Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

129 files changed, 3808 insertions, 1794 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index 55eda7afc041..f35f93c31b09 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -1865,7 +1865,6 @@ static int adm8211_probe(struct pci_dev *pdev,
         dev->flags = IEEE80211_HW_SIGNAL_UNSPEC;
         dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 
-        dev->channel_change_time = 1000;
         dev->max_signal = 100;    /* FIXME: find better value */
 
         dev->queues = 1; /* ADM8211C supports more, maybe ADM8211B too */
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 031d4ec64779..99b3bfa717d5 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -2112,7 +2112,6 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
         priv->pm_period = 0;
 
         /* unit us */
-        priv->hw->channel_change_time = 100000;
 
         return priv;
 }
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e0ba7cd14252..b59cfbe0276b 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -17,6 +17,7 @@
 #ifndef ATH_H
 #define ATH_H
 
+#include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/spinlock.h>
@@ -165,6 +166,7 @@ struct ath_common {
 struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 u32 len,
                                 gfp_t gfp_mask);
+bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr);
 
 void ath_hw_setbssidmask(struct ath_common *common);
 void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key);
diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig
index 82e8088ca9b4..a6f5285235af 100644
--- a/drivers/net/wireless/ath/ath10k/Kconfig
+++ b/drivers/net/wireless/ath/ath10k/Kconfig
@@ -37,3 +37,10 @@ config ATH10K_TRACING
         ---help---
           Select this to ath10k use tracing infrastructure.
 
+config ATH10K_DFS_CERTIFIED
+        bool "Atheros DFS support for certified platforms"
+        depends on ATH10K && CFG80211_CERTIFICATION_ONUS
+        default n
+        ---help---
+        This option enables DFS support for initiating radiation on
+        ath10k.
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 79726e0fe2f0..ade1781c7186 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -253,6 +253,9 @@ struct ath10k_vif {
                         u8 bssid[ETH_ALEN];
                 } ibss;
         } u;
+
+        u8 fixed_rate;
+        u8 fixed_nss;
 };
 
 struct ath10k_vif_iter {
@@ -272,6 +275,8 @@ struct ath10k_debug {
         struct delayed_work htt_stats_dwork;
         struct ath10k_dfs_stats dfs_stats;
         struct ath_dfs_pool_stats dfs_pool_stats;
+
+        u32 fw_dbglog_mask;
 };
 
 enum ath10k_state {
@@ -306,6 +311,9 @@ enum ath10k_fw_features {
         /* firmware support tx frame management over WMI, otherwise it's HTT */
         ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX = 2,
 
+        /* Firmware does not support P2P */
+        ATH10K_FW_FEATURE_NO_P2P = 3,
+
         /* keep last */
         ATH10K_FW_FEATURE_COUNT,
 };
@@ -429,6 +437,9 @@ struct ath10k {
         struct list_head peers;
         wait_queue_head_t peer_mapping_wq;
 
+        /* number of created peers; protected by data_lock */
+        int num_peers;
+
         struct work_struct offchan_tx_work;
         struct sk_buff_head offchan_tx_queue;
         struct completion offchan_tx_completed;
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 6bdfad3144af..6debd281350a 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -614,6 +614,61 @@ static const struct file_operations fops_htt_stats_mask = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_fw_dbglog(struct file *file,
+                                            char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[32];
+
+        len = scnprintf(buf, sizeof(buf), "0x%08x\n",
+                        ar->debug.fw_dbglog_mask);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_fw_dbglog(struct file *file,
+                                      const char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long mask;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
+        if (ret)
+                return ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.fw_dbglog_mask = mask;
+
+        if (ar->state == ATH10K_STATE_ON) {
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                if (ret) {
+                        ath10k_warn("dbglog cfg failed from debugfs: %d\n",
+                                    ret);
+                        goto exit;
+                }
+        }
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_fw_dbglog = {
+        .read = ath10k_read_fw_dbglog,
+        .write = ath10k_write_fw_dbglog,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -625,6 +680,14 @@ int ath10k_debug_start(struct ath10k *ar)
                 /* continue normally anyway, this isn't serious */
                 ath10k_warn("failed to start htt stats workqueue: %d\n", ret);
 
+        if (ar->debug.fw_dbglog_mask) {
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn("failed to enable dbglog during start: %d",
+                                    ret);
+        }
+
         return 0;
 }
 
@@ -747,6 +810,9 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_htt_stats_mask);
 
+        debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_fw_dbglog);
+
         if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
                 debugfs_create_file("dfs_simulate_radar", S_IWUSR,
                                     ar->debug.debugfs_phy, ar,
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 7fc7919ea5f5..b93ae355bc08 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -1183,6 +1183,7 @@ struct htt_rx_info {
         } rate;
         bool fcs_err;
         bool amsdu_more;
+        bool mic_err;
 };
 
 struct ath10k_htt {
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index fcb534f2f28f..fe8bd1b59f0e 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -838,6 +838,20 @@ static bool ath10k_htt_rx_has_fcs_err(struct sk_buff *skb)
         return false;
 }
 
+static bool ath10k_htt_rx_has_mic_err(struct sk_buff *skb)
+{
+        struct htt_rx_desc *rxd;
+        u32 flags;
+
+        rxd = (void *)skb->data - sizeof(*rxd);
+        flags = __le32_to_cpu(rxd->attention.flags);
+
+        if (flags & RX_ATTENTION_FLAGS_TKIP_MIC_ERR)
+                return true;
+
+        return false;
+}
+
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
 {
         struct htt_rx_desc *rxd;
@@ -960,6 +974,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
 
                         info.skb     = msdu_head;
                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
+                        info.mic_err = ath10k_htt_rx_has_mic_err(msdu_head);
                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
                         info.signal += rx->ppdu.combined_rssi;
 
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 9535eaa09f09..f1505a25d810 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -115,6 +115,7 @@ enum ath10k_mcast2ucast_mode {
 #define TARGET_10X_MAC_AGGR_DELIM               0
 #define TARGET_10X_AST_SKID_LIMIT               16
 #define TARGET_10X_NUM_PEERS                    (128 + (TARGET_10X_NUM_VDEVS))
+#define TARGET_10X_NUM_PEERS_MAX                128
 #define TARGET_10X_NUM_OFFLOAD_PEERS            0
 #define TARGET_10X_NUM_OFFLOAD_REORDER_BUFS     0
 #define TARGET_10X_NUM_PEER_KEYS                2
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index ce9ef3499ecb..776e364eadcd 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -332,6 +332,9 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
                 ath10k_warn("Failed to wait for created wmi peer: %i\n", ret);
                 return ret;
         }
+        spin_lock_bh(&ar->data_lock);
+        ar->num_peers++;
+        spin_unlock_bh(&ar->data_lock);
 
         return 0;
 }
@@ -377,6 +380,10 @@ static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
         if (ret)
                 return ret;
 
+        spin_lock_bh(&ar->data_lock);
+        ar->num_peers--;
+        spin_unlock_bh(&ar->data_lock);
+
         return 0;
 }
 
@@ -396,6 +403,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 
                 list_del(&peer->list);
                 kfree(peer);
+                ar->num_peers--;
         }
         spin_unlock_bh(&ar->data_lock);
 }
@@ -411,6 +419,7 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
                 list_del(&peer->list);
                 kfree(peer);
         }
+        ar->num_peers = 0;
         spin_unlock_bh(&ar->data_lock);
 }
 
@@ -2205,7 +2214,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         enum wmi_sta_powersave_param param;
         int ret = 0;
-        u32 value;
+        u32 value, param_id;
         int bit;
         u32 vdev_param;
 
@@ -2297,6 +2306,13 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                         ath10k_warn("Failed to create peer for AP: %d\n", ret);
                         goto err_vdev_delete;
                 }
+
+                param_id = ar->wmi.pdev_param->sta_kickout_th;
+
+                /* Disable STA KICKOUT functionality in FW */
+                ret = ath10k_wmi_pdev_set_param(ar, param_id, 0);
+                if (ret)
+                        ath10k_warn("Failed to disable STA KICKOUT\n");
         }
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
@@ -2842,6 +2858,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 {
         struct ath10k *ar = hw->priv;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        int max_num_peers;
         int ret = 0;
 
         mutex_lock(&ar->conf_mutex);
@@ -2852,9 +2869,21 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New station addition.
                  */
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                        max_num_peers = TARGET_10X_NUM_PEERS_MAX - 1;
+                else
+                        max_num_peers = TARGET_NUM_PEERS;
+
+                if (ar->num_peers >= max_num_peers) {
+                        ath10k_warn("Number of peers exceeded: peers number %d (max peers %d)\n",
+                                    ar->num_peers, max_num_peers);
+                        ret = -ENOBUFS;
+                        goto exit;
+                }
+
                 ath10k_dbg(ATH10K_DBG_MAC,
-                           "mac vdev %d peer create %pM (new sta)\n",
-                           arvif->vdev_id, sta->addr);
+                           "mac vdev %d peer create %pM (new sta) num_peers %d\n",
+                           arvif->vdev_id, sta->addr, ar->num_peers);
 
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
@@ -2904,7 +2933,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                         ath10k_warn("Failed to disassociate station: %pM\n",
                                     sta->addr);
         }
-
+exit:
         mutex_unlock(&ar->conf_mutex);
         return ret;
 }
@@ -3310,6 +3339,307 @@ exit:
         return ret;
 }
 
+/* Helper table for legacy fixed_rate/bitrate_mask */
+static const u8 cck_ofdm_rate[] = {
+        /* CCK */
+        3, /* 1Mbps */
+        2, /* 2Mbps */
+        1, /* 5.5Mbps */
+        0, /* 11Mbps */
+        /* OFDM */
+        3, /* 6Mbps */
+        7, /* 9Mbps */
+        2, /* 12Mbps */
+        6, /* 18Mbps */
+        1, /* 24Mbps */
+        5, /* 36Mbps */
+        0, /* 48Mbps */
+        4, /* 54Mbps */
+};
+
+/* Check if only one bit set */
+static int ath10k_check_single_mask(u32 mask)
+{
+        int bit;
+
+        bit = ffs(mask);
+        if (!bit)
+                return 0;
+
+        mask &= ~BIT(bit - 1);
+        if (mask)
+                return 2;
+
+        return 1;
+}
+
+static bool
+ath10k_default_bitrate_mask(struct ath10k *ar,
+                            enum ieee80211_band band,
+                            const struct cfg80211_bitrate_mask *mask)
+{
+        u32 legacy = 0x00ff;
+        u8 ht = 0xff, i;
+        u16 vht = 0x3ff;
+
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
+                legacy = 0x00fff;
+                vht = 0;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                break;
+        default:
+                return false;
+        }
+
+        if (mask->control[band].legacy != legacy)
+                return false;
+
+        for (i = 0; i < ar->num_rf_chains; i++)
+                if (mask->control[band].ht_mcs[i] != ht)
+                        return false;
+
+        for (i = 0; i < ar->num_rf_chains; i++)
+                if (mask->control[band].vht_mcs[i] != vht)
+                        return false;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_nss(const struct cfg80211_bitrate_mask *mask,
+                        enum ieee80211_band band,
+                        u8 *fixed_nss)
+{
+        int ht_nss = 0, vht_nss = 0, i;
+
+        /* check legacy */
+        if (ath10k_check_single_mask(mask->control[band].legacy))
+                return false;
+
+        /* check HT */
+        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
+                if (mask->control[band].ht_mcs[i] == 0xff)
+                        continue;
+                else if (mask->control[band].ht_mcs[i] == 0x00)
+                        break;
+                else
+                        return false;
+        }
+
+        ht_nss = i;
+
+        /* check VHT */
+        for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
+                if (mask->control[band].vht_mcs[i] == 0x03ff)
+                        continue;
+                else if (mask->control[band].vht_mcs[i] == 0x0000)
+                        break;
+                else
+                        return false;
+        }
+
+        vht_nss = i;
+
+        if (ht_nss > 0 && vht_nss > 0)
+                return false;
+
+        if (ht_nss)
+                *fixed_nss = ht_nss;
+        else if (vht_nss)
+                *fixed_nss = vht_nss;
+        else
+                return false;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_correct(const struct cfg80211_bitrate_mask *mask,
+                            enum ieee80211_band band,
+                            enum wmi_rate_preamble *preamble)
+{
+        int legacy = 0, ht = 0, vht = 0, i;
+
+        *preamble = WMI_RATE_PREAMBLE_OFDM;
+
+        /* check legacy */
+        legacy = ath10k_check_single_mask(mask->control[band].legacy);
+        if (legacy > 1)
+                return false;
+
+        /* check HT */
+        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                ht += ath10k_check_single_mask(mask->control[band].ht_mcs[i]);
+        if (ht > 1)
+                return false;
+
+        /* check VHT */
+        for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
+                vht += ath10k_check_single_mask(mask->control[band].vht_mcs[i]);
+        if (vht > 1)
+                return false;
+
+        /* Currently we support only one fixed_rate */
+        if ((legacy + ht + vht) != 1)
+                return false;
+
+        if (ht)
+                *preamble = WMI_RATE_PREAMBLE_HT;
+        else if (vht)
+                *preamble = WMI_RATE_PREAMBLE_VHT;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_rate(const struct cfg80211_bitrate_mask *mask,
+                         enum ieee80211_band band,
+                         u8 *fixed_rate,
+                         u8 *fixed_nss)
+{
+        u8 rate = 0, pream = 0, nss = 0, i;
+        enum wmi_rate_preamble preamble;
+
+        /* Check if single rate correct */
+        if (!ath10k_bitrate_mask_correct(mask, band, &preamble))
+                return false;
+
+        pream = preamble;
+
+        switch (preamble) {
+        case WMI_RATE_PREAMBLE_CCK:
+        case WMI_RATE_PREAMBLE_OFDM:
+                i = ffs(mask->control[band].legacy) - 1;
+
+                if (band == IEEE80211_BAND_2GHZ && i < 4)
+                        pream = WMI_RATE_PREAMBLE_CCK;
+
+                if (band == IEEE80211_BAND_5GHZ)
+                        i += 4;
+
+                if (i >= ARRAY_SIZE(cck_ofdm_rate))
+                        return false;
+
+                rate = cck_ofdm_rate[i];
+                break;
+        case WMI_RATE_PREAMBLE_HT:
+                for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                        if (mask->control[band].ht_mcs[i])
+                                break;
+
+                if (i == IEEE80211_HT_MCS_MASK_LEN)
+                        return false;
+
+                rate = ffs(mask->control[band].ht_mcs[i]) - 1;
+                nss = i;
+                break;
+        case WMI_RATE_PREAMBLE_VHT:
+                for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
+                        if (mask->control[band].vht_mcs[i])
+                                break;
+
+                if (i == NL80211_VHT_NSS_MAX)
+                        return false;
+
+                rate = ffs(mask->control[band].vht_mcs[i]) - 1;
+                nss = i;
+                break;
+        }
+
+        *fixed_nss = nss + 1;
+        nss <<= 4;
+        pream <<= 6;
+
+        ath10k_dbg(ATH10K_DBG_MAC, "mac fixed rate pream 0x%02x nss 0x%02x rate 0x%02x\n",
+                   pream, nss, rate);
+
+        *fixed_rate = pream | nss | rate;
+
+        return true;
+}
+
+static bool ath10k_get_fixed_rate_nss(const struct cfg80211_bitrate_mask *mask,
+                                      enum ieee80211_band band,
+                                      u8 *fixed_rate,
+                                      u8 *fixed_nss)
+{
+        /* First check full NSS mask, if we can simply limit NSS */
+        if (ath10k_bitrate_mask_nss(mask, band, fixed_nss))
+                return true;
+
+        /* Next Check single rate is set */
+        return ath10k_bitrate_mask_rate(mask, band, fixed_rate, fixed_nss);
+}
+
+static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
+                                       u8 fixed_rate,
+                                       u8 fixed_nss)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 vdev_param;
+        int ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (arvif->fixed_rate == fixed_rate &&
+            arvif->fixed_nss == fixed_nss)
+                goto exit;
+
+        if (fixed_rate == WMI_FIXED_RATE_NONE)
+                ath10k_dbg(ATH10K_DBG_MAC, "mac disable fixed bitrate mask\n");
+
+        vdev_param = ar->wmi.vdev_param->fixed_rate;
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+                                        vdev_param, fixed_rate);
+        if (ret) {
+                ath10k_warn("Could not set fixed_rate param 0x%02x: %d\n",
+                            fixed_rate, ret);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        arvif->fixed_rate = fixed_rate;
+
+        vdev_param = ar->wmi.vdev_param->nss;
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+                                        vdev_param, fixed_nss);
+
+        if (ret) {
+                ath10k_warn("Could not set fixed_nss param %d: %d\n",
+                            fixed_nss, ret);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        arvif->fixed_nss = fixed_nss;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   const struct cfg80211_bitrate_mask *mask)
+{
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct ath10k *ar = arvif->ar;
+        enum ieee80211_band band = ar->hw->conf.chandef.chan->band;
+        u8 fixed_rate = WMI_FIXED_RATE_NONE;
+        u8 fixed_nss = ar->num_rf_chains;
+
+        if (!ath10k_default_bitrate_mask(ar, band, mask)) {
+                if (!ath10k_get_fixed_rate_nss(mask, band,
+                                               &fixed_rate,
+                                               &fixed_nss))
+                        return -EINVAL;
+        }
+
+        return ath10k_set_fixed_rate_param(arvif, fixed_rate, fixed_nss);
+}
+
 static const struct ieee80211_ops ath10k_ops = {
         .tx                             = ath10k_tx,
         .start                          = ath10k_start,
@@ -3332,6 +3662,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .restart_complete               = ath10k_restart_complete,
         .get_survey                     = ath10k_get_survey,
+        .set_bitrate_mask               = ath10k_set_bitrate_mask,
 #ifdef CONFIG_PM
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
@@ -3464,14 +3795,12 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         },
 };
 
-#ifdef CONFIG_ATH10K_DFS_CERTIFIED
-static const struct ieee80211_iface_limit ath10k_if_dfs_limits[] = {
+static const struct ieee80211_iface_limit ath10k_10x_if_limits[] = {
         {
         .max    = 8,
         .types  = BIT(NL80211_IFTYPE_AP)
         },
 };
-#endif
 
 static const struct ieee80211_iface_combination ath10k_if_comb[] = {
         {
@@ -3481,19 +3810,22 @@ static const struct ieee80211_iface_combination ath10k_if_comb[] = {
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
         },
-#ifdef CONFIG_ATH10K_DFS_CERTIFIED
+};
+
+static const struct ieee80211_iface_combination ath10k_10x_if_comb[] = {
         {
-                .limits = ath10k_if_dfs_limits,
-                .n_limits = ARRAY_SIZE(ath10k_if_dfs_limits),
+                .limits = ath10k_10x_if_limits,
+                .n_limits = ARRAY_SIZE(ath10k_10x_if_limits),
                 .max_interfaces = 8,
                 .num_different_channels = 1,
                 .beacon_int_infra_match = true,
+#ifdef CONFIG_ATH10K_DFS_CERTIFIED
                 .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
                                         BIT(NL80211_CHAN_WIDTH_20) |
                                         BIT(NL80211_CHAN_WIDTH_40) |
                                         BIT(NL80211_CHAN_WIDTH_80),
-        }
 #endif
+        },
 };
 
 static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
@@ -3672,9 +4004,12 @@ int ath10k_mac_register(struct ath10k *ar)
         ar->hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) |
-                BIT(NL80211_IFTYPE_AP) |
-                BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                BIT(NL80211_IFTYPE_P2P_GO);
+                BIT(NL80211_IFTYPE_AP);
+
+        if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
+                ar->hw->wiphy->interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO);
 
         ar->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                         IEEE80211_HW_SUPPORTS_PS |
@@ -3704,7 +4039,6 @@ int ath10k_mac_register(struct ath10k *ar)
 
         ar->hw->vif_data_size = sizeof(struct ath10k_vif);
 
-        ar->hw->channel_change_time = 5000;
         ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
 
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
@@ -3717,8 +4051,15 @@ int ath10k_mac_register(struct ath10k *ar)
          */
         ar->hw->queues = 4;
 
-        ar->hw->wiphy->iface_combinations = ath10k_if_comb;
-        ar->hw->wiphy->n_iface_combinations = ARRAY_SIZE(ath10k_if_comb);
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_10x_if_comb);
+        } else {
+                ar->hw->wiphy->iface_combinations = ath10k_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_if_comb);
+        }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
 
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 90817ddc92ba..4eb2ecbc06ef 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -182,6 +182,27 @@ TRACE_EVENT(ath10k_htt_stats,
         )
 );
 
+TRACE_EVENT(ath10k_wmi_dbglog,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "len %zu",
+                __entry->buf_len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 22829803f087..74f45fa6f428 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -231,7 +231,7 @@ void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
                                 ~IEEE80211_FCTL_PROTECTED);
         }
 
-        if (info->status == HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR)
+        if (info->mic_err)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
         if (info->fcs_err)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 1260a8d15dc3..712a606a080a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -16,6 +16,7 @@
  */
 
 #include <linux/skbuff.h>
+#include <linux/ctype.h>
 
 #include "core.h"
 #include "htc.h"
@@ -875,6 +876,7 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_channel *ch;
         struct ieee80211_hdr *hdr;
         u32 rx_status;
         u32 channel;
@@ -927,7 +929,25 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         if (rx_status & WMI_RX_STATUS_ERR_MIC)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
-        status->band = phy_mode_to_band(phy_mode);
+        /* HW can Rx CCK rates on 5GHz. In that case phy_mode is set to
+         * MODE_11B. This means phy_mode is not a reliable source for the band
+         * of mgmt rx. */
+
+        ch = ar->scan_channel;
+        if (!ch)
+                ch = ar->rx_channel;
+
+        if (ch) {
+                status->band = ch->band;
+
+                if (phy_mode == MODE_11B &&
+                    status->band == IEEE80211_BAND_5GHZ)
+                        ath10k_dbg(ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+        } else {
+                ath10k_warn("using (unreliable) phy_mode to extract band for mgmt rx\n");
+                status->band = phy_mode_to_band(phy_mode);
+        }
+
         status->freq = ieee80211_channel_to_frequency(channel, status->band);
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
@@ -937,7 +957,11 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
 
-        if (fc & IEEE80211_FCTL_PROTECTED) {
+        /* FW delivers WEP Shared Auth frame with Protected Bit set and
+         * encrypted payload. However in case of PMF it delivers decrypted
+         * frames with Protected Bit set. */
+        if (ieee80211_has_protected(hdr->frame_control) &&
+            !ieee80211_is_auth(hdr->frame_control)) {
                 status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED |
                                 RX_FLAG_MMIC_STRIPPED;
                 hdr->frame_control = __cpu_to_le16(fc &
@@ -1047,9 +1071,14 @@ static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
         ath10k_dbg(ATH10K_DBG_WMI, "WMI_ECHO_EVENTID\n");
 }
 
-static void ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_DEBUG_MESG_EVENTID\n");
+        ath10k_dbg(ATH10K_DBG_WMI, "wmi event debug mesg len %d\n",
+                   skb->len);
+
+        trace_ath10k_wmi_dbglog(skb->data, skb->len);
+
+        return 0;
 }
 
 static void ath10k_wmi_event_update_stats(struct ath10k *ar,
@@ -1653,9 +1682,37 @@ static void ath10k_wmi_event_profile_match(struct ath10k *ar,
 }
 
 static void ath10k_wmi_event_debug_print(struct ath10k *ar,
-                                  struct sk_buff *skb)
+                                         struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_DEBUG_PRINT_EVENTID\n");
+        char buf[101], c;
+        int i;
+
+        for (i = 0; i < sizeof(buf) - 1; i++) {
+                if (i >= skb->len)
+                        break;
+
+                c = skb->data[i];
+
+                if (c == '\0')
+                        break;
+
+                if (isascii(c) && isprint(c))
+                        buf[i] = c;
+                else
+                        buf[i] = '.';
+        }
+
+        if (i == sizeof(buf) - 1)
+                ath10k_warn("wmi debug print truncated: %d\n", skb->len);
+
+        /* for some reason the debug prints end with \n, remove that */
+        if (skb->data[i - 1] == '\n')
+                i--;
+
+        /* the last byte is always reserved for the null character */
+        buf[i] = '\0';
+
+        ath10k_dbg(ATH10K_DBG_WMI, "wmi event debug print '%s'\n", buf);
 }
 
 static void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
@@ -3445,3 +3502,40 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                    type, delay_ms);
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
 }
+
+int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+{
+        struct wmi_dbglog_cfg_cmd *cmd;
+        struct sk_buff *skb;
+        u32 cfg;
+
+        skb = ath10k_wmi_alloc_skb(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct wmi_dbglog_cfg_cmd *)skb->data;
+
+        if (module_enable) {
+                cfg = SM(ATH10K_DBGLOG_LEVEL_VERBOSE,
+                         ATH10K_DBGLOG_CFG_LOG_LVL);
+        } else {
+                /* set back defaults, all modules with WARN level */
+                cfg = SM(ATH10K_DBGLOG_LEVEL_WARN,
+                         ATH10K_DBGLOG_CFG_LOG_LVL);
+                module_enable = ~0;
+        }
+
+        cmd->module_enable = __cpu_to_le32(module_enable);
+        cmd->module_valid = __cpu_to_le32(~0);
+        cmd->config_enable = __cpu_to_le32(cfg);
+        cmd->config_valid = __cpu_to_le32(ATH10K_DBGLOG_CFG_LOG_LVL_MASK);
+
+        ath10k_dbg(ATH10K_DBG_WMI,
+                   "wmi dbglog cfg modules %08x %08x config %08x %08x\n",
+                   __le32_to_cpu(cmd->module_enable),
+                   __le32_to_cpu(cmd->module_valid),
+                   __le32_to_cpu(cmd->config_enable),
+                   __le32_to_cpu(cmd->config_valid));
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 0087d699b85b..4b5e7d3d32b6 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -3003,6 +3003,18 @@ struct wmi_vdev_install_key_arg {
         const void *key_data;
 };
 
+/*
+ * vdev fixed rate format:
+ * - preamble - b7:b6 - see WMI_RATE_PREMABLE_
+ * - nss      - b5:b4 - ss number (0 mean 1ss)
+ * - rate_mcs - b3:b0 - as below
+ *    CCK:  0 - 11Mbps, 1 - 5,5Mbps, 2 - 2Mbps, 3 - 1Mbps,
+ *          4 - 11Mbps (s), 5 - 5,5Mbps (s), 6 - 2Mbps (s)
+ *    OFDM: 0 - 48Mbps, 1 - 24Mbps, 2 - 12Mbps, 3 - 6Mbps,
+ *          4 - 54Mbps, 5 - 36Mbps, 6 - 18Mbps, 7 - 9Mbps
+ *    HT/VHT: MCS index
+ */
+
 /* Preamble types to be used with VDEV fixed rate configuration */
 enum wmi_rate_preamble {
         WMI_RATE_PREAMBLE_OFDM,
@@ -4090,6 +4102,54 @@ struct wmi_force_fw_hang_cmd {
         __le32 delay_ms;
 } __packed;
 
+enum ath10k_dbglog_level {
+        ATH10K_DBGLOG_LEVEL_VERBOSE = 0,
+        ATH10K_DBGLOG_LEVEL_INFO = 1,
+        ATH10K_DBGLOG_LEVEL_WARN = 2,
+        ATH10K_DBGLOG_LEVEL_ERR = 3,
+};
+
+/* VAP ids to enable dbglog */
+#define ATH10K_DBGLOG_CFG_VAP_LOG_LSB           0
+#define ATH10K_DBGLOG_CFG_VAP_LOG_MASK          0x0000ffff
+
+/* to enable dbglog in the firmware */
+#define ATH10K_DBGLOG_CFG_REPORTING_ENABLE_LSB  16
+#define ATH10K_DBGLOG_CFG_REPORTING_ENABLE_MASK 0x00010000
+
+/* timestamp resolution */
+#define ATH10K_DBGLOG_CFG_RESOLUTION_LSB        17
+#define ATH10K_DBGLOG_CFG_RESOLUTION_MASK       0x000E0000
+
+/* number of queued messages before sending them to the host */
+#define ATH10K_DBGLOG_CFG_REPORT_SIZE_LSB       20
+#define ATH10K_DBGLOG_CFG_REPORT_SIZE_MASK      0x0ff00000
+
+/*
+ * Log levels to enable. This defines the minimum level to enable, this is
+ * not a bitmask. See enum ath10k_dbglog_level for the values.
+ */
+#define ATH10K_DBGLOG_CFG_LOG_LVL_LSB           28
+#define ATH10K_DBGLOG_CFG_LOG_LVL_MASK          0x70000000
+
+/*
+ * Note: this is a cleaned up version of a struct firmware uses. For
+ * example, config_valid was hidden inside an array.
+ */
+struct wmi_dbglog_cfg_cmd {
+        /* bitmask to hold mod id config*/
+        __le32 module_enable;
+
+        /* see ATH10K_DBGLOG_CFG_ */
+        __le32 config_enable;
+
+        /* mask of module id bits to be changed */
+        __le32 module_valid;
+
+        /* mask of config bits to be changed, see ATH10K_DBGLOG_CFG_ */
+        __le32 config_valid;
+} __packed;
+
 #define ATH10K_RTS_MAX          2347
 #define ATH10K_FRAGMT_THRESHOLD_MIN     540
 #define ATH10K_FRAGMT_THRESHOLD_MAX     2346
@@ -4167,5 +4227,6 @@ int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
 int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                              enum wmi_force_fw_hang_type type, u32 delay_ms);
 int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 6396ad4bce67..ef35da84f63b 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1238,14 +1238,11 @@ static void
 ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
                      struct ieee80211_rx_status *rxs)
 {
-        struct ath_common *common = ath5k_hw_common(ah);
         u64 tsf, bc_tstamp;
         u32 hw_tu;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 
-        if (ieee80211_is_beacon(mgmt->frame_control) &&
-            le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
-            ether_addr_equal_64bits(mgmt->bssid, common->curbssid)) {
+        if (le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware *must*
                  * have updated the local TSF. We have to work around various
@@ -1301,23 +1298,6 @@ ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
         }
 }
 
-static void
-ath5k_update_beacon_rssi(struct ath5k_hw *ah, struct sk_buff *skb, int rssi)
-{
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-        struct ath_common *common = ath5k_hw_common(ah);
-
-        /* only beacons from our BSSID */
-        if (!ieee80211_is_beacon(mgmt->frame_control) ||
-            !ether_addr_equal_64bits(mgmt->bssid, common->curbssid))
-                return;
-
-        ewma_add(&ah->ah_beacon_rssi_avg, rssi);
-
-        /* in IBSS mode we should keep RSSI statistics per neighbour */
-        /* le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS */
-}
-
 /*
  * Compute padding position. skb must contain an IEEE 802.11 frame
  */
@@ -1390,6 +1370,7 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
                     struct ath5k_rx_status *rs)
 {
         struct ieee80211_rx_status *rxs;
+        struct ath_common *common = ath5k_hw_common(ah);
 
         ath5k_remove_padding(skb);
 
@@ -1442,11 +1423,13 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
 
         trace_ath5k_rx(ah, skb);
 
-        ath5k_update_beacon_rssi(ah, skb, rs->rs_rssi);
+        if (ath_is_mybeacon(common, (struct ieee80211_hdr *)skb->data)) {
+                ewma_add(&ah->ah_beacon_rssi_avg, rs->rs_rssi);
 
-        /* check beacons in IBSS mode */
-        if (ah->opmode == NL80211_IFTYPE_ADHOC)
-                ath5k_check_ibss_tsf(ah, skb, rxs);
+                /* check beacons in IBSS mode */
+                if (ah->opmode == NL80211_IFTYPE_ADHOC)
+                        ath5k_check_ibss_tsf(ah, skb, rxs);
+        }
 
         ieee80211_rx(ah->hw, skb);
 }
@@ -2549,7 +2532,6 @@ ath5k_init_ah(struct ath5k_hw *ah, const struct ath_bus_ops *bus_ops)
         hw->wiphy->available_antennas_rx = 0x3;
 
         hw->extra_tx_headroom = 2;
-        hw->channel_change_time = 5000;
 
         /*
          * Mark the device as detached to avoid processing
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 30d273c61bff..7b96b3e5712d 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -65,6 +65,14 @@ config ATH9K_DEBUGFS
 
           Also required for changing debug message flags at run time.
 
