Merge remote-tracking branch 'wireless-next/master' into iwlwifi-next

281 files changed, 10550 insertions, 3716 deletions

diff --git a/Documentation/device-mapper/dm-raid.txt b/Documentation/device-mapper/dm-raid.txt
index 56fb62b09fc5..b428556197c9 100644
--- a/Documentation/device-mapper/dm-raid.txt
+++ b/Documentation/device-mapper/dm-raid.txt
@@ -30,6 +30,7 @@ The target is named "raid" and it accepts the following parameters:
   raid10        Various RAID10 inspired algorithms chosen by additional params
                 - RAID10: Striped Mirrors (aka 'Striping on top of mirrors')
                 - RAID1E: Integrated Adjacent Stripe Mirroring
+                - RAID1E: Integrated Offset Stripe Mirroring
                 -  and other similar RAID10 variants
 
   Reference: Chapter 4 of
@@ -64,15 +65,15 @@ The target is named "raid" and it accepts the following parameters:
                 synchronisation state for each region.
 
         [raid10_copies   <# copies>]
-        [raid10_format   near]
+        [raid10_format   <near|far|offset>]
                 These two options are used to alter the default layout of
                 a RAID10 configuration.  The number of copies is can be
-                specified, but the default is 2.  There are other variations
-                to how the copies are laid down - the default and only current
-                option is "near".  Near copies are what most people think of
-                with respect to mirroring.  If these options are left
-                unspecified, or 'raid10_copies 2' and/or 'raid10_format near'
-                are given, then the layouts for 2, 3 and 4 devices are:
+                specified, but the default is 2.  There are also three
+                variations to how the copies are laid down - the default
+                is "near".  Near copies are what most people think of with
+                respect to mirroring.  If these options are left unspecified,
+                or 'raid10_copies 2' and/or 'raid10_format near' are given,
+                then the layouts for 2, 3 and 4 devices are:
                 2 drives         3 drives          4 drives
                 --------         ----------        --------------
                 A1  A1           A1  A1  A2        A1  A1  A2  A2
@@ -85,6 +86,33 @@ The target is named "raid" and it accepts the following parameters:
                 3-device layout is what might be called a 'RAID1E - Integrated
                 Adjacent Stripe Mirroring'.
 
+                If 'raid10_copies 2' and 'raid10_format far', then the layouts
+                for 2, 3 and 4 devices are:
+                2 drives             3 drives             4 drives
+                --------             --------------       --------------------
+                A1  A2               A1   A2   A3         A1   A2   A3   A4
+                A3  A4               A4   A5   A6         A5   A6   A7   A8
+                A5  A6               A7   A8   A9         A9   A10  A11  A12
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+                A2  A1               A3   A1   A2         A2   A1   A4   A3
+                A4  A3               A6   A4   A5         A6   A5   A8   A7
+                A6  A5               A9   A7   A8         A10  A9   A12  A11
+                ..  ..               ..   ..   ..         ..   ..   ..   ..
+
+                If 'raid10_copies 2' and 'raid10_format offset', then the
+                layouts for 2, 3 and 4 devices are:
+                2 drives       3 drives           4 drives
+                --------       ------------       -----------------
+                A1  A2         A1  A2  A3         A1  A2  A3  A4
+                A2  A1         A3  A1  A2         A2  A1  A4  A3
+                A3  A4         A4  A5  A6         A5  A6  A7  A8
+                A4  A3         A6  A4  A5         A6  A5  A8  A7
+                A5  A6         A7  A8  A9         A9  A10 A11 A12
+                A6  A5         A9  A7  A8         A10 A9  A12 A11
+                ..  ..         ..  ..  ..         ..  ..  ..  ..
+                Here we see layouts closely akin to 'RAID1E - Integrated
+                Offset Stripe Mirroring'.
+
 <#raid_devs>: The number of devices composing the array.
         Each device consists of two entries.  The first is the device
         containing the metadata (if any); the second is the one containing the
@@ -142,3 +170,5 @@ Version History
 1.3.0   Added support for RAID 10
 1.3.1   Allow device replacement/rebuild for RAID 10
 1.3.2   Fix/improve redundancy checking for RAID10
+1.4.0   Non-functional change.  Removes arg from mapping function.
+1.4.1   Add RAID10 "far" and "offset" algorithm support.
diff --git a/Documentation/networking/tuntap.txt b/Documentation/networking/tuntap.txt
index c0aab985bad9..949d5dcdd9a3 100644
--- a/Documentation/networking/tuntap.txt
+++ b/Documentation/networking/tuntap.txt
@@ -105,6 +105,83 @@ Copyright (C) 1999-2000 Maxim Krasnyansky <max_mk@yahoo.com>
      Proto [2 bytes]
      Raw protocol(IP, IPv6, etc) frame.
 
+  3.3 Multiqueue tuntap interface:
+
+  From version 3.8, Linux supports multiqueue tuntap which can uses multiple
+  file descriptors (queues) to parallelize packets sending or receiving. The
+  device allocation is the same as before, and if user wants to create multiple
+  queues, TUNSETIFF with the same device name must be called many times with
+  IFF_MULTI_QUEUE flag.
+
+  char *dev should be the name of the device, queues is the number of queues to
+  be created, fds is used to store and return the file descriptors (queues)
+  created to the caller. Each file descriptor were served as the interface of a
+  queue which could be accessed by userspace.
+
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+
+  int tun_alloc_mq(char *dev, int queues, int *fds)
+  {
+      struct ifreq ifr;
+      int fd, err, i;
+
+      if (!dev)
+          return -1;
+
+      memset(&ifr, 0, sizeof(ifr));
+      /* Flags: IFF_TUN   - TUN device (no Ethernet headers)
+       *        IFF_TAP   - TAP device
+       *
+       *        IFF_NO_PI - Do not provide packet information
+       *        IFF_MULTI_QUEUE - Create a queue of multiqueue device
+       */
+      ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_MULTI_QUEUE;
+      strcpy(ifr.ifr_name, dev);
+
+      for (i = 0; i < queues; i++) {
+          if ((fd = open("/dev/net/tun", O_RDWR)) < 0)
+             goto err;
+          err = ioctl(fd, TUNSETIFF, (void *)&ifr);
+          if (err) {
+             close(fd);
+             goto err;
+          }
+          fds[i] = fd;
+      }
+
+      return 0;
+  err:
+      for (--i; i >= 0; i--)
+          close(fds[i]);
+      return err;
+  }
+
+  A new ioctl(TUNSETQUEUE) were introduced to enable or disable a queue. When
+  calling it with IFF_DETACH_QUEUE flag, the queue were disabled. And when
+  calling it with IFF_ATTACH_QUEUE flag, the queue were enabled. The queue were
+  enabled by default after it was created through TUNSETIFF.
+
+  fd is the file descriptor (queue) that we want to enable or disable, when
+  enable is true we enable it, otherwise we disable it
+
+  #include <linux/if.h>
+  #include <linux/if_tun.h>
+
+  int tun_set_queue(int fd, int enable)
+  {
+      struct ifreq ifr;
+
+      memset(&ifr, 0, sizeof(ifr));
+
+      if (enable)
+         ifr.ifr_flags = IFF_ATTACH_QUEUE;
+      else
+         ifr.ifr_flags = IFF_DETACH_QUEUE;
+
+      return ioctl(fd, TUNSETQUEUE, (void *)&ifr);
+  }
+
 Universal TUN/TAP device driver Frequently Asked Question.
    
 1. What platforms are supported by TUN/TAP driver ?
diff --git a/MAINTAINERS b/MAINTAINERS
index e95b1e944eb7..143507e7f6df 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -114,12 +114,6 @@ Maintainers List (try to look for most precise areas first)
 
                 -----------------------------------
 
-3C505 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/3c505*
-
 3C59X NETWORK DRIVER
 M:      Steffen Klassert <klassert@mathematik.tu-chemnitz.de>
 L:      netdev@vger.kernel.org
@@ -2361,12 +2355,6 @@ W:	http://www.arm.linux.org.uk/
 S:      Maintained
 F:      drivers/video/cyber2000fb.*
 
-CYCLADES 2X SYNC CARD DRIVER
-M:      Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
-W:      http://oops.ghostprotocols.net:81/blog
-S:      Maintained
-F:      drivers/net/wan/cycx*
-
 CYCLADES ASYNC MUX DRIVER
 W:      http://www.cyclades.com/
 S:      Orphan
@@ -3067,12 +3055,6 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/kristoffer/linux-hpc.git
 F:      drivers/video/s1d13xxxfb.c
 F:      include/video/s1d13xxxfb.h
 
-ETHEREXPRESS-16 NETWORK DRIVER
-M:      Philip Blundell <philb@gnu.org>
-L:      netdev@vger.kernel.org
-S:      Maintained
-F:      drivers/net/ethernet/i825xx/eexpress.*
-
 ETHERNET BRIDGE
 M:      Stephen Hemminger <stephen@networkplumber.org>
 L:      bridge@lists.linux-foundation.org
@@ -8504,7 +8486,7 @@ F:	drivers/usb/gadget/*uvc*.c
 F:      drivers/usb/gadget/webcam.c
 
 USB WIRELESS RNDIS DRIVER (rndis_wlan)
-M:      Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+M:      Jussi Kivilinna <jussi.kivilinna@iki.fi>
 L:      linux-wireless@vger.kernel.org
 S:      Maintained
 F:      drivers/net/wireless/rndis_wlan.c
diff --git a/arch/powerpc/crypto/sha1-powerpc-asm.S b/arch/powerpc/crypto/sha1-powerpc-asm.S
index a5f8264d2d3c..125e16520061 100644
--- a/arch/powerpc/crypto/sha1-powerpc-asm.S
+++ b/arch/powerpc/crypto/sha1-powerpc-asm.S
@@ -113,7 +113,7 @@
         STEPUP4((t)+16, fn)
 
 _GLOBAL(powerpc_sha_transform)
-        PPC_STLU r1,-STACKFRAMESIZE(r1)
+        PPC_STLU r1,-INT_FRAME_SIZE(r1)
         SAVE_8GPRS(14, r1)
         SAVE_10GPRS(22, r1)
 
@@ -175,5 +175,5 @@ _GLOBAL(powerpc_sha_transform)
 
         REST_8GPRS(14, r1)
         REST_10GPRS(22, r1)
-        addi    r1,r1,STACKFRAMESIZE
+        addi    r1,r1,INT_FRAME_SIZE
         blr
diff --git a/arch/powerpc/include/asm/bitops.h b/arch/powerpc/include/asm/bitops.h
index ef918a2328bb..08bd299c75b1 100644
--- a/arch/powerpc/include/asm/bitops.h
+++ b/arch/powerpc/include/asm/bitops.h
@@ -52,8 +52,6 @@
 #define smp_mb__before_clear_bit()      smp_mb()
 #define smp_mb__after_clear_bit()       smp_mb()
 
-#define BITOP_LE_SWIZZLE        ((BITS_PER_LONG-1) & ~0x7)
-
 /* Macro for generating the ***_bits() functions */
 #define DEFINE_BITOP(fn, op, prefix, postfix)   \
 static __inline__ void fn(unsigned long mask,   \
diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
index e66586122030..c9c67fc888c9 100644
--- a/arch/powerpc/include/asm/reg.h
+++ b/arch/powerpc/include/asm/reg.h
@@ -266,7 +266,8 @@
 #define SPRN_HSRR0      0x13A   /* Hypervisor Save/Restore 0 */
 #define SPRN_HSRR1      0x13B   /* Hypervisor Save/Restore 1 */
 #define SPRN_FSCR       0x099   /* Facility Status & Control Register */
-#define FSCR_TAR        (1<<8)  /* Enable Target Adress Register */
+#define   FSCR_TAR      (1 << (63-55)) /* Enable Target Address Register */
+#define   FSCR_DSCR     (1 << (63-61)) /* Enable Data Stream Control Register */
 #define SPRN_TAR        0x32f   /* Target Address Register */
 #define SPRN_LPCR       0x13E   /* LPAR Control Register */
 #define   LPCR_VPM0     (1ul << (63-0))
diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
index 535b6d8a41cc..ebbec52d21bd 100644
--- a/arch/powerpc/include/asm/systbl.h
+++ b/arch/powerpc/include/asm/systbl.h
@@ -358,3 +358,4 @@ SYSCALL_SPU(setns)
 COMPAT_SYS(process_vm_readv)
 COMPAT_SYS(process_vm_writev)
 SYSCALL(finit_module)
+SYSCALL(ni_syscall) /* sys_kcmp */
diff --git a/arch/powerpc/include/asm/unistd.h b/arch/powerpc/include/asm/unistd.h
index f25b5c45c435..1487f0f12293 100644
--- a/arch/powerpc/include/asm/unistd.h
+++ b/arch/powerpc/include/asm/unistd.h
@@ -12,7 +12,7 @@
 #include <uapi/asm/unistd.h>
 
 
-#define __NR_syscalls           354
+#define __NR_syscalls           355
 
 #define __NR__exit __NR_exit
 #define NR_syscalls     __NR_syscalls
diff --git a/arch/powerpc/include/uapi/asm/unistd.h b/arch/powerpc/include/uapi/asm/unistd.h
index 8c478c6c6b1e..74cb4d72d673 100644
--- a/arch/powerpc/include/uapi/asm/unistd.h
+++ b/arch/powerpc/include/uapi/asm/unistd.h
@@ -376,6 +376,7 @@
 #define __NR_process_vm_readv   351
 #define __NR_process_vm_writev  352
 #define __NR_finit_module       353
+#define __NR_kcmp               354
 
 
 #endif /* _UAPI_ASM_POWERPC_UNISTD_H_ */
diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S
index d29facbf9a28..ea847abb0d0a 100644
--- a/arch/powerpc/kernel/cpu_setup_power.S
+++ b/arch/powerpc/kernel/cpu_setup_power.S
@@ -48,6 +48,7 @@ _GLOBAL(__restore_cpu_power7)
 
 _GLOBAL(__setup_cpu_power8)
         mflr    r11
+        bl      __init_FSCR
         bl      __init_hvmode_206
         mtlr    r11
         beqlr
@@ -56,13 +57,13 @@ _GLOBAL(__setup_cpu_power8)
         mfspr   r3,SPRN_LPCR
         oris    r3, r3, LPCR_AIL_3@h
         bl      __init_LPCR
-        bl      __init_FSCR
         bl      __init_TLB
         mtlr    r11
         blr
 
 _GLOBAL(__restore_cpu_power8)
         mflr    r11
+        bl      __init_FSCR
         mfmsr   r3
         rldicl. r0,r3,4,63
         beqlr
@@ -115,7 +116,7 @@ __init_LPCR:
 
 __init_FSCR:
         mfspr   r3,SPRN_FSCR
-        ori     r3,r3,FSCR_TAR
+        ori     r3,r3,FSCR_TAR|FSCR_DSCR
         mtspr   SPRN_FSCR,r3
         blr
 
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index a8a5361fb70c..87ef8f5ee5bc 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -74,13 +74,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE)				\
         mflr    r10 ;                                           \
         ld      r12,PACAKBASE(r13) ;                            \
         LOAD_HANDLER(r12, system_call_entry_direct) ;           \
-        mtlr    r12 ;                                           \
+        mtctr   r12 ;                                           \
         mfspr   r12,SPRN_SRR1 ;                                 \
         /* Re-use of r13... No spare regs to do this */ \
         li      r13,MSR_RI ;                                    \
         mtmsrd  r13,1 ;                                         \
         GET_PACA(r13) ; /* get r13 back */                      \
-        blr ;
+        bctr ;
 #else
         /* We can branch directly */
 #define SYSCALL_PSERIES_2_DIRECT                                \
diff --git a/arch/powerpc/platforms/pseries/hvcserver.c b/arch/powerpc/platforms/pseries/hvcserver.c
index fcf4b4cbeaf3..4557e91626c4 100644
--- a/arch/powerpc/platforms/pseries/hvcserver.c
+++ b/arch/powerpc/platforms/pseries/hvcserver.c
@@ -23,6 +23,7 @@
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/string.h>
 
 #include <asm/hvcall.h>
 #include <asm/hvcserver.h>
@@ -188,9 +189,9 @@ int hvcs_get_partner_info(uint32_t unit_address, struct list_head *head,
                         = (unsigned int)last_p_partition_ID;
 
                 /* copy the Null-term char too */
-                strncpy(&next_partner_info->location_code[0],
+                strlcpy(&next_partner_info->location_code[0],
                         (char *)&pi_buff[2],
-                        strlen((char *)&pi_buff[2]) + 1);
+                        sizeof(next_partner_info->location_code));
 
                 list_add_tail(&(next_partner_info->node), head);
                 next_partner_info = NULL;
diff --git a/drivers/bcma/core.c b/drivers/bcma/core.c
index 03bbe104338f..17b26ce7e051 100644
--- a/drivers/bcma/core.c
+++ b/drivers/bcma/core.c
@@ -104,7 +104,13 @@ void bcma_core_pll_ctl(struct bcma_device *core, u32 req, u32 status, bool on)
                 if (i)
                         bcma_err(core->bus, "PLL enable timeout\n");
         } else {
-                bcma_warn(core->bus, "Disabling PLL not supported yet!\n");
+                /*
+                 * Mask the PLL but don't wait for it to be disabled. PLL may be
+                 * shared between cores and will be still up if there is another
+                 * core using it.
+                 */
+                bcma_mask32(core, BCMA_CLKCTLST, ~req);
+                bcma_read32(core, BCMA_CLKCTLST);
         }
 }
 EXPORT_SYMBOL_GPL(bcma_core_pll_ctl);
diff --git a/drivers/bcma/driver_pci_host.c b/drivers/bcma/driver_pci_host.c
index d3bde6cec927..30629a3d44cc 100644
--- a/drivers/bcma/driver_pci_host.c
+++ b/drivers/bcma/driver_pci_host.c
@@ -404,6 +404,8 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc)
                 return;
         }
 
+        spin_lock_init(&pc_host->cfgspace_lock);
+
         pc->host_controller = pc_host;
         pc_host->pci_controller.io_resource = &pc_host->io_resource;
         pc_host->pci_controller.mem_resource = &pc_host->mem_resource;
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 9a6188add590..f72f52b4b1dd 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -120,6 +120,11 @@ static int bcma_register_cores(struct bcma_bus *bus)
                         continue;
                 }
 
+                /* Only first GMAC core on BCM4706 is connected and working */
+                if (core->id.id == BCMA_CORE_4706_MAC_GBIT &&
+                    core->core_unit > 0)
+                        continue;
+
                 core->dev.release = bcma_release_core_dev;
                 core->dev.bus = &bcma_bus_type;
                 dev_set_name(&core->dev, "bcma%d:%d", bus->num, dev_id);
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index a8a41e07a221..b282af181b44 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -74,8 +74,10 @@ static struct usb_device_id ath3k_table[] = {
 
         /* Atheros AR3012 with sflash firmware*/
         { USB_DEVICE(0x0CF3, 0x3004) },
+        { USB_DEVICE(0x0CF3, 0x3008) },
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
+        { USB_DEVICE(0x04CA, 0x3004) },
         { USB_DEVICE(0x04CA, 0x3005) },
         { USB_DEVICE(0x04CA, 0x3006) },
         { USB_DEVICE(0x04CA, 0x3008) },
@@ -106,8 +108,10 @@ static struct usb_device_id ath3k_blist_tbl[] = {
 
         /* Atheros AR3012 with sflash firmware*/
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 7e351e345476..e547851870e7 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -132,8 +132,10 @@ static struct usb_device_id blacklist_table[] = {
 
         /* Atheros 3012 with sflash firmware */
         { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c
index 1bafb40ec8a2..69ae5972713c 100644
--- a/drivers/char/hw_random/core.c
+++ b/drivers/char/hw_random/core.c
@@ -40,6 +40,7 @@
 #include <linux/init.h>
 #include <linux/miscdevice.h>
 #include <linux/delay.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 
@@ -52,8 +53,12 @@ static struct hwrng *current_rng;
 static LIST_HEAD(rng_list);
 static DEFINE_MUTEX(rng_mutex);
 static int data_avail;
-static u8 rng_buffer[SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES]
-        __cacheline_aligned;
+static u8 *rng_buffer;
+
+static size_t rng_buffer_size(void)
+{
+        return SMP_CACHE_BYTES < 32 ? 32 : SMP_CACHE_BYTES;
+}
 
 static inline int hwrng_init(struct hwrng *rng)
 {
@@ -116,7 +121,7 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf,
 
                 if (!data_avail) {
                         bytes_read = rng_get_data(current_rng, rng_buffer,
-                                sizeof(rng_buffer),
+                                rng_buffer_size(),
                                 !(filp->f_flags & O_NONBLOCK));
                         if (bytes_read < 0) {
                                 err = bytes_read;
@@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng)
 
         mutex_lock(&rng_mutex);
 
+        /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */
+        err = -ENOMEM;
+        if (!rng_buffer) {
+                rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL);
+                if (!rng_buffer)
+                        goto out_unlock;
+        }
+
         /* Must not register two RNGs with the same name. */
         err = -EEXIST;
         list_for_each_entry(tmp, &rng_list, list) {
diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
index fce2000eec31..1110478dd0fd 100644
--- a/drivers/connector/cn_proc.c
+++ b/drivers/connector/cn_proc.c
@@ -313,6 +313,12 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
             (task_active_pid_ns(current) != &init_pid_ns))
                 return;
 
+        /* Can only change if privileged. */
+        if (!capable(CAP_NET_ADMIN)) {
+                err = EPERM;
+                goto out;
+        }
+
         mc_op = (enum proc_cn_mcast_op *)msg->data;
         switch (*mc_op) {
         case PROC_CN_MCAST_LISTEN:
@@ -325,6 +331,8 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg,
                 err = EINVAL;
                 break;
         }
+
+out:
         cn_proc_ack(err, msg->seq, msg->ack);
 }
 
diff --git a/drivers/gpio/gpio-ich.c b/drivers/gpio/gpio-ich.c
index 6f2306db8591..f9dbd503fc40 100644
--- a/drivers/gpio/gpio-ich.c
+++ b/drivers/gpio/gpio-ich.c
@@ -128,9 +128,9 @@ static int ichx_read_bit(int reg, unsigned nr)
         return data & (1 << bit) ? 1 : 0;
 }
 
-static int ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
+static bool ichx_gpio_check_available(struct gpio_chip *gpio, unsigned nr)
 {
-        return (ichx_priv.use_gpio & (1 << (nr / 32))) ? 0 : -ENXIO;
+        return ichx_priv.use_gpio & (1 << (nr / 32));
 }
 
 static int ichx_gpio_direction_input(struct gpio_chip *gpio, unsigned nr)
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index fff9786cdc64..c2534d62911c 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -88,13 +88,14 @@ static int gpiod_request(struct gpio_desc *desc, const char *label);
 static void gpiod_free(struct gpio_desc *desc);
 static int gpiod_direction_input(struct gpio_desc *desc);
 static int gpiod_direction_output(struct gpio_desc *desc, int value);
+static int gpiod_get_direction(const struct gpio_desc *desc);
 static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce);
-static int gpiod_get_value_cansleep(struct gpio_desc *desc);
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc);
 static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value);
-static int gpiod_get_value(struct gpio_desc *desc);
+static int gpiod_get_value(const struct gpio_desc *desc);
 static void gpiod_set_value(struct gpio_desc *desc, int value);
-static int gpiod_cansleep(struct gpio_desc *desc);
-static int gpiod_to_irq(struct gpio_desc *desc);
+static int gpiod_cansleep(const struct gpio_desc *desc);
+static int gpiod_to_irq(const struct gpio_desc *desc);
 static int gpiod_export(struct gpio_desc *desc, bool direction_may_change);
 static int gpiod_export_link(struct device *dev, const char *name,
                              struct gpio_desc *desc);
@@ -171,12 +172,12 @@ static int gpio_ensure_requested(struct gpio_desc *desc)
         return 0;
 }
 
-/* caller holds gpio_lock *OR* gpio is marked as requested */
-static struct gpio_chip *gpiod_to_chip(struct gpio_desc *desc)
+static struct gpio_chip *gpiod_to_chip(const struct gpio_desc *desc)
 {
-        return desc->chip;
+        return desc ? desc->chip : NULL;
 }
 
+/* caller holds gpio_lock *OR* gpio is marked as requested */
 struct gpio_chip *gpio_to_chip(unsigned gpio)
 {
         return gpiod_to_chip(gpio_to_desc(gpio));
@@ -207,7 +208,7 @@ static int gpiochip_find_base(int ngpio)
 }
 
 /* caller ensures gpio is valid and requested, chip->get_direction may sleep  */
-static int gpiod_get_direction(struct gpio_desc *desc)
+static int gpiod_get_direction(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         unsigned                offset;
@@ -223,11 +224,13 @@ static int gpiod_get_direction(struct gpio_desc *desc)
         if (status > 0) {
                 /* GPIOF_DIR_IN, or other positive */
                 status = 1;
-                clear_bit(FLAG_IS_OUT, &desc->flags);
+                /* FLAG_IS_OUT is just a cache of the result of get_direction(),
+                 * so it does not affect constness per se */
+                clear_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
         }
         if (status == 0) {
                 /* GPIOF_DIR_OUT */
-                set_bit(FLAG_IS_OUT, &desc->flags);
+                set_bit(FLAG_IS_OUT, &((struct gpio_desc *)desc)->flags);
         }
         return status;
 }
@@ -263,7 +266,7 @@ static DEFINE_MUTEX(sysfs_lock);
 static ssize_t gpio_direction_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
-        struct gpio_desc        *desc = dev_get_drvdata(dev);
+        const struct gpio_desc  *desc = dev_get_drvdata(dev);
         ssize_t                 status;
 
         mutex_lock(&sysfs_lock);
@@ -654,6 +657,11 @@ static ssize_t export_store(struct class *class,
                 goto done;
 
         desc = gpio_to_desc(gpio);
+        /* reject invalid GPIOs */
+        if (!desc) {
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
 
         /* No extra locking here; FLAG_SYSFS just signifies that the
          * request and export were done by on behalf of userspace, so
@@ -690,12 +698,14 @@ static ssize_t unexport_store(struct class *class,
         if (status < 0)
                 goto done;
 
-        status = -EINVAL;
-
         desc = gpio_to_desc(gpio);
         /* reject bogus commands (gpio_unexport ignores them) */
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO %ld\n", __func__, gpio);
+                return -EINVAL;
+        }
+
+        status = -EINVAL;
 
         /* No extra locking here; FLAG_SYSFS just signifies that the
          * request and export were done by on behalf of userspace, so
@@ -846,8 +856,10 @@ static int gpiod_export_link(struct device *dev, const char *name,
 {
         int                     status = -EINVAL;
 
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
 
         mutex_lock(&sysfs_lock);
 
@@ -865,7 +877,6 @@ static int gpiod_export_link(struct device *dev, const char *name,
 
         mutex_unlock(&sysfs_lock);
 
-done:
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -896,8 +907,10 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
         struct device           *dev = NULL;
         int                     status = -EINVAL;
 
-        if (!desc)
-                goto done;
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
 
         mutex_lock(&sysfs_lock);
 
@@ -914,7 +927,6 @@ static int gpiod_sysfs_set_active_low(struct gpio_desc *desc, int value)
 unlock:
         mutex_unlock(&sysfs_lock);
 
-done:
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -940,8 +952,8 @@ static void gpiod_unexport(struct gpio_desc *desc)
         struct device           *dev = NULL;
 
         if (!desc) {
-                status = -EINVAL;
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return;
         }
 
         mutex_lock(&sysfs_lock);
@@ -962,7 +974,7 @@ static void gpiod_unexport(struct gpio_desc *desc)
                 device_unregister(dev);
                 put_device(dev);
         }
-done:
+
         if (status)
                 pr_debug("%s: gpio%d status %d\n", __func__, desc_to_gpio(desc),
                          status);
@@ -1384,12 +1396,13 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
         int                     status = -EPROBE_DEFER;
         unsigned long           flags;
 
-        spin_lock_irqsave(&gpio_lock, flags);
-
         if (!desc) {
-                status = -EINVAL;
-                goto done;
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
         }
+
+        spin_lock_irqsave(&gpio_lock, flags);
+
         chip = desc->chip;
         if (chip == NULL)
                 goto done;
@@ -1432,8 +1445,7 @@ static int gpiod_request(struct gpio_desc *desc, const char *label)
 done:
         if (status)
                 pr_debug("_gpio_request: gpio-%d (%s) status %d\n",
-                         desc ? desc_to_gpio(desc) : -1,
-                         label ? : "?", status);
+                         desc_to_gpio(desc), label ? : "?", status);
         spin_unlock_irqrestore(&gpio_lock, flags);
         return status;
 }
@@ -1616,10 +1628,13 @@ static int gpiod_direction_input(struct gpio_desc *desc)
         int                     status = -EINVAL;
         int                     offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->get || !chip->direction_input)
                 goto fail;
@@ -1655,13 +1670,9 @@ lose:
         return status;
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
         return status;
 }
 
@@ -1678,6 +1689,11 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
         int                     status = -EINVAL;
         int offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         /* Open drain pin should not be driven to 1 */
         if (value && test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
                 return gpiod_direction_input(desc);
@@ -1688,8 +1704,6 @@ static int gpiod_direction_output(struct gpio_desc *desc, int value)
 
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->set || !chip->direction_output)
                 goto fail;
@@ -1725,13 +1739,9 @@ lose:
         return status;
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
         return status;
 }
 
@@ -1753,10 +1763,13 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
         int                     status = -EINVAL;
         int                     offset;
 
+        if (!desc) {
+                pr_warn("%s: invalid GPIO\n", __func__);
+                return -EINVAL;
+        }
+
         spin_lock_irqsave(&gpio_lock, flags);
 
-        if (!desc)
-                goto fail;
         chip = desc->chip;
         if (!chip || !chip->set || !chip->set_debounce)
                 goto fail;
@@ -1776,13 +1789,9 @@ static int gpiod_set_debounce(struct gpio_desc *desc, unsigned debounce)
 
 fail:
         spin_unlock_irqrestore(&gpio_lock, flags);
-        if (status) {
-                int gpio = -1;
-                if (desc)
-                        gpio = desc_to_gpio(desc);
-                pr_debug("%s: gpio-%d status %d\n",
-                        __func__, gpio, status);
-        }
+        if (status)
+                pr_debug("%s: gpio-%d status %d\n", __func__,
+                         desc_to_gpio(desc), status);
 
         return status;
 }
@@ -1824,12 +1833,14 @@ EXPORT_SYMBOL_GPL(gpio_set_debounce);
  * It returns the zero or nonzero value provided by the associated
  * gpio_chip.get() method; or zero if no such method is provided.
  */
-static int gpiod_get_value(struct gpio_desc *desc)
+static int gpiod_get_value(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int value;
         int offset;
 
+        if (!desc)
+                return 0;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         /* Should be using gpio_get_value_cansleep() */
@@ -1912,6 +1923,8 @@ static void gpiod_set_value(struct gpio_desc *desc, int value)
 {
         struct gpio_chip        *chip;
 
+        if (!desc)
+                return;
         chip = desc->chip;
         /* Should be using gpio_set_value_cansleep() */
         WARN_ON(chip->can_sleep);
@@ -1938,8 +1951,10 @@ EXPORT_SYMBOL_GPL(__gpio_set_value);
  * This is used directly or indirectly to implement gpio_cansleep().  It
  * returns nonzero if access reading or writing the GPIO value can sleep.
  */
-static int gpiod_cansleep(struct gpio_desc *desc)
+static int gpiod_cansleep(const struct gpio_desc *desc)
 {
+        if (!desc)
+                return 0;
         /* only call this on GPIOs that are valid! */
         return desc->chip->can_sleep;
 }
@@ -1959,11 +1974,13 @@ EXPORT_SYMBOL_GPL(__gpio_cansleep);
  * It returns the number of the IRQ signaled by this (input) GPIO,
  * or a negative errno.
  */
-static int gpiod_to_irq(struct gpio_desc *desc)
+static int gpiod_to_irq(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int                     offset;
 
+        if (!desc)
+                return -EINVAL;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         return chip->to_irq ? chip->to_irq(chip, offset) : -ENXIO;
@@ -1980,13 +1997,15 @@ EXPORT_SYMBOL_GPL(__gpio_to_irq);
  * Common examples include ones connected to I2C or SPI chips.
  */
 
-static int gpiod_get_value_cansleep(struct gpio_desc *desc)
+static int gpiod_get_value_cansleep(const struct gpio_desc *desc)
 {
         struct gpio_chip        *chip;
         int value;
         int offset;
 
         might_sleep_if(extra_checks);
+        if (!desc)
+                return 0;
         chip = desc->chip;
         offset = gpio_chip_hwgpio(desc);
         value = chip->get ? chip->get(chip, offset) : 0;
@@ -2005,6 +2024,8 @@ static void gpiod_set_value_cansleep(struct gpio_desc *desc, int value)
         struct gpio_chip        *chip;
 
         might_sleep_if(extra_checks);
+        if (!desc)
+                return;
         chip = desc->chip;
         trace_gpio_value(desc_to_gpio(desc), 0, value);
         if (test_bit(FLAG_OPEN_DRAIN,  &desc->flags))
diff --git a/drivers/isdn/hisax/st5481_usb.c b/drivers/isdn/hisax/st5481_usb.c
index 017c67ea3f4c..ead0a4fb7448 100644
--- a/drivers/isdn/hisax/st5481_usb.c
+++ b/drivers/isdn/hisax/st5481_usb.c
@@ -294,13 +294,13 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
         // Allocate URBs and buffers for interrupt endpoint
         urb = usb_alloc_urb(0, GFP_KERNEL);
         if (!urb) {
-                return -ENOMEM;
+                goto err1;
         }
         intr->urb = urb;
 
         buf = kmalloc(INT_PKT_SIZE, GFP_KERNEL);
         if (!buf) {
-                return -ENOMEM;
+                goto err2;
         }
 
         endpoint = &altsetting->endpoint[EP_INT-1];
@@ -313,6 +313,14 @@ int st5481_setup_usb(struct st5481_adapter *adapter)
                          endpoint->desc.bInterval);
 
         return 0;
+err2:
+        usb_free_urb(intr->urb);
+        intr->urb = NULL;
+err1:
+        usb_free_urb(ctrl->urb);
+        ctrl->urb = NULL;
+
+        return -ENOMEM;
 }
 
 /*
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index e30b490055aa..4d8d90b4fe78 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -154,17 +154,6 @@ config MD_RAID456
 
           If unsure, say Y.
 
-config MULTICORE_RAID456
-        bool "RAID-4/RAID-5/RAID-6 Multicore processing (EXPERIMENTAL)"
-        depends on MD_RAID456
-        depends on SMP
-        depends on EXPERIMENTAL
-        ---help---
-          Enable the raid456 module to dispatch per-stripe raid operations to a
-          thread pool.
-
-          If unsure, say N.
-
 config MD_MULTIPATH
         tristate "Multipath I/O support"
         depends on BLK_DEV_MD
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 9a01d1e4c783..311e3d35b272 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -91,15 +91,44 @@ static struct raid_type {
         {"raid6_nc", "RAID6 (N continue)",              2, 4, 6, ALGORITHM_ROTATING_N_CONTINUE}
 };
 
+static char *raid10_md_layout_to_format(int layout)
+{
+        /*
+         * Bit 16 and 17 stand for "offset" and "use_far_sets"
+         * Refer to MD's raid10.c for details
+         */
+        if ((layout & 0x10000) && (layout & 0x20000))
+                return "offset";
+
+        if ((layout & 0xFF) > 1)
+                return "near";
+
+        return "far";
+}
+
 static unsigned raid10_md_layout_to_copies(int layout)
 {
-        return layout & 0xFF;
+        if ((layout & 0xFF) > 1)
+                return layout & 0xFF;
+        return (layout >> 8) & 0xFF;
 }
 
 static int raid10_format_to_md_layout(char *format, unsigned copies)
 {
-        /* 1 "far" copy, and 'copies' "near" copies */
-        return (1 << 8) | (copies & 0xFF);
+        unsigned n = 1, f = 1;
+
+        if (!strcmp("near", format))
+                n = copies;
+        else
+                f = copies;
+
+        if (!strcmp("offset", format))
+                return 0x30000 | (f << 8) | n;
+
+        if (!strcmp("far", format))
+                return 0x20000 | (f << 8) | n;
+
+        return (f << 8) | n;
 }
 
 static struct raid_type *get_raid_type(char *name)
@@ -352,6 +381,7 @@ static int validate_raid_redundancy(struct raid_set *rs)
 {
         unsigned i, rebuild_cnt = 0;
         unsigned rebuilds_per_group, copies, d;
+        unsigned group_size, last_group_start;
 
         for (i = 0; i < rs->md.raid_disks; i++)
                 if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
@@ -379,9 +409,6 @@ static int validate_raid_redundancy(struct raid_set *rs)
                  * as long as the failed devices occur in different mirror
                  * groups (i.e. different stripes).
                  *
-                 * Right now, we only allow for "near" copies.  When other
-                 * formats are added, we will have to check those too.
-                 *
                  * When checking "near" format, make sure no adjacent devices
                  * have failed beyond what can be handled.  In addition to the
                  * simple case where the number of devices is a multiple of the
@@ -391,14 +418,41 @@ static int validate_raid_redundancy(struct raid_set *rs)
                  *          A    A    B    B    C
                  *          C    D    D    E    E
                  */
-                for (i = 0; i < rs->md.raid_disks * copies; i++) {
-                        if (!(i % copies))
+                if (!strcmp("near", raid10_md_layout_to_format(rs->md.layout))) {
+                        for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                                if (!(i % copies))
+                                        rebuilds_per_group = 0;
+                                d = i % rs->md.raid_disks;
+                                if ((!rs->dev[d].rdev.sb_page ||
+                                     !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+                                    (++rebuilds_per_group >= copies))
+                                        goto too_many;
+                        }
+                        break;
+                }
+
+                /*
+                 * When checking "far" and "offset" formats, we need to ensure
+                 * that the device that holds its copy is not also dead or
+                 * being rebuilt.  (Note that "far" and "offset" formats only
+                 * support two copies right now.  These formats also only ever
+                 * use the 'use_far_sets' variant.)
+                 *
+                 * This check is somewhat complicated by the need to account
+                 * for arrays that are not a multiple of (far) copies.  This
+                 * results in the need to treat the last (potentially larger)
+                 * set differently.
+                 */
+                group_size = (rs->md.raid_disks / copies);
+                last_group_start = (rs->md.raid_disks / group_size) - 1;
+                last_group_start *= group_size;
+                for (i = 0; i < rs->md.raid_disks; i++) {
+                        if (!(i % copies) && !(i > last_group_start))
                                 rebuilds_per_group = 0;
-                        d = i % rs->md.raid_disks;
-                        if ((!rs->dev[d].rdev.sb_page ||
-                             !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
+                        if ((!rs->dev[i].rdev.sb_page ||
+                             !test_bit(In_sync, &rs->dev[i].rdev.flags)) &&
                             (++rebuilds_per_group >= copies))
-                                goto too_many;
+                                        goto too_many;
                 }
                 break;
         default:
@@ -433,7 +487,7 @@ too_many:
  *
  * RAID10-only options:
  *    [raid10_copies <# copies>]        Number of copies.  (Default: 2)
- *    [raid10_format <near>]            Layout algorithm.  (Default: near)
+ *    [raid10_format <near|far|offset>] Layout algorithm.  (Default: near)
  */
 static int parse_raid_params(struct raid_set *rs, char **argv,
                              unsigned num_raid_params)
@@ -520,7 +574,9 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                                 rs->ti->error = "'raid10_format' is an invalid parameter for this RAID type";
                                 return -EINVAL;
                         }
-                        if (strcmp("near", argv[i])) {
+                        if (strcmp("near", argv[i]) &&
+                            strcmp("far", argv[i]) &&
+                            strcmp("offset", argv[i])) {
                                 rs->ti->error = "Invalid 'raid10_format' value given";
                                 return -EINVAL;
                         }
@@ -644,6 +700,15 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
                         return -EINVAL;
                 }
 
+                /*
+                 * If the format is not "near", we only support
+                 * two copies at the moment.
+                 */
+                if (strcmp("near", raid10_format) && (raid10_copies > 2)) {
+                        rs->ti->error = "Too many copies for given RAID10 format.";
+                        return -EINVAL;
+                }
+
                 /* (Len * #mirrors) / #devices */
                 sectors_per_dev = rs->ti->len * raid10_copies;
                 sector_div(sectors_per_dev, rs->md.raid_disks);
@@ -854,17 +919,30 @@ static int super_init_validation(struct mddev *mddev, struct md_rdev *rdev)
         /*
          * Reshaping is not currently allowed
          */
-        if ((le32_to_cpu(sb->level) != mddev->level) ||
-            (le32_to_cpu(sb->layout) != mddev->layout) ||
-            (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors)) {
-                DMERR("Reshaping arrays not yet supported.");
+        if (le32_to_cpu(sb->level) != mddev->level) {
+                DMERR("Reshaping arrays not yet supported. (RAID level change)");
+                return -EINVAL;
+        }
+        if (le32_to_cpu(sb->layout) != mddev->layout) {
+                DMERR("Reshaping arrays not yet supported. (RAID layout change)");
+                DMERR("  0x%X vs 0x%X", le32_to_cpu(sb->layout), mddev->layout);
+                DMERR("  Old layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(le32_to_cpu(sb->layout)),
+                      raid10_md_layout_to_copies(le32_to_cpu(sb->layout)));
+                DMERR("  New layout: %s w/ %d copies",
+                      raid10_md_layout_to_format(mddev->layout),
+                      raid10_md_layout_to_copies(mddev->layout));
+                return -EINVAL;
+        }
+        if (le32_to_cpu(sb->stripe_sectors) != mddev->chunk_sectors) {
+                DMERR("Reshaping arrays not yet supported. (stripe sectors change)");
                 return -EINVAL;
         }
 
         /* We can only change the number of devices in RAID1 right now */
         if ((rs->raid_type->level != 1) &&
             (le32_to_cpu(sb->num_devices) != mddev->raid_disks)) {
-                DMERR("Reshaping arrays not yet supported.");
+                DMERR("Reshaping arrays not yet supported. (device count change)");
                 return -EINVAL;
         }
 
@@ -1329,7 +1407,8 @@ static void raid_status(struct dm_target *ti, status_type_t type,
                                raid10_md_layout_to_copies(rs->md.layout));
 
                 if (rs->print_flags & DMPF_RAID10_FORMAT)
-                        DMEMIT(" raid10_format near");
+                        DMEMIT(" raid10_format %s",
+                               raid10_md_layout_to_format(rs->md.layout));
 
                 DMEMIT(" %d", rs->md.raid_disks);
                 for (i = 0; i < rs->md.raid_disks; i++) {
@@ -1418,6 +1497,10 @@ static struct target_type raid_target = {
 
 static int __init dm_raid_init(void)
 {
+        DMINFO("Loading target version %u.%u.%u",
+               raid_target.version[0],
+               raid_target.version[1],
+               raid_target.version[2]);
         return dm_register_target(&raid_target);
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 3db3d1b271f7..fcb878f88796 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -307,6 +307,10 @@ static void md_make_request(struct request_queue *q, struct bio *bio)
                 bio_io_error(bio);
                 return;
         }
+        if (mddev->ro == 1 && unlikely(rw == WRITE)) {
+                bio_endio(bio, bio_sectors(bio) == 0 ? 0 : -EROFS);
+                return;
+        }
         smp_rmb(); /* Ensure implications of  'active' are visible */
         rcu_read_lock();
         if (mddev->suspended) {
@@ -2994,6 +2998,9 @@ rdev_size_store(struct md_rdev *rdev, const char *buf, size_t len)
                 } else if (!sectors)
                         sectors = (i_size_read(rdev->bdev->bd_inode) >> 9) -
                                 rdev->data_offset;
+                if (!my_mddev->pers->resize)
+                        /* Cannot change size for RAID0 or Linear etc */
+                        return -EINVAL;
         }
         if (sectors < my_mddev->dev_sectors)
                 return -EINVAL; /* component must fit device */
@@ -6525,7 +6532,17 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode,
                         mddev->ro = 0;
                         sysfs_notify_dirent_safe(mddev->sysfs_state);
                         set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
-                        md_wakeup_thread(mddev->thread);
+                        /* mddev_unlock will wake thread */
+                        /* If a device failed while we were read-only, we
+                         * need to make sure the metadata is updated now.
+                         */
+                        if (test_bit(MD_CHANGE_DEVS, &mddev->flags)) {
+                                mddev_unlock(mddev);
+                                wait_event(mddev->sb_wait,
+                                           !test_bit(MD_CHANGE_DEVS, &mddev->flags) &&
+                                           !test_bit(MD_CHANGE_PENDING, &mddev->flags));
+                                mddev_lock(mddev);
+                        }
                 } else {
                         err = -EROFS;
                         goto abort_unlock;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 24b359717a7e..0505452de8d6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -175,7 +175,13 @@ static int create_strip_zones(struct mddev *mddev, struct r0conf **private_conf)
                         rdev1->new_raid_disk = j;
                 }
 
-                if (j < 0 || j >= mddev->raid_disks) {
+                if (j < 0) {
+                        printk(KERN_ERR
+                               "md/raid0:%s: remove inactive devices before converting to RAID0\n",
+                               mdname(mddev));
+                        goto abort;
+                }
+                if (j >= mddev->raid_disks) {
                         printk(KERN_ERR "md/raid0:%s: bad disk number %d - "
                                "aborting!\n", mdname(mddev), j);
                         goto abort;
@@ -289,7 +295,7 @@ abort:
         kfree(conf->strip_zone);
         kfree(conf->devlist);
         kfree(conf);
-        *private_conf = NULL;
+        *private_conf = ERR_PTR(err);
         return err;
 }
 
@@ -411,7 +417,8 @@ static sector_t raid0_size(struct mddev *mddev, sector_t sectors, int raid_disks
                   "%s does not support generic reshape\n", __func__);
 
         rdev_for_each(rdev, mddev)
-                array_sectors += rdev->sectors;
+                array_sectors += (rdev->sectors &
+                                  ~(sector_t)(mddev->chunk_sectors-1));
 
         return array_sectors;
 }
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index d5bddfc4010e..fd86b372692d 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -967,6 +967,7 @@ static void raid1_unplug(struct blk_plug_cb *cb, bool from_schedule)
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
                 spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                 md_wakeup_thread(mddev->thread);
                 kfree(plug);
                 return;
@@ -1000,6 +1001,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_flush_fua = (bio->bi_rw & (REQ_FLUSH | REQ_FUA));
         const unsigned long do_discard = (bio->bi_rw
                                           & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
         struct md_rdev *blocked_rdev;
         struct blk_plug_cb *cb;
         struct raid1_plug_cb *plug = NULL;
@@ -1301,7 +1303,8 @@ read_again:
                                    conf->mirrors[i].rdev->data_offset);
                 mbio->bi_bdev = conf->mirrors[i].rdev->bdev;
                 mbio->bi_end_io = raid1_end_write_request;
-                mbio->bi_rw = WRITE | do_flush_fua | do_sync | do_discard;
+                mbio->bi_rw =
+                        WRITE | do_flush_fua | do_sync | do_discard | do_same;
                 mbio->bi_private = r1_bio;
 
                 atomic_inc(&r1_bio->remaining);
@@ -2818,6 +2821,9 @@ static int run(struct mddev *mddev)
         if (IS_ERR(conf))
                 return PTR_ERR(conf);
 
+        if (mddev->queue)
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
         rdev_for_each(rdev, mddev) {
                 if (!mddev->gendisk)
                         continue;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 64d48249c03b..77b562d18a90 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -38,21 +38,36 @@
  *    near_copies (stored in low byte of layout)
  *    far_copies (stored in second byte of layout)
  *    far_offset (stored in bit 16 of layout )
+ *    use_far_sets (stored in bit 17 of layout )
  *
- * The data to be stored is divided into chunks using chunksize.
- * Each device is divided into far_copies sections.
- * In each section, chunks are laid out in a style similar to raid0, but
- * near_copies copies of each chunk is stored (each on a different drive).
- * The starting device for each section is offset near_copies from the starting
- * device of the previous section.
- * Thus they are (near_copies*far_copies) of each chunk, and each is on a different
- * drive.
- * near_copies and far_copies must be at least one, and their product is at most
- * raid_disks.
+ * The data to be stored is divided into chunks using chunksize.  Each device
+ * is divided into far_copies sections.   In each section, chunks are laid out
+ * in a style similar to raid0, but near_copies copies of each chunk is stored
+ * (each on a different drive).  The starting device for each section is offset
+ * near_copies from the starting device of the previous section.  Thus there
+ * are (near_copies * far_copies) of each chunk, and each is on a different
+ * drive.  near_copies and far_copies must be at least one, and their product
+ * is at most raid_disks.
  *
  * If far_offset is true, then the far_copies are handled a bit differently.
- * The copies are still in different stripes, but instead of be very far apart
- * on disk, there are adjacent stripes.
+ * The copies are still in different stripes, but instead of being very far
+ * apart on disk, there are adjacent stripes.
+ *
+ * The far and offset algorithms are handled slightly differently if
+ * 'use_far_sets' is true.  In this case, the array's devices are grouped into
+ * sets that are (near_copies * far_copies) in size.  The far copied stripes
+ * are still shifted by 'near_copies' devices, but this shifting stays confined
+ * to the set rather than the entire array.  This is done to improve the number
+ * of device combinations that can fail without causing the array to fail.
+ * Example 'far' algorithm w/o 'use_far_sets' (each letter represents a chunk
+ * on a device):
+ *    A B C D    A B C D E
+ *      ...         ...
+ *    D A B C    E A B C D
+ * Example 'far' algorithm w/ 'use_far_sets' enabled (sets illustrated w/ []'s):
+ *    [A B] [C D]    [A B] [C D E]
+ *    |...| |...|    |...| | ... |
+ *    [B A] [D C]    [B A] [E C D]
  */
 
 /*
@@ -535,6 +550,13 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
         sector_t stripe;
         int dev;
         int slot = 0;
+        int last_far_set_start, last_far_set_size;
+
+        last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+        last_far_set_start *= geo->far_set_size;
+
+        last_far_set_size = geo->far_set_size;
+        last_far_set_size += (geo->raid_disks % geo->far_set_size);
 
         /* now calculate first sector/dev */
         chunk = r10bio->sector >> geo->chunk_shift;
@@ -551,15 +573,25 @@ static void __raid10_find_phys(struct geom *geo, struct r10bio *r10bio)
         /* and calculate all the others */
         for (n = 0; n < geo->near_copies; n++) {
                 int d = dev;
+                int set;
                 sector_t s = sector;
-                r10bio->devs[slot].addr = sector;
                 r10bio->devs[slot].devnum = d;
+                r10bio->devs[slot].addr = s;
                 slot++;
 
                 for (f = 1; f < geo->far_copies; f++) {
+                        set = d / geo->far_set_size;
                         d += geo->near_copies;
-                        if (d >= geo->raid_disks)
-                                d -= geo->raid_disks;
+
+                        if ((geo->raid_disks % geo->far_set_size) &&
+                            (d > last_far_set_start)) {
+                                d -= last_far_set_start;
+                                d %= last_far_set_size;
+                                d += last_far_set_start;
+                        } else {
+                                d %= geo->far_set_size;
+                                d += geo->far_set_size * set;
+                        }
                         s += geo->stride;
                         r10bio->devs[slot].devnum = d;
                         r10bio->devs[slot].addr = s;
@@ -595,6 +627,20 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
          * or recovery, so reshape isn't happening
          */
         struct geom *geo = &conf->geo;
+        int far_set_start = (dev / geo->far_set_size) * geo->far_set_size;
+        int far_set_size = geo->far_set_size;
+        int last_far_set_start;
+
+        if (geo->raid_disks % geo->far_set_size) {
+                last_far_set_start = (geo->raid_disks / geo->far_set_size) - 1;
+                last_far_set_start *= geo->far_set_size;
+
+                if (dev >= last_far_set_start) {
+                        far_set_size = geo->far_set_size;
+                        far_set_size += (geo->raid_disks % geo->far_set_size);
+                        far_set_start = last_far_set_start;
+                }
+        }
 
         offset = sector & geo->chunk_mask;
         if (geo->far_offset) {
@@ -602,13 +648,13 @@ static sector_t raid10_find_virt(struct r10conf *conf, sector_t sector, int dev)
                 chunk = sector >> geo->chunk_shift;
                 fc = sector_div(chunk, geo->far_copies);
                 dev -= fc * geo->near_copies;
-                if (dev < 0)
-                        dev += geo->raid_disks;
+                if (dev < far_set_start)
+                        dev += far_set_size;
         } else {
                 while (sector >= geo->stride) {
                         sector -= geo->stride;
-                        if (dev < geo->near_copies)
-                                dev += geo->raid_disks - geo->near_copies;
+                        if (dev < (geo->near_copies + far_set_start))
+                                dev += far_set_size - geo->near_copies;
                         else
                                 dev -= geo->near_copies;
                 }
@@ -1073,6 +1119,7 @@ static void raid10_unplug(struct blk_plug_cb *cb, bool from_schedule)
                 bio_list_merge(&conf->pending_bio_list, &plug->pending);
                 conf->pending_count += plug->pending_cnt;
                 spin_unlock_irq(&conf->device_lock);
+                wake_up(&conf->wait_barrier);
                 md_wakeup_thread(mddev->thread);
                 kfree(plug);
                 return;
@@ -1105,6 +1152,7 @@ static void make_request(struct mddev *mddev, struct bio * bio)
         const unsigned long do_fua = (bio->bi_rw & REQ_FUA);
         const unsigned long do_discard = (bio->bi_rw
                                           & (REQ_DISCARD | REQ_SECURE));
+        const unsigned long do_same = (bio->bi_rw & REQ_WRITE_SAME);
         unsigned long flags;
         struct md_rdev *blocked_rdev;
         struct blk_plug_cb *cb;
@@ -1460,7 +1508,8 @@ retry_write:
                                                               rdev));
                         mbio->bi_bdev = rdev->bdev;
                         mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                         mbio->bi_private = r10_bio;
 
                         atomic_inc(&r10_bio->remaining);
@@ -1502,7 +1551,8 @@ retry_write:
                                                    r10_bio, rdev));
                         mbio->bi_bdev = rdev->bdev;
                         mbio->bi_end_io = raid10_end_write_request;
-                        mbio->bi_rw = WRITE | do_sync | do_fua | do_discard;
+                        mbio->bi_rw =
+                                WRITE | do_sync | do_fua | do_discard | do_same;
                         mbio->bi_private = r10_bio;
 
                         atomic_inc(&r10_bio->remaining);
@@ -3436,7 +3486,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
                 disks = mddev->raid_disks + mddev->delta_disks;
                 break;
         }
-        if (layout >> 17)
+        if (layout >> 18)
                 return -1;
         if (chunk < (PAGE_SIZE >> 9) ||
             !is_power_of_2(chunk))
@@ -3448,6 +3498,7 @@ static int setup_geo(struct geom *geo, struct mddev *mddev, enum geo_type new)
         geo->near_copies = nc;
         geo->far_copies = fc;
         geo->far_offset = fo;
+        geo->far_set_size = (layout & (1<<17)) ? disks / fc : disks;
         geo->chunk_mask = chunk - 1;
         geo->chunk_shift = ffz(~chunk);
         return nc*fc;
@@ -3569,6 +3620,8 @@ static int run(struct mddev *mddev)
         if (mddev->queue) {
                 blk_queue_max_discard_sectors(mddev->queue,
                                               mddev->chunk_sectors);
+                blk_queue_max_write_same_sectors(mddev->queue,
+                                                 mddev->chunk_sectors);
                 blk_queue_io_min(mddev->queue, chunk_size);
                 if (conf->geo.raid_disks % conf->geo.near_copies)
                         blk_queue_io_opt(mddev->queue, chunk_size * conf->geo.raid_disks);
diff --git a/drivers/md/raid10.h b/drivers/md/raid10.h
index 1054cf602345..157d69e83ff4 100644
--- a/drivers/md/raid10.h
+++ b/drivers/md/raid10.h
@@ -33,6 +33,11 @@ struct r10conf {
                                                * far_offset, in which case it is
                                                * 1 stripe.
                                                */
+                int             far_set_size; /* The number of devices in a set,
+                                               * where a 'set' are devices that
+                                               * contain far/offset copies of
+                                               * each other.
+                                               */
                 int             chunk_shift; /* shift from chunks to sectors */
                 sector_t        chunk_mask;
         } prev, geo;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 5af2d2709081..3ee2912889e7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1403,7 +1403,7 @@ static void ops_run_check_pq(struct stripe_head *sh, struct raid5_percpu *percpu
                            &sh->ops.zero_sum_result, percpu->spare_page, &submit);
 }
 
-static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
+static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
 {
         int overlap_clear = 0, i, disks = sh->disks;
         struct dma_async_tx_descriptor *tx = NULL;
@@ -1468,36 +1468,6 @@ static void __raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
         put_cpu();
 }
 
-#ifdef CONFIG_MULTICORE_RAID456
-static void async_run_ops(void *param, async_cookie_t cookie)
-{
-        struct stripe_head *sh = param;
-        unsigned long ops_request = sh->ops.request;
-
-        clear_bit_unlock(STRIPE_OPS_REQ_PENDING, &sh->state);
-        wake_up(&sh->ops.wait_for_ops);
-
-        __raid_run_ops(sh, ops_request);
-        release_stripe(sh);
-}
-
-static void raid_run_ops(struct stripe_head *sh, unsigned long ops_request)
-{
-        /* since handle_stripe can be called outside of raid5d context
-         * we need to ensure sh->ops.request is de-staged before another
-         * request arrives
-         */
-        wait_event(sh->ops.wait_for_ops,
-                   !test_and_set_bit_lock(STRIPE_OPS_REQ_PENDING, &sh->state));
-        sh->ops.request = ops_request;
-
-        atomic_inc(&sh->count);
-        async_schedule(async_run_ops, sh);
-}
-#else
-#define raid_run_ops __raid_run_ops
-#endif
-
 static int grow_one_stripe(struct r5conf *conf)
 {
         struct stripe_head *sh;
@@ -1506,9 +1476,6 @@ static int grow_one_stripe(struct r5conf *conf)
                 return 0;
 
         sh->raid_conf = conf;
-        #ifdef CONFIG_MULTICORE_RAID456
-        init_waitqueue_head(&sh->ops.wait_for_ops);
-        #endif
 
         spin_lock_init(&sh->stripe_lock);
 
@@ -1627,9 +1594,6 @@ static int resize_stripes(struct r5conf *conf, int newsize)
                         break;
 
                 nsh->raid_conf = conf;
-                #ifdef CONFIG_MULTICORE_RAID456
-                init_waitqueue_head(&nsh->ops.wait_for_ops);
-                #endif
                 spin_lock_init(&nsh->stripe_lock);
 
                 list_add(&nsh->lru, &newstripes);
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 11d01d67b3f5..7bd068a6056a 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1629,7 +1629,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
 
         /* If this is the first slave, then we need to set the master's hardware
          * address to be the same as the slave's. */
-        if (bond->dev_addr_from_first)
+        if (bond->slave_cnt == 0 && bond->dev_addr_from_first)
                 bond_set_dev_addr(bond->dev, slave_dev);
 
         new_slave = kzalloc(sizeof(struct slave), GFP_KERNEL);
diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c
index 639049d7e92d..da5f4397f87c 100644
--- a/drivers/net/ethernet/broadcom/bgmac.c
+++ b/drivers/net/ethernet/broadcom/bgmac.c
@@ -301,12 +301,16 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring,
                         bgmac_err(bgmac, "Found poisoned packet at slot %d, DMA issue!\n",
                                   ring->start);
                 } else {
+                        /* Omit CRC. */
+                        len -= ETH_FCS_LEN;
+
                         new_skb = netdev_alloc_skb_ip_align(bgmac->net_dev, len);
                         if (new_skb) {
                                 skb_put(new_skb, len);
                                 skb_copy_from_linear_data_offset(skb, BGMAC_RX_FRAME_OFFSET,
                                                                  new_skb->data,
                                                                  len);
+                                skb_checksum_none_assert(skb);
                                 new_skb->protocol =
                                         eth_type_trans(new_skb, bgmac->net_dev);
                                 netif_receive_skb(new_skb);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ecac04a3687c..a923bc4d5a1f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -3142,7 +3142,7 @@ static inline __le16 bnx2x_csum_fix(unsigned char *t_header, u16 csum, s8 fix)
                 tsum = ~csum_fold(csum_add((__force __wsum) csum,
                                   csum_partial(t_header, -fix, 0)));
 
-        return bswab16(csum);
+        return bswab16(tsum);
 }
 
 static inline u32 bnx2x_xmit_type(struct bnx2x *bp, struct sk_buff *skb)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 9a674b14b403..edfa67adf2f9 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -281,6 +281,8 @@ static int bnx2x_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                         cmd->lp_advertising |= ADVERTISED_2500baseX_Full;
                 if (status & LINK_STATUS_LINK_PARTNER_10GXFD_CAPABLE)
                         cmd->lp_advertising |= ADVERTISED_10000baseT_Full;
+                if (status & LINK_STATUS_LINK_PARTNER_20GXFD_CAPABLE)
+                        cmd->lp_advertising |= ADVERTISED_20000baseKR2_Full;
         }
 
         cmd->maxtxpkt = 0;
@@ -463,6 +465,10 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                                 ADVERTISED_10000baseKR_Full))
                                 bp->link_params.speed_cap_mask[cfg_idx] |=
                                         PORT_HW_CFG_SPEED_CAPABILITY_D0_10G;
+
+                        if (cmd->advertising & ADVERTISED_20000baseKR2_Full)
+                                bp->link_params.speed_cap_mask[cfg_idx] |=
+                                        PORT_HW_CFG_SPEED_CAPABILITY_D0_20G;
                 }
         } else { /* forced speed */
                 /* advertise the requested speed and duplex if supported */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 1663e0b6b5a0..31c5787970db 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -10422,6 +10422,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x0);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant off.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x0);
+                        }
                 }
                 break;
         case LED_MODE_ON:
@@ -10468,6 +10490,28 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LED1_MASK,
                                          0x20);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Disable MI_INT interrupt before setting LED4
+                                 * source to constant on.
+                                 */
+                                if (REG_RD(bp, NIG_REG_MASK_INTERRUPT_PORT0 +
+                                           params->port*4) &
+                                    NIG_MASK_MI_INT) {
+                                        params->link_flags |=
+                                        LINK_FLAGS_INT_DISABLED;
+
+                                        bnx2x_bits_dis(
+                                                bp,
+                                                NIG_REG_MASK_INTERRUPT_PORT0 +
+                                                params->port*4,
+                                                NIG_MASK_MI_INT);
+                                }
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x20);
+                        }
                 }
                 break;
 
@@ -10532,6 +10576,22 @@ static void bnx2x_848xx_set_link_led(struct bnx2x_phy *phy,
                                          MDIO_PMA_DEVAD,
                                          MDIO_PMA_REG_8481_LINK_SIGNAL,
                                          val);
+                        if (phy->type ==
+                            PORT_HW_CFG_XGXS_EXT_PHY_TYPE_BCM84834) {
+                                /* Restore LED4 source to external link,
+                                 * and re-enable interrupts.
+                                 */
+                                bnx2x_cl45_write(bp, phy,
+                                                 MDIO_PMA_DEVAD,
+                                                 MDIO_PMA_REG_8481_SIGNAL_MASK,
+                                                 0x40);
+                                if (params->link_flags &
+                                    LINK_FLAGS_INT_DISABLED) {
+                                        bnx2x_link_int_enable(params);
+                                        params->link_flags &=
+                                                ~LINK_FLAGS_INT_DISABLED;
+                                }
+                        }
                 }
                 break;
         }
@@ -11791,6 +11851,8 @@ static int bnx2x_populate_int_phy(struct bnx2x *bp, u32 shmem_base, u8 port,
                         phy->media_type = ETH_PHY_KR;
                         phy->flags |= FLAGS_WC_DUAL_MODE;
                         phy->supported &= (SUPPORTED_20000baseKR2_Full |
+                                           SUPPORTED_10000baseT_Full |
+                                           SUPPORTED_1000baseT_Full |
                                            SUPPORTED_Autoneg |
                                            SUPPORTED_FIBRE |
                                            SUPPORTED_Pause |
@@ -13437,7 +13499,7 @@ void bnx2x_period_func(struct link_params *params, struct link_vars *vars)
                 struct bnx2x_phy *phy = &params->phy[INT_PHY];
                 bnx2x_set_aer_mmd(params, phy);
                 if ((phy->supported & SUPPORTED_20000baseKR2_Full) &&
-                    (phy->speed_cap_mask & SPEED_20000))
+                    (phy->speed_cap_mask & PORT_HW_CFG_SPEED_CAPABILITY_D0_20G))
                         bnx2x_check_kr2_wa(params, vars, phy);
                 bnx2x_check_over_curr(params, vars);
                 if (vars->rx_tx_asic_rst)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
index d25c7d79787a..be5c195d03dd 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.h
@@ -307,7 +307,8 @@ struct link_params {
         struct bnx2x *bp;
         u16 req_fc_auto_adv; /* Should be set to TX / BOTH when
                                 req_flow_ctrl is set to AUTO */
-        u16 rsrv1;
+        u16 link_flags;
+#define LINK_FLAGS_INT_DISABLED         (1<<0)
         u32 lfa_base;
 };
 
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 28ceb8414185..29aff55f2eea 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -349,6 +349,7 @@ struct be_adapter {
         struct pci_dev *pdev;
         struct net_device *netdev;
 
+        u8 __iomem *csr;        /* CSR BAR used only for BE2/3 */
         u8 __iomem *db;         /* Door Bell */
 
         struct mutex mbox_lock; /* For serializing mbox cmds to BE card */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index 071aea79d218..3c9b4f12e3e5 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -473,19 +473,17 @@ static int be_mbox_notify_wait(struct be_adapter *adapter)
         return 0;
 }
 
-static int be_POST_stage_get(struct be_adapter *adapter, u16 *stage)
+static u16 be_POST_stage_get(struct be_adapter *adapter)
 {
         u32 sem;
-        u32 reg = skyhawk_chip(adapter) ? SLIPORT_SEMAPHORE_OFFSET_SH :
-                                          SLIPORT_SEMAPHORE_OFFSET_BE;
 
-        pci_read_config_dword(adapter->pdev, reg, &sem);
-        *stage = sem & POST_STAGE_MASK;
-
-        if ((sem >> POST_ERR_SHIFT) & POST_ERR_MASK)
-                return -1;
+        if (BEx_chip(adapter))
+                sem  = ioread32(adapter->csr + SLIPORT_SEMAPHORE_OFFSET_BEx);
         else
-                return 0;
+                pci_read_config_dword(adapter->pdev,
+                                      SLIPORT_SEMAPHORE_OFFSET_SH, &sem);
+
+        return sem & POST_STAGE_MASK;
 }
 
 int lancer_wait_ready(struct be_adapter *adapter)
@@ -579,19 +577,17 @@ int be_fw_wait_ready(struct be_adapter *adapter)
         }
 
         do {
-                status = be_POST_stage_get(adapter, &stage);
-                if (status) {
-                        dev_err(dev, "POST error; stage=0x%x\n", stage);
-                        return -1;
-                } else if (stage != POST_STAGE_ARMFW_RDY) {
-                        if (msleep_interruptible(2000)) {
-                                dev_err(dev, "Waiting for POST aborted\n");
-                                return -EINTR;
-                        }
-                        timeout += 2;
-                } else {
+                stage = be_POST_stage_get(adapter);
+                if (stage == POST_STAGE_ARMFW_RDY)
                         return 0;
+
+                dev_info(dev, "Waiting for POST, %ds elapsed\n",
+                         timeout);
+                if (msleep_interruptible(2000)) {
+                        dev_err(dev, "Waiting for POST aborted\n");
+                        return -EINTR;
                 }
+                timeout += 2;
         } while (timeout < 60);
 
         dev_err(dev, "POST timeout; stage=0x%x\n", stage);
diff --git a/drivers/net/ethernet/emulex/benet/be_hw.h b/drivers/net/ethernet/emulex/benet/be_hw.h
index 541d4530d5bf..62dc220695f7 100644
--- a/drivers/net/ethernet/emulex/benet/be_hw.h
+++ b/drivers/net/ethernet/emulex/benet/be_hw.h
@@ -32,8 +32,8 @@
 #define MPU_EP_CONTROL          0
 
 /********** MPU semphore: used for SH & BE  *************/
-#define SLIPORT_SEMAPHORE_OFFSET_BE             0x7c
-#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94
+#define SLIPORT_SEMAPHORE_OFFSET_BEx            0xac  /* CSR BAR offset */
+#define SLIPORT_SEMAPHORE_OFFSET_SH             0x94  /* PCI-CFG offset */
 #define POST_STAGE_MASK                         0x0000FFFF
 #define POST_ERR_MASK                           0x1
 #define POST_ERR_SHIFT                          31
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 3860888ac711..08e54f3d288b 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3688,6 +3688,8 @@ static void be_netdev_init(struct net_device *netdev)
 
 static void be_unmap_pci_bars(struct be_adapter *adapter)
 {
+        if (adapter->csr)
+                pci_iounmap(adapter->pdev, adapter->csr);
         if (adapter->db)
                 pci_iounmap(adapter->pdev, adapter->db);
 }
@@ -3721,6 +3723,12 @@ static int be_map_pci_bars(struct be_adapter *adapter)
         adapter->if_type = (sli_intf & SLI_INTF_IF_TYPE_MASK) >>
                                 SLI_INTF_IF_TYPE_SHIFT;
 
+        if (BEx_chip(adapter) && be_physfn(adapter)) {
+                adapter->csr = pci_iomap(adapter->pdev, 2, 0);
+                if (adapter->csr == NULL)
+                        return -ENOMEM;
+        }
+
         addr = pci_iomap(adapter->pdev, db_bar(adapter), 0);
         if (addr == NULL)
                 goto pci_map_err;
@@ -4329,6 +4337,8 @@ static pci_ers_result_t be_eeh_reset(struct pci_dev *pdev)
         pci_restore_state(pdev);
 
         /* Check if card is ok and fw is ready */
+        dev_info(&adapter->pdev->dev,
+                 "Waiting for FW to be ready after EEH reset\n");
         status = be_fw_wait_ready(adapter);
         if (status)
                 return PCI_ERS_RESULT_DISCONNECT;
diff --git a/drivers/net/ethernet/freescale/fec.c b/drivers/net/ethernet/freescale/fec.c
index fccc3bf2141d..069a155d16ed 100644
--- a/drivers/net/ethernet/freescale/fec.c
+++ b/drivers/net/ethernet/freescale/fec.c
@@ -246,14 +246,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         struct bufdesc *bdp;
         void *bufaddr;
         unsigned short  status;
-        unsigned long flags;
+        unsigned int index;
 
         if (!fep->link) {
                 /* Link is down or autonegotiation is in progress. */
                 return NETDEV_TX_BUSY;
         }
 
-        spin_lock_irqsave(&fep->hw_lock, flags);
         /* Fill in a Tx ring entry */
         bdp = fep->cur_tx;
 
@@ -264,7 +263,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                  * This should not happen, since ndev->tbusy should be set.
                  */
                 printk("%s: tx queue full!.\n", ndev->name);
-                spin_unlock_irqrestore(&fep->hw_lock, flags);
                 return NETDEV_TX_BUSY;
         }
 
@@ -280,13 +278,13 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
          * 4-byte boundaries. Use bounce buffers to copy data
          * and get it aligned. Ugh.
          */
+        if (fep->bufdesc_ex)
+                index = (struct bufdesc_ex *)bdp -
+                        (struct bufdesc_ex *)fep->tx_bd_base;
+        else
+                index = bdp - fep->tx_bd_base;
+
         if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
-                unsigned int index;
-                if (fep->bufdesc_ex)
-                        index = (struct bufdesc_ex *)bdp -
-                                (struct bufdesc_ex *)fep->tx_bd_base;
-                else
-                        index = bdp - fep->tx_bd_base;
                 memcpy(fep->tx_bounce[index], skb->data, skb->len);
                 bufaddr = fep->tx_bounce[index];
         }
@@ -300,10 +298,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                 swap_buffer(bufaddr, skb->len);
 
         /* Save skb pointer */
-        fep->tx_skbuff[fep->skb_cur] = skb;
-
-        ndev->stats.tx_bytes += skb->len;
-        fep->skb_cur = (fep->skb_cur+1) & TX_RING_MOD_MASK;
+        fep->tx_skbuff[index] = skb;
 
         /* Push the data cache so the CPM does not get stale memory
          * data.
@@ -331,26 +326,22 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
                         ebdp->cbd_esc = BD_ENET_TX_INT;
                 }
         }
-        /* Trigger transmission start */
-        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
-
         /* If this was the last BD in the ring, start at the beginning again. */
         if (status & BD_ENET_TX_WRAP)
                 bdp = fep->tx_bd_base;
         else
                 bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
 
-        if (bdp == fep->dirty_tx) {
-                fep->tx_full = 1;
+        fep->cur_tx = bdp;
+
+        if (fep->cur_tx == fep->dirty_tx)
                 netif_stop_queue(ndev);
-        }
 
-        fep->cur_tx = bdp;
+        /* Trigger transmission start */
+        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
 
         skb_tx_timestamp(skb);
 
-        spin_unlock_irqrestore(&fep->hw_lock, flags);
-
         return NETDEV_TX_OK;
 }
 
@@ -406,11 +397,8 @@ fec_restart(struct net_device *ndev, int duplex)
                 writel((unsigned long)fep->bd_dma + sizeof(struct bufdesc)
                         * RX_RING_SIZE, fep->hwp + FEC_X_DES_START);
 
-        fep->dirty_tx = fep->cur_tx = fep->tx_bd_base;
         fep->cur_rx = fep->rx_bd_base;
 
-        /* Reset SKB transmit buffers. */
-        fep->skb_cur = fep->skb_dirty = 0;
         for (i = 0; i <= TX_RING_MOD_MASK; i++) {
                 if (fep->tx_skbuff[i]) {
                         dev_kfree_skb_any(fep->tx_skbuff[i]);
@@ -573,20 +561,35 @@ fec_enet_tx(struct net_device *ndev)
         struct bufdesc *bdp;
         unsigned short status;
         struct  sk_buff *skb;
+        int     index = 0;
 
         fep = netdev_priv(ndev);
-        spin_lock(&fep->hw_lock);
         bdp = fep->dirty_tx;
 
+        /* get next bdp of dirty_tx */
+        if (bdp->cbd_sc & BD_ENET_TX_WRAP)
+                bdp = fep->tx_bd_base;
+        else
+                bdp = fec_enet_get_nextdesc(bdp, fep->bufdesc_ex);
+
         while (((status = bdp->cbd_sc) & BD_ENET_TX_READY) == 0) {
-                if (bdp == fep->cur_tx && fep->tx_full == 0)
+
+                /* current queue is empty */
+                if (bdp == fep->cur_tx)
                         break;
 
+                if (fep->bufdesc_ex)
+                        index = (struct bufdesc_ex *)bdp -
+                                (struct bufdesc_ex *)fep->tx_bd_base;
+                else
+                        index = bdp - fep->tx_bd_base;
+
                 dma_unmap_single(&fep->pdev->dev, bdp->cbd_bufaddr,
                                 FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
                 bdp->cbd_bufaddr = 0;
 
-                skb = fep->tx_skbuff[fep->skb_dirty];
+                skb = fep->tx_skbuff[index];
+
                 /* Check for errors. */
                 if (status & (BD_ENET_TX_HB | BD_ENET_TX_LC |
                                    BD_ENET_TX_RL | BD_ENET_TX_UN |
@@ -631,8 +634,9 @@ fec_enet_tx(struct net_device *ndev)
 
                 /* Free the sk buffer associated with this last transmit */
                 dev_kfree_skb_any(skb);
-                fep->tx_skbuff[fep->skb_dirty] = NULL;
-                fep->skb_dirty = (fep->skb_dirty + 1) & TX_RING_MOD_MASK;
+                fep->tx_skbuff[index] = NULL;
+
+                fep->dirty_tx = bdp;
 
                 /* Update pointer to next buffer descriptor to be transmitted */
                 if (status & BD_ENET_TX_WRAP)
@@ -642,14 +646,12 @@ fec_enet_tx(struct net_device *ndev)
 
                 /* Since we have freed up a buffer, the ring is no longer full
                  */
-                if (fep->tx_full) {
-                        fep->tx_full = 0;
+                if (fep->dirty_tx != fep->cur_tx) {
                         if (netif_queue_stopped(ndev))
                                 netif_wake_queue(ndev);
                 }
         }
-        fep->dirty_tx = bdp;
-        spin_unlock(&fep->hw_lock);
+        return;
 }
 
 
@@ -816,7 +818,7 @@ fec_enet_interrupt(int irq, void *dev_id)
                 int_events = readl(fep->hwp + FEC_IEVENT);
                 writel(int_events, fep->hwp + FEC_IEVENT);
 
-                if (int_events & FEC_ENET_RXF) {
+                if (int_events & (FEC_ENET_RXF | FEC_ENET_TXF)) {
                         ret = IRQ_HANDLED;
 
                         /* Disable the RX interrupt */
@@ -827,15 +829,6 @@ fec_enet_interrupt(int irq, void *dev_id)
                         }
                 }
 
-                /* Transmit OK, or non-fatal error. Update the buffer
-                 * descriptors. FEC handles all errors, we just discover
-                 * them as part of the transmit process.
-                 */
-                if (int_events & FEC_ENET_TXF) {
-                        ret = IRQ_HANDLED;
-                        fec_enet_tx(ndev);
-                }
-
                 if (int_events & FEC_ENET_MII) {
                         ret = IRQ_HANDLED;
                         complete(&fep->mdio_done);
@@ -851,6 +844,8 @@ static int fec_enet_rx_napi(struct napi_struct *napi, int budget)
         int pkts = fec_enet_rx(ndev, budget);
         struct fec_enet_private *fep = netdev_priv(ndev);
 
+        fec_enet_tx(ndev);
+
         if (pkts < budget) {
                 napi_complete(napi);
                 writel(FEC_DEFAULT_IMASK, fep->hwp + FEC_IMASK);
@@ -1646,6 +1641,7 @@ static int fec_enet_init(struct net_device *ndev)
 
         /* ...and the same for transmit */
         bdp = fep->tx_bd_base;
+        fep->cur_tx = bdp;
         for (i = 0; i < TX_RING_SIZE; i++) {
 
                 /* Initialize the BD for every fragment in the page. */
@@ -1657,6 +1653,7 @@ static int fec_enet_init(struct net_device *ndev)
         /* Set the last buffer to wrap */
         bdp = fec_enet_get_prevdesc(bdp, fep->bufdesc_ex);
         bdp->cbd_sc |= BD_SC_WRAP;
+        fep->dirty_tx = bdp;
 
         fec_restart(ndev, 0);
 
diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/freescale/fec.h
index 01579b8e37c4..f5390071efd0 100644
--- a/drivers/net/ethernet/freescale/fec.h
+++ b/drivers/net/ethernet/freescale/fec.h
@@ -97,6 +97,13 @@ struct bufdesc {
         unsigned short cbd_sc;  /* Control and status info */
         unsigned long cbd_bufaddr;      /* Buffer address */
 };
+#else
+struct bufdesc {
+        unsigned short  cbd_sc;                 /* Control and status info */
+        unsigned short  cbd_datlen;             /* Data length */
+        unsigned long   cbd_bufaddr;            /* Buffer address */
+};
+#endif
 
 struct bufdesc_ex {
         struct bufdesc desc;
@@ -107,14 +114,6 @@ struct bufdesc_ex {
         unsigned short res0[4];
 };
 
-#else
-struct bufdesc {
-        unsigned short  cbd_sc;                 /* Control and status info */
-        unsigned short  cbd_datlen;             /* Data length */
-        unsigned long   cbd_bufaddr;            /* Buffer address */
-};
-#endif
-
 /*
  *      The following definitions courtesy of commproc.h, which where
  *      Copyright (c) 1997 Dan Malek (dmalek@jlc.net).
@@ -214,8 +213,6 @@ struct fec_enet_private {
         unsigned char *tx_bounce[TX_RING_SIZE];
         struct  sk_buff *tx_skbuff[TX_RING_SIZE];
         struct  sk_buff *rx_skbuff[RX_RING_SIZE];
-        ushort  skb_cur;
-        ushort  skb_dirty;
 
         /* CPM dual port RAM relative addresses */
         dma_addr_t      bd_dma;
@@ -227,7 +224,6 @@ struct fec_enet_private {
         /* The ring entries to be free()ed */
         struct bufdesc  *dirty_tx;
 
-        uint    tx_full;
         /* hold while accessing the HW like ringbuffer for tx/rx but not MAC */
         spinlock_t hw_lock;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index dff7bff8b8e0..121a865c7fbd 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -782,6 +782,59 @@ release:
 }
 
 /**
+ *  e1000_k1_workaround_lpt_lp - K1 workaround on Lynxpoint-LP
+ *  @hw:   pointer to the HW structure
+ *  @link: link up bool flag
+ *
+ *  When K1 is enabled for 1Gbps, the MAC can miss 2 DMA completion indications
+ *  preventing further DMA write requests.  Workaround the issue by disabling
+ *  the de-assertion of the clock request when in 1Gpbs mode.
+ **/
+static s32 e1000_k1_workaround_lpt_lp(struct e1000_hw *hw, bool link)
+{
+        u32 fextnvm6 = er32(FEXTNVM6);
+        s32 ret_val = 0;
+
+        if (link && (er32(STATUS) & E1000_STATUS_SPEED_1000)) {
+                u16 kmrn_reg;
+
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return ret_val;
+
+                ret_val =
+                    e1000e_read_kmrn_reg_locked(hw, E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                &kmrn_reg);
+                if (ret_val)
+                        goto release;
+
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg &
+                                                 ~E1000_KMRNCTRLSTA_K1_ENABLE);
+                if (ret_val)
+                        goto release;
+
+                usleep_range(10, 20);
+
+                ew32(FEXTNVM6, fextnvm6 | E1000_FEXTNVM6_REQ_PLL_CLK);
+
+                ret_val =
+                    e1000e_write_kmrn_reg_locked(hw,
+                                                 E1000_KMRNCTRLSTA_K1_CONFIG,
+                                                 kmrn_reg);
+release:
+                hw->phy.ops.release(hw);
+        } else {
+                /* clear FEXTNVM6 bit 8 on link down or 10/100 */
+                ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+        }
+
+        return ret_val;
+}
+
+/**
  *  e1000_check_for_copper_link_ich8lan - Check for link (Copper)
  *  @hw: pointer to the HW structure
  *
@@ -818,6 +871,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                         return ret_val;
         }
 
+        /* Work-around I218 hang issue */
+        if ((hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+            (hw->adapter->pdev->device == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                ret_val = e1000_k1_workaround_lpt_lp(hw, link);
+                if (ret_val)
+                        return ret_val;
+        }
+
         /* Clear link partner's EEE ability */
         hw->dev_spec.ich8lan.eee_lp_ability = 0;
 
@@ -3954,8 +4015,16 @@ void e1000_suspend_workarounds_ich8lan(struct e1000_hw *hw)
 
         phy_ctrl = er32(PHY_CTRL);
         phy_ctrl |= E1000_PHY_CTRL_GBE_DISABLE;
+
         if (hw->phy.type == e1000_phy_i217) {
-                u16 phy_reg;
+                u16 phy_reg, device_id = hw->adapter->pdev->device;
+
+                if ((device_id == E1000_DEV_ID_PCH_LPTLP_I218_LM) ||
+                    (device_id == E1000_DEV_ID_PCH_LPTLP_I218_V)) {
+                        u32 fextnvm6 = er32(FEXTNVM6);
+
+                        ew32(FEXTNVM6, fextnvm6 & ~E1000_FEXTNVM6_REQ_PLL_CLK);
+                }
 
                 ret_val = hw->phy.ops.acquire(hw);
                 if (ret_val)
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h
index b6d3174d7d2d..8bf4655c2e17 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h
@@ -92,6 +92,8 @@
 #define E1000_FEXTNVM4_BEACON_DURATION_8USEC    0x7
 #define E1000_FEXTNVM4_BEACON_DURATION_16USEC   0x3
 
+#define E1000_FEXTNVM6_REQ_PLL_CLK      0x00000100
+
 #define PCIE_ICH8_SNOOP_ALL     PCIE_NO_SNOOP_ALL
 
 #define E1000_ICH_RAR_ENTRIES   7
diff --git a/drivers/net/ethernet/intel/e1000e/regs.h b/drivers/net/ethernet/intel/e1000e/regs.h
index 794fe1497666..a7e6a3e37257 100644
--- a/drivers/net/ethernet/intel/e1000e/regs.h
+++ b/drivers/net/ethernet/intel/e1000e/regs.h
@@ -42,6 +42,7 @@
 #define E1000_FEXTNVM   0x00028 /* Future Extended NVM - RW */
 #define E1000_FEXTNVM3  0x0003C /* Future Extended NVM 3 - RW */
 #define E1000_FEXTNVM4  0x00024 /* Future Extended NVM 4 - RW */
+#define E1000_FEXTNVM6  0x00010 /* Future Extended NVM 6 - RW */
 #define E1000_FEXTNVM7  0x000E4 /* Future Extended NVM 7 - RW */
 #define E1000_FCT       0x00030 /* Flow Control Type - RW */
 #define E1000_VET       0x00038 /* VLAN Ether Type - RW */
diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c
index 84e7e0909def..b64542acfa34 100644
--- a/drivers/net/ethernet/intel/igb/e1000_82575.c
+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c
@@ -1361,11 +1361,16 @@ static s32 igb_setup_copper_link_82575(struct e1000_hw *hw)
         switch (hw->phy.type) {
         case e1000_phy_i210:
         case e1000_phy_m88:
-                if (hw->phy.id == I347AT4_E_PHY_ID ||
-                    hw->phy.id == M88E1112_E_PHY_ID)
+                switch (hw->phy.id) {
+                case I347AT4_E_PHY_ID:
+                case M88E1112_E_PHY_ID:
+                case I210_I_PHY_ID:
                         ret_val = igb_copper_link_setup_m88_gen2(hw);
-                else
+                        break;
+                default:
                         ret_val = igb_copper_link_setup_m88(hw);
+                        break;
+                }
                 break;
         case e1000_phy_igp_3:
                 ret_val = igb_copper_link_setup_igp(hw);
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index d27edbc63923..25151401c2ab 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -447,7 +447,7 @@ struct igb_adapter {
 #endif
         struct i2c_algo_bit_data i2c_algo;
         struct i2c_adapter i2c_adap;
-        struct igb_i2c_client_list *i2c_clients;
+        struct i2c_client *i2c_client;
 };
 
 #define IGB_FLAG_HAS_MSI                (1 << 0)
diff --git a/drivers/net/ethernet/intel/igb/igb_hwmon.c b/drivers/net/ethernet/intel/igb/igb_hwmon.c
index 0a9b073d0b03..4623502054d5 100644
--- a/drivers/net/ethernet/intel/igb/igb_hwmon.c
+++ b/drivers/net/ethernet/intel/igb/igb_hwmon.c
@@ -39,6 +39,10 @@
 #include <linux/pci.h>
 
 #ifdef CONFIG_IGB_HWMON
+struct i2c_board_info i350_sensor_info = {
+        I2C_BOARD_INFO("i350bb", (0Xf8 >> 1)),
+};
+
 /* hwmon callback functions */
 static ssize_t igb_hwmon_show_location(struct device *dev,
                                          struct device_attribute *attr,
@@ -188,6 +192,7 @@ int igb_sysfs_init(struct igb_adapter *adapter)
         unsigned int i;
         int n_attrs;
         int rc = 0;
+        struct i2c_client *client = NULL;
 
         /* If this method isn't defined we don't support thermals */
         if (adapter->hw.mac.ops.init_thermal_sensor_thresh == NULL)
@@ -198,6 +203,15 @@ int igb_sysfs_init(struct igb_adapter *adapter)
                 if (rc)
                         goto exit;
 
+        /* init i2c_client */
+        client = i2c_new_device(&adapter->i2c_adap, &i350_sensor_info);
+        if (client == NULL) {
+                dev_info(&adapter->pdev->dev,
+                        "Failed to create new i2c device..\n");
+                goto exit;
+        }
+        adapter->i2c_client = client;
+
         /* Allocation space for max attributes
          * max num sensors * values (loc, temp, max, caution)
          */
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index ed79a1c53b59..4dbd62968c7a 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -1923,10 +1923,6 @@ void igb_set_fw_version(struct igb_adapter *adapter)
         return;
 }
 
-static const struct i2c_board_info i350_sensor_info = {
-        I2C_BOARD_INFO("i350bb", 0Xf8),
-};
-
 /*  igb_init_i2c - Init I2C interface
  *  @adapter: pointer to adapter structure
  *
@@ -6227,13 +6223,6 @@ static struct sk_buff *igb_build_rx_buffer(struct igb_ring *rx_ring,
         /* If we spanned a buffer we have a huge mess so test for it */
         BUG_ON(unlikely(!igb_test_staterr(rx_desc, E1000_RXD_STAT_EOP)));
 
-        /* Guarantee this function can be used by verifying buffer sizes */
-        BUILD_BUG_ON(SKB_WITH_OVERHEAD(IGB_RX_BUFSZ) < (NET_SKB_PAD +
-                                                        NET_IP_ALIGN +
-                                                        IGB_TS_HDR_LEN +
-                                                        ETH_FRAME_LEN +
-                                                        ETH_FCS_LEN));
-
         rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean];
         page = rx_buffer->page;
         prefetchw(page);
@@ -7724,67 +7713,6 @@ static void igb_init_dmac(struct igb_adapter *adapter, u32 pba)
         }
 }
 
-static DEFINE_SPINLOCK(i2c_clients_lock);
-
-/*  igb_get_i2c_client - returns matching client
- *  in adapters's client list.
- *  @adapter: adapter struct
- *  @dev_addr: device address of i2c needed.
- */
-static struct i2c_client *
-igb_get_i2c_client(struct igb_adapter *adapter, u8 dev_addr)
-{
-        ulong flags;
-        struct igb_i2c_client_list *client_list;
-        struct i2c_client *client = NULL;
-        struct i2c_board_info client_info = {
-                I2C_BOARD_INFO("igb", 0x00),
-        };
-
-        spin_lock_irqsave(&i2c_clients_lock, flags);
-        client_list = adapter->i2c_clients;
-
-        /* See if we already have an i2c_client */
-        while (client_list) {
-                if (client_list->client->addr == (dev_addr >> 1)) {
-                        client = client_list->client;
-                        goto exit;
-                } else {
-                        client_list = client_list->next;
-                }
-        }
-
-        /* no client_list found, create a new one */
-        client_list = kzalloc(sizeof(*client_list), GFP_ATOMIC);
-        if (client_list == NULL)
-                goto exit;
-
-        /* dev_addr passed to us is left-shifted by 1 bit
-         * i2c_new_device call expects it to be flush to the right.
-         */
-        client_info.addr = dev_addr >> 1;
-        client_info.platform_data = adapter;
-        client_list->client = i2c_new_device(&adapter->i2c_adap, &client_info);
-        if (client_list->client == NULL) {
-                dev_info(&adapter->pdev->dev,
-                        "Failed to create new i2c device..\n");
-                goto err_no_client;
-        }
-
-        /* insert new client at head of list */
-        client_list->next = adapter->i2c_clients;
-        adapter->i2c_clients = client_list;
-
-        client = client_list->client;
-        goto exit;
-
-err_no_client:
-        kfree(client_list);
-exit:
-        spin_unlock_irqrestore(&i2c_clients_lock, flags);
-        return client;
-}
-
 /*  igb_read_i2c_byte - Reads 8 bit word over I2C
  *  @hw: pointer to hardware structure
  *  @byte_offset: byte offset to read
@@ -7798,7 +7726,7 @@ s32 igb_read_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                 u8 dev_addr, u8 *data)
 {
         struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
         s32 status;
         u16 swfw_mask = 0;
 
@@ -7835,7 +7763,7 @@ s32 igb_write_i2c_byte(struct e1000_hw *hw, u8 byte_offset,
                                  u8 dev_addr, u8 data)
 {
         struct igb_adapter *adapter = container_of(hw, struct igb_adapter, hw);
-        struct i2c_client *this_client = igb_get_i2c_client(adapter, dev_addr);
+        struct i2c_client *this_client = adapter->i2c_client;
         s32 status;
         u16 swfw_mask = E1000_SWFW_PHY0_SM;
 
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index 8900398ba103..28fb50a1e9c3 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -4765,8 +4765,10 @@ static void rtl_hw_start_8168bb(struct rtl8169_private *tp)
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 
-        rtl_tx_performance_tweak(pdev,
-                (0x5 << MAX_READ_REQUEST_SHIFT) | PCI_EXP_DEVCTL_NOSNOOP_EN);
+        if (tp->dev->mtu <= ETH_DATA_LEN) {
+                rtl_tx_performance_tweak(pdev, (0x5 << MAX_READ_REQUEST_SHIFT) |
+                                         PCI_EXP_DEVCTL_NOSNOOP_EN);
+        }
 }
 
 static void rtl_hw_start_8168bef(struct rtl8169_private *tp)
@@ -4789,7 +4791,8 @@ static void __rtl_hw_start_8168cp(struct rtl8169_private *tp)
 
         RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         rtl_disable_clock_request(pdev);
 
@@ -4822,7 +4825,8 @@ static void rtl_hw_start_8168cp_2(struct rtl8169_private *tp)
 
         RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4841,7 +4845,8 @@ static void rtl_hw_start_8168cp_3(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4901,7 +4906,8 @@ static void rtl_hw_start_8168d(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R8168_CPCMD_QUIRK_MASK);
 }
@@ -4913,7 +4919,8 @@ static void rtl_hw_start_8168dp(struct rtl8169_private *tp)
 
         rtl_csi_access_enable_1(tp);
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
@@ -4972,7 +4979,8 @@ static void rtl_hw_start_8168e_1(struct rtl8169_private *tp)
 
         rtl_ephy_init(tp, e_info_8168e_1, ARRAY_SIZE(e_info_8168e_1));
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         RTL_W8(MaxTxPacketSize, TxPacketMax);
 
@@ -4998,7 +5006,8 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
 
         rtl_ephy_init(tp, e_info_8168e_2, ARRAY_SIZE(e_info_8168e_2));
 
-        rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
+        if (tp->dev->mtu <= ETH_DATA_LEN)
+                rtl_tx_performance_tweak(pdev, 0x5 << MAX_READ_REQUEST_SHIFT);
 
         rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index bf57b3cb16ab..0bc00991d310 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -779,6 +779,7 @@ efx_realloc_channels(struct efx_nic *efx, u32 rxq_entries, u32 txq_entries)
                                                 tx_queue->txd.entries);
         }
 
+        efx_device_detach_sync(efx);
         efx_stop_all(efx);
         efx_stop_interrupts(efx, true);
 
@@ -832,6 +833,7 @@ out:
 
         efx_start_interrupts(efx, true);
         efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
         return rc;
 
 rollback:
@@ -1641,8 +1643,12 @@ static void efx_stop_all(struct efx_nic *efx)
         /* Flush efx_mac_work(), refill_workqueue, monitor_work */
         efx_flush_all(efx);
 
-        /* Stop the kernel transmit interface late, so the watchdog
-         * timer isn't ticking over the flush */
+        /* Stop the kernel transmit interface.  This is only valid if
+         * the device is stopped or detached; otherwise the watchdog
+         * may fire immediately.
+         */
+        WARN_ON(netif_running(efx->net_dev) &&
+                netif_device_present(efx->net_dev));
         netif_tx_disable(efx->net_dev);
 
         efx_stop_datapath(efx);
@@ -1963,16 +1969,18 @@ static int efx_change_mtu(struct net_device *net_dev, int new_mtu)
         if (new_mtu > EFX_MAX_MTU)
                 return -EINVAL;
 
-        efx_stop_all(efx);
-
         netif_dbg(efx, drv, efx->net_dev, "changing MTU to %d\n", new_mtu);
 
+        efx_device_detach_sync(efx);
+        efx_stop_all(efx);
+
         mutex_lock(&efx->mac_lock);
         net_dev->mtu = new_mtu;
         efx->type->reconfigure_mac(efx);
         mutex_unlock(&efx->mac_lock);
 
         efx_start_all(efx);
+        netif_device_attach(efx->net_dev);
         return 0;
 }
 
diff --git a/drivers/net/ethernet/sfc/efx.h b/drivers/net/ethernet/sfc/efx.h
index 50247dfe8f57..d2f790df6dcb 100644
--- a/drivers/net/ethernet/sfc/efx.h
+++ b/drivers/net/ethernet/sfc/efx.h
@@ -171,9 +171,9 @@ static inline void efx_device_detach_sync(struct efx_nic *efx)
          * TX scheduler is stopped when we're done and before
          * netif_device_present() becomes false.
          */
-        netif_tx_lock(dev);
+        netif_tx_lock_bh(dev);
         netif_device_detach(dev);
-        netif_tx_unlock(dev);
+        netif_tx_unlock_bh(dev);
 }
 
 #endif /* EFX_EFX_H */
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index 2d756c1d7142..0a90abd2421b 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -210,6 +210,7 @@ struct efx_tx_queue {
  *      Will be %NULL if the buffer slot is currently free.
  * @page: The associated page buffer. Valif iff @flags & %EFX_RX_BUF_PAGE.
  *      Will be %NULL if the buffer slot is currently free.
+ * @page_offset: Offset within page. Valid iff @flags & %EFX_RX_BUF_PAGE.
  * @len: Buffer length, in bytes.
  * @flags: Flags for buffer and packet state.
  */
@@ -219,7 +220,8 @@ struct efx_rx_buffer {
                 struct sk_buff *skb;
                 struct page *page;
         } u;
-        unsigned int len;
+        u16 page_offset;
+        u16 len;
         u16 flags;
 };
 #define EFX_RX_BUF_PAGE         0x0001
diff --git a/drivers/net/ethernet/sfc/rx.c b/drivers/net/ethernet/sfc/rx.c
index d780a0d096b4..bb579a6128c8 100644
--- a/drivers/net/ethernet/sfc/rx.c
+++ b/drivers/net/ethernet/sfc/rx.c
@@ -90,11 +90,7 @@ static unsigned int rx_refill_threshold;
 static inline unsigned int efx_rx_buf_offset(struct efx_nic *efx,
                                              struct efx_rx_buffer *buf)
 {
-        /* Offset is always within one page, so we don't need to consider
-         * the page order.
-         */
-        return ((unsigned int) buf->dma_addr & (PAGE_SIZE - 1)) +
-                efx->type->rx_buffer_hash_size;
+        return buf->page_offset + efx->type->rx_buffer_hash_size;
 }
 static inline unsigned int efx_rx_buf_size(struct efx_nic *efx)
 {
@@ -187,6 +183,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
         struct efx_nic *efx = rx_queue->efx;
         struct efx_rx_buffer *rx_buf;
         struct page *page;
+        unsigned int page_offset;
         struct efx_rx_page_state *state;
         dma_addr_t dma_addr;
         unsigned index, count;
@@ -211,12 +208,14 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                 state->dma_addr = dma_addr;
 
                 dma_addr += sizeof(struct efx_rx_page_state);
+                page_offset = sizeof(struct efx_rx_page_state);
 
         split:
                 index = rx_queue->added_count & rx_queue->ptr_mask;
                 rx_buf = efx_rx_buffer(rx_queue, index);
                 rx_buf->dma_addr = dma_addr + EFX_PAGE_IP_ALIGN;
                 rx_buf->u.page = page;
+                rx_buf->page_offset = page_offset + EFX_PAGE_IP_ALIGN;
                 rx_buf->len = efx->rx_buffer_len - EFX_PAGE_IP_ALIGN;
                 rx_buf->flags = EFX_RX_BUF_PAGE;
                 ++rx_queue->added_count;
@@ -227,6 +226,7 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
                         /* Use the second half of the page */
                         get_page(page);
                         dma_addr += (PAGE_SIZE >> 1);
+                        page_offset += (PAGE_SIZE >> 1);
                         ++count;
                         goto split;
                 }
@@ -236,7 +236,8 @@ static int efx_init_rx_buffers_page(struct efx_rx_queue *rx_queue)
 }
 
 static void efx_unmap_rx_buffer(struct efx_nic *efx,
-                                struct efx_rx_buffer *rx_buf)
+                                struct efx_rx_buffer *rx_buf,
+                                unsigned int used_len)
 {
         if ((rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.page) {
                 struct efx_rx_page_state *state;
@@ -247,6 +248,10 @@ static void efx_unmap_rx_buffer(struct efx_nic *efx,
                                        state->dma_addr,
                                        efx_rx_buf_size(efx),
                                        DMA_FROM_DEVICE);
+                } else if (used_len) {
+                        dma_sync_single_for_cpu(&efx->pci_dev->dev,
+                                                rx_buf->dma_addr, used_len,
+                                                DMA_FROM_DEVICE);
                 }
         } else if (!(rx_buf->flags & EFX_RX_BUF_PAGE) && rx_buf->u.skb) {
                 dma_unmap_single(&efx->pci_dev->dev, rx_buf->dma_addr,
@@ -269,7 +274,7 @@ static void efx_free_rx_buffer(struct efx_nic *efx,
 static void efx_fini_rx_buffer(struct efx_rx_queue *rx_queue,
                                struct efx_rx_buffer *rx_buf)
 {
-        efx_unmap_rx_buffer(rx_queue->efx, rx_buf);
+        efx_unmap_rx_buffer(rx_queue->efx, rx_buf, 0);
         efx_free_rx_buffer(rx_queue->efx, rx_buf);
 }
 
@@ -535,10 +540,10 @@ void efx_rx_packet(struct efx_rx_queue *rx_queue, unsigned int index,
                 goto out;
         }
 
-        /* Release card resources - assumes all RX buffers consumed in-order
-         * per RX queue
+        /* Release and/or sync DMA mapping - assumes all RX buffers
+         * consumed in-order per RX queue
          */
-        efx_unmap_rx_buffer(efx, rx_buf);
+        efx_unmap_rx_buffer(efx, rx_buf, len);
 
         /* Prefetch nice and early so data will (hopefully) be in cache by
          * the time we look at it.
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 7e93df6585e7..01ffbc486982 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -731,7 +731,7 @@ static inline void cpsw_add_default_vlan(struct cpsw_priv *priv)
 
         writel(vlan, &priv->host_port_regs->port_vlan);
 
-        for (i = 0; i < 2; i++)
+        for (i = 0; i < priv->data.slaves; i++)
                 slave_write(priv->slaves + i, vlan, reg);
 
         cpsw_ale_add_vlan(priv->ale, vlan, ALE_ALL_PORTS << port,
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 29934446436a..abf7b6153d00 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -257,8 +257,7 @@ static struct phy_driver ksphy_driver[] = {
         .phy_id         = PHY_ID_KSZ9021,
         .phy_id_mask    = 0x000ffffe,
         .name           = "Micrel KSZ9021 Gigabit PHY",
-        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause
-                                | SUPPORTED_Asym_Pause),
+        .features       = (PHY_GBIT_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
         .config_init    = kszphy_config_init,
         .config_aneg    = genphy_config_aneg,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 9930f9999561..3657b4a29124 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -44,13 +44,13 @@ MODULE_LICENSE("GPL");
 
 void phy_device_free(struct phy_device *phydev)
 {
-        kfree(phydev);
+        put_device(&phydev->dev);
 }
 EXPORT_SYMBOL(phy_device_free);
 
 static void phy_device_release(struct device *dev)
 {
-        phy_device_free(to_phy_device(dev));
+        kfree(to_phy_device(dev));
 }
 
 static struct phy_driver genphy_driver;
@@ -201,6 +201,8 @@ struct phy_device *phy_device_create(struct mii_bus *bus, int addr, int phy_id,
            there's no driver _already_ loaded. */
         request_module(MDIO_MODULE_PREFIX MDIO_ID_FMT, MDIO_ID_ARGS(phy_id));
 
+        device_initialize(&dev->dev);
+
         return dev;
 }
 EXPORT_SYMBOL(phy_device_create);
@@ -363,9 +365,9 @@ int phy_device_register(struct phy_device *phydev)
         /* Run all of the fixups for this PHY */
         phy_scan_fixups(phydev);
 
-        err = device_register(&phydev->dev);
+        err = device_add(&phydev->dev);
         if (err) {
-                pr_err("phy %d failed to register\n", phydev->addr);
+                pr_err("PHY %d failed to add\n", phydev->addr);
                 goto out;
         }
 
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index da92ed3797aa..3b6e9b83342d 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -156,6 +156,24 @@ config USB_NET_AX8817X
           This driver creates an interface named "ethX", where X depends on
           what other networking devices you have in use.
 
