return RX_MGMT_NONE;
+                return;
 
         /*
          * AssocResp and ReassocResp have identical structure, so process both
@@ -2701,7 +2665,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
          */
 
         if (len < 24 + 6)
-                return RX_MGMT_NONE;
+                return;
 
         reassoc = ieee80211_is_reassoc_req(mgmt->frame_control);
         capab_info = le16_to_cpu(mgmt->u.assoc_resp.capab_info);
@@ -2728,22 +2692,23 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 assoc_data->timeout = jiffies + msecs_to_jiffies(ms);
                 assoc_data->timeout_started = true;
                 if (ms > IEEE80211_ASSOC_TIMEOUT)
-                        run_again(ifmgd, assoc_data->timeout);
-                return RX_MGMT_NONE;
+                        run_again(sdata, assoc_data->timeout);
+                return;
         }
 
-        *bss = assoc_data->bss;
+        bss = assoc_data->bss;
 
         if (status_code != WLAN_STATUS_SUCCESS) {
                 sdata_info(sdata, "%pM denied association (code=%d)\n",
                            mgmt->sa, status_code);
                 ieee80211_destroy_assoc_data(sdata, false);
         } else {
-                if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
+                if (!ieee80211_assoc_success(sdata, bss, mgmt, len)) {
                         /* oops -- internal error -- send timeout for now */
                         ieee80211_destroy_assoc_data(sdata, false);
-                        cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
-                        return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
+                        cfg80211_put_bss(sdata->local->hw.wiphy, bss);
+                        cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
+                        return;
                 }
                 sdata_info(sdata, "associated\n");
 
@@ -2755,7 +2720,7 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                 ieee80211_destroy_assoc_data(sdata, true);
         }
 
-        return RX_MGMT_CFG80211_RX_ASSOC;
+        cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, len);
 }
 
 static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
@@ -2769,7 +2734,7 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *channel;
         bool need_ps = false;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         if ((sdata->u.mgd.associated &&
              ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
@@ -2828,7 +2793,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         ifmgd = &sdata->u.mgd;
 
-        ASSERT_MGD_MTX(ifmgd);
+        sdata_assert_lock(sdata);
 
         if (!ether_addr_equal(mgmt->da, sdata->vif.addr))
                 return; /* ignore ProbeResp to foreign address */
@@ -2853,7 +2818,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
                 ifmgd->auth_data->tries = 0;
                 ifmgd->auth_data->timeout = jiffies;
                 ifmgd->auth_data->timeout_started = true;
-                run_again(ifmgd, ifmgd->auth_data->timeout);
+                run_again(sdata, ifmgd->auth_data->timeout);
         }
 }
 
@@ -2878,10 +2843,9 @@ static const u64 care_about_ies =
         (1ULL << WLAN_EID_HT_CAPABILITY) |
         (1ULL << WLAN_EID_HT_OPERATION);
 
-static enum rx_mgmt_action
-ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
-                         struct ieee80211_mgmt *mgmt, size_t len,
-                         u8 *deauth_buf, struct ieee80211_rx_status *rx_status)
+static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
+                                     struct ieee80211_mgmt *mgmt, size_t len,
+                                     struct ieee80211_rx_status *rx_status)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_bss_conf *bss_conf = &sdata->vif.bss_conf;
@@ -2896,24 +2860,25 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         u8 erp_value = 0;
         u32 ncrc;
         u8 *bssid;
+        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         /* Process beacon from the current BSS */
         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
         if (baselen > len)
-                return RX_MGMT_NONE;
+                return;
 
         rcu_read_lock();
         chanctx_conf = rcu_dereference(sdata->vif.chanctx_conf);
         if (!chanctx_conf) {
                 rcu_read_unlock();
-                return RX_MGMT_NONE;
+                return;
         }
 
         if (rx_status->freq != chanctx_conf->def.chan->center_freq) {
                 rcu_read_unlock();
-                return RX_MGMT_NONE;
+                return;
         }
         chan = chanctx_conf->def.chan;
         rcu_read_unlock();
@@ -2940,13 +2905,13 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 /* continue assoc process */
                 ifmgd->assoc_data->timeout = jiffies;
                 ifmgd->assoc_data->timeout_started = true;
-                run_again(ifmgd, ifmgd->assoc_data->timeout);
-                return RX_MGMT_NONE;
+                run_again(sdata, ifmgd->assoc_data->timeout);
+                return;
         }
 
         if (!ifmgd->associated ||
             !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
-                return RX_MGMT_NONE;
+                return;
         bssid = ifmgd->associated->bssid;
 
         /* Track average RSSI from the Beacon frames of the current AP */
@@ -3092,7 +3057,7 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
         }
 
         if (ncrc == ifmgd->beacon_crc && ifmgd->beacon_crc_valid)
-                return RX_MGMT_NONE;
+                return;
         ifmgd->beacon_crc = ncrc;
         ifmgd->beacon_crc_valid = true;
 
@@ -3126,6 +3091,7 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 }
 
                 changed |= BSS_CHANGED_DTIM_PERIOD;
+                ieee80211_recalc_ps_vif(sdata);
         }
 
         if (elems.erp_info) {
@@ -3147,7 +3113,9 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH,
                                        WLAN_REASON_DEAUTH_LEAVING,
                                        true, deauth_buf);
-                return RX_MGMT_CFG80211_TX_DEAUTH;
+                cfg80211_send_deauth(sdata->dev, deauth_buf,
+                                     sizeof(deauth_buf));
+                return;
         }
 
         if (sta && elems.opmode_notif)
@@ -3164,19 +3132,13 @@ ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
                                                        elems.pwr_constr_elem);
 
         ieee80211_bss_info_change_notify(sdata, changed);
-
-        return RX_MGMT_NONE;
 }
 
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         struct ieee80211_rx_status *rx_status;
         struct ieee80211_mgmt *mgmt;
-        struct cfg80211_bss *bss = NULL;
-        enum rx_mgmt_action rma = RX_MGMT_NONE;
-        u8 deauth_buf[IEEE80211_DEAUTH_FRAME_LEN];
         u16 fc;
         struct ieee802_11_elems elems;
         int ies_len;
@@ -3185,28 +3147,27 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
         mgmt = (struct ieee80211_mgmt *) skb->data;
         fc = le16_to_cpu(mgmt->frame_control);
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         switch (fc & IEEE80211_FCTL_STYPE) {
         case IEEE80211_STYPE_BEACON:
-                rma = ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len,
-                                               deauth_buf, rx_status);
+                ieee80211_rx_mgmt_beacon(sdata, mgmt, skb->len, rx_status);
                 break;
         case IEEE80211_STYPE_PROBE_RESP:
                 ieee80211_rx_mgmt_probe_resp(sdata, skb);
                 break;
         case IEEE80211_STYPE_AUTH:
-                rma = ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_auth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DEAUTH:
-                rma = ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_deauth(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_DISASSOC:
-                rma = ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
+                ieee80211_rx_mgmt_disassoc(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ASSOC_RESP:
         case IEEE80211_STYPE_REASSOC_RESP:
-                rma = ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len, &bss);
+                ieee80211_rx_mgmt_assoc_resp(sdata, mgmt, skb->len);
                 break;
         case IEEE80211_STYPE_ACTION:
                 if (mgmt->u.action.category == WLAN_CATEGORY_SPECTRUM_MGMT) {
@@ -3252,34 +3213,7 @@ void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                 }
                 break;
         }
-        mutex_unlock(&ifmgd->mtx);
-
-        switch (rma) {
-        case RX_MGMT_NONE:
-                /* no action */
-                break;
-        case RX_MGMT_CFG80211_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_DISASSOC:
-                cfg80211_send_disassoc(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_RX_AUTH:
-                cfg80211_send_rx_auth(sdata->dev, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_RX_ASSOC:
-                cfg80211_send_rx_assoc(sdata->dev, bss, (u8 *)mgmt, skb->len);
-                break;
-        case RX_MGMT_CFG80211_ASSOC_TIMEOUT:
-                cfg80211_send_assoc_timeout(sdata->dev, mgmt->bssid);
-                break;
-        case RX_MGMT_CFG80211_TX_DEAUTH:
-                cfg80211_send_deauth(sdata->dev, deauth_buf,
-                                     sizeof(deauth_buf));
-                break;
-        default:
-                WARN(1, "unexpected: %d", rma);
-        }
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_sta_timer(unsigned long data)
@@ -3293,20 +3227,12 @@ static void ieee80211_sta_timer(unsigned long data)
 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
                                           u8 *bssid, u8 reason, bool tx)
 {
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
                                tx, frame_buf);
-        mutex_unlock(&ifmgd->mtx);
 
-        /*
-         * must be outside lock due to cfg80211,
-         * but that's not a problem.
-         */
         cfg80211_send_deauth(sdata->dev, frame_buf, IEEE80211_DEAUTH_FRAME_LEN);
-
-        mutex_lock(&ifmgd->mtx);
 }
 
 static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
@@ -3316,7 +3242,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgd_auth_data *auth_data = ifmgd->auth_data;
         u32 tx_flags = 0;
 
-        lockdep_assert_held(&ifmgd->mtx);
+        sdata_assert_lock(sdata);
 
         if (WARN_ON_ONCE(!auth_data))
                 return -EINVAL;
@@ -3389,7 +3315,7 @@ static int ieee80211_probe_auth(struct ieee80211_sub_if_data *sdata)
         if (tx_flags == 0) {
                 auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT;
                 ifmgd->auth_data->timeout_started = true;
-                run_again(ifmgd, auth_data->timeout);
+                run_again(sdata, auth_data->timeout);
         } else {
                 auth_data->timeout_started = false;
         }
@@ -3402,7 +3328,7 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_mgd_assoc_data *assoc_data = sdata->u.mgd.assoc_data;
         struct ieee80211_local *local = sdata->local;
 
-        lockdep_assert_held(&sdata->u.mgd.mtx);
+        sdata_assert_lock(sdata);
 
         assoc_data->tries++;
         if (assoc_data->tries > IEEE80211_ASSOC_MAX_TRIES) {
@@ -3426,7 +3352,7 @@ static int ieee80211_do_assoc(struct ieee80211_sub_if_data *sdata)
         if (!(local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS)) {
                 assoc_data->timeout = jiffies + IEEE80211_ASSOC_TIMEOUT;
                 assoc_data->timeout_started = true;
-                run_again(&sdata->u.mgd, assoc_data->timeout);
+                run_again(sdata, assoc_data->timeout);
         } else {
                 assoc_data->timeout_started = false;
         }
@@ -3451,7 +3377,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
 
         if (ifmgd->status_received) {
                 __le16 fc = ifmgd->status_fc;
@@ -3463,7 +3389,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         if (status_acked) {
                                 ifmgd->auth_data->timeout =
                                         jiffies + IEEE80211_AUTH_TIMEOUT_SHORT;
-                                run_again(ifmgd, ifmgd->auth_data->timeout);
+                                run_again(sdata, ifmgd->auth_data->timeout);
                         } else {
                                 ifmgd->auth_data->timeout = jiffies - 1;
                         }
@@ -3474,7 +3400,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                         if (status_acked) {
                                 ifmgd->assoc_data->timeout =
                                         jiffies + IEEE80211_ASSOC_TIMEOUT_SHORT;
-                                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                                run_again(sdata, ifmgd->assoc_data->timeout);
                         } else {
                                 ifmgd->assoc_data->timeout = jiffies - 1;
                         }
@@ -3497,12 +3423,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 
                         ieee80211_destroy_auth_data(sdata, false);
 
-                        mutex_unlock(&ifmgd->mtx);
                         cfg80211_send_auth_timeout(sdata->dev, bssid);
-                        mutex_lock(&ifmgd->mtx);
                 }
         } else if (ifmgd->auth_data && ifmgd->auth_data->timeout_started)
-                run_again(ifmgd, ifmgd->auth_data->timeout);
+                run_again(sdata, ifmgd->auth_data->timeout);
 
         if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started &&
             time_after(jiffies, ifmgd->assoc_data->timeout)) {
@@ -3515,12 +3439,10 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
 
                         ieee80211_destroy_assoc_data(sdata, false);
 
-                        mutex_unlock(&ifmgd->mtx);
                         cfg80211_send_assoc_timeout(sdata->dev, bssid);
-                        mutex_lock(&ifmgd->mtx);
                 }
         } else if (ifmgd->assoc_data && ifmgd->assoc_data->timeout_started)
-                run_again(ifmgd, ifmgd->assoc_data->timeout);
+                run_again(sdata, ifmgd->assoc_data->timeout);
 
         if (ifmgd->flags & (IEEE80211_STA_BEACON_POLL |
                             IEEE80211_STA_CONNECTION_POLL) &&
@@ -3554,7 +3476,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                                         false);
                         }
                 } else if (time_is_after_jiffies(ifmgd->probe_timeout))
-                        run_again(ifmgd, ifmgd->probe_timeout);
+                        run_again(sdata, ifmgd->probe_timeout);
                 else if (local->hw.flags & IEEE80211_HW_REPORTS_TX_ACK_STATUS) {
                         mlme_dbg(sdata,
                                  "Failed to send nullfunc to AP %pM after %dms, disconnecting\n",
@@ -3583,7 +3505,7 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata)
                 }
         }
 
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 static void ieee80211_sta_bcn_mon_timer(unsigned long data)
@@ -3644,9 +3566,9 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (!ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
 
@@ -3657,10 +3579,10 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
                                               ifmgd->associated->bssid,
                                               WLAN_REASON_UNSPECIFIED,
                                               true);
-                mutex_unlock(&ifmgd->mtx);
+                sdata_unlock(sdata);
                 return;
         }
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 #endif
 
@@ -3692,8 +3614,6 @@ void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
         ifmgd->uapsd_max_sp_len = sdata->local->hw.uapsd_max_sp_len;
         ifmgd->p2p_noa_index = -1;
 
-        mutex_init(&ifmgd->mtx);
-
         if (sdata->local->hw.flags & IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS)
                 ifmgd->req_smps = IEEE80211_SMPS_AUTOMATIC;
         else
@@ -4049,8 +3969,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 
         /* try to authenticate/probe */
 
-        mutex_lock(&ifmgd->mtx);
-
         if ((ifmgd->auth_data && !ifmgd->auth_data->done) ||
             ifmgd->assoc_data) {
                 err = -EBUSY;
@@ -4070,8 +3988,8 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
                                        WLAN_REASON_UNSPECIFIED,
                                        false, frame_buf);
 
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       sizeof(frame_buf));
+                cfg80211_send_deauth(sdata->dev, frame_buf,
+                                     sizeof(frame_buf));
         }
 
         sdata_info(sdata, "authenticate with %pM\n", req->bss->bssid);
@@ -4088,8 +4006,7 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
 
         /* hold our own reference */
         cfg80211_ref_bss(local->hw.wiphy, auth_data->bss);
-        err = 0;
-        goto out_unlock;
+        return 0;
 
  err_clear:
         memset(ifmgd->bssid, 0, ETH_ALEN);
@@ -4097,9 +4014,6 @@ int ieee80211_mgd_auth(struct ieee80211_sub_if_data *sdata,
         ifmgd->auth_data = NULL;
  err_free:
         kfree(auth_data);
- out_unlock:
-        mutex_unlock(&ifmgd->mtx);
-
         return err;
 }
 
@@ -4130,8 +4044,6 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         assoc_data->ssid_len = ssidie[1];
         rcu_read_unlock();
 
-        mutex_lock(&ifmgd->mtx);
-
         if (ifmgd->associated) {
                 u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
@@ -4139,8 +4051,8 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                                        WLAN_REASON_UNSPECIFIED,
                                        false, frame_buf);
 
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       sizeof(frame_buf));
+                cfg80211_send_deauth(sdata->dev, frame_buf,
+                                     sizeof(frame_buf));
         }
 
         if (ifmgd->auth_data && !ifmgd->auth_data->done) {
@@ -4334,7 +4246,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         }
         rcu_read_unlock();
 
-        run_again(ifmgd, assoc_data->timeout);
+        run_again(sdata, assoc_data->timeout);
 
         if (bss->corrupt_data) {
                 char *corrupt_type = "data";
@@ -4350,17 +4262,13 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                            corrupt_type);
         }
 
-        err = 0;
-        goto out;
+        return 0;
  err_clear:
         memset(ifmgd->bssid, 0, ETH_ALEN);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BSSID);
         ifmgd->assoc_data = NULL;
  err_free:
         kfree(assoc_data);
- out:
-        mutex_unlock(&ifmgd->mtx);
-
         return err;
 }
 
@@ -4372,8 +4280,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         bool tx = !req->local_state_change;
         bool report_frame = false;
 
-        mutex_lock(&ifmgd->mtx);
-
         sdata_info(sdata,
                    "deauthenticating from %pM by local choice (reason=%d)\n",
                    req->bssid, req->reason_code);
@@ -4385,7 +4291,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                                req->reason_code, tx,
                                                frame_buf);
                 ieee80211_destroy_auth_data(sdata, false);
-                mutex_unlock(&ifmgd->mtx);
 
                 report_frame = true;
                 goto out;
@@ -4397,12 +4302,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                        req->reason_code, tx, frame_buf);
                 report_frame = true;
         }
-        mutex_unlock(&ifmgd->mtx);
 
  out:
         if (report_frame)
-                __cfg80211_send_deauth(sdata->dev, frame_buf,
-                                       IEEE80211_DEAUTH_FRAME_LEN);
+                cfg80211_send_deauth(sdata->dev, frame_buf,
+                                     IEEE80211_DEAUTH_FRAME_LEN);
 
         return 0;
 }
@@ -4414,18 +4318,14 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         u8 bssid[ETH_ALEN];
         u8 frame_buf[IEEE80211_DEAUTH_FRAME_LEN];
 
