Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next into for-davem

12 files changed, 290 insertions, 74 deletions

diff --git a/drivers/net/wireless/ti/wl12xx/cmd.c b/drivers/net/wireless/ti/wl12xx/cmd.c
index 30be784a40d8..622206241e83 100644
--- a/drivers/net/wireless/ti/wl12xx/cmd.c
+++ b/drivers/net/wireless/ti/wl12xx/cmd.c
@@ -85,7 +85,11 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
 
         memcpy(&gen_parms->general_params, gp, sizeof(*gp));
 
-        if (gp->tx_bip_fem_auto_detect)
+        /* If we started in PLT FEM_DETECT mode, force auto detect */
+        if (wl->plt_mode == PLT_FEM_DETECT)
+                gen_parms->general_params.tx_bip_fem_auto_detect = true;
+
+        if (gen_parms->general_params.tx_bip_fem_auto_detect)
                 answer = true;
 
         /* Override the REF CLK from the NVS with the one from platform data */
@@ -106,8 +110,17 @@ int wl1271_cmd_general_parms(struct wl1271 *wl)
                 goto out;
         }
 
+        /* If we are in calibrator based fem auto detect - save fem nr */
+        if (wl->plt_mode == PLT_FEM_DETECT)
+                wl->fem_manuf = gp->tx_bip_fem_manufacturer;
+
         wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
-                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+                answer == false ?
+                        "manual" :
+                wl->plt_mode == PLT_FEM_DETECT ?
+                        "calibrator_fem_detect" :
+                        "auto",
+                gp->tx_bip_fem_manufacturer);
 
 out:
         kfree(gen_parms);
@@ -139,7 +152,11 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
 
         memcpy(&gen_parms->general_params, gp, sizeof(*gp));
 
-        if (gp->tx_bip_fem_auto_detect)
+        /* If we started in PLT FEM_DETECT mode, force auto detect */
+        if (wl->plt_mode == PLT_FEM_DETECT)
+                gen_parms->general_params.tx_bip_fem_auto_detect = true;
+
+        if (gen_parms->general_params.tx_bip_fem_auto_detect)
                 answer = true;
 
         /* Replace REF and TCXO CLKs with the ones from platform data */
@@ -161,8 +178,17 @@ int wl128x_cmd_general_parms(struct wl1271 *wl)
                 goto out;
         }
 
+        /* If we are in calibrator based fem auto detect - save fem nr */
+        if (wl->plt_mode == PLT_FEM_DETECT)
+                wl->fem_manuf = gp->tx_bip_fem_manufacturer;
+
         wl1271_debug(DEBUG_CMD, "FEM autodetect: %s, manufacturer: %d\n",
-                     answer ? "auto" : "manual", gp->tx_bip_fem_manufacturer);
+                answer == false ?
+                        "manual" :
+                wl->plt_mode == PLT_FEM_DETECT ?
+                        "calibrator_fem_detect" :
+                        "auto",
+                gp->tx_bip_fem_manufacturer);
 
 out:
         kfree(gen_parms);
diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
index 3d6c71b7a3c7..f429fc110cb0 100644
--- a/drivers/net/wireless/ti/wl12xx/main.c
+++ b/drivers/net/wireless/ti/wl12xx/main.c
@@ -1339,6 +1339,14 @@ static int wl12xx_hw_init(struct wl1271 *wl)
                 ret = wl128x_cmd_general_parms(wl);
                 if (ret < 0)
                         goto out;
+
+                /*
+                 * If we are in calibrator based auto detect then we got the FEM nr
+                 * in wl->fem_manuf. No need to continue further
+                 */
+                if (wl->plt_mode == PLT_FEM_DETECT)
+                        goto out;
+
                 ret = wl128x_cmd_radio_parms(wl);
                 if (ret < 0)
                         goto out;
@@ -1355,6 +1363,14 @@ static int wl12xx_hw_init(struct wl1271 *wl)
                 ret = wl1271_cmd_general_parms(wl);
                 if (ret < 0)
                         goto out;
+
+                /*
+                 * If we are in calibrator based auto detect then we got the FEM nr
+                 * in wl->fem_manuf. No need to continue further
+                 */
+                if (wl->plt_mode == PLT_FEM_DETECT)
+                        goto out;
+
                 ret = wl1271_cmd_radio_parms(wl);
                 if (ret < 0)
                         goto out;
@@ -1500,6 +1516,13 @@ static int wl12xx_plt_init(struct wl1271 *wl)
         if (ret < 0)
                 goto out_irq_disable;
 