+config USB_NET_AX88179_178A
+        tristate "ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet"
+        depends on USB_USBNET
+        select CRC32
+        select PHYLIB
+        default y
+        help
+          This option adds support for ASIX AX88179 based USB 3.0/2.0
+          to Gigabit Ethernet adapters.
+
+          This driver should work with at least the following devices:
+            * ASIX AX88179
+            * ASIX AX88178A
+            * Sitcomm LN-032
+
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.
+
 config USB_NET_CDCETHER
         tristate "CDC Ethernet support (smart devices such as cable modems)"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 478691326f37..119b06c9aa16 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 asix-y := asix_devices.o asix_common.o ax88172a.o
+obj-$(CONFIG_USB_NET_AX88179_178A)      += ax88179_178a.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
 obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c
index 2205dbc8d32f..709753469099 100644
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -924,6 +924,29 @@ static const struct driver_info ax88178_info = {
         .tx_fixup = asix_tx_fixup,
 };
 
+/*
+ * USBLINK 20F9 "USB 2.0 LAN" USB ethernet adapter, typically found in
+ * no-name packaging.
+ * USB device strings are:
+ *   1: Manufacturer: USBLINK
+ *   2: Product: HG20F9 USB2.0
+ *   3: Serial: 000003
+ * Appears to be compatible with Asix 88772B.
+ */
+static const struct driver_info hg20f9_info = {
+        .description = "HG20F9 USB 2.0 Ethernet",
+        .bind = ax88772_bind,
+        .unbind = ax88772_unbind,
+        .status = asix_status,
+        .link_reset = ax88772_link_reset,
+        .reset = ax88772_reset,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_LINK_INTR |
+                 FLAG_MULTI_PACKET,
+        .rx_fixup = asix_rx_fixup_common,
+        .tx_fixup = asix_tx_fixup,
+        .data = FLAG_EEPROM_MAC,
+};
+
 extern const struct driver_info ax88172a_info;
 
 static const struct usb_device_id       products [] = {
@@ -1063,6 +1086,14 @@ static const struct usb_device_id	products [] = {
         /* ASIX 88172a demo board */
         USB_DEVICE(0x0b95, 0x172a),
         .driver_info = (unsigned long) &ax88172a_info,
+}, {
+        /*
+         * USBLINK HG20F9 "USB 2.0 LAN"
+         * Appears to have gazumped Linksys's manufacturer ID but
+         * doesn't (yet) conflict with any known Linksys product.
+         */
+        USB_DEVICE(0x066b, 0x20f9),
+        .driver_info = (unsigned long) &hg20f9_info,
 },
         { },            // END
 };
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
new file mode 100644
index 000000000000..71c27d8d214f
--- /dev/null
+++ b/drivers/net/usb/ax88179_178a.c
@@ -0,0 +1,1448 @@
+/*
+ * ASIX AX88179/178A USB 3.0/2.0 to Gigabit Ethernet Devices
+ *
+ * Copyright (C) 2011-2013 ASIX
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ */
+
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/usbnet.h>
+
+#define AX88179_PHY_ID                          0x03
+#define AX_EEPROM_LEN                           0x100
+#define AX88179_EEPROM_MAGIC                    0x17900b95
+#define AX_MCAST_FLTSIZE                        8
+#define AX_MAX_MCAST                            64
+#define AX_INT_PPLS_LINK                        ((u32)BIT(16))
+#define AX_RXHDR_L4_TYPE_MASK                   0x1c
+#define AX_RXHDR_L4_TYPE_UDP                    4
+#define AX_RXHDR_L4_TYPE_TCP                    16
+#define AX_RXHDR_L3CSUM_ERR                     2
+#define AX_RXHDR_L4CSUM_ERR                     1
+#define AX_RXHDR_CRC_ERR                        ((u32)BIT(31))
+#define AX_RXHDR_DROP_ERR                       ((u32)BIT(30))
+#define AX_ACCESS_MAC                           0x01
+#define AX_ACCESS_PHY                           0x02
+#define AX_ACCESS_EEPROM                        0x04
+#define AX_ACCESS_EFUS                          0x05
+#define AX_PAUSE_WATERLVL_HIGH                  0x54
+#define AX_PAUSE_WATERLVL_LOW                   0x55
+
+#define PHYSICAL_LINK_STATUS                    0x02
+        #define AX_USB_SS               0x04
+        #define AX_USB_HS               0x02
+
+#define GENERAL_STATUS                          0x03
+/* Check AX88179 version. UA1:Bit2 = 0,  UA2:Bit2 = 1 */
+        #define AX_SECLD                0x04
+
+#define AX_SROM_ADDR                            0x07
+#define AX_SROM_CMD                             0x0a
+        #define EEP_RD                  0x04
+        #define EEP_BUSY                0x10
+
+#define AX_SROM_DATA_LOW                        0x08
+#define AX_SROM_DATA_HIGH                       0x09
+
+#define AX_RX_CTL                               0x0b
+        #define AX_RX_CTL_DROPCRCERR    0x0100
+        #define AX_RX_CTL_IPE           0x0200
+        #define AX_RX_CTL_START         0x0080
+        #define AX_RX_CTL_AP            0x0020
+        #define AX_RX_CTL_AM            0x0010
+        #define AX_RX_CTL_AB            0x0008
+        #define AX_RX_CTL_AMALL         0x0002
+        #define AX_RX_CTL_PRO           0x0001
+        #define AX_RX_CTL_STOP          0x0000
+
+#define AX_NODE_ID                              0x10
+#define AX_MULFLTARY                            0x16
+
+#define AX_MEDIUM_STATUS_MODE                   0x22
+        #define AX_MEDIUM_GIGAMODE      0x01
+        #define AX_MEDIUM_FULL_DUPLEX   0x02
+        #define AX_MEDIUM_ALWAYS_ONE    0x04
+        #define AX_MEDIUM_EN_125MHZ     0x08
+        #define AX_MEDIUM_RXFLOW_CTRLEN 0x10
+        #define AX_MEDIUM_TXFLOW_CTRLEN 0x20
+        #define AX_MEDIUM_RECEIVE_EN    0x100
+        #define AX_MEDIUM_PS            0x200
+        #define AX_MEDIUM_JUMBO_EN      0x8040
+
+#define AX_MONITOR_MOD                          0x24
+        #define AX_MONITOR_MODE_RWLC    0x02
+        #define AX_MONITOR_MODE_RWMP    0x04
+        #define AX_MONITOR_MODE_PMEPOL  0x20
+        #define AX_MONITOR_MODE_PMETYPE 0x40
+
+#define AX_GPIO_CTRL                            0x25
+        #define AX_GPIO_CTRL_GPIO3EN    0x80
+        #define AX_GPIO_CTRL_GPIO2EN    0x40
+        #define AX_GPIO_CTRL_GPIO1EN    0x20
+
+#define AX_PHYPWR_RSTCTL                        0x26
+        #define AX_PHYPWR_RSTCTL_BZ     0x0010
+        #define AX_PHYPWR_RSTCTL_IPRL   0x0020
+        #define AX_PHYPWR_RSTCTL_AT     0x1000
+
+#define AX_RX_BULKIN_QCTRL                      0x2e
+#define AX_CLK_SELECT                           0x33
+        #define AX_CLK_SELECT_BCS       0x01
+        #define AX_CLK_SELECT_ACS       0x02
+        #define AX_CLK_SELECT_ULR       0x08
+
+#define AX_RXCOE_CTL                            0x34
+        #define AX_RXCOE_IP             0x01
+        #define AX_RXCOE_TCP            0x02
+        #define AX_RXCOE_UDP            0x04
+        #define AX_RXCOE_TCPV6          0x20
+        #define AX_RXCOE_UDPV6          0x40
+
+#define AX_TXCOE_CTL                            0x35
+        #define AX_TXCOE_IP             0x01
+        #define AX_TXCOE_TCP            0x02
+        #define AX_TXCOE_UDP            0x04
+        #define AX_TXCOE_TCPV6          0x20
+        #define AX_TXCOE_UDPV6          0x40
+
+#define AX_LEDCTRL                              0x73
+
+#define GMII_PHY_PHYSR                          0x11
+        #define GMII_PHY_PHYSR_SMASK    0xc000
+        #define GMII_PHY_PHYSR_GIGA     0x8000
+        #define GMII_PHY_PHYSR_100      0x4000
+        #define GMII_PHY_PHYSR_FULL     0x2000
+        #define GMII_PHY_PHYSR_LINK     0x400
+
+#define GMII_LED_ACT                            0x1a
+        #define GMII_LED_ACTIVE_MASK    0xff8f
+        #define GMII_LED0_ACTIVE        BIT(4)
+        #define GMII_LED1_ACTIVE        BIT(5)
+        #define GMII_LED2_ACTIVE        BIT(6)
+
+#define GMII_LED_LINK                           0x1c
+        #define GMII_LED_LINK_MASK      0xf888
+        #define GMII_LED0_LINK_10       BIT(0)
+        #define GMII_LED0_LINK_100      BIT(1)
+        #define GMII_LED0_LINK_1000     BIT(2)
+        #define GMII_LED1_LINK_10       BIT(4)
+        #define GMII_LED1_LINK_100      BIT(5)
+        #define GMII_LED1_LINK_1000     BIT(6)
+        #define GMII_LED2_LINK_10       BIT(8)
+        #define GMII_LED2_LINK_100      BIT(9)
+        #define GMII_LED2_LINK_1000     BIT(10)
+        #define LED0_ACTIVE             BIT(0)
+        #define LED0_LINK_10            BIT(1)
+        #define LED0_LINK_100           BIT(2)
+        #define LED0_LINK_1000          BIT(3)
+        #define LED0_FD                 BIT(4)
+        #define LED0_USB3_MASK          0x001f
+        #define LED1_ACTIVE             BIT(5)
+        #define LED1_LINK_10            BIT(6)
+        #define LED1_LINK_100           BIT(7)
+        #define LED1_LINK_1000          BIT(8)
+        #define LED1_FD                 BIT(9)
+        #define LED1_USB3_MASK          0x03e0
+        #define LED2_ACTIVE             BIT(10)
+        #define LED2_LINK_1000          BIT(13)
+        #define LED2_LINK_100           BIT(12)
+        #define LED2_LINK_10            BIT(11)
+        #define LED2_FD                 BIT(14)
+        #define LED_VALID               BIT(15)
+        #define LED2_USB3_MASK          0x7c00
+
+#define GMII_PHYPAGE                            0x1e
+#define GMII_PHY_PAGE_SELECT                    0x1f
+        #define GMII_PHY_PGSEL_EXT      0x0007
+        #define GMII_PHY_PGSEL_PAGE0    0x0000
+
+struct ax88179_data {
+        u16 rxctl;
+        u16 reserved;
+};
+
+struct ax88179_int_data {
+        __le32 intdata1;
+        __le32 intdata2;
+};
+
+static const struct {
+        unsigned char ctrl, timer_l, timer_h, size, ifg;
+} AX88179_BULKIN_SIZE[] =       {
+        {7, 0x4f, 0,    0x12, 0xff},
+        {7, 0x20, 3,    0x16, 0xff},
+        {7, 0xae, 7,    0x18, 0xff},
+        {7, 0xcc, 0x4c, 0x18, 8},
+};
+
+static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                              u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
+
+        BUG_ON(!dev);
+
+        if (!in_pm)
+                fn = usbnet_read_cmd;
+        else
+                fn = usbnet_read_cmd_nopm;
+
+        ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
+                            index, ret);
+
+        return ret;
+}
+
+static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                               u16 size, void *data, int in_pm)
+{
+        int ret;
+        int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16);
+
+        BUG_ON(!dev);
+
+        if (!in_pm)
+                fn = usbnet_write_cmd;
+        else
+                fn = usbnet_write_cmd_nopm;
+
+        ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                 value, index, data, size);
+
+        if (unlikely(ret < 0))
+                netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
+                            index, ret);
+
+        return ret;
+}
+
+static void ax88179_write_cmd_async(struct usbnet *dev, u8 cmd, u16 value,
+                                    u16 index, u16 size, void *data)
+{
+        u16 buf;
+
+        if (2 == size) {
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, &buf,
+                                       size);
+        } else {
+                usbnet_write_cmd_async(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR |
+                                       USB_RECIP_DEVICE, value, index, data,
+                                       size);
+        }
+}
+
+static int ax88179_read_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                 u16 index, u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 1);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 1);
+        }
+
+        return ret;
+}
+
+static int ax88179_write_cmd_nopm(struct usbnet *dev, u8 cmd, u16 value,
+                                  u16 index, u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 1);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 1);
+        }
+
+        return ret;
+}
+
+static int ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                            u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le16_to_cpus(&buf);
+                *((u16 *)data) = buf;
+        } else if (4 == size) {
+                u32 buf;
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, &buf, 0);
+                le32_to_cpus(&buf);
+                *((u32 *)data) = buf;
+        } else {
+                ret = __ax88179_read_cmd(dev, cmd, value, index, size, data, 0);
+        }
+
+        return ret;
+}
+
+static int ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
+                             u16 size, void *data)
+{
+        int ret;
+
+        if (2 == size) {
+                u16 buf;
+                buf = *((u16 *)data);
+                cpu_to_le16s(&buf);
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, &buf, 0);
+        } else {
+                ret = __ax88179_write_cmd(dev, cmd, value, index,
+                                          size, data, 0);
+        }
+
+        return ret;
+}
+
+static void ax88179_status(struct usbnet *dev, struct urb *urb)
+{
+        struct ax88179_int_data *event;
+        u32 link;
+
+        if (urb->actual_length < 8)
+                return;
+
+        event = urb->transfer_buffer;
+        le32_to_cpus((void *)&event->intdata1);
+
+        link = (((__force u32)event->intdata1) & AX_INT_PPLS_LINK) >> 16;
+
+        if (netif_carrier_ok(dev->net) != link) {
+                if (link)
+                        usbnet_defer_kevent(dev, EVENT_LINK_RESET);
+                else
+                        netif_carrier_off(dev->net);
+
+                netdev_info(dev->net, "ax88179 - Link status is: %d\n", link);
+        }
+}
+
+static int ax88179_mdio_read(struct net_device *netdev, int phy_id, int loc)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res;
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+        return res;
+}
+
+static void ax88179_mdio_write(struct net_device *netdev, int phy_id, int loc,
+                               int val)
+{
+        struct usbnet *dev = netdev_priv(netdev);
+        u16 res = (u16) val;
+
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, phy_id, (__u16)loc, 2, &res);
+}
+
+static int ax88179_suspend(struct usb_interface *intf, pm_message_t message)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+
+        usbnet_suspend(intf, message);
+
+        /* Disable RX path */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                              2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                               2, 2, &tmp16);
+
+        /* Force bulk-in zero length */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                              2, 2, &tmp16);
+
+        tmp16 |= AX_PHYPWR_RSTCTL_BZ | AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+
+        /* change clock */
+        tmp8 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        return 0;
+}
+
+/* This function is used to enable the autodetach function. */
+/* This function is determined by offset 0x43 of EEPROM */
+static int ax88179_auto_detach(struct usbnet *dev, int in_pm)
+{
+        u16 tmp16;
+        u8 tmp8;
+        int (*fnr)(struct usbnet *, u8, u16, u16, u16, void *);
+        int (*fnw)(struct usbnet *, u8, u16, u16, u16, void *);
+
+        if (!in_pm) {
+                fnr = ax88179_read_cmd;
+                fnw = ax88179_write_cmd;
+        } else {
+                fnr = ax88179_read_cmd_nopm;
+                fnw = ax88179_write_cmd_nopm;
+        }
+
+        if (fnr(dev, AX_ACCESS_EEPROM, 0x43, 1, 2, &tmp16) < 0)
+                return 0;
+
+        if ((tmp16 == 0xFFFF) || (!(tmp16 & 0x0100)))
+                return 0;
+
+        /* Enable Auto Detach bit */
+        tmp8 = 0;
+        fnr(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ULR;
+        fnw(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+
+        fnr(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+        tmp16 |= AX_PHYPWR_RSTCTL_AT;
+        fnw(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+
+        return 0;
+}
+
+static int ax88179_resume(struct usb_interface *intf)
+{
+        struct usbnet *dev = usb_get_intfdata(intf);
+        u16 tmp16;
+        u8 tmp8;
+
+        netif_carrier_off(dev->net);
+
+        /* Power up ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        udelay(1000);
+
+        tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL,
+                               2, 2, &tmp16);
+        msleep(200);
+
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 1);
+
+        /* Enable clock */
+        ax88179_read_cmd_nopm(dev, AX_ACCESS_MAC,  AX_CLK_SELECT, 1, 1, &tmp8);
+        tmp8 |= AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp8);
+        msleep(100);
+
+        /* Configure RX control register => start operation */
+        tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd_nopm(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        return usbnet_resume(intf);
+}
+
+static void
+ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt;
+
+        if (ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                             1, 1, &opt) < 0) {
+                wolinfo->supported = 0;
+                wolinfo->wolopts = 0;
+                return;
+        }
+
+        wolinfo->supported = WAKE_PHY | WAKE_MAGIC;
+        wolinfo->wolopts = 0;
+        if (opt & AX_MONITOR_MODE_RWLC)
+                wolinfo->wolopts |= WAKE_PHY;
+        if (opt & AX_MONITOR_MODE_RWMP)
+                wolinfo->wolopts |= WAKE_MAGIC;
+}
+
+static int
+ax88179_set_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u8 opt = 0;
+
+        if (wolinfo->wolopts & WAKE_PHY)
+                opt |= AX_MONITOR_MODE_RWLC;
+        if (wolinfo->wolopts & WAKE_MAGIC)
+                opt |= AX_MONITOR_MODE_RWMP;
+
+        if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD,
+                              1, 1, &opt) < 0)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int ax88179_get_eeprom_len(struct net_device *net)
+{
+        return AX_EEPROM_LEN;
+}
+
+static int
+ax88179_get_eeprom(struct net_device *net, struct ethtool_eeprom *eeprom,
+                   u8 *data)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 *eeprom_buff;
+        int first_word, last_word;
+        int i, ret;
+
+        if (eeprom->len == 0)
+                return -EINVAL;
+
+        eeprom->magic = AX88179_EEPROM_MAGIC;
+
+        first_word = eeprom->offset >> 1;
+        last_word = (eeprom->offset + eeprom->len - 1) >> 1;
+        eeprom_buff = kmalloc(sizeof(u16) * (last_word - first_word + 1),
+                              GFP_KERNEL);
+        if (!eeprom_buff)
+                return -ENOMEM;
+
+        /* ax88179/178A returns 2 bytes from eeprom on read */
+        for (i = first_word; i <= last_word; i++) {
+                ret = __ax88179_read_cmd(dev, AX_ACCESS_EEPROM, i, 1, 2,
+                                         &eeprom_buff[i - first_word],
+                                         0);
+                if (ret < 0) {
+                        kfree(eeprom_buff);
+                        return -EIO;
+                }
+        }
+
+        memcpy(data, (u8 *)eeprom_buff + (eeprom->offset & 1), eeprom->len);
+        kfree(eeprom_buff);
+        return 0;
+}
+
+static int ax88179_get_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_gset(&dev->mii, cmd);
+}
+
+static int ax88179_set_settings(struct net_device *net, struct ethtool_cmd *cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return mii_ethtool_sset(&dev->mii, cmd);
+}
+
+
+static int ax88179_ioctl(struct net_device *net, struct ifreq *rq, int cmd)
+{
+        struct usbnet *dev = netdev_priv(net);
+        return generic_mii_ioctl(&dev->mii, if_mii(rq), cmd, NULL);
+}
+
+static const struct ethtool_ops ax88179_ethtool_ops = {
+        .get_link               = ethtool_op_get_link,
+        .get_msglevel           = usbnet_get_msglevel,
+        .set_msglevel           = usbnet_set_msglevel,
+        .get_wol                = ax88179_get_wol,
+        .set_wol                = ax88179_set_wol,
+        .get_eeprom_len         = ax88179_get_eeprom_len,
+        .get_eeprom             = ax88179_get_eeprom,
+        .get_settings           = ax88179_get_settings,
+        .set_settings           = ax88179_set_settings,
+        .nway_reset             = usbnet_nway_reset,
+};
+
+static void ax88179_set_multicast(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct ax88179_data *data = (struct ax88179_data *)dev->data;
+        u8 *m_filter = ((u8 *)dev->data) + 12;
+
+        data->rxctl = (AX_RX_CTL_START | AX_RX_CTL_AB | AX_RX_CTL_IPE);
+
+        if (net->flags & IFF_PROMISC) {
+                data->rxctl |= AX_RX_CTL_PRO;
+        } else if (net->flags & IFF_ALLMULTI ||
+                   netdev_mc_count(net) > AX_MAX_MCAST) {
+                data->rxctl |= AX_RX_CTL_AMALL;
+        } else if (netdev_mc_empty(net)) {
+                /* just broadcast and directed */
+        } else {
+                /* We use the 20 byte dev->data for our 8 byte filter buffer
+                 * to avoid allocating memory that is tricky to free later
+                 */
+                u32 crc_bits;
+                struct netdev_hw_addr *ha;
+
+                memset(m_filter, 0, AX_MCAST_FLTSIZE);
+
+                netdev_for_each_mc_addr(ha, net) {
+                        crc_bits = ether_crc(ETH_ALEN, ha->addr) >> 26;
+                        *(m_filter + (crc_bits >> 3)) |= (1 << (crc_bits & 7));
+                }
+
+                ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_MULFLTARY,
+                                        AX_MCAST_FLTSIZE, AX_MCAST_FLTSIZE,
+                                        m_filter);
+
+                data->rxctl |= AX_RX_CTL_AM;
+        }
+
+        ax88179_write_cmd_async(dev, AX_ACCESS_MAC, AX_RX_CTL,
+                                2, 2, &data->rxctl);
+}
+
+static int
+ax88179_set_features(struct net_device *net, netdev_features_t features)
+{
+        u8 tmp;
+        struct usbnet *dev = netdev_priv(net);
+        netdev_features_t changed = net->features ^ features;
+
+        if (changed & NETIF_F_IP_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCP | AX_TXCOE_UDP;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+
+        if (changed & NETIF_F_IPV6_CSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, &tmp);
+        }
+
+        if (changed & NETIF_F_RXCSUM) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+                tmp ^= AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+                       AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, &tmp);
+        }
+
+        return 0;
+}
+
+static int ax88179_change_mtu(struct net_device *net, int new_mtu)
+{
+        struct usbnet *dev = netdev_priv(net);
+        u16 tmp16;
+
+        if (new_mtu <= 0 || new_mtu > 4088)
+                return -EINVAL;
+
+        net->mtu = new_mtu;
+        dev->hard_mtu = net->mtu + net->hard_header_len;
+
+        if (net->mtu > 1500) {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 |= AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        } else {
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                 2, 2, &tmp16);
+                tmp16 &= ~AX_MEDIUM_JUMBO_EN;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                                  2, 2, &tmp16);
+        }
+
+        return 0;
+}
+
+static int ax88179_set_mac_addr(struct net_device *net, void *p)
+{
+        struct usbnet *dev = netdev_priv(net);
+        struct sockaddr *addr = p;
+
+        if (netif_running(net))
+                return -EBUSY;
+        if (!is_valid_ether_addr(addr->sa_data))
+                return -EADDRNOTAVAIL;
+
+        memcpy(net->dev_addr, addr->sa_data, ETH_ALEN);
+
+        /* Set the MAC address */
+        return ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                                 ETH_ALEN, net->dev_addr);
+}
+
+static const struct net_device_ops ax88179_netdev_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = ax88179_change_mtu,
+        .ndo_set_mac_address    = ax88179_set_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+        .ndo_do_ioctl           = ax88179_ioctl,
+        .ndo_set_rx_mode        = ax88179_set_multicast,
+        .ndo_set_features       = ax88179_set_features,
+};
+
+static int ax88179_check_eeprom(struct usbnet *dev)
+{
+        u8 i, buf, eeprom[20];
+        u16 csum, delay = HZ / 10;
+        unsigned long jtimeout;
+
+        /* Read EEPROM content */
+        for (i = 0; i < 6; i++) {
+                buf = i;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+
+                buf = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &buf) < 0)
+                        return -EINVAL;
+
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &buf);
+
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+
+                } while (buf & EEP_BUSY);
+
+                __ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                   2, 2, &eeprom[i * 2], 0);
+
+                if ((i == 0) && (eeprom[0] == 0xFF))
+                        return -EINVAL;
+        }
+
+        csum = eeprom[6] + eeprom[7] + eeprom[8] + eeprom[9];
+        csum = (csum >> 8) + (csum & 0xff);
+        if ((csum + eeprom[10]) != 0xff)
+                return -EINVAL;
+
+        return 0;
+}
+
+static int ax88179_check_efuse(struct usbnet *dev, u16 *ledmode)
+{
+        u8      i;
+        u8      efuse[64];
+        u16     csum = 0;
+
+        if (ax88179_read_cmd(dev, AX_ACCESS_EFUS, 0, 64, 64, efuse) < 0)
+                return -EINVAL;
+
+        if (*efuse == 0xFF)
+                return -EINVAL;
+
+        for (i = 0; i < 64; i++)
+                csum = csum + efuse[i];
+
+        while (csum > 255)
+                csum = (csum & 0x00FF) + ((csum >> 8) & 0x00FF);
+
+        if (csum != 0xFF)
+                return -EINVAL;
+
+        *ledmode = (efuse[51] << 8) | efuse[52];
+
+        return 0;
+}
+
+static int ax88179_convert_old_led(struct usbnet *dev, u16 *ledvalue)
+{
+        u16 led;
+
+        /* Loaded the old eFuse LED Mode */
+        if (ax88179_read_cmd(dev, AX_ACCESS_EEPROM, 0x3C, 1, 2, &led) < 0)
+                return -EINVAL;
+
+        led >>= 8;
+        switch (led) {
+        case 0xFF:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        case 0xFE:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 | LED_VALID;
+                break;
+        case 0xFD:
+                led = LED0_ACTIVE | LED1_LINK_1000 | LED2_LINK_100 |
+                      LED2_LINK_10 | LED_VALID;
+                break;
+        case 0xFC:
+                led = LED0_ACTIVE | LED1_ACTIVE | LED1_LINK_1000 | LED2_ACTIVE |
+                      LED2_LINK_100 | LED2_LINK_10 | LED_VALID;
+                break;
+        default:
+                led = LED0_ACTIVE | LED1_LINK_10 | LED1_LINK_100 |
+                      LED1_LINK_1000 | LED2_ACTIVE | LED2_LINK_10 |
+                      LED2_LINK_100 | LED2_LINK_1000 | LED_VALID;
+                break;
+        }
+
+        *ledvalue = led;
+
+        return 0;
+}
+
+static int ax88179_led_setting(struct usbnet *dev)
+{
+        u8 ledfd, value = 0;
+        u16 tmp, ledact, ledlink, ledvalue = 0, delay = HZ / 10;
+        unsigned long jtimeout;
+
+        /* Check AX88179 version. UA1 or UA2*/
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, GENERAL_STATUS, 1, 1, &value);
+
+        if (!(value & AX_SECLD)) {      /* UA1 */
+                value = AX_GPIO_CTRL_GPIO3EN | AX_GPIO_CTRL_GPIO2EN |
+                        AX_GPIO_CTRL_GPIO1EN;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_GPIO_CTRL,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+        }
+
+        /* Check EEPROM */
+        if (!ax88179_check_eeprom(dev)) {
+                value = 0x42;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_ADDR,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+
+                value = EEP_RD;
+                if (ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                      1, 1, &value) < 0)
+                        return -EINVAL;
+
+                jtimeout = jiffies + delay;
+                do {
+                        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_CMD,
+                                         1, 1, &value);
+
+                        if (time_after(jiffies, jtimeout))
+                                return -EINVAL;
+
+                } while (value & EEP_BUSY);
+
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_HIGH,
+                                 1, 1, &value);
+                ledvalue = (value << 8);
+
+                ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_SROM_DATA_LOW,
+                                 1, 1, &value);
+                ledvalue |= value;
+
+                /* load internal ROM for defaule setting */
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+
+        } else if (!ax88179_check_efuse(dev, &ledvalue)) {
+                if ((ledvalue == 0xFFFF) || ((ledvalue & LED_VALID) == 0))
+                        ax88179_convert_old_led(dev, &ledvalue);
+        } else {
+                ax88179_convert_old_led(dev, &ledvalue);
+        }
+
+        tmp = GMII_PHY_PGSEL_EXT;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+
+        tmp = 0x2c;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHYPAGE, 2, &tmp);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_ACT, 2, &ledact);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_LED_LINK, 2, &ledlink);
+
+        ledact &= GMII_LED_ACTIVE_MASK;
+        ledlink &= GMII_LED_LINK_MASK;
+
+        if (ledvalue & LED0_ACTIVE)
+                ledact |= GMII_LED0_ACTIVE;
+
+        if (ledvalue & LED1_ACTIVE)
+                ledact |= GMII_LED1_ACTIVE;
+
+        if (ledvalue & LED2_ACTIVE)
+                ledact |= GMII_LED2_ACTIVE;
+
+        if (ledvalue & LED0_LINK_10)
+                ledlink |= GMII_LED0_LINK_10;
+
+        if (ledvalue & LED1_LINK_10)
+                ledlink |= GMII_LED1_LINK_10;
+
+        if (ledvalue & LED2_LINK_10)
+                ledlink |= GMII_LED2_LINK_10;
+
+        if (ledvalue & LED0_LINK_100)
+                ledlink |= GMII_LED0_LINK_100;
+
+        if (ledvalue & LED1_LINK_100)
+                ledlink |= GMII_LED1_LINK_100;
+
+        if (ledvalue & LED2_LINK_100)
+                ledlink |= GMII_LED2_LINK_100;
+
+        if (ledvalue & LED0_LINK_1000)
+                ledlink |= GMII_LED0_LINK_1000;
+
+        if (ledvalue & LED1_LINK_1000)
+                ledlink |= GMII_LED1_LINK_1000;
+
+        if (ledvalue & LED2_LINK_1000)
+                ledlink |= GMII_LED2_LINK_1000;
+
+        tmp = ledact;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_ACT, 2, &tmp);
+
+        tmp = ledlink;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_LED_LINK, 2, &tmp);
+
+        tmp = GMII_PHY_PGSEL_PAGE0;
+        ax88179_write_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                          GMII_PHY_PAGE_SELECT, 2, &tmp);
+
+        /* LED full duplex setting */
+        ledfd = 0;
+        if (ledvalue & LED0_FD)
+                ledfd |= 0x01;
+        else if ((ledvalue & LED0_USB3_MASK) == 0)
+                ledfd |= 0x02;
+
+        if (ledvalue & LED1_FD)
+                ledfd |= 0x04;
+        else if ((ledvalue & LED1_USB3_MASK) == 0)
+                ledfd |= 0x08;
+
+        if (ledvalue & LED2_FD)
+                ledfd |= 0x10;
+        else if ((ledvalue & LED2_USB3_MASK) == 0)
+                ledfd |= 0x20;
+
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_LEDCTRL, 1, 1, &ledfd);
+
+        return 0;
+}
+
+static int ax88179_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+
+        usbnet_get_endpoints(dev, intf);
+
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+
+        memset(ax179_data, 0, sizeof(*ax179_data));
+
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN,
+                         ETH_ALEN, dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = 1024 * 20;
+
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+
+        dev->net->netdev_ops = &ax88179_netdev_ops;
+        dev->net->ethtool_ops = &ax88179_ethtool_ops;
+        dev->net->needed_headroom = 8;
+
+        /* Initialize MII structure */
+        dev->mii.dev = dev->net;
+        dev->mii.mdio_read = ax88179_mdio_read;
+        dev->mii.mdio_write = ax88179_mdio_write;
+        dev->mii.phy_id_mask = 0xff;
+        dev->mii.reg_num_mask = 0xff;
+        dev->mii.phy_id = 0x03;
+        dev->mii.supports_gmii = 1;
+
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+
+        ax88179_led_setting(dev);
+
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+
+        netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static void ax88179_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u16 tmp16;
+
+        /* Configure RX control register => stop operation */
+        tmp16 = AX_RX_CTL_STOP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &tmp16);
+
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, &tmp16);
+
+        /* Power down ethernet PHY */
+        tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, &tmp16);
+}
+
+static void
+ax88179_rx_checksum(struct sk_buff *skb, u32 *pkt_hdr)
+{
+        skb->ip_summed = CHECKSUM_NONE;
+
+        /* checksum error bit is set */
+        if ((*pkt_hdr & AX_RXHDR_L3CSUM_ERR) ||
+            (*pkt_hdr & AX_RXHDR_L4CSUM_ERR))
+                return;
+
+        /* It must be a TCP or UDP packet with a valid checksum */
+        if (((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_TCP) ||
+            ((*pkt_hdr & AX_RXHDR_L4_TYPE_MASK) == AX_RXHDR_L4_TYPE_UDP))
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
+static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct sk_buff *ax_skb;
+        int pkt_cnt;
+        u32 rx_hdr;
+        u16 hdr_off;
+        u32 *pkt_hdr;
+
+        skb_trim(skb, skb->len - 4);
+        memcpy(&rx_hdr, skb_tail_pointer(skb), 4);
+        le32_to_cpus(&rx_hdr);
+
+        pkt_cnt = (u16)rx_hdr;
+        hdr_off = (u16)(rx_hdr >> 16);
+        pkt_hdr = (u32 *)(skb->data + hdr_off);
+
+        while (pkt_cnt--) {
+                u16 pkt_len;
+
+                le32_to_cpus(pkt_hdr);
+                pkt_len = (*pkt_hdr >> 16) & 0x1fff;
+
+                /* Check CRC or runt packet */
+                if ((*pkt_hdr & AX_RXHDR_CRC_ERR) ||
+                    (*pkt_hdr & AX_RXHDR_DROP_ERR)) {
+                        skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                        pkt_hdr++;
+                        continue;
+                }
+
+                if (pkt_cnt == 0) {
+                        /* Skip IP alignment psudo header */
+                        skb_pull(skb, 2);
+                        skb->len = pkt_len;
+                        skb_set_tail_pointer(skb, pkt_len);
+                        skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(skb, pkt_hdr);
+                        return 1;
+                }
+
+                ax_skb = skb_clone(skb, GFP_ATOMIC);
+                if (ax_skb) {
+                        ax_skb->len = pkt_len;
+                        ax_skb->data = skb->data + 2;
+                        skb_set_tail_pointer(ax_skb, pkt_len);
+                        ax_skb->truesize = pkt_len + sizeof(struct sk_buff);
+                        ax88179_rx_checksum(ax_skb, pkt_hdr);
+                        usbnet_skb_return(dev, ax_skb);
+                } else {
+                        return 0;
+                }
+
+                skb_pull(skb, (pkt_len + 7) & 0xFFF8);
+                pkt_hdr++;
+        }
+        return 1;
+}
+
+static struct sk_buff *
+ax88179_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+{
+        u32 tx_hdr1, tx_hdr2;
+        int frame_size = dev->maxpacket;
+        int mss = skb_shinfo(skb)->gso_size;
+        int headroom;
+        int tailroom;
+
+        tx_hdr1 = skb->len;
+        tx_hdr2 = mss;
+        if (((skb->len + 8) % frame_size) == 0)
+                tx_hdr2 |= 0x80008000;  /* Enable padding */
+
+        skb_linearize(skb);
+        headroom = skb_headroom(skb);
+        tailroom = skb_tailroom(skb);
+
+        if (!skb_header_cloned(skb) &&
+            !skb_cloned(skb) &&
+            (headroom + tailroom) >= 8) {
+                if (headroom < 8) {
+                        skb->data = memmove(skb->head + 8, skb->data, skb->len);
+                        skb_set_tail_pointer(skb, skb->len);
+                }
+        } else {
+                struct sk_buff *skb2;
+
+                skb2 = skb_copy_expand(skb, 8, 0, flags);
+                dev_kfree_skb_any(skb);
+                skb = skb2;
+                if (!skb)
+                        return NULL;
+        }
+
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr2);
+        skb_copy_to_linear_data(skb, &tx_hdr2, 4);
+
+        skb_push(skb, 4);
+        cpu_to_le32s(&tx_hdr1);
+        skb_copy_to_linear_data(skb, &tx_hdr1, 4);
+
+        return skb;
+}
+
+static int ax88179_link_reset(struct usbnet *dev)
+{
+        struct ax88179_data *ax179_data = (struct ax88179_data *)dev->data;
+        u8 tmp[5], link_sts;
+        u16 mode, tmp16, delay = HZ / 10;
+        u32 tmp32 = 0x40000000;
+        unsigned long jtimeout;
+
+        jtimeout = jiffies + delay;
+        while (tmp32 & 0x40000000) {
+                mode = 0;
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, &mode);
+                ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2,
+                                  &ax179_data->rxctl);
+
+                /*link up, check the usb device control TX FIFO full or empty*/
+                ax88179_read_cmd(dev, 0x81, 0x8c, 0, 4, &tmp32);
+
+                if (time_after(jiffies, jtimeout))
+                        return 0;
+        }
+
+        mode = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+               AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE;
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, PHYSICAL_LINK_STATUS,
+                         1, 1, &link_sts);
+
+        ax88179_read_cmd(dev, AX_ACCESS_PHY, AX88179_PHY_ID,
+                         GMII_PHY_PHYSR, 2, &tmp16);
+
+        if (!(tmp16 & GMII_PHY_PHYSR_LINK)) {
+                return 0;
+        } else if (GMII_PHY_PHYSR_GIGA == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_GIGAMODE | AX_MEDIUM_EN_125MHZ;
+                if (dev->net->mtu > 1500)
+                        mode |= AX_MEDIUM_JUMBO_EN;
+
+                if (link_sts & AX_USB_SS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+                else if (link_sts & AX_USB_HS)
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[1], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else if (GMII_PHY_PHYSR_100 == (tmp16 & GMII_PHY_PHYSR_SMASK)) {
+                mode |= AX_MEDIUM_PS;
+
+                if (link_sts & (AX_USB_SS | AX_USB_HS))
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[2], 5);
+                else
+                        memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        } else {
+                memcpy(tmp, &AX88179_BULKIN_SIZE[3], 5);
+        }
+
+        /* RX bulk configuration */
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = (1024 * (tmp[3] + 2));
+
+        if (tmp16 & GMII_PHY_PHYSR_FULL)
+                mode |= AX_MEDIUM_FULL_DUPLEX;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &mode);
+
+        netif_carrier_on(dev->net);
+
+        return 0;
+}
+
+static int ax88179_reset(struct usbnet *dev)
+{
+        u8 buf[5];
+        u16 *tmp16;
+        u8 *tmp;
+
+        tmp16 = (u16 *)buf;
+        tmp = (u8 *)buf;
+
+        /* Power up ethernet PHY */
+        *tmp16 = 0;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+
+        *tmp16 = AX_PHYPWR_RSTCTL_IPRL;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PHYPWR_RSTCTL, 2, 2, tmp16);
+        msleep(200);
+
+        *tmp = AX_CLK_SELECT_ACS | AX_CLK_SELECT_BCS;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_CLK_SELECT, 1, 1, tmp);
+        msleep(100);
+
+        /* Ethernet PHY Auto Detach*/
+        ax88179_auto_detach(dev, 0);
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_NODE_ID, ETH_ALEN, ETH_ALEN,
+                         dev->net->dev_addr);
+        memcpy(dev->net->perm_addr, dev->net->dev_addr, ETH_ALEN);
+
+        /* RX bulk configuration */
+        memcpy(tmp, &AX88179_BULKIN_SIZE[0], 5);
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_BULKIN_QCTRL, 5, 5, tmp);
+
+        dev->rx_urb_size = 1024 * 20;
+
+        *tmp = 0x34;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_LOW, 1, 1, tmp);
+
+        *tmp = 0x52;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_PAUSE_WATERLVL_HIGH,
+                          1, 1, tmp);
+
+        dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                              NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+                                 NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
+
+        /* Enable checksum offload */
+        *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+               AX_RXCOE_TCPV6 | AX_RXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RXCOE_CTL, 1, 1, tmp);
+
+        *tmp = AX_TXCOE_IP | AX_TXCOE_TCP | AX_TXCOE_UDP |
+               AX_TXCOE_TCPV6 | AX_TXCOE_UDPV6;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_TXCOE_CTL, 1, 1, tmp);
+
+        /* Configure RX control register => start operation */
+        *tmp16 = AX_RX_CTL_DROPCRCERR | AX_RX_CTL_IPE | AX_RX_CTL_START |
+                 AX_RX_CTL_AP | AX_RX_CTL_AMALL | AX_RX_CTL_AB;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_RX_CTL, 2, 2, tmp16);
+
+        *tmp = AX_MONITOR_MODE_PMETYPE | AX_MONITOR_MODE_PMEPOL |
+               AX_MONITOR_MODE_RWMP;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MONITOR_MOD, 1, 1, tmp);
+
+        /* Configure default medium type => giga */
+        *tmp16 = AX_MEDIUM_RECEIVE_EN | AX_MEDIUM_TXFLOW_CTRLEN |
+                 AX_MEDIUM_RXFLOW_CTRLEN | AX_MEDIUM_ALWAYS_ONE |
+                 AX_MEDIUM_FULL_DUPLEX | AX_MEDIUM_GIGAMODE;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, tmp16);
+
+        ax88179_led_setting(dev);
+
+        /* Restart autoneg */
+        mii_nway_restart(&dev->mii);
+
+        netif_carrier_off(dev->net);
+
+        return 0;
+}
+
+static int ax88179_stop(struct usbnet *dev)
+{
+        u16 tmp16;
+
+        ax88179_read_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                         2, 2, &tmp16);
+        tmp16 &= ~AX_MEDIUM_RECEIVE_EN;
+        ax88179_write_cmd(dev, AX_ACCESS_MAC, AX_MEDIUM_STATUS_MODE,
+                          2, 2, &tmp16);
+
+        return 0;
+}
+
+static const struct driver_info ax88179_info = {
+        .description = "ASIX AX88179 USB 3.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct driver_info ax88178a_info = {
+        .description = "ASIX AX88178A USB 2.0 Gigibit Ethernet",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct driver_info sitecom_info = {
+        .description = "Sitecom USB 3.0 to Gigabit Adapter",
+        .bind = ax88179_bind,
+        .unbind = ax88179_unbind,
+        .status = ax88179_status,
+        .link_reset = ax88179_link_reset,
+        .reset = ax88179_reset,
+        .stop = ax88179_stop,
+        .flags = FLAG_ETHER | FLAG_FRAMING_AX,
+        .rx_fixup = ax88179_rx_fixup,
+        .tx_fixup = ax88179_tx_fixup,
+};
+
+static const struct usb_device_id products[] = {
+{
+        /* ASIX AX88179 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x1790),
+        .driver_info = (unsigned long)&ax88179_info,
+}, {
+        /* ASIX AX88178A 10/100/1000 */
+        USB_DEVICE(0x0b95, 0x178a),
+        .driver_info = (unsigned long)&ax88178a_info,
+}, {
+        /* Sitecom USB 3.0 to Gigabit Adapter */
+        USB_DEVICE(0x0df6, 0x0072),
+        .driver_info = (unsigned long) &sitecom_info,
+},
+        { },
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver ax88179_178a_driver = {
+        .name =         "ax88179_178a",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .suspend =      ax88179_suspend,
+        .resume =       ax88179_resume,
+        .disconnect =   usbnet_disconnect,
+        .supports_autosuspend = 1,
+        .disable_hub_initiated_lpm = 1,
+};
+
+module_usb_driver(ax88179_178a_driver);
+
+MODULE_DESCRIPTION("ASIX AX88179/178A based USB 3.0/2.0 Gigabit Ethernet Devices");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 4a8c25a22294..61b74a2b89ac 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1213,6 +1213,14 @@ static const struct usb_device_id cdc_devs[] = {
           .driver_info = (unsigned long) &wwan_info,
         },
 
+        /* tag Huawei devices as wwan */
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1,
+                                        USB_CLASS_COMM,
+                                        USB_CDC_SUBCLASS_NCM,
+                                        USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+
         /* Huawei NCM devices disguised as vendor specific */
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x16),
           .driver_info = (unsigned long)&wwan_info,
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index f10e58ac9c1b..c3e3d2929ee3 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -961,6 +961,8 @@ static netdev_tx_t vxlan_xmit(struct sk_buff *skb, struct net_device *dev)
         iph->ttl        = ttl ? : ip4_dst_hoplimit(&rt->dst);
         tunnel_ip_select_ident(skb, old_iph, &rt->dst);
 
+        nf_reset(skb);
+
         vxlan_set_owner(dev, skb);
 
         /* See iptunnel_xmit() */
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index 3150def17193..2d691b8b95b9 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -1523,7 +1523,8 @@ int ath5k_hw_dma_stop(struct ath5k_hw *ah);
 /* EEPROM access functions */
 int ath5k_eeprom_init(struct ath5k_hw *ah);
 void ath5k_eeprom_detach(struct ath5k_hw *ah);
-
+int ath5k_eeprom_mode_from_channel(struct ath5k_hw *ah,
+                struct ieee80211_channel *channel);
 
 /* Protocol Control Unit Functions */
 /* Helpers */
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c
index b7e0258887e7..94d34ee02265 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.c
+++ b/drivers/net/wireless/ath/ath5k/eeprom.c
@@ -1779,7 +1779,8 @@ ath5k_eeprom_detach(struct ath5k_hw *ah)
 }
 
 int
-ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel)
+ath5k_eeprom_mode_from_channel(struct ath5k_hw *ah,
+                struct ieee80211_channel *channel)
 {
         switch (channel->hw_value) {
         case AR5K_MODE_11A:
@@ -1789,6 +1790,7 @@ ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel)
         case AR5K_MODE_11B:
                 return AR5K_EEPROM_MODE_11B;
         default:
-                return -1;
+                ATH5K_WARN(ah, "channel is not A/B/G!");
+                return AR5K_EEPROM_MODE_11A;
         }
 }
diff --git a/drivers/net/wireless/ath/ath5k/eeprom.h b/drivers/net/wireless/ath/ath5k/eeprom.h
index 94a9bbea6874..693296ee9693 100644
--- a/drivers/net/wireless/ath/ath5k/eeprom.h
+++ b/drivers/net/wireless/ath/ath5k/eeprom.h
@@ -493,6 +493,3 @@ struct ath5k_eeprom_info {
         /* Antenna raw switch tables */
         u32     ee_antenna[AR5K_EEPROM_N_MODES][AR5K_ANT_MAX];
 };
-
-int
-ath5k_eeprom_mode_from_channel(struct ieee80211_channel *channel);
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index a78afa98c650..d6bc7cb61bfb 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -1612,11 +1612,7 @@ ath5k_hw_update_noise_floor(struct ath5k_hw *ah)
 
         ah->ah_cal_mask |= AR5K_CALIBRATION_NF;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(ah->ah_current_channel);
-        if (WARN_ON(ee_mode < 0)) {
-                ah->ah_cal_mask &= ~AR5K_CALIBRATION_NF;
-                return;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, ah->ah_current_channel);
 
         /* completed NF calibration, test threshold */
         nf = ath5k_hw_read_measured_noise_floor(ah);
@@ -2317,12 +2313,7 @@ ath5k_hw_set_antenna_mode(struct ath5k_hw *ah, u8 ant_mode)
 
         def_ant = ah->ah_def_ant;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (ee_mode < 0) {
-                ATH5K_ERR(ah,
-                        "invalid channel: %d\n", channel->center_freq);
-                return;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         switch (ant_mode) {
         case AR5K_ANTMODE_DEFAULT:
@@ -3622,12 +3613,7 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 return -EINVAL;
         }
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (ee_mode < 0) {
-                ATH5K_ERR(ah,
-                        "invalid channel: %d\n", channel->center_freq);
-                return -EINVAL;
-        }
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         /* Initialize TX power table */
         switch (ah->ah_radio) {
diff --git a/drivers/net/wireless/ath/ath5k/reset.c b/drivers/net/wireless/ath/ath5k/reset.c
index e2d8b2cf19eb..a3399c4f13a9 100644
--- a/drivers/net/wireless/ath/ath5k/reset.c
+++ b/drivers/net/wireless/ath/ath5k/reset.c
@@ -984,9 +984,7 @@ ath5k_hw_commit_eeprom_settings(struct ath5k_hw *ah,
         if (ah->ah_version == AR5K_AR5210)
                 return;
 
-        ee_mode = ath5k_eeprom_mode_from_channel(channel);
-        if (WARN_ON(ee_mode < 0))
-                return;
+        ee_mode = ath5k_eeprom_mode_from_channel(ah, channel);
 
         /* Adjust power delta for channel 14 */
         if (channel->center_freq == 2484)
diff --git a/drivers/net/wireless/ath/ath6kl/Kconfig b/drivers/net/wireless/ath/ath6kl/Kconfig
index 630c83db056e..e39e5860a2e9 100644
--- a/drivers/net/wireless/ath/ath6kl/Kconfig
+++ b/drivers/net/wireless/ath/ath6kl/Kconfig
@@ -30,6 +30,15 @@ config ATH6KL_DEBUG
         ---help---
           Enables debug support
 
+config ATH6KL_TRACING
+        bool "Atheros ath6kl tracing support"
+        depends on ATH6KL
+        depends on EVENT_TRACING
+        ---help---
+          Select this to ath6kl use tracing infrastructure.
+
+          If unsure, say Y to make it easier to debug problems.
+
 config ATH6KL_REGDOMAIN
         bool "Atheros ath6kl regdomain support"
         depends on ATH6KL
diff --git a/drivers/net/wireless/ath/ath6kl/Makefile b/drivers/net/wireless/ath/ath6kl/Makefile
index cab0ec0d5380..dc2b3b46781e 100644
--- a/drivers/net/wireless/ath/ath6kl/Makefile
+++ b/drivers/net/wireless/ath/ath6kl/Makefile
@@ -35,10 +35,15 @@ ath6kl_core-y += txrx.o
 ath6kl_core-y += wmi.o
 ath6kl_core-y += core.o
 ath6kl_core-y += recovery.o
+
 ath6kl_core-$(CONFIG_NL80211_TESTMODE) += testmode.o
+ath6kl_core-$(CONFIG_ATH6KL_TRACING) += trace.o
 
 obj-$(CONFIG_ATH6KL_SDIO) += ath6kl_sdio.o
 ath6kl_sdio-y += sdio.o
 
 obj-$(CONFIG_ATH6KL_USB) += ath6kl_usb.o
 ath6kl_usb-y += usb.o
+
+# for tracing framework to find trace.h
+CFLAGS_trace.o := -I$(src)
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 752ffc4f4166..5c9736a94e54 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -402,7 +402,7 @@ static bool ath6kl_is_valid_iftype(struct ath6kl *ar, enum nl80211_iftype type,
         if (type == NL80211_IFTYPE_STATION ||
             type == NL80211_IFTYPE_AP || type == NL80211_IFTYPE_ADHOC) {
                 for (i = 0; i < ar->vif_max; i++) {
-                        if ((ar->avail_idx_map >> i) & BIT(0)) {
+                        if ((ar->avail_idx_map) & BIT(i)) {
                                 *if_idx = i;
                                 return true;
                         }
@@ -412,7 +412,7 @@ static bool ath6kl_is_valid_iftype(struct ath6kl *ar, enum nl80211_iftype type,
         if (type == NL80211_IFTYPE_P2P_CLIENT ||
             type == NL80211_IFTYPE_P2P_GO) {
                 for (i = ar->max_norm_iface; i < ar->vif_max; i++) {
-                        if ((ar->avail_idx_map >> i) & BIT(0)) {
+                        if ((ar->avail_idx_map) & BIT(i)) {
                                 *if_idx = i;
                                 return true;
                         }
@@ -1535,7 +1535,9 @@ static int ath6kl_cfg80211_del_iface(struct wiphy *wiphy,
 
         ath6kl_cfg80211_vif_stop(vif, test_bit(WMI_READY, &ar->flag));
 
+        rtnl_lock();
         ath6kl_cfg80211_vif_cleanup(vif);
+        rtnl_unlock();
 
         return 0;
 }
@@ -2990,13 +2992,15 @@ static int ath6kl_change_station(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ath6kl *ar = ath6kl_priv(dev);
         struct ath6kl_vif *vif = netdev_priv(dev);
+        int err;
 
         if (vif->nw_type != AP_NETWORK)
                 return -EOPNOTSUPP;
 
-        /* Use this only for authorizing/unauthorizing a station */
-        if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
-                return -EOPNOTSUPP;
+        err = cfg80211_check_station_change(wiphy, params,
+                                            CFG80211_STA_AP_MLME_CLIENT);
+        if (err)
+                return err;
 
         if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED))
                 return ath6kl_wmi_ap_set_mlme(ar->wmi, vif->fw_vif_idx,
@@ -3659,7 +3663,6 @@ struct wireless_dev *ath6kl_interface_add(struct ath6kl *ar, const char *name,
         vif->sme_state = SME_DISCONNECTED;
         set_bit(WLAN_ENABLED, &vif->flags);
         ar->wlan_pwr_state = WLAN_POWER_STATE_ON;
-        set_bit(NETDEV_REGISTERED, &vif->flags);
 
         if (type == NL80211_IFTYPE_ADHOC)
                 ar->ibss_if_active = true;
diff --git a/drivers/net/wireless/ath/ath6kl/core.h b/drivers/net/wireless/ath/ath6kl/core.h
index 61b2f98b4e77..26b0f92424e1 100644
--- a/drivers/net/wireless/ath/ath6kl/core.h
+++ b/drivers/net/wireless/ath/ath6kl/core.h
@@ -560,7 +560,6 @@ enum ath6kl_vif_state {
         WMM_ENABLED,
         NETQ_STOPPED,
         DTIM_EXPIRED,
-        NETDEV_REGISTERED,
         CLEAR_BSSFILTER_ON_BEACON,
         DTIM_PERIOD_AVAIL,
         WLAN_ENABLED,
@@ -936,8 +935,6 @@ void aggr_recv_addba_req_evt(struct ath6kl_vif *vif, u8 tid, u16 seq_no,
                              u8 win_sz);
 void ath6kl_wakeup_event(void *dev);
 
-void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
-                         bool wait_fot_compltn, bool cold_reset);
 void ath6kl_init_control_info(struct ath6kl_vif *vif);
 struct ath6kl_vif *ath6kl_vif_first(struct ath6kl *ar);
 void ath6kl_cfg80211_vif_stop(struct ath6kl_vif *vif, bool wmi_ready);
diff --git a/drivers/net/wireless/ath/ath6kl/debug.c b/drivers/net/wireless/ath/ath6kl/debug.c
index 15cfe30e54fd..fe38b836cb26 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.c
+++ b/drivers/net/wireless/ath/ath6kl/debug.c
@@ -56,6 +56,60 @@ int ath6kl_printk(const char *level, const char *fmt, ...)
 }
 EXPORT_SYMBOL(ath6kl_printk);
 
+int ath6kl_info(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_INFO, "%pV", &vaf);
+        trace_ath6kl_log_info(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_info);
+
+int ath6kl_err(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_ERR, "%pV", &vaf);
+        trace_ath6kl_log_err(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_err);
+
+int ath6kl_warn(const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+        int ret;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        ret = ath6kl_printk(KERN_WARNING, "%pV", &vaf);
+        trace_ath6kl_log_warn(&vaf);
+        va_end(args);
+
+        return ret;
+}
+EXPORT_SYMBOL(ath6kl_warn);
+
 #ifdef CONFIG_ATH6KL_DEBUG
 
 void ath6kl_dbg(enum ATH6K_DEBUG_MASK mask, const char *fmt, ...)
@@ -63,15 +117,15 @@ void ath6kl_dbg(enum ATH6K_DEBUG_MASK mask, const char *fmt, ...)
         struct va_format vaf;
         va_list args;
 
-        if (!(debug_mask & mask))
-                return;
-
         va_start(args, fmt);
 
         vaf.fmt = fmt;
         vaf.va = &args;
 
-        ath6kl_printk(KERN_DEBUG, "%pV", &vaf);
+        if (debug_mask & mask)
+                ath6kl_printk(KERN_DEBUG, "%pV", &vaf);
+
+        trace_ath6kl_log_dbg(mask, &vaf);
 
         va_end(args);
 }
@@ -87,6 +141,10 @@ void ath6kl_dbg_dump(enum ATH6K_DEBUG_MASK mask,
 
                 print_hex_dump_bytes(prefix, DUMP_PREFIX_OFFSET, buf, len);
         }
+
+        /* tracing code doesn't like null strings :/ */
+        trace_ath6kl_log_dbg_dump(msg ? msg : "", prefix ? prefix : "",
+                                  buf, len);
 }
 EXPORT_SYMBOL(ath6kl_dbg_dump);
 
@@ -1752,8 +1810,10 @@ int ath6kl_debug_init_fs(struct ath6kl *ar)
         debugfs_create_file("tgt_stats", S_IRUSR, ar->debugfs_phy, ar,
                             &fops_tgt_stats);
 
-        debugfs_create_file("credit_dist_stats", S_IRUSR, ar->debugfs_phy, ar,
-                            &fops_credit_dist_stats);
+        if (ar->hif_type == ATH6KL_HIF_TYPE_SDIO)
+                debugfs_create_file("credit_dist_stats", S_IRUSR,
+                                    ar->debugfs_phy, ar,
+                                    &fops_credit_dist_stats);
 
         debugfs_create_file("endpoint_stats", S_IRUSR | S_IWUSR,
                             ar->debugfs_phy, ar, &fops_endpoint_stats);
diff --git a/drivers/net/wireless/ath/ath6kl/debug.h b/drivers/net/wireless/ath/ath6kl/debug.h
index f97cd4ead543..74369de00fb5 100644
--- a/drivers/net/wireless/ath/ath6kl/debug.h
+++ b/drivers/net/wireless/ath/ath6kl/debug.h
@@ -19,6 +19,7 @@
 #define DEBUG_H
 
 #include "hif.h"
+#include "trace.h"
 
 enum ATH6K_DEBUG_MASK {
         ATH6KL_DBG_CREDIT       = BIT(0),
@@ -51,13 +52,9 @@ enum ATH6K_DEBUG_MASK {
 extern unsigned int debug_mask;
 extern __printf(2, 3)
 int ath6kl_printk(const char *level, const char *fmt, ...);
-
-#define ath6kl_info(fmt, ...)                           \
-        ath6kl_printk(KERN_INFO, fmt, ##__VA_ARGS__)
-#define ath6kl_err(fmt, ...)                                    \
-        ath6kl_printk(KERN_ERR, fmt, ##__VA_ARGS__)
-#define ath6kl_warn(fmt, ...)                                   \
-        ath6kl_printk(KERN_WARNING, fmt, ##__VA_ARGS__)
+extern __printf(1, 2) int ath6kl_info(const char *fmt, ...);
+extern __printf(1, 2) int ath6kl_err(const char *fmt, ...);
+extern __printf(1, 2) int ath6kl_warn(const char *fmt, ...);
 
 enum ath6kl_war {
         ATH6KL_WAR_INVALID_RATE,
diff --git a/drivers/net/wireless/ath/ath6kl/hif.c b/drivers/net/wireless/ath/ath6kl/hif.c
index a6b614421fa4..fea7709b5dda 100644
--- a/drivers/net/wireless/ath/ath6kl/hif.c
+++ b/drivers/net/wireless/ath/ath6kl/hif.c
@@ -22,6 +22,7 @@
 #include "target.h"
 #include "hif-ops.h"
 #include "debug.h"
+#include "trace.h"
 
 #define MAILBOX_FOR_BLOCK_SIZE          1
 
@@ -436,6 +437,8 @@ static int proc_pending_irqs(struct ath6kl_device *dev, bool *done)
 
                 ath6kl_dump_registers(dev, &dev->irq_proc_reg,
                                       &dev->irq_en_reg);
+                trace_ath6kl_sdio_irq(&dev->irq_en_reg,
+                                      sizeof(dev->irq_en_reg));
 
                 /* Update only those registers that are enabled */
                 host_int_status = dev->irq_proc_reg.host_int_status &
diff --git a/drivers/net/wireless/ath/ath6kl/htc_mbox.c b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
index fbb78dfe078f..65e5b719093d 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c
@@ -19,6 +19,8 @@
 #include "hif.h"
 #include "debug.h"
 #include "hif-ops.h"
+#include "trace.h"
+
 #include <asm/unaligned.h>
 
 #define CALC_TXRX_PADDED_LEN(dev, len)  (__ALIGN_MASK((len), (dev)->block_mask))
@@ -537,6 +539,8 @@ static int ath6kl_htc_tx_issue(struct htc_target *target,
                                 packet->buf, padded_len,
                                 HIF_WR_ASYNC_BLOCK_INC, packet);
 
+        trace_ath6kl_htc_tx(status, packet->endpoint, packet->buf, send_len);
+
         return status;
 }
 
@@ -757,7 +761,8 @@ static void ath6kl_htc_tx_bundle(struct htc_endpoint *endpoint,
 {
         struct htc_target *target = endpoint->target;
         struct hif_scatter_req *scat_req = NULL;
-        int n_scat, n_sent_bundle = 0, tot_pkts_bundle = 0;
+        int n_scat, n_sent_bundle = 0, tot_pkts_bundle = 0, i;
+        struct htc_packet *packet;
         int status;
         u32 txb_mask;
         u8 ac = WMM_NUM_AC;
@@ -832,6 +837,13 @@ static void ath6kl_htc_tx_bundle(struct htc_endpoint *endpoint,
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "htc tx scatter bytes %d entries %d\n",
                            scat_req->len, scat_req->scat_entries);
+
+                for (i = 0; i < scat_req->scat_entries; i++) {
+                        packet = scat_req->scat_list[i].packet;
+                        trace_ath6kl_htc_tx(packet->status, packet->endpoint,
+                                            packet->buf, packet->act_len);
+                }
+
                 ath6kl_hif_submit_scat_req(target->dev, scat_req, false);
 
                 if (status)
@@ -1903,6 +1915,7 @@ static void ath6kl_htc_rx_complete(struct htc_endpoint *endpoint,
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "htc rx complete ep %d packet 0x%p\n",
                            endpoint->eid, packet);
+
                 endpoint->ep_cb.rx(endpoint->target, packet);
 }
 
@@ -2011,6 +2024,9 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
         list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) {
                 ep = &target->endpoint[packet->endpoint];
 
+                trace_ath6kl_htc_rx(packet->status, packet->endpoint,
+                                    packet->buf, packet->act_len);
+
                 /* process header for each of the recv packet */
                 status = ath6kl_htc_rx_process_hdr(target, packet, lk_ahds,
                                                    n_lk_ahd);
@@ -2291,6 +2307,9 @@ static struct htc_packet *htc_wait_for_ctrl_msg(struct htc_target *target)
         if (ath6kl_htc_rx_packet(target, packet, packet->act_len))
                 goto fail_ctrl_rx;
 
+        trace_ath6kl_htc_rx(packet->status, packet->endpoint,
+                            packet->buf, packet->act_len);
+
         /* process receive header */
         packet->status = ath6kl_htc_rx_process_hdr(target, packet, NULL, NULL);
 
diff --git a/drivers/net/wireless/ath/ath6kl/htc_pipe.c b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
index 281390178e3d..67aa924ed8b3 100644
--- a/drivers/net/wireless/ath/ath6kl/htc_pipe.c
+++ b/drivers/net/wireless/ath/ath6kl/htc_pipe.c
@@ -988,8 +988,6 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
 
         htc_hdr = (struct htc_frame_hdr *) netdata;
 
-        ep = &target->endpoint[htc_hdr->eid];
-
         if (htc_hdr->eid >= ENDPOINT_MAX) {
                 ath6kl_dbg(ATH6KL_DBG_HTC,
                            "HTC Rx: invalid EndpointID=%d\n",
@@ -997,6 +995,7 @@ static int ath6kl_htc_pipe_rx_complete(struct ath6kl *ar, struct sk_buff *skb,
                 status = -EINVAL;
                 goto free_skb;
         }
+        ep = &target->endpoint[htc_hdr->eid];
 
         payload_len = le16_to_cpu(get_unaligned(&htc_hdr->payld_len));
 
@@ -1168,8 +1167,8 @@ static int htc_wait_recv_ctrl_message(struct htc_target *target)
         }
 
         if (count <= 0) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "%s: Timeout!\n", __func__);
-                return -ECOMM;
+                ath6kl_warn("htc pipe control receive timeout!\n");
+                return -ETIMEDOUT;
         }
 
         return 0;
@@ -1582,16 +1581,16 @@ static int ath6kl_htc_pipe_wait_target(struct htc_target *target)
                 return status;
 
         if (target->pipe.ctrl_response_len < sizeof(*ready_msg)) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg len:%d!\n",
-                           target->pipe.ctrl_response_len);
+                ath6kl_warn("invalid htc pipe ready msg len: %d\n",
+                            target->pipe.ctrl_response_len);
                 return -ECOMM;
         }
 
         ready_msg = (struct htc_ready_ext_msg *) target->pipe.ctrl_response_buf;
 
         if (ready_msg->ver2_0_info.msg_id != cpu_to_le16(HTC_MSG_READY_ID)) {
-                ath6kl_dbg(ATH6KL_DBG_HTC, "invalid htc ready msg : 0x%X !\n",
-                           ready_msg->ver2_0_info.msg_id);
+                ath6kl_warn("invalid htc pipe ready msg: 0x%x\n",
+                            ready_msg->ver2_0_info.msg_id);
                 return -ECOMM;
         }
 
diff --git a/drivers/net/wireless/ath/ath6kl/init.c b/drivers/net/wireless/ath/ath6kl/init.c
index 5d434cf88f35..40ffee6184fd 100644
--- a/drivers/net/wireless/ath/ath6kl/init.c
+++ b/drivers/net/wireless/ath/ath6kl/init.c
@@ -201,8 +201,8 @@ struct sk_buff *ath6kl_buf_alloc(int size)
         u16 reserved;
 
         /* Add chacheline space at front and back of buffer */
-        reserved = (2 * L1_CACHE_BYTES) + ATH6KL_DATA_OFFSET +
-                   sizeof(struct htc_packet) + ATH6KL_HTC_ALIGN_BYTES;
+        reserved = roundup((2 * L1_CACHE_BYTES) + ATH6KL_DATA_OFFSET +
+                   sizeof(struct htc_packet) + ATH6KL_HTC_ALIGN_BYTES, 4);
         skb = dev_alloc_skb(size + reserved);
 
         if (skb)
@@ -1549,10 +1549,89 @@ static const char *ath6kl_init_get_hif_name(enum ath6kl_hif_type type)
         return NULL;
 }
 
+
+static const struct fw_capa_str_map {
+        int id;
+        const char *name;
+} fw_capa_map[] = {
+        { ATH6KL_FW_CAPABILITY_HOST_P2P, "host-p2p" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN, "sched-scan" },
+        { ATH6KL_FW_CAPABILITY_STA_P2PDEV_DUPLEX, "sta-p2pdev-duplex" },
+        { ATH6KL_FW_CAPABILITY_INACTIVITY_TIMEOUT, "inactivity-timeout" },
+        { ATH6KL_FW_CAPABILITY_RSN_CAP_OVERRIDE, "rsn-cap-override" },
+        { ATH6KL_FW_CAPABILITY_WOW_MULTICAST_FILTER, "wow-mc-filter" },
+        { ATH6KL_FW_CAPABILITY_BMISS_ENHANCE, "bmiss-enhance" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN_MATCH_LIST, "sscan-match-list" },
+        { ATH6KL_FW_CAPABILITY_RSSI_SCAN_THOLD, "rssi-scan-thold" },
+        { ATH6KL_FW_CAPABILITY_CUSTOM_MAC_ADDR, "custom-mac-addr" },
+        { ATH6KL_FW_CAPABILITY_TX_ERR_NOTIFY, "tx-err-notify" },
+        { ATH6KL_FW_CAPABILITY_REGDOMAIN, "regdomain" },
+        { ATH6KL_FW_CAPABILITY_SCHED_SCAN_V2, "sched-scan-v2" },
+        { ATH6KL_FW_CAPABILITY_HEART_BEAT_POLL, "hb-poll" },
+};
+
+static const char *ath6kl_init_get_fw_capa_name(unsigned int id)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_capa_map); i++) {
+                if (fw_capa_map[i].id == id)
+                        return fw_capa_map[i].name;
+        }
+
+        return "<unknown>";
+}
+
+static void ath6kl_init_get_fwcaps(struct ath6kl *ar, char *buf, size_t buf_len)
+{
+        u8 *data = (u8 *) ar->fw_capabilities;
+        size_t trunc_len, len = 0;
+        int i, index, bit;
+        char *trunc = "...";
+
+        for (i = 0; i < ATH6KL_FW_CAPABILITY_MAX; i++) {
+                index = i / 8;
+                bit = i % 8;
+
+                if (index >= sizeof(ar->fw_capabilities) * 4)
+                        break;
+
+                if (buf_len - len < 4) {
+                        ath6kl_warn("firmware capability buffer too small!\n");
+
+                        /* add "..." to the end of string */
+                        trunc_len = strlen(trunc) + 1;
+                        strncpy(buf + buf_len - trunc_len, trunc, trunc_len);
+
+                        return;
+                }
+
+                if (data[index] & (1 << bit)) {
+                        len += scnprintf(buf + len, buf_len - len, "%s,",
+                                            ath6kl_init_get_fw_capa_name(i));
+                }
+        }
+
+        /* overwrite the last comma */
+        if (len > 0)
+                len--;
+
+        buf[len] = '\0';
+}
+
+static int ath6kl_init_hw_reset(struct ath6kl *ar)
+{
+        ath6kl_dbg(ATH6KL_DBG_BOOT, "cold resetting the device");
+
+        return ath6kl_diag_write32(ar, RESET_CONTROL_ADDRESS,
+                                   cpu_to_le32(RESET_CONTROL_COLD_RST));
+}
+
 static int __ath6kl_init_hw_start(struct ath6kl *ar)
 {
         long timeleft;
         int ret, i;
+        char buf[200];
 
         ath6kl_dbg(ATH6KL_DBG_BOOT, "hw start\n");
 
@@ -1569,24 +1648,35 @@ static int __ath6kl_init_hw_start(struct ath6kl *ar)
                 goto err_power_off;
 
         /* Do we need to finish the BMI phase */
-        /* FIXME: return error from ath6kl_bmi_done() */
-        if (ath6kl_bmi_done(ar)) {
-                ret = -EIO;
+        ret = ath6kl_bmi_done(ar);
+        if (ret)
                 goto err_power_off;
-        }
 
         /*
          * The reason we have to wait for the target here is that the
          * driver layer has to init BMI in order to set the host block
          * size.
          */
-        if (ath6kl_htc_wait_target(ar->htc_target)) {
-                ret = -EIO;
+        ret = ath6kl_htc_wait_target(ar->htc_target);
+
+        if (ret == -ETIMEDOUT) {
+                /*
+                 * Most likely USB target is in odd state after reboot and
+                 * needs a reset. A cold reset makes the whole device
+                 * disappear from USB bus and initialisation starts from
+                 * beginning.
+                 */
+                ath6kl_warn("htc wait target timed out, resetting device\n");
+                ath6kl_init_hw_reset(ar);
+                goto err_power_off;
+        } else if (ret) {
+                ath6kl_err("htc wait target failed: %d\n", ret);
                 goto err_power_off;
         }
 
-        if (ath6kl_init_service_ep(ar)) {
-                ret = -EIO;
+        ret = ath6kl_init_service_ep(ar);
+        if (ret) {
+                ath6kl_err("Endpoint service initilisation failed: %d\n", ret);
                 goto err_cleanup_scatter;
         }
 
@@ -1617,6 +1707,8 @@ static int __ath6kl_init_hw_start(struct ath6kl *ar)
                             ar->wiphy->fw_version,
                             ar->fw_api,
                             test_bit(TESTMODE, &ar->flag) ? " testmode" : "");
+                ath6kl_init_get_fwcaps(ar, buf, sizeof(buf));
+                ath6kl_info("firmware supports: %s\n", buf);
         }
 
         if (ar->version.abi_ver != ATH6KL_ABI_VERSION) {
@@ -1765,9 +1857,7 @@ void ath6kl_stop_txrx(struct ath6kl *ar)
          * Try to reset the device if we can. The driver may have been
          * configure NOT to reset the target during a debug session.
          */
-        ath6kl_dbg(ATH6KL_DBG_TRC,
-                   "attempting to reset target on instance destroy\n");
-        ath6kl_reset_device(ar, ar->target_type, true, true);
+        ath6kl_init_hw_reset(ar);
 
         up(&ar->sem);
 }
diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
index bd50b6b7b492..d4fcfcad57d0 100644
--- a/drivers/net/wireless/ath/ath6kl/main.c
+++ b/drivers/net/wireless/ath/ath6kl/main.c
@@ -345,39 +345,6 @@ out:
         return ret;
 }
 
-/* FIXME: move to a better place, target.h? */
-#define AR6003_RESET_CONTROL_ADDRESS 0x00004000
-#define AR6004_RESET_CONTROL_ADDRESS 0x00004000
-
-void ath6kl_reset_device(struct ath6kl *ar, u32 target_type,
-                         bool wait_fot_compltn, bool cold_reset)
-{
-        int status = 0;
-        u32 address;
-        __le32 data;
-
-        if (target_type != TARGET_TYPE_AR6003 &&
-            target_type != TARGET_TYPE_AR6004)
-                return;
-
-        data = cold_reset ? cpu_to_le32(RESET_CONTROL_COLD_RST) :
-                            cpu_to_le32(RESET_CONTROL_MBOX_RST);
-
-        switch (target_type) {
-        case TARGET_TYPE_AR6003:
-                address = AR6003_RESET_CONTROL_ADDRESS;
-                break;
-        case TARGET_TYPE_AR6004:
-                address = AR6004_RESET_CONTROL_ADDRESS;
-                break;
-        }
-
-        status = ath6kl_diag_write32(ar, address, data);
-
-        if (status)
-                ath6kl_err("failed to reset target\n");
-}
-
 static void ath6kl_install_static_wep_keys(struct ath6kl_vif *vif)
 {
         u8 index;
@@ -1327,9 +1294,11 @@ void init_netdev(struct net_device *dev)
         dev->watchdog_timeo = ATH6KL_TX_TIMEOUT;
 
         dev->needed_headroom = ETH_HLEN;
-        dev->needed_headroom += sizeof(struct ath6kl_llc_snap_hdr) +
-                                sizeof(struct wmi_data_hdr) + HTC_HDR_LENGTH
-                                + WMI_MAX_TX_META_SZ + ATH6KL_HTC_ALIGN_BYTES;
+        dev->needed_headroom += roundup(sizeof(struct ath6kl_llc_snap_hdr) +
+                                        sizeof(struct wmi_data_hdr) +
+                                        HTC_HDR_LENGTH +
+                                        WMI_MAX_TX_META_SZ +
+                                        ATH6KL_HTC_ALIGN_BYTES, 4);
 
         dev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_RXCSUM;
 
diff --git a/drivers/net/wireless/ath/ath6kl/sdio.c b/drivers/net/wireless/ath/ath6kl/sdio.c
index d111980d44c0..fb141454c6d2 100644
--- a/drivers/net/wireless/ath/ath6kl/sdio.c
+++ b/drivers/net/wireless/ath/ath6kl/sdio.c
@@ -28,6 +28,7 @@
 #include "target.h"
 #include "debug.h"
 #include "cfg80211.h"
+#include "trace.h"
 
 struct ath6kl_sdio {
         struct sdio_func *func;
@@ -179,6 +180,8 @@ static int ath6kl_sdio_io(struct sdio_func *func, u32 request, u32 addr,
                    request & HIF_FIXED_ADDRESS ? " (fixed)" : "", buf, len);
         ath6kl_dbg_dump(ATH6KL_DBG_SDIO_DUMP, NULL, "sdio ", buf, len);
 
+        trace_ath6kl_sdio(addr, request, buf, len);
+
         return ret;
 }
 
@@ -309,6 +312,13 @@ static int ath6kl_sdio_scat_rw(struct ath6kl_sdio *ar_sdio,
         sdio_claim_host(ar_sdio->func);
 
         mmc_set_data_timeout(&data, ar_sdio->func->card);
+
+        trace_ath6kl_sdio_scat(scat_req->addr,
+                               scat_req->req,
+                               scat_req->len,
+                               scat_req->scat_entries,
+                               scat_req->scat_list);
+
         /* synchronous call to process request */
         mmc_wait_for_req(ar_sdio->func->card->host, &mmc_req);
 
@@ -1123,10 +1133,12 @@ static int ath6kl_sdio_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)
 
         ret = ath6kl_sdio_read_write_sync(ar, addr, buf, len,
                                           HIF_WR_SYNC_BYTE_INC);
-        if (ret)
+        if (ret) {
                 ath6kl_err("unable to send the bmi data to the device\n");
+                return ret;
+        }
 
-        return ret;
+        return 0;
 }
 
 static int ath6kl_sdio_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
diff --git a/drivers/net/wireless/ath/ath6kl/target.h b/drivers/net/wireless/ath/ath6kl/target.h
index a98c12ba70c1..a580a629a0da 100644
--- a/drivers/net/wireless/ath/ath6kl/target.h
+++ b/drivers/net/wireless/ath/ath6kl/target.h
@@ -25,7 +25,7 @@
 #define AR6004_BOARD_DATA_SZ     6144
 #define AR6004_BOARD_EXT_DATA_SZ 0
 
-#define RESET_CONTROL_ADDRESS           0x00000000
+#define RESET_CONTROL_ADDRESS           0x00004000
 #define RESET_CONTROL_COLD_RST          0x00000100
 #define RESET_CONTROL_MBOX_RST          0x00000004
 
diff --git a/drivers/net/wireless/ath/ath6kl/trace.c b/drivers/net/wireless/ath/ath6kl/trace.c
new file mode 100644
index 000000000000..e7d64b1285cb
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/trace.c
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+
+#define CREATE_TRACE_POINTS
+#include "trace.h"
+
+EXPORT_TRACEPOINT_SYMBOL(ath6kl_sdio);
+EXPORT_TRACEPOINT_SYMBOL(ath6kl_sdio_scat);
diff --git a/drivers/net/wireless/ath/ath6kl/trace.h b/drivers/net/wireless/ath/ath6kl/trace.h
new file mode 100644
index 000000000000..6af6fa038312
--- /dev/null
+++ b/drivers/net/wireless/ath/ath6kl/trace.h
@@ -0,0 +1,332 @@
+#if !defined(_ATH6KL_TRACE_H) || defined(TRACE_HEADER_MULTI_READ)
+
+#include <net/cfg80211.h>
+#include <linux/skbuff.h>
+#include <linux/tracepoint.h>
+#include "wmi.h"
+#include "hif.h"
+
+#if !defined(_ATH6KL_TRACE_H)
+static inline unsigned int ath6kl_get_wmi_id(void *buf, size_t buf_len)
+{
+        struct wmi_cmd_hdr *hdr = buf;
+
+        if (buf_len < sizeof(*hdr))
+                return 0;
+
+        return le16_to_cpu(hdr->cmd_id);
+}
+#endif /* __ATH6KL_TRACE_H */
+
+#define _ATH6KL_TRACE_H
+
+/* create empty functions when tracing is disabled */
+#if !defined(CONFIG_ATH6KL_TRACING)
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+#endif /* !CONFIG_ATH6KL_TRACING || __CHECKER__ */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM ath6kl
+
+TRACE_EVENT(ath6kl_wmi_cmd,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, id)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->id = ath6kl_get_wmi_id(buf, buf_len);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "id %d len %d",
+                __entry->id, __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_wmi_event,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, id)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->id = ath6kl_get_wmi_id(buf, buf_len);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "id %d len %d",
+                __entry->id, __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio,
+        TP_PROTO(unsigned int addr, int flags,
+                 void *buf, size_t buf_len),
+
+        TP_ARGS(addr, flags, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, tx)
+                __field(unsigned int, addr)
+                __field(int, flags)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->addr = addr;
+                __entry->flags = flags;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+
+                if (flags & HIF_WRITE)
+                        __entry->tx = 1;
+                else
+                        __entry->tx = 0;
+        ),
+
+        TP_printk(
+                "%s addr 0x%x flags 0x%x len %d\n",
+                __entry->tx ? "tx" : "rx",
+                __entry->addr,
+                __entry->flags,
+                __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio_scat,
+        TP_PROTO(unsigned int addr, int flags, unsigned int total_len,
+                 unsigned int entries, struct hif_scatter_item *list),
+
+        TP_ARGS(addr, flags, total_len, entries, list),
+
+        TP_STRUCT__entry(
+                __field(unsigned int, tx)
+                __field(unsigned int, addr)
+                __field(int, flags)
+                __field(unsigned int, entries)
+                __field(size_t, total_len)
+                __dynamic_array(unsigned int, len_array, entries)
+                __dynamic_array(u8, data, total_len)
+        ),
+
+        TP_fast_assign(
+                unsigned int *len_array;
+                int i, offset = 0;
+                size_t len;
+
+                __entry->addr = addr;
+                __entry->flags = flags;
+                __entry->entries = entries;
+                __entry->total_len = total_len;
+
+                if (flags & HIF_WRITE)
+                        __entry->tx = 1;
+                else
+                        __entry->tx = 0;
+
+                len_array = __get_dynamic_array(len_array);
+
+                for (i = 0; i < entries; i++) {
+                        len = list[i].len;
+
+                        memcpy((u8 *) __get_dynamic_array(data) + offset,
+                               list[i].buf, len);
+
+                        len_array[i] = len;
+                        offset += len;
+                }
+        ),
+
+        TP_printk(
+                "%s addr 0x%x flags 0x%x entries %d total_len %d\n",
+                __entry->tx ? "tx" : "rx",
+                __entry->addr,
+                __entry->flags,
+                __entry->entries,
+                __entry->total_len
+        )
+);
+
+TRACE_EVENT(ath6kl_sdio_irq,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "irq len %d\n", __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_htc_rx,
+        TP_PROTO(int status, int endpoint, void *buf,
+                 size_t buf_len),
+
+        TP_ARGS(status, endpoint, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(int, status)
+                __field(int, endpoint)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->status = status;
+                __entry->endpoint = endpoint;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "status %d endpoint %d len %d\n",
+                __entry->status,
+                __entry->endpoint,
+                __entry->buf_len
+        )
+);
+
+TRACE_EVENT(ath6kl_htc_tx,
+        TP_PROTO(int status, int endpoint, void *buf,
+                 size_t buf_len),
+
+        TP_ARGS(status, endpoint, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(int, status)
+                __field(int, endpoint)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->status = status;
+                __entry->endpoint = endpoint;
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "status %d endpoint %d len %d\n",
+                __entry->status,
+                __entry->endpoint,
+                __entry->buf_len
+        )
+);
+
+#define ATH6KL_MSG_MAX 200
+
+DECLARE_EVENT_CLASS(ath6kl_log_event,
+        TP_PROTO(struct va_format *vaf),
+        TP_ARGS(vaf),
+        TP_STRUCT__entry(
+                __dynamic_array(char, msg, ATH6KL_MSG_MAX)
+        ),
+        TP_fast_assign(
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       ATH6KL_MSG_MAX,
+                                       vaf->fmt,
+                                       *vaf->va) >= ATH6KL_MSG_MAX);
+        ),
+        TP_printk("%s", __get_str(msg))
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_err,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_warn,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+DEFINE_EVENT(ath6kl_log_event, ath6kl_log_info,
+             TP_PROTO(struct va_format *vaf),
+             TP_ARGS(vaf)
+);
+
+TRACE_EVENT(ath6kl_log_dbg,
+        TP_PROTO(unsigned int level, struct va_format *vaf),
+        TP_ARGS(level, vaf),
+        TP_STRUCT__entry(
+                __field(unsigned int, level)
+                __dynamic_array(char, msg, ATH6KL_MSG_MAX)
+        ),
+        TP_fast_assign(
+                __entry->level = level;
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       ATH6KL_MSG_MAX,
+                                       vaf->fmt,
+                                       *vaf->va) >= ATH6KL_MSG_MAX);
+        ),
+        TP_printk("%s", __get_str(msg))
+);
+
+TRACE_EVENT(ath6kl_log_dbg_dump,
+        TP_PROTO(const char *msg, const char *prefix,
+                 const void *buf, size_t buf_len),
+
+        TP_ARGS(msg, prefix, buf, buf_len),
+
+        TP_STRUCT__entry(
+                __string(msg, msg)
+                __string(prefix, prefix)
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __assign_str(msg, msg);
+                __assign_str(prefix, prefix);
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "%s/%s\n", __get_str(prefix), __get_str(msg)
+        )
+);
+
+#endif /* _ ATH6KL_TRACE_H || TRACE_HEADER_MULTI_READ*/
+
+/* we don't want to use include/trace/events */
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE trace
+
+/* This part must be outside protection */
+#include <trace/define_trace.h>
diff --git a/drivers/net/wireless/ath/ath6kl/txrx.c b/drivers/net/wireless/ath/ath6kl/txrx.c
index 78b369286579..ebb24045a8ae 100644
--- a/drivers/net/wireless/ath/ath6kl/txrx.c
+++ b/drivers/net/wireless/ath/ath6kl/txrx.c
@@ -20,6 +20,7 @@
 #include "core.h"
 #include "debug.h"
 #include "htc-ops.h"
+#include "trace.h"
 
 /*
  * tid - tid_mux0..tid_mux3
@@ -288,6 +289,8 @@ int ath6kl_control_tx(void *devt, struct sk_buff *skb,
         int status = 0;
         struct ath6kl_cookie *cookie = NULL;
 
+        trace_ath6kl_wmi_cmd(skb->data, skb->len);
+
         if (WARN_ON_ONCE(ar->state == ATH6KL_STATE_WOW)) {
                 dev_kfree_skb(skb);
                 return -EACCES;
@@ -1324,7 +1327,7 @@ void ath6kl_rx(struct htc_target *target, struct htc_packet *packet)
                    __func__, ar, ept, skb, packet->buf,
                    packet->act_len, status);
 
-        if (status || !(skb->data + HTC_HDR_LENGTH)) {
+        if (status || packet->act_len < HTC_HDR_LENGTH) {
                 dev_kfree_skb(skb);
                 return;
         }
diff --git a/drivers/net/wireless/ath/ath6kl/usb.c b/drivers/net/wireless/ath/ath6kl/usb.c
index 5fcd342762de..bed0d337712d 100644
--- a/drivers/net/wireless/ath/ath6kl/usb.c
+++ b/drivers/net/wireless/ath/ath6kl/usb.c
@@ -856,11 +856,9 @@ static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,
         int ret;
 
         if (size > 0) {
-                buf = kmalloc(size, GFP_KERNEL);
+                buf = kmemdup(data, size, GFP_KERNEL);
                 if (buf == NULL)
                         return -ENOMEM;
-
-                memcpy(buf, data, size);
         }
 
         /* note: if successful returns number of bytes transfered */
@@ -872,8 +870,9 @@ static int ath6kl_usb_submit_ctrl_out(struct ath6kl_usb *ar_usb,
                               size, 1000);
 
         if (ret < 0) {
-                ath6kl_dbg(ATH6KL_DBG_USB, "%s failed,result = %d\n",
-                           __func__, ret);
+                ath6kl_warn("Failed to submit usb control message: %d\n", ret);
+                kfree(buf);
+                return ret;
         }
 
         kfree(buf);
@@ -903,8 +902,9 @@ static int ath6kl_usb_submit_ctrl_in(struct ath6kl_usb *ar_usb,
                                  size, 2 * HZ);
 
         if (ret < 0) {
-                ath6kl_dbg(ATH6KL_DBG_USB, "%s failed,result = %d\n",
-                           __func__, ret);
+                ath6kl_warn("Failed to read usb control message: %d\n", ret);
+                kfree(buf);
+                return ret;
         }
 
         memcpy((u8 *) data, buf, size);
@@ -961,8 +961,10 @@ static int ath6kl_usb_diag_read32(struct ath6kl *ar, u32 address, u32 *data)
                                 ATH6KL_USB_CONTROL_REQ_DIAG_RESP,
                                 ar_usb->diag_resp_buffer, &resp_len);
 
-        if (ret)
+        if (ret) {
+                ath6kl_warn("diag read32 failed: %d\n", ret);
                 return ret;
+        }
 
         resp = (struct ath6kl_usb_ctrl_diag_resp_read *)
                 ar_usb->diag_resp_buffer;
@@ -976,6 +978,7 @@ static int ath6kl_usb_diag_write32(struct ath6kl *ar, u32 address, __le32 data)
 {
         struct ath6kl_usb *ar_usb = ar->hif_priv;
         struct ath6kl_usb_ctrl_diag_cmd_write *cmd;
+        int ret;
 
         cmd = (struct ath6kl_usb_ctrl_diag_cmd_write *) ar_usb->diag_cmd_buffer;
 
@@ -984,12 +987,17 @@ static int ath6kl_usb_diag_write32(struct ath6kl *ar, u32 address, __le32 data)
         cmd->address = cpu_to_le32(address);
         cmd->value = data;
 
-        return ath6kl_usb_ctrl_msg_exchange(ar_usb,
-                                            ATH6KL_USB_CONTROL_REQ_DIAG_CMD,
-                                            (u8 *) cmd,
-                                            sizeof(*cmd),
-                                            0, NULL, NULL);
+        ret = ath6kl_usb_ctrl_msg_exchange(ar_usb,
+                                           ATH6KL_USB_CONTROL_REQ_DIAG_CMD,
+                                           (u8 *) cmd,
+                                           sizeof(*cmd),
+                                           0, NULL, NULL);
+        if (ret) {
+                ath6kl_warn("diag_write32 failed: %d\n", ret);
+                return ret;
+        }
 
+        return 0;
 }
 
 static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
@@ -1001,7 +1009,7 @@ static int ath6kl_usb_bmi_read(struct ath6kl *ar, u8 *buf, u32 len)
         ret = ath6kl_usb_submit_ctrl_in(ar_usb,
                                         ATH6KL_USB_CONTROL_REQ_RECV_BMI_RESP,
                                         0, 0, buf, len);
-        if (ret != 0) {
+        if (ret) {
                 ath6kl_err("Unable to read the bmi data from the device: %d\n",
                            ret);
                 return ret;
@@ -1019,7 +1027,7 @@ static int ath6kl_usb_bmi_write(struct ath6kl *ar, u8 *buf, u32 len)
         ret = ath6kl_usb_submit_ctrl_out(ar_usb,
                                          ATH6KL_USB_CONTROL_REQ_SEND_BMI_CMD,
                                          0, 0, buf, len);
-        if (ret != 0) {
+        if (ret) {
                 ath6kl_err("unable to send the bmi data to the device: %d\n",
                            ret);
                 return ret;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index d76b5bd81a0d..87aefb4c4c23 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -20,6 +20,7 @@
 #include "core.h"
 #include "debug.h"
 #include "testmode.h"
+#include "trace.h"
 #include "../regd.h"
 #include "../regd_common.h"
 
@@ -2028,6 +2029,9 @@ int ath6kl_wmi_beginscan_cmd(struct wmi *wmi, u8 if_idx,
                 if (!sband)
                         continue;
 
+                if (WARN_ON(band >= ATH6KL_NUM_BANDS))
+                        break;
+
                 ratemask = rates[band];
                 supp_rates = sc->supp_rates[band].rates;
                 num_rates = 0;
@@ -4086,6 +4090,8 @@ int ath6kl_wmi_control_rx(struct wmi *wmi, struct sk_buff *skb)
                 return -EINVAL;
         }
 
+        trace_ath6kl_wmi_event(skb->data, skb->len);
+
         return ath6kl_wmi_proc_events(wmi, skb);
 }
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 881e989ea470..e6b92ff265fd 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -3606,6 +3606,12 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         value = ar9003_hw_ant_ctrl_common_2_get(ah, is2ghz);
         REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM_2, AR_SWITCH_TABLE_COM2_ALL, value);
 
+        if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
+                value = ar9003_hw_ant_ctrl_chain_get(ah, 1, is2ghz);
+                REG_RMW_FIELD(ah, switch_chain_reg[0],
+                              AR_SWITCH_TABLE_ALL, value);
+        }
+
         for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
                 if ((ah->rxchainmask & BIT(chain)) ||
                     (ah->txchainmask & BIT(chain))) {
@@ -3772,6 +3778,17 @@ static void ar9003_hw_atten_apply(struct ath_hw *ah, struct ath9k_channel *chan)
                                           AR_PHY_EXT_ATTEN_CTL_2,
                                          };
 
+        if ((AR_SREV_9462(ah)) && (ah->rxchainmask == 0x2)) {
+                value = ar9003_hw_atten_chain_get(ah, 1, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[0],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_DB, value);
+
+                value = ar9003_hw_atten_chain_get_margin(ah, 1, chan);
+                REG_RMW_FIELD(ah, ext_atten_reg[0],
+                              AR_PHY_EXT_ATTEN_CTL_XATTEN1_MARGIN,
+                              value);
+        }
+
         /* Test value. if 0 then attenuation is unused. Don't load anything. */
         for (i = 0; i < 3; i++) {
                 if (ah->txchainmask & BIT(i)) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index ccc42a71b436..999ab08c34e6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -37,28 +37,28 @@ static const u32 ar9462_pciephy_clkreq_enable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18253ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_2p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
         {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a01ae},
-        {0x00009824, 0x5ac640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
+        {0x00009824, 0x63c640de, 0x5ac640d0, 0x5ac640d0, 0x63c640da},
         {0x00009828, 0x0796be89, 0x0696b081, 0x0696b881, 0x09143e81},
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
-        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a2},
         {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
         {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000d8},
         {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec86d2e},
-        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3376605e, 0x32395d5e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32365a5e},
         {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
         {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
         {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
-        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcfd5c782, 0xcfd5c282},
+        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
         {0x00009e44, 0x62321e27, 0x62321e27, 0xfe291e27, 0xfe291e27},
         {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
         {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
@@ -82,9 +82,9 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a3a4, 0x00000010, 0x00000010, 0x00000000, 0x00000000},
+        {0x0000a3a4, 0x00000050, 0x00000050, 0x00000000, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa},
-        {0x0000a3ac, 0xaaaaaa00, 0xaaaaaa30, 0xaaaaaa00, 0xaaaaaa00},
+        {0x0000a3ac, 0xaaaaaa00, 0xaa30aa30, 0xaaaaaa00, 0xaaaaaa00},
         {0x0000a41c, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
         {0x0000a420, 0x000001ce, 0x000001ce, 0x000001ce, 0x000001ce},
         {0x0000a424, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce, 0x1ce739ce},
@@ -363,14 +363,14 @@ static const u32 ar9462_pciephy_clkreq_disable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18213ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_pciephy_pll_on_clkreq_disable_L1_2p0[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18212ede},
         {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003580c},
+        {0x00018c08, 0x0003780c},
 };
 
 static const u32 ar9462_2p0_radio_postamble_sys2ant[][5] = {
@@ -775,7 +775,7 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x00009fc0, 0x803e4788},
         {0x00009fc4, 0x0001efb5},
         {0x00009fcc, 0x40000014},
-        {0x00009fd0, 0x01193b93},
+        {0x00009fd0, 0x0a193b93},
         {0x0000a20c, 0x00000000},
         {0x0000a220, 0x00000000},
         {0x0000a224, 0x00000000},
@@ -850,7 +850,7 @@ static const u32 ar9462_2p0_baseband_core[][2] = {
         {0x0000a7cc, 0x00000000},
         {0x0000a7d0, 0x00000000},
         {0x0000a7d4, 0x00000004},
-        {0x0000a7dc, 0x00000001},
+        {0x0000a7dc, 0x00000000},
         {0x0000a7f0, 0x80000000},
         {0x0000a8d0, 0x004b6a8e},
         {0x0000a8d4, 0x00000820},
@@ -886,7 +886,7 @@ static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
         {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
         {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050da, 0x000050da, 0x000050de, 0x000050de},
         {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
@@ -906,20 +906,20 @@ static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
         {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
         {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53025eb2, 0x53025eb2, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb6, 0x59025eb6, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001c84, 0x44001c84},
+        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001a84, 0x44001a84},
         {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
         {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
         {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
         {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x7504ff56, 0x7504ff56, 0x56001eec, 0x56001eec},
+        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x58001ef0, 0x58001ef0},
+        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x5a001ef4, 0x5a001ef4},
+        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
+        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -1053,7 +1053,6 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x00008044, 0x00000000},
         {0x00008048, 0x00000000},
         {0x0000804c, 0xffffffff},
-        {0x00008050, 0xffffffff},
         {0x00008054, 0x00000000},
         {0x00008058, 0x00000000},
         {0x0000805c, 0x000fc78f},
@@ -1117,9 +1116,9 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x000081f8, 0x00000000},
         {0x000081fc, 0x00000000},
         {0x00008240, 0x00100000},
-        {0x00008244, 0x0010f424},
+        {0x00008244, 0x0010f400},
         {0x00008248, 0x00000800},
-        {0x0000824c, 0x0001e848},
+        {0x0000824c, 0x0001e800},
         {0x00008250, 0x00000000},
         {0x00008254, 0x00000000},
         {0x00008258, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/calib.c b/drivers/net/wireless/ath/ath9k/calib.c
index 1e8508530e98..7bdd726c7a8f 100644
--- a/drivers/net/wireless/ath/ath9k/calib.c
+++ b/drivers/net/wireless/ath/ath9k/calib.c
@@ -369,7 +369,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
         struct ieee80211_channel *c = chan->chan;
         struct ath9k_hw_cal_data *caldata = ah->caldata;
 
-        chan->channelFlags &= (~CHANNEL_CW_INT);
         if (REG_READ(ah, AR_PHY_AGC_CONTROL) & AR_PHY_AGC_CONTROL_NF) {
                 ath_dbg(common, CALIBRATE,
                         "NF did not complete in calibration window\n");
@@ -384,7 +383,6 @@ bool ath9k_hw_getnf(struct ath_hw *ah, struct ath9k_channel *chan)
                 ath_dbg(common, CALIBRATE,
                         "noise floor failed detected; detected %d, threshold %d\n",
                         nf, nfThresh);
-                chan->channelFlags |= CHANNEL_CW_INT;
         }
 
         if (!caldata) {
@@ -410,7 +408,7 @@ void ath9k_init_nfcal_hist_buffer(struct ath_hw *ah,
         int i, j;
 
         ah->caldata->channel = chan->channel;
-        ah->caldata->channelFlags = chan->channelFlags & ~CHANNEL_CW_INT;
+        ah->caldata->channelFlags = chan->channelFlags;
         ah->caldata->chanmode = chan->chanmode;
         h = ah->caldata->nfCalHist;
         default_nf = ath9k_hw_get_default_nf(ah, chan);
diff --git a/drivers/net/wireless/ath/ath9k/common.h b/drivers/net/wireless/ath/ath9k/common.h
index 5f845beeb18b..6102476a65de 100644
--- a/drivers/net/wireless/ath/ath9k/common.h
+++ b/drivers/net/wireless/ath/ath9k/common.h
@@ -27,7 +27,7 @@
 #define WME_MAX_BA              WME_BA_BMP_SIZE
 #define ATH_TID_MAX_BUFS        (2 * WME_MAX_BA)
 
-#define ATH_RSSI_DUMMY_MARKER   0x127
+#define ATH_RSSI_DUMMY_MARKER   127
 #define ATH_RSSI_LPF_LEN                10
 #define RSSI_LPF_THRESHOLD              -20
 #define ATH_RSSI_EP_MULTIPLIER     (1<<7)
@@ -40,7 +40,7 @@
         x = ATH_LPF_RSSI((x), ATH_RSSI_IN((y)), ATH_RSSI_LPF_LEN);      \
 } while (0)
 #define ATH_EP_RND(x, mul)                                              \
-        ((((x)%(mul)) >= ((mul)/2)) ? ((x) + ((mul) - 1)) / (mul) : (x)/(mul))
+        (((x) + ((mul)/2)) / (mul))
 
 int ath9k_cmn_padpos(__le16 frame_control);
 int ath9k_cmn_get_hw_crypto_keytype(struct sk_buff *skb);
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 3714b971d18e..67a2a4b3b883 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -537,6 +537,7 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf,
         PR("AMPDUs Completed:", a_completed);
         PR("AMPDUs Retried:  ", a_retries);
         PR("AMPDUs XRetried: ", a_xretries);
+        PR("TXERR Filtered:  ", txerr_filtered);
         PR("FIFO Underrun:   ", fifo_underrun);
         PR("TXOP Exceeded:   ", xtxop);
         PR("TXTIMER Expiry:  ", timer_exp);
@@ -756,6 +757,8 @@ void ath_debug_stat_tx(struct ath_softc *sc, struct ath_buf *bf,
                         TX_STAT_INC(qnum, completed);
         }
 
+        if (ts->ts_status & ATH9K_TXERR_FILT)
+                TX_STAT_INC(qnum, txerr_filtered);
         if (ts->ts_status & ATH9K_TXERR_FIFO)
                 TX_STAT_INC(qnum, fifo_underrun);
         if (ts->ts_status & ATH9K_TXERR_XTXOP)
@@ -1909,6 +1912,7 @@ static const char ath9k_gstrings_stats[][ETH_GSTRING_LEN] = {
         AMKSTR(d_tx_desc_cfg_err),
         AMKSTR(d_tx_data_underrun),
         AMKSTR(d_tx_delim_underrun),
+        "d_rx_crc_err",
         "d_rx_decrypt_crc_err",
         "d_rx_phy_err",
         "d_rx_mic_err",
@@ -1989,6 +1993,7 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
         AWDATA(data_underrun);
         AWDATA(delim_underrun);
 
+        AWDATA_RX(crc_err);
         AWDATA_RX(decrypt_crc_err);
         AWDATA_RX(phy_err);
         AWDATA_RX(mic_err);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 410d6d8f1aa7..794a7ec83a24 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -142,6 +142,7 @@ struct ath_interrupt_stats {
  * @a_completed: Total AMPDUs completed
  * @a_retries: No. of AMPDUs retried (SW)
  * @a_xretries: No. of AMPDUs dropped due to xretries
+ * @txerr_filtered: No. of frames with TXERR_FILT flag set.
  * @fifo_underrun: FIFO underrun occurrences
         Valid only for:
                 - non-aggregate condition.
@@ -168,6 +169,7 @@ struct ath_tx_stats {
         u32 a_completed;
         u32 a_retries;
         u32 a_xretries;
+        u32 txerr_filtered;
         u32 fifo_underrun;
         u32 xtxop;
         u32 timer_exp;
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 96bfb18078fa..d3b099d7898b 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -22,6 +22,7 @@
 #include <linux/firmware.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
+#include <linux/etherdevice.h>
 #include <linux/leds.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index 3ad1fd05c5e7..bd8251c1c749 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1067,15 +1067,19 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 
         last_rssi = priv->rx.last_rssi;
 
-        if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
-                rxbuf->rxstatus.rs_rssi = ATH_EP_RND(last_rssi,
-                                                     ATH_RSSI_EP_MULTIPLIER);
+        if (ieee80211_is_beacon(hdr->frame_control) &&
+            !is_zero_ether_addr(common->curbssid) &&
+            ether_addr_equal(hdr->addr3, common->curbssid)) {
+                s8 rssi = rxbuf->rxstatus.rs_rssi;
 
-        if (rxbuf->rxstatus.rs_rssi < 0)
-                rxbuf->rxstatus.rs_rssi = 0;
+                if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
+                        rssi = ATH_EP_RND(last_rssi, ATH_RSSI_EP_MULTIPLIER);
 
-        if (ieee80211_is_beacon(fc))
-                priv->ah->stats.avgbrssi = rxbuf->rxstatus.rs_rssi;
+                if (rssi < 0)
+                        rssi = 0;
+
+                priv->ah->stats.avgbrssi = rssi;
+        }
 
         rx_status->mactime = be64_to_cpu(rxbuf->rxstatus.rs_tstamp);
         rx_status->band = hw->conf.channel->band;
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2a2ae403e0e5..4fa2bb167050 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1463,7 +1463,9 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
                         reset_type = ATH9K_RESET_POWER_ON;
                 else
                         reset_type = ATH9K_RESET_COLD;
-        }
+        } else if (ah->chip_fullsleep || REG_READ(ah, AR_Q_TXE) ||
+                   (REG_READ(ah, AR_CR) & AR_CR_RXE))
+                reset_type = ATH9K_RESET_COLD;
 
         if (!ath9k_hw_set_reset_reg(ah, reset_type))
                 return false;
@@ -1667,6 +1669,104 @@ bool ath9k_hw_check_alive(struct ath_hw *ah)
 }
 EXPORT_SYMBOL(ath9k_hw_check_alive);
 
+static void ath9k_hw_init_mfp(struct ath_hw *ah)
+{
+        /* Setup MFP options for CCMP */
+        if (AR_SREV_9280_20_OR_LATER(ah)) {
+                /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
+                 * frames when constructing CCMP AAD. */
+                REG_RMW_FIELD(ah, AR_AES_MUTE_MASK1, AR_AES_MUTE_MASK1_FC_MGMT,
+                              0xc7ff);
+                ah->sw_mgmt_crypto = false;
+        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
+                /* Disable hardware crypto for management frames */
+                REG_CLR_BIT(ah, AR_PCU_MISC_MODE2,
+                            AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE);
+                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
+                            AR_PCU_MISC_MODE2_NO_CRYPTO_FOR_NON_DATA_PKT);
+                ah->sw_mgmt_crypto = true;
+        } else {
+                ah->sw_mgmt_crypto = true;
+        }
+}
+
+static void ath9k_hw_reset_opmode(struct ath_hw *ah,
+                                  u32 macStaId1, u32 saveDefAntenna)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
+        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
+                  | macStaId1
+                  | AR_STA_ID1_RTS_USE_DEF
+                  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
+                  | ah->sta_id1_defaults);
+        ath_hw_setbssidmask(common);
+        REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
+        ath9k_hw_write_associd(ah);
+        REG_WRITE(ah, AR_ISR, ~0);
+        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+
+        ath9k_hw_set_operating_mode(ah, ah->opmode);
+}
+
+static void ath9k_hw_init_queues(struct ath_hw *ah)
+{
+        int i;
+
+        ENABLE_REGWRITE_BUFFER(ah);
+
+        for (i = 0; i < AR_NUM_DCU; i++)
+                REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
+
+        REGWRITE_BUFFER_FLUSH(ah);
+
+        ah->intr_txqs = 0;
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
+                ath9k_hw_resettxqueue(ah, i);
+}
+
+/*
+ * For big endian systems turn on swapping for descriptors
+ */
+static void ath9k_hw_init_desc(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        if (AR_SREV_9100(ah)) {
+                u32 mask;
+                mask = REG_READ(ah, AR_CFG);
+                if (mask & (AR_CFG_SWRB | AR_CFG_SWTB | AR_CFG_SWRG)) {
+                        ath_dbg(common, RESET, "CFG Byte Swap Set 0x%x\n",
+                                mask);
+                } else {
+                        mask = INIT_CONFIG_STATUS | AR_CFG_SWRB | AR_CFG_SWTB;
+                        REG_WRITE(ah, AR_CFG, mask);
+                        ath_dbg(common, RESET, "Setting CFG 0x%x\n",
+                                REG_READ(ah, AR_CFG));
+                }
+        } else {
+                if (common->bus_ops->ath_bus_type == ATH_USB) {
+                        /* Configure AR9271 target WLAN */
+                        if (AR_SREV_9271(ah))
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
+                        else
+                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
+                }
+#ifdef __BIG_ENDIAN
+                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
+                         AR_SREV_9550(ah))
+                        REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
+                else
+                        REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
+#endif
+        }
+}
+
 /*
  * Fast channel change:
  * (Change synthesizer based on channel freq without resetting chip)
@@ -1744,7 +1844,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         u32 saveDefAntenna;
         u32 macStaId1;
         u64 tsf = 0;
-        int i, r;
+        int r;
         bool start_mci_reset = false;
         bool save_fullsleep = ah->chip_fullsleep;
 
@@ -1761,10 +1861,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 ath9k_hw_getnf(ah, ah->curchan);
 
         ah->caldata = caldata;
-        if (caldata &&
-            (chan->channel != caldata->channel ||
-             (chan->channelFlags & ~CHANNEL_CW_INT) !=
-             (caldata->channelFlags & ~CHANNEL_CW_INT))) {
+        if (caldata && (chan->channel != caldata->channel ||
+                        chan->channelFlags != caldata->channelFlags)) {
                 /* Operating channel changed, reset channel calibration data */
                 memset(caldata, 0, sizeof(*caldata));
                 ath9k_init_nfcal_hist_buffer(ah, chan);
@@ -1851,22 +1949,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 ath9k_hw_settsf64(ah, tsf);
         }
 
-        /* Setup MFP options for CCMP */
-        if (AR_SREV_9280_20_OR_LATER(ah)) {
-                /* Mask Retry(b11), PwrMgt(b12), MoreData(b13) to 0 in mgmt
-                 * frames when constructing CCMP AAD. */
-                REG_RMW_FIELD(ah, AR_AES_MUTE_MASK1, AR_AES_MUTE_MASK1_FC_MGMT,
-                              0xc7ff);
-                ah->sw_mgmt_crypto = false;
-        } else if (AR_SREV_9160_10_OR_LATER(ah)) {
-                /* Disable hardware crypto for management frames */
-                REG_CLR_BIT(ah, AR_PCU_MISC_MODE2,
-                            AR_PCU_MISC_MODE2_MGMT_CRYPTO_ENABLE);
-                REG_SET_BIT(ah, AR_PCU_MISC_MODE2,
-                            AR_PCU_MISC_MODE2_NO_CRYPTO_FOR_NON_DATA_PKT);
-                ah->sw_mgmt_crypto = true;
-        } else
-                ah->sw_mgmt_crypto = true;
+        ath9k_hw_init_mfp(ah);
 
         if (IS_CHAN_OFDM(chan) || IS_CHAN_HT(chan))
                 ath9k_hw_set_delta_slope(ah, chan);
@@ -1874,24 +1957,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_spur_mitigate_freq(ah, chan);
         ah->eep_ops->set_board_values(ah, chan);
 
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        REG_WRITE(ah, AR_STA_ID0, get_unaligned_le32(common->macaddr));
-        REG_WRITE(ah, AR_STA_ID1, get_unaligned_le16(common->macaddr + 4)
-                  | macStaId1
-                  | AR_STA_ID1_RTS_USE_DEF
-                  | (ah->config.
-                     ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
-                  | ah->sta_id1_defaults);
-        ath_hw_setbssidmask(common);
-        REG_WRITE(ah, AR_DEF_ANTENNA, saveDefAntenna);
-        ath9k_hw_write_associd(ah);
-        REG_WRITE(ah, AR_ISR, ~0);
-        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-
-        ath9k_hw_set_operating_mode(ah, ah->opmode);
+        ath9k_hw_reset_opmode(ah, macStaId1, saveDefAntenna);
 
         r = ath9k_hw_rf_set_freq(ah, chan);
         if (r)
@@ -1899,17 +1965,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         ath9k_hw_set_clockrate(ah);
 
-        ENABLE_REGWRITE_BUFFER(ah);
-
-        for (i = 0; i < AR_NUM_DCU; i++)
-                REG_WRITE(ah, AR_DQCUMASK(i), 1 << i);
-
-        REGWRITE_BUFFER_FLUSH(ah);
-
-        ah->intr_txqs = 0;
-        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++)
-                ath9k_hw_resettxqueue(ah, i);
-
+        ath9k_hw_init_queues(ah);
         ath9k_hw_init_interrupt_masks(ah, ah->opmode);
         ath9k_hw_ani_cache_ini_regs(ah);
         ath9k_hw_init_qos(ah);
@@ -1964,38 +2020,7 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         REGWRITE_BUFFER_FLUSH(ah);
 
