Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

Pull networking updates from David Miller:

 1) BPF debugger and asm tool by Daniel Borkmann.

 2) Speed up create/bind in AF_PACKET, also from Daniel Borkmann.

 3) Correct reciprocal_divide and update users, from Hannes Frederic
    Sowa and Daniel Borkmann.

 4) Currently we only have a "set" operation for the hw timestamp socket
    ioctl, add a "get" operation to match.  From Ben Hutchings.

 5) Add better trace events for debugging driver datapath problems, also
    from Ben Hutchings.

 6) Implement auto corking in TCP, from Eric Dumazet.  Basically, if we
    have a small send and a previous packet is already in the qdisc or
    device queue, defer until TX completion or we get more data.

 7) Allow userspace to manage ipv6 temporary addresses, from Jiri Pirko.

 8) Add a qdisc bypass option for AF_PACKET sockets, from Daniel
    Borkmann.

 9) Share IP header compression code between Bluetooth and IEEE802154
    layers, from Jukka Rissanen.

10) Fix ipv6 router reachability probing, from Jiri Benc.

11) Allow packets to be captured on macvtap devices, from Vlad Yasevich.

12) Support tunneling in GRO layer, from Jerry Chu.

13) Allow bonding to be configured fully using netlink, from Scott
    Feldman.

14) Allow AF_PACKET users to obtain the VLAN TPID, just like they can
    already get the TCI.  From Atzm Watanabe.

15) New "Heavy Hitter" qdisc, from Terry Lam.

16) Significantly improve the IPSEC support in pktgen, from Fan Du.

17) Allow ipv4 tunnels to cache routes, just like sockets.  From Tom
    Herbert.

18) Add Proportional Integral Enhanced packet scheduler, from Vijay
    Subramanian.

19) Allow openvswitch to mmap'd netlink, from Thomas Graf.

20) Key TCP metrics blobs also by source address, not just destination
    address.  From Christoph Paasch.

21) Support 10G in generic phylib.  From Andy Fleming.

22) Try to short-circuit GRO flow compares using device provided RX
    hash, if provided.  From Tom Herbert.

The wireless and netfilter folks have been busy little bees too.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (2064 commits)
  net/cxgb4: Fix referencing freed adapter
  ipv6: reallocate addrconf router for ipv6 address when lo device up
  fib_frontend: fix possible NULL pointer dereference
  rtnetlink: remove IFLA_BOND_SLAVE definition
  rtnetlink: remove check for fill_slave_info in rtnl_have_link_slave_info
  qlcnic: update version to 5.3.55
  qlcnic: Enhance logic to calculate msix vectors.
  qlcnic: Refactor interrupt coalescing code for all adapters.
  qlcnic: Update poll controller code path
  qlcnic: Interrupt code cleanup
  qlcnic: Enhance Tx timeout debugging.
  qlcnic: Use bool for rx_mac_learn.
  bonding: fix u64 division
  rtnetlink: add missing IFLA_BOND_AD_INFO_UNSPEC
  sfc: Use the correct maximum TX DMA ring size for SFC9100
  Add Shradha Shah as the sfc driver maintainer.
  net/vxlan: Share RX skb de-marking and checksum checks with ovs
  tulip: cleanup by using ARRAY_SIZE()
  ip_tunnel: clear IPCB in ip_tunnel_xmit() in case dst_link_failure() is called
  net/cxgb4: Don't retrieve stats during recovery
  ...

438 files changed, 17809 insertions, 14911 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index cfce83e1f273..f35f93c31b09 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -15,7 +15,6 @@
  * more details.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
@@ -1314,7 +1313,7 @@ static void adm8211_bss_info_changed(struct ieee80211_hw *dev,
         if (!(changes & BSS_CHANGED_BSSID))
                 return;
 
-        if (memcmp(conf->bssid, priv->bssid, ETH_ALEN)) {
+        if (!ether_addr_equal(conf->bssid, priv->bssid)) {
                 adm8211_set_bssid(dev, conf->bssid);
                 memcpy(priv->bssid, conf->bssid, ETH_ALEN);
         }
@@ -1866,7 +1865,6 @@ static int adm8211_probe(struct pci_dev *pdev,
         dev->flags = IEEE80211_HW_SIGNAL_UNSPEC;
         dev->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
 
-        dev->channel_change_time = 1000;
         dev->max_signal = 100;    /* FIXME: find better value */
 
         dev->queues = 1; /* ADM8211C supports more, maybe ADM8211B too */
diff --git a/drivers/net/wireless/airo_cs.c b/drivers/net/wireless/airo_cs.c
index 14128fd265ac..7e9ede6c5798 100644
--- a/drivers/net/wireless/airo_cs.c
+++ b/drivers/net/wireless/airo_cs.c
@@ -23,7 +23,6 @@
 #ifdef __IN_PCMCIA_PACKAGE__
 #include <pcmcia/k_compat.h>
 #endif
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/ptrace.h>
diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 34c8a33cac06..99b3bfa717d5 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1721,7 +1721,7 @@ static void at76_mac80211_tx(struct ieee80211_hw *hw,
          * following workaround is necessary. If the TX frame is an
          * authentication frame extract the bssid and send the CMD_JOIN. */
         if (mgmt->frame_control & cpu_to_le16(IEEE80211_STYPE_AUTH)) {
-                if (!ether_addr_equal(priv->bssid, mgmt->bssid)) {
+                if (!ether_addr_equal_64bits(priv->bssid, mgmt->bssid)) {
                         memcpy(priv->bssid, mgmt->bssid, ETH_ALEN);
                         ieee80211_queue_work(hw, &priv->work_join_bssid);
                         dev_kfree_skb_any(skb);
@@ -2112,7 +2112,6 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
         priv->pm_period = 0;
 
         /* unit us */
-        priv->hw->channel_change_time = 100000;
 
         return priv;
 }
diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 280fc3d53a36..8aa20df55e50 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c
@@ -25,7 +25,6 @@
  * that and only has minimal functionality.
  */
 #include <linux/compiler.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/list.h>
diff --git a/drivers/net/wireless/ath/ath.h b/drivers/net/wireless/ath/ath.h
index e0ba7cd14252..b59cfbe0276b 100644
--- a/drivers/net/wireless/ath/ath.h
+++ b/drivers/net/wireless/ath/ath.h
@@ -17,6 +17,7 @@
 #ifndef ATH_H
 #define ATH_H
 
+#include <linux/etherdevice.h>
 #include <linux/skbuff.h>
 #include <linux/if_ether.h>
 #include <linux/spinlock.h>
@@ -165,6 +166,7 @@ struct ath_common {
 struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
                                 u32 len,
                                 gfp_t gfp_mask);
+bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr);
 
 void ath_hw_setbssidmask(struct ath_common *common);
 void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf *key);
diff --git a/drivers/net/wireless/ath/ath10k/Kconfig b/drivers/net/wireless/ath/ath10k/Kconfig
index 82e8088ca9b4..a6f5285235af 100644
--- a/drivers/net/wireless/ath/ath10k/Kconfig
+++ b/drivers/net/wireless/ath/ath10k/Kconfig
@@ -37,3 +37,10 @@ config ATH10K_TRACING
         ---help---
           Select this to ath10k use tracing infrastructure.
 
+config ATH10K_DFS_CERTIFIED
+        bool "Atheros DFS support for certified platforms"
+        depends on ATH10K && CFG80211_CERTIFICATION_ONUS
+        default n
+        ---help---
+        This option enables DFS support for initiating radiation on
+        ath10k.
diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c
index e46951b8fb92..d44d618b05f9 100644
--- a/drivers/net/wireless/ath/ath10k/ce.c
+++ b/drivers/net/wireless/ath/ath10k/ce.c
@@ -243,6 +243,16 @@ static inline void ath10k_ce_error_intr_enable(struct ath10k *ar,
                            misc_ie_addr | CE_ERROR_MASK);
 }
 
+static inline void ath10k_ce_error_intr_disable(struct ath10k *ar,
+                                                u32 ce_ctrl_addr)
+{
+        u32 misc_ie_addr = ath10k_pci_read32(ar,
+                                             ce_ctrl_addr + MISC_IE_ADDRESS);
+
+        ath10k_pci_write32(ar, ce_ctrl_addr + MISC_IE_ADDRESS,
+                           misc_ie_addr & ~CE_ERROR_MASK);
+}
+
 static inline void ath10k_ce_engine_int_status_clear(struct ath10k *ar,
                                                      u32 ce_ctrl_addr,
                                                      unsigned int mask)
@@ -731,7 +741,6 @@ void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id)
 
 void ath10k_ce_per_engine_service_any(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ce_id, ret;
         u32 intr_summary;
 
@@ -741,7 +750,7 @@ void ath10k_ce_per_engine_service_any(struct ath10k *ar)
 
         intr_summary = CE_INTERRUPT_SUMMARY(ar);
 
-        for (ce_id = 0; intr_summary && (ce_id < ar_pci->ce_count); ce_id++) {
+        for (ce_id = 0; intr_summary && (ce_id < CE_COUNT); ce_id++) {
                 if (intr_summary & (1 << ce_id))
                         intr_summary &= ~(1 << ce_id);
                 else
@@ -783,22 +792,25 @@ static void ath10k_ce_per_engine_handler_adjust(struct ath10k_ce_pipe *ce_state,
         ath10k_pci_sleep(ar);
 }
 
-void ath10k_ce_disable_interrupts(struct ath10k *ar)
+int ath10k_ce_disable_interrupts(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ce_id, ret;
 
         ret = ath10k_pci_wake(ar);
         if (ret)
-                return;
+                return ret;
 
-        for (ce_id = 0; ce_id < ar_pci->ce_count; ce_id++) {
-                struct ath10k_ce_pipe *ce_state = &ar_pci->ce_states[ce_id];
-                u32 ctrl_addr = ce_state->ctrl_addr;
+        for (ce_id = 0; ce_id < CE_COUNT; ce_id++) {
+                u32 ctrl_addr = ath10k_ce_base_address(ce_id);
 
                 ath10k_ce_copy_complete_intr_disable(ar, ctrl_addr);
+                ath10k_ce_error_intr_disable(ar, ctrl_addr);
+                ath10k_ce_watermark_intr_disable(ar, ctrl_addr);
         }
+
         ath10k_pci_sleep(ar);
+
+        return 0;
 }
 
 void ath10k_ce_send_cb_register(struct ath10k_ce_pipe *ce_state,
@@ -1047,9 +1059,19 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                                 const struct ce_attr *attr)
 {
         struct ath10k_ce_pipe *ce_state;
-        u32 ctrl_addr = ath10k_ce_base_address(ce_id);
         int ret;
 
+        /*
+         * Make sure there's enough CE ringbuffer entries for HTT TX to avoid
+         * additional TX locking checks.
+         *
+         * For the lack of a better place do the check here.
+         */
+        BUILD_BUG_ON(TARGET_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+        BUILD_BUG_ON(TARGET_10X_NUM_MSDU_DESC >
+                     (CE_HTT_H2T_MSG_SRC_NENTRIES - 1));
+
         ret = ath10k_pci_wake(ar);
         if (ret)
                 return NULL;
@@ -1057,7 +1079,7 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
         ce_state = ath10k_ce_init_state(ar, ce_id, attr);
         if (!ce_state) {
                 ath10k_err("Failed to initialize CE state for ID: %d\n", ce_id);
-                return NULL;
+                goto out;
         }
 
         if (attr->src_nentries) {
@@ -1066,7 +1088,8 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                         ath10k_err("Failed to initialize CE src ring for ID: %d (%d)\n",
                                    ce_id, ret);
                         ath10k_ce_deinit(ce_state);
-                        return NULL;
+                        ce_state = NULL;
+                        goto out;
                 }
         }
 
@@ -1076,15 +1099,13 @@ struct ath10k_ce_pipe *ath10k_ce_init(struct ath10k *ar,
                         ath10k_err("Failed to initialize CE dest ring for ID: %d (%d)\n",
                                    ce_id, ret);
                         ath10k_ce_deinit(ce_state);
-                        return NULL;
+                        ce_state = NULL;
+                        goto out;
                 }
         }
 
-        /* Enable CE error interrupts */
-        ath10k_ce_error_intr_enable(ar, ctrl_addr);
-
+out:
         ath10k_pci_sleep(ar);
-
         return ce_state;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/ce.h b/drivers/net/wireless/ath/ath10k/ce.h
index 15d45b5b7615..67dbde6a5c74 100644
--- a/drivers/net/wireless/ath/ath10k/ce.h
+++ b/drivers/net/wireless/ath/ath10k/ce.h
@@ -234,7 +234,7 @@ void ath10k_ce_deinit(struct ath10k_ce_pipe *ce_state);
 /*==================CE Interrupt Handlers====================*/
 void ath10k_ce_per_engine_service_any(struct ath10k *ar);
 void ath10k_ce_per_engine_service(struct ath10k *ar, unsigned int ce_id);
-void ath10k_ce_disable_interrupts(struct ath10k *ar);
+int ath10k_ce_disable_interrupts(struct ath10k *ar);
 
 /* ce_attr.flags values */
 /* Use NonSnooping PCIe accesses? */
diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c
index 1129994fb105..3b59af3bddf4 100644
--- a/drivers/net/wireless/ath/ath10k/core.c
+++ b/drivers/net/wireless/ath/ath10k/core.c
@@ -597,10 +597,8 @@ static int ath10k_init_uart(struct ath10k *ar)
                 return ret;
         }
 
-        if (!uart_print) {
-                ath10k_info("UART prints disabled\n");
+        if (!uart_print)
                 return 0;
-        }
 
         ret = ath10k_bmi_write32(ar, hi_dbg_uart_txpin, 7);
         if (ret) {
@@ -645,8 +643,8 @@ static int ath10k_init_hw_params(struct ath10k *ar)
 
         ar->hw_params = *hw_params;
 
-        ath10k_info("Hardware name %s version 0x%x\n",
-                    ar->hw_params.name, ar->target_version);
+        ath10k_dbg(ATH10K_DBG_BOOT, "Hardware name %s version 0x%x\n",
+                   ar->hw_params.name, ar->target_version);
 
         return 0;
 }
@@ -664,7 +662,8 @@ static void ath10k_core_restart(struct work_struct *work)
                 ieee80211_restart_hw(ar->hw);
                 break;
         case ATH10K_STATE_OFF:
-                /* this can happen if driver is being unloaded */
+                /* this can happen if driver is being unloaded
+                 * or if the crash happens during FW probing */
                 ath10k_warn("cannot restart a device that hasn't been started\n");
                 break;
         case ATH10K_STATE_RESTARTING:
@@ -737,8 +736,6 @@ EXPORT_SYMBOL(ath10k_core_create);
 
 void ath10k_core_destroy(struct ath10k *ar)
 {
-        ath10k_debug_destroy(ar);
-
         flush_workqueue(ar->workqueue);
         destroy_workqueue(ar->workqueue);
 
@@ -786,21 +783,30 @@ int ath10k_core_start(struct ath10k *ar)
                 goto err;
         }
 
-        status = ath10k_htc_wait_target(&ar->htc);
-        if (status)
+        status = ath10k_hif_start(ar);
+        if (status) {
+                ath10k_err("could not start HIF: %d\n", status);
                 goto err_wmi_detach;
+        }
+
+        status = ath10k_htc_wait_target(&ar->htc);
+        if (status) {
+                ath10k_err("failed to connect to HTC: %d\n", status);
+                goto err_hif_stop;
+        }
 
         status = ath10k_htt_attach(ar);
         if (status) {
                 ath10k_err("could not attach htt (%d)\n", status);
-                goto err_wmi_detach;
+                goto err_hif_stop;
         }
 
         status = ath10k_init_connect_htc(ar);
         if (status)
                 goto err_htt_detach;
 
-        ath10k_info("firmware %s booted\n", ar->hw->wiphy->fw_version);
+        ath10k_dbg(ATH10K_DBG_BOOT, "firmware %s booted\n",
+                   ar->hw->wiphy->fw_version);
 
         status = ath10k_wmi_cmd_init(ar);
         if (status) {
@@ -826,12 +832,23 @@ int ath10k_core_start(struct ath10k *ar)
         ar->free_vdev_map = (1 << TARGET_NUM_VDEVS) - 1;
         INIT_LIST_HEAD(&ar->arvifs);
 
+        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
+                ath10k_info("%s (0x%x) fw %s api %d htt %d.%d\n",
+                            ar->hw_params.name, ar->target_version,
+                            ar->hw->wiphy->fw_version, ar->fw_api,
+                            ar->htt.target_version_major,
+                            ar->htt.target_version_minor);
+
+        __set_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags);
+
         return 0;
 
 err_disconnect_htc:
         ath10k_htc_stop(&ar->htc);
 err_htt_detach:
         ath10k_htt_detach(&ar->htt);
+err_hif_stop:
+        ath10k_hif_stop(ar);
 err_wmi_detach:
         ath10k_wmi_detach(ar);
 err:
@@ -985,6 +1002,8 @@ void ath10k_core_unregister(struct ath10k *ar)
         ath10k_mac_unregister(ar);
 
         ath10k_core_free_firmware_files(ar);
+
+        ath10k_debug_destroy(ar);
 }
 EXPORT_SYMBOL(ath10k_core_unregister);
 
diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h
index 0934f7633de3..ade1781c7186 100644
--- a/drivers/net/wireless/ath/ath10k/core.h
+++ b/drivers/net/wireless/ath/ath10k/core.h
@@ -30,6 +30,7 @@
 #include "wmi.h"
 #include "../ath.h"
 #include "../regd.h"
+#include "../dfs_pattern_detector.h"
 
 #define MS(_v, _f) (((_v) & _f##_MASK) >> _f##_LSB)
 #define SM(_v, _f) (((_v) << _f##_LSB) & _f##_MASK)
@@ -43,7 +44,7 @@
 /* Antenna noise floor */
 #define ATH10K_DEFAULT_NOISE_FLOOR -95
 
-#define ATH10K_MAX_NUM_MGMT_PENDING 16
+#define ATH10K_MAX_NUM_MGMT_PENDING 128
 
 struct ath10k;
 
@@ -192,6 +193,14 @@ struct ath10k_target_stats {
 
 };
 
+struct ath10k_dfs_stats {
+        u32 phy_errors;
+        u32 pulses_total;
+        u32 pulses_detected;
+        u32 pulses_discarded;
+        u32 radar_detected;
+};
+
 #define ATH10K_MAX_NUM_PEER_IDS (1 << 11) /* htt rx_desc limit */
 
 struct ath10k_peer {
@@ -244,6 +253,9 @@ struct ath10k_vif {
                         u8 bssid[ETH_ALEN];
                 } ibss;
         } u;
+
+        u8 fixed_rate;
+        u8 fixed_nss;
 };
 
 struct ath10k_vif_iter {
@@ -261,6 +273,10 @@ struct ath10k_debug {
 
         unsigned long htt_stats_mask;
         struct delayed_work htt_stats_dwork;
+        struct ath10k_dfs_stats dfs_stats;
+        struct ath_dfs_pool_stats dfs_pool_stats;
+
+        u32 fw_dbglog_mask;
 };
 
 enum ath10k_state {
@@ -295,10 +311,19 @@ enum ath10k_fw_features {
         /* firmware support tx frame management over WMI, otherwise it's HTT */
         ATH10K_FW_FEATURE_HAS_WMI_MGMT_TX = 2,
 
+        /* Firmware does not support P2P */
+        ATH10K_FW_FEATURE_NO_P2P = 3,
+
         /* keep last */
         ATH10K_FW_FEATURE_COUNT,
 };
 
+enum ath10k_dev_flags {
+        /* Indicates that ath10k device is during CAC phase of DFS */
+        ATH10K_CAC_RUNNING,
+        ATH10K_FLAG_FIRST_BOOT_DONE,
+};
+
 struct ath10k {
         struct ath_common ath_common;
         struct ieee80211_hw *hw;
@@ -392,6 +417,8 @@ struct ath10k {
         bool monitor_enabled;
         bool monitor_present;
         unsigned int filter_flags;
+        unsigned long dev_flags;
+        u32 dfs_block_radar_events;
 
         struct wmi_pdev_set_wmm_params_arg wmm_params;
         struct completion install_key_done;
@@ -410,6 +437,9 @@ struct ath10k {
         struct list_head peers;
         wait_queue_head_t peer_mapping_wq;
 
+        /* number of created peers; protected by data_lock */
+        int num_peers;
+
         struct work_struct offchan_tx_work;
         struct sk_buff_head offchan_tx_queue;
         struct completion offchan_tx_completed;
@@ -428,6 +458,8 @@ struct ath10k {
         u32 survey_last_cycle_count;
         struct survey_info survey[ATH10K_NUM_CHANS];
 
+        struct dfs_pattern_detector *dfs_detector;
+
 #ifdef CONFIG_ATH10K_DEBUGFS
         struct ath10k_debug debug;
 #endif
diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c
index 760ff2289e3c..6debd281350a 100644
--- a/drivers/net/wireless/ath/ath10k/debug.c
+++ b/drivers/net/wireless/ath/ath10k/debug.c
@@ -614,6 +614,61 @@ static const struct file_operations fops_htt_stats_mask = {
         .llseek = default_llseek,
 };
 
+static ssize_t ath10k_read_fw_dbglog(struct file *file,
+                                            char __user *user_buf,
+                                            size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned int len;
+        char buf[32];
+
+        len = scnprintf(buf, sizeof(buf), "0x%08x\n",
+                        ar->debug.fw_dbglog_mask);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t ath10k_write_fw_dbglog(struct file *file,
+                                      const char __user *user_buf,
+                                      size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+        unsigned long mask;
+        int ret;
+
+        ret = kstrtoul_from_user(user_buf, count, 0, &mask);
+        if (ret)
+                return ret;
+
+        mutex_lock(&ar->conf_mutex);
+
+        ar->debug.fw_dbglog_mask = mask;
+
+        if (ar->state == ATH10K_STATE_ON) {
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                if (ret) {
+                        ath10k_warn("dbglog cfg failed from debugfs: %d\n",
+                                    ret);
+                        goto exit;
+                }
+        }
+
+        ret = count;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+
+        return ret;
+}
+
+static const struct file_operations fops_fw_dbglog = {
+        .read = ath10k_read_fw_dbglog,
+        .write = ath10k_write_fw_dbglog,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_start(struct ath10k *ar)
 {
         int ret;
@@ -625,6 +680,14 @@ int ath10k_debug_start(struct ath10k *ar)
                 /* continue normally anyway, this isn't serious */
                 ath10k_warn("failed to start htt stats workqueue: %d\n", ret);
 
+        if (ar->debug.fw_dbglog_mask) {
+                ret = ath10k_wmi_dbglog_cfg(ar, ar->debug.fw_dbglog_mask);
+                if (ret)
+                        /* not serious */
+                        ath10k_warn("failed to enable dbglog during start: %d",
+                                    ret);
+        }
+
         return 0;
 }
 
@@ -639,6 +702,86 @@ void ath10k_debug_stop(struct ath10k *ar)
                 cancel_delayed_work(&ar->debug.htt_stats_dwork);
 }
 
+static ssize_t ath10k_write_simulate_radar(struct file *file,
+                                           const char __user *user_buf,
+                                           size_t count, loff_t *ppos)
+{
+        struct ath10k *ar = file->private_data;
+
+        ieee80211_radar_detected(ar->hw);
+
+        return count;
+}
+
+static const struct file_operations fops_simulate_radar = {
+        .write = ath10k_write_simulate_radar,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+#define ATH10K_DFS_STAT(s, p) (\
+        len += scnprintf(buf + len, size - len, "%-28s : %10u\n", s, \
+                         ar->debug.dfs_stats.p))
+
+#define ATH10K_DFS_POOL_STAT(s, p) (\
+        len += scnprintf(buf + len, size - len, "%-28s : %10u\n", s, \
+                         ar->debug.dfs_pool_stats.p))
+
+static ssize_t ath10k_read_dfs_stats(struct file *file, char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        int retval = 0, len = 0;
+        const int size = 8000;
+        struct ath10k *ar = file->private_data;
+        char *buf;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        if (!ar->dfs_detector) {
+                len += scnprintf(buf + len, size - len, "DFS not enabled\n");
+                goto exit;
+        }
+
+        ar->debug.dfs_pool_stats =
+                        ar->dfs_detector->get_stats(ar->dfs_detector);
+
+        len += scnprintf(buf + len, size - len, "Pulse detector statistics:\n");
+
+        ATH10K_DFS_STAT("reported phy errors", phy_errors);
+        ATH10K_DFS_STAT("pulse events reported", pulses_total);
+        ATH10K_DFS_STAT("DFS pulses detected", pulses_detected);
+        ATH10K_DFS_STAT("DFS pulses discarded", pulses_discarded);
+        ATH10K_DFS_STAT("Radars detected", radar_detected);
+
+        len += scnprintf(buf + len, size - len, "Global Pool statistics:\n");
+        ATH10K_DFS_POOL_STAT("Pool references", pool_reference);
+        ATH10K_DFS_POOL_STAT("Pulses allocated", pulse_allocated);
+        ATH10K_DFS_POOL_STAT("Pulses alloc error", pulse_alloc_error);
+        ATH10K_DFS_POOL_STAT("Pulses in use", pulse_used);
+        ATH10K_DFS_POOL_STAT("Seqs. allocated", pseq_allocated);
+        ATH10K_DFS_POOL_STAT("Seqs. alloc error", pseq_alloc_error);
+        ATH10K_DFS_POOL_STAT("Seqs. in use", pseq_used);
+
+exit:
+        if (len > size)
+                len = size;
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_dfs_stats = {
+        .read = ath10k_read_dfs_stats,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
 int ath10k_debug_create(struct ath10k *ar)
 {
         ar->debug.debugfs_phy = debugfs_create_dir("ath10k",
@@ -667,6 +810,23 @@ int ath10k_debug_create(struct ath10k *ar)
         debugfs_create_file("htt_stats_mask", S_IRUSR, ar->debug.debugfs_phy,
                             ar, &fops_htt_stats_mask);
 
+        debugfs_create_file("fw_dbglog", S_IRUSR, ar->debug.debugfs_phy,
+                            ar, &fops_fw_dbglog);
+
+        if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
+                debugfs_create_file("dfs_simulate_radar", S_IWUSR,
+                                    ar->debug.debugfs_phy, ar,
+                                    &fops_simulate_radar);
+
+                debugfs_create_bool("dfs_block_radar_events", S_IWUSR,
+                                    ar->debug.debugfs_phy,
+                                    &ar->dfs_block_radar_events);
+
+                debugfs_create_file("dfs_stats", S_IRUSR,
+                                    ar->debug.debugfs_phy, ar,
+                                    &fops_dfs_stats);
+        }
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/ath/ath10k/debug.h b/drivers/net/wireless/ath/ath10k/debug.h
index 3cfe3ee90dbe..1773c36c71a0 100644
--- a/drivers/net/wireless/ath/ath10k/debug.h
+++ b/drivers/net/wireless/ath/ath10k/debug.h
@@ -33,6 +33,7 @@ enum ath10k_debug_mask {
         ATH10K_DBG_MGMT         = 0x00000100,
         ATH10K_DBG_DATA         = 0x00000200,
         ATH10K_DBG_BMI          = 0x00000400,
+        ATH10K_DBG_REGULATORY   = 0x00000800,
         ATH10K_DBG_ANY          = 0xffffffff,
 };
 
@@ -53,6 +54,8 @@ void ath10k_debug_read_service_map(struct ath10k *ar,
 void ath10k_debug_read_target_stats(struct ath10k *ar,
                                     struct wmi_stats_event *ev);
 
+#define ATH10K_DFS_STAT_INC(ar, c) (ar->debug.dfs_stats.c++)
+
 #else
 static inline int ath10k_debug_start(struct ath10k *ar)
 {
@@ -82,6 +85,9 @@ static inline void ath10k_debug_read_target_stats(struct ath10k *ar,
                                                   struct wmi_stats_event *ev)
 {
 }
+
+#define ATH10K_DFS_STAT_INC(ar, c) do { } while (0)
+
 #endif /* CONFIG_ATH10K_DEBUGFS */
 
 #ifdef CONFIG_ATH10K_DEBUG
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index edae50b52806..edc57ab505c8 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -191,6 +191,11 @@ static int ath10k_htc_tx_completion_handler(struct ath10k *ar,
         struct ath10k_htc *htc = &ar->htc;
         struct ath10k_htc_ep *ep = &htc->endpoint[eid];
 
+        if (!skb) {
+                ath10k_warn("invalid sk_buff completion - NULL pointer. firmware crashed?\n");
+                return 0;
+        }
+
         ath10k_htc_notify_tx_completion(ep, skb);
         /* the skb now belongs to the completion handler */
 
@@ -534,14 +539,6 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
         u16 credit_count;
         u16 credit_size;
 
-        reinit_completion(&htc->ctl_resp);
-
-        status = ath10k_hif_start(htc->ar);
-        if (status) {
-                ath10k_err("could not start HIF (%d)\n", status);
-                goto err_start;
-        }
-
         status = wait_for_completion_timeout(&htc->ctl_resp,
                                              ATH10K_HTC_WAIT_TIMEOUT_HZ);
         if (status <= 0) {
@@ -549,15 +546,13 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
                         status = -ETIMEDOUT;
 
                 ath10k_err("ctl_resp never came in (%d)\n", status);
-                goto err_target;
+                return status;
         }
 
         if (htc->control_resp_len < sizeof(msg->hdr) + sizeof(msg->ready)) {
                 ath10k_err("Invalid HTC ready msg len:%d\n",
                            htc->control_resp_len);
-
-                status = -ECOMM;
-                goto err_target;
+                return -ECOMM;
         }
 
         msg = (struct ath10k_htc_msg *)htc->control_resp_buffer;
@@ -567,8 +562,7 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
 
         if (message_id != ATH10K_HTC_MSG_READY_ID) {
                 ath10k_err("Invalid HTC ready msg: 0x%x\n", message_id);
-                status = -ECOMM;
-                goto err_target;
+                return -ECOMM;
         }
 
         htc->total_transmit_credits = credit_count;
@@ -581,9 +575,8 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
 
         if ((htc->total_transmit_credits == 0) ||
             (htc->target_credit_size == 0)) {
-                status = -ECOMM;
                 ath10k_err("Invalid credit size received\n");
-                goto err_target;
+                return -ECOMM;
         }
 
         ath10k_htc_setup_target_buffer_assignments(htc);
@@ -600,14 +593,10 @@ int ath10k_htc_wait_target(struct ath10k_htc *htc)
         status = ath10k_htc_connect_service(htc, &conn_req, &conn_resp);
         if (status) {
                 ath10k_err("could not connect to htc service (%d)\n", status);
-                goto err_target;
+                return status;
         }
 
         return 0;
-err_target:
-        ath10k_hif_stop(htc->ar);
-err_start:
-        return status;
 }
 
 int ath10k_htc_connect_service(struct ath10k_htc *htc,
diff --git a/drivers/net/wireless/ath/ath10k/htt.c b/drivers/net/wireless/ath/ath10k/htt.c
index 5f7eeebc5432..69697af59ce0 100644
--- a/drivers/net/wireless/ath/ath10k/htt.c
+++ b/drivers/net/wireless/ath/ath10k/htt.c
@@ -104,8 +104,8 @@ err_htc_attach:
 
 static int ath10k_htt_verify_version(struct ath10k_htt *htt)
 {
-        ath10k_info("htt target version %d.%d\n",
-                    htt->target_version_major, htt->target_version_minor);
+        ath10k_dbg(ATH10K_DBG_BOOT, "htt target version %d.%d\n",
+                   htt->target_version_major, htt->target_version_minor);
 
         if (htt->target_version_major != 2 &&
             htt->target_version_major != 3) {
diff --git a/drivers/net/wireless/ath/ath10k/htt.h b/drivers/net/wireless/ath/ath10k/htt.h
index 1a337e93b7e9..b93ae355bc08 100644
--- a/drivers/net/wireless/ath/ath10k/htt.h
+++ b/drivers/net/wireless/ath/ath10k/htt.h
@@ -1182,6 +1182,8 @@ struct htt_rx_info {
                 u32 info2;
         } rate;
         bool fcs_err;
+        bool amsdu_more;
+        bool mic_err;
 };
 
 struct ath10k_htt {
diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
index 90d4f74c28d7..fe8bd1b59f0e 100644
--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
@@ -659,23 +659,6 @@ static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
         memcpy(hdr_buf, hdr, hdr_len);
         hdr = (struct ieee80211_hdr *)hdr_buf;
 
-        /* FIXME: Hopefully this is a temporary measure.
-         *
-         * Reporting individual A-MSDU subframes means each reported frame
-         * shares the same sequence number.
-         *
-         * mac80211 drops frames it recognizes as duplicates, i.e.
-         * retransmission flag is set and sequence number matches sequence
-         * number from a previous frame (as per IEEE 802.11-2012: 9.3.2.10
-         * "Duplicate detection and recovery")
-         *
-         * To avoid frames being dropped clear retransmission flag for all
-         * received A-MSDUs.
-         *
-         * Worst case: actual duplicate frames will be reported but this should
-         * still be handled gracefully by other OSI/ISO layers. */
-        hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_RETRY);
-
         first = skb;
         while (skb) {
                 void *decap_hdr;
@@ -746,6 +729,9 @@ static void ath10k_htt_rx_amsdu(struct ath10k_htt *htt,
                 skb = skb->next;
                 info->skb->next = NULL;
 
+                if (skb)
+                        info->amsdu_more = true;
+
                 ath10k_process_rx(htt->ar, info);
         }
 
@@ -852,6 +838,20 @@ static bool ath10k_htt_rx_has_fcs_err(struct sk_buff *skb)
         return false;
 }
 
+static bool ath10k_htt_rx_has_mic_err(struct sk_buff *skb)
+{
+        struct htt_rx_desc *rxd;
+        u32 flags;
+
+        rxd = (void *)skb->data - sizeof(*rxd);
+        flags = __le32_to_cpu(rxd->attention.flags);
+
+        if (flags & RX_ATTENTION_FLAGS_TKIP_MIC_ERR)
+                return true;
+
+        return false;
+}
+
 static int ath10k_htt_rx_get_csum_state(struct sk_buff *skb)
 {
         struct htt_rx_desc *rxd;
@@ -959,6 +959,11 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
                                 continue;
                         }
 
+                        if (test_bit(ATH10K_CAC_RUNNING, &htt->ar->dev_flags)) {
+                                ath10k_htt_rx_free_msdu_chain(msdu_head);
+                                continue;
+                        }
+
                         /* FIXME: we do not support chaining yet.
                          * this needs investigation */
                         if (msdu_chaining) {
@@ -969,6 +974,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt,
 
                         info.skb     = msdu_head;
                         info.fcs_err = ath10k_htt_rx_has_fcs_err(msdu_head);
+                        info.mic_err = ath10k_htt_rx_has_mic_err(msdu_head);
                         info.signal  = ATH10K_DEFAULT_NOISE_FLOOR;
                         info.signal += rx->ppdu.combined_rssi;
 
diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c
index d9335e9d0d04..f1d36d2d2723 100644
--- a/drivers/net/wireless/ath/ath10k/htt_tx.c
+++ b/drivers/net/wireless/ath/ath10k/htt_tx.c
@@ -85,16 +85,13 @@ void ath10k_htt_tx_free_msdu_id(struct ath10k_htt *htt, u16 msdu_id)
 
 int ath10k_htt_tx_attach(struct ath10k_htt *htt)
 {
-        u8 pipe;
-
         spin_lock_init(&htt->tx_lock);
         init_waitqueue_head(&htt->empty_tx_wq);
 
-        /* At the beginning free queue number should hint us the maximum
-         * queue length */
-        pipe = htt->ar->htc.endpoint[htt->eid].ul_pipe_id;
-        htt->max_num_pending_tx = ath10k_hif_get_free_queue_number(htt->ar,
-                                                                   pipe);
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, htt->ar->fw_features))
+                htt->max_num_pending_tx = TARGET_10X_NUM_MSDU_DESC;
+        else
+                htt->max_num_pending_tx = TARGET_NUM_MSDU_DESC;
 
         ath10k_dbg(ATH10K_DBG_BOOT, "htt tx max num pending tx %d\n",
                    htt->max_num_pending_tx);
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 8aeb46d9b534..f1505a25d810 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -115,6 +115,7 @@ enum ath10k_mcast2ucast_mode {
 #define TARGET_10X_MAC_AGGR_DELIM               0
 #define TARGET_10X_AST_SKID_LIMIT               16
 #define TARGET_10X_NUM_PEERS                    (128 + (TARGET_10X_NUM_VDEVS))
+#define TARGET_10X_NUM_PEERS_MAX                128
 #define TARGET_10X_NUM_OFFLOAD_PEERS            0
 #define TARGET_10X_NUM_OFFLOAD_REORDER_BUFS     0
 #define TARGET_10X_NUM_PEER_KEYS                2
@@ -269,6 +270,7 @@ enum ath10k_mcast2ucast_mode {
 #define CORE_CTRL_CPU_INTR_MASK                 0x00002000
 #define CORE_CTRL_ADDRESS                       0x0000
 #define PCIE_INTR_ENABLE_ADDRESS                0x0008
+#define PCIE_INTR_CAUSE_ADDRESS                 0x000c
 #define PCIE_INTR_CLR_ADDRESS                   0x0014
 #define SCRATCH_3_ADDRESS                       0x0030
 
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 97ac8c87cba2..776e364eadcd 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -322,12 +322,19 @@ static int ath10k_peer_create(struct ath10k *ar, u32 vdev_id, const u8 *addr)
         lockdep_assert_held(&ar->conf_mutex);
 
         ret = ath10k_wmi_peer_create(ar, vdev_id, addr);
-        if (ret)
+        if (ret) {
+                ath10k_warn("Failed to create wmi peer: %i\n", ret);
                 return ret;
+        }
 
         ret = ath10k_wait_for_peer_created(ar, vdev_id, addr);
-        if (ret)
+        if (ret) {
+                ath10k_warn("Failed to wait for created wmi peer: %i\n", ret);
                 return ret;
+        }
+        spin_lock_bh(&ar->data_lock);
+        ar->num_peers++;
+        spin_unlock_bh(&ar->data_lock);
 
         return 0;
 }
@@ -373,6 +380,10 @@ static int ath10k_peer_delete(struct ath10k *ar, u32 vdev_id, const u8 *addr)
         if (ret)
                 return ret;
 
+        spin_lock_bh(&ar->data_lock);
+        ar->num_peers--;
+        spin_unlock_bh(&ar->data_lock);
+
         return 0;
 }
 
@@ -392,6 +403,7 @@ static void ath10k_peer_cleanup(struct ath10k *ar, u32 vdev_id)
 
                 list_del(&peer->list);
                 kfree(peer);
+                ar->num_peers--;
         }
         spin_unlock_bh(&ar->data_lock);
 }
@@ -407,6 +419,7 @@ static void ath10k_peer_cleanup_all(struct ath10k *ar)
                 list_del(&peer->list);
                 kfree(peer);
         }
+        ar->num_peers = 0;
         spin_unlock_bh(&ar->data_lock);
 }
 
@@ -450,15 +463,19 @@ static int ath10k_vdev_start(struct ath10k_vif *arvif)
 
         arg.channel.mode = chan_to_phymode(&conf->chandef);
 
-        arg.channel.min_power = channel->max_power * 3;
-        arg.channel.max_power = channel->max_power * 4;
-        arg.channel.max_reg_power = channel->max_reg_power * 4;
-        arg.channel.max_antenna_gain = channel->max_antenna_gain;
+        arg.channel.min_power = 0;
+        arg.channel.max_power = channel->max_power * 2;
+        arg.channel.max_reg_power = channel->max_reg_power * 2;
+        arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_AP) {
                 arg.ssid = arvif->u.ap.ssid;
                 arg.ssid_len = arvif->u.ap.ssid_len;
                 arg.hidden_ssid = arvif->u.ap.hidden_ssid;
+
+                /* For now allow DFS for AP mode */
+                arg.channel.chan_radar =
+                        !!(channel->flags & IEEE80211_CHAN_RADAR);
         } else if (arvif->vdev_type == WMI_VDEV_TYPE_IBSS) {
                 arg.ssid = arvif->vif->bss_conf.ssid;
                 arg.ssid_len = arvif->vif->bss_conf.ssid_len;
@@ -516,6 +533,11 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        if (!ar->monitor_present) {
+                ath10k_warn("mac montor stop -- monitor is not present\n");
+                return -EINVAL;
+        }
+
         arg.vdev_id = vdev_id;
         arg.channel.freq = channel->center_freq;
         arg.channel.band_center_freq1 = ar->hw->conf.chandef.center_freq1;
@@ -523,11 +545,13 @@ static int ath10k_monitor_start(struct ath10k *ar, int vdev_id)
         /* TODO setup this dynamically, what in case we
            don't have any vifs? */
         arg.channel.mode = chan_to_phymode(&ar->hw->conf.chandef);
+        arg.channel.chan_radar =
+                        !!(channel->flags & IEEE80211_CHAN_RADAR);
 
-        arg.channel.min_power = channel->max_power * 3;
-        arg.channel.max_power = channel->max_power * 4;
-        arg.channel.max_reg_power = channel->max_reg_power * 4;
-        arg.channel.max_antenna_gain = channel->max_antenna_gain;
+        arg.channel.min_power = 0;
+        arg.channel.max_power = channel->max_power * 2;
+        arg.channel.max_reg_power = channel->max_reg_power * 2;
+        arg.channel.max_antenna_gain = channel->max_antenna_gain * 2;
 
         ret = ath10k_wmi_vdev_start(ar, &arg);
         if (ret) {
@@ -566,6 +590,16 @@ static int ath10k_monitor_stop(struct ath10k *ar)
 
         lockdep_assert_held(&ar->conf_mutex);
 
+        if (!ar->monitor_present) {
+                ath10k_warn("mac montor stop -- monitor is not present\n");
+                return -EINVAL;
+        }
+
+        if (!ar->monitor_enabled) {
+                ath10k_warn("mac montor stop -- monitor is not enabled\n");
+                return -EINVAL;
+        }
+
         ret = ath10k_wmi_vdev_down(ar, ar->monitor_vdev_id);
         if (ret)
                 ath10k_warn("Monitor vdev down failed: %d\n", ret);
@@ -647,6 +681,107 @@ static int ath10k_monitor_destroy(struct ath10k *ar)
         return ret;
 }
 
+static int ath10k_start_cac(struct ath10k *ar)
+{
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        set_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+
+        ret = ath10k_monitor_create(ar);
+        if (ret) {
+                clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+                return ret;
+        }
+
+        ret = ath10k_monitor_start(ar, ar->monitor_vdev_id);
+        if (ret) {
+                clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+                ath10k_monitor_destroy(ar);
+                return ret;
+        }
+
+        ath10k_dbg(ATH10K_DBG_MAC, "mac cac start monitor vdev %d\n",
+                   ar->monitor_vdev_id);
+
+        return 0;
+}
+
+static int ath10k_stop_cac(struct ath10k *ar)
+{
+        lockdep_assert_held(&ar->conf_mutex);
+
+        /* CAC is not running - do nothing */
+        if (!test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags))
+                return 0;
+
+        ath10k_monitor_stop(ar);
+        ath10k_monitor_destroy(ar);
+        clear_bit(ATH10K_CAC_RUNNING, &ar->dev_flags);
+
+        ath10k_dbg(ATH10K_DBG_MAC, "mac cac finished\n");
+
+        return 0;
+}
+
+static const char *ath10k_dfs_state(enum nl80211_dfs_state dfs_state)
+{
+        switch (dfs_state) {
+        case NL80211_DFS_USABLE:
+                return "USABLE";
+        case NL80211_DFS_UNAVAILABLE:
+                return "UNAVAILABLE";
+        case NL80211_DFS_AVAILABLE:
+                return "AVAILABLE";
+        default:
+                WARN_ON(1);
+                return "bug";
+        }
+}
+
+static void ath10k_config_radar_detection(struct ath10k *ar)
+{
+        struct ieee80211_channel *chan = ar->hw->conf.chandef.chan;
+        bool radar = ar->hw->conf.radar_enabled;
+        bool chan_radar = !!(chan->flags & IEEE80211_CHAN_RADAR);
+        enum nl80211_dfs_state dfs_state = chan->dfs_state;
+        int ret;
+
+        lockdep_assert_held(&ar->conf_mutex);
+
+        ath10k_dbg(ATH10K_DBG_MAC,
+                   "mac radar config update: chan %dMHz radar %d chan radar %d chan state %s\n",
+                   chan->center_freq, radar, chan_radar,
+                   ath10k_dfs_state(dfs_state));
+
+        /*
+         * It's safe to call it even if CAC is not started.
+         * This call here guarantees changing channel, etc. will stop CAC.
+         */
+        ath10k_stop_cac(ar);
+
+        if (!radar)
+                return;
+
+        if (!chan_radar)
+                return;
+
+        if (dfs_state != NL80211_DFS_USABLE)
+                return;
+
+        ret = ath10k_start_cac(ar);
+        if (ret) {
+                /*
+                 * Not possible to start CAC on current channel so starting
+                 * radiation is not allowed, make this channel DFS_UNAVAILABLE
+                 * by indicating that radar was detected.
+                 */
+                ath10k_warn("failed to start CAC (%d)\n", ret);
+                ieee80211_radar_detected(ar->hw);
+        }
+}
+
 static void ath10k_control_beaconing(struct ath10k_vif *arvif,
                                 struct ieee80211_bss_conf *info)
 {
@@ -1351,19 +1486,22 @@ static int ath10k_update_channel_list(struct ath10k *ar)
                         ch->allow_vht = true;
 
                         ch->allow_ibss =
-                                !(channel->flags & IEEE80211_CHAN_NO_IBSS);
+                                !(channel->flags & IEEE80211_CHAN_NO_IR);
 
                         ch->ht40plus =
                                 !(channel->flags & IEEE80211_CHAN_NO_HT40PLUS);
 
-                        passive = channel->flags & IEEE80211_CHAN_PASSIVE_SCAN;
+                        ch->chan_radar =
+                                !!(channel->flags & IEEE80211_CHAN_RADAR);
+
+                        passive = channel->flags & IEEE80211_CHAN_NO_IR;
                         ch->passive = passive;
 
                         ch->freq = channel->center_freq;
-                        ch->min_power = channel->max_power * 3;
-                        ch->max_power = channel->max_power * 4;
-                        ch->max_reg_power = channel->max_reg_power * 4;
-                        ch->max_antenna_gain = channel->max_antenna_gain;
+                        ch->min_power = 0;
+                        ch->max_power = channel->max_power * 2;
+                        ch->max_reg_power = channel->max_reg_power * 2;
+                        ch->max_antenna_gain = channel->max_antenna_gain * 2;
                         ch->reg_class_id = 0; /* FIXME */
 
                         /* FIXME: why use only legacy modes, why not any
@@ -1423,9 +1561,20 @@ static void ath10k_reg_notifier(struct wiphy *wiphy,
 {
         struct ieee80211_hw *hw = wiphy_to_ieee80211_hw(wiphy);
         struct ath10k *ar = hw->priv;
+        bool result;
 
         ath_reg_notifier_apply(wiphy, request, &ar->ath_common.regulatory);
 
+        if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector) {
+                ath10k_dbg(ATH10K_DBG_REGULATORY, "dfs region 0x%x\n",
+                           request->dfs_region);
+                result = ar->dfs_detector->set_dfs_domain(ar->dfs_detector,
+                                                          request->dfs_region);
+                if (!result)
+                        ath10k_warn("dfs region 0x%X not supported, will trigger radar for every pulse\n",
+                                    request->dfs_region);
+        }
+
         mutex_lock(&ar->conf_mutex);
         if (ar->state == ATH10K_STATE_ON)
                 ath10k_regd_update(ar);
@@ -1714,8 +1863,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct *work)
                         break;
 
                 ret = ath10k_wmi_mgmt_tx(ar, skb);
-                if (ret)
+                if (ret) {
                         ath10k_warn("wmi mgmt_tx failed (%d)\n", ret);
+                        ieee80211_free_txskb(ar->hw, skb);
+                }
         }
 }
 
@@ -1889,6 +2040,7 @@ void ath10k_halt(struct ath10k *ar)
 {
         lockdep_assert_held(&ar->conf_mutex);
 
+        ath10k_stop_cac(ar);
         del_timer_sync(&ar->scan.timeout);
         ath10k_offchan_tx_purge(ar);
         ath10k_mgmt_over_wmi_tx_purge(ar);
@@ -1943,7 +2095,7 @@ static int ath10k_start(struct ieee80211_hw *hw)
                 ath10k_warn("could not enable WMI_PDEV_PARAM_PMF_QOS (%d)\n",
                             ret);
 
-        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 0);
+        ret = ath10k_wmi_pdev_set_param(ar, ar->wmi.pdev_param->dynamic_bw, 1);
         if (ret)
                 ath10k_warn("could not init WMI_PDEV_PARAM_DYNAMIC_BW (%d)\n",
                             ret);
@@ -1998,15 +2150,40 @@ static int ath10k_config(struct ieee80211_hw *hw, u32 changed)
         struct ath10k *ar = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
         int ret = 0;
+        u32 param;
 
         mutex_lock(&ar->conf_mutex);
 
         if (changed & IEEE80211_CONF_CHANGE_CHANNEL) {
-                ath10k_dbg(ATH10K_DBG_MAC, "mac config channel %d mhz\n",
-                           conf->chandef.chan->center_freq);
+                ath10k_dbg(ATH10K_DBG_MAC,
+                           "mac config channel %d mhz flags 0x%x\n",
+                           conf->chandef.chan->center_freq,
+                           conf->chandef.chan->flags);
+
                 spin_lock_bh(&ar->data_lock);
                 ar->rx_channel = conf->chandef.chan;
                 spin_unlock_bh(&ar->data_lock);
+
+                ath10k_config_radar_detection(ar);
+        }
+
+        if (changed & IEEE80211_CONF_CHANGE_POWER) {
+                ath10k_dbg(ATH10K_DBG_MAC, "mac config power %d\n",
+                           hw->conf.power_level);
+
+                param = ar->wmi.pdev_param->txpower_limit2g;
+                ret = ath10k_wmi_pdev_set_param(ar, param,
+                                                hw->conf.power_level * 2);
+                if (ret)
+                        ath10k_warn("mac failed to set 2g txpower %d (%d)\n",
+                                    hw->conf.power_level, ret);
+
+                param = ar->wmi.pdev_param->txpower_limit5g;
+                ret = ath10k_wmi_pdev_set_param(ar, param,
+                                                hw->conf.power_level * 2);
+                if (ret)
+                        ath10k_warn("mac failed to set 5g txpower %d (%d)\n",
+                                    hw->conf.power_level, ret);
         }
 
         if (changed & IEEE80211_CONF_CHANGE_PS)
@@ -2037,7 +2214,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
         enum wmi_sta_powersave_param param;
         int ret = 0;
-        u32 value;
+        u32 value, param_id;
         int bit;
         u32 vdev_param;
 
@@ -2049,6 +2226,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
         arvif->vif = vif;
 
         INIT_WORK(&arvif->wep_key_work, ath10k_tx_wep_key_work);
+        INIT_LIST_HEAD(&arvif->list);
 
         if ((vif->type == NL80211_IFTYPE_MONITOR) && ar->monitor_present) {
                 ath10k_warn("Only one monitor interface allowed\n");
@@ -2128,6 +2306,13 @@ static int ath10k_add_interface(struct ieee80211_hw *hw,
                         ath10k_warn("Failed to create peer for AP: %d\n", ret);
                         goto err_vdev_delete;
                 }
+
+                param_id = ar->wmi.pdev_param->sta_kickout_th;
+
+                /* Disable STA KICKOUT functionality in FW */
+                ret = ath10k_wmi_pdev_set_param(ar, param_id, 0);
+                if (ret)
+                        ath10k_warn("Failed to disable STA KICKOUT\n");
         }
 
         if (arvif->vdev_type == WMI_VDEV_TYPE_STA) {
@@ -2265,8 +2450,14 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
         *total_flags &= SUPPORTED_FILTERS;
         ar->filter_flags = *total_flags;
 
+        /* Monitor must not be started if it wasn't created first.
+         * Promiscuous mode may be started on a non-monitor interface - in
+         * such case the monitor vdev is not created so starting the
+         * monitor makes no sense. Since ath10k uses no special RX filters
+         * (only BSS filter in STA mode) there's no need for any special
+         * action here. */
         if ((ar->filter_flags & FIF_PROMISC_IN_BSS) &&
-            !ar->monitor_enabled) {
+            !ar->monitor_enabled && ar->monitor_present) {
                 ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d start\n",
                            ar->monitor_vdev_id);
 
@@ -2274,7 +2465,7 @@ static void ath10k_configure_filter(struct ieee80211_hw *hw,
                 if (ret)
                         ath10k_warn("Unable to start monitor mode\n");
         } else if (!(ar->filter_flags & FIF_PROMISC_IN_BSS) &&
-                   ar->monitor_enabled) {
+                   ar->monitor_enabled && ar->monitor_present) {
                 ath10k_dbg(ATH10K_DBG_MAC, "mac monitor %d stop\n",
                            ar->monitor_vdev_id);
 
@@ -2360,8 +2551,8 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw,
                         ret = ath10k_peer_create(ar, arvif->vdev_id,
                                                  info->bssid);
                         if (ret)
-                                ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
-                                            info->bssid, arvif->vdev_id);
+                                ath10k_warn("Failed to add peer %pM for vdev %d when changin bssid: %i\n",
+                                            info->bssid, arvif->vdev_id, ret);
 
                         if (vif->type == NL80211_IFTYPE_STATION) {
                                 /*
@@ -2542,6 +2733,44 @@ static void ath10k_cancel_hw_scan(struct ieee80211_hw *hw,
         mutex_unlock(&ar->conf_mutex);
 }
 
+static void ath10k_set_key_h_def_keyidx(struct ath10k *ar,
+                                        struct ath10k_vif *arvif,
+                                        enum set_key_cmd cmd,
+                                        struct ieee80211_key_conf *key)
+{
+        u32 vdev_param = arvif->ar->wmi.vdev_param->def_keyid;
+        int ret;
+
+        /* 10.1 firmware branch requires default key index to be set to group
+         * key index after installing it. Otherwise FW/HW Txes corrupted
+         * frames with multi-vif APs. This is not required for main firmware
+         * branch (e.g. 636).
+         *
+         * FIXME: This has been tested only in AP. It remains unknown if this
+         * is required for multi-vif STA interfaces on 10.1 */
+
+        if (arvif->vdev_type != WMI_VDEV_TYPE_AP)
+                return;
+
+        if (key->cipher == WLAN_CIPHER_SUITE_WEP40)
+                return;
+
+        if (key->cipher == WLAN_CIPHER_SUITE_WEP104)
+                return;
+
+        if (key->flags & IEEE80211_KEY_FLAG_PAIRWISE)
+                return;
+
+        if (cmd != SET_KEY)
+                return;
+
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param,
+                                        key->keyidx);
+        if (ret)
+                ath10k_warn("failed to set group key as default key: %d\n",
+                            ret);
+}
+
 static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                           struct ieee80211_vif *vif, struct ieee80211_sta *sta,
                           struct ieee80211_key_conf *key)
@@ -2603,6 +2832,8 @@ static int ath10k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 goto exit;
         }
 
+        ath10k_set_key_h_def_keyidx(ar, arvif, cmd, key);
+
         spin_lock_bh(&ar->data_lock);
         peer = ath10k_peer_find(ar, arvif->vdev_id, peer_addr);
         if (peer && cmd == SET_KEY)
@@ -2627,6 +2858,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
 {
         struct ath10k *ar = hw->priv;
         struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        int max_num_peers;
         int ret = 0;
 
         mutex_lock(&ar->conf_mutex);
@@ -2637,14 +2869,26 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                 /*
                  * New station addition.
                  */
+                if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features))
+                        max_num_peers = TARGET_10X_NUM_PEERS_MAX - 1;
+                else
+                        max_num_peers = TARGET_NUM_PEERS;
+
+                if (ar->num_peers >= max_num_peers) {
+                        ath10k_warn("Number of peers exceeded: peers number %d (max peers %d)\n",
+                                    ar->num_peers, max_num_peers);
+                        ret = -ENOBUFS;
+                        goto exit;
+                }
+
                 ath10k_dbg(ATH10K_DBG_MAC,
-                           "mac vdev %d peer create %pM (new sta)\n",
-                           arvif->vdev_id, sta->addr);
+                           "mac vdev %d peer create %pM (new sta) num_peers %d\n",
+                           arvif->vdev_id, sta->addr, ar->num_peers);
 
                 ret = ath10k_peer_create(ar, arvif->vdev_id, sta->addr);
                 if (ret)
-                        ath10k_warn("Failed to add peer: %pM for VDEV: %d\n",
-                                    sta->addr, arvif->vdev_id);
+                        ath10k_warn("Failed to add peer %pM for vdev %d when adding a new sta: %i\n",
+                                    sta->addr, arvif->vdev_id, ret);
         } else if ((old_state == IEEE80211_STA_NONE &&
                     new_state == IEEE80211_STA_NOTEXIST)) {
                 /*
@@ -2689,7 +2933,7 @@ static int ath10k_sta_state(struct ieee80211_hw *hw,
                         ath10k_warn("Failed to disassociate station: %pM\n",
                                     sta->addr);
         }
-
+exit:
         mutex_unlock(&ar->conf_mutex);
         return ret;
 }
@@ -3095,6 +3339,307 @@ exit:
         return ret;
 }
 
+/* Helper table for legacy fixed_rate/bitrate_mask */
+static const u8 cck_ofdm_rate[] = {
+        /* CCK */
+        3, /* 1Mbps */
+        2, /* 2Mbps */
+        1, /* 5.5Mbps */
+        0, /* 11Mbps */
+        /* OFDM */
+        3, /* 6Mbps */
+        7, /* 9Mbps */
+        2, /* 12Mbps */
+        6, /* 18Mbps */
+        1, /* 24Mbps */
+        5, /* 36Mbps */
+        0, /* 48Mbps */
+        4, /* 54Mbps */
+};
+
+/* Check if only one bit set */
+static int ath10k_check_single_mask(u32 mask)
+{
+        int bit;
+
+        bit = ffs(mask);
+        if (!bit)
+                return 0;
+
+        mask &= ~BIT(bit - 1);
+        if (mask)
+                return 2;
+
+        return 1;
+}
+
+static bool
+ath10k_default_bitrate_mask(struct ath10k *ar,
+                            enum ieee80211_band band,
+                            const struct cfg80211_bitrate_mask *mask)
+{
+        u32 legacy = 0x00ff;
+        u8 ht = 0xff, i;
+        u16 vht = 0x3ff;
+
+        switch (band) {
+        case IEEE80211_BAND_2GHZ:
+                legacy = 0x00fff;
+                vht = 0;
+                break;
+        case IEEE80211_BAND_5GHZ:
+                break;
+        default:
+                return false;
+        }
+
+        if (mask->control[band].legacy != legacy)
+                return false;
+
+        for (i = 0; i < ar->num_rf_chains; i++)
+                if (mask->control[band].ht_mcs[i] != ht)
+                        return false;
+
+        for (i = 0; i < ar->num_rf_chains; i++)
+                if (mask->control[band].vht_mcs[i] != vht)
+                        return false;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_nss(const struct cfg80211_bitrate_mask *mask,
+                        enum ieee80211_band band,
+                        u8 *fixed_nss)
+{
+        int ht_nss = 0, vht_nss = 0, i;
+
+        /* check legacy */
+        if (ath10k_check_single_mask(mask->control[band].legacy))
+                return false;
+
+        /* check HT */
+        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
+                if (mask->control[band].ht_mcs[i] == 0xff)
+                        continue;
+                else if (mask->control[band].ht_mcs[i] == 0x00)
+                        break;
+                else
+                        return false;
+        }
+
+        ht_nss = i;
+
+        /* check VHT */
+        for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
+                if (mask->control[band].vht_mcs[i] == 0x03ff)
+                        continue;
+                else if (mask->control[band].vht_mcs[i] == 0x0000)
+                        break;
+                else
+                        return false;
+        }
+
+        vht_nss = i;
+
+        if (ht_nss > 0 && vht_nss > 0)
+                return false;
+
+        if (ht_nss)
+                *fixed_nss = ht_nss;
+        else if (vht_nss)
+                *fixed_nss = vht_nss;
+        else
+                return false;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_correct(const struct cfg80211_bitrate_mask *mask,
+                            enum ieee80211_band band,
+                            enum wmi_rate_preamble *preamble)
+{
+        int legacy = 0, ht = 0, vht = 0, i;
+
+        *preamble = WMI_RATE_PREAMBLE_OFDM;
+
+        /* check legacy */
+        legacy = ath10k_check_single_mask(mask->control[band].legacy);
+        if (legacy > 1)
+                return false;
+
+        /* check HT */
+        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                ht += ath10k_check_single_mask(mask->control[band].ht_mcs[i]);
+        if (ht > 1)
+                return false;
+
+        /* check VHT */
+        for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
+                vht += ath10k_check_single_mask(mask->control[band].vht_mcs[i]);
+        if (vht > 1)
+                return false;
+
+        /* Currently we support only one fixed_rate */
+        if ((legacy + ht + vht) != 1)
+                return false;
+
+        if (ht)
+                *preamble = WMI_RATE_PREAMBLE_HT;
+        else if (vht)
+                *preamble = WMI_RATE_PREAMBLE_VHT;
+
+        return true;
+}
+
+static bool
+ath10k_bitrate_mask_rate(const struct cfg80211_bitrate_mask *mask,
+                         enum ieee80211_band band,
+                         u8 *fixed_rate,
+                         u8 *fixed_nss)
+{
+        u8 rate = 0, pream = 0, nss = 0, i;
+        enum wmi_rate_preamble preamble;
+
+        /* Check if single rate correct */
+        if (!ath10k_bitrate_mask_correct(mask, band, &preamble))
+                return false;
+
+        pream = preamble;
+
+        switch (preamble) {
+        case WMI_RATE_PREAMBLE_CCK:
+        case WMI_RATE_PREAMBLE_OFDM:
+                i = ffs(mask->control[band].legacy) - 1;
+
+                if (band == IEEE80211_BAND_2GHZ && i < 4)
+                        pream = WMI_RATE_PREAMBLE_CCK;
+
+                if (band == IEEE80211_BAND_5GHZ)
+                        i += 4;
+
+                if (i >= ARRAY_SIZE(cck_ofdm_rate))
+                        return false;
+
+                rate = cck_ofdm_rate[i];
+                break;
+        case WMI_RATE_PREAMBLE_HT:
+                for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
+                        if (mask->control[band].ht_mcs[i])
+                                break;
+
+                if (i == IEEE80211_HT_MCS_MASK_LEN)
+                        return false;
+
+                rate = ffs(mask->control[band].ht_mcs[i]) - 1;
+                nss = i;
+                break;
+        case WMI_RATE_PREAMBLE_VHT:
+                for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
+                        if (mask->control[band].vht_mcs[i])
+                                break;
+
+                if (i == NL80211_VHT_NSS_MAX)
+                        return false;
+
+                rate = ffs(mask->control[band].vht_mcs[i]) - 1;
+                nss = i;
+                break;
+        }
+
+        *fixed_nss = nss + 1;
+        nss <<= 4;
+        pream <<= 6;
+
+        ath10k_dbg(ATH10K_DBG_MAC, "mac fixed rate pream 0x%02x nss 0x%02x rate 0x%02x\n",
+                   pream, nss, rate);
+
+        *fixed_rate = pream | nss | rate;
+
+        return true;
+}
+
+static bool ath10k_get_fixed_rate_nss(const struct cfg80211_bitrate_mask *mask,
+                                      enum ieee80211_band band,
+                                      u8 *fixed_rate,
+                                      u8 *fixed_nss)
+{
+        /* First check full NSS mask, if we can simply limit NSS */
+        if (ath10k_bitrate_mask_nss(mask, band, fixed_nss))
+                return true;
+
+        /* Next Check single rate is set */
+        return ath10k_bitrate_mask_rate(mask, band, fixed_rate, fixed_nss);
+}
+
+static int ath10k_set_fixed_rate_param(struct ath10k_vif *arvif,
+                                       u8 fixed_rate,
+                                       u8 fixed_nss)
+{
+        struct ath10k *ar = arvif->ar;
+        u32 vdev_param;
+        int ret = 0;
+
+        mutex_lock(&ar->conf_mutex);
+
+        if (arvif->fixed_rate == fixed_rate &&
+            arvif->fixed_nss == fixed_nss)
+                goto exit;
+
+        if (fixed_rate == WMI_FIXED_RATE_NONE)
+                ath10k_dbg(ATH10K_DBG_MAC, "mac disable fixed bitrate mask\n");
+
+        vdev_param = ar->wmi.vdev_param->fixed_rate;
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+                                        vdev_param, fixed_rate);
+        if (ret) {
+                ath10k_warn("Could not set fixed_rate param 0x%02x: %d\n",
+                            fixed_rate, ret);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        arvif->fixed_rate = fixed_rate;
+
+        vdev_param = ar->wmi.vdev_param->nss;
+        ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id,
+                                        vdev_param, fixed_nss);
+
+        if (ret) {
+                ath10k_warn("Could not set fixed_nss param %d: %d\n",
+                            fixed_nss, ret);
+                ret = -EINVAL;
+                goto exit;
+        }
+
+        arvif->fixed_nss = fixed_nss;
+
+exit:
+        mutex_unlock(&ar->conf_mutex);
+        return ret;
+}
+
+static int ath10k_set_bitrate_mask(struct ieee80211_hw *hw,
+                                   struct ieee80211_vif *vif,
+                                   const struct cfg80211_bitrate_mask *mask)
+{
+        struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif);
+        struct ath10k *ar = arvif->ar;
+        enum ieee80211_band band = ar->hw->conf.chandef.chan->band;
+        u8 fixed_rate = WMI_FIXED_RATE_NONE;
+        u8 fixed_nss = ar->num_rf_chains;
+
+        if (!ath10k_default_bitrate_mask(ar, band, mask)) {
+                if (!ath10k_get_fixed_rate_nss(mask, band,
+                                               &fixed_rate,
+                                               &fixed_nss))
+                        return -EINVAL;
+        }
+
+        return ath10k_set_fixed_rate_param(arvif, fixed_rate, fixed_nss);
+}
+
 static const struct ieee80211_ops ath10k_ops = {
         .tx                             = ath10k_tx,
         .start                          = ath10k_start,
@@ -3117,6 +3662,7 @@ static const struct ieee80211_ops ath10k_ops = {
         .tx_last_beacon                 = ath10k_tx_last_beacon,
         .restart_complete               = ath10k_restart_complete,
         .get_survey                     = ath10k_get_survey,
+        .set_bitrate_mask               = ath10k_set_bitrate_mask,
 #ifdef CONFIG_PM
         .suspend                        = ath10k_suspend,
         .resume                         = ath10k_resume,
@@ -3249,12 +3795,37 @@ static const struct ieee80211_iface_limit ath10k_if_limits[] = {
         },
 };
 
-static const struct ieee80211_iface_combination ath10k_if_comb = {
-        .limits = ath10k_if_limits,
-        .n_limits = ARRAY_SIZE(ath10k_if_limits),
-        .max_interfaces = 8,
-        .num_different_channels = 1,
-        .beacon_int_infra_match = true,
+static const struct ieee80211_iface_limit ath10k_10x_if_limits[] = {
+        {
+        .max    = 8,
+        .types  = BIT(NL80211_IFTYPE_AP)
+        },
+};
+
+static const struct ieee80211_iface_combination ath10k_if_comb[] = {
+        {
+                .limits = ath10k_if_limits,
+                .n_limits = ARRAY_SIZE(ath10k_if_limits),
+                .max_interfaces = 8,
+                .num_different_channels = 1,
+                .beacon_int_infra_match = true,
+        },
+};
+
+static const struct ieee80211_iface_combination ath10k_10x_if_comb[] = {
+        {
+                .limits = ath10k_10x_if_limits,
+                .n_limits = ARRAY_SIZE(ath10k_10x_if_limits),
+                .max_interfaces = 8,
+                .num_different_channels = 1,
+                .beacon_int_infra_match = true,
+#ifdef CONFIG_ATH10K_DFS_CERTIFIED
+                .radar_detect_widths =  BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                        BIT(NL80211_CHAN_WIDTH_20) |
+                                        BIT(NL80211_CHAN_WIDTH_40) |
+                                        BIT(NL80211_CHAN_WIDTH_80),
+#endif
+        },
 };
 
 static struct ieee80211_sta_vht_cap ath10k_create_vht_cap(struct ath10k *ar)
@@ -3433,9 +4004,12 @@ int ath10k_mac_register(struct ath10k *ar)
         ar->hw->wiphy->interface_modes =
                 BIT(NL80211_IFTYPE_STATION) |
                 BIT(NL80211_IFTYPE_ADHOC) |
-                BIT(NL80211_IFTYPE_AP) |
-                BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                BIT(NL80211_IFTYPE_P2P_GO);
+                BIT(NL80211_IFTYPE_AP);
+
+        if (!test_bit(ATH10K_FW_FEATURE_NO_P2P, ar->fw_features))
+                ar->hw->wiphy->interface_modes |=
+                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                        BIT(NL80211_IFTYPE_P2P_GO);
 
         ar->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                         IEEE80211_HW_SUPPORTS_PS |
@@ -3465,7 +4039,6 @@ int ath10k_mac_register(struct ath10k *ar)
 
         ar->hw->vif_data_size = sizeof(struct ath10k_vif);
 
-        ar->hw->channel_change_time = 5000;
         ar->hw->max_listen_interval = ATH10K_MAX_HW_LISTEN_INTERVAL;
 
         ar->hw->wiphy->flags |= WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
@@ -3478,11 +4051,28 @@ int ath10k_mac_register(struct ath10k *ar)
          */
         ar->hw->queues = 4;
 
-        ar->hw->wiphy->iface_combinations = &ath10k_if_comb;
-        ar->hw->wiphy->n_iface_combinations = 1;
+        if (test_bit(ATH10K_FW_FEATURE_WMI_10X, ar->fw_features)) {
+                ar->hw->wiphy->iface_combinations = ath10k_10x_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_10x_if_comb);
+        } else {
+                ar->hw->wiphy->iface_combinations = ath10k_if_comb;
+                ar->hw->wiphy->n_iface_combinations =
+                        ARRAY_SIZE(ath10k_if_comb);
+        }
 
         ar->hw->netdev_features = NETIF_F_HW_CSUM;
 
+        if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED)) {
+                /* Init ath dfs pattern detector */
+                ar->ath_common.debug_mask = ATH_DBG_DFS;
+                ar->dfs_detector = dfs_pattern_detector_init(&ar->ath_common,
+                                                             NL80211_DFS_UNSET);
+
+                if (!ar->dfs_detector)
+                        ath10k_warn("dfs pattern detector init failed\n");
+        }
+
         ret = ath_regd_init(&ar->ath_common.regulatory, ar->hw->wiphy,
                             ath10k_reg_notifier);
         if (ret) {
@@ -3518,6 +4108,9 @@ void ath10k_mac_unregister(struct ath10k *ar)
 {
         ieee80211_unregister_hw(ar->hw);
 
+        if (config_enabled(CONFIG_ATH10K_DFS_CERTIFIED) && ar->dfs_detector)
+                ar->dfs_detector->exit(ar->dfs_detector);
+
         kfree(ar->mac.sbands[IEEE80211_BAND_2GHZ].channels);
         kfree(ar->mac.sbands[IEEE80211_BAND_5GHZ].channels);
 
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 9e86a811086f..29fd197d1fd8 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
+#include <linux/bitops.h>
 
 #include "core.h"
 #include "debug.h"
@@ -32,10 +33,21 @@
 #include "ce.h"
 #include "pci.h"
 
+enum ath10k_pci_irq_mode {
+        ATH10K_PCI_IRQ_AUTO = 0,
+        ATH10K_PCI_IRQ_LEGACY = 1,
+        ATH10K_PCI_IRQ_MSI = 2,
+};
+
 static unsigned int ath10k_target_ps;
+static unsigned int ath10k_pci_irq_mode = ATH10K_PCI_IRQ_AUTO;
+
 module_param(ath10k_target_ps, uint, 0644);
 MODULE_PARM_DESC(ath10k_target_ps, "Enable ath10k Target (SoC) PS option");
 
+module_param_named(irq_mode, ath10k_pci_irq_mode, uint, 0644);
+MODULE_PARM_DESC(irq_mode, "0: auto, 1: legacy, 2: msi (default: 0)");
+
 #define QCA988X_2_0_DEVICE_ID   (0x003c)
 
 static DEFINE_PCI_DEVICE_TABLE(ath10k_pci_id_table) = {
@@ -52,10 +64,16 @@ static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                              int num);
 static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info);
 static void ath10k_pci_stop_ce(struct ath10k *ar);
-static void ath10k_pci_device_reset(struct ath10k *ar);
-static int ath10k_pci_reset_target(struct ath10k *ar);
-static int ath10k_pci_start_intr(struct ath10k *ar);
-static void ath10k_pci_stop_intr(struct ath10k *ar);
+static int ath10k_pci_device_reset(struct ath10k *ar);
+static int ath10k_pci_wait_for_target_init(struct ath10k *ar);
+static int ath10k_pci_init_irq(struct ath10k *ar);
+static int ath10k_pci_deinit_irq(struct ath10k *ar);
+static int ath10k_pci_request_irq(struct ath10k *ar);
+static void ath10k_pci_free_irq(struct ath10k *ar);
+static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
+                               struct ath10k_ce_pipe *rx_pipe,
+                               struct bmi_xfer *xfer);
+static void ath10k_pci_cleanup_ce(struct ath10k *ar);
 
 static const struct ce_attr host_ce_config_wlan[] = {
         /* CE0: host->target HTC control and raw streams */
@@ -200,6 +218,87 @@ static const struct ce_pipe_config target_ce_config_wlan[] = {
         /* CE7 used only by Host */
 };
 
+static bool ath10k_pci_irq_pending(struct ath10k *ar)
+{
+        u32 cause;
+
+        /* Check if the shared legacy irq is for us */
+        cause = ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
+                                  PCIE_INTR_CAUSE_ADDRESS);
+        if (cause & (PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL))
+                return true;
+
+        return false;
+}
+
+static void ath10k_pci_disable_and_clear_legacy_irq(struct ath10k *ar)
+{
+        /* IMPORTANT: INTR_CLR register has to be set after
+         * INTR_ENABLE is set to 0, otherwise interrupt can not be
+         * really cleared. */
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + PCIE_INTR_ENABLE_ADDRESS,
+                           0);
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + PCIE_INTR_CLR_ADDRESS,
+                           PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL);
+
+        /* IMPORTANT: this extra read transaction is required to
+         * flush the posted write buffer. */
+        (void) ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
+                                 PCIE_INTR_ENABLE_ADDRESS);
+}
+
+static void ath10k_pci_enable_legacy_irq(struct ath10k *ar)
+{
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS +
+                           PCIE_INTR_ENABLE_ADDRESS,
+                           PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL);
+
+        /* IMPORTANT: this extra read transaction is required to
+         * flush the posted write buffer. */
+        (void) ath10k_pci_read32(ar, SOC_CORE_BASE_ADDRESS +
+                                 PCIE_INTR_ENABLE_ADDRESS);
+}
+
+static irqreturn_t ath10k_pci_early_irq_handler(int irq, void *arg)
+{
+        struct ath10k *ar = arg;
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        if (ar_pci->num_msi_intrs == 0) {
+                if (!ath10k_pci_irq_pending(ar))
+                        return IRQ_NONE;
+
+                ath10k_pci_disable_and_clear_legacy_irq(ar);
+        }
+
+        tasklet_schedule(&ar_pci->early_irq_tasklet);
+
+        return IRQ_HANDLED;
+}
+
+static int ath10k_pci_request_early_irq(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int ret;
+
+        /* Regardless whether MSI-X/MSI/legacy irqs have been set up the first
+         * interrupt from irq vector is triggered in all cases for FW
+         * indication/errors */
+        ret = request_irq(ar_pci->pdev->irq, ath10k_pci_early_irq_handler,
+                          IRQF_SHARED, "ath10k_pci (early)", ar);
+        if (ret) {
+                ath10k_warn("failed to request early irq: %d\n", ret);
+                return ret;
+        }
+
+        return 0;
+}
+
+static void ath10k_pci_free_early_irq(struct ath10k *ar)
+{
+        free_irq(ath10k_pci_priv(ar)->pdev->irq, ar);
+}
+
 /*
  * Diagnostic read/write access is provided for startup/config/debug usage.
  * Caller must guarantee proper alignment, when applicable, and single user
@@ -526,17 +625,6 @@ static bool ath10k_pci_target_is_awake(struct ath10k *ar)
         return (RTC_STATE_V_GET(val) == RTC_STATE_V_ON);
 }
 
-static void ath10k_pci_wait(struct ath10k *ar)
-{
-        int n = 100;
-
-        while (n-- && !ath10k_pci_target_is_awake(ar))
-                msleep(10);
-
-        if (n < 0)
-                ath10k_warn("Unable to wakeup target\n");
-}
-
 int ath10k_do_pci_wake(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
@@ -723,7 +811,7 @@ static int ath10k_pci_hif_send_head(struct ath10k *ar, u8 pipe_id,
         ret = ath10k_ce_send(ce_hdl, nbuf, skb_cb->paddr, len, transfer_id,
                              flags);
         if (ret)
-                ath10k_warn("CE send failed: %p\n", nbuf);
+                ath10k_warn("failed to send sk_buff to CE: %p\n", nbuf);
 
         return ret;
 }
@@ -750,9 +838,10 @@ static void ath10k_pci_hif_dump_area(struct ath10k *ar)
                    ar->fw_version_build);
 
         host_addr = host_interest_item_address(HI_ITEM(hi_failure_state));
-        if (ath10k_pci_diag_read_mem(ar, host_addr,
-                                     &reg_dump_area, sizeof(u32)) != 0) {
-                ath10k_warn("could not read hi_failure_state\n");
+        ret = ath10k_pci_diag_read_mem(ar, host_addr,
+                                       &reg_dump_area, sizeof(u32));
+        if (ret) {
+                ath10k_err("failed to read FW dump area address: %d\n", ret);
                 return;
         }
 
@@ -762,7 +851,7 @@ static void ath10k_pci_hif_dump_area(struct ath10k *ar)
                                        &reg_dump_values[0],
                                        REG_DUMP_COUNT_QCA988X * sizeof(u32));
         if (ret != 0) {
-                ath10k_err("could not dump FW Dump Area\n");
+                ath10k_err("failed to read FW dump area: %d\n", ret);
                 return;
         }
 
@@ -777,7 +866,7 @@ static void ath10k_pci_hif_dump_area(struct ath10k *ar)
                            reg_dump_values[i + 2],
                            reg_dump_values[i + 3]);
 
-        ieee80211_queue_work(ar->hw, &ar->restart_work);
+        queue_work(ar->workqueue, &ar->restart_work);
 }
 
 static void ath10k_pci_hif_send_complete_check(struct ath10k *ar, u8 pipe,
@@ -815,53 +904,41 @@ static void ath10k_pci_hif_set_callbacks(struct ath10k *ar,
                sizeof(ar_pci->msg_callbacks_current));
 }
 
-static int ath10k_pci_start_ce(struct ath10k *ar)
+static int ath10k_pci_alloc_compl(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_ce_pipe *ce_diag = ar_pci->ce_diag;
         const struct ce_attr *attr;
         struct ath10k_pci_pipe *pipe_info;
         struct ath10k_pci_compl *compl;
-        int i, pipe_num, completions, disable_interrupts;
+        int i, pipe_num, completions;
 
         spin_lock_init(&ar_pci->compl_lock);
         INIT_LIST_HEAD(&ar_pci->compl_process);
 
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
 
                 spin_lock_init(&pipe_info->pipe_lock);
                 INIT_LIST_HEAD(&pipe_info->compl_free);
 
                 /* Handle Diagnostic CE specially */
-                if (pipe_info->ce_hdl == ce_diag)
+                if (pipe_info->ce_hdl == ar_pci->ce_diag)
                         continue;
 
                 attr = &host_ce_config_wlan[pipe_num];
                 completions = 0;
 
-                if (attr->src_nentries) {
-                        disable_interrupts = attr->flags & CE_ATTR_DIS_INTR;
-                        ath10k_ce_send_cb_register(pipe_info->ce_hdl,
-                                                   ath10k_pci_ce_send_done,
-                                                   disable_interrupts);
+                if (attr->src_nentries)
                         completions += attr->src_nentries;
-                }
 
-                if (attr->dest_nentries) {
-                        ath10k_ce_recv_cb_register(pipe_info->ce_hdl,
-                                                   ath10k_pci_ce_recv_data);
+                if (attr->dest_nentries)
                         completions += attr->dest_nentries;
-                }
-
-                if (completions == 0)
-                        continue;
 
                 for (i = 0; i < completions; i++) {
                         compl = kmalloc(sizeof(*compl), GFP_KERNEL);
                         if (!compl) {
                                 ath10k_warn("No memory for completion state\n");
-                                ath10k_pci_stop_ce(ar);
+                                ath10k_pci_cleanup_ce(ar);
                                 return -ENOMEM;
                         }
 
@@ -873,20 +950,55 @@ static int ath10k_pci_start_ce(struct ath10k *ar)
         return 0;
 }
 
-static void ath10k_pci_stop_ce(struct ath10k *ar)
+static int ath10k_pci_setup_ce_irq(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        struct ath10k_pci_compl *compl;
-        struct sk_buff *skb;
-        int i;
+        const struct ce_attr *attr;
+        struct ath10k_pci_pipe *pipe_info;
+        int pipe_num, disable_interrupts;
 
-        ath10k_ce_disable_interrupts(ar);
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
+                pipe_info = &ar_pci->pipe_info[pipe_num];
+
+                /* Handle Diagnostic CE specially */
+                if (pipe_info->ce_hdl == ar_pci->ce_diag)
+                        continue;
+
+                attr = &host_ce_config_wlan[pipe_num];
+
+                if (attr->src_nentries) {
+                        disable_interrupts = attr->flags & CE_ATTR_DIS_INTR;
+                        ath10k_ce_send_cb_register(pipe_info->ce_hdl,
+                                                   ath10k_pci_ce_send_done,
+                                                   disable_interrupts);
+                }
+
+                if (attr->dest_nentries)
+                        ath10k_ce_recv_cb_register(pipe_info->ce_hdl,
+                                                   ath10k_pci_ce_recv_data);
+        }
+
+        return 0;
+}
+
+static void ath10k_pci_kill_tasklet(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int i;
 
-        /* Cancel the pending tasklet */
         tasklet_kill(&ar_pci->intr_tq);
+        tasklet_kill(&ar_pci->msi_fw_err);
+        tasklet_kill(&ar_pci->early_irq_tasklet);
 
         for (i = 0; i < CE_COUNT; i++)
                 tasklet_kill(&ar_pci->pipe_info[i].intr);
+}
+
+static void ath10k_pci_stop_ce(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        struct ath10k_pci_compl *compl;
+        struct sk_buff *skb;
 
         /* Mark pending completions as aborted, so that upper layers free up
          * their associated resources */
@@ -920,7 +1032,7 @@ static void ath10k_pci_cleanup_ce(struct ath10k *ar)
         spin_unlock_bh(&ar_pci->compl_lock);
 
         /* Free unused completions for each pipe. */
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
 
                 spin_lock_bh(&pipe_info->pipe_lock);
@@ -974,8 +1086,8 @@ static void ath10k_pci_process_ce(struct ath10k *ar)
                 case ATH10K_PCI_COMPL_RECV:
                         ret = ath10k_pci_post_rx_pipe(compl->pipe_info, 1);
                         if (ret) {
-                                ath10k_warn("Unable to post recv buffer for pipe: %d\n",
-                                            compl->pipe_info->pipe_num);
+                                ath10k_warn("failed to post RX buffer for pipe %d: %d\n",
+                                            compl->pipe_info->pipe_num, ret);
                                 break;
                         }
 