-        mutex_lock(&ifmgd->mtx);
-
         /*
          * cfg80211 should catch this ... but it's racy since
          * we can receive a disassoc frame, process it, hand it
          * to cfg80211 while that's in a locked section already
          * trying to tell us that the user wants to disconnect.
          */
-        if (ifmgd->associated != req->bss) {
-                mutex_unlock(&ifmgd->mtx);
+        if (ifmgd->associated != req->bss)
                 return -ENOLINK;
-        }
 
         sdata_info(sdata,
                    "disassociating from %pM by local choice (reason=%d)\n",
@@ -4435,10 +4335,9 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
         ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DISASSOC,
                                req->reason_code, !req->local_state_change,
                                frame_buf);
-        mutex_unlock(&ifmgd->mtx);
 
-        __cfg80211_send_disassoc(sdata->dev, frame_buf,
-                                 IEEE80211_DEAUTH_FRAME_LEN);
+        cfg80211_send_disassoc(sdata->dev, frame_buf,
+                               IEEE80211_DEAUTH_FRAME_LEN);
 
         return 0;
 }
@@ -4458,13 +4357,13 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
         cancel_work_sync(&ifmgd->csa_connection_drop_work);
         cancel_work_sync(&ifmgd->chswitch_work);
 
-        mutex_lock(&ifmgd->mtx);
+        sdata_lock(sdata);
         if (ifmgd->assoc_data)
                 ieee80211_destroy_assoc_data(sdata, false);
         if (ifmgd->auth_data)
                 ieee80211_destroy_auth_data(sdata, false);
         del_timer_sync(&ifmgd->timer);
-        mutex_unlock(&ifmgd->mtx);
+        sdata_unlock(sdata);
 }
 
 void ieee80211_cqm_rssi_notify(struct ieee80211_vif *vif,
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 8e2952620256..bdd7b4a719e9 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -258,6 +258,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
         pos += 2;
 
         if (status->flag & RX_FLAG_HT) {
+                unsigned int stbc;
+
                 rthdr->it_present |= cpu_to_le32(1 << IEEE80211_RADIOTAP_MCS);
                 *pos++ = local->hw.radiotap_mcs_details;
                 *pos = 0;
@@ -267,6 +269,8 @@ ieee80211_add_rx_radiotap_header(struct ieee80211_local *local,
                         *pos |= IEEE80211_RADIOTAP_MCS_BW_40;
                 if (status->flag & RX_FLAG_HT_GF)
                         *pos |= IEEE80211_RADIOTAP_MCS_FMT_GF;
+                stbc = (status->flag & RX_FLAG_STBC_MASK) >> RX_FLAG_STBC_SHIFT;
+                *pos |= stbc << IEEE80211_RADIOTAP_MCS_STBC_SHIFT;
                 pos++;
                 *pos++ = status->rate_idx;
         }
@@ -1372,6 +1376,7 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
+        int i;
 
         if (!sta)
                 return RX_CONTINUE;
@@ -1422,6 +1427,19 @@ ieee80211_rx_h_sta_process(struct ieee80211_rx_data *rx)
                 ewma_add(&sta->avg_signal, -status->signal);
         }
 
+        if (status->chains) {
+                sta->chains = status->chains;
+                for (i = 0; i < ARRAY_SIZE(status->chain_signal); i++) {
+                        int signal = status->chain_signal[i];
+
+                        if (!(status->chains & BIT(i)))
+                                continue;
+
+                        sta->chain_signal_last[i] = signal;
+                        ewma_add(&sta->chain_signal_avg[i], -signal);
+                }
+        }
+
         /*
          * Change STA power saving mode only at the end of a frame
          * exchange sequence.
@@ -1608,7 +1626,7 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
                         entry->ccmp = 1;
                         memcpy(entry->last_pn,
                                rx->key->u.ccmp.rx_pn[queue],
-                               CCMP_PN_LEN);
+                               IEEE80211_CCMP_PN_LEN);
                 }
                 return RX_QUEUED;
         }
@@ -1627,21 +1645,21 @@ ieee80211_rx_h_defragment(struct ieee80211_rx_data *rx)
          * (IEEE 802.11i, 8.3.3.4.5) */
         if (entry->ccmp) {
                 int i;
-                u8 pn[CCMP_PN_LEN], *rpn;
+                u8 pn[IEEE80211_CCMP_PN_LEN], *rpn;
                 int queue;
                 if (!rx->key || rx->key->conf.cipher != WLAN_CIPHER_SUITE_CCMP)
                         return RX_DROP_UNUSABLE;
-                memcpy(pn, entry->last_pn, CCMP_PN_LEN);
-                for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
+                memcpy(pn, entry->last_pn, IEEE80211_CCMP_PN_LEN);
+                for (i = IEEE80211_CCMP_PN_LEN - 1; i >= 0; i--) {
                         pn[i]++;
                         if (pn[i])
                                 break;
                 }
                 queue = rx->security_idx;
                 rpn = rx->key->u.ccmp.rx_pn[queue];
-                if (memcmp(pn, rpn, CCMP_PN_LEN))
+                if (memcmp(pn, rpn, IEEE80211_CCMP_PN_LEN))
                         return RX_DROP_UNUSABLE;
-                memcpy(entry->last_pn, pn, CCMP_PN_LEN);
+                memcpy(entry->last_pn, pn, IEEE80211_CCMP_PN_LEN);
         }
 
         skb_pull(rx->skb, ieee80211_hdrlen(fc));
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 11216bc13b27..a04c5671d7fd 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -358,6 +358,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         do_posix_clock_monotonic_gettime(&uptime);
         sta->last_connected = uptime.tv_sec;
         ewma_init(&sta->avg_signal, 1024, 8);
+        for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
+                ewma_init(&sta->chain_signal_avg[i], 1024, 8);
 
         if (sta_prepare_rate_control(local, sta, gfp)) {
                 kfree(sta);
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index adc30045f99e..41c28b977f7c 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -344,6 +344,11 @@ struct sta_info {
         int last_signal;
         struct ewma avg_signal;
         int last_ack_signal;
+
+        u8 chains;
+        s8 chain_signal_last[IEEE80211_MAX_CHAINS];
+        struct ewma chain_signal_avg[IEEE80211_MAX_CHAINS];
+
         /* Plus 1 for non-QoS frames */
         __le16 last_seq_ctrl[IEEE80211_NUM_TIDS + 1];
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 9972e07a2f96..34be9336b5d1 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -398,13 +398,14 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
         if (ieee80211_has_order(hdr->frame_control))
                 return TX_CONTINUE;
 
+        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
+                info->hw_queue = tx->sdata->vif.cab_queue;
+
         /* no stations in PS mode */
         if (!atomic_read(&ps->num_sta_ps))
                 return TX_CONTINUE;
 
         info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
-        if (tx->local->hw.flags & IEEE80211_HW_QUEUE_CONTROL)
-                info->hw_queue = tx->sdata->vif.cab_queue;
 
         /* device releases frame after DTIM beacon */
         if (!(tx->local->hw.flags & IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING))
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 27e07150eb46..89a83770d152 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -560,6 +560,9 @@ void ieee80211_iterate_active_interfaces(
         list_for_each_entry(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
+                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                                continue;
+                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
                 default:
@@ -598,6 +601,9 @@ void ieee80211_iterate_active_interfaces_atomic(
         list_for_each_entry_rcu(sdata, &local->interfaces, list) {
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_MONITOR:
+                        if (!(sdata->u.mntr_flags & MONITOR_FLAG_ACTIVE))
+                                continue;
+                        break;
                 case NL80211_IFTYPE_AP_VLAN:
                         continue;
                 default:
@@ -1072,32 +1078,6 @@ void ieee80211_sta_def_wmm_params(struct ieee80211_sub_if_data *sdata,
         ieee80211_set_wmm_default(sdata, true);
 }
 
-u32 ieee80211_mandatory_rates(struct ieee80211_local *local,
-                              enum ieee80211_band band)
-{
-        struct ieee80211_supported_band *sband;
-        struct ieee80211_rate *bitrates;
-        u32 mandatory_rates;
-        enum ieee80211_rate_flags mandatory_flag;
-        int i;
-
-        sband = local->hw.wiphy->bands[band];
-        if (WARN_ON(!sband))
-                return 1;
-
-        if (band == IEEE80211_BAND_2GHZ)
-                mandatory_flag = IEEE80211_RATE_MANDATORY_B;
-        else
-                mandatory_flag = IEEE80211_RATE_MANDATORY_A;
-
-        bitrates = sband->bitrates;
-        mandatory_rates = 0;
-        for (i = 0; i < sband->n_bitrates; i++)
-                if (bitrates[i].flags & mandatory_flag)
-                        mandatory_rates |= BIT(i);
-        return mandatory_rates;
-}
-
 void ieee80211_send_auth(struct ieee80211_sub_if_data *sdata,
                          u16 transaction, u16 auth_alg, u16 status,
                          const u8 *extra, size_t extra_len, const u8 *da,
@@ -1607,9 +1587,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                         if (sdata->u.mgd.dtim_period)
                                 changed |= BSS_CHANGED_DTIM_PERIOD;
 
-                        mutex_lock(&sdata->u.mgd.mtx);
+                        sdata_lock(sdata);
                         ieee80211_bss_info_change_notify(sdata, changed);
-                        mutex_unlock(&sdata->u.mgd.mtx);
+                        sdata_unlock(sdata);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index c04d401dae92..6ee2b5863572 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -28,7 +28,7 @@
 int ieee80211_wep_init(struct ieee80211_local *local)
 {
         /* start WEP IV from a random value */
-        get_random_bytes(&local->wep_iv, WEP_IV_LEN);
+        get_random_bytes(&local->wep_iv, IEEE80211_WEP_IV_LEN);
 
         local->wep_tx_tfm = crypto_alloc_cipher("arc4", 0, CRYPTO_ALG_ASYNC);
         if (IS_ERR(local->wep_tx_tfm)) {
@@ -98,20 +98,21 @@ static u8 *ieee80211_wep_add_iv(struct ieee80211_local *local,
 
         hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
 
-        if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
-                    skb_headroom(skb) < WEP_IV_LEN))
+        if (WARN_ON(skb_tailroom(skb) < IEEE80211_WEP_ICV_LEN ||
+                    skb_headroom(skb) < IEEE80211_WEP_IV_LEN))
                 return NULL;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        newhdr = skb_push(skb, WEP_IV_LEN);
-        memmove(newhdr, newhdr + WEP_IV_LEN, hdrlen);
+        newhdr = skb_push(skb, IEEE80211_WEP_IV_LEN);
+        memmove(newhdr, newhdr + IEEE80211_WEP_IV_LEN, hdrlen);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
             (info->control.hw_key->flags & IEEE80211_KEY_FLAG_PUT_IV_SPACE))
                 return newhdr + hdrlen;
 
-        skb_set_network_header(skb, skb_network_offset(skb) + WEP_IV_LEN);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_WEP_IV_LEN);
         ieee80211_wep_get_iv(local, keylen, keyidx, newhdr + hdrlen);
         return newhdr + hdrlen;
 }
@@ -125,8 +126,8 @@ static void ieee80211_wep_remove_iv(struct ieee80211_local *local,
         unsigned int hdrlen;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, WEP_IV_LEN);
+        memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_WEP_IV_LEN);
 }
 
 
@@ -146,7 +147,7 @@ int ieee80211_wep_encrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
         put_unaligned(icv, (__le32 *)(data + data_len));
 
         crypto_cipher_setkey(tfm, rc4key, klen);
-        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+        for (i = 0; i < data_len + IEEE80211_WEP_ICV_LEN; i++)
                 crypto_cipher_encrypt_one(tfm, data + i, data + i);
 
         return 0;
@@ -172,7 +173,7 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
         if (!iv)
                 return -1;
 
-        len = skb->len - (iv + WEP_IV_LEN - skb->data);
+        len = skb->len - (iv + IEEE80211_WEP_IV_LEN - skb->data);
 
         /* Prepend 24-bit IV to RC4 key */
         memcpy(rc4key, iv, 3);
@@ -181,10 +182,10 @@ int ieee80211_wep_encrypt(struct ieee80211_local *local,
         memcpy(rc4key + 3, key, keylen);
 
         /* Add room for ICV */
-        skb_put(skb, WEP_ICV_LEN);
+        skb_put(skb, IEEE80211_WEP_ICV_LEN);
 
         return ieee80211_wep_encrypt_data(local->wep_tx_tfm, rc4key, keylen + 3,
-                                          iv + WEP_IV_LEN, len);
+                                          iv + IEEE80211_WEP_IV_LEN, len);
 }
 
 
@@ -201,11 +202,11 @@ int ieee80211_wep_decrypt_data(struct crypto_cipher *tfm, u8 *rc4key,
                 return -1;
 
         crypto_cipher_setkey(tfm, rc4key, klen);
-        for (i = 0; i < data_len + WEP_ICV_LEN; i++)
+        for (i = 0; i < data_len + IEEE80211_WEP_ICV_LEN; i++)
                 crypto_cipher_decrypt_one(tfm, data + i, data + i);
 
         crc = cpu_to_le32(~crc32_le(~0, data, data_len));
-        if (memcmp(&crc, data + data_len, WEP_ICV_LEN) != 0)
+        if (memcmp(&crc, data + data_len, IEEE80211_WEP_ICV_LEN) != 0)
                 /* ICV mismatch */
                 return -1;
 
@@ -237,10 +238,10 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
                 return -1;
 
         hdrlen = ieee80211_hdrlen(hdr->frame_control);
-        if (skb->len < hdrlen + WEP_IV_LEN + WEP_ICV_LEN)
+        if (skb->len < hdrlen + IEEE80211_WEP_IV_LEN + IEEE80211_WEP_ICV_LEN)
                 return -1;
 
-        len = skb->len - hdrlen - WEP_IV_LEN - WEP_ICV_LEN;
+        len = skb->len - hdrlen - IEEE80211_WEP_IV_LEN - IEEE80211_WEP_ICV_LEN;
 
         keyidx = skb->data[hdrlen + 3] >> 6;
 
@@ -256,16 +257,16 @@ static int ieee80211_wep_decrypt(struct ieee80211_local *local,
         memcpy(rc4key + 3, key->conf.key, key->conf.keylen);
 
         if (ieee80211_wep_decrypt_data(local->wep_rx_tfm, rc4key, klen,
-                                       skb->data + hdrlen + WEP_IV_LEN,
-                                       len))
+                                       skb->data + hdrlen +
+                                       IEEE80211_WEP_IV_LEN, len))
                 ret = -1;
 
         /* Trim ICV */
-        skb_trim(skb, skb->len - WEP_ICV_LEN);
+        skb_trim(skb, skb->len - IEEE80211_WEP_ICV_LEN);
 
         /* Remove IV */
-        memmove(skb->data + WEP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, WEP_IV_LEN);
+        memmove(skb->data + IEEE80211_WEP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_WEP_IV_LEN);
 
         return ret;
 }
@@ -305,13 +306,14 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx)
                 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key))
                         return RX_DROP_UNUSABLE;
         } else if (!(status->flag & RX_FLAG_IV_STRIPPED)) {
-                if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) + WEP_IV_LEN))
+                if (!pskb_may_pull(rx->skb, ieee80211_hdrlen(fc) +
+                                            IEEE80211_WEP_IV_LEN))
                         return RX_DROP_UNUSABLE;
                 if (rx->sta && ieee80211_wep_is_weak_iv(rx->skb, rx->key))
                         rx->sta->wep_weak_iv_count++;
                 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
                 /* remove ICV */
-                if (pskb_trim(rx->skb, rx->skb->len - WEP_ICV_LEN))
+                if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN))
                         return RX_DROP_UNUSABLE;
         }
 
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index c7c6d644486f..c9edfcb7a13b 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -62,10 +62,10 @@ ieee80211_tx_h_michael_mic_add(struct ieee80211_tx_data *tx)
 
         tail = MICHAEL_MIC_LEN;
         if (!info->control.hw_key)
-                tail += TKIP_ICV_LEN;
+                tail += IEEE80211_TKIP_ICV_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < TKIP_IV_LEN))
+                    skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
                 return TX_DROP;
 
         key = &tx->key->conf.key[NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY];
@@ -198,15 +198,16 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 tail = 0;
         else
-                tail = TKIP_ICV_LEN;
+                tail = IEEE80211_TKIP_ICV_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < TKIP_IV_LEN))
+                    skb_headroom(skb) < IEEE80211_TKIP_IV_LEN))
                 return -1;
 
-        pos = skb_push(skb, TKIP_IV_LEN);
-        memmove(pos, pos + TKIP_IV_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + TKIP_IV_LEN);
+        pos = skb_push(skb, IEEE80211_TKIP_IV_LEN);
+        memmove(pos, pos + IEEE80211_TKIP_IV_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_TKIP_IV_LEN);
         pos += hdrlen;
 
         /* the HW only needs room for the IV, but not the actual IV */
@@ -227,7 +228,7 @@ static int tkip_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
                 return 0;
 
         /* Add room for ICV */
-        skb_put(skb, TKIP_ICV_LEN);
+        skb_put(skb, IEEE80211_TKIP_ICV_LEN);
 
         return ieee80211_tkip_encrypt_data(tx->local->wep_tx_tfm,
                                            key, skb, pos, len);
@@ -290,11 +291,11 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx)
                 return RX_DROP_UNUSABLE;
 
         /* Trim ICV */
-        skb_trim(skb, skb->len - TKIP_ICV_LEN);
+        skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN);
 