-        /*
-         * For big endian systems turn on swapping for descriptors
-         */
-        if (AR_SREV_9100(ah)) {
-                u32 mask;
-                mask = REG_READ(ah, AR_CFG);
-                if (mask & (AR_CFG_SWRB | AR_CFG_SWTB | AR_CFG_SWRG)) {
-                        ath_dbg(common, RESET, "CFG Byte Swap Set 0x%x\n",
-                                mask);
-                } else {
-                        mask =
-                                INIT_CONFIG_STATUS | AR_CFG_SWRB | AR_CFG_SWTB;
-                        REG_WRITE(ah, AR_CFG, mask);
-                        ath_dbg(common, RESET, "Setting CFG 0x%x\n",
-                                REG_READ(ah, AR_CFG));
-                }
-        } else {
-                if (common->bus_ops->ath_bus_type == ATH_USB) {
-                        /* Configure AR9271 target WLAN */
-                        if (AR_SREV_9271(ah))
-                                REG_WRITE(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB);
-                        else
-                                REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
-                }
-#ifdef __BIG_ENDIAN
-                else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah))
-                        REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
-                else
-                        REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
-#endif
-        }
+        ath9k_hw_init_desc(ah);
 
         if (ath9k_hw_btcoex_is_enabled(ah))
                 ath9k_hw_btcoex_enable(ah);
@@ -2008,7 +2033,6 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         if (AR_SREV_9300_20_OR_LATER(ah)) {
                 ar9003_hw_bb_watchdog_config(ah);
-
                 ar9003_hw_disable_phy_restart(ah);
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 784e81ccb903..30e62d92d46d 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -363,7 +363,6 @@ enum ath9k_int {
         ATH9K_INT_NOCARD = 0xffffffff
 };
 
-#define CHANNEL_CW_INT    0x00002
 #define CHANNEL_CCK       0x00020
 #define CHANNEL_OFDM      0x00040
 #define CHANNEL_2GHZ      0x00080
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index 9c0b150d5b8e..c61cafa2665b 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -387,8 +387,7 @@ static void carl9170_tx_status_process_ampdu(struct ar9170 *ar,
         u8 tid;
 
         if (!(txinfo->flags & IEEE80211_TX_CTL_AMPDU) ||
-            txinfo->flags & IEEE80211_TX_CTL_INJECTED ||
-           (!(super->f.mac_control & cpu_to_le16(AR9170_TX_MAC_AGGR))))
+            txinfo->flags & IEEE80211_TX_CTL_INJECTED)
                 return;
 
         rcu_read_lock();
@@ -981,30 +980,6 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
 
                 SET_VAL(CARL9170_TX_SUPER_AMPDU_FACTOR,
                         txc->s.ampdu_settings, factor);
-
-                for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
-                        txrate = &info->control.rates[i];
-                        if (txrate->idx >= 0) {
-                                txc->s.ri[i] =
-                                        CARL9170_TX_SUPER_RI_AMPDU;
-
-                                if (WARN_ON(!(txrate->flags &
-                                              IEEE80211_TX_RC_MCS))) {
-                                        /*
-                                         * Not sure if it's even possible
-                                         * to aggregate non-ht rates with
-                                         * this HW.
-                                         */
-                                        goto err_out;
-                                }
-                                continue;
-                        }
-
-                        txrate->idx = 0;
-                        txrate->count = ar->hw->max_rate_tries;
-                }
-
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
         }
 
         /*
@@ -1012,11 +987,31 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
          * taken from mac_control. For all fallback rate, the firmware
          * updates the mac_control flags from the rate info field.
          */
-        for (i = 1; i < CARL9170_TX_MAX_RATES; i++) {
+        for (i = 0; i < CARL9170_TX_MAX_RATES; i++) {
+                __le32 phy_set;
                 txrate = &info->control.rates[i];
                 if (txrate->idx < 0)
                         break;
 
+                phy_set = carl9170_tx_physet(ar, info, txrate);
+                if (i == 0) {
+                        /* first rate - part of the hw's frame header */
+                        txc->f.phy_control = phy_set;
+
+                        if (ampdu && txrate->flags & IEEE80211_TX_RC_MCS)
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_AGGR);
+                        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
+                        else if (carl9170_tx_cts_check(ar, txrate))
+                                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
+
+                } else {
+                        /* fallback rates are stored in the firmware's
+                         * retry rate set array.
+                         */
+                        txc->s.rr[i - 1] = phy_set;
+                }
+
                 SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[i],
                         txrate->count);
 
@@ -1027,21 +1022,13 @@ static int carl9170_tx_prepare(struct ar9170 *ar,
                         txc->s.ri[i] |= (AR9170_TX_MAC_PROT_CTS <<
                                 CARL9170_TX_SUPER_RI_ERP_PROT_S);
 
-                txc->s.rr[i - 1] = carl9170_tx_physet(ar, info, txrate);
+                if (ampdu && (txrate->flags & IEEE80211_TX_RC_MCS))
+                        txc->s.ri[i] |= CARL9170_TX_SUPER_RI_AMPDU;
         }
 
-        txrate = &info->control.rates[0];
-        SET_VAL(CARL9170_TX_SUPER_RI_TRIES, txc->s.ri[0], txrate->count);
-
-        if (carl9170_tx_rts_check(ar, txrate, ampdu, no_ack))
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_RTS);
-        else if (carl9170_tx_cts_check(ar, txrate))
-                mac_tmp |= cpu_to_le16(AR9170_TX_MAC_PROT_CTS);
-
         txc->s.len = cpu_to_le16(skb->len);
         txc->f.length = cpu_to_le16(len + FCS_LEN);
         txc->f.mac_control = mac_tmp;
-        txc->f.phy_control = carl9170_tx_physet(ar, info, txrate);
 
         arinfo = (void *)info->rate_driver_data;
         arinfo->timeout = jiffies;
@@ -1381,9 +1368,9 @@ static void carl9170_tx(struct ar9170 *ar)
 }
 
 static bool carl9170_tx_ampdu_queue(struct ar9170 *ar,
-        struct ieee80211_sta *sta, struct sk_buff *skb)
+        struct ieee80211_sta *sta, struct sk_buff *skb,
+        struct ieee80211_tx_info *txinfo)
 {
-        struct _carl9170_tx_superframe *super = (void *) skb->data;
         struct carl9170_sta_info *sta_info;
         struct carl9170_sta_tid *agg;
         struct sk_buff *iter;
@@ -1450,7 +1437,7 @@ err_unlock:
 
 err_unlock_rcu:
         rcu_read_unlock();
-        super->f.mac_control &= ~cpu_to_le16(AR9170_TX_MAC_AGGR);
+        txinfo->flags &= ~IEEE80211_TX_CTL_AMPDU;
         carl9170_tx_status(ar, skb, false);
         ar->tx_dropped++;
         return false;
@@ -1492,7 +1479,7 @@ void carl9170_op_tx(struct ieee80211_hw *hw,
                  * sta == NULL checks are redundant in this
                  * special case.
                  */
-                run = carl9170_tx_ampdu_queue(ar, sta, skb);
+                run = carl9170_tx_ampdu_queue(ar, sta, skb, info);
                 if (run)
                         carl9170_tx_ampdu(ar);
 
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
index 9396dc9fe3c5..d288eea0a26a 100644
--- a/drivers/net/wireless/ath/wil6210/Makefile
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -9,5 +9,7 @@ wil6210-objs += wmi.o
 wil6210-objs += interrupt.o
 wil6210-objs += txrx.o
 
-subdir-ccflags-y += -Werror
+ifeq (, $(findstring -W,$(EXTRA_CFLAGS)))
+        subdir-ccflags-y += -Werror
+endif
 subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
index 9ecc1968262c..c5d4a87abaaf 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -14,16 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/etherdevice.h>
-#include <linux/wireless.h>
-#include <linux/ieee80211.h>
-#include <linux/slab.h>
-#include <linux/version.h>
-#include <net/cfg80211.h>
-
 #include "wil6210.h"
 #include "wmi.h"
 
@@ -292,7 +282,7 @@ static int wil_cfg80211_connect(struct wiphy *wiphy,
 
         /* WMI_CONNECT_CMD */
         memset(&conn, 0, sizeof(conn));
-        switch (bss->capability & 0x03) {
+        switch (bss->capability & WLAN_CAPABILITY_DMG_TYPE_MASK) {
         case WLAN_CAPABILITY_DMG_TYPE_AP:
                 conn.network_type = WMI_NETTYPE_INFRA;
                 break;
@@ -437,17 +427,18 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
         if (rc)
                 return rc;
 
-        rc = wmi_set_channel(wil, channel->hw_value);
-        if (rc)
-                return rc;
-
         /* MAC address - pre-requisite for other commands */
         wmi_set_mac_address(wil, ndev->dev_addr);
 
         /* IE's */
         /* bcon 'head IE's are not relevant for 60g band */
-        wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
-                   bcon->beacon_ies);
+        /*
+         * FW do not form regular beacon, so bcon IE's are not set
+         * For the DMG bcon, when it will be supported, bcon IE's will
+         * be reused; add something like:
+         * wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
+         * bcon->beacon_ies);
+         */
         wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
                    bcon->proberesp_ies);
         wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
@@ -455,7 +446,8 @@ static int wil_cfg80211_start_ap(struct wiphy *wiphy,
 
         wil->secure_pcp = info->privacy;
 
-        rc = wmi_set_bcon(wil, info->beacon_interval, wmi_nettype);
+        rc = wmi_pcp_start(wil, info->beacon_interval, wmi_nettype,
+                           channel->hw_value);
         if (rc)
                 return rc;
 
@@ -472,11 +464,8 @@ static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
 {
         int rc = 0;
         struct wil6210_priv *wil = wiphy_to_wil(wiphy);
-        struct wireless_dev *wdev = ndev->ieee80211_ptr;
-        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
 
-        /* To stop beaconing, set BI to 0 */
-        rc = wmi_set_bcon(wil, 0, wmi_nettype);
+        rc = wmi_pcp_stop(wil);
 
         return rc;
 }
diff --git a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
deleted file mode 100644
index e5712f026c47..000000000000
--- a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
+++ /dev/null
@@ -1,20 +0,0 @@
-#ifndef WIL_DBG_HEXDUMP_H_
-#define WIL_DBG_HEXDUMP_H_
-
-#include <linux/printk.h>
-#include <linux/dynamic_debug.h>
-
-#if defined(CONFIG_DYNAMIC_DEBUG)
-#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
-                                 groupsize, buf, len, ascii)            \
-        dynamic_hex_dump(prefix_str, prefix_type, rowsize,              \
-                             groupsize, buf, len, ascii)
-
-#else /* defined(CONFIG_DYNAMIC_DEBUG) */
-#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
-                                 groupsize, buf, len, ascii)            \
-        print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,    \
-                       groupsize, buf, len, ascii)
-#endif /* defined(CONFIG_DYNAMIC_DEBUG) */
-
-#endif /* WIL_DBG_HEXDUMP_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index 65fc9683bfd8..4be07f5e22b9 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -312,14 +312,6 @@ static const struct file_operations fops_memread = {
         .llseek         = seq_lseek,
 };
 
-static int wil_default_open(struct inode *inode, struct file *file)
-{
-        if (inode->i_private)
-                file->private_data = inode->i_private;
-
-        return 0;
-}
-
 static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -361,7 +353,7 @@ static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
 
 static const struct file_operations fops_ioblob = {
         .read =         wil_read_file_ioblob,
-        .open =         wil_default_open,
+        .open =         simple_open,
         .llseek =       default_llseek,
 };
 
@@ -396,7 +388,7 @@ static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
 
 static const struct file_operations fops_reset = {
         .write = wil_write_file_reset,
-        .open  = wil_default_open,
+        .open  = simple_open,
 };
 /*---------Tx descriptor------------*/
 
@@ -526,7 +518,50 @@ static ssize_t wil_write_file_ssid(struct file *file, const char __user *buf,
 static const struct file_operations fops_ssid = {
         .read = wil_read_file_ssid,
         .write = wil_write_file_ssid,
-        .open  = wil_default_open,
+        .open  = simple_open,
+};
+
+/*---------temp------------*/
+static void print_temp(struct seq_file *s, const char *prefix, u32 t)
+{
+        switch (t) {
+        case 0:
+        case ~(u32)0:
+                seq_printf(s, "%s N/A\n", prefix);
+        break;
+        default:
+                seq_printf(s, "%s %d.%03d\n", prefix, t / 1000, t % 1000);
+                break;
+        }
+}
+
+static int wil_temp_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        u32 t_m, t_r;
+
+        int rc = wmi_get_temperature(wil, &t_m, &t_r);
+        if (rc) {
+                seq_printf(s, "Failed\n");
+                return 0;
+        }
+
+        print_temp(s, "MAC temperature   :", t_m);
+        print_temp(s, "Radio temperature :", t_r);
+
+        return 0;
+}
+
+static int wil_temp_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_temp_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_temp = {
+        .open           = wil_temp_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
 };
 
 /*----------------*/
@@ -563,6 +598,7 @@ int wil6210_debugfs_init(struct wil6210_priv *wil)
         debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
 
         debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+        debugfs_create_file("temp", S_IRUGO, dbg, wil, &fops_temp);
 
         wil->rgf_blob.data = (void * __force)wil->csr + 0;
         wil->rgf_blob.size = 0xa000;
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index dc97e7b2609c..e3c1e7684f9c 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -240,6 +240,15 @@ static void wil_notify_fw_error(struct wil6210_priv *wil)
         kobject_uevent_env(&dev->kobj, KOBJ_CHANGE, envp);
 }
 
+static void wil_cache_mbox_regs(struct wil6210_priv *wil)
+{
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+}
+
 static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
 {
         struct wil6210_priv *wil = cookie;
@@ -257,14 +266,19 @@ static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
         wil6210_mask_irq_misc(wil);
 
         if (isr & ISR_MISC_FW_ERROR) {
-                wil_dbg_irq(wil, "IRQ: Firmware error\n");
+                wil_err(wil, "Firmware error detected\n");
                 clear_bit(wil_status_fwready, &wil->status);
-                wil_notify_fw_error(wil);
-                isr &= ~ISR_MISC_FW_ERROR;
+                /*
+                 * do not clear @isr here - we do 2-nd part in thread
+                 * there, user space get notified, and it should be done
+                 * in non-atomic context
+                 */
         }
 
         if (isr & ISR_MISC_FW_READY) {
                 wil_dbg_irq(wil, "IRQ: FW ready\n");
+                wil_cache_mbox_regs(wil);
+                set_bit(wil_status_reset_done, &wil->status);
                 /**
                  * Actual FW ready indicated by the
                  * WMI_FW_READY_EVENTID
@@ -289,6 +303,11 @@ static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
 
         wil_dbg_irq(wil, "Thread ISR MISC 0x%08x\n", isr);
 
+        if (isr & ISR_MISC_FW_ERROR) {
+                wil_notify_fw_error(wil);
+                isr &= ~ISR_MISC_FW_ERROR;
+        }
+
         if (isr & ISR_MISC_MBOX_EVT) {
                 wil_dbg_irq(wil, "MBOX event\n");
                 wmi_recv_cmd(wil);
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
index 761c389586d4..a0478e2f6868 100644
--- a/drivers/net/wireless/ath/wil6210/main.c
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -14,12 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
-#include <linux/sched.h>
-#include <linux/ieee80211.h>
-#include <linux/wireless.h>
-#include <linux/slab.h>
 #include <linux/moduleparam.h>
 #include <linux/if_arp.h>
 
@@ -109,13 +103,24 @@ static void wil_connect_timer_fn(ulong x)
         schedule_work(&wil->disconnect_worker);
 }
 
-static void wil_cache_mbox_regs(struct wil6210_priv *wil)
+static void wil_connect_worker(struct work_struct *work)
 {
-        /* make shadow copy of registers that should not change on run time */
-        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
-                             sizeof(struct wil6210_mbox_ctl));
-        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
-        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+        int rc;
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                connect_worker);
+        int cid = wil->pending_connect_cid;
+
+        if (cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                return;
+        }
+
+        wil_dbg_wmi(wil, "Configure for connection CID %d\n", cid);
+
+        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE, cid, 0);
+        wil->pending_connect_cid = -1;
+        if (rc == 0)
+                wil_link_on(wil);
 }
 
 int wil_priv_init(struct wil6210_priv *wil)
@@ -130,7 +135,7 @@ int wil_priv_init(struct wil6210_priv *wil)
         wil->pending_connect_cid = -1;
         setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
 
-        INIT_WORK(&wil->wmi_connect_worker, wmi_connect_worker);
+        INIT_WORK(&wil->connect_worker, wil_connect_worker);
         INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
         INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
 
@@ -147,8 +152,6 @@ int wil_priv_init(struct wil6210_priv *wil)
                 return -EAGAIN;
         }
 
-        wil_cache_mbox_regs(wil);
-
         return 0;
 }
 
@@ -185,15 +188,11 @@ static void wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
         W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
 
-        msleep(100);
-
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
 
-        msleep(100);
-
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
@@ -203,12 +202,6 @@ static void wil_target_reset(struct wil6210_priv *wil)
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
         W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
 
-        msleep(2000);
-
-        W(RGF_USER_USER_CPU_0, BIT(0)); /* user_cpu_man_de_rst */
-
-        msleep(2000);
-
         wil_dbg_misc(wil, "Reset completed\n");
 
 #undef W
@@ -265,8 +258,6 @@ int wil_reset(struct wil6210_priv *wil)
         wil->pending_connect_cid = -1;
         INIT_COMPLETION(wil->wmi_ready);
 
-        wil_cache_mbox_regs(wil);
-
         /* TODO: release MAC reset */
         wil6210_enable_irq(wil);
 
@@ -352,9 +343,9 @@ static int __wil_up(struct wil6210_priv *wil)
                         wil_err(wil, "SSID not set\n");
                         return -EINVAL;
                 }
-                wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
-                if (channel)
-                        wmi_set_channel(wil, channel->hw_value);
+                rc = wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
+                if (rc)
+                        return rc;
                 break;
         default:
                 break;
@@ -364,9 +355,12 @@ static int __wil_up(struct wil6210_priv *wil)
         wmi_set_mac_address(wil, ndev->dev_addr);
 
         /* Set up beaconing if required. */
-        rc = wmi_set_bcon(wil, bi, wmi_nettype);
-        if (rc)
-                return rc;
+        if (bi > 0) {
+                rc = wmi_pcp_start(wil, bi, wmi_nettype,
+                                   (channel ? channel->hw_value : 0));
+                if (rc)
+                        return rc;
+        }
 
         /* Rx VRING. After MAC and beacon */
         wil_rx_init(wil);
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
index 8ce2e33dce20..098a8ec6b841 100644
--- a/drivers/net/wireless/ath/wil6210/netdev.c
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/module.h>
-#include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/slab.h>
 
 #include "wil6210.h"
 
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
index 81c35c6e3832..eb1dc7ad80fb 100644
--- a/drivers/net/wireless/ath/wil6210/pcie_bus.c
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/netdevice.h>
 #include <linux/debugfs.h>
 #include <linux/pci.h>
 #include <linux/moduleparam.h>
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index d1315b442375..1bfa736cc1f2 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -14,10 +14,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/kernel.h>
-#include <linux/netdevice.h>
 #include <linux/etherdevice.h>
-#include <linux/hardirq.h>
 #include <net/ieee80211_radiotap.h>
 #include <linux/if_arp.h>
 #include <linux/moduleparam.h>
@@ -560,7 +557,7 @@ int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
         if (rc)
                 goto out_free;
 
-        if (reply.cmd.status != WMI_VRING_CFG_SUCCESS) {
+        if (reply.cmd.status != WMI_FW_STATUS_SUCCESS) {
                 wil_err(wil, "Tx config failed, status 0x%02x\n",
                         reply.cmd.status);
                 rc = -EINVAL;
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index aea961ff8f08..8f76ecd8a7e5 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -21,8 +21,6 @@
 #include <linux/wireless.h>
 #include <net/cfg80211.h>
 
-#include "dbg_hexdump.h"
-
 #define WIL_NAME "wil6210"
 
 /**
@@ -188,6 +186,7 @@ enum { /* for wil6210_priv.status */
         wil_status_fwready = 0,
         wil_status_fwconnected,
         wil_status_dontscan,
+        wil_status_reset_done,
         wil_status_irqen, /* FIXME: interrupts enabled - for debug */
 };
 
@@ -210,6 +209,8 @@ struct wil6210_priv {
         struct wireless_dev *wdev;
         void __iomem *csr;
         ulong status;
+        u32 fw_version;
+        u8 n_mids; /* number of additional MIDs as reported by FW */
         /* profile */
         u32 monitor_flags;
         u32 secure_pcp; /* create secure PCP? */
@@ -227,7 +228,7 @@ struct wil6210_priv {
         struct workqueue_struct *wmi_wq; /* for deferred calls */
         struct work_struct wmi_event_worker;
         struct workqueue_struct *wmi_wq_conn; /* for connect worker */
-        struct work_struct wmi_connect_worker;
+        struct work_struct connect_worker;
         struct work_struct disconnect_worker;
         struct timer_list connect_timer;
         int pending_connect_cid;
@@ -277,13 +278,13 @@ struct wil6210_priv {
 
 #define wil_hex_dump_txrx(prefix_str, prefix_type, rowsize,     \
                           groupsize, buf, len, ascii)           \
-                          wil_print_hex_dump_debug("DBG[TXRX]" prefix_str,\
+                          print_hex_dump_debug("DBG[TXRX]" prefix_str,\
                                          prefix_type, rowsize,  \
                                          groupsize, buf, len, ascii)
 
 #define wil_hex_dump_wmi(prefix_str, prefix_type, rowsize,      \
                          groupsize, buf, len, ascii)            \
-                         wil_print_hex_dump_debug("DBG[ WMI]" prefix_str,\
+                         print_hex_dump_debug("DBG[ WMI]" prefix_str,\
                                         prefix_type, rowsize,   \
                                         groupsize, buf, len, ascii)
 
@@ -313,7 +314,6 @@ int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len);
 void wmi_recv_cmd(struct wil6210_priv *wil);
 int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
              u16 reply_id, void *reply, u8 reply_size, int to_msec);
-void wmi_connect_worker(struct work_struct *work);
 void wmi_event_worker(struct work_struct *work);
 void wmi_event_flush(struct wil6210_priv *wil);
 int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid);
@@ -328,6 +328,8 @@ int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
 int wmi_echo(struct wil6210_priv *wil);
 int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie);
 int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring);
+int wmi_p2p_cfg(struct wil6210_priv *wil, int channel);
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r);
 
 int wil6210_init_irq(struct wil6210_priv *wil, int irq);
 void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
@@ -341,7 +343,8 @@ struct wireless_dev *wil_cfg80211_init(struct device *dev);
 void wil_wdev_free(struct wil6210_priv *wil);
 
 int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
-int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype);
+int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan);
+int wmi_pcp_stop(struct wil6210_priv *wil);
 void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
 
 int wil_rx_init(struct wil6210_priv *wil);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
index 0bb3b76b4b58..45b04e383f9a 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -14,9 +14,6 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/pci.h>
-#include <linux/io.h>
-#include <linux/list.h>
 #include <linux/etherdevice.h>
 #include <linux/if_arp.h>
 
@@ -272,16 +269,18 @@ static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
         struct net_device *ndev = wil_to_ndev(wil);
         struct wireless_dev *wdev = wil->wdev;
         struct wmi_ready_event *evt = d;
-        u32 ver = le32_to_cpu(evt->sw_version);
+        wil->fw_version = le32_to_cpu(evt->sw_version);
+        wil->n_mids = evt->numof_additional_mids;
 
-        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM\n", ver, evt->mac);
+        wil_dbg_wmi(wil, "FW ver. %d; MAC %pM; %d MID's\n", wil->fw_version,
+                    evt->mac, wil->n_mids);
 
         if (!is_valid_ether_addr(ndev->dev_addr)) {
                 memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
                 memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
         }
         snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
-                 "%d", ver);
+                 "%d", wil->fw_version);
 }
 
 static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
@@ -324,17 +323,9 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
 
         if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
                 struct cfg80211_bss *bss;
-                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
-                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
-                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
-                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
-                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
-                                                 u.beacon.variable);
-                wil_dbg_wmi(wil, "Capability info : 0x%04x\n", cap);
-
-                bss = cfg80211_inform_bss(wiphy, channel, rx_mgmt_frame->bssid,
-                                          tsf, cap, bi, ie_buf, ie_len,
-                                          signal, GFP_KERNEL);
+
+                bss = cfg80211_inform_bss_frame(wiphy, channel, rx_mgmt_frame,
+                                                d_len, signal, GFP_KERNEL);
                 if (bss) {
                         wil_dbg_wmi(wil, "Added BSS %pM\n",
                                     rx_mgmt_frame->bssid);
@@ -342,6 +333,9 @@ static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
                 } else {
                         wil_err(wil, "cfg80211_inform_bss() failed\n");
                 }
+        } else {
+                cfg80211_rx_mgmt(wil->wdev, freq, signal,
+                                 (void *)rx_mgmt_frame, d_len, GFP_KERNEL);
         }
 }
 
@@ -443,7 +437,7 @@ static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
         memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
 
         wil->pending_connect_cid = evt->cid;
-        queue_work(wil->wmi_wq_conn, &wil->wmi_connect_worker);
+        queue_work(wil->wmi_wq_conn, &wil->connect_worker);
 }
 
 static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
@@ -528,6 +522,37 @@ static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
         }
 }
 
+static void wmi_evt_linkup(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_data_port_open_event *evt = d;
+
+        wil_dbg_wmi(wil, "Link UP for CID %d\n", evt->cid);
+
+        netif_carrier_on(ndev);
+}
+
+static void wmi_evt_linkdown(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_wbe_link_down_event *evt = d;
+
+        wil_dbg_wmi(wil, "Link DOWN for CID %d, reason %d\n",
+                    evt->cid, le32_to_cpu(evt->reason));
+
+        netif_carrier_off(ndev);
+}
+
+static void wmi_evt_ba_status(struct wil6210_priv *wil, int id, void *d,
+                              int len)
+{
+        struct wmi_vring_ba_status_event *evt = d;
+
+        wil_dbg_wmi(wil, "BACK[%d] %s {%d} timeout %d\n",
+                    evt->ringid, evt->status ? "N/A" : "OK", evt->agg_wsize,
+                    __le16_to_cpu(evt->ba_timeout));
+}
+
 static const struct {
         int eventid;
         void (*handler)(struct wil6210_priv *wil, int eventid,
@@ -541,6 +566,9 @@ static const struct {
         {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
         {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
         {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
+        {WMI_DATA_PORT_OPEN_EVENTID,    wmi_evt_linkup},
+        {WMI_WBE_LINKDOWN_EVENTID,      wmi_evt_linkdown},
+        {WMI_BA_STATUS_EVENTID,         wmi_evt_ba_status},
 };
 
 /*
@@ -559,6 +587,11 @@ void wmi_recv_cmd(struct wil6210_priv *wil)
         void __iomem *src;
         ulong flags;
 
+        if (!test_bit(wil_status_reset_done, &wil->status)) {
+                wil_err(wil, "Reset not completed\n");
+                return;
+        }
+
         for (;;) {
                 u16 len;
 
@@ -683,18 +716,39 @@ int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
         return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
 }
 
-int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype)
+int wmi_pcp_start(struct wil6210_priv *wil, int bi, u8 wmi_nettype, u8 chan)
 {
-        struct wmi_bcon_ctrl_cmd cmd = {
+        int rc;
+
+        struct wmi_pcp_start_cmd cmd = {
                 .bcon_interval = cpu_to_le16(bi),
                 .network_type = wmi_nettype,
                 .disable_sec_offload = 1,
+                .channel = chan,
         };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_pcp_started_event evt;
+        } __packed reply;
 
         if (!wil->secure_pcp)
                 cmd.disable_sec = 1;
 
-        return wmi_send(wil, WMI_BCON_CTRL_CMDID, &cmd, sizeof(cmd));
+        rc = wmi_call(wil, WMI_PCP_START_CMDID, &cmd, sizeof(cmd),
+                      WMI_PCP_STARTED_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (reply.evt.status != WMI_FW_STATUS_SUCCESS)
+                rc = -EINVAL;
+
+        return rc;
+}
+
+int wmi_pcp_stop(struct wil6210_priv *wil)
+{
+        return wmi_call(wil, WMI_PCP_STOP_CMDID, NULL, 0,
+                        WMI_PCP_STOPPED_EVENTID, NULL, 0, 20);
 }
 
 int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
@@ -765,6 +819,16 @@ int wmi_get_channel(struct wil6210_priv *wil, int *channel)
         return 0;
 }
 
+int wmi_p2p_cfg(struct wil6210_priv *wil, int channel)
+{
+        struct wmi_p2p_cfg_cmd cmd = {
+                .discovery_mode = WMI_DISCOVERY_MODE_NON_OFFLOAD,
+                .channel = channel - 1,
+        };
+
+        return wmi_send(wil, WMI_P2P_CFG_CMDID, &cmd, sizeof(cmd));
+}
+
 int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
 {
         struct wmi_eapol_tx_cmd *cmd;
@@ -843,7 +907,7 @@ int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
         /* BUG: FW API define ieLen as u8. Will fix FW */
         cmd->ie_len = cpu_to_le16(ie_len);
         memcpy(cmd->ie_info, ie, ie_len);
-        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, &cmd, len);
+        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, cmd, len);
         kfree(cmd);
 
         return rc;
@@ -898,6 +962,31 @@ int wmi_rx_chain_add(struct wil6210_priv *wil, struct vring *vring)
         return rc;
 }
 
+int wmi_get_temperature(struct wil6210_priv *wil, u32 *t_m, u32 *t_r)
+{
+        int rc;
+        struct wmi_temp_sense_cmd cmd = {
+                .measure_marlon_m_en = cpu_to_le32(!!t_m),
+                .measure_marlon_r_en = cpu_to_le32(!!t_r),
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_temp_sense_done_event evt;
+        } __packed reply;
+
+        rc = wmi_call(wil, WMI_TEMP_SENSE_CMDID, &cmd, sizeof(cmd),
+                      WMI_TEMP_SENSE_DONE_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                return rc;
+
+        if (t_m)
+                *t_m = le32_to_cpu(reply.evt.marlon_m_t1000);
+        if (t_r)
+                *t_r = le32_to_cpu(reply.evt.marlon_r_t1000);
+
+        return 0;
+}
+
 void wmi_event_flush(struct wil6210_priv *wil)
 {
         struct pending_wmi_event *evt, *t;
@@ -997,24 +1086,3 @@ void wmi_event_worker(struct work_struct *work)
                 kfree(evt);
         }
 }
-
-void wmi_connect_worker(struct work_struct *work)
-{
-        int rc;
-        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
-                                                wmi_connect_worker);
-
-        if (wil->pending_connect_cid < 0) {
-                wil_err(wil, "No connection pending\n");
-                return;
-        }
-
-        wil_dbg_wmi(wil, "Configure for connection CID %d\n",
-                    wil->pending_connect_cid);
-
-        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE,
-                               wil->pending_connect_cid, 0);
-        wil->pending_connect_cid = -1;
-        if (rc == 0)
-                wil_link_on(wil);
-}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
index 3bbf87572b07..50b8528394f4 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.h
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -36,6 +36,7 @@
 enum wmi_command_id {
         WMI_CONNECT_CMDID               = 0x0001,
         WMI_DISCONNECT_CMDID            = 0x0003,
+        WMI_DISCONNECT_STA_CMDID        = 0x0004,
         WMI_START_SCAN_CMDID            = 0x0007,
         WMI_SET_BSS_FILTER_CMDID        = 0x0009,
         WMI_SET_PROBED_SSID_CMDID       = 0x000a,
@@ -44,7 +45,6 @@ enum wmi_command_id {
         WMI_ADD_CIPHER_KEY_CMDID        = 0x0016,
         WMI_DELETE_CIPHER_KEY_CMDID     = 0x0017,
         WMI_SET_APPIE_CMDID             = 0x003f,
-        WMI_GET_APPIE_CMDID             = 0x0040,
         WMI_SET_WSC_STATUS_CMDID        = 0x0041,
         WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
         WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
@@ -55,11 +55,11 @@ enum wmi_command_id {
         WMI_DEEP_ECHO_CMDID             = 0x0804,
         WMI_CONFIG_MAC_CMDID            = 0x0805,
         WMI_CONFIG_PHY_DEBUG_CMDID      = 0x0806,
-        WMI_ADD_STATION_CMDID           = 0x0807,
         WMI_ADD_DEBUG_TX_PCKT_CMDID     = 0x0808,
         WMI_PHY_GET_STATISTICS_CMDID    = 0x0809,
         WMI_FS_TUNE_CMDID               = 0x080a,
         WMI_CORR_MEASURE_CMDID          = 0x080b,
+        WMI_READ_RSSI_CMDID             = 0x080c,
         WMI_TEMP_SENSE_CMDID            = 0x080e,
         WMI_DC_CALIB_CMDID              = 0x080f,
         WMI_SEND_TONE_CMDID             = 0x0810,
@@ -75,9 +75,9 @@ enum wmi_command_id {
         MAC_IO_STATIC_PARAMS_CMDID      = 0x081b,
         MAC_IO_DYNAMIC_PARAMS_CMDID     = 0x081c,
         WMI_SILENT_RSSI_CALIB_CMDID     = 0x081d,
+        WMI_RF_RX_TEST_CMDID            = 0x081e,
         WMI_CFG_RX_CHAIN_CMDID          = 0x0820,
         WMI_VRING_CFG_CMDID             = 0x0821,
-        WMI_RX_ON_CMDID                 = 0x0822,
         WMI_VRING_BA_EN_CMDID           = 0x0823,
         WMI_VRING_BA_DIS_CMDID          = 0x0824,
         WMI_RCP_ADDBA_RESP_CMDID        = 0x0825,
@@ -87,7 +87,6 @@ enum wmi_command_id {
         WMI_SET_PCP_CHANNEL_CMDID       = 0x0829,
         WMI_GET_PCP_CHANNEL_CMDID       = 0x082a,
         WMI_SW_TX_REQ_CMDID             = 0x082b,
-        WMI_RX_OFF_CMDID                = 0x082c,
         WMI_READ_MAC_RXQ_CMDID          = 0x0830,
         WMI_READ_MAC_TXQ_CMDID          = 0x0831,
         WMI_WRITE_MAC_RXQ_CMDID         = 0x0832,
@@ -112,6 +111,18 @@ enum wmi_command_id {
         WMI_FLASH_READ_CMDID            = 0x0902,
         WMI_FLASH_WRITE_CMDID           = 0x0903,
         WMI_SECURITY_UNIT_TEST_CMDID    = 0x0904,
+        /*P2P*/
+        WMI_P2P_CFG_CMDID               = 0x0910,
+        WMI_PORT_ALLOCATE_CMDID         = 0x0911,
+        WMI_PORT_DELETE_CMDID           = 0x0912,
+        WMI_POWER_MGMT_CFG_CMDID        = 0x0913,
+        WMI_START_LISTEN_CMDID          = 0x0914,
+        WMI_START_SEARCH_CMDID          = 0x0915,
+        WMI_DISCOVERY_START_CMDID       = 0x0916,
+        WMI_DISCOVERY_STOP_CMDID        = 0x0917,
+        WMI_PCP_START_CMDID             = 0x0918,
+        WMI_PCP_STOP_CMDID              = 0x0919,
+        WMI_GET_PCP_FACTOR_CMDID        = 0x091b,
 
         WMI_SET_MAC_ADDRESS_CMDID       = 0xf003,
         WMI_ABORT_SCAN_CMDID            = 0xf007,
@@ -132,18 +143,6 @@ enum wmi_command_id {
  */
 
 /*
- * Frame Types
- */
-enum wmi_mgmt_frame_type {
-        WMI_FRAME_BEACON        = 0,
-        WMI_FRAME_PROBE_REQ     = 1,
-        WMI_FRAME_PROBE_RESP    = 2,
-        WMI_FRAME_ASSOC_REQ     = 3,
-        WMI_FRAME_ASSOC_RESP    = 4,
-        WMI_NUM_MGMT_FRAME,
-};
-
-/*
  * WMI_CONNECT_CMDID
  */
 enum wmi_network_type {
@@ -184,7 +183,7 @@ enum wmi_crypto_type {
 enum wmi_connect_ctrl_flag_bits {
         WMI_CONNECT_ASSOC_POLICY_USER           = 0x0001,
         WMI_CONNECT_SEND_REASSOC                = 0x0002,
-        WMI_CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+        WMI_CONNECT_IGNORE_WPA_GROUP_CIPHER     = 0x0004,
         WMI_CONNECT_PROFILE_MATCH_DONE          = 0x0008,
         WMI_CONNECT_IGNORE_AAC_BEACON           = 0x0010,
         WMI_CONNECT_CSA_FOLLOW_BSS              = 0x0020,
@@ -212,6 +211,13 @@ struct wmi_connect_cmd {
         u8 reserved1[2];
 } __packed;
 
+/*
+ * WMI_DISCONNECT_STA_CMDID
+ */
+struct wmi_disconnect_sta_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 disconnect_reason;
+} __packed;
 
 /*
  * WMI_RECONNECT_CMDID
@@ -289,10 +295,12 @@ struct wmi_delete_cipher_key_cmd {
 enum wmi_scan_type {
         WMI_LONG_SCAN           = 0,
         WMI_SHORT_SCAN          = 1,
+        WMI_PBC_SCAN            = 2,
 };
 
 struct wmi_start_scan_cmd {
         u8 reserved[8];
+
         __le32 home_dwell_time; /* Max duration in the home channel(ms) */
         __le32 force_scan_interval;     /* Time interval between scans (ms)*/
         u8 scan_type;           /* wmi_scan_type */
@@ -309,7 +317,7 @@ struct wmi_start_scan_cmd {
 /*
  * WMI_SET_PROBED_SSID_CMDID
  */
-#define MAX_PROBED_SSID_INDEX   (15)
+#define MAX_PROBED_SSID_INDEX   (3)
 
 enum wmi_ssid_flag {
         WMI_SSID_FLAG_DISABLE   = 0,    /* disables entry */
@@ -328,6 +336,20 @@ struct wmi_probed_ssid_cmd {
  * WMI_SET_APPIE_CMDID
  * Add Application specified IE to a management frame
  */
+#define WMI_MAX_IE_LEN          (1024)
+
+/*
+ * Frame Types
+ */
+enum wmi_mgmt_frame_type {
+        WMI_FRAME_BEACON        = 0,
+        WMI_FRAME_PROBE_REQ     = 1,
+        WMI_FRAME_PROBE_RESP    = 2,
+        WMI_FRAME_ASSOC_REQ     = 3,
+        WMI_FRAME_ASSOC_RESP    = 4,
+        WMI_NUM_MGMT_FRAME,
+};
+
 struct wmi_set_appie_cmd {
         u8 mgmt_frm_type;       /* enum wmi_mgmt_frame_type */
         u8 reserved;
@@ -335,13 +357,18 @@ struct wmi_set_appie_cmd {
         u8 ie_info[0];
 } __packed;
 
-#define WMI_MAX_IE_LEN (1024)
 
+/*
+ * WMI_PXMT_RANGE_CFG_CMDID
+ */
 struct wmi_pxmt_range_cfg_cmd {
         u8 dst_mac[WMI_MAC_LEN];
         __le16 range;
 } __packed;
 
+/*
+ * WMI_PXMT_SNR2_RANGE_CFG_CMDID
+ */
 struct wmi_pxmt_snr2_range_cfg_cmd {
         s8 snr2range_arr[WMI_PROX_RANGE_NUM-1];
 } __packed;
@@ -359,6 +386,23 @@ struct wmi_rf_mgmt_cmd {
         __le32 rf_mgmt_type;
 } __packed;
 
+
+/*
+ * WMI_RF_RX_TEST_CMDID
+ */
+struct wmi_rf_rx_test_cmd {
+        __le32 sector;
+} __packed;
+
+/*
+ * WMI_CORR_MEASURE_CMDID
+ */
+struct wmi_corr_measure_cmd {
+        s32 freq_mhz;
+        __le32 length_samples;
+        __le32 iterations;
+} __packed;
+
 /*
  * WMI_SET_SSID_CMDID
  */
@@ -388,6 +432,74 @@ struct wmi_bcon_ctrl_cmd {
         u8 disable_sec;
 } __packed;
 
+
+/******* P2P ***********/
+
+/*
+ * WMI_PORT_ALLOCATE_CMDID
+ */
+enum wmi_port_role {
+        WMI_PORT_STA            = 0,
+        WMI_PORT_PCP            = 1,
+        WMI_PORT_AP             = 2,
+        WMI_PORT_P2P_DEV        = 3,
+        WMI_PORT_P2P_CLIENT     = 4,
+        WMI_PORT_P2P_GO         = 5,
+};
+
+struct wmi_port_allocate_cmd {
+        u8 mac[WMI_MAC_LEN];
+        u8 port_role;
+        u8 midid;
+} __packed;
+
+/*
+ * WMI_PORT_DELETE_CMDID
+ */
+struct wmi_delete_port_cmd {
+        u8 mid;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_P2P_CFG_CMDID
+ */
+enum wmi_discovery_mode {
+        WMI_DISCOVERY_MODE_NON_OFFLOAD  = 0,
+        WMI_DISCOVERY_MODE_OFFLOAD      = 1,
+};
+
+struct wmi_p2p_cfg_cmd {
+        u8 discovery_mode;      /* wmi_discovery_mode */
+        u8 channel;
+        __le16 bcon_interval; /* base to listen/search duration calculation */
+} __packed;
+
+/*
+ * WMI_POWER_MGMT_CFG_CMDID
+ */
+enum wmi_power_source_type {
+        WMI_POWER_SOURCE_BATTERY        = 0,
+        WMI_POWER_SOURCE_OTHER          = 1,
+};
+
+struct wmi_power_mgmt_cfg_cmd {
+        u8 power_source;        /* wmi_power_source_type */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_START_CMDID
+ */
+struct wmi_pcp_start_cmd {
+        __le16 bcon_interval;
+        u8 reserved0[10];
+        u8 network_type;
+        u8 channel;
+        u8 disable_sec_offload;
+        u8 disable_sec;
+} __packed;
+
 /*
  * WMI_SW_TX_REQ_CMDID
  */
@@ -435,16 +547,17 @@ enum wmi_vring_cfg_schd_params_priority {
         WMI_SCH_PRIO_HIGH                       = 1,
 };
 
+#define CIDXTID_CID_POS (0)
+#define CIDXTID_CID_LEN (4)
+#define CIDXTID_CID_MSK (0xF)
+#define CIDXTID_TID_POS (4)
+#define CIDXTID_TID_LEN (4)
+#define CIDXTID_TID_MSK (0xF0)
+
 struct wmi_vring_cfg {
         struct wmi_sw_ring_cfg tx_sw_ring;
         u8 ringid;                              /* 0-23 vrings */
 
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
 
         u8 encap_trans_type;
@@ -501,8 +614,14 @@ struct wmi_vring_ba_dis_cmd {
  */
 struct wmi_notify_req_cmd {
         u8 cid;
-        u8 reserved[3];
+        u8 year;
+        u8 month;
+        u8 day;
         __le32 interval_usec;
+        u8 hour;
+        u8 minute;
+        u8 second;
+        u8 miliseconds;
 } __packed;
 
 /*
@@ -548,6 +667,11 @@ enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
         WMI_NWIFI_RX_TRANS_MODE_PBSS2STA        = 2,
 };
 
+enum wmi_cfg_rx_chain_cmd_reorder_type {
+        WMI_RX_HW_REORDER = 0,
+        WMI_RX_SW_REORDER = 1,
+};
+
 struct wmi_cfg_rx_chain_cmd {
         __le32 action;
         struct wmi_sw_ring_cfg rx_sw_ring;
@@ -596,7 +720,8 @@ struct wmi_cfg_rx_chain_cmd {
         __le16 wb_thrsh;
         __le32 itr_value;
         __le16 host_thrsh;
-        u8 reserved[2];
+        u8 reorder_type;
+        u8 reserved;
         struct wmi_sniffer_cfg sniffer_cfg;
 } __packed;
 
@@ -604,15 +729,7 @@ struct wmi_cfg_rx_chain_cmd {
  * WMI_RCP_ADDBA_RESP_CMDID
  */
 struct wmi_rcp_addba_resp_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         __le16 status_code;
         __le16 ba_param_set;    /* ieee80211_ba_parameterset field to send */
@@ -623,15 +740,7 @@ struct wmi_rcp_addba_resp_cmd {
  * WMI_RCP_DELBA_CMDID
  */
 struct wmi_rcp_delba_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 reserved;
         __le16 reason;
 } __packed;
@@ -640,15 +749,7 @@ struct wmi_rcp_delba_cmd {
  * WMI_RCP_ADDBA_REQ_CMDID
  */
 struct wmi_rcp_addba_req_cmd {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         /* ieee80211_ba_parameterset field as it received */
         __le16 ba_param_set;
@@ -665,7 +766,6 @@ struct wmi_set_mac_address_cmd {
         u8 reserved[2];
 } __packed;
 
-
 /*
 * WMI_EAPOL_TX_CMDID
 */
@@ -692,6 +792,17 @@ struct wmi_echo_cmd {
 } __packed;
 
 /*
+ * WMI_TEMP_SENSE_CMDID
+ *
+ * Measure MAC and radio temperatures
+ */
+struct wmi_temp_sense_cmd {
+        __le32 measure_marlon_m_en;
+        __le32 measure_marlon_r_en;
+} __packed;
+
+
+/*
  * WMI Events
  */
 
@@ -699,7 +810,6 @@ struct wmi_echo_cmd {
  * List of Events (target to host)
  */
 enum wmi_event_id {
-        WMI_IMM_RSP_EVENTID                     = 0x0000,
         WMI_READY_EVENTID                       = 0x1001,
         WMI_CONNECT_EVENTID                     = 0x1002,
         WMI_DISCONNECT_EVENTID                  = 0x1003,
@@ -709,13 +819,9 @@ enum wmi_event_id {
         WMI_FW_READY_EVENTID                    = 0x1801,
         WMI_EXIT_FAST_MEM_ACC_MODE_EVENTID      = 0x0200,
         WMI_ECHO_RSP_EVENTID                    = 0x1803,
-        WMI_CONFIG_MAC_DONE_EVENTID             = 0x1805,
-        WMI_CONFIG_PHY_DEBUG_DONE_EVENTID       = 0x1806,
-        WMI_ADD_STATION_DONE_EVENTID            = 0x1807,
-        WMI_ADD_DEBUG_TX_PCKT_DONE_EVENTID      = 0x1808,
-        WMI_PHY_GET_STATISTICS_EVENTID          = 0x1809,
         WMI_FS_TUNE_DONE_EVENTID                = 0x180a,
-        WMI_CORR_MEASURE_DONE_EVENTID           = 0x180b,
+        WMI_CORR_MEASURE_EVENTID                = 0x180b,
+        WMI_READ_RSSI_EVENTID                   = 0x180c,
         WMI_TEMP_SENSE_DONE_EVENTID             = 0x180e,
         WMI_DC_CALIB_DONE_EVENTID               = 0x180f,
         WMI_IQ_TX_CALIB_DONE_EVENTID            = 0x1811,
@@ -727,10 +833,9 @@ enum wmi_event_id {
         WMI_MARLON_R_WRITE_DONE_EVENTID         = 0x1819,
         WMI_MARLON_R_TXRX_SEL_DONE_EVENTID      = 0x181a,
         WMI_SILENT_RSSI_CALIB_DONE_EVENTID      = 0x181d,
-
+        WMI_RF_RX_TEST_DONE_EVENTID             = 0x181e,
         WMI_CFG_RX_CHAIN_DONE_EVENTID           = 0x1820,
         WMI_VRING_CFG_DONE_EVENTID              = 0x1821,
-        WMI_RX_ON_DONE_EVENTID                  = 0x1822,
         WMI_BA_STATUS_EVENTID                   = 0x1823,
         WMI_RCP_ADDBA_REQ_EVENTID               = 0x1824,
         WMI_ADDBA_RESP_SENT_EVENTID             = 0x1825,
@@ -738,7 +843,6 @@ enum wmi_event_id {
         WMI_GET_SSID_EVENTID                    = 0x1828,
         WMI_GET_PCP_CHANNEL_EVENTID             = 0x182a,
         WMI_SW_TX_COMPLETE_EVENTID              = 0x182b,
-        WMI_RX_OFF_DONE_EVENTID                 = 0x182c,
 
         WMI_READ_MAC_RXQ_EVENTID                = 0x1830,
         WMI_READ_MAC_TXQ_EVENTID                = 0x1831,
@@ -765,7 +869,16 @@ enum wmi_event_id {
         WMI_UNIT_TEST_EVENTID                   = 0x1900,
         WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
         WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
-
+        /*P2P*/
+        WMI_PORT_ALLOCATED_EVENTID              = 0x1911,
+        WMI_PORT_DELETED_EVENTID                = 0x1912,
+        WMI_LISTEN_STARTED_EVENTID              = 0x1914,
+        WMI_SEARCH_STARTED_EVENTID              = 0x1915,
+        WMI_DISCOVERY_STARTED_EVENTID           = 0x1916,
+        WMI_DISCOVERY_STOPPED_EVENTID           = 0x1917,
+        WMI_PCP_STARTED_EVENTID                 = 0x1918,
+        WMI_PCP_STOPPED_EVENTID                 = 0x1919,
+        WMI_PCP_FACTOR_EVENTID                  = 0x191a,
         WMI_SET_CHANNEL_EVENTID                 = 0x9000,
         WMI_ASSOC_REQ_EVENTID                   = 0x9001,
         WMI_EAPOL_RX_EVENTID                    = 0x9002,
@@ -777,6 +890,12 @@ enum wmi_event_id {
  * Events data structures
  */
 
+
+enum wmi_fw_status {
+        WMI_FW_STATUS_SUCCESS,
+        WMI_FW_STATUS_FAILURE,
+};
+
 /*
  * WMI_RF_MGMT_STATUS_EVENTID
  */
@@ -857,7 +976,7 @@ struct wmi_ready_event {
         __le32 abi_version;
         u8 mac[WMI_MAC_LEN];
         u8 phy_capability;              /* enum wmi_phy_capability */
-        u8 reserved;
+        u8 numof_additional_mids;
 } __packed;
 
 /*
@@ -876,6 +995,8 @@ struct wmi_notify_req_done_event {
         __le16 other_rx_sector;
         __le16 other_tx_sector;
         __le16 range;
+        u8 sqi;
+        u8 reserved[3];
 } __packed;
 
 /*
@@ -951,27 +1072,15 @@ struct wmi_vring_ba_status_event {
  * WMI_DELBA_EVENTID
  */
 struct wmi_delba_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 from_initiator;
         __le16 reason;
 } __packed;
 
+
 /*
  * WMI_VRING_CFG_DONE_EVENTID
  */
-enum wmi_vring_cfg_done_event_status {
-        WMI_VRING_CFG_SUCCESS           = 0,
-        WMI_VRING_CFG_FAILURE           = 1,
-};
-
 struct wmi_vring_cfg_done_event {
         u8 ringid;
         u8 status;
@@ -982,21 +1091,8 @@ struct wmi_vring_cfg_done_event {
 /*
  * WMI_ADDBA_RESP_SENT_EVENTID
  */
-enum wmi_rcp_addba_resp_sent_event_status {
-        WMI_ADDBA_SUCCESS               = 0,
-        WMI_ADDBA_FAIL                  = 1,
-};
-
 struct wmi_rcp_addba_resp_sent_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 reserved;
         __le16 status;
 } __packed;
@@ -1005,15 +1101,7 @@ struct wmi_rcp_addba_resp_sent_event {
  * WMI_RCP_ADDBA_REQ_EVENTID
  */
 struct wmi_rcp_addba_req_event {
-
-        #define CIDXTID_CID_POS (0)
-        #define CIDXTID_CID_LEN (4)
-        #define CIDXTID_CID_MSK (0xF)
-        #define CIDXTID_TID_POS (4)
-        #define CIDXTID_TID_LEN (4)
-        #define CIDXTID_TID_MSK (0xF0)
         u8 cidxtid;
-
         u8 dialog_token;
         __le16 ba_param_set;    /* ieee80211_ba_parameterset as it received */
         __le16 ba_timeout;
@@ -1055,6 +1143,7 @@ struct wmi_data_port_open_event {
         u8 reserved[3];
 } __packed;
 
+
 /*
  * WMI_GET_PCP_CHANNEL_EVENTID
  */
@@ -1063,6 +1152,54 @@ struct wmi_get_pcp_channel_event {
         u8 reserved[3];
 } __packed;
 
+
+/*
+* WMI_PORT_ALLOCATED_EVENTID
+*/
+struct wmi_port_allocated_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+* WMI_PORT_DELETED_EVENTID
+*/
+struct wmi_port_deleted_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_LISTEN_STARTED_EVENTID
+ */
+struct wmi_listen_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_SEARCH_STARTED_EVENTID
+ */
+struct wmi_search_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_STARTED_EVENTID
+ */
+struct wmi_pcp_started_event {
+        u8 status;      /* wmi_fw_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_PCP_FACTOR_EVENTID
+ */
+struct wmi_pcp_factor_event {
+        __le32 pcp_factor;
+} __packed;
+
 /*
  * WMI_SW_TX_COMPLETE_EVENTID
  */
@@ -1078,6 +1215,23 @@ struct wmi_sw_tx_complete_event {
 } __packed;
 
 /*
+ * WMI_CORR_MEASURE_EVENTID
+ */
+struct wmi_corr_measure_event {
+        s32 i;
+        s32 q;
+        s32 image_i;
+        s32 image_q;
+} __packed;
+
+/*
+ * WMI_READ_RSSI_EVENTID
+ */
+struct wmi_read_rssi_event {
+        __le32 ina_rssi_adc_dbm;
+} __packed;
+
+/*
  * WMI_GET_SSID_EVENTID
  */
 struct wmi_get_ssid_event {
@@ -1091,7 +1245,8 @@ struct wmi_get_ssid_event {
 struct wmi_rx_mgmt_info {
         u8 mcs;
         s8 snr;
-        __le16 range;
+        u8 range;
+        u8 sqi;
         __le16 stype;
         __le16 status;
         __le32 len;
@@ -1113,4 +1268,14 @@ struct wmi_echo_event {
         __le32 echoed_value;
 } __packed;
 
+/*
+ * WMI_TEMP_SENSE_DONE_EVENTID
+ *
+ * Measure MAC and radio temperatures
+ */
+struct wmi_temp_sense_done_event {
+        __le32 marlon_m_t1000;
+        __le32 marlon_r_t1000;
+} __packed;
+
 #endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index 287c6b670a36..078e6f3477a9 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -131,7 +131,7 @@ config B43_PHY_LP
 
 config B43_PHY_HT
         bool "Support for HT-PHY (high throughput) devices"
-        depends on B43
+        depends on B43 && B43_BCMA
         ---help---
           Support for the HT-PHY.
 
@@ -166,8 +166,8 @@ config B43_DEBUG
           Broadcom 43xx debugging.
 
           This adds additional runtime sanity checks and statistics to the driver.
-          These checks and statistics might me expensive and hurt runtime performance
-          of your system.
+          These checks and statistics might be expensive and hurt the runtime
+          performance of your system.
           This also adds the b43 debugfs interface.
 
           Do not enable this, unless you are debugging the driver.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 10e288d470e7..fe4a77ee05c9 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -473,6 +473,12 @@ enum {
 #define B43_MACCMD_CCA                  0x00000008      /* Clear channel assessment */
 #define B43_MACCMD_BGNOISE              0x00000010      /* Background noise */
 
+/* See BCMA_CLKCTLST_EXTRESREQ and BCMA_CLKCTLST_EXTRESST */
+#define B43_BCMA_CLKCTLST_80211_PLL_REQ 0x00000100
+#define B43_BCMA_CLKCTLST_PHY_PLL_REQ   0x00000200
+#define B43_BCMA_CLKCTLST_80211_PLL_ST  0x01000000
+#define B43_BCMA_CLKCTLST_PHY_PLL_ST    0x02000000
+
 /* BCMA 802.11 core specific IO Control (BCMA_IOCTL) flags */
 #define B43_BCMA_IOCTL_PHY_CLKEN        0x00000004      /* PHY Clock Enable */
 #define B43_BCMA_IOCTL_PHY_RESET        0x00000008      /* PHY Reset */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 05682736e466..c4d0cc582555 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -1189,10 +1189,15 @@ static void b43_bcma_phy_reset(struct b43_wldev *dev)
 
 static void b43_bcma_wireless_core_reset(struct b43_wldev *dev, bool gmode)
 {
+        u32 req = B43_BCMA_CLKCTLST_80211_PLL_REQ |
+                  B43_BCMA_CLKCTLST_PHY_PLL_REQ;
+        u32 status = B43_BCMA_CLKCTLST_80211_PLL_ST |
+                     B43_BCMA_CLKCTLST_PHY_PLL_ST;
+
         b43_device_enable(dev, B43_BCMA_IOCTL_PHY_CLKEN);
         bcma_core_set_clockmode(dev->dev->bdev, BCMA_CLKMODE_FAST);
         b43_bcma_phy_reset(dev);
-        bcma_core_pll_ctl(dev->dev->bdev, 0x300, 0x3000000, true);
+        bcma_core_pll_ctl(dev->dev->bdev, req, status, true);
 }
 #endif
 
diff --git a/drivers/net/wireless/b43/phy_ht.c b/drivers/net/wireless/b43/phy_ht.c
index 7416c5e9154d..b8667706fc27 100644
--- a/drivers/net/wireless/b43/phy_ht.c
+++ b/drivers/net/wireless/b43/phy_ht.c
@@ -154,9 +154,84 @@ static void b43_radio_2059_init(struct b43_wldev *dev)
 }
 
 /**************************************************
+ * RF
+ **************************************************/
+
+static void b43_phy_ht_force_rf_sequence(struct b43_wldev *dev, u16 rf_seq)
+{
+        u8 i;
+
+        u16 save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE, 0x3);
+
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_TRIG, rf_seq);
+        for (i = 0; i < 200; i++) {
+                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & rf_seq)) {
+                        i = 0;
+                        break;
+                }
+                msleep(1);
+        }
+        if (i)
+                b43err(dev->wl, "Forcing RF sequence timeout\n");
+
+        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
+}
+
+static void b43_phy_ht_pa_override(struct b43_wldev *dev, bool enable)
+{
+        struct b43_phy_ht *htphy = dev->phy.ht;
+        static const u16 regs[3] = { B43_PHY_HT_RF_CTL_INT_C1,
+                                     B43_PHY_HT_RF_CTL_INT_C2,
+                                     B43_PHY_HT_RF_CTL_INT_C3 };
+        int i;
+
+        if (enable) {
+                for (i = 0; i < 3; i++)
+                        b43_phy_write(dev, regs[i], htphy->rf_ctl_int_save[i]);
+        } else {
+                for (i = 0; i < 3; i++)
+                        htphy->rf_ctl_int_save[i] = b43_phy_read(dev, regs[i]);
+                /* TODO: Does 5GHz band use different value (not 0x0400)? */
+                for (i = 0; i < 3; i++)
+                        b43_phy_write(dev, regs[i], 0x0400);
+        }
+}
+
+/**************************************************
  * Various PHY ops
  **************************************************/
 
+static u16 b43_phy_ht_classifier(struct b43_wldev *dev, u16 mask, u16 val)
+{
+        u16 tmp;
+        u16 allowed = B43_PHY_HT_CLASS_CTL_CCK_EN |
+                      B43_PHY_HT_CLASS_CTL_OFDM_EN |
+                      B43_PHY_HT_CLASS_CTL_WAITED_EN;
+
+        tmp = b43_phy_read(dev, B43_PHY_HT_CLASS_CTL);
+        tmp &= allowed;
+        tmp &= ~mask;
+        tmp |= (val & mask);
+        b43_phy_maskset(dev, B43_PHY_HT_CLASS_CTL, ~allowed, tmp);
+
+        return tmp;
+}
+
+static void b43_phy_ht_reset_cca(struct b43_wldev *dev)
+{
+        u16 bbcfg;
+
+        b43_phy_force_clock(dev, true);
+        bbcfg = b43_phy_read(dev, B43_PHY_HT_BBCFG);
+        b43_phy_write(dev, B43_PHY_HT_BBCFG, bbcfg | B43_PHY_HT_BBCFG_RSTCCA);
+        udelay(1);
+        b43_phy_write(dev, B43_PHY_HT_BBCFG, bbcfg & ~B43_PHY_HT_BBCFG_RSTCCA);
+        b43_phy_force_clock(dev, false);
+
+        b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RST2RX);
+}
+
 static void b43_phy_ht_zero_extg(struct b43_wldev *dev)
 {
         u8 i, j;
@@ -176,10 +251,10 @@ static void b43_phy_ht_afe_unk1(struct b43_wldev *dev)
 {
         u8 i;
 
-        const u16 ctl_regs[3][2] = {
-                { B43_PHY_HT_AFE_CTL1, B43_PHY_HT_AFE_CTL2 },
-                { B43_PHY_HT_AFE_CTL3, B43_PHY_HT_AFE_CTL4 },
-                { B43_PHY_HT_AFE_CTL5, B43_PHY_HT_AFE_CTL6},
+        static const u16 ctl_regs[3][2] = {
+                { B43_PHY_HT_AFE_C1_OVER, B43_PHY_HT_AFE_C1 },
+                { B43_PHY_HT_AFE_C2_OVER, B43_PHY_HT_AFE_C2 },
+                { B43_PHY_HT_AFE_C3_OVER, B43_PHY_HT_AFE_C3},
         };
 
         for (i = 0; i < 3; i++) {
@@ -193,27 +268,6 @@ static void b43_phy_ht_afe_unk1(struct b43_wldev *dev)
         }
 }
 
-static void b43_phy_ht_force_rf_sequence(struct b43_wldev *dev, u16 rf_seq)
-{
-        u8 i;
-
-        u16 save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
-        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE, 0x3);
-
-        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_TRIG, rf_seq);
-        for (i = 0; i < 200; i++) {
-                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & rf_seq)) {
-                        i = 0;
-                        break;
-                }
-                msleep(1);
-        }
-        if (i)
-                b43err(dev->wl, "Forcing RF sequence timeout\n");
-
-        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
-}
-
 static void b43_phy_ht_read_clip_detection(struct b43_wldev *dev, u16 *clip_st)
 {
         clip_st[0] = b43_phy_read(dev, B43_PHY_HT_C1_CLIP1THRES);
@@ -240,15 +294,426 @@ static void b43_phy_ht_bphy_init(struct b43_wldev *dev)
 }
 
 /**************************************************
+ * Samples
+ **************************************************/
+
+static void b43_phy_ht_stop_playback(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 tmp;
+        int i;
+
+        tmp = b43_phy_read(dev, B43_PHY_HT_SAMP_STAT);
+        if (tmp & 0x1)
+                b43_phy_set(dev, B43_PHY_HT_SAMP_CMD, B43_PHY_HT_SAMP_CMD_STOP);
+        else if (tmp & 0x2)
+                b43_phy_mask(dev, B43_PHY_HT_IQLOCAL_CMDGCTL, 0x7FFF);
+
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0x0004);
+
+        for (i = 0; i < 3; i++) {
+                if (phy_ht->bb_mult_save[i] >= 0) {
+                        b43_httab_write(dev, B43_HTTAB16(13, 0x63 + i * 4),
+                                        phy_ht->bb_mult_save[i]);
+                        b43_httab_write(dev, B43_HTTAB16(13, 0x67 + i * 4),
+                                        phy_ht->bb_mult_save[i]);
+                }
+        }
+}
+
+static u16 b43_phy_ht_load_samples(struct b43_wldev *dev)
+{
+        int i;
+        u16 len = 20 << 3;
+
+        b43_phy_write(dev, B43_PHY_HT_TABLE_ADDR, 0x4400);
+
+        for (i = 0; i < len; i++) {
+                b43_phy_write(dev, B43_PHY_HT_TABLE_DATAHI, 0);
+                b43_phy_write(dev, B43_PHY_HT_TABLE_DATALO, 0);
+        }
+
+        return len;
+}
+
+static void b43_phy_ht_run_samples(struct b43_wldev *dev, u16 samps, u16 loops,
+                                   u16 wait)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 save_seq_mode;
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                if (phy_ht->bb_mult_save[i] < 0)
+                        phy_ht->bb_mult_save[i] = b43_httab_read(dev, B43_HTTAB16(13, 0x63 + i * 4));
+        }
+
+        b43_phy_write(dev, B43_PHY_HT_SAMP_DEP_CNT, samps - 1);
+        if (loops != 0xFFFF)
+                loops--;
+        b43_phy_write(dev, B43_PHY_HT_SAMP_LOOP_CNT, loops);
+        b43_phy_write(dev, B43_PHY_HT_SAMP_WAIT_CNT, wait);
+
+        save_seq_mode = b43_phy_read(dev, B43_PHY_HT_RF_SEQ_MODE);
+        b43_phy_set(dev, B43_PHY_HT_RF_SEQ_MODE,
+                    B43_PHY_HT_RF_SEQ_MODE_CA_OVER);
+
+        /* TODO: find out mask bits! Do we need more function arguments? */
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0);
+        b43_phy_mask(dev, B43_PHY_HT_SAMP_CMD, ~0);
+        b43_phy_mask(dev, B43_PHY_HT_IQLOCAL_CMDGCTL, ~0);
+        b43_phy_set(dev, B43_PHY_HT_SAMP_CMD, 0x1);
+
+        for (i = 0; i < 100; i++) {
+                if (!(b43_phy_read(dev, B43_PHY_HT_RF_SEQ_STATUS) & 1)) {
+                        i = 0;
+                        break;
+                }
+                udelay(10);
+        }
+        if (i)
+                b43err(dev->wl, "run samples timeout\n");
+
+        b43_phy_write(dev, B43_PHY_HT_RF_SEQ_MODE, save_seq_mode);
+}
+
+static void b43_phy_ht_tx_tone(struct b43_wldev *dev)
+{
+        u16 samp;
+
+        samp = b43_phy_ht_load_samples(dev);
+        b43_phy_ht_run_samples(dev, samp, 0xFFFF, 0);
+}
+
+/**************************************************
+ * RSSI
+ **************************************************/
+
+static void b43_phy_ht_rssi_select(struct b43_wldev *dev, u8 core_sel,
+                                   u8 rssi_type)
+{
+        static const u16 ctl_regs[3][2] = {
+                { B43_PHY_HT_AFE_C1, B43_PHY_HT_AFE_C1_OVER, },
+                { B43_PHY_HT_AFE_C2, B43_PHY_HT_AFE_C2_OVER, },
+                { B43_PHY_HT_AFE_C3, B43_PHY_HT_AFE_C3_OVER, },
+        };
+        static const u16 radio_r[] = { R2059_SYN, R2059_TXRX0, R2059_RXRX1, };
+        int core;
+
+        if (core_sel == 0) {
+                b43err(dev->wl, "RSSI selection for core off not implemented yet\n");
+        } else {
+                for (core = 0; core < 3; core++) {
+                        /* Check if caller requested a one specific core */
+                        if ((core_sel == 1 && core != 0) ||
+                            (core_sel == 2 && core != 1) ||
+                            (core_sel == 3 && core != 2))
+                                continue;
+
+                        switch (rssi_type) {
+                        case 4:
+                                b43_phy_set(dev, ctl_regs[core][0], 0x3 << 8);
+                                b43_phy_set(dev, ctl_regs[core][0], 0x3 << 10);
+                                b43_phy_set(dev, ctl_regs[core][1], 0x1 << 9);
+                                b43_phy_set(dev, ctl_regs[core][1], 0x1 << 10);
+
+                                b43_radio_set(dev, R2059_RXRX1 | 0xbf, 0x1);
+                                b43_radio_write(dev, radio_r[core] | 0x159,
+                                                0x11);
+                                break;
+                        default:
+                                b43err(dev->wl, "RSSI selection for type %d not implemented yet\n",
+                                       rssi_type);
+                        }
+                }
+        }
+}
+
+static void b43_phy_ht_poll_rssi(struct b43_wldev *dev, u8 type, s32 *buf,
+                                 u8 nsamp)
+{
+        u16 phy_regs_values[12];
+        static const u16 phy_regs_to_save[] = {
+                B43_PHY_HT_AFE_C1, B43_PHY_HT_AFE_C1_OVER,
+                0x848, 0x841,
+                B43_PHY_HT_AFE_C2, B43_PHY_HT_AFE_C2_OVER,
+                0x868, 0x861,
+                B43_PHY_HT_AFE_C3, B43_PHY_HT_AFE_C3_OVER,
+                0x888, 0x881,
+        };
+        u16 tmp[3];
+        int i;
+
+        for (i = 0; i < 12; i++)
+                phy_regs_values[i] = b43_phy_read(dev, phy_regs_to_save[i]);
+
+        b43_phy_ht_rssi_select(dev, 5, type);
+
+        for (i = 0; i < 6; i++)
+                buf[i] = 0;
+
+        for (i = 0; i < nsamp; i++) {
+                tmp[0] = b43_phy_read(dev, B43_PHY_HT_RSSI_C1);
+                tmp[1] = b43_phy_read(dev, B43_PHY_HT_RSSI_C2);
+                tmp[2] = b43_phy_read(dev, B43_PHY_HT_RSSI_C3);
+
+                buf[0] += ((s8)((tmp[0] & 0x3F) << 2)) >> 2;
+                buf[1] += ((s8)(((tmp[0] >> 8) & 0x3F) << 2)) >> 2;
+                buf[2] += ((s8)((tmp[1] & 0x3F) << 2)) >> 2;
+                buf[3] += ((s8)(((tmp[1] >> 8) & 0x3F) << 2)) >> 2;
+                buf[4] += ((s8)((tmp[2] & 0x3F) << 2)) >> 2;
+                buf[5] += ((s8)(((tmp[2] >> 8) & 0x3F) << 2)) >> 2;
+        }
+
+        for (i = 0; i < 12; i++)
+                b43_phy_write(dev, phy_regs_to_save[i], phy_regs_values[i]);
+}
+
+/**************************************************
+ * Tx/Rx
+ **************************************************/
+
+static void b43_phy_ht_tx_power_fix(struct b43_wldev *dev)
+{
+        int i;
+
+        for (i = 0; i < 3; i++) {
+                u16 mask;
+                u32 tmp = b43_httab_read(dev, B43_HTTAB32(26, 0xE8));
+
+                if (0) /* FIXME */
+                        mask = 0x2 << (i * 4);
+                else
+                        mask = 0;
+                b43_phy_mask(dev, B43_PHY_EXTG(0x108), mask);
+
+                b43_httab_write(dev, B43_HTTAB16(7, 0x110 + i), tmp >> 16);
+                b43_httab_write(dev, B43_HTTAB8(13, 0x63 + (i * 4)),
+                                tmp & 0xFF);
+                b43_httab_write(dev, B43_HTTAB8(13, 0x73 + (i * 4)),
+                                tmp & 0xFF);
+        }
+}
+
+static void b43_phy_ht_tx_power_ctl(struct b43_wldev *dev, bool enable)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        u16 en_bits = B43_PHY_HT_TXPCTL_CMD_C1_COEFF |
+                      B43_PHY_HT_TXPCTL_CMD_C1_HWPCTLEN |
+                      B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN;
+        static const u16 cmd_regs[3] = { B43_PHY_HT_TXPCTL_CMD_C1,
+                                         B43_PHY_HT_TXPCTL_CMD_C2,
+                                         B43_PHY_HT_TXPCTL_CMD_C3 };
+        int i;
+
+        if (!enable) {
+                if (b43_phy_read(dev, B43_PHY_HT_TXPCTL_CMD_C1) & en_bits) {
+                        /* We disable enabled TX pwr ctl, save it's state */
+                        /*
+                         * TODO: find the registers. On N-PHY they were 0x1ed
+                         * and 0x1ee, we need 3 such a registers for HT-PHY
+                         */
+                }
+                b43_phy_mask(dev, B43_PHY_HT_TXPCTL_CMD_C1, ~en_bits);
+        } else {
+                b43_phy_set(dev, B43_PHY_HT_TXPCTL_CMD_C1, en_bits);
+
+                if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                        for (i = 0; i < 3; i++)
+                                b43_phy_write(dev, cmd_regs[i], 0x32);
+                }
+
+                for (i = 0; i < 3; i++)
+                        if (phy_ht->tx_pwr_idx[i] <=
+                            B43_PHY_HT_TXPCTL_CMD_C1_INIT)
+                                b43_phy_write(dev, cmd_regs[i],
+                                              phy_ht->tx_pwr_idx[i]);
+        }
+
+        phy_ht->tx_pwr_ctl = enable;
+}
+
+static void b43_phy_ht_tx_power_ctl_idle_tssi(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        s32 rssi_buf[6];
+
+        /* TODO */
+
+        b43_phy_ht_tx_tone(dev);
+        udelay(20);
+        b43_phy_ht_poll_rssi(dev, 4, rssi_buf, 1);
+        b43_phy_ht_stop_playback(dev);
+        b43_phy_ht_reset_cca(dev);
+
+        phy_ht->idle_tssi[0] = rssi_buf[0] & 0xff;
+        phy_ht->idle_tssi[1] = rssi_buf[2] & 0xff;
+        phy_ht->idle_tssi[2] = rssi_buf[4] & 0xff;
+
+        /* TODO */
+}
+
+static void b43_phy_ht_tx_power_ctl_setup(struct b43_wldev *dev)
+{
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
+        struct ssb_sprom *sprom = dev->dev->bus_sprom;
+
+        u8 *idle = phy_ht->idle_tssi;
+        u8 target[3];
+        s16 a1[3], b0[3], b1[3];
+
+        u16 freq = dev->phy.channel_freq;
+        int i, c;
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_2g;
+                        a1[c] = sprom->core_pwr_info[c].pa_2g[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_2g[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_2g[2];
+                }
+        } else if (freq >= 4900 && freq < 5100) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5gl;
+                        a1[c] = sprom->core_pwr_info[c].pa_5gl[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5gl[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5gl[2];
+                }
+        } else if (freq >= 5100 && freq < 5500) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5g;
+                        a1[c] = sprom->core_pwr_info[c].pa_5g[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5g[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5g[2];
+                }
+        } else if (freq >= 5500) {
+                for (c = 0; c < 3; c++) {
+                        target[c] = sprom->core_pwr_info[c].maxpwr_5gh;
+                        a1[c] = sprom->core_pwr_info[c].pa_5gh[0];
+                        b0[c] = sprom->core_pwr_info[c].pa_5gh[1];
+                        b1[c] = sprom->core_pwr_info[c].pa_5gh[2];
+                }
+        } else {
+                target[0] = target[1] = target[2] = 52;
+                a1[0] = a1[1] = a1[2] = -424;
+                b0[0] = b0[1] = b0[2] = 5612;
+                b1[0] = b1[1] = b1[2] = -1393;
+        }
+
+        b43_phy_set(dev, B43_PHY_HT_TSSIMODE, B43_PHY_HT_TSSIMODE_EN);
+        b43_phy_mask(dev, B43_PHY_HT_TXPCTL_CMD_C1,
+                     ~B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN & 0xFFFF);
+
+        /* TODO: Does it depend on sprom->fem.ghz2.tssipos? */
+        b43_phy_set(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI, 0x4000);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1,
+                        ~B43_PHY_HT_TXPCTL_CMD_C1_INIT, 0x19);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C2,
+                        ~B43_PHY_HT_TXPCTL_CMD_C2_INIT, 0x19);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C3,
+                        ~B43_PHY_HT_TXPCTL_CMD_C3_INIT, 0x19);
+
+        b43_phy_set(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                    B43_PHY_HT_TXPCTL_IDLE_TSSI_BINF);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI_C1,
+                        idle[0] << B43_PHY_HT_TXPCTL_IDLE_TSSI_C1_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI_C2,
+                        idle[1] << B43_PHY_HT_TXPCTL_IDLE_TSSI_C2_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_IDLE_TSSI2,
+                        ~B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3,
+                        idle[2] << B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3_SHIFT);
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_N, ~B43_PHY_HT_TXPCTL_N_TSSID,
+                        0xf0);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_N, ~B43_PHY_HT_TXPCTL_N_NPTIL2,
+                        0x3 << B43_PHY_HT_TXPCTL_N_NPTIL2_SHIFT);
+#if 0
+        /* TODO: what to mask/set? */
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1, 0x800, 0)
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_CMD_C1, 0x400, 0)
+#endif
+
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR_C1,
+                        target[0] << B43_PHY_HT_TXPCTL_TARG_PWR_C1_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR_C2 & 0xFFFF,
+                        target[1] << B43_PHY_HT_TXPCTL_TARG_PWR_C2_SHIFT);
+        b43_phy_maskset(dev, B43_PHY_HT_TXPCTL_TARG_PWR2,
+                        ~B43_PHY_HT_TXPCTL_TARG_PWR2_C3,
+                        target[2] << B43_PHY_HT_TXPCTL_TARG_PWR2_C3_SHIFT);
+
+        for (c = 0; c < 3; c++) {
+                s32 num, den, pwr;
+                u32 regval[64];
+
+                for (i = 0; i < 64; i++) {
+                        num = 8 * (16 * b0[c] + b1[c] * i);
+                        den = 32768 + a1[c] * i;
+                        pwr = max((4 * num + den / 2) / den, -8);
+                        regval[i] = pwr;
+                }
+                b43_httab_write_bulk(dev, B43_HTTAB16(26 + c, 0), 64, regval);
+        }
+}
+
+/**************************************************
  * Channel switching ops.
  **************************************************/
 
+static void b43_phy_ht_spur_avoid(struct b43_wldev *dev,
+                                  struct ieee80211_channel *new_channel)
+{
+        struct bcma_device *core = dev->dev->bdev;
+        int spuravoid = 0;
+        u16 tmp;
+
+        /* Check for 13 and 14 is just a guess, we don't have enough logs. */
+        if (new_channel->hw_value == 13 || new_channel->hw_value == 14)
+                spuravoid = 1;
+        bcma_core_pll_ctl(core, B43_BCMA_CLKCTLST_PHY_PLL_REQ, 0, false);
+        bcma_pmu_spuravoid_pllupdate(&core->bus->drv_cc, spuravoid);
+        bcma_core_pll_ctl(core,
+                          B43_BCMA_CLKCTLST_80211_PLL_REQ |
+                          B43_BCMA_CLKCTLST_PHY_PLL_REQ,
+                          B43_BCMA_CLKCTLST_80211_PLL_ST |
+                          B43_BCMA_CLKCTLST_PHY_PLL_ST, false);
+
+        /* Values has been taken from wlc_bmac_switch_macfreq comments */
+        switch (spuravoid) {
+        case 2: /* 126MHz */
+                tmp = 0x2082;
+                break;
+        case 1: /* 123MHz */
+                tmp = 0x5341;
+                break;
+        default: /* 120MHz */
+                tmp = 0x8889;
+        }
+
+        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_LOW, tmp);
+        b43_write16(dev, B43_MMIO_TSF_CLK_FRAC_HIGH, 0x8);
+
+        /* TODO: reset PLL */
+
+        if (spuravoid)
+                b43_phy_set(dev, B43_PHY_HT_BBCFG, B43_PHY_HT_BBCFG_RSTRX);
+        else
+                b43_phy_mask(dev, B43_PHY_HT_BBCFG,
+                                ~B43_PHY_HT_BBCFG_RSTRX & 0xFFFF);
+
+        b43_phy_ht_reset_cca(dev);
+}
+
 static void b43_phy_ht_channel_setup(struct b43_wldev *dev,
                                 const struct b43_phy_ht_channeltab_e_phy *e,
                                 struct ieee80211_channel *new_channel)
 {
         bool old_band_5ghz;
-        u8 i;
 
         old_band_5ghz = b43_phy_read(dev, B43_PHY_HT_BANDCTL) & 0; /* FIXME */
         if (new_channel->band == IEEE80211_BAND_5GHZ && !old_band_5ghz) {
@@ -264,25 +729,20 @@ static void b43_phy_ht_channel_setup(struct b43_wldev *dev,
         b43_phy_write(dev, B43_PHY_HT_BW5, e->bw5);
         b43_phy_write(dev, B43_PHY_HT_BW6, e->bw6);
 
-        /* TODO: some ops on PHY regs 0x0B0 and 0xC0A */
+        if (new_channel->hw_value == 14) {
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_OFDM_EN, 0);
+                b43_phy_set(dev, B43_PHY_HT_TEST, 0x0800);
+        } else {
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_OFDM_EN,
+                                      B43_PHY_HT_CLASS_CTL_OFDM_EN);
+                if (new_channel->band == IEEE80211_BAND_2GHZ)
+                        b43_phy_mask(dev, B43_PHY_HT_TEST, ~0x840);
+        }
 
-        /* TODO: separated function? */
-        for (i = 0; i < 3; i++) {
-                u16 mask;
-                u32 tmp = b43_httab_read(dev, B43_HTTAB32(26, 0xE8));
+        if (1) /* TODO: On N it's for early devices only, what about HT? */
+                b43_phy_ht_tx_power_fix(dev);
 
-                if (0) /* FIXME */
-                        mask = 0x2 << (i * 4);
-                else
-                        mask = 0;
-                b43_phy_mask(dev, B43_PHY_EXTG(0x108), mask);
-
-                b43_httab_write(dev, B43_HTTAB16(7, 0x110 + i), tmp >> 16);
-                b43_httab_write(dev, B43_HTTAB8(13, 0x63 + (i * 4)),
-                                tmp & 0xFF);
-                b43_httab_write(dev, B43_HTTAB8(13, 0x73 + (i * 4)),
-                                tmp & 0xFF);
-        }
+        b43_phy_ht_spur_avoid(dev, new_channel);
 
         b43_phy_write(dev, 0x017e, 0x3830);
 }
@@ -337,14 +797,29 @@ static void b43_phy_ht_op_prepare_structs(struct b43_wldev *dev)
 {
         struct b43_phy *phy = &dev->phy;
         struct b43_phy_ht *phy_ht = phy->ht;
+        int i;
 
         memset(phy_ht, 0, sizeof(*phy_ht));
+
+        phy_ht->tx_pwr_ctl = true;
+        for (i = 0; i < 3; i++)
+                phy_ht->tx_pwr_idx[i] = B43_PHY_HT_TXPCTL_CMD_C1_INIT + 1;
+
+        for (i = 0; i < 3; i++)
+                phy_ht->bb_mult_save[i] = -1;
 }
 
 static int b43_phy_ht_op_init(struct b43_wldev *dev)
 {
+        struct b43_phy_ht *phy_ht = dev->phy.ht;
         u16 tmp;
         u16 clip_state[3];
+        bool saved_tx_pwr_ctl;
+
+        if (dev->dev->bus_type != B43_BUS_BCMA) {
+                b43err(dev->wl, "HT-PHY is supported only on BCMA bus!\n");
+                return -EOPNOTSUPP;
+        }
 
         b43_phy_ht_tables_init(dev);
 
@@ -357,9 +832,9 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
 
         b43_phy_mask(dev, B43_PHY_EXTG(0), ~0x3);
 
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0);
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0);
-        b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0);
+        b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0);
 
         b43_phy_write(dev, B43_PHY_EXTG(0x103), 0x20);
         b43_phy_write(dev, B43_PHY_EXTG(0x101), 0x20);
@@ -371,8 +846,11 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
         if (0) /* TODO: condition */
                 ; /* TODO: PHY op on reg 0x217 */
 
-        b43_phy_read(dev, 0xb0); /* TODO: what for? */
-        b43_phy_set(dev, 0xb0, 0x1);
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_CCK_EN, 0);
+        else
+                b43_phy_ht_classifier(dev, B43_PHY_HT_CLASS_CTL_CCK_EN,
+                                      B43_PHY_HT_CLASS_CTL_CCK_EN);
 
         b43_phy_set(dev, 0xb1, 0x91);
         b43_phy_write(dev, 0x32f, 0x0003);
@@ -448,12 +926,13 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
 
         b43_mac_phy_clock_set(dev, true);
 
+        b43_phy_ht_pa_override(dev, false);
         b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RX2TX);
         b43_phy_ht_force_rf_sequence(dev, B43_PHY_HT_RF_SEQ_TRIG_RST2RX);
-
-        /* TODO: PHY op on reg 0xb0 */
+        b43_phy_ht_pa_override(dev, true);
 
         /* TODO: Should we restore it? Or store it in global PHY info? */
+        b43_phy_ht_classifier(dev, 0, 0);
         b43_phy_ht_read_clip_detection(dev, clip_state);
 
         if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ)
@@ -462,6 +941,13 @@ static int b43_phy_ht_op_init(struct b43_wldev *dev)
         b43_httab_write_bulk(dev, B43_HTTAB32(0x1a, 0xc0),
                         B43_HTTAB_1A_C0_LATE_SIZE, b43_httab_0x1a_0xc0_late);
 
+        saved_tx_pwr_ctl = phy_ht->tx_pwr_ctl;
+        b43_phy_ht_tx_power_fix(dev);
+        b43_phy_ht_tx_power_ctl(dev, false);
+        b43_phy_ht_tx_power_ctl_idle_tssi(dev);
+        b43_phy_ht_tx_power_ctl_setup(dev);
+        b43_phy_ht_tx_power_ctl(dev, saved_tx_pwr_ctl);
+
         return 0;
 }
 
@@ -506,19 +992,19 @@ static void b43_phy_ht_op_software_rfkill(struct b43_wldev *dev,
 static void b43_phy_ht_op_switch_analog(struct b43_wldev *dev, bool on)
 {
         if (on) {
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL2, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0x0000);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL4, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0x0000);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL6, 0x00cd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0x0000);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3, 0x00cd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0x0000);
         } else {
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL1, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL2, 0x00fd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL3, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL4, 0x00fd);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL5, 0x07ff);
-                b43_phy_write(dev, B43_PHY_HT_AFE_CTL6, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C1, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C2, 0x00fd);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3_OVER, 0x07ff);
+                b43_phy_write(dev, B43_PHY_HT_AFE_C3, 0x00fd);
         }
 }
 
diff --git a/drivers/net/wireless/b43/phy_ht.h b/drivers/net/wireless/b43/phy_ht.h
index 6544c4293b34..9b2408efb224 100644
--- a/drivers/net/wireless/b43/phy_ht.h
+++ b/drivers/net/wireless/b43/phy_ht.h
@@ -12,18 +12,60 @@
 #define B43_PHY_HT_TABLE_ADDR                   0x072 /* Table address */
 #define B43_PHY_HT_TABLE_DATALO                 0x073 /* Table data low */
 #define B43_PHY_HT_TABLE_DATAHI                 0x074 /* Table data high */
+#define B43_PHY_HT_CLASS_CTL                    0x0B0 /* Classifier control */
+#define  B43_PHY_HT_CLASS_CTL_CCK_EN            0x0001 /* CCK enable */
+#define  B43_PHY_HT_CLASS_CTL_OFDM_EN           0x0002 /* OFDM enable */
+#define  B43_PHY_HT_CLASS_CTL_WAITED_EN         0x0004 /* Waited enable */
+#define B43_PHY_HT_IQLOCAL_CMDGCTL              0x0C2   /* I/Q LO cal command G control */
+#define B43_PHY_HT_SAMP_CMD                     0x0C3   /* Sample command */
+#define  B43_PHY_HT_SAMP_CMD_STOP               0x0002  /* Stop */
+#define B43_PHY_HT_SAMP_LOOP_CNT                0x0C4   /* Sample loop count */
+#define B43_PHY_HT_SAMP_WAIT_CNT                0x0C5   /* Sample wait count */
+#define B43_PHY_HT_SAMP_DEP_CNT                 0x0C6   /* Sample depth count */
+#define B43_PHY_HT_SAMP_STAT                    0x0C7   /* Sample status */
+#define B43_PHY_HT_TSSIMODE                     0x122   /* TSSI mode */
+#define  B43_PHY_HT_TSSIMODE_EN                 0x0001  /* TSSI enable */
+#define  B43_PHY_HT_TSSIMODE_PDEN               0x0002  /* Power det enable */
 #define B43_PHY_HT_BW1                          0x1CE
 #define B43_PHY_HT_BW2                          0x1CF
 #define B43_PHY_HT_BW3                          0x1D0
 #define B43_PHY_HT_BW4                          0x1D1
 #define B43_PHY_HT_BW5                          0x1D2
 #define B43_PHY_HT_BW6                          0x1D3
+#define B43_PHY_HT_TXPCTL_CMD_C1                0x1E7   /* TX power control command */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_INIT          0x007F  /* Init */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_COEFF         0x2000  /* Power control coefficients */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_HWPCTLEN      0x4000  /* Hardware TX power control enable */
+#define  B43_PHY_HT_TXPCTL_CMD_C1_PCTLEN        0x8000  /* TX power control enable */
+#define B43_PHY_HT_TXPCTL_N                     0x1E8   /* TX power control N num */
+#define  B43_PHY_HT_TXPCTL_N_TSSID              0x00FF  /* N TSSI delay */
+#define  B43_PHY_HT_TXPCTL_N_TSSID_SHIFT        0
+#define  B43_PHY_HT_TXPCTL_N_NPTIL2             0x0700  /* N PT integer log2 */
+#define  B43_PHY_HT_TXPCTL_N_NPTIL2_SHIFT       8
+#define B43_PHY_HT_TXPCTL_IDLE_TSSI             0x1E9   /* TX power control idle TSSI */
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C1         0x003F
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C1_SHIFT   0
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C2         0x3F00
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_C2_SHIFT   8
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI_BINF       0x8000  /* Raw TSSI offset bin format */
+#define B43_PHY_HT_TXPCTL_TARG_PWR              0x1EA   /* TX power control target power */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C1          0x00FF  /* Power 0 */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C1_SHIFT    0
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C2          0xFF00  /* Power 1 */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR_C2_SHIFT    8
+#define B43_PHY_HT_TXPCTL_CMD_C2                0x222
+#define  B43_PHY_HT_TXPCTL_CMD_C2_INIT          0x007F
+#define B43_PHY_HT_RSSI_C1                      0x219
+#define B43_PHY_HT_RSSI_C2                      0x21A
+#define B43_PHY_HT_RSSI_C3                      0x21B
 
 #define B43_PHY_HT_C1_CLIP1THRES                B43_PHY_OFDM(0x00E)
 #define B43_PHY_HT_C2_CLIP1THRES                B43_PHY_OFDM(0x04E)
 #define B43_PHY_HT_C3_CLIP1THRES                B43_PHY_OFDM(0x08E)
 
 #define B43_PHY_HT_RF_SEQ_MODE                  B43_PHY_EXTG(0x000)
+#define  B43_PHY_HT_RF_SEQ_MODE_CA_OVER         0x0001  /* Core active override */
+#define  B43_PHY_HT_RF_SEQ_MODE_TR_OVER         0x0002  /* Trigger override */
 #define B43_PHY_HT_RF_SEQ_TRIG                  B43_PHY_EXTG(0x003)
 #define  B43_PHY_HT_RF_SEQ_TRIG_RX2TX           0x0001 /* RX2TX */
 #define  B43_PHY_HT_RF_SEQ_TRIG_TX2RX           0x0002 /* TX2RX */
@@ -36,12 +78,27 @@
 
 #define B43_PHY_HT_RF_CTL1                      B43_PHY_EXTG(0x010)
 
-#define B43_PHY_HT_AFE_CTL1                     B43_PHY_EXTG(0x110)
-#define B43_PHY_HT_AFE_CTL2                     B43_PHY_EXTG(0x111)
-#define B43_PHY_HT_AFE_CTL3                     B43_PHY_EXTG(0x114)
-#define B43_PHY_HT_AFE_CTL4                     B43_PHY_EXTG(0x115)
-#define B43_PHY_HT_AFE_CTL5                     B43_PHY_EXTG(0x118)
-#define B43_PHY_HT_AFE_CTL6                     B43_PHY_EXTG(0x119)
+#define B43_PHY_HT_RF_CTL_INT_C1                B43_PHY_EXTG(0x04c)
+#define B43_PHY_HT_RF_CTL_INT_C2                B43_PHY_EXTG(0x06c)
+#define B43_PHY_HT_RF_CTL_INT_C3                B43_PHY_EXTG(0x08c)
+
+#define B43_PHY_HT_AFE_C1_OVER                  B43_PHY_EXTG(0x110)
+#define B43_PHY_HT_AFE_C1                       B43_PHY_EXTG(0x111)
+#define B43_PHY_HT_AFE_C2_OVER                  B43_PHY_EXTG(0x114)
+#define B43_PHY_HT_AFE_C2                       B43_PHY_EXTG(0x115)
+#define B43_PHY_HT_AFE_C3_OVER                  B43_PHY_EXTG(0x118)
+#define B43_PHY_HT_AFE_C3                       B43_PHY_EXTG(0x119)
+
+#define B43_PHY_HT_TXPCTL_CMD_C3                B43_PHY_EXTG(0x164)
+#define  B43_PHY_HT_TXPCTL_CMD_C3_INIT          0x007F
+#define B43_PHY_HT_TXPCTL_IDLE_TSSI2            B43_PHY_EXTG(0x165)     /* TX power control idle TSSI */
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3        0x003F
+#define  B43_PHY_HT_TXPCTL_IDLE_TSSI2_C3_SHIFT  0
+#define B43_PHY_HT_TXPCTL_TARG_PWR2             B43_PHY_EXTG(0x166)     /* TX power control target power */
+#define  B43_PHY_HT_TXPCTL_TARG_PWR2_C3         0x00FF
+#define  B43_PHY_HT_TXPCTL_TARG_PWR2_C3_SHIFT   0
+
+#define B43_PHY_HT_TEST                         B43_PHY_N_BMODE(0x00A)
 
 
 /* Values for PHY registers used on channel switching */
@@ -56,6 +113,14 @@ struct b43_phy_ht_channeltab_e_phy {
 
 
 struct b43_phy_ht {
+        u16 rf_ctl_int_save[3];
+
+        bool tx_pwr_ctl;
+        u8 tx_pwr_idx[3];
+
+        s32 bb_mult_save[3];
+
+        u8 idle_tssi[3];
 };
 
 
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index 1d92d874ebb6..747e9317dabd 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -12,8 +12,9 @@ config BRCMSMAC
         select CORDIC
         ---help---
           This module adds support for PCIe wireless adapters based on Broadcom
-          IEEE802.11n SoftMAC chipsets.  If you choose to build a module, it'll
-          be called brcmsmac.ko.
+          IEEE802.11n SoftMAC chipsets. It also has WLAN led support, which will
+          be available if you select BCMA_DRIVER_GPIO. If you choose to build a
+          module, the driver will be called brcmsmac.ko.
 
 config BRCMFMAC
         tristate "Broadcom IEEE802.11n embedded FullMAC WLAN driver"
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 756e19fc2795..598c8e2f8d2b 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -26,6 +26,7 @@ brcmfmac-objs += \
                 wl_cfg80211.o \
                 fwil.o \
                 fweh.o \
+                fwsignal.o \
                 p2p.o \
                 dhd_cdc.o \
                 dhd_common.o \
@@ -39,3 +40,5 @@ brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
 brcmfmac-$(CONFIG_BRCMDBG) += \
                 dhd_dbg.o
+brcmfmac-$(CONFIG_BRCM_TRACING) += \
+                tracepoint.o
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index ef6f23be6d32..c7fa20846b32 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -501,6 +501,7 @@ struct brcmf_dcmd {
 /* Forward decls for struct brcmf_pub (see below) */
 struct brcmf_proto;     /* device communication protocol info */
 struct brcmf_cfg80211_dev; /* cfg80211 device info */
+struct brcmf_fws_info; /* firmware signalling info */
 
 /* Common structure for module and instance linkage */
 struct brcmf_pub {
@@ -527,6 +528,10 @@ struct brcmf_pub {
         unsigned char proto_buf[BRCMF_DCMD_MAXLEN];
 
         struct brcmf_fweh_info fweh;
+
+        bool fw_signals;
+        struct brcmf_fws_info *fws;
+        spinlock_t fws_spinlock;
 #ifdef DEBUG
         struct dentry *dbgfs_dir;
 #endif
@@ -582,7 +587,7 @@ extern int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
                                     void *buf, uint len);
 
 /* Remove any protocol-specific data header. */
-extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+extern int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
                                struct sk_buff *rxp);
 
 extern int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index ad25c3408b59..883ef9063e8a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -134,7 +134,7 @@ extern void brcmf_dev_reset(struct device *dev);
 /* Indication from bus module to change flow-control state */
 extern void brcmf_txflowblock(struct device *dev, bool state);
 
-/* Notify tx completion */
+/* Notify the bus has transferred the tx packet to firmware */
 extern void brcmf_txcomplete(struct device *dev, struct sk_buff *txp,
                              bool success);
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
index a2354d951dd7..e224bcb90024 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
@@ -28,6 +28,7 @@
 #include "dhd.h"
 #include "dhd_proto.h"
 #include "dhd_bus.h"
+#include "fwsignal.h"
 #include "dhd_dbg.h"
 
 struct brcmf_proto_cdc_dcmd {
@@ -71,13 +72,26 @@ struct brcmf_proto_cdc_dcmd {
         ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | \
         ((idx) << BDC_FLAG2_IF_SHIFT)))
 
+/**
+ * struct brcmf_proto_bdc_header - BDC header format
+ *
+ * @flags: flags contain protocol and checksum info.
+ * @priority: 802.1d priority and USB flow control info (bit 4:7).
+ * @flags2: additional flags containing dongle interface index.
+ * @data_offset: start of packet data. header is following by firmware signals.
+ */
 struct brcmf_proto_bdc_header {
         u8 flags;
-        u8 priority;    /* 802.1d Priority, 4:7 flow control info for usb */
+        u8 priority;
         u8 flags2;
         u8 data_offset;
 };
 
+/*
+ * maximum length of firmware signal data between
+ * the BDC header and packet data in the tx path.
+ */
+#define BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES        12
 
 #define RETRIES 2 /* # of retries to retrieve matching dcmd response */
 #define BUS_HEADER_LEN  (16+64)         /* Must be atleast SDPCM_RESERVE
@@ -258,7 +272,7 @@ static void pkt_set_sum_good(struct sk_buff *skb, bool x)
         skb->ip_summed = (x ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE);
 }
 
-void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
+void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset,
                          struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
@@ -266,7 +280,6 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
         brcmf_dbg(CDC, "Enter\n");
 
         /* Push BDC header used to convey priority for buses that don't */
-
         skb_push(pktbuf, BDC_HEADER_LEN);
 
         h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
@@ -277,11 +290,11 @@ void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx,
 
         h->priority = (pktbuf->priority & BDC_PRIORITY_MASK);
         h->flags2 = 0;
-        h->data_offset = 0;
+        h->data_offset = offset;
         BDC_SET_IF_IDX(h, ifidx);
 }
 
-int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
+int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
                         struct sk_buff *pktbuf)
 {
         struct brcmf_proto_bdc_header *h;
@@ -328,7 +341,10 @@ int brcmf_proto_hdrpull(struct brcmf_pub *drvr, u8 *ifidx,
         pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
 
         skb_pull(pktbuf, BDC_HEADER_LEN);
-        skb_pull(pktbuf, h->data_offset << 2);
+        if (do_fws)
+                brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
+        else
+                skb_pull(pktbuf, h->data_offset << 2);
 
         if (pktbuf->len == 0)
                 return -ENODATA;
@@ -350,7 +366,7 @@ int brcmf_proto_attach(struct brcmf_pub *drvr)
         }
 
         drvr->prot = cdc;
-        drvr->hdrlen += BDC_HEADER_LEN;
+        drvr->hdrlen += BDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
         drvr->bus_if->maxctl = BRCMF_DCMD_MAXLEN +
                         sizeof(struct brcmf_proto_cdc_dcmd) + ROUND_UP_MARGIN;
         return 0;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 4544342a0428..be0787cab24f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -24,6 +24,7 @@
 #include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "fwil.h"
+#include "tracepoint.h"
 
 #define PKTFILTER_BUF_SIZE              128
 #define BRCMF_ARPOL_MODE                0xb     /* agent|snoop|peer_autoreply */
@@ -373,3 +374,35 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
 done:
         return err;
 }
+
+#ifdef CONFIG_BRCM_TRACING
+void __brcmf_err(const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        pr_err("%s: %pV", func, &vaf);
+        trace_brcmf_err(func, &vaf);
+        va_end(args);
+}
+#endif
+#if defined(CONFIG_BRCM_TRACING) || defined(CONFIG_BRCMDBG)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...)
+{
+        struct va_format vaf = {
+                .fmt = fmt,
+        };
+        va_list args;
+
+        va_start(args, fmt);
+        vaf.va = &args;
+        if (brcmf_msg_level & level)
+                pr_debug("%s %pV", func, &vaf);
+        trace_brcmf_dbg(level, func, &vaf);
+        va_end(args);
+}
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
index 57671eddf79d..ac792499b46a 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
@@ -22,6 +22,7 @@
 #include "dhd.h"
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
+#include "tracepoint.h"
 
 static struct dentry *root_folder;
 
@@ -123,3 +124,44 @@ void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
                 debugfs_create_file("counters", S_IRUGO, dentry,
                                     sdcnt, &brcmf_debugfs_sdio_counter_ops);
 }
+
+static
+ssize_t brcmf_debugfs_fws_stats_read(struct file *f, char __user *data,
+                                     size_t count, loff_t *ppos)
+{
+        struct brcmf_fws_stats *fwstats = f->private_data;
+        char buf[100];
+        int res;
+
+        /* only allow read from start */
+        if (*ppos > 0)
+                return 0;
+
+        res = scnprintf(buf, sizeof(buf),
+                        "header_pulls:     %u\n"
+                        "header_only_pkt:  %u\n"
+                        "tlv_parse_failed: %u\n"
+                        "tlv_invalid_type: %u\n",
+                        fwstats->header_pulls,
+                        fwstats->header_only_pkt,
+                        fwstats->tlv_parse_failed,
+                        fwstats->tlv_invalid_type);
+
+        return simple_read_from_buffer(data, count, ppos, buf, res);
+}
+
+static const struct file_operations brcmf_debugfs_fws_stats_ops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = brcmf_debugfs_fws_stats_read
+};
+
+void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                    struct brcmf_fws_stats *stats)
+{
+        struct dentry *dentry =  drvr->dbgfs_dir;
+
+        if (!IS_ERR_OR_NULL(dentry))
+                debugfs_create_file("fws_stats", S_IRUGO, dentry,
+                                    stats, &brcmf_debugfs_fws_stats_ops);
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index bc013cbe06f6..4bc646bde16f 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -43,6 +43,7 @@
  * debugging is not selected. When debugging the driver error
  * messages are as important as other tracing or even more so.
  */
+#ifndef CONFIG_BRCM_TRACING
 #ifdef CONFIG_BRCMDBG
 #define brcmf_err(fmt, ...)     pr_err("%s: " fmt, __func__, ##__VA_ARGS__)
 #else
@@ -52,15 +53,21 @@
                         pr_err("%s: " fmt, __func__, ##__VA_ARGS__);    \
         } while (0)
 #endif
+#else
+__printf(2, 3)
+void __brcmf_err(const char *func, const char *fmt, ...);
+#define brcmf_err(fmt, ...) \
+        __brcmf_err(__func__, fmt, ##__VA_ARGS__)
+#endif
 
-#if defined(DEBUG)
-
+#if defined(DEBUG) || defined(CONFIG_BRCM_TRACING)
+__printf(3, 4)
+void __brcmf_dbg(u32 level, const char *func, const char *fmt, ...);
 #define brcmf_dbg(level, fmt, ...)                              \
 do {                                                            \
-        if (brcmf_msg_level & BRCMF_##level##_VAL)              \
-                pr_debug("%s: " fmt, __func__, ##__VA_ARGS__);  \
+        __brcmf_dbg(BRCMF_##level##_VAL, __func__,              \
+                    fmt, ##__VA_ARGS__);                        \
 } while (0)
-
 #define BRCMF_DATA_ON()         (brcmf_msg_level & BRCMF_DATA_VAL)
 #define BRCMF_CTL_ON()          (brcmf_msg_level & BRCMF_CTL_VAL)
 #define BRCMF_HDRS_ON()         (brcmf_msg_level & BRCMF_HDRS_VAL)
@@ -69,7 +76,7 @@ do {								\
 #define BRCMF_EVENT_ON()        (brcmf_msg_level & BRCMF_EVENT_VAL)
 #define BRCMF_FIL_ON()          (brcmf_msg_level & BRCMF_FIL_VAL)
 
-#else   /* (defined DEBUG) || (defined DEBUG) */
+#else /* defined(DEBUG) || defined(CONFIG_BRCM_TRACING) */
 
 #define brcmf_dbg(level, fmt, ...) no_printk(fmt, ##__VA_ARGS__)
 
@@ -81,7 +88,7 @@ do {								\
 #define BRCMF_EVENT_ON()        0
 #define BRCMF_FIL_ON()          0
 
-#endif                          /* defined(DEBUG) */
+#endif /* defined(DEBUG) || defined(CONFIG_BRCM_TRACING) */
 
 #define brcmf_dbg_hex_dump(test, data, len, fmt, ...)                   \
 do {                                                                    \
@@ -125,6 +132,13 @@ struct brcmf_sdio_count {
         ulong rx_readahead_cnt; /* packets where header read-ahead was used */
 };
 
+struct brcmf_fws_stats {
+        u32 tlv_parse_failed;
+        u32 tlv_invalid_type;
+        u32 header_only_pkt;
+        u32 header_pulls;
+};
+
 struct brcmf_pub;
 #ifdef DEBUG
 void brcmf_debugfs_init(void);
@@ -134,6 +148,8 @@ void brcmf_debugfs_detach(struct brcmf_pub *drvr);
 struct dentry *brcmf_debugfs_get_devdir(struct brcmf_pub *drvr);
 void brcmf_debugfs_create_sdio_count(struct brcmf_pub *drvr,
                                      struct brcmf_sdio_count *sdcnt);
+void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                    struct brcmf_fws_stats *stats);
 #else
 static inline void brcmf_debugfs_init(void)
 {
@@ -148,6 +164,10 @@ static inline int brcmf_debugfs_attach(struct brcmf_pub *drvr)
 static inline void brcmf_debugfs_detach(struct brcmf_pub *drvr)
 {
 }
+static inline void brcmf_debugfs_create_fws_stats(struct brcmf_pub *drvr,
+                                                  struct brcmf_fws_stats *stats)
+{
+}
 #endif
 
 #endif                          /* _BRCMF_DBG_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index c06cea88df0d..fa5a2af04d46 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -30,17 +30,18 @@
 #include "p2p.h"
 #include "wl_cfg80211.h"
 #include "fwil.h"
+#include "fwsignal.h"
 
 MODULE_AUTHOR("Broadcom Corporation");
 MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
-MODULE_SUPPORTED_DEVICE("Broadcom 802.11 WLAN fullmac cards");
 MODULE_LICENSE("Dual BSD/GPL");
 
 #define MAX_WAIT_FOR_8021X_TX           50      /* msecs */
 
 /* Error bits */
 int brcmf_msg_level;
-module_param(brcmf_msg_level, int, 0);
+module_param_named(debug, brcmf_msg_level, int, S_IRUSR | S_IWUSR);
+MODULE_PARM_DESC(debug, "level of debug output");
 
 /* P2P0 enable */
 static int brcmf_p2p_enable;
@@ -230,7 +231,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb,
                 atomic_inc(&ifp->pend_8021x_cnt);
 
         /* If the protocol uses a data header, apply it */
-        brcmf_proto_hdrpush(drvr, ifp->ifidx, skb);
+        brcmf_proto_hdrpush(drvr, ifp->ifidx, 0, skb);
 
         /* Use bus module to send data frame */
         ret =  brcmf_bus_txdata(drvr->bus_if, skb);
@@ -283,7 +284,7 @@ void brcmf_rx_frames(struct device *dev, struct sk_buff_head *skb_list)
                 skb_unlink(skb, skb_list);
 
                 /* process and remove protocol-specific header */
-                ret = brcmf_proto_hdrpull(drvr, &ifidx, skb);
+                ret = brcmf_proto_hdrpull(drvr, drvr->fw_signals, &ifidx, skb);
                 ifp = drvr->iflist[ifidx];
 
                 if (ret || !ifp || !ifp->ndev) {
@@ -357,23 +358,29 @@ void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success)
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_pub *drvr = bus_if->drvr;
         struct brcmf_if *ifp;
+        int res;
 
-        brcmf_proto_hdrpull(drvr, &ifidx, txp);
+        res = brcmf_proto_hdrpull(drvr, false, &ifidx, txp);
 
         ifp = drvr->iflist[ifidx];
         if (!ifp)
-                return;
+                goto done;
 
-        eh = (struct ethhdr *)(txp->data);
-        type = ntohs(eh->h_proto);
+        if (res == 0) {
+                eh = (struct ethhdr *)(txp->data);
+                type = ntohs(eh->h_proto);
 