@@ -1114,7 +1226,7 @@ static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
         for (i = 0; i < num; i++) {
                 skb = dev_alloc_skb(pipe_info->buf_sz);
                 if (!skb) {
-                        ath10k_warn("could not allocate skbuff for pipe %d\n",
+                        ath10k_warn("failed to allocate skbuff for pipe %d\n",
                                     num);
                         ret = -ENOMEM;
                         goto err;
@@ -1127,7 +1239,7 @@ static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                                          DMA_FROM_DEVICE);
 
                 if (unlikely(dma_mapping_error(ar->dev, ce_data))) {
-                        ath10k_warn("could not dma map skbuff\n");
+                        ath10k_warn("failed to DMA map sk_buff\n");
                         dev_kfree_skb_any(skb);
                         ret = -EIO;
                         goto err;
@@ -1142,7 +1254,7 @@ static int ath10k_pci_post_rx_pipe(struct ath10k_pci_pipe *pipe_info,
                 ret = ath10k_ce_recv_buf_enqueue(ce_state, (void *)skb,
                                                  ce_data);
                 if (ret) {
-                        ath10k_warn("could not enqueue to pipe %d (%d)\n",
+                        ath10k_warn("failed to enqueue to pipe %d: %d\n",
                                     num, ret);
                         goto err;
                 }
@@ -1162,7 +1274,7 @@ static int ath10k_pci_post_rx(struct ath10k *ar)
         const struct ce_attr *attr;
         int pipe_num, ret = 0;
 
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
                 attr = &host_ce_config_wlan[pipe_num];
 
@@ -1172,8 +1284,8 @@ static int ath10k_pci_post_rx(struct ath10k *ar)
                 ret = ath10k_pci_post_rx_pipe(pipe_info,
                                               attr->dest_nentries - 1);
                 if (ret) {
-                        ath10k_warn("Unable to replenish recv buffers for pipe: %d\n",
-                                    pipe_num);
+                        ath10k_warn("failed to post RX buffer for pipe %d: %d\n",
+                                    pipe_num, ret);
 
                         for (; pipe_num >= 0; pipe_num--) {
                                 pipe_info = &ar_pci->pipe_info[pipe_num];
@@ -1189,23 +1301,58 @@ static int ath10k_pci_post_rx(struct ath10k *ar)
 static int ath10k_pci_hif_start(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ret;
+        int ret, ret_early;
 
-        ret = ath10k_pci_start_ce(ar);
+        ath10k_pci_free_early_irq(ar);
+        ath10k_pci_kill_tasklet(ar);
+
+        ret = ath10k_pci_alloc_compl(ar);
         if (ret) {
-                ath10k_warn("could not start CE (%d)\n", ret);
-                return ret;
+                ath10k_warn("failed to allocate CE completions: %d\n", ret);
+                goto err_early_irq;
+        }
+
+        ret = ath10k_pci_request_irq(ar);
+        if (ret) {
+                ath10k_warn("failed to post RX buffers for all pipes: %d\n",
+                            ret);
+                goto err_free_compl;
+        }
+
+        ret = ath10k_pci_setup_ce_irq(ar);
+        if (ret) {
+                ath10k_warn("failed to setup CE interrupts: %d\n", ret);
+                goto err_stop;
         }
 
         /* Post buffers once to start things off. */
         ret = ath10k_pci_post_rx(ar);
         if (ret) {
-                ath10k_warn("could not post rx pipes (%d)\n", ret);
-                return ret;
+                ath10k_warn("failed to post RX buffers for all pipes: %d\n",
+                            ret);
+                goto err_stop;
         }
 
         ar_pci->started = 1;
         return 0;
+
+err_stop:
+        ath10k_ce_disable_interrupts(ar);
+        ath10k_pci_free_irq(ar);
+        ath10k_pci_kill_tasklet(ar);
+        ath10k_pci_stop_ce(ar);
+        ath10k_pci_process_ce(ar);
+err_free_compl:
+        ath10k_pci_cleanup_ce(ar);
+err_early_irq:
+        /* Though there should be no interrupts (device was reset)
+         * power_down() expects the early IRQ to be installed as per the
+         * driver lifecycle. */
+        ret_early = ath10k_pci_request_early_irq(ar);
+        if (ret_early)
+                ath10k_warn("failed to re-enable early irq: %d\n", ret_early);
+
+        return ret;
 }
 
 static void ath10k_pci_rx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
@@ -1271,6 +1418,13 @@ static void ath10k_pci_tx_pipe_cleanup(struct ath10k_pci_pipe *pipe_info)
                  * Indicate the completion to higer layer to free
                  * the buffer
                  */
+
+                if (!netbuf) {
+                        ath10k_warn("invalid sk_buff on CE %d - NULL pointer. firmware crashed?\n",
+                                    ce_hdl->id);
+                        continue;
+                }
+
                 ATH10K_SKB_CB(netbuf)->is_aborted = true;
                 ar_pci->msg_callbacks_current.tx_completion(ar,
                                                             netbuf,
@@ -1291,7 +1445,7 @@ static void ath10k_pci_buffer_cleanup(struct ath10k *ar)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int pipe_num;
 
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 struct ath10k_pci_pipe *pipe_info;
 
                 pipe_info = &ar_pci->pipe_info[pipe_num];
@@ -1306,7 +1460,7 @@ static void ath10k_pci_ce_deinit(struct ath10k *ar)
         struct ath10k_pci_pipe *pipe_info;
         int pipe_num;
 
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
                 if (pipe_info->ce_hdl) {
                         ath10k_ce_deinit(pipe_info->ce_hdl);
@@ -1316,27 +1470,25 @@ static void ath10k_pci_ce_deinit(struct ath10k *ar)
         }
 }
 
-static void ath10k_pci_disable_irqs(struct ath10k *ar)
-{
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int i;
-
-        for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
-                disable_irq(ar_pci->pdev->irq + i);
-}
-
 static void ath10k_pci_hif_stop(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int ret;
 
         ath10k_dbg(ATH10K_DBG_PCI, "%s\n", __func__);
 
-        /* Irqs are never explicitly re-enabled. They are implicitly re-enabled
-         * by ath10k_pci_start_intr(). */
-        ath10k_pci_disable_irqs(ar);
+        ret = ath10k_ce_disable_interrupts(ar);
+        if (ret)
+                ath10k_warn("failed to disable CE interrupts: %d\n", ret);
 
+        ath10k_pci_free_irq(ar);
+        ath10k_pci_kill_tasklet(ar);
         ath10k_pci_stop_ce(ar);
 
+        ret = ath10k_pci_request_early_irq(ar);
+        if (ret)
+                ath10k_warn("failed to re-enable early irq: %d\n", ret);
+
         /* At this point, asynchronous threads are stopped, the target should
          * not DMA nor interrupt. We process the leftovers and then free
          * everything else up. */
@@ -1345,6 +1497,13 @@ static void ath10k_pci_hif_stop(struct ath10k *ar)
         ath10k_pci_cleanup_ce(ar);
         ath10k_pci_buffer_cleanup(ar);
 
+        /* Make the sure the device won't access any structures on the host by
+         * resetting it. The device was fed with PCI CE ringbuffer
+         * configuration during init. If ringbuffers are freed and the device
+         * were to access them this could lead to memory corruption on the
+         * host. */
+        ath10k_pci_device_reset(ar);
+
         ar_pci->started = 0;
 }
 
@@ -1363,6 +1522,8 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
         void *treq, *tresp = NULL;
         int ret = 0;
 
+        might_sleep();
+
         if (resp && !resp_len)
                 return -EINVAL;
 
@@ -1403,14 +1564,12 @@ static int ath10k_pci_hif_exchange_bmi_msg(struct ath10k *ar,
         if (ret)
                 goto err_resp;
 
-        ret = wait_for_completion_timeout(&xfer.done,
-                                          BMI_COMMUNICATION_TIMEOUT_HZ);
-        if (ret <= 0) {
+        ret = ath10k_pci_bmi_wait(ce_tx, ce_rx, &xfer);
+        if (ret) {
                 u32 unused_buffer;
                 unsigned int unused_nbytes;
                 unsigned int unused_id;
 
-                ret = -ETIMEDOUT;
                 ath10k_ce_cancel_send_next(ce_tx, NULL, &unused_buffer,
                                            &unused_nbytes, &unused_id);
         } else {
@@ -1478,6 +1637,25 @@ static void ath10k_pci_bmi_recv_data(struct ath10k_ce_pipe *ce_state)
         complete(&xfer->done);
 }
 
+static int ath10k_pci_bmi_wait(struct ath10k_ce_pipe *tx_pipe,
+                               struct ath10k_ce_pipe *rx_pipe,
+                               struct bmi_xfer *xfer)
+{
+        unsigned long timeout = jiffies + BMI_COMMUNICATION_TIMEOUT_HZ;
+
+        while (time_before_eq(jiffies, timeout)) {
+                ath10k_pci_bmi_send_done(tx_pipe);
+                ath10k_pci_bmi_recv_data(rx_pipe);
+
+                if (completion_done(&xfer->done))
+                        return 0;
+
+                schedule();
+        }
+
+        return -ETIMEDOUT;
+}
+
 /*
  * Map from service/endpoint to Copy Engine.
  * This table is derived from the CE_PCI TABLE, above.
@@ -1587,7 +1765,7 @@ static int ath10k_pci_wake_target_cpu(struct ath10k *ar)
                                               CORE_CTRL_ADDRESS,
                                           &core_ctrl);
         if (ret) {
-                ath10k_warn("Unable to read core ctrl\n");
+                ath10k_warn("failed to read core_ctrl: %d\n", ret);
                 return ret;
         }
 
@@ -1597,10 +1775,13 @@ static int ath10k_pci_wake_target_cpu(struct ath10k *ar)
         ret = ath10k_pci_diag_write_access(ar, SOC_CORE_BASE_ADDRESS |
                                                CORE_CTRL_ADDRESS,
                                            core_ctrl);
-        if (ret)
-                ath10k_warn("Unable to set interrupt mask\n");
+        if (ret) {
+                ath10k_warn("failed to set target CPU interrupt mask: %d\n",
+                            ret);
+                return ret;
+        }
 
-        return ret;
+        return 0;
 }
 
 static int ath10k_pci_init_config(struct ath10k *ar)
@@ -1751,7 +1932,7 @@ static int ath10k_pci_ce_init(struct ath10k *ar)
         const struct ce_attr *attr;
         int pipe_num;
 
-        for (pipe_num = 0; pipe_num < ar_pci->ce_count; pipe_num++) {
+        for (pipe_num = 0; pipe_num < CE_COUNT; pipe_num++) {
                 pipe_info = &ar_pci->pipe_info[pipe_num];
                 pipe_info->pipe_num = pipe_num;
                 pipe_info->hif_ce_state = ar;
@@ -1759,7 +1940,7 @@ static int ath10k_pci_ce_init(struct ath10k *ar)
 
                 pipe_info->ce_hdl = ath10k_ce_init(ar, pipe_num, attr);
                 if (pipe_info->ce_hdl == NULL) {
-                        ath10k_err("Unable to initialize CE for pipe: %d\n",
+                        ath10k_err("failed to initialize CE for pipe: %d\n",
                                    pipe_num);
 
                         /* It is safe to call it here. It checks if ce_hdl is
@@ -1768,31 +1949,18 @@ static int ath10k_pci_ce_init(struct ath10k *ar)
                         return -1;
                 }
 
-                if (pipe_num == ar_pci->ce_count - 1) {
+                if (pipe_num == CE_COUNT - 1) {
                         /*
                          * Reserve the ultimate CE for
                          * diagnostic Window support
                          */
-                        ar_pci->ce_diag =
-                        ar_pci->pipe_info[ar_pci->ce_count - 1].ce_hdl;
+                        ar_pci->ce_diag = pipe_info->ce_hdl;
                         continue;
                 }
 
                 pipe_info->buf_sz = (size_t) (attr->src_sz_max);
         }
 
-        /*
-         * Initially, establish CE completion handlers for use with BMI.
-         * These are overwritten with generic handlers after we exit BMI phase.
-         */
-        pipe_info = &ar_pci->pipe_info[BMI_CE_NUM_TO_TARG];
-        ath10k_ce_send_cb_register(pipe_info->ce_hdl,
-                                   ath10k_pci_bmi_send_done, 0);
-
-        pipe_info = &ar_pci->pipe_info[BMI_CE_NUM_TO_HOST];
-        ath10k_ce_recv_cb_register(pipe_info->ce_hdl,
-                                   ath10k_pci_bmi_recv_data);
-
         return 0;
 }
 
@@ -1828,14 +1996,9 @@ static void ath10k_pci_fw_interrupt_handler(struct ath10k *ar)
 static int ath10k_pci_hif_power_up(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        const char *irq_mode;
         int ret;
 
-        ret = ath10k_pci_start_intr(ar);
-        if (ret) {
-                ath10k_err("could not start interrupt handling (%d)\n", ret);
-                goto err;
-        }
-
         /*
          * Bring the target up cleanly.
          *
@@ -1846,39 +2009,80 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar)
          * is in an unexpected state. We try to catch that here in order to
          * reset the Target and retry the probe.
          */
-        ath10k_pci_device_reset(ar);
-
-        ret = ath10k_pci_reset_target(ar);
-        if (ret)
-                goto err_irq;
+        ret = ath10k_pci_device_reset(ar);
+        if (ret) {
+                ath10k_err("failed to reset target: %d\n", ret);
+                goto err;
+        }
 
         if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 /* Force AWAKE forever */
                 ath10k_do_pci_wake(ar);
 
         ret = ath10k_pci_ce_init(ar);
-        if (ret)
+        if (ret) {
+                ath10k_err("failed to initialize CE: %d\n", ret);
                 goto err_ps;
+        }
 
-        ret = ath10k_pci_init_config(ar);
-        if (ret)
+        ret = ath10k_ce_disable_interrupts(ar);
+        if (ret) {
+                ath10k_err("failed to disable CE interrupts: %d\n", ret);
                 goto err_ce;
+        }
 
-        ret = ath10k_pci_wake_target_cpu(ar);
+        ret = ath10k_pci_init_irq(ar);
         if (ret) {
-                ath10k_err("could not wake up target CPU (%d)\n", ret);
+                ath10k_err("failed to init irqs: %d\n", ret);
                 goto err_ce;
         }
 
+        ret = ath10k_pci_request_early_irq(ar);
+        if (ret) {
+                ath10k_err("failed to request early irq: %d\n", ret);
+                goto err_deinit_irq;
+        }
+
+        ret = ath10k_pci_wait_for_target_init(ar);
+        if (ret) {
+                ath10k_err("failed to wait for target to init: %d\n", ret);
+                goto err_free_early_irq;
+        }
+
+        ret = ath10k_pci_init_config(ar);
+        if (ret) {
+                ath10k_err("failed to setup init config: %d\n", ret);
+                goto err_free_early_irq;
+        }
+
+        ret = ath10k_pci_wake_target_cpu(ar);
+        if (ret) {
+                ath10k_err("could not wake up target CPU: %d\n", ret);
+                goto err_free_early_irq;
+        }
+
+        if (ar_pci->num_msi_intrs > 1)
+                irq_mode = "MSI-X";
+        else if (ar_pci->num_msi_intrs == 1)
+                irq_mode = "MSI";
+        else
+                irq_mode = "legacy";
+
+        if (!test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
+                ath10k_info("pci irq %s\n", irq_mode);
+
         return 0;
 
+err_free_early_irq:
+        ath10k_pci_free_early_irq(ar);
+err_deinit_irq:
+        ath10k_pci_deinit_irq(ar);
 err_ce:
         ath10k_pci_ce_deinit(ar);
+        ath10k_pci_device_reset(ar);
 err_ps:
         if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
                 ath10k_do_pci_sleep(ar);
-err_irq:
-        ath10k_pci_stop_intr(ar);
 err:
         return ret;
 }
@@ -1887,7 +2091,10 @@ static void ath10k_pci_hif_power_down(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
-        ath10k_pci_stop_intr(ar);
+        ath10k_pci_free_early_irq(ar);
+        ath10k_pci_kill_tasklet(ar);
+        ath10k_pci_deinit_irq(ar);
+        ath10k_pci_device_reset(ar);
 
         ath10k_pci_ce_deinit(ar);
         if (!test_bit(ATH10K_PCI_FEATURE_SOC_POWER_SAVE, ar_pci->features))
@@ -2023,25 +2230,10 @@ static irqreturn_t ath10k_pci_interrupt_handler(int irq, void *arg)
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
         if (ar_pci->num_msi_intrs == 0) {
-                /*
-                 * IMPORTANT: INTR_CLR regiser has to be set after
-                 * INTR_ENABLE is set to 0, otherwise interrupt can not be
-                 * really cleared.
-                 */
-                iowrite32(0, ar_pci->mem +
-                          (SOC_CORE_BASE_ADDRESS |
-                           PCIE_INTR_ENABLE_ADDRESS));
-                iowrite32(PCIE_INTR_FIRMWARE_MASK |
-                          PCIE_INTR_CE_MASK_ALL,
-                          ar_pci->mem + (SOC_CORE_BASE_ADDRESS |
-                                         PCIE_INTR_CLR_ADDRESS));
-                /*
-                 * IMPORTANT: this extra read transaction is required to
-                 * flush the posted write buffer.
-                 */
-                (void) ioread32(ar_pci->mem +
-                                (SOC_CORE_BASE_ADDRESS |
-                                 PCIE_INTR_ENABLE_ADDRESS));
+                if (!ath10k_pci_irq_pending(ar))
+                        return IRQ_NONE;
+
+                ath10k_pci_disable_and_clear_legacy_irq(ar);
         }
 
         tasklet_schedule(&ar_pci->intr_tq);
@@ -2049,6 +2241,34 @@ static irqreturn_t ath10k_pci_interrupt_handler(int irq, void *arg)
         return IRQ_HANDLED;
 }
 
+static void ath10k_pci_early_irq_tasklet(unsigned long data)
+{
+        struct ath10k *ar = (struct ath10k *)data;
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        u32 fw_ind;
+        int ret;
+
+        ret = ath10k_pci_wake(ar);
+        if (ret) {
+                ath10k_warn("failed to wake target in early irq tasklet: %d\n",
+                            ret);
+                return;
+        }
+
+        fw_ind = ath10k_pci_read32(ar, ar_pci->fw_indicator_address);
+        if (fw_ind & FW_IND_EVENT_PENDING) {
+                ath10k_pci_write32(ar, ar_pci->fw_indicator_address,
+                                   fw_ind & ~FW_IND_EVENT_PENDING);
+
+                /* Some structures are unavailable during early boot or at
+                 * driver teardown so just print that the device has crashed. */
+                ath10k_warn("device crashed - no diagnostics available\n");
+        }
+
+        ath10k_pci_sleep(ar);
+        ath10k_pci_enable_legacy_irq(ar);
+}
+
 static void ath10k_pci_tasklet(unsigned long data)
 {
         struct ath10k *ar = (struct ath10k *)data;
@@ -2057,40 +2277,22 @@ static void ath10k_pci_tasklet(unsigned long data)
         ath10k_pci_fw_interrupt_handler(ar); /* FIXME: Handle FW error */
         ath10k_ce_per_engine_service_any(ar);
 
-        if (ar_pci->num_msi_intrs == 0) {
-                /* Enable Legacy PCI line interrupts */
-                iowrite32(PCIE_INTR_FIRMWARE_MASK |
-                          PCIE_INTR_CE_MASK_ALL,
-                          ar_pci->mem + (SOC_CORE_BASE_ADDRESS |
-                                         PCIE_INTR_ENABLE_ADDRESS));
-                /*
-                 * IMPORTANT: this extra read transaction is required to
-                 * flush the posted write buffer
-                 */
-                (void) ioread32(ar_pci->mem +
-                                (SOC_CORE_BASE_ADDRESS |
-                                 PCIE_INTR_ENABLE_ADDRESS));
-        }
+        /* Re-enable legacy irq that was disabled in the irq handler */
+        if (ar_pci->num_msi_intrs == 0)
+                ath10k_pci_enable_legacy_irq(ar);
 }
 
-static int ath10k_pci_start_intr_msix(struct ath10k *ar, int num)
+static int ath10k_pci_request_irq_msix(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int ret;
-        int i;
-
-        ret = pci_enable_msi_block(ar_pci->pdev, num);
-        if (ret)
-                return ret;
+        int ret, i;
 
         ret = request_irq(ar_pci->pdev->irq + MSI_ASSIGN_FW,
                           ath10k_pci_msi_fw_handler,
                           IRQF_SHARED, "ath10k_pci", ar);
         if (ret) {
-                ath10k_warn("request_irq(%d) failed %d\n",
+                ath10k_warn("failed to request MSI-X fw irq %d: %d\n",
                             ar_pci->pdev->irq + MSI_ASSIGN_FW, ret);
-
-                pci_disable_msi(ar_pci->pdev);
                 return ret;
         }
 
@@ -2099,44 +2301,38 @@ static int ath10k_pci_start_intr_msix(struct ath10k *ar, int num)
                                   ath10k_pci_per_engine_handler,
                                   IRQF_SHARED, "ath10k_pci", ar);
                 if (ret) {
-                        ath10k_warn("request_irq(%d) failed %d\n",
+                        ath10k_warn("failed to request MSI-X ce irq %d: %d\n",
                                     ar_pci->pdev->irq + i, ret);
 
                         for (i--; i >= MSI_ASSIGN_CE_INITIAL; i--)
                                 free_irq(ar_pci->pdev->irq + i, ar);
 
                         free_irq(ar_pci->pdev->irq + MSI_ASSIGN_FW, ar);
-                        pci_disable_msi(ar_pci->pdev);
                         return ret;
                 }
         }
 
-        ath10k_info("MSI-X interrupt handling (%d intrs)\n", num);
         return 0;
 }
 
-static int ath10k_pci_start_intr_msi(struct ath10k *ar)
+static int ath10k_pci_request_irq_msi(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret;
 
-        ret = pci_enable_msi(ar_pci->pdev);
-        if (ret < 0)
-                return ret;
-
         ret = request_irq(ar_pci->pdev->irq,
                           ath10k_pci_interrupt_handler,
                           IRQF_SHARED, "ath10k_pci", ar);
-        if (ret < 0) {
-                pci_disable_msi(ar_pci->pdev);
+        if (ret) {
+                ath10k_warn("failed to request MSI irq %d: %d\n",
+                            ar_pci->pdev->irq, ret);
                 return ret;
         }
 
-        ath10k_info("MSI interrupt handling\n");
         return 0;
 }
 
-static int ath10k_pci_start_intr_legacy(struct ath10k *ar)
+static int ath10k_pci_request_irq_legacy(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int ret;
@@ -2144,112 +2340,165 @@ static int ath10k_pci_start_intr_legacy(struct ath10k *ar)
         ret = request_irq(ar_pci->pdev->irq,
                           ath10k_pci_interrupt_handler,
                           IRQF_SHARED, "ath10k_pci", ar);
-        if (ret < 0)
+        if (ret) {
+                ath10k_warn("failed to request legacy irq %d: %d\n",
+                            ar_pci->pdev->irq, ret);
                 return ret;
+        }
 
-        /*
-         * Make sure to wake the Target before enabling Legacy
-         * Interrupt.
-         */
-        iowrite32(PCIE_SOC_WAKE_V_MASK,
-                  ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS +
-                  PCIE_SOC_WAKE_ADDRESS);
+        return 0;
+}
+
+static int ath10k_pci_request_irq(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
 
-        ath10k_pci_wait(ar);
+        switch (ar_pci->num_msi_intrs) {
+        case 0:
+                return ath10k_pci_request_irq_legacy(ar);
+        case 1:
+                return ath10k_pci_request_irq_msi(ar);
+        case MSI_NUM_REQUEST:
+                return ath10k_pci_request_irq_msix(ar);
+        }
 
-        /*
-         * A potential race occurs here: The CORE_BASE write
-         * depends on target correctly decoding AXI address but
-         * host won't know when target writes BAR to CORE_CTRL.
-         * This write might get lost if target has NOT written BAR.
-         * For now, fix the race by repeating the write in below
-         * synchronization checking.
-         */
-        iowrite32(PCIE_INTR_FIRMWARE_MASK |
-                  PCIE_INTR_CE_MASK_ALL,
-                  ar_pci->mem + (SOC_CORE_BASE_ADDRESS |
-                                 PCIE_INTR_ENABLE_ADDRESS));
-        iowrite32(PCIE_SOC_WAKE_RESET,
-                  ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS +
-                  PCIE_SOC_WAKE_ADDRESS);
-
-        ath10k_info("legacy interrupt handling\n");
-        return 0;
+        ath10k_warn("unknown irq configuration upon request\n");
+        return -EINVAL;
 }
 
-static int ath10k_pci_start_intr(struct ath10k *ar)
+static void ath10k_pci_free_irq(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        int i;
+
+        /* There's at least one interrupt irregardless whether its legacy INTR
+         * or MSI or MSI-X */
+        for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
+                free_irq(ar_pci->pdev->irq + i, ar);
+}
+
+static void ath10k_pci_init_irq_tasklets(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int num = MSI_NUM_REQUEST;
-        int ret;
         int i;
 
-        tasklet_init(&ar_pci->intr_tq, ath10k_pci_tasklet, (unsigned long) ar);
+        tasklet_init(&ar_pci->intr_tq, ath10k_pci_tasklet, (unsigned long)ar);
         tasklet_init(&ar_pci->msi_fw_err, ath10k_msi_err_tasklet,
-                     (unsigned long) ar);
+                     (unsigned long)ar);
+        tasklet_init(&ar_pci->early_irq_tasklet, ath10k_pci_early_irq_tasklet,
+                     (unsigned long)ar);
 
         for (i = 0; i < CE_COUNT; i++) {
                 ar_pci->pipe_info[i].ar_pci = ar_pci;
-                tasklet_init(&ar_pci->pipe_info[i].intr,
-                             ath10k_pci_ce_tasklet,
+                tasklet_init(&ar_pci->pipe_info[i].intr, ath10k_pci_ce_tasklet,
                              (unsigned long)&ar_pci->pipe_info[i]);
         }
+}
+
+static int ath10k_pci_init_irq(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+        bool msix_supported = test_bit(ATH10K_PCI_FEATURE_MSI_X,
+                                       ar_pci->features);
+        int ret;
 
-        if (!test_bit(ATH10K_PCI_FEATURE_MSI_X, ar_pci->features))
-                num = 1;
+        ath10k_pci_init_irq_tasklets(ar);
 
-        if (num > 1) {
-                ret = ath10k_pci_start_intr_msix(ar, num);
+        if (ath10k_pci_irq_mode != ATH10K_PCI_IRQ_AUTO &&
+            !test_bit(ATH10K_FLAG_FIRST_BOOT_DONE, &ar->dev_flags))
+                ath10k_info("limiting irq mode to: %d\n", ath10k_pci_irq_mode);
+
+        /* Try MSI-X */
+        if (ath10k_pci_irq_mode == ATH10K_PCI_IRQ_AUTO && msix_supported) {
+                ar_pci->num_msi_intrs = MSI_NUM_REQUEST;
+                ret = pci_enable_msi_block(ar_pci->pdev, ar_pci->num_msi_intrs);
                 if (ret == 0)
-                        goto exit;
+                        return 0;
+                if (ret > 0)
+                        pci_disable_msi(ar_pci->pdev);
 
-                ath10k_warn("MSI-X didn't succeed (%d), trying MSI\n", ret);
-                num = 1;
+                /* fall-through */
         }
 
-        if (num == 1) {
-                ret = ath10k_pci_start_intr_msi(ar);
+        /* Try MSI */
+        if (ath10k_pci_irq_mode != ATH10K_PCI_IRQ_LEGACY) {
+                ar_pci->num_msi_intrs = 1;
+                ret = pci_enable_msi(ar_pci->pdev);
                 if (ret == 0)
-                        goto exit;
+                        return 0;
 
-                ath10k_warn("MSI didn't succeed (%d), trying legacy INTR\n",
-                            ret);
-                num = 0;
+                /* fall-through */
         }
 
-        ret = ath10k_pci_start_intr_legacy(ar);
+        /* Try legacy irq
+         *
+         * A potential race occurs here: The CORE_BASE write
+         * depends on target correctly decoding AXI address but
+         * host won't know when target writes BAR to CORE_CTRL.
+         * This write might get lost if target has NOT written BAR.
+         * For now, fix the race by repeating the write in below
+         * synchronization checking. */
+        ar_pci->num_msi_intrs = 0;
 
-exit:
-        ar_pci->num_msi_intrs = num;
-        ar_pci->ce_count = CE_COUNT;
-        return ret;
+        ret = ath10k_pci_wake(ar);
+        if (ret) {
+                ath10k_warn("failed to wake target: %d\n", ret);
+                return ret;
+        }
+
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + PCIE_INTR_ENABLE_ADDRESS,
+                           PCIE_INTR_FIRMWARE_MASK | PCIE_INTR_CE_MASK_ALL);
+        ath10k_pci_sleep(ar);
+
+        return 0;
 }
 
-static void ath10k_pci_stop_intr(struct ath10k *ar)
+static int ath10k_pci_deinit_irq_legacy(struct ath10k *ar)
 {
-        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
-        int i;
+        int ret;
 
-        /* There's at least one interrupt irregardless whether its legacy INTR
-         * or MSI or MSI-X */
-        for (i = 0; i < max(1, ar_pci->num_msi_intrs); i++)
-                free_irq(ar_pci->pdev->irq + i, ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret) {
+                ath10k_warn("failed to wake target: %d\n", ret);
+                return ret;
+        }
 
-        if (ar_pci->num_msi_intrs > 0)
+        ath10k_pci_write32(ar, SOC_CORE_BASE_ADDRESS + PCIE_INTR_ENABLE_ADDRESS,
+                           0);
+        ath10k_pci_sleep(ar);
+
+        return 0;
+}
+
+static int ath10k_pci_deinit_irq(struct ath10k *ar)
+{
+        struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
+
+        switch (ar_pci->num_msi_intrs) {
+        case 0:
+                return ath10k_pci_deinit_irq_legacy(ar);
+        case 1:
+                /* fall-through */
+        case MSI_NUM_REQUEST:
                 pci_disable_msi(ar_pci->pdev);
+                return 0;
+        }
+
+        ath10k_warn("unknown irq configuration upon deinit\n");
+        return -EINVAL;
 }
 
-static int ath10k_pci_reset_target(struct ath10k *ar)
+static int ath10k_pci_wait_for_target_init(struct ath10k *ar)
 {
         struct ath10k_pci *ar_pci = ath10k_pci_priv(ar);
         int wait_limit = 300; /* 3 sec */
+        int ret;
 
-        /* Wait for Target to finish initialization before we proceed. */
-        iowrite32(PCIE_SOC_WAKE_V_MASK,
-                  ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS +
-                  PCIE_SOC_WAKE_ADDRESS);
-
-        ath10k_pci_wait(ar);
+        ret = ath10k_pci_wake(ar);
+        if (ret) {
+                ath10k_err("failed to wake up target: %d\n", ret);
+                return ret;
+        }
 
         while (wait_limit-- &&
                !(ioread32(ar_pci->mem + FW_INDICATOR_ADDRESS) &
@@ -2264,34 +2513,26 @@ static int ath10k_pci_reset_target(struct ath10k *ar)
         }
 
         if (wait_limit < 0) {
-                ath10k_err("Target stalled\n");
-                iowrite32(PCIE_SOC_WAKE_RESET,
-                          ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS +
-                          PCIE_SOC_WAKE_ADDRESS);
-                return -EIO;
+                ath10k_err("target stalled\n");
+                ret = -EIO;
+                goto out;
         }
 
-        iowrite32(PCIE_SOC_WAKE_RESET,
-                  ar_pci->mem + PCIE_LOCAL_BASE_ADDRESS +
-                  PCIE_SOC_WAKE_ADDRESS);
-
-        return 0;
+out:
+        ath10k_pci_sleep(ar);
+        return ret;
 }
 
-static void ath10k_pci_device_reset(struct ath10k *ar)
+static int ath10k_pci_device_reset(struct ath10k *ar)
 {
-        int i;
+        int i, ret;
         u32 val;
 
-        if (!SOC_GLOBAL_RESET_ADDRESS)
-                return;
-
-        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS,
-                               PCIE_SOC_WAKE_V_MASK);
-        for (i = 0; i < ATH_PCI_RESET_WAIT_MAX; i++) {
-                if (ath10k_pci_target_is_awake(ar))
-                        break;
-                msleep(1);
+        ret = ath10k_do_pci_wake(ar);
+        if (ret) {
+                ath10k_err("failed to wake up target: %d\n",
+                           ret);
+                return ret;
         }
 
         /* Put Target, including PCIe, into RESET. */
@@ -2317,7 +2558,8 @@ static void ath10k_pci_device_reset(struct ath10k *ar)
                 msleep(1);
         }
 
-        ath10k_pci_reg_write32(ar, PCIE_SOC_WAKE_ADDRESS, PCIE_SOC_WAKE_RESET);
+        ath10k_do_pci_sleep(ar);
+        return 0;
 }
 
 static void ath10k_pci_dump_features(struct ath10k_pci *ar_pci)
@@ -2374,7 +2616,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         ar = ath10k_core_create(ar_pci, ar_pci->dev, &ath10k_pci_hif_ops);
         if (!ar) {
-                ath10k_err("ath10k_core_create failed!\n");
+                ath10k_err("failed to create driver core\n");
                 ret = -EINVAL;
                 goto err_ar_pci;
         }
@@ -2393,20 +2635,20 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
          */
         ret = pci_assign_resource(pdev, BAR_NUM);
         if (ret) {
-                ath10k_err("cannot assign PCI space: %d\n", ret);
+                ath10k_err("failed to assign PCI space: %d\n", ret);
                 goto err_ar;
         }
 
         ret = pci_enable_device(pdev);
         if (ret) {
-                ath10k_err("cannot enable PCI device: %d\n", ret);
+                ath10k_err("failed to enable PCI device: %d\n", ret);
                 goto err_ar;
         }
 
         /* Request MMIO resources */
         ret = pci_request_region(pdev, BAR_NUM, "ath");
         if (ret) {
-                ath10k_err("PCI MMIO reservation error: %d\n", ret);
+                ath10k_err("failed to request MMIO region: %d\n", ret);
                 goto err_device;
         }
 
@@ -2416,13 +2658,13 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
          */
         ret = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
         if (ret) {
-                ath10k_err("32-bit DMA not available: %d\n", ret);
+                ath10k_err("failed to set DMA mask to 32-bit: %d\n", ret);
                 goto err_region;
         }
 
         ret = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
         if (ret) {
-                ath10k_err("cannot enable 32-bit consistent DMA\n");
+                ath10k_err("failed to set consistent DMA mask to 32-bit\n");
                 goto err_region;
         }
 
@@ -2439,7 +2681,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         /* Arrange for access to Target SoC registers. */
         mem = pci_iomap(pdev, BAR_NUM, 0);
         if (!mem) {
-                ath10k_err("PCI iomap error\n");
+                ath10k_err("failed to perform IOMAP for BAR%d\n", BAR_NUM);
                 ret = -EIO;
                 goto err_master;
         }
@@ -2451,11 +2693,10 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
         ret = ath10k_do_pci_wake(ar);
         if (ret) {
                 ath10k_err("Failed to get chip id: %d\n", ret);
-                return ret;
+                goto err_iomap;
         }
 
-        chip_id = ath10k_pci_read32(ar,
-                                    RTC_SOC_BASE_ADDRESS + SOC_CHIP_ID_ADDRESS);
+        chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS);
 
         ath10k_do_pci_sleep(ar);
 
@@ -2463,7 +2704,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev,
 
         ret = ath10k_core_register(ar, chip_id);
         if (ret) {
-                ath10k_err("could not register driver core (%d)\n", ret);
+                ath10k_err("failed to register driver core: %d\n", ret);
                 goto err_iomap;
         }
 
@@ -2529,7 +2770,7 @@ static int __init ath10k_pci_init(void)
 
         ret = pci_register_driver(&ath10k_pci_driver);
         if (ret)
-                ath10k_err("pci_register_driver failed [%d]\n", ret);
+                ath10k_err("failed to register PCI driver: %d\n", ret);
 
         return ret;
 }
diff --git a/drivers/net/wireless/ath/ath10k/pci.h b/drivers/net/wireless/ath/ath10k/pci.h
index 52fb7b973571..a4f32038c440 100644
--- a/drivers/net/wireless/ath/ath10k/pci.h
+++ b/drivers/net/wireless/ath/ath10k/pci.h
@@ -198,9 +198,7 @@ struct ath10k_pci {
 
         struct tasklet_struct intr_tq;
         struct tasklet_struct msi_fw_err;
-
-        /* Number of Copy Engines supported */
-        unsigned int ce_count;
+        struct tasklet_struct early_irq_tasklet;
 
         int started;
 
@@ -318,6 +316,16 @@ static inline u32 ath10k_pci_read32(struct ath10k *ar, u32 offset)
         return ioread32(ar_pci->mem + offset);
 }
 
+static inline u32 ath10k_pci_soc_read32(struct ath10k *ar, u32 addr)
+{
+        return ath10k_pci_read32(ar, RTC_SOC_BASE_ADDRESS + addr);
+}
+
+static inline void ath10k_pci_soc_write32(struct ath10k *ar, u32 addr, u32 val)
+{
+        ath10k_pci_write32(ar, RTC_SOC_BASE_ADDRESS + addr, val);
+}
+
 int ath10k_do_pci_wake(struct ath10k *ar);
 void ath10k_do_pci_sleep(struct ath10k *ar);
 
diff --git a/drivers/net/wireless/ath/ath10k/trace.h b/drivers/net/wireless/ath/ath10k/trace.h
index 90817ddc92ba..4eb2ecbc06ef 100644
--- a/drivers/net/wireless/ath/ath10k/trace.h
+++ b/drivers/net/wireless/ath/ath10k/trace.h
@@ -182,6 +182,27 @@ TRACE_EVENT(ath10k_htt_stats,
         )
 );
 
+TRACE_EVENT(ath10k_wmi_dbglog,
+        TP_PROTO(void *buf, size_t buf_len),
+
+        TP_ARGS(buf, buf_len),
+
+        TP_STRUCT__entry(
+                __field(size_t, buf_len)
+                __dynamic_array(u8, buf, buf_len)
+        ),
+
+        TP_fast_assign(
+                __entry->buf_len = buf_len;
+                memcpy(__get_dynamic_array(buf), buf, buf_len);
+        ),
+
+        TP_printk(
+                "len %zu",
+                __entry->buf_len
+        )
+);
+
 #endif /* _TRACE_H_ || TRACE_HEADER_MULTI_READ*/
 
 /* we don't want to use include/trace/events */
diff --git a/drivers/net/wireless/ath/ath10k/txrx.c b/drivers/net/wireless/ath/ath10k/txrx.c
index 5ae373a1e294..74f45fa6f428 100644
--- a/drivers/net/wireless/ath/ath10k/txrx.c
+++ b/drivers/net/wireless/ath/ath10k/txrx.c
@@ -75,6 +75,7 @@ void ath10k_txrx_tx_unref(struct ath10k_htt *htt,
         ath10k_report_offchan_tx(htt->ar, msdu);
 
         info = IEEE80211_SKB_CB(msdu);
+        memset(&info->status, 0, sizeof(info->status));
 
         if (tx_done->discard) {
                 ieee80211_free_txskb(htt->ar->hw, msdu);
@@ -183,7 +184,7 @@ static void process_rx_rates(struct ath10k *ar, struct htt_rx_info *info,
                 /* VHT-SIG-A1 in info 1, VHT-SIG-A2 in info2
                    TODO check this */
                 mcs = (info2 >> 4) & 0x0F;
-                nss = (info1 >> 10) & 0x07;
+                nss = ((info1 >> 10) & 0x07) + 1;
                 bw = info1 & 3;
                 sgi = info2 & 1;
 
@@ -230,12 +231,15 @@ void ath10k_process_rx(struct ath10k *ar, struct htt_rx_info *info)
                                 ~IEEE80211_FCTL_PROTECTED);
         }
 
-        if (info->status == HTT_RX_IND_MPDU_STATUS_TKIP_MIC_ERR)
+        if (info->mic_err)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
         if (info->fcs_err)
                 status->flag |= RX_FLAG_FAILED_FCS_CRC;
 
+        if (info->amsdu_more)
+                status->flag |= RX_FLAG_AMSDU_MORE;
+
         status->signal = info->signal;
 
         spin_lock_bh(&ar->data_lock);
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index ccf3597fd9e2..712a606a080a 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -16,6 +16,7 @@
  */
 
 #include <linux/skbuff.h>
+#include <linux/ctype.h>
 
 #include "core.h"
 #include "htc.h"
@@ -674,10 +675,8 @@ int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb)
 
         /* Send the management frame buffer to the target */
         ret = ath10k_wmi_cmd_send(ar, wmi_skb, ar->wmi.cmd->mgmt_tx_cmdid);
-        if (ret) {
-                dev_kfree_skb_any(skb);
+        if (ret)
                 return ret;
-        }
 
         /* TODO: report tx status to mac80211 - temporary just ACK */
         info->flags |= IEEE80211_TX_STAT_ACK;
@@ -877,6 +876,7 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         struct wmi_mgmt_rx_event_v2 *ev_v2;
         struct wmi_mgmt_rx_hdr_v1 *ev_hdr;
         struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
+        struct ieee80211_channel *ch;
         struct ieee80211_hdr *hdr;
         u32 rx_status;
         u32 channel;
@@ -909,6 +909,11 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         ath10k_dbg(ATH10K_DBG_MGMT,
                    "event mgmt rx status %08x\n", rx_status);
 
+        if (test_bit(ATH10K_CAC_RUNNING, &ar->dev_flags)) {
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
         if (rx_status & WMI_RX_STATUS_ERR_DECRYPT) {
                 dev_kfree_skb(skb);
                 return 0;
@@ -924,7 +929,25 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         if (rx_status & WMI_RX_STATUS_ERR_MIC)
                 status->flag |= RX_FLAG_MMIC_ERROR;
 
-        status->band = phy_mode_to_band(phy_mode);
+        /* HW can Rx CCK rates on 5GHz. In that case phy_mode is set to
+         * MODE_11B. This means phy_mode is not a reliable source for the band
+         * of mgmt rx. */
+
+        ch = ar->scan_channel;
+        if (!ch)
+                ch = ar->rx_channel;
+
+        if (ch) {
+                status->band = ch->band;
+
+                if (phy_mode == MODE_11B &&
+                    status->band == IEEE80211_BAND_5GHZ)
+                        ath10k_dbg(ATH10K_DBG_MGMT, "wmi mgmt rx 11b (CCK) on 5GHz\n");
+        } else {
+                ath10k_warn("using (unreliable) phy_mode to extract band for mgmt rx\n");
+                status->band = phy_mode_to_band(phy_mode);
+        }
+
         status->freq = ieee80211_channel_to_frequency(channel, status->band);
         status->signal = snr + ATH10K_DEFAULT_NOISE_FLOOR;
         status->rate_idx = get_rate_idx(rate, status->band);
@@ -934,7 +957,11 @@ static int ath10k_wmi_event_mgmt_rx(struct ath10k *ar, struct sk_buff *skb)
         hdr = (struct ieee80211_hdr *)skb->data;
         fc = le16_to_cpu(hdr->frame_control);
 
-        if (fc & IEEE80211_FCTL_PROTECTED) {
+        /* FW delivers WEP Shared Auth frame with Protected Bit set and
+         * encrypted payload. However in case of PMF it delivers decrypted
+         * frames with Protected Bit set. */
+        if (ieee80211_has_protected(hdr->frame_control) &&
+            !ieee80211_is_auth(hdr->frame_control)) {
                 status->flag |= RX_FLAG_DECRYPTED | RX_FLAG_IV_STRIPPED |
                                 RX_FLAG_MMIC_STRIPPED;
                 hdr->frame_control = __cpu_to_le16(fc &
@@ -1044,9 +1071,14 @@ static void ath10k_wmi_event_echo(struct ath10k *ar, struct sk_buff *skb)
         ath10k_dbg(ATH10K_DBG_WMI, "WMI_ECHO_EVENTID\n");
 }
 
-static void ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
+static int ath10k_wmi_event_debug_mesg(struct ath10k *ar, struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_DEBUG_MESG_EVENTID\n");
+        ath10k_dbg(ATH10K_DBG_WMI, "wmi event debug mesg len %d\n",
+                   skb->len);
+
+        trace_ath10k_wmi_dbglog(skb->data, skb->len);
+
+        return 0;
 }
 
 static void ath10k_wmi_event_update_stats(struct ath10k *ar,
@@ -1383,9 +1415,259 @@ static void ath10k_wmi_event_tbttoffset_update(struct ath10k *ar,
         ath10k_dbg(ATH10K_DBG_WMI, "WMI_TBTTOFFSET_UPDATE_EVENTID\n");
 }
 
+static void ath10k_dfs_radar_report(struct ath10k *ar,
+                                    struct wmi_single_phyerr_rx_event *event,
+                                    struct phyerr_radar_report *rr,
+                                    u64 tsf)
+{
+        u32 reg0, reg1, tsf32l;
+        struct pulse_event pe;
+        u64 tsf64;
+        u8 rssi, width;
+
+        reg0 = __le32_to_cpu(rr->reg0);
+        reg1 = __le32_to_cpu(rr->reg1);
+
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi phyerr radar report chirp %d max_width %d agc_total_gain %d pulse_delta_diff %d\n",
+                   MS(reg0, RADAR_REPORT_REG0_PULSE_IS_CHIRP),
+                   MS(reg0, RADAR_REPORT_REG0_PULSE_IS_MAX_WIDTH),
+                   MS(reg0, RADAR_REPORT_REG0_AGC_TOTAL_GAIN),
+                   MS(reg0, RADAR_REPORT_REG0_PULSE_DELTA_DIFF));
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi phyerr radar report pulse_delta_pean %d pulse_sidx %d fft_valid %d agc_mb_gain %d subchan_mask %d\n",
+                   MS(reg0, RADAR_REPORT_REG0_PULSE_DELTA_PEAK),
+                   MS(reg0, RADAR_REPORT_REG0_PULSE_SIDX),
+                   MS(reg1, RADAR_REPORT_REG1_PULSE_SRCH_FFT_VALID),
+                   MS(reg1, RADAR_REPORT_REG1_PULSE_AGC_MB_GAIN),
+                   MS(reg1, RADAR_REPORT_REG1_PULSE_SUBCHAN_MASK));
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi phyerr radar report pulse_tsf_offset 0x%X pulse_dur: %d\n",
+                   MS(reg1, RADAR_REPORT_REG1_PULSE_TSF_OFFSET),
+                   MS(reg1, RADAR_REPORT_REG1_PULSE_DUR));
+
+        if (!ar->dfs_detector)
+                return;
+
+        /* report event to DFS pattern detector */
+        tsf32l = __le32_to_cpu(event->hdr.tsf_timestamp);
+        tsf64 = tsf & (~0xFFFFFFFFULL);
+        tsf64 |= tsf32l;
+
+        width = MS(reg1, RADAR_REPORT_REG1_PULSE_DUR);
+        rssi = event->hdr.rssi_combined;
+
+        /* hardware store this as 8 bit signed value,
+         * set to zero if negative number
+         */
+        if (rssi & 0x80)
+                rssi = 0;
+
+        pe.ts = tsf64;
+        pe.freq = ar->hw->conf.chandef.chan->center_freq;
+        pe.width = width;
+        pe.rssi = rssi;
+
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "dfs add pulse freq: %d, width: %d, rssi %d, tsf: %llX\n",
+                   pe.freq, pe.width, pe.rssi, pe.ts);
+
+        ATH10K_DFS_STAT_INC(ar, pulses_detected);
+
+        if (!ar->dfs_detector->add_pulse(ar->dfs_detector, &pe)) {
+                ath10k_dbg(ATH10K_DBG_REGULATORY,
+                           "dfs no pulse pattern detected, yet\n");
+                return;
+        }
+
+        ath10k_dbg(ATH10K_DBG_REGULATORY, "dfs radar detected\n");
+        ATH10K_DFS_STAT_INC(ar, radar_detected);
+
+        /* Control radar events reporting in debugfs file
+           dfs_block_radar_events */
+        if (ar->dfs_block_radar_events) {
+                ath10k_info("DFS Radar detected, but ignored as requested\n");
+                return;
+        }
+
+        ieee80211_radar_detected(ar->hw);
+}
+
+static int ath10k_dfs_fft_report(struct ath10k *ar,
+                                 struct wmi_single_phyerr_rx_event *event,
+                                 struct phyerr_fft_report *fftr,
+                                 u64 tsf)
+{
+        u32 reg0, reg1;
+        u8 rssi, peak_mag;
+
+        reg0 = __le32_to_cpu(fftr->reg0);
+        reg1 = __le32_to_cpu(fftr->reg1);
+        rssi = event->hdr.rssi_combined;
+
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi phyerr fft report total_gain_db %d base_pwr_db %d fft_chn_idx %d peak_sidx %d\n",
+                   MS(reg0, SEARCH_FFT_REPORT_REG0_TOTAL_GAIN_DB),
+                   MS(reg0, SEARCH_FFT_REPORT_REG0_BASE_PWR_DB),
+                   MS(reg0, SEARCH_FFT_REPORT_REG0_FFT_CHN_IDX),
+                   MS(reg0, SEARCH_FFT_REPORT_REG0_PEAK_SIDX));
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi phyerr fft report rel_pwr_db %d avgpwr_db %d peak_mag %d num_store_bin %d\n",
+                   MS(reg1, SEARCH_FFT_REPORT_REG1_RELPWR_DB),
+                   MS(reg1, SEARCH_FFT_REPORT_REG1_AVGPWR_DB),
+                   MS(reg1, SEARCH_FFT_REPORT_REG1_PEAK_MAG),
+                   MS(reg1, SEARCH_FFT_REPORT_REG1_NUM_STR_BINS_IB));
+
+        peak_mag = MS(reg1, SEARCH_FFT_REPORT_REG1_PEAK_MAG);
+
+        /* false event detection */
+        if (rssi == DFS_RSSI_POSSIBLY_FALSE &&
+            peak_mag < 2 * DFS_PEAK_MAG_THOLD_POSSIBLY_FALSE) {
+                ath10k_dbg(ATH10K_DBG_REGULATORY, "dfs false pulse detected\n");
+                ATH10K_DFS_STAT_INC(ar, pulses_discarded);
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static void ath10k_wmi_event_dfs(struct ath10k *ar,
+                                 struct wmi_single_phyerr_rx_event *event,
+                                 u64 tsf)
+{
+        int buf_len, tlv_len, res, i = 0;
+        struct phyerr_tlv *tlv;
+        struct phyerr_radar_report *rr;
+        struct phyerr_fft_report *fftr;
+        u8 *tlv_buf;
+
+        buf_len = __le32_to_cpu(event->hdr.buf_len);
+        ath10k_dbg(ATH10K_DBG_REGULATORY,
+                   "wmi event dfs err_code %d rssi %d tsfl 0x%X tsf64 0x%llX len %d\n",
+                   event->hdr.phy_err_code, event->hdr.rssi_combined,
+                   __le32_to_cpu(event->hdr.tsf_timestamp), tsf, buf_len);
+
+        /* Skip event if DFS disabled */
+        if (!config_enabled(CONFIG_ATH10K_DFS_CERTIFIED))
+                return;
+
+        ATH10K_DFS_STAT_INC(ar, pulses_total);
+
+        while (i < buf_len) {
+                if (i + sizeof(*tlv) > buf_len) {
+                        ath10k_warn("too short buf for tlv header (%d)\n", i);
+                        return;
+                }
+
+                tlv = (struct phyerr_tlv *)&event->bufp[i];
+                tlv_len = __le16_to_cpu(tlv->len);
+                tlv_buf = &event->bufp[i + sizeof(*tlv)];
+                ath10k_dbg(ATH10K_DBG_REGULATORY,
+                           "wmi event dfs tlv_len %d tlv_tag 0x%02X tlv_sig 0x%02X\n",
+                           tlv_len, tlv->tag, tlv->sig);
+
+                switch (tlv->tag) {
+                case PHYERR_TLV_TAG_RADAR_PULSE_SUMMARY:
+                        if (i + sizeof(*tlv) + sizeof(*rr) > buf_len) {
+                                ath10k_warn("too short radar pulse summary (%d)\n",
+                                            i);
+                                return;
+                        }
+
+                        rr = (struct phyerr_radar_report *)tlv_buf;
+                        ath10k_dfs_radar_report(ar, event, rr, tsf);
+                        break;
+                case PHYERR_TLV_TAG_SEARCH_FFT_REPORT:
+                        if (i + sizeof(*tlv) + sizeof(*fftr) > buf_len) {
+                                ath10k_warn("too short fft report (%d)\n", i);
+                                return;
+                        }
+
+                        fftr = (struct phyerr_fft_report *)tlv_buf;
+                        res = ath10k_dfs_fft_report(ar, event, fftr, tsf);
+                        if (res)
+                                return;
+                        break;
+                }
+
+                i += sizeof(*tlv) + tlv_len;
+        }
+}
+
+static void ath10k_wmi_event_spectral_scan(struct ath10k *ar,
+                                struct wmi_single_phyerr_rx_event *event,
+                                u64 tsf)
+{
+        ath10k_dbg(ATH10K_DBG_WMI, "wmi event spectral scan\n");
+}
+
 static void ath10k_wmi_event_phyerr(struct ath10k *ar, struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_PHYERR_EVENTID\n");
+        struct wmi_comb_phyerr_rx_event *comb_event;
+        struct wmi_single_phyerr_rx_event *event;
+        u32 count, i, buf_len, phy_err_code;
+        u64 tsf;
+        int left_len = skb->len;
+
+        ATH10K_DFS_STAT_INC(ar, phy_errors);
+
+        /* Check if combined event available */
+        if (left_len < sizeof(*comb_event)) {
+                ath10k_warn("wmi phyerr combined event wrong len\n");
+                return;
+        }
+
+        left_len -= sizeof(*comb_event);
+
+        /* Check number of included events */
+        comb_event = (struct wmi_comb_phyerr_rx_event *)skb->data;
+        count = __le32_to_cpu(comb_event->hdr.num_phyerr_events);
+
+        tsf = __le32_to_cpu(comb_event->hdr.tsf_u32);
+        tsf <<= 32;
+        tsf |= __le32_to_cpu(comb_event->hdr.tsf_l32);
+
+        ath10k_dbg(ATH10K_DBG_WMI,
+                   "wmi event phyerr count %d tsf64 0x%llX\n",
+                   count, tsf);
+
+        event = (struct wmi_single_phyerr_rx_event *)comb_event->bufp;
+        for (i = 0; i < count; i++) {
+                /* Check if we can read event header */
+                if (left_len < sizeof(*event)) {
+                        ath10k_warn("single event (%d) wrong head len\n", i);
+                        return;
+                }
+
+                left_len -= sizeof(*event);
+
+                buf_len = __le32_to_cpu(event->hdr.buf_len);
+                phy_err_code = event->hdr.phy_err_code;
+
+                if (left_len < buf_len) {
+                        ath10k_warn("single event (%d) wrong buf len\n", i);
+                        return;
+                }
+
+                left_len -= buf_len;
+
+                switch (phy_err_code) {
+                case PHY_ERROR_RADAR:
+                        ath10k_wmi_event_dfs(ar, event, tsf);
+                        break;
+                case PHY_ERROR_SPECTRAL_SCAN:
+                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        break;
+                case PHY_ERROR_FALSE_RADAR_EXT:
+                        ath10k_wmi_event_dfs(ar, event, tsf);
+                        ath10k_wmi_event_spectral_scan(ar, event, tsf);
+                        break;
+                default:
+                        break;
+                }
+
+                event += sizeof(*event) + buf_len;
+        }
 }
 
 static void ath10k_wmi_event_roam(struct ath10k *ar, struct sk_buff *skb)
@@ -1400,9 +1682,37 @@ static void ath10k_wmi_event_profile_match(struct ath10k *ar,
 }
 
 static void ath10k_wmi_event_debug_print(struct ath10k *ar,
-                                  struct sk_buff *skb)
+                                         struct sk_buff *skb)
 {
-        ath10k_dbg(ATH10K_DBG_WMI, "WMI_DEBUG_PRINT_EVENTID\n");
+        char buf[101], c;
+        int i;
+
+        for (i = 0; i < sizeof(buf) - 1; i++) {
+                if (i >= skb->len)
+                        break;
+
+                c = skb->data[i];
+
+                if (c == '\0')
+                        break;
+
+                if (isascii(c) && isprint(c))
+                        buf[i] = c;
+                else
+                        buf[i] = '.';
+        }
+
+        if (i == sizeof(buf) - 1)
+                ath10k_warn("wmi debug print truncated: %d\n", skb->len);
+
+        /* for some reason the debug prints end with \n, remove that */
+        if (skb->data[i - 1] == '\n')
+                i--;
+
+        /* the last byte is always reserved for the null character */
+        buf[i] = '\0';
+
+        ath10k_dbg(ATH10K_DBG_WMI, "wmi event debug print '%s'\n", buf);
 }
 
 static void ath10k_wmi_event_pdev_qvit(struct ath10k *ar, struct sk_buff *skb)
@@ -2062,6 +2372,7 @@ int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
 {
         struct wmi_set_channel_cmd *cmd;
         struct sk_buff *skb;
+        u32 ch_flags = 0;
 
         if (arg->passive)
                 return -EINVAL;
@@ -2070,10 +2381,14 @@ int ath10k_wmi_pdev_set_channel(struct ath10k *ar,
         if (!skb)
                 return -ENOMEM;
 
+        if (arg->chan_radar)
+                ch_flags |= WMI_CHAN_FLAG_DFS;
+
         cmd = (struct wmi_set_channel_cmd *)skb->data;
         cmd->chan.mhz               = __cpu_to_le32(arg->freq);
         cmd->chan.band_center_freq1 = __cpu_to_le32(arg->freq);
         cmd->chan.mode              = arg->mode;
+        cmd->chan.flags            |= __cpu_to_le32(ch_flags);
         cmd->chan.min_power         = arg->min_power;
         cmd->chan.max_power         = arg->max_power;
         cmd->chan.reg_power         = arg->max_reg_power;
@@ -2211,7 +2526,7 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
         }
 
         ath10k_dbg(ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   __cpu_to_le32(ar->wmi.num_mem_chunks));
+                   ar->wmi.num_mem_chunks);
 
         cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
 
@@ -2224,10 +2539,10 @@ static int ath10k_wmi_main_cmd_init(struct ath10k *ar)
                         __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
 
                 ath10k_dbg(ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%x\n",
+                           "wmi chunk %d len %d requested, addr 0x%llx\n",
                            i,
-                           cmd->host_mem_chunks[i].size,
-                           cmd->host_mem_chunks[i].ptr);
+                           ar->wmi.mem_chunks[i].len,
+                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
         }
 out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
@@ -2302,7 +2617,7 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
         }
 
         ath10k_dbg(ATH10K_DBG_WMI, "wmi sending %d memory chunks info.\n",
-                   __cpu_to_le32(ar->wmi.num_mem_chunks));
+                   ar->wmi.num_mem_chunks);
 
         cmd->num_host_mem_chunks = __cpu_to_le32(ar->wmi.num_mem_chunks);
 
@@ -2315,10 +2630,10 @@ static int ath10k_wmi_10x_cmd_init(struct ath10k *ar)
                         __cpu_to_le32(ar->wmi.mem_chunks[i].req_id);
 
                 ath10k_dbg(ATH10K_DBG_WMI,
-                           "wmi chunk %d len %d requested, addr 0x%x\n",
+                           "wmi chunk %d len %d requested, addr 0x%llx\n",
                            i,
-                           cmd->host_mem_chunks[i].size,
-                           cmd->host_mem_chunks[i].ptr);
+                           ar->wmi.mem_chunks[i].len,
+                           (unsigned long long)ar->wmi.mem_chunks[i].paddr);
         }
 out:
         memcpy(&cmd->resource_config, &config, sizeof(config));
@@ -2622,6 +2937,7 @@ static int ath10k_wmi_vdev_start_restart(struct ath10k *ar,
         struct sk_buff *skb;
         const char *cmdname;
         u32 flags = 0;
+        u32 ch_flags = 0;
 
         if (cmd_id != ar->wmi.cmd->vdev_start_request_cmdid &&
             cmd_id != ar->wmi.cmd->vdev_restart_request_cmdid)
@@ -2648,6 +2964,8 @@ static int ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 flags |= WMI_VDEV_START_HIDDEN_SSID;
         if (arg->pmf_enabled)
                 flags |= WMI_VDEV_START_PMF_ENABLED;
+        if (arg->channel.chan_radar)
+                ch_flags |= WMI_CHAN_FLAG_DFS;
 
         cmd = (struct wmi_vdev_start_request_cmd *)skb->data;
         cmd->vdev_id         = __cpu_to_le32(arg->vdev_id);
@@ -2669,6 +2987,7 @@ static int ath10k_wmi_vdev_start_restart(struct ath10k *ar,
                 __cpu_to_le32(arg->channel.band_center_freq1);
 
         cmd->chan.mode = arg->channel.mode;
+        cmd->chan.flags |= __cpu_to_le32(ch_flags);
         cmd->chan.min_power = arg->channel.min_power;
         cmd->chan.max_power = arg->channel.max_power;
         cmd->chan.reg_power = arg->channel.max_reg_power;
@@ -2676,9 +2995,10 @@ static int ath10k_wmi_vdev_start_restart(struct ath10k *ar,
         cmd->chan.antenna_max = arg->channel.max_antenna_gain;
 
         ath10k_dbg(ATH10K_DBG_WMI,
-                   "wmi vdev %s id 0x%x freq %d, mode %d, ch_flags: 0x%0X,"
-                   "max_power: %d\n", cmdname, arg->vdev_id, arg->channel.freq,
-                   arg->channel.mode, flags, arg->channel.max_power);
+                   "wmi vdev %s id 0x%x flags: 0x%0X, freq %d, mode %d, "
+                   "ch_flags: 0x%0X, max_power: %d\n", cmdname, arg->vdev_id,
+                   flags, arg->channel.freq, arg->channel.mode,
+                   cmd->chan.flags, arg->channel.max_power);
 
         return ath10k_wmi_cmd_send(ar, skb, cmd_id);
 }
@@ -3012,6 +3332,8 @@ int ath10k_wmi_scan_chan_list(struct ath10k *ar,
                         flags |= WMI_CHAN_FLAG_ALLOW_VHT;
                 if (ch->ht40plus)
                         flags |= WMI_CHAN_FLAG_HT40_PLUS;
+                if (ch->chan_radar)
+                        flags |= WMI_CHAN_FLAG_DFS;
 
                 ci->mhz               = __cpu_to_le32(ch->freq);
                 ci->band_center_freq1 = __cpu_to_le32(ch->freq);
@@ -3094,6 +3416,7 @@ int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
 {
         struct wmi_bcn_tx_cmd *cmd;
         struct sk_buff *skb;
+        int ret;
 
         skb = ath10k_wmi_alloc_skb(sizeof(*cmd) + arg->bcn_len);
         if (!skb)
@@ -3106,7 +3429,11 @@ int ath10k_wmi_beacon_send_nowait(struct ath10k *ar,
         cmd->hdr.bcn_len  = __cpu_to_le32(arg->bcn_len);
         memcpy(cmd->bcn, arg->bcn, arg->bcn_len);
 
-        return ath10k_wmi_cmd_send_nowait(ar, skb, ar->wmi.cmd->bcn_tx_cmdid);
+        ret = ath10k_wmi_cmd_send_nowait(ar, skb, ar->wmi.cmd->bcn_tx_cmdid);
+        if (ret)
+                dev_kfree_skb(skb);
+
+        return ret;
 }
 
 static void ath10k_wmi_pdev_set_wmm_param(struct wmi_wmm_params *params,
@@ -3175,3 +3502,40 @@ int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                    type, delay_ms);
         return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->force_fw_hang_cmdid);
 }
+
+int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable)
+{
+        struct wmi_dbglog_cfg_cmd *cmd;
+        struct sk_buff *skb;
+        u32 cfg;
+
+        skb = ath10k_wmi_alloc_skb(sizeof(*cmd));
+        if (!skb)
+                return -ENOMEM;
+
+        cmd = (struct wmi_dbglog_cfg_cmd *)skb->data;
+
+        if (module_enable) {
+                cfg = SM(ATH10K_DBGLOG_LEVEL_VERBOSE,
+                         ATH10K_DBGLOG_CFG_LOG_LVL);
+        } else {
+                /* set back defaults, all modules with WARN level */
+                cfg = SM(ATH10K_DBGLOG_LEVEL_WARN,
+                         ATH10K_DBGLOG_CFG_LOG_LVL);
+                module_enable = ~0;
+        }
+
+        cmd->module_enable = __cpu_to_le32(module_enable);
+        cmd->module_valid = __cpu_to_le32(~0);
+        cmd->config_enable = __cpu_to_le32(cfg);
+        cmd->config_valid = __cpu_to_le32(ATH10K_DBGLOG_CFG_LOG_LVL_MASK);
+
+        ath10k_dbg(ATH10K_DBG_WMI,
+                   "wmi dbglog cfg modules %08x %08x config %08x %08x\n",
+                   __le32_to_cpu(cmd->module_enable),
+                   __le32_to_cpu(cmd->module_valid),
+                   __le32_to_cpu(cmd->config_enable),
+                   __le32_to_cpu(cmd->config_valid));
+
+        return ath10k_wmi_cmd_send(ar, skb, ar->wmi.cmd->dbglog_cfg_cmdid);
+}
diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h
index 78c991aec7f9..4b5e7d3d32b6 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.h
+++ b/drivers/net/wireless/ath/ath10k/wmi.h
@@ -893,6 +893,7 @@ struct wmi_channel {
         union {
                 __le32 reginfo0;
                 struct {
+                        /* note: power unit is 0.5 dBm */
                         u8 min_power;
                         u8 max_power;
                         u8 reg_power;
@@ -915,7 +916,8 @@ struct wmi_channel_arg {
         bool allow_ht;
         bool allow_vht;
         bool ht40plus;
-        /* note: power unit is 1/4th of dBm */
+        bool chan_radar;
+        /* note: power unit is 0.5 dBm */
         u32 min_power;
         u32 max_power;
         u32 max_reg_power;
@@ -1977,6 +1979,10 @@ struct wmi_mgmt_rx_event_v2 {
 #define WMI_RX_STATUS_ERR_MIC                   0x10
 #define WMI_RX_STATUS_ERR_KEY_CACHE_MISS        0x20
 
+#define PHY_ERROR_SPECTRAL_SCAN         0x26
+#define PHY_ERROR_FALSE_RADAR_EXT               0x24
+#define PHY_ERROR_RADAR                         0x05
+
 struct wmi_single_phyerr_rx_hdr {
         /* TSF timestamp */
         __le32 tsf_timestamp;
@@ -2068,6 +2074,87 @@ struct wmi_comb_phyerr_rx_event {
         u8 bufp[0];
 } __packed;
 
+#define PHYERR_TLV_SIG                          0xBB
+#define PHYERR_TLV_TAG_SEARCH_FFT_REPORT        0xFB
+#define PHYERR_TLV_TAG_RADAR_PULSE_SUMMARY      0xF8
+
+struct phyerr_radar_report {
+        __le32 reg0; /* RADAR_REPORT_REG0_* */
+        __le32 reg1; /* REDAR_REPORT_REG1_* */
+} __packed;
+
+#define RADAR_REPORT_REG0_PULSE_IS_CHIRP_MASK           0x80000000
+#define RADAR_REPORT_REG0_PULSE_IS_CHIRP_LSB            31
+
+#define RADAR_REPORT_REG0_PULSE_IS_MAX_WIDTH_MASK       0x40000000
+#define RADAR_REPORT_REG0_PULSE_IS_MAX_WIDTH_LSB        30
+
+#define RADAR_REPORT_REG0_AGC_TOTAL_GAIN_MASK           0x3FF00000
+#define RADAR_REPORT_REG0_AGC_TOTAL_GAIN_LSB            20
+
+#define RADAR_REPORT_REG0_PULSE_DELTA_DIFF_MASK         0x000F0000
+#define RADAR_REPORT_REG0_PULSE_DELTA_DIFF_LSB          16
+
+#define RADAR_REPORT_REG0_PULSE_DELTA_PEAK_MASK         0x0000FC00
+#define RADAR_REPORT_REG0_PULSE_DELTA_PEAK_LSB          10
+
+#define RADAR_REPORT_REG0_PULSE_SIDX_MASK               0x000003FF
+#define RADAR_REPORT_REG0_PULSE_SIDX_LSB                0
+
+#define RADAR_REPORT_REG1_PULSE_SRCH_FFT_VALID_MASK     0x80000000
+#define RADAR_REPORT_REG1_PULSE_SRCH_FFT_VALID_LSB      31
+
+#define RADAR_REPORT_REG1_PULSE_AGC_MB_GAIN_MASK        0x7F000000
+#define RADAR_REPORT_REG1_PULSE_AGC_MB_GAIN_LSB         24
+
+#define RADAR_REPORT_REG1_PULSE_SUBCHAN_MASK_MASK       0x00FF0000
+#define RADAR_REPORT_REG1_PULSE_SUBCHAN_MASK_LSB        16
+
+#define RADAR_REPORT_REG1_PULSE_TSF_OFFSET_MASK         0x0000FF00
+#define RADAR_REPORT_REG1_PULSE_TSF_OFFSET_LSB          8
+
+#define RADAR_REPORT_REG1_PULSE_DUR_MASK                0x000000FF
+#define RADAR_REPORT_REG1_PULSE_DUR_LSB                 0
+
+struct phyerr_fft_report {
+        __le32 reg0; /* SEARCH_FFT_REPORT_REG0_ * */
+        __le32 reg1; /* SEARCH_FFT_REPORT_REG1_ * */
+} __packed;
+
+#define SEARCH_FFT_REPORT_REG0_TOTAL_GAIN_DB_MASK       0xFF800000
+#define SEARCH_FFT_REPORT_REG0_TOTAL_GAIN_DB_LSB        23
+
+#define SEARCH_FFT_REPORT_REG0_BASE_PWR_DB_MASK         0x007FC000
+#define SEARCH_FFT_REPORT_REG0_BASE_PWR_DB_LSB          14
+
+#define SEARCH_FFT_REPORT_REG0_FFT_CHN_IDX_MASK         0x00003000
+#define SEARCH_FFT_REPORT_REG0_FFT_CHN_IDX_LSB          12
+
+#define SEARCH_FFT_REPORT_REG0_PEAK_SIDX_MASK           0x00000FFF
+#define SEARCH_FFT_REPORT_REG0_PEAK_SIDX_LSB            0
+
+#define SEARCH_FFT_REPORT_REG1_RELPWR_DB_MASK           0xFC000000
+#define SEARCH_FFT_REPORT_REG1_RELPWR_DB_LSB            26
+
+#define SEARCH_FFT_REPORT_REG1_AVGPWR_DB_MASK           0x03FC0000
+#define SEARCH_FFT_REPORT_REG1_AVGPWR_DB_LSB            18
+
+#define SEARCH_FFT_REPORT_REG1_PEAK_MAG_MASK            0x0003FF00
+#define SEARCH_FFT_REPORT_REG1_PEAK_MAG_LSB             8
+
+#define SEARCH_FFT_REPORT_REG1_NUM_STR_BINS_IB_MASK     0x000000FF
+#define SEARCH_FFT_REPORT_REG1_NUM_STR_BINS_IB_LSB      0
+
+
+struct phyerr_tlv {
+        __le16 len;
+        u8 tag;
+        u8 sig;
+} __packed;
+
+#define DFS_RSSI_POSSIBLY_FALSE                 50
+#define DFS_PEAK_MAG_THOLD_POSSIBLY_FALSE       40
+
 struct wmi_mgmt_tx_hdr {
         __le32 vdev_id;
         struct wmi_mac_addr peer_macaddr;
@@ -2233,7 +2320,12 @@ enum wmi_pdev_param {
          * 0: no protection 1:use CTS-to-self 2: use RTS/CTS
          */
         WMI_PDEV_PARAM_PROTECTION_MODE,
-        /* Dynamic bandwidth 0: disable 1: enable */
+        /*
+         * Dynamic bandwidth - 0: disable, 1: enable
+         *
+         * When enabled HW rate control tries different bandwidths when
+         * retransmitting frames.
+         */
         WMI_PDEV_PARAM_DYNAMIC_BW,
         /* Non aggregrate/ 11g sw retry threshold.0-disable */
         WMI_PDEV_PARAM_NON_AGG_SW_RETRY_TH,
@@ -2911,6 +3003,18 @@ struct wmi_vdev_install_key_arg {
         const void *key_data;
 };
 
+/*
+ * vdev fixed rate format:
+ * - preamble - b7:b6 - see WMI_RATE_PREMABLE_
+ * - nss      - b5:b4 - ss number (0 mean 1ss)
+ * - rate_mcs - b3:b0 - as below
+ *    CCK:  0 - 11Mbps, 1 - 5,5Mbps, 2 - 2Mbps, 3 - 1Mbps,
+ *          4 - 11Mbps (s), 5 - 5,5Mbps (s), 6 - 2Mbps (s)
+ *    OFDM: 0 - 48Mbps, 1 - 24Mbps, 2 - 12Mbps, 3 - 6Mbps,
+ *          4 - 54Mbps, 5 - 36Mbps, 6 - 18Mbps, 7 - 9Mbps
+ *    HT/VHT: MCS index
+ */
+
 /* Preamble types to be used with VDEV fixed rate configuration */
 enum wmi_rate_preamble {
         WMI_RATE_PREAMBLE_OFDM,
@@ -3998,6 +4102,54 @@ struct wmi_force_fw_hang_cmd {
         __le32 delay_ms;
 } __packed;
 
+enum ath10k_dbglog_level {
+        ATH10K_DBGLOG_LEVEL_VERBOSE = 0,
+        ATH10K_DBGLOG_LEVEL_INFO = 1,
+        ATH10K_DBGLOG_LEVEL_WARN = 2,
+        ATH10K_DBGLOG_LEVEL_ERR = 3,
+};
+
+/* VAP ids to enable dbglog */
+#define ATH10K_DBGLOG_CFG_VAP_LOG_LSB           0
+#define ATH10K_DBGLOG_CFG_VAP_LOG_MASK          0x0000ffff
+
+/* to enable dbglog in the firmware */
+#define ATH10K_DBGLOG_CFG_REPORTING_ENABLE_LSB  16
+#define ATH10K_DBGLOG_CFG_REPORTING_ENABLE_MASK 0x00010000
+
+/* timestamp resolution */
+#define ATH10K_DBGLOG_CFG_RESOLUTION_LSB        17
+#define ATH10K_DBGLOG_CFG_RESOLUTION_MASK       0x000E0000
+
+/* number of queued messages before sending them to the host */
+#define ATH10K_DBGLOG_CFG_REPORT_SIZE_LSB       20
+#define ATH10K_DBGLOG_CFG_REPORT_SIZE_MASK      0x0ff00000
+
+/*
+ * Log levels to enable. This defines the minimum level to enable, this is
+ * not a bitmask. See enum ath10k_dbglog_level for the values.
+ */
+#define ATH10K_DBGLOG_CFG_LOG_LVL_LSB           28
+#define ATH10K_DBGLOG_CFG_LOG_LVL_MASK          0x70000000
+
+/*
+ * Note: this is a cleaned up version of a struct firmware uses. For
+ * example, config_valid was hidden inside an array.
+ */
+struct wmi_dbglog_cfg_cmd {
+        /* bitmask to hold mod id config*/
+        __le32 module_enable;
+
+        /* see ATH10K_DBGLOG_CFG_ */
+        __le32 config_enable;
+
+        /* mask of module id bits to be changed */
+        __le32 module_valid;
+
+        /* mask of config bits to be changed, see ATH10K_DBGLOG_CFG_ */
+        __le32 config_valid;
+} __packed;
+
 #define ATH10K_RTS_MAX          2347
 #define ATH10K_FRAGMT_THRESHOLD_MIN     540
 #define ATH10K_FRAGMT_THRESHOLD_MAX     2346
@@ -4075,5 +4227,6 @@ int ath10k_wmi_request_stats(struct ath10k *ar, enum wmi_stats_id stats_id);
 int ath10k_wmi_force_fw_hang(struct ath10k *ar,
                              enum wmi_force_fw_hang_type type, u32 delay_ms);
 int ath10k_wmi_mgmt_tx(struct ath10k *ar, struct sk_buff *skb);
+int ath10k_wmi_dbglog_cfg(struct ath10k *ar, u32 module_enable);
 
 #endif /* _WMI_H_ */
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 69f58b073e85..ef35da84f63b 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1238,14 +1238,11 @@ static void
 ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
                      struct ieee80211_rx_status *rxs)
 {
-        struct ath_common *common = ath5k_hw_common(ah);
         u64 tsf, bc_tstamp;
         u32 hw_tu;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 
-        if (ieee80211_is_beacon(mgmt->frame_control) &&
-            le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
-            ether_addr_equal(mgmt->bssid, common->curbssid)) {
+        if (le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS) {
                 /*
                  * Received an IBSS beacon with the same BSSID. Hardware *must*
                  * have updated the local TSF. We have to work around various
@@ -1301,23 +1298,6 @@ ath5k_check_ibss_tsf(struct ath5k_hw *ah, struct sk_buff *skb,
         }
 }
 
-static void
-ath5k_update_beacon_rssi(struct ath5k_hw *ah, struct sk_buff *skb, int rssi)
-{
-        struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
-        struct ath_common *common = ath5k_hw_common(ah);
-
-        /* only beacons from our BSSID */
-        if (!ieee80211_is_beacon(mgmt->frame_control) ||
-            !ether_addr_equal(mgmt->bssid, common->curbssid))
-                return;
-
-        ewma_add(&ah->ah_beacon_rssi_avg, rssi);
-
-        /* in IBSS mode we should keep RSSI statistics per neighbour */
-        /* le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS */
-}
-
 /*
  * Compute padding position. skb must contain an IEEE 802.11 frame
  */
@@ -1390,6 +1370,7 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
                     struct ath5k_rx_status *rs)
 {
         struct ieee80211_rx_status *rxs;
+        struct ath_common *common = ath5k_hw_common(ah);
 
         ath5k_remove_padding(skb);
 
@@ -1442,11 +1423,13 @@ ath5k_receive_frame(struct ath5k_hw *ah, struct sk_buff *skb,
 
         trace_ath5k_rx(ah, skb);
 
-        ath5k_update_beacon_rssi(ah, skb, rs->rs_rssi);
+        if (ath_is_mybeacon(common, (struct ieee80211_hdr *)skb->data)) {
+                ewma_add(&ah->ah_beacon_rssi_avg, rs->rs_rssi);
 
-        /* check beacons in IBSS mode */
-        if (ah->opmode == NL80211_IFTYPE_ADHOC)
-                ath5k_check_ibss_tsf(ah, skb, rxs);
+                /* check beacons in IBSS mode */
+                if (ah->opmode == NL80211_IFTYPE_ADHOC)
+                        ath5k_check_ibss_tsf(ah, skb, rxs);
+        }
 
         ieee80211_rx(ah->hw, skb);
 }
@@ -2549,7 +2532,6 @@ ath5k_init_ah(struct ath5k_hw *ah, const struct ath_bus_ops *bus_ops)
         hw->wiphy->available_antennas_rx = 0x3;
 
         hw->extra_tx_headroom = 2;
-        hw->channel_change_time = 5000;
 
         /*
          * Mark the device as detached to avoid processing
diff --git a/drivers/net/wireless/ath/ath5k/dma.c b/drivers/net/wireless/ath/ath5k/dma.c
index ba200b24be64..e6c52f7c26e7 100644
--- a/drivers/net/wireless/ath/ath5k/dma.c
+++ b/drivers/net/wireless/ath/ath5k/dma.c
@@ -616,7 +616,16 @@ ath5k_hw_get_isr(struct ath5k_hw *ah, enum ath5k_int *interrupt_mask)
                  * SISRs will also clear PISR so no need to worry here.
                  */
 
-                pisr_clear = pisr & ~AR5K_ISR_BITS_FROM_SISRS;
+                /* XXX: There seems to be  an issue on some cards
+                 *      with tx interrupt flags not being updated
+                 *      on PISR despite that all Tx interrupt bits
+                 *      are cleared on SISRs. Since we handle all
+                 *      Tx queues all together it shouldn't be an
+                 *      issue if we clear Tx interrupt flags also
+                 *      on PISR to avoid that.
+                 */
+                pisr_clear = (pisr & ~AR5K_ISR_BITS_FROM_SISRS) |
+                                        (pisr & AR5K_INT_TX_ALL);
 
                 /*
                  * Write to clear them...
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 2437ad26949d..fd4c89df67e1 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -1109,7 +1109,9 @@ void ath6kl_cfg80211_ch_switch_notify(struct ath6kl_vif *vif, int freq,
                                 (mode == WMI_11G_HT20) ?
                                         NL80211_CHAN_HT20 : NL80211_CHAN_NO_HT);
 
+        mutex_lock(&vif->wdev.mtx);
         cfg80211_ch_switch_notify(vif->ndev, &chandef);
+        mutex_unlock(&vif->wdev.mtx);
 }
 
 static int ath6kl_cfg80211_add_key(struct wiphy *wiphy, struct net_device *ndev,
@@ -3169,12 +3171,15 @@ static bool ath6kl_is_p2p_go_ssid(const u8 *buf, size_t len)
 }
 
 static int ath6kl_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-                          struct ieee80211_channel *chan, bool offchan,
-                          unsigned int wait, const u8 *buf, size_t len,
-                          bool no_cck, bool dont_wait_for_ack, u64 *cookie)
+                          struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 {
         struct ath6kl_vif *vif = ath6kl_vif_from_wdev(wdev);
         struct ath6kl *ar = ath6kl_priv(vif->ndev);
+        struct ieee80211_channel *chan = params->chan;
+        const u8 *buf = params->buf;
+        size_t len = params->len;
+        unsigned int wait = params->wait;
+        bool no_cck = params->no_cck;
         u32 id, freq;
         const struct ieee80211_mgmt *mgmt;
         bool more_data, queued;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 546d5da0b894..4f16d79c9eb1 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -2754,9 +2754,9 @@ static int ath6kl_set_bitrate_mask64(struct wmi *wmi, u8 if_idx,
                                 mask->control[band].legacy << 4;
 
                 /* copy mcs rate mask */
-                mcsrate = mask->control[band].mcs[1];
+                mcsrate = mask->control[band].ht_mcs[1];
                 mcsrate <<= 8;
-                mcsrate |= mask->control[band].mcs[0];
+                mcsrate |= mask->control[band].ht_mcs[0];
                 ratemask[band] |= mcsrate << 12;
                 ratemask[band] |= mcsrate << 28;
         }
@@ -2806,7 +2806,7 @@ static int ath6kl_set_bitrate_mask32(struct wmi *wmi, u8 if_idx,
                                 mask->control[band].legacy << 4;
 
                 /* copy mcs rate mask */
-                mcsrate = mask->control[band].mcs[0];
+                mcsrate = mask->control[band].ht_mcs[0];
                 ratemask[band] |= mcsrate << 12;
                 ratemask[band] |= mcsrate << 20;
         }
diff --git a/drivers/net/wireless/ath/ath9k/Kconfig b/drivers/net/wireless/ath/ath9k/Kconfig
index 32f139e2e897..7b96b3e5712d 100644
--- a/drivers/net/wireless/ath/ath9k/Kconfig
+++ b/drivers/net/wireless/ath/ath9k/Kconfig
@@ -65,6 +65,14 @@ config ATH9K_DEBUGFS
 
           Also required for changing debug message flags at run time.
 