+config ATH9K_STATION_STATISTICS
+        bool "Detailed station statistics"
+        depends on ATH9K && ATH9K_DEBUGFS && DEBUG_FS
+        select MAC80211_DEBUGFS
+        default n
+        ---help---
+          This option enables detailed statistics for association stations.
+
 config ATH9K_DFS_CERTIFIED
         bool "Atheros DFS support for certified platforms"
         depends on ATH9K && CFG80211_CERTIFICATION_ONUS
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index e9904e5ccd81..a40e5c5d7418 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -19,6 +19,8 @@ ath9k-$(CONFIG_ATH9K_WOW) += wow.o
 ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o \
                                  spectral.o
 
+ath9k-$(CONFIG_ATH9K_STATION_STATISTICS) += debug_sta.o
+
 obj-$(CONFIG_ATH9K) += ath9k.o
 
 ath9k_hw-y:=    \
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 8c145cd98c1c..a352128c40ad 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -565,7 +565,7 @@ static bool ar9003_hw_solve_iq_cal(struct ath_hw *ah,
         const s32 result_shift = 1 << 15;
         struct ath_common *common = ath9k_hw_common(ah);
 
-        f2 = (f1 * f1 + f3 * f3) / result_shift;
+        f2 = ((f1 >> 3) * (f1 >> 3) + (f3 >> 3) * (f3 >> 3)) >> 9;
 
         if (!f2) {
                 ath_dbg(common, CALIBRATE, "Divide by 0\n");
@@ -655,8 +655,8 @@ static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
         if (i2_m_q2_a0_d1 > 0x800)
                 i2_m_q2_a0_d1 = -((0xfff - i2_m_q2_a0_d1) + 1);
 
-        if (i2_p_q2_a0_d1 > 0x800)
-                i2_p_q2_a0_d1 = -((0xfff - i2_p_q2_a0_d1) + 1);
+        if (i2_p_q2_a0_d1 > 0x1000)
+                i2_p_q2_a0_d1 = -((0x1fff - i2_p_q2_a0_d1) + 1);
 
         if (iq_corr_a0_d1 > 0x800)
                 iq_corr_a0_d1 = -((0xfff - iq_corr_a0_d1) + 1);
@@ -700,6 +700,19 @@ static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
                 return false;
         }
 
+        if ((i2_p_q2_a0_d0 < 1024) || (i2_p_q2_a0_d0 > 2047) ||
+            (i2_p_q2_a1_d0 < 0) || (i2_p_q2_a1_d1 < 0) ||
+            (i2_p_q2_a0_d0 <= i2_m_q2_a0_d0) ||
+            (i2_p_q2_a0_d0 <= iq_corr_a0_d0) ||
+            (i2_p_q2_a0_d1 <= i2_m_q2_a0_d1) ||
+            (i2_p_q2_a0_d1 <= iq_corr_a0_d1) ||
+            (i2_p_q2_a1_d0 <= i2_m_q2_a1_d0) ||
+            (i2_p_q2_a1_d0 <= iq_corr_a1_d0) ||
+            (i2_p_q2_a1_d1 <= i2_m_q2_a1_d1) ||
+            (i2_p_q2_a1_d1 <= iq_corr_a1_d1)) {
+                return false;
+        }
+
         mag_a0_d0 = (i2_m_q2_a0_d0 * res_scale) / i2_p_q2_a0_d0;
         phs_a0_d0 = (iq_corr_a0_d0 * res_scale) / i2_p_q2_a0_d0;
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index f622a986c8cc..b5ac32cfbeb8 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -146,7 +146,9 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 
 #define ATH_AN_2_TID(_an, _tidno)  (&(_an)->tid[(_tidno)])
 
-#define IS_CCK_RATE(rate) ((rate >= 0x18) && (rate <= 0x1e))
+#define IS_HT_RATE(rate)   (rate & 0x80)
+#define IS_CCK_RATE(rate)  ((rate >= 0x18) && (rate <= 0x1e))
+#define IS_OFDM_RATE(rate) ((rate >= 0x8) && (rate <= 0xf))
 
 struct ath_txq {
         int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
@@ -262,6 +264,10 @@ struct ath_node {
 
         bool sleeping;
         bool no_ps_filter;
+
+#ifdef CONFIG_ATH9K_STATION_STATISTICS
+        struct ath_rx_rate_stats rx_rate_stats;
+#endif
 };
 
 struct ath_tx_control {
@@ -685,6 +691,7 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define DEFAULT_CACHELINE       32
 #define ATH_CABQ_READY_TIME     80      /* % of beacon interval */
 #define ATH_TXPOWER_MAX         100     /* .5 dBm units */
+#define MAX_GTT_CNT             5
 
 enum sc_op_flags {
         SC_OP_INVALID,
@@ -727,6 +734,7 @@ struct ath_softc {
         unsigned long sc_flags;
         unsigned long driver_data;
 
+        u8 gtt_cnt;
         u32 intrstatus;
         u16 ps_flags; /* PS_* */
         u16 curtxpow;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index b041052a10ee..ab7264c1d8f7 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -943,14 +943,10 @@ static const struct file_operations fops_reset = {
 static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
-#define PHY_ERR(s, p) \
-        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                         sc->debug.stats.rxstats.phy_err_stats[p]);
-
 #define RXS_ERR(s, e)                                       \
         do {                                                \
                 len += scnprintf(buf + len, size - len,     \
-                                 "%22s : %10u\n", s,        \
+                                 "%18s : %10u\n", s,        \
                                  sc->debug.stats.rxstats.e);\
         } while (0)
 
@@ -963,6 +959,12 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
+        RXS_ERR("PKTS-ALL", rx_pkts_all);
+        RXS_ERR("BYTES-ALL", rx_bytes_all);
+        RXS_ERR("BEACONS", rx_beacons);
+        RXS_ERR("FRAGS", rx_frags);
+        RXS_ERR("SPECTRAL", rx_spectral);
+
         RXS_ERR("CRC ERR", crc_err);
         RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
         RXS_ERR("PHY ERR", phy_err);
@@ -970,43 +972,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
         RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
         RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
-        RXS_ERR("RX-LENGTH-ERR", rx_len_err);
-        RXS_ERR("RX-OOM-ERR", rx_oom_err);
-        RXS_ERR("RX-RATE-ERR", rx_rate_err);
-        RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
-
-        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
-
-        RXS_ERR("RX-Pkts-All", rx_pkts_all);
-        RXS_ERR("RX-Bytes-All", rx_bytes_all);
-        RXS_ERR("RX-Beacons", rx_beacons);
-        RXS_ERR("RX-Frags", rx_frags);
-        RXS_ERR("RX-Spectral", rx_spectral);
+        RXS_ERR("LENGTH-ERR", rx_len_err);
+        RXS_ERR("OOM-ERR", rx_oom_err);
+        RXS_ERR("RATE-ERR", rx_rate_err);
+        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         if (len > size)
                 len = size;
@@ -1017,7 +986,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         return retval;
 
 #undef RXS_ERR
-#undef PHY_ERR
 }
 
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
@@ -1056,6 +1024,67 @@ static const struct file_operations fops_recv = {
         .llseek = default_llseek,
 };
 
+static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
+{
+#define PHY_ERR(s, p) \
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         sc->debug.stats.rxstats.phy_err_stats[p]);
+
+        struct ath_softc *sc = file->private_data;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
+
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+
+#undef PHY_ERR
+}
+
+static const struct file_operations fops_phy_err = {
+        .read = read_file_phy_err,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1322,86 +1351,6 @@ static const struct file_operations fops_btcoex = {
 };
 #endif
 
-static ssize_t read_file_node_stat(struct file *file, char __user *user_buf,
-                                   size_t count, loff_t *ppos)
-{
-        struct ath_node *an = file->private_data;
-        struct ath_softc *sc = an->sc;
-        struct ath_atx_tid *tid;
-        struct ath_atx_ac *ac;
-        struct ath_txq *txq;
-        u32 len = 0, size = 4096;
-        char *buf;
-        size_t retval;
-        int tidno, acno;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        if (!an->sta->ht_cap.ht_supported) {
-                len = scnprintf(buf, size, "%s\n",
-                                "HT not supported");
-                goto exit;
-        }
-
-        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
-                        an->maxampdu);
-        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
-                         an->mpdudensity);
-
-        len += scnprintf(buf + len, size - len,
-                         "%2s%7s\n", "AC", "SCHED");
-
-        for (acno = 0, ac = &an->ac[acno];
-             acno < IEEE80211_NUM_ACS; acno++, ac++) {
-                txq = ac->txq;
-                ath_txq_lock(sc, txq);
-                len += scnprintf(buf + len, size - len,
-                                 "%2d%7d\n",
-                                 acno, ac->sched);
-                ath_txq_unlock(sc, txq);
-        }
-
-        len += scnprintf(buf + len, size - len,
-                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
-                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
-                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
-
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-                txq = tid->ac->txq;
-                ath_txq_lock(sc, txq);
-                len += scnprintf(buf + len, size - len,
-                                 "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
-                                 tid->tidno, tid->seq_start, tid->seq_next,
-                                 tid->baw_size, tid->baw_head, tid->baw_tail,
-                                 tid->bar_index, tid->sched, tid->paused);
-                ath_txq_unlock(sc, txq);
-        }
-exit:
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_node_stat = {
-        .read = read_file_node_stat,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
-                           struct ieee80211_vif *vif,
-                           struct ieee80211_sta *sta,
-                           struct dentry *dir)
-{
-        struct ath_node *an = (struct ath_node *)sta->drv_priv;
-        debugfs_create_file("node_stat", S_IRUGO, dir, an, &fops_node_stat);
-}
-
 /* Ethtool support for get-stats */
 
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
@@ -1569,6 +1518,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_reset);
         debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_recv);
+        debugfs_create_file("phy_err", S_IRUSR, sc->debug.debugfs_phy, sc,
+                            &fops_phy_err);
         debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
                           &ah->rxchainmask);
         debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index ec02d38ea8ea..cc7a025d833e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -27,11 +27,13 @@ struct fft_sample_tlv;
 
 #ifdef CONFIG_ATH9K_DEBUGFS
 #define TX_STAT_INC(q, c) sc->debug.stats.txstats[q].c++
+#define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
 #define RESET_STAT_INC(sc, type) sc->debug.stats.reset[type]++
 #define ANT_STAT_INC(i, c) sc->debug.stats.ant_stats[i].c++
 #define ANT_LNA_INC(i, c) sc->debug.stats.ant_stats[i].lna_recv_cnt[c]++;
 #else
 #define TX_STAT_INC(q, c) do { } while (0)
+#define RX_STAT_INC(c)
 #define RESET_STAT_INC(sc, type) do { } while (0)
 #define ANT_STAT_INC(i, c) do { } while (0)
 #define ANT_LNA_INC(i, c) do { } while (0)
@@ -42,6 +44,7 @@ enum ath_reset_type {
         RESET_TYPE_BB_WATCHDOG,
         RESET_TYPE_FATAL_INT,
         RESET_TYPE_TX_ERROR,
+        RESET_TYPE_TX_GTT,
         RESET_TYPE_TX_HANG,
         RESET_TYPE_PLL_HANG,
         RESET_TYPE_MAC_HANG,
@@ -201,7 +204,23 @@ struct ath_tx_stats {
                                  TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
         } while(0)
 
-#define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
+struct ath_rx_rate_stats {
+        struct {
+                u32 ht20_cnt;
+                u32 ht40_cnt;
+                u32 sgi_cnt;
+                u32 lgi_cnt;
+        } ht_stats[24];
+
+        struct {
+                u32 ofdm_cnt;
+        } ofdm_stats[8];
+
+        struct {
+                u32 cck_lp_cnt;
+                u32 cck_sp_cnt;
+        } cck_stats[4];
+};
 
 /**
  * struct ath_rx_stats - RX Statistics
@@ -299,8 +318,6 @@ void ath9k_debug_sync_cause(struct ath_softc *sc, u32 sync_cause);
 
 #else
 
-#define RX_STAT_INC(c) /* NOP */
-
 static inline int ath9k_init_debug(struct ath_hw *ah)
 {
         return 0;
@@ -338,4 +355,16 @@ ath9k_debug_sync_cause(struct ath_softc *sc, u32 sync_cause)
 
 #endif /* CONFIG_ATH9K_DEBUGFS */
 
+#ifdef CONFIG_ATH9K_STATION_STATISTICS
+void ath_debug_rate_stats(struct ath_softc *sc,
+                          struct ath_rx_status *rs,
+                          struct sk_buff *skb);
+#else
+static inline void ath_debug_rate_stats(struct ath_softc *sc,
+                                        struct ath_rx_status *rs,
+                                        struct sk_buff *skb)
+{
+}
+#endif /* CONFIG_ATH9K_STATION_STATISTICS */
+
 #endif /* DEBUG_H */
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
new file mode 100644
index 000000000000..d76e6e0120d2
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+/*************/
+/* node_aggr */
+/*************/
+
+static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath_node *an = file->private_data;
+        struct ath_softc *sc = an->sc;
+        struct ath_atx_tid *tid;
+        struct ath_atx_ac *ac;
+        struct ath_txq *txq;
+        u32 len = 0, size = 4096;
+        char *buf;
+        size_t retval;
+        int tidno, acno;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        if (!an->sta->ht_cap.ht_supported) {
+                len = scnprintf(buf, size, "%s\n",
+                                "HT not supported");
+                goto exit;
+        }
+
+        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
+                        an->maxampdu);
+        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
+                         an->mpdudensity);
+
+        len += scnprintf(buf + len, size - len,
+                         "%2s%7s\n", "AC", "SCHED");
+
+        for (acno = 0, ac = &an->ac[acno];
+             acno < IEEE80211_NUM_ACS; acno++, ac++) {
+                txq = ac->txq;
+                ath_txq_lock(sc, txq);
+                len += scnprintf(buf + len, size - len,
+                                 "%2d%7d\n",
+                                 acno, ac->sched);
+                ath_txq_unlock(sc, txq);
+        }
+
+        len += scnprintf(buf + len, size - len,
+                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
+                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
+                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
+
+        for (tidno = 0, tid = &an->tid[tidno];
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+                txq = tid->ac->txq;
+                ath_txq_lock(sc, txq);
+                if (tid->active) {
+                        len += scnprintf(buf + len, size - len,
+                                         "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                         tid->tidno,
+                                         tid->seq_start,
+                                         tid->seq_next,
+                                         tid->baw_size,
+                                         tid->baw_head,
+                                         tid->baw_tail,
+                                         tid->bar_index,
+                                         tid->sched,
+                                         tid->paused);
+                }
+                ath_txq_unlock(sc, txq);
+        }
+exit:
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_node_aggr = {
+        .read = read_file_node_aggr,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/*************/
+/* node_recv */
+/*************/
+
+void ath_debug_rate_stats(struct ath_softc *sc,
+                          struct ath_rx_status *rs,
+                          struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ieee80211_rx_status *rxs;
+        struct ath_rx_rate_stats *rstats;
+        struct ieee80211_sta *sta;
+        struct ath_node *an;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return;
+
+        rcu_read_lock();
+
+        sta = ieee80211_find_sta_by_ifaddr(sc->hw, hdr->addr2, NULL);
+        if (!sta)
+                goto exit;
+
+        an = (struct ath_node *) sta->drv_priv;
+        rstats = &an->rx_rate_stats;
+        rxs = IEEE80211_SKB_RXCB(skb);
+
+        if (IS_HT_RATE(rs->rs_rate)) {
+                if (rxs->rate_idx >= ARRAY_SIZE(rstats->ht_stats))
+                        goto exit;
+
+                if (rxs->flag & RX_FLAG_40MHZ)
+                        rstats->ht_stats[rxs->rate_idx].ht40_cnt++;
+                else
+                        rstats->ht_stats[rxs->rate_idx].ht20_cnt++;
+
+                if (rxs->flag & RX_FLAG_SHORT_GI)
+                        rstats->ht_stats[rxs->rate_idx].sgi_cnt++;
+                else
+                        rstats->ht_stats[rxs->rate_idx].lgi_cnt++;
+
+                goto exit;
+        }
+
+        if (IS_CCK_RATE(rs->rs_rate)) {
+                if (rxs->flag & RX_FLAG_SHORTPRE)
+                        rstats->cck_stats[rxs->rate_idx].cck_sp_cnt++;
+                else
+                        rstats->cck_stats[rxs->rate_idx].cck_lp_cnt++;
+
+                goto exit;
+        }
+
+        if (IS_OFDM_RATE(rs->rs_rate)) {
+                if (ah->curchan->chan->band == IEEE80211_BAND_2GHZ)
+                        rstats->ofdm_stats[rxs->rate_idx - 4].ofdm_cnt++;
+                else
+                        rstats->ofdm_stats[rxs->rate_idx].ofdm_cnt++;
+        }
+exit:
+        rcu_read_unlock();
+}
+
+#define PRINT_CCK_RATE(str, i, sp)                                      \
+        do {                                                            \
+                len += scnprintf(buf + len, size - len,                 \
+                         "%11s : %10u\n",                               \
+                         str,                                           \
+                         (sp) ? rstats->cck_stats[i].cck_sp_cnt :       \
+                         rstats->cck_stats[i].cck_lp_cnt);              \
+        } while (0)
+
+#define PRINT_OFDM_RATE(str, i)                                 \
+        do {                                                    \
+                len += scnprintf(buf + len, size - len,         \
+                         "%11s : %10u\n",                       \
+                         str,                                   \
+                         rstats->ofdm_stats[i].ofdm_cnt);       \
+        } while (0)
+
+static ssize_t read_file_node_recv(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath_node *an = file->private_data;
+        struct ath_softc *sc = an->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_rx_rate_stats *rstats;
+        struct ieee80211_sta *sta = an->sta;
+        enum ieee80211_band band;
+        u32 len = 0, size = 4096;
+        char *buf;
+        size_t retval;
+        int i;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        band = ah->curchan->chan->band;
+        rstats = &an->rx_rate_stats;
+
+        if (!sta->ht_cap.ht_supported)
+                goto legacy;
+
+        len += scnprintf(buf + len, size - len,
+                         "%24s%10s%10s%10s\n",
+                         "HT20", "HT40", "SGI", "LGI");
+
+        for (i = 0; i < 24; i++) {
+                len += scnprintf(buf + len, size - len,
+                                 "%8s%3u : %10u%10u%10u%10u\n",
+                                 "MCS", i,
+                                 rstats->ht_stats[i].ht20_cnt,
+                                 rstats->ht_stats[i].ht40_cnt,
+                                 rstats->ht_stats[i].sgi_cnt,
+                                 rstats->ht_stats[i].lgi_cnt);
+        }
+
+        len += scnprintf(buf + len, size - len, "\n");
+
+legacy:
+        if (band == IEEE80211_BAND_2GHZ) {
+                PRINT_CCK_RATE("CCK-1M/LP", 0, false);
+                PRINT_CCK_RATE("CCK-2M/LP", 1, false);
+                PRINT_CCK_RATE("CCK-5.5M/LP", 2, false);
+                PRINT_CCK_RATE("CCK-11M/LP", 3, false);
+
+                PRINT_CCK_RATE("CCK-2M/SP", 1, true);
+                PRINT_CCK_RATE("CCK-5.5M/SP", 2, true);
+                PRINT_CCK_RATE("CCK-11M/SP", 3, true);
+        }
+
+        PRINT_OFDM_RATE("OFDM-6M", 0);
+        PRINT_OFDM_RATE("OFDM-9M", 1);
+        PRINT_OFDM_RATE("OFDM-12M", 2);
+        PRINT_OFDM_RATE("OFDM-18M", 3);
+        PRINT_OFDM_RATE("OFDM-24M", 4);
+        PRINT_OFDM_RATE("OFDM-36M", 5);
+        PRINT_OFDM_RATE("OFDM-48M", 6);
+        PRINT_OFDM_RATE("OFDM-54M", 7);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+#undef PRINT_OFDM_RATE
+#undef PRINT_CCK_RATE
+
+static const struct file_operations fops_node_recv = {
+        .read = read_file_node_recv,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct dentry *dir)
+{
+        struct ath_node *an = (struct ath_node *)sta->drv_priv;
+
+        debugfs_create_file("node_aggr", S_IRUGO, dir, an, &fops_node_aggr);
+        debugfs_create_file("node_recv", S_IRUGO, dir, an, &fops_node_recv);
+}
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index b576c44bb314..f4e1de20d99c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -748,7 +748,6 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         hw->queues = 4;
-        hw->channel_change_time = 5000;
         hw->max_listen_interval = 1;
 
         hw->vif_data_size = sizeof(struct ath9k_htc_vif);
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index b41e008298dc..12e0f32a4905 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1075,9 +1075,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 
         last_rssi = priv->rx.last_rssi;
 
-        if (ieee80211_is_beacon(hdr->frame_control) &&
-            !is_zero_ether_addr(common->curbssid) &&
-            ether_addr_equal_64bits(hdr->addr3, common->curbssid)) {
+        if (ath_is_mybeacon(common, hdr)) {
                 s8 rssi = rxbuf->rxstatus.rs_rssi;
 
                 if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index f2a17fcf1ae4..c36de303c8f3 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -946,7 +946,6 @@ static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 
         hw->queues = 4;
         hw->max_rates = 4;
-        hw->channel_change_time = 5000;
         hw->max_listen_interval = 1;
         hw->max_rate_tries = 10;
         hw->sta_data_size = sizeof(struct ath_node);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index d0c3aec7c74e..73a36551a5ed 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -258,6 +258,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                 }
         }
 
+        sc->gtt_cnt = 0;
         ieee80211_wake_queues(sc->hw);
 
         return true;
@@ -476,6 +477,19 @@ void ath9k_tasklet(unsigned long data)
                 }
         }
 
+        if (status & ATH9K_INT_GTT) {
+                sc->gtt_cnt++;
+
+                if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) {
+                        type = RESET_TYPE_TX_GTT;
+                        ath9k_queue_reset(sc, type);
+                        atomic_inc(&ah->intr_ref_cnt);
+                        ath_dbg(common, ANY,
+                                "GTT: Skipping interrupts\n");
+                        goto out;
+                }
+        }
+
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
@@ -503,10 +517,19 @@ void ath9k_tasklet(unsigned long data)
         }
 
         if (status & ATH9K_INT_TX) {
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                        /*
+                         * For EDMA chips, TX completion is enabled for the
+                         * beacon queue, so if a beacon has been transmitted
+                         * successfully after a GTT interrupt, the GTT counter
+                         * gets reset to zero here.
+                         */
+                        /* sc->gtt_cnt = 0; */
+
                         ath_tx_edma_tasklet(sc);
-                else
+                } else {
                         ath_tx_tasklet(sc);
+                }
 
                 wake_up(&sc->tx_wait);
         }
@@ -536,13 +559,13 @@ irqreturn_t ath_isr(int irq, void *dev)
                 ATH9K_INT_TX |                  \
                 ATH9K_INT_BMISS |               \
                 ATH9K_INT_CST |                 \
+                ATH9K_INT_GTT |                 \
                 ATH9K_INT_TSFOOR |              \
                 ATH9K_INT_GENTIMER |            \
                 ATH9K_INT_MCI)
 
         struct ath_softc *sc = dev;
         struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
         enum ath9k_int status;
         u32 sync_cause = 0;
         bool sched = false;
@@ -603,14 +626,12 @@ irqreturn_t ath_isr(int irq, void *dev)
 #ifdef CONFIG_ATH9K_WOW
         if (status & ATH9K_INT_BMISS) {
                 if (atomic_read(&sc->wow_sleep_proc_intr) == 0) {
-                        ath_dbg(common, ANY, "during WoW we got a BMISS\n");
                         atomic_inc(&sc->wow_got_bmiss_intr);
                         atomic_dec(&sc->wow_sleep_proc_intr);
                 }
         }
 #endif
 
-
         if (status & ATH9K_INT_SWBA)
                 tasklet_schedule(&sc->bcon_tasklet);
 
@@ -735,7 +756,12 @@ static int ath9k_start(struct ieee80211_hw *hw)
         if (ah->config.hw_hang_checks & HW_BB_WATCHDOG)
                 ah->imask |= ATH9K_INT_BB_WATCHDOG;
 
-        ah->imask |= ATH9K_INT_GTT;
+        /*
+         * Enable GTT interrupts only for AR9003/AR9004 chips
+         * for now.
+         */
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 ah->imask |= ATH9K_INT_CST;
@@ -2111,7 +2137,7 @@ struct ieee80211_ops ath9k_ops = {
         .get_et_strings     = ath9k_get_et_strings,
 #endif
 
-#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
+#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_STATION_STATISTICS)
         .sta_add_debugfs    = ath9k_sta_add_debugfs,
 #endif
         .sw_scan_start      = ath9k_sw_scan_start,
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index f7cc5b37a18f..a0ebdd000fc2 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -969,21 +969,6 @@ static void ath9k_process_tsf(struct ath_rx_status *rs,
                 rxs->mactime += 0x100000000ULL;
 }
 
-static bool ath9k_is_mybeacon(struct ath_softc *sc, struct ieee80211_hdr *hdr)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (ieee80211_is_beacon(hdr->frame_control)) {
-                RX_STAT_INC(rx_beacons);
-                if (!is_zero_ether_addr(common->curbssid) &&
-                    ether_addr_equal_64bits(hdr->addr3, common->curbssid))
-                        return true;
-        }
-
-        return false;
-}
-
 /*
  * For Decrypt or Demic errors, we only mark packet status here and always push
  * up the frame up to let mac80211 handle the actual error case, be it no
@@ -1071,7 +1056,10 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 goto exit;
         }
 
-        rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
+        if (ath_is_mybeacon(common, hdr)) {
+                RX_STAT_INC(rx_beacons);
+                rx_stats->is_mybeacon = true;
+        }
 
         /*
          * This shouldn't happen, but have a safety check anyway.
@@ -1354,8 +1342,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
                 ath9k_antenna_check(sc, &rs);
-
                 ath9k_apply_ampdu_details(sc, &rs, rxs);
+                ath_debug_rate_stats(sc, &rs, skb);
 
                 ieee80211_rx(hw, skb);
 
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index e8d0e7fc77da..0a75e2f68c9d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -47,8 +47,6 @@ static u16 bits_per_symbol[][2] = {
         {   260,  540 },     /*  7: 64-QAM 5/6 */
 };
 
-#define IS_HT_RATE(_rate)     ((_rate) & 0x80)
-
 static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
                                struct ath_atx_tid *tid, struct sk_buff *skb);
 static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 4c3f576c3144..4c8cdb097b65 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -1967,18 +1967,6 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
                 return -ENOMEM;
         ar->num_channels = chans;
 
-        /*
-         * I measured this, a bandswitch takes roughly
-         * 135 ms and a frequency switch about 80.
-         *
-         * FIXME: measure these values again once EEPROM settings
-         *        are used, that will influence them!
-         */
-        if (bands == 2)
-                ar->hw->channel_change_time = 135 * 1000;
-        else
-                ar->hw->channel_change_time = 80 * 1000;
-
         regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
 
         /* second part of wiphy init */
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index 1b1b20751ead..536bc46a2912 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -519,6 +519,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
 {
         struct ieee80211_hdr *hdr = data;
         struct ieee80211_tim_ie *tim_ie;
+        struct ath_common *common = &ar->common;
         u8 *tim;
         u8 tim_len;
         bool cam;
@@ -526,17 +527,13 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
         if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS)))
                 return;
 
-        /* check if this really is a beacon */
-        if (!ieee80211_is_beacon(hdr->frame_control))
-                return;
-
         /* min. beacon length + FCS_LEN */
         if (len <= 40 + FCS_LEN)
                 return;
 
+        /* check if this really is a beacon */
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal_64bits(hdr->addr3, ar->common.curbssid) ||
-            !ar->common.curaid)
+        if (!ath_is_mybeacon(common, hdr) || !common->curaid)
                 return;
 
         ar->ps.last_beacon = jiffies;
diff --git a/drivers/net/wireless/ath/main.c b/drivers/net/wireless/ath/main.c
index 8e99540cd90e..8b0ac14d5c32 100644
--- a/drivers/net/wireless/ath/main.c
+++ b/drivers/net/wireless/ath/main.c
@@ -59,6 +59,14 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
 }
 EXPORT_SYMBOL(ath_rxbuf_alloc);
 
+bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr)
+{
+        return ieee80211_is_beacon(hdr->frame_control) &&
+                !is_zero_ether_addr(common->curbssid) &&
+                ether_addr_equal_64bits(hdr->addr3, common->curbssid);
+}
+EXPORT_SYMBOL(ath_is_mybeacon);
+
 void ath_printk(const char *level, const struct ath_common* common,
                 const char *fmt, ...)
 {
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 9e154732afaa..e5e905910db4 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -632,7 +632,8 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         const struct ieee80211_regdomain *regd;
 
         wiphy->reg_notifier = reg_notifier;
-        wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
+        wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
+                                   REGULATORY_CUSTOM_REG;
 
         if (ath_is_world_regd(reg)) {
                 /*
@@ -640,8 +641,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
                  * saved on the wiphy orig_* parameters
                  */
                 regd = ath_world_regdomain(reg);
-                wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
-                                           REGULATORY_COUNTRY_IE_FOLLOW_POWER;
+                wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_FOLLOW_POWER;
         } else {
                 /*
                  * This gets applied in the case of the absence of CRDA,
@@ -650,6 +650,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
                  */
                 regd = ath_default_world_regdomain();
         }
+
         wiphy_apply_custom_regulatory(wiphy, regd);
         ath_reg_apply_radar_flags(wiphy);
         ath_reg_apply_world_flags(wiphy, NL80211_REGDOM_SET_BY_DRIVER, reg);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index 9b88440ef05b..0b0975d88b43 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -21,7 +21,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
-#include <asm/processor.h>
+#include <linux/prefetch.h>
 
 #include "wil6210.h"
 #include "wmi.h"
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 7f3d461f7e8d..54376fddfaf9 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
 struct b43_request_fw_context {
         /* The device we are requesting the fw for. */
         struct b43_wldev *dev;
-        /* a completion event structure needed if this call is asynchronous */
-        struct completion fw_load_complete;
         /* a pointer to the firmware object */
         const struct firmware *blob;
         /* The type of firmware to request. */
@@ -809,6 +807,8 @@ enum {
 struct b43_wldev {
         struct b43_bus_dev *dev;
         struct b43_wl *wl;
+        /* a completion event structure needed if this call is asynchronous */
+        struct completion fw_load_complete;
 
         /* The device initialization status.
          * Use b43_status() to query. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ccd24f0acb8d..c75237eb55a1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2070,6 +2070,7 @@ void b43_do_release_fw(struct b43_firmware_file *fw)
 
 static void b43_release_firmware(struct b43_wldev *dev)
 {
+        complete(&dev->fw_load_complete);
         b43_do_release_fw(&dev->fw.ucode);
         b43_do_release_fw(&dev->fw.pcm);
         b43_do_release_fw(&dev->fw.initvals);
@@ -2095,7 +2096,7 @@ static void b43_fw_cb(const struct firmware *firmware, void *context)
         struct b43_request_fw_context *ctx = context;
 
         ctx->blob = firmware;
-        complete(&ctx->fw_load_complete);
+        complete(&ctx->dev->fw_load_complete);
 }
 
 int b43_do_request_fw(struct b43_request_fw_context *ctx,
@@ -2142,7 +2143,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
         }
         if (async) {
                 /* do this part asynchronously */
-                init_completion(&ctx->fw_load_complete);
+                init_completion(&ctx->dev->fw_load_complete);
                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
                                               ctx->dev->dev->dev, GFP_KERNEL,
                                               ctx, b43_fw_cb);
@@ -2150,12 +2151,11 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                         pr_err("Unable to load firmware\n");
                         return err;
                 }
-                /* stall here until fw ready */
-                wait_for_completion(&ctx->fw_load_complete);
+                wait_for_completion(&ctx->dev->fw_load_complete);
                 if (ctx->blob)
                         goto fw_ready;
         /* On some ARM systems, the async request will fail, but the next sync
-         * request works. For this reason, we dall through here
+         * request works. For this reason, we fall through here
          */
         }
         err = request_firmware(&ctx->blob, ctx->fwname,
@@ -2424,6 +2424,7 @@ error:
 
 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
 static void b43_one_core_detach(struct b43_bus_dev *dev);
+static int b43_rng_init(struct b43_wl *wl);
 
 static void b43_request_firmware(struct work_struct *work)
 {
@@ -2475,6 +2476,10 @@ start_ieee80211:
                 goto err_one_core_detach;
         wl->hw_registred = true;
         b43_leds_register(wl->current_dev);
+
+        /* Register HW RNG driver */
+        b43_rng_init(wl);
+
         goto out;
 
 err_one_core_detach:
@@ -4636,9 +4641,6 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
                 return;
 
-        /* Unregister HW RNG driver */
-        b43_rng_exit(dev->wl);
-
         b43_set_status(dev, B43_STAT_UNINIT);
 
         /* Stop the microcode PSM. */
@@ -4795,9 +4797,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
-        /* Register HW RNG driver */
-        b43_rng_init(dev->wl);
-
 out:
         return err;
 
@@ -5464,6 +5463,9 @@ static void b43_bcma_remove(struct bcma_device *core)
 
         b43_one_core_detach(wldev->dev);
 
+        /* Unregister HW RNG driver */
+        b43_rng_exit(wl);
+
         b43_leds_unregister(wl);
 
         ieee80211_free_hw(wl->hw);
@@ -5541,6 +5543,9 @@ static void b43_ssb_remove(struct ssb_device *sdev)
 
         b43_one_core_detach(dev);
 
+        /* Unregister HW RNG driver */
+        b43_rng_exit(wl);
+
         if (list_empty(&wl->devlist)) {
                 b43_leds_unregister(wl);
                 /* Last core on the chip unregistered.
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 572668821862..349c77605231 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_device *dev)
          * as the ieee80211 unreg will destroy the workqueue. */
         cancel_work_sync(&wldev->restart_work);
         cancel_work_sync(&wl->firmware_load);
+        complete(&wldev->fw_load_complete);
 
         B43legacy_WARN_ON(!wl);
         if (!wldev->fw.ucode)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 5681b9862023..57cddee03252 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -32,6 +32,7 @@ brcmfmac-objs += \
                 bcdc.o \
                 dhd_common.o \
                 dhd_linux.o \
+                nvram.o \
                 btcoex.o
 brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
                 dhd_sdio.o \
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 34c993dd0602..fa35b23bbaa7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -287,6 +287,9 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
         s32 retry = 0;
         int ret;
 
+        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+                return -ENOMEDIUM;
+
         /*
          * figure out how to read the register based on address range
          * 0x00 ~ 0x7FF: function 0 CCCR and FBR
@@ -306,9 +309,12 @@ static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
                         usleep_range(1000, 2000);
                 ret = brcmf_sdiod_request_data(sdiodev, func_num, addr, regsz,
                                                data, write);
-        } while (ret != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+        } while (ret != 0 && ret != -ENOMEDIUM &&
+                 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
 
-        if (ret != 0)
+        if (ret == -ENOMEDIUM)
+                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+        else if (ret != 0)
                 brcmf_err("failed with %d\n", ret);
 
         return ret;
@@ -320,6 +326,9 @@ brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
         int err = 0, i;
         u8 addr[3];
 
+        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+                return -ENOMEDIUM;
+
         addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
         addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
         addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
@@ -429,6 +438,7 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                              bool write, u32 addr, struct sk_buff *pkt)
 {
         unsigned int req_sz;
+        int err;
 
         brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
         if (brcmf_sdiod_pm_resume_error(sdiodev))
@@ -439,18 +449,18 @@ static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
         req_sz &= (uint)~3;
 
         if (write)
-                return sdio_memcpy_toio(sdiodev->func[fn], addr,
-                                        ((u8 *)(pkt->data)),
-                                        req_sz);
+                err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+                                       ((u8 *)(pkt->data)), req_sz);
         else if (fn == 1)
-                return sdio_memcpy_fromio(sdiodev->func[fn],
-                                          ((u8 *)(pkt->data)),
-                                          addr, req_sz);
+                err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
+                                         addr, req_sz);
         else
                 /* function 2 read is FIFO operation */
-                return sdio_readsb(sdiodev->func[fn],
-                                   ((u8 *)(pkt->data)), addr,
-                                   req_sz);
+                err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
+                                  req_sz);
+        if (err == -ENOMEDIUM)
+                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+        return err;
 }
 
 /**
@@ -593,7 +603,11 @@ static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
 
                 ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
-                if (ret != 0) {
+                if (ret == -ENOMEDIUM) {
+                        brcmf_bus_change_state(sdiodev->bus_if,
+                                               BRCMF_BUS_NOMEDIUM);
+                        break;
+                } else if (ret != 0) {
                         brcmf_err("CMD53 sg block %s failed %d\n",
                                   write ? "write" : "read", ret);
                         ret = -EIO;
@@ -852,8 +866,6 @@ int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
 
 static int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev)
 {
-        sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-
         if (sdiodev->bus) {
                 brcmf_sdio_remove(sdiodev->bus);
                 sdiodev->bus = NULL;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index 5c12a07673fa..c4535616064e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -17,8 +17,12 @@
 #ifndef _BRCMF_BUS_H_
 #define _BRCMF_BUS_H_
 
+#include "dhd_dbg.h"
+
 /* The level of bus communication with the dongle */
 enum brcmf_bus_state {
+        BRCMF_BUS_UNKNOWN,      /* Not determined yet */
+        BRCMF_BUS_NOMEDIUM,     /* No medium access to dongle */
         BRCMF_BUS_DOWN,         /* Not ready for frame transfers */
         BRCMF_BUS_LOAD,         /* Download access only (CPU reset) */
         BRCMF_BUS_DATA          /* Ready for frame transfers */
@@ -144,6 +148,23 @@ struct pktq *brcmf_bus_gettxq(struct brcmf_bus *bus)
 
         return bus->ops->gettxq(bus->dev);
 }
+
+static inline bool brcmf_bus_ready(struct brcmf_bus *bus)
+{
+        return bus->state == BRCMF_BUS_LOAD || bus->state == BRCMF_BUS_DATA;
+}
+
+static inline void brcmf_bus_change_state(struct brcmf_bus *bus,
+                                          enum brcmf_bus_state new_state)
+{
+        /* NOMEDIUM is permanent */
+        if (bus->state == BRCMF_BUS_NOMEDIUM)
+                return;
+
+        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, new_state);
+        bus->state = new_state;
+}
+
 /*
  * interface functions from common layer
  */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index af39edae8c62..d4d966beb840 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -934,7 +934,7 @@ int brcmf_bus_start(struct device *dev)
                 p2p_ifp = NULL;
 