         /* Remove IV */
-        memmove(skb->data + TKIP_IV_LEN, skb->data, hdrlen);
-        skb_pull(skb, TKIP_IV_LEN);
+        memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_TKIP_IV_LEN);
 
         return RX_CONTINUE;
 }
@@ -337,9 +338,9 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
         else
                 qos_tid = 0;
 
-        data_len = skb->len - hdrlen - CCMP_HDR_LEN;
+        data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN;
         if (encrypted)
-                data_len -= CCMP_MIC_LEN;
+                data_len -= IEEE80211_CCMP_MIC_LEN;
 
         /* First block, b_0 */
         b_0[0] = 0x59; /* flags: Adata: 1, M: 011, L: 001 */
@@ -348,7 +349,7 @@ static void ccmp_special_blocks(struct sk_buff *skb, u8 *pn, u8 *scratch,
          */
         b_0[1] = qos_tid | (mgmt << 4);
         memcpy(&b_0[2], hdr->addr2, ETH_ALEN);
-        memcpy(&b_0[8], pn, CCMP_PN_LEN);
+        memcpy(&b_0[8], pn, IEEE80211_CCMP_PN_LEN);
         /* l(m) */
         put_unaligned_be16(data_len, &b_0[14]);
 
@@ -424,15 +425,16 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 tail = 0;
         else
-                tail = CCMP_MIC_LEN;
+                tail = IEEE80211_CCMP_MIC_LEN;
 
         if (WARN_ON(skb_tailroom(skb) < tail ||
-                    skb_headroom(skb) < CCMP_HDR_LEN))
+                    skb_headroom(skb) < IEEE80211_CCMP_HDR_LEN))
                 return -1;
 
-        pos = skb_push(skb, CCMP_HDR_LEN);
-        memmove(pos, pos + CCMP_HDR_LEN, hdrlen);
-        skb_set_network_header(skb, skb_network_offset(skb) + CCMP_HDR_LEN);
+        pos = skb_push(skb, IEEE80211_CCMP_HDR_LEN);
+        memmove(pos, pos + IEEE80211_CCMP_HDR_LEN, hdrlen);
+        skb_set_network_header(skb, skb_network_offset(skb) +
+                                    IEEE80211_CCMP_HDR_LEN);
 
         /* the HW only needs room for the IV, but not the actual IV */
         if (info->control.hw_key &&
@@ -457,10 +459,10 @@ static int ccmp_encrypt_skb(struct ieee80211_tx_data *tx, struct sk_buff *skb)
         if (info->control.hw_key)
                 return 0;
 
-        pos += CCMP_HDR_LEN;
+        pos += IEEE80211_CCMP_HDR_LEN;
         ccmp_special_blocks(skb, pn, scratch, 0);
         ieee80211_aes_ccm_encrypt(key->u.ccmp.tfm, scratch, pos, len,
-                                  pos, skb_put(skb, CCMP_MIC_LEN));
+                                  pos, skb_put(skb, IEEE80211_CCMP_MIC_LEN));
 
         return 0;
 }
@@ -490,7 +492,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
         struct ieee80211_key *key = rx->key;
         struct sk_buff *skb = rx->skb;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
-        u8 pn[CCMP_PN_LEN];
+        u8 pn[IEEE80211_CCMP_PN_LEN];
         int data_len;
         int queue;
 
@@ -500,12 +502,13 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
             !ieee80211_is_robust_mgmt_frame(hdr))
                 return RX_CONTINUE;
 
-        data_len = skb->len - hdrlen - CCMP_HDR_LEN - CCMP_MIC_LEN;
+        data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN -
+                   IEEE80211_CCMP_MIC_LEN;
         if (!rx->sta || data_len < 0)
                 return RX_DROP_UNUSABLE;
 
         if (status->flag & RX_FLAG_DECRYPTED) {
-                if (!pskb_may_pull(rx->skb, hdrlen + CCMP_HDR_LEN))
+                if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
         } else {
                 if (skb_linearize(rx->skb))
@@ -516,7 +519,7 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
         queue = rx->security_idx;
 
-        if (memcmp(pn, key->u.ccmp.rx_pn[queue], CCMP_PN_LEN) <= 0) {
+        if (memcmp(pn, key->u.ccmp.rx_pn[queue], IEEE80211_CCMP_PN_LEN) <= 0) {
                 key->u.ccmp.replays++;
                 return RX_DROP_UNUSABLE;
         }
@@ -528,19 +531,20 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx)
 
                 if (ieee80211_aes_ccm_decrypt(
                             key->u.ccmp.tfm, scratch,
-                            skb->data + hdrlen + CCMP_HDR_LEN, data_len,
-                            skb->data + skb->len - CCMP_MIC_LEN,
-                            skb->data + hdrlen + CCMP_HDR_LEN))
+                            skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN,
+                            data_len,
+                            skb->data + skb->len - IEEE80211_CCMP_MIC_LEN,
+                            skb->data + hdrlen + IEEE80211_CCMP_HDR_LEN))
                         return RX_DROP_UNUSABLE;
         }
 
-        memcpy(key->u.ccmp.rx_pn[queue], pn, CCMP_PN_LEN);
+        memcpy(key->u.ccmp.rx_pn[queue], pn, IEEE80211_CCMP_PN_LEN);
 
         /* Remove CCMP header and MIC */
-        if (pskb_trim(skb, skb->len - CCMP_MIC_LEN))
+        if (pskb_trim(skb, skb->len - IEEE80211_CCMP_MIC_LEN))
                 return RX_DROP_UNUSABLE;
-        memmove(skb->data + CCMP_HDR_LEN, skb->data, hdrlen);
-        skb_pull(skb, CCMP_HDR_LEN);
+        memmove(skb->data + IEEE80211_CCMP_HDR_LEN, skb->data, hdrlen);
+        skb_pull(skb, IEEE80211_CCMP_HDR_LEN);
 
         return RX_CONTINUE;
 }
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 01e41191f1bf..e4df77490229 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -34,13 +34,12 @@
 MODULE_AUTHOR("Johannes Berg");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("wireless configuration support");
+MODULE_ALIAS_GENL_FAMILY(NL80211_GENL_NAME);
 
-/* RCU-protected (and cfg80211_mutex for writers) */
+/* RCU-protected (and RTNL for writers) */
 LIST_HEAD(cfg80211_rdev_list);
 int cfg80211_rdev_list_generation;
 
-DEFINE_MUTEX(cfg80211_mutex);
-
 /* for debugfs */
 static struct dentry *ieee80211_debugfs_dir;
 
@@ -52,12 +51,11 @@ module_param(cfg80211_disable_40mhz_24ghz, bool, 0644);
 MODULE_PARM_DESC(cfg80211_disable_40mhz_24ghz,
                  "Disable 40MHz support in the 2.4GHz band");
 
-/* requires cfg80211_mutex to be held! */
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx)
 {
         struct cfg80211_registered_device *result = NULL, *rdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (rdev->wiphy_idx == wiphy_idx) {
@@ -76,12 +74,11 @@ int get_wiphy_idx(struct wiphy *wiphy)
         return rdev->wiphy_idx;
 }
 
-/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
 {
         struct cfg80211_registered_device *rdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         rdev = cfg80211_rdev_by_wiphy_idx(wiphy_idx);
         if (!rdev)
@@ -89,35 +86,13 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx)
         return &rdev->wiphy;
 }
 
-struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
-{
-        struct cfg80211_registered_device *rdev = ERR_PTR(-ENODEV);
-        struct net_device *dev;
-
-        mutex_lock(&cfg80211_mutex);
-        dev = dev_get_by_index(net, ifindex);
-        if (!dev)
-                goto out;
-        if (dev->ieee80211_ptr) {
-                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
-                mutex_lock(&rdev->mtx);
-        } else
-                rdev = ERR_PTR(-ENODEV);
-        dev_put(dev);
- out:
-        mutex_unlock(&cfg80211_mutex);
-        return rdev;
-}
-
-/* requires cfg80211_mutex to be held */
 int cfg80211_dev_rename(struct cfg80211_registered_device *rdev,
                         char *newname)
 {
         struct cfg80211_registered_device *rdev2;
         int wiphy_idx, taken = -1, result, digits;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         /* prohibit calling the thing phy%d when %d is not its number */
         sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken);
@@ -215,8 +190,7 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
 void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
                               struct wireless_dev *wdev)
 {
-        lockdep_assert_held(&rdev->devlist_mtx);
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_P2P_DEVICE))
                 return;
@@ -230,18 +204,15 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
         rdev->opencount--;
 
         if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
-                bool busy = work_busy(&rdev->scan_done_wk);
-
                 /*
-                 * If the work isn't pending or running (in which case it would
-                 * be waiting for the lock we hold) the driver didn't properly
-                 * cancel the scan when the interface was removed. In this case
-                 * warn and leak the scan request object to not crash later.
+                 * If the scan request wasn't notified as done, set it
+                 * to aborted and leak it after a warning. The driver
+                 * should have notified us that it ended at the latest
+                 * during rdev_stop_p2p_device().
                  */
-                WARN_ON(!busy);
-
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, !busy);
+                if (WARN_ON(!rdev->scan_req->notified))
+                        rdev->scan_req->aborted = true;
+                ___cfg80211_scan_done(rdev, !rdev->scan_req->notified);
         }
 }
 
@@ -255,8 +226,6 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
 
         rtnl_lock();
 
-        /* read-only iteration need not hold the devlist_mtx */
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->netdev) {
                         dev_close(wdev->netdev);
@@ -265,12 +234,7 @@ static int cfg80211_rfkill_set_block(void *data, bool blocked)
                 /* otherwise, check iftype */
                 switch (wdev->iftype) {
                 case NL80211_IFTYPE_P2P_DEVICE:
-                        /* but this requires it */
-                        mutex_lock(&rdev->devlist_mtx);
-                        mutex_lock(&rdev->sched_scan_mtx);
                         cfg80211_stop_p2p_device(rdev, wdev);
-                        mutex_unlock(&rdev->sched_scan_mtx);
-                        mutex_unlock(&rdev->devlist_mtx);
                         break;
                 default:
                         break;
@@ -298,10 +262,7 @@ static void cfg80211_event_work(struct work_struct *work)
                             event_work);
 
         rtnl_lock();
-        cfg80211_lock_rdev(rdev);
-
         cfg80211_process_rdev_events(rdev);
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
@@ -309,7 +270,7 @@ static void cfg80211_event_work(struct work_struct *work)
 
 struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 {
-        static int wiphy_counter;
+        static atomic_t wiphy_counter = ATOMIC_INIT(0);
 
         struct cfg80211_registered_device *rdev;
         int alloc_size;
@@ -331,26 +292,18 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
 
         rdev->ops = ops;
 
-        mutex_lock(&cfg80211_mutex);
-
-        rdev->wiphy_idx = wiphy_counter++;
+        rdev->wiphy_idx = atomic_inc_return(&wiphy_counter);
 
         if (unlikely(rdev->wiphy_idx < 0)) {
-                wiphy_counter--;
-                mutex_unlock(&cfg80211_mutex);
                 /* ugh, wrapped! */
+                atomic_dec(&wiphy_counter);
                 kfree(rdev);
                 return NULL;
         }
 
-        mutex_unlock(&cfg80211_mutex);
-
         /* give it a proper name */
         dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
 
-        mutex_init(&rdev->mtx);
-        mutex_init(&rdev->devlist_mtx);
-        mutex_init(&rdev->sched_scan_mtx);
         INIT_LIST_HEAD(&rdev->wdev_list);
         INIT_LIST_HEAD(&rdev->beacon_registrations);
         spin_lock_init(&rdev->beacon_registrations_lock);
@@ -598,11 +551,11 @@ int wiphy_register(struct wiphy *wiphy)
         /* check and set up bitrates */
         ieee80211_set_bitrate_flags(wiphy);
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
 
         res = device_add(&rdev->wiphy.dev);
         if (res) {
-                mutex_unlock(&cfg80211_mutex);
+                rtnl_unlock();
                 return res;
         }
 
@@ -631,25 +584,18 @@ int wiphy_register(struct wiphy *wiphy)
         }
 
         cfg80211_debugfs_rdev_add(rdev);
-        mutex_unlock(&cfg80211_mutex);
 
-        /*
-         * due to a locking dependency this has to be outside of the
-         * cfg80211_mutex lock
-         */
         res = rfkill_register(rdev->rfkill);
         if (res) {
                 device_del(&rdev->wiphy.dev);
 
-                mutex_lock(&cfg80211_mutex);
                 debugfs_remove_recursive(rdev->wiphy.debugfsdir);
                 list_del_rcu(&rdev->list);
                 wiphy_regulatory_deregister(wiphy);
-                mutex_unlock(&cfg80211_mutex);
+                rtnl_unlock();
                 return res;
         }
 
-        rtnl_lock();
         rdev->wiphy.registered = true;
         rtnl_unlock();
         return 0;
@@ -679,25 +625,19 @@ void wiphy_unregister(struct wiphy *wiphy)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
-        rtnl_lock();
-        rdev->wiphy.registered = false;
-        rtnl_unlock();
-
-        rfkill_unregister(rdev->rfkill);
-
-        /* protect the device list */
-        mutex_lock(&cfg80211_mutex);
-
         wait_event(rdev->dev_wait, ({
                 int __count;
-                mutex_lock(&rdev->devlist_mtx);
+                rtnl_lock();
                 __count = rdev->opencount;
-                mutex_unlock(&rdev->devlist_mtx);
+                rtnl_unlock();
                 __count == 0; }));
 
-        mutex_lock(&rdev->devlist_mtx);
+        rtnl_lock();
+        rdev->wiphy.registered = false;
+
+        rfkill_unregister(rdev->rfkill);
+
         BUG_ON(!list_empty(&rdev->wdev_list));
-        mutex_unlock(&rdev->devlist_mtx);
 
         /*
          * First remove the hardware from everywhere, this makes
@@ -708,20 +648,6 @@ void wiphy_unregister(struct wiphy *wiphy)
         synchronize_rcu();
 
         /*
-         * Try to grab rdev->mtx. If a command is still in progress,
-         * hopefully the driver will refuse it since it's tearing
-         * down the device already. We wait for this command to complete
-         * before unlinking the item from the list.
-         * Note: as codified by the BUG_ON above we cannot get here if
-         * a virtual interface is still present. Hence, we can only get
-         * to lock contention here if userspace issues a command that
-         * identified the hardware by wiphy index.
-         */
-        cfg80211_lock_rdev(rdev);
-        /* nothing */
-        cfg80211_unlock_rdev(rdev);
-
-        /*
          * If this device got a regulatory hint tell core its
          * free to listen now to a new shiny device regulatory hint
          */
@@ -730,15 +656,17 @@ void wiphy_unregister(struct wiphy *wiphy)
         cfg80211_rdev_list_generation++;
         device_del(&rdev->wiphy.dev);
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         flush_work(&rdev->scan_done_wk);
         cancel_work_sync(&rdev->conn_work);
         flush_work(&rdev->event_work);
         cancel_delayed_work_sync(&rdev->dfs_update_channels_wk);
 
-        if (rdev->wowlan && rdev->ops->set_wakeup)
+#ifdef CONFIG_PM
+        if (rdev->wiphy.wowlan_config && rdev->ops->set_wakeup)
                 rdev_set_wakeup(rdev, false);
+#endif
         cfg80211_rdev_free_wowlan(rdev);
 }
 EXPORT_SYMBOL(wiphy_unregister);
@@ -748,9 +676,6 @@ void cfg80211_dev_free(struct cfg80211_registered_device *rdev)
         struct cfg80211_internal_bss *scan, *tmp;
         struct cfg80211_beacon_registration *reg, *treg;
         rfkill_destroy(rdev->rfkill);
-        mutex_destroy(&rdev->mtx);
-        mutex_destroy(&rdev->devlist_mtx);
-        mutex_destroy(&rdev->sched_scan_mtx);
         list_for_each_entry_safe(reg, treg, &rdev->beacon_registrations, list) {
                 list_del(&reg->list);
                 kfree(reg);
@@ -775,36 +700,6 @@ void wiphy_rfkill_set_hw_state(struct wiphy *wiphy, bool blocked)
 }
 EXPORT_SYMBOL(wiphy_rfkill_set_hw_state);
 
-static void wdev_cleanup_work(struct work_struct *work)
-{
-        struct wireless_dev *wdev;
-        struct cfg80211_registered_device *rdev;
-
-        wdev = container_of(work, struct wireless_dev, cleanup_work);
-        rdev = wiphy_to_dev(wdev->wiphy);
-
-        mutex_lock(&rdev->sched_scan_mtx);
-
-        if (WARN_ON(rdev->scan_req && rdev->scan_req->wdev == wdev)) {
-                rdev->scan_req->aborted = true;
-                ___cfg80211_scan_done(rdev, true);
-        }
-
-        if (WARN_ON(rdev->sched_scan_req &&
-                    rdev->sched_scan_req->dev == wdev->netdev)) {
-                __cfg80211_stop_sched_scan(rdev, false);
-        }
-
-        mutex_unlock(&rdev->sched_scan_mtx);
-
-        mutex_lock(&rdev->devlist_mtx);
-        rdev->opencount--;
-        mutex_unlock(&rdev->devlist_mtx);
-        wake_up(&rdev->dev_wait);
-
-        dev_put(wdev->netdev);
-}
-
 void cfg80211_unregister_wdev(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
@@ -814,8 +709,6 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
         if (WARN_ON(wdev->netdev))
                 return;
 
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         list_del_rcu(&wdev->list);
         rdev->devlist_generation++;
 
@@ -827,8 +720,6 @@ void cfg80211_unregister_wdev(struct wireless_dev *wdev)
                 WARN_ON_ONCE(1);
                 break;
         }
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
 }
 EXPORT_SYMBOL(cfg80211_unregister_wdev);
 