+config ATH9K_STATION_STATISTICS
+        bool "Detailed station statistics"
+        depends on ATH9K && ATH9K_DEBUGFS && DEBUG_FS
+        select MAC80211_DEBUGFS
+        default n
+        ---help---
+          This option enables detailed statistics for association stations.
+
 config ATH9K_DFS_CERTIFIED
         bool "Atheros DFS support for certified platforms"
         depends on ATH9K && CFG80211_CERTIFICATION_ONUS
@@ -86,7 +94,7 @@ config ATH9K_DFS_CERTIFIED
 
 config ATH9K_TX99
         bool "Atheros ath9k TX99 testing support"
-        depends on CFG80211_CERTIFICATION_ONUS
+        depends on ATH9K_DEBUGFS && CFG80211_CERTIFICATION_ONUS
         default n
         ---help---
           Say N. This should only be enabled on systems undergoing
@@ -104,6 +112,14 @@ config ATH9K_TX99
           be evaluated to meet the RF exposure limits set forth in the
           governmental SAR regulations.
 
+config ATH9K_WOW
+        bool "Wake on Wireless LAN support (EXPERIMENTAL)"
+        depends on ATH9K && PM
+        default n
+        ---help---
+          This option enables Wake on Wireless LAN support for certain cards.
+          Currently, AR9462 is supported.
+
 config ATH9K_LEGACY_RATE_CONTROL
         bool "Atheros ath9k rate control"
         depends on ATH9K
diff --git a/drivers/net/wireless/ath/ath9k/Makefile b/drivers/net/wireless/ath/ath9k/Makefile
index 6205ef5a9321..a40e5c5d7418 100644
--- a/drivers/net/wireless/ath/ath9k/Makefile
+++ b/drivers/net/wireless/ath/ath9k/Makefile
@@ -11,11 +11,15 @@ ath9k-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += mci.o
 ath9k-$(CONFIG_ATH9K_LEGACY_RATE_CONTROL) += rc.o
 ath9k-$(CONFIG_ATH9K_PCI) += pci.o
 ath9k-$(CONFIG_ATH9K_AHB) += ahb.o
-ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o
 ath9k-$(CONFIG_ATH9K_DFS_DEBUGFS) += dfs_debug.o
-ath9k-$(CONFIG_ATH9K_DFS_CERTIFIED) += \
-                dfs.o
-ath9k-$(CONFIG_PM_SLEEP) += wow.o
+ath9k-$(CONFIG_ATH9K_DFS_CERTIFIED) += dfs.o
+ath9k-$(CONFIG_ATH9K_TX99) += tx99.o
+ath9k-$(CONFIG_ATH9K_WOW) += wow.o
+
+ath9k-$(CONFIG_ATH9K_DEBUGFS) += debug.o \
+                                 spectral.o
+
+ath9k-$(CONFIG_ATH9K_STATION_STATISTICS) += debug_sta.o
 
 obj-$(CONFIG_ATH9K) += ath9k.o
 
@@ -41,6 +45,8 @@ ath9k_hw-y:=	\
                 ar9003_eeprom.o \
                 ar9003_paprd.o
 
+ath9k_hw-$(CONFIG_ATH9K_WOW) += ar9003_wow.o
+
 ath9k_hw-$(CONFIG_ATH9K_BTCOEX_SUPPORT) += btcoex.o \
                                            ar9003_mci.o
 obj-$(CONFIG_ATH9K_HW) += ath9k_hw.o
diff --git a/drivers/net/wireless/ath/ath9k/antenna.c b/drivers/net/wireless/ath/ath9k/antenna.c
index bd048cc69a33..a3668433dc02 100644
--- a/drivers/net/wireless/ath/ath9k/antenna.c
+++ b/drivers/net/wireless/ath/ath9k/antenna.c
@@ -724,14 +724,14 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs)
         struct ath_ant_comb *antcomb = &sc->ant_comb;
         int alt_ratio = 0, alt_rssi_avg = 0, main_rssi_avg = 0, curr_alt_set;
         int curr_main_set;
-        int main_rssi = rs->rs_rssi_ctl0;
-        int alt_rssi = rs->rs_rssi_ctl1;
+        int main_rssi = rs->rs_rssi_ctl[0];
+        int alt_rssi = rs->rs_rssi_ctl[1];
         int rx_ant_conf,  main_ant_conf;
         bool short_scan = false, ret;
 
-        rx_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_CURRENT_SHIFT) &
+        rx_ant_conf = (rs->rs_rssi_ctl[2] >> ATH_ANT_RX_CURRENT_SHIFT) &
                        ATH_ANT_RX_MASK;
-        main_ant_conf = (rs->rs_rssi_ctl2 >> ATH_ANT_RX_MAIN_SHIFT) &
+        main_ant_conf = (rs->rs_rssi_ctl[2] >> ATH_ANT_RX_MAIN_SHIFT) &
                          ATH_ANT_RX_MASK;
 
         if (alt_rssi >= antcomb->low_rssi_thresh) {
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_hw.c b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
index 5c95fd9e9c9e..d480d2f3e185 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_hw.c
@@ -32,12 +32,8 @@ static int ar9002_hw_init_mode_regs(struct ath_hw *ah)
                 return 0;
         }
 
-        if (ah->config.pcie_clock_req)
-                INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                           ar9280PciePhy_clkreq_off_L1_9280);
-        else
-                INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                           ar9280PciePhy_clkreq_always_on_L1_9280);
+        INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                       ar9280PciePhy_clkreq_always_on_L1_9280);
 
         if (AR_SREV_9287_11_OR_LATER(ah)) {
                 INIT_INI_ARRAY(&ah->iniModes, ar9287Modes_9287_1_1);
@@ -387,6 +383,20 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah)
         }
 }
 
+static void ar9002_hw_init_hang_checks(struct ath_hw *ah)
+{
+        if (AR_SREV_9100(ah) || AR_SREV_9160(ah)) {
+                ah->config.hw_hang_checks |= HW_BB_RIFS_HANG;
+                ah->config.hw_hang_checks |= HW_BB_DFS_HANG;
+        }
+
+        if (AR_SREV_9280(ah))
+                ah->config.hw_hang_checks |= HW_BB_RX_CLEAR_STUCK_HANG;
+
+        if (AR_SREV_5416(ah) || AR_SREV_9100(ah) || AR_SREV_9160(ah))
+                ah->config.hw_hang_checks |= HW_MAC_HANG;
+}
+
 /* Sets up the AR5008/AR9001/AR9002 hardware familiy callbacks */
 int ar9002_hw_attach_ops(struct ath_hw *ah)
 {
@@ -399,6 +409,7 @@ int ar9002_hw_attach_ops(struct ath_hw *ah)
                 return ret;
 
         priv_ops->init_mode_gain_regs = ar9002_hw_init_mode_gain_regs;
+        priv_ops->init_hang_checks = ar9002_hw_init_hang_checks;
 
         ops->config_pci_powersave = ar9002_hw_configpcipowersave;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index a366d6b4626f..741b38ddcb37 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -29,7 +29,8 @@ static void ar9002_hw_set_desc_link(void *ds, u32 ds_link)
         ((struct ath_desc*) ds)->ds_link = ds_link;
 }
 
-static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked,
+                              u32 *sync_cause_p)
 {
         u32 isr = 0;
         u32 mask2 = 0;
@@ -170,7 +171,8 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 return true;
 
         if (sync_cause) {
-                ath9k_debug_sync_cause(common, sync_cause);
+                if (sync_cause_p)
+                        *sync_cause_p = sync_cause;
                 fatal_int =
                         (sync_cause &
                          (AR_INTR_SYNC_HOST1_FATAL | AR_INTR_SYNC_HOST1_PERR))
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_phy.c b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
index f087117b2e6b..9a2afa2c690b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_phy.c
@@ -201,7 +201,6 @@ static void ar9002_hw_spur_mitigate(struct ath_hw *ah,
         ath9k_hw_get_channel_centers(ah, chan, &centers);
         freq = centers.synth_center;
 
-        ah->config.spurmode = SPUR_ENABLE_EEPROM;
         for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
                 cur_bb_spur = ah->eep_ops->get_spur_channel(ah, i, is2GHz);
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
index 7546b9a7dcbf..0a6163e9248c 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h
@@ -303,7 +303,7 @@ static const u32 ar9300_2p2_mac_postamble[][5] = {
         {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
         {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
         {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x00008120, 0x18f04800, 0x18f04800, 0x18f04810, 0x18f04810},
         {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
         {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
 };
@@ -352,7 +352,7 @@ static const u32 ar9300_2p2_baseband_postamble[][5] = {
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
         {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
-        {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
+        {0x0000a2d0, 0x00041983, 0x00041983, 0x00041981, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
@@ -378,9 +378,9 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009814, 0x9280c00a},
         {0x00009818, 0x00000000},
         {0x0000981c, 0x00020028},
-        {0x00009834, 0x6400a290},
+        {0x00009834, 0x6400a190},
         {0x00009838, 0x0108ecff},
-        {0x0000983c, 0x0d000600},
+        {0x0000983c, 0x14000600},
         {0x00009880, 0x201fff00},
         {0x00009884, 0x00001042},
         {0x000098a4, 0x00200400},
@@ -401,7 +401,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x00009d04, 0x40206c10},
         {0x00009d08, 0x009c4060},
         {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
+        {0x00009d10, 0x01884061},
         {0x00009d14, 0x00c0040b},
         {0x00009d18, 0x00000000},
         {0x00009e08, 0x0038230c},
@@ -459,7 +459,7 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
         {0x0000a3e8, 0x20202020},
         {0x0000a3ec, 0x20202020},
         {0x0000a3f0, 0x00000000},
-        {0x0000a3f4, 0x00000246},
+        {0x0000a3f4, 0x00000000},
         {0x0000a3f8, 0x0c9bd380},
         {0x0000a3fc, 0x000f0f01},
         {0x0000a400, 0x8fa91f01},
@@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = {
 
 static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
         {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
-        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
-        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
-        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
-        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
-        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
-        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
-        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
-        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
-        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
-        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
-        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
-        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
-        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
-        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
-        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
-        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
-        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
-        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
-        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
-        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
-        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
-        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
-        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
-        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
-        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
-        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
-        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
-        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
-        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
-        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
-        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5e08442e, 0x5e08442e, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x620a4431, 0x620a4431, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
+        {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5e88442e, 0x5e88442e, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x628a4431, 0x628a4431, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
         {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
-        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
-        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
         {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
-        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
-        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
         {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
         {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
         {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
         {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
         {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
-        {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001},
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
@@ -644,7 +644,7 @@ static const u32 ar9300Modes_high_ob_db_tx_gain_table_2p2[][5] = {
         {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
         {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
         {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
+        {0x0000a410, 0x000050d4, 0x000050d4, 0x000050d9, 0x000050d9},
         {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
         {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
         {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
@@ -1086,8 +1086,8 @@ static const u32 ar9300Common_rx_gain_table_2p2[][2] = {
         {0x0000b074, 0x00000000},
         {0x0000b078, 0x00000000},
         {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x2a2d2f32},
-        {0x0000b084, 0x21232328},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
         {0x0000b088, 0x19191c1e},
         {0x0000b08c, 0x12141417},
         {0x0000b090, 0x07070e0e},
@@ -1385,9 +1385,9 @@ static const u32 ar9300_2p2_mac_core[][2] = {
         {0x000081f8, 0x00000000},
         {0x000081fc, 0x00000000},
         {0x00008240, 0x00100000},
-        {0x00008244, 0x0010f424},
+        {0x00008244, 0x0010f400},
         {0x00008248, 0x00000800},
-        {0x0000824c, 0x0001e848},
+        {0x0000824c, 0x0001e800},
         {0x00008250, 0x00000000},
         {0x00008254, 0x00000000},
         {0x00008258, 0x00000000},
@@ -1726,16 +1726,30 @@ static const u32 ar9300PciePhy_pll_on_clkreq_disable_L1_2p2[][2] = {
 
 static const u32 ar9300PciePhy_clkreq_enable_L1_2p2[][2] = {
         /* Addr      allmodes  */
-        {0x00004040, 0x08253e5e},
+        {0x00004040, 0x0825365e},
         {0x00004040, 0x0008003b},
         {0x00004044, 0x00000000},
 };
 
 static const u32 ar9300PciePhy_clkreq_disable_L1_2p2[][2] = {
         /* Addr      allmodes  */
-        {0x00004040, 0x08213e5e},
+        {0x00004040, 0x0821365e},
         {0x00004040, 0x0008003b},
         {0x00004044, 0x00000000},
 };
 
+static const u32 ar9300_2p2_baseband_core_txfir_coeff_japan_2484[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x6f7f0301},
+        {0x0000a3a0, 0xca9228ee},
+};
+
+static const u32 ar9300_2p2_baseband_postamble_dfs_channel[][3] = {
+        /* Addr      5G          2G        */
+        {0x00009824, 0x5ac668d0, 0x5ac668d0},
+        {0x00009e0c, 0x6d4000e2, 0x6d4000e2},
+        {0x00009e14, 0x37b9625e, 0x37b9625e},
+};
+
 #endif /* INITVALS_9003_2P2_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_buffalo_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_buffalo_initvals.h
new file mode 100644
index 000000000000..59cf738f70df
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_buffalo_initvals.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_9003_BUFFALO_H
+#define INITVALS_9003_BUFFALO_H
+
+static const u32 ar9300Modes_high_power_tx_gain_table_buffalo[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d8, 0x000050d8, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
+        {0x0000a504, 0x04002222, 0x04002222, 0x04000002, 0x04000002},
+        {0x0000a508, 0x09002421, 0x09002421, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x0d002621, 0x0d002621, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x13004620, 0x13004620, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x19004a20, 0x19004a20, 0x11000400, 0x11000400},
+        {0x0000a518, 0x1d004e20, 0x1d004e20, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x21005420, 0x21005420, 0x19000404, 0x19000404},
+        {0x0000a520, 0x26005e20, 0x26005e20, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x2b005e40, 0x2b005e40, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x2f005e42, 0x2f005e42, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x33005e44, 0x33005e44, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x38005e65, 0x38005e65, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x3c005e69, 0x3c005e69, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x40005e6b, 0x40005e6b, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x44005e6d, 0x44005e6d, 0x34001640, 0x34001640},
+        {0x0000a540, 0x49005e72, 0x49005e72, 0x38001660, 0x38001660},
+        {0x0000a544, 0x4e005eb2, 0x4e005eb2, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x53005f12, 0x53005f12, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x59025eb2, 0x59025eb2, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x5e025f12, 0x5e025f12, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x61027f12, 0x61027f12, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6702bf12, 0x6702bf12, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x6b02bf14, 0x6b02bf14, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x6f02bf16, 0x6f02bf16, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x6f02bf16, 0x6f02bf16, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00802220, 0x00802220, 0x00800000, 0x00800000},
+        {0x0000a584, 0x04802222, 0x04802222, 0x04800002, 0x04800002},
+        {0x0000a588, 0x09802421, 0x09802421, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x0d802621, 0x0d802621, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x13804620, 0x13804620, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x19804a20, 0x19804a20, 0x11800400, 0x11800400},
+        {0x0000a598, 0x1d804e20, 0x1d804e20, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x21805420, 0x21805420, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x26805e20, 0x26805e20, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2b805e40, 0x2b805e40, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x2f805e42, 0x2f805e42, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x33805e44, 0x33805e44, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x38805e65, 0x38805e65, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x3c805e69, 0x3c805e69, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x40805e6b, 0x40805e6b, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x44805e6d, 0x44805e6d, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x49805e72, 0x49805e72, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x4e805eb2, 0x4e805eb2, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x53805f12, 0x53805f12, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x59825eb2, 0x59825eb2, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x5e825f12, 0x5e825f12, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x61827f12, 0x61827f12, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6782bf12, 0x6782bf12, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x6b82bf14, 0x6b82bf14, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x6f82bf16, 0x6f82bf16, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x6f82bf16, 0x6f82bf16, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
+        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
+        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
+
+#endif /* INITVALS_9003_BUFFALO_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 22934d3ca544..a352128c40ad 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -326,6 +326,224 @@ static void ar9003_hw_init_cal_settings(struct ath_hw *ah)
         ah->supp_cals = IQ_MISMATCH_CAL;
 }
 
+#define OFF_UPPER_LT 24
+#define OFF_LOWER_LT 7
+
+static bool ar9003_hw_dynamic_osdac_selection(struct ath_hw *ah,
+                                              bool txiqcal_done)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        int ch0_done, osdac_ch0, dc_off_ch0_i1, dc_off_ch0_q1, dc_off_ch0_i2,
+                dc_off_ch0_q2, dc_off_ch0_i3, dc_off_ch0_q3;
+        int ch1_done, osdac_ch1, dc_off_ch1_i1, dc_off_ch1_q1, dc_off_ch1_i2,
+                dc_off_ch1_q2, dc_off_ch1_i3, dc_off_ch1_q3;
+        int ch2_done, osdac_ch2, dc_off_ch2_i1, dc_off_ch2_q1, dc_off_ch2_i2,
+                dc_off_ch2_q2, dc_off_ch2_i3, dc_off_ch2_q3;
+        bool status;
+        u32 temp, val;
+
+        /*
+         * Clear offset and IQ calibration, run AGC cal.
+         */
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
+                    AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
+        REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                  REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_CAL);
+
+        status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                               AR_PHY_AGC_CONTROL_CAL,
+                               0, AH_WAIT_TIMEOUT);
+        if (!status) {
+                ath_dbg(common, CALIBRATE,
+                        "AGC cal without offset cal failed to complete in 1ms");
+                return false;
+        }
+
+        /*
+         * Allow only offset calibration and disable the others
+         * (Carrier Leak calibration, TX Filter calibration and
+         *  Peak Detector offset calibration).
+         */
+        REG_SET_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_CLR_BIT(ah, AR_PHY_CL_CAL_CTL,
+                    AR_PHY_CL_CAL_ENABLE);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_FLTR_CAL);
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_PKDET_CAL);
+
+        ch0_done = 0;
+        ch1_done = 0;
+        ch2_done = 0;
+
+        while ((ch0_done == 0) || (ch1_done == 0) || (ch2_done == 0)) {
+                osdac_ch0 = (REG_READ(ah, AR_PHY_65NM_CH0_BB1) >> 30) & 0x3;
+                osdac_ch1 = (REG_READ(ah, AR_PHY_65NM_CH1_BB1) >> 30) & 0x3;
+                osdac_ch2 = (REG_READ(ah, AR_PHY_65NM_CH2_BB1) >> 30) & 0x3;
+
+                REG_SET_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                          REG_READ(ah, AR_PHY_AGC_CONTROL) | AR_PHY_AGC_CONTROL_CAL);
+
+                status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                       AR_PHY_AGC_CONTROL_CAL,
+                                       0, AH_WAIT_TIMEOUT);
+                if (!status) {
+                        ath_dbg(common, CALIBRATE,
+                                "DC offset cal failed to complete in 1ms");
+                        return false;
+                }
+
+                REG_CLR_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+                /*
+                 * High gain.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (1 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (1 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (1 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q1 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q1 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i1 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q1 = (temp >> 21) & 0x1f;
+
+                /*
+                 * Low gain.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (2 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (2 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (2 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q2 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q2 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i2 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q2 = (temp >> 21) & 0x1f;
+
+                /*
+                 * Loopback.
+                 */
+                REG_WRITE(ah, AR_PHY_65NM_CH0_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH0_BB3) & 0xfffffcff) | (3 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH1_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH1_BB3) & 0xfffffcff) | (3 << 8)));
+                REG_WRITE(ah, AR_PHY_65NM_CH2_BB3,
+                          ((REG_READ(ah, AR_PHY_65NM_CH2_BB3) & 0xfffffcff) | (3 << 8)));
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH0_BB3);
+                dc_off_ch0_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch0_q3 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH1_BB3);
+                dc_off_ch1_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch1_q3 = (temp >> 21) & 0x1f;
+
+                temp = REG_READ(ah, AR_PHY_65NM_CH2_BB3);
+                dc_off_ch2_i3 = (temp >> 26) & 0x1f;
+                dc_off_ch2_q3 = (temp >> 21) & 0x1f;
+
+                if ((dc_off_ch0_i1 > OFF_UPPER_LT) || (dc_off_ch0_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_i2 > OFF_UPPER_LT) || (dc_off_ch0_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_i3 > OFF_UPPER_LT) || (dc_off_ch0_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q1 > OFF_UPPER_LT) || (dc_off_ch0_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q2 > OFF_UPPER_LT) || (dc_off_ch0_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch0_q3 > OFF_UPPER_LT) || (dc_off_ch0_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch0 == 3) {
+                                ch0_done = 1;
+                        } else {
+                                osdac_ch0++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH0_BB1) & 0x3fffffff;
+                                val |= (osdac_ch0 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH0_BB1, val);
+
+                                ch0_done = 0;
+                        }
+                } else {
+                        ch0_done = 1;
+                }
+
+                if ((dc_off_ch1_i1 > OFF_UPPER_LT) || (dc_off_ch1_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_i2 > OFF_UPPER_LT) || (dc_off_ch1_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_i3 > OFF_UPPER_LT) || (dc_off_ch1_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q1 > OFF_UPPER_LT) || (dc_off_ch1_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q2 > OFF_UPPER_LT) || (dc_off_ch1_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch1_q3 > OFF_UPPER_LT) || (dc_off_ch1_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch1 == 3) {
+                                ch1_done = 1;
+                        } else {
+                                osdac_ch1++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH1_BB1) & 0x3fffffff;
+                                val |= (osdac_ch1 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH1_BB1, val);
+
+                                ch1_done = 0;
+                        }
+                } else {
+                        ch1_done = 1;
+                }
+
+                if ((dc_off_ch2_i1 > OFF_UPPER_LT) || (dc_off_ch2_i1 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_i2 > OFF_UPPER_LT) || (dc_off_ch2_i2 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_i3 > OFF_UPPER_LT) || (dc_off_ch2_i3 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q1 > OFF_UPPER_LT) || (dc_off_ch2_q1 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q2 > OFF_UPPER_LT) || (dc_off_ch2_q2 < OFF_LOWER_LT) ||
+                    (dc_off_ch2_q3 > OFF_UPPER_LT) || (dc_off_ch2_q3 < OFF_LOWER_LT)) {
+                        if (osdac_ch2 == 3) {
+                                ch2_done = 1;
+                        } else {
+                                osdac_ch2++;
+
+                                val = REG_READ(ah, AR_PHY_65NM_CH2_BB1) & 0x3fffffff;
+                                val |= (osdac_ch2 << 30);
+                                REG_WRITE(ah, AR_PHY_65NM_CH2_BB1, val);
+
+                                ch2_done = 0;
+                        }
+                } else {
+                        ch2_done = 1;
+                }
+        }
+
+        REG_CLR_BIT(ah, AR_PHY_AGC_CONTROL,
+                    AR_PHY_AGC_CONTROL_OFFSET_CAL);
+        REG_SET_BIT(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+
+        /*
+         * We don't need to check txiqcal_done here since it is always
+         * set for AR9550.
+         */
+        REG_SET_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
+                    AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
+
+        return true;
+}
+
 /*
  * solve 4x4 linear equation used in loopback iq cal.
  */
@@ -347,7 +565,7 @@ static bool ar9003_hw_solve_iq_cal(struct ath_hw *ah,
         const s32 result_shift = 1 << 15;
         struct ath_common *common = ath9k_hw_common(ah);
 
-        f2 = (f1 * f1 + f3 * f3) / result_shift;
+        f2 = ((f1 >> 3) * (f1 >> 3) + (f3 >> 3) * (f3 >> 3)) >> 9;
 
         if (!f2) {
                 ath_dbg(common, CALIBRATE, "Divide by 0\n");
@@ -437,8 +655,8 @@ static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
         if (i2_m_q2_a0_d1 > 0x800)
                 i2_m_q2_a0_d1 = -((0xfff - i2_m_q2_a0_d1) + 1);
 
-        if (i2_p_q2_a0_d1 > 0x800)
-                i2_p_q2_a0_d1 = -((0xfff - i2_p_q2_a0_d1) + 1);
+        if (i2_p_q2_a0_d1 > 0x1000)
+                i2_p_q2_a0_d1 = -((0x1fff - i2_p_q2_a0_d1) + 1);
 
         if (iq_corr_a0_d1 > 0x800)
                 iq_corr_a0_d1 = -((0xfff - iq_corr_a0_d1) + 1);
@@ -482,6 +700,19 @@ static bool ar9003_hw_calc_iq_corr(struct ath_hw *ah,
                 return false;
         }
 
+        if ((i2_p_q2_a0_d0 < 1024) || (i2_p_q2_a0_d0 > 2047) ||
+            (i2_p_q2_a1_d0 < 0) || (i2_p_q2_a1_d1 < 0) ||
+            (i2_p_q2_a0_d0 <= i2_m_q2_a0_d0) ||
+            (i2_p_q2_a0_d0 <= iq_corr_a0_d0) ||
+            (i2_p_q2_a0_d1 <= i2_m_q2_a0_d1) ||
+            (i2_p_q2_a0_d1 <= iq_corr_a0_d1) ||
+            (i2_p_q2_a1_d0 <= i2_m_q2_a1_d0) ||
+            (i2_p_q2_a1_d0 <= iq_corr_a1_d0) ||
+            (i2_p_q2_a1_d1 <= i2_m_q2_a1_d1) ||
+            (i2_p_q2_a1_d1 <= iq_corr_a1_d1)) {
+                return false;
+        }
+
         mag_a0_d0 = (i2_m_q2_a0_d0 * res_scale) / i2_p_q2_a0_d0;
         phs_a0_d0 = (iq_corr_a0_d0 * res_scale) / i2_p_q2_a0_d0;
 
@@ -898,7 +1129,7 @@ static void ar9003_hw_tx_iq_cal_reload(struct ath_hw *ah)
 
 static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
 {
-        int offset[8], total = 0, test;
+        int offset[8] = {0}, total = 0, test;
         int agc_out, i;
 
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_GAINSTAGES(chain),
@@ -923,12 +1154,18 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
                       AR_PHY_65NM_RXRF_AGC_AGC_ON_OVR, 0x1);
         REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0x1);
-        if (is_2g)
-                REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                              AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR, 0x0);
-        else
+
+        if (AR_SREV_9330_11(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
-                              AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR, 0x0);
+                              AR_PHY_65NM_RXRF_AGC_AGC2G_CALDAC_OVR, 0x0);
+        } else {
+                if (is_2g)
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
+                                      AR_PHY_65NM_RXRF_AGC_AGC2G_DBDAC_OVR, 0x0);
+                else
+                        REG_RMW_FIELD(ah, AR_PHY_65NM_RXRF_AGC(chain),
+                                      AR_PHY_65NM_RXRF_AGC_AGC5G_DBDAC_OVR, 0x0);
+        }
 
         for (i = 6; i > 0; i--) {
                 offset[i] = BIT(i - 1);
@@ -964,9 +1201,9 @@ static void ar9003_hw_manual_peak_cal(struct ath_hw *ah, u8 chain, bool is_2g)
                       AR_PHY_65NM_RXRF_AGC_AGC_CAL_OVR, 0);
 }
 
-static void ar9003_hw_do_manual_peak_cal(struct ath_hw *ah,
-                                         struct ath9k_channel *chan,
-                                         bool run_rtt_cal)
+static void ar9003_hw_do_pcoem_manual_peak_cal(struct ath_hw *ah,
+                                               struct ath9k_channel *chan,
+                                               bool run_rtt_cal)
 {
         struct ath9k_hw_cal_data *caldata = ah->caldata;
         int i;
@@ -1040,14 +1277,14 @@ static void ar9003_hw_cl_cal_post_proc(struct ath_hw *ah, bool is_reusable)
         }
 }
 
-static bool ar9003_hw_init_cal(struct ath_hw *ah,
-                               struct ath9k_channel *chan)
+static bool ar9003_hw_init_cal_pcoem(struct ath_hw *ah,
+                                     struct ath9k_channel *chan)
 {
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_cal_data *caldata = ah->caldata;
         bool txiqcal_done = false;
         bool is_reusable = true, status = true;
-        bool run_rtt_cal = false, run_agc_cal, sep_iq_cal = false;
+        bool run_rtt_cal = false, run_agc_cal;
         bool rtt = !!(ah->caps.hw_caps & ATH9K_HW_CAP_RTT);
         u32 rx_delay = 0;
         u32 agc_ctrl = 0, agc_supp_cals = AR_PHY_AGC_CONTROL_OFFSET_CAL |
@@ -1119,22 +1356,12 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                         REG_CLR_BIT(ah, AR_PHY_TX_IQCAL_CONTROL_0,
                                     AR_PHY_TX_IQCAL_CONTROL_0_ENABLE_TXIQ_CAL);
                 txiqcal_done = run_agc_cal = true;
-        } else if (caldata && !test_bit(TXIQCAL_DONE, &caldata->cal_flags)) {
-                run_agc_cal = true;
-                sep_iq_cal = true;
         }
 
 skip_tx_iqcal:
         if (ath9k_hw_mci_is_enabled(ah) && IS_CHAN_2GHZ(chan) && run_agc_cal)
                 ar9003_mci_init_cal_req(ah, &is_reusable);
 
-        if (sep_iq_cal) {
-                txiqcal_done = ar9003_hw_tx_iq_cal_run(ah);
-                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
-                udelay(5);
-                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
-        }
-
         if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
                 rx_delay = REG_READ(ah, AR_PHY_RX_DELAY);
                 /* Disable BB_active */
@@ -1155,7 +1382,7 @@ skip_tx_iqcal:
                                        AR_PHY_AGC_CONTROL_CAL,
                                        0, AH_WAIT_TIMEOUT);
 
-                ar9003_hw_do_manual_peak_cal(ah, chan, run_rtt_cal);
+                ar9003_hw_do_pcoem_manual_peak_cal(ah, chan, run_rtt_cal);
         }
 
         if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE) {
@@ -1228,13 +1455,117 @@ skip_tx_iqcal:
         return true;
 }
 
+static bool ar9003_hw_init_cal_soc(struct ath_hw *ah,
+                                   struct ath9k_channel *chan)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath9k_hw_cal_data *caldata = ah->caldata;
+        bool txiqcal_done = false;
+        bool is_reusable = true, status = true;
+        bool run_agc_cal = false, sep_iq_cal = false;
+
+        /* Use chip chainmask only for calibration */
+        ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
+
+        if (ah->enabled_cals & TX_CL_CAL) {
+                REG_SET_BIT(ah, AR_PHY_CL_CAL_CTL, AR_PHY_CL_CAL_ENABLE);
+                run_agc_cal = true;
+        }
+
+        if (IS_CHAN_HALF_RATE(chan) || IS_CHAN_QUARTER_RATE(chan))
+                goto skip_tx_iqcal;
+
+        /* Do Tx IQ Calibration */
+        REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
+                      AR_PHY_TX_IQCAL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
+                      DELPT);
+
+        /*
+         * For AR9485 or later chips, TxIQ cal runs as part of
+         * AGC calibration. Specifically, AR9550 in SoC chips.
+         */
+        if (ah->enabled_cals & TX_IQ_ON_AGC_CAL) {
+                txiqcal_done = true;
+                run_agc_cal = true;
+        } else {
+                sep_iq_cal = true;
+                run_agc_cal = true;
+        }
+
+        /*
+         * In the SoC family, this will run for AR9300, AR9331 and AR9340.
+         */
+        if (sep_iq_cal) {
+                txiqcal_done = ar9003_hw_tx_iq_cal_run(ah);
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_DIS);
+                udelay(5);
+                REG_WRITE(ah, AR_PHY_ACTIVE, AR_PHY_ACTIVE_EN);
+        }
+
+        if (AR_SREV_9550(ah) && IS_CHAN_2GHZ(chan)) {
+                if (!ar9003_hw_dynamic_osdac_selection(ah, txiqcal_done))
+                        return false;
+        }
+
+skip_tx_iqcal:
+        if (run_agc_cal || !(ah->ah_flags & AH_FASTCC)) {
+                if (AR_SREV_9330_11(ah))
+                        ar9003_hw_manual_peak_cal(ah, 0, IS_CHAN_2GHZ(chan));
+
+                /* Calibrate the AGC */
+                REG_WRITE(ah, AR_PHY_AGC_CONTROL,
+                          REG_READ(ah, AR_PHY_AGC_CONTROL) |
+                          AR_PHY_AGC_CONTROL_CAL);
+
+                /* Poll for offset calibration complete */
+                status = ath9k_hw_wait(ah, AR_PHY_AGC_CONTROL,
+                                       AR_PHY_AGC_CONTROL_CAL,
+                                       0, AH_WAIT_TIMEOUT);
+        }
+
+        if (!status) {
+                ath_dbg(common, CALIBRATE,
+                        "offset calibration failed to complete in %d ms; noisy environment?\n",
+                        AH_WAIT_TIMEOUT / 1000);
+                return false;
+        }
+
+        if (txiqcal_done)
+                ar9003_hw_tx_iq_cal_post_proc(ah, is_reusable);
+
+        /* Revert chainmask to runtime parameters */
+        ar9003_hw_set_chain_masks(ah, ah->rxchainmask, ah->txchainmask);
+
+        /* Initialize list pointers */
+        ah->cal_list = ah->cal_list_last = ah->cal_list_curr = NULL;
+
+        INIT_CAL(&ah->iq_caldata);
+        INSERT_CAL(ah, &ah->iq_caldata);
+        ath_dbg(common, CALIBRATE, "enabling IQ Calibration\n");
+
+        /* Initialize current pointer to first element in list */
+        ah->cal_list_curr = ah->cal_list;
+
+        if (ah->cal_list_curr)
+                ath9k_hw_reset_calibration(ah, ah->cal_list_curr);
+
+        if (caldata)
+                caldata->CalValid = 0;
+
+        return true;
+}
+
 void ar9003_hw_attach_calib_ops(struct ath_hw *ah)
 {
         struct ath_hw_private_ops *priv_ops = ath9k_hw_private_ops(ah);
         struct ath_hw_ops *ops = ath9k_hw_ops(ah);
 
+        if (AR_SREV_9485(ah) || AR_SREV_9462(ah) || AR_SREV_9565(ah))
+                priv_ops->init_cal = ar9003_hw_init_cal_pcoem;
+        else
+                priv_ops->init_cal = ar9003_hw_init_cal_soc;
+
         priv_ops->init_cal_settings = ar9003_hw_init_cal_settings;
-        priv_ops->init_cal = ar9003_hw_init_cal;
         priv_ops->setup_calibration = ar9003_hw_setup_calibration;
 
         ops->calibrate = ar9003_hw_calibrate;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
index 130657db5c43..25243cbc07f0 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
@@ -131,6 +131,7 @@ static const struct ar9300_eeprom ar9300_default = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0cf0e0e0),
                 .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -138,7 +139,7 @@ static const struct ar9300_eeprom ar9300_default = {
          },
         .base_ext1 = {
                 .ant_div_control = 0,
-                .future = {0, 0, 0},
+                .future = {0, 0},
                 .tempslopextension = {0, 0, 0, 0, 0, 0, 0, 0}
         },
         .calFreqPier2G = {
@@ -333,6 +334,7 @@ static const struct ar9300_eeprom ar9300_default = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0c80c080),
                 .papdRateMaskHt40 = LE32(0x0080c080),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -707,6 +709,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0c80c080),
                 .papdRateMaskHt40 = LE32(0x0080c080),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -714,7 +717,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
          },
          .base_ext1 = {
                 .ant_div_control = 0,
-                .future = {0, 0, 0},
+                .future = {0, 0},
                 .tempslopextension = {0, 0, 0, 0, 0, 0, 0, 0}
          },
         .calFreqPier2G = {
@@ -909,6 +912,7 @@ static const struct ar9300_eeprom ar9300_x113 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0cf0e0e0),
                 .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -1284,6 +1288,7 @@ static const struct ar9300_eeprom ar9300_h112 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0c80c080),
                 .papdRateMaskHt40 = LE32(0x0080c080),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -1291,7 +1296,7 @@ static const struct ar9300_eeprom ar9300_h112 = {
         },
         .base_ext1 = {
                 .ant_div_control = 0,
-                .future = {0, 0, 0},
+                .future = {0, 0},
                 .tempslopextension = {0, 0, 0, 0, 0, 0, 0, 0}
         },
         .calFreqPier2G = {
@@ -1486,6 +1491,7 @@ static const struct ar9300_eeprom ar9300_h112 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0cf0e0e0),
                 .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -1861,6 +1867,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0c80c080),
                 .papdRateMaskHt40 = LE32(0x0080c080),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -1868,7 +1875,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
         },
         .base_ext1 = {
                 .ant_div_control = 0,
-                .future = {0, 0, 0},
+                .future = {0, 0},
                 .tempslopextension = {0, 0, 0, 0, 0, 0, 0, 0}
         },
         .calFreqPier2G = {
@@ -2063,6 +2070,7 @@ static const struct ar9300_eeprom ar9300_x112 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0cf0e0e0),
                 .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -2437,6 +2445,7 @@ static const struct ar9300_eeprom ar9300_h116 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0c80C080),
                 .papdRateMaskHt40 = LE32(0x0080C080),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -2444,7 +2453,7 @@ static const struct ar9300_eeprom ar9300_h116 = {
          },
          .base_ext1 = {
                 .ant_div_control = 0,
-                .future = {0, 0, 0},
+                .future = {0, 0},
                 .tempslopextension = {0, 0, 0, 0, 0, 0, 0, 0}
          },
         .calFreqPier2G = {
@@ -2639,6 +2648,7 @@ static const struct ar9300_eeprom ar9300_h116 = {
                 .thresh62 = 28,
                 .papdRateMaskHt20 = LE32(0x0cf0e0e0),
                 .papdRateMaskHt40 = LE32(0x6cf0e0e0),
+                .switchcomspdt = 0,
                 .xlna_bias_strength = 0,
                 .futureModal = {
                         0, 0, 0, 0, 0, 0, 0,
@@ -3588,7 +3598,7 @@ static void ar9003_hw_ant_ctrl_apply(struct ath_hw *ah, bool is2ghz)
         if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9462_ALL, value);
-        } else if (AR_SREV_9550(ah)) {
+        } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 REG_RMW_FIELD(ah, AR_PHY_SWITCH_COM,
                                 AR_SWITCH_TABLE_COM_AR9550_ALL, value);
         } else
@@ -3965,7 +3975,7 @@ static void ar9003_hw_apply_tuning_caps(struct ath_hw *ah)
         struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
         u8 tuning_caps_param = eep->baseEepHeader.params_for_tuning_caps[0];
 
-        if (AR_SREV_9485(ah) || AR_SREV_9330(ah) || AR_SREV_9340(ah))
+        if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
                 return;
 
         if (eep->baseEepHeader.featureEnable & 0x40) {
@@ -4020,7 +4030,10 @@ static void ar9003_hw_xpa_timing_control_apply(struct ath_hw *ah, bool is2ghz)
         if (!(eep->baseEepHeader.featureEnable & 0x80))
                 return;
 
-        if (!AR_SREV_9300(ah) && !AR_SREV_9340(ah) && !AR_SREV_9580(ah))
+        if (!AR_SREV_9300(ah) &&
+            !AR_SREV_9340(ah) &&
+            !AR_SREV_9580(ah) &&
+            !AR_SREV_9531(ah))
                 return;
 
         xpa_ctl = ar9003_modal_header(ah, is2ghz)->txFrameToXpaOn;
@@ -4111,6 +4124,37 @@ static void ar9003_hw_thermo_cal_apply(struct ath_hw *ah)
         }
 }
 
+static void ar9003_hw_apply_minccapwr_thresh(struct ath_hw *ah,
+                                             bool is2ghz)
+{
+        struct ar9300_eeprom *eep = &ah->eeprom.ar9300_eep;
+        const u_int32_t cca_ctrl[AR9300_MAX_CHAINS] = {
+                AR_PHY_CCA_CTRL_0,
+                AR_PHY_CCA_CTRL_1,
+                AR_PHY_CCA_CTRL_2,
+        };
+        int chain;
+        u32 val;
+
+        if (is2ghz) {
+                if (!(eep->base_ext1.misc_enable & BIT(2)))
+                        return;
+        } else {
+                if (!(eep->base_ext1.misc_enable & BIT(3)))
+                        return;
+        }
+
+        for (chain = 0; chain < AR9300_MAX_CHAINS; chain++) {
+                if (!(ah->caps.tx_chainmask & BIT(chain)))
+                        continue;
+
+                val = ar9003_modal_header(ah, is2ghz)->noiseFloorThreshCh[chain];
+                REG_RMW_FIELD(ah, cca_ctrl[chain],
+                              AR_PHY_EXT_CCA0_THRESH62_1, val);
+        }
+
+}
+
 static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
                                              struct ath9k_channel *chan)
 {
@@ -4122,9 +4166,10 @@ static void ath9k_hw_ar9300_set_board_values(struct ath_hw *ah,
         ar9003_hw_xlna_bias_strength_apply(ah, is2ghz);
         ar9003_hw_atten_apply(ah, chan);
         ar9003_hw_quick_drop_apply(ah, chan->channel);
-        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9550(ah))
+        if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
                 ar9003_hw_internal_regulator_apply(ah);
         ar9003_hw_apply_tuning_caps(ah);
+        ar9003_hw_apply_minccapwr_thresh(ah, chan);
         ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
         ar9003_hw_thermometer_apply(ah);
         ar9003_hw_thermo_cal_apply(ah);
@@ -4746,7 +4791,7 @@ static void ar9003_hw_power_control_override(struct ath_hw *ah,
         }
 
 tempslope:
-        if (AR_SREV_9550(ah)) {
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 /*
                  * AR955x has tempSlope register for each chain.
                  * Check whether temp_compensation feature is enabled or not.
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
index 0e5daa58a4fc..694ca2e680e5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h
@@ -270,10 +270,20 @@ struct cal_ctl_data_5g {
         u8 ctlEdges[AR9300_NUM_BAND_EDGES_5G];
 } __packed;
 
+#define MAX_BASE_EXTENSION_FUTURE 2
+
 struct ar9300_BaseExtension_1 {
         u8 ant_div_control;
-        u8 future[3];
-        u8 tempslopextension[8];
+        u8 future[MAX_BASE_EXTENSION_FUTURE];
+        /*
+         * misc_enable:
+         *
+         * BIT 0   - TX Gain Cap enable.
+         * BIT 1   - Uncompressed Checksum enable.
+         * BIT 2/3 - MinCCApwr enable 2g/5g.
+         */
+        u8 misc_enable;
+        int8_t tempslopextension[8];
         int8_t quick_drop_low;
         int8_t quick_drop_high;
 } __packed;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_hw.c b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
index 20e49095db2a..ec1da0cc25f5 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_hw.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_hw.c
@@ -17,6 +17,7 @@
 #include "hw.h"
 #include "ar9003_mac.h"
 #include "ar9003_2p2_initvals.h"
+#include "ar9003_buffalo_initvals.h"
 #include "ar9485_initvals.h"
 #include "ar9340_initvals.h"
 #include "ar9330_1p1_initvals.h"
@@ -26,6 +27,8 @@
 #include "ar9462_2p0_initvals.h"
 #include "ar9462_2p1_initvals.h"
 #include "ar9565_1p0_initvals.h"
+#include "ar9565_1p1_initvals.h"
+#include "ar953x_initvals.h"
 
 /* General hardware code for the AR9003 hadware family */
 
@@ -148,7 +151,11 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                 ar9340Modes_high_ob_db_tx_gain_table_1p0);
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
-                                ar9340Modes_fast_clock_1p0);
+                               ar9340Modes_fast_clock_1p0);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9340_1p0_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               ar9340_1p0_baseband_postamble_dfs_channel);
 
                 if (!ah->is_clk_25mhz)
                         INIT_INI_ARRAY(&ah->iniAdditional,
@@ -223,6 +230,10 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                ar9462_2p1_modes_fast_clock);
                 INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
                                ar9462_2p1_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                               ar9462_2p1_pciephy_clkreq_disable_L1);
+                INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                               ar9462_2p1_pciephy_clkreq_disable_L1);
         } else if (AR_SREV_9462_20(ah)) {
 
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE], ar9462_2p0_mac_core);
@@ -247,18 +258,18 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                 ar9462_2p0_soc_postamble);
 
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                ar9462_common_rx_gain_table_2p0);
+                                ar9462_2p0_common_rx_gain);
 
                 /* Awake -> Sleep Setting */
                 INIT_INI_ARRAY(&ah->iniPcieSerdes,
-                               ar9462_pciephy_clkreq_disable_L1_2p0);
+                               ar9462_2p0_pciephy_clkreq_disable_L1);
                 /* Sleep -> Awake Setting */
                 INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
-                               ar9462_pciephy_clkreq_disable_L1_2p0);
+                               ar9462_2p0_pciephy_clkreq_disable_L1);
 
                 /* Fast clock modal settings */
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
-                                ar9462_modes_fast_clock_2p0);
+                                ar9462_2p0_modes_fast_clock);
 
                 INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
                                ar9462_2p0_baseband_core_txfir_coeff_japan_2484);
@@ -298,6 +309,31 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                 /* Fast clock modal settings */
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
                                 ar955x_1p0_modes_fast_clock);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               qca953x_1p0_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               qca953x_1p0_mac_postamble);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               qca953x_1p0_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               qca953x_1p0_baseband_postamble);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               qca953x_1p0_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               qca953x_1p0_radio_postamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               qca953x_1p0_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               qca953x_1p0_soc_postamble);
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_wo_xlna_rx_gain_bounds);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               qca953x_1p0_modes_no_xpa_tx_gain_table);
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                               qca953x_1p0_modes_fast_clock);
         } else if (AR_SREV_9580(ah)) {
                 /* mac */
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
@@ -330,7 +366,46 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
                                 ar9580_1p0_low_ob_db_tx_gain_table);
 
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
-                                ar9580_1p0_modes_fast_clock);
+                               ar9580_1p0_modes_fast_clock);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9580_1p0_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               ar9580_1p0_baseband_postamble_dfs_channel);
+        } else if (AR_SREV_9565_11_OR_LATER(ah)) {
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
+                               ar9565_1p1_mac_core);
+                INIT_INI_ARRAY(&ah->iniMac[ATH_INI_POST],
+                               ar9565_1p1_mac_postamble);
+
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_CORE],
+                               ar9565_1p1_baseband_core);
+                INIT_INI_ARRAY(&ah->iniBB[ATH_INI_POST],
+                               ar9565_1p1_baseband_postamble);
+
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_CORE],
+                               ar9565_1p1_radio_core);
+                INIT_INI_ARRAY(&ah->iniRadio[ATH_INI_POST],
+                               ar9565_1p1_radio_postamble);
+
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_PRE],
+                               ar9565_1p1_soc_preamble);
+                INIT_INI_ARRAY(&ah->iniSOC[ATH_INI_POST],
+                               ar9565_1p1_soc_postamble);
+
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9565_1p1_Common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9565_1p1_Modes_lowest_ob_db_tx_gain_table);
+
+                INIT_INI_ARRAY(&ah->iniPcieSerdes,
+                               ar9565_1p1_pciephy_clkreq_disable_L1);
+                INIT_INI_ARRAY(&ah->iniPcieSerdesLowPower,
+                               ar9565_1p1_pciephy_clkreq_disable_L1);
+
+                INIT_INI_ARRAY(&ah->iniModesFastClock,
+                                ar9565_1p1_modes_fast_clock);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9565_1p1_baseband_core_txfir_coeff_japan_2484);
         } else if (AR_SREV_9565(ah)) {
                 INIT_INI_ARRAY(&ah->iniMac[ATH_INI_CORE],
                                ar9565_1p0_mac_core);
@@ -411,7 +486,11 @@ static void ar9003_hw_init_mode_regs(struct ath_hw *ah)
 
                 /* Fast clock modal settings */
                 INIT_INI_ARRAY(&ah->iniModesFastClock,
-                                ar9300Modes_fast_clock_2p2);
+                               ar9300Modes_fast_clock_2p2);
+                INIT_INI_ARRAY(&ah->iniCckfirJapan2484,
+                               ar9300_2p2_baseband_core_txfir_coeff_japan_2484);
+                INIT_INI_ARRAY(&ah->ini_dfs,
+                               ar9300_2p2_baseband_postamble_dfs_channel);
         }
 }
 
@@ -432,6 +511,9 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_xpa_tx_gain_table);
+        else if (AR_SREV_9531(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                        qca953x_1p0_modes_xpa_tx_gain_table);
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_lowest_ob_db_tx_gain_table);
@@ -440,7 +522,10 @@ static void ar9003_tx_gain_table_mode0(struct ath_hw *ah)
                         ar9462_2p1_modes_low_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9462_modes_low_ob_db_tx_gain_table_2p0);
+                        ar9462_2p0_modes_low_ob_db_tx_gain);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9565_1p1_modes_low_ob_db_tx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p0_modes_low_ob_db_tx_gain_table);
@@ -469,12 +554,22 @@ static void ar9003_tx_gain_table_mode1(struct ath_hw *ah)
         else if (AR_SREV_9550(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar955x_1p0_modes_no_xpa_tx_gain_table);
-        else if (AR_SREV_9462_21(ah))
+        else if (AR_SREV_9531(ah)) {
+                if (AR_SREV_9531_11(ah))
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p1_modes_no_xpa_tx_gain_table);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       qca953x_1p0_modes_no_xpa_tx_gain_table);
+        } else if (AR_SREV_9462_21(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9462_2p1_modes_high_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9462_modes_high_ob_db_tx_gain_table_2p0);
+                        ar9462_2p0_modes_high_ob_db_tx_gain);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9565_1p1_modes_high_ob_db_tx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p0_modes_high_ob_db_tx_gain_table);
@@ -500,6 +595,9 @@ static void ar9003_tx_gain_table_mode2(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_low_ob_db_tx_gain_table);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9565_1p1_modes_low_ob_db_tx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p0_modes_low_ob_db_tx_gain_table);
@@ -525,12 +623,20 @@ static void ar9003_tx_gain_table_mode3(struct ath_hw *ah)
         else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9580_1p0_high_power_tx_gain_table);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9565_1p1_modes_high_power_tx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                                ar9565_1p0_modes_high_power_tx_gain_table);
-        else
-                INIT_INI_ARRAY(&ah->iniModesTxGain,
-                        ar9300Modes_high_power_tx_gain_table_2p2);
+        else {
+                if (ah->config.tx_gain_buffalo)
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_high_power_tx_gain_table_buffalo);
+                else
+                        INIT_INI_ARRAY(&ah->iniModesTxGain,
+                                       ar9300Modes_high_power_tx_gain_table_2p2);
+        }
 }
 
 static void ar9003_tx_gain_table_mode4(struct ath_hw *ah)
@@ -546,7 +652,7 @@ static void ar9003_tx_gain_table_mode4(struct ath_hw *ah)
                        ar9462_2p1_modes_mix_ob_db_tx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
-                       ar9462_modes_mix_ob_db_tx_gain_table_2p0);
+                       ar9462_2p0_modes_mix_ob_db_tx_gain);
         else
                 INIT_INI_ARRAY(&ah->iniModesTxGain,
                         ar9300Modes_mixed_ob_db_tx_gain_table_2p2);
@@ -581,6 +687,13 @@ static void ar9003_tx_gain_table_mode6(struct ath_hw *ah)
                         ar9580_1p0_type6_tx_gain_table);
 }
 
+static void ar9003_tx_gain_table_mode7(struct ath_hw *ah)
+{
+        if (AR_SREV_9340(ah))
+                INIT_INI_ARRAY(&ah->iniModesTxGain,
+                               ar9340_cus227_tx_gain_table_1p0);
+}
+
 typedef void (*ath_txgain_tab)(struct ath_hw *ah);
 
 static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
@@ -593,6 +706,7 @@ static void ar9003_tx_gain_table_apply(struct ath_hw *ah)
                 ar9003_tx_gain_table_mode4,
                 ar9003_tx_gain_table_mode5,
                 ar9003_tx_gain_table_mode6,
+                ar9003_tx_gain_table_mode7,
         };
         int idx = ar9003_hw_get_tx_gain_idx(ah);
 
@@ -621,6 +735,11 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                 ar955x_1p0_common_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                                 ar955x_1p0_common_rx_gain_bounds);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                 ar9580_1p0_rx_gain_table);
@@ -629,7 +748,10 @@ static void ar9003_rx_gain_table_mode0(struct ath_hw *ah)
                                 ar9462_2p1_common_rx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                                ar9462_common_rx_gain_table_2p0);
+                                ar9462_2p0_common_rx_gain);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9565_1p1_Common_rx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9565_1p0_Common_rx_gain_table);
@@ -657,15 +779,23 @@ static void ar9003_rx_gain_table_mode1(struct ath_hw *ah)
                         ar9462_2p1_common_wo_xlna_rx_gain);
         else if (AR_SREV_9462_20(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                        ar9462_common_wo_xlna_rx_gain_table_2p0);
+                        ar9462_2p0_common_wo_xlna_rx_gain);
         else if (AR_SREV_9550(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar955x_1p0_common_wo_xlna_rx_gain_table);
                 INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
                         ar955x_1p0_common_wo_xlna_rx_gain_bounds);
+        } else if (AR_SREV_9531(ah)) {
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               qca953x_1p0_common_wo_xlna_rx_gain_table);
+                INIT_INI_ARRAY(&ah->ini_modes_rx_gain_bounds,
+                               qca953x_1p0_common_wo_xlna_rx_gain_bounds);
         } else if (AR_SREV_9580(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                         ar9580_1p0_wo_xlna_rx_gain_table);
+        else if (AR_SREV_9565_11(ah))
+                INIT_INI_ARRAY(&ah->iniModesRxGain,
+                               ar9565_1p1_common_wo_xlna_rx_gain_table);
         else if (AR_SREV_9565(ah))
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
                                ar9565_1p0_common_wo_xlna_rx_gain_table);
@@ -687,7 +817,7 @@ static void ar9003_rx_gain_table_mode2(struct ath_hw *ah)
                                ar9462_2p1_baseband_postamble_5g_xlna);
         } else if (AR_SREV_9462_20(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                               ar9462_common_mixed_rx_gain_table_2p0);
+                               ar9462_2p0_common_mixed_rx_gain);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_bb_core,
                                ar9462_2p0_baseband_core_mix_rxgain);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_bb_postamble,
@@ -701,12 +831,12 @@ static void ar9003_rx_gain_table_mode3(struct ath_hw *ah)
 {
         if (AR_SREV_9462_21(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                               ar9462_2p1_common_5g_xlna_only_rx_gain);
+                               ar9462_2p1_common_5g_xlna_only_rxgain);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
                                ar9462_2p1_baseband_postamble_5g_xlna);
         } else if (AR_SREV_9462_20(ah)) {
                 INIT_INI_ARRAY(&ah->iniModesRxGain,
-                               ar9462_2p0_5g_xlna_only_rxgain);
+                               ar9462_2p0_common_5g_xlna_only_rxgain);
                 INIT_INI_ARRAY(&ah->ini_modes_rxgain_5g_xlna,
                                ar9462_2p0_baseband_postamble_5g_xlna);
         }
@@ -750,6 +880,9 @@ static void ar9003_hw_init_mode_gain_regs(struct ath_hw *ah)
 static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
                                          bool power_off)
 {
+        unsigned int i;
+        struct ar5416IniArray *array;
+
         /*
          * Increase L1 Entry Latency. Some WB222 boards don't have
          * this change in eeprom/OTP.
@@ -775,19 +908,125 @@ static void ar9003_hw_configpcipowersave(struct ath_hw *ah,
          * Configire PCIE after Ini init. SERDES values now come from ini file
          * This enables PCIe low power mode.
          */
-        if (ah->config.pcieSerDesWrite) {
-                unsigned int i;
-                struct ar5416IniArray *array;
+        array = power_off ? &ah->iniPcieSerdes :
+                &ah->iniPcieSerdesLowPower;
+
+        for (i = 0; i < array->ia_rows; i++) {
+                REG_WRITE(ah,
+                          INI_RA(array, i, 0),
+                          INI_RA(array, i, 1));
+        }
+}
+
+static void ar9003_hw_init_hang_checks(struct ath_hw *ah)
+{
+        /*
+         * All chips support detection of BB/MAC hangs.
+         */
+        ah->config.hw_hang_checks |= HW_BB_WATCHDOG;
+        ah->config.hw_hang_checks |= HW_MAC_HANG;
+
+        /*
+         * This is not required for AR9580 1.0
+         */
+        if (AR_SREV_9300_22(ah))
+                ah->config.hw_hang_checks |= HW_PHYRESTART_CLC_WAR;
+
+        if (AR_SREV_9330(ah))
+                ah->bb_watchdog_timeout_ms = 85;
+        else
+                ah->bb_watchdog_timeout_ms = 25;
+}
 
-                array = power_off ? &ah->iniPcieSerdes :
-                                    &ah->iniPcieSerdesLowPower;
+/*
+ * MAC HW hang check
+ * =================
+ *
+ * Signature: dcu_chain_state is 0x6 and dcu_complete_state is 0x1.
+ *
+ * The state of each DCU chain (mapped to TX queues) is available from these
+ * DMA debug registers:
+ *
+ * Chain 0 state : Bits 4:0   of AR_DMADBG_4
+ * Chain 1 state : Bits 9:5   of AR_DMADBG_4
+ * Chain 2 state : Bits 14:10 of AR_DMADBG_4
+ * Chain 3 state : Bits 19:15 of AR_DMADBG_4
+ * Chain 4 state : Bits 24:20 of AR_DMADBG_4
+ * Chain 5 state : Bits 29:25 of AR_DMADBG_4
+ * Chain 6 state : Bits 4:0   of AR_DMADBG_5
+ * Chain 7 state : Bits 9:5   of AR_DMADBG_5
+ * Chain 8 state : Bits 14:10 of AR_DMADBG_5
+ * Chain 9 state : Bits 19:15 of AR_DMADBG_5
+ *
+ * The DCU chain state "0x6" means "WAIT_FRDONE" - wait for TX frame to be done.
+ */
+
+#define NUM_STATUS_READS 50
+
+static bool ath9k_hw_verify_hang(struct ath_hw *ah, unsigned int queue)
+{
+        u32 dma_dbg_chain, dma_dbg_complete;
+        u8 dcu_chain_state, dcu_complete_state;
+        int i;
+
+        for (i = 0; i < NUM_STATUS_READS; i++) {
+                if (queue < 6)
+                        dma_dbg_chain = REG_READ(ah, AR_DMADBG_4);
+                else
+                        dma_dbg_chain = REG_READ(ah, AR_DMADBG_5);
+
+                dma_dbg_complete = REG_READ(ah, AR_DMADBG_6);
+
+                dcu_chain_state = (dma_dbg_chain >> (5 * queue)) & 0x1f;
+                dcu_complete_state = dma_dbg_complete & 0x3;
+
+                if ((dcu_chain_state != 0x6) || (dcu_complete_state != 0x1))
+                        return false;
+        }
+
+        ath_dbg(ath9k_hw_common(ah), RESET,
+                "MAC Hang signature found for queue: %d\n", queue);
+
+        return true;
+}
+
+static bool ar9003_hw_detect_mac_hang(struct ath_hw *ah)
+{
+        u32 dma_dbg_4, dma_dbg_5, dma_dbg_6, chk_dbg;
+        u8 dcu_chain_state, dcu_complete_state;
+        bool dcu_wait_frdone = false;
+        unsigned long chk_dcu = 0;
+        unsigned int i = 0;
+
+        dma_dbg_4 = REG_READ(ah, AR_DMADBG_4);
+        dma_dbg_5 = REG_READ(ah, AR_DMADBG_5);
+        dma_dbg_6 = REG_READ(ah, AR_DMADBG_6);
+
+        dcu_complete_state = dma_dbg_6 & 0x3;
+        if (dcu_complete_state != 0x1)
+                goto exit;
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                if (i < 6)
+                        chk_dbg = dma_dbg_4;
+                else
+                        chk_dbg = dma_dbg_5;
+
+                dcu_chain_state = (chk_dbg >> (5 * i)) & 0x1f;
+                if (dcu_chain_state == 0x6) {
+                        dcu_wait_frdone = true;
+                        chk_dcu |= BIT(i);
+                }
+        }
 
-                for (i = 0; i < array->ia_rows; i++) {
-                        REG_WRITE(ah,
-                                  INI_RA(array, i, 0),
-                                  INI_RA(array, i, 1));
+        if ((dcu_complete_state == 0x1) && dcu_wait_frdone) {
+                for_each_set_bit(i, &chk_dcu, ATH9K_NUM_TX_QUEUES) {
+                        if (ath9k_hw_verify_hang(ah, i))
+                                return true;
                 }
         }
+exit:
+        return false;
 }
 
 /* Sets up the AR9003 hardware familiy callbacks */
@@ -798,6 +1037,8 @@ void ar9003_hw_attach_ops(struct ath_hw *ah)
 
         ar9003_hw_init_mode_regs(ah);
         priv_ops->init_mode_gain_regs = ar9003_hw_init_mode_gain_regs;
+        priv_ops->init_hang_checks = ar9003_hw_init_hang_checks;
+        priv_ops->detect_mac_hang = ar9003_hw_detect_mac_hang;
 
         ops->config_pci_powersave = ar9003_hw_configpcipowersave;
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_mac.c b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
index f6c5c1b50471..729ffbf07343 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_mac.c
@@ -175,7 +175,8 @@ static void ar9003_hw_set_desc_link(void *ds, u32 ds_link)
         ads->ctl10 |= ar9003_calc_ptr_chksum(ads);
 }
 
-static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
+static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked,
+                              u32 *sync_cause_p)
 {
         u32 isr = 0;
         u32 mask2 = 0;
@@ -310,7 +311,8 @@ static bool ar9003_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                 ar9003_mci_get_isr(ah, masked);
 
         if (sync_cause) {
-                ath9k_debug_sync_cause(common, sync_cause);
+                if (sync_cause_p)
+                        *sync_cause_p = sync_cause;
                 fatal_int =
                         (sync_cause &
                          (AR_INTR_SYNC_HOST1_FATAL | AR_INTR_SYNC_HOST1_PERR))
@@ -476,12 +478,12 @@ int ath9k_hw_process_rxdesc_edma(struct ath_hw *ah, struct ath_rx_status *rxs,
 
         /* XXX: Keycache */
         rxs->rs_rssi = MS(rxsp->status5, AR_RxRSSICombined);
-        rxs->rs_rssi_ctl0 = MS(rxsp->status1, AR_RxRSSIAnt00);
-        rxs->rs_rssi_ctl1 = MS(rxsp->status1, AR_RxRSSIAnt01);
-        rxs->rs_rssi_ctl2 = MS(rxsp->status1, AR_RxRSSIAnt02);
-        rxs->rs_rssi_ext0 = MS(rxsp->status5, AR_RxRSSIAnt10);
-        rxs->rs_rssi_ext1 = MS(rxsp->status5, AR_RxRSSIAnt11);
-        rxs->rs_rssi_ext2 = MS(rxsp->status5, AR_RxRSSIAnt12);
+        rxs->rs_rssi_ctl[0] = MS(rxsp->status1, AR_RxRSSIAnt00);
+        rxs->rs_rssi_ctl[1] = MS(rxsp->status1, AR_RxRSSIAnt01);
+        rxs->rs_rssi_ctl[2] = MS(rxsp->status1, AR_RxRSSIAnt02);
+        rxs->rs_rssi_ext[0] = MS(rxsp->status5, AR_RxRSSIAnt10);
+        rxs->rs_rssi_ext[1] = MS(rxsp->status5, AR_RxRSSIAnt11);
+        rxs->rs_rssi_ext[2] = MS(rxsp->status5, AR_RxRSSIAnt12);
 
         if (rxsp->status11 & AR_RxKeyIdxValid)
                 rxs->rs_keyix = MS(rxsp->status11, AR_KeyIdx);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index d39b79f5e841..09facba1dc6d 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -103,7 +103,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                         } else {
                                 channelSel = CHANSEL_2G(freq) >> 1;
                         }
-                } else if (AR_SREV_9550(ah)) {
+                } else if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                         if (ah->is_clk_25mhz)
                                 div = 75;
                         else
@@ -118,7 +118,7 @@ static int ar9003_hw_set_channel(struct ath_hw *ah, struct ath9k_channel *chan)
                 /* Set to 2G mode */
                 bMode = 1;
         } else {
-                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) &&
+                if ((AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) &&
                     ah->is_clk_25mhz) {
                         channelSel = freq / 75;
                         chan_frac = ((freq % 75) * 0x20000) / 75;
@@ -641,11 +641,12 @@ static void ar9003_hw_override_ini(struct ath_hw *ah)
                 else
                         ah->enabled_cals &= ~TX_IQ_CAL;
 
-                if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE)
-                        ah->enabled_cals |= TX_CL_CAL;
-                else
-                        ah->enabled_cals &= ~TX_CL_CAL;
         }
+
+        if (REG_READ(ah, AR_PHY_CL_CAL_CTL) & AR_PHY_CL_CAL_ENABLE)
+                ah->enabled_cals |= TX_CL_CAL;
+        else
+                ah->enabled_cals &= ~TX_CL_CAL;
 }
 
 static void ar9003_hw_prog_ini(struct ath_hw *ah,
@@ -809,10 +810,12 @@ static int ar9003_hw_process_ini(struct ath_hw *ah,
         /*
          * TXGAIN initvals.
          */
-        if (AR_SREV_9550(ah)) {
-                int modes_txgain_index;
+        if (AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
+                int modes_txgain_index = 1;
+
+                if (AR_SREV_9550(ah))
+                        modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
 
-                modes_txgain_index = ar9550_hw_get_modes_txgain_index(ah, chan);
                 if (modes_txgain_index < 0)
                         return -EINVAL;
 
@@ -1331,6 +1334,7 @@ static void ar9003_hw_ani_cache_ini_regs(struct ath_hw *ah)
 static void ar9003_hw_set_radar_params(struct ath_hw *ah,
                                        struct ath_hw_radar_conf *conf)
 {
+        unsigned int regWrites = 0;
         u32 radar_0 = 0, radar_1 = 0;
 
         if (!conf) {
@@ -1357,6 +1361,11 @@ static void ar9003_hw_set_radar_params(struct ath_hw *ah,
                 REG_SET_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
         else
                 REG_CLR_BIT(ah, AR_PHY_RADAR_EXT, AR_PHY_RADAR_EXT_ENA);
+
+        if (AR_SREV_9300(ah) || AR_SREV_9340(ah) || AR_SREV_9580(ah)) {
+                REG_WRITE_ARRAY(&ah->ini_dfs,
+                                IS_CHAN_HT40(ah->curchan) ? 2 : 1, regWrites);
+        }
 }
 
 static void ar9003_hw_set_radar_conf(struct ath_hw *ah)
@@ -1807,6 +1816,68 @@ void ar9003_hw_attach_phy_ops(struct ath_hw *ah)
         memcpy(ah->nf_regs, ar9300_cca_regs, sizeof(ah->nf_regs));
 }
 
+/*
+ * Baseband Watchdog signatures:
+ *
+ * 0x04000539: BB hang when operating in HT40 DFS Channel.
+ *             Full chip reset is not required, but a recovery
+ *             mechanism is needed.
+ *
+ * 0x1300000a: Related to CAC deafness.
+ *             Chip reset is not required.
+ *
+ * 0x0400000a: Related to CAC deafness.
+ *             Full chip reset is required.
+ *
+ * 0x04000b09: RX state machine gets into an illegal state
+ *             when a packet with unsupported rate is received.
+ *             Full chip reset is required and PHY_RESTART has
+ *             to be disabled.
+ *
+ * 0x04000409: Packet stuck on receive.
+ *             Full chip reset is required for all chips except AR9340.
+ */
+
+/*
+ * ar9003_hw_bb_watchdog_check(): Returns true if a chip reset is required.
+ */
+bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah)
+{
+        u32 val;
+
+        switch(ah->bb_watchdog_last_status) {
+        case 0x04000539:
+                val = REG_READ(ah, AR_PHY_RADAR_0);
+                val &= (~AR_PHY_RADAR_0_FIRPWR);
+                val |= SM(0x7f, AR_PHY_RADAR_0_FIRPWR);
+                REG_WRITE(ah, AR_PHY_RADAR_0, val);
+                udelay(1);
+                val = REG_READ(ah, AR_PHY_RADAR_0);
+                val &= ~AR_PHY_RADAR_0_FIRPWR;
+                val |= SM(AR9300_DFS_FIRPWR, AR_PHY_RADAR_0_FIRPWR);
+                REG_WRITE(ah, AR_PHY_RADAR_0, val);
+
+                return false;
+        case 0x1300000a:
+                return false;
+        case 0x0400000a:
+        case 0x04000b09:
+                return true;
+        case 0x04000409:
+                if (AR_SREV_9340(ah) || AR_SREV_9531(ah))
+                        return false;
+                else
+                        return true;
+        default:
+                /*
+                 * For any other unknown signatures, do a
+                 * full chip reset.
+                 */
+                return true;
+        }
+}
+EXPORT_SYMBOL(ar9003_hw_bb_watchdog_check);
+
 void ar9003_hw_bb_watchdog_config(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1923,6 +1994,7 @@ EXPORT_SYMBOL(ar9003_hw_bb_watchdog_dbg_info);
 
 void ar9003_hw_disable_phy_restart(struct ath_hw *ah)
 {
+        u8 result;
         u32 val;
 
         /* While receiving unsupported rate frame rx state machine
@@ -1930,15 +2002,13 @@ void ar9003_hw_disable_phy_restart(struct ath_hw *ah)
          * state, BB would go hang. If RXSM is in 0xb state after
          * first bb panic, ensure to disable the phy_restart.
          */
-        if (!((MS(ah->bb_watchdog_last_status,
-                  AR_PHY_WATCHDOG_RX_OFDM_SM) == 0xb) ||
-            ah->bb_hang_rx_ofdm))
-                return;
+        result = MS(ah->bb_watchdog_last_status, AR_PHY_WATCHDOG_RX_OFDM_SM);
 
-        ah->bb_hang_rx_ofdm = true;
-        val = REG_READ(ah, AR_PHY_RESTART);
-        val &= ~AR_PHY_RESTART_ENA;
-
-        REG_WRITE(ah, AR_PHY_RESTART, val);
+        if ((result == 0xb) || ah->bb_hang_rx_ofdm) {
+                ah->bb_hang_rx_ofdm = true;
+                val = REG_READ(ah, AR_PHY_RESTART);
+                val &= ~AR_PHY_RESTART_ENA;
+                REG_WRITE(ah, AR_PHY_RESTART, val);
+        }
 }
 EXPORT_SYMBOL(ar9003_hw_disable_phy_restart);
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.h b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
index 2af667beb273..fd090b1f2d0f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.h
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.h
@@ -270,7 +270,7 @@
 #define AR_PHY_AGC              (AR_AGC_BASE + 0x14)
 #define AR_PHY_EXT_ATTEN_CTL_0  (AR_AGC_BASE + 0x18)
 #define AR_PHY_CCA_0            (AR_AGC_BASE + 0x1c)
-#define AR_PHY_EXT_CCA0         (AR_AGC_BASE + 0x20)
+#define AR_PHY_CCA_CTRL_0       (AR_AGC_BASE + 0x20)
 #define AR_PHY_RESTART          (AR_AGC_BASE + 0x24)
 
 /*
@@ -338,17 +338,17 @@
 #define AR_PHY_CCA_NOM_VAL_9300_5GHZ          -115
 #define AR_PHY_CCA_MIN_GOOD_VAL_9300_2GHZ     -125
 #define AR_PHY_CCA_MIN_GOOD_VAL_9300_5GHZ     -125
-#define AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ     -95
-#define AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ     -100
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_2GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_5GHZ     -60
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_2GHZ -95
+#define AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_5GHZ -100
 
 #define AR_PHY_CCA_NOM_VAL_9462_2GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_2GHZ     -127
 #define AR_PHY_CCA_MAX_GOOD_VAL_9462_2GHZ     -60
-#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ -95
 #define AR_PHY_CCA_NOM_VAL_9462_5GHZ          -127
 #define AR_PHY_CCA_MIN_GOOD_VAL_9462_5GHZ     -127
 #define AR_PHY_CCA_MAX_GOOD_VAL_9462_5GHZ     -60
-#define AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ -100
 
 #define AR_PHY_CCA_NOM_VAL_9330_2GHZ          -118
 
@@ -397,6 +397,8 @@
 #define AR9280_PHY_CCA_THRESH62_S   12
 #define AR_PHY_EXT_CCA0_THRESH62    0x000000FF
 #define AR_PHY_EXT_CCA0_THRESH62_S  0
+#define AR_PHY_EXT_CCA0_THRESH62_1    0x000001FF
+#define AR_PHY_EXT_CCA0_THRESH62_1_S  0
 #define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK          0x0000003F
 #define AR_PHY_CCK_DETECT_WEAK_SIG_THR_CCK_S        0
 #define AR_PHY_CCK_DETECT_ANT_SWITCH_TIME           0x00001FC0
@@ -667,6 +669,16 @@
 #define AR_PHY_65NM_CH1_RXTX4       0x1650c
 #define AR_PHY_65NM_CH2_RXTX4       0x1690c
 
+#define AR_PHY_65NM_CH0_BB1         0x16140
+#define AR_PHY_65NM_CH0_BB2         0x16144
+#define AR_PHY_65NM_CH0_BB3         0x16148
+#define AR_PHY_65NM_CH1_BB1         0x16540
+#define AR_PHY_65NM_CH1_BB2         0x16544
+#define AR_PHY_65NM_CH1_BB3         0x16548
+#define AR_PHY_65NM_CH2_BB1         0x16940
+#define AR_PHY_65NM_CH2_BB2         0x16944
+#define AR_PHY_65NM_CH2_BB3         0x16948
+
 #define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3           0x00780000
 #define AR_PHY_65NM_CH0_SYNTH12_VREFMUL3_S         19
 #define AR_PHY_65NM_CH0_RXTX2_SYNTHON_MASK         0x00000004
@@ -1331,4 +1343,6 @@
 #define AR_PHY_65NM_RXRF_AGC_AGC_OUT                   0x00000004
 #define AR_PHY_65NM_RXRF_AGC_AGC_OUT_S                 2
 
+#define AR9300_DFS_FIRPWR -28
+
 #endif  /* AR9003_PHY_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_wow.c b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
new file mode 100644
index 000000000000..81c88dd606dc
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9003_wow.c
@@ -0,0 +1,422 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/export.h>
+#include "ath9k.h"
+#include "reg.h"
+#include "hw-ops.h"
+
+const char *ath9k_hw_wow_event_to_string(u32 wow_event)
+{
+        if (wow_event & AH_WOW_MAGIC_PATTERN_EN)
+                return "Magic pattern";
+        if (wow_event & AH_WOW_USER_PATTERN_EN)
+                return "User pattern";
+        if (wow_event & AH_WOW_LINK_CHANGE)
+                return "Link change";
+        if (wow_event & AH_WOW_BEACON_MISS)
+                return "Beacon miss";
+
+        return  "unknown reason";
+}
+EXPORT_SYMBOL(ath9k_hw_wow_event_to_string);
+
+static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
+
+        /* set rx disable bit */
+        REG_WRITE(ah, AR_CR, AR_CR_RXD);
+
+        if (!ath9k_hw_wait(ah, AR_CR, AR_CR_RXE, 0, AH_WAIT_TIMEOUT)) {
+                ath_err(common, "Failed to stop Rx DMA in 10ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
+                        REG_READ(ah, AR_CR), REG_READ(ah, AR_DIAG_SW));
+                return;
+        }
+
+        REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_ON_INT);
+}
+
+static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
+{
+        struct ath_common *common = ath9k_hw_common(ah);
+        u8 sta_mac_addr[ETH_ALEN], ap_mac_addr[ETH_ALEN];
+        u32 ctl[13] = {0};
+        u32 data_word[KAL_NUM_DATA_WORDS];
+        u8 i;
+        u32 wow_ka_data_word0;
+
+        memcpy(sta_mac_addr, common->macaddr, ETH_ALEN);
+        memcpy(ap_mac_addr, common->curbssid, ETH_ALEN);
+
+        /* set the transmit buffer */
+        ctl[0] = (KAL_FRAME_LEN | (MAX_RATE_POWER << 16));
+        ctl[1] = 0;
+        ctl[3] = 0xb;   /* OFDM_6M hardware value for this rate */
+        ctl[4] = 0;
+        ctl[7] = (ah->txchainmask) << 2;
+        ctl[2] = 0xf << 16; /* tx_tries 0 */
+
+        for (i = 0; i < KAL_NUM_DESC_WORDS; i++)
+                REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
+
+        REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
+
+        data_word[0] = (KAL_FRAME_TYPE << 2) | (KAL_FRAME_SUB_TYPE << 4) |
+                       (KAL_TO_DS << 8) | (KAL_DURATION_ID << 16);
+        data_word[1] = (ap_mac_addr[3] << 24) | (ap_mac_addr[2] << 16) |
+                       (ap_mac_addr[1] << 8) | (ap_mac_addr[0]);
+        data_word[2] = (sta_mac_addr[1] << 24) | (sta_mac_addr[0] << 16) |
+                       (ap_mac_addr[5] << 8) | (ap_mac_addr[4]);
+        data_word[3] = (sta_mac_addr[5] << 24) | (sta_mac_addr[4] << 16) |
+                       (sta_mac_addr[3] << 8) | (sta_mac_addr[2]);
+        data_word[4] = (ap_mac_addr[3] << 24) | (ap_mac_addr[2] << 16) |
+                       (ap_mac_addr[1] << 8) | (ap_mac_addr[0]);
+        data_word[5] = (ap_mac_addr[5] << 8) | (ap_mac_addr[4]);
+
+        if (AR_SREV_9462_20(ah)) {
+                /* AR9462 2.0 has an extra descriptor word (time based
+                 * discard) compared to other chips */
+                REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + (12 * 4)), 0);
+                wow_ka_data_word0 = AR_WOW_TXBUF(13);
+        } else {
+                wow_ka_data_word0 = AR_WOW_TXBUF(12);
+        }
+
+        for (i = 0; i < KAL_NUM_DATA_WORDS; i++)
+                REG_WRITE(ah, (wow_ka_data_word0 + i*4), data_word[i]);
+
+}
+
+void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
+                                u8 *user_mask, int pattern_count,
+                                int pattern_len)
+{
+        int i;
+        u32 pattern_val, mask_val;
+        u32 set, clr;
+
+        /* FIXME: should check count by querying the hardware capability */
+        if (pattern_count >= MAX_NUM_PATTERN)
+                return;
+
+        REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
+
+        /* set the registers for pattern */
+        for (i = 0; i < MAX_PATTERN_SIZE; i += 4) {
+                memcpy(&pattern_val, user_pattern, 4);
+                REG_WRITE(ah, (AR_WOW_TB_PATTERN(pattern_count) + i),
+                          pattern_val);
+                user_pattern += 4;
+        }
+
+        /* set the registers for mask */
+        for (i = 0; i < MAX_PATTERN_MASK_SIZE; i += 4) {
+                memcpy(&mask_val, user_mask, 4);
+                REG_WRITE(ah, (AR_WOW_TB_MASK(pattern_count) + i), mask_val);
+                user_mask += 4;
+        }
+
+        /* set the pattern length to be matched
+         *
+         * AR_WOW_LENGTH1_REG1
+         * bit 31:24 pattern 0 length
+         * bit 23:16 pattern 1 length
+         * bit 15:8 pattern 2 length
+         * bit 7:0 pattern 3 length
+         *
+         * AR_WOW_LENGTH1_REG2
+         * bit 31:24 pattern 4 length
+         * bit 23:16 pattern 5 length
+         * bit 15:8 pattern 6 length
+         * bit 7:0 pattern 7 length
+         *
+         * the below logic writes out the new
+         * pattern length for the corresponding
+         * pattern_count, while masking out the
+         * other fields
+         */
+
+        ah->wow_event_mask |= BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
+
+        if (pattern_count < 4) {
+                /* Pattern 0-3 uses AR_WOW_LENGTH1 register */
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN1_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH1_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH1, set, clr);
+        } else {
+                /* Pattern 4-7 uses AR_WOW_LENGTH2 register */
+                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
+                       AR_WOW_LEN2_SHIFT(pattern_count);
+                clr = AR_WOW_LENGTH2_MASK(pattern_count);
+                REG_RMW(ah, AR_WOW_LENGTH2, set, clr);
+        }
+
+}
+EXPORT_SYMBOL(ath9k_hw_wow_apply_pattern);
+
+u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
+{
+        u32 wow_status = 0;
+        u32 val = 0, rval;
+
+        /*
+         * read the WoW status register to know
+         * the wakeup reason
+         */
+        rval = REG_READ(ah, AR_WOW_PATTERN);
+        val = AR_WOW_STATUS(rval);
+
+        /*
+         * mask only the WoW events that we have enabled. Sometimes
+         * we have spurious WoW events from the AR_WOW_PATTERN
+         * register. This mask will clean it up.
+         */
+
+        val &= ah->wow_event_mask;
+
+        if (val) {
+                if (val & AR_WOW_MAGIC_PAT_FOUND)
+                        wow_status |= AH_WOW_MAGIC_PATTERN_EN;
+                if (AR_WOW_PATTERN_FOUND(val))
+                        wow_status |= AH_WOW_USER_PATTERN_EN;
+                if (val & AR_WOW_KEEP_ALIVE_FAIL)
+                        wow_status |= AH_WOW_LINK_CHANGE;
+                if (val & AR_WOW_BEACON_FAIL)
+                        wow_status |= AH_WOW_BEACON_MISS;
+        }
+
+        /*
+         * set and clear WOW_PME_CLEAR registers for the chip to
+         * generate next wow signal.
+         * disable D3 before accessing other registers ?
+         */
+
+        /* do we need to check the bit value 0x01000000 (7-10) ?? */
+        REG_RMW(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_WOW_PME_CLR,
+                AR_PMCTRL_PWR_STATE_D1D3);
+
+        /*
+         * clear all events
+         */
+        REG_WRITE(ah, AR_WOW_PATTERN,
+                  AR_WOW_CLEAR_EVENTS(REG_READ(ah, AR_WOW_PATTERN)));
+
+        /*
+         * restore the beacon threshold to init value
+         */
+        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
+
+        /*
+         * Restore the way the PCI-E reset, Power-On-Reset, external
+         * PCIE_POR_SHORT pins are tied to its original value.
+         * Previously just before WoW sleep, we untie the PCI-E
+         * reset to our Chip's Power On Reset so that any PCI-E
+         * reset from the bus will not reset our chip
+         */
+        if (ah->is_pciexpress)
+                ath9k_hw_configpcipowersave(ah, false);
+
+        ah->wow_event_mask = 0;
+
+        return wow_status;
+}
+EXPORT_SYMBOL(ath9k_hw_wow_wakeup);
+
+void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+{
+        u32 wow_event_mask;
+        u32 set, clr;
+
+        /*
+         * wow_event_mask is a mask to the AR_WOW_PATTERN register to
+         * indicate which WoW events we have enabled. The WoW events
+         * are from the 'pattern_enable' in this function and
+         * 'pattern_count' of ath9k_hw_wow_apply_pattern()
+         */
+        wow_event_mask = ah->wow_event_mask;
+
+        /*
+         * Untie Power-on-Reset from the PCI-E-Reset. When we are in
+         * WOW sleep, we do want the Reset from the PCI-E to disturb
+         * our hw state
+         */
+        if (ah->is_pciexpress) {
+                /*
+                 * we need to untie the internal POR (power-on-reset)
+                 * to the external PCI-E reset. We also need to tie
+                 * the PCI-E Phy reset to the PCI-E reset.
+                 */
+                set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
+                clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
+                REG_RMW(ah, AR_WA, set, clr);
+        }
+
+        /*
+         * set the power states appropriately and enable PME
+         */
+        set = AR_PMCTRL_HOST_PME_EN | AR_PMCTRL_PWR_PM_CTRL_ENA |
+              AR_PMCTRL_AUX_PWR_DET | AR_PMCTRL_WOW_PME_CLR;
+
+        /*
+         * set and clear WOW_PME_CLEAR registers for the chip
+         * to generate next wow signal.
+         */
+        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
+        clr = AR_PMCTRL_WOW_PME_CLR;
+        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+
+        /*
+         * Setup for:
+         *      - beacon misses
+         *      - magic pattern
+         *      - keep alive timeout
+         *      - pattern matching
+         */
+
+        /*
+         * Program default values for pattern backoff, aifs/slot/KAL count,
+         * beacon miss timeout, KAL timeout, etc.
+         */
+        set = AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF);
+        REG_SET_BIT(ah, AR_WOW_PATTERN, set);
+
+        set = AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
+              AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
+              AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT);
+        REG_SET_BIT(ah, AR_WOW_COUNT, set);
+
+        if (pattern_enable & AH_WOW_BEACON_MISS)
+                set = AR_WOW_BEACON_TIMO;
+        /* We are not using beacon miss, program a large value */
+        else
+                set = AR_WOW_BEACON_TIMO_MAX;
+
+        REG_WRITE(ah, AR_WOW_BCN_TIMO, set);
+
+        /*
+         * Keep alive timo in ms except AR9280
+         */
+        if (!pattern_enable)
+                set = AR_WOW_KEEP_ALIVE_NEVER;
+        else
+                set = KAL_TIMEOUT * 32;
+
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, set);
+
+        /*
+         * Keep alive delay in us. based on 'power on clock',
+         * therefore in usec
+         */
+        set = KAL_DELAY * 1000;
+        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, set);
+
+        /*
+         * Create keep alive pattern to respond to beacons
+         */
+        ath9k_wow_create_keep_alive_pattern(ah);
+
+        /*
+         * Configure MAC WoW Registers
+         */
+        set = 0;
+        /* Send keep alive timeouts anyway */
+        clr = AR_WOW_KEEP_ALIVE_AUTO_DIS;
+
+        if (pattern_enable & AH_WOW_LINK_CHANGE)
+                wow_event_mask |= AR_WOW_KEEP_ALIVE_FAIL;
+        else
+                set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
+
+        set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        REG_RMW(ah, AR_WOW_KEEP_ALIVE, set, clr);
+
+        /*
+         * we are relying on a bmiss failure. ensure we have
+         * enough threshold to prevent false positives
+         */
+        REG_RMW_FIELD(ah, AR_RSSI_THR, AR_RSSI_THR_BM_THR,
+                      AR_WOW_BMISSTHRESHOLD);
+
+        set = 0;
+        clr = 0;
+
+        if (pattern_enable & AH_WOW_BEACON_MISS) {
+                set = AR_WOW_BEACON_FAIL_EN;
+                wow_event_mask |= AR_WOW_BEACON_FAIL;
+        } else {
+                clr = AR_WOW_BEACON_FAIL_EN;
+        }
+
+        REG_RMW(ah, AR_WOW_BCN_EN, set, clr);
+
+        set = 0;
+        clr = 0;
+        /*
+         * Enable the magic packet registers
+         */
+        if (pattern_enable & AH_WOW_MAGIC_PATTERN_EN) {
+                set = AR_WOW_MAGIC_EN;
+                wow_event_mask |= AR_WOW_MAGIC_PAT_FOUND;
+        } else {
+                clr = AR_WOW_MAGIC_EN;
+        }
+        set |= AR_WOW_MAC_INTR_EN;
+        REG_RMW(ah, AR_WOW_PATTERN, set, clr);
+
+        REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
+                  AR_WOW_PATTERN_SUPPORTED);
+
+        /*
+         * Set the power states appropriately and enable PME
+         */
+        clr = 0;
+        set = AR_PMCTRL_PWR_STATE_D1D3 | AR_PMCTRL_HOST_PME_EN |
+              AR_PMCTRL_PWR_PM_CTRL_ENA;
+
+        clr = AR_PCIE_PM_CTRL_ENA;
+        REG_RMW(ah, AR_PCIE_PM_CTRL, set, clr);
+
+        /*
+         * this is needed to prevent the chip waking up
+         * the host within 3-4 seconds with certain
+         * platform/BIOS. The fix is to enable
+         * D1 & D3 to match original definition and
+         * also match the OTP value. Anyway this
+         * is more related to SW WOW.
+         */
+        clr = AR_PMCTRL_PWR_STATE_D1D3;
+        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+
+        set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
+        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
+
+        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
+
+        /* to bring down WOW power low margin */
+        set = BIT(13);
+        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
+        /* HW WoW */
+        clr = BIT(5);
+        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
+
+        ath9k_hw_set_powermode_wow_sleep(ah);
+        ah->wow_event_mask = wow_event_mask;
+}
+EXPORT_SYMBOL(ath9k_hw_wow_enable);
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
index 6e1756bc3833..f76139bbb74f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p1_initvals.h
@@ -18,6 +18,10 @@
 #ifndef INITVALS_9330_1P1_H
 #define INITVALS_9330_1P1_H
 