+        /*
+         * If we are in calibrator based auto detect then we got the FEM nr
+         * in wl->fem_manuf. No need to continue further
+         */
+        if (wl->plt_mode == PLT_FEM_DETECT)
+                goto out;
+
         ret = wl1271_acx_init_mem_config(wl);
         if (ret < 0)
                 goto out_irq_disable;
diff --git a/drivers/net/wireless/ti/wl18xx/conf.h b/drivers/net/wireless/ti/wl18xx/conf.h
index fac0b7e87e75..4d426cc20274 100644
--- a/drivers/net/wireless/ti/wl18xx/conf.h
+++ b/drivers/net/wireless/ti/wl18xx/conf.h
@@ -23,7 +23,7 @@
 #define __WL18XX_CONF_H__
 
 #define WL18XX_CONF_MAGIC       0x10e100ca
-#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0002)
+#define WL18XX_CONF_VERSION     (WLCORE_CONF_VERSION | 0x0003)
 #define WL18XX_CONF_MASK        0x0000ffff
 #define WL18XX_CONF_SIZE        (WLCORE_CONF_SIZE + \
                                  sizeof(struct wl18xx_priv_conf))
@@ -84,7 +84,26 @@ struct wl18xx_mac_and_phy_params {
         u8 padding[1];
 } __packed;
 
+enum wl18xx_ht_mode {
+        /* Default - use MIMO, fallback to SISO20 */
+        HT_MODE_DEFAULT = 0,
+
+        /* Wide - use SISO40 */
+        HT_MODE_WIDE = 1,
+
+        /* Use SISO20 */
+        HT_MODE_SISO20 = 2,
+};
+
+struct wl18xx_ht_settings {
+        /* DEFAULT / WIDE / SISO20 */
+        u8 mode;
+} __packed;
+
 struct wl18xx_priv_conf {
+        /* Module params structures */
+        struct wl18xx_ht_settings ht;
+
         /* this structure is copied wholesale to FW */
         struct wl18xx_mac_and_phy_params phy;
 } __packed;
diff --git a/drivers/net/wireless/ti/wl18xx/io.c b/drivers/net/wireless/ti/wl18xx/io.c
index 0c06ccfd1b8c..f0abf3ef2c95 100644
--- a/drivers/net/wireless/ti/wl18xx/io.c
+++ b/drivers/net/wireless/ti/wl18xx/io.c
@@ -54,7 +54,7 @@ out:
 
 int wl18xx_top_reg_read(struct wl1271 *wl, int addr, u16 *out)
 {
-        u32 val;
+        u32 val = 0;
         int ret;
 
         if (WARN_ON(addr % 2))
diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c
index b378b34c4a6a..69042bb9a097 100644
--- a/drivers/net/wireless/ti/wl18xx/main.c
+++ b/drivers/net/wireless/ti/wl18xx/main.c
@@ -43,8 +43,8 @@
 
 #define WL18XX_RX_CHECKSUM_MASK      0x40
 
-static char *ht_mode_param = "default";
-static char *board_type_param = "hdk";
+static char *ht_mode_param = NULL;
+static char *board_type_param = NULL;
 static bool checksum_param = false;
 static bool enable_11a_param = true;
 static int num_rx_desc_param = -1;
@@ -494,16 +494,20 @@ static struct wlcore_conf wl18xx_conf = {
 };
 