@@ -847,7 +738,7 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
 }
 
 void cfg80211_leave(struct cfg80211_registered_device *rdev,
-                   struct wireless_dev *wdev)
+                    struct wireless_dev *wdev)
 {
         struct net_device *dev = wdev->netdev;
 
@@ -857,9 +748,7 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
-                mutex_lock(&rdev->sched_scan_mtx);
                 __cfg80211_stop_sched_scan(rdev, false);
-                mutex_unlock(&rdev->sched_scan_mtx);
 
                 wdev_lock(wdev);
 #ifdef CONFIG_CFG80211_WEXT
@@ -868,8 +757,8 @@ void cfg80211_leave(struct cfg80211_registered_device *rdev,
                 wdev->wext.ie_len = 0;
                 wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
 #endif
-                __cfg80211_disconnect(rdev, dev,
-                                      WLAN_REASON_DEAUTH_LEAVING, true);
+                cfg80211_disconnect(rdev, dev,
+                                    WLAN_REASON_DEAUTH_LEAVING, true);
                 wdev_unlock(wdev);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
@@ -911,13 +800,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                  * are added with nl80211.
                  */
                 mutex_init(&wdev->mtx);
-                INIT_WORK(&wdev->cleanup_work, wdev_cleanup_work);
                 INIT_LIST_HEAD(&wdev->event_list);
                 spin_lock_init(&wdev->event_lock);
                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
                 spin_lock_init(&wdev->mgmt_registrations_lock);
 
-                mutex_lock(&rdev->devlist_mtx);
                 wdev->identifier = ++rdev->wdev_id;
                 list_add_rcu(&wdev->list, &rdev->wdev_list);
                 rdev->devlist_generation++;
@@ -930,7 +817,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 }
                 wdev->netdev = dev;
                 wdev->sme_state = CFG80211_SME_IDLE;
-                mutex_unlock(&rdev->devlist_mtx);
 #ifdef CONFIG_CFG80211_WEXT
                 wdev->wext.default_key = -1;
                 wdev->wext.default_mgmt_key = -1;
@@ -956,26 +842,22 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 break;
         case NETDEV_DOWN:
                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
-                dev_hold(dev);
-                queue_work(cfg80211_wq, &wdev->cleanup_work);
+                if (rdev->scan_req && rdev->scan_req->wdev == wdev) {
+                        if (WARN_ON(!rdev->scan_req->notified))
+                                rdev->scan_req->aborted = true;
+                        ___cfg80211_scan_done(rdev, true);
+                }
+
+                if (WARN_ON(rdev->sched_scan_req &&
+                            rdev->sched_scan_req->dev == wdev->netdev)) {
+                        __cfg80211_stop_sched_scan(rdev, false);
+                }
+
+                rdev->opencount--;
+                wake_up(&rdev->dev_wait);
                 break;
         case NETDEV_UP:
-                /*
-                 * If we have a really quick DOWN/UP succession we may
-                 * have this work still pending ... cancel it and see
-                 * if it was pending, in which case we need to account
-                 * for some of the work it would have done.
-                 */
-                if (cancel_work_sync(&wdev->cleanup_work)) {
-                        mutex_lock(&rdev->devlist_mtx);
-                        rdev->opencount--;
-                        mutex_unlock(&rdev->devlist_mtx);
-                        dev_put(dev);
-                }
                 cfg80211_update_iface_num(rdev, wdev->iftype, 1);
-                cfg80211_lock_rdev(rdev);
-                mutex_lock(&rdev->devlist_mtx);
-                mutex_lock(&rdev->sched_scan_mtx);
                 wdev_lock(wdev);
                 switch (wdev->iftype) {
 #ifdef CONFIG_CFG80211_WEXT
@@ -1007,10 +889,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         break;
                 }
                 wdev_unlock(wdev);
-                mutex_unlock(&rdev->sched_scan_mtx);
                 rdev->opencount++;
-                mutex_unlock(&rdev->devlist_mtx);
-                cfg80211_unlock_rdev(rdev);
 
                 /*
                  * Configure power management to the driver here so that its
@@ -1027,12 +906,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 break;
         case NETDEV_UNREGISTER:
                 /*
-                 * NB: cannot take rdev->mtx here because this may be
-                 * called within code protected by it when interfaces
-                 * are removed with nl80211.
-                 */
-                mutex_lock(&rdev->devlist_mtx);
-                /*
                  * It is possible to get NETDEV_UNREGISTER
                  * multiple times. To detect that, check
                  * that the interface is still on the list
@@ -1048,7 +921,6 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         kfree(wdev->wext.keys);
 #endif
                 }
-                mutex_unlock(&rdev->devlist_mtx);
                 /*
                  * synchronise (so that we won't find this netdev
                  * from other code any more) and then clear the list
@@ -1068,9 +940,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         return notifier_from_errno(-EOPNOTSUPP);
                 if (rfkill_blocked(rdev->rfkill))
                         return notifier_from_errno(-ERFKILL);
-                mutex_lock(&rdev->devlist_mtx);
                 ret = cfg80211_can_add_interface(rdev, wdev->iftype);
-                mutex_unlock(&rdev->devlist_mtx);
                 if (ret)
                         return notifier_from_errno(ret);
                 break;
@@ -1088,12 +958,10 @@ static void __net_exit cfg80211_pernet_exit(struct net *net)
         struct cfg80211_registered_device *rdev;
 
         rtnl_lock();
-        mutex_lock(&cfg80211_mutex);
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (net_eq(wiphy_net(&rdev->wiphy), net))
                         WARN_ON(cfg80211_switch_netns(rdev, &init_net));
         }
-        mutex_unlock(&cfg80211_mutex);
         rtnl_unlock();
 }
 
diff --git a/net/wireless/core.h b/net/wireless/core.h
index fd35dae547c4..a65eaf8a84c1 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -5,7 +5,6 @@
  */
 #ifndef __NET_WIRELESS_CORE_H
 #define __NET_WIRELESS_CORE_H
-#include <linux/mutex.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
 #include <linux/rbtree.h>
@@ -23,11 +22,6 @@
 struct cfg80211_registered_device {
         const struct cfg80211_ops *ops;
         struct list_head list;
-        /* we hold this mutex during any call so that
-         * we cannot do multiple calls at once, and also
-         * to avoid the deregister call to proceed while
-         * any call is in progress */
-        struct mutex mtx;
 
         /* rfkill support */
         struct rfkill_ops rfkill_ops;
@@ -49,9 +43,7 @@ struct cfg80211_registered_device {
         /* wiphy index, internal only */
         int wiphy_idx;
 
-        /* associated wireless interfaces */
-        struct mutex devlist_mtx;
-        /* protected by devlist_mtx or RCU */
+        /* associated wireless interfaces, protected by rtnl or RCU */
         struct list_head wdev_list;
         int devlist_generation, wdev_id;
         int opencount; /* also protected by devlist_mtx */
@@ -75,8 +67,6 @@ struct cfg80211_registered_device {
         struct work_struct scan_done_wk;
         struct work_struct sched_scan_results_wk;
 
-        struct mutex sched_scan_mtx;
-
 #ifdef CONFIG_NL80211_TESTMODE
         struct genl_info *testmode_info;
 #endif
@@ -84,8 +74,6 @@ struct cfg80211_registered_device {
         struct work_struct conn_work;
         struct work_struct event_work;
 
-        struct cfg80211_wowlan *wowlan;
-
         struct delayed_work dfs_update_channels_wk;
 
         /* netlink port which started critical protocol (0 means not started) */
@@ -106,29 +94,26 @@ struct cfg80211_registered_device *wiphy_to_dev(struct wiphy *wiphy)
 static inline void
 cfg80211_rdev_free_wowlan(struct cfg80211_registered_device *rdev)
 {
+#ifdef CONFIG_PM
         int i;
 
-        if (!rdev->wowlan)
+        if (!rdev->wiphy.wowlan_config)
                 return;
-        for (i = 0; i < rdev->wowlan->n_patterns; i++)
-                kfree(rdev->wowlan->patterns[i].mask);
-        kfree(rdev->wowlan->patterns);
-        if (rdev->wowlan->tcp && rdev->wowlan->tcp->sock)
-                sock_release(rdev->wowlan->tcp->sock);
-        kfree(rdev->wowlan->tcp);
-        kfree(rdev->wowlan);
+        for (i = 0; i < rdev->wiphy.wowlan_config->n_patterns; i++)
+                kfree(rdev->wiphy.wowlan_config->patterns[i].mask);
+        kfree(rdev->wiphy.wowlan_config->patterns);
+        if (rdev->wiphy.wowlan_config->tcp &&
+            rdev->wiphy.wowlan_config->tcp->sock)
+                sock_release(rdev->wiphy.wowlan_config->tcp->sock);
+        kfree(rdev->wiphy.wowlan_config->tcp);
+        kfree(rdev->wiphy.wowlan_config);
+#endif
 }
 
 extern struct workqueue_struct *cfg80211_wq;
-extern struct mutex cfg80211_mutex;
 extern struct list_head cfg80211_rdev_list;
 extern int cfg80211_rdev_list_generation;
 
-static inline void assert_cfg80211_lock(void)
-{
-        lockdep_assert_held(&cfg80211_mutex);
-}
-
 struct cfg80211_internal_bss {
         struct list_head list;
         struct list_head hidden_list;
@@ -161,27 +146,11 @@ static inline void cfg80211_unhold_bss(struct cfg80211_internal_bss *bss)
 struct cfg80211_registered_device *cfg80211_rdev_by_wiphy_idx(int wiphy_idx);
 int get_wiphy_idx(struct wiphy *wiphy);
 
-/* requires cfg80211_rdev_mutex to be held! */
 struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx);
 
-/* identical to cfg80211_get_dev_from_info but only operate on ifindex */
-extern struct cfg80211_registered_device *
-cfg80211_get_dev_from_ifindex(struct net *net, int ifindex);
-
 int cfg80211_switch_netns(struct cfg80211_registered_device *rdev,
                           struct net *net);
 
-static inline void cfg80211_lock_rdev(struct cfg80211_registered_device *rdev)
-{
-        mutex_lock(&rdev->mtx);
-}
-
-static inline void cfg80211_unlock_rdev(struct cfg80211_registered_device *rdev)
-{
-        BUG_ON(IS_ERR(rdev) || !rdev);
-        mutex_unlock(&rdev->mtx);
-}
-
 static inline void wdev_lock(struct wireless_dev *wdev)
         __acquires(wdev)
 {
@@ -196,7 +165,7 @@ static inline void wdev_unlock(struct wireless_dev *wdev)
         mutex_unlock(&wdev->mtx);
 }
 
-#define ASSERT_RDEV_LOCK(rdev) lockdep_assert_held(&(rdev)->mtx)
+#define ASSERT_RDEV_LOCK(rdev) ASSERT_RTNL()
 #define ASSERT_WDEV_LOCK(wdev) lockdep_assert_held(&(wdev)->mtx)
 
 static inline bool cfg80211_has_monitors_only(struct cfg80211_registered_device *rdev)
@@ -314,38 +283,21 @@ int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
                      struct net_device *dev);
 
 /* MLME */
-int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_auth_type auth_type,
-                         const u8 *bssid,
-                         const u8 *ssid, int ssid_len,
-                         const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         const u8 *sae_data, int sae_data_len);
 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev, struct ieee80211_channel *chan,
-                       enum nl80211_auth_type auth_type, const u8 *bssid,
+                       struct net_device *dev,
+                       struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type,
+                       const u8 *bssid,
                        const u8 *ssid, int ssid_len,
                        const u8 *ie, int ie_len,
                        const u8 *key, int key_len, int key_idx,
                        const u8 *sae_data, int sae_data_len);
-int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev,
-                          struct ieee80211_channel *chan,
-                          const u8 *bssid,
-                          const u8 *ssid, int ssid_len,
-                          struct cfg80211_assoc_request *req);
 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                         struct net_device *dev,
                         struct ieee80211_channel *chan,
                         const u8 *bssid,
                         const u8 *ssid, int ssid_len,
                         struct cfg80211_assoc_request *req);
-int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change);
 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                          struct net_device *dev, const u8 *bssid,
                          const u8 *ie, int ie_len, u16 reason,
@@ -377,18 +329,11 @@ void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                                 const struct ieee80211_vht_cap *vht_capa_mask);
 
 /* SME */
-int __cfg80211_connect(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys,
-                       const u8 *prev_bssid);
 int cfg80211_connect(struct cfg80211_registered_device *rdev,
                      struct net_device *dev,
                      struct cfg80211_connect_params *connect,
-                     struct cfg80211_cached_keys *connkeys);
-int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev, u16 reason,
-                          bool wextev);
+                     struct cfg80211_cached_keys *connkeys,
+                     const u8 *prev_bssid);
 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                         struct net_device *dev, u16 reason,
                         bool wextev);
diff --git a/net/wireless/debugfs.c b/net/wireless/debugfs.c
index 920cabe0461b..90d050036624 100644
--- a/net/wireless/debugfs.c
+++ b/net/wireless/debugfs.c
@@ -74,7 +74,7 @@ static ssize_t ht40allow_map_read(struct file *file,
         if (!buf)
                 return -ENOMEM;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                 sband = wiphy->bands[band];
@@ -85,7 +85,7 @@ static ssize_t ht40allow_map_read(struct file *file,
                                                 buf, buf_size, offset);
         }
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         r = simple_read_from_buffer(user_buf, count, ppos, buf, offset);
 
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index d80e47194d49..5449c5a6de84 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -152,11 +152,11 @@ int cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
-        mutex_lock(&rdev->devlist_mtx);
+        ASSERT_RTNL();
+
         wdev_lock(wdev);
         err = __cfg80211_join_ibss(rdev, dev, params, connkeys);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -359,11 +359,9 @@ int cfg80211_ibss_wext_siwfreq(struct net_device *dev,
                 wdev->wext.ibss.channel_fixed = false;
         }
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -429,11 +427,9 @@ int cfg80211_ibss_wext_siwessid(struct net_device *dev,
         memcpy(wdev->wext.ibss.ssid, ssid, len);
         wdev->wext.ibss.ssid_len = len;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -512,11 +508,9 @@ int cfg80211_ibss_wext_siwap(struct net_device *dev,
         } else
                 wdev->wext.ibss.bssid = NULL;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = cfg80211_ibss_wext_join(rdev, wdev);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 0bb93f3061a4..5dfb289ab761 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -82,6 +82,7 @@ const struct mesh_setup default_mesh_setup = {
         .sync_method = IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET,
         .path_sel_proto = IEEE80211_PATH_PROTOCOL_HWMP,
         .path_metric = IEEE80211_PATH_METRIC_AIRTIME,
+        .auth_id = 0, /* open */
         .ie = NULL,
         .ie_len = 0,
         .is_secure = false,
@@ -185,11 +186,9 @@ int cfg80211_join_mesh(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
         err = __cfg80211_join_mesh(rdev, dev, setup, conf);
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 0c7b7dd855f6..7bde5d9c0003 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -25,12 +25,9 @@ void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
         trace_cfg80211_send_rx_auth(dev);
-        wdev_lock(wdev);
 
         nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
         cfg80211_sme_rx_auth(dev, buf, len);
-
-        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_auth);
 
@@ -46,7 +43,6 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
         int ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
 
         trace_cfg80211_send_rx_assoc(dev, bss);
-        wdev_lock(wdev);
 
         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
 
@@ -59,7 +55,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
             cfg80211_sme_failed_reassoc(wdev)) {
                 cfg80211_put_bss(wiphy, bss);
-                goto out;
+                return;
         }
 
         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
@@ -71,7 +67,7 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
                  * sme will schedule work that does it later.
                  */
                 cfg80211_put_bss(wiphy, bss);
-                goto out;
+                return;
         }
 
         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
@@ -87,13 +83,11 @@ void cfg80211_send_rx_assoc(struct net_device *dev, struct cfg80211_bss *bss,
         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
                                   status_code,
                                   status_code == WLAN_STATUS_SUCCESS, bss);
- out:
-        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 
-void __cfg80211_send_deauth(struct net_device *dev,
-                                   const u8 *buf, size_t len)
+void cfg80211_send_deauth(struct net_device *dev,
+                          const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
@@ -102,7 +96,7 @@ void __cfg80211_send_deauth(struct net_device *dev,
         const u8 *bssid = mgmt->bssid;
         bool was_current = false;
 
-        trace___cfg80211_send_deauth(dev);
+        trace_cfg80211_send_deauth(dev);
         ASSERT_WDEV_LOCK(wdev);
 
         if (wdev->current_bss &&
@@ -129,20 +123,10 @@ void __cfg80211_send_deauth(struct net_device *dev,
                                           false, NULL);
         }
 }
-EXPORT_SYMBOL(__cfg80211_send_deauth);
-
-void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-
-        wdev_lock(wdev);
-        __cfg80211_send_deauth(dev, buf, len);
-        wdev_unlock(wdev);
-}
 EXPORT_SYMBOL(cfg80211_send_deauth);
 
-void __cfg80211_send_disassoc(struct net_device *dev,
-                                     const u8 *buf, size_t len)
+void cfg80211_send_disassoc(struct net_device *dev,
+                            const u8 *buf, size_t len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct wiphy *wiphy = wdev->wiphy;
@@ -152,7 +136,7 @@ void __cfg80211_send_disassoc(struct net_device *dev,
         u16 reason_code;
         bool from_ap;
 
-        trace___cfg80211_send_disassoc(dev);
+        trace_cfg80211_send_disassoc(dev);
         ASSERT_WDEV_LOCK(wdev);
 