+#define ar9331_1p1_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
+#define ar9331_modes_high_power_tx_gain_1p1 ar9331_modes_lowest_ob_db_tx_gain_1p1
+
 static const u32 ar9331_1p1_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8005},
@@ -55,7 +59,7 @@ static const u32 ar9331_1p1_baseband_postamble[][5] = {
         {0x0000a284, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00058d18, 0x00058d18},
         {0x0000a2d0, 0x00071982, 0x00071982, 0x00071982, 0x00071982},
         {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
@@ -252,7 +256,7 @@ static const u32 ar9331_modes_low_ob_db_tx_gain_1p1[][5] = {
         {0x0000a2e0, 0xffffcc84, 0xffffcc84, 0xffffcc84, 0xffffcc84},
         {0x0000a2e4, 0xfffff000, 0xfffff000, 0xfffff000, 0xfffff000},
         {0x0000a2e8, 0xfffe0000, 0xfffe0000, 0xfffe0000, 0xfffe0000},
-        {0x0000a410, 0x000050d7, 0x000050d7, 0x000050d0, 0x000050d0},
+        {0x0000a410, 0x000050d7, 0x000050d7, 0x000050d4, 0x000050d4},
         {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
         {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
         {0x0000a508, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
@@ -337,8 +341,6 @@ static const u32 ar9331_modes_low_ob_db_tx_gain_1p1[][5] = {
         {0x00016284, 0x14d3f000, 0x14d3f000, 0x14d3f000, 0x14d3f000},
 };
 
-#define ar9331_1p1_baseband_core_txfir_coeff_japan_2484 ar9462_2p0_baseband_core_txfir_coeff_japan_2484
-
 static const u32 ar9331_1p1_xtal_25M[][2] = {
         /* Addr      allmodes  */
         {0x00007038, 0x000002f8},
@@ -373,17 +375,17 @@ static const u32 ar9331_1p1_radio_core[][2] = {
         {0x000160b4, 0x92480040},
         {0x000160c0, 0x006db6db},
         {0x000160c4, 0x0186db60},
-        {0x000160c8, 0x6db4db6c},
+        {0x000160c8, 0x6db6db6c},
         {0x000160cc, 0x6de6c300},
         {0x000160d0, 0x14500820},
         {0x00016100, 0x04cb0001},
         {0x00016104, 0xfff80015},
         {0x00016108, 0x00080010},
         {0x0001610c, 0x00170000},
-        {0x00016140, 0x10800000},
+        {0x00016140, 0x50804000},
         {0x00016144, 0x01884080},
         {0x00016148, 0x000080c0},
-        {0x00016280, 0x01000015},
+        {0x00016280, 0x01001015},
         {0x00016284, 0x14d20000},
         {0x00016288, 0x00318000},
         {0x0001628c, 0x50000000},
@@ -622,12 +624,12 @@ static const u32 ar9331_1p1_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x001f0e0f},
-        {0x0000a39c, 0x0075393f},
-        {0x0000a3a0, 0xb79f6427},
-        {0x0000a3a4, 0x00000000},
-        {0x0000a3a8, 0xaaaaaaaa},
-        {0x0000a3ac, 0x3c466478},
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x210d0401},
+        {0x0000a3a0, 0xab9a7144},
+        {0x0000a3a4, 0x00000011},
+        {0x0000a3a8, 0x3c3c003d},
+        {0x0000a3ac, 0x30310030},
         {0x0000a3c0, 0x20202020},
         {0x0000a3c4, 0x22222220},
         {0x0000a3c8, 0x20200020},
@@ -686,100 +688,18 @@ static const u32 ar9331_1p1_baseband_core[][2] = {
         {0x0000a7dc, 0x00000001},
 };
 
-static const u32 ar9331_modes_high_power_tx_gain_1p1[][5] = {
+static const u32 ar9331_1p1_mac_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2d8, 0x7999a83a, 0x7999a83a, 0x7999a83a, 0x7999a83a},
-        {0x0000a2dc, 0xffff2a52, 0xffff2a52, 0xffff2a52, 0xffff2a52},
-        {0x0000a2e0, 0xffffcc84, 0xffffcc84, 0xffffcc84, 0xffffcc84},
-        {0x0000a2e4, 0xfffff000, 0xfffff000, 0xfffff000, 0xfffff000},
-        {0x0000a2e8, 0xfffe0000, 0xfffe0000, 0xfffe0000, 0xfffe0000},
-        {0x0000a410, 0x000050d7, 0x000050d7, 0x000050d0, 0x000050d0},
-        {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
-        {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x11062202, 0x11062202, 0x0d000200, 0x0d000200},
-        {0x0000a510, 0x17022e00, 0x17022e00, 0x11000202, 0x11000202},
-        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x15000400, 0x15000400},
-        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x19000402, 0x19000402},
-        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x1d000404, 0x1d000404},
-        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x23000a00, 0x23000a00},
-        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x27000a02, 0x27000a02},
-        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x2b000a04, 0x2b000a04},
-        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2d000a20, 0x2d000a20},
-        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x31000a22, 0x31000a22},
-        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x35000a24, 0x35000a24},
-        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x38000a43, 0x38000a43},
-        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x3b000e42, 0x3b000e42},
-        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x3f000e44, 0x3f000e44},
-        {0x0000a544, 0x6502feca, 0x6502feca, 0x42000e64, 0x42000e64},
-        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x46000e66, 0x46000e66},
-        {0x0000a54c, 0x7203feca, 0x7203feca, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x4a000ea6, 0x4a000ea6},
-        {0x0000a580, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
-        {0x0000a584, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
-        {0x0000a588, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
-        {0x0000a58c, 0x11062202, 0x11062202, 0x0b000200, 0x0b000200},
-        {0x0000a590, 0x17022e00, 0x17022e00, 0x0f000202, 0x0f000202},
-        {0x0000a594, 0x1d000ec2, 0x1d000ec2, 0x11000400, 0x11000400},
-        {0x0000a598, 0x25020ec0, 0x25020ec0, 0x15000402, 0x15000402},
-        {0x0000a59c, 0x2b020ec3, 0x2b020ec3, 0x19000404, 0x19000404},
-        {0x0000a5a0, 0x2f001f04, 0x2f001f04, 0x1b000603, 0x1b000603},
-        {0x0000a5a4, 0x35001fc4, 0x35001fc4, 0x1f000a02, 0x1f000a02},
-        {0x0000a5a8, 0x3c022f04, 0x3c022f04, 0x23000a04, 0x23000a04},
-        {0x0000a5ac, 0x41023e85, 0x41023e85, 0x26000a20, 0x26000a20},
-        {0x0000a5b0, 0x48023ec6, 0x48023ec6, 0x2a000e20, 0x2a000e20},
-        {0x0000a5b4, 0x4d023f01, 0x4d023f01, 0x2e000e22, 0x2e000e22},
-        {0x0000a5b8, 0x53023f4b, 0x53023f4b, 0x31000e24, 0x31000e24},
-        {0x0000a5bc, 0x5a027f09, 0x5a027f09, 0x34001640, 0x34001640},
-        {0x0000a5c0, 0x5f027fc9, 0x5f027fc9, 0x38001660, 0x38001660},
-        {0x0000a5c4, 0x6502feca, 0x6502feca, 0x3b001861, 0x3b001861},
-        {0x0000a5c8, 0x6b02ff4a, 0x6b02ff4a, 0x3e001a81, 0x3e001a81},
-        {0x0000a5cc, 0x7203feca, 0x7203feca, 0x42001a83, 0x42001a83},
-        {0x0000a5d0, 0x7703ff0b, 0x7703ff0b, 0x44001c84, 0x44001c84},
-        {0x0000a5d4, 0x7d06ffcb, 0x7d06ffcb, 0x48001ce3, 0x48001ce3},
-        {0x0000a5d8, 0x8407ff0b, 0x8407ff0b, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a5dc, 0x8907ffcb, 0x8907ffcb, 0x50001ce9, 0x50001ce9},
-        {0x0000a5e0, 0x900fff0b, 0x900fff0b, 0x54001ceb, 0x54001ceb},
-        {0x0000a5e4, 0x960fffcb, 0x960fffcb, 0x56001eec, 0x56001eec},
-        {0x0000a5e8, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a5ec, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a5f0, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a5f4, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a5f8, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a5fc, 0x9c1fff0b, 0x9c1fff0b, 0x56001eec, 0x56001eec},
-        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
-        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x02008802, 0x02008802, 0x02008802, 0x02008802},
-        {0x0000a620, 0x0280c802, 0x0280c802, 0x0280c802, 0x0280c802},
-        {0x0000a624, 0x03010a03, 0x03010a03, 0x03010a03, 0x03010a03},
-        {0x0000a628, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x0000a62c, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x0000a630, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x0000a634, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x0000a638, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x0000a63c, 0x03010c04, 0x03010c04, 0x03010c04, 0x03010c04},
-        {0x00016044, 0x034922db, 0x034922db, 0x034922db, 0x034922db},
-        {0x00016284, 0x14d3f000, 0x14d3f000, 0x14d3f000, 0x14d3f000},
+        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
+        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
+        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
+        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
+        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
+        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
+        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
+        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
 };
 
-#define ar9331_1p1_mac_postamble ar9300_2p2_mac_postamble
-
 static const u32 ar9331_1p1_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x00007020, 0x00000000},
diff --git a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
index 57ed8a112173..0ac8be96097f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9330_1p2_initvals.h
@@ -18,6 +18,28 @@
 #ifndef INITVALS_9330_1P2_H
 #define INITVALS_9330_1P2_H
 
+#define ar9331_modes_high_power_tx_gain_1p2 ar9331_modes_high_ob_db_tx_gain_1p2
+
+#define ar9331_modes_low_ob_db_tx_gain_1p2 ar9331_modes_high_ob_db_tx_gain_1p2
+
+#define ar9331_modes_lowest_ob_db_tx_gain_1p2 ar9331_modes_high_ob_db_tx_gain_1p2
+
+#define ar9331_1p2_baseband_core_txfir_coeff_japan_2484 ar9331_1p1_baseband_core_txfir_coeff_japan_2484
+
+#define ar9331_1p2_xtal_25M ar9331_1p1_xtal_25M
+
+#define ar9331_1p2_xtal_40M ar9331_1p1_xtal_40M
+
+#define ar9331_1p2_soc_postamble ar9331_1p1_soc_postamble
+
+#define ar9331_1p2_mac_postamble ar9331_1p1_mac_postamble
+
+#define ar9331_1p2_soc_preamble ar9331_1p1_soc_preamble
+
+#define ar9331_1p2_mac_core ar9331_1p1_mac_core
+
+#define ar9331_common_wo_xlna_rx_gain_1p2 ar9331_common_wo_xlna_rx_gain_1p1
+
 static const u32 ar9331_modes_high_ob_db_tx_gain_1p2[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x0000a410, 0x000050d7, 0x000050d7, 0x000050d7, 0x000050d7},
@@ -103,57 +125,6 @@ static const u32 ar9331_modes_high_ob_db_tx_gain_1p2[][5] = {
         {0x0000a63c, 0x04011004, 0x04011004, 0x04011004, 0x04011004},
 };
 
-#define ar9331_modes_high_power_tx_gain_1p2 ar9331_modes_high_ob_db_tx_gain_1p2
-
-#define ar9331_modes_low_ob_db_tx_gain_1p2 ar9331_modes_high_power_tx_gain_1p2
-
-#define ar9331_modes_lowest_ob_db_tx_gain_1p2 ar9331_modes_low_ob_db_tx_gain_1p2
-
-static const u32 ar9331_1p2_baseband_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8005},
-        {0x00009820, 0x206a002e, 0x206a002e, 0x206a002e, 0x206a002e},
-        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
-        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
-        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
-        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x0000059c},
-        {0x00009c00, 0x00000044, 0x00000044, 0x00000044, 0x00000044},
-        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a4, 0x037216a4},
-        {0x00009e04, 0x00182020, 0x00182020, 0x00182020, 0x00182020},
-        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
-        {0x00009e10, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e},
-        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
-        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
-        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
-        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00003221, 0x00003221},
-        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946222, 0xcf946222},
-        {0x00009e44, 0x02321e27, 0x02321e27, 0x02282324, 0x02282324},
-        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302010, 0x50302010},
-        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
-        {0x0000a204, 0x00003fc0, 0x00003fc4, 0x00003fc4, 0x00003fc0},
-        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
-        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
-        {0x0000a234, 0x00000fff, 0x00000fff, 0x10000fff, 0x00000fff},
-        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
-        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
-        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
-        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
-        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
-        {0x0000a260, 0x3a021501, 0x3a021501, 0x3a021501, 0x3a021501},
-        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
-        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
-        {0x0000a284, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
-        {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071981},
-        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
-        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000ae04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
-        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-};
-
 static const u32 ar9331_1p2_radio_core[][2] = {
         /* Addr      allmodes  */
         {0x00016000, 0x36db6db6},
@@ -219,24 +190,318 @@ static const u32 ar9331_1p2_radio_core[][2] = {
         {0x000163d4, 0x00000000},
 };
 
-#define ar9331_1p2_baseband_core_txfir_coeff_japan_2484 ar9331_1p1_baseband_core_txfir_coeff_japan_2484
-
-#define ar9331_1p2_xtal_25M ar9331_1p1_xtal_25M
-
-#define ar9331_1p2_xtal_40M ar9331_1p1_xtal_40M
-
-#define ar9331_1p2_baseband_core ar9331_1p1_baseband_core
-
-#define ar9331_1p2_soc_postamble ar9331_1p1_soc_postamble
-
-#define ar9331_1p2_mac_postamble ar9331_1p1_mac_postamble
-
-#define ar9331_1p2_soc_preamble ar9331_1p1_soc_preamble
-
-#define ar9331_1p2_mac_core ar9331_1p1_mac_core
+static const u32 ar9331_1p2_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a8f6b},
+        {0x0000980c, 0x04800000},
+        {0x00009814, 0x9280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x5f3ca3de},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14750600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840bbe},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0x00000000},
+        {0x00009c08, 0x03200000},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x1883800a},
+        {0x00009d10, 0x01834061},
+        {0x00009d14, 0x00c00400},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038233c},
+        {0x00009e24, 0x9927b515},
+        {0x00009e28, 0x12ef0200},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x803e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a2a0, 0x00000001},
+        {0x0000a2c0, 0x00000001},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2cc, 0x18c43433},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2dc, 0x00000000},
+        {0x0000a2e0, 0x00000000},
+        {0x0000a2e4, 0x00000000},
+        {0x0000a2e8, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x001f0e0f},
+        {0x0000a39c, 0x0075393f},
+        {0x0000a3a0, 0xb79f6427},
+        {0x0000a3a4, 0x00000000},
+        {0x0000a3a8, 0xaaaaaaaa},
+        {0x0000a3ac, 0x3c466478},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000006},
+        {0x0000a3f8, 0x0cdbd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce739ce},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce739ce},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce739ce},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00000000},
+        {0x0000a440, 0x00000000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x04000000},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a640, 0x00000000},
+        {0x0000a644, 0x3fad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x00000838},
+        {0x0000a7c0, 0x00000000},
+        {0x0000a7c4, 0xfffffffc},
+        {0x0000a7c8, 0x00000000},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000001},
+};
 
-#define ar9331_common_wo_xlna_rx_gain_1p2 ar9331_common_wo_xlna_rx_gain_1p1
+static const u32 ar9331_1p2_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8005, 0xd00a8005},
+        {0x00009820, 0x206a002e, 0x206a002e, 0x206a002e, 0x206a002e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000059c, 0x0000059c},
+        {0x00009c00, 0x00000044, 0x00000044, 0x00000044, 0x00000044},
+        {0x00009e00, 0x0372161e, 0x0372161e, 0x037216a4, 0x037216a4},
+        {0x00009e04, 0x00182020, 0x00182020, 0x00182020, 0x00182020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e, 0x7ec80d2e},
+        {0x00009e14, 0x31395d5e, 0x3139605e, 0x3139605e, 0x31395d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00003221, 0x00003221},
+        {0x00009e3c, 0xcf946222, 0xcf946222, 0xcf946222, 0xcf946222},
+        {0x00009e44, 0x02321e27, 0x02321e27, 0x02282324, 0x02282324},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302010, 0x50302010},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x00003fc0, 0x00003fc4, 0x00003fc4, 0x00003fc0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x00000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb81018, 0xffb81018, 0xffb81018, 0xffb81018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a260, 0x3a021501, 0x3a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x00000e0e, 0x00000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a288, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a28c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2d0, 0x00071981, 0x00071981, 0x00071981, 0x00071981},
+        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0xf999a83a, 0xf999a83a},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae04, 0x00802020, 0x00802020, 0x00802020, 0x00802020},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+};
 
-#define ar9331_common_rx_gain_1p2 ar9485_common_rx_gain_1_1
+static const u32 ar9331_common_rx_gain_1p2[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x01800082},
+        {0x0000a014, 0x01820181},
+        {0x0000a018, 0x01840183},
+        {0x0000a01c, 0x01880185},
+        {0x0000a020, 0x018a0189},
+        {0x0000a024, 0x02850284},
+        {0x0000a028, 0x02890288},
+        {0x0000a02c, 0x03850384},
+        {0x0000a030, 0x03890388},
+        {0x0000a034, 0x038b038a},
+        {0x0000a038, 0x038d038c},
+        {0x0000a03c, 0x03910390},
+        {0x0000a040, 0x03930392},
+        {0x0000a044, 0x03950394},
+        {0x0000a048, 0x00000396},
+        {0x0000a04c, 0x00000000},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x28282828},
+        {0x0000a084, 0x28282828},
+        {0x0000a088, 0x28282828},
+        {0x0000a08c, 0x28282828},
+        {0x0000a090, 0x28282828},
+        {0x0000a094, 0x21212128},
+        {0x0000a098, 0x171c1c1c},
+        {0x0000a09c, 0x02020212},
+        {0x0000a0a0, 0x00000202},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x111f1100},
+        {0x0000a0c8, 0x111d111e},
+        {0x0000a0cc, 0x111b111c},
+        {0x0000a0d0, 0x22032204},
+        {0x0000a0d4, 0x22012202},
+        {0x0000a0d8, 0x221f2200},
+        {0x0000a0dc, 0x221d221e},
+        {0x0000a0e0, 0x33013302},
+        {0x0000a0e4, 0x331f3300},
+        {0x0000a0e8, 0x4402331e},
+        {0x0000a0ec, 0x44004401},
+        {0x0000a0f0, 0x441e441f},
+        {0x0000a0f4, 0x55015502},
+        {0x0000a0f8, 0x551f5500},
+        {0x0000a0fc, 0x6602551e},
+        {0x0000a100, 0x66006601},
+        {0x0000a104, 0x661e661f},
+        {0x0000a108, 0x7703661d},
+        {0x0000a10c, 0x77017702},
+        {0x0000a110, 0x00007700},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x111f1100},
+        {0x0000a148, 0x111d111e},
+        {0x0000a14c, 0x111b111c},
+        {0x0000a150, 0x22032204},
+        {0x0000a154, 0x22012202},
+        {0x0000a158, 0x221f2200},
+        {0x0000a15c, 0x221d221e},
+        {0x0000a160, 0x33013302},
+        {0x0000a164, 0x331f3300},
+        {0x0000a168, 0x4402331e},
+        {0x0000a16c, 0x44004401},
+        {0x0000a170, 0x441e441f},
+        {0x0000a174, 0x55015502},
+        {0x0000a178, 0x551f5500},
+        {0x0000a17c, 0x6602551e},
+        {0x0000a180, 0x66006601},
+        {0x0000a184, 0x661e661f},
+        {0x0000a188, 0x7703661d},
+        {0x0000a18c, 0x77017702},
+        {0x0000a190, 0x00007700},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000296},
+};
 
 #endif /* INITVALS_9330_1P2_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
index 25db9215985a..a01f0edb6518 100644
--- a/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9340_initvals.h
@@ -18,6 +18,20 @@
 #ifndef INITVALS_9340_H
 #define INITVALS_9340_H
 
+#define ar9340_1p0_mac_postamble ar9300_2p2_mac_postamble
+
+#define ar9340_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define ar9340Modes_fast_clock_1p0 ar9300Modes_fast_clock_2p2
+
+#define ar9340Common_rx_gain_table_1p0 ar9300Common_rx_gain_table_2p2
+
+#define ar9340Common_wo_xlna_rx_gain_table_1p0 ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define ar9340_1p0_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
+#define ar9340_1p0_baseband_postamble_dfs_channel ar9300_2p2_baseband_postamble_dfs_channel
+
 static const u32 ar9340_1p0_radio_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000160ac, 0xa4646800, 0xa4646800, 0xa4646800, 0xa4646800},
@@ -100,8 +114,6 @@ static const u32 ar9340Modes_lowest_ob_db_tx_gain_table_1p0[][5] = {
         {0x00016448, 0x24925266, 0x24925266, 0x24925266, 0x24925266},
 };
 
-#define ar9340Modes_fast_clock_1p0 ar9300Modes_fast_clock_2p2
-
 static const u32 ar9340_1p0_radio_core[][2] = {
         /* Addr      allmodes  */
         {0x00016000, 0x36db6db6},
@@ -215,16 +227,12 @@ static const u32 ar9340_1p0_radio_core_40M[][2] = {
         {0x0000824c, 0x0001e800},
 };
 
-#define ar9340_1p0_mac_postamble ar9300_2p2_mac_postamble
-
-#define ar9340_1p0_soc_postamble ar9300_2p2_soc_postamble
-
 static const u32 ar9340_1p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
         {0x00009820, 0x206a022e, 0x206a022e, 0x206a022e, 0x206a022e},
         {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
-        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x00009828, 0x06903081, 0x06903081, 0x09103881, 0x09103881},
         {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
         {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
         {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
@@ -340,9 +348,9 @@ static const u32 ar9340_1p0_baseband_core[][2] = {
         {0x0000a370, 0x00000000},
         {0x0000a390, 0x00000001},
         {0x0000a394, 0x00000444},
-        {0x0000a398, 0x001f0e0f},
-        {0x0000a39c, 0x0075393f},
-        {0x0000a3a0, 0xb79f6427},
+        {0x0000a398, 0x00000000},
+        {0x0000a39c, 0x210d0401},
+        {0x0000a3a0, 0xab9a7144},
         {0x0000a3a4, 0x00000000},
         {0x0000a3a8, 0xaaaaaaaa},
         {0x0000a3ac, 0x3c466478},
@@ -714,266 +722,6 @@ static const u32 ar9340Modes_ub124_tx_gain_table_1p0[][5] = {
         {0x0000b2e8, 0xfffe0000, 0xfffe0000, 0xfffc0000, 0xfffc0000},
 };
 
-static const u32 ar9340Common_rx_gain_table_1p0[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x01910190},
-        {0x0000a030, 0x01930192},
-        {0x0000a034, 0x01950194},
-        {0x0000a038, 0x038a0196},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x22222229},
-        {0x0000a084, 0x1d1d1d1d},
-        {0x0000a088, 0x1d1d1d1d},
-        {0x0000a08c, 0x1d1d1d1d},
-        {0x0000a090, 0x171d1d1d},
-        {0x0000a094, 0x11111717},
-        {0x0000a098, 0x00030311},
-        {0x0000a09c, 0x00000000},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x23232323},
-        {0x0000b084, 0x21232323},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
 static const u32 ar9340Modes_low_ob_db_tx_gain_table_1p0[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
@@ -1437,8 +1185,6 @@ static const u32 ar9340_1p0_mac_core[][2] = {
         {0x000083d0, 0x000101ff},
 };
 
-#define ar9340Common_wo_xlna_rx_gain_table_1p0 ar9300Common_wo_xlna_rx_gain_table_2p2
-
 static const u32 ar9340_1p0_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x00007008, 0x00000000},
@@ -1447,4 +1193,106 @@ static const u32 ar9340_1p0_soc_preamble[][2] = {
         {0x00007038, 0x000004c2},
 };
 
+static const u32 ar9340_cus227_tx_gain_table_1p0[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1c000223, 0x1c000223, 0x11000400, 0x11000400},
+        {0x0000a518, 0x21002220, 0x21002220, 0x15000402, 0x15000402},
+        {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2c022220, 0x2c022220, 0x1b000603, 0x1b000603},
+        {0x0000a524, 0x30022222, 0x30022222, 0x1f000a02, 0x1f000a02},
+        {0x0000a528, 0x35022225, 0x35022225, 0x23000a04, 0x23000a04},
+        {0x0000a52c, 0x3b02222a, 0x3b02222a, 0x26000a20, 0x26000a20},
+        {0x0000a530, 0x3f02222c, 0x3f02222c, 0x2a000e20, 0x2a000e20},
+        {0x0000a534, 0x4202242a, 0x4202242a, 0x2e000e22, 0x2e000e22},
+        {0x0000a538, 0x4702244a, 0x4702244a, 0x31000e24, 0x31000e24},
+        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x34001640, 0x34001640},
+        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x38001660, 0x38001660},
+        {0x0000a544, 0x5302266c, 0x5302266c, 0x3b001861, 0x3b001861},
+        {0x0000a548, 0x5702286c, 0x5702286c, 0x3e001a81, 0x3e001a81},
+        {0x0000a54c, 0x5c02486b, 0x5c02486b, 0x42001a83, 0x42001a83},
+        {0x0000a550, 0x61024a6c, 0x61024a6c, 0x44001c84, 0x44001c84},
+        {0x0000a554, 0x66026a6c, 0x66026a6c, 0x48001ce3, 0x48001ce3},
+        {0x0000a558, 0x6b026e6c, 0x6b026e6c, 0x4c001ce5, 0x4c001ce5},
+        {0x0000a55c, 0x7002708c, 0x7002708c, 0x50001ce9, 0x50001ce9},
+        {0x0000a560, 0x7302b08a, 0x7302b08a, 0x54001ceb, 0x54001ceb},
+        {0x0000a564, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a568, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a56c, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a570, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a574, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a578, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a57c, 0x7702b08c, 0x7702b08c, 0x56001eec, 0x56001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1c800223, 0x1c800223, 0x11800400, 0x11800400},
+        {0x0000a598, 0x21820220, 0x21820220, 0x15800402, 0x15800402},
+        {0x0000a59c, 0x27820223, 0x27820223, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1b800603, 0x1b800603},
+        {0x0000a5a4, 0x2f822222, 0x2f822222, 0x1f800a02, 0x1f800a02},
+        {0x0000a5a8, 0x34822225, 0x34822225, 0x23800a04, 0x23800a04},
+        {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x26800a20, 0x26800a20},
+        {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2a800e20, 0x2a800e20},
+        {0x0000a5b4, 0x4282242a, 0x4282242a, 0x2e800e22, 0x2e800e22},
+        {0x0000a5b8, 0x4782244a, 0x4782244a, 0x31800e24, 0x31800e24},
+        {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x34801640, 0x34801640},
+        {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x38801660, 0x38801660},
+        {0x0000a5c4, 0x5382266c, 0x5382266c, 0x3b801861, 0x3b801861},
+        {0x0000a5c8, 0x5782286c, 0x5782286c, 0x3e801a81, 0x3e801a81},
+        {0x0000a5cc, 0x5c84286b, 0x5c84286b, 0x42801a83, 0x42801a83},
+        {0x0000a5d0, 0x61842a6c, 0x61842a6c, 0x44801c84, 0x44801c84},
+        {0x0000a5d4, 0x66862a6c, 0x66862a6c, 0x48801ce3, 0x48801ce3},
+        {0x0000a5d8, 0x6b862e6c, 0x6b862e6c, 0x4c801ce5, 0x4c801ce5},
+        {0x0000a5dc, 0x7086308c, 0x7086308c, 0x50801ce9, 0x50801ce9},
+        {0x0000a5e0, 0x738a308a, 0x738a308a, 0x54801ceb, 0x54801ceb},
+        {0x0000a5e4, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5e8, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5ec, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5f0, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5f4, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5f8, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a5fc, 0x778a308c, 0x778a308c, 0x56801eec, 0x56801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
+        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x056db2db, 0x056db2db, 0x03b6d2e4, 0x03b6d2e4},
+        {0x00016048, 0x24925666, 0x24925666, 0x8e481266, 0x8e481266},
+        {0x00016280, 0x01000015, 0x01000015, 0x01001015, 0x01001015},
+        {0x00016288, 0x30318000, 0x30318000, 0x00318000, 0x00318000},
+        {0x00016444, 0x056db2db, 0x056db2db, 0x03b6d2e4, 0x03b6d2e4},
+        {0x00016448, 0x24925666, 0x24925666, 0x8e481266, 0x8e481266},
+        {0x0000a3a4, 0x00000011, 0x00000011, 0x00000011, 0x00000011},
+        {0x0000a3a8, 0x3c3c3c3c, 0x3c3c3c3c, 0x3c3c3c3c, 0x3c3c3c3c},
+        {0x0000a3ac, 0x30303030, 0x30303030, 0x30303030, 0x30303030},
+};
+
 #endif /* INITVALS_9340_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
index 092b9d412e7f..1cc13569b17b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p0_initvals.h
@@ -20,7 +20,15 @@
 
 /* AR9462 2.0 */
 
-static const u32 ar9462_modes_fast_clock_2p0[][3] = {
+#define ar9462_2p0_mac_postamble ar9331_1p1_mac_postamble
+
+#define ar9462_2p0_common_wo_xlna_rx_gain ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define ar9462_2p0_common_5g_xlna_only_rxgain ar9462_2p0_common_mixed_rx_gain
+
+#define ar9462_2p0_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
+static const u32 ar9462_2p0_modes_fast_clock[][3] = {
         /* Addr      5G_HT20     5G_HT40   */
         {0x00001030, 0x00000268, 0x000004d0},
         {0x00001070, 0x0000018c, 0x00000318},
@@ -33,13 +41,6 @@ static const u32 ar9462_modes_fast_clock_2p0[][3] = {
         {0x0000a254, 0x00000898, 0x00001130},
 };
 
-static const u32 ar9462_pciephy_clkreq_enable_L1_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18253ede},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003780c},
-};
-
 static const u32 ar9462_2p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
@@ -99,7 +100,7 @@ static const u32 ar9462_2p0_baseband_postamble[][5] = {
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
-static const u32 ar9462_common_rx_gain_table_2p0[][2] = {
+static const u32 ar9462_2p0_common_rx_gain[][2] = {
         /* Addr      allmodes  */
         {0x0000a000, 0x00010000},
         {0x0000a004, 0x00030002},
@@ -359,20 +360,13 @@ static const u32 ar9462_common_rx_gain_table_2p0[][2] = {
         {0x0000b1fc, 0x00000196},
 };
 
-static const u32 ar9462_pciephy_clkreq_disable_L1_2p0[][2] = {
+static const u32 ar9462_2p0_pciephy_clkreq_disable_L1[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18213ede},
         {0x00018c04, 0x000801d8},
         {0x00018c08, 0x0003780c},
 };
 
-static const u32 ar9462_pciephy_pll_on_clkreq_disable_L1_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x00018c00, 0x18212ede},
-        {0x00018c04, 0x000801d8},
-        {0x00018c08, 0x0003780c},
-};
-
 static const u32 ar9462_2p0_radio_postamble_sys2ant[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000160ac, 0xa4646c08, 0xa4646c08, 0x24645808, 0x24645808},
@@ -380,274 +374,7 @@ static const u32 ar9462_2p0_radio_postamble_sys2ant[][5] = {
         {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
 };
 
-static const u32 ar9462_common_wo_xlna_rx_gain_table_2p0[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9462_2p0_baseband_core_txfir_coeff_japan_2484[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x6f7f0301},
-        {0x0000a3a0, 0xca9228ee},
-};
-
-static const u32 ar9462_modes_low_ob_db_tx_gain_table_2p0[][5] = {
+static const u32 ar9462_2p0_modes_low_ob_db_tx_gain[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
         {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
@@ -879,7 +606,7 @@ static const u32 ar9462_2p0_radio_postamble[][5] = {
         {0x0001650c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
 };
 
-static const u32 ar9462_modes_mix_ob_db_tx_gain_table_2p0[][5] = {
+static const u32 ar9462_2p0_modes_mix_ob_db_tx_gain[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
         {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
@@ -942,7 +669,7 @@ static const u32 ar9462_modes_mix_ob_db_tx_gain_table_2p0[][5] = {
         {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
 };
 
-static const u32 ar9462_modes_high_ob_db_tx_gain_table_2p0[][5] = {
+static const u32 ar9462_2p0_modes_high_ob_db_tx_gain[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
         {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
@@ -1240,19 +967,7 @@ static const u32 ar9462_2p0_mac_core[][2] = {
         {0x000083d0, 0x000301ff},
 };
 
-static const u32 ar9462_2p0_mac_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
-        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
-        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
-        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
-        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
-        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
-        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
-};
-
-static const u32 ar9462_common_mixed_rx_gain_table_2p0[][2] = {
+static const u32 ar9462_2p0_common_mixed_rx_gain[][2] = {
         /* Addr      allmodes  */
         {0x0000a000, 0x00010000},
         {0x0000a004, 0x00030002},
@@ -1517,266 +1232,6 @@ static const u32 ar9462_2p0_baseband_postamble_5g_xlna[][5] = {
         {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
 };
 
-static const u32 ar9462_2p0_5g_xlna_only_rxgain[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x2a2d2f32},
-        {0x0000b084, 0x21232328},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
 static const u32 ar9462_2p0_baseband_core_mix_rxgain[][2] = {
         /* Addr      allmodes  */
         {0x00009fd0, 0x0a2d6b93},
diff --git a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
index 57fc5f459d0a..dc3adda46e8b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9462_2p1_initvals.h
@@ -20,6 +20,44 @@
 
 /* AR9462 2.1 */
 
+#define ar9462_2p1_mac_postamble ar9462_2p0_mac_postamble
+
+#define ar9462_2p1_baseband_core ar9462_2p0_baseband_core
+
+#define ar9462_2p1_radio_core ar9462_2p0_radio_core
+
+#define ar9462_2p1_radio_postamble ar9462_2p0_radio_postamble
+
+#define ar9462_2p1_soc_postamble ar9462_2p0_soc_postamble
+
+#define ar9462_2p1_radio_postamble_sys2ant ar9462_2p0_radio_postamble_sys2ant
+
+#define ar9462_2p1_common_rx_gain ar9462_2p0_common_rx_gain
+
+#define ar9462_2p1_common_mixed_rx_gain ar9462_2p0_common_mixed_rx_gain
+
+#define ar9462_2p1_common_5g_xlna_only_rxgain ar9462_2p0_common_5g_xlna_only_rxgain
+
+#define ar9462_2p1_baseband_core_mix_rxgain ar9462_2p0_baseband_core_mix_rxgain
+
+#define ar9462_2p1_baseband_postamble_mix_rxgain ar9462_2p0_baseband_postamble_mix_rxgain
+
+#define ar9462_2p1_baseband_postamble_5g_xlna ar9462_2p0_baseband_postamble_5g_xlna
+
+#define ar9462_2p1_common_wo_xlna_rx_gain ar9462_2p0_common_wo_xlna_rx_gain
+
+#define ar9462_2p1_modes_low_ob_db_tx_gain ar9462_2p0_modes_low_ob_db_tx_gain
+
+#define ar9462_2p1_modes_high_ob_db_tx_gain ar9462_2p0_modes_high_ob_db_tx_gain
+
+#define ar9462_2p1_modes_mix_ob_db_tx_gain ar9462_2p0_modes_mix_ob_db_tx_gain
+
+#define ar9462_2p1_modes_fast_clock ar9462_2p0_modes_fast_clock
+
+#define ar9462_2p1_baseband_core_txfir_coeff_japan_2484 ar9462_2p0_baseband_core_txfir_coeff_japan_2484
+
+#define ar9462_2p1_pciephy_clkreq_disable_L1 ar9462_2p0_pciephy_clkreq_disable_L1
+
 static const u32 ar9462_2p1_mac_core[][2] = {
         /* Addr      allmodes  */
         {0x00000008, 0x00000000},
@@ -183,168 +221,6 @@ static const u32 ar9462_2p1_mac_core[][2] = {
         {0x000083d0, 0x000301ff},
 };
 
-static const u32 ar9462_2p1_mac_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
-        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
-        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
-        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
-        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
-        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
-        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
-};
-
-static const u32 ar9462_2p1_baseband_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00009800, 0xafe68e30},
-        {0x00009804, 0xfd14e000},
-        {0x00009808, 0x9c0a9f6b},
-        {0x0000980c, 0x04900000},
-        {0x00009814, 0x9280c00a},
-        {0x00009818, 0x00000000},
-        {0x0000981c, 0x00020028},
-        {0x00009834, 0x6400a290},
-        {0x00009838, 0x0108ecff},
-        {0x0000983c, 0x0d000600},
-        {0x00009880, 0x201fff00},
-        {0x00009884, 0x00001042},
-        {0x000098a4, 0x00200400},
-        {0x000098b0, 0x32440bbe},
-        {0x000098d0, 0x004b6a8e},
-        {0x000098d4, 0x00000820},
-        {0x000098dc, 0x00000000},
-        {0x000098e4, 0x01ffffff},
-        {0x000098e8, 0x01ffffff},
-        {0x000098ec, 0x01ffffff},
-        {0x000098f0, 0x00000000},
-        {0x000098f4, 0x00000000},
-        {0x00009bf0, 0x80000000},
-        {0x00009c04, 0xff55ff55},
-        {0x00009c08, 0x0320ff55},
-        {0x00009c0c, 0x00000000},
-        {0x00009c10, 0x00000000},
-        {0x00009c14, 0x00046384},
-        {0x00009c18, 0x05b6b440},
-        {0x00009c1c, 0x00b6b440},
-        {0x00009d00, 0xc080a333},
-        {0x00009d04, 0x40206c10},
-        {0x00009d08, 0x009c4060},
-        {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
-        {0x00009d14, 0x00c0040b},
-        {0x00009d18, 0x00000000},
-        {0x00009e08, 0x0038230c},
-        {0x00009e24, 0x990bb515},
-        {0x00009e28, 0x0c6f0000},
-        {0x00009e30, 0x06336f77},
-        {0x00009e34, 0x6af6532f},
-        {0x00009e38, 0x0cc80c00},
-        {0x00009e40, 0x15262820},
-        {0x00009e4c, 0x00001004},
-        {0x00009e50, 0x00ff03f1},
-        {0x00009e54, 0xe4c555c2},
-        {0x00009e58, 0xfd857722},
-        {0x00009e5c, 0xe9198724},
-        {0x00009fc0, 0x803e4788},
-        {0x00009fc4, 0x0001efb5},
-        {0x00009fcc, 0x40000014},
-        {0x00009fd0, 0x0a193b93},
-        {0x0000a20c, 0x00000000},
-        {0x0000a220, 0x00000000},
-        {0x0000a224, 0x00000000},
-        {0x0000a228, 0x10002310},
-        {0x0000a23c, 0x00000000},
-        {0x0000a244, 0x0c000000},
-        {0x0000a2a0, 0x00000001},
-        {0x0000a2c0, 0x00000001},
-        {0x0000a2c8, 0x00000000},
-        {0x0000a2cc, 0x18c43433},
-        {0x0000a2d4, 0x00000000},
-        {0x0000a2ec, 0x00000000},
-        {0x0000a2f0, 0x00000000},
-        {0x0000a2f4, 0x00000000},
-        {0x0000a2f8, 0x00000000},
-        {0x0000a344, 0x00000000},
-        {0x0000a34c, 0x00000000},
-        {0x0000a350, 0x0000a000},
-        {0x0000a364, 0x00000000},
-        {0x0000a370, 0x00000000},
-        {0x0000a390, 0x00000001},
-        {0x0000a394, 0x00000444},
-        {0x0000a398, 0x001f0e0f},
-        {0x0000a39c, 0x0075393f},
-        {0x0000a3a0, 0xb79f6427},
-        {0x0000a3c0, 0x20202020},
-        {0x0000a3c4, 0x22222220},
-        {0x0000a3c8, 0x20200020},
-        {0x0000a3cc, 0x20202020},
-        {0x0000a3d0, 0x20202020},
-        {0x0000a3d4, 0x20202020},
-        {0x0000a3d8, 0x20202020},
-        {0x0000a3dc, 0x20202020},
-        {0x0000a3e0, 0x20202020},
-        {0x0000a3e4, 0x20202020},
-        {0x0000a3e8, 0x20202020},
-        {0x0000a3ec, 0x20202020},
-        {0x0000a3f0, 0x00000000},
-        {0x0000a3f4, 0x00000006},
-        {0x0000a3f8, 0x0c9bd380},
-        {0x0000a3fc, 0x000f0f01},
-        {0x0000a400, 0x8fa91f01},
-        {0x0000a404, 0x00000000},
-        {0x0000a408, 0x0e79e5c6},
-        {0x0000a40c, 0x00820820},
-        {0x0000a414, 0x1ce739ce},
-        {0x0000a418, 0x2d001dce},
-        {0x0000a434, 0x00000000},
-        {0x0000a438, 0x00001801},
-        {0x0000a43c, 0x00100000},
-        {0x0000a444, 0x00000000},
-        {0x0000a448, 0x05000080},
-        {0x0000a44c, 0x00000001},
-        {0x0000a450, 0x00010000},
-        {0x0000a454, 0x07000000},
-        {0x0000a644, 0xbfad9d74},
-        {0x0000a648, 0x0048060a},
-        {0x0000a64c, 0x00002037},
-        {0x0000a670, 0x03020100},
-        {0x0000a674, 0x09080504},
-        {0x0000a678, 0x0d0c0b0a},
-        {0x0000a67c, 0x13121110},
-        {0x0000a680, 0x31301514},
-        {0x0000a684, 0x35343332},
-        {0x0000a688, 0x00000036},
-        {0x0000a690, 0x00000838},
-        {0x0000a6b0, 0x0000000a},
-        {0x0000a6b4, 0x00512c01},
-        {0x0000a7c0, 0x00000000},
-        {0x0000a7c4, 0xfffffffc},
-        {0x0000a7c8, 0x00000000},
-        {0x0000a7cc, 0x00000000},
-        {0x0000a7d0, 0x00000000},
-        {0x0000a7d4, 0x00000004},
-        {0x0000a7dc, 0x00000000},
-        {0x0000a7f0, 0x80000000},
-        {0x0000a8d0, 0x004b6a8e},
-        {0x0000a8d4, 0x00000820},
-        {0x0000a8dc, 0x00000000},
-        {0x0000a8f0, 0x00000000},
-        {0x0000a8f4, 0x00000000},
-        {0x0000abf0, 0x80000000},
-        {0x0000b2d0, 0x00000080},
-        {0x0000b2d4, 0x00000000},
-        {0x0000b2ec, 0x00000000},
-        {0x0000b2f0, 0x00000000},
-        {0x0000b2f4, 0x00000000},
-        {0x0000b2f8, 0x00000000},
-        {0x0000b408, 0x0e79e5c0},
-        {0x0000b40c, 0x00820820},
-        {0x0000b420, 0x00000000},
-        {0x0000b6b0, 0x0000000a},
-        {0x0000b6b4, 0x00000001},
-};
-
 static const u32 ar9462_2p1_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a800d},
@@ -404,72 +280,6 @@ static const u32 ar9462_2p1_baseband_postamble[][5] = {
         {0x0000b284, 0x00000000, 0x00000000, 0x00000550, 0x00000550},
 };
 
-static const u32 ar9462_2p1_radio_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00016000, 0x36db6db6},
-        {0x00016004, 0x6db6db40},
-        {0x00016008, 0x73f00000},
-        {0x0001600c, 0x00000000},
-        {0x00016010, 0x6d820001},
-        {0x00016040, 0x7f80fff8},
-        {0x0001604c, 0x2699e04f},
-        {0x00016050, 0x6db6db6c},
-        {0x00016058, 0x6c200000},
-        {0x00016080, 0x000c0000},
-        {0x00016084, 0x9a68048c},
-        {0x00016088, 0x54214514},
-        {0x0001608c, 0x1203040b},
-        {0x00016090, 0x24926490},
-        {0x00016098, 0xd2888888},
-        {0x000160a0, 0x0a108ffe},
-        {0x000160a4, 0x812fc491},
-        {0x000160a8, 0x423c8000},
-        {0x000160b4, 0x92000000},
-        {0x000160b8, 0x0285dddc},
-        {0x000160bc, 0x02908888},
-        {0x000160c0, 0x00adb6d0},
-        {0x000160c4, 0x6db6db60},
-        {0x000160c8, 0x6db6db6c},
-        {0x000160cc, 0x0de6c1b0},
-        {0x00016100, 0x3fffbe04},
-        {0x00016104, 0xfff80000},
-        {0x00016108, 0x00200400},
-        {0x00016110, 0x00000000},
-        {0x00016144, 0x02084080},
-        {0x00016148, 0x000080c0},
-        {0x00016280, 0x050a0001},
-        {0x00016284, 0x3d841418},
-        {0x00016288, 0x00000000},
-        {0x0001628c, 0xe3000000},
-        {0x00016290, 0xa1005080},
-        {0x00016294, 0x00000020},
-        {0x00016298, 0x54a82900},
-        {0x00016340, 0x121e4276},
-        {0x00016344, 0x00300000},
-        {0x00016400, 0x36db6db6},
-        {0x00016404, 0x6db6db40},
-        {0x00016408, 0x73f00000},
-        {0x0001640c, 0x00000000},
-        {0x00016410, 0x6c800001},
-        {0x00016440, 0x7f80fff8},
-        {0x0001644c, 0x4699e04f},
-        {0x00016450, 0x6db6db6c},
-        {0x00016500, 0x3fffbe04},
-        {0x00016504, 0xfff80000},
-        {0x00016508, 0x00200400},
-        {0x00016510, 0x00000000},
-        {0x00016544, 0x02084080},
-        {0x00016548, 0x000080c0},
-};
-
-static const u32 ar9462_2p1_radio_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0001609c, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524},
-        {0x000160b0, 0x01d67f70, 0x01d67f70, 0x01d67f70, 0x01d67f70},
-        {0x0001610c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
-        {0x0001650c, 0x48000000, 0x40000000, 0x40000000, 0x40000000},
-};
-
 static const u32 ar9462_2p1_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x000040a4, 0x00a0c9c9},
@@ -478,1297 +288,4 @@ static const u32 ar9462_2p1_soc_preamble[][2] = {
         {0x00007038, 0x000004c2},
 };
 
-static const u32 ar9462_2p1_soc_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00007010, 0x00000033, 0x00000033, 0x00000033, 0x00000033},
-};
-
-static const u32 ar9462_2p1_radio_postamble_sys2ant[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x000160ac, 0xa4646c08, 0xa4646c08, 0x24645808, 0x24645808},
-        {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-        {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-};
-
-static const u32 ar9462_2p1_common_rx_gain[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x01910190},
-        {0x0000a030, 0x01930192},
-        {0x0000a034, 0x01950194},
-        {0x0000a038, 0x038a0196},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x22222229},
-        {0x0000a084, 0x1d1d1d1d},
-        {0x0000a088, 0x1d1d1d1d},
-        {0x0000a08c, 0x1d1d1d1d},
-        {0x0000a090, 0x171d1d1d},
-        {0x0000a094, 0x11111717},
-        {0x0000a098, 0x00030311},
-        {0x0000a09c, 0x00000000},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x2a2d2f32},
-        {0x0000b084, 0x21232328},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9462_2p1_common_mixed_rx_gain[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x2a2d2f32},
-        {0x0000b084, 0x21232328},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9462_2p1_baseband_core_mix_rxgain[][2] = {
-        /* Addr      allmodes  */
-        {0x00009fd0, 0x0a2d6b93},
-};
-
-static const u32 ar9462_2p1_baseband_postamble_mix_rxgain[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009820, 0x206a022e, 0x206a022e, 0x206a01ae, 0x206a01ae},
-        {0x00009824, 0x63c640de, 0x5ac640d0, 0x63c640da, 0x63c640da},
-        {0x00009828, 0x0796be89, 0x0696b081, 0x0916be81, 0x0916be81},
-        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000d8, 0x6c4000d8},
-        {0x00009e10, 0x92c88d2e, 0x7ec88d2e, 0x7ec86d2e, 0x7ec86d2e},
-        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3236605e, 0x32395c5e},
-};
-
-static const u32 ar9462_2p1_baseband_postamble_5g_xlna[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00009e3c, 0xcf946220, 0xcf946220, 0xcfd5c782, 0xcfd5c282},
-};
-
-static const u32 ar9462_2p1_common_wo_xlna_rx_gain[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9462_2p1_common_5g_xlna_only_rx_gain[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x2a2d2f32},
-        {0x0000b084, 0x21232328},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
-static const u32 ar9462_2p1_modes_low_ob_db_tx_gain[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
-        {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
-        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
-        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x01404000, 0x01404000, 0x01404000, 0x01404000},
-        {0x0000a618, 0x01404501, 0x01404501, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x02008802, 0x02008802, 0x02008501, 0x02008501},
-        {0x0000a620, 0x0300cc03, 0x0300cc03, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x0300cc03, 0x0300cc03, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x03810c03, 0x03810c03, 0x04015005, 0x04015005},
-        {0x0000a630, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a634, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a638, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x03810e04, 0x03810e04, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x0000f800, 0x0000f800, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x03ff0000, 0x03ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x00016044, 0x012482d4, 0x012482d4, 0x012482d4, 0x012482d4},
-        {0x00016048, 0x64992060, 0x64992060, 0x64992060, 0x64992060},
-        {0x00016054, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
-        {0x00016444, 0x012482d4, 0x012482d4, 0x012482d4, 0x012482d4},
-        {0x00016448, 0x64992000, 0x64992000, 0x64992000, 0x64992000},
-        {0x00016454, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
-};
-
-static const u32 ar9462_2p1_modes_high_ob_db_tx_gain[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
-        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x000050da, 0x000050da, 0x000050de, 0x000050de},
-        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x18022622, 0x18022622, 0x11000400, 0x11000400},
-        {0x0000a518, 0x1b022822, 0x1b022822, 0x15000402, 0x15000402},
-        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
-        {0x0000a520, 0x22022c41, 0x22022c41, 0x1b000603, 0x1b000603},
-        {0x0000a524, 0x28023042, 0x28023042, 0x1f000a02, 0x1f000a02},
-        {0x0000a528, 0x2c023044, 0x2c023044, 0x23000a04, 0x23000a04},
-        {0x0000a52c, 0x2f023644, 0x2f023644, 0x26000a20, 0x26000a20},
-        {0x0000a530, 0x34025643, 0x34025643, 0x2a000e20, 0x2a000e20},
-        {0x0000a534, 0x38025a44, 0x38025a44, 0x2e000e22, 0x2e000e22},
-        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x31000e24, 0x31000e24},
-        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x34001640, 0x34001640},
-        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x38001660, 0x38001660},
-        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3b001861, 0x3b001861},
-        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x3e001a81, 0x3e001a81},
-        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x42001a83, 0x42001a83},
-        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x44001a84, 0x44001a84},
-        {0x0000a554, 0x62025f56, 0x62025f56, 0x48001ce3, 0x48001ce3},
-        {0x0000a558, 0x66027f56, 0x66027f56, 0x4c001ce5, 0x4c001ce5},
-        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x50001ce9, 0x50001ce9},
-        {0x0000a560, 0x70049f56, 0x70049f56, 0x54001ceb, 0x54001ceb},
-        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x56001eec, 0x56001eec},
-        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x58001ef0, 0x58001ef0},
-        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x5a001ef4, 0x5a001ef4},
-        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
-        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
-        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
-        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x5c001ff6, 0x5c001ff6},
-        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
-        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
-        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x00016044, 0x056d82e4, 0x056d82e4, 0x056d82e4, 0x056d82e4},
-        {0x00016048, 0x8db49060, 0x8db49060, 0x8db49060, 0x8db49060},
-        {0x00016054, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
-        {0x00016444, 0x056d82e4, 0x056d82e4, 0x056d82e4, 0x056d82e4},
-        {0x00016448, 0x8db49000, 0x8db49000, 0x8db49000, 0x8db49000},
-        {0x00016454, 0x6db60000, 0x6db60000, 0x6db60000, 0x6db60000},
-};
-
-static const u32 ar9462_2p1_modes_mix_ob_db_tx_gain[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
-        {0x0000a2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
-        {0x0000a2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
-        {0x0000a2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-        {0x0000a410, 0x0000d0da, 0x0000d0da, 0x0000d0de, 0x0000d0de},
-        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a500, 0x00002220, 0x00002220, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06002223, 0x06002223, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a022220, 0x0a022220, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x0f022223, 0x0f022223, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x14022620, 0x14022620, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x18022622, 0x18022622, 0x12000400, 0x12000400},
-        {0x0000a518, 0x1b022822, 0x1b022822, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x20022842, 0x20022842, 0x19000404, 0x19000404},
-        {0x0000a520, 0x22022c41, 0x22022c41, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x28023042, 0x28023042, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x2c023044, 0x2c023044, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x2f023644, 0x2f023644, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x34025643, 0x34025643, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x38025a44, 0x38025a44, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x3b025e45, 0x3b025e45, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x41025e4a, 0x41025e4a, 0x38001640, 0x38001640},
-        {0x0000a540, 0x48025e6c, 0x48025e6c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x4e025e8e, 0x4e025e8e, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x55025eb3, 0x55025eb3, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x58025ef3, 0x58025ef3, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x5d025ef6, 0x5d025ef6, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x62025f56, 0x62025f56, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x66027f56, 0x66027f56, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x6a029f56, 0x6a029f56, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x70049f56, 0x70049f56, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x751ffff6, 0x751ffff6, 0x5c001eec, 0x5c001eec},
-        {0x0000a568, 0x751ffff6, 0x751ffff6, 0x5e001ef0, 0x5e001ef0},
-        {0x0000a56c, 0x751ffff6, 0x751ffff6, 0x60001ef4, 0x60001ef4},
-        {0x0000a570, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
-        {0x0000a574, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
-        {0x0000a578, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
-        {0x0000a57c, 0x751ffff6, 0x751ffff6, 0x62001ff6, 0x62001ff6},
-        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00804000, 0x00804000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x00804201, 0x00804201, 0x01404000, 0x01404000},
-        {0x0000a618, 0x0280c802, 0x0280c802, 0x01404501, 0x01404501},
-        {0x0000a61c, 0x0280ca03, 0x0280ca03, 0x02008501, 0x02008501},
-        {0x0000a620, 0x04c15104, 0x04c15104, 0x0280ca03, 0x0280ca03},
-        {0x0000a624, 0x04c15305, 0x04c15305, 0x03010c04, 0x03010c04},
-        {0x0000a628, 0x04c15305, 0x04c15305, 0x04014c04, 0x04014c04},
-        {0x0000a62c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a630, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a634, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a638, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000a63c, 0x04c15305, 0x04c15305, 0x04015005, 0x04015005},
-        {0x0000b2dc, 0x01feee00, 0x01feee00, 0x03aaa352, 0x03aaa352},
-        {0x0000b2e0, 0x0000f000, 0x0000f000, 0x03ccc584, 0x03ccc584},
-        {0x0000b2e4, 0x01ff0000, 0x01ff0000, 0x03f0f800, 0x03f0f800},
-        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
-};
-
-static const u32 ar9462_2p1_modes_fast_clock[][3] = {
-        /* Addr      5G_HT20     5G_HT40   */
-        {0x00001030, 0x00000268, 0x000004d0},
-        {0x00001070, 0x0000018c, 0x00000318},
-        {0x000010b0, 0x00000fd0, 0x00001fa0},
-        {0x00008014, 0x044c044c, 0x08980898},
-        {0x0000801c, 0x148ec02b, 0x148ec057},
-        {0x00008318, 0x000044c0, 0x00008980},
-        {0x00009e00, 0x0372131c, 0x0372131c},
-        {0x0000a230, 0x0000400b, 0x00004016},
-        {0x0000a254, 0x00000898, 0x00001130},
-};
-
-static const u32 ar9462_2p1_baseband_core_txfir_coeff_japan_2484[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x6f7f0301},
-        {0x0000a3a0, 0xca9228ee},
-};
-
 #endif /* INITVALS_9462_2P1_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
index 7c1845221e1c..ce83ce47a1ca 100644
--- a/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9485_initvals.h
@@ -20,17 +20,11 @@
 
 /* AR9485 1.1 */
 
-static const u32 ar9485_1_1_mac_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
-        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
-        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
-        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
-        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
-        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
-        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
-};
+#define ar9485_modes_lowest_ob_db_tx_gain_1_1 ar9485Modes_low_ob_db_tx_gain_1_1
+
+#define ar9485_1_1_mac_postamble ar9331_1p1_mac_postamble
+
+#define ar9485_1_1_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
 
 static const u32 ar9485Common_wo_xlna_rx_gain_1_1[][2] = {
         /* Addr      allmodes  */
@@ -546,100 +540,6 @@ static const u32 ar9485Modes_low_ob_db_tx_gain_1_1[][5] = {
         {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
 };
 
-static const u32 ar9485_modes_lowest_ob_db_tx_gain_1_1[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x000098bc, 0x00000002, 0x00000002, 0x00000002, 0x00000002},
-        {0x0000a2d8, 0xf999a83a, 0xf999a83a, 0x7999a83a, 0x7999a83a},
-        {0x0000a2dc, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a2e0, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a2e4, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a2e8, 0x00000000, 0x00000000, 0xfe2d3552, 0xfe2d3552},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d8, 0x000050d8},
-        {0x0000a458, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a500, 0x00022200, 0x00022200, 0x00000000, 0x00000000},
-        {0x0000a504, 0x05062002, 0x05062002, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0c002e00, 0x0c002e00, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x11062202, 0x11062202, 0x0d000200, 0x0d000200},
-        {0x0000a510, 0x17022e00, 0x17022e00, 0x11000202, 0x11000202},
-        {0x0000a514, 0x1d000ec2, 0x1d000ec2, 0x15000400, 0x15000400},
-        {0x0000a518, 0x25020ec0, 0x25020ec0, 0x19000402, 0x19000402},
-        {0x0000a51c, 0x2b020ec3, 0x2b020ec3, 0x1d000404, 0x1d000404},
-        {0x0000a520, 0x2f001f04, 0x2f001f04, 0x21000603, 0x21000603},
-        {0x0000a524, 0x35001fc4, 0x35001fc4, 0x25000605, 0x25000605},
-        {0x0000a528, 0x3c022f04, 0x3c022f04, 0x2a000a03, 0x2a000a03},
-        {0x0000a52c, 0x41023e85, 0x41023e85, 0x2c000a04, 0x2c000a04},
-        {0x0000a530, 0x48023ec6, 0x48023ec6, 0x34000e20, 0x34000e20},
-        {0x0000a534, 0x4d023f01, 0x4d023f01, 0x35000e21, 0x35000e21},
-        {0x0000a538, 0x53023f4b, 0x53023f4b, 0x43000e62, 0x43000e62},
-        {0x0000a53c, 0x5a027f09, 0x5a027f09, 0x45000e63, 0x45000e63},
-        {0x0000a540, 0x5f027fc9, 0x5f027fc9, 0x49000e65, 0x49000e65},
-        {0x0000a544, 0x6502feca, 0x6502feca, 0x4b000e66, 0x4b000e66},
-        {0x0000a548, 0x6b02ff4a, 0x6b02ff4a, 0x4d001645, 0x4d001645},
-        {0x0000a54c, 0x7203feca, 0x7203feca, 0x51001865, 0x51001865},
-        {0x0000a550, 0x7703ff0b, 0x7703ff0b, 0x55001a86, 0x55001a86},
-        {0x0000a554, 0x7d06ffcb, 0x7d06ffcb, 0x57001ce9, 0x57001ce9},
-        {0x0000a558, 0x8407ff0b, 0x8407ff0b, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a55c, 0x8907ffcb, 0x8907ffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a560, 0x900fff0b, 0x900fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a564, 0x960fffcb, 0x960fffcb, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a568, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a56c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a570, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a574, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a578, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a57c, 0x9c1fff0b, 0x9c1fff0b, 0x5e001eeb, 0x5e001eeb},
-        {0x0000a580, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a584, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a588, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a58c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a590, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a594, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a598, 0x00000000, 0x00000000, 0x01404501, 0x01404501},
-        {0x0000a59c, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
-        {0x0000a5a0, 0x00000000, 0x00000000, 0x02808a02, 0x02808a02},
-        {0x0000a5a4, 0x00000000, 0x00000000, 0x02808803, 0x02808803},
-        {0x0000a5a8, 0x00000000, 0x00000000, 0x04c14b04, 0x04c14b04},
-        {0x0000a5ac, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
-        {0x0000a5b0, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
-        {0x0000a5b4, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
-        {0x0000a5b8, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
-        {0x0000a5bc, 0x00000000, 0x00000000, 0x04c15305, 0x04c15305},
-        {0x0000b500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b504, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b508, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b50c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b510, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b514, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b518, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b51c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b520, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b524, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b528, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b52c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b530, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b534, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b538, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b53c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b540, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b544, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b548, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b54c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b550, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b554, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b558, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b55c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b560, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b564, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b568, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b56c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b570, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b574, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b578, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000b57c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016044, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db, 0x05d6b2db},
-        {0x00016048, 0x6c924260, 0x6c924260, 0x6c924260, 0x6c924260},
-};
-
 static const u32 ar9485Modes_green_spur_ob_db_tx_gain_1_1[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x000098bc, 0x00000003, 0x00000003, 0x00000003, 0x00000003},
@@ -1323,13 +1223,6 @@ static const u32 ar9485_1_1_mac_core[][2] = {
         {0x000083d0, 0x000301ff},
 };
 
-static const u32 ar9485_1_1_baseband_core_txfir_coeff_japan_2484[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x6f7f0301},
-        {0x0000a3a0, 0xca9228ee},
-};
-
 static const u32 ar9485_1_1_pcie_phy_clkreq_disable_L1[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18013e5e},
diff --git a/drivers/net/wireless/ath/ath9k/ar953x_initvals.h b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
new file mode 100644
index 000000000000..3c9113d9b1bc
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar953x_initvals.h
@@ -0,0 +1,718 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_953X_H
+#define INITVALS_953X_H
+
+#define qca953x_1p0_mac_postamble ar9300_2p2_mac_postamble
+
+#define qca953x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define qca953x_1p0_common_rx_gain_table ar9300Common_rx_gain_table_2p2
+
+#define qca953x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define qca953x_1p0_modes_fast_clock ar9300Modes_fast_clock_2p2
+
+static const u32 qca953x_1p0_mac_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00000008, 0x00000000},
+        {0x00000030, 0x00020085},
+        {0x00000034, 0x00000005},
+        {0x00000040, 0x00000000},
+        {0x00000044, 0x00000000},
+        {0x00000048, 0x00000008},
+        {0x0000004c, 0x00000010},
+        {0x00000050, 0x00000000},
+        {0x00001040, 0x002ffc0f},
+        {0x00001044, 0x002ffc0f},
+        {0x00001048, 0x002ffc0f},
+        {0x0000104c, 0x002ffc0f},
+        {0x00001050, 0x002ffc0f},
+        {0x00001054, 0x002ffc0f},
+        {0x00001058, 0x002ffc0f},
+        {0x0000105c, 0x002ffc0f},
+        {0x00001060, 0x002ffc0f},
+        {0x00001064, 0x002ffc0f},
+        {0x000010f0, 0x00000100},
+        {0x00001270, 0x00000000},
+        {0x000012b0, 0x00000000},
+        {0x000012f0, 0x00000000},
+        {0x0000143c, 0x00000000},
+        {0x0000147c, 0x00000000},
+        {0x00008000, 0x00000000},
+        {0x00008004, 0x00000000},
+        {0x00008008, 0x00000000},
+        {0x0000800c, 0x00000000},
+        {0x00008018, 0x00000000},
+        {0x00008020, 0x00000000},
+        {0x00008038, 0x00000000},
+        {0x0000803c, 0x00000000},
+        {0x00008040, 0x00000000},
+        {0x00008044, 0x00000000},
+        {0x00008048, 0x00000000},
+        {0x0000804c, 0xffffffff},
+        {0x00008054, 0x00000000},
+        {0x00008058, 0x00000000},
+        {0x0000805c, 0x000fc78f},
+        {0x00008060, 0x0000000f},
+        {0x00008064, 0x00000000},
+        {0x00008070, 0x00000310},
+        {0x00008074, 0x00000020},
+        {0x00008078, 0x00000000},
+        {0x0000809c, 0x0000000f},
+        {0x000080a0, 0x00000000},
+        {0x000080a4, 0x02ff0000},
+        {0x000080a8, 0x0e070605},
+        {0x000080ac, 0x0000000d},
+        {0x000080b0, 0x00000000},
+        {0x000080b4, 0x00000000},
+        {0x000080b8, 0x00000000},
+        {0x000080bc, 0x00000000},
+        {0x000080c0, 0x2a800000},
+        {0x000080c4, 0x06900168},
+        {0x000080c8, 0x13881c22},
+        {0x000080cc, 0x01f40000},
+        {0x000080d0, 0x00252500},
+        {0x000080d4, 0x00a00000},
+        {0x000080d8, 0x00400000},
+        {0x000080dc, 0x00000000},
+        {0x000080e0, 0xffffffff},
+        {0x000080e4, 0x0000ffff},
+        {0x000080e8, 0x3f3f3f3f},
+        {0x000080ec, 0x00000000},
+        {0x000080f0, 0x00000000},
+        {0x000080f4, 0x00000000},
+        {0x000080fc, 0x00020000},
+        {0x00008100, 0x00000000},
+        {0x00008108, 0x00000052},
+        {0x0000810c, 0x00000000},
+        {0x00008110, 0x00000000},
+        {0x00008114, 0x000007ff},
+        {0x00008118, 0x000000aa},
+        {0x0000811c, 0x00003210},
+        {0x00008124, 0x00000000},
+        {0x00008128, 0x00000000},
+        {0x0000812c, 0x00000000},
+        {0x00008130, 0x00000000},
+        {0x00008134, 0x00000000},
+        {0x00008138, 0x00000000},
+        {0x0000813c, 0x0000ffff},
+        {0x00008140, 0x000000fe},
+        {0x00008144, 0xffffffff},
+        {0x00008168, 0x00000000},
+        {0x0000816c, 0x00000000},
+        {0x000081c0, 0x00000000},
+        {0x000081c4, 0x33332210},
+        {0x000081ec, 0x00000000},
+        {0x000081f0, 0x00000000},
+        {0x000081f4, 0x00000000},
+        {0x000081f8, 0x00000000},
+        {0x000081fc, 0x00000000},
+        {0x00008240, 0x00100000},
+        {0x00008244, 0x0010f3d7},
+        {0x00008248, 0x00000852},
+        {0x0000824c, 0x0001e7ae},
+        {0x00008250, 0x00000000},
+        {0x00008254, 0x00000000},
+        {0x00008258, 0x00000000},
+        {0x0000825c, 0x40000000},
+        {0x00008260, 0x00080922},
+        {0x00008264, 0x9d400010},
+        {0x00008268, 0xffffffff},
+        {0x0000826c, 0x0000ffff},
+        {0x00008270, 0x00000000},
+        {0x00008274, 0x40000000},
+        {0x00008278, 0x003e4180},
+        {0x0000827c, 0x00000004},
+        {0x00008284, 0x0000002c},
+        {0x00008288, 0x0000002c},
+        {0x0000828c, 0x000000ff},
+        {0x00008294, 0x00000000},
+        {0x00008298, 0x00000000},
+        {0x0000829c, 0x00000000},
+        {0x00008300, 0x00001d40},
+        {0x00008314, 0x00000000},
+        {0x0000831c, 0x0000010d},
+        {0x00008328, 0x00000000},
+        {0x0000832c, 0x0000001f},
+        {0x00008330, 0x00000302},
+        {0x00008334, 0x00000700},
+        {0x00008338, 0xffff0000},
+        {0x0000833c, 0x02400000},
+        {0x00008340, 0x000107ff},
+        {0x00008344, 0xaa48107b},
+        {0x00008348, 0x008f0000},
+        {0x0000835c, 0x00000000},
+        {0x00008360, 0xffffffff},
+        {0x00008364, 0xffffffff},
+        {0x00008368, 0x00000000},
+        {0x00008370, 0x00000000},
+        {0x00008374, 0x000000ff},
+        {0x00008378, 0x00000000},
+        {0x0000837c, 0x00000000},
+        {0x00008380, 0xffffffff},
+        {0x00008384, 0xffffffff},
+        {0x00008390, 0xffffffff},
+        {0x00008394, 0xffffffff},
+        {0x00008398, 0x00000000},
+        {0x0000839c, 0x00000000},
+        {0x000083a0, 0x00000000},
+        {0x000083a4, 0x0000fa14},
+        {0x000083a8, 0x000f0c00},
+        {0x000083ac, 0x33332210},
+        {0x000083b0, 0x33332210},
+        {0x000083b4, 0x33332210},
+        {0x000083b8, 0x33332210},
+        {0x000083bc, 0x00000000},
+        {0x000083c0, 0x00000000},
+        {0x000083c4, 0x00000000},
+        {0x000083c8, 0x00000000},
+        {0x000083cc, 0x00000200},
+        {0x000083d0, 0x8c7901ff},
+};
+
+static const u32 qca953x_1p0_baseband_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00009800, 0xafe68e30},
+        {0x00009804, 0xfd14e000},
+        {0x00009808, 0x9c0a9f6b},
+        {0x0000980c, 0x04900000},
+        {0x00009814, 0x0280c00a},
+        {0x00009818, 0x00000000},
+        {0x0000981c, 0x00020028},
+        {0x00009834, 0x6400a190},
+        {0x00009838, 0x0108ecff},
+        {0x0000983c, 0x14000600},
+        {0x00009880, 0x201fff00},
+        {0x00009884, 0x00001042},
+        {0x000098a4, 0x00200400},
+        {0x000098b0, 0x32840bbe},
+        {0x000098bc, 0x00000002},
+        {0x000098d0, 0x004b6a8e},
+        {0x000098d4, 0x00000820},
+        {0x000098dc, 0x00000000},
+        {0x000098f0, 0x00000000},
+        {0x000098f4, 0x00000000},
+        {0x00009c04, 0xff55ff55},
+        {0x00009c08, 0x0320ff55},
+        {0x00009c0c, 0x00000000},
+        {0x00009c10, 0x00000000},
+        {0x00009c14, 0x00046384},
+        {0x00009c18, 0x05b6b440},
+        {0x00009c1c, 0x00b6b440},
+        {0x00009d00, 0xc080a333},
+        {0x00009d04, 0x40206c10},
+        {0x00009d08, 0x009c4060},
+        {0x00009d0c, 0x9883800a},
+        {0x00009d10, 0x01884061},
+        {0x00009d14, 0x00c0040b},
+        {0x00009d18, 0x00000000},
+        {0x00009e08, 0x0038230c},
+        {0x00009e24, 0x990bb515},
+        {0x00009e28, 0x0c6f0000},
+        {0x00009e30, 0x06336f77},
+        {0x00009e34, 0x6af6532f},
+        {0x00009e38, 0x0cc80c00},
+        {0x00009e40, 0x0d261820},
+        {0x00009e4c, 0x00001004},
+        {0x00009e50, 0x00ff03f1},
+        {0x00009fc0, 0x813e4788},
+        {0x00009fc4, 0x0001efb5},
+        {0x00009fcc, 0x40000014},
+        {0x00009fd0, 0x01193b91},
+        {0x0000a20c, 0x00000000},
+        {0x0000a220, 0x00000000},
+        {0x0000a224, 0x00000000},
+        {0x0000a228, 0x10002310},
+        {0x0000a23c, 0x00000000},
+        {0x0000a244, 0x0c000000},
+        {0x0000a248, 0x00000140},
+        {0x0000a2a0, 0x00000007},
+        {0x0000a2c0, 0x00000007},
+        {0x0000a2c8, 0x00000000},
+        {0x0000a2d4, 0x00000000},
+        {0x0000a2ec, 0x00000000},
+        {0x0000a2f0, 0x00000000},
+        {0x0000a2f4, 0x00000000},
+        {0x0000a2f8, 0x00000000},
+        {0x0000a344, 0x00000000},
+        {0x0000a34c, 0x00000000},
+        {0x0000a350, 0x0000a000},
+        {0x0000a364, 0x00000000},
+        {0x0000a370, 0x00000000},
+        {0x0000a390, 0x00000001},
+        {0x0000a394, 0x00000444},
+        {0x0000a398, 0x1f020503},
+        {0x0000a39c, 0x29180c03},
+        {0x0000a3a0, 0x9a8b6844},
+        {0x0000a3a4, 0x000000ff},
+        {0x0000a3a8, 0x6a6a6a6a},
+        {0x0000a3ac, 0x6a6a6a6a},
+        {0x0000a3b0, 0x00c8641a},
+        {0x0000a3b4, 0x0000001a},
+        {0x0000a3b8, 0x0088642a},
+        {0x0000a3bc, 0x000001fa},
+        {0x0000a3c0, 0x20202020},
+        {0x0000a3c4, 0x22222220},
+        {0x0000a3c8, 0x20200020},
+        {0x0000a3cc, 0x20202020},
+        {0x0000a3d0, 0x20202020},
+        {0x0000a3d4, 0x20202020},
+        {0x0000a3d8, 0x20202020},
+        {0x0000a3dc, 0x20202020},
+        {0x0000a3e0, 0x20202020},
+        {0x0000a3e4, 0x20202020},
+        {0x0000a3e8, 0x20202020},
+        {0x0000a3ec, 0x20202020},
+        {0x0000a3f0, 0x00000000},
+        {0x0000a3f4, 0x00000000},
+        {0x0000a3f8, 0x0c9bd380},
+        {0x0000a3fc, 0x000f0f01},
+        {0x0000a400, 0x8fa91f01},
+        {0x0000a404, 0x00000000},
+        {0x0000a408, 0x0e79e5c6},
+        {0x0000a40c, 0x00820820},
+        {0x0000a414, 0x1ce42108},
+        {0x0000a418, 0x2d001dce},
+        {0x0000a41c, 0x1ce73908},
+        {0x0000a420, 0x000001ce},
+        {0x0000a424, 0x1ce738e7},
+        {0x0000a428, 0x000001ce},
+        {0x0000a42c, 0x1ce739ce},
+        {0x0000a430, 0x1ce739ce},
+        {0x0000a434, 0x00000000},
+        {0x0000a438, 0x00001801},
+        {0x0000a43c, 0x00100000},
+        {0x0000a444, 0x00000000},
+        {0x0000a448, 0x05000080},
+        {0x0000a44c, 0x00000001},
+        {0x0000a450, 0x00010000},
+        {0x0000a458, 0x00000000},
+        {0x0000a644, 0xbfad9d74},
+        {0x0000a648, 0x0048060a},
+        {0x0000a64c, 0x00003c37},
+        {0x0000a670, 0x03020100},
+        {0x0000a674, 0x09080504},
+        {0x0000a678, 0x0d0c0b0a},
+        {0x0000a67c, 0x13121110},
+        {0x0000a680, 0x31301514},
+        {0x0000a684, 0x35343332},
+        {0x0000a688, 0x00000036},
+        {0x0000a690, 0x08000838},
+        {0x0000a7cc, 0x00000000},
+        {0x0000a7d0, 0x00000000},
+        {0x0000a7d4, 0x00000004},
+        {0x0000a7dc, 0x00000000},
+        {0x0000a8d0, 0x004b6a8e},
+        {0x0000a8d4, 0x00000820},
+        {0x0000a8dc, 0x00000000},
+        {0x0000a8f0, 0x00000000},
+        {0x0000a8f4, 0x00000000},
+        {0x0000b2d0, 0x00000080},
+        {0x0000b2d4, 0x00000000},
+        {0x0000b2ec, 0x00000000},
+        {0x0000b2f0, 0x00000000},
+        {0x0000b2f4, 0x00000000},
+        {0x0000b2f8, 0x00000000},
+        {0x0000b408, 0x0e79e5c0},
+        {0x0000b40c, 0x00820820},
+        {0x0000b420, 0x00000000},
+};
+
+static const u32 qca953x_1p0_baseband_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
+        {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
+        {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
+        {0x0000982c, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4, 0x05eea6d4},
+        {0x00009830, 0x0000059c, 0x0000059c, 0x0000119c, 0x0000119c},
+        {0x00009c00, 0x000000c4, 0x000000c4, 0x000000c4, 0x000000c4},
+        {0x00009e00, 0x0372111a, 0x0372111a, 0x037216a0, 0x037216a0},
+        {0x00009e04, 0x001c2020, 0x001c2020, 0x001c2020, 0x001c2020},
+        {0x00009e0c, 0x6c4000e2, 0x6d4000e2, 0x6d4000e2, 0x6c4000e2},
+        {0x00009e10, 0x7ec88d2e, 0x7ec88d2e, 0x7ec84d2e, 0x7ec84d2e},
+        {0x00009e14, 0x37b95d5e, 0x37b9605e, 0x3379605e, 0x33795d5e},
+        {0x00009e18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x00009e1c, 0x0001cf9c, 0x0001cf9c, 0x00021f9c, 0x00021f9c},
+        {0x00009e20, 0x000003b5, 0x000003b5, 0x000003ce, 0x000003ce},
+        {0x00009e2c, 0x0000001c, 0x0000001c, 0x00000021, 0x00000021},
+        {0x00009e3c, 0xcfa10820, 0xcfa10820, 0xcfa10822, 0xcfa10822},
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+        {0x00009fc8, 0x0003f000, 0x0003f000, 0x0001a000, 0x0001a000},
+        {0x0000a204, 0x005c0ec0, 0x005c0ec4, 0x005c0ec4, 0x005c0ec0},
+        {0x0000a208, 0x00000104, 0x00000104, 0x00000004, 0x00000004},
+        {0x0000a22c, 0x07e26a2f, 0x07e26a2f, 0x01026a2f, 0x01026a2f},
+        {0x0000a230, 0x0000000a, 0x00000014, 0x00000016, 0x0000000b},
+        {0x0000a234, 0x00000fff, 0x10000fff, 0x10000fff, 0x00000fff},
+        {0x0000a238, 0xffb01018, 0xffb01018, 0xffb01018, 0xffb01018},
+        {0x0000a250, 0x00000000, 0x00000000, 0x00000210, 0x00000108},
+        {0x0000a254, 0x000007d0, 0x00000fa0, 0x00001130, 0x00000898},
+        {0x0000a258, 0x02020002, 0x02020002, 0x02020002, 0x02020002},
+        {0x0000a25c, 0x01000e0e, 0x01000e0e, 0x01010e0e, 0x01010e0e},
+        {0x0000a260, 0x0a021501, 0x0a021501, 0x3a021501, 0x3a021501},
+        {0x0000a264, 0x00000e0e, 0x00000e0e, 0x01000e0e, 0x01000e0e},
+        {0x0000a280, 0x00000007, 0x00000007, 0x0000000b, 0x0000000b},
+        {0x0000a284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+        {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
+        {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
+        {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
+        {0x0000a2cc, 0x18c50033, 0x18c43433, 0x18c41033, 0x18c44c33},
+        {0x0000a2d0, 0x00041982, 0x00041982, 0x00041982, 0x00041982},
+        {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
+        {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae04, 0x001c0000, 0x001c0000, 0x001c0000, 0x001c0000},
+        {0x0000ae18, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000ae1c, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
+        {0x0000ae20, 0x000001b5, 0x000001b5, 0x000001ce, 0x000001ce},
+        {0x0000b284, 0x00000000, 0x00000000, 0x00000010, 0x00000010},
+};
+
+static const u32 qca953x_1p0_radio_core[][2] = {
+        /* Addr      allmodes  */
+        {0x00016000, 0x36db6db6},
+        {0x00016004, 0x6db6db40},
+        {0x00016008, 0x73f00000},
+        {0x0001600c, 0x00000000},
+        {0x00016040, 0x3f80fff8},
+        {0x0001604c, 0x000f0278},
+        {0x00016050, 0x8036db6c},
+        {0x00016054, 0x6db60000},
+        {0x00016080, 0x00080000},
+        {0x00016084, 0x0e48048c},
+        {0x00016088, 0x14214514},
+        {0x0001608c, 0x119f080a},
+        {0x00016090, 0x24926490},
+        {0x00016094, 0x00000000},
+        {0x000160a0, 0xc2108ffe},
+        {0x000160a4, 0x812fc370},
+        {0x000160a8, 0x423c8000},
+        {0x000160b4, 0x92480080},
+        {0x000160c0, 0x006db6d8},
+        {0x000160c4, 0x24b6db6c},
+        {0x000160c8, 0x6db6db6c},
+        {0x000160cc, 0x6db6fb7c},
+        {0x000160d0, 0x6db6da44},
+        {0x00016100, 0x07ff8001},
+        {0x00016108, 0x00080010},
+        {0x00016144, 0x01884080},
+        {0x00016148, 0x000080d8},
+        {0x00016280, 0x01000901},
+        {0x00016284, 0x15d30000},
+        {0x00016288, 0x00318000},
+        {0x0001628c, 0x50000000},
+        {0x00016380, 0x00000000},
+        {0x00016384, 0x00000000},
+        {0x00016388, 0x00800700},
+        {0x0001638c, 0x00800700},
+        {0x00016390, 0x00800700},
+        {0x00016394, 0x00000000},
+        {0x00016398, 0x00000000},
+        {0x0001639c, 0x00000000},
+        {0x000163a0, 0x00000001},
+        {0x000163a4, 0x00000001},
+        {0x000163a8, 0x00000000},
+        {0x000163ac, 0x00000000},
+        {0x000163b0, 0x00000000},
+        {0x000163b4, 0x00000000},
+        {0x000163b8, 0x00000000},
+        {0x000163bc, 0x00000000},
+        {0x000163c0, 0x000000a0},
+        {0x000163c4, 0x000c0000},
+        {0x000163c8, 0x14021402},
+        {0x000163cc, 0x00001402},
+        {0x000163d0, 0x00000000},
+        {0x000163d4, 0x00000000},
+        {0x00016400, 0x36db6db6},
+        {0x00016404, 0x6db6db40},
+        {0x00016408, 0x73f00000},
+        {0x0001640c, 0x00000000},
+        {0x00016440, 0x3f80fff8},
+        {0x0001644c, 0x000f0278},
+        {0x00016450, 0x8036db6c},
+        {0x00016454, 0x6db60000},
+        {0x00016500, 0x07ff8001},
+        {0x00016508, 0x00080010},
+        {0x00016544, 0x01884080},
+        {0x00016548, 0x000080d8},
+        {0x00016780, 0x00000000},
+        {0x00016784, 0x00000000},
+        {0x00016788, 0x00800700},
+        {0x0001678c, 0x00800700},
+        {0x00016790, 0x00800700},
+        {0x00016794, 0x00000000},
+        {0x00016798, 0x00000000},
+        {0x0001679c, 0x00000000},
+        {0x000167a0, 0x00000001},
+        {0x000167a4, 0x00000001},
+        {0x000167a8, 0x00000000},
+        {0x000167ac, 0x00000000},
+        {0x000167b0, 0x00000000},
+        {0x000167b4, 0x00000000},
+        {0x000167b8, 0x00000000},
+        {0x000167bc, 0x00000000},
+        {0x000167c0, 0x000000a0},
+        {0x000167c4, 0x000c0000},
+        {0x000167c8, 0x14021402},
+        {0x000167cc, 0x00001402},
+        {0x000167d0, 0x00000000},
+        {0x000167d4, 0x00000000},
+};
+
+static const u32 qca953x_1p0_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xc4128f5c, 0xc4128f5c},
+        {0x0001609c, 0x0a566f3a, 0x0a566f3a, 0x0fd08f25, 0x0fd08f25},
+        {0x000160ac, 0xa4647c00, 0xa4647c00, 0x24646800, 0x24646800},
+        {0x000160b0, 0x01885f52, 0x01885f52, 0x00fe7f46, 0x00fe7f46},
+        {0x00016104, 0xb7a00001, 0xb7a00001, 0xfff80005, 0xfff80005},
+        {0x0001610c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+        {0x00016504, 0xb7a00001, 0xb7a00001, 0xfff80001, 0xfff80001},
+        {0x0001650c, 0xc0000000, 0xc0000000, 0x00000000, 0x00000000},
+        {0x00016540, 0x10804008, 0x10804008, 0x50804000, 0x50804000},
+};
+
+static const u32 qca953x_1p0_soc_preamble[][2] = {
+        /* Addr      allmodes  */
+        {0x00007000, 0x00000000},
+        {0x00007004, 0x00000000},
+        {0x00007008, 0x00000000},
+        {0x0000700c, 0x00000000},
+        {0x0000701c, 0x00000000},
+        {0x00007020, 0x00000000},
+        {0x00007024, 0x00000000},
+        {0x00007028, 0x00000000},
+        {0x0000702c, 0x00000000},
+        {0x00007030, 0x00000000},
+        {0x00007034, 0x00000002},
+        {0x00007038, 0x000004c2},
+        {0x00007048, 0x00000000},
+};
+
+static const u32 qca953x_1p0_common_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302018, 0x50302018},
+};
+
+static const u32 qca953x_1p0_common_wo_xlna_rx_gain_bounds[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x00009e44, 0xfe321e27, 0xfe321e27, 0xfe291e27, 0xfe291e27},
+        {0x00009e48, 0x5030201a, 0x5030201a, 0x50302012, 0x50302012},
+};
+
+static const u32 qca953x_1p0_modes_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xfffd5aaa},
+        {0x0000a2e0, 0xfffe9ccc},
+        {0x0000a2e4, 0xffffe0f0},
+        {0x0000a2e8, 0xfffcff00},
+        {0x0000a410, 0x000050da},
+        {0x0000a500, 0x00000000},
+        {0x0000a504, 0x04000002},
+        {0x0000a508, 0x08000004},
+        {0x0000a50c, 0x0c000006},
+        {0x0000a510, 0x0f00000a},
+        {0x0000a514, 0x1300000c},
+        {0x0000a518, 0x1700000e},
+        {0x0000a51c, 0x1b000064},
+        {0x0000a520, 0x1f000242},
+        {0x0000a524, 0x23000229},
+        {0x0000a528, 0x270002a2},
+        {0x0000a52c, 0x2c001203},
+        {0x0000a530, 0x30001803},
+        {0x0000a534, 0x33000881},
+        {0x0000a538, 0x38001809},
+        {0x0000a53c, 0x3a000814},
+        {0x0000a540, 0x3f001a0c},
+        {0x0000a544, 0x43001a0e},
+        {0x0000a548, 0x46001812},
+        {0x0000a54c, 0x49001884},
+        {0x0000a550, 0x4d001e84},
+        {0x0000a554, 0x50001e69},
+        {0x0000a558, 0x550006f4},
+        {0x0000a55c, 0x59000ad3},
+        {0x0000a560, 0x5e000ad5},
+        {0x0000a564, 0x61001ced},
+        {0x0000a568, 0x660018d4},
+        {0x0000a56c, 0x660018d4},
+        {0x0000a570, 0x660018d4},
+        {0x0000a574, 0x660018d4},
+        {0x0000a578, 0x660018d4},
+        {0x0000a57c, 0x660018d4},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x03804000},
+        {0x0000a610, 0x0300ca02},
+        {0x0000a614, 0x00000e04},
+        {0x0000a618, 0x03014000},
+        {0x0000a61c, 0x00000000},
+        {0x0000a620, 0x00000000},
+        {0x0000a624, 0x03014000},
+        {0x0000a628, 0x03804c05},
+        {0x0000a62c, 0x0701de06},
+        {0x0000a630, 0x07819c07},
+        {0x0000a634, 0x0701dc07},
+        {0x0000a638, 0x0701dc07},
+        {0x0000a63c, 0x0701dc07},
+        {0x0000b2dc, 0xfffd5aaa},
+        {0x0000b2e0, 0xfffe9ccc},
+        {0x0000b2e4, 0xffffe0f0},
+        {0x0000b2e8, 0xfffcff00},
+        {0x00016044, 0x010002d4},
+        {0x00016048, 0x66482400},
+        {0x00016280, 0x01000015},
+        {0x00016444, 0x010002d4},
+        {0x00016448, 0x66482400},
+};
+
+static const u32 qca953x_1p0_modes_no_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xffd5f552},
+        {0x0000a2e0, 0xffe60664},
+        {0x0000a2e4, 0xfff80780},
+        {0x0000a2e8, 0xfffff800},
+        {0x0000a410, 0x000050d6},
+        {0x0000a500, 0x00060020},
+        {0x0000a504, 0x04060060},
+        {0x0000a508, 0x080600a0},
+        {0x0000a50c, 0x0c068020},
+        {0x0000a510, 0x10068060},
+        {0x0000a514, 0x140680a0},
+        {0x0000a518, 0x18090040},
+        {0x0000a51c, 0x1b090080},
+        {0x0000a520, 0x1f0900c0},
+        {0x0000a524, 0x240c0041},
+        {0x0000a528, 0x280d0021},
+        {0x0000a52c, 0x2d0f0061},
+        {0x0000a530, 0x310f00a1},
+        {0x0000a534, 0x350e00a2},
+        {0x0000a538, 0x360e80a2},
+        {0x0000a53c, 0x380f00a2},
+        {0x0000a540, 0x3b0e00a3},
+        {0x0000a544, 0x3d110083},
+        {0x0000a548, 0x3e1100a3},
+        {0x0000a54c, 0x401100e3},
+        {0x0000a550, 0x421380e3},
+        {0x0000a554, 0x431780e3},
+        {0x0000a558, 0x461f80e3},
+        {0x0000a55c, 0x461f80e3},
+        {0x0000a560, 0x461f80e3},
+        {0x0000a564, 0x461f80e3},
+        {0x0000a568, 0x461f80e3},
+        {0x0000a56c, 0x461f80e3},
+        {0x0000a570, 0x461f80e3},
+        {0x0000a574, 0x461f80e3},
+        {0x0000a578, 0x461f80e3},
+        {0x0000a57c, 0x461f80e3},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00804201},
+        {0x0000a610, 0x01008201},
+        {0x0000a614, 0x0180c402},
+        {0x0000a618, 0x0180c603},
+        {0x0000a61c, 0x0180c603},
+        {0x0000a620, 0x01c10603},
+        {0x0000a624, 0x01c10704},
+        {0x0000a628, 0x02c18b05},
+        {0x0000a62c, 0x0301cc07},
+        {0x0000a630, 0x0301cc07},
+        {0x0000a634, 0x0301cc07},
+        {0x0000a638, 0x0301cc07},
+        {0x0000a63c, 0x0301cc07},
+        {0x0000b2dc, 0xffd5f552},
+        {0x0000b2e0, 0xffe60664},
+        {0x0000b2e4, 0xfff80780},
+        {0x0000b2e8, 0xfffff800},
+        {0x00016044, 0x049242db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x049242db},
+        {0x00016448, 0x6c927a70},
+};
+
+static const u32 qca953x_1p1_modes_no_xpa_tx_gain_table[][2] = {
+        /* Addr      allmodes  */
+        {0x0000a2dc, 0xffd5f552},
+        {0x0000a2e0, 0xffe60664},
+        {0x0000a2e4, 0xfff80780},
+        {0x0000a2e8, 0xfffff800},
+        {0x0000a410, 0x000050de},
+        {0x0000a500, 0x00000061},
+        {0x0000a504, 0x04000063},
+        {0x0000a508, 0x08000065},
+        {0x0000a50c, 0x0c000261},
+        {0x0000a510, 0x10000263},
+        {0x0000a514, 0x14000265},
+        {0x0000a518, 0x18000482},
+        {0x0000a51c, 0x1b000484},
+        {0x0000a520, 0x1f000486},
+        {0x0000a524, 0x240008c2},
+        {0x0000a528, 0x28000cc1},
+        {0x0000a52c, 0x2d000ce3},
+        {0x0000a530, 0x31000ce5},
+        {0x0000a534, 0x350010e5},
+        {0x0000a538, 0x360012e5},
+        {0x0000a53c, 0x380014e5},
+        {0x0000a540, 0x3b0018e5},
+        {0x0000a544, 0x3d001d04},
+        {0x0000a548, 0x3e001d05},
+        {0x0000a54c, 0x40001d07},
+        {0x0000a550, 0x42001f27},
+        {0x0000a554, 0x43001f67},
+        {0x0000a558, 0x46001fe7},
+        {0x0000a55c, 0x47001f2b},
+        {0x0000a560, 0x49001f0d},
+        {0x0000a564, 0x4b001ed2},
+        {0x0000a568, 0x4c001ed4},
+        {0x0000a56c, 0x4e001f15},
+        {0x0000a570, 0x4f001ff6},
+        {0x0000a574, 0x4f001ff6},
+        {0x0000a578, 0x4f001ff6},
+        {0x0000a57c, 0x4f001ff6},
+        {0x0000a600, 0x00000000},
+        {0x0000a604, 0x00000000},
+        {0x0000a608, 0x00000000},
+        {0x0000a60c, 0x00804201},
+        {0x0000a610, 0x01008201},
+        {0x0000a614, 0x0180c402},
+        {0x0000a618, 0x0180c603},
+        {0x0000a61c, 0x0180c603},
+        {0x0000a620, 0x01c10603},
+        {0x0000a624, 0x01c10704},
+        {0x0000a628, 0x02c18b05},
+        {0x0000a62c, 0x02c14c07},
+        {0x0000a630, 0x01008704},
+        {0x0000a634, 0x01c10402},
+        {0x0000a638, 0x0301cc07},
+        {0x0000a63c, 0x0301cc07},
+        {0x0000b2dc, 0xffd5f552},
+        {0x0000b2e0, 0xffe60664},
+        {0x0000b2e4, 0xfff80780},
+        {0x0000b2e8, 0xfffff800},
+        {0x00016044, 0x049242db},
+        {0x00016048, 0x6c927a70},
+        {0x00016444, 0x049242db},
+        {0x00016448, 0x6c927a70},
+};
+
+#endif /* INITVALS_953X_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
index ccc5b6c99add..74d8bc05b317 100644
--- a/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar955x_1p0_initvals.h
@@ -20,6 +20,14 @@
 