 static struct wl18xx_priv_conf wl18xx_default_priv_conf = {
+        .ht = {
+                .mode                           = HT_MODE_DEFAULT,
+        },
         .phy = {
                 .phy_standalone                 = 0x00,
                 .primary_clock_setting_time     = 0x05,
                 .clock_valid_on_wake_up         = 0x00,
                 .secondary_clock_setting_time   = 0x05,
+                .board_type                     = BOARD_TYPE_HDK_18XX,
                 .rdl                            = 0x01,
                 .auto_detect                    = 0x00,
                 .dedicated_fem                  = FEM_NONE,
                 .low_band_component             = COMPONENT_2_WAY_SWITCH,
-                .low_band_component_type        = 0x05,
+                .low_band_component_type        = 0x06,
                 .high_band_component            = COMPONENT_2_WAY_SWITCH,
                 .high_band_component_type       = 0x09,
                 .tcxo_ldo_voltage               = 0x00,
@@ -772,16 +776,24 @@ out:
 static int wl18xx_set_mac_and_phy(struct wl1271 *wl)
 {
         struct wl18xx_priv *priv = wl->priv;
+        struct wl18xx_mac_and_phy_params *params;
         int ret;
 
+        params = kmemdup(&priv->conf.phy, sizeof(*params), GFP_KERNEL);
+        if (!params) {
+                ret = -ENOMEM;
+                goto out;
+        }
+
         ret = wlcore_set_partition(wl, &wl->ptable[PART_PHY_INIT]);
         if (ret < 0)
                 goto out;
 
-        ret = wlcore_write(wl, WL18XX_PHY_INIT_MEM_ADDR, (u8 *)&priv->conf.phy,
-                           sizeof(struct wl18xx_mac_and_phy_params), false);
+        ret = wlcore_write(wl, WL18XX_PHY_INIT_MEM_ADDR, params,
+                           sizeof(*params), false);
 
 out:
+        kfree(params);
         return ret;
 }
 
@@ -1001,6 +1013,13 @@ static void wl18xx_set_rx_csum(struct wl1271 *wl,
                 skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
+static bool wl18xx_is_mimo_supported(struct wl1271 *wl)
+{
+        struct wl18xx_priv *priv = wl->priv;
+
+        return priv->conf.phy.number_of_assembled_ant2_4 >= 2;
+}
+
 /*
  * TODO: instead of having these two functions to get the rate mask,
  * we should modify the wlvif->rate_set instead
@@ -1017,6 +1036,9 @@ static u32 wl18xx_sta_get_ap_rate_mask(struct wl1271 *wl,
 
                 /* we don't support MIMO in wide-channel mode */
                 hw_rate_set &= ~CONF_TX_MIMO_RATES;
+        } else if (wl18xx_is_mimo_supported(wl)) {
+                wl1271_debug(DEBUG_ACX, "using MIMO channel rate mask");
+                hw_rate_set |= CONF_TX_MIMO_RATES;
         }
 
         return hw_rate_set;
@@ -1025,8 +1047,6 @@ static u32 wl18xx_sta_get_ap_rate_mask(struct wl1271 *wl,
 static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
                                              struct wl12xx_vif *wlvif)
 {
-        struct wl18xx_priv *priv = wl->priv;
-
         if (wlvif->channel_type == NL80211_CHAN_HT40MINUS ||
             wlvif->channel_type == NL80211_CHAN_HT40PLUS) {
                 wl1271_debug(DEBUG_ACX, "using wide channel rate mask");
@@ -1036,7 +1056,7 @@ static u32 wl18xx_ap_get_mimo_wide_rate_mask(struct wl1271 *wl,
                         return 0;
 
                 return CONF_TX_RATE_USE_WIDE_CHAN;
-        } else if (priv->conf.phy.number_of_assembled_ant2_4 >= 2 &&
+        } else if (wl18xx_is_mimo_supported(wl) &&
                    wlvif->band == IEEE80211_BAND_2GHZ) {
                 wl1271_debug(DEBUG_ACX, "using MIMO rate mask");
                 /*
@@ -1136,6 +1156,12 @@ static int wl18xx_plt_init(struct wl1271 *wl)
 {
         int ret;
 
+        /* calibrator based auto/fem detect not supported for 18xx */
+        if (wl->plt_mode == PLT_FEM_DETECT) {
+                wl1271_error("wl18xx_plt_init: PLT FEM_DETECT not supported");
+                return -EINVAL;
+        }
+
         ret = wlcore_write32(wl, WL18XX_SCR_PAD8, WL18XX_SCR_PAD8_PLT);
         if (ret < 0)
                 return ret;
@@ -1383,27 +1409,44 @@ static int __devinit wl18xx_probe(struct platform_device *pdev)
         if (ret < 0)
                 goto out_free;
 