-        if (type == ETH_P_PAE) {
-                atomic_dec(&ifp->pend_8021x_cnt);
-                if (waitqueue_active(&ifp->pend_8021x_wait))
-                        wake_up(&ifp->pend_8021x_wait);
+                if (type == ETH_P_PAE) {
+                        atomic_dec(&ifp->pend_8021x_cnt);
+                        if (waitqueue_active(&ifp->pend_8021x_wait))
+                                wake_up(&ifp->pend_8021x_wait);
+                }
         }
         if (!success)
                 ifp->stats.tx_errors++;
+
+done:
+        brcmu_pkt_buf_free_skb(txp);
 }
 
 static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
@@ -873,6 +880,9 @@ int brcmf_bus_start(struct device *dev)
         if (ret < 0)
                 goto fail;
 
+        drvr->fw_signals = true;
+        (void)brcmf_fws_init(drvr);
+
         drvr->config = brcmf_cfg80211_attach(drvr, bus_if->dev);
         if (drvr->config == NULL) {
                 ret = -ENOMEM;
@@ -889,6 +899,8 @@ fail:
                 brcmf_err("failed: %d\n", ret);
                 if (drvr->config)
                         brcmf_cfg80211_detach(drvr->config);
+                if (drvr->fws)
+                        brcmf_fws_deinit(drvr);
                 free_netdev(ifp->ndev);
                 drvr->iflist[0] = NULL;
                 if (p2p_ifp) {
@@ -952,6 +964,9 @@ void brcmf_detach(struct device *dev)
         if (drvr->prot)
                 brcmf_proto_detach(drvr);
 
+        if (drvr->fws)
+                brcmf_fws_deinit(drvr);
+
         brcmf_debugfs_detach(drvr);
         bus_if->drvr = NULL;
         kfree(drvr);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
index 48fa70302192..ef9179883748 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
@@ -33,7 +33,7 @@ extern void brcmf_proto_stop(struct brcmf_pub *drvr);
 /* Add any protocol-specific data header.
  * Caller must reserve prot_hdrlen prepend space.
  */
-extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx,
+extern void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx, u8 offset,
                                 struct sk_buff *txp);
 
 /* Sets dongle media info (drv_version, mac address). */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index 4469321c0eb3..9a2edd3f0a5c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -1546,7 +1546,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         struct sk_buff_head pktlist;    /* needed for bus interface */
         u16 pad;                /* Number of pad bytes to read */
         uint rxleft = 0;        /* Remaining number of frames allowed */
-        int sdret;              /* Return code from calls */
+        int ret;                /* Return code from calls */
         uint rxcount = 0;       /* Total frames read */
         struct brcmf_sdio_read *rd = &bus->cur_read, rd_new;
         u8 head_read = 0;
@@ -1577,15 +1577,15 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 /* read header first for unknow frame length */
                 sdio_claim_host(bus->sdiodev->func[1]);
                 if (!rd->len) {
-                        sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
+                        ret = brcmf_sdcard_recv_buf(bus->sdiodev,
                                                       bus->sdiodev->sbwad,
                                                       SDIO_FUNC_2, F2SYNC,
                                                       bus->rxhdr,
                                                       BRCMF_FIRSTREAD);
                         bus->sdcnt.f2rxhdrs++;
-                        if (sdret < 0) {
+                        if (ret < 0) {
                                 brcmf_err("RXHEADER FAILED: %d\n",
-                                          sdret);
+                                          ret);
                                 bus->sdcnt.rx_hdrfail++;
                                 brcmf_sdbrcm_rxfail(bus, true, true);
                                 sdio_release_host(bus->sdiodev->func[1]);
@@ -1637,14 +1637,14 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 skb_pull(pkt, head_read);
                 pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
 
-                sdret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
+                ret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
                                               SDIO_FUNC_2, F2SYNC, pkt);
                 bus->sdcnt.f2rxdata++;
                 sdio_release_host(bus->sdiodev->func[1]);
 
-                if (sdret < 0) {
+                if (ret < 0) {
                         brcmf_err("read %d bytes from channel %d failed: %d\n",
-                                  rd->len, rd->channel, sdret);
+                                  rd->len, rd->channel, ret);
                         brcmu_pkt_buf_free_skb(pkt);
                         sdio_claim_host(bus->sdiodev->func[1]);
                         brcmf_sdbrcm_rxfail(bus, true,
@@ -1775,7 +1775,7 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
 /* Writes a HW/SW header into the packet and sends it. */
 /* Assumes: (a) header space already there, (b) caller holds lock */
 static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
-                              uint chan, bool free_pkt)
+                              uint chan)
 {
         int ret;
         u8 *frame;
@@ -1805,10 +1805,7 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
 
                         pkt_align(new, pkt->len, BRCMF_SDALIGN);
                         memcpy(new->data, pkt->data, pkt->len);
-                        if (free_pkt)
-                                brcmu_pkt_buf_free_skb(pkt);
-                        /* free the pkt if canned one is not used */
-                        free_pkt = true;
+                        brcmu_pkt_buf_free_skb(pkt);
                         pkt = new;
                         frame = (u8 *) (pkt->data);
                         /* precondition: (frame % BRCMF_SDALIGN) == 0) */
@@ -1901,10 +1898,6 @@ done:
         /* restore pkt buffer pointer before calling tx complete routine */
         skb_pull(pkt, SDPCM_HDRLEN + pad);
         brcmf_txcomplete(bus->sdiodev->dev, pkt, ret != 0);
-
-        if (free_pkt)
-                brcmu_pkt_buf_free_skb(pkt);
-
         return ret;
 }
 
@@ -1932,7 +1925,7 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
                 spin_unlock_bh(&bus->txqlock);
                 datalen = pkt->len - SDPCM_HDRLEN;
 
-                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL, true);
+                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
 
                 /* In poll mode, need to check for other events */
                 if (!bus->intr && cnt) {
@@ -2343,7 +2336,6 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
         if (!brcmf_c_prec_enq(bus->sdiodev->dev, &bus->txq, pkt, prec)) {
                 skb_pull(pkt, SDPCM_HDRLEN);
                 brcmf_txcomplete(bus->sdiodev->dev, pkt, false);
-                brcmu_pkt_buf_free_skb(pkt);
                 brcmf_err("out of bus->txq !!!\n");
                 ret = -ENOSR;
         } else {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
new file mode 100644
index 000000000000..071d55f9cd4d
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -0,0 +1,382 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#include <linux/types.h>
+#include <linux/if_ether.h>
+#include <linux/spinlock.h>
+#include <linux/skbuff.h>
+#include <linux/netdevice.h>
+#include <linux/err.h>
+#include <uapi/linux/nl80211.h>
+
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+#include "dhd.h"
+#include "dhd_dbg.h"
+#include "fwil.h"
+#include "fweh.h"
+#include "fwsignal.h"
+
+/**
+ * DOC: Firmware Signalling
+ *
+ * Firmware can send signals to host and vice versa, which are passed in the
+ * data packets using TLV based header. This signalling layer is on top of the
+ * BDC bus protocol layer.
+ */
+
+/*
+ * single definition for firmware-driver flow control tlv's.
+ *
+ * each tlv is specified by BRCMF_FWS_TLV_DEF(name, ID, length).
+ * A length value 0 indicates variable length tlv.
+ */
+#define BRCMF_FWS_TLV_DEFLIST \
+        BRCMF_FWS_TLV_DEF(MAC_OPEN, 1, 1) \
+        BRCMF_FWS_TLV_DEF(MAC_CLOSE, 2, 1) \
+        BRCMF_FWS_TLV_DEF(MAC_REQUEST_CREDIT, 3, 2) \
+        BRCMF_FWS_TLV_DEF(TXSTATUS, 4, 4) \
+        BRCMF_FWS_TLV_DEF(PKTTAG, 5, 4) \
+        BRCMF_FWS_TLV_DEF(MACDESC_ADD,  6, 8) \
+        BRCMF_FWS_TLV_DEF(MACDESC_DEL, 7, 8) \
+        BRCMF_FWS_TLV_DEF(RSSI, 8, 1) \
+        BRCMF_FWS_TLV_DEF(INTERFACE_OPEN, 9, 1) \
+        BRCMF_FWS_TLV_DEF(INTERFACE_CLOSE, 10, 1) \
+        BRCMF_FWS_TLV_DEF(FIFO_CREDITBACK, 11, 8) \
+        BRCMF_FWS_TLV_DEF(PENDING_TRAFFIC_BMP, 12, 2) \
+        BRCMF_FWS_TLV_DEF(MAC_REQUEST_PACKET, 13, 3) \
+        BRCMF_FWS_TLV_DEF(HOST_REORDER_RXPKTS, 14, 10) \
+        BRCMF_FWS_TLV_DEF(TRANS_ID, 18, 6) \
+        BRCMF_FWS_TLV_DEF(COMP_TXSTATUS, 19, 1) \
+        BRCMF_FWS_TLV_DEF(FILLER, 255, 0)
+
+/**
+ * enum brcmf_fws_tlv_type - definition of tlv identifiers.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        BRCMF_FWS_TYPE_ ## name =  id,
+enum brcmf_fws_tlv_type {
+        BRCMF_FWS_TLV_DEFLIST
+        BRCMF_FWS_TYPE_INVALID
+};
+#undef BRCMF_FWS_TLV_DEF
+
+/**
+ * enum brcmf_fws_tlv_len - length values for tlvs.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        BRCMF_FWS_TYPE_ ## name ## _LEN = len,
+enum brcmf_fws_tlv_len {
+        BRCMF_FWS_TLV_DEFLIST
+};
+#undef BRCMF_FWS_TLV_DEF
+
+#ifdef DEBUG
+/**
+ * brcmf_fws_tlv_names - array of tlv names.
+ */
+#define BRCMF_FWS_TLV_DEF(name, id, len) \
+        { id, #name },
+static struct {
+        enum brcmf_fws_tlv_type id;
+        const char *name;
+} brcmf_fws_tlv_names[] = {
+        BRCMF_FWS_TLV_DEFLIST
+};
+#undef BRCMF_FWS_TLV_DEF
+
+static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(brcmf_fws_tlv_names); i++)
+                if (brcmf_fws_tlv_names[i].id == id)
+                        return brcmf_fws_tlv_names[i].name;
+
+        return "INVALID";
+}
+#else
+static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
+{
+        return "NODEBUG";
+}
+#endif /* DEBUG */
+
+/**
+ * flags used to enable tlv signalling from firmware.
+ */
+#define BRCMF_FWS_FLAGS_RSSI_SIGNALS                            0x0001
+#define BRCMF_FWS_FLAGS_XONXOFF_SIGNALS                         0x0002
+#define BRCMF_FWS_FLAGS_CREDIT_STATUS_SIGNALS                   0x0004
+#define BRCMF_FWS_FLAGS_HOST_PROPTXSTATUS_ACTIVE                0x0008
+#define BRCMF_FWS_FLAGS_PSQ_GENERATIONFSM_ENABLE                0x0010
+#define BRCMF_FWS_FLAGS_PSQ_ZERO_BUFFER_ENABLE                  0x0020
+#define BRCMF_FWS_FLAGS_HOST_RXREORDER_ACTIVE                   0x0040
+
+#define BRCMF_FWS_HANGER_MAXITEMS                               1024
+#define BRCMF_FWS_HANGER_ITEM_STATE_FREE                        1
+#define BRCMF_FWS_HANGER_ITEM_STATE_INUSE                       2
+#define BRCMF_FWS_HANGER_ITEM_STATE_INUSE_SUPPRESSED            3
+
+#define BRCMF_FWS_STATE_OPEN                                    1
+#define BRCMF_FWS_STATE_CLOSE                           2
+
+#define BRCMF_FWS_FCMODE_NONE                           0
+#define BRCMF_FWS_FCMODE_IMPLIED_CREDIT                 1
+#define BRCMF_FWS_FCMODE_EXPLICIT_CREDIT                        2
+
+#define BRCMF_FWS_MAC_DESC_TABLE_SIZE                   32
+#define BRCMF_FWS_MAX_IFNUM                                     16
+#define BRCMF_FWS_MAC_DESC_ID_INVALID                   0xff
+
+#define BRCMF_FWS_HOSTIF_FLOWSTATE_OFF                  0
+#define BRCMF_FWS_HOSTIF_FLOWSTATE_ON                   1
+
+/**
+ * FWFC packet identifier
+ *
+ * 32-bit packet identifier used in PKTTAG tlv from host to dongle.
+ *
+ * - Generated at the host (e.g. dhd)
+ * - Seen as a generic sequence number by wlc except the flags field
+ *
+ * Generation   : b[31] => generation number for this packet [host->fw]
+ *                         OR, current generation number [fw->host]
+ * Flags        : b[30:27] => command, status flags
+ * FIFO-AC      : b[26:24] => AC-FIFO id
+ * h-slot       : b[23:8] => hanger-slot
+ * freerun      : b[7:0] => A free running counter
+ */
+#define BRCMF_FWS_PKTTAG_GENERATION_MASK                0x80000000
+#define BRCMF_FWS_PKTTAG_GENERATION_SHIFT               31
+#define BRCMF_FWS_PKTTAG_FLAGS_MASK                     0x78000000
+#define BRCMF_FWS_PKTTAG_FLAGS_SHIFT                    27
+#define BRCMF_FWS_PKTTAG_FIFO_MASK                      0x07000000
+#define BRCMF_FWS_PKTTAG_FIFO_SHIFT                     24
+#define BRCMF_FWS_PKTTAG_HSLOT_MASK                     0x00ffff00
+#define BRCMF_FWS_PKTTAG_HSLOT_SHIFT                    8
+#define BRCMF_FWS_PKTTAG_FREERUN_MASK                   0x000000ff
+#define BRCMF_FWS_PKTTAG_FREERUN_SHIFT                  0
+
+#define brcmf_fws_pkttag_set_field(var, field, value) \
+        brcmu_maskset32((var), BRCMF_FWS_PKTTAG_ ## field ## _MASK, \
+                             BRCMF_FWS_PKTTAG_ ## field ## _SHIFT, (value))
+#define brcmf_fws_pkttag_get_field(var, field) \
+        brcmu_maskget32((var), BRCMF_FWS_PKTTAG_ ## field ## _MASK, \
+                             BRCMF_FWS_PKTTAG_ ## field ## _SHIFT)
+
+struct brcmf_fws_info {
+        struct brcmf_pub *drvr;
+        struct brcmf_fws_stats stats;
+};
+
+static int brcmf_fws_rssi_indicate(struct brcmf_fws_info *fws, s8 rssi)
+{
+        brcmf_dbg(CTL, "rssi %d\n", rssi);
+        return 0;
+}
+
+static int brcmf_fws_dbg_seqnum_check(struct brcmf_fws_info *fws, u8 *data)
+{
+        __le32 timestamp;
+
+        memcpy(&timestamp, &data[2], sizeof(timestamp));
+        brcmf_dbg(INFO, "received: seq %d, timestamp %d\n", data[1],
+                  le32_to_cpu(timestamp));
+        return 0;
+}
+
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_lock(drvr, flags)                             \
+do {                                                            \
+        flags = 0;                                              \
+        spin_lock_irqsave(&((drvr)->fws_spinlock), (flags));    \
+} while (0)
+
+/* using macro so sparse checking does not complain
+ * about locking imbalance.
+ */
+#define brcmf_fws_unlock(drvr, flags) \
+        spin_unlock_irqrestore(&((drvr)->fws_spinlock), (flags))
+
+int brcmf_fws_init(struct brcmf_pub *drvr)
+{
+        u32 tlv;
+        int rc;
+
+        /* enable rssi signals */
+        tlv = drvr->fw_signals ? BRCMF_FWS_FLAGS_RSSI_SIGNALS : 0;
+
+        spin_lock_init(&drvr->fws_spinlock);
+
+        drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
+        if (!drvr->fws) {
+                rc = -ENOMEM;
+                goto fail;
+        }
+
+        /* enable proptxtstatus signaling by default */
+        rc = brcmf_fil_iovar_int_set(drvr->iflist[0], "tlv", tlv);
+        if (rc < 0) {
+                brcmf_err("failed to set bdcv2 tlv signaling\n");
+                goto fail;
+        }
+        /* set linkage back */
+        drvr->fws->drvr = drvr;
+
+        /* create debugfs file for statistics */
+        brcmf_debugfs_create_fws_stats(drvr, &drvr->fws->stats);
+
+        /* TODO: remove upon feature delivery */
+        brcmf_err("%s bdcv2 tlv signaling [%x]\n",
+                  drvr->fw_signals ? "enabled" : "disabled", tlv);
+        return 0;
+
+fail:
+        /* disable flow control entirely */
+        drvr->fw_signals = false;
+        brcmf_fws_deinit(drvr);
+        return rc;
+}
+
+void brcmf_fws_deinit(struct brcmf_pub *drvr)
+{
+        /* free top structure */
+        kfree(drvr->fws);
+        drvr->fws = NULL;
+}
+
+int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
+                      struct sk_buff *skb)
+{
+        struct brcmf_fws_info *fws = drvr->fws;
+        ulong flags;
+        u8 *signal_data;
+        s16 data_len;
+        u8 type;
+        u8 len;
+        u8 *data;
+
+        brcmf_dbg(TRACE, "enter: ifidx %d, skblen %u, sig %d\n",
+                  ifidx, skb->len, signal_len);
+
+        WARN_ON(signal_len > skb->len);
+
+        /* if flow control disabled, skip to packet data and leave */
+        if (!signal_len || !drvr->fw_signals) {
+                skb_pull(skb, signal_len);
+                return 0;
+        }
+
+        /* lock during tlv parsing */
+        brcmf_fws_lock(drvr, flags);
+
+        fws->stats.header_pulls++;
+        data_len = signal_len;
+        signal_data = skb->data;
+
+        while (data_len > 0) {
+                /* extract tlv info */
+                type = signal_data[0];
+
+                /* FILLER type is actually not a TLV, but
+                 * a single byte that can be skipped.
+                 */
+                if (type == BRCMF_FWS_TYPE_FILLER) {
+                        signal_data += 1;
+                        data_len -= 1;
+                        continue;
+                }
+                len = signal_data[1];
+                data = signal_data + 2;
+
+                /* abort parsing when length invalid */
+                if (data_len < len + 2)
+                        break;
+
+                brcmf_dbg(INFO, "tlv type=%d (%s), len=%d\n", type,
+                          brcmf_fws_get_tlv_name(type), len);
+                switch (type) {
+                case BRCMF_FWS_TYPE_MAC_OPEN:
+                case BRCMF_FWS_TYPE_MAC_CLOSE:
+                        WARN_ON(len != BRCMF_FWS_TYPE_MAC_OPEN_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT:
+                        WARN_ON(len != BRCMF_FWS_TYPE_MAC_REQUEST_CREDIT_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_TXSTATUS:
+                        WARN_ON(len != BRCMF_FWS_TYPE_TXSTATUS_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_PKTTAG:
+                        WARN_ON(len != BRCMF_FWS_TYPE_PKTTAG_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_MACDESC_ADD:
+                case BRCMF_FWS_TYPE_MACDESC_DEL:
+                        WARN_ON(len != BRCMF_FWS_TYPE_MACDESC_ADD_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_RSSI:
+                        WARN_ON(len != BRCMF_FWS_TYPE_RSSI_LEN);
+                        brcmf_fws_rssi_indicate(fws, *(s8 *)data);
+                        break;
+                case BRCMF_FWS_TYPE_INTERFACE_OPEN:
+                case BRCMF_FWS_TYPE_INTERFACE_CLOSE:
+                        WARN_ON(len != BRCMF_FWS_TYPE_INTERFACE_OPEN_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_FIFO_CREDITBACK:
+                        WARN_ON(len != BRCMF_FWS_TYPE_FIFO_CREDITBACK_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP:
+                        WARN_ON(len != BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_MAC_REQUEST_PACKET:
+                        WARN_ON(len != BRCMF_FWS_TYPE_MAC_REQUEST_PACKET_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS:
+                        WARN_ON(len != BRCMF_FWS_TYPE_HOST_REORDER_RXPKTS_LEN);
+                        break;
+                case BRCMF_FWS_TYPE_TRANS_ID:
+                        WARN_ON(len != BRCMF_FWS_TYPE_TRANS_ID_LEN);
+                        brcmf_fws_dbg_seqnum_check(fws, data);
+                        break;
+                case BRCMF_FWS_TYPE_COMP_TXSTATUS:
+                        WARN_ON(len != BRCMF_FWS_TYPE_COMP_TXSTATUS_LEN);
+                        break;
+                default:
+                        fws->stats.tlv_invalid_type++;
+                        break;
+                }
+
+                signal_data += len + 2;
+                data_len -= len + 2;
+        }
+
+        if (data_len != 0)
+                fws->stats.tlv_parse_failed++;
+
+        /* signalling processing result does
+         * not affect the actual ethernet packet.
+         */
+        skb_pull(skb, signal_len);
+
+        /* this may be a signal-only packet
+         */
+        if (skb->len == 0)
+                fws->stats.header_only_pkt++;
+
+        brcmf_fws_unlock(drvr, flags);
+        return 0;
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
new file mode 100644
index 000000000000..e728eea72bb4
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.h
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+#ifndef FWSIGNAL_H_
+#define FWSIGNAL_H_
+
+int brcmf_fws_init(struct brcmf_pub *drvr);
+void brcmf_fws_deinit(struct brcmf_pub *drvr);
+int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
+                      struct sk_buff *skb);
+#endif /* FWSIGNAL_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
new file mode 100644
index 000000000000..b505db48c60d
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.c
@@ -0,0 +1,22 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h> /* bug in tracepoint.h, it should include this */
+
+#ifndef __CHECKER__
+#define CREATE_TRACE_POINTS
+#include "tracepoint.h"
+#endif
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
new file mode 100644
index 000000000000..35efc7a67644
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#if !defined(BRCMF_TRACEPOINT_H_) || defined(TRACE_HEADER_MULTI_READ)
+#define BRCMF_TRACEPOINT_H_
+
+#include <linux/types.h>
+#include <linux/tracepoint.h>
+
+#ifndef CONFIG_BRCM_TRACING
+
+#undef TRACE_EVENT
+#define TRACE_EVENT(name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+
+#undef DECLARE_EVENT_CLASS
+#define DECLARE_EVENT_CLASS(...)
+
+#undef DEFINE_EVENT
+#define DEFINE_EVENT(evt_class, name, proto, ...) \
+static inline void trace_ ## name(proto) {}
+
+#endif /* CONFIG_BRCM_TRACING */
+
+#undef TRACE_SYSTEM
+#define TRACE_SYSTEM    brcmfmac
+
+#define MAX_MSG_LEN             100
+
+TRACE_EVENT(brcmf_err,
+        TP_PROTO(const char *func, struct va_format *vaf),
+        TP_ARGS(func, vaf),
+        TP_STRUCT__entry(
+                __string(func, func)
+                __dynamic_array(char, msg, MAX_MSG_LEN)
+        ),
+        TP_fast_assign(
+                __assign_str(func, func);
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       MAX_MSG_LEN, vaf->fmt,
+                                       *vaf->va) >= MAX_MSG_LEN);
+        ),
+        TP_printk("%s: %s", __get_str(func), __get_str(msg))
+);
+
+TRACE_EVENT(brcmf_dbg,
+        TP_PROTO(u32 level, const char *func, struct va_format *vaf),
+        TP_ARGS(level, func, vaf),
+        TP_STRUCT__entry(
+                __field(u32, level)
+                __string(func, func)
+                __dynamic_array(char, msg, MAX_MSG_LEN)
+        ),
+        TP_fast_assign(
+                __entry->level = level;
+                __assign_str(func, func);
+                WARN_ON_ONCE(vsnprintf(__get_dynamic_array(msg),
+                                       MAX_MSG_LEN, vaf->fmt,
+                                       *vaf->va) >= MAX_MSG_LEN);
+        ),
+        TP_printk("%s: %s", __get_str(func), __get_str(msg))
+);
+
+#ifdef CONFIG_BRCM_TRACING
+
+#undef TRACE_INCLUDE_PATH
+#define TRACE_INCLUDE_PATH .
+#undef TRACE_INCLUDE_FILE
+#define TRACE_INCLUDE_FILE tracepoint
+
+#include <trace/define_trace.h>
+
+#endif /* CONFIG_BRCM_TRACING */
+
+#endif /* BRCMF_TRACEPOINT_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 42289e9ea886..01aed7ad6bec 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -112,11 +112,6 @@ struct brcmf_usbdev_info {
 static void brcmf_usb_rx_refill(struct brcmf_usbdev_info *devinfo,
                                 struct brcmf_usbreq  *req);
 
-MODULE_AUTHOR("Broadcom Corporation");
-MODULE_DESCRIPTION("Broadcom 802.11n wireless LAN fullmac usb driver.");
-MODULE_SUPPORTED_DEVICE("Broadcom 802.11n WLAN fullmac usb cards");
-MODULE_LICENSE("Dual BSD/GPL");
-
 static struct brcmf_usbdev *brcmf_usb_get_buspub(struct device *dev)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
@@ -422,8 +417,6 @@ static void brcmf_usb_tx_complete(struct urb *urb)
         brcmf_usb_del_fromq(devinfo, req);
 
         brcmf_txcomplete(devinfo->dev, req->skb, urb->status == 0);
-
-        brcmu_pkt_buf_free_skb(req->skb);
         req->skb = NULL;
         brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req, &devinfo->tx_freecount);
         if (devinfo->tx_freecount > devinfo->tx_high_watermark &&
@@ -577,15 +570,17 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
         int ret;
 
         brcmf_dbg(USB, "Enter, skb=%p\n", skb);
-        if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP)
-                return -EIO;
+        if (devinfo->bus_pub.state != BRCMFMAC_USB_STATE_UP) {
+                ret = -EIO;
+                goto fail;
+        }
 
         req = brcmf_usb_deq(devinfo, &devinfo->tx_freeq,
                                         &devinfo->tx_freecount);
         if (!req) {
-                brcmu_pkt_buf_free_skb(skb);
                 brcmf_err("no req to send\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto fail;
         }
 
         req->skb = skb;
@@ -598,18 +593,21 @@ static int brcmf_usb_tx(struct device *dev, struct sk_buff *skb)
         if (ret) {
                 brcmf_err("brcmf_usb_tx usb_submit_urb FAILED\n");
                 brcmf_usb_del_fromq(devinfo, req);
-                brcmu_pkt_buf_free_skb(req->skb);
                 req->skb = NULL;
                 brcmf_usb_enq(devinfo, &devinfo->tx_freeq, req,
-                                                &devinfo->tx_freecount);
-        } else {
-                if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
-                        !devinfo->tx_flowblock) {
-                        brcmf_txflowblock(dev, true);
-                        devinfo->tx_flowblock = true;
-                }
+                              &devinfo->tx_freecount);
+                goto fail;
         }
 
+        if (devinfo->tx_freecount < devinfo->tx_low_watermark &&
+            !devinfo->tx_flowblock) {
+                brcmf_txflowblock(dev, true);
+                devinfo->tx_flowblock = true;
+        }
+        return 0;
+
+fail:
+        brcmf_txcomplete(dev, skb, false);
         return ret;
 }
 
@@ -1485,6 +1483,7 @@ static struct usb_device_id brcmf_usb_devid_table[] = {
         { USB_DEVICE(BRCMF_USB_VENDOR_ID_BROADCOM, BRCMF_USB_DEVICE_ID_BCMFW) },
         { }
 };
+
 MODULE_DEVICE_TABLE(usb, brcmf_usb_devid_table);
 MODULE_FIRMWARE(BRCMF_USB_43143_FW_NAME);
 MODULE_FIRMWARE(BRCMF_USB_43236_FW_NAME);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 2af9c0f0798d..804473fc5c5e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -3052,16 +3052,16 @@ brcmf_cfg80211_sched_scan_start(struct wiphy *wiphy,
         int i;
         int ret = 0;
 
-        brcmf_dbg(SCAN, "Enter n_match_sets:%d   n_ssids:%d\n",
+        brcmf_dbg(SCAN, "Enter n_match_sets:%d n_ssids:%d\n",
                   request->n_match_sets, request->n_ssids);
         if (test_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status)) {
                 brcmf_err("Scanning already: status (%lu)\n", cfg->scan_status);
                 return -EAGAIN;
         }
 
-        if (!request || !request->n_ssids || !request->n_match_sets) {
+        if (!request->n_ssids || !request->n_match_sets) {
                 brcmf_err("Invalid sched scan req!! n_ssids:%d\n",
-                          request ? request->n_ssids : 0);
+                          request->n_ssids);
                 return -EINVAL;
         }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/Makefile b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
index d3d4151c3eda..cba19d839b77 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmsmac/Makefile
@@ -43,6 +43,10 @@ BRCMSMAC_OFILES := \
         brcms_trace_events.o \
         debug.o
 
+ifdef CONFIG_BCMA_DRIVER_GPIO
+BRCMSMAC_OFILES += led.o
+endif
+
 MODULEPFX := brcmsmac
 
 obj-$(CONFIG_BRCMSMAC)  += $(MODULEPFX).o
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/led.c b/drivers/net/wireless/brcm80211/brcmsmac/led.c
new file mode 100644
index 000000000000..74b17cecb189
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.c
@@ -0,0 +1,126 @@
+#include <net/mac80211.h>
+#include <linux/bcma/bcma_driver_chipcommon.h>
+#include <linux/gpio.h>
+
+#include "mac80211_if.h"
+#include "pub.h"
+#include "main.h"
+#include "led.h"
+
+        /* number of leds */
+#define  BRCMS_LED_NO           4
+        /* behavior mask */
+#define  BRCMS_LED_BEH_MASK     0x7f
+        /* activelow (polarity) bit */
+#define  BRCMS_LED_AL_MASK      0x80
+        /* radio enabled */
+#define  BRCMS_LED_RADIO        3
+
+static void brcms_radio_led_ctrl(struct brcms_info *wl, bool state)
+{
+        if (wl->radio_led.gpio == -1)
+                return;
+
+        if (wl->radio_led.active_low)
+                state = !state;
+
+        if (state)
+                gpio_set_value(wl->radio_led.gpio, 1);
+        else
+                gpio_set_value(wl->radio_led.gpio, 0);
+}
+
+
+/* Callback from the LED subsystem. */
+static void brcms_led_brightness_set(struct led_classdev *led_dev,
+                                   enum led_brightness brightness)
+{
+        struct brcms_info *wl = container_of(led_dev,
+                struct brcms_info, led_dev);
+        brcms_radio_led_ctrl(wl, brightness);
+}
+
+void brcms_led_unregister(struct brcms_info *wl)
+{
+        if (wl->led_dev.dev)
+                led_classdev_unregister(&wl->led_dev);
+        if (wl->radio_led.gpio != -1)
+                gpio_free(wl->radio_led.gpio);
+}
+
+int brcms_led_register(struct brcms_info *wl)
+{
+        int i, err;
+        struct brcms_led *radio_led = &wl->radio_led;
+        /* get CC core */
+        struct bcma_drv_cc *cc_drv  = &wl->wlc->hw->d11core->bus->drv_cc;
+        struct gpio_chip *bcma_gpio = &cc_drv->gpio;
+        struct ssb_sprom *sprom = &wl->wlc->hw->d11core->bus->sprom;
+        u8 *leds[] = { &sprom->gpio0,
+                &sprom->gpio1,
+                &sprom->gpio2,
+                &sprom->gpio3 };
+        unsigned gpio = -1;
+        bool active_low = false;
+
+        /* none by default */
+        radio_led->gpio = -1;
+        radio_led->active_low = false;
+
+        if (!bcma_gpio || !gpio_is_valid(bcma_gpio->base))
+                return -ENODEV;
+
+        /* find radio enabled LED */
+        for (i = 0; i < BRCMS_LED_NO; i++) {
+                u8 led = *leds[i];
+                if ((led & BRCMS_LED_BEH_MASK) == BRCMS_LED_RADIO) {
+                        gpio = bcma_gpio->base + i;
+                        if (led & BRCMS_LED_AL_MASK)
+                                active_low = true;
+                        break;
+                }
+        }
+
+        if (gpio == -1 || !gpio_is_valid(gpio))
+                return -ENODEV;
+
+        /* request and configure LED gpio */
+        err = gpio_request_one(gpio,
+                                active_low ? GPIOF_OUT_INIT_HIGH
+                                        : GPIOF_OUT_INIT_LOW,
+                                "radio on");
+        if (err) {
+                wiphy_err(wl->wiphy, "requesting led gpio %d failed (err: %d)\n",
+                          gpio, err);
+                return err;
+        }
+        err = gpio_direction_output(gpio, 1);
+        if (err) {
+                wiphy_err(wl->wiphy, "cannot set led gpio %d to output (err: %d)\n",
+                          gpio, err);
+                return err;
+        }
+
+        snprintf(wl->radio_led.name, sizeof(wl->radio_led.name),
+                 "brcmsmac-%s:radio", wiphy_name(wl->wiphy));
+
+        wl->led_dev.name = wl->radio_led.name;
+        wl->led_dev.default_trigger =
+                ieee80211_get_radio_led_name(wl->pub->ieee_hw);
+        wl->led_dev.brightness_set = brcms_led_brightness_set;
+        err = led_classdev_register(wiphy_dev(wl->wiphy), &wl->led_dev);
+
+        if (err) {
+                wiphy_err(wl->wiphy, "cannot register led device: %s (err: %d)\n",
+                          wl->radio_led.name, err);
+                return err;
+        }
+
+        wiphy_info(wl->wiphy, "registered radio enabled led device: %s gpio: %d\n",
+                   wl->radio_led.name,
+                   gpio);
+        radio_led->gpio = gpio;
+        radio_led->active_low = active_low;
+
+        return 0;
+}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/led.h b/drivers/net/wireless/brcm80211/brcmsmac/led.h
new file mode 100644
index 000000000000..17a0b1f5dbcf
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmsmac/led.h
@@ -0,0 +1,36 @@
+/*
+ * Copyright (c) 2012 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef _BRCM_LED_H_
+#define _BRCM_LED_H_
+struct brcms_led {
+        char name[32];
+        unsigned gpio;
+        bool active_low;
+};
+
+#ifdef CONFIG_BCMA_DRIVER_GPIO
+void brcms_led_unregister(struct brcms_info *wl);
+int brcms_led_register(struct brcms_info *wl);
+#else
+static inline void brcms_led_unregister(struct brcms_info *wl) {};
+static inline int brcms_led_register(struct brcms_info *wl)
+{
+        return -ENOTSUPP;
+};
+#endif
+
+#endif /* _BRCM_LED_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index c6451c61407a..c70cf7b654cd 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -34,6 +34,7 @@
 #include "mac80211_if.h"
 #include "main.h"
 #include "debug.h"
+#include "led.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
 #define BRCMS_FLUSH_TIMEOUT     500 /* msec */
@@ -904,6 +905,7 @@ static void brcms_remove(struct bcma_device *pdev)
         struct brcms_info *wl = hw->priv;
 
         if (wl->wlc) {
+                brcms_led_unregister(wl);
                 wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, false);
                 wiphy_rfkill_stop_polling(wl->pub->ieee_hw->wiphy);
                 ieee80211_unregister_hw(hw);
@@ -1151,6 +1153,8 @@ static int brcms_bcma_probe(struct bcma_device *pdev)
                 pr_err("%s: brcms_attach failed!\n", __func__);
                 return -ENODEV;
         }
+        brcms_led_register(wl);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 947ccacf43e6..4090032e81a2 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -20,8 +20,10 @@
 #include <linux/timer.h>
 #include <linux/interrupt.h>
 #include <linux/workqueue.h>
+#include <linux/leds.h>
 
 #include "ucode_loader.h"
+#include "led.h"
 /*
  * Starting index for 5G rates in the
  * legacy rate table.
@@ -81,6 +83,8 @@ struct brcms_info {
         struct wiphy *wiphy;
         struct brcms_ucode ucode;
         bool mute_tx;
+        struct brcms_led radio_led;
+        struct led_classdev led_dev;
 };
 
 /* misc callbacks */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 8ef02dca8f8c..0c8e998bfb1e 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -7810,9 +7810,14 @@ void brcms_c_init(struct brcms_c_info *wlc, bool mute_tx)
 
         /* read the ucode version if we have not yet done so */
         if (wlc->ucode_rev == 0) {
-                wlc->ucode_rev =
-                    brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR) << NBITS(u16);
-                wlc->ucode_rev |= brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
+                u16 rev;
+                u16 patch;
+
+                rev = brcms_b_read_shm(wlc->hw, M_BOM_REV_MAJOR);
+                patch = brcms_b_read_shm(wlc->hw, M_BOM_REV_MINOR);
+                wlc->ucode_rev = (rev << NBITS(u16)) | patch;
+                snprintf(wlc->wiphy->fw_version,
+                         sizeof(wlc->wiphy->fw_version), "%u.%u", rev, patch);
         }
 
         /* ..now really unleash hell (allow the MAC out of suspend) */
diff --git a/drivers/net/wireless/brcm80211/brcmutil/utils.c b/drivers/net/wireless/brcm80211/brcmutil/utils.c
index 3e6405e06ac0..bf5e50fc21ba 100644
--- a/drivers/net/wireless/brcm80211/brcmutil/utils.c
+++ b/drivers/net/wireless/brcm80211/brcmutil/utils.c
@@ -116,6 +116,31 @@ struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec)
 }
 EXPORT_SYMBOL(brcmu_pktq_pdeq);
 
+/*
+ * precedence based dequeue with match function. Passing a NULL pointer
+ * for the match function parameter is considered to be a wildcard so
+ * any packet on the queue is returned. In that case it is no different
+ * from brcmu_pktq_pdeq() above.
+ */
+struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
+                                      bool (*match_fn)(struct sk_buff *skb,
+                                                       void *arg), void *arg)
+{
+        struct sk_buff_head *q;
+        struct sk_buff *p, *next;
+
+        q = &pq->q[prec].skblist;
+        skb_queue_walk_safe(q, p, next) {
+                if (match_fn == NULL || match_fn(p, arg)) {
+                        skb_unlink(p, q);
+                        pq->len--;
+                        return p;
+                }
+        }
+        return NULL;
+}
+EXPORT_SYMBOL(brcmu_pktq_pdeq_match);
+
 struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec)
 {
         struct sk_buff_head *q;
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_utils.h b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
index 477b92ad3d62..898cacb8d01d 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_utils.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_utils.h
@@ -120,6 +120,10 @@ extern struct sk_buff *brcmu_pktq_penq_head(struct pktq *pq, int prec,
                                       struct sk_buff *p);
 extern struct sk_buff *brcmu_pktq_pdeq(struct pktq *pq, int prec);
 extern struct sk_buff *brcmu_pktq_pdeq_tail(struct pktq *pq, int prec);
+extern struct sk_buff *brcmu_pktq_pdeq_match(struct pktq *pq, int prec,
+                                             bool (*match_fn)(struct sk_buff *p,
+                                                              void *arg),
+                                             void *arg);
 
 /* packet primitives */
 extern struct sk_buff *brcmu_pkt_buf_get_skb(uint len);
@@ -173,6 +177,29 @@ extern void brcmu_pktq_flush(struct pktq *pq, bool dir,
 /* ip address */
 struct ipv4_addr;
 
+/*
+ * bitfield macros using masking and shift
+ *
+ * remark: the mask parameter should be a shifted mask.
+ */
+static inline void brcmu_maskset32(u32 *var, u32 mask, u8 shift, u32 value)
+{
+        value = (value << shift) & mask;
+        *var = (*var & ~mask) | value;
+}
+static inline u32 brcmu_maskget32(u32 var, u32 mask, u8 shift)
+{
+        return (var & mask) >> shift;
+}
+static inline void brcmu_maskset16(u16 *var, u16 mask, u8 shift, u16 value)
+{
+        value = (value << shift) & mask;
+        *var = (*var & ~mask) | value;
+}
+static inline u16 brcmu_maskget16(u16 var, u16 mask, u8 shift)
+{
+        return (var & mask) >> shift;
+}
 
 /* externs */
 /* format/print */
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index 3630a41df50d..df5a57c74808 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3475,7 +3475,7 @@ static struct attribute_group il3945_attribute_group = {
         .attrs = il3945_sysfs_entries,
 };
 
-struct ieee80211_ops il3945_mac_ops = {
+static struct ieee80211_ops il3945_mac_ops __read_mostly = {
         .tx = il3945_mac_tx,
         .start = il3945_mac_start,
         .stop = il3945_mac_stop,
diff --git a/drivers/net/wireless/iwlegacy/3945.h b/drivers/net/wireless/iwlegacy/3945.h
index 1d45075e0d5b..9a8703def0ba 100644
--- a/drivers/net/wireless/iwlegacy/3945.h
+++ b/drivers/net/wireless/iwlegacy/3945.h
@@ -150,10 +150,6 @@ struct il3945_frame {
         struct list_head list;
 };
 
-#define SEQ_TO_SN(seq) (((seq) & IEEE80211_SCTL_SEQ) >> 4)
-#define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
-#define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
-
 #define SUP_RATE_11A_MAX_NUM_CHANNELS  8
 #define SUP_RATE_11B_MAX_NUM_CHANNELS  4
 #define SUP_RATE_11G_MAX_NUM_CHANNELS  12
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 7941eb3a0166..5bc995a48519 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -612,7 +612,7 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
 
 /* Called for N_RX (legacy ABG frames), or
  * N_RX_MPDU (HT high-throughput N frames). */
-void
+static void
 il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct ieee80211_hdr *header;
@@ -744,7 +744,7 @@ il4965_hdl_rx(struct il_priv *il, struct il_rx_buf *rxb)
 
 /* Cache phy data (Rx signal strength, etc) for HT frame (N_RX_PHY).
  * This will be used later in il_hdl_rx() for N_RX_MPDU. */
-void
+static void
 il4965_hdl_rx_phy(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -1250,7 +1250,7 @@ il4965_dump_fh(struct il_priv *il, char **buf, bool display)
         return 0;
 }
 
-void
+static void
 il4965_hdl_missed_beacon(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -1357,7 +1357,7 @@ il4965_accumulative_stats(struct il_priv *il, __le32 * stats)
 }
 #endif
 
-void
+static void
 il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
 {
         const int recalib_seconds = 60;
@@ -1399,7 +1399,7 @@ il4965_hdl_stats(struct il_priv *il, struct il_rx_buf *rxb)
                 il4965_temperature_calib(il);
 }
 
-void
+static void
 il4965_hdl_c_stats(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -2050,7 +2050,7 @@ il4965_txq_ctx_reset(struct il_priv *il)
                 il_tx_queue_reset(il, txq_id);
 }
 
-void
+static void
 il4965_txq_ctx_unmap(struct il_priv *il)
 {
         int txq_id;
@@ -2258,7 +2258,7 @@ il4965_tx_agg_start(struct il_priv *il, struct ieee80211_vif *vif,
 
         spin_lock_irqsave(&il->sta_lock, flags);
         tid_data = &il->stations[sta_id].tid[tid];
-        *ssn = SEQ_TO_SN(tid_data->seq_number);
+        *ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
         tid_data->agg.txq_id = txq_id;
         il_set_swq_id(&il->txq[txq_id], il4965_get_ac_from_tid(tid), txq_id);
         spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -2408,7 +2408,7 @@ il4965_txq_check_empty(struct il_priv *il, int sta_id, u8 tid, int txq_id)
                 /* aggregated HW queue */
                 if (txq_id == tid_data->agg.txq_id &&
                     q->read_ptr == q->write_ptr) {
-                        u16 ssn = SEQ_TO_SN(tid_data->seq_number);
+                        u16 ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
                         int tx_fifo = il4965_get_fifo_from_tid(tid);
                         D_HT("HW queue empty: continue DELBA flow\n");
                         il4965_txq_agg_disable(il, txq_id, ssn, tx_fifo);
@@ -2627,7 +2627,8 @@ il4965_get_ra_sta_id(struct il_priv *il, struct ieee80211_hdr *hdr)
 static inline u32
 il4965_get_scd_ssn(struct il4965_tx_resp *tx_resp)
 {
-        return le32_to_cpup(&tx_resp->u.status + tx_resp->frame_count) & MAX_SN;
+        return le32_to_cpup(&tx_resp->u.status +
+                            tx_resp->frame_count) & IEEE80211_MAX_SN;
 }
 
 static inline u32
@@ -2717,15 +2718,15 @@ il4965_tx_status_reply_tx(struct il_priv *il, struct il_ht_agg *agg,
                         hdr = (struct ieee80211_hdr *) skb->data;
 
                         sc = le16_to_cpu(hdr->seq_ctrl);
-                        if (idx != (SEQ_TO_SN(sc) & 0xff)) {
+                        if (idx != (IEEE80211_SEQ_TO_SN(sc) & 0xff)) {
                                 IL_ERR("BUG_ON idx doesn't match seq control"
                                        " idx=%d, seq_idx=%d, seq=%d\n", idx,
-                                       SEQ_TO_SN(sc), hdr->seq_ctrl);
+                                       IEEE80211_SEQ_TO_SN(sc), hdr->seq_ctrl);
                                 return -1;
                         }
 
                         D_TX_REPLY("AGG Frame i=%d idx %d seq=%d\n", i, idx,
-                                   SEQ_TO_SN(sc));
+                                   IEEE80211_SEQ_TO_SN(sc));
 
                         sh = idx - start;
                         if (sh > 64) {
@@ -2895,7 +2896,7 @@ il4965_hwrate_to_tx_control(struct il_priv *il, u32 rate_n_flags,
  * Handles block-acknowledge notification from device, which reports success
  * of frames sent via aggregation.
  */
-void
+static void
 il4965_hdl_compressed_ba(struct il_priv *il, struct il_rx_buf *rxb)
 {
         struct il_rx_pkt *pkt = rxb_addr(rxb);
@@ -6316,7 +6317,7 @@ il4965_tx_queue_set_status(struct il_priv *il, struct il_tx_queue *txq,
                scd_retry ? "BA" : "AC", txq_id, tx_fifo_id);
 }
 
-const struct ieee80211_ops il4965_mac_ops = {
+static const struct ieee80211_ops il4965_mac_ops = {
         .tx = il4965_mac_tx,
         .start = il4965_mac_start,
         .stop = il4965_mac_stop,
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index e006ea831320..bc465da40476 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -1122,7 +1122,7 @@ il_set_power(struct il_priv *il, struct il_powertable_cmd *cmd)
                                sizeof(struct il_powertable_cmd), cmd);
 }
 
-int
+static int
 il_power_set_mode(struct il_priv *il, struct il_powertable_cmd *cmd, bool force)
 {
         int ret;
diff --git a/drivers/net/wireless/iwlegacy/common.h b/drivers/net/wireless/iwlegacy/common.h
index 96f2025d936e..73bd3ef316c8 100644
--- a/drivers/net/wireless/iwlegacy/common.h
+++ b/drivers/net/wireless/iwlegacy/common.h
@@ -541,10 +541,6 @@ struct il_frame {
         struct list_head list;
 };
 
-#define SEQ_TO_SN(seq) (((seq) & IEEE80211_SCTL_SEQ) >> 4)
-#define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
-#define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
-
 enum {
         CMD_SYNC = 0,
         CMD_SIZE_NORMAL = 0,
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index 323e4a33fcac..c7cd2dffa5cd 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1137,7 +1137,8 @@ done:
 static int iwlagn_mac_remain_on_channel(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif,
                                      struct ieee80211_channel *channel,
-                                     int duration)
+                                     int duration,
+                                     enum ieee80211_roc_type type)
 {
         struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw);
         struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_PAN];
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 303403b86b75..cc1e0c1a6f48 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -418,7 +418,8 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                                 " Tx flags = 0x%08x, agg.state = %d",
                                 info->flags, tid_data->agg.state);
                         IWL_ERR(priv, "sta_id = %d, tid = %d seq_num = %d",
-                                sta_id, tid, SEQ_TO_SN(tid_data->seq_number));
+                                sta_id, tid,
+                                IEEE80211_SEQ_TO_SN(tid_data->seq_number));
                         goto drop_unlock_sta;
                 }
 
@@ -569,7 +570,7 @@ int iwlagn_tx_agg_stop(struct iwl_priv *priv, struct ieee80211_vif *vif,
                 return 0;
         }
 
-        tid_data->agg.ssn = SEQ_TO_SN(tid_data->seq_number);
+        tid_data->agg.ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
 
         /* There are still packets for this RA / TID in the HW */
         if (!test_bit(txq_id, priv->agg_q_alloc)) {
@@ -651,7 +652,7 @@ int iwlagn_tx_agg_start(struct iwl_priv *priv, struct ieee80211_vif *vif,
 
         spin_lock_bh(&priv->sta_lock);
         tid_data = &priv->tid_data[sta_id][tid];
-        tid_data->agg.ssn = SEQ_TO_SN(tid_data->seq_number);
+        tid_data->agg.ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
         tid_data->agg.txq_id = txq_id;
 
         *ssn = tid_data->agg.ssn;
@@ -911,7 +912,7 @@ static void iwlagn_count_agg_tx_err_status(struct iwl_priv *priv, u16 status)
 static inline u32 iwlagn_get_scd_ssn(struct iwlagn_tx_resp *tx_resp)
 {
         return le32_to_cpup((__le32 *)&tx_resp->status +
-                            tx_resp->frame_count) & MAX_SN;
+                            tx_resp->frame_count) & IEEE80211_MAX_SN;
 }
 
 static void iwl_rx_reply_tx_agg(struct iwl_priv *priv,
@@ -1148,7 +1149,7 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
 
         if (tx_resp->frame_count == 1) {
                 u16 next_reclaimed = le16_to_cpu(tx_resp->seq_ctl);
-                next_reclaimed = SEQ_TO_SN(next_reclaimed + 0x10);
+                next_reclaimed = IEEE80211_SEQ_TO_SN(next_reclaimed + 0x10);
 
                 if (is_agg) {
                         /* If this is an aggregation queue, we can rely on the
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 205aab851e5f..7f9c254292a8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -114,9 +114,6 @@
  * completely agnostic to these differences.
  * The transport does provide helper functionnality (i.e. SYNC / ASYNC mode),
  */
-#define SEQ_TO_SN(seq) (((seq) & IEEE80211_SCTL_SEQ) >> 4)
-#define SN_TO_SEQ(ssn) (((ssn) << 4) & IEEE80211_SCTL_SEQ)
-#define MAX_SN ((IEEE80211_SCTL_SEQ) >> 4)
 #define SEQ_TO_QUEUE(s) (((s) >> 8) & 0x1f)
 #define QUEUE_TO_SEQ(q) (((q) & 0x1f) << 8)
 #define SEQ_TO_INDEX(s) ((s) & 0xff)
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index ccbeaed60943..de4e0e476f4e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -1139,7 +1139,8 @@ static void iwl_mvm_mac_update_tkip_key(struct ieee80211_hw *hw,
 static int iwl_mvm_roc(struct ieee80211_hw *hw,
                        struct ieee80211_vif *vif,
                        struct ieee80211_channel *channel,
-                       int duration)
+                       int duration,
+                       enum ieee80211_roc_type type)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
         struct cfg80211_chan_def chandef;
@@ -1150,8 +1151,8 @@ static int iwl_mvm_roc(struct ieee80211_hw *hw,
                 return -EINVAL;
         }
 
-        IWL_DEBUG_MAC80211(mvm, "enter (%d, %d)\n", channel->hw_value,
-                           duration);
+        IWL_DEBUG_MAC80211(mvm, "enter (%d, %d, %d)\n", channel->hw_value,
+                           duration, type);
 
         mutex_lock(&mvm->mutex);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 4872ec23b371..4d872d69577f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -733,7 +733,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         spin_lock_bh(&mvmsta->lock);
         tid_data = &mvmsta->tid_data[tid];
-        tid_data->ssn = SEQ_TO_SN(tid_data->seq_number);
+        tid_data->ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
         tid_data->txq_id = txq_id;
         *ssn = tid_data->ssn;
 
@@ -836,7 +836,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 
         switch (tid_data->state) {
         case IWL_AGG_ON:
-                tid_data->ssn = SEQ_TO_SN(tid_data->seq_number);
+                tid_data->ssn = IEEE80211_SEQ_TO_SN(tid_data->seq_number);
 
                 IWL_DEBUG_TX_QUEUES(mvm,
                                     "ssn = %d, next_recl = %d\n",
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index ccff2e5f71a6..0acc0bff43c7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -637,7 +637,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                 next_reclaimed = ssn;
         } else {
                 /* The next packet to be reclaimed is the one after this one */
-                next_reclaimed = SEQ_TO_SN(seq_ctl + 0x10);
+                next_reclaimed = IEEE80211_SEQ_TO_SN(seq_ctl + 0x10);
         }
 
         IWL_DEBUG_TX_REPLY(mvm,
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index b29034d9c963..a4508c2fa92b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1612,7 +1612,7 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
          * Check here that the packets are in the right place on the ring.
          */
 #ifdef CONFIG_IWLWIFI_DEBUG
-        wifi_seq = SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
+        wifi_seq = IEEE80211_SEQ_TO_SN(le16_to_cpu(hdr->seq_ctrl));
         WARN_ONCE((iwl_read_prph(trans, SCD_AGGR_SEL) & BIT(txq_id)) &&
                   ((wifi_seq & 0xff) != q->write_ptr),
                   "Q: %d WiFi Seq %d tfdNum %d",
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 739309e70d8b..45578335e420 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -825,6 +825,11 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
 
         sdio_release_host(func);
 
+        /* Set fw_ready before queuing any commands so that
+         * lbs_thread won't block from sending them to firmware.
+         */
+        priv->fw_ready = 1;
+
         /*
          * FUNC_INIT is required for SD8688 WLAN/BT multiple functions
          */
@@ -839,7 +844,6 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
                         netdev_alert(priv->dev, "CMD_FUNC_INIT cmd failed\n");
         }
 
-        priv->fw_ready = 1;
         wake_up(&card->pwron_waitq);
 
         if (!card->started) {
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index cffdf4fbf161..7490c4fc7177 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -1535,7 +1535,8 @@ static void hw_roc_done(struct work_struct *work)
 static int mac80211_hwsim_roc(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif,
                               struct ieee80211_channel *chan,
-                              int duration)
+                              int duration,
+                              enum ieee80211_roc_type type)
 {
         struct mac80211_hwsim_data *hwsim = hw->priv;
 
diff --git a/drivers/net/wireless/mwifiex/Makefile b/drivers/net/wireless/mwifiex/Makefile
index 97b245cbafd8..ecf28464367f 100644
--- a/drivers/net/wireless/mwifiex/Makefile
+++ b/drivers/net/wireless/mwifiex/Makefile
@@ -39,6 +39,7 @@ mwifiex-y += sta_tx.o
 mwifiex-y += sta_rx.o
 mwifiex-y += uap_txrx.o
 mwifiex-y += cfg80211.o
+mwifiex-y += ethtool.o
 mwifiex-$(CONFIG_DEBUG_FS) += debugfs.o
 obj-$(CONFIG_MWIFIEX) += mwifiex.o
 
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a44023a7bd57..dbf5b1289516 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1932,66 +1932,10 @@ static void mwifiex_setup_vht_caps(struct ieee80211_sta_vht_cap *vht_info,
                                    struct mwifiex_private *priv)
 {
         struct mwifiex_adapter *adapter = priv->adapter;
-        u32 vht_cap = 0, cap = adapter->hw_dot_11ac_dev_cap;
 
         vht_info->vht_supported = true;
 
-        switch (GET_VHTCAP_MAXMPDULEN(cap)) {
-        case 0x00:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895;
-                break;
-        case 0x01:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
-                break;
-        case 0x10:
-                vht_cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454;
-            break;
-        default:
-            dev_err(adapter->dev, "unsupported MAX MPDU len\n");
-            break;
-        }
-
-        if (ISSUPP_11ACVHTHTCVHT(cap))
-                vht_cap |= IEEE80211_VHT_CAP_HTC_VHT;
-
-        if (ISSUPP_11ACVHTTXOPPS(cap))
-                vht_cap |= IEEE80211_VHT_CAP_VHT_TXOP_PS;
-
-        if (ISSUPP_11ACMURXBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
-
-        if (ISSUPP_11ACMUTXBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
-
-        if (ISSUPP_11ACSUBEAMFORMER(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE;
-
-        if (ISSUPP_11ACSUBEAMFORMEE(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
-
-        if (ISSUPP_11ACRXSTBC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_RXSTBC_1;
-
-        if (ISSUPP_11ACTXSTBC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_TXSTBC;
-
-        if (ISSUPP_11ACSGI160(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SHORT_GI_160;
-
-        if (ISSUPP_11ACSGI80(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SHORT_GI_80;
-
-        if (ISSUPP_11ACLDPC(cap))
-                vht_cap |= IEEE80211_VHT_CAP_RXLDPC;
-
-        if (ISSUPP_11ACBW8080(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
-
-        if (ISSUPP_11ACBW160(cap))
-                vht_cap |= IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
-
-        vht_info->cap = vht_cap;
-
+        vht_info->cap = adapter->hw_dot_11ac_dev_cap;
         /* Update MCS support for VHT */
         vht_info->vht_mcs.rx_mcs_map = cpu_to_le16(
                                 adapter->hw_dot_11ac_mcs_support & 0xFFFF);
@@ -2235,6 +2179,7 @@ struct wireless_dev *mwifiex_add_virtual_intf(struct wiphy *wiphy,
         dev->flags |= IFF_BROADCAST | IFF_MULTICAST;
         dev->watchdog_timeo = MWIFIEX_DEFAULT_WATCHDOG_TIMEOUT;
         dev->hard_header_len += MWIFIEX_MIN_DATA_HEADER_LEN;
+        dev->ethtool_ops = &mwifiex_ethtool_ops;
 
         mdev_priv = netdev_priv(dev);
         *((unsigned long *) mdev_priv) = (unsigned long) priv;
@@ -2293,6 +2238,152 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev)
 }
 EXPORT_SYMBOL_GPL(mwifiex_del_virtual_intf);
 
+#ifdef CONFIG_PM
+static bool
+mwifiex_is_pattern_supported(struct cfg80211_wowlan_trig_pkt_pattern *pat,
+                             s8 *byte_seq)
+{
+        int j, k, valid_byte_cnt = 0;
+        bool dont_care_byte = false;
+
+        for (j = 0; j < DIV_ROUND_UP(pat->pattern_len, 8); j++) {
+                for (k = 0; k < 8; k++) {
+                        if (pat->mask[j] & 1 << k) {
+                                memcpy(byte_seq + valid_byte_cnt,
+                                       &pat->pattern[j * 8 + k], 1);
+                                valid_byte_cnt++;
+                                if (dont_care_byte)
+                                        return false;
+                        } else {
+                                if (valid_byte_cnt)
+                                        dont_care_byte = true;
+                        }
+
+                        if (valid_byte_cnt > MAX_BYTESEQ)
+                                return false;
+                }
+        }
+
+        byte_seq[MAX_BYTESEQ] = valid_byte_cnt;
+
+        return true;
+}
+
+static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
+                                    struct cfg80211_wowlan *wowlan)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_ds_mef_cfg mef_cfg;
+        struct mwifiex_mef_entry *mef_entry;
+        int i, filt_num = 0, ret;
+        bool first_pat = true;
+        u8 byte_seq[MAX_BYTESEQ + 1];
+        const u8 ipv4_mc_mac[] = {0x33, 0x33};
+        const u8 ipv6_mc_mac[] = {0x01, 0x00, 0x5e};
+        struct mwifiex_private *priv =
+                        mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA);
+
+        if (!wowlan) {
+                dev_warn(adapter->dev, "None of the WOWLAN triggers enabled\n");
+                return 0;
+        }
+
+        if (!priv->media_connected) {
+                dev_warn(adapter->dev,
+                         "Can not configure WOWLAN in disconnected state\n");
+                return 0;
+        }
+
+        mef_entry = kzalloc(sizeof(*mef_entry), GFP_KERNEL);
+        if (!mef_entry)
+                return -ENOMEM;
+
+        memset(&mef_cfg, 0, sizeof(mef_cfg));
+        mef_cfg.num_entries = 1;
+        mef_cfg.mef_entry = mef_entry;
+        mef_entry->mode = MEF_MODE_HOST_SLEEP;
+        mef_entry->action = MEF_ACTION_ALLOW_AND_WAKEUP_HOST;
+
+        for (i = 0; i < wowlan->n_patterns; i++) {
+                memset(byte_seq, 0, sizeof(byte_seq));
+                if (!mwifiex_is_pattern_supported(&wowlan->patterns[i],
+                                                  byte_seq)) {
+                        wiphy_err(wiphy, "Pattern not supported\n");
+                        kfree(mef_entry);
+                        return -EOPNOTSUPP;
+                }
+
+                if (!wowlan->patterns[i].pkt_offset) {
+                        if (!(byte_seq[0] & 0x01) &&
+                            (byte_seq[MAX_BYTESEQ] == 1)) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
+                                continue;
+                        } else if (is_broadcast_ether_addr(byte_seq)) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_BROADCAST;
+                                continue;
+                        } else if ((!memcmp(byte_seq, ipv4_mc_mac, 2) &&
+                                    (byte_seq[MAX_BYTESEQ] == 2)) ||
+                                   (!memcmp(byte_seq, ipv6_mc_mac, 3) &&
+                                    (byte_seq[MAX_BYTESEQ] == 3))) {
+                                mef_cfg.criteria |= MWIFIEX_CRITERIA_MULTICAST;
+                                continue;
+                        }
+                }
+
+                mef_entry->filter[filt_num].repeat = 1;
+                mef_entry->filter[filt_num].offset =
+                                                wowlan->patterns[i].pkt_offset;
+                memcpy(mef_entry->filter[filt_num].byte_seq, byte_seq,
+                       sizeof(byte_seq));
+                mef_entry->filter[filt_num].filt_type = TYPE_EQ;
+
+                if (first_pat)
+                        first_pat = false;
+                else
+                        mef_entry->filter[filt_num].filt_action = TYPE_AND;
+
+                filt_num++;
+        }
+
+        if (wowlan->magic_pkt) {
+                mef_cfg.criteria |= MWIFIEX_CRITERIA_UNICAST;
+                mef_entry->filter[filt_num].repeat = 16;
+                memcpy(mef_entry->filter[filt_num].byte_seq, priv->curr_addr,
+                       ETH_ALEN);
+                mef_entry->filter[filt_num].byte_seq[MAX_BYTESEQ] = ETH_ALEN;
+                mef_entry->filter[filt_num].offset = 14;
+                mef_entry->filter[filt_num].filt_type = TYPE_EQ;
+                if (filt_num)
+                        mef_entry->filter[filt_num].filt_action = TYPE_OR;
+        }
+
+        if (!mef_cfg.criteria)
+                mef_cfg.criteria = MWIFIEX_CRITERIA_BROADCAST |
+                                   MWIFIEX_CRITERIA_UNICAST |
+                                   MWIFIEX_CRITERIA_MULTICAST;
+
+        ret =  mwifiex_send_cmd_sync(priv, HostCmd_CMD_MEF_CFG,
+                                     HostCmd_ACT_GEN_SET, 0,
+                                     &mef_cfg);
+
+        kfree(mef_entry);
+        return ret;
+}
+
+static int mwifiex_cfg80211_resume(struct wiphy *wiphy)
+{
+        return 0;
+}
+
+static void mwifiex_cfg80211_set_wakeup(struct wiphy *wiphy,
+                                       bool enabled)
+{
+        struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+
+        device_set_wakeup_enable(adapter->dev, enabled);
+}
+#endif
+
 /* station cfg80211 operations */
 static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .add_virtual_intf = mwifiex_add_virtual_intf,
@@ -2321,6 +2412,11 @@ static struct cfg80211_ops mwifiex_cfg80211_ops = {
         .change_beacon = mwifiex_cfg80211_change_beacon,
         .set_cqm_rssi_config = mwifiex_cfg80211_set_cqm_rssi_config,
         .set_antenna = mwifiex_cfg80211_set_antenna,
+#ifdef CONFIG_PM
+        .suspend = mwifiex_cfg80211_suspend,
+        .resume = mwifiex_cfg80211_resume,
+        .set_wakeup = mwifiex_cfg80211_set_wakeup,
+#endif
 };
 
 /*
@@ -2379,6 +2475,14 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
 
         wiphy_apply_custom_regulatory(wiphy, &mwifiex_world_regdom_custom);
 
+#ifdef CONFIG_PM
+        wiphy->wowlan.flags = WIPHY_WOWLAN_MAGIC_PKT;
+        wiphy->wowlan.n_patterns = MWIFIEX_MAX_FILTERS;
+        wiphy->wowlan.pattern_min_len = 1;
+        wiphy->wowlan.pattern_max_len = MWIFIEX_MAX_PATTERN_LEN;
+        wiphy->wowlan.max_pkt_offset = MWIFIEX_MAX_OFFSET_LEN;
+#endif
+
         wiphy->probe_resp_offload = NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
                                     NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
                                     NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index 20a6c5555873..d19a88c47a4d 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -1139,7 +1139,7 @@ int mwifiex_ret_802_11_hs_cfg(struct mwifiex_private *priv,
                         phs_cfg->params.hs_config.gpio,
                         phs_cfg->params.hs_config.gap);
         }
-        if (conditions != HOST_SLEEP_CFG_CANCEL) {
+        if (conditions != HS_CFG_CANCEL) {
                 adapter->is_hs_configured = true;
                 if (adapter->iface_type == MWIFIEX_USB ||
                     adapter->iface_type == MWIFIEX_PCIE)
diff --git a/drivers/net/wireless/mwifiex/ethtool.c b/drivers/net/wireless/mwifiex/ethtool.c
new file mode 100644
index 000000000000..bfb39908b2c6
--- /dev/null
+++ b/drivers/net/wireless/mwifiex/ethtool.c
@@ -0,0 +1,70 @@
+/*
+ * Marvell Wireless LAN device driver: ethtool
+ *
+ * Copyright (C) 2013, Marvell International Ltd.
+ *
+ * This software file (the "File") is distributed by Marvell International
+ * Ltd. under the terms of the GNU General Public License Version 2, June 1991
+ * (the "License").  You may use, redistribute and/or modify this File in
+ * accordance with the terms and conditions of the License, a copy of which
+ * is available by writing to the Free Software Foundation, Inc.,
+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA or on the
+ * worldwide web at http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt.
+ *
+ * THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
+ * ARE EXPRESSLY DISCLAIMED.  The License provides additional details about
+ * this warranty disclaimer.
+ */
+
+#include "main.h"
+
+static void mwifiex_ethtool_get_wol(struct net_device *dev,
+                                    struct ethtool_wolinfo *wol)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        u32 conditions = le32_to_cpu(priv->adapter->hs_cfg.conditions);
+
+        wol->supported = WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY;
+
+        if (conditions == HS_CFG_COND_DEF)
+                return;
+
+        if (conditions & HS_CFG_COND_UNICAST_DATA)
+                wol->wolopts |= WAKE_UCAST;
+        if (conditions & HS_CFG_COND_MULTICAST_DATA)
+                wol->wolopts |= WAKE_MCAST;
+        if (conditions & HS_CFG_COND_BROADCAST_DATA)
+                wol->wolopts |= WAKE_BCAST;
+        if (conditions & HS_CFG_COND_MAC_EVENT)
+                wol->wolopts |= WAKE_PHY;
+}
+
+static int mwifiex_ethtool_set_wol(struct net_device *dev,
+                                   struct ethtool_wolinfo *wol)
+{
+        struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
+        u32 conditions = 0;
+
+        if (wol->wolopts & ~(WAKE_UCAST|WAKE_MCAST|WAKE_BCAST|WAKE_PHY))
+                return -EOPNOTSUPP;
+
+        if (wol->wolopts & WAKE_UCAST)
+                conditions |= HS_CFG_COND_UNICAST_DATA;
+        if (wol->wolopts & WAKE_MCAST)
+                conditions |= HS_CFG_COND_MULTICAST_DATA;
+        if (wol->wolopts & WAKE_BCAST)
+                conditions |= HS_CFG_COND_BROADCAST_DATA;
+        if (wol->wolopts & WAKE_PHY)
+                conditions |= HS_CFG_COND_MAC_EVENT;
+        if (wol->wolopts == 0)
+                conditions |= HS_CFG_COND_DEF;
+        priv->adapter->hs_cfg.conditions = cpu_to_le32(conditions);
+
+        return 0;
+}
+
+const struct ethtool_ops mwifiex_ethtool_ops = {
+        .get_wol = mwifiex_ethtool_get_wol,
+        .set_wol = mwifiex_ethtool_set_wol,
+};
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 25acb0682c56..57c5defe1f9d 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -230,40 +230,12 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 
 #define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
 
-#define GET_VHTCAP_MAXMPDULEN(vht_cap_info) (vht_cap_info & 0x3)
 #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
 #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
 #define SET_VHTNSSMCS(mcs_mapset, nss, value) (mcs_mapset |= (value & 0x3) << \
                                               (2 * (nss - 1)))
 #define NO_NSS_SUPPORT          0x3
 
-/* HW_SPEC: HTC-VHT supported */
-#define ISSUPP_11ACVHTHTCVHT(Dot11acDevCap) (Dot11acDevCap & BIT(22))
-/* HW_SPEC: VHT TXOP PS support */
-#define ISSUPP_11ACVHTTXOPPS(Dot11acDevCap) (Dot11acDevCap & BIT(21))
-/* HW_SPEC: MU RX beamformee support */
-#define ISSUPP_11ACMURXBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(20))
-/* HW_SPEC: MU TX beamformee support */
-#define ISSUPP_11ACMUTXBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(19))
-/* HW_SPEC: SU Beamformee support */
-#define ISSUPP_11ACSUBEAMFORMEE(Dot11acDevCap) (Dot11acDevCap & BIT(10))
-/* HW_SPEC: SU Beamformer support */
-#define ISSUPP_11ACSUBEAMFORMER(Dot11acDevCap) (Dot11acDevCap & BIT(9))
-/* HW_SPEC: Rx STBC support */
-#define ISSUPP_11ACRXSTBC(Dot11acDevCap) (Dot11acDevCap & BIT(8))
-/* HW_SPEC: Tx STBC support */
-#define ISSUPP_11ACTXSTBC(Dot11acDevCap) (Dot11acDevCap & BIT(7))
-/* HW_SPEC: Short GI support for 160MHz BW */
-#define ISSUPP_11ACSGI160(Dot11acDevCap) (Dot11acDevCap & BIT(6))
-/* HW_SPEC: Short GI support for 80MHz BW */
-#define ISSUPP_11ACSGI80(Dot11acDevCap) (Dot11acDevCap & BIT(5))
-/* HW_SPEC: LDPC coding support */
-#define ISSUPP_11ACLDPC(Dot11acDevCap) (Dot11acDevCap & BIT(4))
-/* HW_SPEC: Channel BW 20/40/80/160/80+80 MHz support */
-#define ISSUPP_11ACBW8080(Dot11acDevCap) (Dot11acDevCap & BIT(3))
-/* HW_SPEC: Channel BW 20/40/80/160 MHz support */
-#define ISSUPP_11ACBW160(Dot11acDevCap) (Dot11acDevCap & BIT(2))
-
 #define GET_DEVTXMCSMAP(dev_mcs_map)      (dev_mcs_map >> 16)
 #define GET_DEVRXMCSMAP(dev_mcs_map)      (dev_mcs_map & 0xFFFF)
 
@@ -300,6 +272,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 #define HostCmd_CMD_802_11_TX_RATE_QUERY              0x007f
 #define HostCmd_CMD_802_11_IBSS_COALESCING_STATUS     0x0083
 #define HostCmd_CMD_VERSION_EXT                       0x0097
+#define HostCmd_CMD_MEF_CFG                           0x009a
 #define HostCmd_CMD_RSSI_INFO                         0x00a4
 #define HostCmd_CMD_FUNC_INIT                         0x00a9
 #define HostCmd_CMD_FUNC_SHUTDOWN                     0x00aa
@@ -376,10 +349,14 @@ enum P2P_MODES {
 #define HostCmd_SCAN_RADIO_TYPE_BG          0
 #define HostCmd_SCAN_RADIO_TYPE_A           1
 
-#define HOST_SLEEP_CFG_CANCEL           0xffffffff
-#define HOST_SLEEP_CFG_COND_DEF         0x00000000
-#define HOST_SLEEP_CFG_GPIO_DEF         0xff
-#define HOST_SLEEP_CFG_GAP_DEF          0
+#define HS_CFG_CANCEL                   0xffffffff
+#define HS_CFG_COND_DEF                 0x00000000
+#define HS_CFG_GPIO_DEF                 0xff
+#define HS_CFG_GAP_DEF                  0
+#define HS_CFG_COND_BROADCAST_DATA      0x00000001
+#define HS_CFG_COND_UNICAST_DATA        0x00000002
+#define HS_CFG_COND_MAC_EVENT           0x00000004
+#define HS_CFG_COND_MULTICAST_DATA      0x00000008
 
 #define MWIFIEX_TIMEOUT_FOR_AP_RESP             0xfffc
 #define MWIFIEX_STATUS_CODE_AUTH_TIMEOUT        2
@@ -469,6 +446,23 @@ enum P2P_MODES {
 #define EVENT_GET_BSS_TYPE(event_cause)         \
         (((event_cause) >> 24) & 0x00ff)
 
+#define MWIFIEX_MAX_PATTERN_LEN         20
+#define MWIFIEX_MAX_OFFSET_LEN          50
+#define STACK_NBYTES                    100
+#define TYPE_DNUM                       1
+#define TYPE_BYTESEQ                    2
+#define MAX_OPERAND                     0x40
+#define TYPE_EQ                         (MAX_OPERAND+1)
+#define TYPE_EQ_DNUM                    (MAX_OPERAND+2)
+#define TYPE_EQ_BIT                     (MAX_OPERAND+3)
+#define TYPE_AND                        (MAX_OPERAND+4)
+#define TYPE_OR                         (MAX_OPERAND+5)
+#define MEF_MODE_HOST_SLEEP                     1
+#define MEF_ACTION_ALLOW_AND_WAKEUP_HOST        3
+#define MWIFIEX_CRITERIA_BROADCAST      BIT(0)
+#define MWIFIEX_CRITERIA_UNICAST        BIT(1)
+#define MWIFIEX_CRITERIA_MULTICAST      BIT(3)
+
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -1499,6 +1493,19 @@ struct host_cmd_ds_802_11_ibss_status {
         __le16 use_g_rate_protect;
 } __packed;
 
+struct mwifiex_fw_mef_entry {
+        u8 mode;
+        u8 action;
+        __le16 exprsize;
+        u8 expr[0];
+} __packed;
+
+struct host_cmd_ds_mef_cfg {
+        __le32 criteria;
+        __le16 num_entries;
+        struct mwifiex_fw_mef_entry mef_entry[0];
+} __packed;
+
 #define CONNECTION_TYPE_INFRA   0
 #define CONNECTION_TYPE_ADHOC   1
 #define CONNECTION_TYPE_AP      2
@@ -1603,6 +1610,7 @@ struct host_cmd_ds_command {
                 struct host_cmd_ds_remain_on_chan roc_cfg;
                 struct host_cmd_ds_p2p_mode_cfg mode_cfg;
                 struct host_cmd_ds_802_11_ibss_status ibss_coalescing;
+                struct host_cmd_ds_mef_cfg mef_cfg;
                 struct host_cmd_ds_mac_reg_access mac_reg;
                 struct host_cmd_ds_bbp_reg_access bbp_reg;
                 struct host_cmd_ds_rf_reg_access rf_reg;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index e38aa9b3663d..cab3434d0d52 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -318,9 +318,9 @@ static void mwifiex_init_adapter(struct mwifiex_adapter *adapter)
         adapter->curr_tx_buf_size = MWIFIEX_TX_DATA_BUF_SIZE_2K;
 
         adapter->is_hs_configured = false;
-        adapter->hs_cfg.conditions = cpu_to_le32(HOST_SLEEP_CFG_COND_DEF);
-        adapter->hs_cfg.gpio = HOST_SLEEP_CFG_GPIO_DEF;
-        adapter->hs_cfg.gap = HOST_SLEEP_CFG_GAP_DEF;
+        adapter->hs_cfg.conditions = cpu_to_le32(HS_CFG_COND_DEF);
+        adapter->hs_cfg.gpio = HS_CFG_GPIO_DEF;
+        adapter->hs_cfg.gap = HS_CFG_GAP_DEF;
         adapter->hs_activated = false;
 
         memset(adapter->event_body, 0, sizeof(adapter->event_body));
diff --git a/drivers/net/wireless/mwifiex/ioctl.h b/drivers/net/wireless/mwifiex/ioctl.h
index d85e6eb1f58a..91d522c746ed 100644
--- a/drivers/net/wireless/mwifiex/ioctl.h
+++ b/drivers/net/wireless/mwifiex/ioctl.h
@@ -354,6 +354,29 @@ struct mwifiex_ds_misc_subsc_evt {
         struct subsc_evt_cfg bcn_h_rssi_cfg;
 };
 
+#define MAX_BYTESEQ             6       /* non-adjustable */
+#define MWIFIEX_MAX_FILTERS     10
+
+struct mwifiex_mef_filter {
+        u16 repeat;
+        u16 offset;
+        s8 byte_seq[MAX_BYTESEQ + 1];
+        u8 filt_type;
+        u8 filt_action;
+};
+
+struct mwifiex_mef_entry {
+        u8 mode;
+        u8 action;
+        struct mwifiex_mef_filter filter[MWIFIEX_MAX_FILTERS];
+};
+
+struct mwifiex_ds_mef_cfg {
+        u32 criteria;
+        u16 num_entries;
+        struct mwifiex_mef_entry *mef_entry;
+};
+
 #define MWIFIEX_MAX_VSIE_LEN       (256)
 #define MWIFIEX_MAX_VSIE_NUM       (8)
 #define MWIFIEX_VSIE_MASK_CLEAR    0x00
diff --git a/drivers/net/wireless/mwifiex/join.c b/drivers/net/wireless/mwifiex/join.c
index 246aa62a4817..2fe0ceba4400 100644
--- a/drivers/net/wireless/mwifiex/join.c
+++ b/drivers/net/wireless/mwifiex/join.c
@@ -1117,10 +1117,9 @@ mwifiex_cmd_802_11_ad_hoc_join(struct mwifiex_private *priv,
                 adhoc_join->bss_descriptor.bssid,
                 adhoc_join->bss_descriptor.ssid);
 
-        for (i = 0; bss_desc->supported_rates[i] &&
-                        i < MWIFIEX_SUPPORTED_RATES;
-                        i++)
-                        ;
+        for (i = 0; i < MWIFIEX_SUPPORTED_RATES &&
+                    bss_desc->supported_rates[i]; i++)
+                ;
         rates_size = i;
 
         /* Copy Data Rates from the Rates recorded in scan response */
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 9c802ede9c3b..121443a0f2a1 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -588,10 +588,19 @@ mwifiex_tx_timeout(struct net_device *dev)
 {
         struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev);
 
-        dev_err(priv->adapter->dev, "%lu : Tx timeout, bss_type-num = %d-%d\n",
-                jiffies, priv->bss_type, priv->bss_num);
-        mwifiex_set_trans_start(dev);
         priv->num_tx_timeout++;
+        priv->tx_timeout_cnt++;
+        dev_err(priv->adapter->dev,
+                "%lu : Tx timeout(#%d), bss_type-num = %d-%d\n",
+                jiffies, priv->tx_timeout_cnt, priv->bss_type, priv->bss_num);
+        mwifiex_set_trans_start(dev);
+
+        if (priv->tx_timeout_cnt > TX_TIMEOUT_THRESHOLD &&
+            priv->adapter->if_ops.card_reset) {
+                dev_err(priv->adapter->dev,
+                        "tx_timeout_cnt exceeds threshold. Triggering card reset!\n");
+                priv->adapter->if_ops.card_reset(priv->adapter);
+        }
 }
 
 /*
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 553adfb0aa81..920657587fff 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -130,6 +130,9 @@ enum {
 #define MWIFIEX_USB_TYPE_DATA                   0xBEADC0DE
 #define MWIFIEX_USB_TYPE_EVENT                  0xBEEFFACE
 
+/* Threshold for tx_timeout_cnt before we trigger a card reset */
+#define TX_TIMEOUT_THRESHOLD    6
+
 struct mwifiex_dbg {
         u32 num_cmd_host_to_card_failure;
         u32 num_cmd_sleep_cfm_host_to_card_failure;
@@ -394,6 +397,8 @@ struct mwifiex_private {
         u8 curr_addr[ETH_ALEN];
         u8 media_connected;
         u32 num_tx_timeout;
+        /* track consecutive timeout */
+        u8 tx_timeout_cnt;
         struct net_device *netdev;
         struct net_device_stats stats;
         u16 curr_pkt_filter;
@@ -1098,11 +1103,15 @@ int mwifiex_del_virtual_intf(struct wiphy *wiphy, struct wireless_dev *wdev);
 
 void mwifiex_set_sys_config_invalid_data(struct mwifiex_uap_bss_param *config);
 
+int mwifiex_add_wowlan_magic_pkt_filter(struct mwifiex_adapter *adapter);
+
 int mwifiex_set_mgmt_ies(struct mwifiex_private *priv,
                          struct cfg80211_beacon_data *data);
 int mwifiex_del_mgmt_ies(struct mwifiex_private *priv);
 u8 *mwifiex_11d_code_2_region(u8 code);
 
+extern const struct ethtool_ops mwifiex_ethtool_ops;
+
 #ifdef CONFIG_DEBUG_FS
 void mwifiex_debugfs_init(void);
 void mwifiex_debugfs_remove(void);
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 35c79722c361..6283294398bf 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -36,8 +36,6 @@ static u8 user_rmmod;
 static struct mwifiex_if_ops pcie_ops;
 
 static struct semaphore add_remove_card_sem;
-static int mwifiex_pcie_enable_host_int(struct mwifiex_adapter *adapter);
-static int mwifiex_pcie_resume(struct pci_dev *pdev);
 
 static int
 mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
@@ -78,6 +76,82 @@ static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
         return false;
 }
 
+#ifdef CONFIG_PM
+/*
+ * Kernel needs to suspend all functions separately. Therefore all
+ * registered functions must have drivers with suspend and resume
+ * methods. Failing that the kernel simply removes the whole card.
+ *
+ * If already not suspended, this function allocates and sends a host
+ * sleep activate request to the firmware and turns off the traffic.
+ */
+static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
+{
+        struct mwifiex_adapter *adapter;
+        struct pcie_service_card *card;
+        int hs_actived;
+
+        if (pdev) {
+                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                if (!card || !card->adapter) {
+                        pr_err("Card or adapter structure is not valid\n");
+                        return 0;
+                }
+        } else {
+                pr_err("PCIE device is not specified\n");
+                return 0;
+        }
+
+        adapter = card->adapter;
+
+        hs_actived = mwifiex_enable_hs(adapter);
+
+        /* Indicate device suspended */
+        adapter->is_suspended = true;
+
+        return 0;
+}
+
+/*
+ * Kernel needs to suspend all functions separately. Therefore all
+ * registered functions must have drivers with suspend and resume
+ * methods. Failing that the kernel simply removes the whole card.
+ *
+ * If already not resumed, this function turns on the traffic and
+ * sends a host sleep cancel request to the firmware.
+ */
+static int mwifiex_pcie_resume(struct pci_dev *pdev)
+{
+        struct mwifiex_adapter *adapter;
+        struct pcie_service_card *card;
+
+        if (pdev) {
+                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
+                if (!card || !card->adapter) {
+                        pr_err("Card or adapter structure is not valid\n");
+                        return 0;
+                }
+        } else {
+                pr_err("PCIE device is not specified\n");
+                return 0;
+        }
+
+        adapter = card->adapter;
+
+        if (!adapter->is_suspended) {
+                dev_warn(adapter->dev, "Device already resumed\n");
+                return 0;
+        }
+
+        adapter->is_suspended = false;
+
+        mwifiex_cancel_hs(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA),
+                          MWIFIEX_ASYNC_CMD);
+
+        return 0;
+}
+#endif
+
 /*
  * This function probes an mwifiex device and registers it. It allocates
  * the card structure, enables PCIE function number and initiates the
@@ -159,80 +233,6 @@ static void mwifiex_pcie_remove(struct pci_dev *pdev)
         kfree(card);
 }
 
-/*
- * Kernel needs to suspend all functions separately. Therefore all
- * registered functions must have drivers with suspend and resume
- * methods. Failing that the kernel simply removes the whole card.
- *
- * If already not suspended, this function allocates and sends a host
- * sleep activate request to the firmware and turns off the traffic.
- */
-static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
-{
-        struct mwifiex_adapter *adapter;
-        struct pcie_service_card *card;
-        int hs_actived;
-
-        if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || !card->adapter) {
-                        pr_err("Card or adapter structure is not valid\n");
-                        return 0;
-                }
-        } else {
-                pr_err("PCIE device is not specified\n");
-                return 0;
-        }
-
-        adapter = card->adapter;
-
-        hs_actived = mwifiex_enable_hs(adapter);
-
-        /* Indicate device suspended */
-        adapter->is_suspended = true;
-
-        return 0;
-}
-
-/*
- * Kernel needs to suspend all functions separately. Therefore all
- * registered functions must have drivers with suspend and resume
- * methods. Failing that the kernel simply removes the whole card.
- *
- * If already not resumed, this function turns on the traffic and
- * sends a host sleep cancel request to the firmware.
- */
-static int mwifiex_pcie_resume(struct pci_dev *pdev)
-{
-        struct mwifiex_adapter *adapter;
-        struct pcie_service_card *card;
-
-        if (pdev) {
-                card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || !card->adapter) {
-                        pr_err("Card or adapter structure is not valid\n");
-                        return 0;
-                }
-        } else {
-                pr_err("PCIE device is not specified\n");
-                return 0;
-        }
-
-        adapter = card->adapter;
-
-        if (!adapter->is_suspended) {
-                dev_warn(adapter->dev, "Device already resumed\n");
-                return 0;
-        }
-
-        adapter->is_suspended = false;
-
-        mwifiex_cancel_hs(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_STA),
-                          MWIFIEX_ASYNC_CMD);
-
-        return 0;
-}
-
 static DEFINE_PCI_DEVICE_TABLE(mwifiex_ids) = {
         {
                 PCIE_VENDOR_ID_MARVELL, PCIE_DEVICE_ID_MARVELL_88W8766P,
@@ -302,7 +302,7 @@ static int mwifiex_pm_wakeup_card(struct mwifiex_adapter *adapter)
                 i++;
                 usleep_range(10, 20);
                 /* 50ms max wait */
-                if (i == 50000)
+                if (i == 5000)
                         break;
         }
 
@@ -1030,8 +1030,8 @@ mwifiex_pcie_send_data(struct mwifiex_adapter *adapter, struct sk_buff *skb,
         u32 wrindx, num_tx_buffs, rx_val;
         int ret;
         dma_addr_t buf_pa;
-        struct mwifiex_pcie_buf_desc *desc;
-        struct mwifiex_pfu_buf_desc *desc2;
+        struct mwifiex_pcie_buf_desc *desc = NULL;
+        struct mwifiex_pfu_buf_desc *desc2 = NULL;
         __le16 *tmp;
 
         if (!(skb->data && skb->len)) {
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index c55c5bb93134..a2ae690a0a67 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -334,7 +334,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
         cmd->command = cpu_to_le16(HostCmd_CMD_802_11_HS_CFG_ENH);
 
         if (!hs_activate &&
-            (hscfg_param->conditions != cpu_to_le32(HOST_SLEEP_CFG_CANCEL)) &&
+            (hscfg_param->conditions != cpu_to_le32(HS_CFG_CANCEL)) &&
             ((adapter->arp_filter_size > 0) &&
              (adapter->arp_filter_size <= ARP_FILTER_MAX_BUF_SIZE))) {
                 dev_dbg(adapter->dev,
@@ -1059,6 +1059,80 @@ mwifiex_cmd_802_11_subsc_evt(struct mwifiex_private *priv,
         return 0;
 }
 
+static int
+mwifiex_cmd_append_rpn_expression(struct mwifiex_private *priv,
+                                  struct mwifiex_mef_entry *mef_entry,
+                                  u8 **buffer)
+{
+        struct mwifiex_mef_filter *filter = mef_entry->filter;
+        int i, byte_len;
+        u8 *stack_ptr = *buffer;
+
+        for (i = 0; i < MWIFIEX_MAX_FILTERS; i++) {
+                filter = &mef_entry->filter[i];
+                if (!filter->filt_type)
+                        break;
+                *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->repeat);
+                stack_ptr += 4;
+                *stack_ptr = TYPE_DNUM;
+                stack_ptr += 1;
+
+                byte_len = filter->byte_seq[MAX_BYTESEQ];
+                memcpy(stack_ptr, filter->byte_seq, byte_len);
+                stack_ptr += byte_len;
+                *stack_ptr = byte_len;
+                stack_ptr += 1;
+                *stack_ptr = TYPE_BYTESEQ;
+                stack_ptr += 1;
+
+                *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->offset);
+                stack_ptr += 4;
+                *stack_ptr = TYPE_DNUM;
+                stack_ptr += 1;
+
+                *stack_ptr = filter->filt_type;
+                stack_ptr += 1;
+
+                if (filter->filt_action) {
+                        *stack_ptr = filter->filt_action;
+                        stack_ptr += 1;
+                }
+
+                if (stack_ptr - *buffer > STACK_NBYTES)
+                        return -1;
+        }
+
+        *buffer = stack_ptr;
+        return 0;
+}
+
+static int
+mwifiex_cmd_mef_cfg(struct mwifiex_private *priv,
+                    struct host_cmd_ds_command *cmd,
+                    struct mwifiex_ds_mef_cfg *mef)
+{
+        struct host_cmd_ds_mef_cfg *mef_cfg = &cmd->params.mef_cfg;
+        u8 *pos = (u8 *)mef_cfg;
+
+        cmd->command = cpu_to_le16(HostCmd_CMD_MEF_CFG);
+
+        mef_cfg->criteria = cpu_to_le32(mef->criteria);
+        mef_cfg->num_entries = cpu_to_le16(mef->num_entries);
+        pos += sizeof(*mef_cfg);
+        mef_cfg->mef_entry->mode = mef->mef_entry->mode;
+        mef_cfg->mef_entry->action = mef->mef_entry->action;
+        pos += sizeof(*(mef_cfg->mef_entry));
+
+        if (mwifiex_cmd_append_rpn_expression(priv, mef->mef_entry, &pos))
+                return -1;
+
+        mef_cfg->mef_entry->exprsize =
+                        cpu_to_le16(pos - mef_cfg->mef_entry->expr);
+        cmd->size = cpu_to_le16((u16) (pos - (u8 *)mef_cfg) + S_DS_GEN);
+
+        return 0;
+}
+
 /*
  * This function prepares the commands before sending them to the firmware.
  *
@@ -1273,6 +1347,9 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
         case HostCmd_CMD_802_11_SUBSCRIBE_EVENT:
                 ret = mwifiex_cmd_802_11_subsc_evt(priv, cmd_ptr, data_buf);
                 break;
+        case HostCmd_CMD_MEF_CFG:
+                ret = mwifiex_cmd_mef_cfg(priv, cmd_ptr, data_buf);
+                break;
         default:
                 dev_err(priv->adapter->dev,
                         "PREP_CMD: unknown cmd- %#x\n", cmd_no);
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 4669f8d9389f..80b9f2238001 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -976,6 +976,8 @@ int mwifiex_process_sta_cmdresp(struct mwifiex_private *priv, u16 cmdresp_no,
         case HostCmd_CMD_UAP_BSS_STOP:
                 priv->bss_started = 0;
                 break;
+        case HostCmd_CMD_MEF_CFG:
+                break;
         default:
                 dev_err(adapter->dev, "CMD_RESP: unknown cmd response %#x\n",
                         resp->command);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index 9f33c92c90f5..76d31deb7b1b 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -388,7 +388,7 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                         break;
                 }
                 if (hs_cfg->is_invoke_hostcmd) {
-                        if (hs_cfg->conditions == HOST_SLEEP_CFG_CANCEL) {
+                        if (hs_cfg->conditions == HS_CFG_CANCEL) {
                                 if (!adapter->is_hs_configured)
                                         /* Already cancelled */
                                         break;
@@ -403,8 +403,8 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                                 adapter->hs_cfg.gpio = (u8)hs_cfg->gpio;
                                 if (hs_cfg->gap)
                                         adapter->hs_cfg.gap = (u8)hs_cfg->gap;
-                        } else if (adapter->hs_cfg.conditions
-                                   == cpu_to_le32(HOST_SLEEP_CFG_CANCEL)) {
+                        } else if (adapter->hs_cfg.conditions ==
+                                   cpu_to_le32(HS_CFG_CANCEL)) {
                                 /* Return failure if no parameters for HS
                                    enable */
                                 status = -1;
@@ -420,7 +420,7 @@ static int mwifiex_set_hs_params(struct mwifiex_private *priv, u16 action,
                                                 HostCmd_CMD_802_11_HS_CFG_ENH,
                                                 HostCmd_ACT_GEN_SET, 0,
                                                 &adapter->hs_cfg);
-                        if (hs_cfg->conditions == HOST_SLEEP_CFG_CANCEL)
+                        if (hs_cfg->conditions == HS_CFG_CANCEL)
                                 /* Restore previous condition */
                                 adapter->hs_cfg.conditions =
                                                 cpu_to_le32(prev_cond);
@@ -454,7 +454,7 @@ int mwifiex_cancel_hs(struct mwifiex_private *priv, int cmd_type)
 {
         struct mwifiex_ds_hs_cfg hscfg;
 
-        hscfg.conditions = HOST_SLEEP_CFG_CANCEL;
+        hscfg.conditions = HS_CFG_CANCEL;
         hscfg.is_invoke_hostcmd = true;
 
         return mwifiex_set_hs_params(priv, HostCmd_ACT_GEN_SET,
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 296faec14365..8f923d0d2ba6 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -169,6 +169,8 @@ int mwifiex_write_data_complete(struct mwifiex_adapter *adapter,
         if (!status) {
                 priv->stats.tx_packets++;
                 priv->stats.tx_bytes += skb->len;
+                if (priv->tx_timeout_cnt)
+                        priv->tx_timeout_cnt = 0;
         } else {
                 priv->stats.tx_errors++;
         }
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index 21553976b550..54667e65ca47 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -195,7 +195,7 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
         skb->protocol = eth_type_trans(skb, priv->netdev);
         skb->ip_summed = CHECKSUM_NONE;
 
-        /* This is required only in case of 11n and USB as we alloc
+        /* This is required only in case of 11n and USB/PCIE as we alloc
          * a buffer of 4K only if its 11N (to be able to receive 4K
          * AMSDU packets). In case of SD we allocate buffers based
          * on the size of packet and hence this is not needed.
@@ -212,7 +212,8 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
          * fragments. Currently we fail the Filesndl-ht.scr script
          * for UDP, hence this fix
          */
-        if ((priv->adapter->iface_type == MWIFIEX_USB) &&
+        if ((priv->adapter->iface_type == MWIFIEX_USB ||
+             priv->adapter->iface_type == MWIFIEX_PCIE) &&
             (skb->truesize > MWIFIEX_RX_DATA_BUF_SIZE))
                 skb->truesize += (skb->len - MWIFIEX_RX_DATA_BUF_SIZE);
 
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index 091d9a64080a..0640e7d7f0c2 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -232,6 +232,7 @@ struct mwl8k_priv {
         u16 num_mcaddrs;
         u8 hw_rev;
         u32 fw_rev;
+        u32 caps;
 
         /*
          * Running count of TX packets in flight, to avoid
@@ -284,6 +285,7 @@ struct mwl8k_priv {
         unsigned fw_state;
         char *fw_pref;
         char *fw_alt;
+        bool is_8764;
         struct completion firmware_loading_complete;
 
         /* bitmap of running BSSes */
@@ -600,13 +602,18 @@ mwl8k_send_fw_load_cmd(struct mwl8k_priv *priv, void *data, int length)
         loops = 1000;
         do {
                 u32 int_code;
-
-                int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
-                if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
-                        iowrite32(0, regs + MWL8K_HIU_INT_CODE);
-                        break;
+                if (priv->is_8764) {
+                        int_code = ioread32(regs +
+                                            MWL8K_HIU_H2A_INTERRUPT_STATUS);
+                        if (int_code == 0)
+                                break;
+                } else {
+                        int_code = ioread32(regs + MWL8K_HIU_INT_CODE);
+                        if (int_code == MWL8K_INT_CODE_CMD_FINISHED) {
+                                iowrite32(0, regs + MWL8K_HIU_INT_CODE);
+                                break;
+                        }
                 }
-
                 cond_resched();
                 udelay(1);
         } while (--loops);
@@ -724,7 +731,7 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
         int rc;
         int loops;
 
-        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4)) {
+        if (!memcmp(fw->data, "\x01\x00\x00\x00", 4) && !priv->is_8764) {
                 const struct firmware *helper = priv->fw_helper;
 
                 if (helper == NULL) {
@@ -743,7 +750,10 @@ static int mwl8k_load_firmware(struct ieee80211_hw *hw)
 
                 rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
         } else {
-                rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
+                if (priv->is_8764)
+                        rc = mwl8k_feed_fw_image(priv, fw->data, fw->size);
+                else
+                        rc = mwl8k_load_fw_image(priv, fw->data, fw->size);
         }
 
         if (rc) {
@@ -908,9 +918,9 @@ static void mwl8k_encapsulate_tx_frame(struct mwl8k_priv *priv,
 }
 
 /*
- * Packet reception for 88w8366 AP firmware.
+ * Packet reception for 88w8366/88w8764 AP firmware.
  */
-struct mwl8k_rxd_8366_ap {
+struct mwl8k_rxd_ap {
         __le16 pkt_len;
         __u8 sq2;
         __u8 rate;
@@ -928,30 +938,30 @@ struct mwl8k_rxd_8366_ap {
         __u8 rx_ctrl;
 } __packed;
 
-#define MWL8K_8366_AP_RATE_INFO_MCS_FORMAT      0x80
-#define MWL8K_8366_AP_RATE_INFO_40MHZ           0x40
-#define MWL8K_8366_AP_RATE_INFO_RATEID(x)       ((x) & 0x3f)
+#define MWL8K_AP_RATE_INFO_MCS_FORMAT           0x80
+#define MWL8K_AP_RATE_INFO_40MHZ                0x40
+#define MWL8K_AP_RATE_INFO_RATEID(x)            ((x) & 0x3f)
 
-#define MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST     0x80
+#define MWL8K_AP_RX_CTRL_OWNED_BY_HOST          0x80
 
-/* 8366 AP rx_status bits */
-#define MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK           0x80
-#define MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR        0xFF
-#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR       0x02
-#define MWL8K_8366_AP_RXSTAT_WEP_DECRYPT_ICV_ERR        0x04
-#define MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR       0x08
+/* 8366/8764 AP rx_status bits */
+#define MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK                0x80
+#define MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR             0xFF
+#define MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR            0x02
+#define MWL8K_AP_RXSTAT_WEP_DECRYPT_ICV_ERR             0x04
+#define MWL8K_AP_RXSTAT_TKIP_DECRYPT_ICV_ERR            0x08
 
-static void mwl8k_rxd_8366_ap_init(void *_rxd, dma_addr_t next_dma_addr)
+static void mwl8k_rxd_ap_init(void *_rxd, dma_addr_t next_dma_addr)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
         rxd->next_rxd_phys_addr = cpu_to_le32(next_dma_addr);
-        rxd->rx_ctrl = MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST;
+        rxd->rx_ctrl = MWL8K_AP_RX_CTRL_OWNED_BY_HOST;
 }
 
-static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
+static void mwl8k_rxd_ap_refill(void *_rxd, dma_addr_t addr, int len)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
         rxd->pkt_len = cpu_to_le16(len);
         rxd->pkt_phys_addr = cpu_to_le32(addr);
@@ -960,12 +970,12 @@ static void mwl8k_rxd_8366_ap_refill(void *_rxd, dma_addr_t addr, int len)
 }
 
 static int
-mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
-                          __le16 *qos, s8 *noise)
+mwl8k_rxd_ap_process(void *_rxd, struct ieee80211_rx_status *status,
+                     __le16 *qos, s8 *noise)
 {
-        struct mwl8k_rxd_8366_ap *rxd = _rxd;
+        struct mwl8k_rxd_ap *rxd = _rxd;
 
-        if (!(rxd->rx_ctrl & MWL8K_8366_AP_RX_CTRL_OWNED_BY_HOST))
+        if (!(rxd->rx_ctrl & MWL8K_AP_RX_CTRL_OWNED_BY_HOST))
                 return -1;
         rmb();
 
@@ -974,11 +984,11 @@ mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
         status->signal = -rxd->rssi;
         *noise = -rxd->noise_floor;
 
-        if (rxd->rate & MWL8K_8366_AP_RATE_INFO_MCS_FORMAT) {
+        if (rxd->rate & MWL8K_AP_RATE_INFO_MCS_FORMAT) {
                 status->flag |= RX_FLAG_HT;
-                if (rxd->rate & MWL8K_8366_AP_RATE_INFO_40MHZ)
+                if (rxd->rate & MWL8K_AP_RATE_INFO_40MHZ)
                         status->flag |= RX_FLAG_40MHZ;
-                status->rate_idx = MWL8K_8366_AP_RATE_INFO_RATEID(rxd->rate);
+                status->rate_idx = MWL8K_AP_RATE_INFO_RATEID(rxd->rate);
         } else {
                 int i;
 
@@ -1002,19 +1012,19 @@ mwl8k_rxd_8366_ap_process(void *_rxd, struct ieee80211_rx_status *status,
 
         *qos = rxd->qos_control;
 
-        if ((rxd->rx_status != MWL8K_8366_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
-            (rxd->rx_status & MWL8K_8366_AP_RXSTAT_DECRYPT_ERR_MASK) &&
-            (rxd->rx_status & MWL8K_8366_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
+        if ((rxd->rx_status != MWL8K_AP_RXSTAT_GENERAL_DECRYPT_ERR) &&
+            (rxd->rx_status & MWL8K_AP_RXSTAT_DECRYPT_ERR_MASK) &&
+            (rxd->rx_status & MWL8K_AP_RXSTAT_TKIP_DECRYPT_MIC_ERR))
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
         return le16_to_cpu(rxd->pkt_len);
 }
 
-static struct rxd_ops rxd_8366_ap_ops = {
-        .rxd_size       = sizeof(struct mwl8k_rxd_8366_ap),
-        .rxd_init       = mwl8k_rxd_8366_ap_init,
-        .rxd_refill     = mwl8k_rxd_8366_ap_refill,
-        .rxd_process    = mwl8k_rxd_8366_ap_process,
+static struct rxd_ops rxd_ap_ops = {
+        .rxd_size       = sizeof(struct mwl8k_rxd_ap),
+        .rxd_init       = mwl8k_rxd_ap_init,
+        .rxd_refill     = mwl8k_rxd_ap_refill,
+        .rxd_process    = mwl8k_rxd_ap_process,
 };
 
 /*
@@ -2401,6 +2411,9 @@ mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
 {
         struct mwl8k_priv *priv = hw->priv;
 
+        if (priv->caps)
+                return;
+
         if ((caps & MWL8K_CAP_2GHZ4) || !(caps & MWL8K_CAP_BAND_MASK)) {
                 mwl8k_setup_2ghz_band(hw);
                 if (caps & MWL8K_CAP_MIMO)
@@ -2412,6 +2425,8 @@ mwl8k_set_caps(struct ieee80211_hw *hw, u32 caps)
                 if (caps & MWL8K_CAP_MIMO)
                         mwl8k_set_ht_caps(hw, &priv->band_50, caps);
         }
+
+        priv->caps = caps;
 }
 
 static int mwl8k_cmd_get_hw_spec_sta(struct ieee80211_hw *hw)
@@ -5429,12 +5444,17 @@ enum {
         MWL8363 = 0,
         MWL8687,
         MWL8366,
+        MWL8764,
 };
 
 #define MWL8K_8366_AP_FW_API 3
 #define _MWL8K_8366_AP_FW(api) "mwl8k/fmimage_8366_ap-" #api ".fw"
 #define MWL8K_8366_AP_FW(api) _MWL8K_8366_AP_FW(api)
 
+#define MWL8K_8764_AP_FW_API 1
+#define _MWL8K_8764_AP_FW(api) "mwl8k/fmimage_8764_ap-" #api ".fw"
+#define MWL8K_8764_AP_FW(api) _MWL8K_8764_AP_FW(api)
+
 static struct mwl8k_device_info mwl8k_info_tbl[] = {
         [MWL8363] = {
                 .part_name      = "88w8363",
@@ -5452,7 +5472,13 @@ static struct mwl8k_device_info mwl8k_info_tbl[] = {
                 .fw_image_sta   = "mwl8k/fmimage_8366.fw",
                 .fw_image_ap    = MWL8K_8366_AP_FW(MWL8K_8366_AP_FW_API),
                 .fw_api_ap      = MWL8K_8366_AP_FW_API,
-                .ap_rxd_ops     = &rxd_8366_ap_ops,
+                .ap_rxd_ops     = &rxd_ap_ops,
+        },
+        [MWL8764] = {
+                .part_name      = "88w8764",
+                .fw_image_ap    = MWL8K_8764_AP_FW(MWL8K_8764_AP_FW_API),
+                .fw_api_ap      = MWL8K_8764_AP_FW_API,
+                .ap_rxd_ops     = &rxd_ap_ops,
         },
 };
 
@@ -5474,6 +5500,7 @@ static DEFINE_PCI_DEVICE_TABLE(mwl8k_pci_id_table) = {
         { PCI_VDEVICE(MARVELL, 0x2a41), .driver_data = MWL8366, },
         { PCI_VDEVICE(MARVELL, 0x2a42), .driver_data = MWL8366, },
         { PCI_VDEVICE(MARVELL, 0x2a43), .driver_data = MWL8366, },
+        { PCI_VDEVICE(MARVELL, 0x2b36), .driver_data = MWL8764, },
         { },
 };
 MODULE_DEVICE_TABLE(pci, mwl8k_pci_id_table);
@@ -5995,6 +6022,8 @@ static int mwl8k_probe(struct pci_dev *pdev,
         priv->pdev = pdev;
         priv->device_info = &mwl8k_info_tbl[id->driver_data];
 
+        if (id->driver_data == MWL8764)
+                priv->is_8764 = true;
 
         priv->sram = pci_iomap(pdev, 0, 0x10000);
         if (priv->sram == NULL) {
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index 7744f42de1ea..1f9cb55c3360 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -1584,7 +1584,7 @@ static int ezusb_probe(struct usb_interface *interface,
         struct ezusb_priv *upriv = NULL;
         struct usb_interface_descriptor *iface_desc;
         struct usb_endpoint_descriptor *ep;
-        const struct firmware *fw_entry;
+        const struct firmware *fw_entry = NULL;
         int retval = 0;
         int i;
 
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 3109c0db66e1..4775b5d172d5 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -144,7 +144,7 @@ static int psm;
 static char *essid;
 
 /* Default to encapsulation unless translation requested */
-static int translate = 1;
+static bool translate = 1;
 
 static int country = USA;
 
@@ -178,7 +178,7 @@ module_param(hop_dwell, int, 0);
 module_param(beacon_period, int, 0);
 module_param(psm, int, 0);
 module_param(essid, charp, 0);
-module_param(translate, int, 0);
+module_param(translate, bool, 0);
 module_param(country, int, 0);
 module_param(sniffer, int, 0);
 module_param(bc, int, 0);
@@ -1353,7 +1353,7 @@ static int ray_get_range(struct net_device *dev, struct iw_request_info *info,
 static int ray_set_framing(struct net_device *dev, struct iw_request_info *info,
                            union iwreq_data *wrqu, char *extra)
 {
-        translate = *(extra);   /* Set framing mode */
+        translate = !!*(extra); /* Set framing mode */
 
         return 0;
 }
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 525fd7521dff..8169a85c4498 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2,7 +2,7 @@
  * Driver for RNDIS based wireless USB devices.
  *
  * Copyright (C) 2007 by Bjorge Dijkstra <bjd@jooz.net>
- * Copyright (C) 2008-2009 by Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
+ * Copyright (C) 2008-2009 by Jussi Kivilinna <jussi.kivilinna@iki.fi>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -2839,8 +2839,7 @@ static void rndis_wlan_do_link_up_work(struct usbnet *usbdev)
         } else if (priv->infra_mode == NDIS_80211_INFRA_ADHOC)
                 cfg80211_ibss_joined(usbdev->net, bssid, GFP_KERNEL);
 