         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
@@ -175,16 +159,6 @@ void __cfg80211_send_disassoc(struct net_device *dev,
         from_ap = !ether_addr_equal(mgmt->sa, dev->dev_addr);
         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 }
-EXPORT_SYMBOL(__cfg80211_send_disassoc);
-
-void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-
-        wdev_lock(wdev);
-        __cfg80211_send_disassoc(dev, buf, len);
-        wdev_unlock(wdev);
-}
 EXPORT_SYMBOL(cfg80211_send_disassoc);
 
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
@@ -194,15 +168,12 @@ void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
         trace_cfg80211_send_auth_timeout(dev, addr);
-        wdev_lock(wdev);
 
         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
         if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
                                           false, NULL);
-
-        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 
@@ -213,15 +184,12 @@ void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 
         trace_cfg80211_send_assoc_timeout(dev, addr);
-        wdev_lock(wdev);
 
         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
         if (wdev->sme_state == CFG80211_SME_CONNECTING)
                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
                                           false, NULL);
-
-        wdev_unlock(wdev);
 }
 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 
@@ -253,18 +221,27 @@ void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 
 /* some MLME handling for userspace SME */
-int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev,
-                         struct ieee80211_channel *chan,
-                         enum nl80211_auth_type auth_type,
-                         const u8 *bssid,
-                         const u8 *ssid, int ssid_len,
-                         const u8 *ie, int ie_len,
-                         const u8 *key, int key_len, int key_idx,
-                         const u8 *sae_data, int sae_data_len)
+int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
+                       struct net_device *dev,
+                       struct ieee80211_channel *chan,
+                       enum nl80211_auth_type auth_type,
+                       const u8 *bssid,
+                       const u8 *ssid, int ssid_len,
+                       const u8 *ie, int ie_len,
+                       const u8 *key, int key_len, int key_idx,
+                       const u8 *sae_data, int sae_data_len)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_auth_request req;
+        struct cfg80211_auth_request req = {
+                .ie = ie,
+                .ie_len = ie_len,
+                .sae_data = sae_data,
+                .sae_data_len = sae_data_len,
+                .auth_type = auth_type,
+                .key = key,
+                .key_len = key_len,
+                .key_idx = key_idx,
+        };
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -277,18 +254,8 @@ int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
             ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
                 return -EALREADY;
 
-        memset(&req, 0, sizeof(req));
-
-        req.ie = ie;
-        req.ie_len = ie_len;
-        req.sae_data = sae_data;
-        req.sae_data_len = sae_data_len;
-        req.auth_type = auth_type;
         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        req.key = key;
-        req.key_len = key_len;
-        req.key_idx = key_idx;
         if (!req.bss)
                 return -ENOENT;
 
@@ -304,28 +271,6 @@ out:
         return err;
 }
 
-int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev, struct ieee80211_channel *chan,
-                       enum nl80211_auth_type auth_type, const u8 *bssid,
-                       const u8 *ssid, int ssid_len,
-                       const u8 *ie, int ie_len,
-                       const u8 *key, int key_len, int key_idx,
-                       const u8 *sae_data, int sae_data_len)
-{
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
-                                   ssid, ssid_len, ie, ie_len,
-                                   key, key_len, key_idx,
-                                   sae_data, sae_data_len);
-        wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
-}
-
 /*  Do a logical ht_capa &= ht_capa_mask.  */
 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
                                const struct ieee80211_ht_cap *ht_capa_mask)
@@ -360,12 +305,12 @@ void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
                 p1[i] &= p2[i];
 }
 
-int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev,
-                          struct ieee80211_channel *chan,
-                          const u8 *bssid,
-                          const u8 *ssid, int ssid_len,
-                          struct cfg80211_assoc_request *req)
+int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev,
+                        struct ieee80211_channel *chan,
+                        const u8 *bssid,
+                        const u8 *ssid, int ssid_len,
+                        struct cfg80211_assoc_request *req)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -415,30 +360,10 @@ out:
         return err;
 }
 
-int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev,
-                        struct ieee80211_channel *chan,
-                        const u8 *bssid,
-                        const u8 *ssid, int ssid_len,
-                        struct cfg80211_assoc_request *req)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid,
-                                    ssid, ssid_len, req);
-        wdev_unlock(wdev);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
-}
-
-int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change)
+int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
+                         struct net_device *dev, const u8 *bssid,
+                         const u8 *ie, int ie_len, u16 reason,
+                         bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_deauth_request req = {
@@ -458,29 +383,18 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
         return rdev_deauth(rdev, dev, &req);
 }
 
-int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
-                         struct net_device *dev, const u8 *bssid,
-                         const u8 *ie, int ie_len, u16 reason,
-                         bool local_state_change)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
-                                     local_state_change);
-        wdev_unlock(wdev);
-
-        return err;
-}
-
-static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
-                                    struct net_device *dev, const u8 *bssid,
-                                    const u8 *ie, int ie_len, u16 reason,
-                                    bool local_state_change)
+int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
+                           struct net_device *dev, const u8 *bssid,
+                           const u8 *ie, int ie_len, u16 reason,
+                           bool local_state_change)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_disassoc_request req;
+        struct cfg80211_disassoc_request req = {
+                .reason_code = reason,
+                .local_state_change = local_state_change,
+                .ie = ie,
+                .ie_len = ie_len,
+        };
 
         ASSERT_WDEV_LOCK(wdev);
 
@@ -490,11 +404,6 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
         if (WARN(!wdev->current_bss, "sme_state=%d\n", wdev->sme_state))
                 return -ENOTCONN;
 
-        memset(&req, 0, sizeof(req));
-        req.reason_code = reason;
-        req.local_state_change = local_state_change;
-        req.ie = ie;
-        req.ie_len = ie_len;
         if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
                 req.bss = &wdev->current_bss->pub;
         else
@@ -503,44 +412,25 @@ static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
         return rdev_disassoc(rdev, dev, &req);
 }
 
-int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
-                           struct net_device *dev, const u8 *bssid,
-                           const u8 *ie, int ie_len, u16 reason,
-                           bool local_state_change)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        int err;
-
-        wdev_lock(wdev);
-        err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
-                                       local_state_change);
-        wdev_unlock(wdev);
-
-        return err;
-}
-
 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
                         struct net_device *dev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_deauth_request req;
         u8 bssid[ETH_ALEN];
+        struct cfg80211_deauth_request req = {
+                .reason_code = WLAN_REASON_DEAUTH_LEAVING,
+                .bssid = bssid,
+        };
 
         ASSERT_WDEV_LOCK(wdev);
 
         if (!rdev->ops->deauth)
                 return;
 
-        memset(&req, 0, sizeof(req));
-        req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
-        req.ie = NULL;
-        req.ie_len = 0;
-
         if (!wdev->current_bss)
                 return;
 
         memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
-        req.bssid = bssid;
         rdev_deauth(rdev, dev, &req);
 
         if (wdev->current_bss) {
@@ -848,7 +738,7 @@ void cfg80211_dfs_channels_update_work(struct work_struct *work)
                             dfs_update_channels_wk);
         wiphy = &rdev->wiphy;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
         for (bandid = 0; bandid < IEEE80211_NUM_BANDS; bandid++) {
                 sband = wiphy->bands[bandid];
                 if (!sband)
@@ -881,7 +771,7 @@ void cfg80211_dfs_channels_update_work(struct work_struct *work)
                         check_again = true;
                 }
         }
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         /* reschedule if there are other channels waiting to be cleared again */
         if (check_again)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index d5aed3bb3945..31d265f36d2c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -37,10 +37,10 @@ static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
 
 /* the netlink family */
 static struct genl_family nl80211_fam = {
-        .id = GENL_ID_GENERATE, /* don't bother with a hardcoded ID */
-        .name = "nl80211",      /* have users key off the name instead */
-        .hdrsize = 0,           /* no private header */
-        .version = 1,           /* no particular meaning now */
+        .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
+        .name = NL80211_GENL_NAME,      /* have users key off the name instead */
+        .hdrsize = 0,                   /* no private header */
+        .version = 1,                   /* no particular meaning now */
         .maxattr = NL80211_ATTR_MAX,
         .netnsok = true,
         .pre_doit = nl80211_pre_doit,
@@ -59,7 +59,7 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
         int wiphy_idx = -1;
         int ifidx = -1;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         if (!have_ifidx && !have_wdev_id)
                 return ERR_PTR(-EINVAL);
@@ -80,7 +80,6 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
                         continue;
 
-                mutex_lock(&rdev->devlist_mtx);
                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
                         if (have_ifidx && wdev->netdev &&
                             wdev->netdev->ifindex == ifidx) {
@@ -92,7 +91,6 @@ __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
                                 break;
                         }
                 }
-                mutex_unlock(&rdev->devlist_mtx);
 
                 if (result)
                         break;
@@ -109,7 +107,7 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
         struct cfg80211_registered_device *rdev = NULL, *tmp;
         struct net_device *netdev;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         if (!attrs[NL80211_ATTR_WIPHY] &&
             !attrs[NL80211_ATTR_IFINDEX] &&
@@ -128,14 +126,12 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
                 if (tmp) {
                         /* make sure wdev exists */
-                        mutex_lock(&tmp->devlist_mtx);
                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
                                 if (wdev->identifier != (u32)wdev_id)
                                         continue;
                                 found = true;
                                 break;
                         }
-                        mutex_unlock(&tmp->devlist_mtx);
 
                         if (!found)
                                 tmp = NULL;
@@ -182,19 +178,6 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 /*
  * This function returns a pointer to the driver
  * that the genl_info item that is passed refers to.
- * If successful, it returns non-NULL and also locks
- * the driver's mutex!
- *
- * This means that you need to call cfg80211_unlock_rdev()
- * before being allowed to acquire &cfg80211_mutex!
- *
- * This is necessary because we need to lock the global
- * mutex to get an item off the list safely, and then
- * we lock the rdev mutex so it doesn't go away under us.
- *
- * We don't want to keep cfg80211_mutex locked
- * for all the time in order to allow requests on
- * other interfaces to go through at the same time.
  *
  * The result of this can be a PTR_ERR and hence must
  * be checked with IS_ERR() for errors.
@@ -202,20 +185,7 @@ __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 static struct cfg80211_registered_device *
 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 {
-        struct cfg80211_registered_device *rdev;
-
-        mutex_lock(&cfg80211_mutex);
-        rdev = __cfg80211_rdev_from_attrs(netns, info->attrs);
-
-        /* if it is not an error we grab the lock on
-         * it to assure it won't be going away while
-         * we operate on it */
-        if (!IS_ERR(rdev))
-                mutex_lock(&rdev->mtx);
-
-        mutex_unlock(&cfg80211_mutex);
-
-        return rdev;
+        return __cfg80211_rdev_from_attrs(netns, info->attrs);
 }
 
 /* policy for the attributes */
@@ -378,6 +348,7 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
                                   .len = IEEE80211_MAX_DATA_LEN },
+        [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 };
 
 /* policy for the key attributes */
@@ -455,7 +426,6 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
         int err;
 
         rtnl_lock();
-        mutex_lock(&cfg80211_mutex);
 
         if (!cb->args[0]) {
                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
@@ -484,14 +454,12 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 *rdev = wiphy_to_dev(wiphy);
                 *wdev = NULL;
 
-                mutex_lock(&(*rdev)->devlist_mtx);
                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
                         if (tmp->identifier == cb->args[1]) {
                                 *wdev = tmp;
                                 break;
                         }
                 }
-                mutex_unlock(&(*rdev)->devlist_mtx);
 
                 if (!*wdev) {
                         err = -ENODEV;
@@ -499,19 +467,14 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                 }
         }
 
-        cfg80211_lock_rdev(*rdev);
-
-        mutex_unlock(&cfg80211_mutex);
         return 0;
  out_unlock:
-        mutex_unlock(&cfg80211_mutex);
         rtnl_unlock();
         return err;
 }
 
 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 {
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
@@ -1567,7 +1530,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
         struct nlattr **tb = nl80211_fam.attrbuf;
         int res;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
         res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
                           tb, nl80211_fam.maxattr, nl80211_policy);
         if (res == 0) {
@@ -1581,10 +1544,8 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                         int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 
                         netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
-                        if (!netdev) {
-                                mutex_unlock(&cfg80211_mutex);
+                        if (!netdev)
                                 return -ENODEV;
-                        }
                         if (netdev->ieee80211_ptr) {
                                 dev = wiphy_to_dev(
                                         netdev->ieee80211_ptr->wiphy);
@@ -1628,7 +1589,6 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                                     !skb->len &&
                                     cb->min_dump_alloc < 4096) {
                                         cb->min_dump_alloc = 4096;
-                                        mutex_unlock(&cfg80211_mutex);
                                         return 1;
                                 }
                                 idx--;
@@ -1637,7 +1597,7 @@ static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
                 } while (cb->args[1] > 0);
                 break;
         }
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         cb->args[0] = idx;
 
@@ -1792,7 +1752,6 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         if (result)
                 return result;
 
-        mutex_lock(&rdev->devlist_mtx);
         switch (iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_P2P_GO:
@@ -1816,7 +1775,6 @@ static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
         default:
                 result = -EINVAL;
         }
-        mutex_unlock(&rdev->devlist_mtx);
 
         return result;
 }
@@ -1865,6 +1823,8 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         u32 frag_threshold = 0, rts_threshold = 0;
         u8 coverage_class = 0;
 
+        ASSERT_RTNL();
+
         /*
          * Try to find the wiphy and netdev. Normally this
          * function shouldn't need the netdev, but this is
@@ -1874,31 +1834,25 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
          * also passed a netdev to set_wiphy, so that it is
          * possible to let that go to the right netdev!
          */
-        mutex_lock(&cfg80211_mutex);
 
         if (info->attrs[NL80211_ATTR_IFINDEX]) {
                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 
                 netdev = dev_get_by_index(genl_info_net(info), ifindex);
-                if (netdev && netdev->ieee80211_ptr) {
+                if (netdev && netdev->ieee80211_ptr)
                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
-                        mutex_lock(&rdev->mtx);
-                } else
+                else
                         netdev = NULL;
         }
 
         if (!netdev) {
                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
                                                   info->attrs);
-                if (IS_ERR(rdev)) {
-                        mutex_unlock(&cfg80211_mutex);
+                if (IS_ERR(rdev))
                         return PTR_ERR(rdev);
-                }
                 wdev = NULL;
                 netdev = NULL;
                 result = 0;
-
-                mutex_lock(&rdev->mtx);
         } else
                 wdev = netdev->ieee80211_ptr;
 
@@ -1911,8 +1865,6 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
                 result = cfg80211_dev_rename(
                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 
-        mutex_unlock(&cfg80211_mutex);
-
         if (result)
                 goto bad_res;
 
@@ -2119,7 +2071,6 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
         }
 
  bad_res:
-        mutex_unlock(&rdev->mtx);
         if (netdev)
                 dev_put(netdev);
         return result;
@@ -2217,7 +2168,7 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
         struct cfg80211_registered_device *rdev;
         struct wireless_dev *wdev;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
                         continue;
@@ -2227,7 +2178,6 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                 }
                 if_idx = 0;
 
-                mutex_lock(&rdev->devlist_mtx);
                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
                         if (if_idx < if_start) {
                                 if_idx++;
@@ -2236,17 +2186,15 @@ static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *
                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
                                                rdev, wdev) < 0) {
-                                mutex_unlock(&rdev->devlist_mtx);
                                 goto out;
                         }
                         if_idx++;
                 }
-                mutex_unlock(&rdev->devlist_mtx);
 
                 wp_idx++;
         }
  out:
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 
         cb->args[0] = wp_idx;
         cb->args[1] = if_idx;
@@ -2279,6 +2227,7 @@ static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
+        [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
 };
 
 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
@@ -2390,6 +2339,10 @@ static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
                 change = true;
         }
 
+        if (flags && (*flags & NL80211_MNTR_FLAG_ACTIVE) &&
+            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+                return -EOPNOTSUPP;
+
         if (change)
                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
         else
@@ -2447,6 +2400,11 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
                                   &flags);
+
+        if (!err && (flags & NL80211_MNTR_FLAG_ACTIVE) &&
+            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
+                return -EOPNOTSUPP;
+
         wdev = rdev_add_virtual_intf(rdev,
                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
                                 type, err ? NULL : &flags, &params);
@@ -2479,11 +2437,9 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
                 spin_lock_init(&wdev->mgmt_registrations_lock);
 
-                mutex_lock(&rdev->devlist_mtx);
                 wdev->identifier = ++rdev->wdev_id;
                 list_add_rcu(&wdev->list, &rdev->wdev_list);
                 rdev->devlist_generation++;
-                mutex_unlock(&rdev->devlist_mtx);
                 break;
         default:
                 break;
@@ -2992,8 +2948,6 @@ static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
         struct wireless_dev *wdev;
         bool ret = false;
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (wdev->iftype != NL80211_IFTYPE_AP &&
                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
@@ -3007,8 +2961,6 @@ static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
                 break;
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
-
         return ret;
 }
 
@@ -3170,13 +3122,10 @@ static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
                 params.radar_required = true;
         }
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
                                            params.chandef.chan,
                                            CHAN_MODE_SHARED,
                                            radar_detect_width);
-        mutex_unlock(&rdev->devlist_mtx);
-
         if (err)
                 return err;
 
@@ -3376,6 +3325,32 @@ static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
         return true;
 }
 