         /* signal bus ready */
-        bus_if->state = BRCMF_BUS_DATA;
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_DATA);
 
         /* Bus is ready, do any initialization */
         ret = brcmf_c_preinit_dcmds(ifp);
@@ -1029,6 +1029,8 @@ void brcmf_detach(struct device *dev)
         /* stop firmware event handling */
         brcmf_fweh_detach(drvr);
 
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+
         /* make sure primary interface removed last */
         for (i = BRCMF_MAX_IFS-1; i > -1; i--)
                 if (drvr->iflist[i]) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 9c7f08a13105..3e991897d7ca 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -41,6 +41,7 @@
 #include <soc.h>
 #include "sdio_host.h"
 #include "sdio_chip.h"
+#include "nvram.h"
 
 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
 
@@ -368,9 +369,7 @@ struct brcmf_sdio_hdrinfo {
 /* Private data for SDIO bus interaction */
 struct brcmf_sdio {
         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
-        struct chip_info *ci;   /* Chip info struct */
-        char *vars;             /* Variables (from CIS and/or other) */
-        uint varsz;             /* Size of variables buffer */
+        struct brcmf_chip *ci;  /* Chip info struct */
 
         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 
@@ -1083,10 +1082,6 @@ static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 
         /* Clear partial in any case */
         bus->cur_read.len = 0;
-
-        /* If we can't reach the device, signal failure */
-        if (err)
-                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
 }
 
 /* return total length of buffer chain */
@@ -1683,8 +1678,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         bus->rxpending = true;
 
         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
-             !bus->rxskip && rxleft &&
-             bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
+             !bus->rxskip && rxleft && brcmf_bus_ready(bus->sdiodev->bus_if);
              rd->seq_num++, rxleft--) {
 
                 /* Handle glomming separately */
@@ -2233,41 +2227,37 @@ static void brcmf_sdio_bus_stop(struct device *dev)
                 bus->watchdog_tsk = NULL;
         }
 
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Enable clock for device interrupts */
-        brcmf_sdio_bus_sleep(bus, false, false);
+        if (bus_if->state == BRCMF_BUS_DOWN) {
+                sdio_claim_host(sdiodev->func[1]);
+
+                /* Enable clock for device interrupts */
+                brcmf_sdio_bus_sleep(bus, false, false);
+
+                /* Disable and clear interrupts at the chip level also */
+                w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
+                local_hostintmask = bus->hostintmask;
+                bus->hostintmask = 0;
+
+                /* Force backplane clocks to assure F2 interrupt propagates */
+                saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                            &err);
+                if (!err)
+                        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                          (saveclk | SBSDIO_FORCE_HT), &err);
+                if (err)
+                        brcmf_err("Failed to force clock for F2: err %d\n",
+                                  err);
 
-        /* Disable and clear interrupts at the chip level also */
-        w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
-        local_hostintmask = bus->hostintmask;
-        bus->hostintmask = 0;
+                /* Turn off the bus (F2), free any pending packets */
+                brcmf_dbg(INTR, "disable SDIO interrupts\n");
+                sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
 
-        /* Change our idea of bus state */
-        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
+                /* Clear any pending interrupts now that F2 is disabled */
+                w_sdreg32(bus, local_hostintmask,
+                          offsetof(struct sdpcmd_regs, intstatus));
 
-        /* Force clocks on backplane to be sure F2 interrupt propagates */
-        saveclk = brcmf_sdiod_regrb(bus->sdiodev,
-                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
-        if (!err) {
-                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                  (saveclk | SBSDIO_FORCE_HT), &err);
+                sdio_release_host(sdiodev->func[1]);
         }
-        if (err)
-                brcmf_err("Failed to force clock for F2: err %d\n", err);
-
-        /* Turn off the bus (F2), free any pending packets */
-        brcmf_dbg(INTR, "disable SDIO interrupts\n");
-        sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
-
-        /* Clear any pending interrupts now that F2 is disabled */
-        w_sdreg32(bus, local_hostintmask,
-                  offsetof(struct sdpcmd_regs, intstatus));
-
-        /* Turn off the backplane clock (only) */
-        brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
-        sdio_release_host(bus->sdiodev->func[1]);
-
         /* Clear the data packet queues */
         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
 
@@ -2357,20 +2347,11 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
                 /* Check for inconsistent device control */
                 devctl = brcmf_sdiod_regrb(bus->sdiodev,
                                            SBSDIO_DEVICE_CTL, &err);
-                if (err) {
-                        brcmf_err("error reading DEVCTL: %d\n", err);
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                }
 #endif                          /* DEBUG */
 
                 /* Read CSR, if clock on switch to AVAIL, else ignore */
                 clkctl = brcmf_sdiod_regrb(bus->sdiodev,
                                            SBSDIO_FUNC1_CHIPCLKCSR, &err);
-                if (err) {
-                        brcmf_err("error reading CSR: %d\n",
-                                  err);
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                }
 
                 brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
                           devctl, clkctl);
@@ -2378,19 +2359,9 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
                 if (SBSDIO_HTAV(clkctl)) {
                         devctl = brcmf_sdiod_regrb(bus->sdiodev,
                                                    SBSDIO_DEVICE_CTL, &err);
-                        if (err) {
-                                brcmf_err("error reading DEVCTL: %d\n",
-                                          err);
-                                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                        }
                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
                         brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
                                           devctl, &err);
-                        if (err) {
-                                brcmf_err("error writing DEVCTL: %d\n",
-                                          err);
-                                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                        }
                         bus->clkstate = CLK_AVAIL;
                 }
         }
@@ -2525,9 +2496,8 @@ static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
                 txlimit -= framecnt;
         }
 
-        if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
+        if (!brcmf_bus_ready(bus->sdiodev->bus_if) || (err != 0)) {
                 brcmf_err("failed backplane access over SDIO, halting operation\n");
-                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
                 atomic_set(&bus->intstatus, 0);
         } else if (atomic_read(&bus->intstatus) ||
                    atomic_read(&bus->ipend) > 0 ||
@@ -3195,46 +3165,69 @@ brcmf_sdio_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
         return rxlen ? (int)rxlen : -ETIMEDOUT;
 }
 
-static bool brcmf_sdio_download_state(struct brcmf_sdio *bus, bool enter)
+#ifdef DEBUG
+static bool
+brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
+                        u8 *ram_data, uint ram_sz)
 {
-        struct chip_info *ci = bus->ci;
-
-        /* To enter download state, disable ARM and reset SOCRAM.
-         * To exit download state, simply reset ARM (default is RAM boot).
-         */
-        if (enter) {
-                bus->alp_only = true;
-
-                brcmf_sdio_chip_enter_download(bus->sdiodev, ci);
-        } else {
-                if (!brcmf_sdio_chip_exit_download(bus->sdiodev, ci, bus->vars,
-                                                   bus->varsz))
-                        return false;
+        char *ram_cmp;
+        int err;
+        bool ret = true;
+        int address;
+        int offset;
+        int len;
 
-                /* Allow HT Clock now that the ARM is running. */
-                bus->alp_only = false;
+        /* read back and verify */
+        brcmf_dbg(INFO, "Compare RAM dl & ul at 0x%08x; size=%d\n", ram_addr,
+                  ram_sz);
+        ram_cmp = kmalloc(MEMBLOCK, GFP_KERNEL);
+        /* do not proceed while no memory but  */
+        if (!ram_cmp)
+                return true;
 
-                bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
+        address = ram_addr;
+        offset = 0;
+        while (offset < ram_sz) {
+                len = ((offset + MEMBLOCK) < ram_sz) ? MEMBLOCK :
+                      ram_sz - offset;
+                err = brcmf_sdiod_ramrw(sdiodev, false, address, ram_cmp, len);
+                if (err) {
+                        brcmf_err("error %d on reading %d membytes at 0x%08x\n",
+                                  err, len, address);
+                        ret = false;
+                        break;
+                } else if (memcmp(ram_cmp, &ram_data[offset], len)) {
+                        brcmf_err("Downloaded RAM image is corrupted, block offset is %d, len is %d\n",
+                                  offset, len);
+                        ret = false;
+                        break;
+                }
+                offset += len;
+                address += len;
         }
 
+        kfree(ram_cmp);
+
+        return ret;
+}
+#else   /* DEBUG */
+static bool
+brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
+                        u8 *ram_data, uint ram_sz)
+{
         return true;
 }
+#endif  /* DEBUG */
 
-static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus)
+static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus,
+                                         const struct firmware *fw)
 {
-        const struct firmware *fw;
         int err;
         int offset;
         int address;
         int len;
 
-        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_BIN);
-        if (fw == NULL)
-                return -ENOENT;
-
-        if (brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4) !=
-            BRCMF_MAX_CORENUM)
-                memcpy(&bus->ci->rst_vec, fw->data, sizeof(bus->ci->rst_vec));
+        brcmf_dbg(TRACE, "Enter\n");
 
         err = 0;
         offset = 0;
@@ -3247,138 +3240,96 @@ static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus)
                 if (err) {
                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
                                   err, len, address);
-                        goto failure;
+                        return err;
                 }
                 offset += len;
                 address += len;
         }
-
-failure:
-        release_firmware(fw);
+        if (!err)
+                if (!brcmf_sdio_verifymemory(bus->sdiodev, bus->ci->rambase,
+                                             (u8 *)fw->data, fw->size))
+                        err = -EIO;
 
         return err;
 }
 
-/*
- * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
- * and ending in a NUL.
- * Removes carriage returns, empty lines, comment lines, and converts
- * newlines to NULs.
- * Shortens buffer as needed and pads with NULs.  End of buffer is marked
- * by two NULs.
-*/
-
-static int brcmf_sdio_strip_nvram(struct brcmf_sdio *bus,
-                                  const struct firmware *nv)
+static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
+                                     const struct firmware *nv)
 {
-        char *varbuf;
-        char *dp;
-        bool findNewline;
-        int column;
-        int ret = 0;
-        uint buf_len, n, len;
-
-        len = nv->size;
-        varbuf = vmalloc(len);
-        if (!varbuf)
-                return -ENOMEM;
-
-        memcpy(varbuf, nv->data, len);
-        dp = varbuf;
-
-        findNewline = false;
-        column = 0;
-
-        for (n = 0; n < len; n++) {
-                if (varbuf[n] == 0)
-                        break;
-                if (varbuf[n] == '\r')
-                        continue;
-                if (findNewline && varbuf[n] != '\n')
-                        continue;
-                findNewline = false;
-                if (varbuf[n] == '#') {
-                        findNewline = true;
-                        continue;
-                }
-                if (varbuf[n] == '\n') {
-                        if (column == 0)
-                                continue;
-                        *dp++ = 0;
-                        column = 0;
-                        continue;
-                }
-                *dp++ = varbuf[n];
-                column++;
-        }
-        buf_len = dp - varbuf;
-        while (dp < varbuf + n)
-                *dp++ = 0;
-
-        kfree(bus->vars);
-        /* roundup needed for download to device */
-        bus->varsz = roundup(buf_len + 1, 4);
-        bus->vars = kmalloc(bus->varsz, GFP_KERNEL);
-        if (bus->vars == NULL) {
-                bus->varsz = 0;
-                ret = -ENOMEM;
-                goto err;
-        }
+        void *vars;
+        u32 varsz;
+        int address;
+        int err;
 
-        /* copy the processed variables and add null termination */
-        memcpy(bus->vars, varbuf, buf_len);
-        bus->vars[buf_len] = 0;
-err:
-        vfree(varbuf);
-        return ret;
-}
+        brcmf_dbg(TRACE, "Enter\n");
 
-static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus)
-{
-        const struct firmware *nv;
-        int ret;
+        vars = brcmf_nvram_strip(nv, &varsz);
 
-        nv = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
-        if (nv == NULL)
-                return -ENOENT;
+        if (vars == NULL)
+                return -EINVAL;
 
-        ret = brcmf_sdio_strip_nvram(bus, nv);
+        address = bus->ci->ramsize - varsz + bus->ci->rambase;
+        err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, vars, varsz);
+        if (err)
+                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
+                          err, varsz, address);
+        else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz))
+                err = -EIO;
 
-        release_firmware(nv);
+        brcmf_nvram_free(vars);
 
-        return ret;
+        return err;
 }
 
 static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
 {
         int bcmerror = -EFAULT;
-
+        const struct firmware *fw;
+        u32 rstvec;
 
         sdio_claim_host(bus->sdiodev->func[1]);
         brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
 
         /* Keep arm in reset */
-        if (!brcmf_sdio_download_state(bus, true)) {
-                brcmf_err("error placing ARM core in reset\n");
+        brcmf_sdio_chip_enter_download(bus->sdiodev, bus->ci);
+
+        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_BIN);
+        if (fw == NULL) {
+                bcmerror = -ENOENT;
                 goto err;
         }
 
-        if (brcmf_sdio_download_code_file(bus)) {
+        rstvec = get_unaligned_le32(fw->data);
+        brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
+
+        bcmerror = brcmf_sdio_download_code_file(bus, fw);
+        release_firmware(fw);
+        if (bcmerror) {
                 brcmf_err("dongle image file download failed\n");
                 goto err;
         }
 
-        if (brcmf_sdio_download_nvram(bus)) {
+        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
+        if (fw == NULL) {
+                bcmerror = -ENOENT;
+                goto err;
+        }
+
+        bcmerror = brcmf_sdio_download_nvram(bus, fw);
+        release_firmware(fw);
+        if (bcmerror) {
                 brcmf_err("dongle nvram file download failed\n");
                 goto err;
         }
 
         /* Take arm out of reset */
-        if (!brcmf_sdio_download_state(bus, false)) {
+        if (!brcmf_sdio_chip_exit_download(bus->sdiodev, bus->ci, rstvec)) {
                 brcmf_err("error getting out of ARM core reset\n");
                 goto err;
         }
 
+        /* Allow HT Clock now that the ARM is running. */
+        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_LOAD);
         bcmerror = 0;
 
 err:
@@ -3567,9 +3518,11 @@ static int brcmf_sdio_bus_init(struct device *dev)
 
         /* try to download image and nvram to the dongle */
         if (bus_if->state == BRCMF_BUS_DOWN) {
+                bus->alp_only = true;
                 err = brcmf_sdio_download_firmware(bus);
                 if (err)
                         return err;
+                bus->alp_only = false;
         }
 
         if (!bus->sdiodev->bus_if->drvr)
@@ -3653,7 +3606,7 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
                 return;
         }
 
-        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+        if (!brcmf_bus_ready(bus->sdiodev->bus_if)) {
                 brcmf_err("bus is down. we have nothing to do\n");
                 return;
         }
@@ -3664,7 +3617,6 @@ void brcmf_sdio_isr(struct brcmf_sdio *bus)
         else
                 if (brcmf_sdio_intr_rstatus(bus)) {
                         brcmf_err("failed backplane access\n");
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
                 }
 
         /* Disable additional interrupts (is this needed now)? */
@@ -3779,8 +3731,6 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
         u32 reg_val;
         u32 drivestrength;
 
-        bus->alp_only = true;
-
         sdio_claim_host(bus->sdiodev->func[1]);
 
         pr_debug("F1 signature read @0x18000000=0x%4x\n",
@@ -3803,6 +3753,11 @@ brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
                 goto fail;
         }
 
+        /* SDIO register access works so moving
+         * state from UNKNOWN to DOWN.
+         */
+        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_DOWN);
+
         if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci)) {
                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
                 goto fail;
@@ -4026,7 +3981,6 @@ struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
         /* Disable F2 to clear any intermediate frame state on the dongle */
         sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
 
-        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
         bus->rxflow = false;
 
         /* Done with backplane-dependent accesses, can drop clock... */
@@ -4082,17 +4036,26 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus)
                 }
 
                 if (bus->ci) {
-                        sdio_claim_host(bus->sdiodev->func[1]);
-                        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
-                        brcmf_sdio_clkctl(bus, CLK_NONE, false);
-                        sdio_release_host(bus->sdiodev->func[1]);
+                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+                                sdio_claim_host(bus->sdiodev->func[1]);
+                                brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+                                /* Leave the device in state where it is
+                                 * 'quiet'. This is done by putting it in
+                                 * download_state which essentially resets
+                                 * all necessary cores.
+                                 */
+                                msleep(20);
+                                brcmf_sdio_chip_enter_download(bus->sdiodev,
+                                                               bus->ci);
+                                brcmf_sdio_clkctl(bus, CLK_NONE, false);
+                                sdio_release_host(bus->sdiodev->func[1]);
+                        }
                         brcmf_sdio_chip_detach(&bus->ci);
                 }
 
                 brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
                 kfree(bus->rxbuf);
                 kfree(bus->hdrbuf);
-                kfree(bus->vars);
                 kfree(bus);
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
new file mode 100644
index 000000000000..d5ef86db631b
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/firmware.h>
+
+#include "nvram.h"
+
+/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a file
+ * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
+ * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
+ * End of buffer is completed with token identifying length of buffer.
+ */
+void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length)
+{
+        u8 *nvram;
+        u32 i;
+        u32 len;
+        u32 column;
+        u8 val;
+        bool comment;
+        u32 token;
+        __le32 token_le;
+
+        /* Alloc for extra 0 byte + roundup by 4 + length field */
+        nvram = kmalloc(nv->size + 1 + 3 + sizeof(token_le), GFP_KERNEL);
+        if (!nvram)
+                return NULL;
+
+        len = 0;
+        column = 0;
+        comment = false;
+        for (i = 0; i < nv->size; i++) {
+                val = nv->data[i];
+                if (val == 0)
+                        break;
+                if (val == '\r')
+                        continue;
+                if (comment && (val != '\n'))
+                        continue;
+                comment = false;
+                if (val == '#') {
+                        comment = true;
+                        continue;
+                }
+                if (val == '\n') {
+                        if (column == 0)
+                                continue;
+                        nvram[len] = 0;
+                        len++;
+                        column = 0;
+                        continue;
+                }
+                nvram[len] = val;
+                len++;
+                column++;
+        }
+        column = len;
+        *new_length = roundup(len + 1, 4);
+        while (column != *new_length) {
+                nvram[column] = 0;
+                column++;
+        }
+
+        token = *new_length / 4;
+        token = (~token << 16) | (token & 0x0000FFFF);
+        token_le = cpu_to_le32(token);
+
+        memcpy(&nvram[*new_length], &token_le, sizeof(token_le));
+        *new_length += sizeof(token_le);
+
+        return nvram;
+}
+
+void brcmf_nvram_free(void *nvram)
+{
+        kfree(nvram);
+}
+
+
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.h b/drivers/net/wireless/brcm80211/brcmfmac/nvram.h
new file mode 100644
index 000000000000..d454580928c9
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef BRCMFMAC_NVRAM_H
+#define BRCMFMAC_NVRAM_H
+
+
+void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length);
+void brcmf_nvram_free(void *nvram);
+
+
+#endif /* BRCMFMAC_NVRAM_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index 9fd40675f18e..82bf3c5d3cdc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -51,6 +51,9 @@
 #define BCM43143_CORE_ARM_BASE          0x18003000
 #define BCM43143_RAMSIZE                0x70000
 
+/* All D11 cores, ID 0x812 */
+#define BCM43xx_CORE_D11_BASE           0x18001000
+
 #define SBCOREREV(sbidh) \
         ((((sbidh) & SSB_IDHIGH_RCHI) >> SSB_IDHIGH_RCHI_SHIFT) | \
           ((sbidh) & SSB_IDHIGH_RCLO))
@@ -66,6 +69,10 @@
 /* ARM CR4 core specific control flag bits */
 #define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
 
+/* D11 core specific control flag bits */
+#define D11_BCMA_IOCTL_PHYCLOCKEN       0x0004
+#define D11_BCMA_IOCTL_PHYRESET         0x0008
+
 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
 /* SDIO Pad drive strength to select value mappings */
 struct sdiod_drive_str {
@@ -111,7 +118,7 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 };
 
 u8
-brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
+brcmf_sdio_chip_getinfidx(struct brcmf_chip *ci, u16 coreid)
 {
         u8 idx;
 
@@ -124,7 +131,7 @@ brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
 
 static u32
 brcmf_sdio_sb_corerev(struct brcmf_sdio_dev *sdiodev,
-                      struct chip_info *ci, u16 coreid)
+                      struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
@@ -139,7 +146,7 @@ brcmf_sdio_sb_corerev(struct brcmf_sdio_dev *sdiodev,
 
 static u32
 brcmf_sdio_ai_corerev(struct brcmf_sdio_dev *sdiodev,
-                      struct chip_info *ci, u16 coreid)
+                      struct brcmf_chip *ci, u16 coreid)
 {
         u8 idx;
 
@@ -150,7 +157,7 @@ brcmf_sdio_ai_corerev(struct brcmf_sdio_dev *sdiodev,
 
 static bool
 brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
-                       struct chip_info *ci, u16 coreid)
+                       struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
@@ -169,7 +176,7 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
 
 static bool
 brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
-                       struct chip_info *ci, u16 coreid)
+                       struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
@@ -193,7 +200,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid, u32 core_bits)
+                          struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                          u32 in_resetbits)
 {
         u32 regdata, base;
         u8 idx;
@@ -279,52 +287,48 @@ brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid, u32 core_bits)
+                          struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                          u32 in_resetbits)
 {
         u8 idx;
         u32 regdata;
+        u32 wrapbase;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
         if (idx == BRCMF_MAX_CORENUM)
                 return;
 
+        wrapbase = ci->c_inf[idx].wrapbase;
+
         /* if core is already in reset, just return */
-        regdata = brcmf_sdiod_regrl(sdiodev,
-                                    ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                                    NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL);
         if ((regdata & BCMA_RESET_CTL_RESET) != 0)
                 return;
 
-        /* ensure no pending backplane operation
-         * 300uc should be sufficient for backplane ops to be finish
-         * extra 10ms is taken into account for firmware load stage
-         * after 10300us carry on disabling the core anyway
-         */
-        SPINWAIT(brcmf_sdiod_regrl(sdiodev,
-                                   ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
-                                   NULL), 10300);
-        regdata = brcmf_sdiod_regrl(sdiodev,
-                                    ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
-                                    NULL);
-        if (regdata)
-                brcmf_err("disabling core 0x%x with reset status %x\n",
-                          coreid, regdata);
+        /* configure reset */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
+                          BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 
-        brcmf_sdiod_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
+        /* put in reset */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_RESET_CTL,
                           BCMA_RESET_CTL_RESET, NULL);
-        udelay(1);
-
-        brcmf_sdiod_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                          core_bits, NULL);
-        regdata = brcmf_sdiod_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                    NULL);
         usleep_range(10, 20);
 
+        /* wait till reset is 1 */
+        SPINWAIT(brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL) !=
+                 BCMA_RESET_CTL_RESET, 300);
+
+        /* post reset configure */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
+                          BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 }
 
 static void
 brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits)
+                        struct brcmf_chip *ci, u16 coreid,  u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits)
 {
         u32 regdata;
         u8 idx;
@@ -337,7 +341,8 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
          * Must do the disable sequence first to work for
          * arbitrary current core state.
          */
-        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid, 0);
+        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid, pre_resetbits,
+                                  in_resetbits);
 
         /*
          * Now do the initialization sequence.
@@ -390,40 +395,37 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits)
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits)
 {
         u8 idx;
         u32 regdata;
+        u32 wrapbase;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
         if (idx == BRCMF_MAX_CORENUM)
                 return;
 
+        wrapbase = ci->c_inf[idx].wrapbase;
+
         /* must disable first to work for arbitrary current core state */
-        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);
+        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, pre_resetbits,
+                                  in_resetbits);
 
-        /* now do initialization sequence */
-        brcmf_sdiod_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                          core_bits | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
-        regdata = brcmf_sdiod_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                    NULL);
-        brcmf_sdiod_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                          0, NULL);
-        regdata = brcmf_sdiod_regrl(sdiodev,
-                                    ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                                    NULL);
-        udelay(1);
+        while (brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL) &
+               BCMA_RESET_CTL_RESET) {
+                brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_RESET_CTL, 0, NULL);
+                usleep_range(40, 60);
+        }
 
-        brcmf_sdiod_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                          core_bits | BCMA_IOCTL_CLK, NULL);
-        regdata = brcmf_sdiod_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                    NULL);
-        udelay(1);
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, post_resetbits |
+                          BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 }
 
 #ifdef DEBUG
 /* safety check for chipinfo */
-static int brcmf_sdio_chip_cichk(struct chip_info *ci)
+static int brcmf_sdio_chip_cichk(struct brcmf_chip *ci)
 {
         u8 core_idx;
 
@@ -450,189 +452,213 @@ static int brcmf_sdio_chip_cichk(struct chip_info *ci)
         return 0;
 }
 #else   /* DEBUG */
-static inline int brcmf_sdio_chip_cichk(struct chip_info *ci)
+static inline int brcmf_sdio_chip_cichk(struct brcmf_chip *ci)
 {
         return 0;
 }
 #endif
 
 static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci)
+                                       struct brcmf_chip *ci)
 {
         u32 regdata;
-        int ret;
+        u32 socitype;
 
         /* Get CC core rev
-         * Chipid is assume to be at offset 0 from regs arg
+         * Chipid is assume to be at offset 0 from SI_ENUM_BASE
          * For different chiptypes or old sdio hosts w/o chipcommon,
          * other ways of recognition should be added here.
          */
-        ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
-        ci->c_inf[0].base = SI_ENUM_BASE;
         regdata = brcmf_sdiod_regrl(sdiodev,
-                                    CORE_CC_REG(ci->c_inf[0].base, chipid),
+                                    CORE_CC_REG(SI_ENUM_BASE, chipid),
                                     NULL);
         ci->chip = regdata & CID_ID_MASK;
         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
         if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
             ci->chiprev >= 2)
                 ci->chip = BCM4339_CHIP_ID;
-        ci->socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+        socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
 
-        brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
+        brcmf_dbg(INFO, "found %s chip: id=0x%x, rev=%d\n",
+                  socitype == SOCI_SB ? "SB" : "AXI", ci->chip, ci->chiprev);
 
-        /* Address of cores for new chips should be added here */
-        switch (ci->chip) {
-        case BCM43143_CHIP_ID:
-                ci->c_inf[0].wrapbase = ci->c_inf[0].base + 0x00100000;
-                ci->c_inf[0].cib = 0x2b000000;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = BCM43143_CORE_BUS_BASE;
-                ci->c_inf[1].wrapbase = ci->c_inf[1].base + 0x00100000;
-                ci->c_inf[1].cib = 0x18000000;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = BCM43143_CORE_SOCRAM_BASE;
-                ci->c_inf[2].wrapbase = ci->c_inf[2].base + 0x00100000;
-                ci->c_inf[2].cib = 0x14000000;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = BCM43143_CORE_ARM_BASE;
-                ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
-                ci->c_inf[3].cib = 0x07000000;
-                ci->ramsize = BCM43143_RAMSIZE;
-                break;
-        case BCM43241_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2a084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x0e004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x14080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x07004211;
-                ci->ramsize = 0x90000;
-                break;
-        case BCM4329_CHIP_ID:
+        if (socitype == SOCI_SB) {
+                if (ci->chip != BCM4329_CHIP_ID) {
+                        brcmf_err("SB chip is not supported\n");
+                        return -ENODEV;
+                }
+                ci->iscoreup = brcmf_sdio_sb_iscoreup;
+                ci->corerev = brcmf_sdio_sb_corerev;
+                ci->coredisable = brcmf_sdio_sb_coredisable;
+                ci->resetcore = brcmf_sdio_sb_resetcore;
+
+                ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
+                ci->c_inf[0].base = SI_ENUM_BASE;
                 ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
                 ci->c_inf[1].base = BCM4329_CORE_BUS_BASE;
                 ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
                 ci->c_inf[2].base = BCM4329_CORE_SOCRAM_BASE;
                 ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
                 ci->c_inf[3].base = BCM4329_CORE_ARM_BASE;
+                ci->c_inf[4].id = BCMA_CORE_80211;
+                ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
                 ci->ramsize = BCM4329_RAMSIZE;
-                break;
-        case BCM4330_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x27004211;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x07004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x0d080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x03004211;
-                ci->ramsize = 0x48000;
-                break;
-        case BCM4334_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x29004211;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x0d004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x13080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x07004211;
-                ci->ramsize = 0x80000;
-                break;
-        case BCM4335_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2b084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18005000;
-                ci->c_inf[1].wrapbase = 0x18105000;
-                ci->c_inf[1].cib = 0x0f004211;
-                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
-                ci->c_inf[2].base = 0x18002000;
-                ci->c_inf[2].wrapbase = 0x18102000;
-                ci->c_inf[2].cib = 0x01084411;
-                ci->ramsize = 0xc0000;
-                ci->rambase = 0x180000;
-                break;
-        case BCM4339_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2e084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18005000;
-                ci->c_inf[1].wrapbase = 0x18105000;
-                ci->c_inf[1].cib = 0x15004211;
-                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
-                ci->c_inf[2].base = 0x18002000;
-                ci->c_inf[2].wrapbase = 0x18102000;
-                ci->c_inf[2].cib = 0x04084411;
-                ci->ramsize = 0xc0000;
-                ci->rambase = 0x180000;
-                break;
-        case BCM43362_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x27004211;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x0a004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x08080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x03004211;
-                ci->ramsize = 0x3C000;
-                break;
-        default:
-                brcmf_err("chipid 0x%x is not supported\n", ci->chip);
-                return -ENODEV;
-        }
-
-        ret = brcmf_sdio_chip_cichk(ci);
-        if (ret)
-                return ret;
-
-        switch (ci->socitype) {
-        case SOCI_SB:
-                ci->iscoreup = brcmf_sdio_sb_iscoreup;
-                ci->corerev = brcmf_sdio_sb_corerev;
-                ci->coredisable = brcmf_sdio_sb_coredisable;
-                ci->resetcore = brcmf_sdio_sb_resetcore;
-                break;
-        case SOCI_AI:
+        } else if (socitype == SOCI_AI) {
                 ci->iscoreup = brcmf_sdio_ai_iscoreup;
                 ci->corerev = brcmf_sdio_ai_corerev;
                 ci->coredisable = brcmf_sdio_ai_coredisable;
                 ci->resetcore = brcmf_sdio_ai_resetcore;
-                break;
-        default:
-                brcmf_err("socitype %u not supported\n", ci->socitype);
+
+                ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
+                ci->c_inf[0].base = SI_ENUM_BASE;
+
+                /* Address of cores for new chips should be added here */
+                switch (ci->chip) {
+                case BCM43143_CHIP_ID:
+                        ci->c_inf[0].wrapbase = ci->c_inf[0].base + 0x00100000;
+                        ci->c_inf[0].cib = 0x2b000000;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = BCM43143_CORE_BUS_BASE;
+                        ci->c_inf[1].wrapbase = ci->c_inf[1].base + 0x00100000;
+                        ci->c_inf[1].cib = 0x18000000;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = BCM43143_CORE_SOCRAM_BASE;
+                        ci->c_inf[2].wrapbase = ci->c_inf[2].base + 0x00100000;
+                        ci->c_inf[2].cib = 0x14000000;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = BCM43143_CORE_ARM_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->c_inf[3].cib = 0x07000000;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = BCM43143_RAMSIZE;
+                        break;
+                case BCM43241_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2a084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0e004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x14080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x07004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x90000;
+                        break;
+                case BCM4330_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x27004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x07004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x0d080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x03004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x48000;
+                        break;
+                case BCM4334_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x29004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0d004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x13080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x07004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x80000;
+                        break;
+                case BCM4335_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2b084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18005000;
+                        ci->c_inf[1].wrapbase = 0x18105000;
+                        ci->c_inf[1].cib = 0x0f004211;
+                        ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                        ci->c_inf[2].base = 0x18002000;
+                        ci->c_inf[2].wrapbase = 0x18102000;
+                        ci->c_inf[2].cib = 0x01084411;
+                        ci->c_inf[3].id = BCMA_CORE_80211;
+                        ci->c_inf[3].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->ramsize = 0xc0000;
+                        ci->rambase = 0x180000;
+                        break;
+                case BCM43362_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x27004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0a004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x08080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x03004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x3C000;
+                        break;
+                case BCM4339_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2e084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18005000;
+                        ci->c_inf[1].wrapbase = 0x18105000;
+                        ci->c_inf[1].cib = 0x15004211;
+                        ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                        ci->c_inf[2].base = 0x18002000;
+                        ci->c_inf[2].wrapbase = 0x18102000;
+                        ci->c_inf[2].cib = 0x04084411;
+                        ci->c_inf[3].id = BCMA_CORE_80211;
+                        ci->c_inf[3].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->ramsize = 0xc0000;
+                        ci->rambase = 0x180000;
+                        break;
+                default:
+                        brcmf_err("AXI chip is not supported\n");
+                        return -ENODEV;
+                }
+        } else {
+                brcmf_err("chip backplane type %u is not supported\n",
+                          socitype);
                 return -ENODEV;
         }
 
-        return 0;
+        return brcmf_sdio_chip_cichk(ci);
 }
 
 static int
@@ -682,7 +708,7 @@ brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
 
 static void
 brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
-                             struct chip_info *ci)
+                             struct brcmf_chip *ci)
 {
         u32 base = ci->c_inf[0].base;
 
@@ -713,19 +739,18 @@ brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
          * Make sure any on-chip ARM is off (in case strapping is wrong),
          * or downloaded code was already running.
          */
-        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0);
 }
 
 int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
-                           struct chip_info **ci_ptr)
+                           struct brcmf_chip **ci_ptr)
 {
         int ret;
-        struct chip_info *ci;
+        struct brcmf_chip *ci;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* alloc chip_info_t */
-        ci = kzalloc(sizeof(struct chip_info), GFP_ATOMIC);
+        ci = kzalloc(sizeof(*ci), GFP_ATOMIC);
         if (!ci)
                 return -ENOMEM;
 
@@ -753,7 +778,7 @@ err:
 }
 
 void
-brcmf_sdio_chip_detach(struct chip_info **ci_ptr)
+brcmf_sdio_chip_detach(struct brcmf_chip **ci_ptr)
 {
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -772,7 +797,7 @@ static char *brcmf_sdio_chip_name(uint chipid, char *buf, uint len)
 
 void
 brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
-                                  struct chip_info *ci, u32 drivestrength)
+                                  struct brcmf_chip *ci, u32 drivestrength)
 {
         const struct sdiod_drive_str *str_tab = NULL;
         u32 str_mask;
@@ -842,107 +867,19 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
         }
 }
 