 /* AR955X 1.0 */
 
+#define ar955x_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define ar955x_1p0_common_rx_gain_table ar9300Common_rx_gain_table_2p2
+
+#define ar955x_1p0_common_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define ar955x_1p0_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
 static const u32 ar955x_1p0_radio_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00016098, 0xd2dd5554, 0xd2dd5554, 0xd28b3330, 0xd28b3330},
@@ -37,13 +45,6 @@ static const u32 ar955x_1p0_radio_postamble[][5] = {
         {0x00016940, 0x10804008, 0x10804008, 0x10804008, 0x10804008},
 };
 
-static const u32 ar955x_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x6f7f0301},
-        {0x0000a3a0, 0xca9228ee},
-};
-
 static const u32 ar955x_1p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
@@ -473,266 +474,6 @@ static const u32 ar955x_1p0_mac_core[][2] = {
         {0x000083d0, 0x8c7901ff},
 };
 
-static const u32 ar955x_1p0_common_rx_gain_table[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x01910190},
-        {0x0000a030, 0x01930192},
-        {0x0000a034, 0x01950194},
-        {0x0000a038, 0x038a0196},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x22222229},
-        {0x0000a084, 0x1d1d1d1d},
-        {0x0000a088, 0x1d1d1d1d},
-        {0x0000a08c, 0x1d1d1d1d},
-        {0x0000a090, 0x171d1d1d},
-        {0x0000a094, 0x11111717},
-        {0x0000a098, 0x00030311},
-        {0x0000a09c, 0x00000000},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x23232323},
-        {0x0000b084, 0x21232323},
-        {0x0000b088, 0x19191c1e},
-        {0x0000b08c, 0x12141417},
-        {0x0000b090, 0x07070e0e},
-        {0x0000b094, 0x03030305},
-        {0x0000b098, 0x00000003},
-        {0x0000b09c, 0x00000000},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
 static const u32 ar955x_1p0_baseband_core[][2] = {
         /* Addr      allmodes  */
         {0x00009800, 0xafe68e30},
@@ -891,266 +632,6 @@ static const u32 ar955x_1p0_baseband_core[][2] = {
         {0x0000c420, 0x00000000},
 };
 
-static const u32 ar955x_1p0_common_wo_xlna_rx_gain_table[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a000, 0x00010000},
-        {0x0000a004, 0x00030002},
-        {0x0000a008, 0x00050004},
-        {0x0000a00c, 0x00810080},
-        {0x0000a010, 0x00830082},
-        {0x0000a014, 0x01810180},
-        {0x0000a018, 0x01830182},
-        {0x0000a01c, 0x01850184},
-        {0x0000a020, 0x01890188},
-        {0x0000a024, 0x018b018a},
-        {0x0000a028, 0x018d018c},
-        {0x0000a02c, 0x03820190},
-        {0x0000a030, 0x03840383},
-        {0x0000a034, 0x03880385},
-        {0x0000a038, 0x038a0389},
-        {0x0000a03c, 0x038c038b},
-        {0x0000a040, 0x0390038d},
-        {0x0000a044, 0x03920391},
-        {0x0000a048, 0x03940393},
-        {0x0000a04c, 0x03960395},
-        {0x0000a050, 0x00000000},
-        {0x0000a054, 0x00000000},
-        {0x0000a058, 0x00000000},
-        {0x0000a05c, 0x00000000},
-        {0x0000a060, 0x00000000},
-        {0x0000a064, 0x00000000},
-        {0x0000a068, 0x00000000},
-        {0x0000a06c, 0x00000000},
-        {0x0000a070, 0x00000000},
-        {0x0000a074, 0x00000000},
-        {0x0000a078, 0x00000000},
-        {0x0000a07c, 0x00000000},
-        {0x0000a080, 0x29292929},
-        {0x0000a084, 0x29292929},
-        {0x0000a088, 0x29292929},
-        {0x0000a08c, 0x29292929},
-        {0x0000a090, 0x22292929},
-        {0x0000a094, 0x1d1d2222},
-        {0x0000a098, 0x0c111117},
-        {0x0000a09c, 0x00030303},
-        {0x0000a0a0, 0x00000000},
-        {0x0000a0a4, 0x00000000},
-        {0x0000a0a8, 0x00000000},
-        {0x0000a0ac, 0x00000000},
-        {0x0000a0b0, 0x00000000},
-        {0x0000a0b4, 0x00000000},
-        {0x0000a0b8, 0x00000000},
-        {0x0000a0bc, 0x00000000},
-        {0x0000a0c0, 0x001f0000},
-        {0x0000a0c4, 0x01000101},
-        {0x0000a0c8, 0x011e011f},
-        {0x0000a0cc, 0x011c011d},
-        {0x0000a0d0, 0x02030204},
-        {0x0000a0d4, 0x02010202},
-        {0x0000a0d8, 0x021f0200},
-        {0x0000a0dc, 0x0302021e},
-        {0x0000a0e0, 0x03000301},
-        {0x0000a0e4, 0x031e031f},
-        {0x0000a0e8, 0x0402031d},
-        {0x0000a0ec, 0x04000401},
-        {0x0000a0f0, 0x041e041f},
-        {0x0000a0f4, 0x0502041d},
-        {0x0000a0f8, 0x05000501},
-        {0x0000a0fc, 0x051e051f},
-        {0x0000a100, 0x06010602},
-        {0x0000a104, 0x061f0600},
-        {0x0000a108, 0x061d061e},
-        {0x0000a10c, 0x07020703},
-        {0x0000a110, 0x07000701},
-        {0x0000a114, 0x00000000},
-        {0x0000a118, 0x00000000},
-        {0x0000a11c, 0x00000000},
-        {0x0000a120, 0x00000000},
-        {0x0000a124, 0x00000000},
-        {0x0000a128, 0x00000000},
-        {0x0000a12c, 0x00000000},
-        {0x0000a130, 0x00000000},
-        {0x0000a134, 0x00000000},
-        {0x0000a138, 0x00000000},
-        {0x0000a13c, 0x00000000},
-        {0x0000a140, 0x001f0000},
-        {0x0000a144, 0x01000101},
-        {0x0000a148, 0x011e011f},
-        {0x0000a14c, 0x011c011d},
-        {0x0000a150, 0x02030204},
-        {0x0000a154, 0x02010202},
-        {0x0000a158, 0x021f0200},
-        {0x0000a15c, 0x0302021e},
-        {0x0000a160, 0x03000301},
-        {0x0000a164, 0x031e031f},
-        {0x0000a168, 0x0402031d},
-        {0x0000a16c, 0x04000401},
-        {0x0000a170, 0x041e041f},
-        {0x0000a174, 0x0502041d},
-        {0x0000a178, 0x05000501},
-        {0x0000a17c, 0x051e051f},
-        {0x0000a180, 0x06010602},
-        {0x0000a184, 0x061f0600},
-        {0x0000a188, 0x061d061e},
-        {0x0000a18c, 0x07020703},
-        {0x0000a190, 0x07000701},
-        {0x0000a194, 0x00000000},
-        {0x0000a198, 0x00000000},
-        {0x0000a19c, 0x00000000},
-        {0x0000a1a0, 0x00000000},
-        {0x0000a1a4, 0x00000000},
-        {0x0000a1a8, 0x00000000},
-        {0x0000a1ac, 0x00000000},
-        {0x0000a1b0, 0x00000000},
-        {0x0000a1b4, 0x00000000},
-        {0x0000a1b8, 0x00000000},
-        {0x0000a1bc, 0x00000000},
-        {0x0000a1c0, 0x00000000},
-        {0x0000a1c4, 0x00000000},
-        {0x0000a1c8, 0x00000000},
-        {0x0000a1cc, 0x00000000},
-        {0x0000a1d0, 0x00000000},
-        {0x0000a1d4, 0x00000000},
-        {0x0000a1d8, 0x00000000},
-        {0x0000a1dc, 0x00000000},
-        {0x0000a1e0, 0x00000000},
-        {0x0000a1e4, 0x00000000},
-        {0x0000a1e8, 0x00000000},
-        {0x0000a1ec, 0x00000000},
-        {0x0000a1f0, 0x00000396},
-        {0x0000a1f4, 0x00000396},
-        {0x0000a1f8, 0x00000396},
-        {0x0000a1fc, 0x00000196},
-        {0x0000b000, 0x00010000},
-        {0x0000b004, 0x00030002},
-        {0x0000b008, 0x00050004},
-        {0x0000b00c, 0x00810080},
-        {0x0000b010, 0x00830082},
-        {0x0000b014, 0x01810180},
-        {0x0000b018, 0x01830182},
-        {0x0000b01c, 0x01850184},
-        {0x0000b020, 0x02810280},
-        {0x0000b024, 0x02830282},
-        {0x0000b028, 0x02850284},
-        {0x0000b02c, 0x02890288},
-        {0x0000b030, 0x028b028a},
-        {0x0000b034, 0x0388028c},
-        {0x0000b038, 0x038a0389},
-        {0x0000b03c, 0x038c038b},
-        {0x0000b040, 0x0390038d},
-        {0x0000b044, 0x03920391},
-        {0x0000b048, 0x03940393},
-        {0x0000b04c, 0x03960395},
-        {0x0000b050, 0x00000000},
-        {0x0000b054, 0x00000000},
-        {0x0000b058, 0x00000000},
-        {0x0000b05c, 0x00000000},
-        {0x0000b060, 0x00000000},
-        {0x0000b064, 0x00000000},
-        {0x0000b068, 0x00000000},
-        {0x0000b06c, 0x00000000},
-        {0x0000b070, 0x00000000},
-        {0x0000b074, 0x00000000},
-        {0x0000b078, 0x00000000},
-        {0x0000b07c, 0x00000000},
-        {0x0000b080, 0x32323232},
-        {0x0000b084, 0x2f2f3232},
-        {0x0000b088, 0x23282a2d},
-        {0x0000b08c, 0x1c1e2123},
-        {0x0000b090, 0x14171919},
-        {0x0000b094, 0x0e0e1214},
-        {0x0000b098, 0x03050707},
-        {0x0000b09c, 0x00030303},
-        {0x0000b0a0, 0x00000000},
-        {0x0000b0a4, 0x00000000},
-        {0x0000b0a8, 0x00000000},
-        {0x0000b0ac, 0x00000000},
-        {0x0000b0b0, 0x00000000},
-        {0x0000b0b4, 0x00000000},
-        {0x0000b0b8, 0x00000000},
-        {0x0000b0bc, 0x00000000},
-        {0x0000b0c0, 0x003f0020},
-        {0x0000b0c4, 0x00400041},
-        {0x0000b0c8, 0x0140005f},
-        {0x0000b0cc, 0x0160015f},
-        {0x0000b0d0, 0x017e017f},
-        {0x0000b0d4, 0x02410242},
-        {0x0000b0d8, 0x025f0240},
-        {0x0000b0dc, 0x027f0260},
-        {0x0000b0e0, 0x0341027e},
-        {0x0000b0e4, 0x035f0340},
-        {0x0000b0e8, 0x037f0360},
-        {0x0000b0ec, 0x04400441},
-        {0x0000b0f0, 0x0460045f},
-        {0x0000b0f4, 0x0541047f},
-        {0x0000b0f8, 0x055f0540},
-        {0x0000b0fc, 0x057f0560},
-        {0x0000b100, 0x06400641},
-        {0x0000b104, 0x0660065f},
-        {0x0000b108, 0x067e067f},
-        {0x0000b10c, 0x07410742},
-        {0x0000b110, 0x075f0740},
-        {0x0000b114, 0x077f0760},
-        {0x0000b118, 0x07800781},
-        {0x0000b11c, 0x07a0079f},
-        {0x0000b120, 0x07c107bf},
-        {0x0000b124, 0x000007c0},
-        {0x0000b128, 0x00000000},
-        {0x0000b12c, 0x00000000},
-        {0x0000b130, 0x00000000},
-        {0x0000b134, 0x00000000},
-        {0x0000b138, 0x00000000},
-        {0x0000b13c, 0x00000000},
-        {0x0000b140, 0x003f0020},
-        {0x0000b144, 0x00400041},
-        {0x0000b148, 0x0140005f},
-        {0x0000b14c, 0x0160015f},
-        {0x0000b150, 0x017e017f},
-        {0x0000b154, 0x02410242},
-        {0x0000b158, 0x025f0240},
-        {0x0000b15c, 0x027f0260},
-        {0x0000b160, 0x0341027e},
-        {0x0000b164, 0x035f0340},
-        {0x0000b168, 0x037f0360},
-        {0x0000b16c, 0x04400441},
-        {0x0000b170, 0x0460045f},
-        {0x0000b174, 0x0541047f},
-        {0x0000b178, 0x055f0540},
-        {0x0000b17c, 0x057f0560},
-        {0x0000b180, 0x06400641},
-        {0x0000b184, 0x0660065f},
-        {0x0000b188, 0x067e067f},
-        {0x0000b18c, 0x07410742},
-        {0x0000b190, 0x075f0740},
-        {0x0000b194, 0x077f0760},
-        {0x0000b198, 0x07800781},
-        {0x0000b19c, 0x07a0079f},
-        {0x0000b1a0, 0x07c107bf},
-        {0x0000b1a4, 0x000007c0},
-        {0x0000b1a8, 0x00000000},
-        {0x0000b1ac, 0x00000000},
-        {0x0000b1b0, 0x00000000},
-        {0x0000b1b4, 0x00000000},
-        {0x0000b1b8, 0x00000000},
-        {0x0000b1bc, 0x00000000},
-        {0x0000b1c0, 0x00000000},
-        {0x0000b1c4, 0x00000000},
-        {0x0000b1c8, 0x00000000},
-        {0x0000b1cc, 0x00000000},
-        {0x0000b1d0, 0x00000000},
-        {0x0000b1d4, 0x00000000},
-        {0x0000b1d8, 0x00000000},
-        {0x0000b1dc, 0x00000000},
-        {0x0000b1e0, 0x00000000},
-        {0x0000b1e4, 0x00000000},
-        {0x0000b1e8, 0x00000000},
-        {0x0000b1ec, 0x00000000},
-        {0x0000b1f0, 0x00000396},
-        {0x0000b1f4, 0x00000396},
-        {0x0000b1f8, 0x00000396},
-        {0x0000b1fc, 0x00000196},
-};
-
 static const u32 ar955x_1p0_soc_preamble[][2] = {
         /* Addr      allmodes  */
         {0x00007000, 0x00000000},
@@ -1263,11 +744,6 @@ static const u32 ar955x_1p0_modes_no_xpa_tx_gain_table[][9] = {
         {0x00016848, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401, 0x66482401},
 };
 
-static const u32 ar955x_1p0_soc_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00007010, 0x00000023, 0x00000023, 0x00000023, 0x00000023},
-};
-
 static const u32 ar955x_1p0_modes_fast_clock[][3] = {
         /* Addr      5G_HT20     5G_HT40   */
         {0x00001030, 0x00000268, 0x000004d0},
diff --git a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
index a8c757b6124f..10d4a6cb1c3b 100644
--- a/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9565_1p0_initvals.h
@@ -20,6 +20,12 @@
 
 /* AR9565 1.0 */
 
+#define ar9565_1p0_mac_postamble ar9331_1p1_mac_postamble
+
+#define ar9565_1p0_Modes_lowest_ob_db_tx_gain_table ar9565_1p0_modes_low_ob_db_tx_gain_table
+
+#define ar9565_1p0_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
 static const u32 ar9565_1p0_mac_core[][2] = {
         /* Addr      allmodes  */
         {0x00000008, 0x00000000},
@@ -182,18 +188,6 @@ static const u32 ar9565_1p0_mac_core[][2] = {
         {0x000083d0, 0x800301ff},
 };
 
-static const u32 ar9565_1p0_mac_postamble[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x00001030, 0x00000230, 0x00000460, 0x000002c0, 0x00000160},
-        {0x00001070, 0x00000168, 0x000002d0, 0x00000318, 0x0000018c},
-        {0x000010b0, 0x00000e60, 0x00001cc0, 0x00007c70, 0x00003e38},
-        {0x00008014, 0x03e803e8, 0x07d007d0, 0x10801600, 0x08400b00},
-        {0x0000801c, 0x128d8027, 0x128d804f, 0x12e00057, 0x12e0002b},
-        {0x00008120, 0x08f04800, 0x08f04800, 0x08f04810, 0x08f04810},
-        {0x000081d0, 0x00003210, 0x00003210, 0x0000320a, 0x0000320a},
-        {0x00008318, 0x00003e80, 0x00007d00, 0x00006880, 0x00003440},
-};
-
 static const u32 ar9565_1p0_baseband_core[][2] = {
         /* Addr      allmodes  */
         {0x00009800, 0xafe68e30},
@@ -711,66 +705,6 @@ static const u32 ar9565_1p0_Common_rx_gain_table[][2] = {
         {0x0000b1fc, 0x00000196},
 };
 
-static const u32 ar9565_1p0_Modes_lowest_ob_db_tx_gain_table[][5] = {
-        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
-        {0x0000a2dc, 0xfc0a9380, 0xfc0a9380, 0xfdab5b52, 0xfdab5b52},
-        {0x0000a2e0, 0xffecec00, 0xffecec00, 0xfd339c84, 0xfd339c84},
-        {0x0000a2e4, 0xfc0f0000, 0xfc0f0000, 0xfec3e000, 0xfec3e000},
-        {0x0000a2e8, 0xfc100000, 0xfc100000, 0xfffc0000, 0xfffc0000},
-        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
-        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
-        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
-        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
-        {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202},
-        {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400},
-        {0x0000a518, 0x21020220, 0x21020220, 0x16000402, 0x16000402},
-        {0x0000a51c, 0x27020223, 0x27020223, 0x19000404, 0x19000404},
-        {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603},
-        {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02},
-        {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04},
-        {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20},
-        {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20},
-        {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22},
-        {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24},
-        {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640},
-        {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660},
-        {0x0000a544, 0x5302266c, 0x5302266c, 0x3f001861, 0x3f001861},
-        {0x0000a548, 0x5702286c, 0x5702286c, 0x43001a81, 0x43001a81},
-        {0x0000a54c, 0x5c04286b, 0x5c04286b, 0x47001a83, 0x47001a83},
-        {0x0000a550, 0x61042a6c, 0x61042a6c, 0x4a001c84, 0x4a001c84},
-        {0x0000a554, 0x66062a6c, 0x66062a6c, 0x4e001ce3, 0x4e001ce3},
-        {0x0000a558, 0x6b062e6c, 0x6b062e6c, 0x52001ce5, 0x52001ce5},
-        {0x0000a55c, 0x7006308c, 0x7006308c, 0x56001ce9, 0x56001ce9},
-        {0x0000a560, 0x730a308a, 0x730a308a, 0x5a001ceb, 0x5a001ceb},
-        {0x0000a564, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a568, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a56c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a570, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a574, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a578, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a57c, 0x770a308c, 0x770a308c, 0x5d001eec, 0x5d001eec},
-        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a614, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a618, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a61c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a620, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a624, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a628, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a62c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a630, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a634, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a638, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x0000a63c, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016044, 0x012482d4, 0x012482d4, 0x012482d4, 0x012482d4},
-        {0x00016048, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-        {0x00016054, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
-};
-
 static const u32 ar9565_1p0_pciephy_clkreq_disable_L1[][2] = {
         /* Addr      allmodes  */
         {0x00018c00, 0x18212ede},
@@ -1231,11 +1165,4 @@ static const u32 ar9565_1p0_modes_high_power_tx_gain_table[][5] = {
         {0x00016054, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
 };
 
-static const u32 ar9565_1p0_baseband_core_txfir_coeff_japan_2484[][2] = {
-        /* Addr      allmodes  */
-        {0x0000a398, 0x00000000},
-        {0x0000a39c, 0x6f7f0301},
-        {0x0000a3a0, 0xca9228ee},
-};
-
 #endif /* INITVALS_9565_1P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9565_1p1_initvals.h b/drivers/net/wireless/ath/ath9k/ar9565_1p1_initvals.h
new file mode 100644
index 000000000000..56810539971e
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/ar9565_1p1_initvals.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (c) 2010-2011 Atheros Communications Inc.
+ * Copyright (c) 2011-2012 Qualcomm Atheros Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef INITVALS_9565_1P1_H
+#define INITVALS_9565_1P1_H
+
+/* AR9565 1.1 */
+
+#define ar9565_1p1_mac_core ar9565_1p0_mac_core
+
+#define ar9565_1p1_mac_postamble ar9565_1p0_mac_postamble
+
+#define ar9565_1p1_baseband_core ar9565_1p0_baseband_core
+
+#define ar9565_1p1_baseband_postamble ar9565_1p0_baseband_postamble
+
+#define ar9565_1p1_radio_core ar9565_1p0_radio_core
+
+#define ar9565_1p1_soc_preamble ar9565_1p0_soc_preamble
+
+#define ar9565_1p1_soc_postamble ar9565_1p0_soc_postamble
+
+#define ar9565_1p1_Common_rx_gain_table ar9565_1p0_Common_rx_gain_table
+
+#define ar9565_1p1_Modes_lowest_ob_db_tx_gain_table ar9565_1p0_Modes_lowest_ob_db_tx_gain_table
+
+#define ar9565_1p1_pciephy_clkreq_disable_L1 ar9565_1p0_pciephy_clkreq_disable_L1
+
+#define ar9565_1p1_modes_fast_clock ar9565_1p0_modes_fast_clock
+
+#define ar9565_1p1_common_wo_xlna_rx_gain_table ar9565_1p0_common_wo_xlna_rx_gain_table
+
+#define ar9565_1p1_modes_low_ob_db_tx_gain_table ar9565_1p0_modes_low_ob_db_tx_gain_table
+
+#define ar9565_1p1_modes_high_ob_db_tx_gain_table ar9565_1p0_modes_high_ob_db_tx_gain_table
+
+#define ar9565_1p1_modes_high_power_tx_gain_table ar9565_1p0_modes_high_power_tx_gain_table
+
+#define ar9565_1p1_baseband_core_txfir_coeff_japan_2484 ar9565_1p0_baseband_core_txfir_coeff_japan_2484
+
+static const u32 ar9565_1p1_radio_postamble[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0001609c, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524, 0x0b8ee524},
+        {0x000160ac, 0xa4646c08, 0xa4646c08, 0x24645808, 0x24645808},
+        {0x000160b0, 0x01d67f70, 0x01d67f70, 0x01d67f70, 0x01d67f70},
+        {0x0001610c, 0x40000000, 0x40000000, 0x40000000, 0x40000000},
+        {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
+};
+
+#endif /* INITVALS_9565_1P1_H */
diff --git a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
index bdee2ed67219..e6aec2c0207f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
+++ b/drivers/net/wireless/ath/ath9k/ar9580_1p0_initvals.h
@@ -20,18 +20,34 @@
 
 /* AR9580 1.0 */
 
+#define ar9580_1p0_soc_preamble ar9300_2p2_soc_preamble
+
+#define ar9580_1p0_soc_postamble ar9300_2p2_soc_postamble
+
+#define ar9580_1p0_radio_core ar9300_2p2_radio_core
+
+#define ar9580_1p0_mac_postamble ar9300_2p2_mac_postamble
+
+#define ar9580_1p0_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
+
+#define ar9580_1p0_type5_tx_gain_table ar9300Modes_type5_tx_gain_table_2p2
+
+#define ar9580_1p0_high_ob_db_tx_gain_table ar9300Modes_high_ob_db_tx_gain_table_2p2
+
 #define ar9580_1p0_modes_fast_clock ar9300Modes_fast_clock_2p2
 
+#define ar9580_1p0_baseband_core_txfir_coeff_japan_2484 ar9300_2p2_baseband_core_txfir_coeff_japan_2484
+
 static const u32 ar9580_1p0_radio_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x0001609c, 0x0dd08f29, 0x0dd08f29, 0x0b283f31, 0x0b283f31},
         {0x000160ac, 0xa4653c00, 0xa4653c00, 0x24652800, 0x24652800},
         {0x000160b0, 0x03284f3e, 0x03284f3e, 0x05d08f20, 0x05d08f20},
-        {0x0001610c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0001610c, 0xc8000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016140, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-        {0x0001650c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0001650c, 0xc8000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016540, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
-        {0x0001690c, 0x08000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0001690c, 0xc8000000, 0xc0000000, 0xc0000000, 0xc0000000},
         {0x00016940, 0x10804008, 0x10804008, 0x50804008, 0x50804008},
 };
 
@@ -41,12 +57,10 @@ static const u32 ar9580_1p0_baseband_core[][2] = {
         {0x00009804, 0xfd14e000},
         {0x00009808, 0x9c0a9f6b},
         {0x0000980c, 0x04900000},
-        {0x00009814, 0x3280c00a},
-        {0x00009818, 0x00000000},
         {0x0000981c, 0x00020028},
-        {0x00009834, 0x6400a290},
+        {0x00009834, 0x6400a190},
         {0x00009838, 0x0108ecff},
-        {0x0000983c, 0x0d000600},
+        {0x0000983c, 0x14000600},
         {0x00009880, 0x201fff00},
         {0x00009884, 0x00001042},
         {0x000098a4, 0x00200400},
@@ -67,7 +81,7 @@ static const u32 ar9580_1p0_baseband_core[][2] = {
         {0x00009d04, 0x40206c10},
         {0x00009d08, 0x009c4060},
         {0x00009d0c, 0x9883800a},
-        {0x00009d10, 0x01834061},
+        {0x00009d10, 0x01884061},
         {0x00009d14, 0x00c0040b},
         {0x00009d18, 0x00000000},
         {0x00009e08, 0x0038230c},
@@ -198,8 +212,6 @@ static const u32 ar9580_1p0_baseband_core[][2] = {
         {0x0000c420, 0x00000000},
 };
 
-#define ar9580_1p0_mac_postamble ar9300_2p2_mac_postamble
-
 static const u32 ar9580_1p0_low_ob_db_tx_gain_table[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x0000a2dc, 0x0380c7fc, 0x0380c7fc, 0x03aaa352, 0x03aaa352},
@@ -306,7 +318,112 @@ static const u32 ar9580_1p0_low_ob_db_tx_gain_table[][5] = {
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
-#define ar9580_1p0_high_power_tx_gain_table ar9580_1p0_low_ob_db_tx_gain_table
+static const u32 ar9580_1p0_high_power_tx_gain_table[][5] = {
+        /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
+        {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9},
+        {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002},
+        {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004},
+        {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200},
+        {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202},
+        {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400},
+        {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402},
+        {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404},
+        {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603},
+        {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02},
+        {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04},
+        {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20},
+        {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20},
+        {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22},
+        {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24},
+        {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640},
+        {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660},
+        {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861},
+        {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81},
+        {0x0000a54c, 0x5e08442e, 0x5e08442e, 0x47001a83, 0x47001a83},
+        {0x0000a550, 0x620a4431, 0x620a4431, 0x4a001c84, 0x4a001c84},
+        {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3},
+        {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5},
+        {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9},
+        {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb},
+        {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec},
+        {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000},
+        {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002},
+        {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004},
+        {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200},
+        {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202},
+        {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400},
+        {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402},
+        {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404},
+        {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603},
+        {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02},
+        {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04},
+        {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20},
+        {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20},
+        {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22},
+        {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24},
+        {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640},
+        {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660},
+        {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861},
+        {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81},
+        {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83},
+        {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84},
+        {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3},
+        {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5},
+        {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9},
+        {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb},
+        {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec},
+        {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
+        {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000},
+        {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000},
+        {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501},
+        {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501},
+        {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03},
+        {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04},
+        {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04},
+        {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005},
+        {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
+        {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584},
+        {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800},
+        {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000},
+        {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016048, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016288, 0x05a2040a, 0x05a2040a, 0x05a20408, 0x05a20408},
+        {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016448, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+        {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4},
+        {0x00016848, 0x65240001, 0x65240001, 0x66480001, 0x66480001},
+        {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
+};
 
 static const u32 ar9580_1p0_lowest_ob_db_tx_gain_table[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
@@ -414,8 +531,6 @@ static const u32 ar9580_1p0_lowest_ob_db_tx_gain_table[][5] = {
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
-#define ar9580_1p0_baseband_core_txfir_coeff_japan_2484 ar9462_2p0_baseband_core_txfir_coeff_japan_2484
-
 static const u32 ar9580_1p0_mac_core[][2] = {
         /* Addr      allmodes  */
         {0x00000008, 0x00000000},
@@ -679,14 +794,6 @@ static const u32 ar9580_1p0_mixed_ob_db_tx_gain_table[][5] = {
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
-#define ar9580_1p0_wo_xlna_rx_gain_table ar9300Common_wo_xlna_rx_gain_table_2p2
-
-#define ar9580_1p0_soc_postamble ar9300_2p2_soc_postamble
-
-#define ar9580_1p0_high_ob_db_tx_gain_table ar9300Modes_high_ob_db_tx_gain_table_2p2
-
-#define ar9580_1p0_type5_tx_gain_table ar9300Modes_type5_tx_gain_table_2p2
-
 static const u32 ar9580_1p0_type6_tx_gain_table[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352},
@@ -761,165 +868,271 @@ static const u32 ar9580_1p0_type6_tx_gain_table[][5] = {
         {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c},
 };
 
-static const u32 ar9580_1p0_soc_preamble[][2] = {
+static const u32 ar9580_1p0_rx_gain_table[][2] = {
         /* Addr      allmodes  */
-        {0x000040a4, 0x00a0c1c9},
-        {0x00007008, 0x00000000},
-        {0x00007020, 0x00000000},
-        {0x00007034, 0x00000002},
-        {0x00007038, 0x000004c2},
-        {0x00007048, 0x00000008},
-};
-
-#define ar9580_1p0_rx_gain_table ar9462_common_rx_gain_table_2p0
-
-static const u32 ar9580_1p0_radio_core[][2] = {
-        /* Addr      allmodes  */
-        {0x00016000, 0x36db6db6},
-        {0x00016004, 0x6db6db40},
-        {0x00016008, 0x73f00000},
-        {0x0001600c, 0x00000000},
-        {0x00016040, 0x7f80fff8},
-        {0x0001604c, 0x76d005b5},
-        {0x00016050, 0x556cf031},
-        {0x00016054, 0x13449440},
-        {0x00016058, 0x0c51c92c},
-        {0x0001605c, 0x3db7fffc},
-        {0x00016060, 0xfffffffc},
-        {0x00016064, 0x000f0278},
-        {0x0001606c, 0x6db60000},
-        {0x00016080, 0x00000000},
-        {0x00016084, 0x0e48048c},
-        {0x00016088, 0x54214514},
-        {0x0001608c, 0x119f481e},
-        {0x00016090, 0x24926490},
-        {0x00016098, 0xd2888888},
-        {0x000160a0, 0x0a108ffe},
-        {0x000160a4, 0x812fc370},
-        {0x000160a8, 0x423c8000},
-        {0x000160b4, 0x92480080},
-        {0x000160c0, 0x00adb6d0},
-        {0x000160c4, 0x6db6db60},
-        {0x000160c8, 0x6db6db6c},
-        {0x000160cc, 0x01e6c000},
-        {0x00016100, 0x3fffbe01},
-        {0x00016104, 0xfff80000},
-        {0x00016108, 0x00080010},
-        {0x00016144, 0x02084080},
-        {0x00016148, 0x00000000},
-        {0x00016280, 0x058a0001},
-        {0x00016284, 0x3d840208},
-        {0x00016288, 0x05a20408},
-        {0x0001628c, 0x00038c07},
-        {0x00016290, 0x00000004},
-        {0x00016294, 0x458aa14f},
-        {0x00016380, 0x00000000},
-        {0x00016384, 0x00000000},
-        {0x00016388, 0x00800700},
-        {0x0001638c, 0x00800700},
-        {0x00016390, 0x00800700},
-        {0x00016394, 0x00000000},
-        {0x00016398, 0x00000000},
-        {0x0001639c, 0x00000000},
-        {0x000163a0, 0x00000001},
-        {0x000163a4, 0x00000001},
-        {0x000163a8, 0x00000000},
-        {0x000163ac, 0x00000000},
-        {0x000163b0, 0x00000000},
-        {0x000163b4, 0x00000000},
-        {0x000163b8, 0x00000000},
-        {0x000163bc, 0x00000000},
-        {0x000163c0, 0x000000a0},
-        {0x000163c4, 0x000c0000},
-        {0x000163c8, 0x14021402},
-        {0x000163cc, 0x00001402},
-        {0x000163d0, 0x00000000},
-        {0x000163d4, 0x00000000},
-        {0x00016400, 0x36db6db6},
-        {0x00016404, 0x6db6db40},
-        {0x00016408, 0x73f00000},
-        {0x0001640c, 0x00000000},
-        {0x00016440, 0x7f80fff8},
-        {0x0001644c, 0x76d005b5},
-        {0x00016450, 0x556cf031},
-        {0x00016454, 0x13449440},
-        {0x00016458, 0x0c51c92c},
-        {0x0001645c, 0x3db7fffc},
-        {0x00016460, 0xfffffffc},
-        {0x00016464, 0x000f0278},
-        {0x0001646c, 0x6db60000},
-        {0x00016500, 0x3fffbe01},
-        {0x00016504, 0xfff80000},
-        {0x00016508, 0x00080010},
-        {0x00016544, 0x02084080},
-        {0x00016548, 0x00000000},
-        {0x00016780, 0x00000000},
-        {0x00016784, 0x00000000},
-        {0x00016788, 0x00800700},
-        {0x0001678c, 0x00800700},
-        {0x00016790, 0x00800700},
-        {0x00016794, 0x00000000},
-        {0x00016798, 0x00000000},
-        {0x0001679c, 0x00000000},
-        {0x000167a0, 0x00000001},
-        {0x000167a4, 0x00000001},
-        {0x000167a8, 0x00000000},
-        {0x000167ac, 0x00000000},
-        {0x000167b0, 0x00000000},
-        {0x000167b4, 0x00000000},
-        {0x000167b8, 0x00000000},
-        {0x000167bc, 0x00000000},
-        {0x000167c0, 0x000000a0},
-        {0x000167c4, 0x000c0000},
-        {0x000167c8, 0x14021402},
-        {0x000167cc, 0x00001402},
-        {0x000167d0, 0x00000000},
-        {0x000167d4, 0x00000000},
-        {0x00016800, 0x36db6db6},
-        {0x00016804, 0x6db6db40},
-        {0x00016808, 0x73f00000},
-        {0x0001680c, 0x00000000},
-        {0x00016840, 0x7f80fff8},
-        {0x0001684c, 0x76d005b5},
-        {0x00016850, 0x556cf031},
-        {0x00016854, 0x13449440},
-        {0x00016858, 0x0c51c92c},
-        {0x0001685c, 0x3db7fffc},
-        {0x00016860, 0xfffffffc},
-        {0x00016864, 0x000f0278},
-        {0x0001686c, 0x6db60000},
-        {0x00016900, 0x3fffbe01},
-        {0x00016904, 0xfff80000},
-        {0x00016908, 0x00080010},
-        {0x00016944, 0x02084080},
-        {0x00016948, 0x00000000},
-        {0x00016b80, 0x00000000},
-        {0x00016b84, 0x00000000},
-        {0x00016b88, 0x00800700},
-        {0x00016b8c, 0x00800700},
-        {0x00016b90, 0x00800700},
-        {0x00016b94, 0x00000000},
-        {0x00016b98, 0x00000000},
-        {0x00016b9c, 0x00000000},
-        {0x00016ba0, 0x00000001},
-        {0x00016ba4, 0x00000001},
-        {0x00016ba8, 0x00000000},
-        {0x00016bac, 0x00000000},
-        {0x00016bb0, 0x00000000},
-        {0x00016bb4, 0x00000000},
-        {0x00016bb8, 0x00000000},
-        {0x00016bbc, 0x00000000},
-        {0x00016bc0, 0x000000a0},
-        {0x00016bc4, 0x000c0000},
-        {0x00016bc8, 0x14021402},
-        {0x00016bcc, 0x00001402},
-        {0x00016bd0, 0x00000000},
-        {0x00016bd4, 0x00000000},
+        {0x0000a000, 0x00010000},
+        {0x0000a004, 0x00030002},
+        {0x0000a008, 0x00050004},
+        {0x0000a00c, 0x00810080},
+        {0x0000a010, 0x00830082},
+        {0x0000a014, 0x01810180},
+        {0x0000a018, 0x01830182},
+        {0x0000a01c, 0x01850184},
+        {0x0000a020, 0x01890188},
+        {0x0000a024, 0x018b018a},
+        {0x0000a028, 0x018d018c},
+        {0x0000a02c, 0x01910190},
+        {0x0000a030, 0x01930192},
+        {0x0000a034, 0x01950194},
+        {0x0000a038, 0x038a0196},
+        {0x0000a03c, 0x038c038b},
+        {0x0000a040, 0x0390038d},
+        {0x0000a044, 0x03920391},
+        {0x0000a048, 0x03940393},
+        {0x0000a04c, 0x03960395},
+        {0x0000a050, 0x00000000},
+        {0x0000a054, 0x00000000},
+        {0x0000a058, 0x00000000},
+        {0x0000a05c, 0x00000000},
+        {0x0000a060, 0x00000000},
+        {0x0000a064, 0x00000000},
+        {0x0000a068, 0x00000000},
+        {0x0000a06c, 0x00000000},
+        {0x0000a070, 0x00000000},
+        {0x0000a074, 0x00000000},
+        {0x0000a078, 0x00000000},
+        {0x0000a07c, 0x00000000},
+        {0x0000a080, 0x22222229},
+        {0x0000a084, 0x1d1d1d1d},
+        {0x0000a088, 0x1d1d1d1d},
+        {0x0000a08c, 0x1d1d1d1d},
+        {0x0000a090, 0x171d1d1d},
+        {0x0000a094, 0x11111717},
+        {0x0000a098, 0x00030311},
+        {0x0000a09c, 0x00000000},
+        {0x0000a0a0, 0x00000000},
+        {0x0000a0a4, 0x00000000},
+        {0x0000a0a8, 0x00000000},
+        {0x0000a0ac, 0x00000000},
+        {0x0000a0b0, 0x00000000},
+        {0x0000a0b4, 0x00000000},
+        {0x0000a0b8, 0x00000000},
+        {0x0000a0bc, 0x00000000},
+        {0x0000a0c0, 0x001f0000},
+        {0x0000a0c4, 0x01000101},
+        {0x0000a0c8, 0x011e011f},
+        {0x0000a0cc, 0x011c011d},
+        {0x0000a0d0, 0x02030204},
+        {0x0000a0d4, 0x02010202},
+        {0x0000a0d8, 0x021f0200},
+        {0x0000a0dc, 0x0302021e},
+        {0x0000a0e0, 0x03000301},
+        {0x0000a0e4, 0x031e031f},
+        {0x0000a0e8, 0x0402031d},
+        {0x0000a0ec, 0x04000401},
+        {0x0000a0f0, 0x041e041f},
+        {0x0000a0f4, 0x0502041d},
+        {0x0000a0f8, 0x05000501},
+        {0x0000a0fc, 0x051e051f},
+        {0x0000a100, 0x06010602},
+        {0x0000a104, 0x061f0600},
+        {0x0000a108, 0x061d061e},
+        {0x0000a10c, 0x07020703},
+        {0x0000a110, 0x07000701},
+        {0x0000a114, 0x00000000},
+        {0x0000a118, 0x00000000},
+        {0x0000a11c, 0x00000000},
+        {0x0000a120, 0x00000000},
+        {0x0000a124, 0x00000000},
+        {0x0000a128, 0x00000000},
+        {0x0000a12c, 0x00000000},
+        {0x0000a130, 0x00000000},
+        {0x0000a134, 0x00000000},
+        {0x0000a138, 0x00000000},
+        {0x0000a13c, 0x00000000},
+        {0x0000a140, 0x001f0000},
+        {0x0000a144, 0x01000101},
+        {0x0000a148, 0x011e011f},
+        {0x0000a14c, 0x011c011d},
+        {0x0000a150, 0x02030204},
+        {0x0000a154, 0x02010202},
+        {0x0000a158, 0x021f0200},
+        {0x0000a15c, 0x0302021e},
+        {0x0000a160, 0x03000301},
+        {0x0000a164, 0x031e031f},
+        {0x0000a168, 0x0402031d},
+        {0x0000a16c, 0x04000401},
+        {0x0000a170, 0x041e041f},
+        {0x0000a174, 0x0502041d},
+        {0x0000a178, 0x05000501},
+        {0x0000a17c, 0x051e051f},
+        {0x0000a180, 0x06010602},
+        {0x0000a184, 0x061f0600},
+        {0x0000a188, 0x061d061e},
+        {0x0000a18c, 0x07020703},
+        {0x0000a190, 0x07000701},
+        {0x0000a194, 0x00000000},
+        {0x0000a198, 0x00000000},
+        {0x0000a19c, 0x00000000},
+        {0x0000a1a0, 0x00000000},
+        {0x0000a1a4, 0x00000000},
+        {0x0000a1a8, 0x00000000},
+        {0x0000a1ac, 0x00000000},
+        {0x0000a1b0, 0x00000000},
+        {0x0000a1b4, 0x00000000},
+        {0x0000a1b8, 0x00000000},
+        {0x0000a1bc, 0x00000000},
+        {0x0000a1c0, 0x00000000},
+        {0x0000a1c4, 0x00000000},
+        {0x0000a1c8, 0x00000000},
+        {0x0000a1cc, 0x00000000},
+        {0x0000a1d0, 0x00000000},
+        {0x0000a1d4, 0x00000000},
+        {0x0000a1d8, 0x00000000},
+        {0x0000a1dc, 0x00000000},
+        {0x0000a1e0, 0x00000000},
+        {0x0000a1e4, 0x00000000},
+        {0x0000a1e8, 0x00000000},
+        {0x0000a1ec, 0x00000000},
+        {0x0000a1f0, 0x00000396},
+        {0x0000a1f4, 0x00000396},
+        {0x0000a1f8, 0x00000396},
+        {0x0000a1fc, 0x00000196},
+        {0x0000b000, 0x00010000},
+        {0x0000b004, 0x00030002},
+        {0x0000b008, 0x00050004},
+        {0x0000b00c, 0x00810080},
+        {0x0000b010, 0x00830082},
+        {0x0000b014, 0x01810180},
+        {0x0000b018, 0x01830182},
+        {0x0000b01c, 0x01850184},
+        {0x0000b020, 0x02810280},
+        {0x0000b024, 0x02830282},
+        {0x0000b028, 0x02850284},
+        {0x0000b02c, 0x02890288},
+        {0x0000b030, 0x028b028a},
+        {0x0000b034, 0x0388028c},
+        {0x0000b038, 0x038a0389},
+        {0x0000b03c, 0x038c038b},
+        {0x0000b040, 0x0390038d},
+        {0x0000b044, 0x03920391},
+        {0x0000b048, 0x03940393},
+        {0x0000b04c, 0x03960395},
+        {0x0000b050, 0x00000000},
+        {0x0000b054, 0x00000000},
+        {0x0000b058, 0x00000000},
+        {0x0000b05c, 0x00000000},
+        {0x0000b060, 0x00000000},
+        {0x0000b064, 0x00000000},
+        {0x0000b068, 0x00000000},
+        {0x0000b06c, 0x00000000},
+        {0x0000b070, 0x00000000},
+        {0x0000b074, 0x00000000},
+        {0x0000b078, 0x00000000},
+        {0x0000b07c, 0x00000000},
+        {0x0000b080, 0x23232323},
+        {0x0000b084, 0x21232323},
+        {0x0000b088, 0x19191c1e},
+        {0x0000b08c, 0x12141417},
+        {0x0000b090, 0x07070e0e},
+        {0x0000b094, 0x03030305},
+        {0x0000b098, 0x00000003},
+        {0x0000b09c, 0x00000000},
+        {0x0000b0a0, 0x00000000},
+        {0x0000b0a4, 0x00000000},
+        {0x0000b0a8, 0x00000000},
+        {0x0000b0ac, 0x00000000},
+        {0x0000b0b0, 0x00000000},
+        {0x0000b0b4, 0x00000000},
+        {0x0000b0b8, 0x00000000},
+        {0x0000b0bc, 0x00000000},
+        {0x0000b0c0, 0x003f0020},
+        {0x0000b0c4, 0x00400041},
+        {0x0000b0c8, 0x0140005f},
+        {0x0000b0cc, 0x0160015f},
+        {0x0000b0d0, 0x017e017f},
+        {0x0000b0d4, 0x02410242},
+        {0x0000b0d8, 0x025f0240},
+        {0x0000b0dc, 0x027f0260},
+        {0x0000b0e0, 0x0341027e},
+        {0x0000b0e4, 0x035f0340},
+        {0x0000b0e8, 0x037f0360},
+        {0x0000b0ec, 0x04400441},
+        {0x0000b0f0, 0x0460045f},
+        {0x0000b0f4, 0x0541047f},
+        {0x0000b0f8, 0x055f0540},
+        {0x0000b0fc, 0x057f0560},
+        {0x0000b100, 0x06400641},
+        {0x0000b104, 0x0660065f},
+        {0x0000b108, 0x067e067f},
+        {0x0000b10c, 0x07410742},
+        {0x0000b110, 0x075f0740},
+        {0x0000b114, 0x077f0760},
+        {0x0000b118, 0x07800781},
+        {0x0000b11c, 0x07a0079f},
+        {0x0000b120, 0x07c107bf},
+        {0x0000b124, 0x000007c0},
+        {0x0000b128, 0x00000000},
+        {0x0000b12c, 0x00000000},
+        {0x0000b130, 0x00000000},
+        {0x0000b134, 0x00000000},
+        {0x0000b138, 0x00000000},
+        {0x0000b13c, 0x00000000},
+        {0x0000b140, 0x003f0020},
+        {0x0000b144, 0x00400041},
+        {0x0000b148, 0x0140005f},
+        {0x0000b14c, 0x0160015f},
+        {0x0000b150, 0x017e017f},
+        {0x0000b154, 0x02410242},
+        {0x0000b158, 0x025f0240},
+        {0x0000b15c, 0x027f0260},
+        {0x0000b160, 0x0341027e},
+        {0x0000b164, 0x035f0340},
+        {0x0000b168, 0x037f0360},
+        {0x0000b16c, 0x04400441},
+        {0x0000b170, 0x0460045f},
+        {0x0000b174, 0x0541047f},
+        {0x0000b178, 0x055f0540},
+        {0x0000b17c, 0x057f0560},
+        {0x0000b180, 0x06400641},
+        {0x0000b184, 0x0660065f},
+        {0x0000b188, 0x067e067f},
+        {0x0000b18c, 0x07410742},
+        {0x0000b190, 0x075f0740},
+        {0x0000b194, 0x077f0760},
+        {0x0000b198, 0x07800781},
+        {0x0000b19c, 0x07a0079f},
+        {0x0000b1a0, 0x07c107bf},
+        {0x0000b1a4, 0x000007c0},
+        {0x0000b1a8, 0x00000000},
+        {0x0000b1ac, 0x00000000},
+        {0x0000b1b0, 0x00000000},
+        {0x0000b1b4, 0x00000000},
+        {0x0000b1b8, 0x00000000},
+        {0x0000b1bc, 0x00000000},
+        {0x0000b1c0, 0x00000000},
+        {0x0000b1c4, 0x00000000},
+        {0x0000b1c8, 0x00000000},
+        {0x0000b1cc, 0x00000000},
+        {0x0000b1d0, 0x00000000},
+        {0x0000b1d4, 0x00000000},
+        {0x0000b1d8, 0x00000000},
+        {0x0000b1dc, 0x00000000},
+        {0x0000b1e0, 0x00000000},
+        {0x0000b1e4, 0x00000000},
+        {0x0000b1e8, 0x00000000},
+        {0x0000b1ec, 0x00000000},
+        {0x0000b1f0, 0x00000396},
+        {0x0000b1f4, 0x00000396},
+        {0x0000b1f8, 0x00000396},
+        {0x0000b1fc, 0x00000196},
 };
 
 static const u32 ar9580_1p0_baseband_postamble[][5] = {
         /* Addr      5G_HT20     5G_HT40     2G_HT40     2G_HT20   */
         {0x00009810, 0xd00a8005, 0xd00a8005, 0xd00a8011, 0xd00a8011},
+        {0x00009814, 0x3280c00a, 0x3280c00a, 0x3280c00a, 0x3280c00a},
+        {0x00009818, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x00009820, 0x206a022e, 0x206a022e, 0x206a012e, 0x206a012e},
         {0x00009824, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0, 0x5ac640d0},
         {0x00009828, 0x06903081, 0x06903081, 0x06903881, 0x06903881},
@@ -956,7 +1169,7 @@ static const u32 ar9580_1p0_baseband_postamble[][5] = {
         {0x0000a288, 0x00000110, 0x00000110, 0x00000110, 0x00000110},
         {0x0000a28c, 0x00022222, 0x00022222, 0x00022222, 0x00022222},
         {0x0000a2c4, 0x00158d18, 0x00158d18, 0x00158d18, 0x00158d18},
-        {0x0000a2d0, 0x00041981, 0x00041981, 0x00041981, 0x00041982},
+        {0x0000a2d0, 0x00041983, 0x00041983, 0x00041981, 0x00041982},
         {0x0000a2d8, 0x7999a83b, 0x7999a83b, 0x7999a83b, 0x7999a83b},
         {0x0000a358, 0x00000000, 0x00000000, 0x00000000, 0x00000000},
         {0x0000a830, 0x0000019c, 0x0000019c, 0x0000019c, 0x0000019c},
@@ -994,4 +1207,13 @@ static const u32 ar9580_1p0_pcie_phy_pll_on_clkreq[][2] = {
         {0x00004044, 0x00000000},
 };
 
+static const u32 ar9580_1p0_baseband_postamble_dfs_channel[][3] = {
+        /* Addr      5G          2G        */
+        {0x00009814, 0x3400c00f, 0x3400c00f},
+        {0x00009824, 0x5ac668d0, 0x5ac668d0},
+        {0x00009828, 0x06903080, 0x06903080},
+        {0x00009e0c, 0x6d4000e2, 0x6d4000e2},
+        {0x00009e14, 0x37b9625e, 0x37b9625e},
+};
+
 #endif /* INITVALS_9580_1P0_H */
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 60a5da53668f..b5ac32cfbeb8 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -27,40 +27,15 @@
 #include "common.h"
 #include "mci.h"
 #include "dfs.h"
-
-/*
- * Header for the ath9k.ko driver core *only* -- hw code nor any other driver
- * should rely on this file or its contents.
- */
+#include "spectral.h"
 
 struct ath_node;
+struct ath_rate_table;
 
-/* Macro to expand scalars to 64-bit objects */
-
-#define ito64(x) (sizeof(x) == 1) ?                     \
-        (((unsigned long long int)(x)) & (0xff)) :      \
-        (sizeof(x) == 2) ?                              \
-        (((unsigned long long int)(x)) & 0xffff) :      \
-        ((sizeof(x) == 4) ?                             \
-         (((unsigned long long int)(x)) & 0xffffffff) : \
-         (unsigned long long int)(x))
-
-/* increment with wrap-around */
-#define INCR(_l, _sz)   do {                    \
-                (_l)++;                         \
-                (_l) &= ((_sz) - 1);            \
-        } while (0)
-
-/* decrement with wrap-around */
-#define DECR(_l,  _sz)  do {                    \
-                (_l)--;                         \
-                (_l) &= ((_sz) - 1);            \
-        } while (0)
-
-#define TSF_TO_TU(_h,_l) \
-        ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
-
-#define ATH_TXQ_SETUP(sc, i)        ((sc)->tx.txqsetup & (1<<i))
+extern struct ieee80211_ops ath9k_ops;
+extern int ath9k_modparam_nohwcrypt;
+extern int led_blink;
+extern bool is_ath9k_unloaded;
 
 struct ath_config {
         u16 txpowlimit;
@@ -70,6 +45,17 @@ struct ath_config {
 /* Descriptor Management */
 /*************************/
 
+#define ATH_TXSTATUS_RING_SIZE 512
+
+/* Macro to expand scalars to 64-bit objects */
+#define ito64(x) (sizeof(x) == 1) ?                     \
+        (((unsigned long long int)(x)) & (0xff)) :      \
+        (sizeof(x) == 2) ?                              \
+        (((unsigned long long int)(x)) & 0xffff) :      \
+        ((sizeof(x) == 4) ?                             \
+         (((unsigned long long int)(x)) & 0xffffffff) : \
+         (unsigned long long int)(x))
+
 #define ATH_TXBUF_RESET(_bf) do {                               \
                 (_bf)->bf_lastbf = NULL;                        \
                 (_bf)->bf_next = NULL;                          \
@@ -77,23 +63,6 @@ struct ath_config {
                        sizeof(struct ath_buf_state));           \
         } while (0)
 
-/**
- * enum buffer_type - Buffer type flags
- *
- * @BUF_AMPDU: This buffer is an ampdu, as part of an aggregate (during TX)
- * @BUF_AGGR: Indicates whether the buffer can be aggregated
- *      (used in aggregation scheduling)
- */
-enum buffer_type {
-        BUF_AMPDU               = BIT(0),
-        BUF_AGGR                = BIT(1),
-};
-
-#define bf_isampdu(bf)          (bf->bf_state.bf_type & BUF_AMPDU)
-#define bf_isaggr(bf)           (bf->bf_state.bf_type & BUF_AGGR)
-
-#define ATH_TXSTATUS_RING_SIZE 512
-
 #define DS2PHYS(_dd, _ds)                                               \
         ((_dd)->dd_desc_paddr + ((caddr_t)(_ds) - (caddr_t)(_dd)->dd_desc))
 #define ATH_DESC_4KB_BOUND_CHECK(_daddr) ((((_daddr) & 0xFFF) > 0xF7F) ? 1 : 0)
@@ -113,11 +82,20 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 /* RX / TX */
 /***********/
 
+#define ATH_TXQ_SETUP(sc, i) ((sc)->tx.txqsetup & (1<<i))
+
+/* increment with wrap-around */
+#define INCR(_l, _sz)   do {                    \
+                (_l)++;                         \
+                (_l) &= ((_sz) - 1);            \
+        } while (0)
+
 #define ATH_RXBUF               512
 #define ATH_TXBUF               512
 #define ATH_TXBUF_RESERVE       5
 #define ATH_MAX_QDEPTH          (ATH_TXBUF / 4 - ATH_TXBUF_RESERVE)
 #define ATH_TXMAXTRY            13
+#define ATH_MAX_SW_RETRIES      30
 
 #define TID_TO_WME_AC(_tid)                             \
         ((((_tid) == 0) || ((_tid) == 3)) ? IEEE80211_AC_BE :   \
@@ -133,6 +111,9 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 #define ATH_AGGR_MIN_QDEPTH        2
 /* minimum h/w qdepth for non-aggregated traffic */
 #define ATH_NON_AGGR_MIN_QDEPTH    8
+#define ATH_TX_COMPLETE_POLL_INT   1000
+#define ATH_TXFIFO_DEPTH           8
+#define ATH_TX_ERROR               0x01
 
 #define IEEE80211_SEQ_SEQ_SHIFT    4
 #define IEEE80211_SEQ_MAX          4096
@@ -165,11 +146,10 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
 
 #define ATH_AN_2_TID(_an, _tidno)  (&(_an)->tid[(_tidno)])
 
-#define IS_CCK_RATE(rate) ((rate >= 0x18) && (rate <= 0x1e))
+#define IS_HT_RATE(rate)   (rate & 0x80)
+#define IS_CCK_RATE(rate)  ((rate >= 0x18) && (rate <= 0x1e))
+#define IS_OFDM_RATE(rate) ((rate >= 0x8) && (rate <= 0xf))
 
-#define ATH_TX_COMPLETE_POLL_INT        1000
-
-#define ATH_TXFIFO_DEPTH 8
 struct ath_txq {
         int mac80211_qnum; /* mac80211 queue number, -1 means not mac80211 Q */
         u32 axq_qnum; /* ath9k hardware queue number */
@@ -214,6 +194,21 @@ struct ath_rxbuf {
         dma_addr_t bf_buf_addr;
 };
 
+/**
+ * enum buffer_type - Buffer type flags
+ *
+ * @BUF_AMPDU: This buffer is an ampdu, as part of an aggregate (during TX)
+ * @BUF_AGGR: Indicates whether the buffer can be aggregated
+ *      (used in aggregation scheduling)
+ */
+enum buffer_type {
+        BUF_AMPDU               = BIT(0),
+        BUF_AGGR                = BIT(1),
+};
+
+#define bf_isampdu(bf)          (bf->bf_state.bf_type & BUF_AMPDU)
+#define bf_isaggr(bf)           (bf->bf_state.bf_type & BUF_AGGR)
+
 struct ath_buf_state {
         u8 bf_type;
         u8 bfs_paprd;
@@ -269,6 +264,10 @@ struct ath_node {
 
         bool sleeping;
         bool no_ps_filter;
+
+#ifdef CONFIG_ATH9K_STATION_STATISTICS
+        struct ath_rx_rate_stats rx_rate_stats;
+#endif
 };
 
 struct ath_tx_control {
@@ -278,7 +277,6 @@ struct ath_tx_control {
         struct ieee80211_sta *sta;
 };
 
-#define ATH_TX_ERROR        0x01
 
 /**
  * @txq_map:  Index is mac80211 queue number.  This is
@@ -372,6 +370,22 @@ struct ath_vif {
         struct ath_buf *av_bcbuf;
 };
 
+struct ath9k_vif_iter_data {
+        u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
+        u8 mask[ETH_ALEN]; /* bssid mask */
+        bool has_hw_macaddr;
+
+        int naps;      /* number of AP vifs */
+        int nmeshes;   /* number of mesh vifs */
+        int nstations; /* number of station vifs */
+        int nwds;      /* number of WDS vifs */
+        int nadhocs;   /* number of adhoc vifs */
+};
+
+void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
+                               struct ieee80211_vif *vif,
+                               struct ath9k_vif_iter_data *iter_data);
+
 /*******************/
 /* Beacon Handling */
 /*******************/
@@ -387,6 +401,9 @@ struct ath_vif {
 #define ATH_DEFAULT_BMISS_LIMIT         10
 #define IEEE80211_MS_TO_TU(x)           (((x) * 1000) / 1024)
 
+#define TSF_TO_TU(_h,_l) \
+        ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
+
 struct ath_beacon_config {
         int beacon_interval;
         u16 listen_interval;
@@ -420,12 +437,10 @@ struct ath_beacon {
 };
 
 void ath9k_beacon_tasklet(unsigned long data);
-bool ath9k_allow_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
                          u32 changed);
 void ath9k_beacon_assign_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_beacon_remove_slot(struct ath_softc *sc, struct ieee80211_vif *vif);
-void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif);
 void ath9k_set_beacon(struct ath_softc *sc);
 bool ath9k_csa_is_finished(struct ath_softc *sc);
 
@@ -440,17 +455,14 @@ bool ath9k_csa_is_finished(struct ath_softc *sc);
 #define ATH_LONG_CALINTERVAL_INT  1000    /* 1000 ms */
 #define ATH_LONG_CALINTERVAL      30000   /* 30 seconds */
 #define ATH_RESTART_CALINTERVAL   1200000 /* 20 minutes */
-#define ATH_ANI_MAX_SKIP_COUNT  10
-
-#define ATH_PAPRD_TIMEOUT       100 /* msecs */
-#define ATH_PLL_WORK_INTERVAL   100
+#define ATH_ANI_MAX_SKIP_COUNT    10
+#define ATH_PAPRD_TIMEOUT         100 /* msecs */
+#define ATH_PLL_WORK_INTERVAL     100
 
 void ath_tx_complete_poll_work(struct work_struct *work);
 void ath_reset_work(struct work_struct *work);
-void ath_hw_check(struct work_struct *work);
+bool ath_hw_check(struct ath_softc *sc);
 void ath_hw_pll_work(struct work_struct *work);
-void ath_rx_poll(unsigned long data);
-void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon);
 void ath_paprd_calibrate(struct work_struct *work);
 void ath_ani_calibrate(unsigned long data);
 void ath_start_ani(struct ath_softc *sc);
@@ -459,6 +471,7 @@ void ath_check_ani(struct ath_softc *sc);
 int ath_update_survey_stats(struct ath_softc *sc);
 void ath_update_survey_nf(struct ath_softc *sc, int channel);
 void ath9k_queue_reset(struct ath_softc *sc, enum ath_reset_type type);
+void ath_ps_full_sleep(unsigned long data);
 
 /**********/
 /* BTCOEX */
@@ -476,20 +489,19 @@ enum bt_op_flags {
 };
 
 struct ath_btcoex {
-        bool hw_timer_enabled;
         spinlock_t btcoex_lock;
         struct timer_list period_timer; /* Timer for BT period */
+        struct timer_list no_stomp_timer;
         u32 bt_priority_cnt;
         unsigned long bt_priority_time;
         unsigned long op_flags;
         int bt_stomp_type; /* Types of BT stomping */
-        u32 btcoex_no_stomp; /* in usec */
+        u32 btcoex_no_stomp; /* in msec */
         u32 btcoex_period; /* in msec */
-        u32 btscan_no_stomp; /* in usec */
+        u32 btscan_no_stomp; /* in msec */
         u32 duty_cycle;
         u32 bt_wait_time;
         int rssi_count;
-        struct ath_gen_timer *no_stomp_timer; /* Timer for no BT stomping */
         struct ath_mci_profile mci;
         u8 stomp_audio;
 };
@@ -537,12 +549,6 @@ static inline int ath9k_dump_btcoex(struct ath_softc *sc, u8 *buf, u32 size)
 }
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 
-struct ath9k_wow_pattern {
-        u8 pattern_bytes[MAX_PATTERN_SIZE];
-        u8 mask_bytes[MAX_PATTERN_SIZE];
-        u32 pattern_len;
-};
-
 /********************/
 /*   LED Control    */
 /********************/
@@ -570,6 +576,40 @@ static inline void ath_fill_led_pin(struct ath_softc *sc)
 }
 #endif
 
+/************************/
+/* Wake on Wireless LAN */
+/************************/
+
+struct ath9k_wow_pattern {
+        u8 pattern_bytes[MAX_PATTERN_SIZE];
+        u8 mask_bytes[MAX_PATTERN_SIZE];
+        u32 pattern_len;
+};
+
+#ifdef CONFIG_ATH9K_WOW
+void ath9k_init_wow(struct ieee80211_hw *hw);
+int ath9k_suspend(struct ieee80211_hw *hw,
+                  struct cfg80211_wowlan *wowlan);
+int ath9k_resume(struct ieee80211_hw *hw);
+void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled);
+#else
+static inline void ath9k_init_wow(struct ieee80211_hw *hw)
+{
+}
+static inline int ath9k_suspend(struct ieee80211_hw *hw,
+                                struct cfg80211_wowlan *wowlan)
+{
+        return 0;
+}
+static inline int ath9k_resume(struct ieee80211_hw *hw)
+{
+        return 0;
+}
+static inline void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
+{
+}
+#endif /* CONFIG_ATH9K_WOW */
+
 /*******************************/
 /* Antenna diversity/combining */
 /*******************************/
@@ -642,19 +682,16 @@ void ath_ant_comb_scan(struct ath_softc *sc, struct ath_rx_status *rs);
 #define ATH9K_PCI_AR9565_1ANT     0x0080
 #define ATH9K_PCI_AR9565_2ANT     0x0100
 #define ATH9K_PCI_NO_PLL_PWRSAVE  0x0200
+#define ATH9K_PCI_KILLER          0x0400
 
 /*
  * Default cache line size, in bytes.
  * Used when PCI device not fully initialized by bootrom/BIOS
 */
 #define DEFAULT_CACHELINE       32
-#define ATH_REGCLASSIDS_MAX     10
 #define ATH_CABQ_READY_TIME     80      /* % of beacon interval */
-#define ATH_MAX_SW_RETRIES      30
-#define ATH_CHAN_MAX            255
-
 #define ATH_TXPOWER_MAX         100     /* .5 dBm units */
-#define ATH_RATE_DUMMY_MARKER   0
+#define MAX_GTT_CNT             5
 
 enum sc_op_flags {
         SC_OP_INVALID,
@@ -673,37 +710,6 @@ enum sc_op_flags {
 #define PS_BEACON_SYNC            BIT(4)
 #define PS_WAIT_FOR_ANI           BIT(5)
 
-struct ath_rate_table;
-
-struct ath9k_vif_iter_data {
-        u8 hw_macaddr[ETH_ALEN]; /* address of the first vif */
-        u8 mask[ETH_ALEN]; /* bssid mask */
-        bool has_hw_macaddr;
-
-        int naps;      /* number of AP vifs */
-        int nmeshes;   /* number of mesh vifs */
-        int nstations; /* number of station vifs */
-        int nwds;      /* number of WDS vifs */
-        int nadhocs;   /* number of adhoc vifs */
-};
-
-/* enum spectral_mode:
- *
- * @SPECTRAL_DISABLED: spectral mode is disabled
- * @SPECTRAL_BACKGROUND: hardware sends samples when it is not busy with
- *      something else.
- * @SPECTRAL_MANUAL: spectral scan is enabled, triggering for samples
- *      is performed manually.
- * @SPECTRAL_CHANSCAN: Like manual, but also triggered when changing channels
- *      during a channel scan.
- */
-enum spectral_mode {
-        SPECTRAL_DISABLED = 0,
-        SPECTRAL_BACKGROUND,
-        SPECTRAL_MANUAL,
-        SPECTRAL_CHANSCAN,
-};
-
 struct ath_softc {
         struct ieee80211_hw *hw;
         struct device *dev;
@@ -721,14 +727,14 @@ struct ath_softc {
         spinlock_t sc_pcu_lock;
         struct mutex mutex;
         struct work_struct paprd_work;
-        struct work_struct hw_check_work;
         struct work_struct hw_reset_work;
         struct completion paprd_complete;
+        wait_queue_head_t tx_wait;
 
-        unsigned int hw_busy_count;
         unsigned long sc_flags;
         unsigned long driver_data;
 
+        u8 gtt_cnt;
         u32 intrstatus;
         u16 ps_flags; /* PS_* */
         u16 curtxpow;
@@ -759,7 +765,7 @@ struct ath_softc {
         struct ath_beacon_config cur_beacon_conf;
         struct delayed_work tx_complete_work;
         struct delayed_work hw_pll_work;
-        struct timer_list rx_poll_timer;
+        struct timer_list sleep_timer;
 
 #ifdef CONFIG_ATH9K_BTCOEX_SUPPORT
         struct ath_btcoex btcoex;
@@ -784,199 +790,54 @@ struct ath_softc {
         bool tx99_state;
         s16 tx99_power;
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ATH9K_WOW
         atomic_t wow_got_bmiss_intr;
         atomic_t wow_sleep_proc_intr; /* in the middle of WoW sleep ? */
         u32 wow_intr_before_sleep;
 #endif
 };
 
-#define SPECTRAL_SCAN_BITMASK           0x10
-/* Radar info packet format, used for DFS and spectral formats. */
-struct ath_radar_info {
-        u8 pulse_length_pri;
-        u8 pulse_length_ext;
-        u8 pulse_bw_info;
-} __packed;
-
-/* The HT20 spectral data has 4 bytes of additional information at it's end.
- *
- * [7:0]: all bins {max_magnitude[1:0], bitmap_weight[5:0]}
- * [7:0]: all bins  max_magnitude[9:2]
- * [7:0]: all bins {max_index[5:0], max_magnitude[11:10]}
- * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
- */
-struct ath_ht20_mag_info {
-        u8 all_bins[3];
-        u8 max_exp;
-} __packed;
-
-#define SPECTRAL_HT20_NUM_BINS          56
-
-/* WARNING: don't actually use this struct! MAC may vary the amount of
- * data by -1/+2. This struct is for reference only.
- */
-struct ath_ht20_fft_packet {
-        u8 data[SPECTRAL_HT20_NUM_BINS];
-        struct ath_ht20_mag_info mag_info;
-        struct ath_radar_info radar_info;
-} __packed;
-
-#define SPECTRAL_HT20_TOTAL_DATA_LEN    (sizeof(struct ath_ht20_fft_packet))
-
-/* Dynamic 20/40 mode:
- *
- * [7:0]: lower bins {max_magnitude[1:0], bitmap_weight[5:0]}
- * [7:0]: lower bins  max_magnitude[9:2]
- * [7:0]: lower bins {max_index[5:0], max_magnitude[11:10]}
- * [7:0]: upper bins {max_magnitude[1:0], bitmap_weight[5:0]}
- * [7:0]: upper bins  max_magnitude[9:2]
- * [7:0]: upper bins {max_index[5:0], max_magnitude[11:10]}
- * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
- */
-struct ath_ht20_40_mag_info {
-        u8 lower_bins[3];
-        u8 upper_bins[3];
-        u8 max_exp;
-} __packed;
-
-#define SPECTRAL_HT20_40_NUM_BINS               128
-
-/* WARNING: don't actually use this struct! MAC may vary the amount of
- * data. This struct is for reference only.
- */
-struct ath_ht20_40_fft_packet {
-        u8 data[SPECTRAL_HT20_40_NUM_BINS];
-        struct ath_ht20_40_mag_info mag_info;
-        struct ath_radar_info radar_info;
-} __packed;
-
-
-#define SPECTRAL_HT20_40_TOTAL_DATA_LEN (sizeof(struct ath_ht20_40_fft_packet))
-
-/* grabs the max magnitude from the all/upper/lower bins */
-static inline u16 spectral_max_magnitude(u8 *bins)
-{
-        return (bins[0] & 0xc0) >> 6 |
-               (bins[1] & 0xff) << 2 |
-               (bins[2] & 0x03) << 10;
-}
+/********/
+/* TX99 */
+/********/
 