+static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
+                               int id)
+{
+        void *attr;
+        int i = 0;
+
+        if (!mask)
+                return true;
+
+        attr = nla_nest_start(msg, id);
+        if (!attr)
+                return false;
+
+        for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
+                if (!(mask & BIT(i)))
+                        continue;
+
+                if (nla_put_u8(msg, i, signal[i]))
+                        return false;
+        }
+
+        nla_nest_end(msg, attr);
+
+        return true;
+}
+
 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
                                 int flags,
                                 struct cfg80211_registered_device *rdev,
@@ -3447,6 +3422,18 @@ static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
         default:
                 break;
         }
+        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
+                if (!nl80211_put_signal(msg, sinfo->chains,
+                                        sinfo->chain_signal,
+                                        NL80211_STA_INFO_CHAIN_SIGNAL))
+                        goto nla_put_failure;
+        }
+        if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
+                if (!nl80211_put_signal(msg, sinfo->chains,
+                                        sinfo->chain_signal_avg,
+                                        NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
+                        goto nla_put_failure;
+        }
         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
                                           NL80211_STA_INFO_TX_BITRATE))
@@ -3834,6 +3821,8 @@ static int nl80211_set_station_tdls(struct genl_info *info,
                                     struct station_parameters *params)
 {
         /* Dummy STA entry gets updated once the peer capabilities are known */
+        if (info->attrs[NL80211_ATTR_PEER_AID])
+                params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
                 params->ht_capa =
                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
@@ -3974,7 +3963,8 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
                 return -EINVAL;
 
-        if (!info->attrs[NL80211_ATTR_STA_AID])
+        if (!info->attrs[NL80211_ATTR_STA_AID] &&
+            !info->attrs[NL80211_ATTR_PEER_AID])
                 return -EINVAL;
 
         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
@@ -3985,7 +3975,10 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
         params.listen_interval =
                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 
-        params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        if (info->attrs[NL80211_ATTR_STA_AID])
+                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
+        else
+                params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
         if (!params.aid || params.aid > IEEE80211_MAX_AID)
                 return -EINVAL;
 
@@ -4634,6 +4627,7 @@ static const struct nla_policy
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
+        [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                                     .len = IEEE80211_MAX_DATA_LEN },
@@ -4819,6 +4813,13 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
         if (setup->is_secure)
                 setup->user_mpm = true;
 
+        if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
+                if (!setup->user_mpm)
+                        return -EINVAL;
+                setup->auth_id =
+                        nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
+        }
+
         return 0;
 }
 
@@ -4861,18 +4862,13 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         void *hdr = NULL;
         struct nlattr *nl_reg_rules;
         unsigned int i;
-        int err = -EINVAL;
-
-        mutex_lock(&cfg80211_mutex);
 
         if (!cfg80211_regdomain)
-                goto out;
+                return -EINVAL;
 
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
-        if (!msg) {
-                err = -ENOBUFS;
-                goto out;
-        }
+        if (!msg)
+                return -ENOBUFS;
 
         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
                              NL80211_CMD_GET_REG);
@@ -4931,8 +4927,7 @@ static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
         nla_nest_end(msg, nl_reg_rules);
 
         genlmsg_end(msg, hdr);
-        err = genlmsg_reply(msg, info);
-        goto out;
+        return genlmsg_reply(msg, info);
 
 nla_put_failure_rcu:
         rcu_read_unlock();
@@ -4940,10 +4935,7 @@ nla_put_failure:
         genlmsg_cancel(msg, hdr);
 put_failure:
         nlmsg_free(msg);
-        err = -EMSGSIZE;
-out:
-        mutex_unlock(&cfg80211_mutex);
-        return err;
+        return -EMSGSIZE;
 }
 
 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
@@ -5009,12 +5001,9 @@ static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
                 }
         }
 
-        mutex_lock(&cfg80211_mutex);
-
         r = set_regdom(rd);
         /* set_regdom took ownership */
         rd = NULL;
-        mutex_unlock(&cfg80211_mutex);
 
  bad_reg:
         kfree(rd);
@@ -5064,7 +5053,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->scan)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto unlock;
@@ -5250,7 +5238,6 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
         }
 
  unlock:
-        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -5322,8 +5309,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
         if (ie_len > wiphy->max_sched_scan_ie_len)
                 return -EINVAL;
 
-        mutex_lock(&rdev->sched_scan_mtx);
-
         if (rdev->sched_scan_req) {
                 err = -EINPROGRESS;
                 goto out;
@@ -5491,7 +5476,6 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
 out_free:
         kfree(request);
 out:
-        mutex_unlock(&rdev->sched_scan_mtx);
         return err;
 }
 
@@ -5499,17 +5483,12 @@ static int nl80211_stop_sched_scan(struct sk_buff *skb,
                                    struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        int err;
 
         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
             !rdev->ops->sched_scan_stop)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->sched_scan_mtx);
-        err = __cfg80211_stop_sched_scan(rdev, false);
-        mutex_unlock(&rdev->sched_scan_mtx);
-
-        return err;
+        return __cfg80211_stop_sched_scan(rdev, false);
 }
 
 static int nl80211_start_radar_detection(struct sk_buff *skb,
@@ -5541,12 +5520,11 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
         if (!rdev->ops->start_radar_detection)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
                                            chandef.chan, CHAN_MODE_SHARED,
                                            BIT(chandef.width));
         if (err)
-                goto err_locked;
+                return err;
 
         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
         if (!err) {
@@ -5554,9 +5532,6 @@ static int nl80211_start_radar_detection(struct sk_buff *skb,
                 wdev->cac_started = true;
                 wdev->cac_start_time = jiffies;
         }
-err_locked:
-        mutex_unlock(&rdev->devlist_mtx);
-
         return err;
 }
 
@@ -5939,10 +5914,13 @@ static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
         if (local_state_change)
                 return 0;
 
-        return cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
-                                  ssid, ssid_len, ie, ie_len,
-                                  key.p.key, key.p.key_len, key.idx,
-                                  sae_data, sae_data_len);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
+                                 ssid, ssid_len, ie, ie_len,
+                                 key.p.key, key.p.key_len, key.idx,
+                                 sae_data, sae_data_len);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
@@ -6109,9 +6087,12 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         }
 
         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
-        if (!err)
+        if (!err) {
+                wdev_lock(dev->ieee80211_ptr);
                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
                                           ssid, ssid_len, &req);
+                wdev_unlock(dev->ieee80211_ptr);
+        }
 
         return err;
 }
@@ -6121,7 +6102,7 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         const u8 *ie = NULL, *bssid;
-        int ie_len = 0;
+        int ie_len = 0, err;
         u16 reason_code;
         bool local_state_change;
 
@@ -6156,8 +6137,11 @@ static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
 
         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
 
-        return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
-                                    local_state_change);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
+                                   local_state_change);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
@@ -6165,7 +6149,7 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         const u8 *ie = NULL, *bssid;
-        int ie_len = 0;
+        int ie_len = 0, err;
         u16 reason_code;
         bool local_state_change;
 
@@ -6200,8 +6184,11 @@ static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
 
         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
 
-        return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
-                                      local_state_change);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
+                                     local_state_change);
+        wdev_unlock(dev->ieee80211_ptr);
+        return err;
 }
 
 static bool
@@ -6419,6 +6406,8 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
         void *data = NULL;
         int data_len = 0;
 
+        rtnl_lock();
+
         if (cb->args[0]) {
                 /*
                  * 0 is a valid index, but not valid for args[0],
@@ -6430,18 +6419,16 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
                                   nl80211_policy);
                 if (err)
-                        return err;
+                        goto out_err;
 
-                mutex_lock(&cfg80211_mutex);
                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
                                                   nl80211_fam.attrbuf);
                 if (IS_ERR(rdev)) {
-                        mutex_unlock(&cfg80211_mutex);
-                        return PTR_ERR(rdev);
+                        err = PTR_ERR(rdev);
+                        goto out_err;
                 }
                 phy_idx = rdev->wiphy_idx;
                 rdev = NULL;
-                mutex_unlock(&cfg80211_mutex);
 
                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
                         cb->args[1] =
@@ -6453,14 +6440,11 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
                 data_len = nla_len((void *)cb->args[1]);
         }
 
-        mutex_lock(&cfg80211_mutex);
         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
         if (!rdev) {
-                mutex_unlock(&cfg80211_mutex);
-                return -ENOENT;
+                err = -ENOENT;
+                goto out_err;
         }
-        cfg80211_lock_rdev(rdev);
-        mutex_unlock(&cfg80211_mutex);
 
         if (!rdev->ops->testmode_dump) {
                 err = -EOPNOTSUPP;
@@ -6501,7 +6485,7 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
         /* see above */
         cb->args[0] = phy_idx + 1;
  out_err:
-        cfg80211_unlock_rdev(rdev);
+        rtnl_unlock();
         return err;
 }
 
@@ -6709,7 +6693,9 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                        sizeof(connect.vht_capa));
         }
 
-        err = cfg80211_connect(rdev, dev, &connect, connkeys);
+        wdev_lock(dev->ieee80211_ptr);
+        err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
+        wdev_unlock(dev->ieee80211_ptr);
         if (err)
                 kfree(connkeys);
         return err;
@@ -6720,6 +6706,7 @@ static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
         u16 reason;
+        int ret;
 
         if (!info->attrs[NL80211_ATTR_REASON_CODE])
                 reason = WLAN_REASON_DEAUTH_LEAVING;
@@ -6733,7 +6720,10 @@ static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
                 return -EOPNOTSUPP;
 
-        return cfg80211_disconnect(rdev, dev, reason, true);
+        wdev_lock(dev->ieee80211_ptr);
+        ret = cfg80211_disconnect(rdev, dev, reason, true);
+        wdev_unlock(dev->ieee80211_ptr);
+        return ret;
 }
 
 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
@@ -7509,28 +7499,29 @@ static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
                                         struct cfg80211_registered_device *rdev)
 {
+        struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
         struct nlattr *nl_pats, *nl_pat;
         int i, pat_len;
 
-        if (!rdev->wowlan->n_patterns)
+        if (!wowlan->n_patterns)
                 return 0;
 
         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
         if (!nl_pats)
                 return -ENOBUFS;
 
-        for (i = 0; i < rdev->wowlan->n_patterns; i++) {
+        for (i = 0; i < wowlan->n_patterns; i++) {
                 nl_pat = nla_nest_start(msg, i + 1);
                 if (!nl_pat)
                         return -ENOBUFS;
-                pat_len = rdev->wowlan->patterns[i].pattern_len;
+                pat_len = wowlan->patterns[i].pattern_len;
                 if (nla_put(msg, NL80211_WOWLAN_PKTPAT_MASK,
                             DIV_ROUND_UP(pat_len, 8),
-                            rdev->wowlan->patterns[i].mask) ||
+                            wowlan->patterns[i].mask) ||
                     nla_put(msg, NL80211_WOWLAN_PKTPAT_PATTERN,
-                            pat_len, rdev->wowlan->patterns[i].pattern) ||
+                            pat_len, wowlan->patterns[i].pattern) ||
                     nla_put_u32(msg, NL80211_WOWLAN_PKTPAT_OFFSET,
-                                rdev->wowlan->patterns[i].pkt_offset))
+                                wowlan->patterns[i].pkt_offset))
                         return -ENOBUFS;
                 nla_nest_end(msg, nl_pat);
         }
@@ -7593,12 +7584,12 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
             !rdev->wiphy.wowlan.tcp)
                 return -EOPNOTSUPP;
 
-        if (rdev->wowlan && rdev->wowlan->tcp) {
+        if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
                 /* adjust size to have room for all the data */
-                size += rdev->wowlan->tcp->tokens_size +
-                        rdev->wowlan->tcp->payload_len +
-                        rdev->wowlan->tcp->wake_len +
-                        rdev->wowlan->tcp->wake_len / 8;
+                size += rdev->wiphy.wowlan_config->tcp->tokens_size +
+                        rdev->wiphy.wowlan_config->tcp->payload_len +
+                        rdev->wiphy.wowlan_config->tcp->wake_len +
+                        rdev->wiphy.wowlan_config->tcp->wake_len / 8;
         }
 
         msg = nlmsg_new(size, GFP_KERNEL);
@@ -7610,33 +7601,34 @@ static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
         if (!hdr)
                 goto nla_put_failure;
 
-        if (rdev->wowlan) {
+        if (rdev->wiphy.wowlan_config) {
                 struct nlattr *nl_wowlan;
 
                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
                 if (!nl_wowlan)
                         goto nla_put_failure;
 
-                if ((rdev->wowlan->any &&
+                if ((rdev->wiphy.wowlan_config->any &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
-                    (rdev->wowlan->disconnect &&
+                    (rdev->wiphy.wowlan_config->disconnect &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
-                    (rdev->wowlan->magic_pkt &&
+                    (rdev->wiphy.wowlan_config->magic_pkt &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
-                    (rdev->wowlan->gtk_rekey_failure &&
+                    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
-                    (rdev->wowlan->eap_identity_req &&
+                    (rdev->wiphy.wowlan_config->eap_identity_req &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
-                    (rdev->wowlan->four_way_handshake &&
+                    (rdev->wiphy.wowlan_config->four_way_handshake &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
-                    (rdev->wowlan->rfkill_release &&
+                    (rdev->wiphy.wowlan_config->rfkill_release &&
                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
                         goto nla_put_failure;
 
                 if (nl80211_send_wowlan_patterns(msg, rdev))
                         goto nla_put_failure;
 
-                if (nl80211_send_wowlan_tcp(msg, rdev->wowlan->tcp))
+                if (nl80211_send_wowlan_tcp(msg,
+                                            rdev->wiphy.wowlan_config->tcp))
                         goto nla_put_failure;
 
                 nla_nest_end(msg, nl_wowlan);
@@ -7803,7 +7795,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
         struct cfg80211_wowlan *ntrig;
         struct wiphy_wowlan_support *wowlan = &rdev->wiphy.wowlan;
         int err, i;
-        bool prev_enabled = rdev->wowlan;
+        bool prev_enabled = rdev->wiphy.wowlan_config;
 
         if (!rdev->wiphy.wowlan.flags && !rdev->wiphy.wowlan.n_patterns &&
             !rdev->wiphy.wowlan.tcp)
@@ -7811,7 +7803,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
 
         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
                 cfg80211_rdev_free_wowlan(rdev);
-                rdev->wowlan = NULL;
+                rdev->wiphy.wowlan_config = NULL;
                 goto set_wakeup;
         }
 
@@ -7947,11 +7939,12 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                 goto error;
         }
         cfg80211_rdev_free_wowlan(rdev);
-        rdev->wowlan = ntrig;
+        rdev->wiphy.wowlan_config = ntrig;
 
  set_wakeup:
-        if (rdev->ops->set_wakeup && prev_enabled != !!rdev->wowlan)
-                rdev_set_wakeup(rdev, rdev->wowlan);
+        if (rdev->ops->set_wakeup &&
+            prev_enabled != !!rdev->wiphy.wowlan_config)
+                rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
 
         return 0;
  error:
@@ -8136,9 +8129,7 @@ static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (wdev->p2p_started)
                 return 0;
 
-        mutex_lock(&rdev->devlist_mtx);
         err = cfg80211_can_add_interface(rdev, wdev->iftype);
-        mutex_unlock(&rdev->devlist_mtx);
         if (err)
                 return err;
 
@@ -8147,9 +8138,7 @@ static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
                 return err;
 
         wdev->p2p_started = true;
-        mutex_lock(&rdev->devlist_mtx);
         rdev->opencount++;
-        mutex_unlock(&rdev->devlist_mtx);
 
         return 0;
 }
@@ -8165,11 +8154,7 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         if (!rdev->ops->stop_p2p_device)
                 return -EOPNOTSUPP;
 
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         cfg80211_stop_p2p_device(rdev, wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return 0;
 }
@@ -8312,11 +8297,11 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                 info->user_ptr[0] = rdev;
         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
-                mutex_lock(&cfg80211_mutex);
+                ASSERT_RTNL();
+
                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
                                                   info->attrs);
                 if (IS_ERR(wdev)) {
-                        mutex_unlock(&cfg80211_mutex);
                         if (rtnl)
                                 rtnl_unlock();
                         return PTR_ERR(wdev);
@@ -8327,7 +8312,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
 
                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
                         if (!dev) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -EINVAL;
@@ -8341,7 +8325,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                 if (dev) {
                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
                             !netif_running(dev)) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -ENETDOWN;
@@ -8350,17 +8333,12 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
                         dev_hold(dev);
                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
                         if (!wdev->p2p_started) {
-                                mutex_unlock(&cfg80211_mutex);
                                 if (rtnl)
                                         rtnl_unlock();
                                 return -ENETDOWN;
                         }
                 }
 
-                cfg80211_lock_rdev(rdev);
-
-                mutex_unlock(&cfg80211_mutex);
-
                 info->user_ptr[0] = rdev;
         }
 
@@ -8370,8 +8348,6 @@ static int nl80211_pre_doit(struct genl_ops *ops, struct sk_buff *skb,
 static void nl80211_post_doit(struct genl_ops *ops, struct sk_buff *skb,
                               struct genl_info *info)
 {
-        if (info->user_ptr[0])
-                cfg80211_unlock_rdev(info->user_ptr[0]);
         if (info->user_ptr[1]) {
                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
                         struct wireless_dev *wdev = info->user_ptr[1];
@@ -8393,7 +8369,8 @@ static struct genl_ops nl80211_ops[] = {
                 .dumpit = nl80211_dump_wiphy,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_WIPHY,
+                .internal_flags = NL80211_FLAG_NEED_WIPHY |
+                                  NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_SET_WIPHY,
@@ -8408,7 +8385,8 @@ static struct genl_ops nl80211_ops[] = {
                 .dumpit = nl80211_dump_interface,
                 .policy = nl80211_policy,
                 /* can be retrieved by unprivileged users */
-                .internal_flags = NL80211_FLAG_NEED_WDEV,
+                .internal_flags = NL80211_FLAG_NEED_WDEV |
+                                  NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_SET_INTERFACE,
@@ -8567,6 +8545,7 @@ static struct genl_ops nl80211_ops[] = {
                 .cmd = NL80211_CMD_GET_REG,
                 .doit = nl80211_get_reg,
                 .policy = nl80211_policy,
+                .internal_flags = NL80211_FLAG_NEED_RTNL,
                 /* can be retrieved by unprivileged users */
         },
         {
@@ -8574,6 +8553,7 @@ static struct genl_ops nl80211_ops[] = {
                 .doit = nl80211_set_reg,
                 .policy = nl80211_policy,
                 .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_RTNL,
         },
         {
                 .cmd = NL80211_CMD_REQ_SET_REG,
@@ -9029,8 +9009,6 @@ static int nl80211_add_scan_req(struct sk_buff *msg,
         struct nlattr *nest;
         int i;
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
-
         if (WARN_ON(!req))
                 return 0;
 