-#ifdef DEBUG
-static bool
-brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
-                            char *nvram_dat, uint nvram_sz)
-{
-        char *nvram_ularray;
-        int err;
-        bool ret = true;
-
-        /* read back and verify */
-        brcmf_dbg(INFO, "Compare NVRAM dl & ul; size=%d\n", nvram_sz);
-        nvram_ularray = kmalloc(nvram_sz, GFP_KERNEL);
-        /* do not proceed while no memory but  */
-        if (!nvram_ularray)
-                return true;
-
-        /* Upload image to verify downloaded contents. */
-        memset(nvram_ularray, 0xaa, nvram_sz);
-
-        /* Read the vars list to temp buffer for comparison */
-        err = brcmf_sdiod_ramrw(sdiodev, false, nvram_addr, nvram_ularray,
-                                nvram_sz);
-        if (err) {
-                brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
-                          err, nvram_sz, nvram_addr);
-        } else if (memcmp(nvram_dat, nvram_ularray, nvram_sz)) {
-                brcmf_err("Downloaded NVRAM image is corrupted\n");
-                ret = false;
-        }
-        kfree(nvram_ularray);
-
-        return ret;
-}
-#else   /* DEBUG */
-static inline bool
-brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
-                            char *nvram_dat, uint nvram_sz)
-{
-        return true;
-}
-#endif  /* DEBUG */
-
-static bool brcmf_sdio_chip_writenvram(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci,
-                                       char *nvram_dat, uint nvram_sz)
-{
-        int err;
-        u32 nvram_addr;
-        u32 token;
-        __le32 token_le;
-
-        nvram_addr = (ci->ramsize - 4) - nvram_sz + ci->rambase;
-
-        /* Write the vars list */
-        err = brcmf_sdiod_ramrw(sdiodev, true, nvram_addr, nvram_dat, nvram_sz);
-        if (err) {
-                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
-                          err, nvram_sz, nvram_addr);
-                return false;
-        }
-
-        if (!brcmf_sdio_chip_verifynvram(sdiodev, nvram_addr,
-                                         nvram_dat, nvram_sz))
-                return false;
-
-        /* generate token:
-         * nvram size, converted to words, in lower 16-bits, checksum
-         * in upper 16-bits.
-         */
-        token = nvram_sz / 4;
-        token = (~token << 16) | (token & 0x0000FFFF);
-        token_le = cpu_to_le32(token);
-
-        brcmf_dbg(INFO, "RAM size: %d\n", ci->ramsize);
-        brcmf_dbg(INFO, "nvram is placed at %d, size %d, token=0x%08x\n",
-                  nvram_addr, nvram_sz, token);
-
-        /* Write the length token to the last word */
-        if (brcmf_sdiod_ramrw(sdiodev, true, (ci->ramsize - 4 + ci->rambase),
-                              (u8 *)&token_le, 4))
-                return false;
-
-        return true;
-}
-
 static void
 brcmf_sdio_chip_cm3_enterdl(struct brcmf_sdio_dev *sdiodev,
-                            struct chip_info *ci)
+                            struct brcmf_chip *ci)
 {
-        u32 zeros = 0;
-
-        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
-        ci->resetcore(sdiodev, ci, BCMA_CORE_INTERNAL_MEM, 0);
-
-        /* clear length token */
-        brcmf_sdiod_ramrw(sdiodev, true, ci->ramsize - 4, (u8 *)&zeros, 4);
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_80211,
+                      D11_BCMA_IOCTL_PHYRESET | D11_BCMA_IOCTL_PHYCLOCKEN,
+                      D11_BCMA_IOCTL_PHYCLOCKEN, D11_BCMA_IOCTL_PHYCLOCKEN);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_INTERNAL_MEM, 0, 0, 0);
 }
 
-static bool
-brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
-                           char *nvram_dat, uint nvram_sz)
+static bool brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev,
+                                       struct brcmf_chip *ci)
 {
         u8 core_idx;
         u32 reg_addr;
@@ -952,38 +889,45 @@ brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
                 return false;
         }
 
-        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
-                return false;
-
         /* clear all interrupts */
         core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
         reg_addr = ci->c_inf[core_idx].base;
         reg_addr += offsetof(struct sdpcmd_regs, intstatus);
         brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
 
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0, 0);
 
         return true;
 }
 
 static inline void
 brcmf_sdio_chip_cr4_enterdl(struct brcmf_sdio_dev *sdiodev,
-                            struct chip_info *ci)
+                            struct brcmf_chip *ci)
 {
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4,
-                      ARMCR4_BCMA_IOCTL_CPUHALT);
+        u8 idx;
+        u32 regdata;
+        u32 wrapbase;
+        idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CR4);
+
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
+
+        wrapbase = ci->c_inf[idx].wrapbase;
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
+        regdata &= ARMCR4_BCMA_IOCTL_CPUHALT;
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, regdata,
+                      ARMCR4_BCMA_IOCTL_CPUHALT, ARMCR4_BCMA_IOCTL_CPUHALT);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_80211,
+                      D11_BCMA_IOCTL_PHYRESET | D11_BCMA_IOCTL_PHYCLOCKEN,
+                      D11_BCMA_IOCTL_PHYCLOCKEN, D11_BCMA_IOCTL_PHYCLOCKEN);
 }
 
-static bool
-brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
-                           char *nvram_dat, uint nvram_sz)
+static bool brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev,
+                                       struct brcmf_chip *ci, u32 rstvec)
 {
         u8 core_idx;
         u32 reg_addr;
 
-        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
-                return false;
-
         /* clear all interrupts */
         core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
         reg_addr = ci->c_inf[core_idx].base;
@@ -991,17 +935,18 @@ brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
         brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
 
         /* Write reset vector to address 0 */
-        brcmf_sdiod_ramrw(sdiodev, true, 0, (void *)&ci->rst_vec,
-                          sizeof(ci->rst_vec));
+        brcmf_sdiod_ramrw(sdiodev, true, 0, (void *)&rstvec,
+                          sizeof(rstvec));
 
         /* restore ARM */
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, ARMCR4_BCMA_IOCTL_CPUHALT,
+                      0, 0);
 
         return true;
 }
 
 void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
-                                    struct chip_info *ci)
+                                    struct brcmf_chip *ci)
 {
         u8 arm_core_idx;
 
@@ -1015,15 +960,13 @@ void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
 }
 
 bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
-                                   struct chip_info *ci, char *nvram_dat,
-                                   uint nvram_sz)
+                                   struct brcmf_chip *ci, u32 rstvec)
 {
         u8 arm_core_idx;
 
         arm_core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CM3);
         if (BRCMF_MAX_CORENUM != arm_core_idx)
-                return brcmf_sdio_chip_cm3_exitdl(sdiodev, ci, nvram_dat,
-                                                  nvram_sz);
+                return brcmf_sdio_chip_cm3_exitdl(sdiodev, ci);
 
-        return brcmf_sdio_chip_cr4_exitdl(sdiodev, ci, nvram_dat, nvram_sz);
+        return brcmf_sdio_chip_cr4_exitdl(sdiodev, ci, rstvec);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index 7ea424e20773..fb0614329ede 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -54,7 +54,7 @@
 
 #define BRCMF_MAX_CORENUM       6
 
-struct chip_core_info {
+struct brcmf_core {
         u16 id;
         u16 rev;
         u32 base;
@@ -63,27 +63,28 @@ struct chip_core_info {
         u32 cib;
 };
 
-struct chip_info {
+struct brcmf_chip {
         u32 chip;
         u32 chiprev;
-        u32 socitype;
         /* core info */
         /* always put chipcommon core at 0, bus core at 1 */
-        struct chip_core_info c_inf[BRCMF_MAX_CORENUM];
+        struct brcmf_core c_inf[BRCMF_MAX_CORENUM];
         u32 pmurev;
         u32 pmucaps;
         u32 ramsize;
         u32 rambase;
         u32 rst_vec;    /* reset vertor for ARM CR4 core */
 
-        bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+        bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct brcmf_chip *ci,
                          u16 coreid);
-        u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+        u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct brcmf_chip *ci,
                          u16 coreid);
         void (*coredisable)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits);
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits);
         void (*resetcore)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits);
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits);
 };
 
 struct sbconfig {
@@ -216,15 +217,15 @@ struct sdpcmd_regs {
 };
 
 int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
-                           struct chip_info **ci_ptr);
-void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
+                           struct brcmf_chip **ci_ptr);
+void brcmf_sdio_chip_detach(struct brcmf_chip **ci_ptr);
 void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci, u32 drivestrength);
-u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
+                                       struct brcmf_chip *ci,
+                                       u32 drivestrength);
+u8 brcmf_sdio_chip_getinfidx(struct brcmf_chip *ci, u16 coreid);
 void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
-                                    struct chip_info *ci);
+                                    struct brcmf_chip *ci);
 bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
-                                   struct chip_info *ci, char *nvram_dat,
-                                   uint nvram_sz);
+                                   struct brcmf_chip *ci, u32 rstvec);
 
 #endif          /* _BRCMFMAC_SDIO_CHIP_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index c345c32eb631..24f65cd53859 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -522,10 +522,10 @@ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
         /* update state of upper layer */
         if (state == BRCMFMAC_USB_STATE_DOWN) {
                 brcmf_dbg(USB, "DBUS is down\n");
-                bcmf_bus->state = BRCMF_BUS_DOWN;
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
         } else if (state == BRCMFMAC_USB_STATE_UP) {
                 brcmf_dbg(USB, "DBUS is up\n");
-                bcmf_bus->state = BRCMF_BUS_DATA;
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
         } else {
                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
         }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index aad83aef7d93..d7718a5fa2f0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -2989,6 +2989,7 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
                 }
 
                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+                cfg->escan_info.run = brcmf_run_escan;
                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
                 if (err) {
                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index e71ce8c842a2..925034b80e9c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -1071,7 +1071,6 @@ static int ieee_hw_init(struct ieee80211_hw *hw)
         hw->max_rates = 2;      /* Primary rate and 1 fallback rate */
 
         /* channel change time is dependent on chip and band  */
-        hw->channel_change_time = 7 * 1000;
         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                      BIT(NL80211_IFTYPE_AP) |
                                      BIT(NL80211_IFTYPE_ADHOC);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 8138f1cff4e5..9417cb5a2553 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -7108,7 +7108,6 @@ prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
                      struct sk_buff *p,
                      struct ieee80211_rx_status *rx_status)
 {
-        int preamble;
         int channel;
         u32 rspec;
         unsigned char *plcp;
@@ -7191,7 +7190,6 @@ prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
 
                 /* Determine short preamble and rate_idx */
-                preamble = 0;
                 if (is_cck_rate(rspec)) {
                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
                                 rx_status->flag |= RX_FLAG_SHORTPRE;
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index d1270da4dfea..3e78cc3ccb78 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -301,7 +301,6 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        hw->channel_change_time = 1000; /* TODO: find actual value */
         hw->queues = 4;
 
         priv->rts_threshold = -1;
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 40eb5e691475..c24d1d3d55f6 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -406,9 +406,8 @@ static bool iwl_resume_status_fn(struct iwl_notif_wait_data *notif_wait,
 {
         struct iwl_resume_data *resume_data = data;
         struct iwl_priv *priv = resume_data->priv;
-        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 
-        if (len - 4 != sizeof(*resume_data->cmd)) {
+        if (iwl_rx_packet_payload_len(pkt) != sizeof(*resume_data->cmd)) {
                 IWL_ERR(priv, "rx wrong size data\n");
                 return true;
         }
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index b68bb2f4d2c2..7a1bc1c547e1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -205,8 +205,7 @@ static int iwlagn_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
                                              struct iwl_device_cmd *cmd)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u32 __maybe_unused len =
-                le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        u32 __maybe_unused len = iwl_rx_packet_len(pkt);
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                         "notification for PM_DEBUG_STATISTIC_NOTIFIC:\n", len);
         iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->data, len);
@@ -457,7 +456,7 @@ static int iwlagn_rx_statistics(struct iwl_priv *priv,
         const int reg_recalib_period = 60;
         int change;
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        u32 len = iwl_rx_packet_payload_len(pkt);
         __le32 *flag;
         struct statistics_general_common *common;
         struct statistics_rx_non_phy *rx_non_phy;
@@ -467,8 +466,6 @@ static int iwlagn_rx_statistics(struct iwl_priv *priv,
         struct statistics_tx *tx;
         struct statistics_bt_activity *bt_activity;
 
-        len -= sizeof(struct iwl_cmd_header); /* skip header */
-
         IWL_DEBUG_RX(priv, "Statistics notification received (%d bytes).\n",
                      len);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index f59709a9b79d..cf03ef5619d9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -388,7 +388,6 @@ static bool iwlagn_wait_calib(struct iwl_notif_wait_data *notif_wait,
 {
         struct iwl_priv *priv = data;
         struct iwl_calib_hdr *hdr;
-        int len;
 
         if (pkt->hdr.cmd != CALIBRATION_RES_NOTIFICATION) {
                 WARN_ON(pkt->hdr.cmd != CALIBRATION_COMPLETE_NOTIFICATION);
@@ -396,12 +395,8 @@ static bool iwlagn_wait_calib(struct iwl_notif_wait_data *notif_wait,
         }
 
         hdr = (struct iwl_calib_hdr *)pkt->data;
-        len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 
-        /* reduce the size by the length field itself */
-        len -= sizeof(__le32);
-
-        if (iwl_calib_set(priv, hdr, len))
+        if (iwl_calib_set(priv, hdr, iwl_rx_packet_payload_len(pkt)))
                 IWL_ERR(priv, "Failed to record calibration data %d\n",
                         hdr->op_code);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index 1b61cb529948..f06f4cbe1317 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -264,14 +264,13 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                                   struct ieee80211_sta_vht_cap *vht_cap)
 {
         int num_ants = num_of_ant(data->valid_rx_ant);
-        int bf_sts_cap = num_ants - 1;
 
         vht_cap->vht_supported = true;
 
         vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
                        IEEE80211_VHT_CAP_RXSTBC_1 |
                        IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
-                       bf_sts_cap << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
+                       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
                        7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
 
         if (num_ants > 1)
@@ -290,9 +289,6 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
 
-        /* Max rate for Long GI NSS=2 80Mhz is 780Mbps */
-        vht_cap->vht_mcs.rx_highest = cpu_to_le16(780);
-
         if (num_ants == 1 ||
             cfg->rx_with_siso_diversity) {
                 vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
@@ -300,12 +296,9 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                 /* this works because NOT_SUPPORTED == 3 */
                 vht_cap->vht_mcs.rx_mcs_map |=
                         cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << 2);
-                /* Max rate for Long GI NSS=1 80Mhz is 390Mbps */
-                vht_cap->vht_mcs.rx_highest = cpu_to_le16(390);
         }
 
         vht_cap->vht_mcs.tx_mcs_map = vht_cap->vht_mcs.rx_mcs_map;
-        vht_cap->vht_mcs.tx_highest = vht_cap->vht_mcs.rx_highest;
 }
 
 static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg,
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index d69b0fb0a434..100bd0d79681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -277,4 +277,8 @@ static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
 
 /*********************** END TX SCHEDULER *************************************/
 
+/* Oscillator clock */
+#define OSC_CLK                         (0xa04068)
+#define OSC_CLK_FORCE_CONTROL           (0x8)
+
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 8d1b5ed3502a..1f065cf4a4ba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -176,6 +176,16 @@ struct iwl_rx_packet {
         u8 data[];
 } __packed;
 
+static inline u32 iwl_rx_packet_len(const struct iwl_rx_packet *pkt)
+{
+        return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+}
+
+static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
+{
+        return iwl_rx_packet_len(pkt) - sizeof(pkt->hdr);
+}
+
 /**
  * enum CMD_MODE - how to send the host commands ?
  *
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index f04d2f4d80cd..f36a7ee0267f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -886,8 +886,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
         if (err)
                 return err;
 
-        size = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        size -= sizeof(cmd.resp_pkt->hdr);
+        size = iwl_rx_packet_payload_len(cmd.resp_pkt);
         if (size < sizeof(__le16)) {
                 err = -EINVAL;
         } else {
@@ -1211,9 +1210,8 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        len = le32_to_cpu(d3_cfg_cmd.resp_pkt->len_n_flags) &
-                FH_RSCSR_FRAME_SIZE_MSK;
-        if (len >= sizeof(u32) * 2) {
+        len = iwl_rx_packet_payload_len(d3_cfg_cmd.resp_pkt);
+        if (len >= sizeof(u32)) {
                 mvm->d3_test_pme_ptr =
                         le32_to_cpup((__le32 *)d3_cfg_cmd.resp_pkt->data);
         }
@@ -1668,8 +1666,8 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         else
                 status_size = sizeof(struct iwl_wowlan_status_v4);
 
-        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (len - sizeof(struct iwl_cmd_header) < status_size) {
+        len = iwl_rx_packet_payload_len(cmd.resp_pkt);
+        if (len < status_size) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out_free_resp;
         }
@@ -1704,8 +1702,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                 status.wake_packet = status_v4->wake_packet;
         }
 
-        if (len - sizeof(struct iwl_cmd_header) !=
-            status_size + ALIGN(status.wake_packet_bufsize, 4)) {
+        if (len != status_size + ALIGN(status.wake_packet_bufsize, 4)) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out_free_resp;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 76cdce9edf55..369d4c90e669 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -135,7 +135,7 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
         ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
         len = img->sec[IWL_UCODE_SECTION_DATA].len;
 
-        if (!mvm->dbgfs_sram_offset && !mvm->dbgfs_sram_len) {
+        if (mvm->dbgfs_sram_len) {
                 ofs = mvm->dbgfs_sram_offset;
                 len = mvm->dbgfs_sram_len;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
index 6bbbad453a3b..1b60fdff6a56 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
@@ -97,9 +97,6 @@ enum iwl_sta_flags {
                                            STA_FLG_FLG_ANT_B),
 
         STA_FLG_PS                      = BIT(8),
-        STA_FLG_INVALID                 = BIT(9),
-        STA_FLG_DLP_EN                  = BIT(10),
-        STA_FLG_SET_ALL_KEYS            = BIT(11),
         STA_FLG_DRAIN_FLOW              = BIT(12),
         STA_FLG_PAN                     = BIT(13),
         STA_FLG_CLASS_AUTH              = BIT(14),
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index b41177eb4888..c49b5073c251 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -262,9 +262,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 
         /* currently FW API supports only one optional cipher scheme */
-        if (mvm->fw->cs->cipher) {
+        if (mvm->fw->cs[0].cipher) {
                 mvm->hw->n_cipher_schemes = 1;
-                mvm->hw->cipher_schemes = mvm->fw->cs;
+                mvm->hw->cipher_schemes = &mvm->fw->cs[0];
         }
 
 #ifdef CONFIG_PM_SLEEP
@@ -944,6 +944,8 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update power mode\n");
                 }
                 iwl_mvm_bt_coex_vif_change(mvm);
+                iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
+                                    IEEE80211_SMPS_AUTOMATIC);
         } else if (changes & BSS_CHANGED_BEACON_INFO) {
                 /*
                  * We received a beacon _after_ association so
@@ -1012,9 +1014,16 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (ret)
                 goto out_unbind;
 
+        /* must be set before quota calculations */
+        mvmvif->ap_ibss_active = true;
+
+        /* power updated needs to be done before quotas */
+        mvm->bound_vif_cnt++;
+        iwl_mvm_power_update_binding(mvm, vif, true);
+
         ret = iwl_mvm_update_quotas(mvm, vif);
         if (ret)
-                goto out_rm_bcast;
+                goto out_quota_failed;
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
@@ -1025,7 +1034,10 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         mutex_unlock(&mvm->mutex);
         return 0;
 
-out_rm_bcast:
+out_quota_failed:
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
+        mvmvif->ap_ibss_active = false;
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
 out_unbind:
         iwl_mvm_binding_remove_vif(mvm, vif);
@@ -1057,6 +1069,10 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
         iwl_mvm_update_quotas(mvm, NULL);
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
         iwl_mvm_binding_remove_vif(mvm, vif);
+
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
+
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
         mutex_unlock(&mvm->mutex);
@@ -1790,11 +1806,11 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         }
 
         iwl_mvm_binding_remove_vif(mvm, vif);
-out_unlock:
-        mvmvif->phy_ctxt = NULL;
         mvm->bound_vif_cnt--;
         iwl_mvm_power_update_binding(mvm, vif, false);
 
+out_unlock:
+        mvmvif->phy_ctxt = NULL;
         mutex_unlock(&mvm->mutex);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index c6beb0f842d5..35b71af78d02 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -392,17 +392,16 @@ out:
 /* Loads the NVM data stored in mvm->nvm_sections into the NIC */
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm)
 {
-        int i, ret;
-        u16 section_id;
+        int i, ret = 0;
         struct iwl_nvm_section *sections = mvm->nvm_sections;
 
         IWL_DEBUG_EEPROM(mvm->trans->dev, "'Write to NVM\n");
 
-        for (i = 0; i < ARRAY_SIZE(nvm_to_read); i++) {
-                section_id = nvm_to_read[i];
-                ret = iwl_nvm_write_section(mvm, section_id,
-                                            sections[section_id].data,
-                                            sections[section_id].length);
+        for (i = 0; i < ARRAY_SIZE(mvm->nvm_sections); i++) {
+                if (!mvm->nvm_sections[i].data || !mvm->nvm_sections[i].length)
+                        continue;
+                ret = iwl_nvm_write_section(mvm, i, sections[i].data,
+                                            sections[i].length);
                 if (ret < 0) {
                         IWL_ERR(mvm, "iwl_mvm_send_cmd failed: %d\n", ret);
                         break;
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index 552c76a926ed..a3d43de342d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -309,6 +309,7 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(BT_PROFILE_NOTIFICATION),
         CMD(BT_CONFIG),
         CMD(MCAST_FILTER_CMD),
+        CMD(REPLY_SF_CFG_CMD),
         CMD(REPLY_BEACON_FILTERING_CMD),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
         CMD(MAC_PM_POWER_TABLE),
@@ -472,6 +473,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
  out_unregister:
         ieee80211_unregister_hw(mvm->hw);
+        iwl_mvm_leds_exit(mvm);
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index ba078a3322b8..6abf74e1351f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -356,7 +356,7 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
                                 return idx;
         }
 
-        return -1;
+        return IWL_RATE_INVALID;
 }
 
 static void rs_rate_scale_perform(struct iwl_mvm *mvm,
@@ -702,10 +702,8 @@ static int rs_rate_from_ucode_rate(const u32 ucode_rate,
         memset(rate, 0, sizeof(*rate));
         rate->index = iwl_hwrate_to_plcp_idx(ucode_rate);
 
-        if (rate->index == IWL_RATE_INVALID) {
-                rate->index = -1;
+        if (rate->index == IWL_RATE_INVALID)
                 return -EINVAL;
-        }
 
         rate->ant = (ant_msk >> RATE_MCS_ANT_POS);
 
@@ -1590,6 +1588,8 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
         search_tbl->column = col_id;
         rs_set_expected_tpt_table(lq_sta, search_tbl);
 
+        lq_sta->visited_columns |= BIT(col_id);
+
         /* Get the best matching rate if we're changing modes. e.g.
          * SISO->MIMO, LEGACY->SISO, MIMO->SISO
          */
@@ -1613,7 +1613,6 @@ static int rs_switch_to_column(struct iwl_mvm *mvm,
         IWL_DEBUG_RATE(mvm, "Switched to column %d: Index %d\n",
                        col_id, rate->index);
 
-        lq_sta->visited_columns |= BIT(col_id);
         return 0;
 
 err:
@@ -2560,7 +2559,9 @@ static int rs_pretty_print_rate(char *buf, const u32 rate)
                 int index = iwl_hwrate_to_plcp_idx(rate);
 
                 return sprintf(buf, "Legacy | ANT: %s Rate: %s Mbps\n",
-                               rs_pretty_ant(ant), iwl_rate_mcs[index].mbps);
+                               rs_pretty_ant(ant),
+                               index == IWL_RATE_INVALID ? "BAD" :
+                               iwl_rate_mcs[index].mbps);
         }
 
         if (rate & RATE_MCS_VHT_MSK) {
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 50f3d7f560bc..b4c2abaa297b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -249,12 +249,12 @@ static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
                 container_of(notif_wait, struct iwl_mvm, notif_wait);
         struct iwl_mvm_time_event_data *te_data = data;
         struct iwl_time_event_resp *resp;
-        int resp_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        int resp_len = iwl_rx_packet_payload_len(pkt);
 
         if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_CMD))
                 return true;
 
-        if (WARN_ON_ONCE(resp_len != sizeof(pkt->hdr) + sizeof(*resp))) {
+        if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
                 IWL_ERR(mvm, "Invalid TIME_EVENT_CMD response\n");
                 return true;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 3c575a39987b..90378c217bc7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -390,7 +390,6 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
                 seq_number &= IEEE80211_SCTL_SEQ;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
                 hdr->seq_ctrl |= cpu_to_le16(seq_number);
-                seq_number += 0x10;
                 is_data_qos = true;
                 is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;
         }
@@ -407,13 +406,13 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         }
 
         IWL_DEBUG_TX(mvm, "TX to [%d|%d] Q:%d - seq: 0x%x\n", mvmsta->sta_id,
-                     tid, txq_id, seq_number);
+                     tid, txq_id, IEEE80211_SEQ_TO_SN(seq_number));
 
         if (iwl_trans_tx(mvm->trans, skb, dev_cmd, txq_id))
                 goto drop_unlock_sta;
 
         if (is_data_qos && !ieee80211_has_morefrags(fc))
-                mvmsta->tid_data[tid].seq_number = seq_number;
+                mvmsta->tid_data[tid].seq_number = seq_number + 0x10;
 
         spin_unlock(&mvmsta->lock);
 
@@ -704,7 +703,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                          */
                         spin_lock_bh(&mvmsta->lock);
                         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (IS_ERR_OR_NULL(sta)) {
+                        if (!sta || PTR_ERR(sta) == -EBUSY) {
                                 /*
                                  * Station disappeared in the meantime:
                                  * so we are draining.
@@ -713,7 +712,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                                 schedule_work(&mvm->sta_drained_wk);
                         }
                         spin_unlock_bh(&mvmsta->lock);
-                } else if (!mvmsta) {
+                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
                         /* Tx response without STA, so we are draining */
                         set_bit(sta_id, mvm->sta_drained);
                         schedule_work(&mvm->sta_drained_wk);
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index 487d61b25359..a4a5e25623c3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -168,8 +168,8 @@ int iwl_mvm_send_cmd_status(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd,
                 goto out_free_resp;
         }
 
-        resp_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (WARN_ON_ONCE(resp_len != sizeof(pkt->hdr) + sizeof(*resp))) {
+        resp_len = iwl_rx_packet_payload_len(pkt);
+        if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
                 ret = -EIO;
                 goto out_free_resp;
         }
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index 1890ea29c264..08c23d497a02 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -615,7 +615,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                         rxcb._offset, get_cmd_string(trans_pcie, pkt->hdr.cmd),
                         pkt->hdr.cmd);
 
-                len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+                len = iwl_rx_packet_len(pkt);
                 len += sizeof(u32); /* account for status word */
                 trace_iwlwifi_dev_rx(trans->dev, trans, pkt, len);
                 trace_iwlwifi_dev_rx_data(trans->dev, trans, pkt, len);
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 16f66c1a23de..f9507807b486 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -178,6 +178,28 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
                 goto out;
         }
 
+        if (trans->cfg->host_interrupt_operation_mode) {
+                /*
+                 * This is a bit of an abuse - This is needed for 7260 / 3160
+                 * only check host_interrupt_operation_mode even if this is
+                 * not related to host_interrupt_operation_mode.
+                 *
+                 * Enable the oscillator to count wake up time for L1 exit. This
+                 * consumes slightly more power (100uA) - but allows to be sure
+                 * that we wake up from L1 on time.
+                 *
+                 * This looks weird: read twice the same register, discard the
+                 * value, set a bit, and yet again, read that same register
+                 * just to discard the value. But that's the way the hardware
+                 * seems to like it.
+                 */
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_read_prph(trans, OSC_CLK);
+        }
+
         /*
          * Enable DMA clock and wait for it to stabilize.
          *
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 116f4aba08d6..32f75007a825 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1268,14 +1268,9 @@ static struct cfg80211_scan_request *
 _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
 {
         struct cfg80211_scan_request *creq = NULL;
-        int i, n_channels = 0;
+        int i, n_channels = ieee80211_get_num_supported_channels(wiphy);
         enum ieee80211_band band;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (wiphy->bands[band])
-                        n_channels += wiphy->bands[band]->n_channels;
-        }
-
         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                        n_channels * sizeof(void *),
                        GFP_ATOMIC);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index fa41a773b79b..69d4c3179d04 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -163,6 +163,11 @@ static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
         }
 };
 
+static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
+        &hwsim_world_regdom_custom_01,
+        &hwsim_world_regdom_custom_02,
+};
+
 struct hwsim_vif_priv {
         u32 magic;
         u8 bssid[ETH_ALEN];
@@ -321,8 +326,52 @@ static const struct ieee80211_rate hwsim_rates[] = {
         { .bitrate = 540 }
 };
 
+static const struct ieee80211_iface_limit hwsim_if_limits[] = {
+        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
+        { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
+};
+
+static const struct ieee80211_iface_limit hwsim_if_dfs_limits[] = {
+        { .max = 8, .types = BIT(NL80211_IFTYPE_AP) },
+};
+
+static const struct ieee80211_iface_combination hwsim_if_comb[] = {
+        {
+                .limits = hwsim_if_limits,
+                .n_limits = ARRAY_SIZE(hwsim_if_limits),
+                .max_interfaces = 2048,
+                .num_different_channels = 1,
+        },
+        {
+                .limits = hwsim_if_dfs_limits,
+                .n_limits = ARRAY_SIZE(hwsim_if_dfs_limits),
+                .max_interfaces = 8,
+                .num_different_channels = 1,
+                .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                       BIT(NL80211_CHAN_WIDTH_20) |
+                                       BIT(NL80211_CHAN_WIDTH_40) |
+                                       BIT(NL80211_CHAN_WIDTH_80) |
+                                       BIT(NL80211_CHAN_WIDTH_160),
+        }
+};
+
 static spinlock_t hwsim_radio_lock;
 static struct list_head hwsim_radios;
+static int hwsim_radio_idx;
+
+static struct platform_driver mac80211_hwsim_driver = {
+        .driver = {
+                .name = "mac80211_hwsim",
+                .owner = THIS_MODULE,
+        },
+};
 
 struct mac80211_hwsim_data {
         struct list_head list;
@@ -332,8 +381,10 @@ struct mac80211_hwsim_data {
         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
+        struct ieee80211_iface_combination if_combination;
 
         struct mac_address addresses[2];
+        int channels, idx;
 
         struct ieee80211_channel *tmp_chan;
         struct delayed_work roc_done;
@@ -401,21 +452,179 @@ static struct genl_family hwsim_genl_family = {
 /* MAC80211_HWSIM netlink policy */
 
 static struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
-        [HWSIM_ATTR_ADDR_RECEIVER] = { .type = NLA_UNSPEC,
-                                       .len = 6*sizeof(u8) },
-        [HWSIM_ATTR_ADDR_TRANSMITTER] = { .type = NLA_UNSPEC,
-                                          .len = 6*sizeof(u8) },
+        [HWSIM_ATTR_ADDR_RECEIVER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
+        [HWSIM_ATTR_ADDR_TRANSMITTER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
                                .len = IEEE80211_MAX_DATA_LEN },
         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
         [HWSIM_ATTR_TX_INFO] = { .type = NLA_UNSPEC,
-                                 .len = IEEE80211_TX_MAX_RATES*sizeof(
-                                        struct hwsim_tx_rate)},
+                                 .len = IEEE80211_TX_MAX_RATES *
+                                        sizeof(struct hwsim_tx_rate)},
         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
+        [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
+        [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
+        [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
+        [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
+        [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 };
 
+static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
+                                    struct sk_buff *skb,
+                                    struct ieee80211_channel *chan);
+
+/* sysfs attributes */
+static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+        struct sk_buff *skb;
+        struct ieee80211_pspoll *pspoll;
+
+        if (!vp->assoc)
+                return;
+
+        wiphy_debug(data->hw->wiphy,
+                    "%s: send PS-Poll to %pM for aid %d\n",
+                    __func__, vp->bssid, vp->aid);
+
+        skb = dev_alloc_skb(sizeof(*pspoll));
+        if (!skb)
+                return;
+        pspoll = (void *) skb_put(skb, sizeof(*pspoll));
+        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                            IEEE80211_STYPE_PSPOLL |
+                                            IEEE80211_FCTL_PM);
+        pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
+        memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, mac, ETH_ALEN);
+
+        rcu_read_lock();
+        mac80211_hwsim_tx_frame(data->hw, skb,
+                                rcu_dereference(vif->chanctx_conf)->def.chan);
+        rcu_read_unlock();
+}
+
+static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
+                                struct ieee80211_vif *vif, int ps)
+{
+        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+
+        if (!vp->assoc)
+                return;
+
+        wiphy_debug(data->hw->wiphy,
+                    "%s: send data::nullfunc to %pM ps=%d\n",
+                    __func__, vp->bssid, ps);
+
+        skb = dev_alloc_skb(sizeof(*hdr));
+        if (!skb)
+                return;
+        hdr = (void *) skb_put(skb, sizeof(*hdr) - ETH_ALEN);
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                         IEEE80211_STYPE_NULLFUNC |
+                                         (ps ? IEEE80211_FCTL_PM : 0));
+        hdr->duration_id = cpu_to_le16(0);
+        memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
+        memcpy(hdr->addr2, mac, ETH_ALEN);
+        memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+
+        rcu_read_lock();
+        mac80211_hwsim_tx_frame(data->hw, skb,
+                                rcu_dereference(vif->chanctx_conf)->def.chan);
+        rcu_read_unlock();
+}
+
+
+static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
+                                   struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        hwsim_send_nullfunc(data, mac, vif, 1);
+}
+
+static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        hwsim_send_nullfunc(data, mac, vif, 0);
+}
+
+static int hwsim_fops_ps_read(void *dat, u64 *val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        *val = data->ps;
+        return 0;
+}
+
+static int hwsim_fops_ps_write(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        enum ps_mode old_ps;
+
+        if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
+            val != PS_MANUAL_POLL)
+                return -EINVAL;
+
+        old_ps = data->ps;
+        data->ps = val;
+
+        if (val == PS_MANUAL_POLL) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_ps_poll, data);
+                data->ps_poll_pending = true;
+        } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_nullfunc_ps,
+                                                    data);
+        } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_nullfunc_no_ps,
+                                                    data);
+        }
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
+                        "%llu\n");
+
+static int hwsim_write_simulate_radar(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+
+        ieee80211_radar_detected(data->hw);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_simulate_radar, NULL,
+                        hwsim_write_simulate_radar, "%llu\n");
+
+static int hwsim_fops_group_read(void *dat, u64 *val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        *val = data->group;
+        return 0;
+}
+
+static int hwsim_fops_group_write(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        data->group = val;
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_group,
+                        hwsim_fops_group_read, hwsim_fops_group_write,
+                        "%llx\n");
+
 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
                                         struct net_device *dev)
 {
@@ -639,7 +848,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         }
 
         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
-                    sizeof(struct mac_address), data->addresses[1].addr))
+                    ETH_ALEN, data->addresses[1].addr))
                 goto nla_put_failure;
 
         /* We get the skb->data */
@@ -878,7 +1087,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                 return;
         }
 
-        if (channels == 1) {
+        if (data->channels == 1) {
                 channel = data->channel;
         } else if (txi->hw_queue == 4) {
                 channel = data->tmp_chan;
@@ -906,7 +1115,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
         if (control->sta)
                 hwsim_check_sta_magic(control->sta);
 
-        if (rctbl)
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
                                        txi->control.rates,
                                        ARRAY_SIZE(txi->control.rates));
@@ -1013,7 +1222,7 @@ static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 {
         u32 _pid = ACCESS_ONCE(wmediumd_portid);
 
-        if (rctbl) {
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE) {
                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
                                        txi->control.rates,
@@ -1050,7 +1259,7 @@ static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
         if (skb == NULL)
                 return;
         info = IEEE80211_SKB_CB(skb);
-        if (rctbl)
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
                 ieee80211_get_tx_rates(vif, NULL, skb,
                                        info->control.rates,
                                        ARRAY_SIZE(info->control.rates));
@@ -1141,7 +1350,7 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 
         data->channel = conf->chandef.chan;
 