-        if (info != NULL)
-                kfree(info);
+        kfree(info);
 
         priv->connected = true;
         memcpy(priv->bssid, bssid, ETH_ALEN);
diff --git a/drivers/net/wireless/rt2x00/Kconfig b/drivers/net/wireless/rt2x00/Kconfig
index 44d6ead43341..ffe61d53e3fe 100644
--- a/drivers/net/wireless/rt2x00/Kconfig
+++ b/drivers/net/wireless/rt2x00/Kconfig
@@ -55,10 +55,10 @@ config RT61PCI
 
 config RT2800PCI
         tristate "Ralink rt27xx/rt28xx/rt30xx (PCI/PCIe/PCMCIA) support"
-        depends on PCI || RALINK_RT288X || RALINK_RT305X
+        depends on PCI || SOC_RT288X || SOC_RT305X
         select RT2800_LIB
         select RT2X00_LIB_PCI if PCI
-        select RT2X00_LIB_SOC if RALINK_RT288X || RALINK_RT305X
+        select RT2X00_LIB_SOC if SOC_RT288X || SOC_RT305X
         select RT2X00_LIB_FIRMWARE
         select RT2X00_LIB_CRYPTO
         select CRC_CCITT
@@ -169,6 +169,13 @@ config RT2800USB_RT53XX
          rt2800usb driver.
          Supported chips: RT5370
 
+config RT2800USB_RT55XX
+       bool "rt2800usb - Include support for rt55xx devices (EXPERIMENTAL)"
+       ---help---
+         This adds support for rt55xx wireless chipset family to the
+         rt2800usb driver.
+         Supported chips: RT5572
+
 config RT2800USB_UNKNOWN
         bool "rt2800usb - Include support for unknown (USB) devices"
         default n
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index 4db1088a847f..a7630d5ec892 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -51,6 +51,7 @@
  * RF3320 2.4G 1T1R(RT3350/RT3370/RT3390)
  * RF3322 2.4G 2T2R(RT3352/RT3371/RT3372/RT3391/RT3392)
  * RF3053 2.4G/5G 3T3R(RT3883/RT3563/RT3573/RT3593/RT3662)
+ * RF5592 2.4G/5G 2T2R
  * RF5360 2.4G 1T1R
  * RF5370 2.4G 1T1R
  * RF5390 2.4G 1T1R
@@ -68,6 +69,7 @@
 #define RF3320                          0x000b
 #define RF3322                          0x000c
 #define RF3053                          0x000d
+#define RF5592                          0x000f
 #define RF3290                          0x3290
 #define RF5360                          0x5360
 #define RF5370                          0x5370
@@ -88,11 +90,8 @@
 #define REV_RT3390E                     0x0211
 #define REV_RT5390F                     0x0502
 #define REV_RT5390R                     0x1502
+#define REV_RT5592C                     0x0221
 
-/*
- * Signal information.
- * Default offset is required for RSSI <-> dBm conversion.
- */
 #define DEFAULT_RSSI_OFFSET             120
 
 /*
@@ -690,6 +689,12 @@
 #define GPIO_SWITCH_7                   FIELD32(0x00000080)
 
 /*
+ * FIXME: where the DEBUG_INDEX name come from?
+ */
+#define MAC_DEBUG_INDEX                 0x05e8
+#define MAC_DEBUG_INDEX_XTAL            FIELD32(0x80000000)
+
+/*
  * MAC Control/Status Registers(CSR).
  * Some values are set in TU, whereas 1 TU == 1024 us.
  */
@@ -1934,6 +1939,9 @@ struct mac_iveiv_entry {
 #define BBP4_BANDWIDTH                  FIELD8(0x18)
 #define BBP4_MAC_IF_CTRL                FIELD8(0x40)
 
+/* BBP27 */
+#define BBP27_RX_CHAIN_SEL              FIELD8(0x60)
+
 /*
  * BBP 47: Bandwidth
  */
@@ -1948,6 +1956,20 @@ struct mac_iveiv_entry {
 #define BBP49_UPDATE_FLAG               FIELD8(0x01)
 
 /*
+ * BBP 105:
+ * - bit0: detect SIG on primary channel only (on 40MHz bandwidth)
+ * - bit1: FEQ (Feed Forward Compensation) for independend streams
+ * - bit2: MLD (Maximum Likehood Detection) for 2 streams (reserved on single
+ *         stream)
+ * - bit4: channel estimation updates based on remodulation of
+ *         L-SIG and HT-SIG symbols
+ */
+#define BBP105_DETECT_SIG_ON_PRIMARY    FIELD8(0x01)
+#define BBP105_FEQ                      FIELD8(0x02)
+#define BBP105_MLD                      FIELD8(0x04)
+#define BBP105_SIG_REMODULATION         FIELD8(0x08)
+
+/*
  * BBP 109
  */
 #define BBP109_TX0_POWER                FIELD8(0x0f)
@@ -1967,6 +1989,11 @@ struct mac_iveiv_entry {
 #define BBP152_RX_DEFAULT_ANT           FIELD8(0x80)
 
 /*
+ * BBP 254: unknown
+ */
+#define BBP254_BIT7                     FIELD8(0x80)
+
+/*
  * RFCSR registers
  * The wordsize of the RFCSR is 8 bits.
  */
@@ -2022,9 +2049,18 @@ struct mac_iveiv_entry {
 #define RFCSR7_BITS67                   FIELD8(0xc0)
 
 /*
+ * RFCSR 9:
+ */
+#define RFCSR9_K                        FIELD8(0x0f)
+#define RFCSR9_N                        FIELD8(0x10)
+#define RFCSR9_UNKNOWN                  FIELD8(0x60)
+#define RFCSR9_MOD                      FIELD8(0x80)
+
+/*
  * RFCSR 11:
  */
 #define RFCSR11_R                       FIELD8(0x03)
+#define RFCSR11_MOD                     FIELD8(0xc0)
 
 /*
  * RFCSR 12:
@@ -2130,11 +2166,13 @@ struct mac_iveiv_entry {
  * RFCSR 49:
  */
 #define RFCSR49_TX                      FIELD8(0x3f)
+#define RFCSR49_EP                      FIELD8(0xc0)
 
 /*
  * RFCSR 50:
  */
 #define RFCSR50_TX                      FIELD8(0x3f)
+#define RFCSR50_EP                      FIELD8(0xc0)
 
 /*
  * RF registers
@@ -2497,6 +2535,61 @@ struct mac_iveiv_entry {
 #define EEPROM_BBP_REG_ID               FIELD16(0xff00)
 
 /*
+ * EEPROM IQ Calibration, unlike other entries those are byte addresses.
+ */
+
+#define EEPROM_IQ_GAIN_CAL_TX0_2G                       0x130
+#define EEPROM_IQ_PHASE_CAL_TX0_2G                      0x131
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_2G                 0x132
+#define EEPROM_IQ_GAIN_CAL_TX1_2G                       0x133
+#define EEPROM_IQ_PHASE_CAL_TX1_2G                      0x134
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_2G                 0x135
+#define EEPROM_IQ_GAIN_CAL_RX0_2G                       0x136
+#define EEPROM_IQ_PHASE_CAL_RX0_2G                      0x137
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_2G                 0x138
+#define EEPROM_IQ_GAIN_CAL_RX1_2G                       0x139
+#define EEPROM_IQ_PHASE_CAL_RX1_2G                      0x13A
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_2G                 0x13B
+#define EEPROM_RF_IQ_COMPENSATION_CONTROL               0x13C
+#define EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CONTROL     0x13D
+#define EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5G          0x144
+#define EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5G         0x145
+#define EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5G        0X146
+#define EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5G       0x147
+#define EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5G        0x148
+#define EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5G       0x149
+#define EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5G          0x14A
+#define EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5G         0x14B
+#define EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5G        0X14C
+#define EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5G       0x14D
+#define EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5G        0x14E
+#define EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5G       0x14F
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH36_TO_CH64_5G    0x150
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH36_TO_CH64_5G    0x151
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH100_TO_CH138_5G  0x152
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH100_TO_CH138_5G  0x153
+#define EEPROM_IQ_GROUPDELAY_CAL_TX0_CH140_TO_CH165_5G  0x154
+#define EEPROM_IQ_GROUPDELAY_CAL_TX1_CH140_TO_CH165_5G  0x155
+#define EEPROM_IQ_GAIN_CAL_RX0_CH36_TO_CH64_5G          0x156
+#define EEPROM_IQ_PHASE_CAL_RX0_CH36_TO_CH64_5G         0x157
+#define EEPROM_IQ_GAIN_CAL_RX0_CH100_TO_CH138_5G        0X158
+#define EEPROM_IQ_PHASE_CAL_RX0_CH100_TO_CH138_5G       0x159
+#define EEPROM_IQ_GAIN_CAL_RX0_CH140_TO_CH165_5G        0x15A
+#define EEPROM_IQ_PHASE_CAL_RX0_CH140_TO_CH165_5G       0x15B
+#define EEPROM_IQ_GAIN_CAL_RX1_CH36_TO_CH64_5G          0x15C
+#define EEPROM_IQ_PHASE_CAL_RX1_CH36_TO_CH64_5G         0x15D
+#define EEPROM_IQ_GAIN_CAL_RX1_CH100_TO_CH138_5G        0X15E
+#define EEPROM_IQ_PHASE_CAL_RX1_CH100_TO_CH138_5G       0x15F
+#define EEPROM_IQ_GAIN_CAL_RX1_CH140_TO_CH165_5G        0x160
+#define EEPROM_IQ_PHASE_CAL_RX1_CH140_TO_CH165_5G       0x161
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH36_TO_CH64_5G    0x162
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH36_TO_CH64_5G    0x163
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH100_TO_CH138_5G  0x164
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH100_TO_CH138_5G  0x165
+#define EEPROM_IQ_GROUPDELAY_CAL_RX0_CH140_TO_CH165_5G  0x166
+#define EEPROM_IQ_GROUPDELAY_CAL_RX1_CH140_TO_CH165_5G  0x167
+
+/*
  * MCU mailbox commands.
  * MCU_SLEEP - go to power-save mode.
  *             arg1: 1: save as much power as possible, 0: save less power.
@@ -2535,6 +2628,8 @@ struct mac_iveiv_entry {
 #define TXWI_DESC_SIZE                  (4 * sizeof(__le32))
 #define RXWI_DESC_SIZE                  (4 * sizeof(__le32))
 
+#define TXWI_DESC_SIZE_5592             (5 * sizeof(__le32))
+#define RXWI_DESC_SIZE_5592             (6 * sizeof(__le32))
 /*
  * TX WI structure
  */
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index a658b4bc7da2..f08a0424fe4d 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -527,8 +527,10 @@ int rt2800_load_firmware(struct rt2x00_dev *rt2x00dev,
          */
         rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
         rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
-        if (rt2x00_is_usb(rt2x00dev))
+        if (rt2x00_is_usb(rt2x00dev)) {
                 rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        }
         msleep(1);
 
         return 0;
@@ -674,11 +676,6 @@ void rt2800_process_rxwi(struct queue_entry *entry,
          * Convert descriptor AGC value to RSSI value.
          */
         rxdesc->rssi = rt2800_agc_to_rssi(entry->queue->rt2x00dev, word);
-
-        /*
-         * Remove RXWI descriptor from start of buffer.
-         */
-        skb_pull(entry->skb, RXWI_DESC_SIZE);
 }
 EXPORT_SYMBOL_GPL(rt2800_process_rxwi);
 
@@ -1988,8 +1985,21 @@ static void rt2800_config_channel_rf3052(struct rt2x00_dev *rt2x00dev,
 }
 
 #define POWER_BOUND             0x27
+#define POWER_BOUND_5G          0x2b
 #define FREQ_OFFSET_BOUND       0x5f
 
+static void rt2800_adjust_freq_offset(struct rt2x00_dev *rt2x00dev)
+{
+        u8 rfcsr;
+
+        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
+        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
+        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+}
+
 static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                                          struct ieee80211_conf *conf,
                                          struct rf_channel *rf,
@@ -2010,12 +2020,7 @@ static void rt2800_config_channel_rf3290(struct rt2x00_dev *rt2x00dev,
                 rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
         rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         if (rf->channel <= 14) {
                 if (rf->channel == 6)
@@ -2056,13 +2061,7 @@ static void rt2800_config_channel_rf3322(struct rt2x00_dev *rt2x00dev,
         else
                 rt2800_rfcsr_write(rt2x00dev, 48, info->default_power2);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         rt2800_rfcsr_read(rt2x00dev, 1, &rfcsr);
         rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD, 1);
@@ -2127,12 +2126,7 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD, 1);
         rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
 
-        rt2800_rfcsr_read(rt2x00dev, 17, &rfcsr);
-        if (rt2x00dev->freq_offset > FREQ_OFFSET_BOUND)
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, FREQ_OFFSET_BOUND);
-        else
-                rt2x00_set_field8(&rfcsr, RFCSR17_CODE, rt2x00dev->freq_offset);
-        rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
+        rt2800_adjust_freq_offset(rt2x00dev);
 
         if (rf->channel <= 14) {
                 int idx = rf->channel-1;
@@ -2184,6 +2178,382 @@ static void rt2800_config_channel_rf53xx(struct rt2x00_dev *rt2x00dev,
         }
 }
 
+static void rt2800_config_channel_rf55xx(struct rt2x00_dev *rt2x00dev,
+                                         struct ieee80211_conf *conf,
+                                         struct rf_channel *rf,
+                                         struct channel_info *info)
+{
+        u8 rfcsr, ep_reg;
+        u32 reg;
+        int power_bound;
+
+        /* TODO */
+        const bool is_11b = false;
+        const bool is_type_ep = false;
+
+        rt2800_register_read(rt2x00dev, LDO_CFG0, &reg);
+        rt2x00_set_field32(&reg, LDO_CFG0_LDO_CORE_VLEVEL,
+                           (rf->channel > 14 || conf_is_ht40(conf)) ? 5 : 0);
+        rt2800_register_write(rt2x00dev, LDO_CFG0, reg);
+
+        /* Order of values on rf_channel entry: N, K, mod, R */
+        rt2800_rfcsr_write(rt2x00dev, 8, rf->rf1 & 0xff);
+
+        rt2800_rfcsr_read(rt2x00dev,  9, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR9_K, rf->rf2 & 0xf);
+        rt2x00_set_field8(&rfcsr, RFCSR9_N, (rf->rf1 & 0x100) >> 8);
+        rt2x00_set_field8(&rfcsr, RFCSR9_MOD, ((rf->rf3 - 8) & 0x4) >> 2);
+        rt2800_rfcsr_write(rt2x00dev, 9, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 11, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR11_R, rf->rf4 - 1);
+        rt2x00_set_field8(&rfcsr, RFCSR11_MOD, (rf->rf3 - 8) & 0x3);
+        rt2800_rfcsr_write(rt2x00dev, 11, rfcsr);
+
+        if (rf->channel <= 14) {
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x90);
+                /* FIXME: RF11 owerwrite ? */
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x4A);
+                rt2800_rfcsr_write(rt2x00dev, 12, 0x52);
+                rt2800_rfcsr_write(rt2x00dev, 13, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 22, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 24, 0x4A);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 36, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 37, 0x08);
+                rt2800_rfcsr_write(rt2x00dev, 38, 0x89);
+                rt2800_rfcsr_write(rt2x00dev, 39, 0x1B);
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x0D);
+                rt2800_rfcsr_write(rt2x00dev, 41, 0x9B);
+                rt2800_rfcsr_write(rt2x00dev, 42, 0xD5);
+                rt2800_rfcsr_write(rt2x00dev, 43, 0x72);
+                rt2800_rfcsr_write(rt2x00dev, 44, 0x0E);
+                rt2800_rfcsr_write(rt2x00dev, 45, 0xA2);
+                rt2800_rfcsr_write(rt2x00dev, 46, 0x6B);
+                rt2800_rfcsr_write(rt2x00dev, 48, 0x10);
+                rt2800_rfcsr_write(rt2x00dev, 51, 0x3E);
+                rt2800_rfcsr_write(rt2x00dev, 52, 0x48);
+                rt2800_rfcsr_write(rt2x00dev, 54, 0x38);
+                rt2800_rfcsr_write(rt2x00dev, 56, 0xA1);
+                rt2800_rfcsr_write(rt2x00dev, 57, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 58, 0x39);
+                rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
+                rt2800_rfcsr_write(rt2x00dev, 61, 0x91);
+                rt2800_rfcsr_write(rt2x00dev, 62, 0x39);
+
+                /* TODO RF27 <- tssi */
+
+                rfcsr = rf->channel <= 10 ? 0x07 : 0x06;
+                rt2800_rfcsr_write(rt2x00dev, 23, rfcsr);
+                rt2800_rfcsr_write(rt2x00dev, 59, rfcsr);
+
+                if (is_11b) {
+                        /* CCK */
+                        rt2800_rfcsr_write(rt2x00dev, 31, 0xF8);
+                        rt2800_rfcsr_write(rt2x00dev, 32, 0xC0);
+                        if (is_type_ep)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x06);
+                        else
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x47);
+                } else {
+                        /* OFDM */
+                        if (is_type_ep)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x03);
+                        else
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x43);
+                }
+
+                power_bound = POWER_BOUND;
+                ep_reg = 0x2;
+        } else {
+                rt2800_rfcsr_write(rt2x00dev, 10, 0x97);
+                /* FIMXE: RF11 overwrite */
+                rt2800_rfcsr_write(rt2x00dev, 11, 0x40);
+                rt2800_rfcsr_write(rt2x00dev, 25, 0xBF);
+                rt2800_rfcsr_write(rt2x00dev, 27, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 36, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 37, 0x04);
+                rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
+                rt2800_rfcsr_write(rt2x00dev, 40, 0x42);
+                rt2800_rfcsr_write(rt2x00dev, 41, 0xBB);
+                rt2800_rfcsr_write(rt2x00dev, 42, 0xD7);
+                rt2800_rfcsr_write(rt2x00dev, 45, 0x41);
+                rt2800_rfcsr_write(rt2x00dev, 48, 0x00);
+                rt2800_rfcsr_write(rt2x00dev, 57, 0x77);
+                rt2800_rfcsr_write(rt2x00dev, 60, 0x05);
+                rt2800_rfcsr_write(rt2x00dev, 61, 0x01);
+
+                /* TODO RF27 <- tssi */
+
+                if (rf->channel >= 36 && rf->channel <= 64) {
+
+                        rt2800_rfcsr_write(rt2x00dev, 12, 0x2E);
+                        rt2800_rfcsr_write(rt2x00dev, 13, 0x22);
+                        rt2800_rfcsr_write(rt2x00dev, 22, 0x60);
+                        rt2800_rfcsr_write(rt2x00dev, 23, 0x7F);
+                        if (rf->channel <= 50)
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x09);
+                        else if (rf->channel >= 52)
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x07);
+                        rt2800_rfcsr_write(rt2x00dev, 39, 0x1C);
+                        rt2800_rfcsr_write(rt2x00dev, 43, 0x5B);
+                        rt2800_rfcsr_write(rt2x00dev, 44, 0X40);
+                        rt2800_rfcsr_write(rt2x00dev, 46, 0X00);
+                        rt2800_rfcsr_write(rt2x00dev, 51, 0xFE);
+                        rt2800_rfcsr_write(rt2x00dev, 52, 0x0C);
+                        rt2800_rfcsr_write(rt2x00dev, 54, 0xF8);
+                        if (rf->channel <= 50) {
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x06),
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xD3);
+                        } else if (rf->channel >= 52) {
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x04);
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
+                        }
+
+                        rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+                        rt2800_rfcsr_write(rt2x00dev, 59, 0x7F);
+                        rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
+
+                } else if (rf->channel >= 100 && rf->channel <= 165) {
+
+                        rt2800_rfcsr_write(rt2x00dev, 12, 0x0E);
+                        rt2800_rfcsr_write(rt2x00dev, 13, 0x42);
+                        rt2800_rfcsr_write(rt2x00dev, 22, 0x40);
+                        if (rf->channel <= 153) {
+                                rt2800_rfcsr_write(rt2x00dev, 23, 0x3C);
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x06);
+                        } else if (rf->channel >= 155) {
+                                rt2800_rfcsr_write(rt2x00dev, 23, 0x38);
+                                rt2800_rfcsr_write(rt2x00dev, 24, 0x05);
+                        }
+                        if (rf->channel <= 138) {
+                                rt2800_rfcsr_write(rt2x00dev, 39, 0x1A);
+                                rt2800_rfcsr_write(rt2x00dev, 43, 0x3B);
+                                rt2800_rfcsr_write(rt2x00dev, 44, 0x20);
+                                rt2800_rfcsr_write(rt2x00dev, 46, 0x18);
+                        } else if (rf->channel >= 140) {
+                                rt2800_rfcsr_write(rt2x00dev, 39, 0x18);
+                                rt2800_rfcsr_write(rt2x00dev, 43, 0x1B);
+                                rt2800_rfcsr_write(rt2x00dev, 44, 0x10);
+                                rt2800_rfcsr_write(rt2x00dev, 46, 0X08);
+                        }
+                        if (rf->channel <= 124)
+                                rt2800_rfcsr_write(rt2x00dev, 51, 0xFC);
+                        else if (rf->channel >= 126)
+                                rt2800_rfcsr_write(rt2x00dev, 51, 0xEC);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 52, 0x06);
+                        rt2800_rfcsr_write(rt2x00dev, 54, 0xEB);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x01);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 55, 0x00);
+                        if (rf->channel <= 128)
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xBB);
+                        else if (rf->channel >= 130)
+                                rt2800_rfcsr_write(rt2x00dev, 56, 0xAB);
+                        if (rf->channel <= 116)
+                                rt2800_rfcsr_write(rt2x00dev, 58, 0x1D);
+                        else if (rf->channel >= 118)
+                                rt2800_rfcsr_write(rt2x00dev, 58, 0x15);
+                        if (rf->channel <= 138)
+                                rt2800_rfcsr_write(rt2x00dev, 59, 0x3F);
+                        else if (rf->channel >= 140)
+                                rt2800_rfcsr_write(rt2x00dev, 59, 0x7C);
+                        if (rf->channel <= 116)
+                                rt2800_rfcsr_write(rt2x00dev, 62, 0x1D);
+                        else if (rf->channel >= 118)
+                                rt2800_rfcsr_write(rt2x00dev, 62, 0x15);
+                }
+
+                power_bound = POWER_BOUND_5G;
+                ep_reg = 0x3;
+        }
+
+        rt2800_rfcsr_read(rt2x00dev, 49, &rfcsr);
+        if (info->default_power1 > power_bound)
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, power_bound);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR49_TX, info->default_power1);
+        if (is_type_ep)
+                rt2x00_set_field8(&rfcsr, RFCSR49_EP, ep_reg);
+        rt2800_rfcsr_write(rt2x00dev, 49, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 50, &rfcsr);
+        if (info->default_power1 > power_bound)
+                rt2x00_set_field8(&rfcsr, RFCSR50_TX, power_bound);
+        else
+                rt2x00_set_field8(&rfcsr, RFCSR50_TX, info->default_power2);
+        if (is_type_ep)
+                rt2x00_set_field8(&rfcsr, RFCSR50_EP, ep_reg);
+        rt2800_rfcsr_write(rt2x00dev, 50, rfcsr);
+
+        rt2800_rfcsr_read(rt2x00dev, 1, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RF_BLOCK_EN, 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_PLL_PD, 1);
+
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX0_PD,
+                          rt2x00dev->default_ant.tx_chain_num >= 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX1_PD,
+                          rt2x00dev->default_ant.tx_chain_num == 2);
+        rt2x00_set_field8(&rfcsr, RFCSR1_TX2_PD, 0);
+
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX0_PD,
+                          rt2x00dev->default_ant.rx_chain_num >= 1);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX1_PD,
+                          rt2x00dev->default_ant.rx_chain_num == 2);
+        rt2x00_set_field8(&rfcsr, RFCSR1_RX2_PD, 0);
+
+        rt2800_rfcsr_write(rt2x00dev, 1, rfcsr);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xe4);
+
+        if (conf_is_ht40(conf))
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x16);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 30, 0x10);
+
+        if (!is_11b) {
+                rt2800_rfcsr_write(rt2x00dev, 31, 0x80);
+                rt2800_rfcsr_write(rt2x00dev, 32, 0x80);
+        }
+
+        /* TODO proper frequency adjustment */
+        rt2800_adjust_freq_offset(rt2x00dev);
+
+        /* TODO merge with others */
+        rt2800_rfcsr_read(rt2x00dev, 3, &rfcsr);
+        rt2x00_set_field8(&rfcsr, RFCSR3_VCOCAL_EN, 1);
+        rt2800_rfcsr_write(rt2x00dev, 3, rfcsr);
+
+        /* BBP settings */
+        rt2800_bbp_write(rt2x00dev, 62, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 63, 0x37 - rt2x00dev->lna_gain);
+        rt2800_bbp_write(rt2x00dev, 64, 0x37 - rt2x00dev->lna_gain);
+
+        rt2800_bbp_write(rt2x00dev, 79, (rf->channel <= 14) ? 0x1C : 0x18);
+        rt2800_bbp_write(rt2x00dev, 80, (rf->channel <= 14) ? 0x0E : 0x08);
+        rt2800_bbp_write(rt2x00dev, 81, (rf->channel <= 14) ? 0x3A : 0x38);
+        rt2800_bbp_write(rt2x00dev, 82, (rf->channel <= 14) ? 0x62 : 0x92);
+
+        /* GLRT band configuration */
+        rt2800_bbp_write(rt2x00dev, 195, 128);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0xE0 : 0xF0);
+        rt2800_bbp_write(rt2x00dev, 195, 129);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x1F : 0x1E);
+        rt2800_bbp_write(rt2x00dev, 195, 130);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x38 : 0x28);
+        rt2800_bbp_write(rt2x00dev, 195, 131);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x32 : 0x20);
+        rt2800_bbp_write(rt2x00dev, 195, 133);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x28 : 0x7F);
+        rt2800_bbp_write(rt2x00dev, 195, 124);
+        rt2800_bbp_write(rt2x00dev, 196, (rf->channel <= 14) ? 0x19 : 0x7F);
+}
+
+static void rt2800_bbp_write_with_rx_chain(struct rt2x00_dev *rt2x00dev,
+                                           const unsigned int word,
+                                           const u8 value)
+{
+        u8 chain, reg;
+
+        for (chain = 0; chain < rt2x00dev->default_ant.rx_chain_num; chain++) {
+                rt2800_bbp_read(rt2x00dev, 27, &reg);
+                rt2x00_set_field8(&reg,  BBP27_RX_CHAIN_SEL, chain);
+                rt2800_bbp_write(rt2x00dev, 27, reg);
+
+                rt2800_bbp_write(rt2x00dev, word, value);
+        }
+}
+
+static void rt2800_iq_calibrate(struct rt2x00_dev *rt2x00dev, int channel)
+{
+        u8 cal;
+
+        /* TX0 IQ Gain */
+        rt2800_bbp_write(rt2x00dev, 158, 0x2c);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_GAIN_CAL_TX0_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX0 IQ Phase */
+        rt2800_bbp_write(rt2x00dev, 158, 0x2d);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_PHASE_CAL_TX0_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX1 IQ Gain */
+        rt2800_bbp_write(rt2x00dev, 158, 0x4a);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_GAIN_CAL_TX1_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* TX1 IQ Phase */
+        rt2800_bbp_write(rt2x00dev, 158, 0x4b);
+        if (channel <= 14)
+                cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_IQ_PHASE_CAL_TX1_2G);
+        else if (channel >= 36 && channel <= 64)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5G);
+        else if (channel >= 100 && channel <= 138)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5G);
+        else if (channel >= 140 && channel <= 165)
+                cal = rt2x00_eeprom_byte(rt2x00dev,
+                                         EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5G);
+        else
+                cal = 0;
+        rt2800_bbp_write(rt2x00dev, 159, cal);
+
+        /* FIXME: possible RX0, RX1 callibration ? */
+
+        /* RF IQ compensation control */
+        rt2800_bbp_write(rt2x00dev, 158, 0x04);
+        cal = rt2x00_eeprom_byte(rt2x00dev, EEPROM_RF_IQ_COMPENSATION_CONTROL);
+        rt2800_bbp_write(rt2x00dev, 159, cal != 0xff ? cal : 0);
+
+        /* RF IQ imbalance compensation control */
+        rt2800_bbp_write(rt2x00dev, 158, 0x03);
+        cal = rt2x00_eeprom_byte(rt2x00dev,
+                                 EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CONTROL);
+        rt2800_bbp_write(rt2x00dev, 159, cal != 0xff ? cal : 0);
+}
+
 static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
                                   struct ieee80211_conf *conf,
                                   struct rf_channel *rf,
@@ -2225,6 +2595,9 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         case RF5392:
                 rt2800_config_channel_rf53xx(rt2x00dev, conf, rf, info);
                 break;
+        case RF5592:
+                rt2800_config_channel_rf55xx(rt2x00dev, conf, rf, info);
+                break;
         default:
                 rt2800_config_channel_rf2xxx(rt2x00dev, conf, rf, info);
         }
@@ -2326,6 +2699,17 @@ static void rt2800_config_channel(struct rt2x00_dev *rt2x00dev,
         if (rt2x00_rt(rt2x00dev, RT3572))
                 rt2800_rfcsr_write(rt2x00dev, 8, 0x80);
 
+        if (rt2x00_rt(rt2x00dev, RT5592)) {
+                rt2800_bbp_write(rt2x00dev, 195, 141);
+                rt2800_bbp_write(rt2x00dev, 196, conf_is_ht40(conf) ? 0x10 : 0x1a);
+
+                /* AGC init */
+                reg = (rf->channel <= 14 ? 0x1c : 0x24) + 2 * rt2x00dev->lna_gain;
+                rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, reg);
+
+                rt2800_iq_calibrate(rt2x00dev, rf->channel);
+        }
+
         rt2800_bbp_read(rt2x00dev, 4, &bbp);
         rt2x00_set_field8(&bbp, BBP4_BANDWIDTH, 2 * conf_is_ht40(conf));
         rt2800_bbp_write(rt2x00dev, 4, bbp);
@@ -2938,13 +3322,16 @@ static u8 rt2800_get_default_vgc(struct rt2x00_dev *rt2x00dev)
                     rt2x00_rt(rt2x00dev, RT3390) ||
                     rt2x00_rt(rt2x00dev, RT3572) ||
                     rt2x00_rt(rt2x00dev, RT5390) ||
-                    rt2x00_rt(rt2x00dev, RT5392))
+                    rt2x00_rt(rt2x00dev, RT5392) ||
+                    rt2x00_rt(rt2x00dev, RT5592))
                         vgc = 0x1c + (2 * rt2x00dev->lna_gain);
                 else
                         vgc = 0x2e + rt2x00dev->lna_gain;
         } else { /* 5GHZ band */
                 if (rt2x00_rt(rt2x00dev, RT3572))
                         vgc = 0x22 + (rt2x00dev->lna_gain * 5) / 3;
+                else if (rt2x00_rt(rt2x00dev, RT5592))
+                        vgc = 0x24 + (2 * rt2x00dev->lna_gain);
                 else {
                         if (!test_bit(CONFIG_CHANNEL_HT40, &rt2x00dev->flags))
                                 vgc = 0x32 + (rt2x00dev->lna_gain * 5) / 3;
@@ -2960,7 +3347,11 @@ static inline void rt2800_set_vgc(struct rt2x00_dev *rt2x00dev,
                                   struct link_qual *qual, u8 vgc_level)
 {
         if (qual->vgc_level != vgc_level) {
-                rt2800_bbp_write(rt2x00dev, 66, vgc_level);
+                if (rt2x00_rt(rt2x00dev, RT5592)) {
+                        rt2800_bbp_write(rt2x00dev, 83, qual->rssi > -65 ? 0x4a : 0x7a);
+                        rt2800_bbp_write_with_rx_chain(rt2x00dev, 66, vgc_level);
+                } else
+                        rt2800_bbp_write(rt2x00dev, 66, vgc_level);
                 qual->vgc_level = vgc_level;
                 qual->vgc_level_reg = vgc_level;
         }
@@ -2975,15 +3366,23 @@ EXPORT_SYMBOL_GPL(rt2800_reset_tuner);
 void rt2800_link_tuner(struct rt2x00_dev *rt2x00dev, struct link_qual *qual,
                        const u32 count)
 {
+        u8 vgc;
+
         if (rt2x00_rt_rev(rt2x00dev, RT2860, REV_RT2860C))
                 return;
-
         /*
-         * When RSSI is better then -80 increase VGC level with 0x10
+         * When RSSI is better then -80 increase VGC level with 0x10, except
+         * for rt5592 chip.
          */
-        rt2800_set_vgc(rt2x00dev, qual,
-                       rt2800_get_default_vgc(rt2x00dev) +
-                       ((qual->rssi > -80) * 0x10));
+
+        vgc = rt2800_get_default_vgc(rt2x00dev);
+
+        if (rt2x00_rt(rt2x00dev, RT5592) && qual->rssi > -65)
+                vgc += 0x20;
+        else if (qual->rssi > -80)
+                vgc += 0x10;
+
+        rt2800_set_vgc(rt2x00dev, qual, vgc);
 }
 EXPORT_SYMBOL_GPL(rt2800_link_tuner);
 
@@ -3122,7 +3521,8 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000400);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
         } else if (rt2x00_rt(rt2x00dev, RT5390) ||
-                   rt2x00_rt(rt2x00dev, RT5392)) {
+                   rt2x00_rt(rt2x00dev, RT5392) ||
+                   rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_register_write(rt2x00dev, TX_SW_CFG0, 0x00000404);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG1, 0x00080606);
                 rt2800_register_write(rt2x00dev, TX_SW_CFG2, 0x00000000);
@@ -3302,7 +3702,8 @@ static int rt2800_init_registers(struct rt2x00_dev *rt2x00dev)
         rt2x00_set_field32(&reg, TXOP_CTRL_CFG_EXT_CWMIN, 0);
         rt2800_register_write(rt2x00dev, TXOP_CTRL_CFG, reg);
 
-        rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, 0x00000002);
+        reg = rt2x00_rt(rt2x00dev, RT5592) ? 0x00000082 : 0x00000002;
+        rt2800_register_write(rt2x00dev, TXOP_HLDR_ET, reg);
 
         rt2800_register_read(rt2x00dev, TX_RTS_CFG, &reg);
         rt2x00_set_field32(&reg, TX_RTS_CFG_AUTO_RTS_RETRY_LIMIT, 32);
@@ -3487,6 +3888,136 @@ static int rt2800_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
         return -EACCES;
 }
 
+static void rt2800_bbp4_mac_if_ctrl(struct rt2x00_dev *rt2x00dev)
+{
+        u8 value;
+
+        rt2800_bbp_read(rt2x00dev, 4, &value);
+        rt2x00_set_field8(&value, BBP4_MAC_IF_CTRL, 1);
+        rt2800_bbp_write(rt2x00dev, 4, value);
+}
+
+static void rt2800_init_freq_calibration(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 142, 1);
+        rt2800_bbp_write(rt2x00dev, 143, 57);
+}
+
+static void rt2800_init_bbp_5592_glrt(struct rt2x00_dev *rt2x00dev)
+{
+        const u8 glrt_table[] = {
+                0xE0, 0x1F, 0X38, 0x32, 0x08, 0x28, 0x19, 0x0A, 0xFF, 0x00, /* 128 ~ 137 */
+                0x16, 0x10, 0x10, 0x0B, 0x36, 0x2C, 0x26, 0x24, 0x42, 0x36, /* 138 ~ 147 */
+                0x30, 0x2D, 0x4C, 0x46, 0x3D, 0x40, 0x3E, 0x42, 0x3D, 0x40, /* 148 ~ 157 */
+                0X3C, 0x34, 0x2C, 0x2F, 0x3C, 0x35, 0x2E, 0x2A, 0x49, 0x41, /* 158 ~ 167 */
+                0x36, 0x31, 0x30, 0x30, 0x0E, 0x0D, 0x28, 0x21, 0x1C, 0x16, /* 168 ~ 177 */
+                0x50, 0x4A, 0x43, 0x40, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00, /* 178 ~ 187 */
+                0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* 188 ~ 197 */
+                0x00, 0x00, 0x7D, 0x14, 0x32, 0x2C, 0x36, 0x4C, 0x43, 0x2C, /* 198 ~ 207 */
+                0x2E, 0x36, 0x30, 0x6E,                                     /* 208 ~ 211 */
+        };
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(glrt_table); i++) {
+                rt2800_bbp_write(rt2x00dev, 195, 128 + i);
+                rt2800_bbp_write(rt2x00dev, 196, glrt_table[i]);
+        }
+};
+
+static void rt2800_init_bbb_early(struct rt2x00_dev *rt2x00dev)
+{
+        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
+        rt2800_bbp_write(rt2x00dev, 66, 0x38);
+        rt2800_bbp_write(rt2x00dev, 68, 0x0B);
+        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
+        rt2800_bbp_write(rt2x00dev, 73, 0x10);
+        rt2800_bbp_write(rt2x00dev, 81, 0x37);
+        rt2800_bbp_write(rt2x00dev, 82, 0x62);
+        rt2800_bbp_write(rt2x00dev, 83, 0x6A);
+        rt2800_bbp_write(rt2x00dev, 84, 0x99);
+        rt2800_bbp_write(rt2x00dev, 86, 0x00);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x00);
+        rt2800_bbp_write(rt2x00dev, 103, 0x00);
+        rt2800_bbp_write(rt2x00dev, 105, 0x05);
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+}
+
+static void rt2800_init_bbp_5592(struct rt2x00_dev *rt2x00dev)
+{
+        int ant, div_mode;
+        u16 eeprom;
+        u8 value;
+
+        rt2800_init_bbb_early(rt2x00dev);
+
+        rt2800_bbp_read(rt2x00dev, 105, &value);
+        rt2x00_set_field8(&value, BBP105_MLD,
+                          rt2x00dev->default_ant.rx_chain_num == 2);
+        rt2800_bbp_write(rt2x00dev, 105, value);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 20, 0x06);
+        rt2800_bbp_write(rt2x00dev, 31, 0x08);
+        rt2800_bbp_write(rt2x00dev, 65, 0x2C);
+        rt2800_bbp_write(rt2x00dev, 68, 0xDD);
+        rt2800_bbp_write(rt2x00dev, 69, 0x1A);
+        rt2800_bbp_write(rt2x00dev, 70, 0x05);
+        rt2800_bbp_write(rt2x00dev, 73, 0x13);
+        rt2800_bbp_write(rt2x00dev, 74, 0x0F);
+        rt2800_bbp_write(rt2x00dev, 75, 0x4F);
+        rt2800_bbp_write(rt2x00dev, 76, 0x28);
+        rt2800_bbp_write(rt2x00dev, 77, 0x59);
+        rt2800_bbp_write(rt2x00dev, 84, 0x9A);
+        rt2800_bbp_write(rt2x00dev, 86, 0x38);
+        rt2800_bbp_write(rt2x00dev, 88, 0x90);
+        rt2800_bbp_write(rt2x00dev, 91, 0x04);
+        rt2800_bbp_write(rt2x00dev, 92, 0x02);
+        rt2800_bbp_write(rt2x00dev, 95, 0x9a);
+        rt2800_bbp_write(rt2x00dev, 98, 0x12);
+        rt2800_bbp_write(rt2x00dev, 103, 0xC0);
+        rt2800_bbp_write(rt2x00dev, 104, 0x92);
+        /* FIXME BBP105 owerwrite */
+        rt2800_bbp_write(rt2x00dev, 105, 0x3C);
+        rt2800_bbp_write(rt2x00dev, 106, 0x35);
+        rt2800_bbp_write(rt2x00dev, 128, 0x12);
+        rt2800_bbp_write(rt2x00dev, 134, 0xD0);
+        rt2800_bbp_write(rt2x00dev, 135, 0xF6);
+        rt2800_bbp_write(rt2x00dev, 137, 0x0F);
+
+        /* Initialize GLRT (Generalized Likehood Radio Test) */
+        rt2800_init_bbp_5592_glrt(rt2x00dev);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF1, &eeprom);
+        div_mode = rt2x00_get_field16(eeprom, EEPROM_NIC_CONF1_ANT_DIVERSITY);
+        ant = (div_mode == 3) ? 1 : 0;
+        rt2800_bbp_read(rt2x00dev, 152, &value);
+        if (ant == 0) {
+                /* Main antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 1);
+        } else {
+                /* Auxiliary antenna */
+                rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
+        }
+        rt2800_bbp_write(rt2x00dev, 152, value);
+
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C)) {
+                rt2800_bbp_read(rt2x00dev, 254, &value);
+                rt2x00_set_field8(&value, BBP254_BIT7, 1);
+                rt2800_bbp_write(rt2x00dev, 254, value);
+        }
+
+        rt2800_init_freq_calibration(rt2x00dev);
+
+        rt2800_bbp_write(rt2x00dev, 84, 0x19);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+}
+
 static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 {
         unsigned int i;
@@ -3498,6 +4029,11 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                      rt2800_wait_bbp_ready(rt2x00dev)))
                 return -EACCES;
 
+        if (rt2x00_rt(rt2x00dev, RT5592)) {
+                rt2800_init_bbp_5592(rt2x00dev);
+                return 0;
+        }
+
         if (rt2x00_rt(rt2x00dev, RT3352)) {
                 rt2800_bbp_write(rt2x00dev, 3, 0x00);
                 rt2800_bbp_write(rt2x00dev, 4, 0x50);
@@ -3505,11 +4041,8 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
 
         if (rt2x00_rt(rt2x00dev, RT3290) ||
             rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
-                rt2800_bbp_read(rt2x00dev, 4, &value);
-                rt2x00_set_field8(&value, BBP4_MAC_IF_CTRL, 1);
-                rt2800_bbp_write(rt2x00dev, 4, value);
-        }
+            rt2x00_rt(rt2x00dev, RT5392))
+                rt2800_bbp4_mac_if_ctrl(rt2x00dev);
 
         if (rt2800_is_305x_soc(rt2x00dev) ||
             rt2x00_rt(rt2x00dev, RT3290) ||
@@ -3783,9 +4316,7 @@ static int rt2800_init_bbp(struct rt2x00_dev *rt2x00dev)
                         rt2x00_set_field8(&value, BBP152_RX_DEFAULT_ANT, 0);
                 rt2800_bbp_write(rt2x00dev, 152, value);
 
-                /* Init frequency calibration */
-                rt2800_bbp_write(rt2x00dev, 142, 1);
-                rt2800_bbp_write(rt2x00dev, 143, 57);
+                rt2800_init_freq_calibration(rt2x00dev);
         }
 
         for (i = 0; i < EEPROM_BBP_SIZE; i++) {
@@ -4259,6 +4790,69 @@ static void rt2800_init_rfcsr_5392(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
 }
 
+static void rt2800_init_rfcsr_5592(struct rt2x00_dev *rt2x00dev)
+{
+        u8 reg;
+        u16 eeprom;
+
+        rt2800_rfcsr_write(rt2x00dev, 1, 0x3F);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
+        rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 6, 0xE4);
+        rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 16, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 18, 0x03);
+        rt2800_rfcsr_write(rt2x00dev, 19, 0x4D);
+        rt2800_rfcsr_write(rt2x00dev, 20, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 21, 0x8D);
+        rt2800_rfcsr_write(rt2x00dev, 26, 0x82);
+        rt2800_rfcsr_write(rt2x00dev, 28, 0x00);
+        rt2800_rfcsr_write(rt2x00dev, 29, 0x10);
+        rt2800_rfcsr_write(rt2x00dev, 33, 0xC0);
+        rt2800_rfcsr_write(rt2x00dev, 34, 0x07);
+        rt2800_rfcsr_write(rt2x00dev, 35, 0x12);
+        rt2800_rfcsr_write(rt2x00dev, 47, 0x0C);
+        rt2800_rfcsr_write(rt2x00dev, 53, 0x22);
+        rt2800_rfcsr_write(rt2x00dev, 63, 0x07);
+
+        rt2800_rfcsr_write(rt2x00dev, 2, 0x80);
+        msleep(1);
+
+        rt2800_adjust_freq_offset(rt2x00dev);
+
+        rt2800_bbp_read(rt2x00dev, 138, &reg);
+
+        /*  Turn off unused DAC1 and ADC1 to reduce power consumption */
+        rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC_CONF0, &eeprom);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_RXPATH) == 1)
+                rt2x00_set_field8(&reg, BBP138_RX_ADC1, 0);
+        if (rt2x00_get_field16(eeprom, EEPROM_NIC_CONF0_TXPATH) == 1)
+                rt2x00_set_field8(&reg, BBP138_TX_DAC1, 1);
+
+        rt2800_bbp_write(rt2x00dev, 138, reg);
+
+        /* Enable DC filter */
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5592, REV_RT5592C))
+                rt2800_bbp_write(rt2x00dev, 103, 0xc0);
+
+        rt2800_rfcsr_read(rt2x00dev, 38, &reg);
+        rt2x00_set_field8(&reg, RFCSR38_RX_LO1_EN, 0);
+        rt2800_rfcsr_write(rt2x00dev, 38, reg);
+
+        rt2800_rfcsr_read(rt2x00dev, 39, &reg);
+        rt2x00_set_field8(&reg, RFCSR39_RX_LO2_EN, 0);
+        rt2800_rfcsr_write(rt2x00dev, 39, reg);
+
+        rt2800_bbp4_mac_if_ctrl(rt2x00dev);
+
+        rt2800_rfcsr_read(rt2x00dev, 30, &reg);
+        rt2x00_set_field8(&reg, RFCSR30_RX_VCM, 2);
+        rt2800_rfcsr_write(rt2x00dev, 30, reg);
+}
+
 static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
 {
         struct rt2800_drv_data *drv_data = rt2x00dev->drv_data;
@@ -4276,6 +4870,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
             !rt2x00_rt(rt2x00dev, RT3572) &&
             !rt2x00_rt(rt2x00dev, RT5390) &&
             !rt2x00_rt(rt2x00dev, RT5392) &&
+            !rt2x00_rt(rt2x00dev, RT5392) &&
+            !rt2x00_rt(rt2x00dev, RT5592) &&
             !rt2800_is_305x_soc(rt2x00dev))
                 return 0;
 
@@ -4330,6 +4926,9 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         case RT5392:
                 rt2800_init_rfcsr_5392(rt2x00dev);
                 break;
+        case RT5592:
+                rt2800_init_rfcsr_5592(rt2x00dev);
+                return 0;
         }
 
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F)) {
@@ -4427,7 +5026,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt_rev_lt(rt2x00dev, RT3070, REV_RT3070F) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3071, REV_RT3071E) ||
             rt2x00_rt_rev_lt(rt2x00dev, RT3090, REV_RT3090E) ||
-            rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E))
+            rt2x00_rt_rev_lt(rt2x00dev, RT3390, REV_RT3390E) ||
+            rt2x00_rt_rev_lt(rt2x00dev, RT5592, REV_RT5592C))
                 rt2800_rfcsr_write(rt2x00dev, 27, 0x03);
 
         rt2800_register_read(rt2x00dev, OPT_14_CSR, &reg);
@@ -4451,7 +5051,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 17, rfcsr);
         }
 
-        if (rt2x00_rt(rt2x00dev, RT3090)) {
+        if (rt2x00_rt(rt2x00dev, RT3090) ||
+            rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_bbp_read(rt2x00dev, 138, &bbp);
 
                 /*  Turn off unused DAC1 and ADC1 to reduce power consumption */
@@ -4507,7 +5108,8 @@ static int rt2800_init_rfcsr(struct rt2x00_dev *rt2x00dev)
         }
 
         if (rt2x00_rt(rt2x00dev, RT5390) ||
-            rt2x00_rt(rt2x00dev, RT5392)) {
+            rt2x00_rt(rt2x00dev, RT5392) ||
+            rt2x00_rt(rt2x00dev, RT5592)) {
                 rt2800_rfcsr_read(rt2x00dev, 38, &rfcsr);
                 rt2x00_set_field8(&rfcsr, RFCSR38_RX_LO1_EN, 0);
                 rt2800_rfcsr_write(rt2x00dev, 38, rfcsr);
@@ -4533,15 +5135,23 @@ int rt2800_enable_radio(struct rt2x00_dev *rt2x00dev)
          * Initialize all registers.
          */
         if (unlikely(rt2800_wait_wpdma_ready(rt2x00dev) ||
-                     rt2800_init_registers(rt2x00dev) ||
-                     rt2800_init_bbp(rt2x00dev) ||
-                     rt2800_init_rfcsr(rt2x00dev)))
+                     rt2800_init_registers(rt2x00dev)))
                 return -EIO;
 
         /*
          * Send signal to firmware during boot time.
          */
-        rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        rt2800_register_write(rt2x00dev, H2M_BBP_AGENT, 0);
+        rt2800_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
+        if (rt2x00_is_usb(rt2x00dev)) {
+                rt2800_register_write(rt2x00dev, H2M_INT_SRC, 0);
+                rt2800_mcu_request(rt2x00dev, MCU_BOOT_SIGNAL, 0, 0, 0);
+        }
+        msleep(1);
+
+        if (unlikely(rt2800_init_bbp(rt2x00dev) ||
+                     rt2800_init_rfcsr(rt2x00dev)))
+                return -EIO;
 
         if (rt2x00_is_usb(rt2x00dev) &&
             (rt2x00_rt(rt2x00dev, RT3070) ||
@@ -4863,6 +5473,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RT3572:
         case RT5390:
         case RT5392:
+        case RT5592:
                 break;
         default:
                 ERROR(rt2x00dev, "Invalid RT chipset 0x%04x detected.\n", rt2x00dev->chip.rt);
@@ -4887,6 +5498,7 @@ static int rt2800_init_eeprom(struct rt2x00_dev *rt2x00dev)
         case RF5372:
         case RF5390:
         case RF5392:
+        case RF5592:
                 break;
         default:
                 ERROR(rt2x00dev, "Invalid RF chipset 0x%04x detected.\n",
@@ -5122,6 +5734,138 @@ static const struct rf_channel rf_vals_3x[] = {
         {173, 0x61, 0, 9},
 };
 
+static const struct rf_channel rf_vals_5592_xtal20[] = {
+        /* Channel, N, K, mod, R */
+        {1, 482, 4, 10, 3},
+        {2, 483, 4, 10, 3},
+        {3, 484, 4, 10, 3},
+        {4, 485, 4, 10, 3},
+        {5, 486, 4, 10, 3},
+        {6, 487, 4, 10, 3},
+        {7, 488, 4, 10, 3},
+        {8, 489, 4, 10, 3},
+        {9, 490, 4, 10, 3},
+        {10, 491, 4, 10, 3},
+        {11, 492, 4, 10, 3},
+        {12, 493, 4, 10, 3},
+        {13, 494, 4, 10, 3},
+        {14, 496, 8, 10, 3},
+        {36, 172, 8, 12, 1},
+        {38, 173, 0, 12, 1},
+        {40, 173, 4, 12, 1},
+        {42, 173, 8, 12, 1},
+        {44, 174, 0, 12, 1},
+        {46, 174, 4, 12, 1},
+        {48, 174, 8, 12, 1},
+        {50, 175, 0, 12, 1},
+        {52, 175, 4, 12, 1},
+        {54, 175, 8, 12, 1},
+        {56, 176, 0, 12, 1},
+        {58, 176, 4, 12, 1},
+        {60, 176, 8, 12, 1},
+        {62, 177, 0, 12, 1},
+        {64, 177, 4, 12, 1},
+        {100, 183, 4, 12, 1},
+        {102, 183, 8, 12, 1},
+        {104, 184, 0, 12, 1},
+        {106, 184, 4, 12, 1},
+        {108, 184, 8, 12, 1},
+        {110, 185, 0, 12, 1},
+        {112, 185, 4, 12, 1},
+        {114, 185, 8, 12, 1},
+        {116, 186, 0, 12, 1},
+        {118, 186, 4, 12, 1},
+        {120, 186, 8, 12, 1},
+        {122, 187, 0, 12, 1},
+        {124, 187, 4, 12, 1},
+        {126, 187, 8, 12, 1},
+        {128, 188, 0, 12, 1},
+        {130, 188, 4, 12, 1},
+        {132, 188, 8, 12, 1},
+        {134, 189, 0, 12, 1},
+        {136, 189, 4, 12, 1},
+        {138, 189, 8, 12, 1},
+        {140, 190, 0, 12, 1},
+        {149, 191, 6, 12, 1},
+        {151, 191, 10, 12, 1},
+        {153, 192, 2, 12, 1},
+        {155, 192, 6, 12, 1},
+        {157, 192, 10, 12, 1},
+        {159, 193, 2, 12, 1},
+        {161, 193, 6, 12, 1},
+        {165, 194, 2, 12, 1},
+        {184, 164, 0, 12, 1},
+        {188, 164, 4, 12, 1},
+        {192, 165, 8, 12, 1},
+        {196, 166, 0, 12, 1},
+};
+
+static const struct rf_channel rf_vals_5592_xtal40[] = {
+        /* Channel, N, K, mod, R */
+        {1, 241, 2, 10, 3},
+        {2, 241, 7, 10, 3},
+        {3, 242, 2, 10, 3},
+        {4, 242, 7, 10, 3},
+        {5, 243, 2, 10, 3},
+        {6, 243, 7, 10, 3},
+        {7, 244, 2, 10, 3},
+        {8, 244, 7, 10, 3},
+        {9, 245, 2, 10, 3},
+        {10, 245, 7, 10, 3},
+        {11, 246, 2, 10, 3},
+        {12, 246, 7, 10, 3},
+        {13, 247, 2, 10, 3},
+        {14, 248, 4, 10, 3},
+        {36, 86, 4, 12, 1},
+        {38, 86, 6, 12, 1},
+        {40, 86, 8, 12, 1},
+        {42, 86, 10, 12, 1},
+        {44, 87, 0, 12, 1},
+        {46, 87, 2, 12, 1},
+        {48, 87, 4, 12, 1},
+        {50, 87, 6, 12, 1},
+        {52, 87, 8, 12, 1},
+        {54, 87, 10, 12, 1},
+        {56, 88, 0, 12, 1},
+        {58, 88, 2, 12, 1},
+        {60, 88, 4, 12, 1},
+        {62, 88, 6, 12, 1},
+        {64, 88, 8, 12, 1},
+        {100, 91, 8, 12, 1},
+        {102, 91, 10, 12, 1},
+        {104, 92, 0, 12, 1},
+        {106, 92, 2, 12, 1},
+        {108, 92, 4, 12, 1},
+        {110, 92, 6, 12, 1},
+        {112, 92, 8, 12, 1},
+        {114, 92, 10, 12, 1},
+        {116, 93, 0, 12, 1},
+        {118, 93, 2, 12, 1},
+        {120, 93, 4, 12, 1},
+        {122, 93, 6, 12, 1},
+        {124, 93, 8, 12, 1},
+        {126, 93, 10, 12, 1},
+        {128, 94, 0, 12, 1},
+        {130, 94, 2, 12, 1},
+        {132, 94, 4, 12, 1},
+        {134, 94, 6, 12, 1},
+        {136, 94, 8, 12, 1},
+        {138, 94, 10, 12, 1},
+        {140, 95, 0, 12, 1},
+        {149, 95, 9, 12, 1},
+        {151, 95, 11, 12, 1},
+        {153, 96, 1, 12, 1},
+        {155, 96, 3, 12, 1},
+        {157, 96, 5, 12, 1},
+        {159, 96, 7, 12, 1},
+        {161, 96, 9, 12, 1},
+        {165, 97, 1, 12, 1},
+        {184, 82, 0, 12, 1},
+        {188, 82, 4, 12, 1},
+        {192, 82, 8, 12, 1},
+        {196, 83, 0, 12, 1},
+};
+
 static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
 {
         struct hw_mode_spec *spec = &rt2x00dev->spec;
@@ -5130,6 +5874,7 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
         char *default_power2;
         unsigned int i;
         u16 eeprom;
+        u32 reg;
 
         /*
          * Disable powersaving as default on PCI devices.
@@ -5211,8 +5956,22 @@ static int rt2800_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
                 spec->supported_bands |= SUPPORT_BAND_5GHZ;
                 spec->num_channels = ARRAY_SIZE(rf_vals_3x);
                 spec->channels = rf_vals_3x;
+        } else if (rt2x00_rf(rt2x00dev, RF5592)) {
+                spec->supported_bands |= SUPPORT_BAND_5GHZ;
+
+                rt2800_register_read(rt2x00dev, MAC_DEBUG_INDEX, &reg);
+                if (rt2x00_get_field32(reg, MAC_DEBUG_INDEX_XTAL)) {
+                        spec->num_channels = ARRAY_SIZE(rf_vals_5592_xtal40);
+                        spec->channels = rf_vals_5592_xtal40;
+                } else {
+                        spec->num_channels = ARRAY_SIZE(rf_vals_5592_xtal20);
+                        spec->channels = rf_vals_5592_xtal20;
+                }
         }
 
+        if (WARN_ON_ONCE(!spec->channels))
+                return -ENODEV;
+
         /*
          * Initialize HT information.
          */
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 48a01aa21f1c..f732ded8f1ba 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -89,7 +89,7 @@ static void rt2800pci_mcu_status(struct rt2x00_dev *rt2x00dev, const u8 token)
         rt2x00pci_register_write(rt2x00dev, H2M_MAILBOX_CID, ~0);
 }
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         void __iomem *base_addr = ioremap(0x1F040000, EEPROM_SIZE);
@@ -107,7 +107,7 @@ static inline int rt2800pci_read_eeprom_soc(struct rt2x00_dev *rt2x00dev)
 {
         return -ENOMEM;
 }
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static void rt2800pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
@@ -729,6 +729,11 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
          * Process the RXWI structure that is at the start of the buffer.
          */
         rt2800_process_rxwi(entry, rxdesc);
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, RXWI_DESC_SIZE);
 }
 
 /*
@@ -742,10 +747,90 @@ static void rt2800pci_wakeup(struct rt2x00_dev *rt2x00dev)
         rt2800_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
 }
 
+static bool rt2800pci_txdone_entry_check(struct queue_entry *entry, u32 status)
+{
+        __le32 *txwi;
+        u32 word;
+        int wcid, tx_wcid;
+
+        wcid = rt2x00_get_field32(status, TX_STA_FIFO_WCID);
+
+        txwi = rt2800_drv_get_txwi(entry);
+        rt2x00_desc_read(txwi, 1, &word);
+        tx_wcid = rt2x00_get_field32(word, TXWI_W1_WIRELESS_CLI_ID);
+
+        return (tx_wcid == wcid);
+}
+
+static bool rt2800pci_txdone_find_entry(struct queue_entry *entry, void *data)
+{
+        u32 status = *(u32 *)data;
+
+        /*
+         * rt2800pci hardware might reorder frames when exchanging traffic
+         * with multiple BA enabled STAs.
+         *
+         * For example, a tx queue
+         *    [ STA1 | STA2 | STA1 | STA2 ]
+         * can result in tx status reports
+         *    [ STA1 | STA1 | STA2 | STA2 ]
+         * when the hw decides to aggregate the frames for STA1 into one AMPDU.
+         *
+         * To mitigate this effect, associate the tx status to the first frame
+         * in the tx queue with a matching wcid.
+         */
+        if (rt2800pci_txdone_entry_check(entry, status) &&
+            !test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                /*
+                 * Got a matching frame, associate the tx status with
+                 * the frame
+                 */
+                entry->status = status;
+                set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+                return true;
+        }
+
+        /* Check the next frame */
+        return false;
+}
+
+static bool rt2800pci_txdone_match_first(struct queue_entry *entry, void *data)
+{
+        u32 status = *(u32 *)data;
+
+        /*
+         * Find the first frame without tx status and assign this status to it
+         * regardless if it matches or not.
+         */
+        if (!test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                /*
+                 * Got a matching frame, associate the tx status with
+                 * the frame
+                 */
+                entry->status = status;
+                set_bit(ENTRY_DATA_STATUS_SET, &entry->flags);
+                return true;
+        }
+
+        /* Check the next frame */
+        return false;
+}
+static bool rt2800pci_txdone_release_entries(struct queue_entry *entry,
+                                             void *data)
+{
+        if (test_bit(ENTRY_DATA_STATUS_SET, &entry->flags)) {
+                rt2800_txdone_entry(entry, entry->status,
+                                    rt2800pci_get_txwi(entry));
+                return false;
+        }
+
+        /* No more frames to release */
+        return true;
+}
+
 static bool rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
 {
         struct data_queue *queue;
-        struct queue_entry *entry;
         u32 status;
         u8 qid;
         int max_tx_done = 16;
@@ -783,8 +868,33 @@ static bool rt2800pci_txdone(struct rt2x00_dev *rt2x00dev)
                         break;
                 }
 
-                entry = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
-                rt2800_txdone_entry(entry, status, rt2800pci_get_txwi(entry));
+                /*
+                 * Let's associate this tx status with the first
+                 * matching frame.
+                 */
+                if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                                Q_INDEX, &status,
+                                                rt2800pci_txdone_find_entry)) {
+                        /*
+                         * We cannot match the tx status to any frame, so just
+                         * use the first one.
+                         */
+                        if (!rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                                        Q_INDEX, &status,
+                                                        rt2800pci_txdone_match_first)) {
+                                WARNING(rt2x00dev, "No frame found for TX "
+                                                   "status on queue %u, dropping\n",
+                                                   qid);
+                                break;
+                        }
+                }
+
+                /*
+                 * Release all frames with a valid tx status.
+                 */
+                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE,
+                                           Q_INDEX, NULL,
+                                           rt2800pci_txdone_release_entries);
 
                 if (--max_tx_done == 0)
                         break;
@@ -1177,7 +1287,7 @@ MODULE_DEVICE_TABLE(pci, rt2800pci_device_table);
 #endif /* CONFIG_PCI */
 MODULE_LICENSE("GPL");
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
 static int rt2800soc_probe(struct platform_device *pdev)
 {
         return rt2x00soc_probe(pdev, &rt2800pci_ops);
@@ -1194,7 +1304,7 @@ static struct platform_driver rt2800soc_driver = {
         .suspend        = rt2x00soc_suspend,
         .resume         = rt2x00soc_resume,
 };
-#endif /* CONFIG_RALINK_RT288X || CONFIG_RALINK_RT305X */
+#endif /* CONFIG_SOC_RT288X || CONFIG_SOC_RT305X */
 
 #ifdef CONFIG_PCI
 static int rt2800pci_probe(struct pci_dev *pci_dev,
@@ -1217,7 +1327,7 @@ static int __init rt2800pci_init(void)
 {
         int ret = 0;
 
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         ret = platform_driver_register(&rt2800soc_driver);
         if (ret)
                 return ret;
@@ -1225,7 +1335,7 @@ static int __init rt2800pci_init(void)
 #ifdef CONFIG_PCI
         ret = pci_register_driver(&rt2800pci_driver);
         if (ret) {
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
                 platform_driver_unregister(&rt2800soc_driver);
 #endif
                 return ret;
@@ -1240,7 +1350,7 @@ static void __exit rt2800pci_exit(void)
 #ifdef CONFIG_PCI
         pci_unregister_driver(&rt2800pci_driver);
 #endif
-#if defined(CONFIG_RALINK_RT288X) || defined(CONFIG_RALINK_RT305X)
+#if defined(CONFIG_SOC_RT288X) || defined(CONFIG_SOC_RT305X)
         platform_driver_unregister(&rt2800soc_driver);
 #endif
 }
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 098613ed93fb..f32282009146 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -485,7 +485,7 @@ static void rt2800usb_write_tx_desc(struct queue_entry *entry,
          */
         skbdesc->flags |= SKBDESC_DESC_IN_SKB;
         skbdesc->desc = txi;
-        skbdesc->desc_len = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
+        skbdesc->desc_len = entry->queue->desc_size;
 }
 
 /*
@@ -730,6 +730,11 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
          * Process the RXWI structure.
          */
         rt2800_process_rxwi(entry, rxdesc);
+
+        /*
+         * Remove RXWI descriptor from start of buffer.
+         */
+        skb_pull(entry->skb, entry->queue->desc_size - RXINFO_DESC_SIZE);
 }
 
 /*
@@ -890,6 +895,47 @@ static const struct rt2x00_ops rt2800usb_ops = {
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
 };
 
+static const struct data_queue_desc rt2800usb_queue_rx_5592 = {
+        .entry_num              = 128,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = RXINFO_DESC_SIZE + RXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_tx_5592 = {
+        .entry_num              = 16,
+        .data_size              = AGGREGATION_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+static const struct data_queue_desc rt2800usb_queue_bcn_5592 = {
+        .entry_num              = 8,
+        .data_size              = MGMT_FRAME_SIZE,
+        .desc_size              = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .priv_size              = sizeof(struct queue_entry_priv_usb),
+};
+
+
+static const struct rt2x00_ops rt2800usb_ops_5592 = {
+        .name                   = KBUILD_MODNAME,
+        .drv_data_size          = sizeof(struct rt2800_drv_data),
+        .max_ap_intf            = 8,
+        .eeprom_size            = EEPROM_SIZE,
+        .rf_size                = RF_SIZE,
+        .tx_queues              = NUM_TX_QUEUES,
+        .extra_tx_headroom      = TXINFO_DESC_SIZE + TXWI_DESC_SIZE_5592,
+        .rx                     = &rt2800usb_queue_rx_5592,
+        .tx                     = &rt2800usb_queue_tx_5592,
+        .bcn                    = &rt2800usb_queue_bcn_5592,
+        .lib                    = &rt2800usb_rt2x00_ops,
+        .drv                    = &rt2800usb_rt2800_ops,
+        .hw                     = &rt2800usb_mac80211_ops,
+#ifdef CONFIG_RT2X00_LIB_DEBUGFS
+        .debugfs                = &rt2800_rt2x00debug,
+#endif /* CONFIG_RT2X00_LIB_DEBUGFS */
+};
+
 /*
  * rt2800usb module information.
  */
@@ -1200,6 +1246,18 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x148f, 0x5370) },
         { USB_DEVICE(0x148f, 0x5372) },
 #endif
+#ifdef CONFIG_RT2800USB_RT55XX
+        /* Arcadyan */
+        { USB_DEVICE(0x043e, 0x7a32), .driver_info = 5592 },
+        /* AVM GmbH */
+        { USB_DEVICE(0x057c, 0x8501), .driver_info = 5592 },
+        /* D-Link DWA-160-B2 */
+        { USB_DEVICE(0x2001, 0x3c1a), .driver_info = 5592 },
+        /* Proware */
+        { USB_DEVICE(0x043e, 0x7a13), .driver_info = 5592 },
+        /* Ralink */
+        { USB_DEVICE(0x148f, 0x5572), .driver_info = 5592 },
+#endif
 #ifdef CONFIG_RT2800USB_UNKNOWN
         /*
          * Unclear what kind of devices these are (they aren't supported by the
@@ -1303,6 +1361,9 @@ MODULE_LICENSE("GPL");
 static int rt2800usb_probe(struct usb_interface *usb_intf,
                            const struct usb_device_id *id)
 {
+        if (id->driver_info == 5592)
+                return rt2x00usb_probe(usb_intf, &rt2800usb_ops_5592);
+
         return rt2x00usb_probe(usb_intf, &rt2800usb_ops);
 }
 
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 086abb403a4f..51922cc179de 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -193,6 +193,7 @@ struct rt2x00_chip {
 #define RT3883          0x3883  /* WSOC */
 #define RT5390          0x5390  /* 2.4GHz */
 #define RT5392          0x5392  /* 2.4GHz */
+#define RT5592          0x5592
 
         u16 rf;
         u16 rev;
@@ -1064,8 +1065,7 @@ static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
 }
 
 /*
- *  Generic EEPROM access.
- * The EEPROM is being accessed by word index.
+ * Generic EEPROM access. The EEPROM is being accessed by word or byte index.
  */
 static inline void *rt2x00_eeprom_addr(struct rt2x00_dev *rt2x00dev,
                                        const unsigned int word)
@@ -1085,6 +1085,12 @@ static inline void rt2x00_eeprom_write(struct rt2x00_dev *rt2x00dev,
         rt2x00dev->eeprom[word] = cpu_to_le16(data);
 }
 
+static inline u8 rt2x00_eeprom_byte(struct rt2x00_dev *rt2x00dev,
+                                    const unsigned int byte)
+{
+        return *(((u8 *)rt2x00dev->eeprom) + byte);
+}
+
 /*
  * Chipset handlers
  */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 1031db66474a..189744db65e0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1236,8 +1236,10 @@ static inline void rt2x00lib_set_if_combinations(struct rt2x00_dev *rt2x00dev)
          */
         if_limit = &rt2x00dev->if_limits_ap;
         if_limit->max = rt2x00dev->ops->max_ap_intf;
-        if_limit->types = BIT(NL80211_IFTYPE_AP) |
-                        BIT(NL80211_IFTYPE_MESH_POINT);
+        if_limit->types = BIT(NL80211_IFTYPE_AP);
+#ifdef CONFIG_MAC80211_MESH
+        if_limit->types |= BIT(NL80211_IFTYPE_MESH_POINT);
+#endif
 
         /*
          * Build up AP interface combinations structure.
@@ -1309,7 +1311,9 @@ int rt2x00lib_probe_dev(struct rt2x00_dev *rt2x00dev)
                 rt2x00dev->hw->wiphy->interface_modes |=
                     BIT(NL80211_IFTYPE_ADHOC) |
                     BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
                     BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
                     BIT(NL80211_IFTYPE_WDS);
 
         rt2x00dev->hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index a0c8caef3b0a..b1c673ecada1 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -52,8 +52,8 @@ int rt2x00pci_regbusy_read(struct rt2x00_dev *rt2x00dev,
                 udelay(REGISTER_BUSY_DELAY);
         }
 
-        ERROR(rt2x00dev, "Indirect register access failed: "
-              "offset=0x%.08x, value=0x%.08x\n", offset, *reg);
+        printk_once(KERN_ERR "%s() Indirect register access failed: "
+              "offset=0x%.08x, value=0x%.08x\n", __func__, offset, *reg);
         *reg = ~0;
 
         return 0;
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 4d91795dc6a2..952a0490eb17 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -832,7 +832,9 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                 enum queue_index start,
                                 enum queue_index end,
-                                bool (*fn)(struct queue_entry *entry))
+                                void *data,
+                                bool (*fn)(struct queue_entry *entry,
+                                           void *data))
 {
         unsigned long irqflags;
         unsigned int index_start;
@@ -863,17 +865,17 @@ bool rt2x00queue_for_each_entry(struct data_queue *queue,
          */
         if (index_start < index_end) {
                 for (i = index_start; i < index_end; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
         } else {
                 for (i = index_start; i < queue->limit; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
 
                 for (i = 0; i < index_end; i++) {
-                        if (fn(&queue->entries[i]))
+                        if (fn(&queue->entries[i], data))
                                 return true;
                 }
         }
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 9b8c10a86dee..3d0137193da0 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -359,6 +359,7 @@ enum queue_entry_flags {
         ENTRY_DATA_PENDING,
         ENTRY_DATA_IO_FAILED,
         ENTRY_DATA_STATUS_PENDING,
+        ENTRY_DATA_STATUS_SET,
 };
 
 /**
@@ -372,6 +373,7 @@ enum queue_entry_flags {
  * @entry_idx: The entry index number.
  * @priv_data: Private data belonging to this queue entry. The pointer
  *      points to data specific to a particular driver and queue type.
+ * @status: Device specific status
  */
 struct queue_entry {
         unsigned long flags;
@@ -383,6 +385,8 @@ struct queue_entry {
 
         unsigned int entry_idx;
 
+        u32 status;
+
         void *priv_data;
 };
 
@@ -584,6 +588,7 @@ struct data_queue_desc {
  * @queue: Pointer to @data_queue
  * @start: &enum queue_index Pointer to start index
  * @end: &enum queue_index Pointer to end index
+ * @data: Data to pass to the callback function
  * @fn: The function to call for each &struct queue_entry
  *
  * This will walk through all entries in the queue, in chronological
@@ -596,7 +601,9 @@ struct data_queue_desc {
 bool rt2x00queue_for_each_entry(struct data_queue *queue,
                                 enum queue_index start,
                                 enum queue_index end,
-                                bool (*fn)(struct queue_entry *entry));
+                                void *data,
+                                bool (*fn)(struct queue_entry *entry,
+                                           void *data));
 
 /**
  * rt2x00queue_empty - Check if the queue is empty.
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 40ea80725a96..5e50d4ff9d21 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -285,7 +285,7 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
                 queue_work(rt2x00dev->workqueue, &rt2x00dev->txdone_work);
 }
 
-static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry)
+static bool rt2x00usb_kick_tx_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -390,7 +390,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         queue_work(rt2x00dev->workqueue, &rt2x00dev->rxdone_work);
 }
 
-static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry)
+static bool rt2x00usb_kick_rx_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
@@ -427,12 +427,18 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
         case QID_AC_BE:
         case QID_AC_BK:
                 if (!rt2x00queue_empty(queue))
-                        rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                        rt2x00queue_for_each_entry(queue,
+                                                   Q_INDEX_DONE,
+                                                   Q_INDEX,
+                                                   NULL,
                                                    rt2x00usb_kick_tx_entry);
                 break;
         case QID_RX:
                 if (!rt2x00queue_full(queue))
-                        rt2x00queue_for_each_entry(queue, Q_INDEX, Q_INDEX_DONE,
+                        rt2x00queue_for_each_entry(queue,
+                                                   Q_INDEX,
+                                                   Q_INDEX_DONE,
+                                                   NULL,
                                                    rt2x00usb_kick_rx_entry);
                 break;
         default:
@@ -441,7 +447,7 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_kick_queue);
 
-static bool rt2x00usb_flush_entry(struct queue_entry *entry)
+static bool rt2x00usb_flush_entry(struct queue_entry *entry, void *data)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct queue_entry_priv_usb *entry_priv = entry->priv_data;
@@ -468,7 +474,7 @@ void rt2x00usb_flush_queue(struct data_queue *queue, bool drop)
         unsigned int i;
 
         if (drop)
-                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX,
+                rt2x00queue_for_each_entry(queue, Q_INDEX_DONE, Q_INDEX, NULL,
                                            rt2x00usb_flush_entry);
 
         /*
@@ -559,7 +565,7 @@ void rt2x00usb_clear_entry(struct queue_entry *entry)
         entry->flags = 0;
 
         if (entry->queue->qid == QID_RX)
-                rt2x00usb_kick_rx_entry(entry);
+                rt2x00usb_kick_rx_entry(entry, NULL);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_clear_entry);
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index b1ccff474c79..c08d0f4c5f3d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1377,74 +1377,57 @@ void rtl92cu_card_disable(struct ieee80211_hw *hw)
 
 void rtl92cu_set_check_bssid(struct ieee80211_hw *hw, bool check_bssid)
 {
-        /* dummy routine needed for callback from rtl_op_configure_filter() */
-}
-
-/*========================================================================== */
-
-static void _rtl92cu_set_check_bssid(struct ieee80211_hw *hw,
-                              enum nl80211_iftype type)
-{
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
         struct rtl_hal *rtlhal = rtl_hal(rtlpriv);
-        struct rtl_phy *rtlphy = &(rtlpriv->phy);
-        u8 filterout_non_associated_bssid = false;
+        u32 reg_rcr = rtl_read_dword(rtlpriv, REG_RCR);
 
-        switch (type) {
-        case NL80211_IFTYPE_ADHOC:
-        case NL80211_IFTYPE_STATION:
-                filterout_non_associated_bssid = true;
-                break;
-        case NL80211_IFTYPE_UNSPECIFIED:
-        case NL80211_IFTYPE_AP:
-        default:
-                break;
-        }
-        if (filterout_non_associated_bssid) {
+        if (rtlpriv->psc.rfpwr_state != ERFON)
+                return;
+
+        if (check_bssid) {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        switch (rtlphy->current_io_type) {
-                        case IO_CMD_RESUME_DM_BY_SCAN:
-                                reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* enable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, 0, BIT(4));
-                                break;
-                        case IO_CMD_PAUSE_DM_BY_SCAN:
-                                reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
-                                rtlpriv->cfg->ops->set_hw_reg(hw,
-                                                 HW_VAR_RCR, (u8 *)(&reg_rcr));
-                                /* disable update TSF */
-                                _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
-                                break;
-                        }
+                        reg_rcr |= (RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr |= (RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, 0, (BIT(4)|BIT(5)));
+                        reg_rcr |= RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
-        } else if (filterout_non_associated_bssid == false) {
+                rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
+                                              (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, 0, tmp);
+        } else {
+                u8 tmp;
                 if (IS_NORMAL_CHIP(rtlhal->version)) {
-                        reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, BIT(4), 0);
+                        reg_rcr &= ~(RCR_CBSSID_DATA | RCR_CBSSID_BCN);
+                        tmp = BIT(4);
                 } else {
-                        reg_rcr &= (~RCR_CBSSID);
-                        rtlpriv->cfg->ops->set_hw_reg(hw, HW_VAR_RCR,
-                                                      (u8 *)(&reg_rcr));
-                        _rtl92cu_set_bcn_ctrl_reg(hw, (BIT(4)|BIT(5)), 0);
+                        reg_rcr &= ~RCR_CBSSID;
+                        tmp = BIT(4) | BIT(5);
                 }
+                reg_rcr &= (~(RCR_CBSSID_DATA | RCR_CBSSID_BCN));
+                rtlpriv->cfg->ops->set_hw_reg(hw,
+                                              HW_VAR_RCR, (u8 *) (&reg_rcr));
+                _rtl92cu_set_bcn_ctrl_reg(hw, tmp, 0);
         }
 }
 
+/*========================================================================== */
+
 int rtl92cu_set_network_type(struct ieee80211_hw *hw, enum nl80211_iftype type)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+
         if (_rtl92cu_set_media_status(hw, type))
                 return -EOPNOTSUPP;
-        _rtl92cu_set_check_bssid(hw, type);
+
+        if (rtlpriv->mac80211.link_state == MAC80211_LINKED) {
+                if (type != NL80211_IFTYPE_AP)
+                        rtl92cu_set_check_bssid(hw, true);
+        } else {
+                rtl92cu_set_check_bssid(hw, false);
+        }
+
         return 0;
 }
 
@@ -2058,8 +2041,6 @@ void rtl92cu_update_hal_rate_table(struct ieee80211_hw *hw,
                                (shortgi_rate << 4) | (shortgi_rate);
         }
         rtl_write_dword(rtlpriv, REG_ARFR0 + ratr_index * 4, ratr_value);
-        RT_TRACE(rtlpriv, COMP_RATR, DBG_DMESG, "%x\n",
-                 rtl_read_dword(rtlpriv, REG_ARFR0));
 }
 
 void rtl92cu_update_hal_rate_mask(struct ieee80211_hw *hw, u8 rssi_level)
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 156b52732f3d..b5c80b5d57ef 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -224,10 +224,9 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data,
         u8 *buffer;
 
         wvalue = (u16)(addr & 0x0000ffff);
-        buffer = kmalloc(len, GFP_ATOMIC);
+        buffer = kmemdup(data, len, GFP_ATOMIC);
         if (!buffer)
                 return;
-        memcpy(buffer, data, len);
         usb_control_msg(udev, pipe, request, reqtype, wvalue,
                         index, buffer, len, 50);
 
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index f13258a8d995..c3eff32acf6c 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -2127,9 +2127,6 @@ value to host byte ordering.*/
 #define WLAN_FC_GET_TYPE(fc)    (le16_to_cpu(fc) & IEEE80211_FCTL_FTYPE)
 #define WLAN_FC_GET_STYPE(fc)   (le16_to_cpu(fc) & IEEE80211_FCTL_STYPE)
 #define WLAN_FC_MORE_DATA(fc)   (le16_to_cpu(fc) & IEEE80211_FCTL_MOREDATA)
-#define SEQ_TO_SN(seq)          (((seq) & IEEE80211_SCTL_SEQ) >> 4)
-#define SN_TO_SEQ(ssn)          (((ssn) << 4) & IEEE80211_SCTL_SEQ)
-#define MAX_SN                  ((IEEE80211_SCTL_SEQ) >> 4)
 
 #define RT_RF_OFF_LEVL_ASPM             BIT(0)  /*PCI ASPM */
 #define RT_RF_OFF_LEVL_CLK_REQ          BIT(1)  /*PCI clock request */
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 2c2ff3e1f849..d7e306333f6c 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -4956,7 +4956,8 @@ static void wlcore_op_flush(struct ieee80211_hw *hw, bool drop)
 static int wlcore_op_remain_on_channel(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        struct ieee80211_channel *chan,
-                                       int duration)
+                                       int duration,
+                                       enum ieee80211_roc_type type)
 {
         struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif);
         struct wl1271 *wl = hw->priv;
diff --git a/drivers/nfc/microread/mei.c b/drivers/nfc/microread/mei.c
index eef38cfd812e..13bde92b1e29 100644
--- a/drivers/nfc/microread/mei.c
+++ b/drivers/nfc/microread/mei.c
@@ -48,7 +48,7 @@ struct mei_nfc_hdr {
 #define MEI_NFC_MAX_READ (MEI_NFC_HEADER_SIZE + MEI_NFC_MAX_HCI_PAYLOAD)
 
 struct microread_mei_phy {
-        struct mei_device *mei_device;
+        struct mei_device *device;
         struct nfc_hci_dev *hdev;
 
         int powered;
diff --git a/drivers/ssb/driver_chipcommon.c b/drivers/ssb/driver_chipcommon.c
index 71098a7b5fed..7cb7d2c8fd86 100644
--- a/drivers/ssb/driver_chipcommon.c
+++ b/drivers/ssb/driver_chipcommon.c
@@ -354,7 +354,7 @@ void ssb_chipcommon_init(struct ssb_chipcommon *cc)
 
         if (cc->dev->id.revision >= 11)
                 cc->status = chipco_read32(cc, SSB_CHIPCO_CHIPSTAT);
-        ssb_dprintk(KERN_INFO PFX "chipcommon status is 0x%x\n", cc->status);
+        ssb_dbg("chipcommon status is 0x%x\n", cc->status);
 
         if (cc->dev->id.revision >= 20) {
                 chipco_write32(cc, SSB_CHIPCO_GPIOPULLUP, 0);
diff --git a/drivers/ssb/driver_chipcommon_pmu.c b/drivers/ssb/driver_chipcommon_pmu.c
index 4c0f6d883dd3..791da2c0d8f6 100644
--- a/drivers/ssb/driver_chipcommon_pmu.c
+++ b/drivers/ssb/driver_chipcommon_pmu.c
@@ -110,8 +110,8 @@ static void ssb_pmu0_pllinit_r0(struct ssb_chipcommon *cc,
                 return;
         }
 
-        ssb_printk(KERN_INFO PFX "Programming PLL to %u.%03u MHz\n",
-                   (crystalfreq / 1000), (crystalfreq % 1000));
+        ssb_info("Programming PLL to %u.%03u MHz\n",
+                 crystalfreq / 1000, crystalfreq % 1000);
 
         /* First turn the PLL off. */
         switch (bus->chip_id) {
@@ -138,7 +138,7 @@ static void ssb_pmu0_pllinit_r0(struct ssb_chipcommon *cc,
         }
         tmp = chipco_read32(cc, SSB_CHIPCO_CLKCTLST);
         if (tmp & SSB_CHIPCO_CLKCTLST_HAVEHT)
-                ssb_printk(KERN_EMERG PFX "Failed to turn the PLL off!\n");
+                ssb_emerg("Failed to turn the PLL off!\n");
 
         /* Set PDIV in PLL control 0. */
         pllctl = ssb_chipco_pll_read(cc, SSB_PMU0_PLLCTL0);
@@ -249,8 +249,8 @@ static void ssb_pmu1_pllinit_r0(struct ssb_chipcommon *cc,
                 return;
         }
 
-        ssb_printk(KERN_INFO PFX "Programming PLL to %u.%03u MHz\n",
-                   (crystalfreq / 1000), (crystalfreq % 1000));
+        ssb_info("Programming PLL to %u.%03u MHz\n",
+                 crystalfreq / 1000, crystalfreq % 1000);
 
         /* First turn the PLL off. */
         switch (bus->chip_id) {
@@ -275,7 +275,7 @@ static void ssb_pmu1_pllinit_r0(struct ssb_chipcommon *cc,
         }
         tmp = chipco_read32(cc, SSB_CHIPCO_CLKCTLST);
         if (tmp & SSB_CHIPCO_CLKCTLST_HAVEHT)
-                ssb_printk(KERN_EMERG PFX "Failed to turn the PLL off!\n");
+                ssb_emerg("Failed to turn the PLL off!\n");
 
         /* Set p1div and p2div. */
         pllctl = ssb_chipco_pll_read(cc, SSB_PMU1_PLLCTL0);
@@ -349,9 +349,8 @@ static void ssb_pmu_pll_init(struct ssb_chipcommon *cc)
         case 43222:
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PLL init unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PLL init unknown for device %04X\n",
+                        bus->chip_id);
         }
 }
 
@@ -472,9 +471,8 @@ static void ssb_pmu_resources_init(struct ssb_chipcommon *cc)
                 max_msk = 0xFFFFF;
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU resource config unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU resource config unknown for device %04X\n",
+                        bus->chip_id);
         }
 
         if (updown_tab) {
@@ -526,8 +524,8 @@ void ssb_pmu_init(struct ssb_chipcommon *cc)
         pmucap = chipco_read32(cc, SSB_CHIPCO_PMU_CAP);
         cc->pmu.rev = (pmucap & SSB_CHIPCO_PMU_CAP_REVISION);
 
-        ssb_dprintk(KERN_DEBUG PFX "Found rev %u PMU (capabilities 0x%08X)\n",
-                    cc->pmu.rev, pmucap);
+        ssb_dbg("Found rev %u PMU (capabilities 0x%08X)\n",
+                cc->pmu.rev, pmucap);
 
         if (cc->pmu.rev == 1)
                 chipco_mask32(cc, SSB_CHIPCO_PMU_CTL,
@@ -638,9 +636,8 @@ u32 ssb_pmu_get_alp_clock(struct ssb_chipcommon *cc)
         case 0x5354:
                 ssb_pmu_get_alp_clock_clk0(cc);
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU alp clock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU alp clock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
@@ -654,9 +651,8 @@ u32 ssb_pmu_get_cpu_clock(struct ssb_chipcommon *cc)
                 /* 5354 chip uses a non programmable PLL of frequency 240MHz */
                 return 240000000;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU cpu clock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU cpu clock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
@@ -669,9 +665,8 @@ u32 ssb_pmu_get_controlclock(struct ssb_chipcommon *cc)
         case 0x5354:
                 return 120000000;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "ERROR: PMU controlclock unknown for device %04X\n",
-                           bus->chip_id);
+                ssb_err("ERROR: PMU controlclock unknown for device %04X\n",
+                        bus->chip_id);
                 return 0;
         }
 }
diff --git a/drivers/ssb/driver_mipscore.c b/drivers/ssb/driver_mipscore.c
index 33b37dac40bd..fa385a368a56 100644
--- a/drivers/ssb/driver_mipscore.c
+++ b/drivers/ssb/driver_mipscore.c
@@ -167,21 +167,22 @@ static void set_irq(struct ssb_device *dev, unsigned int irq)
                 irqflag |= (ipsflag & ~ipsflag_irq_mask[irq]);
                 ssb_write32(mdev, SSB_IPSFLAG, irqflag);
         }
-        ssb_dprintk(KERN_INFO PFX
-                    "set_irq: core 0x%04x, irq %d => %d\n",
-                    dev->id.coreid, oldirq+2, irq+2);
+        ssb_dbg("set_irq: core 0x%04x, irq %d => %d\n",
+                dev->id.coreid, oldirq+2, irq+2);
 }
 
 static void print_irq(struct ssb_device *dev, unsigned int irq)
 {
-        int i;
         static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
-        ssb_dprintk(KERN_INFO PFX
-                "core 0x%04x, irq :", dev->id.coreid);
-        for (i = 0; i <= 6; i++) {
-                ssb_dprintk(" %s%s", irq_name[i], i==irq?"*":" ");
-        }
-        ssb_dprintk("\n");
+        ssb_dbg("core 0x%04x, irq : %s%s %s%s %s%s %s%s %s%s %s%s %s%s\n",
+                dev->id.coreid,
+                irq_name[0], irq == 0 ? "*" : " ",
+                irq_name[1], irq == 1 ? "*" : " ",
+                irq_name[2], irq == 2 ? "*" : " ",
+                irq_name[3], irq == 3 ? "*" : " ",
+                irq_name[4], irq == 4 ? "*" : " ",
+                irq_name[5], irq == 5 ? "*" : " ",
+                irq_name[6], irq == 6 ? "*" : " ");
 }
 
 static void dump_irq(struct ssb_bus *bus)
@@ -286,7 +287,7 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
         if (!mcore->dev)
                 return; /* We don't have a MIPS core */
 
-        ssb_dprintk(KERN_INFO PFX "Initializing MIPS core...\n");
+        ssb_dbg("Initializing MIPS core...\n");
 
         bus = mcore->dev->bus;
         hz = ssb_clockspeed(bus);
@@ -334,7 +335,7 @@ void ssb_mipscore_init(struct ssb_mipscore *mcore)
                         break;
                 }
         }
-        ssb_dprintk(KERN_INFO PFX "after irq reconfiguration\n");
+        ssb_dbg("after irq reconfiguration\n");
         dump_irq(bus);
 
         ssb_mips_serial_init(mcore);
diff --git a/drivers/ssb/driver_pcicore.c b/drivers/ssb/driver_pcicore.c
index 59801d23d7ec..d75b72ba2672 100644
--- a/drivers/ssb/driver_pcicore.c
+++ b/drivers/ssb/driver_pcicore.c
@@ -263,8 +263,7 @@ int ssb_pcicore_plat_dev_init(struct pci_dev *d)
                 return -ENODEV;
         }
 
-        ssb_printk(KERN_INFO "PCI: Fixing up device %s\n",
-                   pci_name(d));
+        ssb_info("PCI: Fixing up device %s\n", pci_name(d));
 
         /* Fix up interrupt lines */
         d->irq = ssb_mips_irq(extpci_core->dev) + 2;
@@ -285,12 +284,12 @@ static void ssb_pcicore_fixup_pcibridge(struct pci_dev *dev)
         if (dev->bus->number != 0 || PCI_SLOT(dev->devfn) != 0)
                 return;
 
-        ssb_printk(KERN_INFO "PCI: Fixing up bridge %s\n", pci_name(dev));
+        ssb_info("PCI: Fixing up bridge %s\n", pci_name(dev));
 
         /* Enable PCI bridge bus mastering and memory space */
         pci_set_master(dev);
         if (pcibios_enable_device(dev, ~0) < 0) {
-                ssb_printk(KERN_ERR "PCI: SSB bridge enable failed\n");
+                ssb_err("PCI: SSB bridge enable failed\n");
                 return;
         }
 
@@ -299,8 +298,8 @@ static void ssb_pcicore_fixup_pcibridge(struct pci_dev *dev)
 
         /* Make sure our latency is high enough to handle the devices behind us */
         lat = 168;
-        ssb_printk(KERN_INFO "PCI: Fixing latency timer of device %s to %u\n",
-                   pci_name(dev), lat);
+        ssb_info("PCI: Fixing latency timer of device %s to %u\n",
+                 pci_name(dev), lat);
         pci_write_config_byte(dev, PCI_LATENCY_TIMER, lat);
 }
 DECLARE_PCI_FIXUP_EARLY(PCI_ANY_ID, PCI_ANY_ID, ssb_pcicore_fixup_pcibridge);
@@ -323,7 +322,7 @@ static void ssb_pcicore_init_hostmode(struct ssb_pcicore *pc)
                 return;
         extpci_core = pc;
 
-        ssb_dprintk(KERN_INFO PFX "PCIcore in host mode found\n");
+        ssb_dbg("PCIcore in host mode found\n");
         /* Reset devices on the external PCI bus */
         val = SSB_PCICORE_CTL_RST_OE;
         val |= SSB_PCICORE_CTL_CLK_OE;
@@ -338,7 +337,7 @@ static void ssb_pcicore_init_hostmode(struct ssb_pcicore *pc)
         udelay(1); /* Assertion time demanded by the PCI standard */
 
         if (pc->dev->bus->has_cardbus_slot) {
-                ssb_dprintk(KERN_INFO PFX "CardBus slot detected\n");
+                ssb_dbg("CardBus slot detected\n");
                 pc->cardbusmode = 1;
                 /* GPIO 1 resets the bridge */
                 ssb_gpio_out(pc->dev->bus, 1, 1);
diff --git a/drivers/ssb/embedded.c b/drivers/ssb/embedded.c
index bb18d76f9f2c..55e101115038 100644
--- a/drivers/ssb/embedded.c
+++ b/drivers/ssb/embedded.c
@@ -57,9 +57,8 @@ int ssb_watchdog_register(struct ssb_bus *bus)
                                              bus->busnumber, &wdt,
                                              sizeof(wdt));
         if (IS_ERR(pdev)) {
-                ssb_dprintk(KERN_INFO PFX
-                            "can not register watchdog device, err: %li\n",
-                            PTR_ERR(pdev));
+                ssb_dbg("can not register watchdog device, err: %li\n",
+                        PTR_ERR(pdev));
                 return PTR_ERR(pdev);
         }
 
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 3b645b8a261f..812775a4bfb6 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -275,8 +275,8 @@ int ssb_devices_thaw(struct ssb_freeze_context *ctx)
 
                 err = sdrv->probe(sdev, &sdev->id);
                 if (err) {
-                        ssb_printk(KERN_ERR PFX "Failed to thaw device %s\n",
-                                   dev_name(sdev->dev));
+                        ssb_err("Failed to thaw device %s\n",
+                                dev_name(sdev->dev));
                         result = err;
                 }
                 ssb_device_put(sdev);
@@ -447,10 +447,9 @@ void ssb_bus_unregister(struct ssb_bus *bus)
 
         err = ssb_gpio_unregister(bus);
         if (err == -EBUSY)
-                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+                ssb_dbg("Some GPIOs are still in use\n");
         else if (err)
-                ssb_dprintk(KERN_ERR PFX
-                            "Can not unregister GPIO driver: %i\n", err);
+                ssb_dbg("Can not unregister GPIO driver: %i\n", err);
 
         ssb_buses_lock();
         ssb_devices_unregister(bus);
@@ -497,8 +496,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 
                 devwrap = kzalloc(sizeof(*devwrap), GFP_KERNEL);
                 if (!devwrap) {
-                        ssb_printk(KERN_ERR PFX
-                                   "Could not allocate device\n");
+                        ssb_err("Could not allocate device\n");
                         err = -ENOMEM;
                         goto error;
                 }
@@ -537,9 +535,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                 sdev->dev = dev;
                 err = device_register(dev);
                 if (err) {
-                        ssb_printk(KERN_ERR PFX
-                                   "Could not register %s\n",
-                                   dev_name(dev));
+                        ssb_err("Could not register %s\n", dev_name(dev));
                         /* Set dev to NULL to not unregister
                          * dev on error unwinding. */
                         sdev->dev = NULL;
@@ -825,10 +821,9 @@ static int ssb_bus_register(struct ssb_bus *bus,
         ssb_mipscore_init(&bus->mipscore);
         err = ssb_gpio_init(bus);
         if (err == -ENOTSUPP)
-                ssb_dprintk(KERN_DEBUG PFX "GPIO driver not activated\n");
+                ssb_dbg("GPIO driver not activated\n");
         else if (err)
-                ssb_dprintk(KERN_ERR PFX
-                           "Error registering GPIO driver: %i\n", err);
+                ssb_dbg("Error registering GPIO driver: %i\n", err);
         err = ssb_fetch_invariants(bus, get_invariants);
         if (err) {
                 ssb_bus_may_powerdown(bus);
@@ -878,11 +873,11 @@ int ssb_bus_pcibus_register(struct ssb_bus *bus, struct pci_dev *host_pci)
 
         err = ssb_bus_register(bus, ssb_pci_get_invariants, 0);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "PCI device %s\n", dev_name(&host_pci->dev));
+                ssb_info("Sonics Silicon Backplane found on PCI device %s\n",
+                         dev_name(&host_pci->dev));
         } else {
-                ssb_printk(KERN_ERR PFX "Failed to register PCI version"
-                           " of SSB with error %d\n", err);
+                ssb_err("Failed to register PCI version of SSB with error %d\n",
+                        err);
         }
 
         return err;
@@ -903,8 +898,8 @@ int ssb_bus_pcmciabus_register(struct ssb_bus *bus,
 
         err = ssb_bus_register(bus, ssb_pcmcia_get_invariants, baseaddr);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "PCMCIA device %s\n", pcmcia_dev->devname);
+                ssb_info("Sonics Silicon Backplane found on PCMCIA device %s\n",
+                         pcmcia_dev->devname);
         }
 
         return err;
@@ -925,8 +920,8 @@ int ssb_bus_sdiobus_register(struct ssb_bus *bus, struct sdio_func *func,
 
         err = ssb_bus_register(bus, ssb_sdio_get_invariants, ~0);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found on "
-                           "SDIO device %s\n", sdio_func_id(func));
+                ssb_info("Sonics Silicon Backplane found on SDIO device %s\n",
+                         sdio_func_id(func));
         }
 
         return err;
@@ -944,8 +939,8 @@ int ssb_bus_ssbbus_register(struct ssb_bus *bus, unsigned long baseaddr,
 
         err = ssb_bus_register(bus, get_invariants, baseaddr);
         if (!err) {
-                ssb_printk(KERN_INFO PFX "Sonics Silicon Backplane found at "
-                           "address 0x%08lX\n", baseaddr);
+                ssb_info("Sonics Silicon Backplane found at address 0x%08lX\n",
+                         baseaddr);
         }
 
         return err;
@@ -1339,7 +1334,7 @@ out:
 #endif
         return err;
 error:
-        ssb_printk(KERN_ERR PFX "Bus powerdown failed\n");
+        ssb_err("Bus powerdown failed\n");
         goto out;
 }
 EXPORT_SYMBOL(ssb_bus_may_powerdown);
@@ -1362,7 +1357,7 @@ int ssb_bus_powerup(struct ssb_bus *bus, bool dynamic_pctl)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Bus powerup failed\n");
+        ssb_err("Bus powerup failed\n");
         return err;
 }
 EXPORT_SYMBOL(ssb_bus_powerup);
@@ -1470,15 +1465,13 @@ static int __init ssb_modinit(void)
 
         err = b43_pci_ssb_bridge_init();
         if (err) {
-                ssb_printk(KERN_ERR "Broadcom 43xx PCI-SSB-bridge "
-                           "initialization failed\n");
+                ssb_err("Broadcom 43xx PCI-SSB-bridge initialization failed\n");
                 /* don't fail SSB init because of this */
                 err = 0;
         }
         err = ssb_gige_init();
         if (err) {
-                ssb_printk(KERN_ERR "SSB Broadcom Gigabit Ethernet "
-                           "driver initialization failed\n");
+                ssb_err("SSB Broadcom Gigabit Ethernet driver initialization failed\n");
                 /* don't fail SSB init because of this */
                 err = 0;
         }
diff --git a/drivers/ssb/pci.c b/drivers/ssb/pci.c
index e9d94968f394..63ff69f9d3eb 100644
--- a/drivers/ssb/pci.c
+++ b/drivers/ssb/pci.c
@@ -56,7 +56,7 @@ int ssb_pci_switch_coreidx(struct ssb_bus *bus, u8 coreidx)
         }
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch to core %u\n", coreidx);
+        ssb_err("Failed to switch to core %u\n", coreidx);
         return -ENODEV;
 }
 
@@ -67,10 +67,9 @@ int ssb_pci_switch_core(struct ssb_bus *bus,
         unsigned long flags;
 
 #if SSB_VERBOSE_PCICORESWITCH_DEBUG
-        ssb_printk(KERN_INFO PFX
-                   "Switching to %s core, index %d\n",
-                   ssb_core_name(dev->id.coreid),
-                   dev->core_index);
+        ssb_info("Switching to %s core, index %d\n",
+                 ssb_core_name(dev->id.coreid),
+                 dev->core_index);
 #endif
 
         spin_lock_irqsave(&bus->bar_lock, flags);
@@ -231,6 +230,15 @@ static inline u8 ssb_crc8(u8 crc, u8 data)
         return t[crc ^ data];
 }
 
+static void sprom_get_mac(char *mac, const u16 *in)
+{
+        int i;
+        for (i = 0; i < 3; i++) {
+                *mac++ = in[i] >> 8;
+                *mac++ = in[i];
+        }
+}
+
 static u8 ssb_sprom_crc(const u16 *sprom, u16 size)
 {
         int word;
@@ -278,7 +286,7 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         u32 spromctl;
         u16 size = bus->sprom_size;
 
-        ssb_printk(KERN_NOTICE PFX "Writing SPROM. Do NOT turn off the power! Please stand by...\n");
+        ssb_notice("Writing SPROM. Do NOT turn off the power! Please stand by...\n");
         err = pci_read_config_dword(pdev, SSB_SPROMCTL, &spromctl);
         if (err)
                 goto err_ctlreg;
@@ -286,17 +294,17 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         err = pci_write_config_dword(pdev, SSB_SPROMCTL, spromctl);
         if (err)
                 goto err_ctlreg;
-        ssb_printk(KERN_NOTICE PFX "[ 0%%");
+        ssb_notice("[ 0%%");
         msleep(500);
         for (i = 0; i < size; i++) {
                 if (i == size / 4)
-                        ssb_printk("25%%");
+                        ssb_cont("25%%");
                 else if (i == size / 2)
-                        ssb_printk("50%%");
+                        ssb_cont("50%%");
                 else if (i == (size * 3) / 4)
-                        ssb_printk("75%%");
+                        ssb_cont("75%%");
                 else if (i % 2)
-                        ssb_printk(".");
+                        ssb_cont(".");
                 writew(sprom[i], bus->mmio + bus->sprom_offset + (i * 2));
                 mmiowb();
                 msleep(20);
@@ -309,12 +317,12 @@ static int sprom_do_write(struct ssb_bus *bus, const u16 *sprom)
         if (err)
                 goto err_ctlreg;
         msleep(500);
-        ssb_printk("100%% ]\n");
-        ssb_printk(KERN_NOTICE PFX "SPROM written.\n");
+        ssb_cont("100%% ]\n");
+        ssb_notice("SPROM written\n");
 
         return 0;
 err_ctlreg:
-        ssb_printk(KERN_ERR PFX "Could not access SPROM control register.\n");
+        ssb_err("Could not access SPROM control register.\n");
         return err;
 }
 
@@ -341,8 +349,6 @@ static s8 r123_extract_antgain(u8 sprom_revision, const u16 *in,
 
 static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
 {
-        int i;
-        u16 v;
         u16 loc[3];
 
         if (out->revision == 3)                 /* rev 3 moved MAC */
@@ -352,19 +358,10 @@ static void sprom_extract_r123(struct ssb_sprom *out, const u16 *in)
                 loc[1] = SSB_SPROM1_ET0MAC;
                 loc[2] = SSB_SPROM1_ET1MAC;
         }
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(loc[0]) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+        sprom_get_mac(out->il0mac, &in[SPOFF(loc[0])]);
         if (out->revision < 3) {        /* only rev 1-2 have et0, et1 */
-                for (i = 0; i < 3; i++) {
-                        v = in[SPOFF(loc[1]) + i];
-                        *(((__be16 *)out->et0mac) + i) = cpu_to_be16(v);
-                }
-                for (i = 0; i < 3; i++) {
-                        v = in[SPOFF(loc[2]) + i];
-                        *(((__be16 *)out->et1mac) + i) = cpu_to_be16(v);
-                }
+                sprom_get_mac(out->et0mac, &in[SPOFF(loc[1])]);
+                sprom_get_mac(out->et1mac, &in[SPOFF(loc[2])]);
         }
         SPEX(et0phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET0A, 0);
         SPEX(et1phyaddr, SSB_SPROM1_ETHPHY, SSB_SPROM1_ETHPHY_ET1A,
@@ -454,19 +451,15 @@ static void sprom_extract_r458(struct ssb_sprom *out, const u16 *in)
 
 static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
 {
-        int i;
-        u16 v;
         u16 il0mac_offset;
 
         if (out->revision == 4)
                 il0mac_offset = SSB_SPROM4_IL0MAC;
         else
                 il0mac_offset = SSB_SPROM5_IL0MAC;
-        /* extract the MAC address */
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(il0mac_offset) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+
+        sprom_get_mac(out->il0mac, &in[SPOFF(il0mac_offset)]);
+
         SPEX(et0phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET0A, 0);
         SPEX(et1phyaddr, SSB_SPROM4_ETHPHY, SSB_SPROM4_ETHPHY_ET1A,
              SSB_SPROM4_ETHPHY_ET1A_SHIFT);
@@ -530,7 +523,7 @@ static void sprom_extract_r45(struct ssb_sprom *out, const u16 *in)
 static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
 {
         int i;
-        u16 v, o;
+        u16 o;
         u16 pwr_info_offset[] = {
                 SSB_SROM8_PWR_INFO_CORE0, SSB_SROM8_PWR_INFO_CORE1,
                 SSB_SROM8_PWR_INFO_CORE2, SSB_SROM8_PWR_INFO_CORE3
@@ -539,10 +532,8 @@ static void sprom_extract_r8(struct ssb_sprom *out, const u16 *in)
                         ARRAY_SIZE(out->core_pwr_info));
 
         /* extract the MAC address */
-        for (i = 0; i < 3; i++) {
-                v = in[SPOFF(SSB_SPROM8_IL0MAC) + i];
-                *(((__be16 *)out->il0mac) + i) = cpu_to_be16(v);
-        }
+        sprom_get_mac(out->il0mac, &in[SPOFF(SSB_SPROM8_IL0MAC)]);
+
         SPEX(board_rev, SSB_SPROM8_BOARDREV, 0xFFFF, 0);
         SPEX(alpha2[0], SSB_SPROM8_CCODE, 0xff00, 8);
         SPEX(alpha2[1], SSB_SPROM8_CCODE, 0x00ff, 0);
@@ -743,7 +734,7 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
         memset(out, 0, sizeof(*out));
 
         out->revision = in[size - 1] & 0x00FF;
-        ssb_dprintk(KERN_DEBUG PFX "SPROM revision %d detected.\n", out->revision);
+        ssb_dbg("SPROM revision %d detected\n", out->revision);
         memset(out->et0mac, 0xFF, 6);           /* preset et0 and et1 mac */
         memset(out->et1mac, 0xFF, 6);
 
@@ -752,7 +743,7 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
                  * number stored in the SPROM.
                  * Always extract r1. */
                 out->revision = 1;
-                ssb_dprintk(KERN_DEBUG PFX "SPROM treated as revision %d\n", out->revision);
+                ssb_dbg("SPROM treated as revision %d\n", out->revision);
         }
 
         switch (out->revision) {
@@ -769,9 +760,8 @@ static int sprom_extract(struct ssb_bus *bus, struct ssb_sprom *out,
                 sprom_extract_r8(out, in);
                 break;
         default:
-                ssb_printk(KERN_WARNING PFX "Unsupported SPROM"
-                           " revision %d detected. Will extract"
-                           " v1\n", out->revision);
+                ssb_warn("Unsupported SPROM revision %d detected. Will extract v1\n",
+                         out->revision);
                 out->revision = 1;
                 sprom_extract_r123(out, in);
         }
@@ -791,7 +781,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
         u16 *buf;
 
         if (!ssb_is_sprom_available(bus)) {
-                ssb_printk(KERN_ERR PFX "No SPROM available!\n");
+                ssb_err("No SPROM available!\n");
                 return -ENODEV;
         }
         if (bus->chipco.dev) {  /* can be unavailable! */
@@ -810,7 +800,7 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
         } else {
                 bus->sprom_offset = SSB_SPROM_BASE1;
         }
-        ssb_dprintk(KERN_INFO PFX "SPROM offset is 0x%x\n", bus->sprom_offset);
+        ssb_dbg("SPROM offset is 0x%x\n", bus->sprom_offset);
 
         buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
         if (!buf)
@@ -835,18 +825,15 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
                          * available for this device in some other storage */
                         err = ssb_fill_sprom_with_fallback(bus, sprom);
                         if (err) {
-                                ssb_printk(KERN_WARNING PFX "WARNING: Using"
-                                           " fallback SPROM failed (err %d)\n",
-                                           err);
+                                ssb_warn("WARNING: Using fallback SPROM failed (err %d)\n",
+                                         err);
                         } else {
-                                ssb_dprintk(KERN_DEBUG PFX "Using SPROM"
-                                            " revision %d provided by"
-                                            " platform.\n", sprom->revision);
+                                ssb_dbg("Using SPROM revision %d provided by platform\n",
+                                        sprom->revision);
                                 err = 0;
                                 goto out_free;
                         }
-                        ssb_printk(KERN_WARNING PFX "WARNING: Invalid"
-                                   " SPROM CRC (corrupt SPROM)\n");
+                        ssb_warn("WARNING: Invalid SPROM CRC (corrupt SPROM)\n");
                 }
         }
         err = sprom_extract(bus, sprom, buf, bus->sprom_size);
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index fbafed5b729b..b413e0187087 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -143,7 +143,7 @@ int ssb_pcmcia_switch_coreidx(struct ssb_bus *bus,
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch to core %u\n", coreidx);
+        ssb_err("Failed to switch to core %u\n", coreidx);
         return err;
 }
 