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index cc35fbaa4578..e1d6749234c6 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -81,7 +81,10 @@ static struct regulatory_request core_request_world = {
         .country_ie_env = ENVIRON_ANY,
 };
 
-/* Receipt of information from last regulatory request */
+/*
+ * Receipt of information from last regulatory request,
+ * protected by RTNL (and can be accessed with RCU protection)
+ */
 static struct regulatory_request __rcu *last_request =
         (void __rcu *)&core_request_world;
 
@@ -96,39 +99,25 @@ static struct device_type reg_device_type = {
  * Central wireless core regulatory domains, we only need two,
  * the current one and a world regulatory domain in case we have no
  * information to give us an alpha2.
+ * (protected by RTNL, can be read under RCU)
  */
 const struct ieee80211_regdomain __rcu *cfg80211_regdomain;
 
 /*
- * Protects static reg.c components:
- *      - cfg80211_regdomain (if not used with RCU)
- *      - cfg80211_world_regdom
- *      - last_request (if not used with RCU)
- *      - reg_num_devs_support_basehint
- */
-static DEFINE_MUTEX(reg_mutex);
-
-/*
  * Number of devices that registered to the core
  * that support cellular base station regulatory hints
+ * (protected by RTNL)
  */
 static int reg_num_devs_support_basehint;
 
-static inline void assert_reg_lock(void)
-{
-        lockdep_assert_held(&reg_mutex);
-}
-
 static const struct ieee80211_regdomain *get_cfg80211_regdom(void)
 {
-        return rcu_dereference_protected(cfg80211_regdomain,
-                                         lockdep_is_held(&reg_mutex));
+        return rtnl_dereference(cfg80211_regdomain);
 }
 
 static const struct ieee80211_regdomain *get_wiphy_regdom(struct wiphy *wiphy)
 {
-        return rcu_dereference_protected(wiphy->regd,
-                                         lockdep_is_held(&reg_mutex));
+        return rtnl_dereference(wiphy->regd);
 }
 
 static void rcu_free_regdom(const struct ieee80211_regdomain *r)
@@ -140,8 +129,7 @@ static void rcu_free_regdom(const struct ieee80211_regdomain *r)
 
 static struct regulatory_request *get_last_request(void)
 {
-        return rcu_dereference_check(last_request,
-                                     lockdep_is_held(&reg_mutex));
+        return rcu_dereference_rtnl(last_request);
 }
 
 /* Used to queue up regulatory hints */
@@ -200,6 +188,7 @@ static const struct ieee80211_regdomain world_regdom = {
         }
 };
 
+/* protected by RTNL */
 static const struct ieee80211_regdomain *cfg80211_world_regdom =
         &world_regdom;
 
@@ -215,7 +204,7 @@ static void reset_regdomains(bool full_reset,
         const struct ieee80211_regdomain *r;
         struct regulatory_request *lr;
 
-        assert_reg_lock();
+        ASSERT_RTNL();
 
         r = get_cfg80211_regdom();
 
@@ -377,7 +366,7 @@ static void reg_regdb_search(struct work_struct *work)
         const struct ieee80211_regdomain *curdom, *regdom = NULL;
         int i;
 
-        mutex_lock(&cfg80211_mutex);
+        rtnl_lock();
 
         mutex_lock(&reg_regdb_search_mutex);
         while (!list_empty(&reg_regdb_search_list)) {
@@ -402,7 +391,7 @@ static void reg_regdb_search(struct work_struct *work)
         if (!IS_ERR_OR_NULL(regdom))
                 set_regdom(regdom);
 
-        mutex_unlock(&cfg80211_mutex);
+        rtnl_unlock();
 }
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_search);
@@ -936,13 +925,7 @@ static bool reg_request_cell_base(struct regulatory_request *request)
 
 bool reg_last_request_cell_base(void)
 {
-        bool val;
-
-        mutex_lock(&reg_mutex);
-        val = reg_request_cell_base(get_last_request());
-        mutex_unlock(&reg_mutex);
-
-        return val;
+        return reg_request_cell_base(get_last_request());
 }
 
 #ifdef CONFIG_CFG80211_CERTIFICATION_ONUS
@@ -1225,7 +1208,7 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)
         struct cfg80211_registered_device *rdev;
         struct wiphy *wiphy;
 
-        assert_cfg80211_lock();
+        ASSERT_RTNL();
 
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
                 wiphy = &rdev->wiphy;
@@ -1444,8 +1427,6 @@ static void reg_set_request_processed(void)
  * what it believes should be the current regulatory domain.
  *
  * Returns one of the different reg request treatment values.
- *
- * Caller must hold &reg_mutex
  */
 static enum reg_request_treatment
 __regulatory_hint(struct wiphy *wiphy,
@@ -1570,21 +1551,19 @@ static void reg_process_pending_hints(void)
 {
         struct regulatory_request *reg_request, *lr;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         /* When last_request->processed becomes true this will be rescheduled */
         if (lr && !lr->processed) {
                 REG_DBG_PRINT("Pending regulatory request, waiting for it to be processed...\n");
-                goto out;
+                return;
         }
 
         spin_lock(&reg_requests_lock);
 
         if (list_empty(&reg_requests_list)) {
                 spin_unlock(&reg_requests_lock);
-                goto out;
+                return;
         }
 
         reg_request = list_first_entry(&reg_requests_list,
@@ -1595,10 +1574,6 @@ static void reg_process_pending_hints(void)
         spin_unlock(&reg_requests_lock);
 
         reg_process_hint(reg_request, reg_request->initiator);
-
-out:
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
 
 /* Processes beacon hints -- this has nothing to do with country IEs */
@@ -1607,9 +1582,6 @@ static void reg_process_pending_beacon_hints(void)
         struct cfg80211_registered_device *rdev;
         struct reg_beacon *pending_beacon, *tmp;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
-
         /* This goes through the _pending_ beacon list */
         spin_lock_bh(&reg_pending_beacons_lock);
 
@@ -1626,14 +1598,14 @@ static void reg_process_pending_beacon_hints(void)
         }
 
         spin_unlock_bh(&reg_pending_beacons_lock);
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
 }
 
 static void reg_todo(struct work_struct *work)
 {
+        rtnl_lock();
         reg_process_pending_hints();
         reg_process_pending_beacon_hints();
+        rtnl_unlock();
 }
 
 static void queue_regulatory_request(struct regulatory_request *request)
@@ -1717,29 +1689,23 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
 }
 EXPORT_SYMBOL(regulatory_hint);
 
-/*
- * We hold wdev_lock() here so we cannot hold cfg80211_mutex() and
- * therefore cannot iterate over the rdev list here.
- */
 void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
                          const u8 *country_ie, u8 country_ie_len)
 {
         char alpha2[2];
         enum environment_cap env = ENVIRON_ANY;
-        struct regulatory_request *request, *lr;
-
-        mutex_lock(&reg_mutex);
-        lr = get_last_request();
-
-        if (unlikely(!lr))
-                goto out;
+        struct regulatory_request *request = NULL, *lr;
 
         /* IE len must be evenly divisible by 2 */
         if (country_ie_len & 0x01)
-                goto out;
+                return;
 
         if (country_ie_len < IEEE80211_COUNTRY_IE_MIN_LEN)
-                goto out;
+                return;
+
+        request = kzalloc(sizeof(*request), GFP_KERNEL);
+        if (!request)
+                return;
 
         alpha2[0] = country_ie[0];
         alpha2[1] = country_ie[1];
@@ -1749,19 +1715,21 @@ void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
         else if (country_ie[2] == 'O')
                 env = ENVIRON_OUTDOOR;
 
+        rcu_read_lock();
+        lr = get_last_request();
+
+        if (unlikely(!lr))
+                goto out;
+
         /*
          * We will run this only upon a successful connection on cfg80211.
          * We leave conflict resolution to the workqueue, where can hold
-         * cfg80211_mutex.
+         * the RTNL.
          */
         if (lr->initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE &&
             lr->wiphy_idx != WIPHY_IDX_INVALID)
                 goto out;
 
-        request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
-        if (!request)
-                goto out;
-
         request->wiphy_idx = get_wiphy_idx(wiphy);
         request->alpha2[0] = alpha2[0];
         request->alpha2[1] = alpha2[1];
@@ -1769,8 +1737,10 @@ void regulatory_hint_11d(struct wiphy *wiphy, enum ieee80211_band band,
         request->country_ie_env = env;
 
         queue_regulatory_request(request);
+        request = NULL;
 out:
-        mutex_unlock(&reg_mutex);
+        kfree(request);
+        rcu_read_unlock();
 }
 
 static void restore_alpha2(char *alpha2, bool reset_user)
@@ -1858,8 +1828,7 @@ static void restore_regulatory_settings(bool reset_user)
         LIST_HEAD(tmp_reg_req_list);
         struct cfg80211_registered_device *rdev;
 
-        mutex_lock(&cfg80211_mutex);
-        mutex_lock(&reg_mutex);
+        ASSERT_RTNL();
 
         reset_regdomains(true, &world_regdom);
         restore_alpha2(alpha2, reset_user);
@@ -1914,9 +1883,6 @@ static void restore_regulatory_settings(bool reset_user)
         list_splice_tail_init(&tmp_reg_req_list, &reg_requests_list);
         spin_unlock(&reg_requests_lock);
 
-        mutex_unlock(&reg_mutex);
-        mutex_unlock(&cfg80211_mutex);
-
         REG_DBG_PRINT("Kicking the queue\n");
 
         schedule_work(&reg_work);
@@ -2231,7 +2197,6 @@ int set_regdom(const struct ieee80211_regdomain *rd)
         struct regulatory_request *lr;
         int r;
 
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         /* Note that this doesn't update the wiphys, this is done below */
@@ -2241,14 +2206,12 @@ int set_regdom(const struct ieee80211_regdomain *rd)
                         reg_set_request_processed();
 
                 kfree(rd);
-                goto out;
+                return r;
         }
 
         /* This would make this whole thing pointless */
-        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom())) {
-                r = -EINVAL;
-                goto out;
-        }
+        if (WARN_ON(!lr->intersect && rd != get_cfg80211_regdom()))
+                return -EINVAL;
 
         /* update all wiphys now with the new established regulatory domain */
         update_all_wiphy_regulatory(lr->initiator);
@@ -2259,10 +2222,7 @@ int set_regdom(const struct ieee80211_regdomain *rd)
 
         reg_set_request_processed();
 
- out:
-        mutex_unlock(&reg_mutex);
-
-        return r;
+        return 0;
 }
 
 int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
@@ -2287,23 +2247,17 @@ int reg_device_uevent(struct device *dev, struct kobj_uevent_env *env)
 
 void wiphy_regulatory_register(struct wiphy *wiphy)
 {
-        mutex_lock(&reg_mutex);
-
         if (!reg_dev_ignore_cell_hint(wiphy))
                 reg_num_devs_support_basehint++;
 
         wiphy_update_regulatory(wiphy, NL80211_REGDOM_SET_BY_CORE);
-
-        mutex_unlock(&reg_mutex);
 }
 
-/* Caller must hold cfg80211_mutex */
 void wiphy_regulatory_deregister(struct wiphy *wiphy)
 {
         struct wiphy *request_wiphy = NULL;
         struct regulatory_request *lr;
 
-        mutex_lock(&reg_mutex);
         lr = get_last_request();
 
         if (!reg_dev_ignore_cell_hint(wiphy))
@@ -2316,12 +2270,10 @@ void wiphy_regulatory_deregister(struct wiphy *wiphy)
                 request_wiphy = wiphy_idx_to_wiphy(lr->wiphy_idx);
 
         if (!request_wiphy || request_wiphy != wiphy)
-                goto out;
+                return;
 
         lr->wiphy_idx = WIPHY_IDX_INVALID;
         lr->country_ie_env = ENVIRON_ANY;
-out:
-        mutex_unlock(&reg_mutex);
 }
 
 static void reg_timeout_work(struct work_struct *work)
@@ -2385,9 +2337,9 @@ void regulatory_exit(void)
         cancel_delayed_work_sync(&reg_timeout);
 
         /* Lock to suppress warnings */
-        mutex_lock(&reg_mutex);
+        rtnl_lock();
         reset_regdomains(true, NULL);
-        mutex_unlock(&reg_mutex);
+        rtnl_unlock();
 
         dev_set_uevent_suppress(&reg_pdev->dev, true);
 
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index fd99ea495b7e..dd01b58fa78c 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -169,7 +169,7 @@ void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev, bool leak)
         union iwreq_data wrqu;
 #endif
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         request = rdev->scan_req;
 
@@ -230,9 +230,9 @@ void __cfg80211_scan_done(struct work_struct *wk)
         rdev = container_of(wk, struct cfg80211_registered_device,
                             scan_done_wk);
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
         ___cfg80211_scan_done(rdev, false);
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 
 void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
@@ -241,6 +241,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
         WARN_ON(request != wiphy_to_dev(request->wiphy)->scan_req);
 
         request->aborted = aborted;
+        request->notified = true;
         queue_work(cfg80211_wq, &wiphy_to_dev(request->wiphy)->scan_done_wk);
 }
 EXPORT_SYMBOL(cfg80211_scan_done);
@@ -255,7 +256,7 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
 
         request = rdev->sched_scan_req;
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
 
         /* we don't have sched_scan_req anymore if the scan is stopping */
         if (request) {
@@ -270,7 +271,7 @@ void __cfg80211_sched_scan_results(struct work_struct *wk)
                 nl80211_send_sched_scan_results(rdev, request->dev);
         }
 
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 
 void cfg80211_sched_scan_results(struct wiphy *wiphy)
@@ -289,9 +290,9 @@ void cfg80211_sched_scan_stopped(struct wiphy *wiphy)
 
         trace_cfg80211_sched_scan_stopped(wiphy);
 
-        mutex_lock(&rdev->sched_scan_mtx);
+        rtnl_lock();
         __cfg80211_stop_sched_scan(rdev, true);
-        mutex_unlock(&rdev->sched_scan_mtx);
+        rtnl_unlock();
 }
 EXPORT_SYMBOL(cfg80211_sched_scan_stopped);
 
@@ -300,7 +301,7 @@ int __cfg80211_stop_sched_scan(struct cfg80211_registered_device *rdev,
 {
         struct net_device *dev;
 
-        lockdep_assert_held(&rdev->sched_scan_mtx);
+        ASSERT_RTNL();
 
         if (!rdev->sched_scan_req)
                 return -ENOENT;
@@ -1040,6 +1041,25 @@ void cfg80211_unlink_bss(struct wiphy *wiphy, struct cfg80211_bss *pub)
 EXPORT_SYMBOL(cfg80211_unlink_bss);
 
 #ifdef CONFIG_CFG80211_WEXT
+static struct cfg80211_registered_device *
+cfg80211_get_dev_from_ifindex(struct net *net, int ifindex)
+{
+        struct cfg80211_registered_device *rdev;
+        struct net_device *dev;
+
+        ASSERT_RTNL();
+
+        dev = dev_get_by_index(net, ifindex);
+        if (!dev)
+                return ERR_PTR(-ENODEV);
+        if (dev->ieee80211_ptr)
+                rdev = wiphy_to_dev(dev->ieee80211_ptr->wiphy);
+        else
+                rdev = ERR_PTR(-ENODEV);
+        dev_put(dev);
+        return rdev;
+}
+
 int cfg80211_wext_siwscan(struct net_device *dev,
                           struct iw_request_info *info,
                           union iwreq_data *wrqu, char *extra)
@@ -1062,7 +1082,6 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        mutex_lock(&rdev->sched_scan_mtx);
         if (rdev->scan_req) {
                 err = -EBUSY;
                 goto out;
@@ -1169,9 +1188,7 @@ int cfg80211_wext_siwscan(struct net_device *dev,
                 dev_hold(dev);
         }
  out:
-        mutex_unlock(&rdev->sched_scan_mtx);
         kfree(creq);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwscan);
@@ -1470,10 +1487,8 @@ int cfg80211_wext_giwscan(struct net_device *dev,
         if (IS_ERR(rdev))
                 return PTR_ERR(rdev);
 
-        if (rdev->scan_req) {
-                res = -EAGAIN;
-                goto out;
-        }
+        if (rdev->scan_req)
+                return -EAGAIN;
 
         res = ieee80211_scan_results(rdev, info, extra, data->length);
         data->length = 0;
@@ -1482,8 +1497,6 @@ int cfg80211_wext_giwscan(struct net_device *dev,
                 res = 0;
         }
 
- out:
-        cfg80211_unlock_rdev(rdev);
         return res;
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_giwscan);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 3ed35c345cae..81be95f3be74 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -43,35 +43,29 @@ static bool cfg80211_is_all_idle(void)
         struct wireless_dev *wdev;
         bool is_all_idle = true;
 