-        WARN_ON(data->channel && channels > 1);
+        WARN_ON(data->channel && data->channels > 1);
 
         data->power_level = conf->power_level;
         if (!data->started || !data->beacon_int)
@@ -1388,8 +1597,6 @@ static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
 };
 
-static int hwsim_fops_ps_write(void *dat, u64 val);
-
 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        void *data, int len)
@@ -1700,8 +1907,7 @@ static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
         hwsim_check_chanctx_magic(ctx);
 }
 
-static struct ieee80211_ops mac80211_hwsim_ops =
-{
+static const struct ieee80211_ops mac80211_hwsim_ops = {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
         .stop = mac80211_hwsim_stop,
@@ -1726,217 +1932,290 @@ static struct ieee80211_ops mac80211_hwsim_ops =
         .set_tsf = mac80211_hwsim_set_tsf,
 };
 
+static struct ieee80211_ops mac80211_hwsim_mchan_ops;
 
-static void mac80211_hwsim_free(void)
+static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
+                                       const struct ieee80211_regdomain *regd,
+                                       bool reg_strict)
 {
-        struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data, *tmpdata;
-
-        INIT_LIST_HEAD(&tmplist);
+        int err;
+        u8 addr[ETH_ALEN];
+        struct mac80211_hwsim_data *data;
+        struct ieee80211_hw *hw;
+        enum ieee80211_band band;
+        const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
+        int idx;
 
         spin_lock_bh(&hwsim_radio_lock);
-        list_for_each_safe(i, tmp, &hwsim_radios)
-                list_move(i, &tmplist);
+        idx = hwsim_radio_idx++;
         spin_unlock_bh(&hwsim_radio_lock);
 
-        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
-                debugfs_remove_recursive(data->debugfs);
-                ieee80211_unregister_hw(data->hw);
-                device_release_driver(data->dev);
-                device_unregister(data->dev);
-                ieee80211_free_hw(data->hw);
+        if (channels > 1)
+                ops = &mac80211_hwsim_mchan_ops;
+        hw = ieee80211_alloc_hw(sizeof(*data), ops);
+        if (!hw) {
+                printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw failed\n");
+                err = -ENOMEM;
+                goto failed;
+        }
+        data = hw->priv;
+        data->hw = hw;
+
+        data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
+        if (IS_ERR(data->dev)) {
+                printk(KERN_DEBUG
+                       "mac80211_hwsim: device_create failed (%ld)\n",
+                       PTR_ERR(data->dev));
+                err = -ENOMEM;
+                goto failed_drvdata;
+        }
+        data->dev->driver = &mac80211_hwsim_driver.driver;
+        err = device_bind_driver(data->dev);
+        if (err != 0) {
+                printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
+                       err);
+                goto failed_hw;
         }
-        class_destroy(hwsim_class);
-}
-
-static struct platform_driver mac80211_hwsim_driver = {
-        .driver = {
-                .name = "mac80211_hwsim",
-                .owner = THIS_MODULE,
-        },
-};
-
-static const struct net_device_ops hwsim_netdev_ops = {
-        .ndo_start_xmit         = hwsim_mon_xmit,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-static void hwsim_mon_setup(struct net_device *dev)
-{
-        dev->netdev_ops = &hwsim_netdev_ops;
-        dev->destructor = free_netdev;
-        ether_setup(dev);
-        dev->tx_queue_len = 0;
-        dev->type = ARPHRD_IEEE80211_RADIOTAP;
-        memset(dev->dev_addr, 0, ETH_ALEN);
-        dev->dev_addr[0] = 0x12;
-}
 
+        skb_queue_head_init(&data->pending);
 
-static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
-        struct sk_buff *skb;
-        struct ieee80211_pspoll *pspoll;
+        SET_IEEE80211_DEV(hw, data->dev);
+        memset(addr, 0, ETH_ALEN);
+        addr[0] = 0x02;
+        addr[3] = idx >> 8;
+        addr[4] = idx;
+        memcpy(data->addresses[0].addr, addr, ETH_ALEN);
+        memcpy(data->addresses[1].addr, addr, ETH_ALEN);
+        data->addresses[1].addr[0] |= 0x40;
+        hw->wiphy->n_addresses = 2;
+        hw->wiphy->addresses = data->addresses;
+
+        data->channels = channels;
+        data->idx = idx;
+
+        if (data->channels > 1) {
+                hw->wiphy->max_scan_ssids = 255;
+                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+                hw->wiphy->max_remain_on_channel_duration = 1000;
+                /* For channels > 1 DFS is not allowed */
+                hw->wiphy->n_iface_combinations = 1;
+                hw->wiphy->iface_combinations = &data->if_combination;
+                data->if_combination = hwsim_if_comb[0];
+                data->if_combination.num_different_channels = data->channels;
+        } else {
+                hw->wiphy->iface_combinations = hwsim_if_comb;
+                hw->wiphy->n_iface_combinations = ARRAY_SIZE(hwsim_if_comb);
+        }
 
-        if (!vp->assoc)
-                return;
+        INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
+        INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
+
+        hw->queues = 5;
+        hw->offchannel_tx_hw_queue = 4;
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                     BIT(NL80211_IFTYPE_AP) |
+                                     BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                                     BIT(NL80211_IFTYPE_P2P_GO) |
+                                     BIT(NL80211_IFTYPE_ADHOC) |
+                                     BIT(NL80211_IFTYPE_MESH_POINT) |
+                                     BIT(NL80211_IFTYPE_P2P_DEVICE);
+
+        hw->flags = IEEE80211_HW_MFP_CAPABLE |
+                    IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_WANT_MONITOR_VIF |
+                    IEEE80211_HW_QUEUE_CONTROL |
+                    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+        if (rctbl)
+                hw->flags |= IEEE80211_HW_SUPPORTS_RC_TABLE;
+
+        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
+                            WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                            WIPHY_FLAG_AP_UAPSD;
+        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+
+        /* ask mac80211 to reserve space for magic */
+        hw->vif_data_size = sizeof(struct hwsim_vif_priv);
+        hw->sta_data_size = sizeof(struct hwsim_sta_priv);
+        hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
+
+        memcpy(data->channels_2ghz, hwsim_channels_2ghz,
+                sizeof(hwsim_channels_2ghz));
+        memcpy(data->channels_5ghz, hwsim_channels_5ghz,
+                sizeof(hwsim_channels_5ghz));
+        memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
+
+        for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband = &data->bands[band];
+                switch (band) {
+                case IEEE80211_BAND_2GHZ:
+                        sband->channels = data->channels_2ghz;
+                        sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
+                        sband->bitrates = data->rates;
+                        sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
+                        break;
+                case IEEE80211_BAND_5GHZ:
+                        sband->channels = data->channels_5ghz;
+                        sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
+                        sband->bitrates = data->rates + 4;
+                        sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
+                        break;
+                default:
+                        continue;
+                }
 
-        wiphy_debug(data->hw->wiphy,
-                    "%s: send PS-Poll to %pM for aid %d\n",
-                    __func__, vp->bssid, vp->aid);
+                sband->ht_cap.ht_supported = true;
+                sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                                    IEEE80211_HT_CAP_GRN_FLD |
+                                    IEEE80211_HT_CAP_SGI_40 |
+                                    IEEE80211_HT_CAP_DSSSCCK40;
+                sband->ht_cap.ampdu_factor = 0x3;
+                sband->ht_cap.ampdu_density = 0x6;
+                memset(&sband->ht_cap.mcs, 0,
+                       sizeof(sband->ht_cap.mcs));
+                sband->ht_cap.mcs.rx_mask[0] = 0xff;
+                sband->ht_cap.mcs.rx_mask[1] = 0xff;
+                sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+
+                hw->wiphy->bands[band] = sband;
+
+                sband->vht_cap.vht_supported = true;
+                sband->vht_cap.cap =
+                        IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+                        IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
+                        IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
+                        IEEE80211_VHT_CAP_RXLDPC |
+                        IEEE80211_VHT_CAP_SHORT_GI_80 |
+                        IEEE80211_VHT_CAP_SHORT_GI_160 |
+                        IEEE80211_VHT_CAP_TXSTBC |
+                        IEEE80211_VHT_CAP_RXSTBC_1 |
+                        IEEE80211_VHT_CAP_RXSTBC_2 |
+                        IEEE80211_VHT_CAP_RXSTBC_3 |
+                        IEEE80211_VHT_CAP_RXSTBC_4 |
+                        IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+                sband->vht_cap.vht_mcs.rx_mcs_map =
+                        cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_8 << 0 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 2 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 6 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 8 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 14);
+                sband->vht_cap.vht_mcs.tx_mcs_map =
+                        sband->vht_cap.vht_mcs.rx_mcs_map;
+        }
 
-        skb = dev_alloc_skb(sizeof(*pspoll));
-        if (!skb)
-                return;
-        pspoll = (void *) skb_put(skb, sizeof(*pspoll));
-        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
-                                            IEEE80211_STYPE_PSPOLL |
-                                            IEEE80211_FCTL_PM);
-        pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
-        memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
-        memcpy(pspoll->ta, mac, ETH_ALEN);
+        /* By default all radios belong to the first group */
+        data->group = 1;
+        mutex_init(&data->mutex);
 
-        rcu_read_lock();
-        mac80211_hwsim_tx_frame(data->hw, skb,
-                                rcu_dereference(vif->chanctx_conf)->def.chan);
-        rcu_read_unlock();
-}
+        /* Enable frame retransmissions for lossy channels */
+        hw->max_rates = 4;
+        hw->max_rate_tries = 11;
 
-static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
-                                struct ieee80211_vif *vif, int ps)
-{
-        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
-        struct sk_buff *skb;
-        struct ieee80211_hdr *hdr;
+        if (reg_strict)
+                hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
+        if (regd) {
+                hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+                wiphy_apply_custom_regulatory(hw->wiphy, regd);
+                /* give the regulatory workqueue a chance to run */
+                schedule_timeout_interruptible(1);
+        }
 
-        if (!vp->assoc)
-                return;
+        err = ieee80211_register_hw(hw);
+        if (err < 0) {
+                printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
+                       err);
+                goto failed_hw;
+        }
 
-        wiphy_debug(data->hw->wiphy,
-                    "%s: send data::nullfunc to %pM ps=%d\n",
-                    __func__, vp->bssid, ps);
+        wiphy_debug(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
 
-        skb = dev_alloc_skb(sizeof(*hdr));
-        if (!skb)
-                return;
-        hdr = (void *) skb_put(skb, sizeof(*hdr) - ETH_ALEN);
-        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                         IEEE80211_STYPE_NULLFUNC |
-                                         (ps ? IEEE80211_FCTL_PM : 0));
-        hdr->duration_id = cpu_to_le16(0);
-        memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
-        memcpy(hdr->addr2, mac, ETH_ALEN);
-        memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+        if (reg_alpha2)
+                regulatory_hint(hw->wiphy, reg_alpha2);
 
-        rcu_read_lock();
-        mac80211_hwsim_tx_frame(data->hw, skb,
-                                rcu_dereference(vif->chanctx_conf)->def.chan);
-        rcu_read_unlock();
-}
+        data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
+        debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
+        debugfs_create_file("group", 0666, data->debugfs, data,
+                            &hwsim_fops_group);
+        if (data->channels == 1)
+                debugfs_create_file("dfs_simulate_radar", 0222,
+                                    data->debugfs,
+                                    data, &hwsim_simulate_radar);
 
+        tasklet_hrtimer_init(&data->beacon_timer,
+                             mac80211_hwsim_beacon,
+                             CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS);
 
-static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
-                                   struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        hwsim_send_nullfunc(data, mac, vif, 1);
-}
+        spin_lock_bh(&hwsim_radio_lock);
+        list_add_tail(&data->list, &hwsim_radios);
+        spin_unlock_bh(&hwsim_radio_lock);
 
+        return idx;
 
-static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
-                                      struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        hwsim_send_nullfunc(data, mac, vif, 0);
+failed_hw:
+        device_unregister(data->dev);
+failed_drvdata:
+        ieee80211_free_hw(hw);
+failed:
+        return err;
 }
 
-
-static int hwsim_fops_ps_read(void *dat, u64 *val)
+static void mac80211_hwsim_destroy_radio(struct mac80211_hwsim_data *data)
 {
-        struct mac80211_hwsim_data *data = dat;
-        *val = data->ps;
-        return 0;
+        debugfs_remove_recursive(data->debugfs);
+        ieee80211_unregister_hw(data->hw);
+        device_release_driver(data->dev);
+        device_unregister(data->dev);
+        ieee80211_free_hw(data->hw);
 }
 
-static int hwsim_fops_ps_write(void *dat, u64 val)
+static void mac80211_hwsim_free(void)
 {
-        struct mac80211_hwsim_data *data = dat;
-        enum ps_mode old_ps;
-
-        if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
-            val != PS_MANUAL_POLL)
-                return -EINVAL;
-
-        old_ps = data->ps;
-        data->ps = val;
+        struct mac80211_hwsim_data *data;
 
-        if (val == PS_MANUAL_POLL) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_ps_poll, data);
-                data->ps_poll_pending = true;
-        } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_ps,
-                                                    data);
-        } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_no_ps,
-                                                    data);
+        spin_lock_bh(&hwsim_radio_lock);
+        while ((data = list_first_entry_or_null(&hwsim_radios,
+                                                struct mac80211_hwsim_data,
+                                                list))) {
+                list_del(&data->list);
+                spin_unlock_bh(&hwsim_radio_lock);
+                mac80211_hwsim_destroy_radio(data);
+                spin_lock_bh(&hwsim_radio_lock);
         }
-
-        return 0;
-}
-
-DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
-                        "%llu\n");
-
-static int hwsim_write_simulate_radar(void *dat, u64 val)
-{
-        struct mac80211_hwsim_data *data = dat;
-
-        ieee80211_radar_detected(data->hw);
-
-        return 0;
+        spin_unlock_bh(&hwsim_radio_lock);
+        class_destroy(hwsim_class);
 }
 
-DEFINE_SIMPLE_ATTRIBUTE(hwsim_simulate_radar, NULL,
-                        hwsim_write_simulate_radar, "%llu\n");
-
-static int hwsim_fops_group_read(void *dat, u64 *val)
-{
-        struct mac80211_hwsim_data *data = dat;
-        *val = data->group;
-        return 0;
-}
+static const struct net_device_ops hwsim_netdev_ops = {
+        .ndo_start_xmit         = hwsim_mon_xmit,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
 
-static int hwsim_fops_group_write(void *dat, u64 val)
+static void hwsim_mon_setup(struct net_device *dev)
 {
-        struct mac80211_hwsim_data *data = dat;
-        data->group = val;
-        return 0;
+        dev->netdev_ops = &hwsim_netdev_ops;
+        dev->destructor = free_netdev;
+        ether_setup(dev);
+        dev->tx_queue_len = 0;
+        dev->type = ARPHRD_IEEE80211_RADIOTAP;
+        memset(dev->dev_addr, 0, ETH_ALEN);
+        dev->dev_addr[0] = 0x12;
 }
 
-DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_group,
-                        hwsim_fops_group_read, hwsim_fops_group_write,
-                        "%llx\n");
-
-static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(
-                             struct mac_address *addr)
+static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 {
         struct mac80211_hwsim_data *data;
         bool _found = false;
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry(data, &hwsim_radios, list) {
-                if (memcmp(data->addresses[1].addr, addr,
-                          sizeof(struct mac_address)) == 0) {
+                if (memcmp(data->addresses[1].addr, addr, ETH_ALEN) == 0) {
                         _found = true;
                         break;
                 }
@@ -1959,27 +2238,26 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
         struct hwsim_tx_rate *tx_attempts;
         unsigned long ret_skb_ptr;
         struct sk_buff *skb, *tmp;
-        struct mac_address *src;
+        const u8 *src;
         unsigned int hwsim_flags;
-
         int i;
         bool found = false;
 
+        if (info->snd_portid != wmediumd_portid)
+                return -EINVAL;
+
         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
-           !info->attrs[HWSIM_ATTR_FLAGS] ||
-           !info->attrs[HWSIM_ATTR_COOKIE] ||
-           !info->attrs[HWSIM_ATTR_TX_INFO])
+            !info->attrs[HWSIM_ATTR_FLAGS] ||
+            !info->attrs[HWSIM_ATTR_COOKIE] ||
+            !info->attrs[HWSIM_ATTR_TX_INFO])
                 goto out;
 
-        src = (struct mac_address *)nla_data(
-                                   info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
+        src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
-
         ret_skb_ptr = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
 
         data2 = get_hwsim_data_ref_from_addr(src);
-
-        if (data2 == NULL)
+        if (!data2)
                 goto out;
 
         /* look for the skb matching the cookie passed back from user */
@@ -2036,38 +2314,37 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
 
         struct mac80211_hwsim_data *data2;
         struct ieee80211_rx_status rx_status;
-        struct mac_address *dst;
+        const u8 *dst;
         int frame_data_len;
-        char *frame_data;
+        void *frame_data;
         struct sk_buff *skb = NULL;
 
+        if (info->snd_portid != wmediumd_portid)
+                return -EINVAL;
+
         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
             !info->attrs[HWSIM_ATTR_FRAME] ||
             !info->attrs[HWSIM_ATTR_RX_RATE] ||
             !info->attrs[HWSIM_ATTR_SIGNAL])
                 goto out;
 
-        dst = (struct mac_address *)nla_data(
-                                   info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
-
+        dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
-        frame_data = (char *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
+        frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
 
         /* Allocate new skb here */
         skb = alloc_skb(frame_data_len, GFP_KERNEL);
         if (skb == NULL)
                 goto err;
 
-        if (frame_data_len <= IEEE80211_MAX_DATA_LEN) {
-                /* Copy the data */
-                memcpy(skb_put(skb, frame_data_len), frame_data,
-                       frame_data_len);
-        } else
+        if (frame_data_len > IEEE80211_MAX_DATA_LEN)
                 goto err;
 
-        data2 = get_hwsim_data_ref_from_addr(dst);
+        /* Copy the data */
+        memcpy(skb_put(skb, frame_data_len), frame_data, frame_data_len);
 
-        if (data2 == NULL)
+        data2 = get_hwsim_data_ref_from_addr(dst);
+        if (!data2)
                 goto out;
 
         /* check if radio is configured properly */
@@ -2075,7 +2352,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
         if (data2->idle || !data2->started)
                 goto out;
 
-        /*A frame is received from user space*/
+        /* A frame is received from user space */
         memset(&rx_status, 0, sizeof(rx_status));
         rx_status.freq = data2->channel->center_freq;
         rx_status.band = data2->channel->band;
@@ -2097,8 +2374,24 @@ out:
 static int hwsim_register_received_nl(struct sk_buff *skb_2,
                                       struct genl_info *info)
 {
-        if (info == NULL)
-                goto out;
+        struct mac80211_hwsim_data *data;
+        int chans = 1;
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry(data, &hwsim_radios, list)
+                chans = max(chans, data->channels);
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        /* In the future we should revise the userspace API and allow it
+         * to set a flag that it does support multi-channel, then we can
+         * let this pass conditionally on the flag.
+         * For current userspace, prohibit it since it won't work right.
+         */
+        if (chans > 1)
+                return -EOPNOTSUPP;
+
+        if (wmediumd_portid)
+                return -EBUSY;
 
         wmediumd_portid = info->snd_portid;
 
@@ -2106,9 +2399,53 @@ static int hwsim_register_received_nl(struct sk_buff *skb_2,
                "switching to wmediumd mode with pid %d\n", info->snd_portid);
 
         return 0;
-out:
-        printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
-        return -EINVAL;
+}
+
+static int hwsim_create_radio_nl(struct sk_buff *msg, struct genl_info *info)
+{
+        unsigned int chans = channels;
+        const char *alpha2 = NULL;
+        const struct ieee80211_regdomain *regd = NULL;
+        bool reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+
+        if (info->attrs[HWSIM_ATTR_CHANNELS])
+                chans = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
+        if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
+                alpha2 = nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
+
+        if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
+                u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
+
+                if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
+                        return -EINVAL;
+                regd = hwsim_world_regdom_custom[idx];
+        }
+
+        return mac80211_hwsim_create_radio(chans, alpha2, regd, reg_strict);
+}
+
+static int hwsim_destroy_radio_nl(struct sk_buff *msg, struct genl_info *info)
+{
+        struct mac80211_hwsim_data *data;
+        int idx;
+
+        if (!info->attrs[HWSIM_ATTR_RADIO_ID])
+                return -EINVAL;
+        idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry(data, &hwsim_radios, list) {
+                if (data->idx != idx)
+                        continue;
+                list_del(&data->list);
+                spin_unlock_bh(&hwsim_radio_lock);
+                mac80211_hwsim_destroy_radio(data);
+                return 0;
+        }
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        return -ENODEV;
 }
 
 /* Generic Netlink operations array */
@@ -2129,6 +2466,18 @@ static const struct genl_ops hwsim_ops[] = {
                 .policy = hwsim_genl_policy,
                 .doit = hwsim_tx_info_frame_received_nl,
         },
+        {
+                .cmd = HWSIM_CMD_CREATE_RADIO,
+                .policy = hwsim_genl_policy,
+                .doit = hwsim_create_radio_nl,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = HWSIM_CMD_DESTROY_RADIO,
+                .policy = hwsim_genl_policy,
+                .doit = hwsim_destroy_radio_nl,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
@@ -2157,10 +2506,6 @@ static int hwsim_init_netlink(void)
 {
         int rc;
 
-        /* userspace test API hasn't been adjusted for multi-channel */
-        if (channels > 1)
-                return 0;
-
         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
 
         rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
@@ -2180,94 +2525,36 @@ failure:
 
 static void hwsim_exit_netlink(void)
 {
-        int ret;
-
-        /* userspace test API hasn't been adjusted for multi-channel */
-        if (channels > 1)
-                return;
-
-        printk(KERN_INFO "mac80211_hwsim: closing netlink\n");
         /* unregister the notifier */
         netlink_unregister_notifier(&hwsim_netlink_notifier);
         /* unregister the family */
-        ret = genl_unregister_family(&hwsim_genl_family);
-        if (ret)
-                printk(KERN_DEBUG "mac80211_hwsim: "
-                       "unregister family %i\n", ret);
+        genl_unregister_family(&hwsim_genl_family);
 }
 
-static const struct ieee80211_iface_limit hwsim_if_limits[] = {
-        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
-        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
-                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
-#ifdef CONFIG_MAC80211_MESH
-                                 BIT(NL80211_IFTYPE_MESH_POINT) |
-#endif
-                                 BIT(NL80211_IFTYPE_AP) |
-                                 BIT(NL80211_IFTYPE_P2P_GO) },
-        { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
-};
-
-static const struct ieee80211_iface_limit hwsim_if_dfs_limits[] = {
-        { .max = 8, .types = BIT(NL80211_IFTYPE_AP) },
-};
-
-static struct ieee80211_iface_combination hwsim_if_comb[] = {
-        {
-                .limits = hwsim_if_limits,
-                .n_limits = ARRAY_SIZE(hwsim_if_limits),
-                .max_interfaces = 2048,
-                .num_different_channels = 1,
-        },
-        {
-                .limits = hwsim_if_dfs_limits,
-                .n_limits = ARRAY_SIZE(hwsim_if_dfs_limits),
-                .max_interfaces = 8,
-                .num_different_channels = 1,
-                .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
-                                       BIT(NL80211_CHAN_WIDTH_20) |
-                                       BIT(NL80211_CHAN_WIDTH_40) |
-                                       BIT(NL80211_CHAN_WIDTH_80) |
-                                       BIT(NL80211_CHAN_WIDTH_160),
-        }
-};
-
 static int __init init_mac80211_hwsim(void)
 {
-        int i, err = 0;
-        u8 addr[ETH_ALEN];
-        struct mac80211_hwsim_data *data;
-        struct ieee80211_hw *hw;
-        enum ieee80211_band band;
+        int i, err;
 
-        if (radios < 1 || radios > 100)
+        if (radios < 0 || radios > 100)
                 return -EINVAL;
 
         if (channels < 1)
                 return -EINVAL;
 
-        if (channels > 1) {
-                hwsim_if_comb[0].num_different_channels = channels;
-                mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
-                mac80211_hwsim_ops.cancel_hw_scan =
-                        mac80211_hwsim_cancel_hw_scan;
-                mac80211_hwsim_ops.sw_scan_start = NULL;
-                mac80211_hwsim_ops.sw_scan_complete = NULL;
-                mac80211_hwsim_ops.remain_on_channel =
-                        mac80211_hwsim_roc;
-                mac80211_hwsim_ops.cancel_remain_on_channel =
-                        mac80211_hwsim_croc;
-                mac80211_hwsim_ops.add_chanctx =
-                        mac80211_hwsim_add_chanctx;
-                mac80211_hwsim_ops.remove_chanctx =
-                        mac80211_hwsim_remove_chanctx;
-                mac80211_hwsim_ops.change_chanctx =
-                        mac80211_hwsim_change_chanctx;
-                mac80211_hwsim_ops.assign_vif_chanctx =
-                        mac80211_hwsim_assign_vif_chanctx;
-                mac80211_hwsim_ops.unassign_vif_chanctx =
-                        mac80211_hwsim_unassign_vif_chanctx;
-        }
+        mac80211_hwsim_mchan_ops = mac80211_hwsim_ops;
+        mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
+        mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
+        mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
+        mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
+        mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
+        mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
+        mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
+        mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
+        mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
+        mac80211_hwsim_mchan_ops.assign_vif_chanctx =
+                mac80211_hwsim_assign_vif_chanctx;
+        mac80211_hwsim_mchan_ops.unassign_vif_chanctx =
+                mac80211_hwsim_unassign_vif_chanctx;
 
         spin_lock_init(&hwsim_radio_lock);
         INIT_LIST_HEAD(&hwsim_radios);
@@ -2279,361 +2566,116 @@ static int __init init_mac80211_hwsim(void)
         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
         if (IS_ERR(hwsim_class)) {
                 err = PTR_ERR(hwsim_class);
-                goto failed_unregister_driver;
+                goto out_unregister_driver;
         }
 
-        memset(addr, 0, ETH_ALEN);
-        addr[0] = 0x02;
-
         for (i = 0; i < radios; i++) {
-                printk(KERN_DEBUG "mac80211_hwsim: Initializing radio %d\n",
-                       i);
-                hw = ieee80211_alloc_hw(sizeof(*data), &mac80211_hwsim_ops);
-                if (!hw) {
-                        printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw "
-                               "failed\n");
-                        err = -ENOMEM;
-                        goto failed;
-                }
-                data = hw->priv;
-                data->hw = hw;
-
-                data->dev = device_create(hwsim_class, NULL, 0, hw,
-                                          "hwsim%d", i);
-                if (IS_ERR(data->dev)) {
-                        printk(KERN_DEBUG
-                               "mac80211_hwsim: device_create failed (%ld)\n",
-                               PTR_ERR(data->dev));
-                        err = -ENOMEM;
-                        goto failed_drvdata;
-                }
-                data->dev->driver = &mac80211_hwsim_driver.driver;
-                err = device_bind_driver(data->dev);
-                if (err != 0) {
-                        printk(KERN_DEBUG
-                               "mac80211_hwsim: device_bind_driver failed (%d)\n",
-                               err);
-                        goto failed_hw;
-                }
-
-                skb_queue_head_init(&data->pending);
-
-                SET_IEEE80211_DEV(hw, data->dev);
-                addr[3] = i >> 8;
-                addr[4] = i;
-                memcpy(data->addresses[0].addr, addr, ETH_ALEN);
-                memcpy(data->addresses[1].addr, addr, ETH_ALEN);
-                data->addresses[1].addr[0] |= 0x40;
-                hw->wiphy->n_addresses = 2;
-                hw->wiphy->addresses = data->addresses;
-
-                hw->wiphy->iface_combinations = hwsim_if_comb;
-                hw->wiphy->n_iface_combinations = ARRAY_SIZE(hwsim_if_comb);
-
-                if (channels > 1) {
-                        hw->wiphy->max_scan_ssids = 255;
-                        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                        hw->wiphy->max_remain_on_channel_duration = 1000;
-                        /* For channels > 1 DFS is not allowed */
-                        hw->wiphy->n_iface_combinations = 1;
-                }
-
-                INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
-                INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
-
-                hw->channel_change_time = 1;
-                hw->queues = 5;
-                hw->offchannel_tx_hw_queue = 4;
-                hw->wiphy->interface_modes =
-                        BIT(NL80211_IFTYPE_STATION) |
-                        BIT(NL80211_IFTYPE_AP) |
-                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                        BIT(NL80211_IFTYPE_P2P_GO) |
-                        BIT(NL80211_IFTYPE_ADHOC) |
-                        BIT(NL80211_IFTYPE_MESH_POINT) |
-                        BIT(NL80211_IFTYPE_P2P_DEVICE);
-
-                hw->flags = IEEE80211_HW_MFP_CAPABLE |
-                            IEEE80211_HW_SIGNAL_DBM |
-                            IEEE80211_HW_SUPPORTS_STATIC_SMPS |
-                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
-                            IEEE80211_HW_AMPDU_AGGREGATION |
-                            IEEE80211_HW_WANT_MONITOR_VIF |
-                            IEEE80211_HW_QUEUE_CONTROL |
-                            IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
-                if (rctbl)
-                        hw->flags |= IEEE80211_HW_SUPPORTS_RC_TABLE;
-
-                hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
-                                    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
-                                    WIPHY_FLAG_AP_UAPSD;
-                hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
-
-                /* ask mac80211 to reserve space for magic */
-                hw->vif_data_size = sizeof(struct hwsim_vif_priv);
-                hw->sta_data_size = sizeof(struct hwsim_sta_priv);
-                hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
-
-                memcpy(data->channels_2ghz, hwsim_channels_2ghz,
-                        sizeof(hwsim_channels_2ghz));
-                memcpy(data->channels_5ghz, hwsim_channels_5ghz,
-                        sizeof(hwsim_channels_5ghz));
-                memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
-
-                for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
-                        struct ieee80211_supported_band *sband = &data->bands[band];
-                        switch (band) {
-                        case IEEE80211_BAND_2GHZ:
-                                sband->channels = data->channels_2ghz;
-                                sband->n_channels =
-                                        ARRAY_SIZE(hwsim_channels_2ghz);
-                                sband->bitrates = data->rates;
-                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
-                                break;
-                        case IEEE80211_BAND_5GHZ:
-                                sband->channels = data->channels_5ghz;
-                                sband->n_channels =
-                                        ARRAY_SIZE(hwsim_channels_5ghz);
-                                sband->bitrates = data->rates + 4;
-                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
-                                break;
-                        default:
-                                continue;
-                        }
-
-                        sband->ht_cap.ht_supported = true;
-                        sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-                                IEEE80211_HT_CAP_GRN_FLD |
-                                IEEE80211_HT_CAP_SGI_40 |
-                                IEEE80211_HT_CAP_DSSSCCK40;
-                        sband->ht_cap.ampdu_factor = 0x3;
-                        sband->ht_cap.ampdu_density = 0x6;
-                        memset(&sband->ht_cap.mcs, 0,
-                               sizeof(sband->ht_cap.mcs));
-                        sband->ht_cap.mcs.rx_mask[0] = 0xff;
-                        sband->ht_cap.mcs.rx_mask[1] = 0xff;
-                        sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
-
-                        hw->wiphy->bands[band] = sband;
-
-                        sband->vht_cap.vht_supported = true;
-                        sband->vht_cap.cap =
-                                IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
-                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
-                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
-                                IEEE80211_VHT_CAP_RXLDPC |
-                                IEEE80211_VHT_CAP_SHORT_GI_80 |
-                                IEEE80211_VHT_CAP_SHORT_GI_160 |
-                                IEEE80211_VHT_CAP_TXSTBC |
-                                IEEE80211_VHT_CAP_RXSTBC_1 |
-                                IEEE80211_VHT_CAP_RXSTBC_2 |
-                                IEEE80211_VHT_CAP_RXSTBC_3 |
-                                IEEE80211_VHT_CAP_RXSTBC_4 |
-                                IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
-                        sband->vht_cap.vht_mcs.rx_mcs_map =
-                                cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_8 << 0 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 2 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 6 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 8 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 14);
-                        sband->vht_cap.vht_mcs.tx_mcs_map =
-                                sband->vht_cap.vht_mcs.rx_mcs_map;
-                }
-                /* By default all radios are belonging to the first group */
-                data->group = 1;
-                mutex_init(&data->mutex);
-
-                /* Enable frame retransmissions for lossy channels */
-                hw->max_rates = 4;
-                hw->max_rate_tries = 11;
+                const char *reg_alpha2 = NULL;
+                const struct ieee80211_regdomain *regd = NULL;
+                bool reg_strict = false;
 
-                /* Work to be done prior to ieee80211_register_hw() */
                 switch (regtest) {
-                case HWSIM_REGTEST_DISABLED:
-                case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
-                case HWSIM_REGTEST_DRIVER_REG_ALL:
                 case HWSIM_REGTEST_DIFF_COUNTRY:
-                        /*
-                         * Nothing to be done for driver regulatory domain
-                         * hints prior to ieee80211_register_hw()
-                         */
-                        break;
-                case HWSIM_REGTEST_WORLD_ROAM:
-                        if (i == 0) {
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_CUSTOM_REG;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        }
-                        break;
-                case HWSIM_REGTEST_CUSTOM_WORLD:
-                        hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
-                        wiphy_apply_custom_regulatory(hw->wiphy,
-                                &hwsim_world_regdom_custom_01);
-                        break;
-                case HWSIM_REGTEST_CUSTOM_WORLD_2:
-                        if (i == 0) {
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_CUSTOM_REG;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        } else if (i == 1) {
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_CUSTOM_REG;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_02);
-                        }
-                        break;
-                case HWSIM_REGTEST_STRICT_ALL:
-                        hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
-                        break;
-                case HWSIM_REGTEST_STRICT_FOLLOW:
-                case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
-                        if (i == 0)
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_STRICT_REG;
-                        break;
-                case HWSIM_REGTEST_ALL:
-                        if (i == 0) {
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_CUSTOM_REG;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        } else if (i == 1) {
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_CUSTOM_REG;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_02);
-                        } else if (i == 4)
-                                hw->wiphy->regulatory_flags |=
-                                        REGULATORY_STRICT_REG;
-                        break;
-                default:
-                        break;
-                }
-
-                /* give the regulatory workqueue a chance to run */
-                if (regtest)
-                        schedule_timeout_interruptible(1);
-                err = ieee80211_register_hw(hw);
-                if (err < 0) {
-                        printk(KERN_DEBUG "mac80211_hwsim: "
-                               "ieee80211_register_hw failed (%d)\n", err);
-                        goto failed_hw;
-                }
-
-                /* Work to be done after to ieee80211_register_hw() */
-                switch (regtest) {
-                case HWSIM_REGTEST_WORLD_ROAM:
-                case HWSIM_REGTEST_DISABLED:
+                        if (i < ARRAY_SIZE(hwsim_alpha2s))
+                                reg_alpha2 = hwsim_alpha2s[i];
                         break;
                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
                         if (!i)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                                reg_alpha2 = hwsim_alpha2s[0];
                         break;
-                case HWSIM_REGTEST_DRIVER_REG_ALL:
                 case HWSIM_REGTEST_STRICT_ALL:
-                        regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                        reg_strict = true;
+                case HWSIM_REGTEST_DRIVER_REG_ALL:
+                        reg_alpha2 = hwsim_alpha2s[0];
                         break;
-                case HWSIM_REGTEST_DIFF_COUNTRY:
-                        if (i < ARRAY_SIZE(hwsim_alpha2s))
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[i]);
+                case HWSIM_REGTEST_WORLD_ROAM:
+                        if (i == 0)
+                                regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD:
+                        regd = &hwsim_world_regdom_custom_01;
+                        break;
                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
-                        /*
-                         * Nothing to be done for custom world regulatory
-                         * domains after to ieee80211_register_hw
-                         */
+                        if (i == 0)
+                                regd = &hwsim_world_regdom_custom_01;
+                        else if (i == 1)
+                                regd = &hwsim_world_regdom_custom_02;
                         break;
                 case HWSIM_REGTEST_STRICT_FOLLOW:
-                        if (i == 0)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                        if (i == 0) {
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[0];
+                        }
                         break;
                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
-                        if (i == 0)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
-                        else if (i == 1)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[1]);
+                        if (i == 0) {
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[0];
+                        } else if (i == 1) {
+                                reg_alpha2 = hwsim_alpha2s[1];
+                        }
                         break;
                 case HWSIM_REGTEST_ALL:
-                        if (i == 2)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
-                        else if (i == 3)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[1]);
-                        else if (i == 4)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[2]);
+                        switch (i) {
+                        case 0:
+                                regd = &hwsim_world_regdom_custom_01;
+                                break;
+                        case 1:
+                                regd = &hwsim_world_regdom_custom_02;
+                                break;
+                        case 2:
+                                reg_alpha2 = hwsim_alpha2s[0];
+                                break;
+                        case 3:
+                                reg_alpha2 = hwsim_alpha2s[1];
+                                break;
+                        case 4:
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[2];
+                                break;
+                        }
                         break;
                 default:
                         break;
                 }
 