@@ -153,10 +153,9 @@ int ssb_pcmcia_switch_core(struct ssb_bus *bus,
         int err;
 
 #if SSB_VERBOSE_PCMCIACORESWITCH_DEBUG
-        ssb_printk(KERN_INFO PFX
-                   "Switching to %s core, index %d\n",
-                   ssb_core_name(dev->id.coreid),
-                   dev->core_index);
+        ssb_info("Switching to %s core, index %d\n",
+                 ssb_core_name(dev->id.coreid),
+                 dev->core_index);
 #endif
 
         err = ssb_pcmcia_switch_coreidx(bus, dev->core_index);
@@ -192,7 +191,7 @@ int ssb_pcmcia_switch_segment(struct ssb_bus *bus, u8 seg)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to switch pcmcia segment\n");
+        ssb_err("Failed to switch pcmcia segment\n");
         return err;
 }
 
@@ -549,44 +548,39 @@ static int ssb_pcmcia_sprom_write_all(struct ssb_bus *bus, const u16 *sprom)
         bool failed = 0;
         size_t size = SSB_PCMCIA_SPROM_SIZE;
 
-        ssb_printk(KERN_NOTICE PFX
-                   "Writing SPROM. Do NOT turn off the power! "
-                   "Please stand by...\n");
+        ssb_notice("Writing SPROM. Do NOT turn off the power! Please stand by...\n");
         err = ssb_pcmcia_sprom_command(bus, SSB_PCMCIA_SPROMCTL_WRITEEN);
         if (err) {
-                ssb_printk(KERN_NOTICE PFX
-                           "Could not enable SPROM write access.\n");
+                ssb_notice("Could not enable SPROM write access\n");
                 return -EBUSY;
         }
-        ssb_printk(KERN_NOTICE PFX "[ 0%%");
+        ssb_notice("[ 0%%");
         msleep(500);
         for (i = 0; i < size; i++) {
                 if (i == size / 4)
-                        ssb_printk("25%%");
+                        ssb_cont("25%%");
                 else if (i == size / 2)
-                        ssb_printk("50%%");
+                        ssb_cont("50%%");
                 else if (i == (size * 3) / 4)
-                        ssb_printk("75%%");
+                        ssb_cont("75%%");
                 else if (i % 2)
-                        ssb_printk(".");
+                        ssb_cont(".");
                 err = ssb_pcmcia_sprom_write(bus, i, sprom[i]);
                 if (err) {
-                        ssb_printk(KERN_NOTICE PFX
-                                   "Failed to write to SPROM.\n");
+                        ssb_notice("Failed to write to SPROM\n");
                         failed = 1;
                         break;
                 }
         }
         err = ssb_pcmcia_sprom_command(bus, SSB_PCMCIA_SPROMCTL_WRITEDIS);
         if (err) {
-                ssb_printk(KERN_NOTICE PFX
-                           "Could not disable SPROM write access.\n");
+                ssb_notice("Could not disable SPROM write access\n");
                 failed = 1;
         }
         msleep(500);
         if (!failed) {
-                ssb_printk("100%% ]\n");
-                ssb_printk(KERN_NOTICE PFX "SPROM written.\n");
+                ssb_cont("100%% ]\n");
+                ssb_notice("SPROM written\n");
         }
 
         return failed ? -EBUSY : 0;
@@ -700,7 +694,7 @@ static int ssb_pcmcia_do_get_invariants(struct pcmcia_device *p_dev,
         return -ENOSPC; /* continue with next entry */
 
 error:
-        ssb_printk(KERN_ERR PFX
+        ssb_err(
                    "PCMCIA: Failed to fetch device invariants: %s\n",
                    error_description);
         return -ENODEV;
@@ -722,7 +716,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
         res = pcmcia_loop_tuple(bus->host_pcmcia, CISTPL_FUNCE,
                                 ssb_pcmcia_get_mac, sprom);
         if (res != 0) {
-                ssb_printk(KERN_ERR PFX
+                ssb_err(
                         "PCMCIA: Failed to fetch MAC address\n");
                 return -ENODEV;
         }
@@ -733,7 +727,7 @@ int ssb_pcmcia_get_invariants(struct ssb_bus *bus,
         if ((res == 0) || (res == -ENOSPC))
                 return 0;
 
-        ssb_printk(KERN_ERR PFX
+        ssb_err(
                         "PCMCIA: Failed to fetch device invariants\n");
         return -ENODEV;
 }
@@ -843,6 +837,6 @@ int ssb_pcmcia_init(struct ssb_bus *bus)
 
         return 0;
 error:
-        ssb_printk(KERN_ERR PFX "Failed to initialize PCMCIA host device\n");
+        ssb_err("Failed to initialize PCMCIA host device\n");
         return err;
 }
diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c
index ab4627cf1114..b9429df583eb 100644
--- a/drivers/ssb/scan.c
+++ b/drivers/ssb/scan.c
@@ -125,8 +125,7 @@ static u16 pcidev_to_chipid(struct pci_dev *pci_dev)
                 chipid_fallback = 0x4401;
                 break;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "PCI-ID not in fallback list\n");
+                ssb_err("PCI-ID not in fallback list\n");
         }
 
         return chipid_fallback;
@@ -152,8 +151,7 @@ static u8 chipid_to_nrcores(u16 chipid)
         case 0x4704:
                 return 9;
         default:
-                ssb_printk(KERN_ERR PFX
-                           "CHIPID not in nrcores fallback list\n");
+                ssb_err("CHIPID not in nrcores fallback list\n");
         }
 
         return 1;
@@ -320,15 +318,13 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         bus->chip_package = 0;
                 }
         }
-        ssb_printk(KERN_INFO PFX "Found chip with id 0x%04X, rev 0x%02X and "
-                   "package 0x%02X\n", bus->chip_id, bus->chip_rev,
-                   bus->chip_package);
+        ssb_info("Found chip with id 0x%04X, rev 0x%02X and package 0x%02X\n",
+                 bus->chip_id, bus->chip_rev, bus->chip_package);
         if (!bus->nr_devices)
                 bus->nr_devices = chipid_to_nrcores(bus->chip_id);
         if (bus->nr_devices > ARRAY_SIZE(bus->devices)) {
-                ssb_printk(KERN_ERR PFX
-                           "More than %d ssb cores found (%d)\n",
-                           SSB_MAX_NR_CORES, bus->nr_devices);
+                ssb_err("More than %d ssb cores found (%d)\n",
+                        SSB_MAX_NR_CORES, bus->nr_devices);
                 goto err_unmap;
         }
         if (bus->bustype == SSB_BUSTYPE_SSB) {
@@ -370,8 +366,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         nr_80211_cores++;
                         if (nr_80211_cores > 1) {
                                 if (!we_support_multiple_80211_cores(bus)) {
-                                        ssb_dprintk(KERN_INFO PFX "Ignoring additional "
-                                                    "802.11 core\n");
+                                        ssb_dbg("Ignoring additional 802.11 core\n");
                                         continue;
                                 }
                         }
@@ -379,8 +374,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                 case SSB_DEV_EXTIF:
 #ifdef CONFIG_SSB_DRIVER_EXTIF
                         if (bus->extif.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple EXTIFs found\n");
+                                ssb_warn("WARNING: Multiple EXTIFs found\n");
                                 break;
                         }
                         bus->extif.dev = dev;
@@ -388,8 +382,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                         break;
                 case SSB_DEV_CHIPCOMMON:
                         if (bus->chipco.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple ChipCommon found\n");
+                                ssb_warn("WARNING: Multiple ChipCommon found\n");
                                 break;
                         }
                         bus->chipco.dev = dev;
@@ -398,8 +391,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                 case SSB_DEV_MIPS_3302:
 #ifdef CONFIG_SSB_DRIVER_MIPS
                         if (bus->mipscore.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple MIPS cores found\n");
+                                ssb_warn("WARNING: Multiple MIPS cores found\n");
                                 break;
                         }
                         bus->mipscore.dev = dev;
@@ -420,8 +412,7 @@ int ssb_bus_scan(struct ssb_bus *bus,
                                 }
                         }
                         if (bus->pcicore.dev) {
-                                ssb_printk(KERN_WARNING PFX
-                                           "WARNING: Multiple PCI(E) cores found\n");
+                                ssb_warn("WARNING: Multiple PCI(E) cores found\n");
                                 break;
                         }
                         bus->pcicore.dev = dev;
diff --git a/drivers/ssb/sprom.c b/drivers/ssb/sprom.c
index 80d366fcf8d3..a3b23644b0fb 100644
--- a/drivers/ssb/sprom.c
+++ b/drivers/ssb/sprom.c
@@ -127,13 +127,13 @@ ssize_t ssb_attr_sprom_store(struct ssb_bus *bus,
                 goto out_kfree;
         err = ssb_devices_freeze(bus, &freeze);
         if (err) {
-                ssb_printk(KERN_ERR PFX "SPROM write: Could not freeze all devices\n");
+                ssb_err("SPROM write: Could not freeze all devices\n");
                 goto out_unlock;
         }
         res = sprom_write(bus, sprom);
         err = ssb_devices_thaw(&freeze);
         if (err)
-                ssb_printk(KERN_ERR PFX "SPROM write: Could not thaw all devices\n");
+                ssb_err("SPROM write: Could not thaw all devices\n");
 out_unlock:
         mutex_unlock(&bus->sprom_mutex);
 out_kfree:
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 466171b77f68..4671f17f09af 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -9,16 +9,27 @@
 #define PFX     "ssb: "
 
 #ifdef CONFIG_SSB_SILENT
-# define ssb_printk(fmt, x...)  do { /* nothing */ } while (0)
+# define ssb_printk(fmt, ...)                                   \
+        do { if (0) printk(fmt, ##__VA_ARGS__); } while (0)
 #else
-# define ssb_printk             printk
+# define ssb_printk(fmt, ...)                                   \
+        printk(fmt, ##__VA_ARGS__)
 #endif /* CONFIG_SSB_SILENT */
 
+#define ssb_emerg(fmt, ...)     ssb_printk(KERN_EMERG PFX fmt, ##__VA_ARGS__)
+#define ssb_err(fmt, ...)       ssb_printk(KERN_ERR PFX fmt, ##__VA_ARGS__)
+#define ssb_warn(fmt, ...)      ssb_printk(KERN_WARNING PFX fmt, ##__VA_ARGS__)
+#define ssb_notice(fmt, ...)    ssb_printk(KERN_NOTICE PFX fmt, ##__VA_ARGS__)
+#define ssb_info(fmt, ...)      ssb_printk(KERN_INFO PFX fmt, ##__VA_ARGS__)
+#define ssb_cont(fmt, ...)      ssb_printk(KERN_CONT fmt, ##__VA_ARGS__)
+
 /* dprintk: Debugging printk; vanishes for non-debug compilation */
 #ifdef CONFIG_SSB_DEBUG
-# define ssb_dprintk(fmt, x...) ssb_printk(fmt , ##x)
+# define ssb_dbg(fmt, ...)                                      \
+        ssb_printk(KERN_DEBUG PFX fmt, ##__VA_ARGS__)
 #else
-# define ssb_dprintk(fmt, x...) do { /* nothing */ } while (0)
+# define ssb_dbg(fmt, ...)                                      \
+        do { if (0) printk(KERN_DEBUG PFX fmt, ##__VA_ARGS__); } while (0)
 #endif
 
 #ifdef CONFIG_SSB_DEBUG
diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
index 1956593ee89d..81e939e90c4c 100644
--- a/drivers/tty/hvc/hvcs.c
+++ b/drivers/tty/hvc/hvcs.c
@@ -881,17 +881,12 @@ static struct vio_driver hvcs_vio_driver = {
 /* Only called from hvcs_get_pi please */
 static void hvcs_set_pi(struct hvcs_partner_info *pi, struct hvcs_struct *hvcsd)
 {
-        int clclength;
-
         hvcsd->p_unit_address = pi->unit_address;
         hvcsd->p_partition_ID  = pi->partition_ID;
-        clclength = strlen(&pi->location_code[0]);
-        if (clclength > HVCS_CLC_LENGTH)
-                clclength = HVCS_CLC_LENGTH;
 
         /* copy the null-term char too */
-        strncpy(&hvcsd->p_location_code[0],
-                        &pi->location_code[0], clclength + 1);
+        strlcpy(&hvcsd->p_location_code[0],
+                        &pi->location_code[0], sizeof(hvcsd->p_location_code));
 }
 
 /*
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index 29eb805ea4a6..c1d6555d2567 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -118,10 +118,8 @@
 
 #ifdef CONFIG_PREEMPT_COUNT
 # define preemptible()  (preempt_count() == 0 && !irqs_disabled())
-# define IRQ_EXIT_OFFSET (HARDIRQ_OFFSET-1)
 #else
 # define preemptible()  0
-# define IRQ_EXIT_OFFSET HARDIRQ_OFFSET
 #endif
 
 #if defined(CONFIG_SMP) || defined(CONFIG_GENERIC_HARDIRQS)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 7e24fe0cfbcd..4cf0c9e4dd99 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -113,6 +113,34 @@
 #define IEEE80211_CTL_EXT_SSW_FBACK     0x9000
 #define IEEE80211_CTL_EXT_SSW_ACK       0xa000
 
+
+#define IEEE80211_SN_MASK               ((IEEE80211_SCTL_SEQ) >> 4)
+#define IEEE80211_MAX_SN                IEEE80211_SN_MASK
+#define IEEE80211_SN_MODULO             (IEEE80211_MAX_SN + 1)
+
+static inline int ieee80211_sn_less(u16 sn1, u16 sn2)
+{
+        return ((sn1 - sn2) & IEEE80211_SN_MASK) > (IEEE80211_SN_MODULO >> 1);
+}
+
+static inline u16 ieee80211_sn_add(u16 sn1, u16 sn2)
+{
+        return (sn1 + sn2) & IEEE80211_SN_MASK;
+}
+
+static inline u16 ieee80211_sn_inc(u16 sn)
+{
+        return ieee80211_sn_add(sn, 1);
+}
+
+static inline u16 ieee80211_sn_sub(u16 sn1, u16 sn2)
+{
+        return (sn1 - sn2) & IEEE80211_SN_MASK;
+}
+
+#define IEEE80211_SEQ_TO_SN(seq)        (((seq) & IEEE80211_SCTL_SEQ) >> 4)
+#define IEEE80211_SN_TO_SEQ(ssn)        (((ssn) << 4) & IEEE80211_SCTL_SEQ)
+
 /* miscellaneous IEEE 802.11 constants */
 #define IEEE80211_MAX_FRAG_THRESHOLD    2352
 #define IEEE80211_MAX_RTS_THRESHOLD     2353
@@ -185,7 +213,7 @@ struct ieee80211_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         u8 addr4[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_hdr_3addr {
         __le16 frame_control;
@@ -194,7 +222,7 @@ struct ieee80211_hdr_3addr {
         u8 addr2[6];
         u8 addr3[6];
         __le16 seq_ctrl;
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_qos_hdr {
         __le16 frame_control;
@@ -204,7 +232,7 @@ struct ieee80211_qos_hdr {
         u8 addr3[6];
         __le16 seq_ctrl;
         __le16 qos_ctrl;
-} __packed;
+} __packed __aligned(2);
 
 /**
  * ieee80211_has_tods - check if IEEE80211_FCTL_TODS is set
@@ -581,7 +609,7 @@ struct ieee80211s_hdr {
         __le32 seqnum;
         u8 eaddr1[6];
         u8 eaddr2[6];
-} __packed;
+} __packed __aligned(2);
 
 /* Mesh flags */
 #define MESH_FLAGS_AE_A4        0x1
@@ -875,7 +903,7 @@ struct ieee80211_mgmt {
                         } u;
                 } __packed action;
         } u;
-} __packed;
+} __packed __aligned(2);
 
 /* Supported Rates value encodings in 802.11n-2009 7.3.2.2 */
 #define BSS_MEMBERSHIP_SELECTOR_HT_PHY  127
@@ -906,20 +934,20 @@ struct ieee80211_rts {
         __le16 duration;
         u8 ra[6];
         u8 ta[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_cts {
         __le16 frame_control;
         __le16 duration;
         u8 ra[6];
-} __packed;
+} __packed __aligned(2);
 
 struct ieee80211_pspoll {
         __le16 frame_control;
         __le16 aid;
         u8 bssid[6];
         u8 ta[6];
-} __packed;
+} __packed __aligned(2);
 
 /* TDLS */
 
@@ -1290,11 +1318,6 @@ struct ieee80211_vht_operation {
 } __packed;
 
 
-#define IEEE80211_VHT_MCS_ZERO_TO_SEVEN_SUPPORT 0
-#define IEEE80211_VHT_MCS_ZERO_TO_EIGHT_SUPPORT 1
-#define IEEE80211_VHT_MCS_ZERO_TO_NINE_SUPPORT  2
-#define IEEE80211_VHT_MCS_NOT_SUPPORTED 3
-
 /* 802.11ac VHT Capabilities */
 #define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895                  0x00000000
 #define IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991                  0x00000001
@@ -1310,10 +1333,11 @@ struct ieee80211_vht_operation {
 #define IEEE80211_VHT_CAP_RXSTBC_2                              0x00000200
 #define IEEE80211_VHT_CAP_RXSTBC_3                              0x00000300
 #define IEEE80211_VHT_CAP_RXSTBC_4                              0x00000400
+#define IEEE80211_VHT_CAP_RXSTBC_MASK                           0x00000700
 #define IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE                 0x00000800
 #define IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE                 0x00001000
 #define IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX               0x00006000
-#define IEEE80211_VHT_CAP_SOUNDING_DIMENTION_MAX                0x00030000
+#define IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX               0x00030000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE                 0x00080000
 #define IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE                 0x00100000
 #define IEEE80211_VHT_CAP_VHT_TXOP_PS                           0x00200000
diff --git a/include/linux/netfilter/ipset/ip_set_ahash.h b/include/linux/netfilter/ipset/ip_set_ahash.h
index ef9acd3c8450..01d25e6fc792 100644
--- a/include/linux/netfilter/ipset/ip_set_ahash.h
+++ b/include/linux/netfilter/ipset/ip_set_ahash.h
@@ -854,6 +854,8 @@ type_pf_tresize(struct ip_set *set, bool retried)
 retry:
         ret = 0;
         htable_bits++;
+        pr_debug("attempt to resize set %s from %u to %u, t %p\n",
+                 set->name, orig->htable_bits, htable_bits, orig);
         if (!htable_bits) {
                 /* In case we have plenty of memory :-) */
                 pr_warning("Cannot increase the hashsize of set %s further\n",
@@ -873,7 +875,7 @@ retry:
                         data = ahash_tdata(n, j);
                         m = hbucket(t, HKEY(data, h->initval, htable_bits));
                         ret = type_pf_elem_tadd(m, data, AHASH_MAX(h), 0,
-                                                type_pf_data_timeout(data));
+                                                ip_set_timeout_get(type_pf_data_timeout(data)));
                         if (ret < 0) {
                                 read_unlock_bh(&set->lock);
                                 ahash_destroy(t);
diff --git a/include/linux/smpboot.h b/include/linux/smpboot.h
index c65dee059913..13e929679550 100644
--- a/include/linux/smpboot.h
+++ b/include/linux/smpboot.h
@@ -24,6 +24,9 @@ struct smpboot_thread_data;
  *                      parked (cpu offline)
  * @unpark:             Optional unpark function, called when the thread is
  *                      unparked (cpu online)
+ * @pre_unpark:         Optional unpark function, called before the thread is
+ *                      unparked (cpu online). This is not guaranteed to be
+ *                      called on the target cpu of the thread. Careful!
  * @selfparking:        Thread is not parked by the park function.
  * @thread_comm:        The base name of the thread
  */
@@ -37,6 +40,7 @@ struct smp_hotplug_thread {
         void                            (*cleanup)(unsigned int cpu, bool online);
         void                            (*park)(unsigned int cpu);
         void                            (*unpark)(unsigned int cpu);
+        void                            (*pre_unpark)(unsigned int cpu);
         bool                            selfparking;
         const char                      *thread_comm;
 };
diff --git a/include/linux/socket.h b/include/linux/socket.h
index 2b9f74b0ffea..428c37a1f95c 100644
--- a/include/linux/socket.h
+++ b/include/linux/socket.h
@@ -298,6 +298,7 @@ struct ucred {
 #define SOL_IUCV        277
 #define SOL_CAIF        278
 #define SOL_ALG         279
+#define SOL_NFC         280
 
 /* IPX options */
 #define IPX_TYPE        1
diff --git a/include/linux/ssb/ssb.h b/include/linux/ssb/ssb.h
index 22958d68ecfe..8b1322296fed 100644
--- a/include/linux/ssb/ssb.h
+++ b/include/linux/ssb/ssb.h
@@ -26,9 +26,9 @@ struct ssb_sprom_core_pwr_info {
 
 struct ssb_sprom {
         u8 revision;
-        u8 il0mac[6];           /* MAC address for 802.11b/g */
-        u8 et0mac[6];           /* MAC address for Ethernet */
-        u8 et1mac[6];           /* MAC address for 802.11a */
+        u8 il0mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11b/g */
+        u8 et0mac[6] __aligned(sizeof(u16));    /* MAC address for Ethernet */
+        u8 et1mac[6] __aligned(sizeof(u16));    /* MAC address for 802.11a */
         u8 et0phyaddr;          /* MII address for enet0 */
         u8 et1phyaddr;          /* MII address for enet1 */
         u8 et0mdcport;          /* MDIO for enet0 */
diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
index d581c6de5d64..bdba9b619064 100644
--- a/include/net/cfg80211.h
+++ b/include/net/cfg80211.h
@@ -611,22 +611,10 @@ struct cfg80211_ap_settings {
 };
 
 /**
- * enum plink_action - actions to perform in mesh peers
- *
- * @PLINK_ACTION_INVALID: action 0 is reserved
- * @PLINK_ACTION_OPEN: start mesh peer link establishment
- * @PLINK_ACTION_BLOCK: block traffic from this mesh peer
- */
-enum plink_actions {
-        PLINK_ACTION_INVALID,
-        PLINK_ACTION_OPEN,
-        PLINK_ACTION_BLOCK,
-};
-
-/**
  * enum station_parameters_apply_mask - station parameter values to apply
  * @STATION_PARAM_APPLY_UAPSD: apply new uAPSD parameters (uapsd_queues, max_sp)
  * @STATION_PARAM_APPLY_CAPABILITY: apply new capability
+ * @STATION_PARAM_APPLY_PLINK_STATE: apply new plink state
  *
  * Not all station parameters have in-band "no change" signalling,
  * for those that don't these flags will are used.
@@ -634,6 +622,7 @@ enum plink_actions {
 enum station_parameters_apply_mask {
         STATION_PARAM_APPLY_UAPSD = BIT(0),
         STATION_PARAM_APPLY_CAPABILITY = BIT(1),
+        STATION_PARAM_APPLY_PLINK_STATE = BIT(2),
 };
 
 /**
@@ -669,7 +658,7 @@ enum station_parameters_apply_mask {
  * @ext_capab_len: number of extended capabilities
  */
 struct station_parameters {
-        u8 *supported_rates;
+        const u8 *supported_rates;
         struct net_device *vlan;
         u32 sta_flags_mask, sta_flags_set;
         u32 sta_modify_mask;
@@ -678,17 +667,60 @@ struct station_parameters {
         u8 supported_rates_len;
         u8 plink_action;
         u8 plink_state;
-        struct ieee80211_ht_cap *ht_capa;
-        struct ieee80211_vht_cap *vht_capa;
+        const struct ieee80211_ht_cap *ht_capa;
+        const struct ieee80211_vht_cap *vht_capa;
         u8 uapsd_queues;
         u8 max_sp;
         enum nl80211_mesh_power_mode local_pm;
         u16 capability;
-        u8 *ext_capab;
+        const u8 *ext_capab;
         u8 ext_capab_len;
 };
 
 /**
+ * enum cfg80211_station_type - the type of station being modified
+ * @CFG80211_STA_AP_CLIENT: client of an AP interface
+ * @CFG80211_STA_AP_MLME_CLIENT: client of an AP interface that has
+ *      the AP MLME in the device
+ * @CFG80211_STA_AP_STA: AP station on managed interface
+ * @CFG80211_STA_IBSS: IBSS station
+ * @CFG80211_STA_TDLS_PEER_SETUP: TDLS peer on managed interface (dummy entry
+ *      while TDLS setup is in progress, it moves out of this state when
+ *      being marked authorized; use this only if TDLS with external setup is
+ *      supported/used)
+ * @CFG80211_STA_TDLS_PEER_ACTIVE: TDLS peer on managed interface (active
+ *      entry that is operating, has been marked authorized by userspace)
+ * @CFG80211_STA_MESH_PEER_KERNEL: peer on mesh interface (kernel managed)
+ * @CFG80211_STA_MESH_PEER_USER: peer on mesh interface (user managed)
+ */
+enum cfg80211_station_type {
+        CFG80211_STA_AP_CLIENT,
+        CFG80211_STA_AP_MLME_CLIENT,
+        CFG80211_STA_AP_STA,
+        CFG80211_STA_IBSS,
+        CFG80211_STA_TDLS_PEER_SETUP,
+        CFG80211_STA_TDLS_PEER_ACTIVE,
+        CFG80211_STA_MESH_PEER_KERNEL,
+        CFG80211_STA_MESH_PEER_USER,
+};
+
+/**
+ * cfg80211_check_station_change - validate parameter changes
+ * @wiphy: the wiphy this operates on
+ * @params: the new parameters for a station
+ * @statype: the type of station being modified
+ *
+ * Utility function for the @change_station driver method. Call this function
+ * with the appropriate station type looking up the station (and checking that
+ * it exists). It will verify whether the station change is acceptable, and if
+ * not will return an error code. Note that it may modify the parameters for
+ * backward compatibility reasons, so don't use them before calling this.
+ */
+int cfg80211_check_station_change(struct wiphy *wiphy,
+                                  struct station_parameters *params,
+                                  enum cfg80211_station_type statype);
+
+/**
  * enum station_info_flags - station information flags
  *
  * Used by the driver to indicate which info in &struct station_info
@@ -1119,6 +1151,7 @@ struct mesh_config {
  * @ie_len: length of vendor information elements
  * @is_authenticated: this mesh requires authentication
  * @is_secure: this mesh uses security
+ * @user_mpm: userspace handles all MPM functions
  * @dtim_period: DTIM period to use
  * @beacon_interval: beacon interval to use
  * @mcast_rate: multicat rate for Mesh Node [6Mbps is the default for 802.11a]
@@ -1136,6 +1169,7 @@ struct mesh_setup {
         u8 ie_len;
         bool is_authenticated;
         bool is_secure;
+        bool user_mpm;
         u8 dtim_period;
         u16 beacon_interval;
         int mcast_rate[IEEE80211_NUM_BANDS];
@@ -1398,9 +1432,11 @@ struct cfg80211_auth_request {
  * enum cfg80211_assoc_req_flags - Over-ride default behaviour in association.
  *
  * @ASSOC_REQ_DISABLE_HT:  Disable HT (802.11n)
+ * @ASSOC_REQ_DISABLE_VHT:  Disable VHT
  */
 enum cfg80211_assoc_req_flags {
         ASSOC_REQ_DISABLE_HT            = BIT(0),
+        ASSOC_REQ_DISABLE_VHT           = BIT(1),
 };
 
 /**
@@ -1422,6 +1458,8 @@ enum cfg80211_assoc_req_flags {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa: VHT capability override
+ * @vht_capa_mask: VHT capability mask indicating which fields to use
  */
 struct cfg80211_assoc_request {
         struct cfg80211_bss *bss;
@@ -1432,6 +1470,7 @@ struct cfg80211_assoc_request {
         u32 flags;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa, vht_capa_mask;
 };
 
 /**
@@ -1542,6 +1581,8 @@ struct cfg80211_ibss_params {
  * @ht_capa:  HT Capabilities over-rides.  Values set in ht_capa_mask
  *   will be used in ht_capa.  Un-supported values will be ignored.
  * @ht_capa_mask:  The bits of ht_capa which are to be used.
+ * @vht_capa:  VHT Capability overrides
+ * @vht_capa_mask: The bits of vht_capa which are to be used.
  */
 struct cfg80211_connect_params {
         struct ieee80211_channel *channel;
@@ -1560,6 +1601,8 @@ struct cfg80211_connect_params {
         int bg_scan_period;
         struct ieee80211_ht_cap ht_capa;
         struct ieee80211_ht_cap ht_capa_mask;
+        struct ieee80211_vht_cap vht_capa;
+        struct ieee80211_vht_cap vht_capa_mask;
 };
 
 /**
@@ -1722,6 +1765,21 @@ struct cfg80211_gtk_rekey_data {
 };
 
 /**
+ * struct cfg80211_update_ft_ies_params - FT IE Information
+ *
+ * This structure provides information needed to update the fast transition IE
+ *
+ * @md: The Mobility Domain ID, 2 Octet value
+ * @ie: Fast Transition IEs
+ * @ie_len: Length of ft_ie in octets
+ */
+struct cfg80211_update_ft_ies_params {
+        u16 md;
+        const u8 *ie;
+        size_t ie_len;
+};
+
+/**
  * struct cfg80211_ops - backend description for wireless configuration
  *
  * This struct is registered by fullmac card drivers and/or wireless stacks
@@ -1781,9 +1839,8 @@ struct cfg80211_gtk_rekey_data {
  * @change_station: Modify a given station. Note that flags changes are not much
  *      validated in cfg80211, in particular the auth/assoc/authorized flags
  *      might come to the driver in invalid combinations -- make sure to check
- *      them, also against the existing state! Also, supported_rates changes are
- *      not checked in station mode -- drivers need to reject (or ignore) them
- *      for anything but TDLS peers.
+ *      them, also against the existing state! Drivers must call
+ *      cfg80211_check_station_change() to validate the information.
  * @get_station: get station information for the station identified by @mac
  * @dump_station: dump station callback -- resume dump at index @idx
  *
@@ -2168,6 +2225,8 @@ struct cfg80211_ops {
         int     (*start_radar_detection)(struct wiphy *wiphy,
                                          struct net_device *dev,
                                          struct cfg80211_chan_def *chandef);
+        int     (*update_ft_ies)(struct wiphy *wiphy, struct net_device *dev,
+                                 struct cfg80211_update_ft_ies_params *ftie);
 };
 
 /*
@@ -2485,6 +2544,8 @@ struct wiphy_wowlan_support {
  * @ap_sme_capa: AP SME capabilities, flags from &enum nl80211_ap_sme_features.
  * @ht_capa_mod_mask:  Specify what ht_cap values can be over-ridden.
  *      If null, then none can be over-ridden.
+ * @vht_capa_mod_mask:  Specify what VHT capabilities can be over-ridden.
+ *      If null, then none can be over-ridden.
  *
  * @max_acl_mac_addrs: Maximum number of MAC addresses that the device
  *      supports for ACL.
@@ -2593,6 +2654,7 @@ struct wiphy {
         struct dentry *debugfsdir;
 
         const struct ieee80211_ht_cap *ht_capa_mod_mask;
+        const struct ieee80211_vht_cap *vht_capa_mod_mask;
 
 #ifdef CONFIG_NET_NS
         /* the network namespace this phy lives in currently */
@@ -4002,6 +4064,30 @@ u32 cfg80211_calculate_bitrate(struct rate_info *rate);
 void cfg80211_unregister_wdev(struct wireless_dev *wdev);
 
 /**
+ * struct cfg80211_ft_event - FT Information Elements
+ * @ies: FT IEs
+ * @ies_len: length of the FT IE in bytes
+ * @target_ap: target AP's MAC address
+ * @ric_ies: RIC IE
+ * @ric_ies_len: length of the RIC IE in bytes
+ */
+struct cfg80211_ft_event_params {
+        const u8 *ies;
+        size_t ies_len;
+        const u8 *target_ap;
+        const u8 *ric_ies;
+        size_t ric_ies_len;
+};
+
+/**
+ * cfg80211_ft_event - notify userspace about FT IE and RIC IE
+ * @netdev: network device
+ * @ft_event: IE information
+ */
+void cfg80211_ft_event(struct net_device *netdev,
+                       struct cfg80211_ft_event_params *ft_event);
+
+/**
  * cfg80211_get_p2p_attr - find and copy a P2P attribute from IE buffer
  * @ies: the input IE buffer
  * @len: the input length
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index f7eba1300d82..cdd7cea1fd4c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1101,8 +1101,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  * These flags are used for communication about keys between the driver
  * and mac80211, with the @flags parameter of &struct ieee80211_key_conf.
  *
- * @IEEE80211_KEY_FLAG_WMM_STA: Set by mac80211, this flag indicates
- *      that the STA this key will be used with could be using QoS.
  * @IEEE80211_KEY_FLAG_GENERATE_IV: This flag should be set by the
  *      driver to indicate that it requires IV generation for this
  *      particular key.
@@ -1127,7 +1125,6 @@ static inline bool ieee80211_vif_is_mesh(struct ieee80211_vif *vif)
  *      %IEEE80211_KEY_FLAG_SW_MGMT_TX flag to encrypt such frames in SW.
  */
 enum ieee80211_key_flags {
-        IEEE80211_KEY_FLAG_WMM_STA      = 1<<0,
         IEEE80211_KEY_FLAG_GENERATE_IV  = 1<<1,
         IEEE80211_KEY_FLAG_GENERATE_MMIC= 1<<2,
         IEEE80211_KEY_FLAG_PAIRWISE     = 1<<3,
@@ -1231,9 +1228,8 @@ enum ieee80211_sta_rx_bandwidth {
  * @addr: MAC address
  * @aid: AID we assigned to the station if we're an AP
  * @supp_rates: Bitmap of supported rates (per band)
- * @ht_cap: HT capabilities of this STA; restricted to our own TX capabilities
- * @vht_cap: VHT capabilities of this STA; Not restricting any capabilities
- *      of remote STA. Taking as is.
+ * @ht_cap: HT capabilities of this STA; restricted to our own capabilities
+ * @vht_cap: VHT capabilities of this STA; restricted to our own capabilities
  * @wme: indicates whether the STA supports WME. Only valid during AP-mode.
  * @drv_priv: data area for driver use, will always be aligned to
  *      sizeof(void *), size is determined in hw information.
@@ -2135,6 +2131,24 @@ enum ieee80211_rate_control_changed {
 };
 
 /**
+ * enum ieee80211_roc_type - remain on channel type
+ *
+ * With the support for multi channel contexts and multi channel operations,
+ * remain on channel operations might be limited/deferred/aborted by other
+ * flows/operations which have higher priority (and vise versa).
+ * Specifying the ROC type can be used by devices to prioritize the ROC
+ * operations compared to other operations/flows.
+ *
+ * @IEEE80211_ROC_TYPE_NORMAL: There are no special requirements for this ROC.
+ * @IEEE80211_ROC_TYPE_MGMT_TX: The remain on channel request is required
+ *      for sending managment frames offchannel.
+ */
+enum ieee80211_roc_type {
+        IEEE80211_ROC_TYPE_NORMAL = 0,
+        IEEE80211_ROC_TYPE_MGMT_TX,
+};
+
+/**
  * struct ieee80211_ops - callbacks from mac80211 to the driver
  *
  * This structure contains various callbacks that the driver may
@@ -2687,7 +2701,8 @@ struct ieee80211_ops {
         int (*remain_on_channel)(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_channel *chan,
-                                 int duration);
+                                 int duration,
+                                 enum ieee80211_roc_type type);
         int (*cancel_remain_on_channel)(struct ieee80211_hw *hw);
         int (*set_ringparam)(struct ieee80211_hw *hw, u32 tx, u32 rx);
         void (*get_ringparam)(struct ieee80211_hw *hw,
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 23f2e98d4b65..cf0694d4ad60 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -1045,6 +1045,10 @@ static inline bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
         if (sysctl_tcp_low_latency || !tp->ucopy.task)
                 return false;
 
+        if (skb->len <= tcp_hdrlen(skb) &&
+            skb_queue_len(&tp->ucopy.prequeue) == 0)
+                return false;
+
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
         if (tp->ucopy.memory > sk->sk_rcvbuf) {
diff --git a/include/uapi/linux/nfc.h b/include/uapi/linux/nfc.h
index 7969f46f1bb3..7440bc81a04b 100644
--- a/include/uapi/linux/nfc.h
+++ b/include/uapi/linux/nfc.h
@@ -90,6 +90,8 @@ enum nfc_commands {
         NFC_CMD_LLC_SET_PARAMS,
         NFC_CMD_ENABLE_SE,
         NFC_CMD_DISABLE_SE,
+        NFC_CMD_LLC_SDREQ,
+        NFC_EVENT_LLC_SDRES,
 /* private: internal use only */
         __NFC_CMD_AFTER_LAST
 };
@@ -140,11 +142,21 @@ enum nfc_attrs {
         NFC_ATTR_LLC_PARAM_RW,
         NFC_ATTR_LLC_PARAM_MIUX,
         NFC_ATTR_SE,
+        NFC_ATTR_LLC_SDP,
 /* private: internal use only */
         __NFC_ATTR_AFTER_LAST
 };
 #define NFC_ATTR_MAX (__NFC_ATTR_AFTER_LAST - 1)
 
+enum nfc_sdp_attr {
+        NFC_SDP_ATTR_UNSPEC,
+        NFC_SDP_ATTR_URI,
+        NFC_SDP_ATTR_SAP,
+/* private: internal use only */
+        __NFC_SDP_ATTR_AFTER_LAST
+};
+#define NFC_SDP_ATTR_MAX (__NFC_SDP_ATTR_AFTER_LAST - 1)
+
 #define NFC_DEVICE_NAME_MAXSIZE 8
 #define NFC_NFCID1_MAXSIZE 10
 #define NFC_SENSB_RES_MAXSIZE 12
@@ -220,4 +232,8 @@ struct sockaddr_nfc_llcp {
 #define NFC_LLCP_DIRECTION_RX           0x00
 #define NFC_LLCP_DIRECTION_TX           0x01
 
+/* socket option names */
+#define NFC_LLCP_RW   0
+#define NFC_LLCP_MIUX 1
+
 #endif /*__LINUX_NFC_H */
diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h
index c46bb016f4e4..79da8710448e 100644
--- a/include/uapi/linux/nl80211.h
+++ b/include/uapi/linux/nl80211.h
@@ -36,7 +36,21 @@
  * The station is still assumed to belong to the AP interface it was added
  * to.
  *
- * TODO: need more info?
+ * Station handling varies per interface type and depending on the driver's
+ * capabilities.
+ *
+ * For drivers supporting TDLS with external setup (WIPHY_FLAG_SUPPORTS_TDLS
+ * and WIPHY_FLAG_TDLS_EXTERNAL_SETUP), the station lifetime is as follows:
+ *  - a setup station entry is added, not yet authorized, without any rate
+ *    or capability information, this just exists to avoid race conditions
+ *  - when the TDLS setup is done, a single NL80211_CMD_SET_STATION is valid
+ *    to add rate and capability information to the station and at the same
+ *    time mark it authorized.
+ *  - %NL80211_TDLS_ENABLE_LINK is then used
+ *  - after this, the only valid operation is to remove it by tearing down
+ *    the TDLS link (%NL80211_TDLS_DISABLE_LINK)
+ *
+ * TODO: need more info for other interface types
  */
 
 /**
@@ -499,9 +513,11 @@
  * @NL80211_CMD_NEW_PEER_CANDIDATE: Notification on the reception of a
  *      beacon or probe response from a compatible mesh peer.  This is only
  *      sent while no station information (sta_info) exists for the new peer
- *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH is set.  On
- *      reception of this notification, userspace may decide to create a new
- *      station (@NL80211_CMD_NEW_STATION).  To stop this notification from
+ *      candidate and when @NL80211_MESH_SETUP_USERSPACE_AUTH,
+ *      @NL80211_MESH_SETUP_USERSPACE_AMPE, or
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM is set.  On reception of this
+ *      notification, userspace may decide to create a new station
+ *      (@NL80211_CMD_NEW_STATION).  To stop this notification from
  *      reoccurring, the userspace authentication daemon may want to create the
  *      new station with the AUTHENTICATED flag unset and maybe change it later
  *      depending on the authentication result.
@@ -611,6 +627,18 @@
  *      %NL80211_ATTR_RADAR_EVENT is used to inform about the type of the
  *      event.
  *
+ * @NL80211_CMD_GET_PROTOCOL_FEATURES: Get global nl80211 protocol features,
+ *      i.e. features for the nl80211 protocol rather than device features.
+ *      Returns the features in the %NL80211_ATTR_PROTOCOL_FEATURES bitmap.
+ *
+ * @NL80211_CMD_UPDATE_FT_IES: Pass down the most up-to-date Fast Transition
+ *      Information Element to the WLAN driver
+ *
+ * @NL80211_CMD_FT_EVENT: Send a Fast transition event from the WLAN driver
+ *      to the supplicant. This will carry the target AP's MAC address along
+ *      with the relevant Information Elements. This event is used to report
+ *      received FT IEs (MDIE, FTIE, RSN IE, TIE, RICIE).
+ *
  * @NL80211_CMD_MAX: highest used command number
  * @__NL80211_CMD_AFTER_LAST: internal use
  */
@@ -765,6 +793,11 @@ enum nl80211_commands {
 
         NL80211_CMD_RADAR_DETECT,
 
+        NL80211_CMD_GET_PROTOCOL_FEATURES,
+
+        NL80211_CMD_UPDATE_FT_IES,
+        NL80211_CMD_FT_EVENT,
+
         /* add new commands above here */
 
         /* used to define NL80211_CMD_MAX below */
@@ -884,7 +917,8 @@ enum nl80211_commands {
  *      consisting of a nested array.
  *
  * @NL80211_ATTR_MESH_ID: mesh id (1-32 bytes).
- * @NL80211_ATTR_STA_PLINK_ACTION: action to perform on the mesh peer link.
+ * @NL80211_ATTR_STA_PLINK_ACTION: action to perform on the mesh peer link
+ *      (see &enum nl80211_plink_action).
  * @NL80211_ATTR_MPATH_NEXT_HOP: MAC address of the next hop for a mesh path.
  * @NL80211_ATTR_MPATH_INFO: information about a mesh_path, part of mesh path
  *      info given for %NL80211_CMD_GET_MPATH, nested attribute described at
@@ -1167,10 +1201,10 @@ enum nl80211_commands {
  * @NL80211_ATTR_SUPPORT_MESH_AUTH: Currently, this means the underlying driver
  *      allows auth frames in a mesh to be passed to userspace for processing via
  *      the @NL80211_MESH_SETUP_USERSPACE_AUTH flag.
- * @NL80211_ATTR_STA_PLINK_STATE: The state of a mesh peer link as
- *      defined in &enum nl80211_plink_state. Used when userspace is
- *      driving the peer link management state machine.
- *      @NL80211_MESH_SETUP_USERSPACE_AMPE must be enabled.
+ * @NL80211_ATTR_STA_PLINK_STATE: The state of a mesh peer link as defined in
+ *      &enum nl80211_plink_state. Used when userspace is driving the peer link
+ *      management state machine.  @NL80211_MESH_SETUP_USERSPACE_AMPE or
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM must be enabled.
  *
  * @NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED: indicates, as part of the wiphy
  *      capabilities, the supported WoWLAN triggers
@@ -1368,6 +1402,18 @@ enum nl80211_commands {
  *      advertised to the driver, e.g., to enable TDLS off channel operations
  *      and PU-APSD.
  *
+ * @NL80211_ATTR_PROTOCOL_FEATURES: global nl80211 feature flags, see
+ *      &enum nl80211_protocol_features, the attribute is a u32.
+ *
+ * @NL80211_ATTR_SPLIT_WIPHY_DUMP: flag attribute, userspace supports
+ *      receiving the data for a single wiphy split across multiple
+ *      messages, given with wiphy dump message
+ *
+ * @NL80211_ATTR_MDID: Mobility Domain Identifier
+ *
+ * @NL80211_ATTR_IE_RIC: Resource Information Container Information
+ *      Element
+ *
  * @NL80211_ATTR_MAX: highest attribute number currently defined
  * @__NL80211_ATTR_AFTER_LAST: internal use
  */
@@ -1654,6 +1700,15 @@ enum nl80211_attrs {
         NL80211_ATTR_STA_CAPABILITY,
         NL80211_ATTR_STA_EXT_CAPABILITY,
 
+        NL80211_ATTR_PROTOCOL_FEATURES,
+        NL80211_ATTR_SPLIT_WIPHY_DUMP,
+
+        NL80211_ATTR_DISABLE_VHT,
+        NL80211_ATTR_VHT_CAPABILITY_MASK,
+
+        NL80211_ATTR_MDID,
+        NL80211_ATTR_IE_RIC,
+
         /* add attributes here, update the policy in nl80211.c */
 
         __NL80211_ATTR_AFTER_LAST,
@@ -2412,8 +2467,10 @@ enum nl80211_mesh_power_mode {
  * @NL80211_MESHCONF_TTL: specifies the value of TTL field set at a source mesh
  *      point.
  *
- * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically
- *      open peer links when we detect compatible mesh peers.
+ * @NL80211_MESHCONF_AUTO_OPEN_PLINKS: whether we should automatically open
+ *      peer links when we detect compatible mesh peers. Disabled if
+ *      @NL80211_MESH_SETUP_USERSPACE_MPM or @NL80211_MESH_SETUP_USERSPACE_AMPE are
+ *      set.
  *
  * @NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES: the number of action frames
  *      containing a PREQ that an MP can send to a particular destination (path
@@ -2559,6 +2616,9 @@ enum nl80211_meshconf_params {
  *      vendor specific synchronization method or disable it to use the default
  *      neighbor offset synchronization
  *
+ * @NL80211_MESH_SETUP_USERSPACE_MPM: Enable this option if userspace will
+ *      implement an MPM which handles peer allocation and state.
+ *
  * @NL80211_MESH_SETUP_ATTR_MAX: highest possible mesh setup attribute number
  *
  * @__NL80211_MESH_SETUP_ATTR_AFTER_LAST: Internal use
@@ -2571,6 +2631,7 @@ enum nl80211_mesh_setup_params {
         NL80211_MESH_SETUP_USERSPACE_AUTH,
         NL80211_MESH_SETUP_USERSPACE_AMPE,
         NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC,
+        NL80211_MESH_SETUP_USERSPACE_MPM,
 
         /* keep last */
         __NL80211_MESH_SETUP_ATTR_AFTER_LAST,
@@ -3307,6 +3368,23 @@ enum nl80211_plink_state {
         MAX_NL80211_PLINK_STATES = NUM_NL80211_PLINK_STATES - 1
 };
 
+/**
+ * enum nl80211_plink_action - actions to perform in mesh peers
+ *
+ * @NL80211_PLINK_ACTION_NO_ACTION: perform no action
+ * @NL80211_PLINK_ACTION_OPEN: start mesh peer link establishment
+ * @NL80211_PLINK_ACTION_BLOCK: block traffic from this mesh peer
+ * @NUM_NL80211_PLINK_ACTIONS: number of possible actions
+ */
+enum plink_actions {
+        NL80211_PLINK_ACTION_NO_ACTION,
+        NL80211_PLINK_ACTION_OPEN,
+        NL80211_PLINK_ACTION_BLOCK,
+
+        NUM_NL80211_PLINK_ACTIONS,
+};
+
+
 #define NL80211_KCK_LEN                 16
 #define NL80211_KEK_LEN                 16
 #define NL80211_REPLAY_CTR_LEN          8
@@ -3456,6 +3534,10 @@ enum nl80211_ap_sme_features {
  *      stations the authenticated/associated bits have to be set in the mask.
  * @NL80211_FEATURE_ADVERTISE_CHAN_LIMITS: cfg80211 advertises channel limits
  *      (HT40, VHT 80/160 MHz) if this flag is set
+ * @NL80211_FEATURE_USERSPACE_MPM: This driver supports a userspace Mesh
+ *      Peering Management entity which may be implemented by registering for
+ *      beacons or NL80211_CMD_NEW_PEER_CANDIDATE events. The mesh beacon is
+ *      still generated by the driver.
  */
 enum nl80211_feature_flags {
         NL80211_FEATURE_SK_TX_STATUS                    = 1 << 0,
@@ -3474,6 +3556,7 @@ enum nl80211_feature_flags {
         /* bit 13 is reserved */
         NL80211_FEATURE_ADVERTISE_CHAN_LIMITS           = 1 << 14,
         NL80211_FEATURE_FULL_AP_CLIENT_STATE            = 1 << 15,
+        NL80211_FEATURE_USERSPACE_MPM                   = 1 << 16,
 };
 
 /**
@@ -3587,4 +3670,16 @@ enum nl80211_dfs_state {
         NL80211_DFS_AVAILABLE,
 };
 
+/**
+ * enum enum nl80211_protocol_features - nl80211 protocol features
+ * @NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP: nl80211 supports splitting
+ *      wiphy dumps (if requested by the application with the attribute
+ *      %NL80211_ATTR_SPLIT_WIPHY_DUMP. Also supported is filtering the
+ *      wiphy dump by %NL80211_ATTR_WIPHY, %NL80211_ATTR_IFINDEX or
+ *      %NL80211_ATTR_WDEV.
+ */
+enum nl80211_protocol_features {
+        NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP =     1 << 0,
+};
+
 #endif /* __LINUX_NL80211_H */
diff --git a/kernel/smpboot.c b/kernel/smpboot.c
index b9bde5727829..25d3d8b6e4e1 100644
--- a/kernel/smpboot.c
+++ b/kernel/smpboot.c
@@ -209,6 +209,8 @@ static void smpboot_unpark_thread(struct smp_hotplug_thread *ht, unsigned int cp
 {
         struct task_struct *tsk = *per_cpu_ptr(ht->store, cpu);
 
+        if (ht->pre_unpark)
+                ht->pre_unpark(cpu);
         kthread_unpark(tsk);
 }
 
diff --git a/kernel/softirq.c b/kernel/softirq.c
index b4d252fd195b..14d7758074aa 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -323,18 +323,10 @@ void irq_enter(void)
 
 static inline void invoke_softirq(void)
 {
-        if (!force_irqthreads) {
-#ifdef __ARCH_IRQ_EXIT_IRQS_DISABLED
+        if (!force_irqthreads)
                 __do_softirq();
-#else
-                do_softirq();
-#endif
-        } else {
-                __local_bh_disable((unsigned long)__builtin_return_address(0),
-                                SOFTIRQ_OFFSET);
+        else
                 wakeup_softirqd();
-                __local_bh_enable(SOFTIRQ_OFFSET);
-        }
 }
 
 /*
@@ -342,9 +334,15 @@ static inline void invoke_softirq(void)
  */
 void irq_exit(void)
 {
+#ifndef __ARCH_IRQ_EXIT_IRQS_DISABLED
+        local_irq_disable();
+#else
+        WARN_ON_ONCE(!irqs_disabled());
+#endif
+
         account_irq_exit_time(current);
         trace_hardirq_exit();
-        sub_preempt_count(IRQ_EXIT_OFFSET);
+        sub_preempt_count(HARDIRQ_OFFSET);
         if (!in_interrupt() && local_softirq_pending())
                 invoke_softirq();
 
@@ -354,7 +352,6 @@ void irq_exit(void)
                 tick_nohz_irq_exit();
 #endif
         rcu_irq_exit();
-        sched_preempt_enable_no_resched();
 }
 
 /*
diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c
index 95d178c62d5a..c09f2955ae30 100644
--- a/kernel/stop_machine.c
+++ b/kernel/stop_machine.c
@@ -336,7 +336,7 @@ static struct smp_hotplug_thread cpu_stop_threads = {
         .create                 = cpu_stop_create,
         .setup                  = cpu_stop_unpark,
         .park                   = cpu_stop_park,
-        .unpark                 = cpu_stop_unpark,
+        .pre_unpark             = cpu_stop_unpark,
         .selfparking            = true,
 };
 
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 1ae1d9cb278d..21760f008974 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -118,7 +118,7 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
         return NULL;
 }
 
-void caif_flow_cb(struct sk_buff *skb)
+static void caif_flow_cb(struct sk_buff *skb)
 {
         struct caif_device_entry *caifd;
         void (*dtor)(struct sk_buff *skb) = NULL;
diff --git a/net/caif/caif_usb.c b/net/caif/caif_usb.c
index 3ebc8cbc91ff..ef8ebaa993cf 100644
--- a/net/caif/caif_usb.c
+++ b/net/caif/caif_usb.c
@@ -81,8 +81,8 @@ static void cfusbl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
                 layr->up->ctrlcmd(layr->up, ctrl, layr->id);
 }
 
-struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
-                                        u8 braddr[ETH_ALEN])
+static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN],
+                                      u8 braddr[ETH_ALEN])
 {
         struct cfusbl *this = kmalloc(sizeof(struct cfusbl), GFP_ATOMIC);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index a06a7a58dd11..8f152f904f70 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4103,7 +4103,7 @@ static void net_rx_action(struct softirq_action *h)
                  * Allow this to run for 2 jiffies since which will allow
                  * an average latency of 1.5/HZ.
                  */
-                if (unlikely(budget <= 0 || time_after(jiffies, time_limit)))
+                if (unlikely(budget <= 0 || time_after_eq(jiffies, time_limit)))
                         goto softnet_break;
 
                 local_irq_enable();
@@ -4780,7 +4780,7 @@ EXPORT_SYMBOL(dev_set_mac_address);
 /**
  *      dev_change_carrier - Change device carrier
  *      @dev: device
- *      @new_carries: new value
+ *      @new_carrier: new value
  *
  *      Change device carrier
  */
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 87abd3e2bd32..2bdf802e28e2 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -228,9 +228,11 @@ static int ip_local_deliver_finish(struct sk_buff *skb)
                                         icmp_send(skb, ICMP_DEST_UNREACH,
                                                   ICMP_PROT_UNREACH, 0);
                                 }
-                        } else
+                                kfree_skb(skb);
+                        } else {
                                 IP_INC_STATS_BH(net, IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
+                                consume_skb(skb);
+                        }
                 }
         }
  out:
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index f6289bf6f332..310a3647c83d 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -423,7 +423,7 @@ int ip_options_compile(struct net *net,
                                         put_unaligned_be32(midtime, timeptr);
                                         opt->is_changed = 1;
                                 }
-                        } else {
+                        } else if ((optptr[3]&0xF) != IPOPT_TS_PRESPEC) {
                                 unsigned int overflow = optptr[3]>>4;
                                 if (overflow == 15) {
                                         pp_ptr = optptr + 3;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a759e19496d2..0d9bdacce99f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5485,6 +5485,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                 if (tcp_checksum_complete_user(sk, skb))
                                         goto csum_error;
 
+                                if ((int)skb->truesize > sk->sk_forward_alloc)
+                                        goto step5;
+
                                 /* Predicted packet is in window by definition.
                                  * seq == rcv_nxt and rcv_wup <= rcv_nxt.
                                  * Hence, check seq<=rcv_wup reduces to:
@@ -5496,9 +5499,6 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
 
                                 tcp_rcv_rtt_measure_ts(sk, skb);
 
-                                if ((int)skb->truesize > sk->sk_forward_alloc)
-                                        goto step5;
-
                                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPHPHITS);
 
                                 /* Bulk data transfer: receiver */
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 5b10414e619e..b1876e52091e 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -241,9 +241,11 @@ resubmit:
                                 icmpv6_send(skb, ICMPV6_PARAMPROB,
                                             ICMPV6_UNK_NEXTHDR, nhoff);
                         }
-                } else
+                        kfree_skb(skb);
+                } else {
                         IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
-                kfree_skb(skb);
+                        consume_skb(skb);
+                }
         }
         rcu_read_unlock();
         return 0;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 928266569689..e5fe0041adfa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1915,7 +1915,8 @@ void rt6_purge_dflt_routers(struct net *net)
 restart:
         read_lock_bh(&table->tb6_lock);
         for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
-                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) {
+                if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
+                    (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
                         dst_hold(&rt->dst);
                         read_unlock_bh(&table->tb6_lock);
                         ip6_del_rt(rt);
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index 9a5fd3c3e530..362ba47968e4 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -280,7 +280,7 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
         struct tty_port *port = &self->port;
         DECLARE_WAITQUEUE(wait, current);
         int             retval;
-        int             do_clocal = 0, extra_count = 0;
+        int             do_clocal = 0;
         unsigned long   flags;
 
         IRDA_DEBUG(2, "%s()\n", __func__ );
@@ -289,8 +289,15 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
          * If non-blocking mode is set, or the port is not enabled,
          * then make the check up front and then exit.
          */
-        if (filp->f_flags & O_NONBLOCK || tty->flags & (1 << TTY_IO_ERROR)){
-                /* nonblock mode is set or port is not enabled */
+        if (test_bit(TTY_IO_ERROR, &tty->flags)) {
+                port->flags |= ASYNC_NORMAL_ACTIVE;
+                return 0;
+        }
+
+        if (filp->f_flags & O_NONBLOCK) {
+                /* nonblock mode is set */
+                if (tty->termios.c_cflag & CBAUD)
+                        tty_port_raise_dtr_rts(port);
                 port->flags |= ASYNC_NORMAL_ACTIVE;
                 IRDA_DEBUG(1, "%s(), O_NONBLOCK requested!\n", __func__ );
                 return 0;
@@ -315,18 +322,16 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
               __FILE__, __LINE__, tty->driver->name, port->count);
 
         spin_lock_irqsave(&port->lock, flags);
-        if (!tty_hung_up_p(filp)) {
-                extra_count = 1;
+        if (!tty_hung_up_p(filp))
                 port->count--;
-        }
-        spin_unlock_irqrestore(&port->lock, flags);
         port->blocked_open++;
+        spin_unlock_irqrestore(&port->lock, flags);
 
         while (1) {
                 if (tty->termios.c_cflag & CBAUD)
                         tty_port_raise_dtr_rts(port);
 
-                current->state = TASK_INTERRUPTIBLE;
+                set_current_state(TASK_INTERRUPTIBLE);
 
                 if (tty_hung_up_p(filp) ||
                     !test_bit(ASYNCB_INITIALIZED, &port->flags)) {
@@ -361,13 +366,11 @@ static int ircomm_tty_block_til_ready(struct ircomm_tty_cb *self,
         __set_current_state(TASK_RUNNING);
         remove_wait_queue(&port->open_wait, &wait);
 
-        if (extra_count) {
-                /* ++ is not atomic, so this should be protected - Jean II */
-                spin_lock_irqsave(&port->lock, flags);
+        spin_lock_irqsave(&port->lock, flags);
+        if (!tty_hung_up_p(filp))
                 port->count++;
-                spin_unlock_irqrestore(&port->lock, flags);
-        }
         port->blocked_open--;
+        spin_unlock_irqrestore(&port->lock, flags);
 
         IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
               __FILE__, __LINE__, tty->driver->name, port->count);
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index e71e85ba2bf1..29340a9a6fb9 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -495,8 +495,11 @@ static void iriap_getvaluebyclass_confirm(struct iriap_cb *self,
 /*              case CS_ISO_8859_9: */
 /*              case CS_UNICODE: */
                 default:
-                        IRDA_DEBUG(0, "%s(), charset %s, not supported\n",
-                                   __func__, ias_charset_types[charset]);
+                        IRDA_DEBUG(0, "%s(), charset [%d] %s, not supported\n",
+                                   __func__, charset,
+                                   charset < ARRAY_SIZE(ias_charset_types) ?
+                                        ias_charset_types[charset] :
+                                        "(unknown)");
 
                         /* Aborting, close connection! */
                         iriap_disconnect_request(self);
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 3f4e3afc191a..6a53371dba1f 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -355,6 +355,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         l2tp_xmit_skb(session, skb, session->hdr_len);
 
         sock_put(ps->tunnel_sock);
+        sock_put(sk);
 
         return error;
 
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 09d96a8f6c2c..1d1ddabd89ca 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -254,7 +254,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev,
                 goto out_unlock;
         }
 
-        __ieee80211_key_free(key);
+        __ieee80211_key_free(key, true);
 
         ret = 0;
  out_unlock:
@@ -1035,9 +1035,12 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
                 sta_info_flush_defer(vlan);
         sta_info_flush_defer(sdata);
         rcu_barrier();
-        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list) {
                 sta_info_flush_cleanup(vlan);
+                ieee80211_free_keys(vlan);
+        }
         sta_info_flush_cleanup(sdata);
+        ieee80211_free_keys(sdata);
 
         sdata->vif.bss_conf.enable_beacon = false;
         clear_bit(SDATA_STATE_OFFCHANNEL_BEACON_STOPPED, &sdata->state);
@@ -1177,6 +1180,18 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                         mask |= BIT(NL80211_STA_FLAG_ASSOCIATED);
                 if (set & BIT(NL80211_STA_FLAG_AUTHENTICATED))
                         set |= BIT(NL80211_STA_FLAG_ASSOCIATED);
+        } else if (test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
+                /*
+                 * TDLS -- everything follows authorized, but
+                 * only becoming authorized is possible, not
+                 * going back
+                 */
+                if (set & BIT(NL80211_STA_FLAG_AUTHORIZED)) {
+                        set |= BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                               BIT(NL80211_STA_FLAG_ASSOCIATED);
+                        mask |= BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                BIT(NL80211_STA_FLAG_ASSOCIATED);
+                }
         }
 
         ret = sta_apply_auth_flags(local, sta, mask, set);
@@ -1261,7 +1276,8 @@ static int sta_apply_parameters(struct ieee80211_local *local,
         if (ieee80211_vif_is_mesh(&sdata->vif)) {
 #ifdef CONFIG_MAC80211_MESH
                 u32 changed = 0;
-                if (sdata->u.mesh.security & IEEE80211_MESH_SEC_SECURED) {
+
+                if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE) {
                         switch (params->plink_state) {
                         case NL80211_PLINK_ESTAB:
                                 if (sta->plink_state != NL80211_PLINK_ESTAB)
@@ -1292,15 +1308,18 @@ static int sta_apply_parameters(struct ieee80211_local *local,
                                 /*  nothing  */
                                 break;
                         }
-                } else {
-                        switch (params->plink_action) {
-                        case PLINK_ACTION_OPEN:
-                                changed |= mesh_plink_open(sta);
-                                break;
-                        case PLINK_ACTION_BLOCK:
-                                changed |= mesh_plink_block(sta);
-                                break;
-                        }
+                }
+
+                switch (params->plink_action) {
+                case NL80211_PLINK_ACTION_NO_ACTION:
+                        /* nothing */
+                        break;
+                case NL80211_PLINK_ACTION_OPEN:
+                        changed |= mesh_plink_open(sta);
+                        break;
+                case NL80211_PLINK_ACTION_BLOCK:
+                        changed |= mesh_plink_block(sta);
+                        break;
                 }
 
                 if (params->local_pm)
@@ -1346,8 +1365,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
          * defaults -- if userspace wants something else we'll
          * change it accordingly in sta_apply_parameters()
          */
-        sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
-        sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))) {
+                sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
+                sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
+        }
 
         err = sta_apply_parameters(local, sta, params);
         if (err) {
@@ -1356,8 +1377,8 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,
         }
 
         /*
-         * for TDLS, rate control should be initialized only when supported
-         * rates are known.
+         * for TDLS, rate control should be initialized only when
+         * rates are known and station is marked authorized
          */
         if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER))
                 rate_control_rate_init(sta);
@@ -1394,50 +1415,67 @@ static int ieee80211_del_station(struct wiphy *wiphy, struct net_device *dev,
 }
 
 static int ieee80211_change_station(struct wiphy *wiphy,
-                                    struct net_device *dev,
-                                    u8 *mac,
+                                    struct net_device *dev, u8 *mac,
                                     struct station_parameters *params)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
         struct ieee80211_local *local = wiphy_priv(wiphy);
         struct sta_info *sta;
         struct ieee80211_sub_if_data *vlansdata;
+        enum cfg80211_station_type statype;
         int err;
 
         mutex_lock(&local->sta_mtx);
 
         sta = sta_info_get_bss(sdata, mac);
         if (!sta) {
-                mutex_unlock(&local->sta_mtx);
-                return -ENOENT;
+                err = -ENOENT;
+                goto out_err;
         }
 
-        /* in station mode, some updates are only valid with TDLS */
-        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
-            (params->supported_rates || params->ht_capa || params->vht_capa ||
-             params->sta_modify_mask ||
-             (params->sta_flags_mask & BIT(NL80211_STA_FLAG_WME))) &&
-            !test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
-                mutex_unlock(&local->sta_mtx);
-                return -EINVAL;
+        switch (sdata->vif.type) {
+        case NL80211_IFTYPE_MESH_POINT:
+                if (sdata->u.mesh.user_mpm)
+                        statype = CFG80211_STA_MESH_PEER_USER;
+                else
+                        statype = CFG80211_STA_MESH_PEER_KERNEL;
+                break;
+        case NL80211_IFTYPE_ADHOC:
+                statype = CFG80211_STA_IBSS;
+                break;
+        case NL80211_IFTYPE_STATION:
+                if (!test_sta_flag(sta, WLAN_STA_TDLS_PEER)) {
+                        statype = CFG80211_STA_AP_STA;
+                        break;
+                }
+                if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
+                        statype = CFG80211_STA_TDLS_PEER_ACTIVE;
+                else
+                        statype = CFG80211_STA_TDLS_PEER_SETUP;
+                break;
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_AP_VLAN:
+                statype = CFG80211_STA_AP_CLIENT;
+                break;
+        default:
+                err = -EOPNOTSUPP;
+                goto out_err;
         }
 
+        err = cfg80211_check_station_change(wiphy, params, statype);
+        if (err)
+                goto out_err;
+
         if (params->vlan && params->vlan != sta->sdata->dev) {
                 bool prev_4addr = false;
                 bool new_4addr = false;
 
                 vlansdata = IEEE80211_DEV_TO_SUB_IF(params->vlan);
 
-                if (vlansdata->vif.type != NL80211_IFTYPE_AP_VLAN &&
-                    vlansdata->vif.type != NL80211_IFTYPE_AP) {
-                        mutex_unlock(&local->sta_mtx);
-                        return -EINVAL;
-                }
-
                 if (params->vlan->ieee80211_ptr->use_4addr) {
                         if (vlansdata->u.vlan.sta) {
-                                mutex_unlock(&local->sta_mtx);
-                                return -EBUSY;
+                                err = -EBUSY;
+                                goto out_err;
                         }
 
                         rcu_assign_pointer(vlansdata->u.vlan.sta, sta);
@@ -1464,12 +1502,12 @@ static int ieee80211_change_station(struct wiphy *wiphy,
         }
 
         err = sta_apply_parameters(local, sta, params);
-        if (err) {
-                mutex_unlock(&local->sta_mtx);
-                return err;
-        }
+        if (err)
+                goto out_err;
 
-        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) && params->supported_rates)
+        /* When peer becomes authorized, init rate control as well */
+        if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) &&
+            test_sta_flag(sta, WLAN_STA_AUTHORIZED))
                 rate_control_rate_init(sta);
 
         mutex_unlock(&local->sta_mtx);
@@ -1479,7 +1517,11 @@ static int ieee80211_change_station(struct wiphy *wiphy,
                 ieee80211_recalc_ps(local, -1);
                 ieee80211_recalc_ps_vif(sdata);
         }
+
         return 0;
+out_err:
+        mutex_unlock(&local->sta_mtx);
+        return err;
 }
 
 #ifdef CONFIG_MAC80211_MESH
@@ -1687,6 +1729,7 @@ static int copy_mesh_setup(struct ieee80211_if_mesh *ifmsh,
         ifmsh->mesh_sp_id = setup->sync_method;
         ifmsh->mesh_pp_id = setup->path_sel_proto;
         ifmsh->mesh_pm_id = setup->path_metric;
+        ifmsh->user_mpm = setup->user_mpm;
         ifmsh->security = IEEE80211_MESH_SEC_NONE;
         if (setup->is_authenticated)
                 ifmsh->security |= IEEE80211_MESH_SEC_AUTHED;
@@ -1730,8 +1773,11 @@ static int ieee80211_update_mesh_config(struct wiphy *wiphy,
                 conf->dot11MeshTTL = nconf->dot11MeshTTL;
         if (_chg_mesh_attr(NL80211_MESHCONF_ELEMENT_TTL, mask))
                 conf->element_ttl = nconf->element_ttl;
-        if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask))
+        if (_chg_mesh_attr(NL80211_MESHCONF_AUTO_OPEN_PLINKS, mask)) {
+                if (ifmsh->user_mpm)
+                        return -EBUSY;
                 conf->auto_open_plinks = nconf->auto_open_plinks;
+        }
         if (_chg_mesh_attr(NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR, mask))
                 conf->dot11MeshNbrOffsetMaxNeighbor =
                         nconf->dot11MeshNbrOffsetMaxNeighbor;
@@ -2371,7 +2417,8 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                                     struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_channel *channel,
                                     unsigned int duration, u64 *cookie,
-                                    struct sk_buff *txskb)
+                                    struct sk_buff *txskb,
+                                    enum ieee80211_roc_type type)
 {
         struct ieee80211_roc_work *roc, *tmp;
         bool queued = false;
@@ -2390,6 +2437,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         roc->duration = duration;
         roc->req_duration = duration;
         roc->frame = txskb;
+        roc->type = type;
         roc->mgmt_tx_cookie = (unsigned long)txskb;
         roc->sdata = sdata;
         INIT_DELAYED_WORK(&roc->work, ieee80211_sw_roc_work);
@@ -2420,7 +2468,7 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
         if (!duration)
                 duration = 10;
 
-        ret = drv_remain_on_channel(local, sdata, channel, duration);
+        ret = drv_remain_on_channel(local, sdata, channel, duration, type);
         if (ret) {
                 kfree(roc);
                 return ret;
@@ -2439,10 +2487,13 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                  *
                  * If it hasn't started yet, just increase the duration
                  * and add the new one to the list of dependents.
+                 * If the type of the new ROC has higher priority, modify the
+                 * type of the previous one to match that of the new one.
                  */
                 if (!tmp->started) {
                         list_add_tail(&roc->list, &tmp->dependents);
                         tmp->duration = max(tmp->duration, roc->duration);
+                        tmp->type = max(tmp->type, roc->type);
                         queued = true;
                         break;
                 }
@@ -2454,16 +2505,18 @@ static int ieee80211_start_roc_work(struct ieee80211_local *local,
                         /*
                          * In the offloaded ROC case, if it hasn't begun, add
                          * this new one to the dependent list to be handled
-                         * when the the master one begins. If it has begun,
+                         * when the master one begins. If it has begun,
                          * check that there's still a minimum time left and
                          * if so, start this one, transmitting the frame, but
-                         * add it to the list directly after this one with a
+                         * add it to the list directly after this one with
                          * a reduced time so we'll ask the driver to execute
                          * it right after finishing the previous one, in the
                          * hope that it'll also be executed right afterwards,
                          * effectively extending the old one.
                          * If there's no minimum time left, just add it to the
                          * normal list.
+                         * TODO: the ROC type is ignored here, assuming that it
+                         * is better to immediately use the current ROC.
                          */
                         if (!tmp->hw_begun) {
                                 list_add_tail(&roc->list, &tmp->dependents);
@@ -2557,7 +2610,8 @@ static int ieee80211_remain_on_channel(struct wiphy *wiphy,
 
         mutex_lock(&local->mtx);
         ret = ieee80211_start_roc_work(local, sdata, chan,
-                                       duration, cookie, NULL);
+                                       duration, cookie, NULL,
+                                       IEEE80211_ROC_TYPE_NORMAL);
         mutex_unlock(&local->mtx);
 
         return ret;
@@ -2790,7 +2844,8 @@ static int ieee80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
 
         /* This will handle all kinds of coalescing and immediate TX */
         ret = ieee80211_start_roc_work(local, sdata, chan,
-                                       wait, cookie, skb);
+                                       wait, cookie, skb,
+                                       IEEE80211_ROC_TYPE_MGMT_TX);
         if (ret)
                 kfree_skb(skb);
  out_unlock:
@@ -3285,6 +3340,7 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
                                      struct cfg80211_chan_def *chandef)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_WDEV_TO_SUB_IF(wdev);
+        struct ieee80211_local *local = wiphy_priv(wiphy);
         struct ieee80211_chanctx_conf *chanctx_conf;
         int ret = -ENODATA;
 
@@ -3293,6 +3349,16 @@ static int ieee80211_cfg_get_channel(struct wiphy *wiphy,
         if (chanctx_conf) {
                 *chandef = chanctx_conf->def;
                 ret = 0;
+        } else if (local->open_count > 0 &&
+                   local->open_count == local->monitors &&
+                   sdata->vif.type == NL80211_IFTYPE_MONITOR) {
+                if (local->use_chanctx)
+                        *chandef = local->monitor_chandef;
+                else
+                        cfg80211_chandef_create(chandef,
+                                                local->_oper_channel,
+                                                local->_oper_channel_type);
+                ret = 0;
         }
         rcu_read_unlock();
 
diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
index c7591f73dbc3..4f841fe559df 100644
--- a/net/mac80211/debugfs_sta.c
+++ b/net/mac80211/debugfs_sta.c
@@ -325,6 +325,36 @@ static ssize_t sta_ht_capa_read(struct file *file, char __user *userbuf,
 }
 STA_OPS(ht_capa);
 
+static ssize_t sta_vht_capa_read(struct file *file, char __user *userbuf,
+                                 size_t count, loff_t *ppos)
+{
+        char buf[128], *p = buf;
+        struct sta_info *sta = file->private_data;
+        struct ieee80211_sta_vht_cap *vhtc = &sta->sta.vht_cap;
+
+        p += scnprintf(p, sizeof(buf) + buf - p, "VHT %ssupported\n",
+                        vhtc->vht_supported ? "" : "not ");
+        if (vhtc->vht_supported) {
+                p += scnprintf(p, sizeof(buf)+buf-p, "cap: %#.8x\n", vhtc->cap);
+
+                p += scnprintf(p, sizeof(buf)+buf-p, "RX MCS: %.4x\n",
+                               le16_to_cpu(vhtc->vht_mcs.rx_mcs_map));
+                if (vhtc->vht_mcs.rx_highest)
+                        p += scnprintf(p, sizeof(buf)+buf-p,
+                                       "MCS RX highest: %d Mbps\n",
+                                       le16_to_cpu(vhtc->vht_mcs.rx_highest));
+                p += scnprintf(p, sizeof(buf)+buf-p, "TX MCS: %.4x\n",
+                               le16_to_cpu(vhtc->vht_mcs.tx_mcs_map));
+                if (vhtc->vht_mcs.tx_highest)
+                        p += scnprintf(p, sizeof(buf)+buf-p,
+                                       "MCS TX highest: %d Mbps\n",
+                                       le16_to_cpu(vhtc->vht_mcs.tx_highest));
+        }
+
+        return simple_read_from_buffer(userbuf, count, ppos, buf, p - buf);
+}
+STA_OPS(vht_capa);
+
 static ssize_t sta_current_tx_rate_read(struct file *file, char __user *userbuf,
                                         size_t count, loff_t *ppos)
 {
@@ -405,6 +435,7 @@ void ieee80211_sta_debugfs_add(struct sta_info *sta)
         DEBUGFS_ADD(dev);
         DEBUGFS_ADD(last_signal);
         DEBUGFS_ADD(ht_capa);
+        DEBUGFS_ADD(vht_capa);
         DEBUGFS_ADD(last_ack_signal);
         DEBUGFS_ADD(current_tx_rate);
         DEBUGFS_ADD(last_rx_rate);
diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
index ee56d0779d8b..832acea4a5cb 100644
--- a/net/mac80211/driver-ops.h
+++ b/net/mac80211/driver-ops.h
@@ -787,15 +787,16 @@ static inline int drv_get_antenna(struct ieee80211_local *local,
 static inline int drv_remain_on_channel(struct ieee80211_local *local,
                                         struct ieee80211_sub_if_data *sdata,
                                         struct ieee80211_channel *chan,
-                                        unsigned int duration)
+                                        unsigned int duration,
+                                        enum ieee80211_roc_type type)
 {
         int ret;
 
         might_sleep();
 
-        trace_drv_remain_on_channel(local, sdata, chan, duration);
+        trace_drv_remain_on_channel(local, sdata, chan, duration, type);
         ret = local->ops->remain_on_channel(&local->hw, &sdata->vif,
-                                            chan, duration);
+                                            chan, duration, type);
         trace_drv_return_int(local, ret);
 
         return ret;
diff --git a/net/mac80211/ht.c b/net/mac80211/ht.c
index 0db25d4bb223..af8cee06e4f3 100644
--- a/net/mac80211/ht.c
+++ b/net/mac80211/ht.c
@@ -40,13 +40,6 @@ void ieee80211_apply_htcap_overrides(struct ieee80211_sub_if_data *sdata,
         if (!ht_cap->ht_supported)
                 return;
 
-        if (sdata->vif.type != NL80211_IFTYPE_STATION) {
-                /* AP interfaces call this code when adding new stations,
-                 * so just silently ignore non station interfaces.
-                 */
-                return;
-        }
-
         /* NOTE:  If you add more over-rides here, update register_hw
          * ht_capa_mod_msk logic in main.c as well.
          * And, if this method can ever change ht_cap.ht_supported, fix
@@ -97,7 +90,7 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                                        const struct ieee80211_ht_cap *ht_cap_ie,
                                        struct sta_info *sta)
 {
-        struct ieee80211_sta_ht_cap ht_cap;
+        struct ieee80211_sta_ht_cap ht_cap, own_cap;
         u8 ampdu_info, tx_mcs_set_cap;
         int i, max_tx_streams;
         bool changed;
@@ -111,6 +104,18 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
 
         ht_cap.ht_supported = true;
 
+        own_cap = sband->ht_cap;
+
+        /*
+         * If user has specified capability over-rides, take care
+         * of that if the station we're setting up is the AP that
+         * we advertised a restricted capability set to. Override
+         * our own capabilities and then use those below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !test_sta_flag(sta, WLAN_STA_TDLS_PEER))
+                ieee80211_apply_htcap_overrides(sdata, &own_cap);
+
         /*
          * The bits listed in this expression should be
          * the same for the peer and us, if the station
@@ -118,21 +123,20 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          * we mask them out.
          */
         ht_cap.cap = le16_to_cpu(ht_cap_ie->cap_info) &
-                (sband->ht_cap.cap |
-                 ~(IEEE80211_HT_CAP_LDPC_CODING |
-                   IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-                   IEEE80211_HT_CAP_GRN_FLD |
-                   IEEE80211_HT_CAP_SGI_20 |
-                   IEEE80211_HT_CAP_SGI_40 |
-                   IEEE80211_HT_CAP_DSSSCCK40));
+                (own_cap.cap | ~(IEEE80211_HT_CAP_LDPC_CODING |
+                                 IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                                 IEEE80211_HT_CAP_GRN_FLD |
+                                 IEEE80211_HT_CAP_SGI_20 |
+                                 IEEE80211_HT_CAP_SGI_40 |
+                                 IEEE80211_HT_CAP_DSSSCCK40));
 
         /*
          * The STBC bits are asymmetric -- if we don't have
          * TX then mask out the peer's RX and vice versa.
          */
-        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_TX_STBC))
+        if (!(own_cap.cap & IEEE80211_HT_CAP_TX_STBC))
                 ht_cap.cap &= ~IEEE80211_HT_CAP_RX_STBC;
-        if (!(sband->ht_cap.cap & IEEE80211_HT_CAP_RX_STBC))
+        if (!(own_cap.cap & IEEE80211_HT_CAP_RX_STBC))
                 ht_cap.cap &= ~IEEE80211_HT_CAP_TX_STBC;
 
         ampdu_info = ht_cap_ie->ampdu_params_info;
@@ -142,7 +146,7 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
                 (ampdu_info & IEEE80211_HT_AMPDU_PARM_DENSITY) >> 2;
 
         /* own MCS TX capabilities */
-        tx_mcs_set_cap = sband->ht_cap.mcs.tx_params;
+        tx_mcs_set_cap = own_cap.mcs.tx_params;
 
         /* Copy peer MCS TX capabilities, the driver might need them. */
         ht_cap.mcs.tx_params = ht_cap_ie->mcs.tx_params;
@@ -168,26 +172,20 @@ bool ieee80211_ht_cap_ie_to_sta_ht_cap(struct ieee80211_sub_if_data *sdata,
          */
         for (i = 0; i < max_tx_streams; i++)
                 ht_cap.mcs.rx_mask[i] =
-                        sband->ht_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
+                        own_cap.mcs.rx_mask[i] & ht_cap_ie->mcs.rx_mask[i];
 
         if (tx_mcs_set_cap & IEEE80211_HT_MCS_TX_UNEQUAL_MODULATION)
                 for (i = IEEE80211_HT_MCS_UNEQUAL_MODULATION_START_BYTE;
                      i < IEEE80211_HT_MCS_MASK_LEN; i++)
                         ht_cap.mcs.rx_mask[i] =
-                                sband->ht_cap.mcs.rx_mask[i] &
+                                own_cap.mcs.rx_mask[i] &
                                         ht_cap_ie->mcs.rx_mask[i];
 
         /* handle MCS rate 32 too */
-        if (sband->ht_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
+        if (own_cap.mcs.rx_mask[32/8] & ht_cap_ie->mcs.rx_mask[32/8] & 1)
                 ht_cap.mcs.rx_mask[32/8] |= 1;
 
  apply:
-        /*
-         * If user has specified capability over-rides, take care
-         * of that here.
-         */
-        ieee80211_apply_htcap_overrides(sdata, &ht_cap);
-
         changed = memcmp(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
 
         memcpy(&sta->sta.ht_cap, &ht_cap, sizeof(ht_cap));
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 40b71dfcc79d..539d4a11b47b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -985,36 +985,9 @@ static void ieee80211_ibss_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-        struct ieee80211_local *local = sdata->local;
-
-        if (local->quiescing) {
-                ifibss->timer_running = true;
-                return;
-        }
-
-        ieee80211_queue_work(&local->hw, &sdata->work);
-}
-
-#ifdef CONFIG_PM
-void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
 
-        if (del_timer_sync(&ifibss->timer))
-                ifibss->timer_running = true;
-}
-
-void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_ibss *ifibss = &sdata->u.ibss;
-
-        if (ifibss->timer_running) {
-                add_timer(&ifibss->timer);
-                ifibss->timer_running = false;
-        }
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
-#endif
 
 void ieee80211_ibss_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 388580a1bada..f4433f081e77 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -315,6 +315,7 @@ struct ieee80211_roc_work {
         u32 duration, req_duration;
         struct sk_buff *frame;
         u64 cookie, mgmt_tx_cookie;
+        enum ieee80211_roc_type type;
 };
 
 /* flags used in struct ieee80211_if_managed.flags */
@@ -400,7 +401,6 @@ struct ieee80211_if_managed {
 
         u16 aid;
 
-        unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         bool broken_ap; /* AP is broken -- turn off powersave */
         u8 dtim_period;
@@ -479,6 +479,8 @@ struct ieee80211_if_managed {
 
         struct ieee80211_ht_cap ht_capa; /* configured ht-cap over-rides */
         struct ieee80211_ht_cap ht_capa_mask; /* Valid parts of ht_capa */
+        struct ieee80211_vht_cap vht_capa; /* configured VHT overrides */
+        struct ieee80211_vht_cap vht_capa_mask; /* Valid parts of vht_capa */
 };
 
 struct ieee80211_if_ibss {
@@ -490,8 +492,6 @@ struct ieee80211_if_ibss {
 
         u32 basic_rates;
 
-        bool timer_running;
-
         bool fixed_bssid;
         bool fixed_channel;
         bool privacy;
@@ -543,8 +543,6 @@ struct ieee80211_if_mesh {
         struct timer_list mesh_path_timer;
         struct timer_list mesh_path_root_timer;
 
-        unsigned long timers_running;
-
         unsigned long wrkq_flags;
 
         u8 mesh_id[IEEE80211_MAX_MESH_ID_LEN];
@@ -590,6 +588,7 @@ struct ieee80211_if_mesh {
                 IEEE80211_MESH_SEC_AUTHED = 0x1,
                 IEEE80211_MESH_SEC_SECURED = 0x2,
         } security;
+        bool user_mpm;
         /* Extensible Synchronization Framework */
         const struct ieee80211_mesh_sync_ops *sync_ops;
         s64 sync_offset_clockdrift_max;
@@ -682,6 +681,8 @@ struct ieee80211_sub_if_data {
 
         /* count for keys needing tailroom space allocation */
         int crypto_tx_tailroom_needed_cnt;
+        int crypto_tx_tailroom_pending_dec;
+        struct delayed_work dec_tailroom_needed_wk;
 
         struct net_device *dev;
         struct ieee80211_local *local;
@@ -765,10 +766,6 @@ struct ieee80211_sub_if_data {
         } debugfs;
 #endif
 
-#ifdef CONFIG_PM
-        struct ieee80211_bss_conf suspend_bss_conf;
-#endif
-
         /* must be last, dynamically sized area in this! */
         struct ieee80211_vif vif;
 };
@@ -1136,11 +1133,6 @@ struct ieee80211_local {
 
         struct ieee80211_sub_if_data __rcu *p2p_sdata;
 
-        /* dummy netdev for use w/ NAPI */
-        struct net_device napi_dev;
-
-        struct napi_struct napi;
-
         /* virtual monitor interface */
         struct ieee80211_sub_if_data __rcu *monitor_sdata;
         struct cfg80211_chan_def monitor_chandef;
@@ -1283,8 +1275,6 @@ void
 ieee80211_sta_process_chanswitch(struct ieee80211_sub_if_data *sdata,
                                  const struct ieee80211_channel_sw_ie *sw_elem,
                                  struct ieee80211_bss *bss, u64 timestamp);
-void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata);
-void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_sta_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                   struct sk_buff *skb);
@@ -1302,8 +1292,6 @@ void ieee80211_ibss_rx_no_sta(struct ieee80211_sub_if_data *sdata,
 int ieee80211_ibss_join(struct ieee80211_sub_if_data *sdata,
                         struct cfg80211_ibss_params *params);
 int ieee80211_ibss_leave(struct ieee80211_sub_if_data *sdata);
-void ieee80211_ibss_quiesce(struct ieee80211_sub_if_data *sdata);
-void ieee80211_ibss_restart(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_work(struct ieee80211_sub_if_data *sdata);
 void ieee80211_ibss_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
                                    struct sk_buff *skb);
@@ -1441,6 +1429,8 @@ void ieee80211_sta_set_rx_nss(struct sta_info *sta);
 void ieee80211_vht_handle_opmode(struct ieee80211_sub_if_data *sdata,
                                  struct sta_info *sta, u8 opmode,
                                  enum ieee80211_band band, bool nss_only);
+void ieee80211_apply_vhtcap_overrides(struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_sta_vht_cap *vht_cap);
 
 /* Spectrum management */
 void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata,
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 2c059e54e885..d85282f64405 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -107,7 +107,7 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
 
         lockdep_assert_held(&local->mtx);
 
-        active = !list_empty(&local->chanctx_list);
+        active = !list_empty(&local->chanctx_list) || local->monitors;
 
         if (!local->ops->remain_on_channel) {
                 list_for_each_entry(roc, &local->roc_list, list) {
@@ -485,8 +485,6 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
                 res = drv_start(local);
                 if (res)
                         goto err_del_bss;
-                if (local->ops->napi_poll)
-                        napi_enable(&local->napi);
                 /* we're brought up, everything changes */
                 hw_reconf_flags = ~0;
                 ieee80211_led_radio(local, true);
@@ -541,6 +539,9 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
 
                 ieee80211_adjust_monitor_flags(sdata, 1);
                 ieee80211_configure_filter(local);
+                mutex_lock(&local->mtx);
+                ieee80211_recalc_idle(local);
+                mutex_unlock(&local->mtx);
 
                 netif_carrier_on(dev);
                 break;
@@ -812,6 +813,9 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
 
                 ieee80211_adjust_monitor_flags(sdata, -1);
                 ieee80211_configure_filter(local);
+                mutex_lock(&local->mtx);
+                ieee80211_recalc_idle(local);
+                mutex_unlock(&local->mtx);
                 break;
         case NL80211_IFTYPE_P2P_DEVICE:
                 /* relies on synchronize_rcu() below */
@@ -832,14 +836,16 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 rcu_barrier();
                 sta_info_flush_cleanup(sdata);
 
-                skb_queue_purge(&sdata->skb_queue);
-
                 /*
                  * Free all remaining keys, there shouldn't be any,
-                 * except maybe group keys in AP more or WDS?
+                 * except maybe in WDS mode?
                  */
                 ieee80211_free_keys(sdata);
 
+                /* fall through */
+        case NL80211_IFTYPE_AP:
+                skb_queue_purge(&sdata->skb_queue);
+
                 drv_remove_interface_debugfs(local, sdata);
 
                 if (going_down)
@@ -851,8 +857,6 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         ieee80211_recalc_ps(local, -1);
 
         if (local->open_count == 0) {
-                if (local->ops->napi_poll)
-                        napi_disable(&local->napi);
                 ieee80211_clear_tx_pending(local);
                 ieee80211_stop_device(local);
 
@@ -1541,6 +1545,8 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
         INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
         INIT_DELAYED_WORK(&sdata->dfs_cac_timer_work,
                           ieee80211_dfs_cac_timer_work);
+        INIT_DELAYED_WORK(&sdata->dec_tailroom_needed_wk,
+                          ieee80211_delayed_tailroom_dec);
 
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 struct ieee80211_supported_band *sband;
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ef252eb58c36..99e9f6ae6a54 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -397,7 +397,8 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
         return key;
 }
 
-static void __ieee80211_key_destroy(struct ieee80211_key *key)
+static void __ieee80211_key_destroy(struct ieee80211_key *key,
+                                    bool delay_tailroom)
 {
         if (!key)
                 return;
@@ -416,8 +417,18 @@ static void __ieee80211_key_destroy(struct ieee80211_key *key)
         if (key->conf.cipher == WLAN_CIPHER_SUITE_AES_CMAC)
                 ieee80211_aes_cmac_key_free(key->u.aes_cmac.tfm);
         if (key->local) {
+                struct ieee80211_sub_if_data *sdata = key->sdata;
+
                 ieee80211_debugfs_key_remove(key);
-                key->sdata->crypto_tx_tailroom_needed_cnt--;
+
+                if (delay_tailroom) {
+                        /* see ieee80211_delayed_tailroom_dec */
+                        sdata->crypto_tx_tailroom_pending_dec++;
+                        schedule_delayed_work(&sdata->dec_tailroom_needed_wk,
+                                              HZ/2);
+                } else {
+                        sdata->crypto_tx_tailroom_needed_cnt--;
+                }
         }
 
         kfree(key);
@@ -440,32 +451,6 @@ int ieee80211_key_link(struct ieee80211_key *key,
         key->sdata = sdata;
         key->sta = sta;
 
-        if (sta) {
-                /*
-                 * some hardware cannot handle TKIP with QoS, so
-                 * we indicate whether QoS could be in use.
-                 */
-                if (test_sta_flag(sta, WLAN_STA_WME))
-                        key->conf.flags |= IEEE80211_KEY_FLAG_WMM_STA;
-        } else {
-                if (sdata->vif.type == NL80211_IFTYPE_STATION) {
-                        struct sta_info *ap;
-
-                        /*
-                         * We're getting a sta pointer in, so must be under
-                         * appropriate locking for sta_info_get().
-                         */
-
-                        /* same here, the AP could be using QoS */
-                        ap = sta_info_get(key->sdata, key->sdata->u.mgd.bssid);
-                        if (ap) {
-                                if (test_sta_flag(ap, WLAN_STA_WME))
-                                        key->conf.flags |=
-                                                IEEE80211_KEY_FLAG_WMM_STA;
-                        }
-                }
-        }
-
         mutex_lock(&sdata->local->key_mtx);
 
         if (sta && pairwise)
@@ -478,7 +463,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
         increment_tailroom_need_count(sdata);
 
         __ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
-        __ieee80211_key_destroy(old_key);
+        __ieee80211_key_destroy(old_key, true);
 
         ieee80211_debugfs_key_add(key);
 
@@ -489,7 +474,7 @@ int ieee80211_key_link(struct ieee80211_key *key,
         return ret;
 }
 
-void __ieee80211_key_free(struct ieee80211_key *key)
+void __ieee80211_key_free(struct ieee80211_key *key, bool delay_tailroom)
 {
         if (!key)
                 return;
@@ -501,14 +486,14 @@ void __ieee80211_key_free(struct ieee80211_key *key)
                 __ieee80211_key_replace(key->sdata, key->sta,
                                 key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE,
                                 key, NULL);
-        __ieee80211_key_destroy(key);
+        __ieee80211_key_destroy(key, delay_tailroom);
 }
 
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key)
 {
         mutex_lock(&local->key_mtx);
-        __ieee80211_key_free(key);
+        __ieee80211_key_free(key, true);
         mutex_unlock(&local->key_mtx);
 }
 
@@ -566,36 +551,60 @@ void ieee80211_iter_keys(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL(ieee80211_iter_keys);
 
-void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_key *key;
-
-        ASSERT_RTNL();
-
-        mutex_lock(&sdata->local->key_mtx);
-
-        list_for_each_entry(key, &sdata->key_list, list)
-                ieee80211_key_disable_hw_accel(key);
-
-        mutex_unlock(&sdata->local->key_mtx);
-}
-
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_key *key, *tmp;
 
+        cancel_delayed_work_sync(&sdata->dec_tailroom_needed_wk);
+
         mutex_lock(&sdata->local->key_mtx);
 
+        sdata->crypto_tx_tailroom_needed_cnt -=
+                sdata->crypto_tx_tailroom_pending_dec;
+        sdata->crypto_tx_tailroom_pending_dec = 0;
+
         ieee80211_debugfs_key_remove_mgmt_default(sdata);
 
         list_for_each_entry_safe(key, tmp, &sdata->key_list, list)
-                __ieee80211_key_free(key);
+                __ieee80211_key_free(key, false);
 
         ieee80211_debugfs_key_update_default(sdata);
 
+        WARN_ON_ONCE(sdata->crypto_tx_tailroom_needed_cnt ||
+                     sdata->crypto_tx_tailroom_pending_dec);
+
         mutex_unlock(&sdata->local->key_mtx);
 }
 
+void ieee80211_delayed_tailroom_dec(struct work_struct *wk)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = container_of(wk, struct ieee80211_sub_if_data,
+                             dec_tailroom_needed_wk.work);
+
+        /*
+         * The reason for the delayed tailroom needed decrementing is to
+         * make roaming faster: during roaming, all keys are first deleted
+         * and then new keys are installed. The first new key causes the
+         * crypto_tx_tailroom_needed_cnt to go from 0 to 1, which invokes
+         * the cost of synchronize_net() (which can be slow). Avoid this
+         * by deferring the crypto_tx_tailroom_needed_cnt decrementing on
+         * key removal for a while, so if we roam the value is larger than
+         * zero and no 0->1 transition happens.
+         *
+         * The cost is that if the AP switching was from an AP with keys
+         * to one without, we still allocate tailroom while it would no
+         * longer be needed. However, in the typical (fast) roaming case
+         * within an ESS this usually won't happen.
+         */
+
+        mutex_lock(&sdata->local->key_mtx);
+        sdata->crypto_tx_tailroom_needed_cnt -=
+                sdata->crypto_tx_tailroom_pending_dec;
+        sdata->crypto_tx_tailroom_pending_dec = 0;
+        mutex_unlock(&sdata->local->key_mtx);
+}
 
 void ieee80211_gtk_rekey_notify(struct ieee80211_vif *vif, const u8 *bssid,
                                 const u8 *replay_ctr, gfp_t gfp)
diff --git a/net/mac80211/key.h b/net/mac80211/key.h
index 382dc44ed330..2a682d81cee9 100644
--- a/net/mac80211/key.h
+++ b/net/mac80211/key.h
@@ -134,7 +134,7 @@ struct ieee80211_key *ieee80211_key_alloc(u32 cipher, int idx, size_t key_len,
 int __must_check ieee80211_key_link(struct ieee80211_key *key,
                                     struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta);
-void __ieee80211_key_free(struct ieee80211_key *key);
+void __ieee80211_key_free(struct ieee80211_key *key, bool delay_tailroom);
 void ieee80211_key_free(struct ieee80211_local *local,
                         struct ieee80211_key *key);
 void ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, int idx,
@@ -143,9 +143,10 @@ void ieee80211_set_default_mgmt_key(struct ieee80211_sub_if_data *sdata,
                                     int idx);
 void ieee80211_free_keys(struct ieee80211_sub_if_data *sdata);
 void ieee80211_enable_keys(struct ieee80211_sub_if_data *sdata);
-void ieee80211_disable_keys(struct ieee80211_sub_if_data *sdata);
 
 #define key_mtx_dereference(local, ref) \
         rcu_dereference_protected(ref, lockdep_is_held(&((local)->key_mtx)))
 
+void ieee80211_delayed_tailroom_dec(struct work_struct *wk);
+
 #endif /* IEEE80211_KEY_H */
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 1a8591b77a13..5a53aa5ede80 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -399,30 +399,6 @@ static int ieee80211_ifa6_changed(struct notifier_block *nb,
 }
 #endif
 
-static int ieee80211_napi_poll(struct napi_struct *napi, int budget)
-{
-        struct ieee80211_local *local =
-                container_of(napi, struct ieee80211_local, napi);
-
-        return local->ops->napi_poll(&local->hw, budget);
-}
-
-void ieee80211_napi_schedule(struct ieee80211_hw *hw)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
-        napi_schedule(&local->napi);
-}
-EXPORT_SYMBOL(ieee80211_napi_schedule);
-
-void ieee80211_napi_complete(struct ieee80211_hw *hw)
-{
-        struct ieee80211_local *local = hw_to_local(hw);
-
-        napi_complete(&local->napi);
-}
-EXPORT_SYMBOL(ieee80211_napi_complete);
-
 /* There isn't a lot of sense in it, but you can transmit anything you like */
 static const struct ieee80211_txrx_stypes
 ieee80211_default_mgmt_stypes[NUM_NL80211_IFTYPES] = {
@@ -501,6 +477,27 @@ static const struct ieee80211_ht_cap mac80211_ht_capa_mod_mask = {
         },
 };
 
+static const struct ieee80211_vht_cap mac80211_vht_capa_mod_mask = {
+        .vht_cap_info =
+                cpu_to_le32(IEEE80211_VHT_CAP_RXLDPC |
+                            IEEE80211_VHT_CAP_SHORT_GI_80 |
+                            IEEE80211_VHT_CAP_SHORT_GI_160 |
+                            IEEE80211_VHT_CAP_RXSTBC_1 |
+                            IEEE80211_VHT_CAP_RXSTBC_2 |
+                            IEEE80211_VHT_CAP_RXSTBC_3 |
+                            IEEE80211_VHT_CAP_RXSTBC_4 |
+                            IEEE80211_VHT_CAP_TXSTBC |
+                            IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+                            IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                            IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN |
+                            IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
+                            IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK),
+        .supp_mcs = {
+                .rx_mcs_map = cpu_to_le16(~0),
+                .tx_mcs_map = cpu_to_le16(~0),
+        },
+};
+
 static const u8 extended_capabilities[] = {
         0, 0, 0, 0, 0, 0, 0,
         WLAN_EXT_CAPA8_OPMODE_NOTIF,
@@ -572,7 +569,8 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         wiphy->features |= NL80211_FEATURE_SK_TX_STATUS |
                            NL80211_FEATURE_SAE |
                            NL80211_FEATURE_HT_IBSS |
-                           NL80211_FEATURE_VIF_TXPOWER;
+                           NL80211_FEATURE_VIF_TXPOWER |
+                           NL80211_FEATURE_USERSPACE_MPM;
 
         if (!ops->hw_scan)
                 wiphy->features |= NL80211_FEATURE_LOW_PRIORITY_SCAN |
@@ -609,6 +607,7 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
                                          IEEE80211_RADIOTAP_VHT_KNOWN_BANDWIDTH;
         local->user_power_level = IEEE80211_UNSET_POWER_LEVEL;
         wiphy->ht_capa_mod_mask = &mac80211_ht_capa_mod_mask;
+        wiphy->vht_capa_mod_mask = &mac80211_vht_capa_mod_mask;
 
         INIT_LIST_HEAD(&local->interfaces);
 
@@ -664,9 +663,6 @@ struct ieee80211_hw *ieee80211_alloc_hw(size_t priv_data_len,
         skb_queue_head_init(&local->skb_queue);
         skb_queue_head_init(&local->skb_queue_unreliable);
 
-        /* init dummy netdev for use w/ NAPI */
-        init_dummy_netdev(&local->napi_dev);
-
         ieee80211_led_names(local);
 
         ieee80211_roc_setup(local);
@@ -1021,9 +1017,6 @@ int ieee80211_register_hw(struct ieee80211_hw *hw)
                 goto fail_ifa6;
 #endif
 
-        netif_napi_add(&local->napi_dev, &local->napi, ieee80211_napi_poll,
-                        local->hw.napi_weight);
-
         return 0;
 
 #if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 29ce2aa87e7b..5ac017f3fcd2 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -13,10 +13,6 @@
 #include "ieee80211_i.h"
 #include "mesh.h"
 
-#define TMR_RUNNING_HK  0
-#define TMR_RUNNING_MP  1
-#define TMR_RUNNING_MPR 2
-
 static int mesh_allocated;
 static struct kmem_cache *rm_cache;
 
@@ -50,11 +46,6 @@ static void ieee80211_mesh_housekeeping_timer(unsigned long data)
 
         set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags);
 
-        if (local->quiescing) {
-                set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
-                return;
-        }
-
         ieee80211_queue_work(&local->hw, &sdata->work);
 }
 
@@ -165,7 +156,7 @@ void mesh_sta_cleanup(struct sta_info *sta)
          * an update.
          */
         changed = mesh_accept_plinks_update(sdata);
-        if (sdata->u.mesh.security == IEEE80211_MESH_SEC_NONE) {
+        if (!sdata->u.mesh.user_mpm) {
                 changed |= mesh_plink_deactivate(sta);
                 del_timer_sync(&sta->plink_timer);
         }
@@ -479,15 +470,8 @@ static void ieee80211_mesh_path_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct ieee80211_local *local = sdata->local;
-
-        if (local->quiescing) {
-                set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
-                return;
-        }
 
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
 static void ieee80211_mesh_path_root_timer(unsigned long data)
@@ -495,16 +479,10 @@ static void ieee80211_mesh_path_root_timer(unsigned long data)
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
         struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-        struct ieee80211_local *local = sdata->local;
 
         set_bit(MESH_WORK_ROOT, &ifmsh->wrkq_flags);
 
-        if (local->quiescing) {
-                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
-                return;
-        }
-
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
 void ieee80211_mesh_root_setup(struct ieee80211_if_mesh *ifmsh)
@@ -622,35 +600,6 @@ static void ieee80211_mesh_rootpath(struct ieee80211_sub_if_data *sdata)
                   round_jiffies(TU_TO_EXP_TIME(interval)));
 }
 
-#ifdef CONFIG_PM
-void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-
-        /* use atomic bitops in case all timers fire at the same time */
-
-        if (del_timer_sync(&ifmsh->housekeeping_timer))
-                set_bit(TMR_RUNNING_HK, &ifmsh->timers_running);
-        if (del_timer_sync(&ifmsh->mesh_path_timer))
-                set_bit(TMR_RUNNING_MP, &ifmsh->timers_running);
-        if (del_timer_sync(&ifmsh->mesh_path_root_timer))
-                set_bit(TMR_RUNNING_MPR, &ifmsh->timers_running);
-}
-
-void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
-
-        if (test_and_clear_bit(TMR_RUNNING_HK, &ifmsh->timers_running))
-                add_timer(&ifmsh->housekeeping_timer);
-        if (test_and_clear_bit(TMR_RUNNING_MP, &ifmsh->timers_running))
-                add_timer(&ifmsh->mesh_path_timer);
-        if (test_and_clear_bit(TMR_RUNNING_MPR, &ifmsh->timers_running))
-                add_timer(&ifmsh->mesh_path_root_timer);
-        ieee80211_mesh_root_setup(ifmsh);
-}
-#endif
-
 static int
 ieee80211_mesh_build_beacon(struct ieee80211_if_mesh *ifmsh)
 {
@@ -871,8 +820,6 @@ void ieee80211_stop_mesh(struct ieee80211_sub_if_data *sdata)
         local->fif_other_bss--;
         atomic_dec(&local->iff_allmultis);
         ieee80211_configure_filter(local);
-
-        sdata->u.mesh.timers_running = 0;
 }
 
 static void
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 336c88a16687..6ffabbe99c46 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -313,8 +313,6 @@ void mesh_path_timer(unsigned long data);
 void mesh_path_flush_by_nexthop(struct sta_info *sta);
 void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata,
                              struct sk_buff *skb);
-void mesh_path_quiesce(struct ieee80211_sub_if_data *sdata);
-void mesh_path_restart(struct ieee80211_sub_if_data *sdata);
 void mesh_path_tx_root_frame(struct ieee80211_sub_if_data *sdata);
 
 bool mesh_action_is_path_sel(struct ieee80211_mgmt *mgmt);
@@ -359,22 +357,12 @@ static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
 
 void ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local);
 
-void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata);
-void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata);
-void mesh_plink_quiesce(struct sta_info *sta);
-void mesh_plink_restart(struct sta_info *sta);
 void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata);
 void mesh_sync_adjust_tbtt(struct ieee80211_sub_if_data *sdata);
 void ieee80211s_stop(void);
 #else
 static inline void
 ieee80211_mesh_notify_scan_completed(struct ieee80211_local *local) {}
-static inline void ieee80211_mesh_quiesce(struct ieee80211_sub_if_data *sdata)
-{}
-static inline void ieee80211_mesh_restart(struct ieee80211_sub_if_data *sdata)
-{}
-static inline void mesh_plink_quiesce(struct sta_info *sta) {}
-static inline void mesh_plink_restart(struct sta_info *sta) {}
 static inline bool mesh_path_sel_is_hwmp(struct ieee80211_sub_if_data *sdata)
 { return false; }
 static inline void mesh_path_flush_by_iface(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 07d396d57079..937e06fe8f2a 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -420,7 +420,6 @@ __mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *hw_addr)
                 return NULL;
 
         sta->plink_state = NL80211_PLINK_LISTEN;
-        init_timer(&sta->plink_timer);
 
         sta_info_pre_move_state(sta, IEEE80211_STA_AUTH);
         sta_info_pre_move_state(sta, IEEE80211_STA_ASSOC);
@@ -437,8 +436,9 @@ mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr,
 {
         struct sta_info *sta = NULL;
 
-        /* Userspace handles peer allocation when security is enabled */
-        if (sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
+        /* Userspace handles station allocation */
+        if (sdata->u.mesh.user_mpm ||
+            sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED)
                 cfg80211_notify_new_peer_candidate(sdata->dev, addr,
                                                    elems->ie_start,
                                                    elems->total_len,
@@ -534,10 +534,8 @@ static void mesh_plink_timer(unsigned long data)
          */
         sta = (struct sta_info *) data;
 
-        if (sta->sdata->local->quiescing) {
-                sta->plink_timer_was_running = true;
+        if (sta->sdata->local->quiescing)
                 return;
-        }
 
         spin_lock_bh(&sta->lock);
         if (sta->ignore_plink_timer) {
@@ -598,29 +596,6 @@ static void mesh_plink_timer(unsigned long data)
         }
 }
 
-#ifdef CONFIG_PM
-void mesh_plink_quiesce(struct sta_info *sta)
-{
-        if (!ieee80211_vif_is_mesh(&sta->sdata->vif))
-                return;
-
-        /* no kernel mesh sta timers have been initialized */
-        if (sta->sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
-                return;
-
-        if (del_timer_sync(&sta->plink_timer))
-                sta->plink_timer_was_running = true;
-}
-
-void mesh_plink_restart(struct sta_info *sta)
-{
-        if (sta->plink_timer_was_running) {
-                add_timer(&sta->plink_timer);
-                sta->plink_timer_was_running = false;
-        }
-}
-#endif
-
 static inline void mesh_plink_timer_set(struct sta_info *sta, int timeout)
 {
         sta->plink_timer.expires = jiffies + (HZ * timeout / 1000);
@@ -695,6 +670,10 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
         if (len < IEEE80211_MIN_ACTION_SIZE + 3)
                 return;
 