-/* return the max magnitude from the all/upper/lower bins */
-static inline u8 spectral_max_index(u8 *bins)
+#ifdef CONFIG_ATH9K_TX99
+void ath9k_tx99_init_debug(struct ath_softc *sc);
+int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
+                    struct ath_tx_control *txctl);
+#else
+static inline void ath9k_tx99_init_debug(struct ath_softc *sc)
 {
-        s8 m = (bins[2] & 0xfc) >> 2;
-
-        /* TODO: this still doesn't always report the right values ... */
-        if (m > 32)
-                m |= 0xe0;
-        else
-                m &= ~0xe0;
-
-        return m + 29;
 }
-
-/* return the bitmap weight from the all/upper/lower bins */
-static inline u8 spectral_bitmap_weight(u8 *bins)
+static inline int ath9k_tx99_send(struct ath_softc *sc,
+                                  struct sk_buff *skb,
+                                  struct ath_tx_control *txctl)
 {
-        return bins[0] & 0x3f;
+        return 0;
 }
-
-/* FFT sample format given to userspace via debugfs.
- *
- * Please keep the type/length at the front position and change
- * other fields after adding another sample type
- *
- * TODO: this might need rework when switching to nl80211-based
- * interface.
- */
-enum ath_fft_sample_type {
-        ATH_FFT_SAMPLE_HT20 = 1,
-        ATH_FFT_SAMPLE_HT20_40,
-};
-
-struct fft_sample_tlv {
-        u8 type;        /* see ath_fft_sample */
-        __be16 length;
-        /* type dependent data follows */
-} __packed;
-
-struct fft_sample_ht20 {
-        struct fft_sample_tlv tlv;
-
-        u8 max_exp;
-
-        __be16 freq;
-        s8 rssi;
-        s8 noise;
-
-        __be16 max_magnitude;
-        u8 max_index;
-        u8 bitmap_weight;
-
-        __be64 tsf;
-
-        u8 data[SPECTRAL_HT20_NUM_BINS];
-} __packed;
-
-struct fft_sample_ht20_40 {
-        struct fft_sample_tlv tlv;
-
-        u8 channel_type;
-        __be16 freq;
-
-        s8 lower_rssi;
-        s8 upper_rssi;
-
-        __be64 tsf;
-
-        s8 lower_noise;
-        s8 upper_noise;
-
-        __be16 lower_max_magnitude;
-        __be16 upper_max_magnitude;
-
-        u8 lower_max_index;
-        u8 upper_max_index;
-
-        u8 lower_bitmap_weight;
-        u8 upper_bitmap_weight;
-
-        u8 max_exp;
-
-        u8 data[SPECTRAL_HT20_40_NUM_BINS];
-} __packed;
-
-int ath9k_tx99_init(struct ath_softc *sc);
-void ath9k_tx99_deinit(struct ath_softc *sc);
-int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
-                    struct ath_tx_control *txctl);
-
-void ath9k_tasklet(unsigned long data);
-int ath_cabq_update(struct ath_softc *);
+#endif /* CONFIG_ATH9K_TX99 */
 
 static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 {
         common->bus_ops->read_cachesize(common, csz);
 }
 
-extern struct ieee80211_ops ath9k_ops;
-extern int ath9k_modparam_nohwcrypt;
-extern int led_blink;
-extern bool is_ath9k_unloaded;
-
+void ath9k_tasklet(unsigned long data);
+int ath_cabq_update(struct ath_softc *);
 u8 ath9k_parse_mpdudensity(u8 mpdudensity);
 irqreturn_t ath_isr(int irq, void *dev);
+int ath_reset(struct ath_softc *sc);
+void ath_cancel_work(struct ath_softc *sc);
+void ath_restart_work(struct ath_softc *sc);
 int ath9k_init_device(u16 devid, struct ath_softc *sc,
                     const struct ath_bus_ops *bus_ops);
 void ath9k_deinit_device(struct ath_softc *sc);
-void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw);
 void ath9k_reload_chainmask_settings(struct ath_softc *sc);
-
-void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
-int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
-                               enum spectral_mode spectral_mode);
-
+u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate);
+void ath_start_rfkill_poll(struct ath_softc *sc);
+void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
+void ath9k_ps_wakeup(struct ath_softc *sc);
+void ath9k_ps_restore(struct ath_softc *sc);
 
 #ifdef CONFIG_ATH9K_PCI
 int ath_pci_init(void);
@@ -994,15 +855,4 @@ static inline int ath_ahb_init(void) { return 0; };
 static inline void ath_ahb_exit(void) {};
 #endif
 
-void ath9k_ps_wakeup(struct ath_softc *sc);
-void ath9k_ps_restore(struct ath_softc *sc);
-
-u8 ath_txchainmask_reduction(struct ath_softc *sc, u8 chainmask, u32 rate);
-
-void ath_start_rfkill_poll(struct ath_softc *sc);
-void ath9k_rfkill_poll_state(struct ieee80211_hw *hw);
-void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
-                               struct ieee80211_vif *vif,
-                               struct ath9k_vif_iter_data *iter_data);
-
 #endif /* ATH9K_H */
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 17be35392bb4..2e8bba0eb361 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -274,18 +274,19 @@ static int ath9k_beacon_choose_slot(struct ath_softc *sc)
         return slot;
 }
 
-void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif)
+static void ath9k_set_tsfadjust(struct ath_softc *sc, struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_beacon_config *cur_conf = &sc->cur_beacon_conf;
         struct ath_vif *avp = (void *)vif->drv_priv;
-        u64 tsfadjust;
+        u32 tsfadjust;
 
         if (avp->av_bslot == 0)
                 return;
 
-        tsfadjust = cur_conf->beacon_interval * avp->av_bslot / ATH_BCBUF;
-        avp->tsf_adjust = cpu_to_le64(TU_TO_USEC(tsfadjust));
+        tsfadjust = cur_conf->beacon_interval * avp->av_bslot;
+        tsfadjust = TU_TO_USEC(tsfadjust) / ATH_BCBUF;
+        avp->tsf_adjust = cpu_to_le64(tsfadjust);
 
         ath_dbg(common, CONFIG, "tsfadjust is: %llu for bslot: %d\n",
                 (unsigned long long)tsfadjust, avp->av_bslot);
@@ -336,8 +337,14 @@ void ath9k_beacon_tasklet(unsigned long data)
 
                 ath9k_hw_check_nav(ah);
 
-                if (!ath9k_hw_check_alive(ah))
-                        ieee80211_queue_work(sc->hw, &sc->hw_check_work);
+                /*
+                 * If the previous beacon has not been transmitted
+                 * and a MAC/BB hang has been identified, return
+                 * here because a chip reset would have been
+                 * initiated.
+                 */
+                if (!ath_hw_check(sc))
+                        return;
 
                 if (sc->beacon.bmisscnt < BSTUCK_THRESH * sc->nbcnvifs) {
                         ath_dbg(common, BSTUCK,
@@ -431,6 +438,33 @@ static void ath9k_beacon_init(struct ath_softc *sc, u32 nexttbtt,
         ath9k_hw_enable_interrupts(ah);
 }
 
+/* Calculate the modulo of a 64 bit TSF snapshot with a TU divisor */
+static u32 ath9k_mod_tsf64_tu(u64 tsf, u32 div_tu)
+{
+        u32 tsf_mod, tsf_hi, tsf_lo, mod_hi, mod_lo;
+
+        tsf_mod = tsf & (BIT(10) - 1);
+        tsf_hi = tsf >> 32;
+        tsf_lo = ((u32) tsf) >> 10;
+
+        mod_hi = tsf_hi % div_tu;
+        mod_lo = ((mod_hi << 22) + tsf_lo) % div_tu;
+
+        return (mod_lo << 10) | tsf_mod;
+}
+
+static u32 ath9k_get_next_tbtt(struct ath_softc *sc, u64 tsf,
+                               unsigned int interval)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        unsigned int offset;
+
+        tsf += TU_TO_USEC(FUDGE + ah->config.sw_beacon_response_time);
+        offset = ath9k_mod_tsf64_tu(tsf, interval);
+
+        return (u32) tsf + TU_TO_USEC(interval) - offset;
+}
+
 /*
  * For multi-bss ap support beacons are either staggered evenly over N slots or
  * burst together.  For the former arrange for the SWBA to be delivered for each
@@ -446,7 +480,8 @@ static void ath9k_beacon_config_ap(struct ath_softc *sc,
         /* NB: the beacon interval is kept internally in TU's */
         intval = TU_TO_USEC(conf->beacon_interval);
         intval /= ATH_BCBUF;
-        nexttbtt = intval;
+        nexttbtt = ath9k_get_next_tbtt(sc, ath9k_hw_gettsf64(ah),
+                                       conf->beacon_interval);
 
         if (conf->enable_beacon)
                 ah->imask |= ATH9K_INT_SWBA;
@@ -458,7 +493,7 @@ static void ath9k_beacon_config_ap(struct ath_softc *sc,
                 (conf->enable_beacon) ? "Enable" : "Disable",
                 nexttbtt, intval, conf->beacon_interval);
 
-        ath9k_beacon_init(sc, nexttbtt, intval, true);
+        ath9k_beacon_init(sc, nexttbtt, intval, false);
 }
 
 /*
@@ -475,11 +510,9 @@ static void ath9k_beacon_config_sta(struct ath_softc *sc,
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_beacon_state bs;
-        int dtimperiod, dtimcount, sleepduration;
-        int cfpperiod, cfpcount;
-        u32 nexttbtt = 0, intval, tsftu;
+        int dtim_intval, sleepduration;
+        u32 nexttbtt = 0, intval;
         u64 tsf;
-        int num_beacons, offset, dtim_dec_count, cfp_dec_count;
 
         /* No need to configure beacon if we are not associated */
         if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
@@ -492,53 +525,25 @@ static void ath9k_beacon_config_sta(struct ath_softc *sc,
         intval = conf->beacon_interval;
 
         /*
-         * Setup dtim and cfp parameters according to
+         * Setup dtim parameters according to
          * last beacon we received (which may be none).
          */
-        dtimperiod = conf->dtim_period;
-        dtimcount = conf->dtim_count;
-        if (dtimcount >= dtimperiod)    /* NB: sanity check */
-                dtimcount = 0;
-        cfpperiod = 1;                  /* NB: no PCF support yet */
-        cfpcount = 0;
-
+        dtim_intval = intval * conf->dtim_period;
         sleepduration = conf->listen_interval * intval;
 
         /*
          * Pull nexttbtt forward to reflect the current
-         * TSF and calculate dtim+cfp state for the result.
+         * TSF and calculate dtim state for the result.
          */
         tsf = ath9k_hw_gettsf64(ah);
-        tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
-
-        num_beacons = tsftu / intval + 1;
-        offset = tsftu % intval;
-        nexttbtt = tsftu - offset;
-        if (offset)
-                nexttbtt += intval;
-
-        /* DTIM Beacon every dtimperiod Beacon */
-        dtim_dec_count = num_beacons % dtimperiod;
-        /* CFP every cfpperiod DTIM Beacon */
-        cfp_dec_count = (num_beacons / dtimperiod) % cfpperiod;
-        if (dtim_dec_count)
-                cfp_dec_count++;
-
-        dtimcount -= dtim_dec_count;
-        if (dtimcount < 0)
-                dtimcount += dtimperiod;
-
-        cfpcount -= cfp_dec_count;
-        if (cfpcount < 0)
-                cfpcount += cfpperiod;
-
-        bs.bs_intval = intval;
+        nexttbtt = ath9k_get_next_tbtt(sc, tsf, intval);
+
+        bs.bs_intval = TU_TO_USEC(intval);
+        bs.bs_dtimperiod = conf->dtim_period * bs.bs_intval;
         bs.bs_nexttbtt = nexttbtt;
-        bs.bs_dtimperiod = dtimperiod*intval;
-        bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount*intval;
-        bs.bs_cfpperiod = cfpperiod*bs.bs_dtimperiod;
-        bs.bs_cfpnext = bs.bs_nextdtim + cfpcount*bs.bs_dtimperiod;
-        bs.bs_cfpmaxduration = 0;
+        bs.bs_nextdtim = nexttbtt;
+        if (conf->dtim_period > 1)
+                bs.bs_nextdtim = ath9k_get_next_tbtt(sc, tsf, dtim_intval);
 
         /*
          * Calculate the number of consecutive beacons to miss* before taking
@@ -566,18 +571,16 @@ static void ath9k_beacon_config_sta(struct ath_softc *sc,
          * XXX fixed at 100ms
          */
 
-        bs.bs_sleepduration = roundup(IEEE80211_MS_TO_TU(100), sleepduration);
+        bs.bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
+                                                 sleepduration));
         if (bs.bs_sleepduration > bs.bs_dtimperiod)
                 bs.bs_sleepduration = bs.bs_dtimperiod;
 
         /* TSF out of range threshold fixed at 1 second */
         bs.bs_tsfoor_threshold = ATH9K_TSFOOR_THRESHOLD;
 
-        ath_dbg(common, BEACON, "tsf: %llu tsftu: %u\n", tsf, tsftu);
-        ath_dbg(common, BEACON,
-                "bmiss: %u sleep: %u cfp-period: %u maxdur: %u next: %u\n",
-                bs.bs_bmissthreshold, bs.bs_sleepduration,
-                bs.bs_cfpperiod, bs.bs_cfpmaxduration, bs.bs_cfpnext);
+        ath_dbg(common, BEACON, "bmiss: %u sleep: %u\n",
+                bs.bs_bmissthreshold, bs.bs_sleepduration);
 
         /* Set the computed STA beacon timers */
 
@@ -600,25 +603,11 @@ static void ath9k_beacon_config_adhoc(struct ath_softc *sc,
 
         intval = TU_TO_USEC(conf->beacon_interval);
 
-        if (conf->ibss_creator) {
+        if (conf->ibss_creator)
                 nexttbtt = intval;
-        } else {
-                u32 tbtt, offset, tsftu;
-                u64 tsf;
-
-                /*
-                 * Pull nexttbtt forward to reflect the current
-                 * sync'd TSF.
-                 */
-                tsf = ath9k_hw_gettsf64(ah);
-                tsftu = TSF_TO_TU(tsf >> 32, tsf) + FUDGE;
-                offset = tsftu % conf->beacon_interval;
-                tbtt = tsftu - offset;
-                if (offset)
-                        tbtt += conf->beacon_interval;
-
-                nexttbtt = TU_TO_USEC(tbtt);
-        }
+        else
+                nexttbtt = ath9k_get_next_tbtt(sc, ath9k_hw_gettsf64(ah),
+                                               conf->beacon_interval);
 
         if (conf->enable_beacon)
                 ah->imask |= ATH9K_INT_SWBA;
@@ -640,7 +629,8 @@ static void ath9k_beacon_config_adhoc(struct ath_softc *sc,
                 set_bit(SC_OP_BEACONS, &sc->sc_flags);
 }
 
-bool ath9k_allow_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
+static bool ath9k_allow_beacon_config(struct ath_softc *sc,
+                                      struct ieee80211_vif *vif)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ath_vif *avp = (void *)vif->drv_priv;
@@ -711,12 +701,17 @@ void ath9k_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif,
         unsigned long flags;
         bool skip_beacon = false;
 
+        if (vif->type == NL80211_IFTYPE_AP)
+                ath9k_set_tsfadjust(sc, vif);
+
+        if (!ath9k_allow_beacon_config(sc, vif))
+                return;
+
         if (sc->sc_ah->opmode == NL80211_IFTYPE_STATION) {
                 ath9k_cache_beacon_config(sc, bss_conf);
                 ath9k_set_beacon(sc);
                 set_bit(SC_OP_BEACONS, &sc->sc_flags);
                 return;
-
         }
 
         /*
diff --git a/drivers/net/wireless/ath/ath9k/btcoex.c b/drivers/net/wireless/ath/ath9k/btcoex.c
index 9963b0bf9f72..3dfc2c7f1f07 100644
--- a/drivers/net/wireless/ath/ath9k/btcoex.c
+++ b/drivers/net/wireless/ath/ath9k/btcoex.c
@@ -66,7 +66,6 @@ void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum)
                 .bt_first_slot_time = 5,
                 .bt_hold_rx_clear = true,
         };
-        u32 i, idx;
         bool rxclear_polarity = ath_bt_config.bt_rxclear_polarity;
 
         if (AR_SREV_9300_20_OR_LATER(ah))
@@ -88,11 +87,6 @@ void ath9k_hw_init_btcoex_hw(struct ath_hw *ah, int qnum)
                 SM(ath_bt_config.bt_hold_rx_clear, AR_BT_HOLD_RX_CLEAR) |
                 SM(ATH_BTCOEX_BMISS_THRESH, AR_BT_BCN_MISS_THRESH) |
                 AR_BT_DISABLE_BT_ANT;
-
-        for (i = 0; i < 32; i++) {
-                idx = (debruijn32 << i) >> 27;
-                ah->hw_gen_timers.gen_timer_index[idx] = i;
-        }
 }
 EXPORT_SYMBOL(ath9k_hw_init_btcoex_hw);
 
diff --git a/drivers/net/wireless/ath/ath9k/common.c b/drivers/net/wireless/ath/ath9k/common.c
index a7e5a05b2eff..768c733cad31 100644
--- a/drivers/net/wireless/ath/ath9k/common.c
+++ b/drivers/net/wireless/ath/ath9k/common.c
@@ -98,10 +98,8 @@ struct ath9k_channel *ath9k_cmn_get_channel(struct ieee80211_hw *hw,
 {
         struct ieee80211_channel *curchan = chandef->chan;
         struct ath9k_channel *channel;
-        u8 chan_idx;
 
-        chan_idx = curchan->hw_value;
-        channel = &ah->channels[chan_idx];
+        channel = &ah->channels[curchan->hw_value];
         ath9k_cmn_update_ichannel(channel, chandef);
 
         return channel;
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 83a2c59f680b..ab7264c1d8f7 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -17,7 +17,6 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/export.h>
-#include <linux/relay.h>
 #include <asm/unaligned.h>
 
 #include "ath9k.h"
@@ -27,6 +26,47 @@
 #define REG_READ_D(_ah, _reg) \
         ath9k_hw_common(_ah)->ops->read((_ah), (_reg))
 
+void ath9k_debug_sync_cause(struct ath_softc *sc, u32 sync_cause)
+{
+        if (sync_cause)
+                sc->debug.stats.istats.sync_cause_all++;
+        if (sync_cause & AR_INTR_SYNC_RTC_IRQ)
+                sc->debug.stats.istats.sync_rtc_irq++;
+        if (sync_cause & AR_INTR_SYNC_MAC_IRQ)
+                sc->debug.stats.istats.sync_mac_irq++;
+        if (sync_cause & AR_INTR_SYNC_EEPROM_ILLEGAL_ACCESS)
+                sc->debug.stats.istats.eeprom_illegal_access++;
+        if (sync_cause & AR_INTR_SYNC_APB_TIMEOUT)
+                sc->debug.stats.istats.apb_timeout++;
+        if (sync_cause & AR_INTR_SYNC_PCI_MODE_CONFLICT)
+                sc->debug.stats.istats.pci_mode_conflict++;
+        if (sync_cause & AR_INTR_SYNC_HOST1_FATAL)
+                sc->debug.stats.istats.host1_fatal++;
+        if (sync_cause & AR_INTR_SYNC_HOST1_PERR)
+                sc->debug.stats.istats.host1_perr++;
+        if (sync_cause & AR_INTR_SYNC_TRCV_FIFO_PERR)
+                sc->debug.stats.istats.trcv_fifo_perr++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_EP)
+                sc->debug.stats.istats.radm_cpl_ep++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_DLLP_ABORT)
+                sc->debug.stats.istats.radm_cpl_dllp_abort++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TLP_ABORT)
+                sc->debug.stats.istats.radm_cpl_tlp_abort++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_ECRC_ERR)
+                sc->debug.stats.istats.radm_cpl_ecrc_err++;
+        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT)
+                sc->debug.stats.istats.radm_cpl_timeout++;
+        if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT)
+                sc->debug.stats.istats.local_timeout++;
+        if (sync_cause & AR_INTR_SYNC_PM_ACCESS)
+                sc->debug.stats.istats.pm_access++;
+        if (sync_cause & AR_INTR_SYNC_MAC_AWAKE)
+                sc->debug.stats.istats.mac_awake++;
+        if (sync_cause & AR_INTR_SYNC_MAC_ASLEEP)
+                sc->debug.stats.istats.mac_asleep++;
+        if (sync_cause & AR_INTR_SYNC_MAC_SLEEP_ACCESS)
+                sc->debug.stats.istats.mac_sleep_access++;
+}
 
 static ssize_t ath9k_debugfs_read_buf(struct file *file, char __user *user_buf,
                                       size_t count, loff_t *ppos)
@@ -903,14 +943,10 @@ static const struct file_operations fops_reset = {
 static ssize_t read_file_recv(struct file *file, char __user *user_buf,
                               size_t count, loff_t *ppos)
 {
-#define PHY_ERR(s, p) \
-        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
-                         sc->debug.stats.rxstats.phy_err_stats[p]);
-
 #define RXS_ERR(s, e)                                       \
         do {                                                \
                 len += scnprintf(buf + len, size - len,     \
-                                 "%22s : %10u\n", s,        \
+                                 "%18s : %10u\n", s,        \
                                  sc->debug.stats.rxstats.e);\
         } while (0)
 
@@ -923,6 +959,12 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         if (buf == NULL)
                 return -ENOMEM;
 
+        RXS_ERR("PKTS-ALL", rx_pkts_all);
+        RXS_ERR("BYTES-ALL", rx_bytes_all);
+        RXS_ERR("BEACONS", rx_beacons);
+        RXS_ERR("FRAGS", rx_frags);
+        RXS_ERR("SPECTRAL", rx_spectral);
+
         RXS_ERR("CRC ERR", crc_err);
         RXS_ERR("DECRYPT CRC ERR", decrypt_crc_err);
         RXS_ERR("PHY ERR", phy_err);
@@ -930,43 +972,10 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("PRE-DELIM CRC ERR", pre_delim_crc_err);
         RXS_ERR("POST-DELIM CRC ERR", post_delim_crc_err);
         RXS_ERR("DECRYPT BUSY ERR", decrypt_busy_err);
-        RXS_ERR("RX-LENGTH-ERR", rx_len_err);
-        RXS_ERR("RX-OOM-ERR", rx_oom_err);
-        RXS_ERR("RX-RATE-ERR", rx_rate_err);
-        RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
-
-        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
-        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
-        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
-        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
-        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
-        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
-        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
-        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
-        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
-        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
-        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
-        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
-        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
-        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
-        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
-        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
-        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
-        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
-        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
-        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
-        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
-        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
-        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
-        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
-        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
-        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
-
-        RXS_ERR("RX-Pkts-All", rx_pkts_all);
-        RXS_ERR("RX-Bytes-All", rx_bytes_all);
-        RXS_ERR("RX-Beacons", rx_beacons);
-        RXS_ERR("RX-Frags", rx_frags);
-        RXS_ERR("RX-Spectral", rx_spectral);
+        RXS_ERR("LENGTH-ERR", rx_len_err);
+        RXS_ERR("OOM-ERR", rx_oom_err);
+        RXS_ERR("RATE-ERR", rx_rate_err);
+        RXS_ERR("TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         if (len > size)
                 len = size;
@@ -977,7 +986,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         return retval;
 
 #undef RXS_ERR
-#undef PHY_ERR
 }
 
 void ath_debug_stat_rx(struct ath_softc *sc, struct ath_rx_status *rs)
@@ -1016,293 +1024,67 @@ static const struct file_operations fops_recv = {
         .llseek = default_llseek,
 };
 
-static ssize_t read_file_spec_scan_ctl(struct file *file, char __user *user_buf,
-                                       size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char *mode = "";
-        unsigned int len;
-
-        switch (sc->spectral_mode) {
-        case SPECTRAL_DISABLED:
-                mode = "disable";
-                break;
-        case SPECTRAL_BACKGROUND:
-                mode = "background";
-                break;
-        case SPECTRAL_CHANSCAN:
-                mode = "chanscan";
-                break;
-        case SPECTRAL_MANUAL:
-                mode = "manual";
-                break;
-        }
-        len = strlen(mode);
-        return simple_read_from_buffer(user_buf, count, ppos, mode, len);
-}
-
-static ssize_t write_file_spec_scan_ctl(struct file *file,
-                                        const char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        char buf[32];
-        ssize_t len;
-
-        if (config_enabled(CONFIG_ATH9K_TX99))
-                return -EOPNOTSUPP;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-
-        if (strncmp("trigger", buf, 7) == 0) {
-                ath9k_spectral_scan_trigger(sc->hw);
-        } else if (strncmp("background", buf, 9) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_BACKGROUND);
-                ath_dbg(common, CONFIG, "spectral scan: background mode enabled\n");
-        } else if (strncmp("chanscan", buf, 8) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_CHANSCAN);
-                ath_dbg(common, CONFIG, "spectral scan: channel scan mode enabled\n");
-        } else if (strncmp("manual", buf, 6) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_MANUAL);
-                ath_dbg(common, CONFIG, "spectral scan: manual mode enabled\n");
-        } else if (strncmp("disable", buf, 7) == 0) {
-                ath9k_spectral_scan_config(sc->hw, SPECTRAL_DISABLED);
-                ath_dbg(common, CONFIG, "spectral scan: disabled\n");
-        } else {
-                return -EINVAL;
-        }
-
-        return count;
-}
-
-static const struct file_operations fops_spec_scan_ctl = {
-        .read = read_file_spec_scan_ctl,
-        .write = write_file_spec_scan_ctl,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_spectral_short_repeat(struct file *file,
-                                               char __user *user_buf,
-                                               size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "%d\n", sc->spec_config.short_repeat);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_spectral_short_repeat(struct file *file,
-                                                const char __user *user_buf,
-                                                size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        unsigned long val;
-        char buf[32];
-        ssize_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &val))
-                return -EINVAL;
-
-        if (val < 0 || val > 1)
-                return -EINVAL;
-
-        sc->spec_config.short_repeat = val;
-        return count;
-}
-
-static const struct file_operations fops_spectral_short_repeat = {
-        .read = read_file_spectral_short_repeat,
-        .write = write_file_spectral_short_repeat,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_spectral_count(struct file *file,
-                                        char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "%d\n", sc->spec_config.count);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_spectral_count(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
+static ssize_t read_file_phy_err(struct file *file, char __user *user_buf,
+                                 size_t count, loff_t *ppos)
 {
-        struct ath_softc *sc = file->private_data;
-        unsigned long val;
-        char buf[32];
-        ssize_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &val))
-                return -EINVAL;
-
-        if (val < 0 || val > 255)
-                return -EINVAL;
-
-        sc->spec_config.count = val;
-        return count;
-}
-
-static const struct file_operations fops_spectral_count = {
-        .read = read_file_spectral_count,
-        .write = write_file_spectral_count,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_spectral_period(struct file *file,
-                                         char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "%d\n", sc->spec_config.period);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_spectral_period(struct file *file,
-                                          const char __user *user_buf,
-                                          size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        unsigned long val;
-        char buf[32];
-        ssize_t len;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &val))
-                return -EINVAL;
-
-        if (val < 0 || val > 255)
-                return -EINVAL;
-
-        sc->spec_config.period = val;
-        return count;
-}
-
-static const struct file_operations fops_spectral_period = {
-        .read = read_file_spectral_period,
-        .write = write_file_spectral_period,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
+#define PHY_ERR(s, p) \
+        len += scnprintf(buf + len, size - len, "%22s : %10u\n", s, \
+                         sc->debug.stats.rxstats.phy_err_stats[p]);
 
-static ssize_t read_file_spectral_fft_period(struct file *file,
-                                             char __user *user_buf,
-                                             size_t count, loff_t *ppos)
-{
         struct ath_softc *sc = file->private_data;
-        char buf[32];
-        unsigned int len;
+        char *buf;
+        unsigned int len = 0, size = 1600;
+        ssize_t retval = 0;
 
-        len = sprintf(buf, "%d\n", sc->spec_config.fft_period);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
 
-static ssize_t write_file_spectral_fft_period(struct file *file,
-                                              const char __user *user_buf,
-                                              size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        unsigned long val;
-        char buf[32];
-        ssize_t len;
+        PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
+        PHY_ERR("TIMING ERR", ATH9K_PHYERR_TIMING);
+        PHY_ERR("PARITY ERR", ATH9K_PHYERR_PARITY);
+        PHY_ERR("RATE ERR", ATH9K_PHYERR_RATE);
+        PHY_ERR("LENGTH ERR", ATH9K_PHYERR_LENGTH);
+        PHY_ERR("RADAR ERR", ATH9K_PHYERR_RADAR);
+        PHY_ERR("SERVICE ERR", ATH9K_PHYERR_SERVICE);
+        PHY_ERR("TOR ERR", ATH9K_PHYERR_TOR);
+        PHY_ERR("OFDM-TIMING ERR", ATH9K_PHYERR_OFDM_TIMING);
+        PHY_ERR("OFDM-SIGNAL-PARITY ERR", ATH9K_PHYERR_OFDM_SIGNAL_PARITY);
+        PHY_ERR("OFDM-RATE ERR", ATH9K_PHYERR_OFDM_RATE_ILLEGAL);
+        PHY_ERR("OFDM-LENGTH ERR", ATH9K_PHYERR_OFDM_LENGTH_ILLEGAL);
+        PHY_ERR("OFDM-POWER-DROP ERR", ATH9K_PHYERR_OFDM_POWER_DROP);
+        PHY_ERR("OFDM-SERVICE ERR", ATH9K_PHYERR_OFDM_SERVICE);
+        PHY_ERR("OFDM-RESTART ERR", ATH9K_PHYERR_OFDM_RESTART);
+        PHY_ERR("FALSE-RADAR-EXT ERR", ATH9K_PHYERR_FALSE_RADAR_EXT);
+        PHY_ERR("CCK-TIMING ERR", ATH9K_PHYERR_CCK_TIMING);
+        PHY_ERR("CCK-HEADER-CRC ERR", ATH9K_PHYERR_CCK_HEADER_CRC);
+        PHY_ERR("CCK-RATE ERR", ATH9K_PHYERR_CCK_RATE_ILLEGAL);
+        PHY_ERR("CCK-SERVICE ERR", ATH9K_PHYERR_CCK_SERVICE);
+        PHY_ERR("CCK-RESTART ERR", ATH9K_PHYERR_CCK_RESTART);
+        PHY_ERR("CCK-LENGTH ERR", ATH9K_PHYERR_CCK_LENGTH_ILLEGAL);
+        PHY_ERR("CCK-POWER-DROP ERR", ATH9K_PHYERR_CCK_POWER_DROP);
+        PHY_ERR("HT-CRC ERR", ATH9K_PHYERR_HT_CRC_ERROR);
+        PHY_ERR("HT-LENGTH ERR", ATH9K_PHYERR_HT_LENGTH_ILLEGAL);
+        PHY_ERR("HT-RATE ERR", ATH9K_PHYERR_HT_RATE_ILLEGAL);
 
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
+        if (len > size)
+                len = size;
 
-        buf[len] = '\0';
-        if (kstrtoul(buf, 0, &val))
-                return -EINVAL;
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
 
-        if (val < 0 || val > 15)
-                return -EINVAL;
+        return retval;
 
-        sc->spec_config.fft_period = val;
-        return count;
+#undef PHY_ERR
 }
 
-static const struct file_operations fops_spectral_fft_period = {
-        .read = read_file_spectral_fft_period,
-        .write = write_file_spectral_fft_period,
+static const struct file_operations fops_phy_err = {
+        .read = read_file_phy_err,
         .open = simple_open,
         .owner = THIS_MODULE,
         .llseek = default_llseek,
 };
 
-static struct dentry *create_buf_file_handler(const char *filename,
-                                              struct dentry *parent,
-                                              umode_t mode,
-                                              struct rchan_buf *buf,
-                                              int *is_global)
-{
-        struct dentry *buf_file;
-
-        buf_file = debugfs_create_file(filename, mode, parent, buf,
-                                       &relay_file_operations);
-        *is_global = 1;
-        return buf_file;
-}
-
-static int remove_buf_file_handler(struct dentry *dentry)
-{
-        debugfs_remove(dentry);
-
-        return 0;
-}
-
-void ath_debug_send_fft_sample(struct ath_softc *sc,
-                               struct fft_sample_tlv *fft_sample_tlv)
-{
-        int length;
-        if (!sc->rfs_chan_spec_scan)
-                return;
-
-        length = __be16_to_cpu(fft_sample_tlv->length) +
-                 sizeof(*fft_sample_tlv);
-        relay_write(sc->rfs_chan_spec_scan, fft_sample_tlv, length);
-}
-
-static struct rchan_callbacks rfs_spec_scan_cb = {
-        .create_buf_file = create_buf_file_handler,
-        .remove_buf_file = remove_buf_file_handler,
-};
-
-
 static ssize_t read_file_regidx(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
@@ -1569,86 +1351,6 @@ static const struct file_operations fops_btcoex = {
 };
 #endif
 
-static ssize_t read_file_node_stat(struct file *file, char __user *user_buf,
-                                   size_t count, loff_t *ppos)
-{
-        struct ath_node *an = file->private_data;
-        struct ath_softc *sc = an->sc;
-        struct ath_atx_tid *tid;
-        struct ath_atx_ac *ac;
-        struct ath_txq *txq;
-        u32 len = 0, size = 4096;
-        char *buf;
-        size_t retval;
-        int tidno, acno;
-
-        buf = kzalloc(size, GFP_KERNEL);
-        if (buf == NULL)
-                return -ENOMEM;
-
-        if (!an->sta->ht_cap.ht_supported) {
-                len = scnprintf(buf, size, "%s\n",
-                                "HT not supported");
-                goto exit;
-        }
-
-        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
-                        an->maxampdu);
-        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
-                         an->mpdudensity);
-
-        len += scnprintf(buf + len, size - len,
-                         "%2s%7s\n", "AC", "SCHED");
-
-        for (acno = 0, ac = &an->ac[acno];
-             acno < IEEE80211_NUM_ACS; acno++, ac++) {
-                txq = ac->txq;
-                ath_txq_lock(sc, txq);
-                len += scnprintf(buf + len, size - len,
-                                 "%2d%7d\n",
-                                 acno, ac->sched);
-                ath_txq_unlock(sc, txq);
-        }
-
-        len += scnprintf(buf + len, size - len,
-                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
-                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
-                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
-
-        for (tidno = 0, tid = &an->tid[tidno];
-             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
-                txq = tid->ac->txq;
-                ath_txq_lock(sc, txq);
-                len += scnprintf(buf + len, size - len,
-                                 "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
-                                 tid->tidno, tid->seq_start, tid->seq_next,
-                                 tid->baw_size, tid->baw_head, tid->baw_tail,
-                                 tid->bar_index, tid->sched, tid->paused);
-                ath_txq_unlock(sc, txq);
-        }
-exit:
-        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
-        kfree(buf);
-
-        return retval;
-}
-
-static const struct file_operations fops_node_stat = {
-        .read = read_file_node_stat,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
-                           struct ieee80211_vif *vif,
-                           struct ieee80211_sta *sta,
-                           struct dentry *dir)
-{
-        struct ath_node *an = (struct ath_node *)sta->drv_priv;
-        debugfs_create_file("node_stat", S_IRUGO, dir, an, &fops_node_stat);
-}
-
 /* Ethtool support for get-stats */
 
 #define AMKSTR(nm) #nm "_BE", #nm "_BK", #nm "_VI", #nm "_VO"
@@ -1772,117 +1474,9 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,
 
 void ath9k_deinit_debug(struct ath_softc *sc)
 {
-        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && sc->rfs_chan_spec_scan) {
-                relay_close(sc->rfs_chan_spec_scan);
-                sc->rfs_chan_spec_scan = NULL;
-        }
-}
-
-static ssize_t read_file_tx99(struct file *file, char __user *user_buf,
-                              size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[3];
-        unsigned int len;
-
-        len = sprintf(buf, "%d\n", sc->tx99_state);
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
-}
-
-static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
-                               size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        char buf[32];
-        bool start;
-        ssize_t len;
-        int r;
-
-        if (sc->nvifs > 1)
-                return -EOPNOTSUPP;
-
-        len = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, len))
-                return -EFAULT;
-
-        if (strtobool(buf, &start))
-                return -EINVAL;
-
-        if (start == sc->tx99_state) {
-                if (!start)
-                        return count;
-                ath_dbg(common, XMIT, "Resetting TX99\n");
-                ath9k_tx99_deinit(sc);
-        }
-
-        if (!start) {
-                ath9k_tx99_deinit(sc);
-                return count;
-        }
-
-        r = ath9k_tx99_init(sc);
-        if (r)
-                return r;
-
-        return count;
-}
-
-static const struct file_operations fops_tx99 = {
-        .read = read_file_tx99,
-        .write = write_file_tx99,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
-static ssize_t read_file_tx99_power(struct file *file,
-                                    char __user *user_buf,
-                                    size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        char buf[32];
-        unsigned int len;
-
-        len = sprintf(buf, "%d (%d dBm)\n",
-                      sc->tx99_power,
-                      sc->tx99_power / 2);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        ath9k_spectral_deinit_debug(sc);
 }
 
-static ssize_t write_file_tx99_power(struct file *file,
-                                     const char __user *user_buf,
-                                     size_t count, loff_t *ppos)
-{
-        struct ath_softc *sc = file->private_data;
-        int r;
-        u8 tx_power;
-
-        r = kstrtou8_from_user(user_buf, count, 0, &tx_power);
-        if (r)
-                return r;
-
-        if (tx_power > MAX_RATE_POWER)
-                return -EINVAL;
-
-        sc->tx99_power = tx_power;
-
-        ath9k_ps_wakeup(sc);
-        ath9k_hw_tx99_set_txpower(sc->sc_ah, sc->tx99_power);
-        ath9k_ps_restore(sc);
-
-        return count;
-}
-
-static const struct file_operations fops_tx99_power = {
-        .read = read_file_tx99_power,
-        .write = write_file_tx99_power,
-        .open = simple_open,
-        .owner = THIS_MODULE,
-        .llseek = default_llseek,
-};
-
 int ath9k_init_debug(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1899,6 +1493,8 @@ int ath9k_init_debug(struct ath_hw *ah)
 #endif
 
         ath9k_dfs_init_debug(sc);
+        ath9k_tx99_init_debug(sc);
+        ath9k_spectral_init_debug(sc);
 
         debugfs_create_file("dma", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_dma);
@@ -1922,6 +1518,8 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_reset);
         debugfs_create_file("recv", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_recv);
+        debugfs_create_file("phy_err", S_IRUSR, sc->debug.debugfs_phy, sc,
+                            &fops_phy_err);
         debugfs_create_u8("rx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
                           &ah->rxchainmask);
         debugfs_create_u8("tx_chainmask", S_IRUSR, sc->debug.debugfs_phy,
@@ -1945,23 +1543,6 @@ int ath9k_init_debug(struct ath_hw *ah)
                             &fops_base_eeprom);
         debugfs_create_file("modal_eeprom", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_modal_eeprom);
-        sc->rfs_chan_spec_scan = relay_open("spectral_scan",
-                                            sc->debug.debugfs_phy,
-                                            1024, 256, &rfs_spec_scan_cb,
-                                            NULL);
-        debugfs_create_file("spectral_scan_ctl", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
-                            &fops_spec_scan_ctl);
-        debugfs_create_file("spectral_short_repeat", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
-                            &fops_spectral_short_repeat);
-        debugfs_create_file("spectral_count", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc, &fops_spectral_count);
-        debugfs_create_file("spectral_period", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc, &fops_spectral_period);
-        debugfs_create_file("spectral_fft_period", S_IRUSR | S_IWUSR,
-                            sc->debug.debugfs_phy, sc,
-                            &fops_spectral_fft_period);
         debugfs_create_u32("gpio_mask", S_IRUSR | S_IWUSR,
                            sc->debug.debugfs_phy, &sc->sc_ah->gpio_mask);
         debugfs_create_u32("gpio_val", S_IRUSR | S_IWUSR,
@@ -1974,15 +1555,6 @@ int ath9k_init_debug(struct ath_hw *ah)
         debugfs_create_file("btcoex", S_IRUSR, sc->debug.debugfs_phy, sc,
                             &fops_btcoex);
 #endif
-        if (config_enabled(CONFIG_ATH9K_TX99) &&
-            AR_SREV_9300_20_OR_LATER(ah)) {
-                debugfs_create_file("tx99", S_IRUSR | S_IWUSR,
-                                    sc->debug.debugfs_phy, sc,
-                                    &fops_tx99);
-                debugfs_create_file("tx99_power", S_IRUSR | S_IWUSR,
-                                    sc->debug.debugfs_phy, sc,
-                                    &fops_tx99_power);
-        }
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index d6e3fa4299a4..cc7a025d833e 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -27,11 +27,13 @@ struct fft_sample_tlv;
 
 #ifdef CONFIG_ATH9K_DEBUGFS
 #define TX_STAT_INC(q, c) sc->debug.stats.txstats[q].c++
+#define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
 #define RESET_STAT_INC(sc, type) sc->debug.stats.reset[type]++
 #define ANT_STAT_INC(i, c) sc->debug.stats.ant_stats[i].c++
 #define ANT_LNA_INC(i, c) sc->debug.stats.ant_stats[i].lna_recv_cnt[c]++;
 #else
 #define TX_STAT_INC(q, c) do { } while (0)
+#define RX_STAT_INC(c)
 #define RESET_STAT_INC(sc, type) do { } while (0)
 #define ANT_STAT_INC(i, c) do { } while (0)
 #define ANT_LNA_INC(i, c) do { } while (0)
@@ -42,6 +44,7 @@ enum ath_reset_type {
         RESET_TYPE_BB_WATCHDOG,
         RESET_TYPE_FATAL_INT,
         RESET_TYPE_TX_ERROR,
+        RESET_TYPE_TX_GTT,
         RESET_TYPE_TX_HANG,
         RESET_TYPE_PLL_HANG,
         RESET_TYPE_MAC_HANG,
@@ -201,7 +204,23 @@ struct ath_tx_stats {
                                  TXSTATS[PR_QNUM(IEEE80211_AC_VO)].elem); \
         } while(0)
 
-#define RX_STAT_INC(c) (sc->debug.stats.rxstats.c++)
+struct ath_rx_rate_stats {
+        struct {
+                u32 ht20_cnt;
+                u32 ht40_cnt;
+                u32 sgi_cnt;
+                u32 lgi_cnt;
+        } ht_stats[24];
+
+        struct {
+                u32 ofdm_cnt;
+        } ofdm_stats[8];
+
+        struct {
+                u32 cck_lp_cnt;
+                u32 cck_sp_cnt;
+        } cck_stats[4];
+};
 
 /**
  * struct ath_rx_stats - RX Statistics
@@ -292,14 +311,12 @@ void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
                            struct ieee80211_vif *vif,
                            struct ieee80211_sta *sta,
                            struct dentry *dir);
-void ath_debug_send_fft_sample(struct ath_softc *sc,
-                               struct fft_sample_tlv *fft_sample);
 void ath9k_debug_stat_ant(struct ath_softc *sc,
                           struct ath_hw_antcomb_conf *div_ant_conf,
                           int main_rssi_avg, int alt_rssi_avg);
-#else
+void ath9k_debug_sync_cause(struct ath_softc *sc, u32 sync_cause);
 
-#define RX_STAT_INC(c) /* NOP */
+#else
 
 static inline int ath9k_init_debug(struct ath_hw *ah)
 {
@@ -331,6 +348,23 @@ static inline void ath9k_debug_stat_ant(struct ath_softc *sc,
 
 }
 
+static inline void
+ath9k_debug_sync_cause(struct ath_softc *sc, u32 sync_cause)
+{
+}
+
 #endif /* CONFIG_ATH9K_DEBUGFS */
 
+#ifdef CONFIG_ATH9K_STATION_STATISTICS
+void ath_debug_rate_stats(struct ath_softc *sc,
+                          struct ath_rx_status *rs,
+                          struct sk_buff *skb);
+#else
+static inline void ath_debug_rate_stats(struct ath_softc *sc,
+                                        struct ath_rx_status *rs,
+                                        struct sk_buff *skb)
+{
+}
+#endif /* CONFIG_ATH9K_STATION_STATISTICS */
+
 #endif /* DEBUG_H */
diff --git a/drivers/net/wireless/ath/ath9k/debug_sta.c b/drivers/net/wireless/ath/ath9k/debug_sta.c
new file mode 100644
index 000000000000..d76e6e0120d2
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/debug_sta.c
@@ -0,0 +1,269 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+/*************/
+/* node_aggr */
+/*************/
+
+static ssize_t read_file_node_aggr(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath_node *an = file->private_data;
+        struct ath_softc *sc = an->sc;
+        struct ath_atx_tid *tid;
+        struct ath_atx_ac *ac;
+        struct ath_txq *txq;
+        u32 len = 0, size = 4096;
+        char *buf;
+        size_t retval;
+        int tidno, acno;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        if (!an->sta->ht_cap.ht_supported) {
+                len = scnprintf(buf, size, "%s\n",
+                                "HT not supported");
+                goto exit;
+        }
+
+        len = scnprintf(buf, size, "Max-AMPDU: %d\n",
+                        an->maxampdu);
+        len += scnprintf(buf + len, size - len, "MPDU Density: %d\n\n",
+                         an->mpdudensity);
+
+        len += scnprintf(buf + len, size - len,
+                         "%2s%7s\n", "AC", "SCHED");
+
+        for (acno = 0, ac = &an->ac[acno];
+             acno < IEEE80211_NUM_ACS; acno++, ac++) {
+                txq = ac->txq;
+                ath_txq_lock(sc, txq);
+                len += scnprintf(buf + len, size - len,
+                                 "%2d%7d\n",
+                                 acno, ac->sched);
+                ath_txq_unlock(sc, txq);
+        }
+
+        len += scnprintf(buf + len, size - len,
+                         "\n%3s%11s%10s%10s%10s%10s%9s%6s%8s\n",
+                         "TID", "SEQ_START", "SEQ_NEXT", "BAW_SIZE",
+                         "BAW_HEAD", "BAW_TAIL", "BAR_IDX", "SCHED", "PAUSED");
+
+        for (tidno = 0, tid = &an->tid[tidno];
+             tidno < IEEE80211_NUM_TIDS; tidno++, tid++) {
+                txq = tid->ac->txq;
+                ath_txq_lock(sc, txq);
+                if (tid->active) {
+                        len += scnprintf(buf + len, size - len,
+                                         "%3d%11d%10d%10d%10d%10d%9d%6d%8d\n",
+                                         tid->tidno,
+                                         tid->seq_start,
+                                         tid->seq_next,
+                                         tid->baw_size,
+                                         tid->baw_head,
+                                         tid->baw_tail,
+                                         tid->bar_index,
+                                         tid->sched,
+                                         tid->paused);
+                }
+                ath_txq_unlock(sc, txq);
+        }
+exit:
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+static const struct file_operations fops_node_aggr = {
+        .read = read_file_node_aggr,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/*************/
+/* node_recv */
+/*************/
+
+void ath_debug_rate_stats(struct ath_softc *sc,
+                          struct ath_rx_status *rs,
+                          struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ieee80211_rx_status *rxs;
+        struct ath_rx_rate_stats *rstats;
+        struct ieee80211_sta *sta;
+        struct ath_node *an;
+
+        if (!ieee80211_is_data(hdr->frame_control))
+                return;
+
+        rcu_read_lock();
+
+        sta = ieee80211_find_sta_by_ifaddr(sc->hw, hdr->addr2, NULL);
+        if (!sta)
+                goto exit;
+
+        an = (struct ath_node *) sta->drv_priv;
+        rstats = &an->rx_rate_stats;
+        rxs = IEEE80211_SKB_RXCB(skb);
+
+        if (IS_HT_RATE(rs->rs_rate)) {
+                if (rxs->rate_idx >= ARRAY_SIZE(rstats->ht_stats))
+                        goto exit;
+
+                if (rxs->flag & RX_FLAG_40MHZ)
+                        rstats->ht_stats[rxs->rate_idx].ht40_cnt++;
+                else
+                        rstats->ht_stats[rxs->rate_idx].ht20_cnt++;
+
+                if (rxs->flag & RX_FLAG_SHORT_GI)
+                        rstats->ht_stats[rxs->rate_idx].sgi_cnt++;
+                else
+                        rstats->ht_stats[rxs->rate_idx].lgi_cnt++;
+
+                goto exit;
+        }
+
+        if (IS_CCK_RATE(rs->rs_rate)) {
+                if (rxs->flag & RX_FLAG_SHORTPRE)
+                        rstats->cck_stats[rxs->rate_idx].cck_sp_cnt++;
+                else
+                        rstats->cck_stats[rxs->rate_idx].cck_lp_cnt++;
+
+                goto exit;
+        }
+
+        if (IS_OFDM_RATE(rs->rs_rate)) {
+                if (ah->curchan->chan->band == IEEE80211_BAND_2GHZ)
+                        rstats->ofdm_stats[rxs->rate_idx - 4].ofdm_cnt++;
+                else
+                        rstats->ofdm_stats[rxs->rate_idx].ofdm_cnt++;
+        }
+exit:
+        rcu_read_unlock();
+}
+
+#define PRINT_CCK_RATE(str, i, sp)                                      \
+        do {                                                            \
+                len += scnprintf(buf + len, size - len,                 \
+                         "%11s : %10u\n",                               \
+                         str,                                           \
+                         (sp) ? rstats->cck_stats[i].cck_sp_cnt :       \
+                         rstats->cck_stats[i].cck_lp_cnt);              \
+        } while (0)
+
+#define PRINT_OFDM_RATE(str, i)                                 \
+        do {                                                    \
+                len += scnprintf(buf + len, size - len,         \
+                         "%11s : %10u\n",                       \
+                         str,                                   \
+                         rstats->ofdm_stats[i].ofdm_cnt);       \
+        } while (0)
+
+static ssize_t read_file_node_recv(struct file *file, char __user *user_buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct ath_node *an = file->private_data;
+        struct ath_softc *sc = an->sc;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_rx_rate_stats *rstats;
+        struct ieee80211_sta *sta = an->sta;
+        enum ieee80211_band band;
+        u32 len = 0, size = 4096;
+        char *buf;
+        size_t retval;
+        int i;
+
+        buf = kzalloc(size, GFP_KERNEL);
+        if (buf == NULL)
+                return -ENOMEM;
+
+        band = ah->curchan->chan->band;
+        rstats = &an->rx_rate_stats;
+
+        if (!sta->ht_cap.ht_supported)
+                goto legacy;
+
+        len += scnprintf(buf + len, size - len,
+                         "%24s%10s%10s%10s\n",
+                         "HT20", "HT40", "SGI", "LGI");
+
+        for (i = 0; i < 24; i++) {
+                len += scnprintf(buf + len, size - len,
+                                 "%8s%3u : %10u%10u%10u%10u\n",
+                                 "MCS", i,
+                                 rstats->ht_stats[i].ht20_cnt,
+                                 rstats->ht_stats[i].ht40_cnt,
+                                 rstats->ht_stats[i].sgi_cnt,
+                                 rstats->ht_stats[i].lgi_cnt);
+        }
+
+        len += scnprintf(buf + len, size - len, "\n");
+
+legacy:
+        if (band == IEEE80211_BAND_2GHZ) {
+                PRINT_CCK_RATE("CCK-1M/LP", 0, false);
+                PRINT_CCK_RATE("CCK-2M/LP", 1, false);
+                PRINT_CCK_RATE("CCK-5.5M/LP", 2, false);
+                PRINT_CCK_RATE("CCK-11M/LP", 3, false);
+
+                PRINT_CCK_RATE("CCK-2M/SP", 1, true);
+                PRINT_CCK_RATE("CCK-5.5M/SP", 2, true);
+                PRINT_CCK_RATE("CCK-11M/SP", 3, true);
+        }
+
+        PRINT_OFDM_RATE("OFDM-6M", 0);
+        PRINT_OFDM_RATE("OFDM-9M", 1);
+        PRINT_OFDM_RATE("OFDM-12M", 2);
+        PRINT_OFDM_RATE("OFDM-18M", 3);
+        PRINT_OFDM_RATE("OFDM-24M", 4);
+        PRINT_OFDM_RATE("OFDM-36M", 5);
+        PRINT_OFDM_RATE("OFDM-48M", 6);
+        PRINT_OFDM_RATE("OFDM-54M", 7);
+
+        retval = simple_read_from_buffer(user_buf, count, ppos, buf, len);
+        kfree(buf);
+
+        return retval;
+}
+
+#undef PRINT_OFDM_RATE
+#undef PRINT_CCK_RATE
+
+static const struct file_operations fops_node_recv = {
+        .read = read_file_node_recv,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_sta_add_debugfs(struct ieee80211_hw *hw,
+                           struct ieee80211_vif *vif,
+                           struct ieee80211_sta *sta,
+                           struct dentry *dir)
+{
+        struct ath_node *an = (struct ath_node *)sta->drv_priv;
+
+        debugfs_create_file("node_aggr", S_IRUGO, dir, an, &fops_node_aggr);
+        debugfs_create_file("node_recv", S_IRUGO, dir, an, &fops_node_recv);
+}
diff --git a/drivers/net/wireless/ath/ath9k/dfs.c b/drivers/net/wireless/ath/ath9k/dfs.c
index 7187d3671512..857bb28b3894 100644
--- a/drivers/net/wireless/ath/ath9k/dfs.c
+++ b/drivers/net/wireless/ath/ath9k/dfs.c
@@ -158,8 +158,8 @@ void ath9k_dfs_process_phyerr(struct ath_softc *sc, void *data,
                 return;
         }
 
-        ard.rssi = rs->rs_rssi_ctl0;
-        ard.ext_rssi = rs->rs_rssi_ext0;
+        ard.rssi = rs->rs_rssi_ctl[0];
+        ard.ext_rssi = rs->rs_rssi_ext[0];
 
         /*
          * hardware stores this as 8 bit signed value.
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_4k.c b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
index b4091716e9b3..07b806c56c56 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_4k.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_4k.c
@@ -1085,31 +1085,7 @@ static void ath9k_hw_4k_set_board_values(struct ath_hw *ah,
 
 static u16 ath9k_hw_4k_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
 {
-#define EEP_MAP4K_SPURCHAN \
-        (ah->eeprom.map4k.modalHeader.spurChans[i].spurChan)
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        u16 spur_val = AR_NO_SPUR;
-
-        ath_dbg(common, ANI, "Getting spur idx:%d is2Ghz:%d val:%x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                ath_dbg(common, ANI, "Getting spur val from new loc. %d\n",
-                        spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_MAP4K_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_MAP4K_SPURCHAN
+        return ah->eeprom.map4k.modalHeader.spurChans[i].spurChan;
 }
 
 const struct eeprom_ops eep_4k_ops = {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_9287.c b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
index e1d0c217c104..5ba1385c9838 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_9287.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_9287.c
@@ -1004,31 +1004,7 @@ static void ath9k_hw_ar9287_set_board_values(struct ath_hw *ah,
 static u16 ath9k_hw_ar9287_get_spur_channel(struct ath_hw *ah,
                                             u16 i, bool is2GHz)
 {
-#define EEP_MAP9287_SPURCHAN \
-        (ah->eeprom.map9287.modalHeader.spurChans[i].spurChan)
-
-        struct ath_common *common = ath9k_hw_common(ah);
-        u16 spur_val = AR_NO_SPUR;
-
-        ath_dbg(common, ANI, "Getting spur idx:%d is2Ghz:%d val:%x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                ath_dbg(common, ANI, "Getting spur val from new loc. %d\n",
-                        spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_MAP9287_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_MAP9287_SPURCHAN
+        return ah->eeprom.map9287.modalHeader.spurChans[i].spurChan;
 }
 
 const struct eeprom_ops eep_ar9287_ops = {
diff --git a/drivers/net/wireless/ath/ath9k/eeprom_def.c b/drivers/net/wireless/ath/ath9k/eeprom_def.c
index 39107e31e79a..3218ca994746 100644
--- a/drivers/net/wireless/ath/ath9k/eeprom_def.c
+++ b/drivers/net/wireless/ath/ath9k/eeprom_def.c
@@ -1348,31 +1348,7 @@ static void ath9k_hw_def_set_txpower(struct ath_hw *ah,
 
 static u16 ath9k_hw_def_get_spur_channel(struct ath_hw *ah, u16 i, bool is2GHz)
 {
-#define EEP_DEF_SPURCHAN \
-        (ah->eeprom.def.modalHeader[is2GHz].spurChans[i].spurChan)
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        u16 spur_val = AR_NO_SPUR;
-
-        ath_dbg(common, ANI, "Getting spur idx:%d is2Ghz:%d val:%x\n",
-                i, is2GHz, ah->config.spurchans[i][is2GHz]);
-
-        switch (ah->config.spurmode) {
-        case SPUR_DISABLE:
-                break;
-        case SPUR_ENABLE_IOCTL:
-                spur_val = ah->config.spurchans[i][is2GHz];
-                ath_dbg(common, ANI, "Getting spur val from new loc. %d\n",
-                        spur_val);
-                break;
-        case SPUR_ENABLE_EEPROM:
-                spur_val = EEP_DEF_SPURCHAN;
-                break;
-        }
-
-        return spur_val;
-
-#undef EEP_DEF_SPURCHAN
+        return ah->eeprom.def.modalHeader[is2GHz].spurChans[i].spurChan;
 }
 
 const struct eeprom_ops eep_def_ops = {
diff --git a/drivers/net/wireless/ath/ath9k/gpio.c b/drivers/net/wireless/ath/ath9k/gpio.c
index c34f21241da9..b1956bf6e01e 100644
--- a/drivers/net/wireless/ath/ath9k/gpio.c
+++ b/drivers/net/wireless/ath/ath9k/gpio.c
@@ -157,36 +157,6 @@ static void ath_detect_bt_priority(struct ath_softc *sc)
         }
 }
 
-static void ath9k_gen_timer_start(struct ath_hw *ah,
-                                  struct ath_gen_timer *timer,
-                                  u32 trig_timeout,
-                                  u32 timer_period)
-{
-        ath9k_hw_gen_timer_start(ah, timer, trig_timeout, timer_period);
-
-        if ((ah->imask & ATH9K_INT_GENTIMER) == 0) {
-                ath9k_hw_disable_interrupts(ah);
-                ah->imask |= ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah);
-                ath9k_hw_enable_interrupts(ah);
-        }
-}
-
-static void ath9k_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
-{
-        struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
-
-        ath9k_hw_gen_timer_stop(ah, timer);
-
-        /* if no timer is enabled, turn off interrupt mask */
-        if (timer_table->timer_mask.val == 0) {
-                ath9k_hw_disable_interrupts(ah);
-                ah->imask &= ~ATH9K_INT_GENTIMER;
-                ath9k_hw_set_interrupts(ah);
-                ath9k_hw_enable_interrupts(ah);
-        }
-}
-
 static void ath_mci_ftp_adjust(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
@@ -257,19 +227,9 @@ static void ath_btcoex_period_timer(unsigned long data)
 
         spin_unlock_bh(&btcoex->btcoex_lock);
 
-        /*
-         * btcoex_period is in msec while (btocex/btscan_)no_stomp are in usec,
-         * ensure that we properly convert btcoex_period to usec
-         * for any comparision with (btcoex/btscan_)no_stomp.
-         */
-        if (btcoex->btcoex_period * 1000 != btcoex->btcoex_no_stomp) {
-                if (btcoex->hw_timer_enabled)
-                        ath9k_gen_timer_stop(ah, btcoex->no_stomp_timer);
-
-                ath9k_gen_timer_start(ah, btcoex->no_stomp_timer, timer_period,
-                                      timer_period * 10);
-                btcoex->hw_timer_enabled = true;
-        }
+        if (btcoex->btcoex_period != btcoex->btcoex_no_stomp)
+                mod_timer(&btcoex->no_stomp_timer,
+                         jiffies + msecs_to_jiffies(timer_period));
 
         ath9k_ps_restore(sc);
 
@@ -282,7 +242,7 @@ skip_hw_wakeup:
  * Generic tsf based hw timer which configures weight
  * registers to time slice between wlan and bt traffic
  */
-static void ath_btcoex_no_stomp_timer(void *arg)
+static void ath_btcoex_no_stomp_timer(unsigned long arg)
 {
         struct ath_softc *sc = (struct ath_softc *)arg;
         struct ath_hw *ah = sc->sc_ah;
@@ -311,24 +271,18 @@ static int ath_init_btcoex_timer(struct ath_softc *sc)
         struct ath_btcoex *btcoex = &sc->btcoex;
 
         btcoex->btcoex_period = ATH_BTCOEX_DEF_BT_PERIOD;
-        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) * 1000 *
+        btcoex->btcoex_no_stomp = (100 - ATH_BTCOEX_DEF_DUTY_CYCLE) *
                 btcoex->btcoex_period / 100;
-        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) * 1000 *
+        btcoex->btscan_no_stomp = (100 - ATH_BTCOEX_BTSCAN_DUTY_CYCLE) *
                                    btcoex->btcoex_period / 100;
 
         setup_timer(&btcoex->period_timer, ath_btcoex_period_timer,
                         (unsigned long) sc);
+        setup_timer(&btcoex->no_stomp_timer, ath_btcoex_no_stomp_timer,
+                        (unsigned long) sc);
 
         spin_lock_init(&btcoex->btcoex_lock);
 
-        btcoex->no_stomp_timer = ath_gen_timer_alloc(sc->sc_ah,
-                        ath_btcoex_no_stomp_timer,
-                        ath_btcoex_no_stomp_timer,
-                        (void *) sc, AR_FIRST_NDP_TIMER);
-
-        if (!btcoex->no_stomp_timer)
-                return -ENOMEM;
-
         return 0;
 }
 
@@ -343,10 +297,7 @@ void ath9k_btcoex_timer_resume(struct ath_softc *sc)
         ath_dbg(ath9k_hw_common(ah), BTCOEX, "Starting btcoex timers\n");
 
         /* make sure duty cycle timer is also stopped when resuming */
-        if (btcoex->hw_timer_enabled) {
-                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
-                btcoex->hw_timer_enabled = false;
-        }
+        del_timer_sync(&btcoex->no_stomp_timer);
 
         btcoex->bt_priority_cnt = 0;
         btcoex->bt_priority_time = jiffies;
@@ -363,24 +314,16 @@ void ath9k_btcoex_timer_resume(struct ath_softc *sc)
 void ath9k_btcoex_timer_pause(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
-        struct ath_hw *ah = sc->sc_ah;
 
         del_timer_sync(&btcoex->period_timer);
-
-        if (btcoex->hw_timer_enabled) {
-                ath9k_gen_timer_stop(ah, btcoex->no_stomp_timer);
-                btcoex->hw_timer_enabled = false;
-        }
+        del_timer_sync(&btcoex->no_stomp_timer);
 }
 
 void ath9k_btcoex_stop_gen_timer(struct ath_softc *sc)
 {
         struct ath_btcoex *btcoex = &sc->btcoex;
 
-        if (btcoex->hw_timer_enabled) {
-                ath9k_gen_timer_stop(sc->sc_ah, btcoex->no_stomp_timer);
-                btcoex->hw_timer_enabled = false;
-        }
+        del_timer_sync(&btcoex->no_stomp_timer);
 }
 
 u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
@@ -400,12 +343,6 @@ u16 ath9k_btcoex_aggr_limit(struct ath_softc *sc, u32 max_4ms_framelen)
 
 void ath9k_btcoex_handle_interrupt(struct ath_softc *sc, u32 status)
 {
-        struct ath_hw *ah = sc->sc_ah;
-
-        if (ath9k_hw_get_btcoex_scheme(ah) == ATH_BTCOEX_CFG_3WIRE)
-                if (status & ATH9K_INT_GENTIMER)
-                        ath_gen_timer_isr(sc->sc_ah);
-
         if (status & ATH9K_INT_MCI)
                 ath_mci_intr(sc);
 }
@@ -447,10 +384,6 @@ void ath9k_deinit_btcoex(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
 
-        if ((sc->btcoex.no_stomp_timer) &&
-            ath9k_hw_get_btcoex_scheme(sc->sc_ah) == ATH_BTCOEX_CFG_3WIRE)
-                ath_gen_timer_free(sc->sc_ah, sc->btcoex.no_stomp_timer);
-
         if (ath9k_hw_mci_is_enabled(ah))
                 ath_mci_cleanup(sc);
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc.h b/drivers/net/wireless/ath/ath9k/htc.h
index 055d7c25e090..58da3468d1f0 100644
--- a/drivers/net/wireless/ath/ath9k/htc.h
+++ b/drivers/net/wireless/ath/ath9k/htc.h
@@ -600,10 +600,15 @@ void ath9k_htc_rfkill_poll_state(struct ieee80211_hw *hw);
 struct base_eep_header *ath9k_htc_get_eeprom_base(struct ath9k_htc_priv *priv);
 
 #ifdef CONFIG_MAC80211_LEDS
+void ath9k_configure_leds(struct ath9k_htc_priv *priv);
 void ath9k_init_leds(struct ath9k_htc_priv *priv);
 void ath9k_deinit_leds(struct ath9k_htc_priv *priv);
 void ath9k_led_work(struct work_struct *work);
 #else
+static inline void ath9k_configure_leds(struct ath9k_htc_priv *priv)
+{
+}
+
 static inline void ath9k_init_leds(struct ath9k_htc_priv *priv)
 {
 }
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
index e0c03bd64182..8b5757734596 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_beacon.c
@@ -70,11 +70,11 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
         struct ath9k_beacon_state bs;
         enum ath9k_int imask = 0;
         int dtimperiod, dtimcount, sleepduration;
-        int cfpperiod, cfpcount, bmiss_timeout;
+        int bmiss_timeout;
         u32 nexttbtt = 0, intval, tsftu;
         __be32 htc_imask = 0;
         u64 tsf;
-        int num_beacons, offset, dtim_dec_count, cfp_dec_count;
+        int num_beacons, offset, dtim_dec_count;
         int ret __attribute__ ((unused));
         u8 cmd_rsp;
 
@@ -84,7 +84,7 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
         bmiss_timeout = (ATH_DEFAULT_BMISS_LIMIT * bss_conf->beacon_interval);
 
         /*
-         * Setup dtim and cfp parameters according to
+         * Setup dtim parameters according to
          * last beacon we received (which may be none).
          */
         dtimperiod = bss_conf->dtim_period;
@@ -93,8 +93,6 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
         dtimcount = 1;
         if (dtimcount >= dtimperiod)    /* NB: sanity check */
                 dtimcount = 0;
-        cfpperiod = 1;                  /* NB: no PCF support yet */
-        cfpcount = 0;
 
         sleepduration = intval;
         if (sleepduration <= 0)
@@ -102,7 +100,7 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
 
         /*
          * Pull nexttbtt forward to reflect the current
-         * TSF and calculate dtim+cfp state for the result.
+         * TSF and calculate dtim state for the result.
          */
         tsf = ath9k_hw_gettsf64(priv->ah);
         tsftu = TSF_TO_TU(tsf>>32, tsf) + FUDGE;
@@ -115,26 +113,14 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
 
         /* DTIM Beacon every dtimperiod Beacon */
         dtim_dec_count = num_beacons % dtimperiod;
-        /* CFP every cfpperiod DTIM Beacon */
-        cfp_dec_count = (num_beacons / dtimperiod) % cfpperiod;
-        if (dtim_dec_count)
-                cfp_dec_count++;
-
         dtimcount -= dtim_dec_count;
         if (dtimcount < 0)
                 dtimcount += dtimperiod;
 
-        cfpcount -= cfp_dec_count;
-        if (cfpcount < 0)
-                cfpcount += cfpperiod;
-
-        bs.bs_intval = intval;
-        bs.bs_nexttbtt = nexttbtt;
-        bs.bs_dtimperiod = dtimperiod*intval;
-        bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount*intval;
-        bs.bs_cfpperiod = cfpperiod*bs.bs_dtimperiod;
-        bs.bs_cfpnext = bs.bs_nextdtim + cfpcount*bs.bs_dtimperiod;
-        bs.bs_cfpmaxduration = 0;
+        bs.bs_intval = TU_TO_USEC(intval);
+        bs.bs_nexttbtt = TU_TO_USEC(nexttbtt);
+        bs.bs_dtimperiod = dtimperiod * bs.bs_intval;
+        bs.bs_nextdtim = bs.bs_nexttbtt + dtimcount * bs.bs_intval;
 
         /*
          * Calculate the number of consecutive beacons to miss* before taking
@@ -161,7 +147,8 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
          * XXX fixed at 100ms
          */
 
-        bs.bs_sleepduration = roundup(IEEE80211_MS_TO_TU(100), sleepduration);
+        bs.bs_sleepduration = TU_TO_USEC(roundup(IEEE80211_MS_TO_TU(100),
+                                                 sleepduration));
         if (bs.bs_sleepduration > bs.bs_dtimperiod)
                 bs.bs_sleepduration = bs.bs_dtimperiod;
 
@@ -170,10 +157,8 @@ static void ath9k_htc_beacon_config_sta(struct ath9k_htc_priv *priv,
 
         ath_dbg(common, CONFIG, "intval: %u tsf: %llu tsftu: %u\n",
                 intval, tsf, tsftu);
-        ath_dbg(common, CONFIG,
-                "bmiss: %u sleep: %u cfp-period: %u maxdur: %u next: %u\n",
-                bs.bs_bmissthreshold, bs.bs_sleepduration,
-                bs.bs_cfpperiod, bs.bs_cfpmaxduration, bs.bs_cfpnext);
+        ath_dbg(common, CONFIG, "bmiss: %u sleep: %u\n",
+                bs.bs_bmissthreshold, bs.bs_sleepduration);
 
         /* Set the computed STA beacon timers */
 
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
index 105582d6b714..50f74a2a4cf8 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_gpio.c
@@ -255,6 +255,17 @@ void ath9k_deinit_leds(struct ath9k_htc_priv *priv)
         cancel_work_sync(&priv->led_work);
 }
 
+
+void ath9k_configure_leds(struct ath9k_htc_priv *priv)
+{
+        /* Configure gpio 1 for output */
+        ath9k_hw_cfg_output(priv->ah, priv->ah->led_pin,
+                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
+        /* LED off, active low */
+        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 1);
+
+}
+
 void ath9k_init_leds(struct ath9k_htc_priv *priv)
 {
         int ret;
@@ -268,11 +279,7 @@ void ath9k_init_leds(struct ath9k_htc_priv *priv)
         else
                 priv->ah->led_pin = ATH_LED_PIN_DEF;
 
-        /* Configure gpio 1 for output */
-        ath9k_hw_cfg_output(priv->ah, priv->ah->led_pin,
-                            AR_GPIO_OUTPUT_MUX_AS_OUTPUT);
-        /* LED off, active low */
-        ath9k_hw_set_gpio(priv->ah, priv->ah->led_pin, 1);
+        ath9k_configure_leds(priv);
 
         snprintf(priv->led_name, sizeof(priv->led_name),
                 "ath9k_htc-%s", wiphy_name(priv->hw->wiphy));
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
index c3676bf1d6c4..f4e1de20d99c 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
@@ -748,7 +748,6 @@ static void ath9k_set_hw_capab(struct ath9k_htc_priv *priv,
                             WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
 
         hw->queues = 4;
-        hw->channel_change_time = 5000;
         hw->max_listen_interval = 1;
 
         hw->vif_data_size = sizeof(struct ath9k_htc_vif);
@@ -1000,6 +999,8 @@ int ath9k_htc_resume(struct htc_target *htc_handle)
 
         ret = ath9k_init_htc_services(priv, priv->ah->hw_version.devid,
                                       priv->ah->hw_version.usbdev);
+        ath9k_configure_leds(priv);
+
         return ret;
 }
 #endif
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
index c028df76b564..12e0f32a4905 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_txrx.c
@@ -1075,9 +1075,7 @@ static bool ath9k_rx_prepare(struct ath9k_htc_priv *priv,
 
         last_rssi = priv->rx.last_rssi;
 
-        if (ieee80211_is_beacon(hdr->frame_control) &&
-            !is_zero_ether_addr(common->curbssid) &&
-            ether_addr_equal(hdr->addr3, common->curbssid)) {
+        if (ath_is_mybeacon(common, hdr)) {
                 s8 rssi = rxbuf->rxstatus.rs_rssi;
 
                 if (likely(last_rssi != ATH_RSSI_DUMMY_MARKER))
diff --git a/drivers/net/wireless/ath/ath9k/hw-ops.h b/drivers/net/wireless/ath/ath9k/hw-ops.h
index 4f9378ddf07f..a47ea8423f1e 100644
--- a/drivers/net/wireless/ath/ath9k/hw-ops.h
+++ b/drivers/net/wireless/ath/ath9k/hw-ops.h
@@ -49,9 +49,10 @@ static inline bool ath9k_hw_calibrate(struct ath_hw *ah,
         return ath9k_hw_ops(ah)->calibrate(ah, chan, rxchainmask, longcal);
 }
 
-static inline bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked)
+static inline bool ath9k_hw_getisr(struct ath_hw *ah, enum ath9k_int *masked,
+                                   u32 *sync_cause_p)
 {
-        return ath9k_hw_ops(ah)->get_isr(ah, masked);
+        return ath9k_hw_ops(ah)->get_isr(ah, masked, sync_cause_p);
 }
 
 static inline void ath9k_hw_set_txdesc(struct ath_hw *ah, void *ds,
@@ -106,6 +107,21 @@ static inline void ath9k_hw_set_bt_ant_diversity(struct ath_hw *ah, bool enable)
 
 /* Private hardware call ops */
 
+static inline void ath9k_hw_init_hang_checks(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_hang_checks(ah);
+}
+
+static inline bool ath9k_hw_detect_mac_hang(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->detect_mac_hang(ah);
+}
+
+static inline bool ath9k_hw_detect_bb_hang(struct ath_hw *ah)
+{
+        return ath9k_hw_private_ops(ah)->detect_bb_hang(ah);
+}
+
 /* PHY ops */
 
 static inline int ath9k_hw_rf_set_freq(struct ath_hw *ah,
@@ -231,4 +247,31 @@ static inline void ath9k_hw_set_radar_params(struct ath_hw *ah)
         ath9k_hw_private_ops(ah)->set_radar_params(ah, &ah->radar_conf);
 }
 
+static inline void ath9k_hw_init_cal_settings(struct ath_hw *ah)
+{
+        ath9k_hw_private_ops(ah)->init_cal_settings(ah);
+}
+
+static inline u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
+                                               struct ath9k_channel *chan)
+{
+        return ath9k_hw_private_ops(ah)->compute_pll_control(ah, chan);
+}
+
+static inline void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->init_mode_gain_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
+}
+
+static inline void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
+{
+        if (!ath9k_hw_private_ops(ah)->ani_cache_ini_regs)
+                return;
+
+        ath9k_hw_private_ops(ah)->ani_cache_ini_regs(ah);
+}
+
 #endif /* ATH9K_HW_OPS_H */
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 8918035da3a3..fbf43c05713f 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -17,6 +17,8 @@
 #include <linux/io.h>
 #include <linux/slab.h>
 #include <linux/module.h>
+#include <linux/time.h>
+#include <linux/bitops.h>
 #include <asm/unaligned.h>
 
 #include "hw.h"
@@ -35,99 +37,6 @@ MODULE_DESCRIPTION("Support for Atheros 802.11n wireless LAN cards.");
 MODULE_SUPPORTED_DEVICE("Atheros 802.11n WLAN cards");
 MODULE_LICENSE("Dual BSD/GPL");
 
-static int __init ath9k_init(void)
-{
-        return 0;
-}
-module_init(ath9k_init);
-
-static void __exit ath9k_exit(void)
-{
-        return;
-}
-module_exit(ath9k_exit);
-
-/* Private hardware callbacks */
-
-static void ath9k_hw_init_cal_settings(struct ath_hw *ah)
-{
-        ath9k_hw_private_ops(ah)->init_cal_settings(ah);
-}
-
-static u32 ath9k_hw_compute_pll_control(struct ath_hw *ah,
-                                        struct ath9k_channel *chan)
-{
-        return ath9k_hw_private_ops(ah)->compute_pll_control(ah, chan);
-}
-
-static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
-{
-        if (!ath9k_hw_private_ops(ah)->init_mode_gain_regs)
-                return;
-
-        ath9k_hw_private_ops(ah)->init_mode_gain_regs(ah);
-}
-
-static void ath9k_hw_ani_cache_ini_regs(struct ath_hw *ah)
-{
-        /* You will not have this callback if using the old ANI */
-        if (!ath9k_hw_private_ops(ah)->ani_cache_ini_regs)
-                return;
-
-        ath9k_hw_private_ops(ah)->ani_cache_ini_regs(ah);
-}
-
-/********************/
-/* Helper Functions */
-/********************/
-
-#ifdef CONFIG_ATH9K_DEBUGFS
-
-void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause)
-{
-        struct ath_softc *sc = common->priv;
-        if (sync_cause)
-                sc->debug.stats.istats.sync_cause_all++;
-        if (sync_cause & AR_INTR_SYNC_RTC_IRQ)
-                sc->debug.stats.istats.sync_rtc_irq++;
-        if (sync_cause & AR_INTR_SYNC_MAC_IRQ)
-                sc->debug.stats.istats.sync_mac_irq++;
-        if (sync_cause & AR_INTR_SYNC_EEPROM_ILLEGAL_ACCESS)
-                sc->debug.stats.istats.eeprom_illegal_access++;
-        if (sync_cause & AR_INTR_SYNC_APB_TIMEOUT)
-                sc->debug.stats.istats.apb_timeout++;
-        if (sync_cause & AR_INTR_SYNC_PCI_MODE_CONFLICT)
-                sc->debug.stats.istats.pci_mode_conflict++;
-        if (sync_cause & AR_INTR_SYNC_HOST1_FATAL)
-                sc->debug.stats.istats.host1_fatal++;
-        if (sync_cause & AR_INTR_SYNC_HOST1_PERR)
-                sc->debug.stats.istats.host1_perr++;
-        if (sync_cause & AR_INTR_SYNC_TRCV_FIFO_PERR)
-                sc->debug.stats.istats.trcv_fifo_perr++;
-        if (sync_cause & AR_INTR_SYNC_RADM_CPL_EP)
-                sc->debug.stats.istats.radm_cpl_ep++;
-        if (sync_cause & AR_INTR_SYNC_RADM_CPL_DLLP_ABORT)
-                sc->debug.stats.istats.radm_cpl_dllp_abort++;
-        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TLP_ABORT)
-                sc->debug.stats.istats.radm_cpl_tlp_abort++;
-        if (sync_cause & AR_INTR_SYNC_RADM_CPL_ECRC_ERR)
-                sc->debug.stats.istats.radm_cpl_ecrc_err++;
-        if (sync_cause & AR_INTR_SYNC_RADM_CPL_TIMEOUT)
-                sc->debug.stats.istats.radm_cpl_timeout++;
-        if (sync_cause & AR_INTR_SYNC_LOCAL_TIMEOUT)
-                sc->debug.stats.istats.local_timeout++;
-        if (sync_cause & AR_INTR_SYNC_PM_ACCESS)
-                sc->debug.stats.istats.pm_access++;
-        if (sync_cause & AR_INTR_SYNC_MAC_AWAKE)
-                sc->debug.stats.istats.mac_awake++;
-        if (sync_cause & AR_INTR_SYNC_MAC_ASLEEP)
-                sc->debug.stats.istats.mac_asleep++;
-        if (sync_cause & AR_INTR_SYNC_MAC_SLEEP_ACCESS)
-                sc->debug.stats.istats.mac_sleep_access++;
-}
-#endif
-
-
 static void ath9k_hw_set_clockrate(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -336,6 +245,9 @@ static void ath9k_hw_read_revisions(struct ath_hw *ah)
         case AR9300_DEVID_QCA955X:
                 ah->hw_version.macVersion = AR_SREV_VERSION_9550;
                 return;
+        case AR9300_DEVID_AR953X:
+                ah->hw_version.macVersion = AR_SREV_VERSION_9531;
+                return;
         }
 
         val = REG_READ(ah, AR_SREV) & AR_SREV_ID;
@@ -437,23 +349,22 @@ static bool ath9k_hw_chip_test(struct ath_hw *ah)
 
 static void ath9k_hw_init_config(struct ath_hw *ah)
 {
-        int i;
+        struct ath_common *common = ath9k_hw_common(ah);
 
         ah->config.dma_beacon_response_time = 1;
         ah->config.sw_beacon_response_time = 6;
-        ah->config.additional_swba_backoff = 0;
-        ah->config.ack_6mb = 0x0;
         ah->config.cwm_ignore_extcca = 0;
-        ah->config.pcie_clock_req = 0;
         ah->config.analog_shiftreg = 1;
 
-        for (i = 0; i < AR_EEPROM_MODAL_SPURS; i++) {
-                ah->config.spurchans[i][0] = AR_NO_SPUR;
-                ah->config.spurchans[i][1] = AR_NO_SPUR;
-        }
-
         ah->config.rx_intr_mitigation = true;
-        ah->config.pcieSerDesWrite = true;
+
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
+                ah->config.rimt_last = 500;
+                ah->config.rimt_first = 2000;
+        } else {
+                ah->config.rimt_last = 250;
+                ah->config.rimt_first = 700;
+        }
 
         /*
          * We need this for PCI devices only (Cardbus, PCI, miniPCI)
@@ -473,6 +384,24 @@ static void ath9k_hw_init_config(struct ath_hw *ah)
          */
         if (num_possible_cpus() > 1)
                 ah->config.serialize_regmode = SER_REG_MODE_AUTO;
+
+        if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
+                if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
+                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
+                     !ah->is_pciexpress)) {
+                        ah->config.serialize_regmode = SER_REG_MODE_ON;
+                } else {
+                        ah->config.serialize_regmode = SER_REG_MODE_OFF;
+                }
+        }
+
+        ath_dbg(common, RESET, "serialize_regmode is %d\n",
+                ah->config.serialize_regmode);
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
+        else
+                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
 }
 
 static void ath9k_hw_init_defaults(struct ath_hw *ah)
@@ -485,16 +414,24 @@ static void ath9k_hw_init_defaults(struct ath_hw *ah)
         ah->hw_version.magic = AR5416_MAGIC;
         ah->hw_version.subvendorid = 0;
 
-        ah->atim_window = 0;
-        ah->sta_id1_defaults =
-                AR_STA_ID1_CRPT_MIC_ENABLE |
-                AR_STA_ID1_MCAST_KSRCH;
+        ah->sta_id1_defaults = AR_STA_ID1_CRPT_MIC_ENABLE |
+                               AR_STA_ID1_MCAST_KSRCH;
         if (AR_SREV_9100(ah))
                 ah->sta_id1_defaults |= AR_STA_ID1_AR9100_BA_FIX;
+
         ah->slottime = ATH9K_SLOT_TIME_9;
         ah->globaltxtimeout = (u32) -1;
         ah->power_mode = ATH9K_PM_UNDEFINED;
         ah->htc_reset_init = true;
+
+        ah->ani_function = ATH9K_ANI_ALL;
+        if (!AR_SREV_9300_20_OR_LATER(ah))
+                ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
+
+        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
+                ah->tx_trig_level = (AR_FTRIG_256B >> AR_FTRIG_S);
+        else
+                ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
 }
 
 static int ath9k_hw_init_macaddr(struct ath_hw *ah)
@@ -548,11 +485,11 @@ static int ath9k_hw_post_init(struct ath_hw *ah)
          * EEPROM needs to be initialized before we do this.
          * This is required for regulatory compliance.
          */
-        if (AR_SREV_9462(ah) || AR_SREV_9565(ah)) {
+        if (AR_SREV_9300_20_OR_LATER(ah)) {
                 u16 regdmn = ah->eep_ops->get_eeprom(ah, EEP_REG_0);
                 if ((regdmn & 0xF0) == CTL_FCC) {
-                        ah->nf_2g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_2GHZ;
-                        ah->nf_5g.max = AR_PHY_CCA_MAX_GOOD_VAL_9462_FCC_5GHZ;
+                        ah->nf_2g.max = AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_2GHZ;
+                        ah->nf_5g.max = AR_PHY_CCA_MAX_GOOD_VAL_9300_FCC_5GHZ;
                 }
         }
 