-        if (!strcmp(board_type_param, "fpga")) {
-                priv->conf.phy.board_type = BOARD_TYPE_FPGA_18XX;
-        } else if (!strcmp(board_type_param, "hdk")) {
-                priv->conf.phy.board_type = BOARD_TYPE_HDK_18XX;
-                /* HACK! Just for now we hardcode HDK to 0x06 */
-                priv->conf.phy.low_band_component_type = 0x06;
-        } else if (!strcmp(board_type_param, "dvp")) {
-                priv->conf.phy.board_type = BOARD_TYPE_DVP_18XX;
-        } else if (!strcmp(board_type_param, "evb")) {
-                priv->conf.phy.board_type = BOARD_TYPE_EVB_18XX;
-        } else if (!strcmp(board_type_param, "com8")) {
-                priv->conf.phy.board_type = BOARD_TYPE_COM8_18XX;
-                /* HACK! Just for now we hardcode COM8 to 0x06 */
+        /* If the module param is set, update it in conf */
+        if (board_type_param) {
+                if (!strcmp(board_type_param, "fpga")) {
+                        priv->conf.phy.board_type = BOARD_TYPE_FPGA_18XX;
+                } else if (!strcmp(board_type_param, "hdk")) {
+                        priv->conf.phy.board_type = BOARD_TYPE_HDK_18XX;
+                } else if (!strcmp(board_type_param, "dvp")) {
+                        priv->conf.phy.board_type = BOARD_TYPE_DVP_18XX;
+                } else if (!strcmp(board_type_param, "evb")) {
+                        priv->conf.phy.board_type = BOARD_TYPE_EVB_18XX;
+                } else if (!strcmp(board_type_param, "com8")) {
+                        priv->conf.phy.board_type = BOARD_TYPE_COM8_18XX;
+                } else {
+                        wl1271_error("invalid board type '%s'",
+                                board_type_param);
+                        ret = -EINVAL;
+                        goto out_free;
+                }
+        }
+
+        /* HACK! Just for now we hardcode COM8 and HDK to 0x06 */
+        switch (priv->conf.phy.board_type) {
+        case BOARD_TYPE_HDK_18XX:
+        case BOARD_TYPE_COM8_18XX:
                 priv->conf.phy.low_band_component_type = 0x06;
-        } else {
-                wl1271_error("invalid board type '%s'", board_type_param);
+                break;
+        case BOARD_TYPE_FPGA_18XX:
+        case BOARD_TYPE_DVP_18XX:
+        case BOARD_TYPE_EVB_18XX:
+                priv->conf.phy.low_band_component_type = 0x05;
+                break;
+        default:
+                wl1271_error("invalid board type '%d'",
+                        priv->conf.phy.board_type);
                 ret = -EINVAL;
                 goto out_free;
         }
 
-        /* If the module param is set, update it in conf */
         if (low_band_component_param != -1)
                 priv->conf.phy.low_band_component = low_band_component_param;
         if (low_band_component_type_param != -1)
@@ -1424,12 +1467,26 @@ static int __devinit wl18xx_probe(struct platform_device *pdev)
         if (dc2dc_param != -1)
                 priv->conf.phy.external_pa_dc2dc = dc2dc_param;
 