-                wiphy_debug(hw->wiphy, "hwaddr %pm registered\n",
-                            hw->wiphy->perm_addr);
-
-                data->debugfs = debugfs_create_dir("hwsim",
-                                                   hw->wiphy->debugfsdir);
-                debugfs_create_file("ps", 0666, data->debugfs, data,
-                                    &hwsim_fops_ps);
-                debugfs_create_file("group", 0666, data->debugfs, data,
-                                    &hwsim_fops_group);
-                if (channels == 1)
-                        debugfs_create_file("dfs_simulate_radar", 0222,
-                                            data->debugfs,
-                                            data, &hwsim_simulate_radar);
-
-                tasklet_hrtimer_init(&data->beacon_timer,
-                                     mac80211_hwsim_beacon,
-                                     CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS);
-
-                list_add_tail(&data->list, &hwsim_radios);
+                err = mac80211_hwsim_create_radio(channels, reg_alpha2,
+                                                  regd, reg_strict);
+                if (err < 0)
+                        goto out_free_radios;
         }
 
         hwsim_mon = alloc_netdev(0, "hwsim%d", hwsim_mon_setup);
         if (hwsim_mon == NULL) {
                 err = -ENOMEM;
-                goto failed;
+                goto out_free_radios;
         }
 
         rtnl_lock();
-
         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
-        if (err < 0)
-                goto failed_mon;
-
+        if (err < 0) {
+                rtnl_unlock();
+                goto out_free_radios;
+        }
 
         err = register_netdevice(hwsim_mon);
-        if (err < 0)
-                goto failed_mon;
-
+        if (err < 0) {
+                rtnl_unlock();
+                goto out_free_mon;
+        }
         rtnl_unlock();
 
         err = hwsim_init_netlink();
         if (err < 0)
-                goto failed_nl;
+                goto out_free_mon;
 
         return 0;
 
-failed_nl:
-        printk(KERN_DEBUG "mac_80211_hwsim: failed initializing netlink\n");
-        return err;
-
-failed_mon:
-        rtnl_unlock();
+out_free_mon:
         free_netdev(hwsim_mon);
+out_free_radios:
         mac80211_hwsim_free();
-        return err;
-
-failed_hw:
-        device_unregister(data->dev);
-failed_drvdata:
-        ieee80211_free_hw(hw);
-failed:
-        mac80211_hwsim_free();
-failed_unregister_driver:
+out_unregister_driver:
         platform_driver_unregister(&mac80211_hwsim_driver);
         return err;
 }
diff --git a/drivers/net/wireless/mac80211_hwsim.h b/drivers/net/wireless/mac80211_hwsim.h
index afaad5a443b6..2747cce5a269 100644
--- a/drivers/net/wireless/mac80211_hwsim.h
+++ b/drivers/net/wireless/mac80211_hwsim.h
@@ -65,6 +65,9 @@ enum hwsim_tx_control_flags {
  * kernel, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_FLAGS,
  *      %HWSIM_ATTR_TX_INFO, %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
+ * @HWSIM_CMD_CREATE_RADIO: create a new radio with the given parameters,
+ *      returns the radio ID (>= 0) or negative on errors
+ * @HWSIM_CMD_DESTROY_RADIO: destroy a radio
  * @__HWSIM_CMD_MAX: enum limit
  */
 enum {
@@ -72,6 +75,8 @@ enum {
         HWSIM_CMD_REGISTER,
         HWSIM_CMD_FRAME,
         HWSIM_CMD_TX_INFO_FRAME,
+        HWSIM_CMD_CREATE_RADIO,
+        HWSIM_CMD_DESTROY_RADIO,
         __HWSIM_CMD_MAX,
 };
 #define HWSIM_CMD_MAX (_HWSIM_CMD_MAX - 1)
@@ -94,6 +99,14 @@ enum {
         space
  * @HWSIM_ATTR_TX_INFO: ieee80211_tx_rate array
  * @HWSIM_ATTR_COOKIE: sk_buff cookie to identify the frame
+ * @HWSIM_ATTR_CHANNELS: u32 attribute used with the %HWSIM_CMD_CREATE_RADIO
+ *      command giving the number of channels supported by the new radio
+ * @HWSIM_ATTR_RADIO_ID: u32 attribute used with %HWSIM_CMD_DESTROY_RADIO
+ *      only to destroy a radio
+ * @HWSIM_ATTR_REG_HINT_ALPHA2: alpha2 for regulatoro driver hint
+ *      (nla string, length 2)
+ * @HWSIM_ATTR_REG_CUSTOM_REG: custom regulatory domain index (u32 attribute)
+ * @HWSIM_ATTR_REG_STRICT_REG: request REGULATORY_STRICT_REG (flag attribute)
  * @__HWSIM_ATTR_MAX: enum limit
  */
 
@@ -108,6 +121,11 @@ enum {
         HWSIM_ATTR_SIGNAL,
         HWSIM_ATTR_TX_INFO,
         HWSIM_ATTR_COOKIE,
+        HWSIM_ATTR_CHANNELS,
+        HWSIM_ATTR_RADIO_ID,
+        HWSIM_ATTR_REG_HINT_ALPHA2,
+        HWSIM_ATTR_REG_CUSTOM_REG,
+        HWSIM_ATTR_REG_STRICT_REG,
         __HWSIM_ATTR_MAX,
 };
 #define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index f7ff4725506a..ecdf34505b54 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -31,12 +31,12 @@ config MWIFIEX_PCIE
           mwifiex_pcie.
 
 config MWIFIEX_USB
-        tristate "Marvell WiFi-Ex Driver for USB8797"
+        tristate "Marvell WiFi-Ex Driver for USB8797/8897"
         depends on MWIFIEX && USB
         select FW_LOADER
         ---help---
           This adds support for wireless adapters based on Marvell
-          Avastar 88W8797 chipset with USB interface.
+          8797/8897 chipset with USB interface.
 
           If you choose to build it as a module, it will be called
           mwifiex_usb.
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index e7c81abf108e..f37b403e83d0 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -2677,6 +2677,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         struct wiphy *wiphy;
         struct mwifiex_private *priv = adapter->priv[MWIFIEX_BSS_TYPE_STA];
         u8 *country_code;
+        u32 thr, retry;
 
         /* create a new wiphy for use with cfg80211 */
         wiphy = wiphy_new(&mwifiex_cfg80211_ops,
@@ -2766,6 +2767,19 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
                                    country_code);
         }
 
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, FRAG_THRESH_I, &thr);
+        wiphy->frag_threshold = thr;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, RTS_THRESH_I, &thr);
+        wiphy->rts_threshold = thr;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, SHORT_RETRY_LIM_I, &retry);
+        wiphy->retry_short = (u8) retry;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, LONG_RETRY_LIM_I, &retry);
+        wiphy->retry_long = (u8) retry;
+
         adapter->wiphy = wiphy;
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 4cee6ceb7e9e..5fa932d5f905 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -226,7 +226,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 
 /* HW_SPEC fw_cap_info */
 
-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
+#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
 
 #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
 #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 0ed06646f19a..0a8a26e10f01 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1681,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 const u8 *ie_buf;
                 size_t ie_len;
                 u16 channel = 0;
-                u64 fw_tsf = 0;
+                __le64 fw_tsf = 0;
                 u16 beacon_size = 0;
                 u32 curr_bcn_bytes;
                 u32 freq;
@@ -1815,7 +1815,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                               ie_buf, ie_len, rssi, GFP_KERNEL);
                                 bss_priv = (struct mwifiex_bss_priv *)bss->priv;
                                 bss_priv->band = band;
-                                bss_priv->fw_tsf = fw_tsf;
+                                bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
                                 if (priv->media_connected &&
                                     !memcmp(bssid,
                                             priv->curr_bss_params.bss_descriptor
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index a9240a2083f2..e8ebbd4bc3cd 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,15 +22,21 @@
 
 #define USB_VERSION     "1.0"
 
-static const char usbdriver_name[] = "usb8797";
+static const char usbdriver_name[] = "usb8xxx";
 
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
 
 static struct usb_device_id mwifiex_usb_table[] = {
-        {USB_DEVICE(USB8797_VID, USB8797_PID_1)},
-        {USB_DEVICE_AND_INTERFACE_INFO(USB8797_VID, USB8797_PID_2,
+        /* 8797 */
+        {USB_DEVICE(USB8XXX_VID, USB8797_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
+                                       USB_CLASS_VENDOR_SPEC,
+                                       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
+        /* 8897 */
+        {USB_DEVICE(USB8XXX_VID, USB8897_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8897_PID_2,
                                        USB_CLASS_VENDOR_SPEC,
                                        USB_SUBCLASS_VENDOR_SPEC, 0xff)},
         { }     /* Terminating entry */
@@ -343,10 +349,20 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
                  id_vendor, id_product, bcd_device);
 
         /* PID_1 is used for firmware downloading only */
-        if (id_product == USB8797_PID_1)
-                card->usb_boot_state = USB8797_FW_DNLD;
-        else
-                card->usb_boot_state = USB8797_FW_READY;
+        switch (id_product) {
+        case USB8797_PID_1:
+        case USB8897_PID_1:
+                card->usb_boot_state = USB8XXX_FW_DNLD;
+                break;
+        case USB8797_PID_2:
+        case USB8897_PID_2:
+                card->usb_boot_state = USB8XXX_FW_READY;
+                break;
+        default:
+                pr_warning("unknown id_product %#x\n", id_product);
+                card->usb_boot_state = USB8XXX_FW_DNLD;
+                break;
+        }
 
         card->udev = udev;
         card->intf = intf;
@@ -755,9 +771,20 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
-        strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
         usb_card = card;
 
+        switch (le16_to_cpu(card->udev->descriptor.idProduct)) {
+        case USB8897_PID_1:
+        case USB8897_PID_2:
+                strcpy(adapter->fw_name, USB8897_DEFAULT_FW_NAME);
+                break;
+        case USB8797_PID_1:
+        case USB8797_PID_2:
+        default:
+                strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
+                break;
+        }
+
         return 0;
 }
 
@@ -773,7 +800,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
 {
         int ret = 0;
         u8 *firmware = fw->fw_buf, *recv_buff;
-        u32 retries = USB8797_FW_MAX_RETRY, dlen;
+        u32 retries = USB8XXX_FW_MAX_RETRY, dlen;
         u32 fw_seqnum = 0, tlen = 0, dnld_cmd = 0;
         struct fw_data *fwdata;
         struct fw_sync_header sync_fw;
@@ -875,7 +902,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                 continue;
                         }
 
-                        retries = USB8797_FW_MAX_RETRY;
+                        retries = USB8XXX_FW_MAX_RETRY;
                         break;
                 }
                 fw_seqnum++;
@@ -899,13 +926,13 @@ static int mwifiex_usb_dnld_fw(struct mwifiex_adapter *adapter,
         int ret;
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
-        if (card->usb_boot_state == USB8797_FW_DNLD) {
+        if (card->usb_boot_state == USB8XXX_FW_DNLD) {
                 ret = mwifiex_prog_fw_w_helper(adapter, fw);
                 if (ret)
                         return -1;
 
                 /* Boot state changes after successful firmware download */
-                if (card->usb_boot_state == USB8797_FW_DNLD)
+                if (card->usb_boot_state == USB8XXX_FW_DNLD)
                         return -1;
         }
 
@@ -1039,4 +1066,5 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell WiFi-Ex USB Driver version" USB_VERSION);
 MODULE_VERSION(USB_VERSION);
 MODULE_LICENSE("GPL v2");
-MODULE_FIRMWARE("mrvl/usb8797_uapsta.bin");
+MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(USB8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index 98c4316cd1a9..15b73d12e998 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -22,19 +22,23 @@
 
 #include <linux/usb.h>
 
-#define USB8797_VID             0x1286
+#define USB8XXX_VID             0x1286
+
 #define USB8797_PID_1           0x2043
 #define USB8797_PID_2           0x2044
+#define USB8897_PID_1           0x2045
+#define USB8897_PID_2           0x2046
 
-#define USB8797_FW_DNLD         1
-#define USB8797_FW_READY        2
-#define USB8797_FW_MAX_RETRY    3
+#define USB8XXX_FW_DNLD         1
+#define USB8XXX_FW_READY        2
+#define USB8XXX_FW_MAX_RETRY    3
 
 #define MWIFIEX_TX_DATA_URB     6
 #define MWIFIEX_RX_DATA_URB     6
 #define MWIFIEX_USB_TIMEOUT     100
 
 #define USB8797_DEFAULT_FW_NAME "mrvl/usb8797_uapsta.bin"
+#define USB8897_DEFAULT_FW_NAME "mrvl/usb8897_uapsta.bin"
 
 #define FW_DNLD_TX_BUF_SIZE     620
 #define FW_DNLD_RX_BUF_SIZE     2048
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 63dbde5c3713..4987c3f942ce 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -5892,8 +5892,6 @@ static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
 
         hw->extra_tx_headroom -= priv->ap_fw ? REDUCED_TX_HEADROOM : 0;
 
-        hw->channel_change_time = 10;
-
         hw->queues = MWL8K_TX_WMM_QUEUES;
 
         /* Set rssi values to dBm */
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 80d93cba5150..eede90b63f84 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -756,7 +756,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
                                       BIT(NL80211_IFTYPE_AP) |
                                       BIT(NL80211_IFTYPE_MESH_POINT);
 
-        dev->channel_change_time = 1000;        /* TODO: find actual value */
         priv->beacon_req_id = cpu_to_le32(0);
         priv->tx_stats[P54_QUEUE_BEACON].limit = 1;
         priv->tx_stats[P54_QUEUE_FWSCAN].limit = 1;
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index 9c96831c0b5c..153c61539ec8 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -586,7 +586,7 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
         chan = priv->curchan;
         if (chan) {
                 struct survey_info *survey = &priv->survey[chan->hw_value];
-                survey->noise = clamp_t(s8, priv->noise, -128, 127);
+                survey->noise = clamp(priv->noise, -128, 127);
                 survey->channel_time = priv->survey_raw.active;
                 survey->channel_time_tx = priv->survey_raw.tx;
                 survey->channel_time_busy = priv->survey_raw.tx +
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index d63a12cc5de8..93bb384eb001 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -353,7 +353,6 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
 
         /* TODO: Correct this value for our hw */
         /* TODO: define these hard code value */
-        hw->channel_change_time = 100;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 4;
         /* hw->max_rates = 1; */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 8501954cfb44..c61311084d7e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -317,6 +317,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+        {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
         {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
         /* HP - Lite-On ,8188CUS Slim Combo */
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 119c148f7740..757e25784a8a 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -1468,7 +1468,6 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
 
         /* unit us */
         /* FIXME: find a proper value */
-        wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index e9da47cead58..b46b3116cc55 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -4457,6 +4457,16 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if ((changed & BSS_CHANGED_TXPOWER) &&
+            bss_conf->txpower != wlvif->power_level) {
+
+                ret = wl1271_acx_tx_power(wl, wlvif, bss_conf->txpower);
+                if (ret < 0)
+                        goto out;
+
+                wlvif->power_level = bss_conf->txpower;
+        }
+
         if (is_ap)
                 wl1271_bss_info_changed_ap(wl, vif, bss_conf, changed);
         else
@@ -5710,7 +5720,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
         /* unit us */
         /* FIXME: find a proper value */
-        wl->hw->channel_change_time = 10000;
         wl->hw->max_listen_interval = wl->conf.conn.max_listen_interval;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index c1fb20603338..fe20e1cc0545 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -58,5 +58,6 @@ config NFC_PORT100
 
 source "drivers/nfc/pn544/Kconfig"
 source "drivers/nfc/microread/Kconfig"
+source "drivers/nfc/nfcmrvl/Kconfig"
 
 endmenu
diff --git a/drivers/nfc/Makefile b/drivers/nfc/Makefile
index c715fe8582a8..56ab822ba03d 100644
--- a/drivers/nfc/Makefile
+++ b/drivers/nfc/Makefile
@@ -9,5 +9,6 @@ obj-$(CONFIG_NFC_WILINK)	+= nfcwilink.o
 obj-$(CONFIG_NFC_MEI_PHY)       += mei_phy.o
 obj-$(CONFIG_NFC_SIM)           += nfcsim.o
 obj-$(CONFIG_NFC_PORT100)       += port100.o
+obj-$(CONFIG_NFC_MRVL)          += nfcmrvl/
 
 ccflags-$(CONFIG_NFC_DEBUG) := -DDEBUG
diff --git a/drivers/nfc/mei_phy.c b/drivers/nfc/mei_phy.c
index 1d7860551985..11c7cbdade66 100644
--- a/drivers/nfc/mei_phy.c
+++ b/drivers/nfc/mei_phy.c
@@ -127,7 +127,7 @@ void nfc_mei_event_cb(struct mei_cl_device *device, u32 events, void *context)
 
                 reply_size = mei_cl_recv(device, skb->data, MEI_NFC_MAX_READ);
                 if (reply_size < MEI_NFC_HEADER_SIZE) {
-                        kfree(skb);
+                        kfree_skb(skb);
                         return;
                 }
 
diff --git a/drivers/nfc/nfcmrvl/Kconfig b/drivers/nfc/nfcmrvl/Kconfig
new file mode 100644
index 000000000000..5e18afd9abe2
--- /dev/null
+++ b/drivers/nfc/nfcmrvl/Kconfig
@@ -0,0 +1,23 @@
+config NFC_MRVL
+        tristate "Marvell NFC driver support"
+        depends on NFC_NCI
+        help
+          The core driver to support Marvell NFC devices.
+
+          This driver is required if you want to support
+          Marvell NFC device 8897.
+
+          Say Y here to compile Marvell NFC driver into the kernel or
+          say M to compile it as module.
+
+config NFC_MRVL_USB
+        tristate "Marvell NFC-over-USB driver"
+        depends on NFC_MRVL && USB
+        help
+          Marvell NFC-over-USB driver.
+
+          This driver provides support for Marvell NFC-over-USB devices:
+          8897.
+
+          Say Y here to compile support for Marvell NFC-over-USB driver
+          into the kernel or say M to compile it as module.
diff --git a/drivers/nfc/nfcmrvl/Makefile b/drivers/nfc/nfcmrvl/Makefile
new file mode 100644
index 000000000000..97a0de72dc01
--- /dev/null
+++ b/drivers/nfc/nfcmrvl/Makefile
@@ -0,0 +1,9 @@
+#
+# Makefile for NFCMRVL NCI based NFC driver
+#
+
+nfcmrvl-y += main.o
+obj-$(CONFIG_NFC_MRVL) += nfcmrvl.o
+
+nfcmrvl_usb-y += usb.o
+obj-$(CONFIG_NFC_MRVL_USB) += nfcmrvl_usb.o
diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c
new file mode 100644
index 000000000000..85e8bcf98693
--- /dev/null
+++ b/drivers/nfc/nfcmrvl/main.c
@@ -0,0 +1,165 @@
+/*
+ * Marvell NFC driver: major functions
+ *
+ * Copyright (C) 2014, Marvell International Ltd.
+ *
+ * This software file (the "File") is distributed by Marvell International
+ * Ltd. under the terms of the GNU General Public License Version 2, June 1991
+ * (the "License").  You may use, redistribute and/or modify this File in
+ * accordance with the terms and conditions of the License, a copy of which
+ * is available on the worldwide web at
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
+ * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
+ * this warranty disclaimer.
+ */
+
+#include <linux/module.h>
+#include <linux/nfc.h>
+#include <net/nfc/nci.h>
+#include <net/nfc/nci_core.h>
+#include "nfcmrvl.h"
+
+#define VERSION "1.0"
+
+static int nfcmrvl_nci_open(struct nci_dev *ndev)
+{
+        struct nfcmrvl_private *priv = nci_get_drvdata(ndev);
+        int err;
+
+        if (test_and_set_bit(NFCMRVL_NCI_RUNNING, &priv->flags))
+                return 0;
+
+        err = priv->if_ops->nci_open(priv);
+
+        if (err)
+                clear_bit(NFCMRVL_NCI_RUNNING, &priv->flags);
+
+        return err;
+}
+
+static int nfcmrvl_nci_close(struct nci_dev *ndev)
+{
+        struct nfcmrvl_private *priv = nci_get_drvdata(ndev);
+
+        if (!test_and_clear_bit(NFCMRVL_NCI_RUNNING, &priv->flags))
+                return 0;
+
+        priv->if_ops->nci_close(priv);
+
+        return 0;
+}
+
+static int nfcmrvl_nci_send(struct nci_dev *ndev, struct sk_buff *skb)
+{
+        struct nfcmrvl_private *priv = nci_get_drvdata(ndev);
+
+        nfc_info(priv->dev, "send entry, len %d\n", skb->len);
+
+        skb->dev = (void *)ndev;
+
+        if (!test_bit(NFCMRVL_NCI_RUNNING, &priv->flags))
+                return -EBUSY;
+
+        return priv->if_ops->nci_send(priv, skb);
+}
+
+static int nfcmrvl_nci_setup(struct nci_dev *ndev)
+{
+        __u8 val;
+
+        val = NFCMRVL_GPIO_PIN_NFC_NOT_ALLOWED;
+        nci_set_config(ndev, NFCMRVL_NOT_ALLOWED_ID, 1, &val);
+        val = NFCMRVL_GPIO_PIN_NFC_ACTIVE;
+        nci_set_config(ndev, NFCMRVL_ACTIVE_ID, 1, &val);
+        val = NFCMRVL_EXT_COEX_ENABLE;
+        nci_set_config(ndev, NFCMRVL_EXT_COEX_ID, 1, &val);
+
+        return 0;
+}
+
+static struct nci_ops nfcmrvl_nci_ops = {
+        .open = nfcmrvl_nci_open,
+        .close = nfcmrvl_nci_close,
+        .send = nfcmrvl_nci_send,
+        .setup = nfcmrvl_nci_setup,
+};
+
+struct nfcmrvl_private *nfcmrvl_nci_register_dev(void *drv_data,
+                                                 struct nfcmrvl_if_ops *ops,
+                                                 struct device *dev)
+{
+        struct nfcmrvl_private *priv;
+        int rc;
+        u32 protocols;
+
+        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
+        if (!priv)
+                return ERR_PTR(-ENOMEM);
+
+        priv->drv_data = drv_data;
+        priv->if_ops = ops;
+        priv->dev = dev;
+
+        protocols = NFC_PROTO_JEWEL_MASK
+                | NFC_PROTO_MIFARE_MASK | NFC_PROTO_FELICA_MASK
+                | NFC_PROTO_ISO14443_MASK
+                | NFC_PROTO_ISO14443_B_MASK
+                | NFC_PROTO_NFC_DEP_MASK;
+
+        priv->ndev = nci_allocate_device(&nfcmrvl_nci_ops, protocols, 0, 0);
+        if (!priv->ndev) {
+                nfc_err(dev, "nci_allocate_device failed");
+                rc = -ENOMEM;
+                goto error;
+        }
+
+        nci_set_drvdata(priv->ndev, priv);
+
+        rc = nci_register_device(priv->ndev);
+        if (rc) {
+                nfc_err(dev, "nci_register_device failed %d", rc);
+                nci_free_device(priv->ndev);
+                goto error;
+        }
+
+        nfc_info(dev, "registered with nci successfully\n");
+        return priv;
+
+error:
+        kfree(priv);
+        return ERR_PTR(rc);
+}
+EXPORT_SYMBOL_GPL(nfcmrvl_nci_register_dev);
+
+void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv)
+{
+        struct nci_dev *ndev = priv->ndev;
+
+        nci_unregister_device(ndev);
+        nci_free_device(ndev);
+        kfree(priv);
+}
+EXPORT_SYMBOL_GPL(nfcmrvl_nci_unregister_dev);
+
+int nfcmrvl_nci_recv_frame(struct nfcmrvl_private *priv, void *data, int count)
+{
+        struct sk_buff *skb;
+
+        skb = nci_skb_alloc(priv->ndev, count, GFP_ATOMIC);
+        if (!skb)
+                return -ENOMEM;
+
+        memcpy(skb_put(skb, count), data, count);
+        nci_recv_frame(priv->ndev, skb);
+
+        return count;
+}
+EXPORT_SYMBOL_GPL(nfcmrvl_nci_recv_frame);
+
+MODULE_AUTHOR("Marvell International Ltd.");
+MODULE_DESCRIPTION("Marvell NFC driver ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/nfc/nfcmrvl/nfcmrvl.h b/drivers/nfc/nfcmrvl/nfcmrvl.h
new file mode 100644
index 000000000000..54c4a956bd45
--- /dev/null
+++ b/drivers/nfc/nfcmrvl/nfcmrvl.h
@@ -0,0 +1,48 @@
+/**
+ * Marvell NFC driver
+ *
+ * Copyright (C) 2014, Marvell International Ltd.
+ *
+ * This software file (the "File") is distributed by Marvell International
+ * Ltd. under the terms of the GNU General Public License Version 2, June 1991
+ * (the "License").  You may use, redistribute and/or modify this File in
+ * accordance with the terms and conditions of the License, a copy of which
+ * is available on the worldwide web at
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
+ * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
+ * this warranty disclaimer.
+ **/
+
+/* Define private flags: */
+#define NFCMRVL_NCI_RUNNING                     1
+
+#define NFCMRVL_EXT_COEX_ID                     0xE0
+#define NFCMRVL_NOT_ALLOWED_ID                  0xE1
+#define NFCMRVL_ACTIVE_ID                       0xE2
+#define NFCMRVL_EXT_COEX_ENABLE                 1
+#define NFCMRVL_GPIO_PIN_NFC_NOT_ALLOWED        0xA
+#define NFCMRVL_GPIO_PIN_NFC_ACTIVE             0xB
+#define NFCMRVL_NCI_MAX_EVENT_SIZE              260
+
+struct nfcmrvl_private {
+        struct nci_dev *ndev;
+        unsigned long flags;
+        void *drv_data;
+        struct device *dev;
+        struct nfcmrvl_if_ops *if_ops;
+};
+
+struct nfcmrvl_if_ops {
+        int (*nci_open) (struct nfcmrvl_private *priv);
+        int (*nci_close) (struct nfcmrvl_private *priv);
+        int (*nci_send) (struct nfcmrvl_private *priv, struct sk_buff *skb);
+};
+
+void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv);
+int nfcmrvl_nci_recv_frame(struct nfcmrvl_private *priv, void *data, int count);
+struct nfcmrvl_private *nfcmrvl_nci_register_dev(void *drv_data,
+                                                 struct nfcmrvl_if_ops *ops,
+                                                 struct device *dev);
diff --git a/drivers/nfc/nfcmrvl/usb.c b/drivers/nfc/nfcmrvl/usb.c
new file mode 100644
index 000000000000..3221ca37d6c9
--- /dev/null
+++ b/drivers/nfc/nfcmrvl/usb.c
@@ -0,0 +1,459 @@
+/**
+ * Marvell NFC-over-USB driver: USB interface related functions
+ *
+ * Copyright (C) 2014, Marvell International Ltd.
+ *
+ * This software file (the "File") is distributed by Marvell International
+ * Ltd. under the terms of the GNU General Public License Version 2, June 1991
+ * (the "License").  You may use, redistribute and/or modify this File in
+ * accordance with the terms and conditions of the License, a copy of which
+ * is available on the worldwide web at
+ * http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
+ * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
+ * this warranty disclaimer.
+ **/
+
+#include <linux/module.h>
+#include <linux/usb.h>
+#include <linux/nfc.h>
+#include <net/nfc/nci.h>
+#include <net/nfc/nci_core.h>
+#include "nfcmrvl.h"
+
+#define VERSION "1.0"
+
+static struct usb_device_id nfcmrvl_table[] = {
+        { USB_DEVICE_INTERFACE_CLASS(0x1286, 0x2046, 0xff) },
+        { }     /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, nfcmrvl_table);
+
+#define NFCMRVL_USB_BULK_RUNNING        1
+#define NFCMRVL_USB_SUSPENDING          2
+
+struct nfcmrvl_usb_drv_data {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        unsigned long flags;
+        struct work_struct waker;
+        struct usb_anchor tx_anchor;
+        struct usb_anchor bulk_anchor;
+        struct usb_anchor deferred;
+        int tx_in_flight;
+        /* protects tx_in_flight */
+        spinlock_t txlock;
+        struct usb_endpoint_descriptor *bulk_tx_ep;
+        struct usb_endpoint_descriptor *bulk_rx_ep;
+        int suspend_count;
+        struct nfcmrvl_private *priv;
+};
+
+static int nfcmrvl_inc_tx(struct nfcmrvl_usb_drv_data *drv_data)
+{
+        unsigned long flags;
+        int rv;
+
+        spin_lock_irqsave(&drv_data->txlock, flags);
+        rv = test_bit(NFCMRVL_USB_SUSPENDING, &drv_data->flags);
+        if (!rv)
+                drv_data->tx_in_flight++;
+        spin_unlock_irqrestore(&drv_data->txlock, flags);
+
+        return rv;
+}
+
+static void nfcmrvl_bulk_complete(struct urb *urb)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = urb->context;
+        int err;
+
+        dev_dbg(&drv_data->udev->dev, "urb %p status %d count %d",
+                urb, urb->status, urb->actual_length);
+
+        if (!test_bit(NFCMRVL_NCI_RUNNING, &drv_data->flags))
+                return;
+
+        if (!urb->status) {
+                if (nfcmrvl_nci_recv_frame(drv_data->priv, urb->transfer_buffer,
+                                           urb->actual_length) < 0)
+                        nfc_err(&drv_data->udev->dev, "corrupted Rx packet");
+        }
+
+        if (!test_bit(NFCMRVL_USB_BULK_RUNNING, &drv_data->flags))
+                return;
+
+        usb_anchor_urb(urb, &drv_data->bulk_anchor);
+        usb_mark_last_busy(drv_data->udev);
+
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err) {
+                /* -EPERM: urb is being killed;
+                 * -ENODEV: device got disconnected
+                 */
+                if (err != -EPERM && err != -ENODEV)
+                        nfc_err(&drv_data->udev->dev,
+                                "urb %p failed to resubmit (%d)", urb, -err);
+                usb_unanchor_urb(urb);
+        }
+}
+
+static int
+nfcmrvl_submit_bulk_urb(struct nfcmrvl_usb_drv_data *drv_data, gfp_t mem_flags)
+{
+        struct urb *urb;
+        unsigned char *buf;
+        unsigned int pipe;
+        int err, size = NFCMRVL_NCI_MAX_EVENT_SIZE;
+
+        if (!drv_data->bulk_rx_ep)
+                return -ENODEV;
+
+        urb = usb_alloc_urb(0, mem_flags);
+        if (!urb)
+                return -ENOMEM;
+
+        buf = kmalloc(size, mem_flags);
+        if (!buf) {
+                usb_free_urb(urb);
+                return -ENOMEM;
+        }
+
+        pipe = usb_rcvbulkpipe(drv_data->udev,
+                               drv_data->bulk_rx_ep->bEndpointAddress);
+
+        usb_fill_bulk_urb(urb, drv_data->udev, pipe, buf, size,
+                          nfcmrvl_bulk_complete, drv_data);
+
+        urb->transfer_flags |= URB_FREE_BUFFER;
+
+        usb_mark_last_busy(drv_data->udev);
+        usb_anchor_urb(urb, &drv_data->bulk_anchor);
+
+        err = usb_submit_urb(urb, mem_flags);
+        if (err) {
+                if (err != -EPERM && err != -ENODEV)
+                        nfc_err(&drv_data->udev->dev,
+                                "urb %p submission failed (%d)", urb, -err);
+                usb_unanchor_urb(urb);
+        }
+
+        usb_free_urb(urb);
+
+        return err;
+}
+
+static void nfcmrvl_tx_complete(struct urb *urb)
+{
+        struct sk_buff *skb = urb->context;
+        struct nci_dev *ndev = (struct nci_dev *)skb->dev;
+        struct nfcmrvl_private *priv = nci_get_drvdata(ndev);
+        struct nfcmrvl_usb_drv_data *drv_data = priv->drv_data;
+
+        nfc_info(priv->dev, "urb %p status %d count %d",
+                 urb, urb->status, urb->actual_length);
+
+        spin_lock(&drv_data->txlock);
+        drv_data->tx_in_flight--;
+        spin_unlock(&drv_data->txlock);
+
+        kfree(urb->setup_packet);
+        kfree_skb(skb);
+}
+
+static int nfcmrvl_usb_nci_open(struct nfcmrvl_private *priv)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = priv->drv_data;
+        int err;
+
+        err = usb_autopm_get_interface(drv_data->intf);
+        if (err)
+                return err;
+
+        drv_data->intf->needs_remote_wakeup = 1;
+
+        err = nfcmrvl_submit_bulk_urb(drv_data, GFP_KERNEL);
+        if (err)
+                goto failed;
+
+        set_bit(NFCMRVL_USB_BULK_RUNNING, &drv_data->flags);
+        nfcmrvl_submit_bulk_urb(drv_data, GFP_KERNEL);
+
+        usb_autopm_put_interface(drv_data->intf);
+        return 0;
+
+failed:
+        usb_autopm_put_interface(drv_data->intf);
+        return err;
+}
+
+static void nfcmrvl_usb_stop_traffic(struct nfcmrvl_usb_drv_data *drv_data)
+{
+        usb_kill_anchored_urbs(&drv_data->bulk_anchor);
+}
+
+static int nfcmrvl_usb_nci_close(struct nfcmrvl_private *priv)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = priv->drv_data;
+        int err;
+
+        cancel_work_sync(&drv_data->waker);
+
+        clear_bit(NFCMRVL_USB_BULK_RUNNING, &drv_data->flags);
+
+        nfcmrvl_usb_stop_traffic(drv_data);
+        usb_kill_anchored_urbs(&drv_data->tx_anchor);
+        err = usb_autopm_get_interface(drv_data->intf);
+        if (err)
+                goto failed;
+
+        drv_data->intf->needs_remote_wakeup = 0;
+        usb_autopm_put_interface(drv_data->intf);
+
+failed:
+        usb_scuttle_anchored_urbs(&drv_data->deferred);
+        return 0;
+}
+
+static int nfcmrvl_usb_nci_send(struct nfcmrvl_private *priv,
+                                struct sk_buff *skb)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = priv->drv_data;
+        struct urb *urb;
+        unsigned int pipe;
+        int err;
+
+        if (!drv_data->bulk_tx_ep)
+                return -ENODEV;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                return -ENOMEM;
+
+        pipe = usb_sndbulkpipe(drv_data->udev,
+                                drv_data->bulk_tx_ep->bEndpointAddress);
+
+        usb_fill_bulk_urb(urb, drv_data->udev, pipe, skb->data, skb->len,
+                          nfcmrvl_tx_complete, skb);
+
+        err = nfcmrvl_inc_tx(drv_data);
+        if (err) {
+                usb_anchor_urb(urb, &drv_data->deferred);
+                schedule_work(&drv_data->waker);
+                err = 0;
+                goto done;
+        }
+
+        usb_anchor_urb(urb, &drv_data->tx_anchor);
+
+        err = usb_submit_urb(urb, GFP_ATOMIC);
+        if (err) {
+                if (err != -EPERM && err != -ENODEV)
+                        nfc_err(&drv_data->udev->dev,
+                                "urb %p submission failed (%d)", urb, -err);
+                kfree(urb->setup_packet);
+                usb_unanchor_urb(urb);
+        } else {
+                usb_mark_last_busy(drv_data->udev);
+        }
+
+done:
+        usb_free_urb(urb);
+        return err;
+}
+
+static struct nfcmrvl_if_ops usb_ops = {
+        .nci_open = nfcmrvl_usb_nci_open,
+        .nci_close = nfcmrvl_usb_nci_close,
+        .nci_send = nfcmrvl_usb_nci_send,
+};
+
+static void nfcmrvl_waker(struct work_struct *work)
+{
+        struct nfcmrvl_usb_drv_data *drv_data =
+                        container_of(work, struct nfcmrvl_usb_drv_data, waker);
+        int err;
+
+        err = usb_autopm_get_interface(drv_data->intf);
+        if (err)
+                return;
+
+        usb_autopm_put_interface(drv_data->intf);
+}
+
+static int nfcmrvl_probe(struct usb_interface *intf,
+                         const struct usb_device_id *id)
+{
+        struct usb_endpoint_descriptor *ep_desc;
+        struct nfcmrvl_usb_drv_data *drv_data;
+        struct nfcmrvl_private *priv;
+        int i;
+        struct usb_device *udev = interface_to_usbdev(intf);
+
+        nfc_info(&udev->dev, "intf %p id %p", intf, id);
+
+        drv_data = devm_kzalloc(&intf->dev, sizeof(*drv_data), GFP_KERNEL);
+        if (!drv_data)
+                return -ENOMEM;
+
+        for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+                ep_desc = &intf->cur_altsetting->endpoint[i].desc;
+
+                if (!drv_data->bulk_tx_ep &&
+                    usb_endpoint_is_bulk_out(ep_desc)) {
+                        drv_data->bulk_tx_ep = ep_desc;
+                        continue;
+                }
+
+                if (!drv_data->bulk_rx_ep &&
+                    usb_endpoint_is_bulk_in(ep_desc)) {
+                        drv_data->bulk_rx_ep = ep_desc;
+                        continue;
+                }
+        }
+
+        if (!drv_data->bulk_tx_ep || !drv_data->bulk_rx_ep)
+                return -ENODEV;
+
+        drv_data->udev = udev;
+        drv_data->intf = intf;
+
+        INIT_WORK(&drv_data->waker, nfcmrvl_waker);
+        spin_lock_init(&drv_data->txlock);
+
+        init_usb_anchor(&drv_data->tx_anchor);
+        init_usb_anchor(&drv_data->bulk_anchor);
+        init_usb_anchor(&drv_data->deferred);
+
+        priv = nfcmrvl_nci_register_dev(drv_data, &usb_ops,
+                                        &drv_data->udev->dev);
+        if (IS_ERR(priv))
+                return PTR_ERR(priv);
+
+        drv_data->priv = priv;
+        priv->dev = &drv_data->udev->dev;
+
+        usb_set_intfdata(intf, drv_data);
+
+        return 0;
+}
+
+static void nfcmrvl_disconnect(struct usb_interface *intf)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = usb_get_intfdata(intf);
+
+        if (!drv_data)
+                return;
+
+        nfc_info(&drv_data->udev->dev, "intf %p", intf);
+
+        nfcmrvl_nci_unregister_dev(drv_data->priv);
+
+        usb_set_intfdata(drv_data->intf, NULL);
+}
+
+#ifdef CONFIG_PM
+static int nfcmrvl_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = usb_get_intfdata(intf);
+
+        nfc_info(&drv_data->udev->dev, "intf %p", intf);
+
+        if (drv_data->suspend_count++)
+                return 0;
+
+        spin_lock_irq(&drv_data->txlock);
+        if (!(PMSG_IS_AUTO(message) && drv_data->tx_in_flight)) {
+                set_bit(NFCMRVL_USB_SUSPENDING, &drv_data->flags);
+                spin_unlock_irq(&drv_data->txlock);
+        } else {
+                spin_unlock_irq(&drv_data->txlock);
+                drv_data->suspend_count--;
+                return -EBUSY;
+        }
+
+        nfcmrvl_usb_stop_traffic(drv_data);
+        usb_kill_anchored_urbs(&drv_data->tx_anchor);
+
+        return 0;
+}
+
+static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data)
+{
+        struct urb *urb;
+        int err;
+
+        while ((urb = usb_get_from_anchor(&drv_data->deferred))) {
+                err = usb_submit_urb(urb, GFP_ATOMIC);
+                if (err)
+                        break;
+
+                drv_data->tx_in_flight++;
+        }
+        usb_scuttle_anchored_urbs(&drv_data->deferred);
+}
+
+static int nfcmrvl_resume(struct usb_interface *intf)
+{
+        struct nfcmrvl_usb_drv_data *drv_data = usb_get_intfdata(intf);
+        int err = 0;
+
+        nfc_info(&drv_data->udev->dev, "intf %p", intf);
+
+        if (--drv_data->suspend_count)
+                return 0;
+
+        if (!test_bit(NFCMRVL_NCI_RUNNING, &drv_data->flags))
+                goto done;
+
+        if (test_bit(NFCMRVL_USB_BULK_RUNNING, &drv_data->flags)) {
+                err = nfcmrvl_submit_bulk_urb(drv_data, GFP_NOIO);
+                if (err) {
+                        clear_bit(NFCMRVL_USB_BULK_RUNNING, &drv_data->flags);
+                        goto failed;
+                }
+
+                nfcmrvl_submit_bulk_urb(drv_data, GFP_NOIO);
+        }
+
+        spin_lock_irq(&drv_data->txlock);
+        nfcmrvl_play_deferred(drv_data);
+        clear_bit(NFCMRVL_USB_SUSPENDING, &drv_data->flags);
+        spin_unlock_irq(&drv_data->txlock);
+
+        return 0;
+
+failed:
+        usb_scuttle_anchored_urbs(&drv_data->deferred);
+done:
+        spin_lock_irq(&drv_data->txlock);
+        clear_bit(NFCMRVL_USB_SUSPENDING, &drv_data->flags);
+        spin_unlock_irq(&drv_data->txlock);
+
+        return err;
+}
+#endif
+
+static struct usb_driver nfcmrvl_usb_driver = {
+        .name           = "nfcmrvl",
+        .probe          = nfcmrvl_probe,
+        .disconnect     = nfcmrvl_disconnect,
+#ifdef CONFIG_PM
+        .suspend        = nfcmrvl_suspend,
+        .resume         = nfcmrvl_resume,
+        .reset_resume   = nfcmrvl_resume,
+#endif
+        .id_table       = nfcmrvl_table,
+        .supports_autosuspend = 1,
+        .disable_hub_initiated_lpm = 1,
+        .soft_unbind = 1,
+};
+module_usb_driver(nfcmrvl_usb_driver);
+
+MODULE_AUTHOR("Marvell International Ltd.");
+MODULE_DESCRIPTION("Marvell NFC-over-USB driver ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/nfc/pn533.c b/drivers/nfc/pn533.c
index 3df19e657bc1..cf1a87bb74f8 100644
--- a/drivers/nfc/pn533.c
+++ b/drivers/nfc/pn533.c
@@ -521,6 +521,9 @@ static bool pn533_acr122_is_rx_frame_valid(void *_frame, struct pn533 *dev)
         if (frame->ccid.type != 0x83)
                 return false;
 