@@ -576,6 +513,31 @@ static int __ath9k_hw_init(struct ath_hw *ah)
 
         ath9k_hw_read_revisions(ah);
 
+        switch (ah->hw_version.macVersion) {
+        case AR_SREV_VERSION_5416_PCI:
+        case AR_SREV_VERSION_5416_PCIE:
+        case AR_SREV_VERSION_9160:
+        case AR_SREV_VERSION_9100:
+        case AR_SREV_VERSION_9280:
+        case AR_SREV_VERSION_9285:
+        case AR_SREV_VERSION_9287:
+        case AR_SREV_VERSION_9271:
+        case AR_SREV_VERSION_9300:
+        case AR_SREV_VERSION_9330:
+        case AR_SREV_VERSION_9485:
+        case AR_SREV_VERSION_9340:
+        case AR_SREV_VERSION_9462:
+        case AR_SREV_VERSION_9550:
+        case AR_SREV_VERSION_9565:
+        case AR_SREV_VERSION_9531:
+                break;
+        default:
+                ath_err(common,
+                        "Mac Chip Rev 0x%02x.%x is not supported by this driver\n",
+                        ah->hw_version.macVersion, ah->hw_version.macRev);
+                return -EOPNOTSUPP;
+        }
+
         /*
          * Read back AR_WA into a permanent copy and set bits 14 and 17.
          * We need to do this to avoid RMW of this register. We cannot
@@ -609,50 +571,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
                 return -EIO;
         }
 
-        if (NR_CPUS > 1 && ah->config.serialize_regmode == SER_REG_MODE_AUTO) {
-                if (ah->hw_version.macVersion == AR_SREV_VERSION_5416_PCI ||
-                    ((AR_SREV_9160(ah) || AR_SREV_9280(ah) || AR_SREV_9287(ah)) &&
-                     !ah->is_pciexpress)) {
-                        ah->config.serialize_regmode =
-                                SER_REG_MODE_ON;
-                } else {
-                        ah->config.serialize_regmode =
-                                SER_REG_MODE_OFF;
-                }
-        }
-
-        ath_dbg(common, RESET, "serialize_regmode is %d\n",
-                ah->config.serialize_regmode);
-
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
-                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD >> 1;
-        else
-                ah->config.max_txtrig_level = MAX_TX_FIFO_THRESHOLD;
-
-        switch (ah->hw_version.macVersion) {
-        case AR_SREV_VERSION_5416_PCI:
-        case AR_SREV_VERSION_5416_PCIE:
-        case AR_SREV_VERSION_9160:
-        case AR_SREV_VERSION_9100:
-        case AR_SREV_VERSION_9280:
-        case AR_SREV_VERSION_9285:
-        case AR_SREV_VERSION_9287:
-        case AR_SREV_VERSION_9271:
-        case AR_SREV_VERSION_9300:
-        case AR_SREV_VERSION_9330:
-        case AR_SREV_VERSION_9485:
-        case AR_SREV_VERSION_9340:
-        case AR_SREV_VERSION_9462:
-        case AR_SREV_VERSION_9550:
-        case AR_SREV_VERSION_9565:
-                break;
-        default:
-                ath_err(common,
-                        "Mac Chip Rev 0x%02x.%x is not supported by this driver\n",
-                        ah->hw_version.macVersion, ah->hw_version.macRev);
-                return -EOPNOTSUPP;
-        }
-
         if (AR_SREV_9271(ah) || AR_SREV_9100(ah) || AR_SREV_9340(ah) ||
             AR_SREV_9330(ah) || AR_SREV_9550(ah))
                 ah->is_pciexpress = false;
@@ -660,10 +578,6 @@ static int __ath9k_hw_init(struct ath_hw *ah)
         ah->hw_version.phyRev = REG_READ(ah, AR_PHY_CHIP_ID);
         ath9k_hw_init_cal_settings(ah);
 
-        ah->ani_function = ATH9K_ANI_ALL;
-        if (!AR_SREV_9300_20_OR_LATER(ah))
-                ah->ani_function &= ~ATH9K_ANI_MRC_CCK;
-
         if (!ah->is_pciexpress)
                 ath9k_hw_disablepcie(ah);
 
@@ -682,15 +596,7 @@ static int __ath9k_hw_init(struct ath_hw *ah)
                 return r;
         }
 
-        if (AR_SREV_9285(ah) || AR_SREV_9271(ah))
-                ah->tx_trig_level = (AR_FTRIG_256B >> AR_FTRIG_S);
-        else
-                ah->tx_trig_level = (AR_FTRIG_512B >> AR_FTRIG_S);
-
-        if (AR_SREV_9330(ah))
-                ah->bb_watchdog_timeout_ms = 85;
-        else
-                ah->bb_watchdog_timeout_ms = 25;
+        ath9k_hw_init_hang_checks(ah);
 
         common->state = ATH_HW_INITIALIZED;
 
@@ -723,6 +629,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         case AR9300_DEVID_AR9462:
         case AR9485_DEVID_AR1111:
         case AR9300_DEVID_AR9565:
+        case AR9300_DEVID_AR953X:
                 break;
         default:
                 if (common->bus_ops->ath_bus_type == ATH_USB)
@@ -858,7 +765,7 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 /* program BB PLL phase_shift */
                 REG_RMW_FIELD(ah, AR_CH0_BB_DPLL3,
                               AR_CH0_BB_DPLL3_PHASE_SHIFT, 0x1);
-        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah)) {
+        } else if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah)) {
                 u32 regval, pll2_divint, pll2_divfrac, refdiv;
 
                 REG_WRITE(ah, AR_RTC_PLL_CONTROL, 0x1142c);
@@ -868,9 +775,15 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 udelay(100);
 
                 if (ah->is_clk_25mhz) {
-                        pll2_divint = 0x54;
-                        pll2_divfrac = 0x1eb85;
-                        refdiv = 3;
+                        if (AR_SREV_9531(ah)) {
+                                pll2_divint = 0x1c;
+                                pll2_divfrac = 0xa3d2;
+                                refdiv = 1;
+                        } else {
+                                pll2_divint = 0x54;
+                                pll2_divfrac = 0x1eb85;
+                                refdiv = 3;
+                        }
                 } else {
                         if (AR_SREV_9340(ah)) {
                                 pll2_divint = 88;
@@ -884,7 +797,10 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
                 }
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
-                regval |= (0x1 << 16);
+                if (AR_SREV_9531(ah))
+                        regval |= (0x1 << 22);
+                else
+                        regval |= (0x1 << 16);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
                 udelay(100);
 
@@ -894,14 +810,33 @@ static void ath9k_hw_init_pll(struct ath_hw *ah,
 
                 regval = REG_READ(ah, AR_PHY_PLL_MODE);
                 if (AR_SREV_9340(ah))
-                        regval = (regval & 0x80071fff) | (0x1 << 30) |
-                                 (0x1 << 13) | (0x4 << 26) | (0x18 << 19);
+                        regval = (regval & 0x80071fff) |
+                                (0x1 << 30) |
+                                (0x1 << 13) |
+                                (0x4 << 26) |
+                                (0x18 << 19);
+                else if (AR_SREV_9531(ah))
+                        regval = (regval & 0x01c00fff) |
+                                (0x1 << 31) |
+                                (0x2 << 29) |
+                                (0xa << 25) |
+                                (0x1 << 19) |
+                                (0x6 << 12);
                 else
-                        regval = (regval & 0x80071fff) | (0x3 << 30) |
-                                 (0x1 << 13) | (0x4 << 26) | (0x60 << 19);
+                        regval = (regval & 0x80071fff) |
+                                (0x3 << 30) |
+                                (0x1 << 13) |
+                                (0x4 << 26) |
+                                (0x60 << 19);
                 REG_WRITE(ah, AR_PHY_PLL_MODE, regval);
-                REG_WRITE(ah, AR_PHY_PLL_MODE,
-                          REG_READ(ah, AR_PHY_PLL_MODE) & 0xfffeffff);
+
+                if (AR_SREV_9531(ah))
+                        REG_WRITE(ah, AR_PHY_PLL_MODE,
+                                  REG_READ(ah, AR_PHY_PLL_MODE) & 0xffbfffff);
+                else
+                        REG_WRITE(ah, AR_PHY_PLL_MODE,
+                                  REG_READ(ah, AR_PHY_PLL_MODE) & 0xfffeffff);
+
                 udelay(1000);
         }
 
@@ -1281,6 +1216,42 @@ void ath9k_hw_get_delta_slope_vals(struct ath_hw *ah, u32 coef_scaled,
         *coef_exponent = coef_exp - 16;
 }
 
+/* AR9330 WAR:
+ * call external reset function to reset WMAC if:
+ * - doing a cold reset
+ * - we have pending frames in the TX queues.
+ */
+static bool ath9k_hw_ar9330_reset_war(struct ath_hw *ah, int type)
+{
+        int i, npend = 0;
+
+        for (i = 0; i < AR_NUM_QCU; i++) {
+                npend = ath9k_hw_numtxpending(ah, i);
+                if (npend)
+                        break;
+        }
+
+        if (ah->external_reset &&
+            (npend || type == ATH9K_RESET_COLD)) {
+                int reset_err = 0;
+
+                ath_dbg(ath9k_hw_common(ah), RESET,
+                        "reset MAC via external reset\n");
+
+                reset_err = ah->external_reset();
+                if (reset_err) {
+                        ath_err(ath9k_hw_common(ah),
+                                "External reset failed, err=%d\n",
+                                reset_err);
+                        return false;
+                }
+
+                REG_WRITE(ah, AR_RTC_RESET, 1);
+        }
+
+        return true;
+}
+
 static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 {
         u32 rst_flags;
@@ -1331,38 +1302,8 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
         }
 
         if (AR_SREV_9330(ah)) {
-                int npend = 0;
-                int i;
-
-                /* AR9330 WAR:
-                 * call external reset function to reset WMAC if:
-                 * - doing a cold reset
-                 * - we have pending frames in the TX queues
-                 */
-
-                for (i = 0; i < AR_NUM_QCU; i++) {
-                        npend = ath9k_hw_numtxpending(ah, i);
-                        if (npend)
-                                break;
-                }
-
-                if (ah->external_reset &&
-                    (npend || type == ATH9K_RESET_COLD)) {
-                        int reset_err = 0;
-
-                        ath_dbg(ath9k_hw_common(ah), RESET,
-                                "reset MAC via external reset\n");
-
-                        reset_err = ah->external_reset();
-                        if (reset_err) {
-                                ath_err(ath9k_hw_common(ah),
-                                        "External reset failed, err=%d\n",
-                                        reset_err);
-                                return false;
-                        }
-
-                        REG_WRITE(ah, AR_RTC_RESET, 1);
-                }
+                if (!ath9k_hw_ar9330_reset_war(ah, type))
+                        return false;
         }
 
         if (ath9k_hw_mci_is_enabled(ah))
@@ -1372,7 +1313,12 @@ static bool ath9k_hw_set_reset(struct ath_hw *ah, int type)
 
         REGWRITE_BUFFER_FLUSH(ah);
 
-        udelay(50);
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                udelay(50);
+        else if (AR_SREV_9100(ah))
+                udelay(10000);
+        else
+                udelay(100);
 
         REG_WRITE(ah, AR_RTC_RC, 0);
         if (!ath9k_hw_wait(ah, AR_RTC_RC, AR_RTC_RC_M, 0, AH_WAIT_TIMEOUT)) {
@@ -1408,8 +1354,7 @@ static bool ath9k_hw_set_reset_power_on(struct ath_hw *ah)
 
         REGWRITE_BUFFER_FLUSH(ah);
 
-        if (!AR_SREV_9300_20_OR_LATER(ah))
-                udelay(2);
+        udelay(2);
 
         if (!AR_SREV_9100(ah) && !AR_SREV_9300_20_OR_LATER(ah))
                 REG_WRITE(ah, AR_RC, 0);
@@ -1485,7 +1430,6 @@ static bool ath9k_hw_chip_reset(struct ath_hw *ah,
         if (AR_SREV_9330(ah))
                 ar9003_hw_internal_regulator_apply(ah);
         ath9k_hw_init_pll(ah, chan);
-        ath9k_hw_set_rfmode(ah, chan);
 
         return true;
 }
@@ -1501,8 +1445,9 @@ static bool ath9k_hw_channel_change(struct ath_hw *ah,
         int r;
 
         if (pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) {
-                band_switch = IS_CHAN_5GHZ(ah->curchan) != IS_CHAN_5GHZ(chan);
-                mode_diff = (chan->channelFlags != ah->curchan->channelFlags);
+                u32 flags_diff = chan->channelFlags ^ ah->curchan->channelFlags;
+                band_switch = !!(flags_diff & CHANNEL_5GHZ);
+                mode_diff = !!(flags_diff & ~CHANNEL_HT);
         }
 
         for (qnum = 0; qnum < AR_NUM_QCU; qnum++) {
@@ -1573,76 +1518,6 @@ static void ath9k_hw_apply_gpio_override(struct ath_hw *ah)
         }
 }
 
-static bool ath9k_hw_check_dcs(u32 dma_dbg, u32 num_dcu_states,
-                               int *hang_state, int *hang_pos)
-{
-        static u32 dcu_chain_state[] = {5, 6, 9}; /* DCU chain stuck states */
-        u32 chain_state, dcs_pos, i;
-
-        for (dcs_pos = 0; dcs_pos < num_dcu_states; dcs_pos++) {
-                chain_state = (dma_dbg >> (5 * dcs_pos)) & 0x1f;
-                for (i = 0; i < 3; i++) {
-                        if (chain_state == dcu_chain_state[i]) {
-                                *hang_state = chain_state;
-                                *hang_pos = dcs_pos;
-                                return true;
-                        }
-                }
-        }
-        return false;
-}
-
-#define DCU_COMPLETE_STATE        1
-#define DCU_COMPLETE_STATE_MASK 0x3
-#define NUM_STATUS_READS         50
-static bool ath9k_hw_detect_mac_hang(struct ath_hw *ah)
-{
-        u32 chain_state, comp_state, dcs_reg = AR_DMADBG_4;
-        u32 i, hang_pos, hang_state, num_state = 6;
-
-        comp_state = REG_READ(ah, AR_DMADBG_6);
-
-        if ((comp_state & DCU_COMPLETE_STATE_MASK) != DCU_COMPLETE_STATE) {
-                ath_dbg(ath9k_hw_common(ah), RESET,
-                        "MAC Hang signature not found at DCU complete\n");
-                return false;
-        }
-
-        chain_state = REG_READ(ah, dcs_reg);
-        if (ath9k_hw_check_dcs(chain_state, num_state, &hang_state, &hang_pos))
-                goto hang_check_iter;
-
-        dcs_reg = AR_DMADBG_5;
-        num_state = 4;
-        chain_state = REG_READ(ah, dcs_reg);
-        if (ath9k_hw_check_dcs(chain_state, num_state, &hang_state, &hang_pos))
-                goto hang_check_iter;
-
-        ath_dbg(ath9k_hw_common(ah), RESET,
-                "MAC Hang signature 1 not found\n");
-        return false;
-
-hang_check_iter:
-        ath_dbg(ath9k_hw_common(ah), RESET,
-                "DCU registers: chain %08x complete %08x Hang: state %d pos %d\n",
-                chain_state, comp_state, hang_state, hang_pos);
-
-        for (i = 0; i < NUM_STATUS_READS; i++) {
-                chain_state = REG_READ(ah, dcs_reg);
-                chain_state = (chain_state >> (5 * hang_pos)) & 0x1f;
-                comp_state = REG_READ(ah, AR_DMADBG_6);
-
-                if (((comp_state & DCU_COMPLETE_STATE_MASK) !=
-                                        DCU_COMPLETE_STATE) ||
-                    (chain_state != hang_state))
-                        return false;
-        }
-
-        ath_dbg(ath9k_hw_common(ah), RESET, "MAC Hang signature 1 found\n");
-
-        return true;
-}
-
 void ath9k_hw_check_nav(struct ath_hw *ah)
 {
         struct ath_common *common = ath9k_hw_common(ah);
@@ -1717,7 +1592,6 @@ static void ath9k_hw_reset_opmode(struct ath_hw *ah,
 
         REG_RMW(ah, AR_STA_ID1, macStaId1
                   | AR_STA_ID1_RTS_USE_DEF
-                  | (ah->config.ack_6mb ? AR_STA_ID1_ACKCTS_6MB : 0)
                   | ah->sta_id1_defaults,
                   ~AR_STA_ID1_SADH_MASK);
         ath_hw_setbssidmask(common);
@@ -1776,7 +1650,7 @@ static void ath9k_hw_init_desc(struct ath_hw *ah)
                 }
 #ifdef __BIG_ENDIAN
                 else if (AR_SREV_9330(ah) || AR_SREV_9340(ah) ||
-                         AR_SREV_9550(ah))
+                         AR_SREV_9550(ah) || AR_SREV_9531(ah))
                         REG_RMW(ah, AR_CFG, AR_CFG_SWRB | AR_CFG_SWTB, 0);
                 else
                         REG_WRITE(ah, AR_CFG, AR_CFG_SWTD | AR_CFG_SWRD);
@@ -1814,7 +1688,7 @@ static int ath9k_hw_do_fastcc(struct ath_hw *ah, struct ath9k_channel *chan)
          * If cross-band fcc is not supoprted, bail out if channelFlags differ.
          */
         if (!(pCap->hw_caps & ATH9K_HW_CAP_FCC_BAND_SWITCH) &&
-            chan->channelFlags != ah->curchan->channelFlags)
+            ((chan->channelFlags ^ ah->curchan->channelFlags) & ~CHANNEL_HT))
                 goto fail;
 
         if (!ath9k_hw_check_alive(ah))
@@ -1855,10 +1729,12 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                    struct ath9k_hw_cal_data *caldata, bool fastcc)
 {
         struct ath_common *common = ath9k_hw_common(ah);
+        struct timespec ts;
         u32 saveLedState;
         u32 saveDefAntenna;
         u32 macStaId1;
         u64 tsf = 0;
+        s64 usec = 0;
         int r;
         bool start_mci_reset = false;
         bool save_fullsleep = ah->chip_fullsleep;
@@ -1901,10 +1777,10 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
 
         macStaId1 = REG_READ(ah, AR_STA_ID1) & AR_STA_ID1_BASE_RATE_11B;
 
-        /* For chips on which RTC reset is done, save TSF before it gets cleared */
-        if (AR_SREV_9100(ah) ||
-            (AR_SREV_9280(ah) && ah->eep_ops->get_eeprom(ah, EEP_OL_PWRCTRL)))
-                tsf = ath9k_hw_gettsf64(ah);
+        /* Save TSF before chip reset, a cold reset clears it */
+        tsf = ath9k_hw_gettsf64(ah);
+        getrawmonotonic(&ts);
+        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000;
 
         saveLedState = REG_READ(ah, AR_CFG_LED) &
                 (AR_CFG_LED_ASSOC_CTL | AR_CFG_LED_MODE_SEL |
@@ -1937,8 +1813,9 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         }
 
         /* Restore TSF */
-        if (tsf)
-                ath9k_hw_settsf64(ah, tsf);
+        getrawmonotonic(&ts);
+        usec = ts.tv_sec * 1000000ULL + ts.tv_nsec / 1000 - usec;
+        ath9k_hw_settsf64(ah, tsf + usec);
 
         if (AR_SREV_9280_20_OR_LATER(ah))
                 REG_SET_BIT(ah, AR_GPIO_INPUT_EN_VAL, AR_GPIO_JTAG_DISABLE);
@@ -1950,6 +1827,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         if (r)
                 return r;
 
+        ath9k_hw_set_rfmode(ah, chan);
+
         if (ath9k_hw_mci_is_enabled(ah))
                 ar9003_mci_reset(ah, false, IS_CHAN_2GHZ(chan), save_fullsleep);
 
@@ -2005,8 +1884,8 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
                 REG_WRITE(ah, AR_OBS, 8);
 
         if (ah->config.rx_intr_mitigation) {
-                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, 500);
-                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, 2000);
+                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_LAST, ah->config.rimt_last);
+                REG_RMW_FIELD(ah, AR_RIMT, AR_RIMT_FIRST, ah->config.rimt_first);
         }
 
         if (ah->config.tx_intr_mitigation) {
@@ -2044,10 +1923,11 @@ int ath9k_hw_reset(struct ath_hw *ah, struct ath9k_channel *chan,
         ath9k_hw_loadnf(ah, chan);
         ath9k_hw_start_nfcal(ah, true);
 
-        if (AR_SREV_9300_20_OR_LATER(ah)) {
+        if (AR_SREV_9300_20_OR_LATER(ah))
                 ar9003_hw_bb_watchdog_config(ah);
+
+        if (ah->config.hw_hang_checks & HW_PHYRESTART_CLC_WAR)
                 ar9003_hw_disable_phy_restart(ah);
-        }
 
         ath9k_hw_apply_gpio_override(ah);
 
@@ -2171,7 +2051,11 @@ static bool ath9k_hw_set_power_awake(struct ath_hw *ah)
 
         REG_SET_BIT(ah, AR_RTC_FORCE_WAKE,
                     AR_RTC_FORCE_WAKE_EN);
-        udelay(50);
+
+        if (AR_SREV_9100(ah))
+                udelay(10000);
+        else
+                udelay(50);
 
         for (i = POWER_UP_TIME / 50; i > 0; i--) {
                 val = REG_READ(ah, AR_RTC_STATUS) & AR_RTC_STATUS_M;
@@ -2260,9 +2144,6 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
         case NL80211_IFTYPE_ADHOC:
                 REG_SET_BIT(ah, AR_TXCFG,
                             AR_TXCFG_ADHOC_BEACON_ATIM_TX_POLICY);
-                REG_WRITE(ah, AR_NEXT_NDP_TIMER, next_beacon +
-                          TU_TO_USEC(ah->atim_window ? ah->atim_window : 1));
-                flags |= AR_NDP_TIMER_EN;
         case NL80211_IFTYPE_MESH_POINT:
         case NL80211_IFTYPE_AP:
                 REG_WRITE(ah, AR_NEXT_TBTT_TIMER, next_beacon);
@@ -2283,7 +2164,6 @@ void ath9k_hw_beaconinit(struct ath_hw *ah, u32 next_beacon, u32 beacon_period)
         REG_WRITE(ah, AR_BEACON_PERIOD, beacon_period);
         REG_WRITE(ah, AR_DMA_BEACON_PERIOD, beacon_period);
         REG_WRITE(ah, AR_SWBA_PERIOD, beacon_period);
-        REG_WRITE(ah, AR_NDP_PERIOD, beacon_period);
 
         REGWRITE_BUFFER_FLUSH(ah);
 
@@ -2300,12 +2180,9 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
 
         ENABLE_REGWRITE_BUFFER(ah);
 
-        REG_WRITE(ah, AR_NEXT_TBTT_TIMER, TU_TO_USEC(bs->bs_nexttbtt));
-
-        REG_WRITE(ah, AR_BEACON_PERIOD,
-                  TU_TO_USEC(bs->bs_intval));
-        REG_WRITE(ah, AR_DMA_BEACON_PERIOD,
-                  TU_TO_USEC(bs->bs_intval));
+        REG_WRITE(ah, AR_NEXT_TBTT_TIMER, bs->bs_nexttbtt);
+        REG_WRITE(ah, AR_BEACON_PERIOD, bs->bs_intval);
+        REG_WRITE(ah, AR_DMA_BEACON_PERIOD, bs->bs_intval);
 
         REGWRITE_BUFFER_FLUSH(ah);
 
@@ -2333,9 +2210,8 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
 
         ENABLE_REGWRITE_BUFFER(ah);
 
-        REG_WRITE(ah, AR_NEXT_DTIM,
-                  TU_TO_USEC(bs->bs_nextdtim - SLEEP_SLOP));
-        REG_WRITE(ah, AR_NEXT_TIM, TU_TO_USEC(nextTbtt - SLEEP_SLOP));
+        REG_WRITE(ah, AR_NEXT_DTIM, bs->bs_nextdtim - SLEEP_SLOP);
+        REG_WRITE(ah, AR_NEXT_TIM, nextTbtt - SLEEP_SLOP);
 
         REG_WRITE(ah, AR_SLEEP1,
                   SM((CAB_TIMEOUT_VAL << 3), AR_SLEEP1_CAB_TIMEOUT)
@@ -2349,8 +2225,8 @@ void ath9k_hw_set_sta_beacon_timers(struct ath_hw *ah,
         REG_WRITE(ah, AR_SLEEP2,
                   SM(beacontimeout, AR_SLEEP2_BEACON_TIMEOUT));
 
-        REG_WRITE(ah, AR_TIM_PERIOD, TU_TO_USEC(beaconintval));
-        REG_WRITE(ah, AR_DTIM_PERIOD, TU_TO_USEC(dtimperiod));
+        REG_WRITE(ah, AR_TIM_PERIOD, beaconintval);
+        REG_WRITE(ah, AR_DTIM_PERIOD, dtimperiod);
 
         REGWRITE_BUFFER_FLUSH(ah);
 
@@ -2608,13 +2484,6 @@ int ath9k_hw_fill_cap_info(struct ath_hw *ah)
             ah->eep_ops->get_eeprom(ah, EEP_PAPRD))
                         pCap->hw_caps |= ATH9K_HW_CAP_PAPRD;
 
-        /*
-         * Fast channel change across bands is available
-         * only for AR9462 and AR9565.
-         */
-        if (AR_SREV_9462(ah) || AR_SREV_9565(ah))
-                pCap->hw_caps |= ATH9K_HW_CAP_FCC_BAND_SWITCH;
-
         return 0;
 }
 
@@ -2986,20 +2855,6 @@ static const struct ath_gen_timer_configuration gen_tmr_configuration[] =
 
 /* HW generic timer primitives */
 
-/* compute and clear index of rightmost 1 */
-static u32 rightmost_index(struct ath_gen_timer_table *timer_table, u32 *mask)
-{
-        u32 b;
-
-        b = *mask;
-        b &= (0-b);
-        *mask &= ~b;
-        b *= debruijn32;
-        b >>= 27;
-
-        return timer_table->gen_timer_index[b];
-}
-
 u32 ath9k_hw_gettsf32(struct ath_hw *ah)
 {
         return REG_READ(ah, AR_TSF_L32);
@@ -3015,6 +2870,10 @@ struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
         struct ath_gen_timer *timer;
 
+        if ((timer_index < AR_FIRST_NDP_TIMER) ||
+                (timer_index >= ATH_MAX_GEN_TIMER))
+                return NULL;
+
         timer = kzalloc(sizeof(struct ath_gen_timer), GFP_KERNEL);
         if (timer == NULL)
                 return NULL;
@@ -3032,23 +2891,13 @@ EXPORT_SYMBOL(ath_gen_timer_alloc);
 
 void ath9k_hw_gen_timer_start(struct ath_hw *ah,
                               struct ath_gen_timer *timer,
-                              u32 trig_timeout,
+                              u32 timer_next,
                               u32 timer_period)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
-        u32 tsf, timer_next;
-
-        BUG_ON(!timer_period);
-
-        set_bit(timer->index, &timer_table->timer_mask.timer_bits);
+        u32 mask = 0;
 
-        tsf = ath9k_hw_gettsf32(ah);
-
-        timer_next = tsf + trig_timeout;
-
-        ath_dbg(ath9k_hw_common(ah), BTCOEX,
-                "current tsf %x period %x timer_next %x\n",
-                tsf, timer_period, timer_next);
+        timer_table->timer_mask |= BIT(timer->index);
 
         /*
          * Program generic timer registers
@@ -3074,10 +2923,19 @@ void ath9k_hw_gen_timer_start(struct ath_hw *ah,
                                        (1 << timer->index));
         }
 
-        /* Enable both trigger and thresh interrupt masks */
-        REG_SET_BIT(ah, AR_IMR_S5,
-                (SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_THRESH) |
-                SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_TRIG)));
+        if (timer->trigger)
+                mask |= SM(AR_GENTMR_BIT(timer->index),
+                           AR_IMR_S5_GENTIMER_TRIG);
+        if (timer->overflow)
+                mask |= SM(AR_GENTMR_BIT(timer->index),
+                           AR_IMR_S5_GENTIMER_THRESH);
+
+        REG_SET_BIT(ah, AR_IMR_S5, mask);
+
+        if ((ah->imask & ATH9K_INT_GENTIMER) == 0) {
+                ah->imask |= ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah);
+        }
 }
 EXPORT_SYMBOL(ath9k_hw_gen_timer_start);
 
@@ -3085,11 +2943,6 @@ void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
 
-        if ((timer->index < AR_FIRST_NDP_TIMER) ||
-                (timer->index >= ATH_MAX_GEN_TIMER)) {
-                return;
-        }
-
         /* Clear generic timer enable bits. */
         REG_CLR_BIT(ah, gen_tmr_configuration[timer->index].mode_addr,
                         gen_tmr_configuration[timer->index].mode_mask);
@@ -3109,7 +2962,12 @@ void ath9k_hw_gen_timer_stop(struct ath_hw *ah, struct ath_gen_timer *timer)
                 (SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_THRESH) |
                 SM(AR_GENTMR_BIT(timer->index), AR_IMR_S5_GENTIMER_TRIG)));
 
-        clear_bit(timer->index, &timer_table->timer_mask.timer_bits);
+        timer_table->timer_mask &= ~BIT(timer->index);
+
+        if (timer_table->timer_mask == 0) {
+                ah->imask &= ~ATH9K_INT_GENTIMER;
+                ath9k_hw_set_interrupts(ah);
+        }
 }
 EXPORT_SYMBOL(ath9k_hw_gen_timer_stop);
 
@@ -3130,32 +2988,32 @@ void ath_gen_timer_isr(struct ath_hw *ah)
 {
         struct ath_gen_timer_table *timer_table = &ah->hw_gen_timers;
         struct ath_gen_timer *timer;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 trigger_mask, thresh_mask, index;
+        unsigned long trigger_mask, thresh_mask;
+        unsigned int index;
 
         /* get hardware generic timer interrupt status */
         trigger_mask = ah->intr_gen_timer_trigger;
         thresh_mask = ah->intr_gen_timer_thresh;
-        trigger_mask &= timer_table->timer_mask.val;
-        thresh_mask &= timer_table->timer_mask.val;
-
-        trigger_mask &= ~thresh_mask;
+        trigger_mask &= timer_table->timer_mask;
+        thresh_mask &= timer_table->timer_mask;
 
-        while (thresh_mask) {
-                index = rightmost_index(timer_table, &thresh_mask);
+        for_each_set_bit(index, &thresh_mask, ARRAY_SIZE(timer_table->timers)) {
                 timer = timer_table->timers[index];
-                BUG_ON(!timer);
-                ath_dbg(common, BTCOEX, "TSF overflow for Gen timer %d\n",
-                        index);
+                if (!timer)
+                    continue;
+                if (!timer->overflow)
+                    continue;
+
+                trigger_mask &= ~BIT(index);
                 timer->overflow(timer->arg);
         }
 
-        while (trigger_mask) {
-                index = rightmost_index(timer_table, &trigger_mask);
+        for_each_set_bit(index, &trigger_mask, ARRAY_SIZE(timer_table->timers)) {
                 timer = timer_table->timers[index];
-                BUG_ON(!timer);
-                ath_dbg(common, BTCOEX,
-                        "Gen timer[%d] trigger\n", index);
+                if (!timer)
+                    continue;
+                if (!timer->trigger)
+                    continue;
                 timer->trigger(timer->arg);
         }
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index a2c9a5dbac6b..0acd4b5a4892 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -52,6 +52,7 @@
 #define AR9300_DEVID_QCA955X    0x0038
 #define AR9485_DEVID_AR1111     0x0037
 #define AR9300_DEVID_AR9565     0x0036
+#define AR9300_DEVID_AR953X     0x003d
 
 #define AR5416_AR9100_DEVID     0x000b
 
@@ -168,7 +169,7 @@
 #define CAB_TIMEOUT_VAL             10
 #define BEACON_TIMEOUT_VAL          10
 #define MIN_BEACON_TIMEOUT_VAL      1
-#define SLEEP_SLOP                  3
+#define SLEEP_SLOP                  TU_TO_USEC(3)
 
 #define INIT_CONFIG_STATUS          0x00000000
 #define INIT_RSSI_THR               0x00000700
@@ -277,14 +278,25 @@ struct ath9k_hw_capabilities {
         u8 txs_len;
 };
 
+#define AR_NO_SPUR              0x8000
+#define AR_BASE_FREQ_2GHZ       2300
+#define AR_BASE_FREQ_5GHZ       4900
+#define AR_SPUR_FEEQ_BOUND_HT40 19
+#define AR_SPUR_FEEQ_BOUND_HT20 10
+
+enum ath9k_hw_hang_checks {
+        HW_BB_WATCHDOG            = BIT(0),
+        HW_PHYRESTART_CLC_WAR     = BIT(1),
+        HW_BB_RIFS_HANG           = BIT(2),
+        HW_BB_DFS_HANG            = BIT(3),
+        HW_BB_RX_CLEAR_STUCK_HANG = BIT(4),
+        HW_MAC_HANG               = BIT(5),
+};
+
 struct ath9k_ops_config {
         int dma_beacon_response_time;
         int sw_beacon_response_time;
-        int additional_swba_backoff;
-        int ack_6mb;
         u32 cwm_ignore_extcca;
-        bool pcieSerDesWrite;
-        u8 pcie_clock_req;
         u32 pcie_waen;
         u8 analog_shiftreg;
         u32 ofdm_trig_low;
@@ -295,20 +307,11 @@ struct ath9k_ops_config {
         int serialize_regmode;
         bool rx_intr_mitigation;
         bool tx_intr_mitigation;
-#define SPUR_DISABLE            0
-#define SPUR_ENABLE_IOCTL       1
-#define SPUR_ENABLE_EEPROM      2
-#define AR_SPUR_5413_1          1640
-#define AR_SPUR_5413_2          1200
-#define AR_NO_SPUR              0x8000
-#define AR_BASE_FREQ_2GHZ       2300
-#define AR_BASE_FREQ_5GHZ       4900
-#define AR_SPUR_FEEQ_BOUND_HT40 19
-#define AR_SPUR_FEEQ_BOUND_HT20 10
-        int spurmode;
-        u16 spurchans[AR_EEPROM_MODAL_SPURS][2];
         u8 max_txtrig_level;
         u16 ani_poll_interval; /* ANI poll interval in ms */
+        u16 hw_hang_checks;
+        u16 rimt_first;
+        u16 rimt_last;
 
         /* Platform specific config */
         u32 aspm_l1_fix;
@@ -317,6 +320,7 @@ struct ath9k_ops_config {
         bool xatten_margin_cfg;
         bool alt_mingainidx;
         bool no_pll_pwrsave;
+        bool tx_gain_buffalo;
 };
 
 enum ath9k_int {
@@ -460,10 +464,6 @@ struct ath9k_beacon_state {
         u32 bs_intval;
 #define ATH9K_TSFOOR_THRESHOLD    0x00004240 /* 16k us */
         u32 bs_dtimperiod;
-        u16 bs_cfpperiod;
-        u16 bs_cfpmaxduration;
-        u32 bs_cfpnext;
-        u16 bs_timoffset;
         u16 bs_bmissthreshold;
         u32 bs_sleepduration;
         u32 bs_tsfoor_threshold;
@@ -499,12 +499,6 @@ struct ath9k_hw_version {
 
 #define AR_GENTMR_BIT(_index)   (1 << (_index))
 
-/*
- * Using de Bruijin sequence to look up 1's index in a 32 bit number
- * debruijn32 = 0000 0111 0111 1100 1011 0101 0011 0001
- */
-#define debruijn32 0x077CB531U
-
 struct ath_gen_timer_configuration {
         u32 next_addr;
         u32 period_addr;
@@ -520,12 +514,8 @@ struct ath_gen_timer {
 };
 
 struct ath_gen_timer_table {
-        u32 gen_timer_index[32];
         struct ath_gen_timer *timers[ATH_MAX_GEN_TIMER];
-        union {
-                unsigned long timer_bits;
-                u16 val;
-        } timer_mask;
+        u16 timer_mask;
 };
 
 struct ath_hw_antcomb_conf {
@@ -596,6 +586,10 @@ struct ath_hw_radar_conf {
  *      register settings through the register initialization.
  */
 struct ath_hw_private_ops {
+        void (*init_hang_checks)(struct ath_hw *ah);
+        bool (*detect_mac_hang)(struct ath_hw *ah);
+        bool (*detect_bb_hang)(struct ath_hw *ah);
+
         /* Calibration ops */
         void (*init_cal_settings)(struct ath_hw *ah);
         bool (*init_cal)(struct ath_hw *ah, struct ath9k_channel *chan);
@@ -690,7 +684,8 @@ struct ath_hw_ops {
                           struct ath9k_channel *chan,
                           u8 rxchainmask,
                           bool longcal);
-        bool (*get_isr)(struct ath_hw *ah, enum ath9k_int *masked);
+        bool (*get_isr)(struct ath_hw *ah, enum ath9k_int *masked,
+                        u32 *sync_cause_p);
         void (*set_txdesc)(struct ath_hw *ah, void *ds,
                            struct ath_tx_info *i);
         int (*proc_txdesc)(struct ath_hw *ah, void *ds,
@@ -786,7 +781,6 @@ struct ath_hw {
         u32 txurn_interrupt_mask;
         atomic_t intr_ref_cnt;
         bool chip_fullsleep;
-        u32 atim_window;
         u32 modes_index;
 
         /* Calibration */
@@ -865,6 +859,7 @@ struct ath_hw {
         u32 gpio_mask;
         u32 gpio_val;
 
+        struct ar5416IniArray ini_dfs;
         struct ar5416IniArray iniModes;
         struct ar5416IniArray iniCommon;
         struct ar5416IniArray iniBB_RfGain;
@@ -921,7 +916,7 @@ struct ath_hw {
         /* Enterprise mode cap */
         u32 ent_mode;
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ATH9K_WOW
         u32 wow_event_mask;
 #endif
         bool is_clk_25mhz;
@@ -1017,13 +1012,6 @@ bool ath9k_hw_check_alive(struct ath_hw *ah);
 
 bool ath9k_hw_setpower(struct ath_hw *ah, enum ath9k_power_mode mode);
 
-#ifdef CONFIG_ATH9K_DEBUGFS
-void ath9k_debug_sync_cause(struct ath_common *common, u32 sync_cause);
-#else
-static inline void ath9k_debug_sync_cause(struct ath_common *common,
-                                          u32 sync_cause) {}
-#endif
-
 /* Generic hw timer primitives */
 struct ath_gen_timer *ath_gen_timer_alloc(struct ath_hw *ah,
                                           void (*trigger)(void *),
@@ -1058,6 +1046,7 @@ void ar9002_hw_enable_async_fifo(struct ath_hw *ah);
  * Code specific to AR9003, we stuff these here to avoid callbacks
  * for older families
  */
+bool ar9003_hw_bb_watchdog_check(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_config(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_read(struct ath_hw *ah);
 void ar9003_hw_bb_watchdog_dbg_info(struct ath_hw *ah);
@@ -1127,7 +1116,7 @@ ath9k_hw_get_btcoex_scheme(struct ath_hw *ah)
 #endif /* CONFIG_ATH9K_BTCOEX_SUPPORT */
 
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ATH9K_WOW
 const char *ath9k_hw_wow_event_to_string(u32 wow_event);
 void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
                                 u8 *user_mask, int pattern_count,
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 710192ed27ed..c36de303c8f3 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -470,7 +470,6 @@ static int ath9k_init_queues(struct ath_softc *sc)
 
         sc->beacon.beaconq = ath9k_hw_beaconq_setup(sc->sc_ah);
         sc->beacon.cabq = ath_txq_setup(sc, ATH9K_TX_QUEUE_CAB, 0);
-
         ath_cabq_update(sc);
 
         sc->tx.uapsdq = ath_txq_setup(sc, ATH9K_TX_QUEUE_UAPSD, 0);
@@ -554,7 +553,7 @@ static void ath9k_init_misc(struct ath_softc *sc)
         sc->spec_config.fft_period = 0xF;
 }
 
-static void ath9k_init_platform(struct ath_softc *sc)
+static void ath9k_init_pcoem_platform(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath9k_hw_capabilities *pCap = &ah->caps;
@@ -589,6 +588,9 @@ static void ath9k_init_platform(struct ath_softc *sc)
         if (sc->driver_data & ATH9K_PCI_AR9565_2ANT)
                 ath_info(common, "WB335 2-ANT card detected\n");
 
+        if (sc->driver_data & ATH9K_PCI_KILLER)
+                ath_info(common, "Killer Wireless card detected\n");
+
         /*
          * Some WB335 cards do not support antenna diversity. Since
          * we use a hardcoded value for AR9565 instead of using the
@@ -661,6 +663,27 @@ static void ath9k_eeprom_release(struct ath_softc *sc)
         release_firmware(sc->sc_ah->eeprom_blob);
 }
 
+static int ath9k_init_soc_platform(struct ath_softc *sc)
+{
+        struct ath9k_platform_data *pdata = sc->dev->platform_data;
+        struct ath_hw *ah = sc->sc_ah;
+        int ret = 0;
+
+        if (!pdata)
+                return 0;
+
+        if (pdata->eeprom_name) {
+                ret = ath9k_eeprom_request(sc, pdata->eeprom_name);
+                if (ret)
+                        return ret;
+        }
+
+        if (pdata->tx_gain_buffalo)
+                ah->config.tx_gain_buffalo = true;
+
+        return ret;
+}
+
 static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
                             const struct ath_bus_ops *bus_ops)
 {
@@ -681,13 +704,13 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         ah->reg_ops.read = ath9k_ioread32;
         ah->reg_ops.write = ath9k_iowrite32;
         ah->reg_ops.rmw = ath9k_reg_rmw;
-        atomic_set(&ah->intr_ref_cnt, -1);
         sc->sc_ah = ah;
         pCap = &ah->caps;
 
         common = ath9k_hw_common(ah);
         sc->dfs_detector = dfs_pattern_detector_init(common, NL80211_DFS_UNSET);
         sc->tx99_power = MAX_RATE_POWER + 1;
+        init_waitqueue_head(&sc->tx_wait);
 
         if (!pdata) {
                 ah->ah_flags |= AH_USE_EEPROM;
@@ -713,7 +736,11 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         /*
          * Platform quirks.
          */
-        ath9k_init_platform(sc);
+        ath9k_init_pcoem_platform(sc);
+
+        ret = ath9k_init_soc_platform(sc);
+        if (ret)
+                return ret;
 
         /*
          * Enable WLAN/BT RX Antenna diversity only when:
@@ -727,7 +754,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
                 common->bt_ant_diversity = 1;
 
         spin_lock_init(&common->cc_lock);
-
         spin_lock_init(&sc->sc_serial_rw);
         spin_lock_init(&sc->sc_pm_lock);
         mutex_init(&sc->mutex);
@@ -735,11 +761,10 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         tasklet_init(&sc->bcon_tasklet, ath9k_beacon_tasklet,
                      (unsigned long)sc);
 
+        setup_timer(&sc->sleep_timer, ath_ps_full_sleep, (unsigned long)sc);
         INIT_WORK(&sc->hw_reset_work, ath_reset_work);
-        INIT_WORK(&sc->hw_check_work, ath_hw_check);
         INIT_WORK(&sc->paprd_work, ath_paprd_calibrate);
         INIT_DELAYED_WORK(&sc->hw_pll_work, ath_hw_pll_work);
-        setup_timer(&sc->rx_poll_timer, ath_rx_poll, (unsigned long)sc);
 
         /*
          * Cache line size is used to size and align various
@@ -748,12 +773,6 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc,
         ath_read_cachesize(common, &csz);
         common->cachelsz = csz << 2; /* convert to bytes */
 
-        if (pdata && pdata->eeprom_name) {
-                ret = ath9k_eeprom_request(sc, pdata->eeprom_name);
-                if (ret)
-                        return ret;
-        }
-
         /* Initializes the hardware for all supported chipsets */
         ret = ath9k_hw_init(ah);
         if (ret)
@@ -851,6 +870,9 @@ static const struct ieee80211_iface_limit if_limits[] = {
 
 static const struct ieee80211_iface_limit if_dfs_limits[] = {
         { .max = 1,     .types = BIT(NL80211_IFTYPE_AP) |
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
                                  BIT(NL80211_IFTYPE_ADHOC) },
 };
 
@@ -873,16 +895,7 @@ static const struct ieee80211_iface_combination if_comb[] = {
         }
 };
 
-#ifdef CONFIG_PM
-static const struct wiphy_wowlan_support ath9k_wowlan_support = {
-        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
-        .n_patterns = MAX_NUM_USER_PATTERN,
-        .pattern_min_len = 1,
-        .pattern_max_len = MAX_PATTERN_SIZE,
-};
-#endif
-
-void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
+static void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
 {
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
@@ -931,19 +944,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
         hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_5_10_MHZ;
         hw->wiphy->flags |= WIPHY_FLAG_HAS_CHANNEL_SWITCH;
 
-#ifdef CONFIG_PM_SLEEP
-        if ((ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
-            (sc->driver_data & ATH9K_PCI_WOW) &&
-            device_can_wakeup(sc->dev))
-                hw->wiphy->wowlan = &ath9k_wowlan_support;
-
-        atomic_set(&sc->wow_sleep_proc_intr, -1);
-        atomic_set(&sc->wow_got_bmiss_intr, -1);
-#endif
-
         hw->queues = 4;
         hw->max_rates = 4;
-        hw->channel_change_time = 5000;
         hw->max_listen_interval = 1;
         hw->max_rate_tries = 10;
         hw->sta_data_size = sizeof(struct ath_node);
@@ -966,6 +968,7 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 hw->wiphy->bands[IEEE80211_BAND_5GHZ] =
                         &sc->sbands[IEEE80211_BAND_5GHZ];
 
+        ath9k_init_wow(hw);
         ath9k_reload_chainmask_settings(sc);
 
         SET_IEEE80211_PERM_ADDR(hw, common->macaddr);
@@ -1064,6 +1067,7 @@ static void ath9k_deinit_softc(struct ath_softc *sc)
                 if (ATH_TXQ_SETUP(sc, i))
                         ath_tx_cleanupq(sc, &sc->tx.txq[i]);
 
+        del_timer_sync(&sc->sleep_timer);
         ath9k_hw_deinit(sc->sc_ah);
         if (sc->dfs_detector != NULL)
                 sc->dfs_detector->exit(sc->dfs_detector);
diff --git a/drivers/net/wireless/ath/ath9k/link.c b/drivers/net/wireless/ath/ath9k/link.c
index aed7e29dc50f..30dcef5aba10 100644
--- a/drivers/net/wireless/ath/ath9k/link.c
+++ b/drivers/net/wireless/ath/ath9k/link.c
@@ -65,50 +65,26 @@ void ath_tx_complete_poll_work(struct work_struct *work)
 /*
  * Checks if the BB/MAC is hung.
  */
-void ath_hw_check(struct work_struct *work)
+bool ath_hw_check(struct ath_softc *sc)
 {
-        struct ath_softc *sc = container_of(work, struct ath_softc, hw_check_work);
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
-        unsigned long flags;
-        int busy;
-        u8 is_alive, nbeacon = 1;
         enum ath_reset_type type;
+        bool is_alive;
 
         ath9k_ps_wakeup(sc);
+
         is_alive = ath9k_hw_check_alive(sc->sc_ah);
 
-        if ((is_alive && !AR_SREV_9300(sc->sc_ah)) || sc->tx99_state)
-                goto out;
-        else if (!is_alive && AR_SREV_9300(sc->sc_ah)) {
+        if (!is_alive) {
                 ath_dbg(common, RESET,
-                        "DCU stuck is detected. Schedule chip reset\n");
+                        "HW hang detected, schedule chip reset\n");
                 type = RESET_TYPE_MAC_HANG;
-                goto sched_reset;
-        }
-
-        spin_lock_irqsave(&common->cc_lock, flags);
-        busy = ath_update_survey_stats(sc);
-        spin_unlock_irqrestore(&common->cc_lock, flags);
-
-        ath_dbg(common, RESET, "Possible baseband hang, busy=%d (try %d)\n",
-                busy, sc->hw_busy_count + 1);
-        if (busy >= 99) {
-                if (++sc->hw_busy_count >= 3) {
-                        type = RESET_TYPE_BB_HANG;
-                        goto sched_reset;
-                }
-        } else if (busy >= 0) {
-                sc->hw_busy_count = 0;
-                nbeacon = 3;
+                ath9k_queue_reset(sc, type);
         }
 
-        ath_start_rx_poll(sc, nbeacon);
-        goto out;
-
-sched_reset:
-        ath9k_queue_reset(sc, type);
-out:
         ath9k_ps_restore(sc);
+
+        return is_alive;
 }
 
 /*
@@ -162,29 +138,6 @@ void ath_hw_pll_work(struct work_struct *work)
 }
 
 /*
- * RX Polling - monitors baseband hangs.
- */
-void ath_start_rx_poll(struct ath_softc *sc, u8 nbeacon)
-{
-        if (!AR_SREV_9300(sc->sc_ah))
-                return;
-
-        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags))
-                return;
-
-        mod_timer(&sc->rx_poll_timer, jiffies + msecs_to_jiffies
-                  (nbeacon * sc->cur_beacon_conf.beacon_interval));
-}
-
-void ath_rx_poll(unsigned long data)
-{
-        struct ath_softc *sc = (struct ath_softc *)data;
-
-        if (!test_bit(SC_OP_INVALID, &sc->sc_flags))
-                ieee80211_queue_work(sc->hw, &sc->hw_check_work);
-}
-
-/*
  * PA Pre-distortion.
  */
 static void ath_paprd_activate(struct ath_softc *sc)
@@ -409,10 +362,10 @@ void ath_ani_calibrate(unsigned long data)
 
         /* Call ANI routine if necessary */
         if (aniflag) {
-                spin_lock_irqsave(&common->cc_lock, flags);
+                spin_lock(&common->cc_lock);
                 ath9k_hw_ani_monitor(ah, ah->curchan);
                 ath_update_survey_stats(sc);
-                spin_unlock_irqrestore(&common->cc_lock, flags);
+                spin_unlock(&common->cc_lock);
         }
 
         /* Perform calibration if necessary */
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 6a18f9d3e9cc..5f727588ca27 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -481,8 +481,7 @@ bool ath9k_hw_resettxqueue(struct ath_hw *ah, u32 q)
                             | AR_Q_MISC_CBR_INCR_DIS0);
                 value = (qi->tqi_readyTime -
                          (ah->config.sw_beacon_response_time -
-                          ah->config.dma_beacon_response_time) -
-                         ah->config.additional_swba_backoff) * 1024;
+                          ah->config.dma_beacon_response_time)) * 1024;
                 REG_WRITE(ah, AR_QRDYTIMECFG(q),
                           value | AR_Q_RDYTIMECFG_EN);
                 REG_SET_BIT(ah, AR_DMISC(q),
@@ -550,25 +549,25 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
 
         if (ads.ds_rxstatus8 & AR_PostDelimCRCErr) {
                 rs->rs_rssi = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ctl0 = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ctl1 = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ctl2 = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ext0 = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ext1 = ATH9K_RSSI_BAD;
-                rs->rs_rssi_ext2 = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl[0] = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl[1] = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ctl[2] = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext[0] = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext[1] = ATH9K_RSSI_BAD;
+                rs->rs_rssi_ext[2] = ATH9K_RSSI_BAD;
         } else {
                 rs->rs_rssi = MS(ads.ds_rxstatus4, AR_RxRSSICombined);
-                rs->rs_rssi_ctl0 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi_ctl[0] = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt00);
-                rs->rs_rssi_ctl1 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi_ctl[1] = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt01);
-                rs->rs_rssi_ctl2 = MS(ads.ds_rxstatus0,
+                rs->rs_rssi_ctl[2] = MS(ads.ds_rxstatus0,
                                                 AR_RxRSSIAnt02);
-                rs->rs_rssi_ext0 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext[0] = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt10);
-                rs->rs_rssi_ext1 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext[1] = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt11);
-                rs->rs_rssi_ext2 = MS(ads.ds_rxstatus4,
+                rs->rs_rssi_ext[2] = MS(ads.ds_rxstatus4,
                                                 AR_RxRSSIAnt12);
         }
         if (ads.ds_rxstatus8 & AR_RxKeyIdxValid)
@@ -923,11 +922,29 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah)
                         mask2 |= AR_IMR_S2_CST;
         }
 
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG) {
+                if (ints & ATH9K_INT_BB_WATCHDOG) {
+                        mask |= AR_IMR_BCNMISC;
+                        mask2 |= AR_IMR_S2_BB_WATCHDOG;
+                }
+        }
+
         ath_dbg(common, INTERRUPT, "new IMR 0x%x\n", mask);
         REG_WRITE(ah, AR_IMR, mask);
-        ah->imrs2_reg &= ~(AR_IMR_S2_TIM | AR_IMR_S2_DTIM | AR_IMR_S2_DTIMSYNC |
-                           AR_IMR_S2_CABEND | AR_IMR_S2_CABTO |
-                           AR_IMR_S2_TSFOOR | AR_IMR_S2_GTT | AR_IMR_S2_CST);
+        ah->imrs2_reg &= ~(AR_IMR_S2_TIM |
+                           AR_IMR_S2_DTIM |
+                           AR_IMR_S2_DTIMSYNC |
+                           AR_IMR_S2_CABEND |
+                           AR_IMR_S2_CABTO |
+                           AR_IMR_S2_TSFOOR |
+                           AR_IMR_S2_GTT |
+                           AR_IMR_S2_CST);
+
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG) {
+                if (ints & ATH9K_INT_BB_WATCHDOG)
+                        ah->imrs2_reg &= ~AR_IMR_S2_BB_WATCHDOG;
+        }
+
         ah->imrs2_reg |= mask2;
         REG_WRITE(ah, AR_IMR_S2, ah->imrs2_reg);
 
diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h
index e3eed81f2439..10271373a0cd 100644
--- a/drivers/net/wireless/ath/ath9k/mac.h
+++ b/drivers/net/wireless/ath/ath9k/mac.h
@@ -133,12 +133,8 @@ struct ath_rx_status {
         u8 rs_rate;
         u8 rs_antenna;
         u8 rs_more;
-        int8_t rs_rssi_ctl0;
-        int8_t rs_rssi_ctl1;
-        int8_t rs_rssi_ctl2;
-        int8_t rs_rssi_ext0;
-        int8_t rs_rssi_ext1;
-        int8_t rs_rssi_ext2;
+        int8_t rs_rssi_ctl[3];
+        int8_t rs_rssi_ext[3];
         u8 rs_isaggr;
         u8 rs_firstaggr;
         u8 rs_moreaggr;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 21aa09e0e825..5924f72dd493 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -82,6 +82,22 @@ static bool ath9k_setpower(struct ath_softc *sc, enum ath9k_power_mode mode)
         return ret;
 }
 
+void ath_ps_full_sleep(unsigned long data)
+{
+        struct ath_softc *sc = (struct ath_softc *) data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        bool reset;
+
+        spin_lock(&common->cc_lock);
+        ath_hw_cycle_counters_update(common);
+        spin_unlock(&common->cc_lock);
+
+        ath9k_hw_setrxabort(sc->sc_ah, 1);
+        ath9k_hw_stopdmarecv(sc->sc_ah, &reset);
+
+        ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_FULL_SLEEP);
+}
+
 void ath9k_ps_wakeup(struct ath_softc *sc)
 {
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
@@ -92,6 +108,7 @@ void ath9k_ps_wakeup(struct ath_softc *sc)
         if (++sc->ps_usecount != 1)
                 goto unlock;
 
+        del_timer_sync(&sc->sleep_timer);
         power_mode = sc->sc_ah->power_mode;
         ath9k_hw_setpower(sc->sc_ah, ATH9K_PM_AWAKE);
 
@@ -117,17 +134,17 @@ void ath9k_ps_restore(struct ath_softc *sc)
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         enum ath9k_power_mode mode;
         unsigned long flags;
-        bool reset;
 
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if (--sc->ps_usecount != 0)
                 goto unlock;
 
         if (sc->ps_idle) {
-                ath9k_hw_setrxabort(sc->sc_ah, 1);
-                ath9k_hw_stopdmarecv(sc->sc_ah, &reset);
-                mode = ATH9K_PM_FULL_SLEEP;
-        } else if (sc->ps_enabled &&
+                mod_timer(&sc->sleep_timer, jiffies + HZ / 10);
+                goto unlock;
+        }
+
+        if (sc->ps_enabled &&
                    !(sc->ps_flags & (PS_WAIT_FOR_BEACON |
                                      PS_WAIT_FOR_CAB |
                                      PS_WAIT_FOR_PSPOLL_DATA |
@@ -153,7 +170,6 @@ void ath9k_ps_restore(struct ath_softc *sc)
 static void __ath_cancel_work(struct ath_softc *sc)
 {
         cancel_work_sync(&sc->paprd_work);
-        cancel_work_sync(&sc->hw_check_work);
         cancel_delayed_work_sync(&sc->tx_complete_work);
         cancel_delayed_work_sync(&sc->hw_pll_work);
 
@@ -163,13 +179,13 @@ static void __ath_cancel_work(struct ath_softc *sc)
 #endif
 }
 
-static void ath_cancel_work(struct ath_softc *sc)
+void ath_cancel_work(struct ath_softc *sc)
 {
         __ath_cancel_work(sc);
         cancel_work_sync(&sc->hw_reset_work);
 }
 
-static void ath_restart_work(struct ath_softc *sc)
+void ath_restart_work(struct ath_softc *sc)
 {
         ieee80211_queue_delayed_work(sc->hw, &sc->tx_complete_work, 0);
 
@@ -177,7 +193,6 @@ static void ath_restart_work(struct ath_softc *sc)
                 ieee80211_queue_delayed_work(sc->hw, &sc->hw_pll_work,
                                      msecs_to_jiffies(ATH_PLL_WORK_INTERVAL));
 
-        ath_start_rx_poll(sc, 3);
         ath_start_ani(sc);
 }
 
@@ -187,11 +202,7 @@ static bool ath_prepare_reset(struct ath_softc *sc)
         bool ret = true;
 
         ieee80211_stop_queues(sc->hw);
-
-        sc->hw_busy_count = 0;
         ath_stop_ani(sc);
-        del_timer_sync(&sc->rx_poll_timer);
-
         ath9k_hw_disable_interrupts(ah);
 
         if (!ath_drain_all_txq(sc))
@@ -247,6 +258,7 @@ static bool ath_complete_reset(struct ath_softc *sc, bool start)
                 }
         }
 
+        sc->gtt_cnt = 0;
         ieee80211_wake_queues(sc->hw);
 
         return true;
@@ -319,7 +331,6 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
         struct ieee80211_hw *hw = sc->hw;
         struct ath9k_channel *hchan;
         struct ieee80211_channel *chan = chandef->chan;
-        unsigned long flags;
         bool offchannel;
         int pos = chan->hw_value;
         int old_pos = -1;
@@ -337,9 +348,9 @@ static int ath_set_channel(struct ath_softc *sc, struct cfg80211_chan_def *chand
                 chan->center_freq, chandef->width);
 
         /* update survey stats for the old channel before switching */
-        spin_lock_irqsave(&common->cc_lock, flags);
+        spin_lock_bh(&common->cc_lock);
         ath_update_survey_stats(sc);
-        spin_unlock_irqrestore(&common->cc_lock, flags);
+        spin_unlock_bh(&common->cc_lock);
 
         ath9k_cmn_get_channel(hw, ah, chandef);
 
@@ -410,12 +421,6 @@ static void ath_node_attach(struct ath_softc *sc, struct ieee80211_sta *sta,
         an->vif = vif;
 
         ath_tx_node_init(sc, an);
-
-        if (sta->ht_cap.ht_supported) {
-                an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
-                                     sta->ht_cap.ampdu_factor);
-                an->mpdudensity = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
-        }
 }
 
 static void ath_node_detach(struct ath_softc *sc, struct ieee80211_sta *sta)
@@ -437,14 +442,8 @@ void ath9k_tasklet(unsigned long data)
         ath9k_ps_wakeup(sc);
         spin_lock(&sc->sc_pcu_lock);
 
-        if ((status & ATH9K_INT_FATAL) ||
-            (status & ATH9K_INT_BB_WATCHDOG)) {
-
-                if (status & ATH9K_INT_FATAL)
-                        type = RESET_TYPE_FATAL_INT;
-                else
-                        type = RESET_TYPE_BB_WATCHDOG;
-
+        if (status & ATH9K_INT_FATAL) {
+                type = RESET_TYPE_FATAL_INT;
                 ath9k_queue_reset(sc, type);
 
                 /*
@@ -456,6 +455,41 @@ void ath9k_tasklet(unsigned long data)
                 goto out;
         }
 
+        if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
+            (status & ATH9K_INT_BB_WATCHDOG)) {
+                spin_lock(&common->cc_lock);
+                ath_hw_cycle_counters_update(common);
+                ar9003_hw_bb_watchdog_dbg_info(ah);
+                spin_unlock(&common->cc_lock);
+
+                if (ar9003_hw_bb_watchdog_check(ah)) {
+                        type = RESET_TYPE_BB_WATCHDOG;
+                        ath9k_queue_reset(sc, type);
+
+                        /*
+                         * Increment the ref. counter here so that
+                         * interrupts are enabled in the reset routine.
+                         */
+                        atomic_inc(&ah->intr_ref_cnt);
+                        ath_dbg(common, ANY,
+                                "BB_WATCHDOG: Skipping interrupts\n");
+                        goto out;
+                }
+        }
+
+        if (status & ATH9K_INT_GTT) {
+                sc->gtt_cnt++;
+
+                if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) {
+                        type = RESET_TYPE_TX_GTT;
+                        ath9k_queue_reset(sc, type);
+                        atomic_inc(&ah->intr_ref_cnt);
+                        ath_dbg(common, ANY,
+                                "GTT: Skipping interrupts\n");
+                        goto out;
+                }
+        }
+
         spin_lock_irqsave(&sc->sc_pm_lock, flags);
         if ((status & ATH9K_INT_TSFOOR) && sc->ps_enabled) {
                 /*
@@ -483,12 +517,26 @@ void ath9k_tasklet(unsigned long data)
         }
 
         if (status & ATH9K_INT_TX) {
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+                        /*
+                         * For EDMA chips, TX completion is enabled for the
+                         * beacon queue, so if a beacon has been transmitted
+                         * successfully after a GTT interrupt, the GTT counter
+                         * gets reset to zero here.
+                         */
+                        sc->gtt_cnt = 0;
+
                         ath_tx_edma_tasklet(sc);
-                else
+                } else {
                         ath_tx_tasklet(sc);
+                }
+
+                wake_up(&sc->tx_wait);
         }
 
+        if (status & ATH9K_INT_GENTIMER)
+                ath_gen_timer_isr(sc->sc_ah);
+
         ath9k_btcoex_handle_interrupt(sc, status);
 
         /* re-enable hardware interrupt */
@@ -511,14 +559,15 @@ irqreturn_t ath_isr(int irq, void *dev)
                 ATH9K_INT_TX |                  \
                 ATH9K_INT_BMISS |               \
                 ATH9K_INT_CST |                 \
+                ATH9K_INT_GTT |                 \
                 ATH9K_INT_TSFOOR |              \
                 ATH9K_INT_GENTIMER |            \
                 ATH9K_INT_MCI)
 
         struct ath_softc *sc = dev;
         struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
         enum ath9k_int status;
+        u32 sync_cause = 0;
         bool sched = false;
 
         /*
@@ -545,7 +594,8 @@ irqreturn_t ath_isr(int irq, void *dev)
          * bits we haven't explicitly enabled so we mask the
          * value to insure we only process bits we requested.
          */
-        ath9k_hw_getisr(ah, &status);   /* NB: clears ISR too */
+        ath9k_hw_getisr(ah, &status, &sync_cause); /* NB: clears ISR too */
+        ath9k_debug_sync_cause(sc, sync_cause);
         status &= ah->imask;    /* discard unasked-for bits */
 
         /*
@@ -569,25 +619,19 @@ irqreturn_t ath_isr(int irq, void *dev)
             !(ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)))
                 goto chip_reset;
 
-        if ((ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) &&
-            (status & ATH9K_INT_BB_WATCHDOG)) {
-
-                spin_lock(&common->cc_lock);
-                ath_hw_cycle_counters_update(common);
-                ar9003_hw_bb_watchdog_dbg_info(ah);
-                spin_unlock(&common->cc_lock);
-
+        if ((ah->config.hw_hang_checks & HW_BB_WATCHDOG) &&
+            (status & ATH9K_INT_BB_WATCHDOG))
                 goto chip_reset;
-        }
-#ifdef CONFIG_PM_SLEEP
+
+#ifdef CONFIG_ATH9K_WOW
         if (status & ATH9K_INT_BMISS) {
                 if (atomic_read(&sc->wow_sleep_proc_intr) == 0) {
-                        ath_dbg(common, ANY, "during WoW we got a BMISS\n");
                         atomic_inc(&sc->wow_got_bmiss_intr);
                         atomic_dec(&sc->wow_sleep_proc_intr);
                 }
         }
 #endif
+
         if (status & ATH9K_INT_SWBA)
                 tasklet_schedule(&sc->bcon_tasklet);
 
@@ -627,7 +671,7 @@ chip_reset:
 #undef SCHED_INTR
 }
 
-static int ath_reset(struct ath_softc *sc)
+int ath_reset(struct ath_softc *sc)
 {
         int r;
 
@@ -705,12 +749,19 @@ static int ath9k_start(struct ieee80211_hw *hw)
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ah->imask |= ATH9K_INT_RXHP |
-                             ATH9K_INT_RXLP |
-                             ATH9K_INT_BB_WATCHDOG;
+                             ATH9K_INT_RXLP;
         else
                 ah->imask |= ATH9K_INT_RX;
 
-        ah->imask |= ATH9K_INT_GTT;
+        if (ah->config.hw_hang_checks & HW_BB_WATCHDOG)
+                ah->imask |= ATH9K_INT_BB_WATCHDOG;
+
+        /*
+         * Enable GTT interrupts only for AR9003/AR9004 chips
+         * for now.
+         */
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                ah->imask |= ATH9K_INT_GTT;
 
         if (ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                 ah->imask |= ATH9K_INT_CST;
@@ -735,6 +786,8 @@ static int ath9k_start(struct ieee80211_hw *hw)
          */
         ath9k_cmn_init_crypto(sc->sc_ah);
 
+        ath9k_hw_reset_tsf(ah);
+
         spin_unlock_bh(&sc->sc_pcu_lock);
 
         mutex_unlock(&sc->mutex);
@@ -831,7 +884,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
         mutex_lock(&sc->mutex);
 
         ath_cancel_work(sc);
-        del_timer_sync(&sc->rx_poll_timer);
 
         if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
                 ath_dbg(common, ANY, "Device not present\n");
@@ -1636,13 +1688,8 @@ static void ath9k_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if ((changed & BSS_CHANGED_BEACON_ENABLED) ||
-            (changed & BSS_CHANGED_BEACON_INT)) {
-                if (ah->opmode == NL80211_IFTYPE_AP &&
-                    bss_conf->enable_beacon)
-                        ath9k_set_tsfadjust(sc, vif);
-                if (ath9k_allow_beacon_config(sc, vif))
-                        ath9k_beacon_config(sc, vif, changed);
-        }
+            (changed & BSS_CHANGED_BEACON_INT))
+                ath9k_beacon_config(sc, vif, changed);
 
         if (changed & BSS_CHANGED_ERP_SLOT) {
                 if (bss_conf->use_short_slot)
@@ -1767,13 +1814,12 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
         struct ath_common *common = ath9k_hw_common(sc->sc_ah);
         struct ieee80211_supported_band *sband;
         struct ieee80211_channel *chan;
-        unsigned long flags;
         int pos;
 
         if (config_enabled(CONFIG_ATH9K_TX99))
                 return -EOPNOTSUPP;
 
-        spin_lock_irqsave(&common->cc_lock, flags);
+        spin_lock_bh(&common->cc_lock);
         if (idx == 0)
                 ath_update_survey_stats(sc);
 
@@ -1787,7 +1833,7 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
                 sband = hw->wiphy->bands[IEEE80211_BAND_5GHZ];
 
         if (!sband || idx >= sband->n_channels) {
-                spin_unlock_irqrestore(&common->cc_lock, flags);
+                spin_unlock_bh(&common->cc_lock);
                 return -ENOENT;
         }
 
@@ -1795,7 +1841,7 @@ static int ath9k_get_survey(struct ieee80211_hw *hw, int idx,
         pos = chan->hw_value;
         memcpy(survey, &sc->survey[pos], sizeof(*survey));
         survey->channel = chan;
-        spin_unlock_irqrestore(&common->cc_lock, flags);
+        spin_unlock_bh(&common->cc_lock);
 
         return 0;
 }
@@ -1818,13 +1864,31 @@ static void ath9k_set_coverage_class(struct ieee80211_hw *hw, u8 coverage_class)
         mutex_unlock(&sc->mutex);
 }
 
+static bool ath9k_has_tx_pending(struct ath_softc *sc)
+{
+        int i, npend;
+
+        for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
+                if (!ATH_TXQ_SETUP(sc, i))
+                        continue;
+
+                if (!sc->tx.txq[i].axq_depth)
+                        continue;
+
+                npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i]);
+                if (npend)
+                        break;
+        }
+
+        return !!npend;
+}
+
 static void ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
 {
         struct ath_softc *sc = hw->priv;
         struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        int timeout = 200; /* ms */
-        int i, j;
+        int timeout = HZ / 5; /* 200 ms */
         bool drain_txq;
 
         mutex_lock(&sc->mutex);
@@ -1842,25 +1906,9 @@ static void ath9k_flush(struct ieee80211_hw *hw, u32 queues, bool drop)
                 return;
         }
 
-        for (j = 0; j < timeout; j++) {
-                bool npend = false;
-
-                if (j)
-                        usleep_range(1000, 2000);
-
-                for (i = 0; i < ATH9K_NUM_TX_QUEUES; i++) {
-                        if (!ATH_TXQ_SETUP(sc, i))
-                                continue;
-
-                        npend = ath9k_has_pending_frames(sc, &sc->tx.txq[i]);
-
-                        if (npend)
-                                break;
-                }
-
-                if (!npend)
-                    break;
-        }
+        if (wait_event_timeout(sc->tx_wait, !ath9k_has_tx_pending(sc),
+                               timeout) > 0)
+                drop = false;
 
         if (drop) {
                 ath9k_ps_wakeup(sc);
@@ -2022,333 +2070,6 @@ static int ath9k_get_antenna(struct ieee80211_hw *hw, u32 *tx_ant, u32 *rx_ant)
         return 0;
 }
 
-#ifdef CONFIG_PM_SLEEP
-
-static void ath9k_wow_map_triggers(struct ath_softc *sc,
-                                   struct cfg80211_wowlan *wowlan,
-                                   u32 *wow_triggers)
-{
-        if (wowlan->disconnect)
-                *wow_triggers |= AH_WOW_LINK_CHANGE |
-                                 AH_WOW_BEACON_MISS;
-        if (wowlan->magic_pkt)
-                *wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
-
-        if (wowlan->n_patterns)
-                *wow_triggers |= AH_WOW_USER_PATTERN_EN;
-
-        sc->wow_enabled = *wow_triggers;
-
-}
-
-static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        int pattern_count = 0;
-        int i, byte_cnt;
-        u8 dis_deauth_pattern[MAX_PATTERN_SIZE];
-        u8 dis_deauth_mask[MAX_PATTERN_SIZE];
-
-        memset(dis_deauth_pattern, 0, MAX_PATTERN_SIZE);
-        memset(dis_deauth_mask, 0, MAX_PATTERN_SIZE);
-
-        /*
-         * Create Dissassociate / Deauthenticate packet filter
-         *
-         *     2 bytes        2 byte    6 bytes   6 bytes  6 bytes
-         *  +--------------+----------+---------+--------+--------+----
-         *  + Frame Control+ Duration +   DA    +  SA    +  BSSID +
-         *  +--------------+----------+---------+--------+--------+----
-         *
-         * The above is the management frame format for disassociate/
-         * deauthenticate pattern, from this we need to match the first byte
-         * of 'Frame Control' and DA, SA, and BSSID fields
-         * (skipping 2nd byte of FC and Duration feild.
-         *
-         * Disassociate pattern
-         * --------------------
-         * Frame control = 00 00 1010
-         * DA, SA, BSSID = x:x:x:x:x:x
-         * Pattern will be A0000000 | x:x:x:x:x:x | x:x:x:x:x:x
-         *                          | x:x:x:x:x:x  -- 22 bytes
-         *
-         * Deauthenticate pattern
-         * ----------------------
-         * Frame control = 00 00 1100
-         * DA, SA, BSSID = x:x:x:x:x:x
-         * Pattern will be C0000000 | x:x:x:x:x:x | x:x:x:x:x:x
-         *                          | x:x:x:x:x:x  -- 22 bytes
-         */
-
-        /* Create Disassociate Pattern first */
-
-        byte_cnt = 0;
-
-        /* Fill out the mask with all FF's */
-
-        for (i = 0; i < MAX_PATTERN_MASK_SIZE; i++)
-                dis_deauth_mask[i] = 0xff;
-
-        /* copy the first byte of frame control field */
-        dis_deauth_pattern[byte_cnt] = 0xa0;
-        byte_cnt++;
-
-        /* skip 2nd byte of frame control and Duration field */
-        byte_cnt += 3;
-
-        /*
-         * need not match the destination mac address, it can be a broadcast
-         * mac address or an unicast to this station
-         */
-        byte_cnt += 6;
-
-        /* copy the source mac address */
-        memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
-
-        byte_cnt += 6;
-
-        /* copy the bssid, its same as the source mac address */
-
-        memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
-
-        /* Create Disassociate pattern mask */
-
-        dis_deauth_mask[0] = 0xfe;
-        dis_deauth_mask[1] = 0x03;
-        dis_deauth_mask[2] = 0xc0;
-
-        ath_dbg(common, WOW, "Adding disassoc/deauth patterns for WoW\n");
-
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
-
-        pattern_count++;
-        /*
-         * for de-authenticate pattern, only the first byte of the frame
-         * control field gets changed from 0xA0 to 0xC0
-         */
-        dis_deauth_pattern[0] = 0xC0;
-
-        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
-                                   pattern_count, byte_cnt);
-
-}
-
-static void ath9k_wow_add_pattern(struct ath_softc *sc,
-                                  struct cfg80211_wowlan *wowlan)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath9k_wow_pattern *wow_pattern = NULL;
-        struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
-        int mask_len;
-        s8 i = 0;
-
-        if (!wowlan->n_patterns)
-                return;
-
-        /*
-         * Add the new user configured patterns
-         */
-        for (i = 0; i < wowlan->n_patterns; i++) {
-
-                wow_pattern = kzalloc(sizeof(*wow_pattern), GFP_KERNEL);
-
-                if (!wow_pattern)
-                        return;
-
-                /*
-                 * TODO: convert the generic user space pattern to
-                 * appropriate chip specific/802.11 pattern.
-                 */
-
-                mask_len = DIV_ROUND_UP(wowlan->patterns[i].pattern_len, 8);
-                memset(wow_pattern->pattern_bytes, 0, MAX_PATTERN_SIZE);
-                memset(wow_pattern->mask_bytes, 0, MAX_PATTERN_SIZE);
-                memcpy(wow_pattern->pattern_bytes, patterns[i].pattern,
-                       patterns[i].pattern_len);
-                memcpy(wow_pattern->mask_bytes, patterns[i].mask, mask_len);
-                wow_pattern->pattern_len = patterns[i].pattern_len;
-
-                /*
-                 * just need to take care of deauth and disssoc pattern,
-                 * make sure we don't overwrite them.
-                 */
-
-                ath9k_hw_wow_apply_pattern(ah, wow_pattern->pattern_bytes,
-                                           wow_pattern->mask_bytes,
-                                           i + 2,
-                                           wow_pattern->pattern_len);
-                kfree(wow_pattern);
-
-        }
-
-}
-
-static int ath9k_suspend(struct ieee80211_hw *hw,
-                         struct cfg80211_wowlan *wowlan)
-{
-        struct ath_softc *sc = hw->priv;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_triggers_enabled = 0;
-        int ret = 0;
-
-        mutex_lock(&sc->mutex);
-
-        ath_cancel_work(sc);
-        ath_stop_ani(sc);
-        del_timer_sync(&sc->rx_poll_timer);
-
-        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
-                ath_dbg(common, ANY, "Device not present\n");
-                ret = -EINVAL;
-                goto fail_wow;
-        }
-
-        if (WARN_ON(!wowlan)) {
-                ath_dbg(common, WOW, "None of the WoW triggers enabled\n");
-                ret = -EINVAL;
-                goto fail_wow;
-        }
-
-        if (!device_can_wakeup(sc->dev)) {
-                ath_dbg(common, WOW, "device_can_wakeup failed, WoW is not enabled\n");
-                ret = 1;
-                goto fail_wow;
-        }
-
-        /*
-         * none of the sta vifs are associated
-         * and we are not currently handling multivif
-         * cases, for instance we have to seperately
-         * configure 'keep alive frame' for each
-         * STA.
-         */
-
-        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
-                ath_dbg(common, WOW, "None of the STA vifs are associated\n");
-                ret = 1;
-                goto fail_wow;
-        }
-
-        if (sc->nvifs > 1) {
-                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
-                ret = 1;
-                goto fail_wow;
-        }
-
-        ath9k_wow_map_triggers(sc, wowlan, &wow_triggers_enabled);
-
-        ath_dbg(common, WOW, "WoW triggers enabled 0x%x\n",
-                wow_triggers_enabled);
-
-        ath9k_ps_wakeup(sc);
-
-        ath9k_stop_btcoex(sc);
-
-        /*
-         * Enable wake up on recieving disassoc/deauth
-         * frame by default.
-         */
-        ath9k_wow_add_disassoc_deauth_pattern(sc);
-
-        if (wow_triggers_enabled & AH_WOW_USER_PATTERN_EN)
-                ath9k_wow_add_pattern(sc, wowlan);
-
-        spin_lock_bh(&sc->sc_pcu_lock);
-        /*
-         * To avoid false wake, we enable beacon miss interrupt only
-         * when we go to sleep. We save the current interrupt mask
-         * so we can restore it after the system wakes up
-         */
-        sc->wow_intr_before_sleep = ah->imask;
-        ah->imask &= ~ATH9K_INT_GLOBAL;
-        ath9k_hw_disable_interrupts(ah);
-        ah->imask = ATH9K_INT_BMISS | ATH9K_INT_GLOBAL;
-        ath9k_hw_set_interrupts(ah);
-        ath9k_hw_enable_interrupts(ah);
-
-        spin_unlock_bh(&sc->sc_pcu_lock);
-
-        /*
-         * we can now sync irq and kill any running tasklets, since we already
-         * disabled interrupts and not holding a spin lock
-         */
-        synchronize_irq(sc->irq);
-        tasklet_kill(&sc->intr_tq);
-
-        ath9k_hw_wow_enable(ah, wow_triggers_enabled);
-
-        ath9k_ps_restore(sc);
-        ath_dbg(common, ANY, "WoW enabled in ath9k\n");
-        atomic_inc(&sc->wow_sleep_proc_intr);
-
-fail_wow:
-        mutex_unlock(&sc->mutex);
-        return ret;
-}
-
-static int ath9k_resume(struct ieee80211_hw *hw)
-{
-        struct ath_softc *sc = hw->priv;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        u32 wow_status;
-
-        mutex_lock(&sc->mutex);
-
-        ath9k_ps_wakeup(sc);
-
-        spin_lock_bh(&sc->sc_pcu_lock);
-
-        ath9k_hw_disable_interrupts(ah);
-        ah->imask = sc->wow_intr_before_sleep;
-        ath9k_hw_set_interrupts(ah);
-        ath9k_hw_enable_interrupts(ah);
-
-        spin_unlock_bh(&sc->sc_pcu_lock);
-
-        wow_status = ath9k_hw_wow_wakeup(ah);
-
-        if (atomic_read(&sc->wow_got_bmiss_intr) == 0) {
-                /*
-                 * some devices may not pick beacon miss
-                 * as the reason they woke up so we add
-                 * that here for that shortcoming.
-                 */
-                wow_status |= AH_WOW_BEACON_MISS;
-                atomic_dec(&sc->wow_got_bmiss_intr);
-                ath_dbg(common, ANY, "Beacon miss interrupt picked up during WoW sleep\n");
-        }
-
-        atomic_dec(&sc->wow_sleep_proc_intr);
-
-        if (wow_status) {
-                ath_dbg(common, ANY, "Waking up due to WoW triggers %s with WoW status = %x\n",
-                        ath9k_hw_wow_event_to_string(wow_status), wow_status);
-        }
-
-        ath_restart_work(sc);
-        ath9k_start_btcoex(sc);
-
-        ath9k_ps_restore(sc);
-        mutex_unlock(&sc->mutex);
-
-        return 0;
-}
-
-static void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
-{
-        struct ath_softc *sc = hw->priv;
-
-        mutex_lock(&sc->mutex);
-        device_init_wakeup(sc->dev, 1);
-        device_set_wakeup_enable(sc->dev, enabled);
-        mutex_unlock(&sc->mutex);
-}
-
-#endif
 static void ath9k_sw_scan_start(struct ieee80211_hw *hw)
 {
         struct ath_softc *sc = hw->priv;
@@ -2374,134 +2095,6 @@ static void ath9k_channel_switch_beacon(struct ieee80211_hw *hw,
         sc->csa_vif = vif;
 }
 