+        if (sdata->u.mesh.user_mpm)
+                /* userspace must register for these */
+                return;
+
         if (is_multicast_ether_addr(mgmt->da)) {
                 mpl_dbg(sdata,
                         "Mesh plink: ignore frame from multicast address\n");
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 9f6464f3e05f..fdc06e381c10 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -87,9 +87,6 @@ MODULE_PARM_DESC(probe_wait_ms,
  */
 #define IEEE80211_SIGNAL_AVE_MIN_COUNT  4
 
-#define TMR_RUNNING_TIMER       0
-#define TMR_RUNNING_CHANSW      1
-
 /*
  * All cfg80211 functions have to be called outside a locked
  * section so that they can acquire a lock themselves... This
@@ -609,6 +606,7 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
         BUILD_BUG_ON(sizeof(vht_cap) != sizeof(sband->vht_cap));
 
         memcpy(&vht_cap, &sband->vht_cap, sizeof(vht_cap));
+        ieee80211_apply_vhtcap_overrides(sdata, &vht_cap);
 
         /* determine capability flags */
         cap = vht_cap.cap;
@@ -647,6 +645,9 @@ static void ieee80211_add_vht_ie(struct ieee80211_sub_if_data *sdata,
                 our_mcs = (le16_to_cpu(vht_cap.vht_mcs.rx_mcs_map) &
                                                                 mask) >> shift;
 
+                if (our_mcs == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                        continue;
+
                 switch (ap_mcs) {
                 default:
                         if (our_mcs <= ap_mcs)
@@ -1035,14 +1036,8 @@ static void ieee80211_chswitch_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        if (sdata->local->quiescing) {
-                set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
-                return;
-        }
-
-        ieee80211_queue_work(&sdata->local->hw, &ifmgd->chswitch_work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->u.mgd.chswitch_work);
 }
 
 void
@@ -1799,9 +1794,11 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         sdata->vif.bss_conf.p2p_ctwindow = 0;
         sdata->vif.bss_conf.p2p_oppps = false;
 
-        /* on the next assoc, re-program HT parameters */
+        /* on the next assoc, re-program HT/VHT parameters */
         memset(&ifmgd->ht_capa, 0, sizeof(ifmgd->ht_capa));
         memset(&ifmgd->ht_capa_mask, 0, sizeof(ifmgd->ht_capa_mask));
+        memset(&ifmgd->vht_capa, 0, sizeof(ifmgd->vht_capa));
+        memset(&ifmgd->vht_capa_mask, 0, sizeof(ifmgd->vht_capa_mask));
 
         sdata->ap_power_level = IEEE80211_UNSET_POWER_LEVEL;
 
@@ -1827,8 +1824,6 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
         del_timer_sync(&sdata->u.mgd.timer);
         del_timer_sync(&sdata->u.mgd.chswitch_timer);
 
-        sdata->u.mgd.timers_running = 0;
-
         sdata->vif.bss_conf.dtim_period = 0;
 
         ifmgd->flags = 0;
@@ -3137,15 +3132,8 @@ static void ieee80211_sta_timer(unsigned long data)
 {
         struct ieee80211_sub_if_data *sdata =
                 (struct ieee80211_sub_if_data *) data;
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-        struct ieee80211_local *local = sdata->local;
-
-        if (local->quiescing) {
-                set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
-                return;
-        }
 
-        ieee80211_queue_work(&local->hw, &sdata->work);
+        ieee80211_queue_work(&sdata->local->hw, &sdata->work);
 }
 
 static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
@@ -3497,68 +3485,6 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
         }
 }
 
-#ifdef CONFIG_PM
-void ieee80211_sta_quiesce(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
-        /*
-         * we need to use atomic bitops for the running bits
-         * only because both timers might fire at the same
-         * time -- the code here is properly synchronised.
-         */
-
-        cancel_work_sync(&ifmgd->request_smps_work);
-
-        cancel_work_sync(&ifmgd->monitor_work);
-        cancel_work_sync(&ifmgd->beacon_connection_loss_work);
-        cancel_work_sync(&ifmgd->csa_connection_drop_work);
-        if (del_timer_sync(&ifmgd->timer))
-                set_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running);
-
-        cancel_work_sync(&ifmgd->chswitch_work);
-        if (del_timer_sync(&ifmgd->chswitch_timer))
-                set_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running);
-
-        /* these will just be re-established on connection */
-        del_timer_sync(&ifmgd->conn_mon_timer);
-        del_timer_sync(&ifmgd->bcn_mon_timer);
-}
-
-void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
-{
-        struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
-
-        mutex_lock(&ifmgd->mtx);
-        if (!ifmgd->associated) {
-                mutex_unlock(&ifmgd->mtx);
-                return;
-        }
-
-        if (sdata->flags & IEEE80211_SDATA_DISCONNECT_RESUME) {
-                sdata->flags &= ~IEEE80211_SDATA_DISCONNECT_RESUME;
-                mlme_dbg(sdata, "driver requested disconnect after resume\n");
-                ieee80211_sta_connection_lost(sdata,
-                                              ifmgd->associated->bssid,
-                                              WLAN_REASON_UNSPECIFIED,
-                                              true);
-                mutex_unlock(&ifmgd->mtx);
-                return;
-        }
-        mutex_unlock(&ifmgd->mtx);
-
-        if (test_and_clear_bit(TMR_RUNNING_TIMER, &ifmgd->timers_running))
-                add_timer(&ifmgd->timer);
-        if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
-                add_timer(&ifmgd->chswitch_timer);
-        ieee80211_sta_reset_beacon_monitor(sdata);
-
-        mutex_lock(&sdata->local->mtx);
-        ieee80211_restart_sta_timer(sdata);
-        mutex_unlock(&sdata->local->mtx);
-}
-#endif
-
 /* interface setup */
 void ieee80211_sta_setup_sdata(struct ieee80211_sub_if_data *sdata)
 {
@@ -4064,6 +3990,9 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
                 ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
         }
 
+        if (req->flags & ASSOC_REQ_DISABLE_VHT)
+                ifmgd->flags |= IEEE80211_STA_DISABLE_VHT;
+
         /* Also disable HT if we don't support it or the AP doesn't use WMM */
         sband = local->hw.wiphy->bands[req->bss->channel->band];
         if (!sband->ht_cap.ht_supported ||
@@ -4087,6 +4016,10 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         memcpy(&ifmgd->ht_capa_mask, &req->ht_capa_mask,
                sizeof(ifmgd->ht_capa_mask));
 
+        memcpy(&ifmgd->vht_capa, &req->vht_capa, sizeof(ifmgd->vht_capa));
+        memcpy(&ifmgd->vht_capa_mask, &req->vht_capa_mask,
+               sizeof(ifmgd->vht_capa_mask));
+
         if (req->ie && req->ie_len) {
                 memcpy(assoc_data->ie, req->ie, req->ie_len);
                 assoc_data->ie_len = req->ie_len;
@@ -4315,6 +4248,17 @@ void ieee80211_mgd_stop(struct ieee80211_sub_if_data *sdata)
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
+        /*
+         * Make sure some work items will not run after this,
+         * they will not do anything but might not have been
+         * cancelled when disconnecting.
+         */
+        cancel_work_sync(&ifmgd->monitor_work);
+        cancel_work_sync(&ifmgd->beacon_connection_loss_work);
+        cancel_work_sync(&ifmgd->request_smps_work);
+        cancel_work_sync(&ifmgd->csa_connection_drop_work);
+        cancel_work_sync(&ifmgd->chswitch_work);
+
         mutex_lock(&ifmgd->mtx);
         if (ifmgd->assoc_data)
                 ieee80211_destroy_assoc_data(sdata, false);
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index cc79b4a2e821..db547fceaeb9 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -277,7 +277,7 @@ void ieee80211_start_next_roc(struct ieee80211_local *local)
                         duration = 10;
 
                 ret = drv_remain_on_channel(local, roc->sdata, roc->chan,
-                                            duration);
+                                            duration, roc->type);
 
                 roc->started = true;
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index d0275f34bf70..b471a67f224d 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -6,32 +6,11 @@
 #include "driver-ops.h"
 #include "led.h"
 
-/* return value indicates whether the driver should be further notified */
-static void ieee80211_quiesce(struct ieee80211_sub_if_data *sdata)
-{
-        switch (sdata->vif.type) {
-        case NL80211_IFTYPE_STATION:
-                ieee80211_sta_quiesce(sdata);
-                break;
-        case NL80211_IFTYPE_ADHOC:
-                ieee80211_ibss_quiesce(sdata);
-                break;
-        case NL80211_IFTYPE_MESH_POINT:
-                ieee80211_mesh_quiesce(sdata);
-                break;
-        default:
-                break;
-        }
-
-        cancel_work_sync(&sdata->work);
-}
-
 int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 {
         struct ieee80211_local *local = hw_to_local(hw);
         struct ieee80211_sub_if_data *sdata;
         struct sta_info *sta;
-        struct ieee80211_chanctx *ctx;
 
         if (!local->open_count)
                 goto suspend;
@@ -93,19 +72,12 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                         return err;
                 } else if (err > 0) {
                         WARN_ON(err != 1);
-                        local->wowlan = false;
+                        return err;
                 } else {
-                        list_for_each_entry(sdata, &local->interfaces, list)
-                                if (ieee80211_sdata_running(sdata))
-                                        ieee80211_quiesce(sdata);
                         goto suspend;
                 }
         }
 
-        /* disable keys */
-        list_for_each_entry(sdata, &local->interfaces, list)
-                ieee80211_disable_keys(sdata);
-
         /* tear down aggregation sessions and remove STAs */
         mutex_lock(&local->sta_mtx);
         list_for_each_entry(sta, &local->sta_list, list) {
@@ -117,100 +89,25 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                                 WARN_ON(drv_sta_state(local, sta->sdata, sta,
                                                       state, state - 1));
                 }
-
-                mesh_plink_quiesce(sta);
         }
         mutex_unlock(&local->sta_mtx);
 
         /* remove all interfaces */
         list_for_each_entry(sdata, &local->interfaces, list) {
-                static u8 zero_addr[ETH_ALEN] = {};
-                u32 changed = 0;
-
                 if (!ieee80211_sdata_running(sdata))
                         continue;
-
-                switch (sdata->vif.type) {
-                case NL80211_IFTYPE_AP_VLAN:
-                case NL80211_IFTYPE_MONITOR:
-                        /* skip these */
-                        continue;
-                case NL80211_IFTYPE_STATION:
-                        if (sdata->vif.bss_conf.assoc)
-                                changed = BSS_CHANGED_ASSOC |
-                                          BSS_CHANGED_BSSID |
-                                          BSS_CHANGED_IDLE;
-                        break;
-                case NL80211_IFTYPE_AP:
-                case NL80211_IFTYPE_ADHOC:
-                case NL80211_IFTYPE_MESH_POINT:
-                        if (sdata->vif.bss_conf.enable_beacon)
-                                changed = BSS_CHANGED_BEACON_ENABLED;
-                        break;
-                default:
-                        break;
-                }
-
-                ieee80211_quiesce(sdata);
-
-                sdata->suspend_bss_conf = sdata->vif.bss_conf;
-                memset(&sdata->vif.bss_conf, 0, sizeof(sdata->vif.bss_conf));
-                sdata->vif.bss_conf.idle = true;
-                if (sdata->suspend_bss_conf.bssid)
-                        sdata->vif.bss_conf.bssid = zero_addr;
-
-                /* disable beaconing or remove association */
-                ieee80211_bss_info_change_notify(sdata, changed);
-
-                if (sdata->vif.type == NL80211_IFTYPE_AP &&
-                    rcu_access_pointer(sdata->u.ap.beacon))
-                        drv_stop_ap(local, sdata);
-
-                if (local->use_chanctx) {
-                        struct ieee80211_chanctx_conf *conf;
-
-                        mutex_lock(&local->chanctx_mtx);
-                        conf = rcu_dereference_protected(
-                                        sdata->vif.chanctx_conf,
-                                        lockdep_is_held(&local->chanctx_mtx));
-                        if (conf) {
-                                ctx = container_of(conf,
-                                                   struct ieee80211_chanctx,
-                                                   conf);
-                                drv_unassign_vif_chanctx(local, sdata, ctx);
-                        }
-
-                        mutex_unlock(&local->chanctx_mtx);
-                }
                 drv_remove_interface(local, sdata);
         }
 
         sdata = rtnl_dereference(local->monitor_sdata);
-        if (sdata) {
-                if (local->use_chanctx) {
-                        struct ieee80211_chanctx_conf *conf;
-
-                        mutex_lock(&local->chanctx_mtx);
-                        conf = rcu_dereference_protected(
-                                        sdata->vif.chanctx_conf,
-                                        lockdep_is_held(&local->chanctx_mtx));
-                        if (conf) {
-                                ctx = container_of(conf,
-                                                   struct ieee80211_chanctx,
-                                                   conf);
-                                drv_unassign_vif_chanctx(local, sdata, ctx);
-                        }
-
-                        mutex_unlock(&local->chanctx_mtx);
-                }
-
+        if (sdata)
                 drv_remove_interface(local, sdata);
-        }
 
-        mutex_lock(&local->chanctx_mtx);
-        list_for_each_entry(ctx, &local->chanctx_list, list)
-                drv_remove_chanctx(local, ctx);
-        mutex_unlock(&local->chanctx_mtx);
+        /*
+         * We disconnected on all interfaces before suspend, all channel
+         * contexts should be released.
+         */
+        WARN_ON(!list_empty(&local->chanctx_list));
 
         /* stop hardware - this must stop RX */
         if (local->open_count)
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index eea45a2c7c35..1c36c9b4fa4a 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -55,7 +55,6 @@
 #include "rate.h"
 #include "rc80211_minstrel.h"
 
-#define SAMPLE_COLUMNS  10
 #define SAMPLE_TBL(_mi, _idx, _col) \
                 _mi->sample_table[(_idx * SAMPLE_COLUMNS) + _col]
 
@@ -70,16 +69,31 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
         return i;
 }
 
+/* find & sort topmost throughput rates */
+static inline void
+minstrel_sort_best_tp_rates(struct minstrel_sta_info *mi, int i, u8 *tp_list)
+{
+        int j = MAX_THR_RATES;
+
+        while (j > 0 && mi->r[i].cur_tp > mi->r[tp_list[j - 1]].cur_tp)
+                j--;
+        if (j < MAX_THR_RATES - 1)
+                memmove(&tp_list[j + 1], &tp_list[j], MAX_THR_RATES - (j + 1));
+        if (j < MAX_THR_RATES)
+                tp_list[j] = i;
+}
+
 static void
 minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
 {
-        u32 max_tp = 0, index_max_tp = 0, index_max_tp2 = 0;
-        u32 max_prob = 0, index_max_prob = 0;
+        u8 tmp_tp_rate[MAX_THR_RATES];
+        u8 tmp_prob_rate = 0;
         u32 usecs;
-        u32 p;
         int i;
 
-        mi->stats_update = jiffies;
+        for (i=0; i < MAX_THR_RATES; i++)
+            tmp_tp_rate[i] = 0;
+
         for (i = 0; i < mi->n_rates; i++) {
                 struct minstrel_rate *mr = &mi->r[i];
 
@@ -87,27 +101,32 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                 if (!usecs)
                         usecs = 1000000;
 
-                /* To avoid rounding issues, probabilities scale from 0 (0%)
-                 * to 18000 (100%) */
-                if (mr->attempts) {
-                        p = (mr->success * 18000) / mr->attempts;
+                if (unlikely(mr->attempts > 0)) {
+                        mr->sample_skipped = 0;
+                        mr->cur_prob = MINSTREL_FRAC(mr->success, mr->attempts);
                         mr->succ_hist += mr->success;
                         mr->att_hist += mr->attempts;
-                        mr->cur_prob = p;
-                        p = ((p * (100 - mp->ewma_level)) + (mr->probability *
-                                mp->ewma_level)) / 100;
-                        mr->probability = p;
-                        mr->cur_tp = p * (1000000 / usecs);
-                }
+                        mr->probability = minstrel_ewma(mr->probability,
+                                                        mr->cur_prob,
+                                                        EWMA_LEVEL);
+                } else
+                        mr->sample_skipped++;
 
                 mr->last_success = mr->success;
                 mr->last_attempts = mr->attempts;
                 mr->success = 0;
                 mr->attempts = 0;
 
+                /* Update throughput per rate, reset thr. below 10% success */
+                if (mr->probability < MINSTREL_FRAC(10, 100))
+                        mr->cur_tp = 0;
+                else
+                        mr->cur_tp = mr->probability * (1000000 / usecs);
+
                 /* Sample less often below the 10% chance of success.
                  * Sample less often above the 95% chance of success. */
-                if ((mr->probability > 17100) || (mr->probability < 1800)) {
+                if (mr->probability > MINSTREL_FRAC(95, 100) ||
+                    mr->probability < MINSTREL_FRAC(10, 100)) {
                         mr->adjusted_retry_count = mr->retry_count >> 1;
                         if (mr->adjusted_retry_count > 2)
                                 mr->adjusted_retry_count = 2;
@@ -118,35 +137,30 @@ minstrel_update_stats(struct minstrel_priv *mp, struct minstrel_sta_info *mi)
                 }
                 if (!mr->adjusted_retry_count)
                         mr->adjusted_retry_count = 2;
-        }
 
-        for (i = 0; i < mi->n_rates; i++) {
-                struct minstrel_rate *mr = &mi->r[i];
-                if (max_tp < mr->cur_tp) {
-                        index_max_tp = i;
-                        max_tp = mr->cur_tp;
-                }
-                if (max_prob < mr->probability) {
-                        index_max_prob = i;
-                        max_prob = mr->probability;
+                minstrel_sort_best_tp_rates(mi, i, tmp_tp_rate);
+
+                /* To determine the most robust rate (max_prob_rate) used at
+                 * 3rd mmr stage we distinct between two cases:
+                 * (1) if any success probabilitiy >= 95%, out of those rates
+                 * choose the maximum throughput rate as max_prob_rate
+                 * (2) if all success probabilities < 95%, the rate with
+                 * highest success probability is choosen as max_prob_rate */
+                if (mr->probability >= MINSTREL_FRAC(95,100)) {
+                        if (mr->cur_tp >= mi->r[tmp_prob_rate].cur_tp)
+                                tmp_prob_rate = i;
+                } else {
+                        if (mr->probability >= mi->r[tmp_prob_rate].probability)
+                                tmp_prob_rate = i;
                 }
         }
 
-        max_tp = 0;
-        for (i = 0; i < mi->n_rates; i++) {
-                struct minstrel_rate *mr = &mi->r[i];
-
-                if (i == index_max_tp)
-                        continue;
+        /* Assign the new rate set */
+        memcpy(mi->max_tp_rate, tmp_tp_rate, sizeof(mi->max_tp_rate));
+        mi->max_prob_rate = tmp_prob_rate;
 
-                if (max_tp < mr->cur_tp) {
-                        index_max_tp2 = i;
-                        max_tp = mr->cur_tp;
-                }
-        }
-        mi->max_tp_rate = index_max_tp;
-        mi->max_tp_rate2 = index_max_tp2;
-        mi->max_prob_rate = index_max_prob;
+        /* Reset update timer */
+        mi->stats_update = jiffies;
 }
 
 static void
@@ -207,10 +221,10 @@ static int
 minstrel_get_next_sample(struct minstrel_sta_info *mi)
 {
         unsigned int sample_ndx;
-        sample_ndx = SAMPLE_TBL(mi, mi->sample_idx, mi->sample_column);
-        mi->sample_idx++;
-        if ((int) mi->sample_idx > (mi->n_rates - 2)) {
-                mi->sample_idx = 0;
+        sample_ndx = SAMPLE_TBL(mi, mi->sample_row, mi->sample_column);
+        mi->sample_row++;
+        if ((int) mi->sample_row >= mi->n_rates) {
+                mi->sample_row = 0;
                 mi->sample_column++;
                 if (mi->sample_column >= SAMPLE_COLUMNS)
                         mi->sample_column = 0;
@@ -228,31 +242,37 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
         struct minstrel_priv *mp = priv;
         struct ieee80211_tx_rate *ar = info->control.rates;
         unsigned int ndx, sample_ndx = 0;
-        bool mrr;
-        bool sample_slower = false;
-        bool sample = false;
+        bool mrr_capable;
+        bool indirect_rate_sampling = false;
+        bool rate_sampling = false;
         int i, delta;
         int mrr_ndx[3];
-        int sample_rate;
+        int sampling_ratio;
 
+        /* management/no-ack frames do not use rate control */
         if (rate_control_send_low(sta, priv_sta, txrc))
                 return;
 
-        mrr = mp->has_mrr && !txrc->rts && !txrc->bss_conf->use_cts_prot;
-
-        ndx = mi->max_tp_rate;
-
-        if (mrr)
-                sample_rate = mp->lookaround_rate_mrr;
+        /* check multi-rate-retry capabilities & adjust lookaround_rate */
+        mrr_capable = mp->has_mrr &&
+                      !txrc->rts &&
+                      !txrc->bss_conf->use_cts_prot;
+        if (mrr_capable)
+                sampling_ratio = mp->lookaround_rate_mrr;
         else
-                sample_rate = mp->lookaround_rate;
+                sampling_ratio = mp->lookaround_rate;
+
+        /* init rateindex [ndx] with max throughput rate */
+        ndx = mi->max_tp_rate[0];
 
+        /* increase sum packet counter */
         mi->packet_count++;
-        delta = (mi->packet_count * sample_rate / 100) -
+
+        delta = (mi->packet_count * sampling_ratio / 100) -
                         (mi->sample_count + mi->sample_deferred / 2);
 
         /* delta > 0: sampling required */
-        if ((delta > 0) && (mrr || !mi->prev_sample)) {
+        if ((delta > 0) && (mrr_capable || !mi->prev_sample)) {
                 struct minstrel_rate *msr;
                 if (mi->packet_count >= 10000) {
                         mi->sample_deferred = 0;
@@ -271,21 +291,28 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         mi->sample_count += (delta - mi->n_rates * 2);
                 }
 
+                /* get next random rate sample */
                 sample_ndx = minstrel_get_next_sample(mi);
                 msr = &mi->r[sample_ndx];
-                sample = true;
-                sample_slower = mrr && (msr->perfect_tx_time >
-                        mi->r[ndx].perfect_tx_time);
-
-                if (!sample_slower) {
+                rate_sampling = true;
+
+                /* Decide if direct ( 1st mrr stage) or indirect (2nd mrr stage)
+                 * rate sampling method should be used.
+                 * Respect such rates that are not sampled for 20 interations.
+                 */
+                if (mrr_capable &&
+                    msr->perfect_tx_time > mi->r[ndx].perfect_tx_time &&
+                    msr->sample_skipped < 20)
+                                indirect_rate_sampling = true;
+
+                if (!indirect_rate_sampling) {
                         if (msr->sample_limit != 0) {
                                 ndx = sample_ndx;
                                 mi->sample_count++;
                                 if (msr->sample_limit > 0)
                                         msr->sample_limit--;
-                        } else {
-                                sample = false;
-                        }
+                        } else
+                                rate_sampling = false;
                 } else {
                         /* Only use IEEE80211_TX_CTL_RATE_CTRL_PROBE to mark
                          * packets that have the sampling rate deferred to the
@@ -297,34 +324,39 @@ minstrel_get_rate(void *priv, struct ieee80211_sta *sta,
                         mi->sample_deferred++;
                 }
         }
-        mi->prev_sample = sample;
+        mi->prev_sample = rate_sampling;
 
         /* If we're not using MRR and the sampling rate already
          * has a probability of >95%, we shouldn't be attempting
          * to use it, as this only wastes precious airtime */
-        if (!mrr && sample && (mi->r[ndx].probability > 17100))
-                ndx = mi->max_tp_rate;
+        if (!mrr_capable && rate_sampling &&
+           (mi->r[ndx].probability > MINSTREL_FRAC(95, 100)))
+                ndx = mi->max_tp_rate[0];
 
+        /* mrr setup for 1st stage */
         ar[0].idx = mi->r[ndx].rix;
         ar[0].count = minstrel_get_retry_count(&mi->r[ndx], info);
 
-        if (!mrr) {
-                if (!sample)
+        /* non mrr setup for 2nd stage */
+        if (!mrr_capable) {
+                if (!rate_sampling)
                         ar[0].count = mp->max_retry;
                 ar[1].idx = mi->lowest_rix;
                 ar[1].count = mp->max_retry;
                 return;
         }
 
-        /* MRR setup */
-        if (sample) {
-                if (sample_slower)
+        /* mrr setup for 2nd stage */
+        if (rate_sampling) {
+                if (indirect_rate_sampling)
                         mrr_ndx[0] = sample_ndx;
                 else
-                        mrr_ndx[0] = mi->max_tp_rate;
+                        mrr_ndx[0] = mi->max_tp_rate[0];
         } else {
-                mrr_ndx[0] = mi->max_tp_rate2;
+                mrr_ndx[0] = mi->max_tp_rate[1];
         }
+
+        /* mrr setup for 3rd & 4th stage */
         mrr_ndx[1] = mi->max_prob_rate;
         mrr_ndx[2] = 0;
         for (i = 1; i < 4; i++) {
@@ -351,26 +383,21 @@ static void
 init_sample_table(struct minstrel_sta_info *mi)
 {
         unsigned int i, col, new_idx;
-        unsigned int n_srates = mi->n_rates - 1;
         u8 rnd[8];
 
         mi->sample_column = 0;
-        mi->sample_idx = 0;
-        memset(mi->sample_table, 0, SAMPLE_COLUMNS * mi->n_rates);
+        mi->sample_row = 0;
+        memset(mi->sample_table, 0xff, SAMPLE_COLUMNS * mi->n_rates);
 
         for (col = 0; col < SAMPLE_COLUMNS; col++) {
-                for (i = 0; i < n_srates; i++) {
+                for (i = 0; i < mi->n_rates; i++) {
                         get_random_bytes(rnd, sizeof(rnd));
-                        new_idx = (i + rnd[i & 7]) % n_srates;
+                        new_idx = (i + rnd[i & 7]) % mi->n_rates;
 
-                        while (SAMPLE_TBL(mi, new_idx, col) != 0)
-                                new_idx = (new_idx + 1) % n_srates;
+                        while (SAMPLE_TBL(mi, new_idx, col) != 0xff)
+                                new_idx = (new_idx + 1) % mi->n_rates;
 
-                        /* Don't sample the slowest rate (i.e. slowest base
-                         * rate). We must presume that the slowest rate works
-                         * fine, or else other management frames will also be
-                         * failing and the link will break */
-                        SAMPLE_TBL(mi, new_idx, col) = i + 1;
+                        SAMPLE_TBL(mi, new_idx, col) = i;
                 }
         }
 }
@@ -542,9 +569,6 @@ minstrel_alloc(struct ieee80211_hw *hw, struct dentry *debugfsdir)
         mp->lookaround_rate = 5;
         mp->lookaround_rate_mrr = 10;
 
-        /* moving average weight for EWMA */
-        mp->ewma_level = 75;
-
         /* maximum time that the hw is allowed to stay in one MRR segment */
         mp->segment_size = 6000;
 
diff --git a/net/mac80211/rc80211_minstrel.h b/net/mac80211/rc80211_minstrel.h
index 5ecf757817f2..85ebf42cb46d 100644
--- a/net/mac80211/rc80211_minstrel.h
+++ b/net/mac80211/rc80211_minstrel.h
@@ -9,6 +9,28 @@
 #ifndef __RC_MINSTREL_H
 #define __RC_MINSTREL_H
 
+#define EWMA_LEVEL      75      /* ewma weighting factor [%] */
+#define SAMPLE_COLUMNS  10      /* number of columns in sample table */
+
+
+/* scaled fraction values */
+#define MINSTREL_SCALE  16
+#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
+#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
+
+/* number of highest throughput rates to consider*/
+#define MAX_THR_RATES 4
+
+/*
+ * Perform EWMA (Exponentially Weighted Moving Average) calculation
+  */
+static inline int
+minstrel_ewma(int old, int new, int weight)
+{
+        return (new * (100 - weight) + old * weight) / 100;
+}
+
+
 struct minstrel_rate {
         int bitrate;
         int rix;
@@ -26,6 +48,7 @@ struct minstrel_rate {
         u32 attempts;
         u32 last_attempts;
         u32 last_success;
+        u8 sample_skipped;
 
         /* parts per thousand */
         u32 cur_prob;
@@ -45,14 +68,13 @@ struct minstrel_sta_info {
 
         unsigned int lowest_rix;
 
-        unsigned int max_tp_rate;
-        unsigned int max_tp_rate2;
-        unsigned int max_prob_rate;
+        u8 max_tp_rate[MAX_THR_RATES];
+        u8 max_prob_rate;
         unsigned int packet_count;
         unsigned int sample_count;
         int sample_deferred;
 
-        unsigned int sample_idx;
+        unsigned int sample_row;
         unsigned int sample_column;
 
         int n_rates;
@@ -73,7 +95,6 @@ struct minstrel_priv {
         unsigned int cw_min;
         unsigned int cw_max;
         unsigned int max_retry;
-        unsigned int ewma_level;
         unsigned int segment_size;
         unsigned int update_interval;
         unsigned int lookaround_rate;
diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index d5a56226e675..d1048348d399 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -73,15 +73,17 @@ minstrel_stats_open(struct inode *inode, struct file *file)
         for (i = 0; i < mi->n_rates; i++) {
                 struct minstrel_rate *mr = &mi->r[i];
 
-                *(p++) = (i == mi->max_tp_rate) ? 'T' : ' ';
-                *(p++) = (i == mi->max_tp_rate2) ? 't' : ' ';
+                *(p++) = (i == mi->max_tp_rate[0]) ? 'A' : ' ';
+                *(p++) = (i == mi->max_tp_rate[1]) ? 'B' : ' ';
+                *(p++) = (i == mi->max_tp_rate[2]) ? 'C' : ' ';
+                *(p++) = (i == mi->max_tp_rate[3]) ? 'D' : ' ';
                 *(p++) = (i == mi->max_prob_rate) ? 'P' : ' ';
                 p += sprintf(p, "%3u%s", mr->bitrate / 2,
                                 (mr->bitrate & 1 ? ".5" : "  "));
 
-                tp = mr->cur_tp / ((18000 << 10) / 96);
-                prob = mr->cur_prob / 18;
-                eprob = mr->probability / 18;
+                tp = MINSTREL_TRUNC(mr->cur_tp / 10);
+                prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
+                eprob = MINSTREL_TRUNC(mr->probability * 1000);
 
                 p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
                                 "%3u(%3u)   %8llu    %8llu\n",
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 3af141c69712..749552bdcfe1 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -17,8 +17,6 @@
 #include "rc80211_minstrel_ht.h"
 
 #define AVG_PKT_SIZE    1200
-#define SAMPLE_COLUMNS  10
-#define EWMA_LEVEL              75
 
 /* Number of bits for an average sized packet */
 #define MCS_NBITS (AVG_PKT_SIZE << 3)
@@ -26,11 +24,11 @@
 /* Number of symbols for a packet with (bps) bits per symbol */
 #define MCS_NSYMS(bps) ((MCS_NBITS + (bps) - 1) / (bps))
 
-/* Transmission time for a packet containing (syms) symbols */
+/* Transmission time (nanoseconds) for a packet containing (syms) symbols */
 #define MCS_SYMBOL_TIME(sgi, syms)                                      \
         (sgi ?                                                          \
-          ((syms) * 18 + 4) / 5 :       /* syms * 3.6 us */             \
-          (syms) << 2                   /* syms * 4 us */               \
+          ((syms) * 18000 + 4000) / 5 : /* syms * 3.6 us */             \
+          ((syms) * 1000) << 2          /* syms * 4 us */               \
         )
 
 /* Transmit duration for the raw data part of an average sized packet */
@@ -64,9 +62,9 @@
 }
 
 #define CCK_DURATION(_bitrate, _short, _len)            \
-        (10 /* SIFS */ +                                \
+        (1000 * (10 /* SIFS */ +                        \
          (_short ? 72 + 24 : 144 + 48 ) +               \
-         (8 * (_len + 4) * 10) / (_bitrate))
+         (8 * (_len + 4) * 10) / (_bitrate)))
 
 #define CCK_ACK_DURATION(_bitrate, _short)                      \
         (CCK_DURATION((_bitrate > 10 ? 20 : 10), false, 60) +   \
@@ -129,15 +127,6 @@ const struct mcs_group minstrel_mcs_groups[] = {
 static u8 sample_table[SAMPLE_COLUMNS][MCS_GROUP_RATES];
 
 /*
- * Perform EWMA (Exponentially Weighted Moving Average) calculation
- */
-static int
-minstrel_ewma(int old, int new, int weight)
-{
-        return (new * (100 - weight) + old * weight) / 100;
-}
-
-/*
  * Look up an MCS group index based on mac80211 rate information
  */
 static int
@@ -211,7 +200,8 @@ static void
 minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
 {
         struct minstrel_rate_stats *mr;
-        unsigned int usecs = 0;
+        unsigned int nsecs = 0;
+        unsigned int tp;
 
         mr = &mi->groups[group].rates[rate];
 
@@ -221,10 +211,12 @@ minstrel_ht_calc_tp(struct minstrel_ht_sta *mi, int group, int rate)
         }
 
         if (group != MINSTREL_CCK_GROUP)
-                usecs = mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
+                nsecs = 1000 * mi->overhead / MINSTREL_TRUNC(mi->avg_ampdu_len);
 
-        usecs += minstrel_mcs_groups[group].duration[rate];
-        mr->cur_tp = MINSTREL_TRUNC((1000000 / usecs) * mr->probability);
+        nsecs += minstrel_mcs_groups[group].duration[rate];
+        tp = 1000000 * ((mr->probability * 1000) / nsecs);
+
+        mr->cur_tp = MINSTREL_TRUNC(tp);
 }
 
 /*
@@ -308,8 +300,8 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                 }
         }
 
-        /* try to sample up to half of the available rates during each interval */
-        mi->sample_count *= 4;
+        /* try to sample all available rates during each interval */
+        mi->sample_count *= 8;
 
         cur_prob = 0;
         cur_prob_tp = 0;
@@ -320,20 +312,13 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                 if (!mg->supported)
                         continue;
 
-                mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
-                if (cur_prob_tp < mr->cur_tp &&
-                    minstrel_mcs_groups[group].streams == 1) {
-                        mi->max_prob_rate = mg->max_prob_rate;
-                        cur_prob = mr->cur_prob;
-                        cur_prob_tp = mr->cur_tp;
-                }
-
                 mr = minstrel_get_ratestats(mi, mg->max_tp_rate);
                 if (cur_tp < mr->cur_tp) {
                         mi->max_tp_rate2 = mi->max_tp_rate;
                         cur_tp2 = cur_tp;
                         mi->max_tp_rate = mg->max_tp_rate;
                         cur_tp = mr->cur_tp;
+                        mi->max_prob_streams = minstrel_mcs_groups[group].streams - 1;
                 }
 
                 mr = minstrel_get_ratestats(mi, mg->max_tp_rate2);
@@ -343,6 +328,23 @@ minstrel_ht_update_stats(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
                 }
         }
 
+        if (mi->max_prob_streams < 1)
+                mi->max_prob_streams = 1;
+
+        for (group = 0; group < ARRAY_SIZE(minstrel_mcs_groups); group++) {
+                mg = &mi->groups[group];
+                if (!mg->supported)
+                        continue;
+                mr = minstrel_get_ratestats(mi, mg->max_prob_rate);
+                if (cur_prob_tp < mr->cur_tp &&
+                    minstrel_mcs_groups[group].streams <= mi->max_prob_streams) {
+                        mi->max_prob_rate = mg->max_prob_rate;
+                        cur_prob = mr->cur_prob;
+                        cur_prob_tp = mr->cur_tp;
+                }
+        }
+
+
         mi->stats_update = jiffies;
 }
 
@@ -467,7 +469,7 @@ minstrel_ht_tx_status(void *priv, struct ieee80211_supported_band *sband,
 
         if (!mi->sample_wait && !mi->sample_tries && mi->sample_count > 0) {
                 mi->sample_wait = 16 + 2 * MINSTREL_TRUNC(mi->avg_ampdu_len);
-                mi->sample_tries = 2;
+                mi->sample_tries = 1;
                 mi->sample_count--;
         }
 
@@ -536,7 +538,7 @@ minstrel_calc_retransmit(struct minstrel_priv *mp, struct minstrel_ht_sta *mi,
         mr->retry_updated = true;
 
         group = &minstrel_mcs_groups[index / MCS_GROUP_RATES];
-        tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len;
+        tx_time_data = group->duration[index % MCS_GROUP_RATES] * ampdu_len / 1000;
 
         /* Contention time for first 2 tries */
         ctime = (t_slot * cw) >> 1;
@@ -616,6 +618,7 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
 {
         struct minstrel_rate_stats *mr;
         struct minstrel_mcs_group_data *mg;
+        unsigned int sample_dur, sample_group;
         int sample_idx = 0;
 
         if (mi->sample_wait > 0) {
@@ -626,11 +629,11 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
         if (!mi->sample_tries)
                 return -1;
 
-        mi->sample_tries--;
         mg = &mi->groups[mi->sample_group];
         sample_idx = sample_table[mg->column][mg->index];
         mr = &mg->rates[sample_idx];
-        sample_idx += mi->sample_group * MCS_GROUP_RATES;
+        sample_group = mi->sample_group;
+        sample_idx += sample_group * MCS_GROUP_RATES;
         minstrel_next_sample_idx(mi);
 
         /*
@@ -651,14 +654,18 @@ minstrel_get_sample_rate(struct minstrel_priv *mp, struct minstrel_ht_sta *mi)
          * Make sure that lower rates get sampled only occasionally,
          * if the link is working perfectly.
          */
-        if (minstrel_get_duration(sample_idx) >
-            minstrel_get_duration(mi->max_tp_rate)) {
+        sample_dur = minstrel_get_duration(sample_idx);
+        if (sample_dur >= minstrel_get_duration(mi->max_tp_rate2) &&
+            (mi->max_prob_streams <
+             minstrel_mcs_groups[sample_group].streams ||
+             sample_dur >= minstrel_get_duration(mi->max_prob_rate))) {
                 if (mr->sample_skipped < 20)
                         return -1;
 
                 if (mi->sample_slow++ > 2)
                         return -1;
         }
+        mi->sample_tries--;
 
         return sample_idx;
 }
diff --git a/net/mac80211/rc80211_minstrel_ht.h b/net/mac80211/rc80211_minstrel_ht.h
index 302dbd52180d..9b16e9de9923 100644
--- a/net/mac80211/rc80211_minstrel_ht.h
+++ b/net/mac80211/rc80211_minstrel_ht.h
@@ -16,11 +16,6 @@
 #define MINSTREL_MAX_STREAMS    3
 #define MINSTREL_STREAM_GROUPS  4
 
-/* scaled fraction values */
-#define MINSTREL_SCALE  16
-#define MINSTREL_FRAC(val, div) (((val) << MINSTREL_SCALE) / div)
-#define MINSTREL_TRUNC(val) ((val) >> MINSTREL_SCALE)
-
 #define MCS_GROUP_RATES 8
 
 struct mcs_group {
@@ -85,6 +80,7 @@ struct minstrel_ht_sta {
 
         /* best probability rate */
         unsigned int max_prob_rate;
+        unsigned int max_prob_streams;
 
         /* time of last status update */
         unsigned long stats_update;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index bb73ed2d20b9..5b4492af4e85 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -648,24 +648,6 @@ static ieee80211_rx_result ieee80211_rx_mesh_check(struct ieee80211_rx_data *rx)
         return RX_CONTINUE;
 }
 
-#define SEQ_MODULO 0x1000
-#define SEQ_MASK   0xfff
-
-static inline int seq_less(u16 sq1, u16 sq2)
-{
-        return ((sq1 - sq2) & SEQ_MASK) > (SEQ_MODULO >> 1);
-}
-
-static inline u16 seq_inc(u16 sq)
-{
-        return (sq + 1) & SEQ_MASK;
-}
-
-static inline u16 seq_sub(u16 sq1, u16 sq2)
-{
-        return (sq1 - sq2) & SEQ_MASK;
-}
-
 static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
                                             struct tid_ampdu_rx *tid_agg_rx,
                                             int index,
@@ -687,7 +669,7 @@ static void ieee80211_release_reorder_frame(struct ieee80211_sub_if_data *sdata,
         __skb_queue_tail(frames, skb);
 
 no_frame:
-        tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+        tid_agg_rx->head_seq_num = ieee80211_sn_inc(tid_agg_rx->head_seq_num);
 }
 
 static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata,
@@ -699,8 +681,9 @@ static void ieee80211_release_reorder_frames(struct ieee80211_sub_if_data *sdata
 
         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 
-        while (seq_less(tid_agg_rx->head_seq_num, head_seq_num)) {
-                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+        while (ieee80211_sn_less(tid_agg_rx->head_seq_num, head_seq_num)) {
+                index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
+                                         tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
                                                 frames);
@@ -727,8 +710,8 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
         lockdep_assert_held(&tid_agg_rx->reorder_lock);
 
         /* release the buffer until next missing frame */
-        index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
-                                                tid_agg_rx->buf_size;
+        index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
+                                 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
         if (!tid_agg_rx->reorder_buf[index] &&
             tid_agg_rx->stored_mpdu_num) {
                 /*
@@ -756,19 +739,22 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
                          * Increment the head seq# also for the skipped slots.
                          */
                         tid_agg_rx->head_seq_num =
-                                (tid_agg_rx->head_seq_num + skipped) & SEQ_MASK;
+                                (tid_agg_rx->head_seq_num +
+                                 skipped) & IEEE80211_SN_MASK;
                         skipped = 0;
                 }
         } else while (tid_agg_rx->reorder_buf[index]) {
                 ieee80211_release_reorder_frame(sdata, tid_agg_rx, index,
                                                 frames);
-                index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
+                index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
+                                         tid_agg_rx->ssn) %
                                                         tid_agg_rx->buf_size;
         }
 
         if (tid_agg_rx->stored_mpdu_num) {
-                j = index = seq_sub(tid_agg_rx->head_seq_num,
-                                    tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+                j = index = ieee80211_sn_sub(tid_agg_rx->head_seq_num,
+                                             tid_agg_rx->ssn) %
+                                                        tid_agg_rx->buf_size;
 
                 for (; j != (index - 1) % tid_agg_rx->buf_size;
                      j = (j + 1) % tid_agg_rx->buf_size) {
@@ -809,7 +795,7 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
         head_seq_num = tid_agg_rx->head_seq_num;
 
         /* frame with out of date sequence number */
-        if (seq_less(mpdu_seq_num, head_seq_num)) {
+        if (ieee80211_sn_less(mpdu_seq_num, head_seq_num)) {
                 dev_kfree_skb(skb);
                 goto out;
         }
@@ -818,8 +804,9 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
          * If frame the sequence number exceeds our buffering window
          * size release some previous frames to make room for this one.
          */
-        if (!seq_less(mpdu_seq_num, head_seq_num + buf_size)) {
-                head_seq_num = seq_inc(seq_sub(mpdu_seq_num, buf_size));
+        if (!ieee80211_sn_less(mpdu_seq_num, head_seq_num + buf_size)) {
+                head_seq_num = ieee80211_sn_inc(
+                                ieee80211_sn_sub(mpdu_seq_num, buf_size));
                 /* release stored frames up to new head to stack */
                 ieee80211_release_reorder_frames(sdata, tid_agg_rx,
                                                  head_seq_num, frames);
@@ -827,7 +814,8 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
 
         /* Now the new frame is always in the range of the reordering buffer */
 
-        index = seq_sub(mpdu_seq_num, tid_agg_rx->ssn) % tid_agg_rx->buf_size;
+        index = ieee80211_sn_sub(mpdu_seq_num,
+                                 tid_agg_rx->ssn) % tid_agg_rx->buf_size;
 
         /* check if we already stored this frame */
         if (tid_agg_rx->reorder_buf[index]) {
@@ -843,7 +831,8 @@ static bool ieee80211_sta_manage_reorder_buf(struct ieee80211_sub_if_data *sdata
          */
         if (mpdu_seq_num == tid_agg_rx->head_seq_num &&
             tid_agg_rx->stored_mpdu_num == 0) {
-                tid_agg_rx->head_seq_num = seq_inc(tid_agg_rx->head_seq_num);
+                tid_agg_rx->head_seq_num =
+                        ieee80211_sn_inc(tid_agg_rx->head_seq_num);
                 ret = false;
                 goto out;
         }
@@ -1894,8 +1883,10 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                  * 'align' will only take the values 0 or 2 here
                  * since all frames are required to be aligned
                  * to 2-byte boundaries when being passed to
-                 * mac80211. That also explains the __skb_push()
-                 * below.
+                 * mac80211; the code here works just as well if
+                 * that isn't true, but mac80211 assumes it can
+                 * access fields as 2-byte aligned (e.g. for
+                 * compare_ether_addr)
                  */
                 align = ((unsigned long)(skb->data + sizeof(struct ethhdr))) & 3;
                 if (align) {
@@ -2552,7 +2543,7 @@ ieee80211_rx_h_action(struct ieee80211_rx_data *rx)
                 case WLAN_SP_MESH_PEERING_CONFIRM:
                         if (!ieee80211_vif_is_mesh(&sdata->vif))
                                 goto invalid;
-                        if (sdata->u.mesh.security != IEEE80211_MESH_SEC_NONE)
+                        if (sdata->u.mesh.user_mpm)
                                 /* userspace handles this frame */
                                 break;
                         goto queue;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index a79ce820cb50..3644ad79688a 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -342,6 +342,11 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
+#ifdef CONFIG_MAC80211_MESH
+        if (ieee80211_vif_is_mesh(&sdata->vif) &&
+            !sdata->u.mesh.user_mpm)
+                init_timer(&sta->plink_timer);
+#endif
 
         memcpy(sta->sta.addr, addr, ETH_ALEN);
         sta->local = local;
@@ -794,9 +799,11 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
 
         mutex_lock(&local->key_mtx);
         for (i = 0; i < NUM_DEFAULT_KEYS; i++)
-                __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]));
+                __ieee80211_key_free(key_mtx_dereference(local, sta->gtk[i]),
+                                     true);
         if (sta->ptk)
-                __ieee80211_key_free(key_mtx_dereference(local, sta->ptk));
+                __ieee80211_key_free(key_mtx_dereference(local, sta->ptk),
+                                     true);
         mutex_unlock(&local->key_mtx);
 
         sta->dead = true;
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 4947341a2a82..e5868c32d1a3 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -281,7 +281,6 @@ struct sta_ampdu_mlme {
  * @plink_state: peer link state
  * @plink_timeout: timeout of peer link
  * @plink_timer: peer link watch timer
- * @plink_timer_was_running: used by suspend/resume to restore timers
  * @t_offset: timing offset relative to this host
  * @t_offset_setpoint: reference timing offset of this sta to be used when
  *      calculating clockdrift
@@ -379,7 +378,6 @@ struct sta_info {
         __le16 reason;
         u8 plink_retries;
         bool ignore_plink_timer;
-        bool plink_timer_was_running;
         enum nl80211_plink_state plink_state;
         u32 plink_timeout;
         struct timer_list plink_timer;
diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h
index 3d7cd2a0582f..e7db2b804e0c 100644
--- a/net/mac80211/trace.h
+++ b/net/mac80211/trace.h
@@ -1042,15 +1042,17 @@ TRACE_EVENT(drv_remain_on_channel,
         TP_PROTO(struct ieee80211_local *local,
                  struct ieee80211_sub_if_data *sdata,
                  struct ieee80211_channel *chan,
-                 unsigned int duration),
+                 unsigned int duration,
+                 enum ieee80211_roc_type type),
 
-        TP_ARGS(local, sdata, chan, duration),
+        TP_ARGS(local, sdata, chan, duration, type),
 
         TP_STRUCT__entry(
                 LOCAL_ENTRY
                 VIF_ENTRY
                 __field(int, center_freq)
                 __field(unsigned int, duration)
+                __field(u32, type)
         ),
 
         TP_fast_assign(
@@ -1058,12 +1060,13 @@ TRACE_EVENT(drv_remain_on_channel,
                 VIF_ASSIGN;
                 __entry->center_freq = chan->center_freq;
                 __entry->duration = duration;
+                __entry->type = type;
         ),
 
         TP_printk(
-                LOCAL_PR_FMT  VIF_PR_FMT " freq:%dMHz duration:%dms",
+                LOCAL_PR_FMT  VIF_PR_FMT " freq:%dMHz duration:%dms type=%d",
                 LOCAL_PR_ARG, VIF_PR_ARG,
-                __entry->center_freq, __entry->duration
+                __entry->center_freq, __entry->duration, __entry->type
         )
 );
 
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index de8548bf0a7f..8914d2d2881a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1231,34 +1231,40 @@ static bool ieee80211_tx_frags(struct ieee80211_local *local,
                 if (local->queue_stop_reasons[q] ||
                     (!txpending && !skb_queue_empty(&local->pending[q]))) {
                         if (unlikely(info->flags &
-                                        IEEE80211_TX_INTFL_OFFCHAN_TX_OK &&
-                                     local->queue_stop_reasons[q] &
-                                        ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL))) {
+                                     IEEE80211_TX_INTFL_OFFCHAN_TX_OK)) {
+                                if (local->queue_stop_reasons[q] &
+                                    ~BIT(IEEE80211_QUEUE_STOP_REASON_OFFCHANNEL)) {
+                                        /*
+                                         * Drop off-channel frames if queues
+                                         * are stopped for any reason other
+                                         * than off-channel operation. Never
+                                         * queue them.
+                                         */
+                                        spin_unlock_irqrestore(
+                                                &local->queue_stop_reason_lock,
+                                                flags);
+                                        ieee80211_purge_tx_queue(&local->hw,
+                                                                 skbs);
+                                        return true;
+                                }
+                        } else {
+
                                 /*
-                                 * Drop off-channel frames if queues are stopped
-                                 * for any reason other than off-channel
-                                 * operation. Never queue them.
+                                 * Since queue is stopped, queue up frames for
+                                 * later transmission from the tx-pending
+                                 * tasklet when the queue is woken again.
                                  */
-                                spin_unlock_irqrestore(
-                                        &local->queue_stop_reason_lock, flags);
-                                ieee80211_purge_tx_queue(&local->hw, skbs);
-                                return true;
+                                if (txpending)
+                                        skb_queue_splice_init(skbs,
+                                                              &local->pending[q]);
+                                else
+                                        skb_queue_splice_tail_init(skbs,
+                                                                   &local->pending[q]);
+
+                                spin_unlock_irqrestore(&local->queue_stop_reason_lock,
+                                                       flags);
+                                return false;
                         }
-
-                        /*
-                         * Since queue is stopped, queue up frames for later
-                         * transmission from the tx-pending tasklet when the
-                         * queue is woken again.
-                         */
-                        if (txpending)
-                                skb_queue_splice_init(skbs, &local->pending[q]);
-                        else
-                                skb_queue_splice_tail_init(skbs,
-                                                           &local->pending[q]);
-
-                        spin_unlock_irqrestore(&local->queue_stop_reason_lock,
-                                               flags);
-                        return false;
                 }
                 spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
@@ -1844,9 +1850,24 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
                 }
 
                 if (!is_multicast_ether_addr(skb->data)) {
+                        struct sta_info *next_hop;
+                        bool mpp_lookup = true;
+
                         mpath = mesh_path_lookup(sdata, skb->data);
-                        if (!mpath)
+                        if (mpath) {
+                                mpp_lookup = false;
+                                next_hop = rcu_dereference(mpath->next_hop);
+                                if (!next_hop ||
+                                    !(mpath->flags & (MESH_PATH_ACTIVE |
+                                                      MESH_PATH_RESOLVING)))
+                                        mpp_lookup = true;
+                        }
+
+                        if (mpp_lookup)
                                 mppath = mpp_path_lookup(sdata, skb->data);
+
+                        if (mppath && mpath)
+                                mesh_path_del(mpath->sdata, mpath->dst);
                 }
 
                 /*
@@ -2350,9 +2371,9 @@ static int ieee80211_beacon_add_tim(struct ieee80211_sub_if_data *sdata,
         if (local->tim_in_locked_section) {
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
         } else {
-                spin_lock(&local->tim_lock);
+                spin_lock_bh(&local->tim_lock);
                 __ieee80211_beacon_add_tim(sdata, ps, skb);
-                spin_unlock(&local->tim_lock);
+                spin_unlock_bh(&local->tim_lock);
         }
 
         return 0;
@@ -2724,7 +2745,8 @@ ieee80211_get_buffered_bc(struct ieee80211_hw *hw,
                                 cpu_to_le16(IEEE80211_FCTL_MOREDATA);
                 }
 
-                sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
+                if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
+                        sdata = IEEE80211_DEV_TO_SUB_IF(skb->dev);
                 if (!ieee80211_tx_prepare(sdata, &tx, skb))
                         break;
                 dev_kfree_skb_any(skb);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 0f38f43ac62e..b7a856e3281b 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1357,6 +1357,25 @@ void ieee80211_stop_device(struct ieee80211_local *local)
         drv_stop(local);
 }
 
+static void ieee80211_assign_chanctx(struct ieee80211_local *local,
+                                     struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_chanctx_conf *conf;
+        struct ieee80211_chanctx *ctx;
+
+        if (!local->use_chanctx)
+                return;
+
+        mutex_lock(&local->chanctx_mtx);
+        conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        if (conf) {
+                ctx = container_of(conf, struct ieee80211_chanctx, conf);
+                drv_assign_vif_chanctx(local, sdata, ctx);
+        }
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 int ieee80211_reconfig(struct ieee80211_local *local)
 {
         struct ieee80211_hw *hw = &local->hw;
@@ -1445,36 +1464,14 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         }
 
         list_for_each_entry(sdata, &local->interfaces, list) {
-                struct ieee80211_chanctx_conf *ctx_conf;
-
                 if (!ieee80211_sdata_running(sdata))
                         continue;
-
-                mutex_lock(&local->chanctx_mtx);
-                ctx_conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
-                if (ctx_conf) {
-                        ctx = container_of(ctx_conf, struct ieee80211_chanctx,
-                                           conf);
-                        drv_assign_vif_chanctx(local, sdata, ctx);
-                }
-                mutex_unlock(&local->chanctx_mtx);
+                ieee80211_assign_chanctx(local, sdata);
         }
 
         sdata = rtnl_dereference(local->monitor_sdata);
-        if (sdata && local->use_chanctx && ieee80211_sdata_running(sdata)) {
-                struct ieee80211_chanctx_conf *ctx_conf;
-
-                mutex_lock(&local->chanctx_mtx);
-                ctx_conf = rcu_dereference_protected(sdata->vif.chanctx_conf,
-                                lockdep_is_held(&local->chanctx_mtx));
-                if (ctx_conf) {
-                        ctx = container_of(ctx_conf, struct ieee80211_chanctx,
-                                           conf);
-                        drv_assign_vif_chanctx(local, sdata, ctx);
-                }
-                mutex_unlock(&local->chanctx_mtx);
-        }
+        if (sdata && ieee80211_sdata_running(sdata))
+                ieee80211_assign_chanctx(local, sdata);
 
         /* add STAs back */
         mutex_lock(&local->sta_mtx);
@@ -1534,11 +1531,6 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                           BSS_CHANGED_IDLE |
                           BSS_CHANGED_TXPOWER;
 
-#ifdef CONFIG_PM
-                if (local->resuming && !reconfig_due_to_wowlan)
-                        sdata->vif.bss_conf = sdata->suspend_bss_conf;
-#endif
-
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC |
@@ -1678,28 +1670,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
         mb();
         local->resuming = false;
 
-        list_for_each_entry(sdata, &local->interfaces, list) {
-                switch(sdata->vif.type) {
-                case NL80211_IFTYPE_STATION:
-                        ieee80211_sta_restart(sdata);
-                        break;
-                case NL80211_IFTYPE_ADHOC:
-                        ieee80211_ibss_restart(sdata);
-                        break;
-                case NL80211_IFTYPE_MESH_POINT:
-                        ieee80211_mesh_restart(sdata);
-                        break;
-                default:
-                        break;
-                }
-        }
-
         mod_timer(&local->sta_cleanup, jiffies + 1);
-
-        mutex_lock(&local->sta_mtx);
-        list_for_each_entry(sta, &local->sta_list, list)
-                mesh_plink_restart(sta);
-        mutex_unlock(&local->sta_mtx);
 #else
         WARN_ON(1);
 #endif
diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
index a2c2258bc84e..171344d4eb7c 100644
--- a/net/mac80211/vht.c
+++ b/net/mac80211/vht.c
@@ -13,6 +13,104 @@
 #include "rate.h"
 
 
+static void __check_vhtcap_disable(struct ieee80211_sub_if_data *sdata,
+                                   struct ieee80211_sta_vht_cap *vht_cap,
+                                   u32 flag)
+{
+        __le32 le_flag = cpu_to_le32(flag);
+
+        if (sdata->u.mgd.vht_capa_mask.vht_cap_info & le_flag &&
+            !(sdata->u.mgd.vht_capa.vht_cap_info & le_flag))
+                vht_cap->cap &= ~flag;
+}
+
+void ieee80211_apply_vhtcap_overrides(struct ieee80211_sub_if_data *sdata,
+                                      struct ieee80211_sta_vht_cap *vht_cap)
+{
+        int i;
+        u16 rxmcs_mask, rxmcs_cap, rxmcs_n, txmcs_mask, txmcs_cap, txmcs_n;
+
+        if (!vht_cap->vht_supported)
+                return;
+
+        if (sdata->vif.type != NL80211_IFTYPE_STATION)
+                return;
+
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_RXLDPC);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_SHORT_GI_80);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_SHORT_GI_160);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_TXSTBC);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN);
+        __check_vhtcap_disable(sdata, vht_cap,
+                               IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN);
+
+        /* Allow user to decrease AMPDU length exponent */
+        if (sdata->u.mgd.vht_capa_mask.vht_cap_info &
+            cpu_to_le32(IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK)) {
+                u32 cap, n;
+
+                n = le32_to_cpu(sdata->u.mgd.vht_capa.vht_cap_info) &
+                        IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+                n >>= IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
+                cap = vht_cap->cap & IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+                cap >>= IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
+
+                if (n < cap) {
+                        vht_cap->cap &=
+                                ~IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+                        vht_cap->cap |=
+                                n << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
+                }
+        }
+
+        /* Allow the user to decrease MCSes */
+        rxmcs_mask =
+                le16_to_cpu(sdata->u.mgd.vht_capa_mask.supp_mcs.rx_mcs_map);
+        rxmcs_n = le16_to_cpu(sdata->u.mgd.vht_capa.supp_mcs.rx_mcs_map);
+        rxmcs_n &= rxmcs_mask;
+        rxmcs_cap = le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
+
+        txmcs_mask =
+                le16_to_cpu(sdata->u.mgd.vht_capa_mask.supp_mcs.tx_mcs_map);
+        txmcs_n = le16_to_cpu(sdata->u.mgd.vht_capa.supp_mcs.tx_mcs_map);
+        txmcs_n &= txmcs_mask;
+        txmcs_cap = le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
+        for (i = 0; i < 8; i++) {
+                u8 m, n, c;
+
+                m = (rxmcs_mask >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                n = (rxmcs_n >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                c = (rxmcs_cap >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                if (m && ((c != IEEE80211_VHT_MCS_NOT_SUPPORTED && n < c) ||
+                          n == IEEE80211_VHT_MCS_NOT_SUPPORTED)) {
+                        rxmcs_cap &= ~(3 << 2*i);
+                        rxmcs_cap |= (rxmcs_n & (3 << 2*i));
+                }
+
+                m = (txmcs_mask >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                n = (txmcs_n >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                c = (txmcs_cap >> 2*i) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                if (m && ((c != IEEE80211_VHT_MCS_NOT_SUPPORTED && n < c) ||
+                          n == IEEE80211_VHT_MCS_NOT_SUPPORTED)) {
+                        txmcs_cap &= ~(3 << 2*i);
+                        txmcs_cap |= (txmcs_n & (3 << 2*i));
+                }
+        }
+        vht_cap->vht_mcs.rx_mcs_map = cpu_to_le16(rxmcs_cap);
+        vht_cap->vht_mcs.tx_mcs_map = cpu_to_le16(txmcs_cap);
+}
+
 void
 ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
                                     struct ieee80211_supported_band *sband,
@@ -20,6 +118,8 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
                                     struct sta_info *sta)
 {
         struct ieee80211_sta_vht_cap *vht_cap = &sta->sta.vht_cap;
+        struct ieee80211_sta_vht_cap own_cap;
+        u32 cap_info, i;
 
         memset(vht_cap, 0, sizeof(*vht_cap));
 
@@ -35,12 +135,122 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
 
         vht_cap->vht_supported = true;
 
-        vht_cap->cap = le32_to_cpu(vht_cap_ie->vht_cap_info);
+        own_cap = sband->vht_cap;
+        /*
+         * If user has specified capability overrides, take care
+         * of that if the station we're setting up is the AP that
+         * we advertised a restricted capability set to. Override
+         * our own capabilities and then use those below.
+         */
+        if (sdata->vif.type == NL80211_IFTYPE_STATION &&
+            !test_sta_flag(sta, WLAN_STA_TDLS_PEER))
+                ieee80211_apply_vhtcap_overrides(sdata, &own_cap);
+
+        /* take some capabilities as-is */
+        cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info);
+        vht_cap->cap = cap_info;
+        vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 |
+                        IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
+                        IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+                        IEEE80211_VHT_CAP_RXLDPC |
+                        IEEE80211_VHT_CAP_VHT_TXOP_PS |
+                        IEEE80211_VHT_CAP_HTC_VHT |
+                        IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
+                        IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_UNSOL_MFB |
+                        IEEE80211_VHT_CAP_VHT_LINK_ADAPTATION_VHT_MRQ_MFB |
+                        IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
+                        IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+
+        /* and some based on our own capabilities */
+        switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
+                vht_cap->cap |= cap_info &
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ;
+                break;
+        case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
+                vht_cap->cap |= cap_info &
+                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
+                break;
+        default:
+                /* nothing */
+                break;
+        }
+
+        /* symmetric capabilities */
+        vht_cap->cap |= cap_info & own_cap.cap &
+                        (IEEE80211_VHT_CAP_SHORT_GI_80 |
+                         IEEE80211_VHT_CAP_SHORT_GI_160);
+
+        /* remaining ones */
+        if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE) {
+                vht_cap->cap |= cap_info &
+                                (IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE |
+                                 IEEE80211_VHT_CAP_BEAMFORMER_ANTENNAS_MAX |
+                                 IEEE80211_VHT_CAP_SOUNDING_DIMENSIONS_MAX);
+        }
+
+        if (own_cap.cap & IEEE80211_VHT_CAP_SU_BEAMFORMER_CAPABLE)
+                vht_cap->cap |= cap_info &
+                                IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE;
+
+        if (own_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE)
+                vht_cap->cap |= cap_info &
+                                IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE;
+
+        if (own_cap.cap & IEEE80211_VHT_CAP_MU_BEAMFORMEE_CAPABLE)
+                vht_cap->cap |= cap_info &
+                                IEEE80211_VHT_CAP_MU_BEAMFORMER_CAPABLE;
+
+        if (own_cap.cap & IEEE80211_VHT_CAP_TXSTBC)
+                vht_cap->cap |= cap_info & IEEE80211_VHT_CAP_RXSTBC_MASK;
+
+        if (own_cap.cap & IEEE80211_VHT_CAP_RXSTBC_MASK)
+                vht_cap->cap |= cap_info & IEEE80211_VHT_CAP_TXSTBC;
 
         /* Copy peer MCS info, the driver might need them. */
         memcpy(&vht_cap->vht_mcs, &vht_cap_ie->supp_mcs,
                sizeof(struct ieee80211_vht_mcs_info));
 
+        /* but also restrict MCSes */
+        for (i = 0; i < 8; i++) {
+                u16 own_rx, own_tx, peer_rx, peer_tx;
+
+                own_rx = le16_to_cpu(own_cap.vht_mcs.rx_mcs_map);
+                own_rx = (own_rx >> i * 2) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                own_tx = le16_to_cpu(own_cap.vht_mcs.tx_mcs_map);
+                own_tx = (own_tx >> i * 2) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                peer_rx = le16_to_cpu(vht_cap->vht_mcs.rx_mcs_map);
+                peer_rx = (peer_rx >> i * 2) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                peer_tx = le16_to_cpu(vht_cap->vht_mcs.tx_mcs_map);
+                peer_tx = (peer_tx >> i * 2) & IEEE80211_VHT_MCS_NOT_SUPPORTED;
+
+                if (peer_tx != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+                        if (own_rx == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                                peer_tx = IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                        else if (own_rx < peer_tx)
+                                peer_tx = own_rx;
+                }
+
+                if (peer_rx != IEEE80211_VHT_MCS_NOT_SUPPORTED) {
+                        if (own_tx == IEEE80211_VHT_MCS_NOT_SUPPORTED)
+                                peer_rx = IEEE80211_VHT_MCS_NOT_SUPPORTED;
+                        else if (own_tx < peer_rx)
+                                peer_rx = own_tx;
+                }
+
+                vht_cap->vht_mcs.rx_mcs_map &=
+                        ~cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << i * 2);
+                vht_cap->vht_mcs.rx_mcs_map |= cpu_to_le16(peer_rx << i * 2);
+
+                vht_cap->vht_mcs.tx_mcs_map &=
+                        ~cpu_to_le16(IEEE80211_VHT_MCS_NOT_SUPPORTED << i * 2);
+                vht_cap->vht_mcs.tx_mcs_map |= cpu_to_le16(peer_tx << i * 2);
+        }
+
+        /* finally set up the bandwidth */
         switch (vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
         case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
         case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ:
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index f82b2e606cfd..1ba9dbc0e107 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1470,7 +1470,8 @@ ip_set_utest(struct sock *ctnl, struct sk_buff *skb,
         if (ret == -EAGAIN)
                 ret = 1;
 
-        return ret < 0 ? ret : ret > 0 ? 0 : -IPSET_ERR_EXIST;
+        return (ret < 0 && ret != -ENOTEMPTY) ? ret :
+                ret > 0 ? 0 : -IPSET_ERR_EXIST;
 }
 
 /* Get headed data of a set */
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index c6bc3bd95052..b75a9b3f9e89 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -117,6 +117,88 @@ u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length)
         return tlv;
 }
 
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap)
+{
+        struct nfc_llcp_sdp_tlv *sdres;
+        u8 value[2];
+
+        sdres = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
+        if (sdres == NULL)
+                return NULL;
+
+        value[0] = tid;
+        value[1] = sap;
+
+        sdres->tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, value, 2,
+                                        &sdres->tlv_len);
+        if (sdres->tlv == NULL) {
+                kfree(sdres);
+                return NULL;
+        }
+
+        sdres->tid = tid;
+        sdres->sap = sap;
+
+        INIT_HLIST_NODE(&sdres->node);
+
+        return sdres;
+}
+
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
+                                                  size_t uri_len)
+{
+        struct nfc_llcp_sdp_tlv *sdreq;
+
+        pr_debug("uri: %s, len: %zu\n", uri, uri_len);
+
+        sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL);
+        if (sdreq == NULL)
+                return NULL;
+
+        sdreq->tlv_len = uri_len + 3;
+
+        if (uri[uri_len - 1] == 0)
+                sdreq->tlv_len--;
+
+        sdreq->tlv = kzalloc(sdreq->tlv_len + 1, GFP_KERNEL);
+        if (sdreq->tlv == NULL) {
+                kfree(sdreq);
+                return NULL;
+        }
+
+        sdreq->tlv[0] = LLCP_TLV_SDREQ;
+        sdreq->tlv[1] = sdreq->tlv_len - 2;
+        sdreq->tlv[2] = tid;
+
+        sdreq->tid = tid;
+        sdreq->uri = sdreq->tlv + 3;
+        memcpy(sdreq->uri, uri, uri_len);
+
+        sdreq->time = jiffies;
+
+        INIT_HLIST_NODE(&sdreq->node);
+
+        return sdreq;
+}
+
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
+{
+        kfree(sdp->tlv);
+        kfree(sdp);
+}
+
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head)
+{
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct hlist_node *n;
+
+        hlist_for_each_entry_safe(sdp, n, head, node) {
+                hlist_del(&sdp->node);
+
+                nfc_llcp_free_sdp_tlv(sdp);
+        }
+}
+
 int nfc_llcp_parse_gb_tlv(struct nfc_llcp_local *local,
                           u8 *tlv_array, u16 tlv_array_len)
 {
@@ -184,10 +266,10 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
 
                 switch (type) {
                 case LLCP_TLV_MIUX:
-                        sock->miu = llcp_tlv_miux(tlv) + 128;
+                        sock->remote_miu = llcp_tlv_miux(tlv) + 128;
                         break;
                 case LLCP_TLV_RW:
-                        sock->rw = llcp_tlv_rw(tlv);
+                        sock->remote_rw = llcp_tlv_rw(tlv);
                         break;
                 case LLCP_TLV_SN:
                         break;
@@ -200,7 +282,8 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
                 tlv += length + 2;
         }
 
-        pr_debug("sock %p rw %d miu %d\n", sock, sock->rw, sock->miu);
+        pr_debug("sock %p rw %d miu %d\n", sock,
+                 sock->remote_rw, sock->remote_miu);
 
         return 0;
 }
@@ -318,9 +401,9 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
         struct sk_buff *skb;
         u8 *service_name_tlv = NULL, service_name_tlv_length;
         u8 *miux_tlv = NULL, miux_tlv_length;
-        u8 *rw_tlv = NULL, rw_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
         int err;
-        u16 size = 0;
+        u16 size = 0, miux;
 
         pr_debug("Sending CONNECT\n");
 
@@ -336,11 +419,15 @@ int nfc_llcp_send_connect(struct nfc_llcp_sock *sock)
                 size += service_name_tlv_length;
         }
 
-        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
+        /* If the socket parameters are not set, use the local ones */
+        miux = sock->miux > LLCP_MAX_MIUX ? local->miux : sock->miux;
+        rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
+
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
                                       &miux_tlv_length);
         size += miux_tlv_length;
 
-        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &local->rw, 0, &rw_tlv_length);
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
         size += rw_tlv_length;
 
         pr_debug("SKB size %d SN length %zu\n", size, sock->service_name_len);
@@ -377,9 +464,9 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
         struct nfc_llcp_local *local;
         struct sk_buff *skb;
         u8 *miux_tlv = NULL, miux_tlv_length;
-        u8 *rw_tlv = NULL, rw_tlv_length;
+        u8 *rw_tlv = NULL, rw_tlv_length, rw;
         int err;
-        u16 size = 0;
+        u16 size = 0, miux;
 
         pr_debug("Sending CC\n");
 
@@ -387,11 +474,15 @@ int nfc_llcp_send_cc(struct nfc_llcp_sock *sock)
         if (local == NULL)
                 return -ENODEV;
 
-        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&local->miux, 0,
+        /* If the socket parameters are not set, use the local ones */
+        miux = sock->miux > LLCP_MAX_MIUX ? local->miux : sock->miux;
+        rw = sock->rw > LLCP_MAX_RW ? local->rw : sock->rw;
+
+        miux_tlv = nfc_llcp_build_tlv(LLCP_TLV_MIUX, (u8 *)&miux, 0,
                                       &miux_tlv_length);
         size += miux_tlv_length;
 
-        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &local->rw, 0, &rw_tlv_length);
+        rw_tlv = nfc_llcp_build_tlv(LLCP_TLV_RW, &rw, 0, &rw_tlv_length);
         size += rw_tlv_length;
 
         skb = llcp_allocate_pdu(sock, LLCP_PDU_CC, size);
@@ -416,48 +507,90 @@ error_tlv:
         return err;
 }
 
-int nfc_llcp_send_snl(struct nfc_llcp_local *local, u8 tid, u8 sap)
+static struct sk_buff *nfc_llcp_allocate_snl(struct nfc_llcp_local *local,
+                                             size_t tlv_length)
 {
         struct sk_buff *skb;
         struct nfc_dev *dev;
-        u8 *sdres_tlv = NULL, sdres_tlv_length, sdres[2];
         u16 size = 0;
 
-        pr_debug("Sending SNL tid 0x%x sap 0x%x\n", tid, sap);
-
         if (local == NULL)
-                return -ENODEV;
+                return ERR_PTR(-ENODEV);
 
         dev = local->dev;
         if (dev == NULL)
-                return -ENODEV;
-
-        sdres[0] = tid;
-        sdres[1] = sap;
-        sdres_tlv = nfc_llcp_build_tlv(LLCP_TLV_SDRES, sdres, 0,
-                                       &sdres_tlv_length);
-        if (sdres_tlv == NULL)
-                return -ENOMEM;
+                return ERR_PTR(-ENODEV);
 
         size += LLCP_HEADER_SIZE;
         size += dev->tx_headroom + dev->tx_tailroom + NFC_HEADER_SIZE;
-        size += sdres_tlv_length;
+        size += tlv_length;
 
         skb = alloc_skb(size, GFP_KERNEL);
-        if (skb == NULL) {
-                kfree(sdres_tlv);
-                return -ENOMEM;
-        }
+        if (skb == NULL)
+                return ERR_PTR(-ENOMEM);
 
         skb_reserve(skb, dev->tx_headroom + NFC_HEADER_SIZE);
 
         skb = llcp_add_header(skb, LLCP_SAP_SDP, LLCP_SAP_SDP, LLCP_PDU_SNL);
 
-        memcpy(skb_put(skb, sdres_tlv_length), sdres_tlv, sdres_tlv_length);
+        return skb;
+}
+
+int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len)
+{
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct hlist_node *n;
+        struct sk_buff *skb;
+
+        skb = nfc_llcp_allocate_snl(local, tlvs_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        hlist_for_each_entry_safe(sdp, n, tlv_list, node) {
+                memcpy(skb_put(skb, sdp->tlv_len), sdp->tlv, sdp->tlv_len);
+
+                hlist_del(&sdp->node);
+
+                nfc_llcp_free_sdp_tlv(sdp);
+        }
 
         skb_queue_tail(&local->tx_queue, skb);
 
-        kfree(sdres_tlv);
+        return 0;
+}
+
+int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len)
+{
+        struct nfc_llcp_sdp_tlv *sdreq;
+        struct hlist_node *n;
+        struct sk_buff *skb;
+
+        skb = nfc_llcp_allocate_snl(local, tlvs_len);
+        if (IS_ERR(skb))
+                return PTR_ERR(skb);
+
+        mutex_lock(&local->sdreq_lock);
+
+        if (hlist_empty(&local->pending_sdreqs))
+                mod_timer(&local->sdreq_timer,
+                          jiffies + msecs_to_jiffies(3 * local->remote_lto));
+
+        hlist_for_each_entry_safe(sdreq, n, tlv_list, node) {
+                pr_debug("tid %d for %s\n", sdreq->tid, sdreq->uri);
+
+                memcpy(skb_put(skb, sdreq->tlv_len), sdreq->tlv,
+                       sdreq->tlv_len);
+
+                hlist_del(&sdreq->node);
+
+                hlist_add_head(&sdreq->node, &local->pending_sdreqs);
+        }
+
+        mutex_unlock(&local->sdreq_lock);
+
+        skb_queue_tail(&local->tx_queue, skb);
 
         return 0;
 }
@@ -532,8 +665,8 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         /* Remote is ready but has not acknowledged our frames */
         if((sock->remote_ready &&
-            skb_queue_len(&sock->tx_pending_queue) >= sock->rw &&
-            skb_queue_len(&sock->tx_queue) >= 2 * sock->rw)) {
+            skb_queue_len(&sock->tx_pending_queue) >= sock->remote_rw &&
+            skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
                 pr_err("Pending queue is full %d frames\n",
                        skb_queue_len(&sock->tx_pending_queue));
                 return -ENOBUFS;
@@ -541,7 +674,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         /* Remote is not ready and we've been queueing enough frames */
         if ((!sock->remote_ready &&
-             skb_queue_len(&sock->tx_queue) >= 2 * sock->rw)) {
+             skb_queue_len(&sock->tx_queue) >= 2 * sock->remote_rw)) {
                 pr_err("Tx queue is full %d frames\n",
                        skb_queue_len(&sock->tx_queue));
                 return -ENOBUFS;
@@ -561,7 +694,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(size_t, sock->miu, remaining_len);
+                frag_len = min_t(size_t, sock->remote_miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
@@ -621,7 +754,7 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap,
 
         while (remaining_len > 0) {
 
-                frag_len = min_t(size_t, sock->miu, remaining_len);
+                frag_len = min_t(size_t, sock->remote_miu, remaining_len);
 
                 pr_debug("Fragment %zd bytes remaining %zd",
                          frag_len, remaining_len);
diff --git a/net/nfc/llcp/llcp.c b/net/nfc/llcp/llcp.c
index 7f8266dd14cb..bb67b98b9797 100644
--- a/net/nfc/llcp/llcp.c
+++ b/net/nfc/llcp/llcp.c
@@ -68,7 +68,8 @@ static void nfc_llcp_socket_purge(struct nfc_llcp_sock *sock)
         }
 }
 
-static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
+static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen,
+                                    int err)
 {
         struct sock *sk;
         struct hlist_node *tmp;
@@ -100,7 +101,10 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
 
                                 nfc_llcp_accept_unlink(accept_sk);
 
+                                if (err)
+                                        accept_sk->sk_err = err;
                                 accept_sk->sk_state = LLCP_CLOSED;
+                                accept_sk->sk_state_change(sk);
 
                                 bh_unlock_sock(accept_sk);
 
@@ -123,7 +127,10 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
                         continue;
                 }
 
+                if (err)
+                        sk->sk_err = err;
                 sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
 
                 bh_unlock_sock(sk);
 
@@ -133,6 +140,36 @@ static void nfc_llcp_socket_release(struct nfc_llcp_local *local, bool listen)
         }
 
         write_unlock(&local->sockets.lock);
+
+        /*
+         * If we want to keep the listening sockets alive,
+         * we don't touch the RAW ones.
+         */
+        if (listen == true)
+                return;
+
+        write_lock(&local->raw_sockets.lock);
+
+        sk_for_each_safe(sk, tmp, &local->raw_sockets.head) {
+                llcp_sock = nfc_llcp_sock(sk);
+
+                bh_lock_sock(sk);
+
+                nfc_llcp_socket_purge(llcp_sock);
+
+                if (err)
+                        sk->sk_err = err;
+                sk->sk_state = LLCP_CLOSED;
+                sk->sk_state_change(sk);
+
+                bh_unlock_sock(sk);
+
+                sock_orphan(sk);
+
+                sk_del_node_init(sk);
+        }
+
+        write_unlock(&local->raw_sockets.lock);
 }
 
 struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
@@ -142,20 +179,28 @@ struct nfc_llcp_local *nfc_llcp_local_get(struct nfc_llcp_local *local)
         return local;
 }
 
-static void local_release(struct kref *ref)
+static void local_cleanup(struct nfc_llcp_local *local, bool listen)
 {
-        struct nfc_llcp_local *local;
-
-        local = container_of(ref, struct nfc_llcp_local, ref);
-
-        list_del(&local->list);
-        nfc_llcp_socket_release(local, false);
+        nfc_llcp_socket_release(local, listen, ENXIO);
         del_timer_sync(&local->link_timer);
         skb_queue_purge(&local->tx_queue);
         cancel_work_sync(&local->tx_work);
         cancel_work_sync(&local->rx_work);
         cancel_work_sync(&local->timeout_work);
         kfree_skb(local->rx_pending);
+        del_timer_sync(&local->sdreq_timer);
+        cancel_work_sync(&local->sdreq_timeout_work);
+        nfc_llcp_free_sdp_tlv_list(&local->pending_sdreqs);
+}
+
+static void local_release(struct kref *ref)
+{
+        struct nfc_llcp_local *local;
+
+        local = container_of(ref, struct nfc_llcp_local, ref);
+
+        list_del(&local->list);
+        local_cleanup(local, false);
         kfree(local);
 }
 
@@ -223,6 +268,47 @@ static void nfc_llcp_symm_timer(unsigned long data)
         schedule_work(&local->timeout_work);
 }
 
+static void nfc_llcp_sdreq_timeout_work(struct work_struct *work)
+{
+        unsigned long time;
+        HLIST_HEAD(nl_sdres_list);
+        struct hlist_node *n;
+        struct nfc_llcp_sdp_tlv *sdp;
+        struct nfc_llcp_local *local = container_of(work, struct nfc_llcp_local,
+                                                    sdreq_timeout_work);
+
+        mutex_lock(&local->sdreq_lock);
+
+        time = jiffies - msecs_to_jiffies(3 * local->remote_lto);
+
+        hlist_for_each_entry_safe(sdp, n, &local->pending_sdreqs, node) {
+                if (time_after(sdp->time, time))
+                        continue;
+
+                sdp->sap = LLCP_SDP_UNBOUND;
+
+                hlist_del(&sdp->node);
+
+                hlist_add_head(&sdp->node, &nl_sdres_list);
+        }
+
+        if (!hlist_empty(&local->pending_sdreqs))
+                mod_timer(&local->sdreq_timer,
+                          jiffies + msecs_to_jiffies(3 * local->remote_lto));
+
+        mutex_unlock(&local->sdreq_lock);
+
+        if (!hlist_empty(&nl_sdres_list))
+                nfc_genl_llc_send_sdres(local->dev, &nl_sdres_list);
+}
+
+static void nfc_llcp_sdreq_timer(unsigned long data)
+{
+        struct nfc_llcp_local *local = (struct nfc_llcp_local *) data;
+
+        schedule_work(&local->sdreq_timeout_work);
+}
+
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev)
 {
         struct nfc_llcp_local *local, *n;
@@ -766,8 +852,6 @@ static void nfc_llcp_recv_ui(struct nfc_llcp_local *local,
         ui_cb->dsap = dsap;
         ui_cb->ssap = ssap;
 
-        printk("%s %d %d\n", __func__, dsap, ssap);
-
         pr_debug("%d %d\n", dsap, ssap);
 
         /* We're looking for a bound socket, not a client one */
@@ -865,7 +949,9 @@ static void nfc_llcp_recv_connect(struct nfc_llcp_local *local,
         new_sock = nfc_llcp_sock(new_sk);
         new_sock->dev = local->dev;
         new_sock->local = nfc_llcp_local_get(local);
-        new_sock->miu = local->remote_miu;
+        new_sock->rw = sock->rw;
+        new_sock->miux = sock->miux;
+        new_sock->remote_miu = local->remote_miu;
         new_sock->nfc_protocol = sock->nfc_protocol;
         new_sock->dsap = ssap;
         new_sock->target_idx = local->target_idx;
@@ -919,11 +1005,11 @@ int nfc_llcp_queue_i_frames(struct nfc_llcp_sock *sock)
 
         pr_debug("Remote ready %d tx queue len %d remote rw %d",
                  sock->remote_ready, skb_queue_len(&sock->tx_pending_queue),
-                 sock->rw);
+                 sock->remote_rw);
 
         /* Try to queue some I frames for transmission */
         while (sock->remote_ready &&
-               skb_queue_len(&sock->tx_pending_queue) < sock->rw) {
+               skb_queue_len(&sock->tx_pending_queue) < sock->remote_rw) {
                 struct sk_buff *pdu;
 
                 pdu = skb_dequeue(&sock->tx_queue);
@@ -1144,6 +1230,10 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
         u16 tlv_len, offset;
         char *service_name;
         size_t service_name_len;
+        struct nfc_llcp_sdp_tlv *sdp;
+        HLIST_HEAD(llc_sdres_list);
+        size_t sdres_tlvs_len;
+        HLIST_HEAD(nl_sdres_list);
 
         dsap = nfc_llcp_dsap(skb);
         ssap = nfc_llcp_ssap(skb);
@@ -1158,6 +1248,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
         tlv = &skb->data[LLCP_HEADER_SIZE];
         tlv_len = skb->len - LLCP_HEADER_SIZE;
         offset = 0;
+        sdres_tlvs_len = 0;
 
         while (offset < tlv_len) {
                 type = tlv[0];
@@ -1175,14 +1266,14 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
                             !strncmp(service_name, "urn:nfc:sn:sdp",
                                      service_name_len)) {
                                 sap = 1;
-                                goto send_snl;
+                                goto add_snl;
                         }
 
                         llcp_sock = nfc_llcp_sock_from_sn(local, service_name,
                                                           service_name_len);
                         if (!llcp_sock) {
                                 sap = 0;
-                                goto send_snl;
+                                goto add_snl;
                         }
 
                         /*
@@ -1199,7 +1290,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
                                 if (sap == LLCP_SAP_MAX) {
                                         sap = 0;
-                                        goto send_snl;
+                                        goto add_snl;
                                 }
 
                                 client_count =
@@ -1216,8 +1307,37 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
 
                         pr_debug("%p %d\n", llcp_sock, sap);
 
-send_snl:
-                        nfc_llcp_send_snl(local, tid, sap);
+add_snl:
+                        sdp = nfc_llcp_build_sdres_tlv(tid, sap);
+                        if (sdp == NULL)
+                                goto exit;
+
+                        sdres_tlvs_len += sdp->tlv_len;
+                        hlist_add_head(&sdp->node, &llc_sdres_list);
+                        break;
+
+                case LLCP_TLV_SDRES:
+                        mutex_lock(&local->sdreq_lock);
+
+                        pr_debug("LLCP_TLV_SDRES: searching tid %d\n", tlv[2]);
+
+                        hlist_for_each_entry(sdp, &local->pending_sdreqs, node) {
+                                if (sdp->tid != tlv[2])
+                                        continue;
+
+                                sdp->sap = tlv[3];
+
+                                pr_debug("Found: uri=%s, sap=%d\n",
+                                         sdp->uri, sdp->sap);
+
+                                hlist_del(&sdp->node);
+
+                                hlist_add_head(&sdp->node, &nl_sdres_list);
+
+                                break;
+                        }
+
+                        mutex_unlock(&local->sdreq_lock);
                         break;
 
                 default:
@@ -1228,6 +1348,13 @@ send_snl:
                 offset += length + 2;
                 tlv += length + 2;
         }
+
+exit:
+        if (!hlist_empty(&nl_sdres_list))
+                nfc_genl_llc_send_sdres(local->dev, &nl_sdres_list);
+
+        if (!hlist_empty(&llc_sdres_list))
+                nfc_llcp_send_snl_sdres(local, &llc_sdres_list, sdres_tlvs_len);
 }
 
 static void nfc_llcp_rx_work(struct work_struct *work)
@@ -1348,7 +1475,7 @@ void nfc_llcp_mac_is_down(struct nfc_dev *dev)
                 return;
 
         /* Close and purge all existing sockets */
-        nfc_llcp_socket_release(local, true);
+        nfc_llcp_socket_release(local, true, 0);
 }
 
 void nfc_llcp_mac_is_up(struct nfc_dev *dev, u32 target_idx,
@@ -1413,6 +1540,13 @@ int nfc_llcp_register_device(struct nfc_dev *ndev)
         local->remote_miu = LLCP_DEFAULT_MIU;
         local->remote_lto = LLCP_DEFAULT_LTO;
 
+        mutex_init(&local->sdreq_lock);
+        INIT_HLIST_HEAD(&local->pending_sdreqs);
+        init_timer(&local->sdreq_timer);
+        local->sdreq_timer.data = (unsigned long) local;
+        local->sdreq_timer.function = nfc_llcp_sdreq_timer;
+        INIT_WORK(&local->sdreq_timeout_work, nfc_llcp_sdreq_timeout_work);
+
         list_add(&local->list, &llcp_devices);
 
         return 0;
@@ -1427,6 +1561,8 @@ void nfc_llcp_unregister_device(struct nfc_dev *dev)
                 return;
         }
 
+        local_cleanup(local, false);
+
         nfc_llcp_local_put(local);
 }
 
diff --git a/net/nfc/llcp/llcp.h b/net/nfc/llcp/llcp.h
index 0eae5c509504..7e87a66b02ec 100644
--- a/net/nfc/llcp/llcp.h
+++ b/net/nfc/llcp/llcp.h
@@ -46,6 +46,19 @@ struct llcp_sock_list {
         rwlock_t          lock;
 };
 
+struct nfc_llcp_sdp_tlv {
+        u8 *tlv;
+        u8 tlv_len;
+
+        char *uri;
+        u8 tid;
+        u8 sap;
+
+        unsigned long time;
+
+        struct hlist_node node;
+};
+
 struct nfc_llcp_local {
         struct list_head list;
         struct nfc_dev *dev;
@@ -86,6 +99,12 @@ struct nfc_llcp_local {
         u8  remote_opt;
         u16 remote_wks;
 
+        struct mutex sdreq_lock;
+        struct hlist_head pending_sdreqs;
+        struct timer_list sdreq_timer;
+        struct work_struct sdreq_timeout_work;
+        u8 sdreq_next_tid;
+
         /* sockets array */
         struct llcp_sock_list sockets;
         struct llcp_sock_list connecting_sockets;
@@ -105,7 +124,12 @@ struct nfc_llcp_sock {
         char *service_name;
         size_t service_name_len;
         u8 rw;
-        u16 miu;
+        u16 miux;
+
+
+        /* Remote link parameters */
+        u8 remote_rw;
+        u16 remote_miu;
 
         /* Link variables */
         u8 send_n;
@@ -213,12 +237,20 @@ int nfc_llcp_parse_connection_tlv(struct nfc_llcp_sock *sock,
 /* Commands API */
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
 u8 *nfc_llcp_build_tlv(u8 type, u8 *value, u8 value_length, u8 *tlv_length);
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdres_tlv(u8 tid, u8 sap);
+struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri,
+                                                  size_t uri_len);
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head);
 void nfc_llcp_recv(void *data, struct sk_buff *skb, int err);
 int nfc_llcp_disconnect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_symm(struct nfc_dev *dev);
 int nfc_llcp_send_connect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_cc(struct nfc_llcp_sock *sock);
-int nfc_llcp_send_snl(struct nfc_llcp_local *local, u8 tid, u8 sap);
+int nfc_llcp_send_snl_sdres(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len);
+int nfc_llcp_send_snl_sdreq(struct nfc_llcp_local *local,
+                            struct hlist_head *tlv_list, size_t tlvs_len);
 int nfc_llcp_send_dm(struct nfc_llcp_local *local, u8 ssap, u8 dsap, u8 reason);
 int nfc_llcp_send_disconnect(struct nfc_llcp_sock *sock);
 int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 5332751943a9..f1b377e247fe 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -223,6 +223,124 @@ error:
         return ret;
 }
 
+static int nfc_llcp_setsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, unsigned int optlen)
+{
+        struct sock *sk = sock->sk;
+        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        u32 opt;
+        int err = 0;
+
+        pr_debug("%p optname %d\n", sk, optname);
+
+        if (level != SOL_NFC)
+                return -ENOPROTOOPT;
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case NFC_LLCP_RW:
+                if (sk->sk_state == LLCP_CONNECTED ||
+                    sk->sk_state == LLCP_BOUND ||
+                    sk->sk_state == LLCP_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt > LLCP_MAX_RW) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                llcp_sock->rw = (u8) opt;
+
+                break;
+
+        case NFC_LLCP_MIUX:
+                if (sk->sk_state == LLCP_CONNECTED ||
+                    sk->sk_state == LLCP_BOUND ||
+                    sk->sk_state == LLCP_LISTEN) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                if (get_user(opt, (u32 __user *) optval)) {
+                        err = -EFAULT;
+                        break;
+                }
+
+                if (opt > LLCP_MAX_MIUX) {
+                        err = -EINVAL;
+                        break;
+                }
+
+                llcp_sock->miux = (u16) opt;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+
+        pr_debug("%p rw %d miux %d\n", llcp_sock,
+                 llcp_sock->rw, llcp_sock->miux);
+
+        return err;
+}
+
+static int nfc_llcp_getsockopt(struct socket *sock, int level, int optname,
+                               char __user *optval, int __user *optlen)
+{
+        struct sock *sk = sock->sk;
+        struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
+        int len, err = 0;
+
+        pr_debug("%p optname %d\n", sk, optname);
+
+        if (level != SOL_NFC)
+                return -ENOPROTOOPT;
+
+        if (get_user(len, optlen))
+                return -EFAULT;
+
+        len = min_t(u32, len, sizeof(u32));
+
+        lock_sock(sk);
+
+        switch (optname) {
+        case NFC_LLCP_RW:
+                if (put_user(llcp_sock->rw, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        case NFC_LLCP_MIUX:
+                if (put_user(llcp_sock->miux, (u32 __user *) optval))
+                        err = -EFAULT;
+
+                break;
+
+        default:
+                err = -ENOPROTOOPT;
+                break;
+        }
+
+        release_sock(sk);
+
+        if (put_user(len, optlen))
+                return -EFAULT;
+
+        return err;
+}
+
 void nfc_llcp_accept_unlink(struct sock *sk)
 {
         struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
@@ -278,6 +396,8 @@ struct sock *nfc_llcp_accept_dequeue(struct sock *parent,
 
                         pr_debug("Returning sk state %d\n", sk->sk_state);
 
+                        sk_acceptq_removed(parent);
+
                         return sk;
                 }
 
@@ -541,7 +661,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr,
 
         llcp_sock->dev = dev;
         llcp_sock->local = nfc_llcp_local_get(local);
-        llcp_sock->miu = llcp_sock->local->remote_miu;
+        llcp_sock->remote_miu = llcp_sock->local->remote_miu;
         llcp_sock->ssap = nfc_llcp_get_local_ssap(local);
         if (llcp_sock->ssap == LLCP_SAP_MAX) {
                 ret = -ENOMEM;
@@ -735,8 +855,8 @@ static const struct proto_ops llcp_sock_ops = {
         .ioctl          = sock_no_ioctl,
         .listen         = llcp_sock_listen,
         .shutdown       = sock_no_shutdown,
-        .setsockopt     = sock_no_setsockopt,
-        .getsockopt     = sock_no_getsockopt,
+        .setsockopt     = nfc_llcp_setsockopt,
+        .getsockopt     = nfc_llcp_getsockopt,
         .sendmsg        = llcp_sock_sendmsg,
         .recvmsg        = llcp_sock_recvmsg,
         .mmap           = sock_no_mmap,
@@ -800,8 +920,10 @@ struct sock *nfc_llcp_sock_alloc(struct socket *sock, int type, gfp_t gfp)
 
         llcp_sock->ssap = 0;
         llcp_sock->dsap = LLCP_SAP_SDP;
-        llcp_sock->rw = LLCP_DEFAULT_RW;
-        llcp_sock->miu = LLCP_DEFAULT_MIU;
+        llcp_sock->rw = LLCP_MAX_RW + 1;
+        llcp_sock->miux = LLCP_MAX_MIUX + 1;
+        llcp_sock->remote_rw = LLCP_DEFAULT_RW;
+        llcp_sock->remote_miu = LLCP_DEFAULT_MIU;
         llcp_sock->send_n = llcp_sock->send_ack_n = 0;
         llcp_sock->recv_n = llcp_sock->recv_ack_n = 0;
         llcp_sock->remote_ready = 1;
diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
index 504b883439f1..73fd51098f4d 100644
--- a/net/nfc/netlink.c
+++ b/net/nfc/netlink.c
@@ -53,6 +53,15 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = {
         [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 },
         [NFC_ATTR_IM_PROTOCOLS] = { .type = NLA_U32 },
         [NFC_ATTR_TM_PROTOCOLS] = { .type = NLA_U32 },
+        [NFC_ATTR_LLC_PARAM_LTO] = { .type = NLA_U8 },
+        [NFC_ATTR_LLC_PARAM_RW] = { .type = NLA_U8 },
+        [NFC_ATTR_LLC_PARAM_MIUX] = { .type = NLA_U16 },
+        [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED },
+};
+
+static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = {
+        [NFC_SDP_ATTR_URI] = { .type = NLA_STRING },
+        [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 },
 };
 
 static int nfc_genl_send_target(struct sk_buff *msg, struct nfc_target *target,
@@ -348,6 +357,74 @@ free_msg:
         return -EMSGSIZE;
 }
 
+int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list)
+{
+        struct sk_buff *msg;
+        struct nlattr *sdp_attr, *uri_attr;
+        struct nfc_llcp_sdp_tlv *sdres;
+        struct hlist_node *n;
+        void *hdr;
+        int rc = -EMSGSIZE;
+        int i;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = genlmsg_put(msg, 0, 0, &nfc_genl_family, 0,
+                          NFC_EVENT_LLC_SDRES);
+        if (!hdr)
+                goto free_msg;
+
+        if (nla_put_u32(msg, NFC_ATTR_DEVICE_INDEX, dev->idx))
+                goto nla_put_failure;
+
+        sdp_attr = nla_nest_start(msg, NFC_ATTR_LLC_SDP);
+        if (sdp_attr == NULL) {
+                rc = -ENOMEM;
+                goto nla_put_failure;
+        }
+
+        i = 1;
+        hlist_for_each_entry_safe(sdres, n, sdres_list, node) {
+                pr_debug("uri: %s, sap: %d\n", sdres->uri, sdres->sap);
+
+                uri_attr = nla_nest_start(msg, i++);
+                if (uri_attr == NULL) {
+                        rc = -ENOMEM;
+                        goto nla_put_failure;
+                }
+
+                if (nla_put_u8(msg, NFC_SDP_ATTR_SAP, sdres->sap))
+                        goto nla_put_failure;
+
+                if (nla_put_string(msg, NFC_SDP_ATTR_URI, sdres->uri))
+                        goto nla_put_failure;
+
+                nla_nest_end(msg, uri_attr);
+
+                hlist_del(&sdres->node);
+
+                nfc_llcp_free_sdp_tlv(sdres);
+        }
+
+        nla_nest_end(msg, sdp_attr);
+
+        genlmsg_end(msg, hdr);
+
+        return genlmsg_multicast(msg, 0, nfc_genl_event_mcgrp.id, GFP_ATOMIC);
+
+nla_put_failure:
+        genlmsg_cancel(msg, hdr);
+
+free_msg:
+        nlmsg_free(msg);
+
+        nfc_llcp_free_sdp_tlv_list(sdres_list);
+
+        return rc;
+}
+
 static int nfc_genl_send_device(struct sk_buff *msg, struct nfc_dev *dev,
                                 u32 portid, u32 seq,
                                 struct netlink_callback *cb,
@@ -859,6 +936,96 @@ exit:
         return rc;
 }
 
+static int nfc_genl_llc_sdreq(struct sk_buff *skb, struct genl_info *info)
+{
+        struct nfc_dev *dev;
+        struct nfc_llcp_local *local;
+        struct nlattr *attr, *sdp_attrs[NFC_SDP_ATTR_MAX+1];
+        u32 idx;
+        u8 tid;
+        char *uri;
+        int rc = 0, rem;
+        size_t uri_len, tlvs_len;
+        struct hlist_head sdreq_list;
+        struct nfc_llcp_sdp_tlv *sdreq;
+
+        if (!info->attrs[NFC_ATTR_DEVICE_INDEX] ||
+            !info->attrs[NFC_ATTR_LLC_SDP])
+                return -EINVAL;
+
+        idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
+
+        dev = nfc_get_device(idx);
+        if (!dev) {
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        device_lock(&dev->dev);
+
+        if (dev->dep_link_up == false) {
+                rc = -ENOLINK;
+                goto exit;
+        }
+
+        local = nfc_llcp_find_local(dev);
+        if (!local) {
+                nfc_put_device(dev);
+                rc = -ENODEV;
+                goto exit;
+        }
+
+        INIT_HLIST_HEAD(&sdreq_list);
+
+        tlvs_len = 0;
+
+        nla_for_each_nested(attr, info->attrs[NFC_ATTR_LLC_SDP], rem) {
+                rc = nla_parse_nested(sdp_attrs, NFC_SDP_ATTR_MAX, attr,
+                                      nfc_sdp_genl_policy);
+
+                if (rc != 0) {
+                        rc = -EINVAL;
+                        goto exit;
+                }
+
+                if (!sdp_attrs[NFC_SDP_ATTR_URI])
+                        continue;
+
+                uri_len = nla_len(sdp_attrs[NFC_SDP_ATTR_URI]);
+                if (uri_len == 0)
+                        continue;
+
+                uri = nla_data(sdp_attrs[NFC_SDP_ATTR_URI]);
+                if (uri == NULL || *uri == 0)
+                        continue;
+
+                tid = local->sdreq_next_tid++;
+
+                sdreq = nfc_llcp_build_sdreq_tlv(tid, uri, uri_len);
+                if (sdreq == NULL) {
+                        rc = -ENOMEM;
+                        goto exit;
+                }
+
+                tlvs_len += sdreq->tlv_len;
+
+                hlist_add_head(&sdreq->node, &sdreq_list);
+        }
+
+        if (hlist_empty(&sdreq_list)) {
+                rc = -EINVAL;
+                goto exit;
+        }
+
+        rc = nfc_llcp_send_snl_sdreq(local, &sdreq_list, tlvs_len);
+exit:
+        device_unlock(&dev->dev);
+
+        nfc_put_device(dev);
+
+        return rc;
+}
+
 static struct genl_ops nfc_genl_ops[] = {
         {
                 .cmd = NFC_CMD_GET_DEVICE,
@@ -913,6 +1080,11 @@ static struct genl_ops nfc_genl_ops[] = {
                 .doit = nfc_genl_llc_set_params,
                 .policy = nfc_genl_policy,
         },
+        {
+                .cmd = NFC_CMD_LLC_SDREQ,
+                .doit = nfc_genl_llc_sdreq,
+                .policy = nfc_genl_policy,
+        },
 };
 
 
diff --git a/net/nfc/nfc.h b/net/nfc/nfc.h
index 87d914d2876a..94bfe19ba678 100644
--- a/net/nfc/nfc.h
+++ b/net/nfc/nfc.h
@@ -46,6 +46,8 @@ struct nfc_rawsock {
 #define to_rawsock_sk(_tx_work) \
         ((struct sock *) container_of(_tx_work, struct nfc_rawsock, tx_work))
 
+struct nfc_llcp_sdp_tlv;
+
 #ifdef CONFIG_NFC_LLCP
 
 void nfc_llcp_mac_is_down(struct nfc_dev *dev);
@@ -59,6 +61,8 @@ int nfc_llcp_data_received(struct nfc_dev *dev, struct sk_buff *skb);
 struct nfc_llcp_local *nfc_llcp_find_local(struct nfc_dev *dev);
 int __init nfc_llcp_init(void);
 void nfc_llcp_exit(void);
+void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp);
+void nfc_llcp_free_sdp_tlv_list(struct hlist_head *head);
 
 #else
 
@@ -112,6 +116,14 @@ static inline void nfc_llcp_exit(void)
 {
 }
 
+static inline void nfc_llcp_free_sdp_tlv(struct nfc_llcp_sdp_tlv *sdp)
+{
+}
+
+static inline void nfc_llcp_free_sdp_tlv_list(struct hlist_head *sdp_head)
+{
+}
+
 #endif
 
 int __init rawsock_init(void);
@@ -144,6 +156,8 @@ int nfc_genl_dep_link_down_event(struct nfc_dev *dev);
 int nfc_genl_tm_activated(struct nfc_dev *dev, u32 protocol);
 int nfc_genl_tm_deactivated(struct nfc_dev *dev);
 
+int nfc_genl_llc_send_sdres(struct nfc_dev *dev, struct hlist_head *sdres_list);
+
 struct nfc_dev *nfc_get_device(unsigned int idx);
 
 static inline void nfc_put_device(struct nfc_dev *dev)
diff --git a/net/rds/message.c b/net/rds/message.c
index f0a4658f3273..aba232f9f308 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -82,10 +82,7 @@ static void rds_message_purge(struct rds_message *rm)
 void rds_message_put(struct rds_message *rm)
 {
         rdsdebug("put rm %p ref %d\n", rm, atomic_read(&rm->m_refcount));
-        if (atomic_read(&rm->m_refcount) == 0) {
-printk(KERN_CRIT "danger refcount zero on %p\n", rm);
-WARN_ON(1);
-        }
+        WARN(!atomic_read(&rm->m_refcount), "danger refcount zero on %p\n", rm);
         if (atomic_dec_and_test(&rm->m_refcount)) {
                 BUG_ON(!list_empty(&rm->m_sock_item));
                 BUG_ON(!list_empty(&rm->m_conn_item));
@@ -197,6 +194,9 @@ struct rds_message *rds_message_alloc(unsigned int extra_len, gfp_t gfp)
 {
         struct rds_message *rm;
 
+        if (extra_len > KMALLOC_MAX_SIZE - sizeof(struct rds_message))
+                return NULL;
+
         rm = kzalloc(sizeof(struct rds_message) + extra_len, gfp);
         if (!rm)
                 goto out;
diff --git a/net/rfkill/rfkill-regulator.c b/net/rfkill/rfkill-regulator.c
index 4b5ab21ecb24..d11ac79246e4 100644
--- a/net/rfkill/rfkill-regulator.c
+++ b/net/rfkill/rfkill-regulator.c
@@ -51,7 +51,7 @@ static int rfkill_regulator_set_block(void *data, bool blocked)
         return 0;
 }
 
-struct rfkill_ops rfkill_regulator_ops = {
+static struct rfkill_ops rfkill_regulator_ops = {
         .set_block = rfkill_regulator_set_block,
 };
 
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index e9a77f621c3d..d51852bba01c 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -298,6 +298,10 @@ static void qfq_update_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
             new_num_classes == q->max_agg_classes - 1) /* agg no more full */
                 hlist_add_head(&agg->nonfull_next, &q->nonfull_aggs);
 
+        /* The next assignment may let
+         * agg->initial_budget > agg->budgetmax
+         * hold, we will take it into account in charge_actual_service().
+         */
         agg->budgetmax = new_num_classes * agg->lmax;
         new_agg_weight = agg->class_weight * new_num_classes;
         agg->inv_w = ONE_FP/new_agg_weight;
@@ -817,7 +821,7 @@ static void qfq_make_eligible(struct qfq_sched *q)
         unsigned long old_vslot = q->oldV >> q->min_slot_shift;
 
         if (vslot != old_vslot) {
-                unsigned long mask = (1UL << fls(vslot ^ old_vslot)) - 1;
+                unsigned long mask = (1ULL << fls(vslot ^ old_vslot)) - 1;
                 qfq_move_groups(q, mask, IR, ER);
                 qfq_move_groups(q, mask, IB, EB);
         }
@@ -988,12 +992,23 @@ static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
 /* Update F according to the actual service received by the aggregate. */
 static inline void charge_actual_service(struct qfq_aggregate *agg)
 {
-        /* compute the service received by the aggregate */
-        u32 service_received = agg->initial_budget - agg->budget;
+        /* Compute the service received by the aggregate, taking into
+         * account that, after decreasing the number of classes in
+         * agg, it may happen that
+         * agg->initial_budget - agg->budget > agg->bugdetmax
+         */
+        u32 service_received = min(agg->budgetmax,
+                                   agg->initial_budget - agg->budget);
 
         agg->F = agg->S + (u64)service_received * agg->inv_w;
 }
 
+static inline void qfq_update_agg_ts(struct qfq_sched *q,
+                                     struct qfq_aggregate *agg,
+                                     enum update_reason reason);
+
+static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg);
+
 static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
 {
         struct qfq_sched *q = qdisc_priv(sch);
@@ -1021,7 +1036,7 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                 in_serv_agg->initial_budget = in_serv_agg->budget =
                         in_serv_agg->budgetmax;
 