-        if (!strcmp(ht_mode_param, "default")) {
+        if (ht_mode_param) {
+                if (!strcmp(ht_mode_param, "default"))
+                        priv->conf.ht.mode = HT_MODE_DEFAULT;
+                else if (!strcmp(ht_mode_param, "wide"))
+                        priv->conf.ht.mode = HT_MODE_WIDE;
+                else if (!strcmp(ht_mode_param, "siso20"))
+                        priv->conf.ht.mode = HT_MODE_SISO20;
+                else {
+                        wl1271_error("invalid ht_mode '%s'", ht_mode_param);
+                        ret = -EINVAL;
+                        goto out_free;
+                }
+        }
+
+        if (priv->conf.ht.mode == HT_MODE_DEFAULT) {
                 /*
                  * Only support mimo with multiple antennas. Fall back to
                  * siso20.
                  */
-                if (priv->conf.phy.number_of_assembled_ant2_4 >= 2)
+                if (wl18xx_is_mimo_supported(wl))
                         wlcore_set_ht_cap(wl, IEEE80211_BAND_2GHZ,
                                           &wl18xx_mimo_ht_cap_2ghz);
                 else
@@ -1439,20 +1496,16 @@ static int __devinit wl18xx_probe(struct platform_device *pdev)
                 /* 5Ghz is always wide */
                 wlcore_set_ht_cap(wl, IEEE80211_BAND_5GHZ,
                                   &wl18xx_siso40_ht_cap_5ghz);
-        } else if (!strcmp(ht_mode_param, "wide")) {
+        } else if (priv->conf.ht.mode == HT_MODE_WIDE) {
                 wlcore_set_ht_cap(wl, IEEE80211_BAND_2GHZ,
                                   &wl18xx_siso40_ht_cap_2ghz);
                 wlcore_set_ht_cap(wl, IEEE80211_BAND_5GHZ,
                                   &wl18xx_siso40_ht_cap_5ghz);
-        } else if (!strcmp(ht_mode_param, "siso20")) {
+        } else if (priv->conf.ht.mode == HT_MODE_SISO20) {
                 wlcore_set_ht_cap(wl, IEEE80211_BAND_2GHZ,
                                   &wl18xx_siso20_ht_cap);
                 wlcore_set_ht_cap(wl, IEEE80211_BAND_5GHZ,
                                   &wl18xx_siso20_ht_cap);
-        } else {
-                wl1271_error("invalid ht_mode '%s'", ht_mode_param);
-                ret = -EINVAL;
-                goto out_free;
         }
 
         if (!checksum_param) {
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index a23949cdaebc..20e1bd923832 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -497,6 +497,7 @@ int wl12xx_cmd_role_stop_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
 {
         struct wl12xx_cmd_role_stop *cmd;
         int ret;
+        bool timeout = false;
 
         if (WARN_ON(wlvif->sta.hlid == WL12XX_INVALID_LINK_ID))
                 return -EINVAL;
@@ -519,6 +520,17 @@ int wl12xx_cmd_role_stop_sta(struct wl1271 *wl, struct wl12xx_vif *wlvif)
                 goto out_free;
         }
 
+        /*
+         * Sometimes the firmware doesn't send this event, so we just
+         * time out without failing.  Queue recovery for other
+         * failures.
+         */
+        ret = wl1271_cmd_wait_for_event_or_timeout(wl,
+                                                   ROLE_STOP_COMPLETE_EVENT_ID,
+                                                   &timeout);
+        if (ret)
+                wl12xx_queue_recovery_work(wl);
+
         wl12xx_free_link(wl, wlvif, &wlvif->sta.hlid);
 
 out_free:
diff --git a/drivers/net/wireless/ti/wlcore/cmd.h b/drivers/net/wireless/ti/wlcore/cmd.h
index d7d9f801e506..4ef0b095f0d6 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.h
+++ b/drivers/net/wireless/ti/wlcore/cmd.h
@@ -192,7 +192,7 @@ enum cmd_templ {
 #define WL1271_COMMAND_TIMEOUT     2000
 #define WL1271_CMD_TEMPL_DFLT_SIZE 252
 #define WL1271_CMD_TEMPL_MAX_SIZE  512
-#define WL1271_EVENT_TIMEOUT       1000
+#define WL1271_EVENT_TIMEOUT       1500
 
 struct wl1271_cmd_header {
         __le16 id;
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 9f04b64dfa33..72548609f711 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1064,10 +1064,17 @@ out:
         return ret;
 }
 
-int wl1271_plt_start(struct wl1271 *wl)
+int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode)
 {
         int retries = WL1271_BOOT_RETRIES;
         struct wiphy *wiphy = wl->hw->wiphy;
+
+        static const char* const PLT_MODE[] = {
+                "PLT_OFF",
+                "PLT_ON",
+                "PLT_FEM_DETECT"
+        };
+
         int ret;
 
         mutex_lock(&wl->mutex);
@@ -1081,6 +1088,10 @@ int wl1271_plt_start(struct wl1271 *wl)
                 goto out;
         }
 