+        if (!frame->ccid.datalen)
+                return false;
+
         if (frame->data[frame->ccid.datalen - 2] == 0x63)
                 return false;
 
diff --git a/drivers/nfc/pn544/pn544.c b/drivers/nfc/pn544/pn544.c
index 51e21a87cd84..3df4a109cfad 100644
--- a/drivers/nfc/pn544/pn544.c
+++ b/drivers/nfc/pn544/pn544.c
@@ -195,42 +195,42 @@ static int pn544_hci_ready(struct nfc_hci_dev *hdev)
 
                 {{0x9e, 0xaa}, 0x01},
 
-                {{0x9b, 0xd1}, 0x0d},
-                {{0x9b, 0xd2}, 0x24},
-                {{0x9b, 0xd3}, 0x0a},
-                {{0x9b, 0xd4}, 0x22},
-                {{0x9b, 0xd5}, 0x08},
-                {{0x9b, 0xd6}, 0x1e},
-                {{0x9b, 0xdd}, 0x1c},
-
-                {{0x9b, 0x84}, 0x13},
-                {{0x99, 0x81}, 0x7f},
-                {{0x99, 0x31}, 0x70},
+                {{0x9b, 0xd1}, 0x17},
+                {{0x9b, 0xd2}, 0x58},
+                {{0x9b, 0xd3}, 0x10},
+                {{0x9b, 0xd4}, 0x47},
+                {{0x9b, 0xd5}, 0x0c},
+                {{0x9b, 0xd6}, 0x37},
+                {{0x9b, 0xdd}, 0x33},
+
+                {{0x9b, 0x84}, 0x00},
+                {{0x99, 0x81}, 0x79},
+                {{0x99, 0x31}, 0x79},
 
                 {{0x98, 0x00}, 0x3f},
 
-                {{0x9f, 0x09}, 0x00},
+                {{0x9f, 0x09}, 0x02},
 
                 {{0x9f, 0x0a}, 0x05},
 
                 {{0x9e, 0xd1}, 0xa1},
-                {{0x99, 0x23}, 0x00},
-
-                {{0x9e, 0x74}, 0x80},
+                {{0x99, 0x23}, 0x01},
 
+                {{0x9e, 0x74}, 0x00},
+                {{0x9e, 0x90}, 0x00},
                 {{0x9f, 0x28}, 0x10},
 
-                {{0x9f, 0x35}, 0x14},
+                {{0x9f, 0x35}, 0x04},
 
-                {{0x9f, 0x36}, 0x60},
+                {{0x9f, 0x36}, 0x11},
 
                 {{0x9c, 0x31}, 0x00},
 
-                {{0x9c, 0x32}, 0xc8},
+                {{0x9c, 0x32}, 0x00},
 
-                {{0x9c, 0x19}, 0x40},
+                {{0x9c, 0x19}, 0x0a},
 
-                {{0x9c, 0x1a}, 0x40},
+                {{0x9c, 0x1a}, 0x0a},
 
                 {{0x9c, 0x0c}, 0x00},
 
@@ -240,13 +240,13 @@ static int pn544_hci_ready(struct nfc_hci_dev *hdev)
 
                 {{0x9c, 0x13}, 0x00},
 
-                {{0x98, 0xa2}, 0x0e},
+                {{0x98, 0xa2}, 0x09},
 
-                {{0x98, 0x93}, 0x40},
+                {{0x98, 0x93}, 0x00},
 
-                {{0x98, 0x7d}, 0x02},
+                {{0x98, 0x7d}, 0x08},
                 {{0x98, 0x7e}, 0x00},
-                {{0x9f, 0xc8}, 0x01},
+                {{0x9f, 0xc8}, 0x00},
         };
         struct hw_config *p = hw_config;
         int count = ARRAY_SIZE(hw_config);
diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
index 8a0571eb2627..a8555f81cbba 100644
--- a/drivers/nfc/port100.c
+++ b/drivers/nfc/port100.c
@@ -1509,6 +1509,7 @@ static void port100_disconnect(struct usb_interface *interface)
 
         usb_free_urb(dev->in_urb);
         usb_free_urb(dev->out_urb);
+        usb_put_dev(dev->udev);
 
         kfree(dev->cmd);
 
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index 07891a3e316e..0d29624416c3 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -788,7 +788,6 @@ static int wb35_probe(struct usb_interface *intf,
         dev->flags = IEEE80211_HW_SIGNAL_UNSPEC;
         dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 
-        dev->channel_change_time = 1000;
         dev->max_signal = 100;
         dev->queues = 1;
 
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 776cbb80d098..e526a8cecb70 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -1857,6 +1857,7 @@ enum ieee80211_key_len {
         WLAN_KEY_LEN_CCMP = 16,
         WLAN_KEY_LEN_TKIP = 32,
         WLAN_KEY_LEN_AES_CMAC = 16,
+        WLAN_KEY_LEN_SMS4 = 32,
 };
 
 #define IEEE80211_WEP_IV_LEN            4
@@ -1902,6 +1903,7 @@ enum ieee80211_tdls_actioncode {
 #define WLAN_EXT_CAPA5_TDLS_PROHIBITED  BIT(6)
 
 #define WLAN_EXT_CAPA8_OPMODE_NOTIF     BIT(6)
+#define WLAN_EXT_CAPA8_TDLS_WIDE_BW_ENABLED     BIT(7)
 
 /* TDLS specific payload type in the LLC/SNAP header */
 #define WLAN_TDLS_SNAP_RFTYPE   0x2
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index 56c597793d6d..b1f84b05c67e 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -4640,6 +4640,14 @@ void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
  */
 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp);
 
+/**
+ * ieee80211_get_num_supported_channels - get number of channels device has
+ * @wiphy: the wiphy
+ *
+ * Return: the number of channels supported by the device.
+ */
+unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy);
+
 /* Logging, debugging and troubleshooting/diagnostic helpers. */
 
 /* wiphy_printk helpers, similar to dev_printk */
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index f838af816b56..f4ab2fb4d50c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1616,8 +1616,6 @@ enum ieee80211_hw_flags {
  * @extra_beacon_tailroom: tailroom to reserve in each beacon tx skb.
  *      Can be used by drivers to add extra IEs.
  *
- * @channel_change_time: time (in microseconds) it takes to change channels.
- *
  * @max_signal: Maximum value for signal (rssi) in RX information, used
  *      only when @IEEE80211_HW_SIGNAL_UNSPEC or @IEEE80211_HW_SIGNAL_DB
  *
@@ -1699,7 +1697,6 @@ struct ieee80211_hw {
         u32 flags;
         unsigned int extra_tx_headroom;
         unsigned int extra_beacon_tailroom;
-        int channel_change_time;
         int vif_data_size;
         int sta_data_size;
         int chanctx_data_size;
@@ -2122,6 +2119,11 @@ void ieee80211_free_txskb(struct ieee80211_hw *hw, struct sk_buff *skb);
  * appropriately (only the last frame may have %IEEE80211_TX_STATUS_EOSP)
  * and also take care of the EOSP and MORE_DATA bits in the frame.
  * The driver may also use ieee80211_sta_eosp() in this case.
+ *
+ * Note that if the driver ever buffers frames other than QoS-data
+ * frames, it must take care to never send a non-QoS-data frame as
+ * the last frame in a service period, adding a QoS-nulldata frame
+ * after a non-QoS-data frame if needed.
  */
 
 /**
diff --git a/include/net/nfc/digital.h b/include/net/nfc/digital.h
index 36acecd5f06c..81af21e9bcd4 100644
--- a/include/net/nfc/digital.h
+++ b/include/net/nfc/digital.h
@@ -122,6 +122,16 @@ typedef void (*nfc_digital_cmd_complete_t)(struct nfc_digital_dev *ddev,
  *      switch_rf to turn the radio on. A call to in|tg_configure_hw must turn
  *      the device radio on.
  * @abort_cmd: Discard the last sent command.
+ *
+ * Notes: Asynchronous functions have a timeout parameter. It is the driver
+ *      responsibility to call the digital stack back through the
+ *      nfc_digital_cmd_complete_t callback when no RF respsonse has been
+ *      received within the specified time (in milliseconds). In that case the
+ *      driver must set the resp sk_buff to ERR_PTR(-ETIMEDOUT).
+ *      Since the digital stack serializes commands to be sent, it's mandatory
+ *      for the driver to handle the timeout correctly. Otherwise the stack
+ *      would not be able to send new commands, waiting for the reply of the
+ *      current one.
  */
 struct nfc_digital_ops {
         int (*in_configure_hw)(struct nfc_digital_dev *ddev, int type,
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 0ff070e8f8de..1f9a0f5272fe 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -67,6 +67,7 @@ struct nci_ops {
         int (*open)(struct nci_dev *ndev);
         int (*close)(struct nci_dev *ndev);
         int (*send)(struct nci_dev *ndev, struct sk_buff *skb);
+        int (*setup)(struct nci_dev *ndev);
 };
 
 #define NCI_MAX_SUPPORTED_RF_INTERFACES         4
@@ -153,6 +154,7 @@ void nci_free_device(struct nci_dev *ndev);
 int nci_register_device(struct nci_dev *ndev);
 void nci_unregister_device(struct nci_dev *ndev);
 int nci_recv_frame(struct nci_dev *ndev, struct sk_buff *skb);
+int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, __u8 *val);
 
 static inline struct sk_buff *nci_skb_alloc(struct nci_dev *ndev,
                                             unsigned int len,
diff --git a/include/net/regulatory.h b/include/net/regulatory.h
index c96a0b86f342..b07cdc9fa454 100644
--- a/include/net/regulatory.h
+++ b/include/net/regulatory.h
@@ -96,6 +96,10 @@ struct regulatory_request {
  *      initiator is %REGDOM_SET_BY_CORE). Drivers that use
  *      wiphy_apply_custom_regulatory() should have this flag set
  *      or the regulatory core will set it for the wiphy.
+ *      If you use regulatory_hint() *after* using
+ *      wiphy_apply_custom_regulatory() the wireless core will
+ *      clear the REGULATORY_CUSTOM_REG for your wiphy as it would be
+ *      implied that the device somehow gained knowledge of its region.
  * @REGULATORY_STRICT_REG: tells us that the wiphy for this device
  *      has regulatory domain that it wishes to be considered as the
  *      superset for regulatory rules. After this device gets its regulatory
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 09d2e58a2ba7..f9ae9b85d4c1 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1035,6 +1035,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
                 return err;
         }
 
+        ieee80211_recalc_dtim(local, sdata);
         ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(dev);
@@ -3854,7 +3855,7 @@ static int ieee80211_set_qos_map(struct wiphy *wiphy,
                 new_qos_map = NULL;
         }
 
-        old_qos_map = rtnl_dereference(sdata->qos_map);
+        old_qos_map = sdata_dereference(sdata->qos_map, sdata);
         rcu_assign_pointer(sdata->qos_map, new_qos_map);
         if (old_qos_map)
                 kfree_rcu(old_qos_map, rcu_head);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 04b5a14c8a05..ebf80f3abd83 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -133,7 +133,15 @@ static ssize_t ieee80211_if_fmt_##name(					\
                          jiffies_to_msecs(sdata->field));               \
 }
 
-#define __IEEE80211_IF_FILE(name, _write)                               \
+#define _IEEE80211_IF_FILE_OPS(name, _read, _write)                     \
+static const struct file_operations name##_ops = {                      \
+        .read = (_read),                                                \
+        .write = (_write),                                              \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+}
+
+#define _IEEE80211_IF_FILE_R_FN(name)                                   \
 static ssize_t ieee80211_if_read_##name(struct file *file,              \
                                         char __user *userbuf,           \
                                         size_t count, loff_t *ppos)     \
@@ -141,28 +149,34 @@ static ssize_t ieee80211_if_read_##name(struct file *file,		\
         return ieee80211_if_read(file->private_data,                    \
                                  userbuf, count, ppos,                  \
                                  ieee80211_if_fmt_##name);              \
-}                                                                       \
-static const struct file_operations name##_ops = {                      \
-        .read = ieee80211_if_read_##name,                               \
-        .write = (_write),                                              \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
 }
 
-#define __IEEE80211_IF_FILE_W(name)                                     \
+#define _IEEE80211_IF_FILE_W_FN(name)                                   \
 static ssize_t ieee80211_if_write_##name(struct file *file,             \
                                          const char __user *userbuf,    \
                                          size_t count, loff_t *ppos)    \
 {                                                                       \
         return ieee80211_if_write(file->private_data, userbuf, count,   \
                                   ppos, ieee80211_if_parse_##name);     \
-}                                                                       \
-__IEEE80211_IF_FILE(name, ieee80211_if_write_##name)
+}
+
+#define IEEE80211_IF_FILE_R(name)                                       \
+        _IEEE80211_IF_FILE_R_FN(name)                                   \
+        _IEEE80211_IF_FILE_OPS(name, ieee80211_if_read_##name, NULL)
+
+#define IEEE80211_IF_FILE_W(name)                                       \
+        _IEEE80211_IF_FILE_W_FN(name)                                   \
+        _IEEE80211_IF_FILE_OPS(name, NULL, ieee80211_if_write_##name)
 
+#define IEEE80211_IF_FILE_RW(name)                                      \
+        _IEEE80211_IF_FILE_R_FN(name)                                   \
+        _IEEE80211_IF_FILE_W_FN(name)                                   \
+        _IEEE80211_IF_FILE_OPS(name, ieee80211_if_read_##name,          \
+                               ieee80211_if_write_##name)
 
 #define IEEE80211_IF_FILE(name, field, format)                          \
-                IEEE80211_IF_FMT_##format(name, field)                  \
-                __IEEE80211_IF_FILE(name, NULL)
+        IEEE80211_IF_FMT_##format(name, field)                          \
+        IEEE80211_IF_FILE_R(name)
 
 /* common attributes */
 IEEE80211_IF_FILE(drop_unencrypted, drop_unencrypted, DEC);
@@ -199,7 +213,7 @@ ieee80211_if_fmt_hw_queues(const struct ieee80211_sub_if_data *sdata,
 
         return len;
 }
-__IEEE80211_IF_FILE(hw_queues, NULL);
+IEEE80211_IF_FILE_R(hw_queues);
 
 /* STA attributes */
 IEEE80211_IF_FILE(bssid, u.mgd.bssid, MAC);
@@ -275,14 +289,7 @@ static ssize_t ieee80211_if_parse_smps(struct ieee80211_sub_if_data *sdata,
 
         return -EINVAL;
 }
-
-__IEEE80211_IF_FILE_W(smps);
-
-static ssize_t ieee80211_if_fmt_tkip_mic_test(
-        const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
-{
-        return -EOPNOTSUPP;
-}
+IEEE80211_IF_FILE_RW(smps);
 
 static ssize_t ieee80211_if_parse_tkip_mic_test(
         struct ieee80211_sub_if_data *sdata, const char *buf, int buflen)
@@ -349,8 +356,7 @@ static ssize_t ieee80211_if_parse_tkip_mic_test(
 
         return buflen;
 }
-
-__IEEE80211_IF_FILE_W(tkip_mic_test);
+IEEE80211_IF_FILE_W(tkip_mic_test);
 
 static ssize_t ieee80211_if_fmt_uapsd_queues(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
@@ -378,7 +384,7 @@ static ssize_t ieee80211_if_parse_uapsd_queues(
 
         return buflen;
 }
-__IEEE80211_IF_FILE_W(uapsd_queues);
+IEEE80211_IF_FILE_RW(uapsd_queues);
 
 static ssize_t ieee80211_if_fmt_uapsd_max_sp_len(
         const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
@@ -406,7 +412,7 @@ static ssize_t ieee80211_if_parse_uapsd_max_sp_len(
 
         return buflen;
 }
-__IEEE80211_IF_FILE_W(uapsd_max_sp_len);
+IEEE80211_IF_FILE_RW(uapsd_max_sp_len);
 
 /* AP attributes */
 IEEE80211_IF_FILE(num_mcast_sta, u.ap.num_mcast_sta, ATOMIC);
@@ -419,7 +425,7 @@ static ssize_t ieee80211_if_fmt_num_buffered_multicast(
         return scnprintf(buf, buflen, "%u\n",
                          skb_queue_len(&sdata->u.ap.ps.bc_buf));
 }
-__IEEE80211_IF_FILE(num_buffered_multicast, NULL);
+IEEE80211_IF_FILE_R(num_buffered_multicast);
 
 /* IBSS attributes */
 static ssize_t ieee80211_if_fmt_tsf(
@@ -468,9 +474,10 @@ static ssize_t ieee80211_if_parse_tsf(
                 }
         }
 
+        ieee80211_recalc_dtim(local, sdata);
         return buflen;
 }
-__IEEE80211_IF_FILE_W(tsf);
+IEEE80211_IF_FILE_RW(tsf);
 
 
 /* WDS attributes */
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 9a8be8f69224..fab7b91923e0 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -479,10 +479,9 @@ void ieee80211_request_smps(struct ieee80211_vif *vif,
                          vif->type != NL80211_IFTYPE_AP))
                 return;
 
-        if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
-                smps_mode = IEEE80211_SMPS_AUTOMATIC;
-
         if (vif->type == NL80211_IFTYPE_STATION) {
+                if (WARN_ON(smps_mode == IEEE80211_SMPS_OFF))
+                        smps_mode = IEEE80211_SMPS_AUTOMATIC;
                 if (sdata->u.mgd.driver_smps_mode == smps_mode)
                         return;
                 sdata->u.mgd.driver_smps_mode = smps_mode;
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 953b9e294547..3701930c6649 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -1800,6 +1800,8 @@ ieee80211_cs_get(struct ieee80211_local *local, u32 cipher,
 int ieee80211_cs_headroom(struct ieee80211_local *local,
                           struct cfg80211_crypto_settings *crypto,
                           enum nl80211_iftype iftype);
+void ieee80211_recalc_dtim(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata);
 
 #ifdef CONFIG_MAC80211_NOINLINE
 #define debug_noinline noinline
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 2bd5b552b2f6..d767cfb9b45f 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -846,17 +846,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 /* TODO: consider VHT for RX chains, hopefully it's the same */
         }
 
-        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
-                                      sizeof(void *) * channels, GFP_KERNEL);
-        if (!local->int_scan_req)
-                return -ENOMEM;
-
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (!local->hw.wiphy->bands[band])
-                        continue;
-                local->int_scan_req->rates[band] = (u32) -1;
-        }
-
         /* if low-level driver supports AP, we also support VLAN */
         if (local->hw.wiphy->interface_modes & BIT(NL80211_IFTYPE_AP)) {
                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_AP_VLAN);
@@ -880,6 +869,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                                 return -EINVAL;
         }
 
+        local->int_scan_req = kzalloc(sizeof(*local->int_scan_req) +
+                                      sizeof(void *) * channels, GFP_KERNEL);
+        if (!local->int_scan_req)
+                return -ENOMEM;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
+                if (!local->hw.wiphy->bands[band])
+                        continue;
+                local->int_scan_req->rates[band] = (u32) -1;
+        }
+
 #ifndef CONFIG_MAC80211_MESH
         /* mesh depends on Kconfig, but drivers should set it if they want */
         local->hw.wiphy->interface_modes &= ~BIT(NL80211_IFTYPE_MESH_POINT);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 5a74b249ba35..5b919cab1de0 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -807,6 +807,7 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata)
                 return -ENOMEM;
         }
 
+        ieee80211_recalc_dtim(local, sdata);
         ieee80211_bss_info_change_notify(sdata, changed);
 
         netif_carrier_on(sdata->dev);
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index cf83217103f9..e8f60aa2e848 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -437,6 +437,7 @@ __mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
         sta_info_pre_move_state(sta, IEEE80211_STA_AUTHORIZED);
 
         set_sta_flag(sta, WLAN_STA_WME);
+        sta->sta.wme = true;
 
         return sta;
 }
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5a2afe9583a8..c24ca0d0f469 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -3076,8 +3076,8 @@ void ieee80211_release_reorder_timeout(struct sta_info *sta, int tid)
 
 /* main receive path */
 
-static int prepare_for_handlers(struct ieee80211_rx_data *rx,
-                                struct ieee80211_hdr *hdr)
+static bool prepare_for_handlers(struct ieee80211_rx_data *rx,
+                                 struct ieee80211_hdr *hdr)
 {
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct sk_buff *skb = rx->skb;
@@ -3088,29 +3088,29 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_STATION:
                 if (!bssid && !sdata->u.mgd.use_4addr)
-                        return 0;
+                        return false;
                 if (!multicast &&
                     !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC) ||
                             sdata->u.mgd.use_4addr)
-                                return 0;
+                                return false;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
                 break;
         case NL80211_IFTYPE_ADHOC:
                 if (!bssid)
-                        return 0;
+                        return false;
                 if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
                     ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
-                        return 0;
+                        return false;
                 if (ieee80211_is_beacon(hdr->frame_control)) {
-                        return 1;
+                        return true;
                 } else if (!ieee80211_bssid_match(bssid, sdata->u.ibss.bssid)) {
-                        return 0;
+                        return false;
                 } else if (!multicast &&
                            !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
-                                return 0;
+                                return false;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 } else if (!rx->sta) {
                         int rate_idx;
@@ -3126,7 +3126,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 if (!multicast &&
                     !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
                         if (!(sdata->dev->flags & IFF_PROMISC))
-                                return 0;
+                                return false;
 
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
@@ -3135,7 +3135,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
         case NL80211_IFTYPE_AP:
                 if (!bssid) {
                         if (!ether_addr_equal(sdata->vif.addr, hdr->addr1))
-                                return 0;
+                                return false;
                 } else if (!ieee80211_bssid_match(bssid, sdata->vif.addr)) {
                         /*
                          * Accept public action frames even when the
@@ -3145,26 +3145,26 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                          */
                         if (!multicast &&
                             !ether_addr_equal(sdata->vif.addr, hdr->addr1))
-                                return 0;
+                                return false;
                         if (ieee80211_is_public_action(hdr, skb->len))
-                                return 1;
+                                return true;
                         if (!ieee80211_is_beacon(hdr->frame_control))
-                                return 0;
+                                return false;
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
                 }
                 break;
         case NL80211_IFTYPE_WDS:
                 if (bssid || !ieee80211_is_data(hdr->frame_control))
-                        return 0;
+                        return false;
                 if (!ether_addr_equal(sdata->u.wds.remote_addr, hdr->addr2))
-                        return 0;
+                        return false;
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 if (!ieee80211_is_public_action(hdr, skb->len) &&
                     !ieee80211_is_probe_req(hdr->frame_control) &&
                     !ieee80211_is_probe_resp(hdr->frame_control) &&
                     !ieee80211_is_beacon(hdr->frame_control))
-                        return 0;
+                        return false;
                 if (!ether_addr_equal(sdata->vif.addr, hdr->addr1) &&
                     !multicast)
                         status->rx_flags &= ~IEEE80211_RX_RA_MATCH;
@@ -3175,7 +3175,7 @@ static int prepare_for_handlers(struct ieee80211_rx_data *rx,
                 break;
         }
 
-        return 1;
+        return true;
 }
 
 /*
@@ -3191,13 +3191,11 @@ static bool ieee80211_prepare_and_rx_handle(struct ieee80211_rx_data *rx,
         struct ieee80211_sub_if_data *sdata = rx->sdata;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
         struct ieee80211_hdr *hdr = (void *)skb->data;
-        int prepares;
 
         rx->skb = skb;
         status->rx_flags |= IEEE80211_RX_RA_MATCH;
-        prepares = prepare_for_handlers(rx, hdr);
 
-        if (!prepares)
+        if (!prepare_for_handlers(rx, hdr))
                 return false;
 
         if (!consume) {
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index 4576ba0ff221..decd30c1e290 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -300,6 +300,35 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         if (!sta)
                 return NULL;
 
+        rcu_read_lock();
+        tx_latency = rcu_dereference(local->tx_latency);
+        /* init stations Tx latency statistics && TID bins */
+        if (tx_latency) {
+                sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
+                                      sizeof(struct ieee80211_tx_latency_stat),
+                                      GFP_ATOMIC);
+                if (!sta->tx_lat) {
+                        rcu_read_unlock();
+                        goto free;
+                }
+
+                if (tx_latency->n_ranges) {
+                        for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
+                                /* size of bins is size of the ranges +1 */
+                                sta->tx_lat[i].bin_count =
+                                        tx_latency->n_ranges + 1;
+                                sta->tx_lat[i].bins =
+                                        kcalloc(sta->tx_lat[i].bin_count,
+                                                sizeof(u32), GFP_ATOMIC);
+                                if (!sta->tx_lat[i].bins) {
+                                        rcu_read_unlock();
+                                        goto free;
+                                }
+                        }
+                }
+        }
+        rcu_read_unlock();
+
         spin_lock_init(&sta->lock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
@@ -324,10 +353,8 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         for (i = 0; i < ARRAY_SIZE(sta->chain_signal_avg); i++)
                 ewma_init(&sta->chain_signal_avg[i], 1024, 8);
 
-        if (sta_prepare_rate_control(local, sta, gfp)) {
-                kfree(sta);
-                return NULL;
-        }
+        if (sta_prepare_rate_control(local, sta, gfp))
+                goto free;
 
         for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
                 /*
@@ -371,34 +398,17 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
                 }
         }
 
-        rcu_read_lock();
-
-        tx_latency = rcu_dereference(local->tx_latency);
-        /* init stations Tx latency statistics && TID bins */
-        if (tx_latency)
-                sta->tx_lat = kzalloc(IEEE80211_NUM_TIDS *
-                                      sizeof(struct ieee80211_tx_latency_stat),
-                                      GFP_ATOMIC);
-
-        /*
-         * if Tx latency and bins are enabled and the previous allocation
-         * succeeded
-         */
-        if (tx_latency && tx_latency->n_ranges && sta->tx_lat)
-                for (i = 0; i < IEEE80211_NUM_TIDS; i++) {
-                        /* size of bins is size of the ranges +1 */
-                        sta->tx_lat[i].bin_count =
-                                tx_latency->n_ranges + 1;
-                        sta->tx_lat[i].bins  = kcalloc(sta->tx_lat[i].bin_count,
-                                                       sizeof(u32),
-                                                       GFP_ATOMIC);
-                }
-
-        rcu_read_unlock();
-
         sta_dbg(sdata, "Allocated STA %pM\n", sta->sta.addr);
-
         return sta;
+
+free:
+        if (sta->tx_lat) {
+                for (i = 0; i < IEEE80211_NUM_TIDS; i++)
+                        kfree(sta->tx_lat[i].bins);
+                kfree(sta->tx_lat);
+        }
+        kfree(sta);
+        return NULL;
 }
 
 static int sta_info_insert_check(struct sta_info *sta)
@@ -1143,7 +1153,8 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta)
 
 static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
                                          struct sta_info *sta, int tid,
-                                         enum ieee80211_frame_release_type reason)
+                                         enum ieee80211_frame_release_type reason,
+                                         bool call_driver)
 {
         struct ieee80211_local *local = sdata->local;
         struct ieee80211_qos_hdr *nullfunc;
@@ -1201,7 +1212,9 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
                        IEEE80211_TX_STATUS_EOSP |
                        IEEE80211_TX_CTL_REQ_TX_STATUS;
 