-                if (!list_empty(&in_serv_agg->active))
+                if (!list_empty(&in_serv_agg->active)) {
                         /*
                          * Still active: reschedule for
                          * service. Possible optimization: if no other
@@ -1032,8 +1047,9 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
                          * handle it, we would need to maintain an
                          * extra num_active_aggs field.
                         */
-                        qfq_activate_agg(q, in_serv_agg, requeue);
-                else if (sch->q.qlen == 0) { /* no aggregate to serve */
+                        qfq_update_agg_ts(q, in_serv_agg, requeue);
+                        qfq_schedule_agg(q, in_serv_agg);
+                } else if (sch->q.qlen == 0) { /* no aggregate to serve */
                         q->in_serv_agg = NULL;
                         return NULL;
                 }
@@ -1052,7 +1068,15 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
         qdisc_bstats_update(sch, skb);
 
         agg_dequeue(in_serv_agg, cl, len);
-        in_serv_agg->budget -= len;
+        /* If lmax is lowered, through qfq_change_class, for a class
+         * owning pending packets with larger size than the new value
+         * of lmax, then the following condition may hold.
+         */
+        if (unlikely(in_serv_agg->budget < len))
+                in_serv_agg->budget = 0;
+        else
+                in_serv_agg->budget -= len;
+
         q->V += (u64)len * IWSUM;
         pr_debug("qfq dequeue: len %u F %lld now %lld\n",
                  len, (unsigned long long) in_serv_agg->F,
@@ -1217,17 +1241,11 @@ static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         cl->deficit = agg->lmax;
         list_add_tail(&cl->alist, &agg->active);
 
-        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl)
-                return err; /* aggregate was not empty, nothing else to do */
+        if (list_first_entry(&agg->active, struct qfq_class, alist) != cl ||
+            q->in_serv_agg == agg)
+                return err; /* non-empty or in service, nothing else to do */
 
-        /* recharge budget */
-        agg->initial_budget = agg->budget = agg->budgetmax;
-
-        qfq_update_agg_ts(q, agg, enqueue);
-        if (q->in_serv_agg == NULL)
-                q->in_serv_agg = agg;
-        else if (agg != q->in_serv_agg)
-                qfq_schedule_agg(q, agg);
+        qfq_activate_agg(q, agg, enqueue);
 
         return err;
 }
@@ -1261,7 +1279,8 @@ static void qfq_schedule_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                 /* group was surely ineligible, remove */
                 __clear_bit(grp->index, &q->bitmaps[IR]);
                 __clear_bit(grp->index, &q->bitmaps[IB]);
-        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V))
+        } else if (!q->bitmaps[ER] && qfq_gt(roundedS, q->V) &&
+                   q->in_serv_agg == NULL)
                 q->V = roundedS;
 
         grp->S = roundedS;
@@ -1284,8 +1303,15 @@ skip_update:
 static void qfq_activate_agg(struct qfq_sched *q, struct qfq_aggregate *agg,
                              enum update_reason reason)
 {
+        agg->initial_budget = agg->budget = agg->budgetmax; /* recharge budg. */
+
         qfq_update_agg_ts(q, agg, reason);
-        qfq_schedule_agg(q, agg);
+        if (q->in_serv_agg == NULL) { /* no aggr. in service or scheduled */
+                q->in_serv_agg = agg; /* start serving this aggregate */
+                 /* update V: to be in service, agg must be eligible */
+                q->oldV = q->V = agg->S;
+        } else if (agg != q->in_serv_agg)
+                qfq_schedule_agg(q, agg);
 }
 
 static void qfq_slot_remove(struct qfq_sched *q, struct qfq_group *grp,
@@ -1357,8 +1383,6 @@ static void qfq_deactivate_agg(struct qfq_sched *q, struct qfq_aggregate *agg)
                         __set_bit(grp->index, &q->bitmaps[s]);
                 }
         }
-
-        qfq_update_eligible(q);
 }
 
 static void qfq_qlen_notify(struct Qdisc *sch, unsigned long arg)
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index 2b3ef03c6098..12ed45dbe75d 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -155,7 +155,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
 
         /* SCTP-AUTH extensions*/
         INIT_LIST_HEAD(&ep->endpoint_shared_keys);
-        null_key = sctp_auth_shkey_create(0, GFP_KERNEL);
+        null_key = sctp_auth_shkey_create(0, gfp);
         if (!null_key)
                 goto nomem;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c99458df3f3f..b9070736b8d9 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5653,6 +5653,9 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         if (len < sizeof(sctp_assoc_t))
                 return -EINVAL;
 
+        /* Allow the struct to grow and fill in as much as possible */
+        len = min_t(size_t, len, sizeof(sas));
+
         if (copy_from_user(&sas, optval, len))
                 return -EFAULT;
 
@@ -5686,9 +5689,6 @@ static int sctp_getsockopt_assoc_stats(struct sock *sk, int len,
         /* Mark beginning of a new observation period */
         asoc->stats.max_obs_rto = asoc->rto_min;
 
-        /* Allow the struct to grow and fill in as much as possible */
-        len = min_t(size_t, len, sizeof(sas));
-
         if (put_user(len, optlen))
                 return -EFAULT;
 
diff --git a/net/sctp/ssnmap.c b/net/sctp/ssnmap.c
index 442ad4ed6315..825ea94415b3 100644
--- a/net/sctp/ssnmap.c
+++ b/net/sctp/ssnmap.c
@@ -41,8 +41,6 @@
 #include <net/sctp/sctp.h>
 #include <net/sctp/sm.h>
 
-#define MAX_KMALLOC_SIZE        131072
-
 static struct sctp_ssnmap *sctp_ssnmap_init(struct sctp_ssnmap *map, __u16 in,
                                             __u16 out);
 
@@ -65,7 +63,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
         int size;
 
         size = sctp_ssnmap_size(in, out);
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                 retval = kmalloc(size, gfp);
         else
                 retval = (struct sctp_ssnmap *)
@@ -82,7 +80,7 @@ struct sctp_ssnmap *sctp_ssnmap_new(__u16 in, __u16 out,
         return retval;
 
 fail_map:
-        if (size <= MAX_KMALLOC_SIZE)
+        if (size <= KMALLOC_MAX_SIZE)
                 kfree(retval);
         else
                 free_pages((unsigned long)retval, get_order(size));
@@ -124,7 +122,7 @@ void sctp_ssnmap_free(struct sctp_ssnmap *map)
                 int size;
 
                 size = sctp_ssnmap_size(map->in.len, map->out.len);
-                if (size <= MAX_KMALLOC_SIZE)
+                if (size <= KMALLOC_MAX_SIZE)
                         kfree(map);
                 else
                         free_pages((unsigned long)map, get_order(size));
diff --git a/net/sctp/tsnmap.c b/net/sctp/tsnmap.c
index 5f25e0c92c31..396c45174e5b 100644
--- a/net/sctp/tsnmap.c
+++ b/net/sctp/tsnmap.c
@@ -51,7 +51,7 @@
 static void sctp_tsnmap_update(struct sctp_tsnmap *map);
 static void sctp_tsnmap_find_gap_ack(unsigned long *map, __u16 off,
                                      __u16 len, __u16 *start, __u16 *end);
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap);
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size);
 
 /* Initialize a block of memory as a tsnmap.  */
 struct sctp_tsnmap *sctp_tsnmap_init(struct sctp_tsnmap *map, __u16 len,
@@ -124,7 +124,7 @@ int sctp_tsnmap_mark(struct sctp_tsnmap *map, __u32 tsn,
 
         gap = tsn - map->base_tsn;
 
-        if (gap >= map->len && !sctp_tsnmap_grow(map, gap))
+        if (gap >= map->len && !sctp_tsnmap_grow(map, gap + 1))
                 return -ENOMEM;
 
         if (!sctp_tsnmap_has_gap(map) && gap == 0) {
@@ -360,23 +360,24 @@ __u16 sctp_tsnmap_num_gabs(struct sctp_tsnmap *map,
         return ngaps;
 }
 
-static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 gap)
+static int sctp_tsnmap_grow(struct sctp_tsnmap *map, u16 size)
 {
         unsigned long *new;
         unsigned long inc;
         u16  len;
 
-        if (gap >= SCTP_TSN_MAP_SIZE)
+        if (size > SCTP_TSN_MAP_SIZE)
                 return 0;
 
-        inc = ALIGN((gap - map->len),BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
+        inc = ALIGN((size - map->len), BITS_PER_LONG) + SCTP_TSN_MAP_INCREMENT;
         len = min_t(u16, map->len + inc, SCTP_TSN_MAP_SIZE);
 
         new = kzalloc(len>>3, GFP_ATOMIC);
         if (!new)
                 return 0;
 
-        bitmap_copy(new, map->tsn_map, map->max_tsn_seen - map->base_tsn);
+        bitmap_copy(new, map->tsn_map,
+                map->max_tsn_seen - map->cumulative_tsn_ack_point);
         kfree(map->tsn_map);
         map->tsn_map = new;
         map->len = len;
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index ada17464b65b..0fd5b3d2df03 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -106,6 +106,7 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
 {
         struct sk_buff_head temp;
         struct sctp_ulpevent *event;
+        int event_eor = 0;
 
         /* Create an event from the incoming chunk. */
         event = sctp_ulpevent_make_rcvmsg(chunk->asoc, chunk, gfp);
@@ -127,10 +128,12 @@ int sctp_ulpq_tail_data(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         /* Send event to the ULP.  'event' is the sctp_ulpevent for
          * very first SKB on the 'temp' list.
          */
-        if (event)
+        if (event) {
+                event_eor = (event->msg_flags & MSG_EOR) ? 1 : 0;
                 sctp_ulpq_tail_event(ulpq, event);
+        }
 
-        return 0;
+        return event_eor;
 }
 
 /* Add a new event for propagation to the ULP.  */
@@ -540,14 +543,19 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_partial(struct sctp_ulpq *ulpq)
                 ctsn = cevent->tsn;
 
                 switch (cevent->msg_flags & SCTP_DATA_FRAG_MASK) {
+                case SCTP_DATA_FIRST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        goto done;
                 case SCTP_DATA_MIDDLE_FRAG:
                         if (!first_frag) {
                                 first_frag = pos;
                                 next_tsn = ctsn + 1;
                                 last_frag = pos;
-                        } else if (next_tsn == ctsn)
+                        } else if (next_tsn == ctsn) {
                                 next_tsn++;
-                        else
+                                last_frag = pos;
+                        } else
                                 goto done;
                         break;
                 case SCTP_DATA_LAST_FRAG:
@@ -651,6 +659,14 @@ static struct sctp_ulpevent *sctp_ulpq_retrieve_first(struct sctp_ulpq *ulpq)
                         } else
                                 goto done;
                         break;
+
+                case SCTP_DATA_LAST_FRAG:
+                        if (!first_frag)
+                                return NULL;
+                        else
+                                goto done;
+                        break;
+
                 default:
                         return NULL;
                 }
@@ -962,20 +978,43 @@ static __u16 sctp_ulpq_renege_list(struct sctp_ulpq *ulpq,
                 struct sk_buff_head *list, __u16 needed)
 {
         __u16 freed = 0;
-        __u32 tsn;
-        struct sk_buff *skb;
+        __u32 tsn, last_tsn;
+        struct sk_buff *skb, *flist, *last;
         struct sctp_ulpevent *event;
         struct sctp_tsnmap *tsnmap;
 
         tsnmap = &ulpq->asoc->peer.tsn_map;
 
-        while ((skb = __skb_dequeue_tail(list)) != NULL) {
-                freed += skb_headlen(skb);
+        while ((skb = skb_peek_tail(list)) != NULL) {
                 event = sctp_skb2event(skb);
                 tsn = event->tsn;
 
+                /* Don't renege below the Cumulative TSN ACK Point. */
+                if (TSN_lte(tsn, sctp_tsnmap_get_ctsn(tsnmap)))
+                        break;
+
+                /* Events in ordering queue may have multiple fragments
+                 * corresponding to additional TSNs.  Sum the total
+                 * freed space; find the last TSN.
+                 */
+                freed += skb_headlen(skb);
+                flist = skb_shinfo(skb)->frag_list;
+                for (last = flist; flist; flist = flist->next) {
+                        last = flist;
+                        freed += skb_headlen(last);
+                }
+                if (last)
+                        last_tsn = sctp_skb2event(last)->tsn;
+                else
+                        last_tsn = tsn;
+
+                /* Unlink the event, then renege all applicable TSNs. */
+                __skb_unlink(skb, list);
                 sctp_ulpevent_free(event);
-                sctp_tsnmap_renege(tsnmap, tsn);
+                while (TSN_lte(tsn, last_tsn)) {
+                        sctp_tsnmap_renege(tsnmap, tsn);
+                        tsn++;
+                }
                 if (freed >= needed)
                         return freed;
         }
@@ -1002,16 +1041,28 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq,
         struct sctp_ulpevent *event;
         struct sctp_association *asoc;
         struct sctp_sock *sp;
+        __u32 ctsn;
+        struct sk_buff *skb;
 
         asoc = ulpq->asoc;
         sp = sctp_sk(asoc->base.sk);
 
         /* If the association is already in Partial Delivery mode
-         * we have noting to do.
+         * we have nothing to do.
          */
         if (ulpq->pd_mode)
                 return;
 
+        /* Data must be at or below the Cumulative TSN ACK Point to
+         * start partial delivery.
+         */
+        skb = skb_peek(&asoc->ulpq.reasm);
+        if (skb != NULL) {
+                ctsn = sctp_skb2event(skb)->tsn;
+                if (!TSN_lte(ctsn, sctp_tsnmap_get_ctsn(&asoc->peer.tsn_map)))
+                        return;
+        }
+
         /* If the user enabled fragment interleave socket option,
          * multiple associations can enter partial delivery.
          * Otherwise, we can only enter partial delivery if the
@@ -1054,12 +1105,16 @@ void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk,
         }
         /* If able to free enough room, accept this chunk. */
         if (chunk && (freed >= needed)) {
-                __u32 tsn;
-                tsn = ntohl(chunk->subh.data_hdr->tsn);
-                sctp_tsnmap_mark(&asoc->peer.tsn_map, tsn, chunk->transport);
-                sctp_ulpq_tail_data(ulpq, chunk, gfp);
-
-                sctp_ulpq_partial_delivery(ulpq, gfp);
+                int retval;
+                retval = sctp_ulpq_tail_data(ulpq, chunk, gfp);
+                /*
+                 * Enter partial delivery if chunk has not been
+                 * delivered; otherwise, drain the reassembly queue.
+                 */
+                if (retval <= 0)
+                        sctp_ulpq_partial_delivery(ulpq, gfp);
+                else if (retval == 1)
+                        sctp_ulpq_reasm_drain(ulpq);
         }
 
         sk_mem_reclaim(asoc->base.sk);
diff --git a/net/wireless/ap.c b/net/wireless/ap.c
index a4a14e8f55cc..324e8d851dc4 100644
--- a/net/wireless/ap.c
+++ b/net/wireless/ap.c
@@ -46,65 +46,3 @@ int cfg80211_stop_ap(struct cfg80211_registered_device *rdev,
 
         return err;
 }
-
-void cfg80211_ch_switch_notify(struct net_device *dev,
-                               struct cfg80211_chan_def *chandef)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_ch_switch_notify(dev, chandef);
-
-        wdev_lock(wdev);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
-                goto out;
-
-        wdev->channel = chandef->chan;
-        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
-out:
-        wdev_unlock(wdev);
-        return;
-}
-EXPORT_SYMBOL(cfg80211_ch_switch_notify);
-
-bool cfg80211_rx_spurious_frame(struct net_device *dev,
-                                const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-
-        trace_cfg80211_rx_spurious_frame(dev, addr);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
-
-bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
-                                        const u8 *addr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        bool ret;
-
-        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
-
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
-                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
-                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
-                trace_cfg80211_return_bool(false);
-                return false;
-        }
-        ret = nl80211_unexpected_4addr_frame(dev, addr, gfp);
-        trace_cfg80211_return_bool(ret);
-        return ret;
-}
-EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 5ffff039b017..f382cae983ba 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -367,8 +367,7 @@ struct wiphy *wiphy_new(const struct cfg80211_ops *ops, int sizeof_priv)
         rdev->wiphy.rts_threshold = (u32) -1;
         rdev->wiphy.coverage_class = 0;
 
-        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH |
-                               NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
+        rdev->wiphy.features = NL80211_FEATURE_SCAN_FLUSH;
 
         return &rdev->wiphy;
 }
@@ -815,6 +814,46 @@ void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                 rdev->num_running_monitor_ifaces += num;
 }
 
+void cfg80211_leave(struct cfg80211_registered_device *rdev,
+                   struct wireless_dev *wdev)
+{
+        struct net_device *dev = wdev->netdev;
+
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_ADHOC:
+                cfg80211_leave_ibss(rdev, dev, true);
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_STATION:
+                mutex_lock(&rdev->sched_scan_mtx);
+                __cfg80211_stop_sched_scan(rdev, false);
+                mutex_unlock(&rdev->sched_scan_mtx);
+
+                wdev_lock(wdev);
+#ifdef CONFIG_CFG80211_WEXT
+                kfree(wdev->wext.ie);
+                wdev->wext.ie = NULL;
+                wdev->wext.ie_len = 0;
+                wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
+#endif
+                __cfg80211_disconnect(rdev, dev,
+                                      WLAN_REASON_DEAUTH_LEAVING, true);
+                cfg80211_mlme_down(rdev, dev);
+                wdev_unlock(wdev);
+                break;
+        case NL80211_IFTYPE_MESH_POINT:
+                cfg80211_leave_mesh(rdev, dev);
+                break;
+        case NL80211_IFTYPE_AP:
+                cfg80211_stop_ap(rdev, dev);
+                break;
+        default:
+                break;
+        }
+
+        wdev->beacon_interval = 0;
+}
+
 static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                                          unsigned long state,
                                          void *ndev)
@@ -883,38 +922,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                         dev->priv_flags |= IFF_DONT_BRIDGE;
                 break;
         case NETDEV_GOING_DOWN:
-                switch (wdev->iftype) {
-                case NL80211_IFTYPE_ADHOC:
-                        cfg80211_leave_ibss(rdev, dev, true);
-                        break;
-                case NL80211_IFTYPE_P2P_CLIENT:
-                case NL80211_IFTYPE_STATION:
-                        mutex_lock(&rdev->sched_scan_mtx);
-                        __cfg80211_stop_sched_scan(rdev, false);
-                        mutex_unlock(&rdev->sched_scan_mtx);
-
-                        wdev_lock(wdev);
-#ifdef CONFIG_CFG80211_WEXT
-                        kfree(wdev->wext.ie);
-                        wdev->wext.ie = NULL;
-                        wdev->wext.ie_len = 0;
-                        wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
-#endif
-                        __cfg80211_disconnect(rdev, dev,
-                                              WLAN_REASON_DEAUTH_LEAVING, true);
-                        cfg80211_mlme_down(rdev, dev);
-                        wdev_unlock(wdev);
-                        break;
-                case NL80211_IFTYPE_MESH_POINT:
-                        cfg80211_leave_mesh(rdev, dev);
-                        break;
-                case NL80211_IFTYPE_AP:
-                        cfg80211_stop_ap(rdev, dev);
-                        break;
-                default:
-                        break;
-                }
-                wdev->beacon_interval = 0;
+                cfg80211_leave(rdev, wdev);
                 break;
         case NETDEV_DOWN:
                 cfg80211_update_iface_num(rdev, wdev->iftype, -1);
diff --git a/net/wireless/core.h b/net/wireless/core.h
index 3aec0e429d8a..d5d06fdea961 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -330,20 +330,15 @@ int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
                           struct ieee80211_channel *chan,
-                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *bssid,
                           const u8 *ssid, int ssid_len,
-                          const u8 *ie, int ie_len, bool use_mfp,
-                          struct cfg80211_crypto_settings *crypt,
-                          u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
-                          struct ieee80211_ht_cap *ht_capa_mask);
+                          struct cfg80211_assoc_request *req);
 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
-                        struct net_device *dev, struct ieee80211_channel *chan,
-                        const u8 *bssid, const u8 *prev_bssid,
+                        struct net_device *dev,
+                        struct ieee80211_channel *chan,
+                        const u8 *bssid,
                         const u8 *ssid, int ssid_len,
-                        const u8 *ie, int ie_len, bool use_mfp,
-                        struct cfg80211_crypto_settings *crypt,
-                        u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
-                        struct ieee80211_ht_cap *ht_capa_mask);
+                        struct cfg80211_assoc_request *req);
 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
                            struct net_device *dev, const u8 *bssid,
                            const u8 *ie, int ie_len, u16 reason,
@@ -375,6 +370,8 @@ int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
                           bool no_cck, bool dont_wait_for_ack, u64 *cookie);
 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
                                const struct ieee80211_ht_cap *ht_capa_mask);
+void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
+                                const struct ieee80211_vht_cap *vht_capa_mask);
 
 /* SME */
 int __cfg80211_connect(struct cfg80211_registered_device *rdev,
@@ -503,6 +500,9 @@ int cfg80211_validate_beacon_int(struct cfg80211_registered_device *rdev,
 void cfg80211_update_iface_num(struct cfg80211_registered_device *rdev,
                                enum nl80211_iftype iftype, int num);
 
+void cfg80211_leave(struct cfg80211_registered_device *rdev,
+                    struct wireless_dev *wdev);
+
 #define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
 
 #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
diff --git a/net/wireless/mesh.c b/net/wireless/mesh.c
index 55957a284f6c..0bb93f3061a4 100644
--- a/net/wireless/mesh.c
+++ b/net/wireless/mesh.c
@@ -85,6 +85,7 @@ const struct mesh_setup default_mesh_setup = {
         .ie = NULL,
         .ie_len = 0,
         .is_secure = false,
+        .user_mpm = false,
         .beacon_interval = MESH_DEFAULT_BEACON_INTERVAL,
         .dtim_period = MESH_DEFAULT_DTIM_PERIOD,
 };
@@ -233,20 +234,6 @@ int cfg80211_set_mesh_channel(struct cfg80211_registered_device *rdev,
         return 0;
 }
 
-void cfg80211_notify_new_peer_candidate(struct net_device *dev,
-                const u8 *macaddr, const u8* ie, u8 ie_len, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-
-        trace_cfg80211_notify_new_peer_candidate(dev, macaddr);
-        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
-                return;
-
-        nl80211_send_new_peer_candidate(wiphy_to_dev(wdev->wiphy), dev,
-                        macaddr, ie, ie_len, gfp);
-}
-EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
-
 static int __cfg80211_leave_mesh(struct cfg80211_registered_device *rdev,
                                  struct net_device *dev)
 {
diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index caddca35d686..390198bf4b36 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -187,30 +187,6 @@ void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 }
 EXPORT_SYMBOL(cfg80211_send_disassoc);
 
-void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
-                                 size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_send_unprot_deauth(dev);
-        nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
-}
-EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
-
-void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
-                                   size_t len)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_send_unprot_disassoc(dev);
-        nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
-}
-EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
-
 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
@@ -367,27 +343,38 @@ void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
                 p1[i] &= p2[i];
 }
 
+/*  Do a logical ht_capa &= ht_capa_mask.  */
+void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
+                                const struct ieee80211_vht_cap *vht_capa_mask)
+{
+        int i;
+        u8 *p1, *p2;
+        if (!vht_capa_mask) {
+                memset(vht_capa, 0, sizeof(*vht_capa));
+                return;
+        }
+
+        p1 = (u8*)(vht_capa);
+        p2 = (u8*)(vht_capa_mask);
+        for (i = 0; i < sizeof(*vht_capa); i++)
+                p1[i] &= p2[i];
+}
+
 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                           struct net_device *dev,
                           struct ieee80211_channel *chan,
-                          const u8 *bssid, const u8 *prev_bssid,
+                          const u8 *bssid,
                           const u8 *ssid, int ssid_len,
-                          const u8 *ie, int ie_len, bool use_mfp,
-                          struct cfg80211_crypto_settings *crypt,
-                          u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
-                          struct ieee80211_ht_cap *ht_capa_mask)
+                          struct cfg80211_assoc_request *req)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct cfg80211_assoc_request req;
         int err;
         bool was_connected = false;
 
         ASSERT_WDEV_LOCK(wdev);
 
-        memset(&req, 0, sizeof(req));
-
-        if (wdev->current_bss && prev_bssid &&
-            ether_addr_equal(wdev->current_bss->pub.bssid, prev_bssid)) {
+        if (wdev->current_bss && req->prev_bssid &&
+            ether_addr_equal(wdev->current_bss->pub.bssid, req->prev_bssid)) {
                 /*
                  * Trying to reassociate: Allow this to proceed and let the old
                  * association to be dropped when the new one is completed.
@@ -399,40 +386,30 @@ int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
         } else if (wdev->current_bss)
                 return -EALREADY;
 
-        req.ie = ie;
-        req.ie_len = ie_len;
-        memcpy(&req.crypto, crypt, sizeof(req.crypto));
-        req.use_mfp = use_mfp;
-        req.prev_bssid = prev_bssid;
-        req.flags = assoc_flags;
-        if (ht_capa)
-                memcpy(&req.ht_capa, ht_capa, sizeof(req.ht_capa));
-        if (ht_capa_mask)
-                memcpy(&req.ht_capa_mask, ht_capa_mask,
-                       sizeof(req.ht_capa_mask));
-        cfg80211_oper_and_ht_capa(&req.ht_capa_mask,
+        cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
                                   rdev->wiphy.ht_capa_mod_mask);
+        cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
+                                   rdev->wiphy.vht_capa_mod_mask);
 
-        req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
-                                   WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
-        if (!req.bss) {
+        req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
+                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!req->bss) {
                 if (was_connected)
                         wdev->sme_state = CFG80211_SME_CONNECTED;
                 return -ENOENT;
         }
 
-        err = cfg80211_can_use_chan(rdev, wdev, req.bss->channel,
-                                    CHAN_MODE_SHARED);
+        err = cfg80211_can_use_chan(rdev, wdev, chan, CHAN_MODE_SHARED);
         if (err)
                 goto out;
 
-        err = rdev_assoc(rdev, dev, &req);
+        err = rdev_assoc(rdev, dev, req);
 
 out:
         if (err) {
                 if (was_connected)
                         wdev->sme_state = CFG80211_SME_CONNECTED;
-                cfg80211_put_bss(&rdev->wiphy, req.bss);
+                cfg80211_put_bss(&rdev->wiphy, req->bss);
         }
 
         return err;
@@ -441,21 +418,17 @@ out:
 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
                         struct net_device *dev,
                         struct ieee80211_channel *chan,
-                        const u8 *bssid, const u8 *prev_bssid,
+                        const u8 *bssid,
                         const u8 *ssid, int ssid_len,
-                        const u8 *ie, int ie_len, bool use_mfp,
-                        struct cfg80211_crypto_settings *crypt,
-                        u32 assoc_flags, struct ieee80211_ht_cap *ht_capa,
-                        struct ieee80211_ht_cap *ht_capa_mask)
+                        struct cfg80211_assoc_request *req)
 {
         struct wireless_dev *wdev = dev->ieee80211_ptr;
         int err;
 
         mutex_lock(&rdev->devlist_mtx);
         wdev_lock(wdev);
-        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
-                                    ssid, ssid_len, ie, ie_len, use_mfp, crypt,
-                                    assoc_flags, ht_capa, ht_capa_mask);
+        err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid,
+                                    ssid, ssid_len, req);
         wdev_unlock(wdev);
         mutex_unlock(&rdev->devlist_mtx);
 
@@ -577,62 +550,6 @@ void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
         }
 }
 
-void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
-                               struct ieee80211_channel *chan,
-                               unsigned int duration, gfp_t gfp)
-{
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
-        nl80211_send_remain_on_channel(rdev, wdev, cookie, chan, duration, gfp);
-}
-EXPORT_SYMBOL(cfg80211_ready_on_channel);
-
-void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
-                                        struct ieee80211_channel *chan,
-                                        gfp_t gfp)
-{
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
-        nl80211_send_remain_on_channel_cancel(rdev, wdev, cookie, chan, gfp);
-}
-EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
-
-void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
-                      struct station_info *sinfo, gfp_t gfp)
-{
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_new_sta(dev, mac_addr, sinfo);
-        nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
-}
-EXPORT_SYMBOL(cfg80211_new_sta);
-
-void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
-{
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_del_sta(dev, mac_addr);
-        nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
-}
-EXPORT_SYMBOL(cfg80211_del_sta);
-
-void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
-                          enum nl80211_connect_failed_reason reason,
-                          gfp_t gfp)
-{
-        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        nl80211_send_conn_failed_event(rdev, dev, mac_addr, reason, gfp);
-}
-EXPORT_SYMBOL(cfg80211_conn_failed);
-
 struct cfg80211_mgmt_registration {
         struct list_head list;
 
@@ -909,85 +826,6 @@ bool cfg80211_rx_mgmt(struct wireless_dev *wdev, int freq, int sig_mbm,
 }
 EXPORT_SYMBOL(cfg80211_rx_mgmt);
 
-void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
-                             const u8 *buf, size_t len, bool ack, gfp_t gfp)
-{
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
-
-        /* Indicate TX status of the Action frame to user space */
-        nl80211_send_mgmt_tx_status(rdev, wdev, cookie, buf, len, ack, gfp);
-}
-EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
-
-void cfg80211_cqm_rssi_notify(struct net_device *dev,
-                              enum nl80211_cqm_rssi_threshold_event rssi_event,
-                              gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
-
-        /* Indicate roaming trigger event to user space */
-        nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
-}
-EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
-
-void cfg80211_cqm_pktloss_notify(struct net_device *dev,
-                                 const u8 *peer, u32 num_packets, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
-
-        /* Indicate roaming trigger event to user space */
-        nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
-}
-EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
-
-void cfg80211_cqm_txe_notify(struct net_device *dev,
-                             const u8 *peer, u32 num_packets,
-                             u32 rate, u32 intvl, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        nl80211_send_cqm_txe_notify(rdev, dev, peer, num_packets,
-                                    rate, intvl, gfp);
-}
-EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
-
-void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
-                               const u8 *replay_ctr, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_gtk_rekey_notify(dev, bssid);
-        nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
-}
-EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
-
-void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
-                                     const u8 *bssid, bool preauth, gfp_t gfp)
-{
-        struct wireless_dev *wdev = dev->ieee80211_ptr;
-        struct wiphy *wiphy = wdev->wiphy;
-        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
-
-        trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
-        nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
-}
-EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
-
 void cfg80211_dfs_channels_update_work(struct work_struct *work)
 {
         struct delayed_work *delayed_work;
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 35545ccc30fd..f924d45af1b8 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -370,6 +370,14 @@ static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
+        [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
+        [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
+        [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
+                .len = NL80211_VHT_CAPABILITY_LEN,
+        },
+        [NL80211_ATTR_MDID] = { .type = NLA_U16 },
+        [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
+                                  .len = IEEE80211_MAX_DATA_LEN },
 };
 
 /* policy for the key attributes */
@@ -539,7 +547,8 @@ static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 }
 
 static int nl80211_msg_put_channel(struct sk_buff *msg,
-                                   struct ieee80211_channel *chan)
+                                   struct ieee80211_channel *chan,
+                                   bool large)
 {
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
                         chan->center_freq))
@@ -555,27 +564,36 @@ static int nl80211_msg_put_channel(struct sk_buff *msg,
             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IBSS))
                 goto nla_put_failure;
         if (chan->flags & IEEE80211_CHAN_RADAR) {
-                u32 time = elapsed_jiffies_msecs(chan->dfs_state_entered);
                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
                         goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
-                                chan->dfs_state))
+                if (large) {
+                        u32 time;
+
+                        time = elapsed_jiffies_msecs(chan->dfs_state_entered);
+
+                        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
+                                        chan->dfs_state))
+                                goto nla_put_failure;
+                        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
+                                        time))
+                                goto nla_put_failure;
+                }
+        }
+
+        if (large) {
+                if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
+                        goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
+                        goto nla_put_failure;
+                if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
                         goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME, time))
+                if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
+                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
                         goto nla_put_failure;
         }
-        if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
-                goto nla_put_failure;
-        if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
-            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
-                goto nla_put_failure;
 
         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
                         DBM_TO_MBM(chan->max_power)))
@@ -851,7 +869,8 @@ nla_put_failure:
 }
 
 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
-                                          struct sk_buff *msg)
+                                          struct sk_buff *msg,
+                                          bool large)
 {
         struct nlattr *nl_combis;
         int i, j;
@@ -900,7 +919,8 @@ static int nl80211_put_iface_combinations(struct wiphy *wiphy,
                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
                                 c->max_interfaces))
                         goto nla_put_failure;
-                if (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
+                if (large &&
+                    nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
                                 c->radar_detect_widths))
                         goto nla_put_failure;
 
@@ -954,426 +974,571 @@ static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
         nla_nest_end(msg, nl_tcp);
         return 0;
 }
-#endif
 
-static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flags,
-                              struct cfg80211_registered_device *dev)
+static int nl80211_send_wowlan(struct sk_buff *msg,
+                               struct cfg80211_registered_device *dev,
+                               bool large)
 {
-        void *hdr;
-        struct nlattr *nl_bands, *nl_band;
-        struct nlattr *nl_freqs, *nl_freq;
-        struct nlattr *nl_rates, *nl_rate;
-        struct nlattr *nl_cmds;
-        enum ieee80211_band band;
-        struct ieee80211_channel *chan;
-        struct ieee80211_rate *rate;
-        int i;
-        const struct ieee80211_txrx_stypes *mgmt_stypes =
-                                dev->wiphy.mgmt_stypes;
+        struct nlattr *nl_wowlan;
 
-        hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
-        if (!hdr)
-                return -1;
+        if (!dev->wiphy.wowlan.flags && !dev->wiphy.wowlan.n_patterns)
+                return 0;
 
-        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
-            nla_put_string(msg, NL80211_ATTR_WIPHY_NAME, wiphy_name(&dev->wiphy)) ||
-            nla_put_u32(msg, NL80211_ATTR_GENERATION,
-                        cfg80211_rdev_list_generation) ||
-            nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
-                       dev->wiphy.retry_short) ||
-            nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
-                       dev->wiphy.retry_long) ||
-            nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
-                        dev->wiphy.frag_threshold) ||
-            nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
-                        dev->wiphy.rts_threshold) ||
-            nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
-                       dev->wiphy.coverage_class) ||
-            nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
-                       dev->wiphy.max_scan_ssids) ||
-            nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
-                       dev->wiphy.max_sched_scan_ssids) ||
-            nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
-                        dev->wiphy.max_scan_ie_len) ||
-            nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
-                        dev->wiphy.max_sched_scan_ie_len) ||
-            nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
-                       dev->wiphy.max_match_sets))
-                goto nla_put_failure;
+        nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
+        if (!nl_wowlan)
+                return -ENOBUFS;
 
-        if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
-            nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
-                goto nla_put_failure;
-        if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
-            nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
-                goto nla_put_failure;
-        if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
-            nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
-                goto nla_put_failure;
-        if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
-            nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
-                goto nla_put_failure;
-        if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
-            nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
-                goto nla_put_failure;
-        if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
-            nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
-                goto nla_put_failure;
+        if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
+            ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
+             nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
+                return -ENOBUFS;
 
-        if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
-                    sizeof(u32) * dev->wiphy.n_cipher_suites,
-                    dev->wiphy.cipher_suites))
-                goto nla_put_failure;
+        if (dev->wiphy.wowlan.n_patterns) {
+                struct nl80211_wowlan_pattern_support pat = {
+                        .max_patterns = dev->wiphy.wowlan.n_patterns,
+                        .min_pattern_len = dev->wiphy.wowlan.pattern_min_len,
+                        .max_pattern_len = dev->wiphy.wowlan.pattern_max_len,
+                        .max_pkt_offset = dev->wiphy.wowlan.max_pkt_offset,
+                };
 
-        if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
-                       dev->wiphy.max_num_pmkids))
-                goto nla_put_failure;
+                if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
+                            sizeof(pat), &pat))
+                        return -ENOBUFS;
+        }
 
-        if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
-            nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
-                goto nla_put_failure;
+        if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
+                return -ENOBUFS;
 
-        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
-                        dev->wiphy.available_antennas_tx) ||
-            nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
-                        dev->wiphy.available_antennas_rx))
-                goto nla_put_failure;
+        nla_nest_end(msg, nl_wowlan);
 
-        if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
-            nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
-                        dev->wiphy.probe_resp_offload))
-                goto nla_put_failure;
+        return 0;
+}
+#endif
 
-        if ((dev->wiphy.available_antennas_tx ||
-             dev->wiphy.available_antennas_rx) && dev->ops->get_antenna) {
-                u32 tx_ant = 0, rx_ant = 0;
-                int res;
-                res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
-                if (!res) {
-                        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_TX,
-                                        tx_ant) ||
-                            nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_RX,
-                                        rx_ant))
-                                goto nla_put_failure;
-                }
-        }
+static int nl80211_send_band_rateinfo(struct sk_buff *msg,
+                                      struct ieee80211_supported_band *sband)
+{
+        struct nlattr *nl_rates, *nl_rate;
+        struct ieee80211_rate *rate;
+        int i;
 
-        if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
-                                dev->wiphy.interface_modes))
-                goto nla_put_failure;
+        /* add HT info */
+        if (sband->ht_cap.ht_supported &&
+            (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
+                     sizeof(sband->ht_cap.mcs),
+                     &sband->ht_cap.mcs) ||
+             nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
+                         sband->ht_cap.cap) ||
+             nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
+                        sband->ht_cap.ampdu_factor) ||
+             nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
+                        sband->ht_cap.ampdu_density)))
+                return -ENOBUFS;
 
-        nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
-        if (!nl_bands)
-                goto nla_put_failure;
+        /* add VHT info */
+        if (sband->vht_cap.vht_supported &&
+            (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
+                     sizeof(sband->vht_cap.vht_mcs),
+                     &sband->vht_cap.vht_mcs) ||
+             nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
+                         sband->vht_cap.cap)))
+                return -ENOBUFS;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (!dev->wiphy.bands[band])
-                        continue;
+        /* add bitrates */
+        nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
+        if (!nl_rates)
+                return -ENOBUFS;
 
-                nl_band = nla_nest_start(msg, band);
-                if (!nl_band)
-                        goto nla_put_failure;
+        for (i = 0; i < sband->n_bitrates; i++) {
+                nl_rate = nla_nest_start(msg, i);
+                if (!nl_rate)
+                        return -ENOBUFS;
 
-                /* add HT info */
-                if (dev->wiphy.bands[band]->ht_cap.ht_supported &&
-                    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
-                             sizeof(dev->wiphy.bands[band]->ht_cap.mcs),
-                             &dev->wiphy.bands[band]->ht_cap.mcs) ||
-                     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
-                                 dev->wiphy.bands[band]->ht_cap.cap) ||
-                     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
-                                dev->wiphy.bands[band]->ht_cap.ampdu_factor) ||
-                     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
-                                dev->wiphy.bands[band]->ht_cap.ampdu_density)))
-                        goto nla_put_failure;
+                rate = &sband->bitrates[i];
+                if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
+                                rate->bitrate))
+                        return -ENOBUFS;
+                if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
+                    nla_put_flag(msg,
+                                 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
+                        return -ENOBUFS;
 
-                /* add VHT info */
-                if (dev->wiphy.bands[band]->vht_cap.vht_supported &&
-                    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
-                             sizeof(dev->wiphy.bands[band]->vht_cap.vht_mcs),
-                             &dev->wiphy.bands[band]->vht_cap.vht_mcs) ||
-                     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
-                                 dev->wiphy.bands[band]->vht_cap.cap)))
-                        goto nla_put_failure;
+                nla_nest_end(msg, nl_rate);
+        }
 
-                /* add frequencies */
-                nl_freqs = nla_nest_start(msg, NL80211_BAND_ATTR_FREQS);
-                if (!nl_freqs)
-                        goto nla_put_failure;
+        nla_nest_end(msg, nl_rates);
 
-                for (i = 0; i < dev->wiphy.bands[band]->n_channels; i++) {
-                        nl_freq = nla_nest_start(msg, i);
-                        if (!nl_freq)
-                                goto nla_put_failure;
+        return 0;
+}
+
+static int
+nl80211_send_mgmt_stypes(struct sk_buff *msg,
+                         const struct ieee80211_txrx_stypes *mgmt_stypes)
+{
+        u16 stypes;
+        struct nlattr *nl_ftypes, *nl_ifs;
+        enum nl80211_iftype ift;
+        int i;
 
-                        chan = &dev->wiphy.bands[band]->channels[i];
+        if (!mgmt_stypes)
+                return 0;
 
-                        if (nl80211_msg_put_channel(msg, chan))
-                                goto nla_put_failure;
+        nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
+        if (!nl_ifs)
+                return -ENOBUFS;
 
-                        nla_nest_end(msg, nl_freq);
+        for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
+                nl_ftypes = nla_nest_start(msg, ift);
+                if (!nl_ftypes)
+                        return -ENOBUFS;
+                i = 0;
+                stypes = mgmt_stypes[ift].tx;
+                while (stypes) {
+                        if ((stypes & 1) &&
+                            nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
+                                        (i << 4) | IEEE80211_FTYPE_MGMT))
+                                return -ENOBUFS;
+                        stypes >>= 1;
+                        i++;
                 }
+                nla_nest_end(msg, nl_ftypes);
+        }
 
-                nla_nest_end(msg, nl_freqs);
+        nla_nest_end(msg, nl_ifs);
 
-                /* add bitrates */
-                nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
-                if (!nl_rates)
-                        goto nla_put_failure;
+        nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
+        if (!nl_ifs)
+                return -ENOBUFS;
 
-                for (i = 0; i < dev->wiphy.bands[band]->n_bitrates; i++) {
-                        nl_rate = nla_nest_start(msg, i);
-                        if (!nl_rate)
-                                goto nla_put_failure;
+        for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
+                nl_ftypes = nla_nest_start(msg, ift);
+                if (!nl_ftypes)
+                        return -ENOBUFS;
+                i = 0;
+                stypes = mgmt_stypes[ift].rx;
+                while (stypes) {
+                        if ((stypes & 1) &&
+                            nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
+                                        (i << 4) | IEEE80211_FTYPE_MGMT))
+                                return -ENOBUFS;
+                        stypes >>= 1;
+                        i++;
+                }
+                nla_nest_end(msg, nl_ftypes);
+        }
+        nla_nest_end(msg, nl_ifs);
 
-                        rate = &dev->wiphy.bands[band]->bitrates[i];
-                        if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
-                                        rate->bitrate))
-                                goto nla_put_failure;
-                        if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
-                            nla_put_flag(msg,
-                                         NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
-                                goto nla_put_failure;
+        return 0;
+}
 
-                        nla_nest_end(msg, nl_rate);
-                }
+static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
+                              struct sk_buff *msg, u32 portid, u32 seq,
+                              int flags, bool split, long *split_start,
+                              long *band_start, long *chan_start)
+{
+        void *hdr;
+        struct nlattr *nl_bands, *nl_band;
+        struct nlattr *nl_freqs, *nl_freq;
+        struct nlattr *nl_cmds;
+        enum ieee80211_band band;
+        struct ieee80211_channel *chan;
+        int i;
+        const struct ieee80211_txrx_stypes *mgmt_stypes =
+                                dev->wiphy.mgmt_stypes;
+        long start = 0, start_chan = 0, start_band = 0;
+        u32 features;
 
-                nla_nest_end(msg, nl_rates);
+        hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
+        if (!hdr)
+                return -ENOBUFS;
 
-                nla_nest_end(msg, nl_band);
+        /* allow always using the variables */
+        if (!split) {
+                split_start = &start;
+                band_start = &start_band;
+                chan_start = &start_chan;
         }
-        nla_nest_end(msg, nl_bands);
 
-        nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
-        if (!nl_cmds)
-                goto nla_put_failure;
+        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
+            nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
+                           wiphy_name(&dev->wiphy)) ||
+            nla_put_u32(msg, NL80211_ATTR_GENERATION,
+                        cfg80211_rdev_list_generation))
+                goto nla_put_failure;
+
+        switch (*split_start) {
+        case 0:
+                if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
+                               dev->wiphy.retry_short) ||
+                    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
+                               dev->wiphy.retry_long) ||
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
+                                dev->wiphy.frag_threshold) ||
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
+                                dev->wiphy.rts_threshold) ||
+                    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
+                               dev->wiphy.coverage_class) ||
+                    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
+                               dev->wiphy.max_scan_ssids) ||
+                    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
+                               dev->wiphy.max_sched_scan_ssids) ||
+                    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
+                                dev->wiphy.max_scan_ie_len) ||
+                    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
+                                dev->wiphy.max_sched_scan_ie_len) ||
+                    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
+                               dev->wiphy.max_match_sets))
+                        goto nla_put_failure;
 
-        i = 0;
-#define CMD(op, n)                                              \
-         do {                                                   \
-                if (dev->ops->op) {                             \
-                        i++;                                    \
-                        if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
-                                goto nla_put_failure;           \
-                }                                               \
-        } while (0)
-
-        CMD(add_virtual_intf, NEW_INTERFACE);
-        CMD(change_virtual_intf, SET_INTERFACE);
-        CMD(add_key, NEW_KEY);
-        CMD(start_ap, START_AP);
-        CMD(add_station, NEW_STATION);
-        CMD(add_mpath, NEW_MPATH);
-        CMD(update_mesh_config, SET_MESH_CONFIG);
-        CMD(change_bss, SET_BSS);
-        CMD(auth, AUTHENTICATE);
-        CMD(assoc, ASSOCIATE);
-        CMD(deauth, DEAUTHENTICATE);
-        CMD(disassoc, DISASSOCIATE);
-        CMD(join_ibss, JOIN_IBSS);
-        CMD(join_mesh, JOIN_MESH);
-        CMD(set_pmksa, SET_PMKSA);
-        CMD(del_pmksa, DEL_PMKSA);
-        CMD(flush_pmksa, FLUSH_PMKSA);
-        if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
-                CMD(remain_on_channel, REMAIN_ON_CHANNEL);
-        CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
-        CMD(mgmt_tx, FRAME);
-        CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
-        if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
-                i++;
-                if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
+                if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
+                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
                         goto nla_put_failure;
-        }
-        if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
-            dev->ops->join_mesh) {
-                i++;
-                if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
+                if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
+                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
                         goto nla_put_failure;
-        }
-        CMD(set_wds_peer, SET_WDS_PEER);
-        if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
-                CMD(tdls_mgmt, TDLS_MGMT);
-                CMD(tdls_oper, TDLS_OPER);
-        }
-        if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
-                CMD(sched_scan_start, START_SCHED_SCAN);
-        CMD(probe_client, PROBE_CLIENT);
-        CMD(set_noack_map, SET_NOACK_MAP);
-        if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
-                i++;
-                if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
+                if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
+                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
+                        goto nla_put_failure;
+                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
+                    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
+                        goto nla_put_failure;
+                if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
+                    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
+                        goto nla_put_failure;
+                if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
+                    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
                         goto nla_put_failure;
-        }
-        CMD(start_p2p_device, START_P2P_DEVICE);
-        CMD(set_mcast_rate, SET_MCAST_RATE);
 
-#ifdef CONFIG_NL80211_TESTMODE
-        CMD(testmode_cmd, TESTMODE);
-#endif
+                (*split_start)++;
+                if (split)
+                        break;
+        case 1:
+                if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
+                            sizeof(u32) * dev->wiphy.n_cipher_suites,
+                            dev->wiphy.cipher_suites))
+                        goto nla_put_failure;
 
-#undef CMD
+                if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
+                               dev->wiphy.max_num_pmkids))
+                        goto nla_put_failure;
 
-        if (dev->ops->connect || dev->ops->auth) {
-                i++;
-                if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
+                if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
+                    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
                         goto nla_put_failure;
-        }
 
-        if (dev->ops->disconnect || dev->ops->deauth) {
-                i++;
-                if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
+                if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
+                                dev->wiphy.available_antennas_tx) ||
+                    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
+                                dev->wiphy.available_antennas_rx))
+                        goto nla_put_failure;
+
+                if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
+                    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
+                                dev->wiphy.probe_resp_offload))
                         goto nla_put_failure;
-        }
 
-        nla_nest_end(msg, nl_cmds);
+                if ((dev->wiphy.available_antennas_tx ||
+                     dev->wiphy.available_antennas_rx) &&
+                    dev->ops->get_antenna) {
+                        u32 tx_ant = 0, rx_ant = 0;
+                        int res;
+                        res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
+                        if (!res) {
+                                if (nla_put_u32(msg,
+                                                NL80211_ATTR_WIPHY_ANTENNA_TX,
+                                                tx_ant) ||
+                                    nla_put_u32(msg,
+                                                NL80211_ATTR_WIPHY_ANTENNA_RX,
+                                                rx_ant))
+                                        goto nla_put_failure;
+                        }
+                }
 
-        if (dev->ops->remain_on_channel &&
-            (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
-            nla_put_u32(msg, NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
-                        dev->wiphy.max_remain_on_channel_duration))
-                goto nla_put_failure;
+                (*split_start)++;
+                if (split)
+                        break;
+        case 2:
+                if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
+                                        dev->wiphy.interface_modes))
+                                goto nla_put_failure;
+                (*split_start)++;
+                if (split)
+                        break;
+        case 3:
+                nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
+                if (!nl_bands)
+                        goto nla_put_failure;
 
-        if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
-            nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
-                goto nla_put_failure;
+                for (band = *band_start; band < IEEE80211_NUM_BANDS; band++) {
+                        struct ieee80211_supported_band *sband;
 
-        if (mgmt_stypes) {
-                u16 stypes;
-                struct nlattr *nl_ftypes, *nl_ifs;
-                enum nl80211_iftype ift;
+                        sband = dev->wiphy.bands[band];
 
-                nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
-                if (!nl_ifs)
-                        goto nla_put_failure;
+                        if (!sband)
+                                continue;
 
-                for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
-                        nl_ftypes = nla_nest_start(msg, ift);
-                        if (!nl_ftypes)
+                        nl_band = nla_nest_start(msg, band);
+                        if (!nl_band)
                                 goto nla_put_failure;
-                        i = 0;
-                        stypes = mgmt_stypes[ift].tx;
-                        while (stypes) {
-                                if ((stypes & 1) &&
-                                    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
-                                                (i << 4) | IEEE80211_FTYPE_MGMT))
+
+                        switch (*chan_start) {
+                        case 0:
+                                if (nl80211_send_band_rateinfo(msg, sband))
                                         goto nla_put_failure;
-                                stypes >>= 1;
-                                i++;
+                                (*chan_start)++;
+                                if (split)
+                                        break;
+                        default:
+                                /* add frequencies */
+                                nl_freqs = nla_nest_start(
+                                        msg, NL80211_BAND_ATTR_FREQS);
+                                if (!nl_freqs)
+                                        goto nla_put_failure;
+
+                                for (i = *chan_start - 1;
+                                     i < sband->n_channels;
+                                     i++) {
+                                        nl_freq = nla_nest_start(msg, i);
+                                        if (!nl_freq)
+                                                goto nla_put_failure;
+
+                                        chan = &sband->channels[i];
+
+                                        if (nl80211_msg_put_channel(msg, chan,
+                                                                    split))
+                                                goto nla_put_failure;
+
+                                        nla_nest_end(msg, nl_freq);
+                                        if (split)
+                                                break;
+                                }
+                                if (i < sband->n_channels)
+                                        *chan_start = i + 2;
+                                else
+                                        *chan_start = 0;
+                                nla_nest_end(msg, nl_freqs);
+                        }
+
+                        nla_nest_end(msg, nl_band);
+
+                        if (split) {
+                                /* start again here */
+                                if (*chan_start)
+                                        band--;
+                                break;
                         }
-                        nla_nest_end(msg, nl_ftypes);
                 }
+                nla_nest_end(msg, nl_bands);
 
-                nla_nest_end(msg, nl_ifs);
+                if (band < IEEE80211_NUM_BANDS)
+                        *band_start = band + 1;
+                else
+                        *band_start = 0;
 
-                nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
-                if (!nl_ifs)
+                /* if bands & channels are done, continue outside */
+                if (*band_start == 0 && *chan_start == 0)
+                        (*split_start)++;
+                if (split)
+                        break;
+        case 4:
+                nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
+                if (!nl_cmds)
                         goto nla_put_failure;
 
-                for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
-                        nl_ftypes = nla_nest_start(msg, ift);
-                        if (!nl_ftypes)
+                i = 0;
+#define CMD(op, n)                                                      \
+                 do {                                                   \
+                        if (dev->ops->op) {                             \
+                                i++;                                    \
+                                if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
+                                        goto nla_put_failure;           \
+                        }                                               \
+                } while (0)
+
+                CMD(add_virtual_intf, NEW_INTERFACE);
+                CMD(change_virtual_intf, SET_INTERFACE);
+                CMD(add_key, NEW_KEY);
+                CMD(start_ap, START_AP);
+                CMD(add_station, NEW_STATION);
+                CMD(add_mpath, NEW_MPATH);
+                CMD(update_mesh_config, SET_MESH_CONFIG);
+                CMD(change_bss, SET_BSS);
+                CMD(auth, AUTHENTICATE);
+                CMD(assoc, ASSOCIATE);
+                CMD(deauth, DEAUTHENTICATE);
+                CMD(disassoc, DISASSOCIATE);
+                CMD(join_ibss, JOIN_IBSS);
+                CMD(join_mesh, JOIN_MESH);
+                CMD(set_pmksa, SET_PMKSA);
+                CMD(del_pmksa, DEL_PMKSA);
+                CMD(flush_pmksa, FLUSH_PMKSA);
+                if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
+                        CMD(remain_on_channel, REMAIN_ON_CHANNEL);
+                CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
+                CMD(mgmt_tx, FRAME);
+                CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
+                if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
+                        i++;
+                        if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
                                 goto nla_put_failure;
-                        i = 0;
-                        stypes = mgmt_stypes[ift].rx;
-                        while (stypes) {
-                                if ((stypes & 1) &&
-                                    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
-                                                (i << 4) | IEEE80211_FTYPE_MGMT))
-                                        goto nla_put_failure;
-                                stypes >>= 1;
-                                i++;
-                        }
-                        nla_nest_end(msg, nl_ftypes);
                 }
-                nla_nest_end(msg, nl_ifs);
-        }
+                if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
+                    dev->ops->join_mesh) {
+                        i++;
+                        if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
+                                goto nla_put_failure;
+                }
+                CMD(set_wds_peer, SET_WDS_PEER);
+                if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
+                        CMD(tdls_mgmt, TDLS_MGMT);
+                        CMD(tdls_oper, TDLS_OPER);
+                }
+                if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
+                        CMD(sched_scan_start, START_SCHED_SCAN);
+                CMD(probe_client, PROBE_CLIENT);
+                CMD(set_noack_map, SET_NOACK_MAP);
+                if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
+                        i++;
+                        if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
+                                goto nla_put_failure;
+                }
+                CMD(start_p2p_device, START_P2P_DEVICE);
+                CMD(set_mcast_rate, SET_MCAST_RATE);
 
-#ifdef CONFIG_PM
-        if (dev->wiphy.wowlan.flags || dev->wiphy.wowlan.n_patterns) {
-                struct nlattr *nl_wowlan;
+#ifdef CONFIG_NL80211_TESTMODE
+                CMD(testmode_cmd, TESTMODE);
+#endif
 
-                nl_wowlan = nla_nest_start(msg,
-                                NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
-                if (!nl_wowlan)
-                        goto nla_put_failure;
+#undef CMD
 
-                if (((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_ANY) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_DISCONNECT) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_MAGIC_PKT) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
-                    ((dev->wiphy.wowlan.flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
-                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
-                    goto nla_put_failure;
-                if (dev->wiphy.wowlan.n_patterns) {
-                        struct nl80211_wowlan_pattern_support pat = {
-                                .max_patterns = dev->wiphy.wowlan.n_patterns,
-                                .min_pattern_len =
-                                        dev->wiphy.wowlan.pattern_min_len,
-                                .max_pattern_len =
-                                        dev->wiphy.wowlan.pattern_max_len,
-                                .max_pkt_offset =
-                                        dev->wiphy.wowlan.max_pkt_offset,
-                        };
-                        if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
-                                    sizeof(pat), &pat))
+                if (dev->ops->connect || dev->ops->auth) {
+                        i++;
+                        if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
                                 goto nla_put_failure;
                 }
 
-                if (nl80211_send_wowlan_tcp_caps(dev, msg))
+                if (dev->ops->disconnect || dev->ops->deauth) {
+                        i++;
+                        if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
+                                goto nla_put_failure;
+                }
+
+                nla_nest_end(msg, nl_cmds);
+                (*split_start)++;
+                if (split)
+                        break;
+        case 5:
+                if (dev->ops->remain_on_channel &&
+                    (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
+                    nla_put_u32(msg,
+                                NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
+                                dev->wiphy.max_remain_on_channel_duration))
+                        goto nla_put_failure;
+
+                if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
+                    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
                         goto nla_put_failure;
 
-                nla_nest_end(msg, nl_wowlan);
-        }
+                if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
+                        goto nla_put_failure;
+                (*split_start)++;
+                if (split)
+                        break;
+        case 6:
+#ifdef CONFIG_PM
+                if (nl80211_send_wowlan(msg, dev, split))
+                        goto nla_put_failure;
+                (*split_start)++;
+                if (split)
+                        break;
+#else
+                (*split_start)++;
 #endif
+        case 7:
+                if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
+                                        dev->wiphy.software_iftypes))
+                        goto nla_put_failure;
 
-        if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
-                                dev->wiphy.software_iftypes))
-                goto nla_put_failure;
+                if (nl80211_put_iface_combinations(&dev->wiphy, msg, split))
+                        goto nla_put_failure;
 
-        if (nl80211_put_iface_combinations(&dev->wiphy, msg))
-                goto nla_put_failure;
+                (*split_start)++;
+                if (split)
+                        break;
+        case 8:
+                if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
+                    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
+                                dev->wiphy.ap_sme_capa))
+                        goto nla_put_failure;
 
-        if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
-            nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
-                        dev->wiphy.ap_sme_capa))
-                goto nla_put_failure;
+                features = dev->wiphy.features;
+                /*
+                 * We can only add the per-channel limit information if the
+                 * dump is split, otherwise it makes it too big. Therefore
+                 * only advertise it in that case.
+                 */
+                if (split)
+                        features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
+                if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
+                        goto nla_put_failure;
 
-        if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS,
-                        dev->wiphy.features))
-                goto nla_put_failure;
+                if (dev->wiphy.ht_capa_mod_mask &&
+                    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
+                            sizeof(*dev->wiphy.ht_capa_mod_mask),
+                            dev->wiphy.ht_capa_mod_mask))
+                        goto nla_put_failure;
 
-        if (dev->wiphy.ht_capa_mod_mask &&
-            nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
-                    sizeof(*dev->wiphy.ht_capa_mod_mask),
-                    dev->wiphy.ht_capa_mod_mask))
-                goto nla_put_failure;
+                if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
+                    dev->wiphy.max_acl_mac_addrs &&
+                    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
+                                dev->wiphy.max_acl_mac_addrs))
+                        goto nla_put_failure;
 
-        if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
-            dev->wiphy.max_acl_mac_addrs &&
-            nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
-                        dev->wiphy.max_acl_mac_addrs))
-                goto nla_put_failure;
+                /*
+                 * Any information below this point is only available to
+                 * applications that can deal with it being split. This
+                 * helps ensure that newly added capabilities don't break
+                 * older tools by overrunning their buffers.
+                 *
+                 * We still increment split_start so that in the split
+                 * case we'll continue with more data in the next round,
+                 * but break unconditionally so unsplit data stops here.
+                 */
+                (*split_start)++;
+                break;
+        case 9:
+                if (dev->wiphy.extended_capabilities &&
+                    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
+                             dev->wiphy.extended_capabilities_len,
+                             dev->wiphy.extended_capabilities) ||
+                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
+                             dev->wiphy.extended_capabilities_len,
+                             dev->wiphy.extended_capabilities_mask)))
+                        goto nla_put_failure;
 
-        if (dev->wiphy.extended_capabilities &&
-            (nla_put(msg, NL80211_ATTR_EXT_CAPA,
-                     dev->wiphy.extended_capabilities_len,
-                     dev->wiphy.extended_capabilities) ||
-             nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
-                     dev->wiphy.extended_capabilities_len,
-                     dev->wiphy.extended_capabilities_mask)))
-                goto nla_put_failure;
+                if (dev->wiphy.vht_capa_mod_mask &&
+                    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
+                            sizeof(*dev->wiphy.vht_capa_mod_mask),
+                            dev->wiphy.vht_capa_mod_mask))
+                        goto nla_put_failure;
 
+                /* done */
+                *split_start = 0;
+                break;
+        }
         return genlmsg_end(msg, hdr);
 
  nla_put_failure:
@@ -1383,22 +1548,83 @@ static int nl80211_send_wiphy(struct sk_buff *msg, u32 portid, u32 seq, int flag
 
 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 {
-        int idx = 0;
+        int idx = 0, ret;
         int start = cb->args[0];
         struct cfg80211_registered_device *dev;
+        s64 filter_wiphy = -1;
+        bool split = false;
+        struct nlattr **tb = nl80211_fam.attrbuf;
+        int res;
 
         mutex_lock(&cfg80211_mutex);
+        res = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
+                          tb, nl80211_fam.maxattr, nl80211_policy);
+        if (res == 0) {
+                split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
+                if (tb[NL80211_ATTR_WIPHY])
+                        filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
+                if (tb[NL80211_ATTR_WDEV])
+                        filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
+                if (tb[NL80211_ATTR_IFINDEX]) {
+                        struct net_device *netdev;
+                        int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
+
+                        netdev = dev_get_by_index(sock_net(skb->sk), ifidx);
+                        if (!netdev) {
+                                mutex_unlock(&cfg80211_mutex);
+                                return -ENODEV;
+                        }
+                        if (netdev->ieee80211_ptr) {
+                                dev = wiphy_to_dev(
+                                        netdev->ieee80211_ptr->wiphy);
+                                filter_wiphy = dev->wiphy_idx;
+                        }
+                        dev_put(netdev);
+                }
+        }
+
         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
                         continue;
                 if (++idx <= start)
                         continue;
-                if (nl80211_send_wiphy(skb, NETLINK_CB(cb->skb).portid,
-                                       cb->nlh->nlmsg_seq, NLM_F_MULTI,
-                                       dev) < 0) {
-                        idx--;
-                        break;
-                }
+                if (filter_wiphy != -1 && dev->wiphy_idx != filter_wiphy)
+                        continue;
+                /* attempt to fit multiple wiphy data chunks into the skb */
+                do {
+                        ret = nl80211_send_wiphy(dev, skb,
+                                                 NETLINK_CB(cb->skb).portid,
+                                                 cb->nlh->nlmsg_seq,
+                                                 NLM_F_MULTI,
+                                                 split, &cb->args[1],
+                                                 &cb->args[2],
+                                                 &cb->args[3]);
+                        if (ret < 0) {
+                                /*
+                                 * If sending the wiphy data didn't fit (ENOBUFS
+                                 * or EMSGSIZE returned), this SKB is still
+                                 * empty (so it's not too big because another
+                                 * wiphy dataset is already in the skb) and
+                                 * we've not tried to adjust the dump allocation
+                                 * yet ... then adjust the alloc size to be
+                                 * bigger, and return 1 but with the empty skb.
+                                 * This results in an empty message being RX'ed
+                                 * in userspace, but that is ignored.
+                                 *
+                                 * We can then retry with the larger buffer.
+                                 */
+                                if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
+                                    !skb->len &&
+                                    cb->min_dump_alloc < 4096) {
+                                        cb->min_dump_alloc = 4096;
+                                        mutex_unlock(&cfg80211_mutex);
+                                        return 1;
+                                }
+                                idx--;
+                                break;
+                        }
+                } while (cb->args[1] > 0);
+                break;
         }
         mutex_unlock(&cfg80211_mutex);
 
@@ -1412,11 +1638,12 @@ static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
         struct sk_buff *msg;
         struct cfg80211_registered_device *dev = info->user_ptr[0];
 
-        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        msg = nlmsg_new(4096, GFP_KERNEL);
         if (!msg)
                 return -ENOMEM;
 
-        if (nl80211_send_wiphy(msg, info->snd_portid, info->snd_seq, 0, dev) < 0) {
+        if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
+                               false, NULL, NULL, NULL) < 0) {
                 nlmsg_free(msg);
                 return -ENOBUFS;
         }
@@ -3023,6 +3250,7 @@ static int parse_station_flags(struct genl_info *info,
                 sta_flags = nla_data(nla);
                 params->sta_flags_mask = sta_flags->mask;
                 params->sta_flags_set = sta_flags->set;
+                params->sta_flags_set &= params->sta_flags_mask;
                 if ((params->sta_flags_mask |
                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
                         return -EINVAL;
@@ -3376,6 +3604,136 @@ static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
         return genlmsg_reply(msg, info);
 }
 
+int cfg80211_check_station_change(struct wiphy *wiphy,
+                                  struct station_parameters *params,
+                                  enum cfg80211_station_type statype)
+{
+        if (params->listen_interval != -1)
+                return -EINVAL;
+        if (params->aid)
+                return -EINVAL;
+
+        /* When you run into this, adjust the code below for the new flag */
+        BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
+        switch (statype) {
+        case CFG80211_STA_MESH_PEER_KERNEL:
+        case CFG80211_STA_MESH_PEER_USER:
+                /*
+                 * No ignoring the TDLS flag here -- the userspace mesh
+                 * code doesn't have the bug of including TDLS in the
+                 * mask everywhere.
+                 */
+                if (params->sta_flags_mask &
+                                ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_MFP) |
+                                  BIT(NL80211_STA_FLAG_AUTHORIZED)))
+                        return -EINVAL;
+                break;
+        case CFG80211_STA_TDLS_PEER_SETUP:
+        case CFG80211_STA_TDLS_PEER_ACTIVE:
+                if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
+                        return -EINVAL;
+                /* ignore since it can't change */
+                params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
+                break;
+        default:
+                /* disallow mesh-specific things */
+                if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
+                        return -EINVAL;
+                if (params->local_pm)
+                        return -EINVAL;
+                if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
+                        return -EINVAL;
+        }
+
+        if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
+            statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
+                /* TDLS can't be set, ... */
+                if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
+                        return -EINVAL;
+                /*
+                 * ... but don't bother the driver with it. This works around
+                 * a hostapd/wpa_supplicant issue -- it always includes the
+                 * TLDS_PEER flag in the mask even for AP mode.
+                 */
+                params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
+        }
+
+        if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
+                /* reject other things that can't change */
+                if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
+                        return -EINVAL;
+                if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
+                        return -EINVAL;
+                if (params->supported_rates)
+                        return -EINVAL;
+                if (params->ext_capab || params->ht_capa || params->vht_capa)
+                        return -EINVAL;
+        }
+
+        if (statype != CFG80211_STA_AP_CLIENT) {
+                if (params->vlan)
+                        return -EINVAL;
+        }
+
+        switch (statype) {
+        case CFG80211_STA_AP_MLME_CLIENT:
+                /* Use this only for authorizing/unauthorizing a station */
+                if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
+                        return -EOPNOTSUPP;
+                break;
+        case CFG80211_STA_AP_CLIENT:
+                /* accept only the listed bits */
+                if (params->sta_flags_mask &
+                                ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                  BIT(NL80211_STA_FLAG_ASSOCIATED) |
+                                  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
+                                  BIT(NL80211_STA_FLAG_WME) |
+                                  BIT(NL80211_STA_FLAG_MFP)))
+                        return -EINVAL;
+
+                /* but authenticated/associated only if driver handles it */
+                if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
+                    params->sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
+                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
+                        return -EINVAL;
+                break;
+        case CFG80211_STA_IBSS:
+        case CFG80211_STA_AP_STA:
+                /* reject any changes other than AUTHORIZED */
+                if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
+                        return -EINVAL;
+                break;
+        case CFG80211_STA_TDLS_PEER_SETUP:
+                /* reject any changes other than AUTHORIZED or WME */
+                if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
+                                               BIT(NL80211_STA_FLAG_WME)))
+                        return -EINVAL;
+                /* force (at least) rates when authorizing */
+                if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
+                    !params->supported_rates)
+                        return -EINVAL;
+                break;
+        case CFG80211_STA_TDLS_PEER_ACTIVE:
+                /* reject any changes */
+                return -EINVAL;
+        case CFG80211_STA_MESH_PEER_KERNEL:
+                if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
+                        return -EINVAL;
+                break;
+        case CFG80211_STA_MESH_PEER_USER:
+                if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
+                        return -EINVAL;
+                break;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(cfg80211_check_station_change);
+
 /*
  * Get vlan interface making sure it is running and on the right wiphy.
  */
@@ -3398,6 +3756,13 @@ static struct net_device *get_vlan(struct genl_info *info,
                 goto error;
         }
 
+        if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
+            v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
+            v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
+                ret = -EINVAL;
+                goto error;
+        }
+
         if (!netif_running(v)) {
                 ret = -ENETDOWN;
                 goto error;
@@ -3415,21 +3780,13 @@ nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 };
 
-static int nl80211_set_station_tdls(struct genl_info *info,
-                                    struct station_parameters *params)
+static int nl80211_parse_sta_wme(struct genl_info *info,
+                                 struct station_parameters *params)
 {
         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
         struct nlattr *nla;
         int err;
 
-        /* Dummy STA entry gets updated once the peer capabilities are known */
-        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
-                params->ht_capa =
-                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
-        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
-                params->vht_capa =
-                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
-
         /* parse WME attributes if present */
         if (!info->attrs[NL80211_ATTR_STA_WME])
                 return 0;
@@ -3457,18 +3814,34 @@ static int nl80211_set_station_tdls(struct genl_info *info,
         return 0;
 }
 
+static int nl80211_set_station_tdls(struct genl_info *info,
+                                    struct station_parameters *params)
+{
+        /* Dummy STA entry gets updated once the peer capabilities are known */
+        if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
+                params->ht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
+                params->vht_capa =
+                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
+
+        return nl80211_parse_sta_wme(info, params);
+}
+
 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
-        int err;
         struct net_device *dev = info->user_ptr[1];
         struct station_parameters params;
-        u8 *mac_addr = NULL;
+        u8 *mac_addr;
+        int err;
 
         memset(&params, 0, sizeof(params));
 
         params.listen_interval = -1;
-        params.plink_state = -1;
+
+        if (!rdev->ops->change_station)
+                return -EOPNOTSUPP;
 
         if (info->attrs[NL80211_ATTR_STA_AID])
                 return -EINVAL;
@@ -3501,19 +3874,23 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
                 return -EINVAL;
 
-        if (!rdev->ops->change_station)
-                return -EOPNOTSUPP;
-
         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                 return -EINVAL;
 
-        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
+        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
                 params.plink_action =
-                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+                        nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+                if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
+                        return -EINVAL;
+        }
 
-        if (info->attrs[NL80211_ATTR_STA_PLINK_STATE])
+        if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
                 params.plink_state =
-                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
+                        nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
+                if (params.plink_state >= NUM_NL80211_PLINK_STATES)
+                        return -EINVAL;
+                params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
+        }
 
         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
                 enum nl80211_mesh_power_mode pm = nla_get_u32(
@@ -3526,127 +3903,33 @@ static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
                 params.local_pm = pm;
         }
 
+        /* Include parameters for TDLS peer (will check later) */
+        err = nl80211_set_station_tdls(info, &params);
+        if (err)
+                return err;
+
+        params.vlan = get_vlan(info, rdev);
+        if (IS_ERR(params.vlan))
+                return PTR_ERR(params.vlan);
+
         switch (dev->ieee80211_ptr->iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_P2P_GO:
-                /* disallow mesh-specific things */
-                if (params.plink_action)
-                        return -EINVAL;
-                if (params.local_pm)
-                        return -EINVAL;
-
-                /* TDLS can't be set, ... */
-                if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
-                        return -EINVAL;
-                /*
-                 * ... but don't bother the driver with it. This works around
-                 * a hostapd/wpa_supplicant issue -- it always includes the
-                 * TLDS_PEER flag in the mask even for AP mode.
-                 */
-                params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
-
-                /* accept only the listed bits */
-                if (params.sta_flags_mask &
-                                ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
-                                  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
-                                  BIT(NL80211_STA_FLAG_ASSOCIATED) |
-                                  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
-                                  BIT(NL80211_STA_FLAG_WME) |
-                                  BIT(NL80211_STA_FLAG_MFP)))
-                        return -EINVAL;
-
-                /* but authenticated/associated only if driver handles it */
-                if (!(rdev->wiphy.features &
-                                NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
-                    params.sta_flags_mask &
-                                (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
-                                 BIT(NL80211_STA_FLAG_ASSOCIATED)))
-                        return -EINVAL;
-
-                /* reject other things that can't change */
-                if (params.supported_rates)
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
-                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
-                        return -EINVAL;
-
-                /* must be last in here for error handling */
-                params.vlan = get_vlan(info, rdev);
-                if (IS_ERR(params.vlan))
-                        return PTR_ERR(params.vlan);
-                break;
         case NL80211_IFTYPE_P2P_CLIENT:
         case NL80211_IFTYPE_STATION:
-                /*
-                 * Don't allow userspace to change the TDLS_PEER flag,
-                 * but silently ignore attempts to change it since we
-                 * don't have state here to verify that it doesn't try
-                 * to change the flag.
-                 */
-                params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
-                /* Include parameters for TDLS peer (driver will check) */
-                err = nl80211_set_station_tdls(info, &params);
-                if (err)
-                        return err;
-                /* disallow things sta doesn't support */
-                if (params.plink_action)
-                        return -EINVAL;
-                if (params.local_pm)
-                        return -EINVAL;
-                /* reject any changes other than AUTHORIZED or WME (for TDLS) */
-                if (params.sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
-                                              BIT(NL80211_STA_FLAG_WME)))
-                        return -EINVAL;
-                break;
         case NL80211_IFTYPE_ADHOC:
-                /* disallow things sta doesn't support */
-                if (params.plink_action)
-                        return -EINVAL;
-                if (params.local_pm)
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
-                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
-                        return -EINVAL;
-                /* reject any changes other than AUTHORIZED */
-                if (params.sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
-                        return -EINVAL;
-                break;
         case NL80211_IFTYPE_MESH_POINT:
-                /* disallow things mesh doesn't support */
-                if (params.vlan)
-                        return -EINVAL;
-                if (params.supported_rates)
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_STA_CAPABILITY])
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY])
-                        return -EINVAL;
-                if (info->attrs[NL80211_ATTR_HT_CAPABILITY] ||
-                    info->attrs[NL80211_ATTR_VHT_CAPABILITY])
-                        return -EINVAL;
-                /*
-                 * No special handling for TDLS here -- the userspace
-                 * mesh code doesn't have this bug.
-                 */
-                if (params.sta_flags_mask &
-                                ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
-                                  BIT(NL80211_STA_FLAG_MFP) |
-                                  BIT(NL80211_STA_FLAG_AUTHORIZED)))
-                        return -EINVAL;
                 break;
         default:
-                return -EOPNOTSUPP;
+                err = -EOPNOTSUPP;
+                goto out_put_vlan;
         }
 
-        /* be aware of params.vlan when changing code here */
-
+        /* driver will call cfg80211_check_station_change() */
         err = rdev_change_station(rdev, dev, mac_addr, &params);
 
+ out_put_vlan:
         if (params.vlan)
                 dev_put(params.vlan);
 
@@ -3663,6 +3946,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 
         memset(&params, 0, sizeof(params));
 
+        if (!rdev->ops->add_station)
+                return -EOPNOTSUPP;
+
         if (!info->attrs[NL80211_ATTR_MAC])
                 return -EINVAL;
 
@@ -3708,50 +3994,32 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 params.vht_capa =
                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
 
-        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
+        if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
                 params.plink_action =
-                    nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+                        nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
+                if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
+                        return -EINVAL;
+        }
 
-        if (!rdev->ops->add_station)
-                return -EOPNOTSUPP;
+        err = nl80211_parse_sta_wme(info, &params);
+        if (err)
+                return err;
 
         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
                 return -EINVAL;
 
+        /* When you run into this, adjust the code below for the new flag */
+        BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
+
         switch (dev->ieee80211_ptr->iftype) {
         case NL80211_IFTYPE_AP:
         case NL80211_IFTYPE_AP_VLAN:
         case NL80211_IFTYPE_P2P_GO:
-                /* parse WME attributes if sta is WME capable */
-                if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
-                    (params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)) &&
-                    info->attrs[NL80211_ATTR_STA_WME]) {
-                        struct nlattr *tb[NL80211_STA_WME_MAX + 1];
-                        struct nlattr *nla;
-
-                        nla = info->attrs[NL80211_ATTR_STA_WME];
-                        err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
-                                               nl80211_sta_wme_policy);
-                        if (err)
-                                return err;
-
-                        if (tb[NL80211_STA_WME_UAPSD_QUEUES])
-                                params.uapsd_queues =
-                                     nla_get_u8(tb[NL80211_STA_WME_UAPSD_QUEUES]);
-                        if (params.uapsd_queues &
-                                        ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
-                                return -EINVAL;
+                /* ignore WME attributes if iface/sta is not capable */
+                if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
+                    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
+                        params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
 
-                        if (tb[NL80211_STA_WME_MAX_SP])
-                                params.max_sp =
-                                     nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
-
-                        if (params.max_sp &
-                                        ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
-                                return -EINVAL;
-
-                        params.sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
-                }
                 /* TDLS peers cannot be added */
                 if (params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
                         return -EINVAL;
@@ -3772,6 +4040,9 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                         return PTR_ERR(params.vlan);
                 break;
         case NL80211_IFTYPE_MESH_POINT:
+                /* ignore uAPSD data */
+                params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
+
                 /* associated is disallowed */
                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
                         return -EINVAL;
@@ -3780,8 +4051,14 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                         return -EINVAL;
                 break;
         case NL80211_IFTYPE_STATION:
-                /* associated is disallowed */
-                if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
+        case NL80211_IFTYPE_P2P_CLIENT:
+                /* ignore uAPSD data */
+                params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
+
+                /* these are disallowed */
+                if (params.sta_flags_mask &
+                                (BIT(NL80211_STA_FLAG_ASSOCIATED) |
+                                 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
                         return -EINVAL;
                 /* Only TDLS peers can be added */
                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
@@ -3792,6 +4069,11 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
                 /* ... with external setup is supported */
                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
                         return -EOPNOTSUPP;
+                /*
+                 * Older wpa_supplicant versions always mark the TDLS peer
+                 * as authorized, but it shouldn't yet be.
+                 */
+                params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
                 break;
         default:
                 return -EOPNOTSUPP;
@@ -4336,6 +4618,7 @@ static const struct nla_policy
         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
+        [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
                                     .len = IEEE80211_MAX_DATA_LEN },
         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
@@ -4474,6 +4757,7 @@ do {									    \
 static int nl80211_parse_mesh_setup(struct genl_info *info,
                                      struct mesh_setup *setup)
 {
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
 
         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
@@ -4510,8 +4794,14 @@ static int nl80211_parse_mesh_setup(struct genl_info *info,
                 setup->ie = nla_data(ieattr);
                 setup->ie_len = nla_len(ieattr);
         }
+        if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
+            !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
+                return -EINVAL;
+        setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
+        if (setup->is_secure)
+                setup->user_mpm = true;
 
         return 0;
 }
@@ -5706,14 +5996,10 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
 {
         struct cfg80211_registered_device *rdev = info->user_ptr[0];
         struct net_device *dev = info->user_ptr[1];
-        struct cfg80211_crypto_settings crypto;
         struct ieee80211_channel *chan;
-        const u8 *bssid, *ssid, *ie = NULL, *prev_bssid = NULL;
-        int err, ssid_len, ie_len = 0;
-        bool use_mfp = false;
-        u32 flags = 0;
-        struct ieee80211_ht_cap *ht_capa = NULL;
-        struct ieee80211_ht_cap *ht_capa_mask = NULL;
+        struct cfg80211_assoc_request req = {};
+        const u8 *bssid, *ssid;
+        int err, ssid_len = 0;
 
         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
                 return -EINVAL;
@@ -5741,41 +6027,58 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
 
         if (info->attrs[NL80211_ATTR_IE]) {
-                ie = nla_data(info->attrs[NL80211_ATTR_IE]);
-                ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+                req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+                req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
         }
 
         if (info->attrs[NL80211_ATTR_USE_MFP]) {
                 enum nl80211_mfp mfp =
                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
                 if (mfp == NL80211_MFP_REQUIRED)
-                        use_mfp = true;
+                        req.use_mfp = true;
                 else if (mfp != NL80211_MFP_NO)
                         return -EINVAL;
         }
 
         if (info->attrs[NL80211_ATTR_PREV_BSSID])
-                prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
+                req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
 
         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
-                flags |= ASSOC_REQ_DISABLE_HT;
+                req.flags |= ASSOC_REQ_DISABLE_HT;
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
-                ht_capa_mask =
-                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]);
+                memcpy(&req.ht_capa_mask,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
+                       sizeof(req.ht_capa_mask));
 
         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
-                if (!ht_capa_mask)
+                if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
+                        return -EINVAL;
+                memcpy(&req.ht_capa,
+                       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
+                       sizeof(req.ht_capa));
+        }
+
+        if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
+                req.flags |= ASSOC_REQ_DISABLE_VHT;
+
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
+                memcpy(&req.vht_capa_mask,
+                       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
+                       sizeof(req.vht_capa_mask));
+
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
+                if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
                         return -EINVAL;
-                ht_capa = nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
+                memcpy(&req.vht_capa,
+                       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
+                       sizeof(req.vht_capa));
         }
 
-        err = nl80211_crypto_settings(rdev, info, &crypto, 1);
+        err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
         if (!err)
-                err = cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
-                                          ssid, ssid_len, ie, ie_len, use_mfp,
-                                          &crypto, flags, ht_capa,
-                                          ht_capa_mask);
+                err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
+                                          ssid, ssid_len, &req);
 
         return err;
 }
@@ -6355,6 +6658,24 @@ static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
                        sizeof(connect.ht_capa));
         }
 
+        if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
+                connect.flags |= ASSOC_REQ_DISABLE_VHT;
+
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
+                memcpy(&connect.vht_capa_mask,
+                       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
+                       sizeof(connect.vht_capa_mask));
+
+        if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
+                if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
+                        kfree(connkeys);
+                        return -EINVAL;
+                }
+                memcpy(&connect.vht_capa,
+                       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
+                       sizeof(connect.vht_capa));
+        }
+
         err = cfg80211_connect(rdev, dev, &connect, connkeys);
         if (err)
                 kfree(connkeys);
@@ -7128,6 +7449,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
                         return err;
         }
 
+        if (setup.user_mpm)
+                cfg.auto_open_plinks = false;
+
         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
                 if (err)
@@ -7327,7 +7651,8 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
                 return -EINVAL;
 
         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
-                        rdev->wiphy.wowlan.tcp->data_interval_max)
+                        rdev->wiphy.wowlan.tcp->data_interval_max ||
+            nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
                 return -EINVAL;
 
         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
@@ -7823,6 +8148,54 @@ static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
         return 0;
 }
 
+static int nl80211_get_protocol_features(struct sk_buff *skb,
+                                         struct genl_info *info)
+{
+        void *hdr;
+        struct sk_buff *msg;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
+                             NL80211_CMD_GET_PROTOCOL_FEATURES);
+        if (!hdr)
+                goto nla_put_failure;
+
+        if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
+                        NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
+                goto nla_put_failure;
+
+        genlmsg_end(msg, hdr);
+        return genlmsg_reply(msg, info);
+
+ nla_put_failure:
+        kfree_skb(msg);
+        return -ENOBUFS;
+}
+
+static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
+{
+        struct cfg80211_registered_device *rdev = info->user_ptr[0];
+        struct cfg80211_update_ft_ies_params ft_params;
+        struct net_device *dev = info->user_ptr[1];
+
+        if (!rdev->ops->update_ft_ies)
+                return -EOPNOTSUPP;
+
+        if (!info->attrs[NL80211_ATTR_MDID] ||
+            !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
+                return -EINVAL;
+
+        memset(&ft_params, 0, sizeof(ft_params));
+        ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
+        ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
+        ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
+
+        return rdev_update_ft_ies(rdev, dev, &ft_params);
+}
+
 #define NL80211_FLAG_NEED_WIPHY         0x01
 #define NL80211_FLAG_NEED_NETDEV        0x02
 #define NL80211_FLAG_NEED_RTNL          0x04
@@ -8499,6 +8872,19 @@ static struct genl_ops nl80211_ops[] = {
                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
                                   NL80211_FLAG_NEED_RTNL,
         },
+        {
+                .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
+                .doit = nl80211_get_protocol_features,
+                .policy = nl80211_policy,
+        },
+        {
+                .cmd = NL80211_CMD_UPDATE_FT_IES,
+                .doit = nl80211_update_ft_ies,
+                .policy = nl80211_policy,
+                .flags = GENL_ADMIN_PERM,
+                .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
+                                  NL80211_FLAG_NEED_RTNL,
+        },
 };
 
 static struct genl_multicast_group nl80211_mlme_mcgrp = {
@@ -8526,7 +8912,8 @@ void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
         if (!msg)
                 return;
 
-        if (nl80211_send_wiphy(msg, 0, 0, 0, rdev) < 0) {
+        if (nl80211_send_wiphy(rdev, msg, 0, 0, 0,
+                               false, NULL, NULL, NULL) < 0) {
                 nlmsg_free(msg);
                 return;
         }
@@ -8850,21 +9237,31 @@ void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                                 NL80211_CMD_DISASSOCIATE, gfp);
 }
 
-void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev, const u8 *buf,
-                                size_t len, gfp_t gfp)
+void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
+                                 size_t len)
 {
-        nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_UNPROT_DEAUTHENTICATE, gfp);
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_send_unprot_deauth(dev);
+        nl80211_send_mlme_event(rdev, dev, buf, len,
+                                NL80211_CMD_UNPROT_DEAUTHENTICATE, GFP_ATOMIC);
 }
+EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
 
-void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev, const u8 *buf,
-                                  size_t len, gfp_t gfp)
+void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
+                                   size_t len)
 {
-        nl80211_send_mlme_event(rdev, netdev, buf, len,
-                                NL80211_CMD_UNPROT_DISASSOCIATE, gfp);
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_send_unprot_disassoc(dev);
+        nl80211_send_mlme_event(rdev, dev, buf, len,
+                                NL80211_CMD_UNPROT_DISASSOCIATE, GFP_ATOMIC);
 }
+EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
 
 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
                                       struct net_device *netdev, int cmd,
@@ -9067,14 +9464,19 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
-void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
-                struct net_device *netdev,
-                const u8 *macaddr, const u8* ie, u8 ie_len,
-                gfp_t gfp)
+void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
+                                        const u8* ie, u8 ie_len, gfp_t gfp)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct sk_buff *msg;
         void *hdr;
 
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
+                return;
+
+        trace_cfg80211_notify_new_peer_candidate(dev, addr);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9086,8 +9488,8 @@ void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
         }
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
-            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, macaddr) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
+            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
             (ie_len && ie &&
              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
                 goto nla_put_failure;
@@ -9102,6 +9504,7 @@ void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
 
 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                                  struct net_device *netdev, const u8 *addr,
@@ -9170,7 +9573,7 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
         if (!nl_freq)
                 goto nla_put_failure;
-        if (nl80211_msg_put_channel(msg, channel_before))
+        if (nl80211_msg_put_channel(msg, channel_before, false))
                 goto nla_put_failure;
         nla_nest_end(msg, nl_freq);
 
@@ -9178,7 +9581,7 @@ void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
         if (!nl_freq)
                 goto nla_put_failure;
-        if (nl80211_msg_put_channel(msg, channel_after))
+        if (nl80211_msg_put_channel(msg, channel_after, false))
                 goto nla_put_failure;
         nla_nest_end(msg, nl_freq);
 
@@ -9240,31 +9643,42 @@ static void nl80211_send_remain_on_chan_event(
         nlmsg_free(msg);
 }
 
-void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
-                                    struct wireless_dev *wdev, u64 cookie,
-                                    struct ieee80211_channel *chan,
-                                    unsigned int duration, gfp_t gfp)
+void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
+                               struct ieee80211_channel *chan,
+                               unsigned int duration, gfp_t gfp)
 {
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
                                           rdev, wdev, cookie, chan,
                                           duration, gfp);
 }
+EXPORT_SYMBOL(cfg80211_ready_on_channel);
 
-void nl80211_send_remain_on_channel_cancel(
-        struct cfg80211_registered_device *rdev,
-        struct wireless_dev *wdev,
-        u64 cookie, struct ieee80211_channel *chan, gfp_t gfp)
+void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
+                                        struct ieee80211_channel *chan,
+                                        gfp_t gfp)
 {
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
                                           rdev, wdev, cookie, chan, 0, gfp);
 }
+EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
 
-void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
-                            struct net_device *dev, const u8 *mac_addr,
-                            struct station_info *sinfo, gfp_t gfp)
+void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
+                      struct station_info *sinfo, gfp_t gfp)
 {
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
 
+        trace_cfg80211_new_sta(dev, mac_addr, sinfo);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9278,14 +9692,17 @@ void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
         genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
                                 nl80211_mlme_mcgrp.id, gfp);
 }
+EXPORT_SYMBOL(cfg80211_new_sta);
 
-void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
-                                struct net_device *dev, const u8 *mac_addr,
-                                gfp_t gfp)
+void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 {
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
+        trace_cfg80211_del_sta(dev, mac_addr);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9310,12 +9727,14 @@ void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_del_sta);
 
-void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
-                                    struct net_device *dev, const u8 *mac_addr,
-                                    enum nl80211_connect_failed_reason reason,
-                                    gfp_t gfp)
+void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
+                          enum nl80211_connect_failed_reason reason,
+                          gfp_t gfp)
 {
+        struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         void *hdr;
 
@@ -9344,6 +9763,7 @@ void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_conn_failed);
 
 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
                                        const u8 *addr, gfp_t gfp)
@@ -9388,19 +9808,47 @@ static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
         return true;
 }
 
-bool nl80211_unexpected_frame(struct net_device *dev, const u8 *addr, gfp_t gfp)
+bool cfg80211_rx_spurious_frame(struct net_device *dev,
+                                const u8 *addr, gfp_t gfp)
 {
-        return __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
-                                          addr, gfp);
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+
+        trace_cfg80211_rx_spurious_frame(dev, addr);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
+                                         addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
 }
+EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
 
-bool nl80211_unexpected_4addr_frame(struct net_device *dev,
-                                    const u8 *addr, gfp_t gfp)
+bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
+                                        const u8 *addr, gfp_t gfp)
 {
-        return __nl80211_unexpected_frame(dev,
-                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
-                                          addr, gfp);
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        bool ret;
+
+        trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
+                    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
+                trace_cfg80211_return_bool(false);
+                return false;
+        }
+        ret = __nl80211_unexpected_frame(dev,
+                                         NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
+                                         addr, gfp);
+        trace_cfg80211_return_bool(ret);
+        return ret;
 }
+EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
 
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlportid,
@@ -9440,15 +9888,17 @@ int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
         return -ENOBUFS;
 }
 
-void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
-                                 struct wireless_dev *wdev, u64 cookie,
-                                 const u8 *buf, size_t len, bool ack,
-                                 gfp_t gfp)
+void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
+                             const u8 *buf, size_t len, bool ack, gfp_t gfp)
 {
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct net_device *netdev = wdev->netdev;
         struct sk_buff *msg;
         void *hdr;
 
+        trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9476,17 +9926,21 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
 
-void
-nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
-                             struct net_device *netdev,
-                             enum nl80211_cqm_rssi_threshold_event rssi_event,
-                             gfp_t gfp)
+void cfg80211_cqm_rssi_notify(struct net_device *dev,
+                              enum nl80211_cqm_rssi_threshold_event rssi_event,
+                              gfp_t gfp)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
 
+        trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9498,7 +9952,7 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
         }
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
                 goto nla_put_failure;
 
         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
@@ -9521,10 +9975,11 @@ nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
 
-void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev, const u8 *bssid,
-                              const u8 *replay_ctr, gfp_t gfp)
+static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev, const u8 *bssid,
+                                     const u8 *replay_ctr, gfp_t gfp)
 {
         struct sk_buff *msg;
         struct nlattr *rekey_attr;
@@ -9566,9 +10021,22 @@ void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
-void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
-                                    struct net_device *netdev, int index,
-                                    const u8 *bssid, bool preauth, gfp_t gfp)
+void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
+                               const u8 *replay_ctr, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_gtk_rekey_notify(dev, bssid);
+        nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
+}
+EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
+
+static void
+nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
+                               struct net_device *netdev, int index,
+                               const u8 *bssid, bool preauth, gfp_t gfp)
 {
         struct sk_buff *msg;
         struct nlattr *attr;
@@ -9611,9 +10079,22 @@ void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
-void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev,
-                              struct cfg80211_chan_def *chandef, gfp_t gfp)
+void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
+                                     const u8 *bssid, bool preauth, gfp_t gfp)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
+        nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
+}
+EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
+
+static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
+                                     struct net_device *netdev,
+                                     struct cfg80211_chan_def *chandef,
+                                     gfp_t gfp)
 {
         struct sk_buff *msg;
         void *hdr;
@@ -9645,11 +10126,36 @@ void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
-void
-nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
-                            struct net_device *netdev, const u8 *peer,
-                            u32 num_packets, u32 rate, u32 intvl, gfp_t gfp)
+void cfg80211_ch_switch_notify(struct net_device *dev,
+                               struct cfg80211_chan_def *chandef)
+{
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+
+        trace_cfg80211_ch_switch_notify(dev, chandef);
+
+        wdev_lock(wdev);
+
+        if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
+                    wdev->iftype != NL80211_IFTYPE_P2P_GO))
+                goto out;
+
+        wdev->channel = chandef->chan;
+        nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
+out:
+        wdev_unlock(wdev);
+        return;
+}
+EXPORT_SYMBOL(cfg80211_ch_switch_notify);
+
+void cfg80211_cqm_txe_notify(struct net_device *dev,
+                             const u8 *peer, u32 num_packets,
+                             u32 rate, u32 intvl, gfp_t gfp)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
@@ -9665,7 +10171,7 @@ nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
         }
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
                 goto nla_put_failure;
 
@@ -9694,6 +10200,7 @@ nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
 
 void
 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
@@ -9746,15 +10253,18 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
         nlmsg_free(msg);
 }
 
-void
-nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev, const u8 *peer,
-                                u32 num_packets, gfp_t gfp)
+void cfg80211_cqm_pktloss_notify(struct net_device *dev,
+                                 const u8 *peer, u32 num_packets, gfp_t gfp)
 {
+        struct wireless_dev *wdev = dev->ieee80211_ptr;
+        struct wiphy *wiphy = wdev->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
         struct sk_buff *msg;
         struct nlattr *pinfoattr;
         void *hdr;
 
+        trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
+
         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
         if (!msg)
                 return;
@@ -9766,7 +10276,7 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
         }
 
         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
-            nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
+            nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
                 goto nla_put_failure;
 
@@ -9789,6 +10299,7 @@ nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
         genlmsg_cancel(msg, hdr);
         nlmsg_free(msg);
 }
+EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
 
 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
                            u64 cookie, bool acked, gfp_t gfp)
@@ -10075,6 +10586,50 @@ static struct notifier_block nl80211_netlink_notifier = {
         .notifier_call = nl80211_netlink_notify,
 };
 
+void cfg80211_ft_event(struct net_device *netdev,
+                       struct cfg80211_ft_event_params *ft_event)
+{
+        struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
+        struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
+        struct sk_buff *msg;
+        void *hdr;
+        int err;
+
+        trace_cfg80211_ft_event(wiphy, netdev, ft_event);
+
+        if (!ft_event->target_ap)
+                return;
+
+        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
+        if (!msg)
+                return;
+
+        hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
+        if (!hdr) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx);
+        nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex);
+        nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap);
+        if (ft_event->ies)
+                nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies);
+        if (ft_event->ric_ies)
+                nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
+                        ft_event->ric_ies);
+
+        err = genlmsg_end(msg, hdr);
+        if (err < 0) {
+                nlmsg_free(msg);
+                return;
+        }
+
+        genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
+                                nl80211_mlme_mcgrp.id, GFP_KERNEL);
+}
+EXPORT_SYMBOL(cfg80211_ft_event);
+
 /* initialisation/exit functions */
 
 int nl80211_init(void)
diff --git a/net/wireless/nl80211.h b/net/wireless/nl80211.h
index b061da4919e1..a4073e808c13 100644
--- a/net/wireless/nl80211.h
+++ b/net/wireless/nl80211.h
@@ -29,12 +29,6 @@ void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
                            struct net_device *netdev,
                            const u8 *buf, size_t len, gfp_t gfp);
-void nl80211_send_unprot_deauth(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev,
-                                const u8 *buf, size_t len, gfp_t gfp);
-void nl80211_send_unprot_disassoc(struct cfg80211_registered_device *rdev,
-                                  struct net_device *netdev,
-                                  const u8 *buf, size_t len, gfp_t gfp);
 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev,
                                const u8 *addr, gfp_t gfp);
@@ -54,10 +48,6 @@ void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
                                struct net_device *netdev, u16 reason,
                                const u8 *ie, size_t ie_len, bool from_ap);
 
-void nl80211_send_new_peer_candidate(struct cfg80211_registered_device *rdev,
-                                     struct net_device *netdev,
-                                     const u8 *macaddr, const u8* ie, u8 ie_len,
-                                     gfp_t gfp);
 void
 nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
                             struct net_device *netdev, const u8 *addr,
@@ -73,41 +63,10 @@ void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
                              struct net_device *netdev, const u8 *bssid,
                              gfp_t gfp);
 
-void nl80211_send_remain_on_channel(struct cfg80211_registered_device *rdev,
-                                    struct wireless_dev *wdev, u64 cookie,
-                                    struct ieee80211_channel *chan,
-                                    unsigned int duration, gfp_t gfp);
-void nl80211_send_remain_on_channel_cancel(
-        struct cfg80211_registered_device *rdev,
-        struct wireless_dev *wdev,
-        u64 cookie, struct ieee80211_channel *chan, gfp_t gfp);
-
-void nl80211_send_sta_event(struct cfg80211_registered_device *rdev,
-                            struct net_device *dev, const u8 *mac_addr,
-                            struct station_info *sinfo, gfp_t gfp);
-void nl80211_send_sta_del_event(struct cfg80211_registered_device *rdev,
-                                struct net_device *dev, const u8 *mac_addr,
-                                gfp_t gfp);
-
-void nl80211_send_conn_failed_event(struct cfg80211_registered_device *rdev,
-                                    struct net_device *dev, const u8 *mac_addr,
-                                    enum nl80211_connect_failed_reason reason,
-                                    gfp_t gfp);
-
 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
                       struct wireless_dev *wdev, u32 nlpid,
                       int freq, int sig_dbm,
                       const u8 *buf, size_t len, gfp_t gfp);
-void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
-                                 struct wireless_dev *wdev, u64 cookie,
-                                 const u8 *buf, size_t len, bool ack,
-                                 gfp_t gfp);
-
-void
-nl80211_send_cqm_rssi_notify(struct cfg80211_registered_device *rdev,
-                             struct net_device *netdev,
-                             enum nl80211_cqm_rssi_threshold_event rssi_event,
-                             gfp_t gfp);
 
 void
 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
@@ -115,31 +74,4 @@ nl80211_radar_notify(struct cfg80211_registered_device *rdev,
                      enum nl80211_radar_event event,
                      struct net_device *netdev, gfp_t gfp);
 
-void
-nl80211_send_cqm_pktloss_notify(struct cfg80211_registered_device *rdev,
-                                struct net_device *netdev, const u8 *peer,
-                                u32 num_packets, gfp_t gfp);
-
-void
-nl80211_send_cqm_txe_notify(struct cfg80211_registered_device *rdev,
-                            struct net_device *netdev, const u8 *peer,
-                            u32 num_packets, u32 rate, u32 intvl, gfp_t gfp);
-
-void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
-                              struct net_device *netdev, const u8 *bssid,
-                              const u8 *replay_ctr, gfp_t gfp);
-
-void nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
-                                    struct net_device *netdev, int index,
-                                    const u8 *bssid, bool preauth, gfp_t gfp);
-
-void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
-                              struct net_device *dev,
-                              struct cfg80211_chan_def *chandef, gfp_t gfp);
-
-bool nl80211_unexpected_frame(struct net_device *dev,
-                              const u8 *addr, gfp_t gfp);
-bool nl80211_unexpected_4addr_frame(struct net_device *dev,
-                                    const u8 *addr, gfp_t gfp);
-
 #endif /* __NET_WIRELESS_NL80211_H */
diff --git a/net/wireless/rdev-ops.h b/net/wireless/rdev-ops.h
index 422d38291d66..d77e1c1d3a0e 100644
--- a/net/wireless/rdev-ops.h
+++ b/net/wireless/rdev-ops.h
@@ -6,11 +6,12 @@
 #include "core.h"
 #include "trace.h"
 
-static inline int rdev_suspend(struct cfg80211_registered_device *rdev)
+static inline int rdev_suspend(struct cfg80211_registered_device *rdev,
+                               struct cfg80211_wowlan *wowlan)
 {
         int ret;
-        trace_rdev_suspend(&rdev->wiphy, rdev->wowlan);
-        ret = rdev->ops->suspend(&rdev->wiphy, rdev->wowlan);
+        trace_rdev_suspend(&rdev->wiphy, wowlan);
+        ret = rdev->ops->suspend(&rdev->wiphy, wowlan);
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
@@ -887,4 +888,17 @@ static inline int rdev_set_mac_acl(struct cfg80211_registered_device *rdev,
         trace_rdev_return_int(&rdev->wiphy, ret);
         return ret;
 }
+
+static inline int rdev_update_ft_ies(struct cfg80211_registered_device *rdev,
+                                     struct net_device *dev,
+                                     struct cfg80211_update_ft_ies_params *ftie)
+{
+        int ret;
+
+        trace_rdev_update_ft_ies(&rdev->wiphy, dev, ftie);
+        ret = rdev->ops->update_ft_ies(&rdev->wiphy, dev, ftie);
+        trace_rdev_return_int(&rdev->wiphy, ret);
+        return ret;
+}
+
 #endif /* __CFG80211_RDEV_OPS */
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 98532c00242d..e6df52dc8c69 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -184,14 +184,14 @@ static const struct ieee80211_regdomain world_regdom = {
                         NL80211_RRF_NO_IBSS |
                         NL80211_RRF_NO_OFDM),
                 /* IEEE 802.11a, channel 36..48 */
-                REG_RULE(5180-10, 5240+10, 40, 6, 20,
+                REG_RULE(5180-10, 5240+10, 80, 6, 20,
                         NL80211_RRF_PASSIVE_SCAN |
                         NL80211_RRF_NO_IBSS),
 
-                /* NB: 5260 MHz - 5700 MHz requies DFS */
+                /* NB: 5260 MHz - 5700 MHz requires DFS */
 
                 /* IEEE 802.11a, channel 149..165 */
-                REG_RULE(5745-10, 5825+10, 40, 6, 20,
+                REG_RULE(5745-10, 5825+10, 80, 6, 20,
                         NL80211_RRF_PASSIVE_SCAN |
                         NL80211_RRF_NO_IBSS),
 
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f432bd3755b1..bad4c4b5e4eb 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -159,7 +159,7 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
 {
         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
         struct cfg80211_connect_params *params;
-        const u8 *prev_bssid = NULL;
+        struct cfg80211_assoc_request req = {};
         int err;
 
         ASSERT_WDEV_LOCK(wdev);
@@ -186,16 +186,20 @@ static int cfg80211_conn_do_work(struct wireless_dev *wdev)
                 BUG_ON(!rdev->ops->assoc);
                 wdev->conn->state = CFG80211_CONN_ASSOCIATING;
                 if (wdev->conn->prev_bssid_valid)
-                        prev_bssid = wdev->conn->prev_bssid;
-                err = __cfg80211_mlme_assoc(rdev, wdev->netdev,
-                                            params->channel, params->bssid,
-                                            prev_bssid,
-                                            params->ssid, params->ssid_len,
-                                            params->ie, params->ie_len,
-                                            params->mfp != NL80211_MFP_NO,
-                                            &params->crypto,
-                                            params->flags, &params->ht_capa,
-                                            &params->ht_capa_mask);
+                        req.prev_bssid = wdev->conn->prev_bssid;
+                req.ie = params->ie;
+                req.ie_len = params->ie_len;
+                req.use_mfp = params->mfp != NL80211_MFP_NO;
+                req.crypto = params->crypto;
+                req.flags = params->flags;
+                req.ht_capa = params->ht_capa;
+                req.ht_capa_mask = params->ht_capa_mask;
+                req.vht_capa = params->vht_capa;
+                req.vht_capa_mask = params->vht_capa_mask;
+
+                err = __cfg80211_mlme_assoc(rdev, wdev->netdev, params->channel,
+                                            params->bssid, params->ssid,
+                                            params->ssid_len, &req);
                 if (err)
                         __cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
                                                NULL, 0,
diff --git a/net/wireless/sysfs.c b/net/wireless/sysfs.c
index 238ee49b3868..8f28b9f798d8 100644
--- a/net/wireless/sysfs.c
+++ b/net/wireless/sysfs.c
@@ -83,6 +83,14 @@ static int wiphy_uevent(struct device *dev, struct kobj_uevent_env *env)
         return 0;
 }
 
+static void cfg80211_leave_all(struct cfg80211_registered_device *rdev)
+{
+        struct wireless_dev *wdev;
+
+        list_for_each_entry(wdev, &rdev->wdev_list, list)
+                cfg80211_leave(rdev, wdev);
+}
+
 static int wiphy_suspend(struct device *dev, pm_message_t state)
 {
         struct cfg80211_registered_device *rdev = dev_to_rdev(dev);
@@ -90,12 +98,19 @@ static int wiphy_suspend(struct device *dev, pm_message_t state)
 
         rdev->suspend_at = get_seconds();
 
-        if (rdev->ops->suspend) {
-                rtnl_lock();
-                if (rdev->wiphy.registered)
-                        ret = rdev_suspend(rdev);
-                rtnl_unlock();
+        rtnl_lock();
+        if (rdev->wiphy.registered) {
+                if (!rdev->wowlan)
+                        cfg80211_leave_all(rdev);
+                if (rdev->ops->suspend)
+                        ret = rdev_suspend(rdev, rdev->wowlan);
+                if (ret == 1) {
+                        /* Driver refuse to configure wowlan */
+                        cfg80211_leave_all(rdev);
+                        ret = rdev_suspend(rdev, NULL);
+                }
         }
+        rtnl_unlock();
 
         return ret;
 }
diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index b7a531380e19..ccadef2106ac 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h
@@ -1785,6 +1785,26 @@ TRACE_EVENT(rdev_set_mac_acl,
                   WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->acl_policy)
 );
 
+TRACE_EVENT(rdev_update_ft_ies,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_update_ft_ies_params *ftie),
+        TP_ARGS(wiphy, netdev, ftie),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                __field(u16, md)
+                __dynamic_array(u8, ie, ftie->ie_len)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                __entry->md = ftie->md;
+                memcpy(__get_dynamic_array(ie), ftie->ie, ftie->ie_len);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", md: 0x%x",
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, __entry->md)
+);
+
 /*************************************************************
  *           cfg80211 exported functions traces              *
  *************************************************************/
@@ -2413,6 +2433,32 @@ TRACE_EVENT(cfg80211_report_wowlan_wakeup,
         TP_printk(WIPHY_PR_FMT ", " WDEV_PR_FMT, WIPHY_PR_ARG, WDEV_PR_ARG)
 );
 
+TRACE_EVENT(cfg80211_ft_event,
+        TP_PROTO(struct wiphy *wiphy, struct net_device *netdev,
+                 struct cfg80211_ft_event_params *ft_event),
+        TP_ARGS(wiphy, netdev, ft_event),
+        TP_STRUCT__entry(
+                WIPHY_ENTRY
+                NETDEV_ENTRY
+                __dynamic_array(u8, ies, ft_event->ies_len)
+                MAC_ENTRY(target_ap)
+                __dynamic_array(u8, ric_ies, ft_event->ric_ies_len)
+        ),
+        TP_fast_assign(
+                WIPHY_ASSIGN;
+                NETDEV_ASSIGN;
+                if (ft_event->ies)
+                        memcpy(__get_dynamic_array(ies), ft_event->ies,
+                               ft_event->ies_len);
+                MAC_ASSIGN(target_ap, ft_event->target_ap);
+                if (ft_event->ric_ies)
+                        memcpy(__get_dynamic_array(ric_ies), ft_event->ric_ies,
+                               ft_event->ric_ies_len);
+        ),
+        TP_printk(WIPHY_PR_FMT ", " NETDEV_PR_FMT ", target_ap: " MAC_PR_FMT,
+                  WIPHY_PR_ARG, NETDEV_PR_ARG, MAC_PR_ARG(target_ap))
+);
+
 #endif /* !__RDEV_OPS_TRACE || TRACE_HEADER_MULTI_READ */
 
 #undef TRACE_INCLUDE_PATH