+        /* Indicate to lower levels that we are now in PLT mode */
+        wl->plt = true;
+        wl->plt_mode = plt_mode;
+
         while (retries) {
                 retries--;
                 ret = wl12xx_chip_wakeup(wl, true);
@@ -1091,9 +1102,9 @@ int wl1271_plt_start(struct wl1271 *wl)
                 if (ret < 0)
                         goto power_off;
 
-                wl->plt = true;
                 wl->state = WL1271_STATE_ON;
-                wl1271_notice("firmware booted in PLT mode (%s)",
+                wl1271_notice("firmware booted in PLT mode %s (%s)",
+                              PLT_MODE[plt_mode],
                               wl->chip.fw_ver_str);
 
                 /* update hw/fw version info in wiphy struct */
@@ -1107,6 +1118,9 @@ power_off:
                 wl1271_power_off(wl);
         }
 
+        wl->plt = false;
+        wl->plt_mode = PLT_OFF;
+
         wl1271_error("firmware boot in PLT mode failed despite %d retries",
                      WL1271_BOOT_RETRIES);
 out:
@@ -1159,6 +1173,7 @@ int wl1271_plt_stop(struct wl1271 *wl)
         wl->sleep_auth = WL1271_PSM_ILLEGAL;
         wl->state = WL1271_STATE_OFF;
         wl->plt = false;
+        wl->plt_mode = PLT_OFF;
         wl->rx_counter = 0;
         mutex_unlock(&wl->mutex);
 
@@ -1585,6 +1600,12 @@ static int wl1271_configure_suspend_sta(struct wl1271 *wl,
         if (!test_bit(WLVIF_FLAG_STA_ASSOCIATED, &wlvif->flags))
                 goto out;
 
+        if ((wl->conf.conn.suspend_wake_up_event ==
+             wl->conf.conn.wake_up_event) &&
+            (wl->conf.conn.suspend_listen_interval ==
+             wl->conf.conn.listen_interval))
+                goto out;
+
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
                 goto out;
@@ -1648,6 +1669,13 @@ static void wl1271_configure_resume(struct wl1271 *wl,
         if ((!is_ap) && (!is_sta))
                 return;
 
+        if (is_sta &&
+            ((wl->conf.conn.suspend_wake_up_event ==
+              wl->conf.conn.wake_up_event) &&
+             (wl->conf.conn.suspend_listen_interval ==
+              wl->conf.conn.listen_interval)))
+                return;
+
         ret = wl1271_ps_elp_wakeup(wl);
         if (ret < 0)
                 return;
@@ -2364,7 +2392,14 @@ deinit:
         else
                 wl->sta_count--;
 
-        /* Last AP, have more stations. Configure according to STA. */
+        /*
+         * Last AP, have more stations. Configure sleep auth according to STA.
+         * Don't do thin on unintended recovery.
+         */
+        if (test_bit(WL1271_FLAG_RECOVERY_IN_PROGRESS, &wl->flags) &&
+            !test_bit(WL1271_FLAG_INTENDED_FW_RECOVERY, &wl->flags))
+                goto unlock;
+
         if (wl->ap_count == 0 && is_ap && wl->sta_count) {
                 u8 sta_auth = wl->conf.conn.sta_sleep_auth;
                 /* Configure for power according to debugfs */
@@ -2378,6 +2413,7 @@ deinit:
                         wl1271_acx_sleep_auth(wl, WL1271_PSM_ELP);
         }
 
+unlock:
         mutex_unlock(&wl->mutex);
 
         del_timer_sync(&wlvif->rx_streaming_timer);
diff --git a/drivers/net/wireless/ti/wlcore/testmode.c b/drivers/net/wireless/ti/wlcore/testmode.c
index d6f57e2c03cf..49e5ee1525c9 100644
--- a/drivers/net/wireless/ti/wlcore/testmode.c
+++ b/drivers/net/wireless/ti/wlcore/testmode.c
@@ -129,8 +129,12 @@ static int wl1271_tm_cmd_test(struct wl1271 *wl, struct nlattr *tb[])
                         goto out_sleep;
                 }
 