-        mutex_lock(&cfg80211_mutex);
-
         /*
          * All devices must be idle as otherwise if you are actively
          * scanning some new beacon hints could be learned and would
          * count as new regulatory hints.
          */
         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
-                cfg80211_lock_rdev(rdev);
                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
                         wdev_lock(wdev);
                         if (wdev->sme_state != CFG80211_SME_IDLE)
                                 is_all_idle = false;
                         wdev_unlock(wdev);
                 }
-                cfg80211_unlock_rdev(rdev);
         }
 
-        mutex_unlock(&cfg80211_mutex);
-
         return is_all_idle;
 }
 
 static void disconnect_work(struct work_struct *work)
 {
-        if (!cfg80211_is_all_idle())
-                return;
-
-        regulatory_hint_disconnect();
+        rtnl_lock();
+        if (cfg80211_is_all_idle())
+                regulatory_hint_disconnect();
+        rtnl_unlock();
 }
 
 static DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
@@ -85,7 +79,6 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
         ASSERT_WDEV_LOCK(wdev);
-        lockdep_assert_held(&rdev->sched_scan_mtx);
 
         if (rdev->scan_req)
                 return -EBUSY;
@@ -176,13 +169,13 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
         case CFG80211_CONN_AUTHENTICATE_NEXT:
                 BUG_ON(!rdev->ops->auth);
                 wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
-                return __cfg80211_mlme_auth(rdev, wdev->netdev,
-                                            params->channel, params->auth_type,
-                                            params->bssid,
-                                            params->ssid, params->ssid_len,
-                                            NULL, 0,
-                                            params->key, params->key_len,
-                                            params->key_idx, NULL, 0);
+                return cfg80211_mlme_auth(rdev, wdev->netdev,
+                                          params->channel, params->auth_type,
+                                          params->bssid,
+                                          params->ssid, params->ssid_len,
+                                          NULL, 0,
+                                          params->key, params->key_len,
+                                          params->key_idx, NULL, 0);
         case CFG80211_CONN_ASSOCIATE_NEXT:
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
@@ -198,19 +191,19 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                 req.vht_capa = params->vht_capa;
                 req.vht_capa_mask = params->vht_capa_mask;
 
-                err = __cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
-                                            params->bssid, params->ssid,
-                                            params->ssid_len, &req);
+                err = cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
+                                          params->bssid, params->ssid,
+                                          params->ssid_len, &req);
                 if (err)
-                        __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-                                               NULL, 0,
-                                               WLAN_REASON_DEAUTH_LEAVING,
-                                               false);
+                        cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                             NULL, 0,
+                                             WLAN_REASON_DEAUTH_LEAVING,
+                                             false);
                 return err;
         case CFG80211_CONN_DEAUTH_ASSOC_FAIL:
-                __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
-                                       NULL, 0,
-                                       WLAN_REASON_DEAUTH_LEAVING, false);
+                cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
+                                     NULL, 0,
+                                     WLAN_REASON_DEAUTH_LEAVING, false);
                 /* return an error so that we call __cfg80211_connect_result() */
                 return -EINVAL;
         default:
@@ -226,9 +219,6 @@ void cfg80211_conn_work(struct work_struct *work)
         u8 bssid_buf[ETH_ALEN], *bssid = NULL;
 
         rtnl_lock();
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
 
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (!wdev->netdev)
@@ -256,9 +246,6 @@ void cfg80211_conn_work(struct work_struct *work)
                 wdev_unlock(wdev);
         }
 
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         rtnl_unlock();
 }
 
@@ -773,11 +760,11 @@ void cfg80211_disconnected(struct net_device *dev, u16 reason,
 }
 EXPORT_SYMBOL(cfg80211_disconnected);
 
-int __cfg80211_connect(struct cfg80211_registered_device *rdev,
-                       struct net_device *dev,
-                       struct cfg80211_connect_params *connect,
-                       struct cfg80211_cached_keys *connkeys,
-                       const u8 *prev_bssid)
+int cfg80211_connect(struct cfg80211_registered_device *rdev,
+                     struct net_device *dev,
+                     struct cfg80211_connect_params *connect,
+                     struct cfg80211_cached_keys *connkeys,
+                     const u8 *prev_bssid)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         struct cfg80211_bss *bss = NULL;
@@ -924,27 +911,8 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
         }
 }
 
-int cfg80211_connect(struct cfg80211_registered_device *rdev,
-                     struct net_device *dev,
-                     struct cfg80211_connect_params *connect,
-                     struct cfg80211_cached_keys *connkeys)
-{
-        int err;
-
-        mutex_lock(&rdev->devlist_mtx);
-        /* might request scan - scan_mtx -> wdev_mtx dependency */
-        mutex_lock(&rdev->sched_scan_mtx);
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_connect(rdev, dev, connect, connkeys, NULL);
-        wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-
-        return err;
-}
-
-int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                          struct net_device *dev, u16 reason, bool wextev)
+int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
+                        struct net_device *dev, u16 reason, bool wextev)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
@@ -979,7 +947,7 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
                 }
 
                 /* wdev->conn->params.bssid must be set if > SCANNING */
-                err = __cfg80211_mlme_deauth(rdev, dev,
+                err = cfg80211_mlme_deauth(rdev, dev,
                                              wdev->conn->params.bssid,
                                              NULL, 0, reason, false);
                 if (err)
@@ -1001,19 +969,6 @@ int __cfg80211_disconnect(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev,
-                        u16 reason, bool wextev)
-{
-        int err;
-
-        wdev_lock(dev->ieee80211_ptr);
-        err = __cfg80211_disconnect(rdev, dev, reason, wextev);
-        wdev_unlock(dev->ieee80211_ptr);
-
-        return err;
-}
-
 void cfg80211_sme_disassoc(struct net_device *dev,
                            struct cfg80211_internal_bss *bss)
 {
@@ -1036,6 +991,6 @@ void cfg80211_sme_disassoc(struct net_device *dev,
 
         memcpy(bssid, bss->pub.bssid, ETH_ALEN);
 
-        __cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
-                               WLAN_REASON_DEAUTH_LEAVING, false);
+        cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
+                             WLAN_REASON_DEAUTH_LEAVING, false);
 }
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 8f28b9f798d8..360a42c6f694 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -91,6 +91,7 @@ static void cfg80211_leave_all(struct cfg80211_registered_device *rdev)
                 cfg80211_leave(rdev, wdev);
 }
 
+#ifdef CONFIG_PM
 static int wiphy_suspend(struct device *dev, pm_message_t state)
 {
         struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
@@ -100,10 +101,10 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
         rtnl_lock();
         if (rdev->wiphy.registered) {
-                if (!rdev->wowlan)
+                if (!rdev->wiphy.wowlan_config)
                         cfg80211_leave_all(rdev);
                 if (rdev->ops->suspend)
-                        ret = rdev_suspend(rdev, rdev->wowlan);
+                        ret = rdev_suspend(rdev, rdev->wiphy.wowlan_config);
                 if (ret == 1) {
                         /* Driver refuse to configure wowlan */
                         cfg80211_leave_all(rdev);
@@ -132,6 +133,7 @@ static int wiphy_resume(struct device *dev)
 
         return ret;
 }
+#endif
 
 static const void *wiphy_namespace(struct device *d)
 {
@@ -146,8 +148,10 @@ struct class ieee80211_class = {
         .dev_release = wiphy_dev_release,
         .dev_attrs = ieee80211_dev_attrs,
         .dev_uevent = wiphy_uevent,
+#ifdef CONFIG_PM
         .suspend = wiphy_suspend,
         .resume = wiphy_resume,
+#endif
         .ns_type = &net_ns_type_operations,
         .namespace = wiphy_namespace,
 };
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index 5755bc14abbd..23fafeae8a10 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1911,12 +1911,12 @@ TRACE_EVENT(cfg80211_send_rx_assoc,
                   NETDEV_PR_ARG, MAC_PR_ARG(bssid), CHAN_PR_ARG)
 );
 
-DEFINE_EVENT(netdev_evt_only, __cfg80211_send_deauth,
+DEFINE_EVENT(netdev_evt_only, cfg80211_send_deauth,
         TP_PROTO(struct net_device *netdev),
         TP_ARGS(netdev)
 );
 
-DEFINE_EVENT(netdev_evt_only, __cfg80211_send_disassoc,
+DEFINE_EVENT(netdev_evt_only, cfg80211_send_disassoc,
         TP_PROTO(struct net_device *netdev),
         TP_ARGS(netdev)
 );
diff --git a/net/wireless/util.c b/net/wireless/util.c
index f5ad4d94ba88..74458b7f61eb 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -33,6 +33,29 @@ ieee80211_get_response_rate(struct ieee80211_supported_band *sband,
 }
 EXPORT_SYMBOL(ieee80211_get_response_rate);
 
+u32 ieee80211_mandatory_rates(struct ieee80211_supported_band *sband)
+{
+        struct ieee80211_rate *bitrates;
+        u32 mandatory_rates = 0;
+        enum ieee80211_rate_flags mandatory_flag;
+        int i;
+
+        if (WARN_ON(!sband))
+                return 1;
+
+        if (sband->band == IEEE80211_BAND_2GHZ)
+                mandatory_flag = IEEE80211_RATE_MANDATORY_B;
+        else
+                mandatory_flag = IEEE80211_RATE_MANDATORY_A;
+
+        bitrates = sband->bitrates;
+        for (i = 0; i < sband->n_bitrates; i++)
+                if (bitrates[i].flags & mandatory_flag)
+                        mandatory_rates |= BIT(i);
+        return mandatory_rates;
+}
+EXPORT_SYMBOL(ieee80211_mandatory_rates);
+
 int ieee80211_channel_to_frequency(int chan, enum ieee80211_band band)
 {
         /* see 802.11 17.3.8.3.2 and Annex J
@@ -785,12 +808,8 @@ void cfg80211_process_rdev_events(struct cfg80211_registered_device *rdev)
         ASSERT_RTNL();
         ASSERT_RDEV_LOCK(rdev);
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list)
                 cfg80211_process_wdev_events(wdev);
-
-        mutex_unlock(&rdev->devlist_mtx);
 }
 
 int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
@@ -822,10 +841,8 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                 return -EBUSY;
 
         if (ntype != otype && netif_running(dev)) {
-                mutex_lock(&rdev->devlist_mtx);
                 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
                                                     ntype);
-                mutex_unlock(&rdev->devlist_mtx);
                 if (err)
                         return err;
 
@@ -841,8 +858,10 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
                         break;
                 case NL80211_IFTYPE_STATION:
                 case NL80211_IFTYPE_P2P_CLIENT:
+                        wdev_lock(dev->ieee80211_ptr);
                         cfg80211_disconnect(rdev, dev,
                                             WLAN_REASON_DEAUTH_LEAVING, true);
+                        wdev_unlock(dev->ieee80211_ptr);
                         break;
                 case NL80211_IFTYPE_MESH_POINT:
                         /* mesh should be handled? */
@@ -1169,6 +1188,9 @@ bool ieee80211_operating_class_to_band(u8 operating_class,
         case 84:
                 *band = IEEE80211_BAND_2GHZ;
                 return true;
+        case 180:
+                *band = IEEE80211_BAND_60GHZ;
+                return true;
         }
 
         return false;
@@ -1184,8 +1206,6 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
         if (!beacon_int)
                 return -EINVAL;
 
-        mutex_lock(&rdev->devlist_mtx);
-
         list_for_each_entry(wdev, &rdev->wdev_list, list) {
                 if (!wdev->beacon_interval)
                         continue;
@@ -1195,8 +1215,6 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
                 }
         }
 
-        mutex_unlock(&rdev->devlist_mtx);
-
         return res;
 }
 
@@ -1220,7 +1238,6 @@ int cfg80211_can_use_iftype_chan(struct cfg80211_registered_device *rdev,
         int i, j;
 
         ASSERT_RTNL();
-        lockdep_assert_held(&rdev->devlist_mtx);
 
         if (WARN_ON(hweight32(radar_detect) > 1))
                 return -EINVAL;
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index d997d0f0c54a..e7c6e862580d 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -72,7 +72,6 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
         struct cfg80211_registered_device *rdev;
         struct vif_params vifparams;
         enum nl80211_iftype type;
-        int ret;
 
         rdev = wiphy_to_dev(wdev->wiphy);
 
@@ -98,11 +97,7 @@ int cfg80211_wext_siwmode(struct net_device *dev, struct iw_request_info *info,
 
         memset(&vifparams, 0, sizeof(vifparams));
 
-        cfg80211_lock_rdev(rdev);
-        ret = cfg80211_change_iface(rdev, dev, type, NULL, &vifparams);
-        cfg80211_unlock_rdev(rdev);
-
-        return ret;
+        return cfg80211_change_iface(rdev, dev, type, NULL, &vifparams);
 }
 EXPORT_SYMBOL_GPL(cfg80211_wext_siwmode);
 
@@ -579,13 +574,10 @@ static int cfg80211_set_encryption(struct cfg80211_registered_device *rdev,
 {
         int err;
 
-        /* devlist mutex needed for possible IBSS re-join */
-        mutex_lock(&rdev->devlist_mtx);
         wdev_lock(dev->ieee80211_ptr);
         err = __cfg80211_set_encryption(rdev, dev, pairwise, addr,
                                         remove, tx_key, idx, params);
         wdev_unlock(dev->ieee80211_ptr);
-        mutex_unlock(&rdev->devlist_mtx);
 
         return err;
 }
@@ -787,7 +779,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
         struct cfg80211_chan_def chandef = {
                 .width = NL80211_CHAN_WIDTH_20_NOHT,
         };
-        int freq, err;
+        int freq;
 
         switch (wdev->iftype) {
         case NL80211_IFTYPE_STATION:
@@ -804,10 +796,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                 chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);
                 if (!chandef.chan)
                         return -EINVAL;
-                mutex_lock(&rdev->devlist_mtx);
-                err = cfg80211_set_monitor_channel(rdev, &chandef);
-                mutex_unlock(&rdev->devlist_mtx);
-                return err;
+                return cfg80211_set_monitor_channel(rdev, &chandef);
         case NL80211_IFTYPE_MESH_POINT:
                 freq = cfg80211_wext_freq(wdev->wiphy, wextfreq);
                 if (freq < 0)
@@ -818,10 +807,7 @@ static int cfg80211_wext_siwfreq(struct net_device *dev,
                 chandef.chan = ieee80211_get_channel(&rdev->wiphy, freq);
                 if (!chandef.chan)
                         return -EINVAL;
-                mutex_lock(&rdev->devlist_mtx);
-                err = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
-                mutex_unlock(&rdev->devlist_mtx);
-                return err;
+                return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
         default:
                 return -EOPNOTSUPP;
         }
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index e79cb5c0655a..a53f8404f451 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -54,8 +54,8 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         if (wdev->wext.prev_bssid_valid)
                 prev_bssid = wdev->wext.prev_bssid;
 
-        err = __cfg80211_connect(rdev, wdev->netdev,
-                                 &wdev->wext.connect, ck, prev_bssid);
+        err = cfg80211_connect(rdev, wdev->netdev,
+                               &wdev->wext.connect, ck, prev_bssid);
         if (err)
                 kfree(ck);
 
@@ -87,9 +87,6 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                         return -EINVAL;
         }
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -103,8 +100,8 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
                 /* if SSID set, we'll try right again, avoid event */
                 if (wdev->wext.connect.ssid_len)
                         event = false;
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -136,9 +133,6 @@ int cfg80211_mgd_wext_siwfreq(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -190,9 +184,6 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         if (len > 0 && ssid[len - 1] == '\0')
                 len--;
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         err = 0;
@@ -208,8 +199,8 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
                 /* if SSID set now, we'll try to connect, avoid event */
                 if (len)
                         event = false;
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, event);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, event);
                 if (err)
                         goto out;
         }
@@ -226,9 +217,6 @@ int cfg80211_mgd_wext_siwessid(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -287,9 +275,6 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         if (is_zero_ether_addr(bssid) || is_broadcast_ether_addr(bssid))
                 bssid = NULL;
 
-        cfg80211_lock_rdev(rdev);
-        mutex_lock(&rdev->devlist_mtx);
-        mutex_lock(&rdev->sched_scan_mtx);
         wdev_lock(wdev);
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
@@ -303,8 +288,8 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
                     ether_addr_equal(bssid, wdev->wext.connect.bssid))
                         goto out;
 
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -318,9 +303,6 @@ int cfg80211_mgd_wext_siwap(struct net_device *dev,
         err = cfg80211_mgd_wext_connect(rdev, wdev);
  out:
         wdev_unlock(wdev);
-        mutex_unlock(&rdev->sched_scan_mtx);
-        mutex_unlock(&rdev->devlist_mtx);
-        cfg80211_unlock_rdev(rdev);
         return err;
 }
 
@@ -383,8 +365,8 @@ int cfg80211_wext_siwgenie(struct net_device *dev,
         wdev->wext.ie_len = ie_len;
 
         if (wdev->sme_state != CFG80211_SME_IDLE) {
-                err = __cfg80211_disconnect(rdev, dev,
-                                            WLAN_REASON_DEAUTH_LEAVING, false);
+                err = cfg80211_disconnect(rdev, dev,
+                                          WLAN_REASON_DEAUTH_LEAVING, false);
                 if (err)
                         goto out;
         }
@@ -420,8 +402,7 @@ int cfg80211_wext_siwmlme(struct net_device *dev,
         switch (mlme->cmd) {
         case IW_MLME_DEAUTH:
         case IW_MLME_DISASSOC:
-                err = __cfg80211_disconnect(rdev, dev, mlme->reason_code,
-                                            true);
+                err = cfg80211_disconnect(rdev, dev, mlme->reason_code, true);
                 break;
         default:
                 err = -EOPNOTSUPP;