-        drv_allow_buffered_frames(local, sta, BIT(tid), 1, reason, false);
+        if (call_driver)
+                drv_allow_buffered_frames(local, sta, BIT(tid), 1,
+                                          reason, false);
 
         skb->dev = sdata->dev;
 
@@ -1217,6 +1230,17 @@ static void ieee80211_send_null_response(struct ieee80211_sub_if_data *sdata,
         rcu_read_unlock();
 }
 
+static int find_highest_prio_tid(unsigned long tids)
+{
+        /* lower 3 TIDs aren't ordered perfectly */
+        if (tids & 0xF8)
+                return fls(tids) - 1;
+        /* TID 0 is BE just like TID 3 */
+        if (tids & BIT(0))
+                return 0;
+        return fls(tids) - 1;
+}
+
 static void
 ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                                   int n_frames, u8 ignored_acs,
@@ -1224,7 +1248,6 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 {
         struct ieee80211_sub_if_data *sdata = sta->sdata;
         struct ieee80211_local *local = sdata->local;
-        bool found = false;
         bool more_data = false;
         int ac;
         unsigned long driver_release_tids = 0;
@@ -1235,9 +1258,7 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
         __skb_queue_head_init(&frames);
 
-        /*
-         * Get response frame(s) and more data bit for it.
-         */
+        /* Get response frame(s) and more data bit for the last one. */
         for (ac = 0; ac < IEEE80211_NUM_ACS; ac++) {
                 unsigned long tids;
 
@@ -1246,43 +1267,48 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
                 tids = ieee80211_tids_for_ac(ac);
 
-                if (!found) {
-                        driver_release_tids = sta->driver_buffered_tids & tids;
-                        if (driver_release_tids) {
-                                found = true;
-                        } else {
-                                struct sk_buff *skb;
-
-                                while (n_frames > 0) {
-                                        skb = skb_dequeue(&sta->tx_filtered[ac]);
-                                        if (!skb) {
-                                                skb = skb_dequeue(
-                                                        &sta->ps_tx_buf[ac]);
-                                                if (skb)
-                                                        local->total_ps_buffered--;
-                                        }
-                                        if (!skb)
-                                                break;
-                                        n_frames--;
-                                        found = true;
-                                        __skb_queue_tail(&frames, skb);
-                                }
-                        }
+                /* if we already have frames from software, then we can't also
+                 * release from hardware queues
+                 */
+                if (skb_queue_empty(&frames))
+                        driver_release_tids |= sta->driver_buffered_tids & tids;
 
-                        /*
-                         * If the driver has data on more than one TID then
+                if (driver_release_tids) {
+                        /* If the driver has data on more than one TID then
                          * certainly there's more data if we release just a
-                         * single frame now (from a single TID).
+                         * single frame now (from a single TID). This will
+                         * only happen for PS-Poll.
                          */
                         if (reason == IEEE80211_FRAME_RELEASE_PSPOLL &&
                             hweight16(driver_release_tids) > 1) {
                                 more_data = true;
                                 driver_release_tids =
-                                        BIT(ffs(driver_release_tids) - 1);
+                                        BIT(find_highest_prio_tid(
+                                                driver_release_tids));
                                 break;
                         }
+                } else {
+                        struct sk_buff *skb;
+
+                        while (n_frames > 0) {
+                                skb = skb_dequeue(&sta->tx_filtered[ac]);
+                                if (!skb) {
+                                        skb = skb_dequeue(
+                                                &sta->ps_tx_buf[ac]);
+                                        if (skb)
+                                                local->total_ps_buffered--;
+                                }
+                                if (!skb)
+                                        break;
+                                n_frames--;
+                                __skb_queue_tail(&frames, skb);
+                        }
                 }
 
+                /* If we have more frames buffered on this AC, then set the
+                 * more-data bit and abort the loop since we can't send more
+                 * data from other ACs before the buffered frames from this.
+                 */
                 if (!skb_queue_empty(&sta->tx_filtered[ac]) ||
                     !skb_queue_empty(&sta->ps_tx_buf[ac])) {
                         more_data = true;
@@ -1290,7 +1316,7 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                 }
         }
 
-        if (!found) {
+        if (skb_queue_empty(&frames) && !driver_release_tids) {
                 int tid;
 
                 /*
@@ -1311,15 +1337,13 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                 /* This will evaluate to 1, 3, 5 or 7. */
                 tid = 7 - ((ffs(~ignored_acs) - 1) << 1);
 
-                ieee80211_send_null_response(sdata, sta, tid, reason);
-                return;
-        }
-
-        if (!driver_release_tids) {
+                ieee80211_send_null_response(sdata, sta, tid, reason, true);
+        } else if (!driver_release_tids) {
                 struct sk_buff_head pending;
                 struct sk_buff *skb;
                 int num = 0;
                 u16 tids = 0;
+                bool need_null = false;
 
                 skb_queue_head_init(&pending);
 
@@ -1353,22 +1377,57 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                             ieee80211_is_qos_nullfunc(hdr->frame_control))
                                 qoshdr = ieee80211_get_qos_ctl(hdr);
 
-                        /* end service period after last frame */
-                        if (skb_queue_empty(&frames)) {
-                                if (reason == IEEE80211_FRAME_RELEASE_UAPSD &&
-                                    qoshdr)
-                                        *qoshdr |= IEEE80211_QOS_CTL_EOSP;
+                        tids |= BIT(skb->priority);
+
+                        __skb_queue_tail(&pending, skb);
+
+                        /* end service period after last frame or add one */
+                        if (!skb_queue_empty(&frames))
+                                continue;
 
+                        if (reason != IEEE80211_FRAME_RELEASE_UAPSD) {
+                                /* for PS-Poll, there's only one frame */
                                 info->flags |= IEEE80211_TX_STATUS_EOSP |
                                                IEEE80211_TX_CTL_REQ_TX_STATUS;
+                                break;
                         }
 
-                        if (qoshdr)
-                                tids |= BIT(*qoshdr & IEEE80211_QOS_CTL_TID_MASK);
-                        else
-                                tids |= BIT(0);
+                        /* For uAPSD, things are a bit more complicated. If the
+                         * last frame has a QoS header (i.e. is a QoS-data or
+                         * QoS-nulldata frame) then just set the EOSP bit there
+                         * and be done.
+                         * If the frame doesn't have a QoS header (which means
+                         * it should be a bufferable MMPDU) then we can't set
+                         * the EOSP bit in the QoS header; add a QoS-nulldata
+                         * frame to the list to send it after the MMPDU.
+                         *
+                         * Note that this code is only in the mac80211-release
+                         * code path, we assume that the driver will not buffer
+                         * anything but QoS-data frames, or if it does, will
+                         * create the QoS-nulldata frame by itself if needed.
+                         *
+                         * Cf. 802.11-2012 10.2.1.10 (c).
+                         */
+                        if (qoshdr) {
+                                *qoshdr |= IEEE80211_QOS_CTL_EOSP;
 
-                        __skb_queue_tail(&pending, skb);
+                                info->flags |= IEEE80211_TX_STATUS_EOSP |
+                                               IEEE80211_TX_CTL_REQ_TX_STATUS;
+                        } else {
+                                /* The standard isn't completely clear on this
+                                 * as it says the more-data bit should be set
+                                 * if there are more BUs. The QoS-Null frame
+                                 * we're about to send isn't buffered yet, we
+                                 * only create it below, but let's pretend it
+                                 * was buffered just in case some clients only
+                                 * expect more-data=0 when eosp=1.
+                                 */
+                                hdr->frame_control |=
+                                        cpu_to_le16(IEEE80211_FCTL_MOREDATA);
+                                need_null = true;
+                                num++;
+                        }
+                        break;
                 }
 
                 drv_allow_buffered_frames(local, sta, tids, num,
@@ -1376,17 +1435,22 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
 
                 ieee80211_add_pending_skbs(local, &pending);
 
+                if (need_null)
+                        ieee80211_send_null_response(
+                                sdata, sta, find_highest_prio_tid(tids),
+                                reason, false);
+
                 sta_info_recalc_tim(sta);
         } else {
                 /*
                  * We need to release a frame that is buffered somewhere in the
                  * driver ... it'll have to handle that.
-                 * Note that, as per the comment above, it'll also have to see
-                 * if there is more than just one frame on the specific TID that
-                 * we're releasing from, and it needs to set the more-data bit
-                 * accordingly if we tell it that there's no more data. If we do
-                 * tell it there's more data, then of course the more-data bit
-                 * needs to be set anyway.
+                 * Note that the driver also has to check the number of frames
+                 * on the TIDs we're releasing from - if there are more than
+                 * n_frames it has to set the more-data bit (if we didn't ask
+                 * it to set it anyway due to other buffered frames); if there
+                 * are fewer than n_frames it has to make sure to adjust that
+                 * to allow the service period to end properly.
                  */
                 drv_release_buffered_frames(local, sta, driver_release_tids,
                                             n_frames, reason, more_data);
@@ -1394,9 +1458,9 @@ ieee80211_sta_ps_deliver_response(struct sta_info *sta,
                 /*
                  * Note that we don't recalculate the TIM bit here as it would
                  * most likely have no effect at all unless the driver told us
-                 * that the TID became empty before returning here from the
+                 * that the TID(s) became empty before returning here from the
                  * release function.
-                 * Either way, however, when the driver tells us that the TID
+                 * Either way, however, when the driver tells us that the TID(s)
                  * became empty we'll do the TIM recalculation.
                  */
         }
@@ -1485,6 +1549,8 @@ void ieee80211_sta_set_buffered(struct ieee80211_sta *pubsta,
         if (WARN_ON(tid >= IEEE80211_NUM_TIDS))
                 return;
 
+        trace_api_sta_set_buffered(sta->local, pubsta, tid, buffered);
+
         if (buffered)
                 set_bit(tid, &sta->driver_buffered_tids);
         else
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index da9366632f37..a0b0aea76525 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1835,6 +1835,33 @@ TRACE_EVENT(api_eosp,
         )
 );
 
+TRACE_EVENT(api_sta_set_buffered,
+        TP_PROTO(struct ieee80211_local *local,
+                 struct ieee80211_sta *sta,
+                 u8 tid, bool buffered),
+
+        TP_ARGS(local, sta, tid, buffered),
+
+        TP_STRUCT__entry(
+                LOCAL_ENTRY
+                STA_ENTRY
+                __field(u8, tid)
+                __field(bool, buffered)
+        ),
+
+        TP_fast_assign(
+                LOCAL_ASSIGN;
+                STA_ASSIGN;
+                __entry->tid = tid;
+                __entry->buffered = buffered;
+        ),
+
+        TP_printk(
+                LOCAL_PR_FMT STA_PR_FMT " tid:%d buffered:%d",
+                LOCAL_PR_ARG, STA_PR_ARG, __entry->tid, __entry->buffered
+        )
+);
+
 /*
  * Tracing for internal functions
  * (which may also be called in response to driver calls)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index ef3555e16cf9..27c990bf2320 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -490,6 +490,7 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                 info->control.jiffies = jiffies;
                 info->control.vif = &tx->sdata->vif;
                 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+                info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
                 skb_queue_tail(&sta->ps_tx_buf[ac], tx->skb);
 
                 if (!timer_pending(&local->sta_cleanup))
@@ -1076,6 +1077,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx,
                         queued = true;
                         info->control.vif = &tx->sdata->vif;
                         info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
+                        info->flags &= ~IEEE80211_TX_TEMPORARY_FLAGS;
                         __skb_queue_tail(&tid_tx->pending, skb);
                         if (skb_queue_len(&tid_tx->pending) > STA_MAX_TX_BUFFER)
                                 purge_skb = __skb_dequeue(&tid_tx->pending);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index df00f1978a77..676dc0967f37 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -2734,3 +2734,44 @@ int ieee80211_parse_p2p_noa(const struct ieee80211_p2p_noa_attr *attr,
         return ret;
 }
 EXPORT_SYMBOL(ieee80211_parse_p2p_noa);
+
+void ieee80211_recalc_dtim(struct ieee80211_local *local,
+                           struct ieee80211_sub_if_data *sdata)
+{
+        u64 tsf = drv_get_tsf(local, sdata);
+        u64 dtim_count = 0;
+        u16 beacon_int = sdata->vif.bss_conf.beacon_int * 1024;
+        u8 dtim_period = sdata->vif.bss_conf.dtim_period;
+        struct ps_data *ps;
+        u8 bcns_from_dtim;
+
+        if (tsf == -1ULL || !beacon_int || !dtim_period)
+                return;
+
+        if (sdata->vif.type == NL80211_IFTYPE_AP ||
+            sdata->vif.type == NL80211_IFTYPE_AP_VLAN) {
+                if (!sdata->bss)
+                        return;
+
+                ps = &sdata->bss->ps;
+        } else if (ieee80211_vif_is_mesh(&sdata->vif)) {
+                ps = &sdata->u.mesh.ps;
+        } else {
+                return;
+        }
+
+        /*
+         * actually finds last dtim_count, mac80211 will update in
+         * __beacon_add_tim().
+         * dtim_count = dtim_period - (tsf / bcn_int) % dtim_period
+         */
+        do_div(tsf, beacon_int);
+        bcns_from_dtim = do_div(tsf, dtim_period);
+        /* just had a DTIM */
+        if (!bcns_from_dtim)
+                dtim_count = 0;
+        else
+                dtim_count = dtim_period - bcns_from_dtim;
+
+        ps->dtim_count = dtim_count;
+}
diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c
index 7313d379c0d3..21448d629b15 100644
--- a/net/mac80211/wpa.c
+++ b/net/mac80211/wpa.c
@@ -127,7 +127,7 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx)
                  * APs with pairwise keys should never receive Michael MIC
                  * errors for non-zero keyidx because these are reserved for
                  * group keys and only the AP is sending real multicast
-                 * frames in the BSS. (
+                 * frames in the BSS.
                  */
                 return RX_DROP_UNUSABLE;
         }
diff --git a/net/nfc/core.c b/net/nfc/core.c
index b675fa4a6f19..ca1e65f4b133 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -133,11 +133,8 @@ int nfc_dev_up(struct nfc_dev *dev)
                 dev->dev_up = true;
 
         /* We have to enable the device before discovering SEs */
-        if (dev->ops->discover_se) {
-                rc = dev->ops->discover_se(dev);
-                if (rc)
-                        pr_warn("SE discovery failed\n");
-        }
+        if (dev->ops->discover_se && dev->ops->discover_se(dev))
+                pr_err("SE discovery failed\n");
 
 error:
         device_unlock(&dev->dev);
diff --git a/net/nfc/digital_core.c b/net/nfc/digital_core.c
index 09fc95439955..c129d1571ca6 100644
--- a/net/nfc/digital_core.c
+++ b/net/nfc/digital_core.c
@@ -339,7 +339,6 @@ int digital_target_found(struct nfc_digital_dev *ddev,
         pr_debug("rf_tech=%d, protocol=%d\n", rf_tech, protocol);
 
         ddev->curr_rf_tech = rf_tech;
-        ddev->curr_protocol = protocol;
 
         if (DIGITAL_DRV_CAPS_IN_CRC(ddev)) {
                 ddev->skb_add_crc = digital_skb_add_crc_none;
@@ -541,8 +540,14 @@ static int digital_dep_link_up(struct nfc_dev *nfc_dev,
                                __u8 comm_mode, __u8 *gb, size_t gb_len)
 {
         struct nfc_digital_dev *ddev = nfc_get_drvdata(nfc_dev);
+        int rc;
+
+        rc = digital_in_send_atr_req(ddev, target, comm_mode, gb, gb_len);
 
-        return digital_in_send_atr_req(ddev, target, comm_mode, gb, gb_len);
+        if (!rc)
+                ddev->curr_protocol = NFC_PROTO_NFC_DEP;
+
+        return rc;
 }
 
 static int digital_dep_link_down(struct nfc_dev *nfc_dev)
@@ -557,6 +562,20 @@ static int digital_dep_link_down(struct nfc_dev *nfc_dev)
 static int digital_activate_target(struct nfc_dev *nfc_dev,
                                    struct nfc_target *target, __u32 protocol)
 {
+        struct nfc_digital_dev *ddev = nfc_get_drvdata(nfc_dev);
+
+        if (ddev->poll_tech_count) {
+                pr_err("Can't activate a target while polling\n");
+                return -EBUSY;
+        }
+
+        if (ddev->curr_protocol) {
+                pr_err("A target is already active\n");
+                return -EBUSY;
+        }
+
+        ddev->curr_protocol = protocol;
+
         return 0;
 }
 
@@ -565,6 +584,11 @@ static void digital_deactivate_target(struct nfc_dev *nfc_dev,
 {
         struct nfc_digital_dev *ddev = nfc_get_drvdata(nfc_dev);
 
+        if (!ddev->curr_protocol) {
+                pr_err("No active target\n");
+                return;
+        }
+
         ddev->curr_protocol = 0;
 }
 
diff --git a/net/nfc/digital_dep.c b/net/nfc/digital_dep.c
index 07bbc24fb4c7..43e450f78d0a 100644
--- a/net/nfc/digital_dep.c
+++ b/net/nfc/digital_dep.c
@@ -32,7 +32,6 @@
 #define DIGITAL_ATR_REQ_MIN_SIZE 16
 #define DIGITAL_ATR_REQ_MAX_SIZE 64
 
-#define DIGITAL_NFCID3_LEN ((u8)8)
 #define DIGITAL_LR_BITS_PAYLOAD_SIZE_254B 0x30
 #define DIGITAL_GB_BIT  0x02
 
@@ -206,10 +205,9 @@ int digital_in_send_atr_req(struct nfc_digital_dev *ddev,
         atr_req->dir = DIGITAL_NFC_DEP_FRAME_DIR_OUT;
         atr_req->cmd = DIGITAL_CMD_ATR_REQ;
         if (target->nfcid2_len)
-                memcpy(atr_req->nfcid3, target->nfcid2,
-                       max(target->nfcid2_len, DIGITAL_NFCID3_LEN));
+                memcpy(atr_req->nfcid3, target->nfcid2, NFC_NFCID2_MAXSIZE);
         else
-                get_random_bytes(atr_req->nfcid3, DIGITAL_NFCID3_LEN);
+                get_random_bytes(atr_req->nfcid3, NFC_NFCID3_MAXSIZE);
 
         atr_req->did = 0;
         atr_req->bs = 0;
@@ -382,6 +380,33 @@ int digital_in_send_dep_req(struct nfc_digital_dev *ddev,
                                    data_exch);
 }
 
+static void digital_tg_set_rf_tech(struct nfc_digital_dev *ddev, u8 rf_tech)
+{
+        ddev->curr_rf_tech = rf_tech;
+
+        ddev->skb_add_crc = digital_skb_add_crc_none;
+        ddev->skb_check_crc = digital_skb_check_crc_none;
+
+        if (DIGITAL_DRV_CAPS_TG_CRC(ddev))
+                return;
+
+        switch (ddev->curr_rf_tech) {
+        case NFC_DIGITAL_RF_TECH_106A:
+                ddev->skb_add_crc = digital_skb_add_crc_a;
+                ddev->skb_check_crc = digital_skb_check_crc_a;
+                break;
+
+        case NFC_DIGITAL_RF_TECH_212F:
+        case NFC_DIGITAL_RF_TECH_424F:
+                ddev->skb_add_crc = digital_skb_add_crc_f;
+                ddev->skb_check_crc = digital_skb_check_crc_f;
+                break;
+
+        default:
+                break;
+        }
+}
+
 static void digital_tg_recv_dep_req(struct nfc_digital_dev *ddev, void *arg,
                                     struct sk_buff *resp)
 {
@@ -472,11 +497,13 @@ int digital_tg_send_dep_res(struct nfc_digital_dev *ddev, struct sk_buff *skb)
 static void digital_tg_send_psl_res_complete(struct nfc_digital_dev *ddev,
                                              void *arg, struct sk_buff *resp)
 {
-        u8 rf_tech = PTR_ERR(arg);
+        u8 rf_tech = (unsigned long)arg;
 
         if (IS_ERR(resp))
                 return;
 
+        digital_tg_set_rf_tech(ddev, rf_tech);
+
         digital_tg_configure_hw(ddev, NFC_DIGITAL_CONFIG_RF_TECH, rf_tech);
 
         digital_tg_listen(ddev, 1500, digital_tg_recv_dep_req, NULL);
@@ -508,7 +535,7 @@ static int digital_tg_send_psl_res(struct nfc_digital_dev *ddev, u8 did,
         ddev->skb_add_crc(skb);
 
         rc = digital_tg_send_cmd(ddev, skb, 0, digital_tg_send_psl_res_complete,
-                                 ERR_PTR(rf_tech));
+                                 (void *)(unsigned long)rf_tech);
 
         if (rc)
                 kfree_skb(skb);
@@ -661,16 +688,10 @@ void digital_tg_recv_atr_req(struct nfc_digital_dev *ddev, void *arg,
 
         if (resp->data[0] == DIGITAL_NFC_DEP_NFCA_SOD_SB) {
                 min_size = DIGITAL_ATR_REQ_MIN_SIZE + 2;
-
-                ddev->curr_rf_tech = NFC_DIGITAL_RF_TECH_106A;
-                ddev->skb_add_crc = digital_skb_add_crc_a;
-                ddev->skb_check_crc = digital_skb_check_crc_a;
+                digital_tg_set_rf_tech(ddev, NFC_DIGITAL_RF_TECH_106A);
         } else {
                 min_size = DIGITAL_ATR_REQ_MIN_SIZE + 1;
-
-                ddev->curr_rf_tech = NFC_DIGITAL_RF_TECH_212F;
-                ddev->skb_add_crc = digital_skb_add_crc_f;
-                ddev->skb_check_crc = digital_skb_check_crc_f;
+                digital_tg_set_rf_tech(ddev, NFC_DIGITAL_RF_TECH_212F);
         }
 
         if (resp->len < min_size) {
@@ -678,10 +699,7 @@ void digital_tg_recv_atr_req(struct nfc_digital_dev *ddev, void *arg,
                 goto exit;
         }
 
-        if (DIGITAL_DRV_CAPS_TG_CRC(ddev)) {
-                ddev->skb_add_crc = digital_skb_add_crc_none;
-                ddev->skb_check_crc = digital_skb_check_crc_none;
-        }
+        ddev->curr_protocol = NFC_PROTO_NFC_DEP_MASK;
 
         rc = ddev->skb_check_crc(resp);
         if (rc) {
diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
index 3b9610031baa..d45b638e77c7 100644
--- a/net/nfc/hci/core.c
+++ b/net/nfc/hci/core.c
@@ -335,11 +335,8 @@ exit:
         kfree_skb(skb);
 
 exit_noskb:
-        if (r) {
-                /* TODO: There was an error dispatching the event,
-                 * how to propagate up to nfc core?
-                 */
-        }
+        if (r)
+                nfc_hci_driver_failure(hdev, r);
 }
 
 static void nfc_hci_cmd_timeout(unsigned long data)
diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c
index 693cd1aad582..bec6ed15f503 100644
--- a/net/nfc/llcp_commands.c
+++ b/net/nfc/llcp_commands.c
@@ -675,7 +675,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         do {
                 remote_miu = sock->remote_miu > LLCP_MAX_MIU ?
-                                local->remote_miu : sock->remote_miu;
+                                LLCP_DEFAULT_MIU : sock->remote_miu;
 
                 frag_len = min_t(size_t, remote_miu, remaining_len);
 
@@ -684,8 +684,10 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
                 pdu = llcp_allocate_pdu(sock, LLCP_PDU_I,
                                         frag_len + LLCP_SEQUENCE_SIZE);
-                if (pdu == NULL)
+                if (pdu == NULL) {
+                        kfree(msg_data);
                         return -ENOMEM;
+                }
 
                 skb_put(pdu, LLCP_SEQUENCE_SIZE);
 
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index 1349074e1ffc..6184bd1fba3a 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -943,7 +943,6 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
         new_sock->local = nfc_llcp_local_get(local);
         new_sock->rw = sock->rw;
         new_sock->miux = sock->miux;
-        new_sock->remote_miu = local->remote_miu;
         new_sock->nfc_protocol = sock->nfc_protocol;
         new_sock->dsap = ssap;
         new_sock->target_idx = local->target_idx;
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 69fbc8dadba7..4a53bb58a463 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -700,7 +700,6 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 
         llcp_sock->dev = dev;
         llcp_sock->local = nfc_llcp_local_get(local);
-        llcp_sock->remote_miu = llcp_sock->local->remote_miu;
         llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
         if (llcp_sock->ssap == LLCP_SAP_MAX) {
                 ret = -ENOMEM;
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index f0e955e3a385..46bda010bf11 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -301,6 +301,9 @@ static int nci_open_device(struct nci_dev *ndev)
         rc = __nci_request(ndev, nci_reset_req, 0,
                            msecs_to_jiffies(NCI_RESET_TIMEOUT));
 
+        if (ndev->ops->setup(ndev))
+                ndev->ops->setup(ndev);
+
         if (!rc) {
                 rc = __nci_request(ndev, nci_init_req, 0,
                                    msecs_to_jiffies(NCI_INIT_TIMEOUT));
@@ -361,6 +364,8 @@ static int nci_close_device(struct nci_dev *ndev)
                       msecs_to_jiffies(NCI_RESET_TIMEOUT));
         clear_bit(NCI_INIT, &ndev->flags);
 
+        del_timer_sync(&ndev->cmd_timer);
+
         /* Flush cmd wq */
         flush_workqueue(ndev->cmd_wq);
 
@@ -408,12 +413,26 @@ static int nci_dev_down(struct nfc_dev *nfc_dev)
         return nci_close_device(ndev);
 }
 
+int nci_set_config(struct nci_dev *ndev, __u8 id, size_t len, __u8 *val)
+{
+        struct nci_set_config_param param;
+
+        if (!val || !len)
+                return 0;
+
+        param.id = id;
+        param.len = len;
+        param.val = val;
+
+        return __nci_request(ndev, nci_set_config_req, (unsigned long)&param,
+                             msecs_to_jiffies(NCI_SET_CONFIG_TIMEOUT));
+}
+EXPORT_SYMBOL(nci_set_config);
+
 static int nci_set_local_general_bytes(struct nfc_dev *nfc_dev)
 {
         struct nci_dev *ndev = nfc_get_drvdata(nfc_dev);
         struct nci_set_config_param param;
-        __u8 local_gb[NFC_MAX_GT_LEN];
-        int i;
 
         param.val = nfc_get_local_general_bytes(nfc_dev, &param.len);
         if ((param.val == NULL) || (param.len == 0))
@@ -422,11 +441,7 @@ static int nci_set_local_general_bytes(struct nfc_dev *nfc_dev)
         if (param.len > NFC_MAX_GT_LEN)
                 return -EINVAL;
 
-        for (i = 0; i < param.len; i++)
-                local_gb[param.len-1-i] = param.val[i];
-
         param.id = NCI_PN_ATR_REQ_GEN_BYTES;
-        param.val = local_gb;
 
         return nci_request(ndev, nci_set_config_req, (unsigned long)&param,
                            msecs_to_jiffies(NCI_SET_CONFIG_TIMEOUT));
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 4fa555e4dedc..7a742594916e 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -5257,12 +5257,7 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
                         goto unlock;
                 }
         } else {
-                enum ieee80211_band band;
-                n_channels = 0;
-
-                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                        if (wiphy->bands[band])
-                                n_channels += wiphy->bands[band]->n_channels;
+                n_channels = ieee80211_get_num_supported_channels(wiphy);
         }
 
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
@@ -5470,11 +5465,7 @@ static int nl80211_start_sched_scan(struct sk_buff *skb,
                 if (!n_channels)
                         return -EINVAL;
         } else {
-                n_channels = 0;
-
-                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                        if (wiphy->bands[band])
-                                n_channels += wiphy->bands[band]->n_channels;
+                n_channels = ieee80211_get_num_supported_channels(wiphy);
         }
 
         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
@@ -6767,6 +6758,55 @@ __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
         return NULL;
 }
 
+struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
+                                           enum nl80211_commands cmd,
+                                           enum nl80211_attrs attr,
+                                           int vendor_event_idx,
+                                           int approxlen, gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        const struct nl80211_vendor_cmd_info *info;
+
+        switch (cmd) {
+        case NL80211_CMD_TESTMODE:
+                if (WARN_ON(vendor_event_idx != -1))
+                        return NULL;
+                info = NULL;
+                break;
+        case NL80211_CMD_VENDOR:
+                if (WARN_ON(vendor_event_idx < 0 ||
+                            vendor_event_idx >= wiphy->n_vendor_events))
+                        return NULL;
+                info = &wiphy->vendor_events[vendor_event_idx];
+                break;
+        default:
+                WARN_ON(1);
+                return NULL;
+        }
+
+        return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
+                                           cmd, attr, info, gfp);
+}
+EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
+
+void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
+{
+        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
+        void *hdr = ((void **)skb->cb)[1];
+        struct nlattr *data = ((void **)skb->cb)[2];
+        enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
+
+        nla_nest_end(skb, data);
+        genlmsg_end(skb, hdr);
+
+        if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
+                mcgrp = NL80211_MCGRP_VENDOR;
+
+        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
+                                mcgrp, gfp);
+}
+EXPORT_SYMBOL(__cfg80211_send_event_skb);
+
 #ifdef CONFIG_NL80211_TESTMODE
 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
 {
@@ -6893,55 +6933,6 @@ static int nl80211_testmode_dump(struct sk_buff *skb,
         rtnl_unlock();
         return err;
 }
-
-struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
-                                           enum nl80211_commands cmd,
-                                           enum nl80211_attrs attr,
-                                           int vendor_event_idx,
-                                           int approxlen, gfp_t gfp)
-{
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-        const struct nl80211_vendor_cmd_info *info;
-
-        switch (cmd) {
-        case NL80211_CMD_TESTMODE:
-                if (WARN_ON(vendor_event_idx != -1))
-                        return NULL;
-                info = NULL;
-                break;
-        case NL80211_CMD_VENDOR:
-                if (WARN_ON(vendor_event_idx < 0 ||
-                            vendor_event_idx >= wiphy->n_vendor_events))
-                        return NULL;
-                info = &wiphy->vendor_events[vendor_event_idx];
-                break;
-        default:
-                WARN_ON(1);
-                return NULL;
-        }
-
-        return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
-                                           cmd, attr, info, gfp);
-}
-EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
-
-void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
-{
-        struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
-        void *hdr = ((void **)skb->cb)[1];
-        struct nlattr *data = ((void **)skb->cb)[2];
-        enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
-
-        nla_nest_end(skb, data);
-        genlmsg_end(skb, hdr);
-
-        if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
-                mcgrp = NL80211_MCGRP_VENDOR;
-
-        genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
-                                mcgrp, gfp);
-}
-EXPORT_SYMBOL(__cfg80211_send_event_skb);
 #endif
 
 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 7d20d844ca60..9b897fca7487 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1853,6 +1853,8 @@ int regulatory_hint(struct wiphy *wiphy, const char *alpha2)
         if (WARN_ON(!alpha2 || !wiphy))
                 return -EINVAL;
 
+        wiphy->regulatory_flags &= ~REGULATORY_CUSTOM_REG;
+
         request = kzalloc(sizeof(struct regulatory_request), GFP_KERNEL);
         if (!request)
                 return -ENOMEM;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index a32d52a04c27..b528e31da2cf 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1089,11 +1089,8 @@ int cfg80211_wext_siwscan(struct net_device *dev,
         /* Determine number of channels, needed to allocate creq */
         if (wreq && wreq->num_channels)
                 n_channels = wreq->num_channels;
-        else {
-                for (band = 0; band < IEEE80211_NUM_BANDS; band++)
-                        if (wiphy->bands[band])
-                                n_channels += wiphy->bands[band]->n_channels;
-        }
+        else
+                n_channels = ieee80211_get_num_supported_channels(wiphy);
 
         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                        n_channels * sizeof(void *),
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 5d6e7bb2fc89..a63509118508 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -70,18 +70,11 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev)
         if (rdev->scan_req)
                 return -EBUSY;
 
-        if (wdev->conn->params.channel) {
+        if (wdev->conn->params.channel)
                 n_channels = 1;
-        } else {
-                enum ieee80211_band band;
-                n_channels = 0;
+        else
+                n_channels = ieee80211_get_num_supported_channels(wdev->wiphy);
 
-                for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                        if (!wdev->wiphy->bands[band])
-                                continue;
-                        n_channels += wdev->wiphy->bands[band]->n_channels;
-                }
-        }
         request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
                           sizeof(request->channels[0]) * n_channels,
                           GFP_KERNEL);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 5618888853b2..d39c37104ae2 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -879,7 +879,9 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
 
                 dev->ieee80211_ptr->use_4addr = false;
                 dev->ieee80211_ptr->mesh_id_up_len = 0;
+                wdev_lock(dev->ieee80211_ptr);
                 rdev_set_qos_map(rdev, dev, NULL);
+                wdev_unlock(dev->ieee80211_ptr);
 
                 switch (otype) {
                 case NL80211_IFTYPE_AP:
@@ -1479,6 +1481,19 @@ int ieee80211_get_ratemask(struct ieee80211_supported_band *sband,
         return 0;
 }
 
+unsigned int ieee80211_get_num_supported_channels(struct wiphy *wiphy)
+{
+        enum ieee80211_band band;
+        unsigned int n_channels = 0;
+
+        for (band = 0; band < IEEE80211_NUM_BANDS; band++)
+                if (wiphy->bands[band])
+                        n_channels += wiphy->bands[band]->n_channels;
+
+        return n_channels;
+}
+EXPORT_SYMBOL(ieee80211_get_num_supported_channels);
+
 /* See IEEE 802.1H for LLC/SNAP encapsulation/decapsulation */
 /* Ethernet-II snap header (RFC1042 for most EtherTypes) */
 const unsigned char rfc1042_header[] __aligned(2) =
diff --git a/net/wireless/wext-compat.c b/net/wireless/wext-compat.c
index e7c6e862580d..5661a54ac7ee 100644
--- a/net/wireless/wext-compat.c
+++ b/net/wireless/wext-compat.c
@@ -370,7 +370,7 @@ static int cfg80211_wext_siwretry(struct net_device *dev,
         u8 oshort = wdev->wiphy->retry_short;
         int err;
 
-        if (retry->disabled ||
+        if (retry->disabled || retry->value < 1 || retry->value > 255 ||
             (retry->flags & IW_RETRY_TYPE) != IW_RETRY_LIMIT)
                 return -EINVAL;
 
@@ -412,9 +412,9 @@ int cfg80211_wext_giwretry(struct net_device *dev,
                  * First return short value, iwconfig will ask long value
                  * later if needed
                  */
-                retry->flags |= IW_RETRY_LIMIT;
+                retry->flags |= IW_RETRY_LIMIT | IW_RETRY_SHORT;
                 retry->value = wdev->wiphy->retry_short;
-                if (wdev->wiphy->retry_long != wdev->wiphy->retry_short)
+                if (wdev->wiphy->retry_long == wdev->wiphy->retry_short)
                         retry->flags |= IW_RETRY_LONG;
 
                 return 0;