-                if (nla_put(skb, WL1271_TM_ATTR_DATA, buf_len, buf))
-                        goto nla_put_failure;
+                if (nla_put(skb, WL1271_TM_ATTR_DATA, buf_len, buf)) {
+                        kfree_skb(skb);
+                        ret = -EMSGSIZE;
+                        goto out_sleep;
+                }
+
                 ret = cfg80211_testmode_reply(skb);
                 if (ret < 0)
                         goto out_sleep;
@@ -142,11 +146,6 @@ out:
         mutex_unlock(&wl->mutex);
 
         return ret;
-
-nla_put_failure:
-        kfree_skb(skb);
-        ret = -EMSGSIZE;
-        goto out_sleep;
 }
 
 static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
@@ -192,8 +191,12 @@ static int wl1271_tm_cmd_interrogate(struct wl1271 *wl, struct nlattr *tb[])
                 goto out_free;
         }
 
-        if (nla_put(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd))
-                goto nla_put_failure;
+        if (nla_put(skb, WL1271_TM_ATTR_DATA, sizeof(*cmd), cmd)) {
+                kfree_skb(skb);
+                ret = -EMSGSIZE;
+                goto out_free;
+        }
+
         ret = cfg80211_testmode_reply(skb);
         if (ret < 0)
                 goto out_free;
@@ -206,11 +209,6 @@ out:
         mutex_unlock(&wl->mutex);
 
         return ret;
-
-nla_put_failure:
-        kfree_skb(skb);
-        ret = -EMSGSIZE;
-        goto out_free;
 }
 
 static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
@@ -245,6 +243,43 @@ static int wl1271_tm_cmd_configure(struct wl1271 *wl, struct nlattr *tb[])
         return 0;
 }
 
+static int wl1271_tm_detect_fem(struct wl1271 *wl, struct nlattr *tb[])
+{
+        /* return FEM type */
+        int ret, len;
+        struct sk_buff *skb;
+
+        ret = wl1271_plt_start(wl, PLT_FEM_DETECT);
+        if (ret < 0)
+                goto out;
+
+        mutex_lock(&wl->mutex);
+
+        len = nla_total_size(sizeof(wl->fem_manuf));
+        skb = cfg80211_testmode_alloc_reply_skb(wl->hw->wiphy, len);
+        if (!skb) {
+                ret = -ENOMEM;
+                goto out_mutex;
+        }
+
+        if (nla_put(skb, WL1271_TM_ATTR_DATA, sizeof(wl->fem_manuf),
+                                              &wl->fem_manuf)) {
+                kfree_skb(skb);
+                ret = -EMSGSIZE;
+                goto out_mutex;
+        }
+
+        ret = cfg80211_testmode_reply(skb);
+
+out_mutex:
+        mutex_unlock(&wl->mutex);
+
+        /* We always stop plt after DETECT mode */
+        wl1271_plt_stop(wl);
+out:
+        return ret;
+}
+
 static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
 {
         u32 val;
@@ -258,11 +293,14 @@ static int wl1271_tm_cmd_set_plt_mode(struct wl1271 *wl, struct nlattr *tb[])
         val = nla_get_u32(tb[WL1271_TM_ATTR_PLT_MODE]);
 
         switch (val) {
-        case 0:
+        case PLT_OFF:
                 ret = wl1271_plt_stop(wl);
                 break;
-        case 1:
-                ret = wl1271_plt_start(wl);
+        case PLT_ON:
+                ret = wl1271_plt_start(wl, PLT_ON);
+                break;
+        case PLT_FEM_DETECT:
+                ret = wl1271_tm_detect_fem(wl, tb);
                 break;
         default:
                 ret = -EINVAL;
@@ -303,8 +341,12 @@ static int wl12xx_tm_cmd_get_mac(struct wl1271 *wl, struct nlattr *tb[])
                 goto out;
         }
 
-        if (nla_put(skb, WL1271_TM_ATTR_DATA, ETH_ALEN, mac_addr))
-                goto nla_put_failure;
+        if (nla_put(skb, WL1271_TM_ATTR_DATA, ETH_ALEN, mac_addr)) {
+                kfree_skb(skb);
+                ret = -EMSGSIZE;
+                goto out;
+        }
+
         ret = cfg80211_testmode_reply(skb);
         if (ret < 0)
                 goto out;
@@ -312,11 +354,6 @@ static int wl12xx_tm_cmd_get_mac(struct wl1271 *wl, struct nlattr *tb[])
 out:
         mutex_unlock(&wl->mutex);
         return ret;
-
-nla_put_failure:
-        kfree_skb(skb);
-        ret = -EMSGSIZE;
-        goto out;
 }
 
 int wl1271_tm_cmd(struct ieee80211_hw *hw, void *data, int len)
diff --git a/drivers/net/wireless/ti/wlcore/tx.c b/drivers/net/wireless/ti/wlcore/tx.c
index 8038a5026933..f0081f746482 100644
--- a/drivers/net/wireless/ti/wlcore/tx.c
+++ b/drivers/net/wireless/ti/wlcore/tx.c
@@ -306,22 +306,24 @@ static void wl1271_tx_fill_hdr(struct wl1271 *wl, struct wl12xx_vif *wlvif,
                 rate_idx = 0;
         else if (wlvif->bss_type != BSS_TYPE_AP_BSS) {
                 /*
-                 * if the packets are destined for AP (have a STA entry)
+                 * if the packets are data packets
                  * send them with AP rate policies (EAPOLs are an exception),
                  * otherwise use default basic rates
                  */
-                if (control->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
-                        rate_idx = wlvif->sta.p2p_rate_idx;
-                else if (skb->protocol == cpu_to_be16(ETH_P_PAE))
+                if (skb->protocol == cpu_to_be16(ETH_P_PAE))
                         rate_idx = wlvif->sta.basic_rate_idx;
-                else if (control->control.sta)
+                else if (control->flags & IEEE80211_TX_CTL_NO_CCK_RATE)
+                        rate_idx = wlvif->sta.p2p_rate_idx;
+                else if (ieee80211_is_data(frame_control))
                         rate_idx = wlvif->sta.ap_rate_idx;
                 else
                         rate_idx = wlvif->sta.basic_rate_idx;
         } else {
                 if (hlid == wlvif->ap.global_hlid)
                         rate_idx = wlvif->ap.mgmt_rate_idx;
-                else if (hlid == wlvif->ap.bcast_hlid)
+                else if (hlid == wlvif->ap.bcast_hlid ||
+                         skb->protocol == cpu_to_be16(ETH_P_PAE))
+                        /* send AP bcast and EAPOLs using the min basic rate */
                         rate_idx = wlvif->ap.bcast_rate_idx;
                 else
                         rate_idx = wlvif->ap.ucast_rate_idx[ac];
diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
index 27ccc275a1c1..0ce7a8ebbd46 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore.h
@@ -156,6 +156,8 @@ struct wl1271 {
         enum wl1271_state state;
         enum wl12xx_fw_type fw_type;
         bool plt;
+        enum plt_mode plt_mode;
+        u8 fem_manuf;
         u8 last_vif_count;
         struct mutex mutex;
 
diff --git a/drivers/net/wireless/ti/wlcore/wlcore_i.h b/drivers/net/wireless/ti/wlcore/wlcore_i.h
index 0187eef4fb07..c0505635bb00 100644
--- a/drivers/net/wireless/ti/wlcore/wlcore_i.h
+++ b/drivers/net/wireless/ti/wlcore/wlcore_i.h
@@ -293,6 +293,12 @@ enum rx_filter_action {
         FILTER_FW_HANDLE = 2
 };
 
+enum plt_mode {
+        PLT_OFF = 0,
+        PLT_ON = 1,
+        PLT_FEM_DETECT = 2,
+};
+
 struct wl12xx_rx_filter_field {
         __le16 offset;
         u8 len;
@@ -459,7 +465,7 @@ struct ieee80211_vif *wl12xx_wlvif_to_vif(struct wl12xx_vif *wlvif)
 #define wl12xx_for_each_wlvif_ap(wl, wlvif)     \
                 wl12xx_for_each_wlvif_bss_type(wl, wlvif, BSS_TYPE_AP_BSS)
 
-int wl1271_plt_start(struct wl1271 *wl);
+int wl1271_plt_start(struct wl1271 *wl, const enum plt_mode plt_mode);
 int wl1271_plt_stop(struct wl1271 *wl);
 int wl1271_recalc_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif);
 void wl12xx_queue_recovery_work(struct wl1271 *wl);