-static void ath9k_tx99_stop(struct ath_softc *sc)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        ath_drain_all_txq(sc);
-        ath_startrecv(sc);
-
-        ath9k_hw_set_interrupts(ah);
-        ath9k_hw_enable_interrupts(ah);
-
-        ieee80211_wake_queues(sc->hw);
-
-        kfree_skb(sc->tx99_skb);
-        sc->tx99_skb = NULL;
-        sc->tx99_state = false;
-
-        ath9k_hw_tx99_stop(sc->sc_ah);
-        ath_dbg(common, XMIT, "TX99 stopped\n");
-}
-
-static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
-{
-        static u8 PN9Data[] = {0xff, 0x87, 0xb8, 0x59, 0xb7, 0xa1, 0xcc, 0x24,
-                               0x57, 0x5e, 0x4b, 0x9c, 0x0e, 0xe9, 0xea, 0x50,
-                               0x2a, 0xbe, 0xb4, 0x1b, 0xb6, 0xb0, 0x5d, 0xf1,
-                               0xe6, 0x9a, 0xe3, 0x45, 0xfd, 0x2c, 0x53, 0x18,
-                               0x0c, 0xca, 0xc9, 0xfb, 0x49, 0x37, 0xe5, 0xa8,
-                               0x51, 0x3b, 0x2f, 0x61, 0xaa, 0x72, 0x18, 0x84,
-                               0x02, 0x23, 0x23, 0xab, 0x63, 0x89, 0x51, 0xb3,
-                               0xe7, 0x8b, 0x72, 0x90, 0x4c, 0xe8, 0xfb, 0xc0};
-        u32 len = 1200;
-        struct ieee80211_hw *hw = sc->hw;
-        struct ieee80211_hdr *hdr;
-        struct ieee80211_tx_info *tx_info;
-        struct sk_buff *skb;
-
-        skb = alloc_skb(len, GFP_KERNEL);
-        if (!skb)
-                return NULL;
-
-        skb_put(skb, len);
-
-        memset(skb->data, 0, len);
-
-        hdr = (struct ieee80211_hdr *)skb->data;
-        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA);
-        hdr->duration_id = 0;
-
-        memcpy(hdr->addr1, hw->wiphy->perm_addr, ETH_ALEN);
-        memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
-        memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
-
-        hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
-
-        tx_info = IEEE80211_SKB_CB(skb);
-        memset(tx_info, 0, sizeof(*tx_info));
-        tx_info->band = hw->conf.chandef.chan->band;
-        tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
-        tx_info->control.vif = sc->tx99_vif;
-
-        memcpy(skb->data + sizeof(*hdr), PN9Data, sizeof(PN9Data));
-
-        return skb;
-}
-
-void ath9k_tx99_deinit(struct ath_softc *sc)
-{
-        ath_reset(sc);
-
-        ath9k_ps_wakeup(sc);
-        ath9k_tx99_stop(sc);
-        ath9k_ps_restore(sc);
-}
-
-int ath9k_tx99_init(struct ath_softc *sc)
-{
-        struct ieee80211_hw *hw = sc->hw;
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-        struct ath_tx_control txctl;
-        int r;
-
-        if (sc->sc_flags & SC_OP_INVALID) {
-                ath_err(common,
-                        "driver is in invalid state unable to use TX99");
-                return -EINVAL;
-        }
-
-        sc->tx99_skb = ath9k_build_tx99_skb(sc);
-        if (!sc->tx99_skb)
-                return -ENOMEM;
-
-        memset(&txctl, 0, sizeof(txctl));
-        txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
-
-        ath_reset(sc);
-
-        ath9k_ps_wakeup(sc);
-
-        ath9k_hw_disable_interrupts(ah);
-        atomic_set(&ah->intr_ref_cnt, -1);
-        ath_drain_all_txq(sc);
-        ath_stoprecv(sc);
-
-        sc->tx99_state = true;
-
-        ieee80211_stop_queues(hw);
-
-        if (sc->tx99_power == MAX_RATE_POWER + 1)
-                sc->tx99_power = MAX_RATE_POWER;
-
-        ath9k_hw_tx99_set_txpower(ah, sc->tx99_power);
-        r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
-        if (r) {
-                ath_dbg(common, XMIT, "Failed to xmit TX99 skb\n");
-                return r;
-        }
-
-        ath_dbg(common, XMIT, "TX99 xmit started using %d ( %ddBm)\n",
-                sc->tx99_power,
-                sc->tx99_power / 2);
-
-        /* We leave the harware awake as it will be chugging on */
-
-        return 0;
-}
-
 struct ieee80211_ops ath9k_ops = {
         .tx                 = ath9k_tx,
         .start              = ath9k_start,
@@ -2532,7 +2125,7 @@ struct ieee80211_ops ath9k_ops = {
         .set_antenna        = ath9k_set_antenna,
         .get_antenna        = ath9k_get_antenna,
 
-#ifdef CONFIG_PM_SLEEP
+#ifdef CONFIG_ATH9K_WOW
         .suspend            = ath9k_suspend,
         .resume             = ath9k_resume,
         .set_wakeup         = ath9k_set_wakeup,
@@ -2544,7 +2137,7 @@ struct ieee80211_ops ath9k_ops = {
         .get_et_strings     = ath9k_get_et_strings,
 #endif
 
-#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_DEBUGFS)
+#if defined(CONFIG_MAC80211_DEBUGFS) && defined(CONFIG_ATH9K_STATION_STATISTICS)
         .sta_add_debugfs    = ath9k_sta_add_debugfs,
 #endif
         .sw_scan_start      = ath9k_sw_scan_start,
diff --git a/drivers/net/wireless/ath/ath9k/mci.c b/drivers/net/wireless/ath/ath9k/mci.c
index 0ac1b5f04256..71799fcade54 100644
--- a/drivers/net/wireless/ath/ath9k/mci.c
+++ b/drivers/net/wireless/ath/ath9k/mci.c
@@ -200,7 +200,7 @@ skip_tuning:
         if (btcoex->duty_cycle > ATH_MCI_MAX_DUTY_CYCLE)
                 btcoex->duty_cycle = ATH_MCI_MAX_DUTY_CYCLE;
 
-        btcoex->btcoex_no_stomp =  btcoex->btcoex_period * 1000 *
+        btcoex->btcoex_no_stomp =  btcoex->btcoex_period *
                 (100 - btcoex->duty_cycle) / 100;
 
         ath9k_hw_btcoex_enable(sc->sc_ah);
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index b5656fce4ff5..55724b02316b 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -87,6 +87,19 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_VDEVICE(ATHEROS, 0x002C) }, /* PCI-E 802.11n bonded out */
         { PCI_VDEVICE(ATHEROS, 0x002D) }, /* PCI   */
         { PCI_VDEVICE(ATHEROS, 0x002E) }, /* PCI-E */
+
+        /* Killer Wireless (3x3) */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0030,
+                         0x1A56,
+                         0x2000),
+          .driver_data = ATH9K_PCI_KILLER },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0030,
+                         0x1A56,
+                         0x2001),
+          .driver_data = ATH9K_PCI_KILLER },
+
         { PCI_VDEVICE(ATHEROS, 0x0030) }, /* PCI-E  AR9300 */
 
         /* PCI-E CUS198 */
@@ -354,6 +367,13 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          0x1783),
           .driver_data = ATH9K_PCI_WOW },
 
+        /* Killer Wireless (2x2) */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0030,
+                         0x1A56,
+                         0x2003),
+          .driver_data = ATH9K_PCI_KILLER },
+
         { PCI_VDEVICE(ATHEROS, 0x0034) }, /* PCI-E  AR9462 */
         { PCI_VDEVICE(ATHEROS, 0x0037) }, /* PCI-E  AR1111/AR9485 */
 
@@ -392,6 +412,16 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          0x11AD, /* LITEON */
+                         0x06B2),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0842),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
                          0x6671),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -404,6 +434,16 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
                          0x1B9A, /* XAVI */
                          0x2812),
           .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A1),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x218A),
+          .driver_data = ATH9K_PCI_AR9565_1ANT },
 
         /* WB335 1-ANT / Antenna Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
@@ -448,13 +488,18 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
-                         PCI_VENDOR_ID_AZWAVE,
-                         0x213A),
+                         0x11AD, /* LITEON */
+                         0x06A2),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
-                         PCI_VENDOR_ID_LENOVO,
-                         0x3026),
+                         0x11AD, /* LITEON */
+                         0x0682),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213A),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
@@ -468,38 +513,41 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_HP,
+                         0x2005),
+          .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_DELL,
-                         0x020E),
+                         0x020C),
           .driver_data = ATH9K_PCI_AR9565_1ANT | ATH9K_PCI_BT_ANT_DIV },
 
-        /* WB335 2-ANT */
+        /* WB335 2-ANT / Antenna-Diversity */
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411A),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411B),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411C),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411D),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_SAMSUNG,
                          0x411E),
-          .driver_data = ATH9K_PCI_AR9565_2ANT },
-
-        /* WB335 2-ANT / Antenna-Diversity */
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
                          PCI_VENDOR_ID_ATHEROS,
@@ -527,11 +575,31 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x11AD, /* LITEON */
+                         0x0832),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x11AD, /* LITEON */
+                         0x0692),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          PCI_VENDOR_ID_AZWAVE,
                          0x2130),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x213B),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_AZWAVE,
+                         0x2182),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x144F, /* ASKEY */
                          0x7202),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
@@ -542,9 +610,49 @@ static DEFINE_PCI_DEVICE_TABLE(ath_pci_id_table) = {
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
         { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
                          0x0036,
+                         0x1B9A, /* XAVI */
+                         0x28A2),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
                          0x185F, /* WNC */
                          0x3027),
           .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         0x185F, /* WNC */
+                         0xA120),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE07F),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_FOXCONN,
+                         0xE081),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x3026),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_LENOVO,
+                         0x4026),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_ASUSTEK,
+                         0x85F2),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_ATHEROS,
+                         0x0036,
+                         PCI_VENDOR_ID_DELL,
+                         0x020E),
+          .driver_data = ATH9K_PCI_AR9565_2ANT | ATH9K_PCI_BT_ANT_DIV },
 
         /* PCI-E AR9565 (WB335) */
         { PCI_VDEVICE(ATHEROS, 0x0036),
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 95ddca5495d4..a0ebdd000fc2 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -15,7 +15,6 @@
  */
 
 #include <linux/dma-mapping.h>
-#include <linux/relay.h>
 #include "ath9k.h"
 #include "ar9003_mac.h"
 
@@ -420,7 +419,7 @@ u32 ath_calcrxfilter(struct ath_softc *sc)
                 rfilt |= ATH9K_RX_FILTER_MCAST_BCAST_ALL;
         }
 
-        if (AR_SREV_9550(sc->sc_ah))
+        if (AR_SREV_9550(sc->sc_ah) || AR_SREV_9531(sc->sc_ah))
                 rfilt |= ATH9K_RX_FILTER_4ADDRESS;
 
         return rfilt;
@@ -851,20 +850,15 @@ static int ath9k_process_rate(struct ath_common *common,
         enum ieee80211_band band;
         unsigned int i = 0;
         struct ath_softc __maybe_unused *sc = common->priv;
+        struct ath_hw *ah = sc->sc_ah;
 
-        band = hw->conf.chandef.chan->band;
+        band = ah->curchan->chan->band;
         sband = hw->wiphy->bands[band];
 
-        switch (hw->conf.chandef.width) {
-        case NL80211_CHAN_WIDTH_5:
+        if (IS_CHAN_QUARTER_RATE(ah->curchan))
                 rxs->flag |= RX_FLAG_5MHZ;
-                break;
-        case NL80211_CHAN_WIDTH_10:
+        else if (IS_CHAN_HALF_RATE(ah->curchan))
                 rxs->flag |= RX_FLAG_10MHZ;
-                break;
-        default:
-                break;
-        }
 
         if (rx_stats->rs_rate & 0x80) {
                 /* HT rate */
@@ -906,6 +900,7 @@ static void ath9k_process_rssi(struct ath_common *common,
         struct ath_hw *ah = common->ah;
         int last_rssi;
         int rssi = rx_stats->rs_rssi;
+        int i, j;
 
         /*
          * RSSI is not available for subframes in an A-MPDU.
@@ -924,6 +919,20 @@ static void ath9k_process_rssi(struct ath_common *common,
                 return;
         }
 
+        for (i = 0, j = 0; i < ARRAY_SIZE(rx_stats->rs_rssi_ctl); i++) {
+                s8 rssi;
+
+                if (!(ah->rxchainmask & BIT(i)))
+                        continue;
+
+                rssi = rx_stats->rs_rssi_ctl[i];
+                if (rssi != ATH9K_RSSI_BAD) {
+                    rxs->chains |= BIT(j);
+                    rxs->chain_signal[j] = ah->noise + rssi;
+                }
+                j++;
+        }
+
         /*
          * Update Beacon RSSI, this is used by ANI.
          */
@@ -960,201 +969,6 @@ static void ath9k_process_tsf(struct ath_rx_status *rs,
                 rxs->mactime += 0x100000000ULL;
 }
 
-#ifdef CONFIG_ATH9K_DEBUGFS
-static s8 fix_rssi_inv_only(u8 rssi_val)
-{
-        if (rssi_val == 128)
-                rssi_val = 0;
-        return (s8) rssi_val;
-}
-#endif
-
-/* returns 1 if this was a spectral frame, even if not handled. */
-static int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
-                           struct ath_rx_status *rs, u64 tsf)
-{
-#ifdef CONFIG_ATH9K_DEBUGFS
-        struct ath_hw *ah = sc->sc_ah;
-        u8 num_bins, *bins, *vdata = (u8 *)hdr;
-        struct fft_sample_ht20 fft_sample_20;
-        struct fft_sample_ht20_40 fft_sample_40;
-        struct fft_sample_tlv *tlv;
-        struct ath_radar_info *radar_info;
-        int len = rs->rs_datalen;
-        int dc_pos;
-        u16 fft_len, length, freq = ah->curchan->chan->center_freq;
-        enum nl80211_channel_type chan_type;
-
-        /* AR9280 and before report via ATH9K_PHYERR_RADAR, AR93xx and newer
-         * via ATH9K_PHYERR_SPECTRAL. Haven't seen ATH9K_PHYERR_FALSE_RADAR_EXT
-         * yet, but this is supposed to be possible as well.
-         */
-        if (rs->rs_phyerr != ATH9K_PHYERR_RADAR &&
-            rs->rs_phyerr != ATH9K_PHYERR_FALSE_RADAR_EXT &&
-            rs->rs_phyerr != ATH9K_PHYERR_SPECTRAL)
-                return 0;
-
-        /* check if spectral scan bit is set. This does not have to be checked
-         * if received through a SPECTRAL phy error, but shouldn't hurt.
-         */
-        radar_info = ((struct ath_radar_info *)&vdata[len]) - 1;
-        if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
-                return 0;
-
-        chan_type = cfg80211_get_chandef_type(&sc->hw->conf.chandef);
-        if ((chan_type == NL80211_CHAN_HT40MINUS) ||
-            (chan_type == NL80211_CHAN_HT40PLUS)) {
-                fft_len = SPECTRAL_HT20_40_TOTAL_DATA_LEN;
-                num_bins = SPECTRAL_HT20_40_NUM_BINS;
-                bins = (u8 *)fft_sample_40.data;
-        } else {
-                fft_len = SPECTRAL_HT20_TOTAL_DATA_LEN;
-                num_bins = SPECTRAL_HT20_NUM_BINS;
-                bins = (u8 *)fft_sample_20.data;
-        }
-
-        /* Variation in the data length is possible and will be fixed later */
-        if ((len > fft_len + 2) || (len < fft_len - 1))
-                return 1;
-
-        switch (len - fft_len) {
-        case 0:
-                /* length correct, nothing to do. */
-                memcpy(bins, vdata, num_bins);
-                break;
-        case -1:
-                /* first byte missing, duplicate it. */
-                memcpy(&bins[1], vdata, num_bins - 1);
-                bins[0] = vdata[0];
-                break;
-        case 2:
-                /* MAC added 2 extra bytes at bin 30 and 32, remove them. */
-                memcpy(bins, vdata, 30);
-                bins[30] = vdata[31];
-                memcpy(&bins[31], &vdata[33], num_bins - 31);
-                break;
-        case 1:
-                /* MAC added 2 extra bytes AND first byte is missing. */
-                bins[0] = vdata[0];
-                memcpy(&bins[1], vdata, 30);
-                bins[31] = vdata[31];
-                memcpy(&bins[32], &vdata[33], num_bins - 32);
-                break;
-        default:
-                return 1;
-        }
-
-        /* DC value (value in the middle) is the blind spot of the spectral
-         * sample and invalid, interpolate it.
-         */
-        dc_pos = num_bins / 2;
-        bins[dc_pos] = (bins[dc_pos + 1] + bins[dc_pos - 1]) / 2;
-
-        if ((chan_type == NL80211_CHAN_HT40MINUS) ||
-            (chan_type == NL80211_CHAN_HT40PLUS)) {
-                s8 lower_rssi, upper_rssi;
-                s16 ext_nf;
-                u8 lower_max_index, upper_max_index;
-                u8 lower_bitmap_w, upper_bitmap_w;
-                u16 lower_mag, upper_mag;
-                struct ath9k_hw_cal_data *caldata = ah->caldata;
-                struct ath_ht20_40_mag_info *mag_info;
-
-                if (caldata)
-                        ext_nf = ath9k_hw_getchan_noise(ah, ah->curchan,
-                                        caldata->nfCalHist[3].privNF);
-                else
-                        ext_nf = ATH_DEFAULT_NOISE_FLOOR;
-
-                length = sizeof(fft_sample_40) - sizeof(struct fft_sample_tlv);
-                fft_sample_40.tlv.type = ATH_FFT_SAMPLE_HT20_40;
-                fft_sample_40.tlv.length = __cpu_to_be16(length);
-                fft_sample_40.freq = __cpu_to_be16(freq);
-                fft_sample_40.channel_type = chan_type;
-
-                if (chan_type == NL80211_CHAN_HT40PLUS) {
-                        lower_rssi = fix_rssi_inv_only(rs->rs_rssi_ctl0);
-                        upper_rssi = fix_rssi_inv_only(rs->rs_rssi_ext0);
-
-                        fft_sample_40.lower_noise = ah->noise;
-                        fft_sample_40.upper_noise = ext_nf;
-                } else {
-                        lower_rssi = fix_rssi_inv_only(rs->rs_rssi_ext0);
-                        upper_rssi = fix_rssi_inv_only(rs->rs_rssi_ctl0);
-
-                        fft_sample_40.lower_noise = ext_nf;
-                        fft_sample_40.upper_noise = ah->noise;
-                }
-                fft_sample_40.lower_rssi = lower_rssi;
-                fft_sample_40.upper_rssi = upper_rssi;
-
-                mag_info = ((struct ath_ht20_40_mag_info *)radar_info) - 1;
-                lower_mag = spectral_max_magnitude(mag_info->lower_bins);
-                upper_mag = spectral_max_magnitude(mag_info->upper_bins);
-                fft_sample_40.lower_max_magnitude = __cpu_to_be16(lower_mag);
-                fft_sample_40.upper_max_magnitude = __cpu_to_be16(upper_mag);
-                lower_max_index = spectral_max_index(mag_info->lower_bins);
-                upper_max_index = spectral_max_index(mag_info->upper_bins);
-                fft_sample_40.lower_max_index = lower_max_index;
-                fft_sample_40.upper_max_index = upper_max_index;
-                lower_bitmap_w = spectral_bitmap_weight(mag_info->lower_bins);
-                upper_bitmap_w = spectral_bitmap_weight(mag_info->upper_bins);
-                fft_sample_40.lower_bitmap_weight = lower_bitmap_w;
-                fft_sample_40.upper_bitmap_weight = upper_bitmap_w;
-                fft_sample_40.max_exp = mag_info->max_exp & 0xf;
-
-                fft_sample_40.tsf = __cpu_to_be64(tsf);
-
-                tlv = (struct fft_sample_tlv *)&fft_sample_40;
-        } else {
-                u8 max_index, bitmap_w;
-                u16 magnitude;
-                struct ath_ht20_mag_info *mag_info;
-
-                length = sizeof(fft_sample_20) - sizeof(struct fft_sample_tlv);
-                fft_sample_20.tlv.type = ATH_FFT_SAMPLE_HT20;
-                fft_sample_20.tlv.length = __cpu_to_be16(length);
-                fft_sample_20.freq = __cpu_to_be16(freq);
-
-                fft_sample_20.rssi = fix_rssi_inv_only(rs->rs_rssi_ctl0);
-                fft_sample_20.noise = ah->noise;
-
-                mag_info = ((struct ath_ht20_mag_info *)radar_info) - 1;
-                magnitude = spectral_max_magnitude(mag_info->all_bins);
-                fft_sample_20.max_magnitude = __cpu_to_be16(magnitude);
-                max_index = spectral_max_index(mag_info->all_bins);
-                fft_sample_20.max_index = max_index;
-                bitmap_w = spectral_bitmap_weight(mag_info->all_bins);
-                fft_sample_20.bitmap_weight = bitmap_w;
-                fft_sample_20.max_exp = mag_info->max_exp & 0xf;
-
-                fft_sample_20.tsf = __cpu_to_be64(tsf);
-
-                tlv = (struct fft_sample_tlv *)&fft_sample_20;
-        }
-
-        ath_debug_send_fft_sample(sc, tlv);
-        return 1;
-#else
-        return 0;
-#endif
-}
-
-static bool ath9k_is_mybeacon(struct ath_softc *sc, struct ieee80211_hdr *hdr)
-{
-        struct ath_hw *ah = sc->sc_ah;
-        struct ath_common *common = ath9k_hw_common(ah);
-
-        if (ieee80211_is_beacon(hdr->frame_control)) {
-                RX_STAT_INC(rx_beacons);
-                if (!is_zero_ether_addr(common->curbssid) &&
-                    ether_addr_equal(hdr->addr3, common->curbssid))
-                        return true;
-        }
-
-        return false;
-}
-
 /*
  * For Decrypt or Demic errors, we only mark packet status here and always push
  * up the frame up to let mac80211 handle the actual error case, be it no
@@ -1242,10 +1056,17 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
                 goto exit;
         }
 
-        rx_stats->is_mybeacon = ath9k_is_mybeacon(sc, hdr);
-        if (rx_stats->is_mybeacon) {
-                sc->hw_busy_count = 0;
-                ath_start_rx_poll(sc, 3);
+        if (ath_is_mybeacon(common, hdr)) {
+                RX_STAT_INC(rx_beacons);
+                rx_stats->is_mybeacon = true;
+        }
+
+        /*
+         * This shouldn't happen, but have a safety check anyway.
+         */
+        if (WARN_ON(!ah->curchan)) {
+                ret = -EINVAL;
+                goto exit;
         }
 
         if (ath9k_process_rate(common, hw, rx_stats, rx_status)) {
@@ -1255,8 +1076,8 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc,
 
         ath9k_process_rssi(common, hw, rx_stats, rx_status);
 
-        rx_status->band = hw->conf.chandef.chan->band;
-        rx_status->freq = hw->conf.chandef.chan->center_freq;
+        rx_status->band = ah->curchan->chan->band;
+        rx_status->freq = ah->curchan->chan->center_freq;
         rx_status->antenna = rx_stats->rs_antenna;
         rx_status->flag |= RX_FLAG_MACTIME_END;
 
@@ -1521,8 +1342,8 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 spin_unlock_irqrestore(&sc->sc_pm_lock, flags);
 
                 ath9k_antenna_check(sc, &rs);
-
                 ath9k_apply_ampdu_details(sc, &rs, rxs);
+                ath_debug_rate_stats(sc, &rs, skb);
 
                 ieee80211_rx(hw, skb);
 
diff --git a/drivers/net/wireless/ath/ath9k/reg.h b/drivers/net/wireless/ath/ath9k/reg.h
index a13b2d143d9e..b1fd3fa84983 100644
--- a/drivers/net/wireless/ath/ath9k/reg.h
+++ b/drivers/net/wireless/ath/ath9k/reg.h
@@ -304,6 +304,7 @@
 #define AR_IMR_S2              0x00ac
 #define AR_IMR_S2_QCU_TXURN    0x000003FF
 #define AR_IMR_S2_QCU_TXURN_S  0
+#define AR_IMR_S2_BB_WATCHDOG  0x00010000
 #define AR_IMR_S2_CST          0x00400000
 #define AR_IMR_S2_GTT          0x00800000
 #define AR_IMR_S2_TIM          0x01000000
@@ -809,7 +810,12 @@
 #define AR_SREV_REVISION_9462_21        3
 #define AR_SREV_VERSION_9565            0x2C0
 #define AR_SREV_REVISION_9565_10        0
+#define AR_SREV_REVISION_9565_101       1
+#define AR_SREV_REVISION_9565_11        2
 #define AR_SREV_VERSION_9550            0x400
+#define AR_SREV_VERSION_9531            0x500
+#define AR_SREV_REVISION_9531_10        0
+#define AR_SREV_REVISION_9531_11        1
 
 #define AR_SREV_5416(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_5416_PCI) || \
@@ -881,9 +887,6 @@
 
 #define AR_SREV_9330(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9330))
-#define AR_SREV_9330_10(_ah) \
-        (AR_SREV_9330((_ah)) && \
-         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9330_10))
 #define AR_SREV_9330_11(_ah) \
         (AR_SREV_9330((_ah)) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9330_11))
@@ -927,10 +930,18 @@
 
 #define AR_SREV_9565(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565))
-
 #define AR_SREV_9565_10(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
          ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_10))
+#define AR_SREV_9565_101(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_101))
+#define AR_SREV_9565_11(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9565_11))
+#define AR_SREV_9565_11_OR_LATER(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9565) && \
+         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9565_11))
 
 #define AR_SREV_9550(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9550))
@@ -938,11 +949,19 @@
 #define AR_SREV_9580(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9580) && \
         ((_ah)->hw_version.macRev >= AR_SREV_REVISION_9580_10))
-
 #define AR_SREV_9580_10(_ah) \
         (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9580) && \
         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9580_10))
 
+#define AR_SREV_9531(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531))
+#define AR_SREV_9531_10(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_10))
+#define AR_SREV_9531_11(_ah) \
+        (((_ah)->hw_version.macVersion == AR_SREV_VERSION_9531) && \
+         ((_ah)->hw_version.macRev == AR_SREV_REVISION_9531_11))
+
 /* NOTE: When adding chips newer than Peacock, add chip check here */
 #define AR_SREV_9580_10_OR_LATER(_ah) \
         (AR_SREV_9580(_ah))
diff --git a/drivers/net/wireless/ath/ath9k/spectral.c b/drivers/net/wireless/ath/ath9k/spectral.c
new file mode 100644
index 000000000000..99f4de95c264
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/spectral.c
@@ -0,0 +1,543 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/relay.h>
+#include "ath9k.h"
+
+static s8 fix_rssi_inv_only(u8 rssi_val)
+{
+        if (rssi_val == 128)
+                rssi_val = 0;
+        return (s8) rssi_val;
+}
+
+static void ath_debug_send_fft_sample(struct ath_softc *sc,
+                                      struct fft_sample_tlv *fft_sample_tlv)
+{
+        int length;
+        if (!sc->rfs_chan_spec_scan)
+                return;
+
+        length = __be16_to_cpu(fft_sample_tlv->length) +
+                 sizeof(*fft_sample_tlv);
+        relay_write(sc->rfs_chan_spec_scan, fft_sample_tlv, length);
+}
+
+/* returns 1 if this was a spectral frame, even if not handled. */
+int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
+                    struct ath_rx_status *rs, u64 tsf)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        u8 num_bins, *bins, *vdata = (u8 *)hdr;
+        struct fft_sample_ht20 fft_sample_20;
+        struct fft_sample_ht20_40 fft_sample_40;
+        struct fft_sample_tlv *tlv;
+        struct ath_radar_info *radar_info;
+        int len = rs->rs_datalen;
+        int dc_pos;
+        u16 fft_len, length, freq = ah->curchan->chan->center_freq;
+        enum nl80211_channel_type chan_type;
+
+        /* AR9280 and before report via ATH9K_PHYERR_RADAR, AR93xx and newer
+         * via ATH9K_PHYERR_SPECTRAL. Haven't seen ATH9K_PHYERR_FALSE_RADAR_EXT
+         * yet, but this is supposed to be possible as well.
+         */
+        if (rs->rs_phyerr != ATH9K_PHYERR_RADAR &&
+            rs->rs_phyerr != ATH9K_PHYERR_FALSE_RADAR_EXT &&
+            rs->rs_phyerr != ATH9K_PHYERR_SPECTRAL)
+                return 0;
+
+        /* check if spectral scan bit is set. This does not have to be checked
+         * if received through a SPECTRAL phy error, but shouldn't hurt.
+         */
+        radar_info = ((struct ath_radar_info *)&vdata[len]) - 1;
+        if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK))
+                return 0;
+
+        chan_type = cfg80211_get_chandef_type(&sc->hw->conf.chandef);
+        if ((chan_type == NL80211_CHAN_HT40MINUS) ||
+            (chan_type == NL80211_CHAN_HT40PLUS)) {
+                fft_len = SPECTRAL_HT20_40_TOTAL_DATA_LEN;
+                num_bins = SPECTRAL_HT20_40_NUM_BINS;
+                bins = (u8 *)fft_sample_40.data;
+        } else {
+                fft_len = SPECTRAL_HT20_TOTAL_DATA_LEN;
+                num_bins = SPECTRAL_HT20_NUM_BINS;
+                bins = (u8 *)fft_sample_20.data;
+        }
+
+        /* Variation in the data length is possible and will be fixed later */
+        if ((len > fft_len + 2) || (len < fft_len - 1))
+                return 1;
+
+        switch (len - fft_len) {
+        case 0:
+                /* length correct, nothing to do. */
+                memcpy(bins, vdata, num_bins);
+                break;
+        case -1:
+                /* first byte missing, duplicate it. */
+                memcpy(&bins[1], vdata, num_bins - 1);
+                bins[0] = vdata[0];
+                break;
+        case 2:
+                /* MAC added 2 extra bytes at bin 30 and 32, remove them. */
+                memcpy(bins, vdata, 30);
+                bins[30] = vdata[31];
+                memcpy(&bins[31], &vdata[33], num_bins - 31);
+                break;
+        case 1:
+                /* MAC added 2 extra bytes AND first byte is missing. */
+                bins[0] = vdata[0];
+                memcpy(&bins[1], vdata, 30);
+                bins[31] = vdata[31];
+                memcpy(&bins[32], &vdata[33], num_bins - 32);
+                break;
+        default:
+                return 1;
+        }
+
+        /* DC value (value in the middle) is the blind spot of the spectral
+         * sample and invalid, interpolate it.
+         */
+        dc_pos = num_bins / 2;
+        bins[dc_pos] = (bins[dc_pos + 1] + bins[dc_pos - 1]) / 2;
+
+        if ((chan_type == NL80211_CHAN_HT40MINUS) ||
+            (chan_type == NL80211_CHAN_HT40PLUS)) {
+                s8 lower_rssi, upper_rssi;
+                s16 ext_nf;
+                u8 lower_max_index, upper_max_index;
+                u8 lower_bitmap_w, upper_bitmap_w;
+                u16 lower_mag, upper_mag;
+                struct ath9k_hw_cal_data *caldata = ah->caldata;
+                struct ath_ht20_40_mag_info *mag_info;
+
+                if (caldata)
+                        ext_nf = ath9k_hw_getchan_noise(ah, ah->curchan,
+                                        caldata->nfCalHist[3].privNF);
+                else
+                        ext_nf = ATH_DEFAULT_NOISE_FLOOR;
+
+                length = sizeof(fft_sample_40) - sizeof(struct fft_sample_tlv);
+                fft_sample_40.tlv.type = ATH_FFT_SAMPLE_HT20_40;
+                fft_sample_40.tlv.length = __cpu_to_be16(length);
+                fft_sample_40.freq = __cpu_to_be16(freq);
+                fft_sample_40.channel_type = chan_type;
+
+                if (chan_type == NL80211_CHAN_HT40PLUS) {
+                        lower_rssi = fix_rssi_inv_only(rs->rs_rssi_ctl[0]);
+                        upper_rssi = fix_rssi_inv_only(rs->rs_rssi_ext[0]);
+
+                        fft_sample_40.lower_noise = ah->noise;
+                        fft_sample_40.upper_noise = ext_nf;
+                } else {
+                        lower_rssi = fix_rssi_inv_only(rs->rs_rssi_ext[0]);
+                        upper_rssi = fix_rssi_inv_only(rs->rs_rssi_ctl[0]);
+
+                        fft_sample_40.lower_noise = ext_nf;
+                        fft_sample_40.upper_noise = ah->noise;
+                }
+                fft_sample_40.lower_rssi = lower_rssi;
+                fft_sample_40.upper_rssi = upper_rssi;
+
+                mag_info = ((struct ath_ht20_40_mag_info *)radar_info) - 1;
+                lower_mag = spectral_max_magnitude(mag_info->lower_bins);
+                upper_mag = spectral_max_magnitude(mag_info->upper_bins);
+                fft_sample_40.lower_max_magnitude = __cpu_to_be16(lower_mag);
+                fft_sample_40.upper_max_magnitude = __cpu_to_be16(upper_mag);
+                lower_max_index = spectral_max_index(mag_info->lower_bins);
+                upper_max_index = spectral_max_index(mag_info->upper_bins);
+                fft_sample_40.lower_max_index = lower_max_index;
+                fft_sample_40.upper_max_index = upper_max_index;
+                lower_bitmap_w = spectral_bitmap_weight(mag_info->lower_bins);
+                upper_bitmap_w = spectral_bitmap_weight(mag_info->upper_bins);
+                fft_sample_40.lower_bitmap_weight = lower_bitmap_w;
+                fft_sample_40.upper_bitmap_weight = upper_bitmap_w;
+                fft_sample_40.max_exp = mag_info->max_exp & 0xf;
+
+                fft_sample_40.tsf = __cpu_to_be64(tsf);
+
+                tlv = (struct fft_sample_tlv *)&fft_sample_40;
+        } else {
+                u8 max_index, bitmap_w;
+                u16 magnitude;
+                struct ath_ht20_mag_info *mag_info;
+
+                length = sizeof(fft_sample_20) - sizeof(struct fft_sample_tlv);
+                fft_sample_20.tlv.type = ATH_FFT_SAMPLE_HT20;
+                fft_sample_20.tlv.length = __cpu_to_be16(length);
+                fft_sample_20.freq = __cpu_to_be16(freq);
+
+                fft_sample_20.rssi = fix_rssi_inv_only(rs->rs_rssi_ctl[0]);
+                fft_sample_20.noise = ah->noise;
+
+                mag_info = ((struct ath_ht20_mag_info *)radar_info) - 1;
+                magnitude = spectral_max_magnitude(mag_info->all_bins);
+                fft_sample_20.max_magnitude = __cpu_to_be16(magnitude);
+                max_index = spectral_max_index(mag_info->all_bins);
+                fft_sample_20.max_index = max_index;
+                bitmap_w = spectral_bitmap_weight(mag_info->all_bins);
+                fft_sample_20.bitmap_weight = bitmap_w;
+                fft_sample_20.max_exp = mag_info->max_exp & 0xf;
+
+                fft_sample_20.tsf = __cpu_to_be64(tsf);
+
+                tlv = (struct fft_sample_tlv *)&fft_sample_20;
+        }
+
+        ath_debug_send_fft_sample(sc, tlv);
+
+        return 1;
+}
+
+/*********************/
+/* spectral_scan_ctl */
+/*********************/
+
+static ssize_t read_file_spec_scan_ctl(struct file *file, char __user *user_buf,
+                                       size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char *mode = "";
+        unsigned int len;
+
+        switch (sc->spectral_mode) {
+        case SPECTRAL_DISABLED:
+                mode = "disable";
+                break;
+        case SPECTRAL_BACKGROUND:
+                mode = "background";
+                break;
+        case SPECTRAL_CHANSCAN:
+                mode = "chanscan";
+                break;
+        case SPECTRAL_MANUAL:
+                mode = "manual";
+                break;
+        }
+        len = strlen(mode);
+        return simple_read_from_buffer(user_buf, count, ppos, mode, len);
+}
+
+static ssize_t write_file_spec_scan_ctl(struct file *file,
+                                        const char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        char buf[32];
+        ssize_t len;
+
+        if (config_enabled(CONFIG_ATH9K_TX99))
+                return -EOPNOTSUPP;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+
+        if (strncmp("trigger", buf, 7) == 0) {
+                ath9k_spectral_scan_trigger(sc->hw);
+        } else if (strncmp("background", buf, 9) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_BACKGROUND);
+                ath_dbg(common, CONFIG, "spectral scan: background mode enabled\n");
+        } else if (strncmp("chanscan", buf, 8) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_CHANSCAN);
+                ath_dbg(common, CONFIG, "spectral scan: channel scan mode enabled\n");
+        } else if (strncmp("manual", buf, 6) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_MANUAL);
+                ath_dbg(common, CONFIG, "spectral scan: manual mode enabled\n");
+        } else if (strncmp("disable", buf, 7) == 0) {
+                ath9k_spectral_scan_config(sc->hw, SPECTRAL_DISABLED);
+                ath_dbg(common, CONFIG, "spectral scan: disabled\n");
+        } else {
+                return -EINVAL;
+        }
+
+        return count;
+}
+
+static const struct file_operations fops_spec_scan_ctl = {
+        .read = read_file_spec_scan_ctl,
+        .write = write_file_spec_scan_ctl,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/*************************/
+/* spectral_short_repeat */
+/*************************/
+
+static ssize_t read_file_spectral_short_repeat(struct file *file,
+                                               char __user *user_buf,
+                                               size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.short_repeat);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_short_repeat(struct file *file,
+                                                const char __user *user_buf,
+                                                size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 1)
+                return -EINVAL;
+
+        sc->spec_config.short_repeat = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_short_repeat = {
+        .read = read_file_spectral_short_repeat,
+        .write = write_file_spectral_short_repeat,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/******************/
+/* spectral_count */
+/******************/
+
+static ssize_t read_file_spectral_count(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.count);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_count(struct file *file,
+                                         const char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 255)
+                return -EINVAL;
+
+        sc->spec_config.count = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_count = {
+        .read = read_file_spectral_count,
+        .write = write_file_spectral_count,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/*******************/
+/* spectral_period */
+/*******************/
+
+static ssize_t read_file_spectral_period(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.period);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_period(struct file *file,
+                                          const char __user *user_buf,
+                                          size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 255)
+                return -EINVAL;
+
+        sc->spec_config.period = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_period = {
+        .read = read_file_spectral_period,
+        .write = write_file_spectral_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/***********************/
+/* spectral_fft_period */
+/***********************/
+
+static ssize_t read_file_spectral_fft_period(struct file *file,
+                                             char __user *user_buf,
+                                             size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->spec_config.fft_period);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_spectral_fft_period(struct file *file,
+                                              const char __user *user_buf,
+                                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        unsigned long val;
+        char buf[32];
+        ssize_t len;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        buf[len] = '\0';
+        if (kstrtoul(buf, 0, &val))
+                return -EINVAL;
+
+        if (val < 0 || val > 15)
+                return -EINVAL;
+
+        sc->spec_config.fft_period = val;
+        return count;
+}
+
+static const struct file_operations fops_spectral_fft_period = {
+        .read = read_file_spectral_fft_period,
+        .write = write_file_spectral_fft_period,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+/*******************/
+/* Relay interface */
+/*******************/
+
+static struct dentry *create_buf_file_handler(const char *filename,
+                                              struct dentry *parent,
+                                              umode_t mode,
+                                              struct rchan_buf *buf,
+                                              int *is_global)
+{
+        struct dentry *buf_file;
+
+        buf_file = debugfs_create_file(filename, mode, parent, buf,
+                                       &relay_file_operations);
+        *is_global = 1;
+        return buf_file;
+}
+
+static int remove_buf_file_handler(struct dentry *dentry)
+{
+        debugfs_remove(dentry);
+
+        return 0;
+}
+
+static struct rchan_callbacks rfs_spec_scan_cb = {
+        .create_buf_file = create_buf_file_handler,
+        .remove_buf_file = remove_buf_file_handler,
+};
+
+/*********************/
+/* Debug Init/Deinit */
+/*********************/
+
+void ath9k_spectral_deinit_debug(struct ath_softc *sc)
+{
+        if (config_enabled(CONFIG_ATH9K_DEBUGFS) && sc->rfs_chan_spec_scan) {
+                relay_close(sc->rfs_chan_spec_scan);
+                sc->rfs_chan_spec_scan = NULL;
+        }
+}
+
+void ath9k_spectral_init_debug(struct ath_softc *sc)
+{
+        sc->rfs_chan_spec_scan = relay_open("spectral_scan",
+                                            sc->debug.debugfs_phy,
+                                            1024, 256, &rfs_spec_scan_cb,
+                                            NULL);
+        debugfs_create_file("spectral_scan_ctl",
+                            S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spec_scan_ctl);
+        debugfs_create_file("spectral_short_repeat",
+                            S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_short_repeat);
+        debugfs_create_file("spectral_count",
+                            S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_count);
+        debugfs_create_file("spectral_period",
+                            S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_period);
+        debugfs_create_file("spectral_fft_period",
+                            S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_spectral_fft_period);
+}
diff --git a/drivers/net/wireless/ath/ath9k/spectral.h b/drivers/net/wireless/ath/ath9k/spectral.h
new file mode 100644
index 000000000000..ead63412ee1a
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/spectral.h
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef SPECTRAL_H
+#define SPECTRAL_H
+
+/* enum spectral_mode:
+ *
+ * @SPECTRAL_DISABLED: spectral mode is disabled
+ * @SPECTRAL_BACKGROUND: hardware sends samples when it is not busy with
+ *      something else.
+ * @SPECTRAL_MANUAL: spectral scan is enabled, triggering for samples
+ *      is performed manually.
+ * @SPECTRAL_CHANSCAN: Like manual, but also triggered when changing channels
+ *      during a channel scan.
+ */
+enum spectral_mode {
+        SPECTRAL_DISABLED = 0,
+        SPECTRAL_BACKGROUND,
+        SPECTRAL_MANUAL,
+        SPECTRAL_CHANSCAN,
+};
+
+#define SPECTRAL_SCAN_BITMASK           0x10
+/* Radar info packet format, used for DFS and spectral formats. */
+struct ath_radar_info {
+        u8 pulse_length_pri;
+        u8 pulse_length_ext;
+        u8 pulse_bw_info;
+} __packed;
+
+/* The HT20 spectral data has 4 bytes of additional information at it's end.
+ *
+ * [7:0]: all bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: all bins  max_magnitude[9:2]
+ * [7:0]: all bins {max_index[5:0], max_magnitude[11:10]}
+ * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
+ */
+struct ath_ht20_mag_info {
+        u8 all_bins[3];
+        u8 max_exp;
+} __packed;
+
+#define SPECTRAL_HT20_NUM_BINS          56
+
+/* WARNING: don't actually use this struct! MAC may vary the amount of
+ * data by -1/+2. This struct is for reference only.
+ */
+struct ath_ht20_fft_packet {
+        u8 data[SPECTRAL_HT20_NUM_BINS];
+        struct ath_ht20_mag_info mag_info;
+        struct ath_radar_info radar_info;
+} __packed;
+
+#define SPECTRAL_HT20_TOTAL_DATA_LEN    (sizeof(struct ath_ht20_fft_packet))
+
+/* Dynamic 20/40 mode:
+ *
+ * [7:0]: lower bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: lower bins  max_magnitude[9:2]
+ * [7:0]: lower bins {max_index[5:0], max_magnitude[11:10]}
+ * [7:0]: upper bins {max_magnitude[1:0], bitmap_weight[5:0]}
+ * [7:0]: upper bins  max_magnitude[9:2]
+ * [7:0]: upper bins {max_index[5:0], max_magnitude[11:10]}
+ * [3:0]: max_exp (shift amount to size max bin to 8-bit unsigned)
+ */
+struct ath_ht20_40_mag_info {
+        u8 lower_bins[3];
+        u8 upper_bins[3];
+        u8 max_exp;
+} __packed;
+
+#define SPECTRAL_HT20_40_NUM_BINS               128
+
+/* WARNING: don't actually use this struct! MAC may vary the amount of
+ * data. This struct is for reference only.
+ */
+struct ath_ht20_40_fft_packet {
+        u8 data[SPECTRAL_HT20_40_NUM_BINS];
+        struct ath_ht20_40_mag_info mag_info;
+        struct ath_radar_info radar_info;
+} __packed;
+
+
+#define SPECTRAL_HT20_40_TOTAL_DATA_LEN (sizeof(struct ath_ht20_40_fft_packet))
+
+/* grabs the max magnitude from the all/upper/lower bins */
+static inline u16 spectral_max_magnitude(u8 *bins)
+{
+        return (bins[0] & 0xc0) >> 6 |
+               (bins[1] & 0xff) << 2 |
+               (bins[2] & 0x03) << 10;
+}
+
+/* return the max magnitude from the all/upper/lower bins */
+static inline u8 spectral_max_index(u8 *bins)
+{
+        s8 m = (bins[2] & 0xfc) >> 2;
+
+        /* TODO: this still doesn't always report the right values ... */
+        if (m > 32)
+                m |= 0xe0;
+        else
+                m &= ~0xe0;
+
+        return m + 29;
+}
+
+/* return the bitmap weight from the all/upper/lower bins */
+static inline u8 spectral_bitmap_weight(u8 *bins)
+{
+        return bins[0] & 0x3f;
+}
+
+/* FFT sample format given to userspace via debugfs.
+ *
+ * Please keep the type/length at the front position and change
+ * other fields after adding another sample type
+ *
+ * TODO: this might need rework when switching to nl80211-based
+ * interface.
+ */
+enum ath_fft_sample_type {
+        ATH_FFT_SAMPLE_HT20 = 1,
+        ATH_FFT_SAMPLE_HT20_40,
+};
+
+struct fft_sample_tlv {
+        u8 type;        /* see ath_fft_sample */
+        __be16 length;
+        /* type dependent data follows */
+} __packed;
+
+struct fft_sample_ht20 {
+        struct fft_sample_tlv tlv;
+
+        u8 max_exp;
+
+        __be16 freq;
+        s8 rssi;
+        s8 noise;
+
+        __be16 max_magnitude;
+        u8 max_index;
+        u8 bitmap_weight;
+
+        __be64 tsf;
+
+        u8 data[SPECTRAL_HT20_NUM_BINS];
+} __packed;
+
+struct fft_sample_ht20_40 {
+        struct fft_sample_tlv tlv;
+
+        u8 channel_type;
+        __be16 freq;
+
+        s8 lower_rssi;
+        s8 upper_rssi;
+
+        __be64 tsf;
+
+        s8 lower_noise;
+        s8 upper_noise;
+
+        __be16 lower_max_magnitude;
+        __be16 upper_max_magnitude;
+
+        u8 lower_max_index;
+        u8 upper_max_index;
+
+        u8 lower_bitmap_weight;
+        u8 upper_bitmap_weight;
+
+        u8 max_exp;
+
+        u8 data[SPECTRAL_HT20_40_NUM_BINS];
+} __packed;
+
+void ath9k_spectral_init_debug(struct ath_softc *sc);
+void ath9k_spectral_deinit_debug(struct ath_softc *sc);
+
+void ath9k_spectral_scan_trigger(struct ieee80211_hw *hw);
+int ath9k_spectral_scan_config(struct ieee80211_hw *hw,
+                               enum spectral_mode spectral_mode);
+
+#ifdef CONFIG_ATH9K_DEBUGFS
+int ath_process_fft(struct ath_softc *sc, struct ieee80211_hdr *hdr,
+                    struct ath_rx_status *rs, u64 tsf);
+#else
+static inline int ath_process_fft(struct ath_softc *sc,
+                                  struct ieee80211_hdr *hdr,
+                                  struct ath_rx_status *rs, u64 tsf)
+{
+        return 0;
+}
+#endif /* CONFIG_ATH9K_DEBUGFS */
+
+#endif /* SPECTRAL_H */
diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c
new file mode 100644
index 000000000000..b686a7498450
--- /dev/null
+++ b/drivers/net/wireless/ath/ath9k/tx99.c
@@ -0,0 +1,272 @@
+/*
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include "ath9k.h"
+
+static void ath9k_tx99_stop(struct ath_softc *sc)
+{
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+
+        ath_drain_all_txq(sc);
+        ath_startrecv(sc);
+
+        ath9k_hw_set_interrupts(ah);
+        ath9k_hw_enable_interrupts(ah);
+
+        ieee80211_wake_queues(sc->hw);
+
+        kfree_skb(sc->tx99_skb);
+        sc->tx99_skb = NULL;
+        sc->tx99_state = false;
+
+        ath9k_hw_tx99_stop(sc->sc_ah);
+        ath_dbg(common, XMIT, "TX99 stopped\n");
+}
+
+static struct sk_buff *ath9k_build_tx99_skb(struct ath_softc *sc)
+{
+        static u8 PN9Data[] = {0xff, 0x87, 0xb8, 0x59, 0xb7, 0xa1, 0xcc, 0x24,
+                               0x57, 0x5e, 0x4b, 0x9c, 0x0e, 0xe9, 0xea, 0x50,
+                               0x2a, 0xbe, 0xb4, 0x1b, 0xb6, 0xb0, 0x5d, 0xf1,
+                               0xe6, 0x9a, 0xe3, 0x45, 0xfd, 0x2c, 0x53, 0x18,
+                               0x0c, 0xca, 0xc9, 0xfb, 0x49, 0x37, 0xe5, 0xa8,
+                               0x51, 0x3b, 0x2f, 0x61, 0xaa, 0x72, 0x18, 0x84,
+                               0x02, 0x23, 0x23, 0xab, 0x63, 0x89, 0x51, 0xb3,
+                               0xe7, 0x8b, 0x72, 0x90, 0x4c, 0xe8, 0xfb, 0xc0};
+        u32 len = 1200;
+        struct ieee80211_tx_rate *rate;
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ieee80211_hdr *hdr;
+        struct ieee80211_tx_info *tx_info;
+        struct sk_buff *skb;
+
+        skb = alloc_skb(len, GFP_KERNEL);
+        if (!skb)
+                return NULL;
+
+        skb_put(skb, len);
+
+        memset(skb->data, 0, len);
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA);
+        hdr->duration_id = 0;
+
+        memcpy(hdr->addr1, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr2, hw->wiphy->perm_addr, ETH_ALEN);
+        memcpy(hdr->addr3, hw->wiphy->perm_addr, ETH_ALEN);
+
+        hdr->seq_ctrl |= cpu_to_le16(sc->tx.seq_no);
+
+        tx_info = IEEE80211_SKB_CB(skb);
+        memset(tx_info, 0, sizeof(*tx_info));
+        rate = &tx_info->control.rates[0];
+        tx_info->band = hw->conf.chandef.chan->band;
+        tx_info->flags = IEEE80211_TX_CTL_NO_ACK;
+        tx_info->control.vif = sc->tx99_vif;
+        rate->count = 1;
+        if (ah->curchan && IS_CHAN_HT(ah->curchan)) {
+                rate->flags |= IEEE80211_TX_RC_MCS;
+                if (IS_CHAN_HT40(ah->curchan))
+                        rate->flags |= IEEE80211_TX_RC_40_MHZ_WIDTH;
+        }
+
+        memcpy(skb->data + sizeof(*hdr), PN9Data, sizeof(PN9Data));
+
+        return skb;
+}
+
+static void ath9k_tx99_deinit(struct ath_softc *sc)
+{
+        ath_reset(sc);
+
+        ath9k_ps_wakeup(sc);
+        ath9k_tx99_stop(sc);
+        ath9k_ps_restore(sc);
+}
+
+static int ath9k_tx99_init(struct ath_softc *sc)
+{
+        struct ieee80211_hw *hw = sc->hw;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        struct ath_tx_control txctl;
+        int r;
+
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+                ath_err(common,
+                        "driver is in invalid state unable to use TX99");
+                return -EINVAL;
+        }
+
+        sc->tx99_skb = ath9k_build_tx99_skb(sc);
+        if (!sc->tx99_skb)
+                return -ENOMEM;
+
+        memset(&txctl, 0, sizeof(txctl));
+        txctl.txq = sc->tx.txq_map[IEEE80211_AC_VO];
+
+        ath_reset(sc);
+
+        ath9k_ps_wakeup(sc);
+
+        ath9k_hw_disable_interrupts(ah);
+        atomic_set(&ah->intr_ref_cnt, -1);
+        ath_drain_all_txq(sc);
+        ath_stoprecv(sc);
+
+        sc->tx99_state = true;
+
+        ieee80211_stop_queues(hw);
+
+        if (sc->tx99_power == MAX_RATE_POWER + 1)
+                sc->tx99_power = MAX_RATE_POWER;
+
+        ath9k_hw_tx99_set_txpower(ah, sc->tx99_power);
+        r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
+        if (r) {
+                ath_dbg(common, XMIT, "Failed to xmit TX99 skb\n");
+                return r;
+        }
+
+        ath_dbg(common, XMIT, "TX99 xmit started using %d ( %ddBm)\n",
+                sc->tx99_power,
+                sc->tx99_power / 2);
+
+        /* We leave the harware awake as it will be chugging on */
+
+        return 0;
+}
+
+static ssize_t read_file_tx99(struct file *file, char __user *user_buf,
+                              size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[3];
+        unsigned int len;
+
+        len = sprintf(buf, "%d\n", sc->tx99_state);
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_tx99(struct file *file, const char __user *user_buf,
+                               size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+        char buf[32];
+        bool start;
+        ssize_t len;
+        int r;
+
+        if (sc->nvifs > 1)
+                return -EOPNOTSUPP;
+
+        len = min(count, sizeof(buf) - 1);
+        if (copy_from_user(buf, user_buf, len))
+                return -EFAULT;
+
+        if (strtobool(buf, &start))
+                return -EINVAL;
+
+        if (start == sc->tx99_state) {
+                if (!start)
+                        return count;
+                ath_dbg(common, XMIT, "Resetting TX99\n");
+                ath9k_tx99_deinit(sc);
+        }
+
+        if (!start) {
+                ath9k_tx99_deinit(sc);
+                return count;
+        }
+
+        r = ath9k_tx99_init(sc);
+        if (r)
+                return r;
+
+        return count;
+}
+
+static const struct file_operations fops_tx99 = {
+        .read = read_file_tx99,
+        .write = write_file_tx99,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+static ssize_t read_file_tx99_power(struct file *file,
+                                    char __user *user_buf,
+                                    size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        char buf[32];
+        unsigned int len;
+
+        len = sprintf(buf, "%d (%d dBm)\n",
+                      sc->tx99_power,
+                      sc->tx99_power / 2);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, len);
+}
+
+static ssize_t write_file_tx99_power(struct file *file,
+                                     const char __user *user_buf,
+                                     size_t count, loff_t *ppos)
+{
+        struct ath_softc *sc = file->private_data;
+        int r;
+        u8 tx_power;
+
+        r = kstrtou8_from_user(user_buf, count, 0, &tx_power);
+        if (r)
+                return r;
+
+        if (tx_power > MAX_RATE_POWER)
+                return -EINVAL;
+
+        sc->tx99_power = tx_power;
+
+        ath9k_ps_wakeup(sc);
+        ath9k_hw_tx99_set_txpower(sc->sc_ah, sc->tx99_power);
+        ath9k_ps_restore(sc);
+
+        return count;
+}
+
+static const struct file_operations fops_tx99_power = {
+        .read = read_file_tx99_power,
+        .write = write_file_tx99_power,
+        .open = simple_open,
+        .owner = THIS_MODULE,
+        .llseek = default_llseek,
+};
+
+void ath9k_tx99_init_debug(struct ath_softc *sc)
+{
+        if (!AR_SREV_9300_20_OR_LATER(sc->sc_ah))
+                return;
+
+        debugfs_create_file("tx99", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_tx99);
+        debugfs_create_file("tx99_power", S_IRUSR | S_IWUSR,
+                            sc->debug.debugfs_phy, sc,
+                            &fops_tx99_power);
+}
diff --git a/drivers/net/wireless/ath/ath9k/wow.c b/drivers/net/wireless/ath/ath9k/wow.c
index 81c88dd606dc..1b3230fa3651 100644
--- a/drivers/net/wireless/ath/ath9k/wow.c
+++ b/drivers/net/wireless/ath/ath9k/wow.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ * Copyright (c) 2013 Qualcomm Atheros, Inc.
  *
  * Permission to use, copy, modify, and/or distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,409 +14,347 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/export.h>
 #include "ath9k.h"
-#include "reg.h"
-#include "hw-ops.h"
 
-const char *ath9k_hw_wow_event_to_string(u32 wow_event)
-{
-        if (wow_event & AH_WOW_MAGIC_PATTERN_EN)
-                return "Magic pattern";
-        if (wow_event & AH_WOW_USER_PATTERN_EN)
-                return "User pattern";
-        if (wow_event & AH_WOW_LINK_CHANGE)
-                return "Link change";
-        if (wow_event & AH_WOW_BEACON_MISS)
-                return "Beacon miss";
-
-        return  "unknown reason";
-}
-EXPORT_SYMBOL(ath9k_hw_wow_event_to_string);
+static const struct wiphy_wowlan_support ath9k_wowlan_support = {
+        .flags = WIPHY_WOWLAN_MAGIC_PKT | WIPHY_WOWLAN_DISCONNECT,
+        .n_patterns = MAX_NUM_USER_PATTERN,
+        .pattern_min_len = 1,
+        .pattern_max_len = MAX_PATTERN_SIZE,
+};
 
-static void ath9k_hw_set_powermode_wow_sleep(struct ath_hw *ah)
+static void ath9k_wow_map_triggers(struct ath_softc *sc,
+                                   struct cfg80211_wowlan *wowlan,
+                                   u32 *wow_triggers)
 {
-        struct ath_common *common = ath9k_hw_common(ah);
+        if (wowlan->disconnect)
+                *wow_triggers |= AH_WOW_LINK_CHANGE |
+                                 AH_WOW_BEACON_MISS;
+        if (wowlan->magic_pkt)
+                *wow_triggers |= AH_WOW_MAGIC_PATTERN_EN;
 
-        REG_SET_BIT(ah, AR_STA_ID1, AR_STA_ID1_PWR_SAV);
+        if (wowlan->n_patterns)
+                *wow_triggers |= AH_WOW_USER_PATTERN_EN;
 
-        /* set rx disable bit */
-        REG_WRITE(ah, AR_CR, AR_CR_RXD);
-
-        if (!ath9k_hw_wait(ah, AR_CR, AR_CR_RXE, 0, AH_WAIT_TIMEOUT)) {
-                ath_err(common, "Failed to stop Rx DMA in 10ms AR_CR=0x%08x AR_DIAG_SW=0x%08x\n",
-                        REG_READ(ah, AR_CR), REG_READ(ah, AR_DIAG_SW));
-                return;
-        }
+        sc->wow_enabled = *wow_triggers;
 
-        REG_WRITE(ah, AR_RTC_FORCE_WAKE, AR_RTC_FORCE_WAKE_ON_INT);
 }
 
-static void ath9k_wow_create_keep_alive_pattern(struct ath_hw *ah)
+static void ath9k_wow_add_disassoc_deauth_pattern(struct ath_softc *sc)
 {
+        struct ath_hw *ah = sc->sc_ah;
         struct ath_common *common = ath9k_hw_common(ah);
-        u8 sta_mac_addr[ETH_ALEN], ap_mac_addr[ETH_ALEN];
-        u32 ctl[13] = {0};
-        u32 data_word[KAL_NUM_DATA_WORDS];
-        u8 i;
-        u32 wow_ka_data_word0;
-
-        memcpy(sta_mac_addr, common->macaddr, ETH_ALEN);
-        memcpy(ap_mac_addr, common->curbssid, ETH_ALEN);
-
-        /* set the transmit buffer */
-        ctl[0] = (KAL_FRAME_LEN | (MAX_RATE_POWER << 16));
-        ctl[1] = 0;
-        ctl[3] = 0xb;   /* OFDM_6M hardware value for this rate */
-        ctl[4] = 0;
-        ctl[7] = (ah->txchainmask) << 2;
-        ctl[2] = 0xf << 16; /* tx_tries 0 */
-
-        for (i = 0; i < KAL_NUM_DESC_WORDS; i++)
-                REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
-
-        REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + i * 4), ctl[i]);
-
-        data_word[0] = (KAL_FRAME_TYPE << 2) | (KAL_FRAME_SUB_TYPE << 4) |
-                       (KAL_TO_DS << 8) | (KAL_DURATION_ID << 16);
-        data_word[1] = (ap_mac_addr[3] << 24) | (ap_mac_addr[2] << 16) |
-                       (ap_mac_addr[1] << 8) | (ap_mac_addr[0]);
-        data_word[2] = (sta_mac_addr[1] << 24) | (sta_mac_addr[0] << 16) |
-                       (ap_mac_addr[5] << 8) | (ap_mac_addr[4]);
-        data_word[3] = (sta_mac_addr[5] << 24) | (sta_mac_addr[4] << 16) |
-                       (sta_mac_addr[3] << 8) | (sta_mac_addr[2]);
-        data_word[4] = (ap_mac_addr[3] << 24) | (ap_mac_addr[2] << 16) |
-                       (ap_mac_addr[1] << 8) | (ap_mac_addr[0]);
-        data_word[5] = (ap_mac_addr[5] << 8) | (ap_mac_addr[4]);
-
-        if (AR_SREV_9462_20(ah)) {
-                /* AR9462 2.0 has an extra descriptor word (time based
-                 * discard) compared to other chips */
-                REG_WRITE(ah, (AR_WOW_KA_DESC_WORD2 + (12 * 4)), 0);
-                wow_ka_data_word0 = AR_WOW_TXBUF(13);
-        } else {
-                wow_ka_data_word0 = AR_WOW_TXBUF(12);
-        }
-
-        for (i = 0; i < KAL_NUM_DATA_WORDS; i++)
-                REG_WRITE(ah, (wow_ka_data_word0 + i*4), data_word[i]);
-
-}
-
-void ath9k_hw_wow_apply_pattern(struct ath_hw *ah, u8 *user_pattern,
-                                u8 *user_mask, int pattern_count,
-                                int pattern_len)
-{
-        int i;
-        u32 pattern_val, mask_val;
-        u32 set, clr;
+        int pattern_count = 0;
+        int i, byte_cnt;
+        u8 dis_deauth_pattern[MAX_PATTERN_SIZE];
+        u8 dis_deauth_mask[MAX_PATTERN_SIZE];
 
-        /* FIXME: should check count by querying the hardware capability */
-        if (pattern_count >= MAX_NUM_PATTERN)
-                return;
-
-        REG_SET_BIT(ah, AR_WOW_PATTERN, BIT(pattern_count));
-
-        /* set the registers for pattern */
-        for (i = 0; i < MAX_PATTERN_SIZE; i += 4) {
-                memcpy(&pattern_val, user_pattern, 4);
-                REG_WRITE(ah, (AR_WOW_TB_PATTERN(pattern_count) + i),
-                          pattern_val);
-                user_pattern += 4;
-        }
-
-        /* set the registers for mask */
-        for (i = 0; i < MAX_PATTERN_MASK_SIZE; i += 4) {
-                memcpy(&mask_val, user_mask, 4);
-                REG_WRITE(ah, (AR_WOW_TB_MASK(pattern_count) + i), mask_val);
-                user_mask += 4;
-        }
+        memset(dis_deauth_pattern, 0, MAX_PATTERN_SIZE);
+        memset(dis_deauth_mask, 0, MAX_PATTERN_SIZE);
 
-        /* set the pattern length to be matched
+        /*
+         * Create Dissassociate / Deauthenticate packet filter
+         *
+         *     2 bytes        2 byte    6 bytes   6 bytes  6 bytes
+         *  +--------------+----------+---------+--------+--------+----
+         *  + Frame Control+ Duration +   DA    +  SA    +  BSSID +
+         *  +--------------+----------+---------+--------+--------+----
          *
-         * AR_WOW_LENGTH1_REG1
-         * bit 31:24 pattern 0 length
-         * bit 23:16 pattern 1 length
-         * bit 15:8 pattern 2 length
-         * bit 7:0 pattern 3 length
+         * The above is the management frame format for disassociate/
+         * deauthenticate pattern, from this we need to match the first byte
+         * of 'Frame Control' and DA, SA, and BSSID fields
+         * (skipping 2nd byte of FC and Duration feild.
          *
-         * AR_WOW_LENGTH1_REG2
-         * bit 31:24 pattern 4 length
-         * bit 23:16 pattern 5 length
-         * bit 15:8 pattern 6 length
-         * bit 7:0 pattern 7 length
+         * Disassociate pattern
+         * --------------------
+         * Frame control = 00 00 1010
+         * DA, SA, BSSID = x:x:x:x:x:x
+         * Pattern will be A0000000 | x:x:x:x:x:x | x:x:x:x:x:x
+         *                          | x:x:x:x:x:x  -- 22 bytes
          *
-         * the below logic writes out the new
-         * pattern length for the corresponding
-         * pattern_count, while masking out the
-         * other fields
+         * Deauthenticate pattern
+         * ----------------------
+         * Frame control = 00 00 1100
+         * DA, SA, BSSID = x:x:x:x:x:x
+         * Pattern will be C0000000 | x:x:x:x:x:x | x:x:x:x:x:x
+         *                          | x:x:x:x:x:x  -- 22 bytes
          */
 
-        ah->wow_event_mask |= BIT(pattern_count + AR_WOW_PAT_FOUND_SHIFT);
-
-        if (pattern_count < 4) {
-                /* Pattern 0-3 uses AR_WOW_LENGTH1 register */
-                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
-                       AR_WOW_LEN1_SHIFT(pattern_count);
-                clr = AR_WOW_LENGTH1_MASK(pattern_count);
-                REG_RMW(ah, AR_WOW_LENGTH1, set, clr);
-        } else {
-                /* Pattern 4-7 uses AR_WOW_LENGTH2 register */
-                set = (pattern_len & AR_WOW_LENGTH_MAX) <<
-                       AR_WOW_LEN2_SHIFT(pattern_count);
-                clr = AR_WOW_LENGTH2_MASK(pattern_count);
-                REG_RMW(ah, AR_WOW_LENGTH2, set, clr);
-        }
+        /* Create Disassociate Pattern first */
 
-}
-EXPORT_SYMBOL(ath9k_hw_wow_apply_pattern);
+        byte_cnt = 0;
 
-u32 ath9k_hw_wow_wakeup(struct ath_hw *ah)
-{
-        u32 wow_status = 0;
-        u32 val = 0, rval;
+        /* Fill out the mask with all FF's */
 
-        /*
-         * read the WoW status register to know
-         * the wakeup reason
-         */
-        rval = REG_READ(ah, AR_WOW_PATTERN);
-        val = AR_WOW_STATUS(rval);
+        for (i = 0; i < MAX_PATTERN_MASK_SIZE; i++)
+                dis_deauth_mask[i] = 0xff;
 
-        /*
-         * mask only the WoW events that we have enabled. Sometimes
-         * we have spurious WoW events from the AR_WOW_PATTERN
-         * register. This mask will clean it up.
-         */
+        /* copy the first byte of frame control field */
+        dis_deauth_pattern[byte_cnt] = 0xa0;
+        byte_cnt++;
 
-        val &= ah->wow_event_mask;
-
-        if (val) {
-                if (val & AR_WOW_MAGIC_PAT_FOUND)
-                        wow_status |= AH_WOW_MAGIC_PATTERN_EN;
-                if (AR_WOW_PATTERN_FOUND(val))
-                        wow_status |= AH_WOW_USER_PATTERN_EN;
-                if (val & AR_WOW_KEEP_ALIVE_FAIL)
-                        wow_status |= AH_WOW_LINK_CHANGE;
-                if (val & AR_WOW_BEACON_FAIL)
-                        wow_status |= AH_WOW_BEACON_MISS;
-        }
+        /* skip 2nd byte of frame control and Duration field */
+        byte_cnt += 3;
 
         /*
-         * set and clear WOW_PME_CLEAR registers for the chip to
-         * generate next wow signal.
-         * disable D3 before accessing other registers ?
+         * need not match the destination mac address, it can be a broadcast
+         * mac address or an unicast to this station
          */
+        byte_cnt += 6;
 
-        /* do we need to check the bit value 0x01000000 (7-10) ?? */
-        REG_RMW(ah, AR_PCIE_PM_CTRL, AR_PMCTRL_WOW_PME_CLR,
-                AR_PMCTRL_PWR_STATE_D1D3);
+        /* copy the source mac address */
+        memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
 
-        /*
-         * clear all events
-         */
-        REG_WRITE(ah, AR_WOW_PATTERN,
-                  AR_WOW_CLEAR_EVENTS(REG_READ(ah, AR_WOW_PATTERN)));
+        byte_cnt += 6;
 
-        /*
-         * restore the beacon threshold to init value
-         */
-        REG_WRITE(ah, AR_RSSI_THR, INIT_RSSI_THR);
+        /* copy the bssid, its same as the source mac address */
+
+        memcpy((dis_deauth_pattern + byte_cnt), common->curbssid, ETH_ALEN);
+
+        /* Create Disassociate pattern mask */
+
+        dis_deauth_mask[0] = 0xfe;
+        dis_deauth_mask[1] = 0x03;
+        dis_deauth_mask[2] = 0xc0;
+
+        ath_dbg(common, WOW, "Adding disassoc/deauth patterns for WoW\n");
 
+        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                   pattern_count, byte_cnt);
+
+        pattern_count++;
         /*
-         * Restore the way the PCI-E reset, Power-On-Reset, external
-         * PCIE_POR_SHORT pins are tied to its original value.
-         * Previously just before WoW sleep, we untie the PCI-E
-         * reset to our Chip's Power On Reset so that any PCI-E
-         * reset from the bus will not reset our chip
+         * for de-authenticate pattern, only the first byte of the frame
+         * control field gets changed from 0xA0 to 0xC0
          */
-        if (ah->is_pciexpress)
-                ath9k_hw_configpcipowersave(ah, false);
+        dis_deauth_pattern[0] = 0xC0;
 
-        ah->wow_event_mask = 0;
+        ath9k_hw_wow_apply_pattern(ah, dis_deauth_pattern, dis_deauth_mask,
+                                   pattern_count, byte_cnt);
 
-        return wow_status;
 }
-EXPORT_SYMBOL(ath9k_hw_wow_wakeup);
 
-void ath9k_hw_wow_enable(struct ath_hw *ah, u32 pattern_enable)
+static void ath9k_wow_add_pattern(struct ath_softc *sc,
+                                  struct cfg80211_wowlan *wowlan)
 {
-        u32 wow_event_mask;
-        u32 set, clr;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath9k_wow_pattern *wow_pattern = NULL;
+        struct cfg80211_pkt_pattern *patterns = wowlan->patterns;
+        int mask_len;
+        s8 i = 0;
 
-        /*
-         * wow_event_mask is a mask to the AR_WOW_PATTERN register to
-         * indicate which WoW events we have enabled. The WoW events
-         * are from the 'pattern_enable' in this function and
-         * 'pattern_count' of ath9k_hw_wow_apply_pattern()
-         */
-        wow_event_mask = ah->wow_event_mask;
+        if (!wowlan->n_patterns)
+                return;
 
         /*
-         * Untie Power-on-Reset from the PCI-E-Reset. When we are in
-         * WOW sleep, we do want the Reset from the PCI-E to disturb
-         * our hw state
+         * Add the new user configured patterns
          */
-        if (ah->is_pciexpress) {
+        for (i = 0; i < wowlan->n_patterns; i++) {
+
+                wow_pattern = kzalloc(sizeof(*wow_pattern), GFP_KERNEL);
+
+                if (!wow_pattern)
+                        return;
+
+                /*
+                 * TODO: convert the generic user space pattern to
+                 * appropriate chip specific/802.11 pattern.
+                 */
+
+                mask_len = DIV_ROUND_UP(wowlan->patterns[i].pattern_len, 8);
+                memset(wow_pattern->pattern_bytes, 0, MAX_PATTERN_SIZE);
+                memset(wow_pattern->mask_bytes, 0, MAX_PATTERN_SIZE);
+                memcpy(wow_pattern->pattern_bytes, patterns[i].pattern,
+                       patterns[i].pattern_len);
+                memcpy(wow_pattern->mask_bytes, patterns[i].mask, mask_len);
+                wow_pattern->pattern_len = patterns[i].pattern_len;
+
                 /*
-                 * we need to untie the internal POR (power-on-reset)
-                 * to the external PCI-E reset. We also need to tie
-                 * the PCI-E Phy reset to the PCI-E reset.
+                 * just need to take care of deauth and disssoc pattern,
+                 * make sure we don't overwrite them.
                  */
-                set = AR_WA_RESET_EN | AR_WA_POR_SHORT;
-                clr = AR_WA_UNTIE_RESET_EN | AR_WA_D3_L1_DISABLE;
-                REG_RMW(ah, AR_WA, set, clr);
+
+                ath9k_hw_wow_apply_pattern(ah, wow_pattern->pattern_bytes,
+                                           wow_pattern->mask_bytes,
+                                           i + 2,
+                                           wow_pattern->pattern_len);
+                kfree(wow_pattern);
+
         }
 
-        /*
-         * set the power states appropriately and enable PME
-         */
-        set = AR_PMCTRL_HOST_PME_EN | AR_PMCTRL_PWR_PM_CTRL_ENA |
-              AR_PMCTRL_AUX_PWR_DET | AR_PMCTRL_WOW_PME_CLR;
+}
 
-        /*
-         * set and clear WOW_PME_CLEAR registers for the chip
-         * to generate next wow signal.
-         */
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
-        clr = AR_PMCTRL_WOW_PME_CLR;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+int ath9k_suspend(struct ieee80211_hw *hw,
+                  struct cfg80211_wowlan *wowlan)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 wow_triggers_enabled = 0;
+        int ret = 0;
 
-        /*
-         * Setup for:
-         *      - beacon misses
-         *      - magic pattern
-         *      - keep alive timeout
-         *      - pattern matching
-         */
+        mutex_lock(&sc->mutex);
 
-        /*
-         * Program default values for pattern backoff, aifs/slot/KAL count,
-         * beacon miss timeout, KAL timeout, etc.
-         */
-        set = AR_WOW_BACK_OFF_SHIFT(AR_WOW_PAT_BACKOFF);
-        REG_SET_BIT(ah, AR_WOW_PATTERN, set);
+        ath_cancel_work(sc);
+        ath_stop_ani(sc);
 
-        set = AR_WOW_AIFS_CNT(AR_WOW_CNT_AIFS_CNT) |
-              AR_WOW_SLOT_CNT(AR_WOW_CNT_SLOT_CNT) |
-              AR_WOW_KEEP_ALIVE_CNT(AR_WOW_CNT_KA_CNT);
-        REG_SET_BIT(ah, AR_WOW_COUNT, set);
+        if (test_bit(SC_OP_INVALID, &sc->sc_flags)) {
+                ath_dbg(common, ANY, "Device not present\n");
+                ret = -EINVAL;
+                goto fail_wow;
+        }
 
-        if (pattern_enable & AH_WOW_BEACON_MISS)
-                set = AR_WOW_BEACON_TIMO;
-        /* We are not using beacon miss, program a large value */
-        else
-                set = AR_WOW_BEACON_TIMO_MAX;
+        if (WARN_ON(!wowlan)) {
+                ath_dbg(common, WOW, "None of the WoW triggers enabled\n");
+                ret = -EINVAL;
+                goto fail_wow;
+        }
 
-        REG_WRITE(ah, AR_WOW_BCN_TIMO, set);
+        if (!device_can_wakeup(sc->dev)) {
+                ath_dbg(common, WOW, "device_can_wakeup failed, WoW is not enabled\n");
+                ret = 1;
+                goto fail_wow;
+        }
 
         /*
-         * Keep alive timo in ms except AR9280
+         * none of the sta vifs are associated
+         * and we are not currently handling multivif
+         * cases, for instance we have to seperately
+         * configure 'keep alive frame' for each
+         * STA.
          */
-        if (!pattern_enable)
-                set = AR_WOW_KEEP_ALIVE_NEVER;
-        else
-                set = KAL_TIMEOUT * 32;
 
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_TIMO, set);
+        if (!test_bit(SC_OP_PRIM_STA_VIF, &sc->sc_flags)) {
+                ath_dbg(common, WOW, "None of the STA vifs are associated\n");
+                ret = 1;
+                goto fail_wow;
+        }
+
+        if (sc->nvifs > 1) {
+                ath_dbg(common, WOW, "WoW for multivif is not yet supported\n");
+                ret = 1;
+                goto fail_wow;
+        }
+
+        ath9k_wow_map_triggers(sc, wowlan, &wow_triggers_enabled);
+
+        ath_dbg(common, WOW, "WoW triggers enabled 0x%x\n",
+                wow_triggers_enabled);
+
+        ath9k_ps_wakeup(sc);
+
+        ath9k_stop_btcoex(sc);
 
         /*
-         * Keep alive delay in us. based on 'power on clock',
-         * therefore in usec
+         * Enable wake up on recieving disassoc/deauth
+         * frame by default.
          */
-        set = KAL_DELAY * 1000;
-        REG_WRITE(ah, AR_WOW_KEEP_ALIVE_DELAY, set);
+        ath9k_wow_add_disassoc_deauth_pattern(sc);
+
+        if (wow_triggers_enabled & AH_WOW_USER_PATTERN_EN)
+                ath9k_wow_add_pattern(sc, wowlan);
 
+        spin_lock_bh(&sc->sc_pcu_lock);
         /*
-         * Create keep alive pattern to respond to beacons
+         * To avoid false wake, we enable beacon miss interrupt only
+         * when we go to sleep. We save the current interrupt mask
+         * so we can restore it after the system wakes up
          */
-        ath9k_wow_create_keep_alive_pattern(ah);
+        sc->wow_intr_before_sleep = ah->imask;
+        ah->imask &= ~ATH9K_INT_GLOBAL;
+        ath9k_hw_disable_interrupts(ah);
+        ah->imask = ATH9K_INT_BMISS | ATH9K_INT_GLOBAL;
+        ath9k_hw_set_interrupts(ah);
+        ath9k_hw_enable_interrupts(ah);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
 
         /*
-         * Configure MAC WoW Registers
+         * we can now sync irq and kill any running tasklets, since we already
+         * disabled interrupts and not holding a spin lock
          */
-        set = 0;
-        /* Send keep alive timeouts anyway */
-        clr = AR_WOW_KEEP_ALIVE_AUTO_DIS;
+        synchronize_irq(sc->irq);
+        tasklet_kill(&sc->intr_tq);
 
-        if (pattern_enable & AH_WOW_LINK_CHANGE)
-                wow_event_mask |= AR_WOW_KEEP_ALIVE_FAIL;
-        else
-                set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
+        ath9k_hw_wow_enable(ah, wow_triggers_enabled);
 
-        set = AR_WOW_KEEP_ALIVE_FAIL_DIS;
-        REG_RMW(ah, AR_WOW_KEEP_ALIVE, set, clr);
+        ath9k_ps_restore(sc);
+        ath_dbg(common, ANY, "WoW enabled in ath9k\n");
+        atomic_inc(&sc->wow_sleep_proc_intr);
 
-        /*
-         * we are relying on a bmiss failure. ensure we have
-         * enough threshold to prevent false positives
-         */
-        REG_RMW_FIELD(ah, AR_RSSI_THR, AR_RSSI_THR_BM_THR,
-                      AR_WOW_BMISSTHRESHOLD);
+fail_wow:
+        mutex_unlock(&sc->mutex);
+        return ret;
+}
+
+int ath9k_resume(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
+        struct ath_hw *ah = sc->sc_ah;
+        struct ath_common *common = ath9k_hw_common(ah);
+        u32 wow_status;
 
-        set = 0;
-        clr = 0;
+        mutex_lock(&sc->mutex);
 
-        if (pattern_enable & AH_WOW_BEACON_MISS) {
-                set = AR_WOW_BEACON_FAIL_EN;
-                wow_event_mask |= AR_WOW_BEACON_FAIL;
-        } else {
-                clr = AR_WOW_BEACON_FAIL_EN;
+        ath9k_ps_wakeup(sc);
+
+        spin_lock_bh(&sc->sc_pcu_lock);
+
+        ath9k_hw_disable_interrupts(ah);
+        ah->imask = sc->wow_intr_before_sleep;
+        ath9k_hw_set_interrupts(ah);
+        ath9k_hw_enable_interrupts(ah);
+
+        spin_unlock_bh(&sc->sc_pcu_lock);
+
+        wow_status = ath9k_hw_wow_wakeup(ah);
+
+        if (atomic_read(&sc->wow_got_bmiss_intr) == 0) {
+                /*
+                 * some devices may not pick beacon miss
+                 * as the reason they woke up so we add
+                 * that here for that shortcoming.
+                 */
+                wow_status |= AH_WOW_BEACON_MISS;
+                atomic_dec(&sc->wow_got_bmiss_intr);
+                ath_dbg(common, ANY, "Beacon miss interrupt picked up during WoW sleep\n");
         }
 
-        REG_RMW(ah, AR_WOW_BCN_EN, set, clr);
+        atomic_dec(&sc->wow_sleep_proc_intr);
 
-        set = 0;
-        clr = 0;
-        /*
-         * Enable the magic packet registers
-         */
-        if (pattern_enable & AH_WOW_MAGIC_PATTERN_EN) {
-                set = AR_WOW_MAGIC_EN;
-                wow_event_mask |= AR_WOW_MAGIC_PAT_FOUND;
-        } else {
-                clr = AR_WOW_MAGIC_EN;
+        if (wow_status) {
+                ath_dbg(common, ANY, "Waking up due to WoW triggers %s with WoW status = %x\n",
+                        ath9k_hw_wow_event_to_string(wow_status), wow_status);
         }
-        set |= AR_WOW_MAC_INTR_EN;
-        REG_RMW(ah, AR_WOW_PATTERN, set, clr);
 
-        REG_WRITE(ah, AR_WOW_PATTERN_MATCH_LT_256B,
-                  AR_WOW_PATTERN_SUPPORTED);
+        ath_restart_work(sc);
+        ath9k_start_btcoex(sc);
 
-        /*
-         * Set the power states appropriately and enable PME
-         */
-        clr = 0;
-        set = AR_PMCTRL_PWR_STATE_D1D3 | AR_PMCTRL_HOST_PME_EN |
-              AR_PMCTRL_PWR_PM_CTRL_ENA;
+        ath9k_ps_restore(sc);
+        mutex_unlock(&sc->mutex);
 
-        clr = AR_PCIE_PM_CTRL_ENA;
-        REG_RMW(ah, AR_PCIE_PM_CTRL, set, clr);
+        return 0;
+}
 
-        /*
-         * this is needed to prevent the chip waking up
-         * the host within 3-4 seconds with certain
-         * platform/BIOS. The fix is to enable
-         * D1 & D3 to match original definition and
-         * also match the OTP value. Anyway this
-         * is more related to SW WOW.
-         */
-        clr = AR_PMCTRL_PWR_STATE_D1D3;
-        REG_CLR_BIT(ah, AR_PCIE_PM_CTRL, clr);
+void ath9k_set_wakeup(struct ieee80211_hw *hw, bool enabled)
+{
+        struct ath_softc *sc = hw->priv;
 
-        set = AR_PMCTRL_PWR_STATE_D1D3_REAL;
-        REG_SET_BIT(ah, AR_PCIE_PM_CTRL, set);
+        mutex_lock(&sc->mutex);
+        device_init_wakeup(sc->dev, 1);
+        device_set_wakeup_enable(sc->dev, enabled);
+        mutex_unlock(&sc->mutex);
+}
 
-        REG_CLR_BIT(ah, AR_STA_ID1, AR_STA_ID1_PRESERVE_SEQNUM);
+void ath9k_init_wow(struct ieee80211_hw *hw)
+{
+        struct ath_softc *sc = hw->priv;
 
-        /* to bring down WOW power low margin */
-        set = BIT(13);
-        REG_SET_BIT(ah, AR_PCIE_PHY_REG3, set);
-        /* HW WoW */
-        clr = BIT(5);
-        REG_CLR_BIT(ah, AR_PCU_MISC_MODE3, clr);
+        if ((sc->sc_ah->caps.hw_caps & ATH9K_HW_WOW_DEVICE_CAPABLE) &&
+            (sc->driver_data & ATH9K_PCI_WOW) &&
+            device_can_wakeup(sc->dev))
+                hw->wiphy->wowlan = &ath9k_wowlan_support;
 
-        ath9k_hw_set_powermode_wow_sleep(ah);
-        ah->wow_event_mask = wow_event_mask;
+        atomic_set(&sc->wow_sleep_proc_intr, -1);
+        atomic_set(&sc->wow_got_bmiss_intr, -1);
 }
-EXPORT_SYMBOL(ath9k_hw_wow_enable);
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index b5a19e098f2d..0a75e2f68c9d 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -47,8 +47,6 @@ static u16 bits_per_symbol[][2] = {
         {   260,  540 },     /*  7: 64-QAM 5/6 */
 };
 
-#define IS_HT_RATE(_rate)     ((_rate) & 0x80)
-
 static void ath_tx_send_normal(struct ath_softc *sc, struct ath_txq *txq,
                                struct ath_atx_tid *tid, struct sk_buff *skb);
 static void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
@@ -174,14 +172,7 @@ static void ath_txq_skb_done(struct ath_softc *sc, struct ath_txq *txq,
 static struct ath_atx_tid *
 ath_get_skb_tid(struct ath_softc *sc, struct ath_node *an, struct sk_buff *skb)
 {
-        struct ieee80211_hdr *hdr;
-        u8 tidno = 0;
-
-        hdr = (struct ieee80211_hdr *) skb->data;
-        if (ieee80211_is_data_qos(hdr->frame_control))
-                tidno = ieee80211_get_qos_ctl(hdr)[0];
-
-        tidno &= IEEE80211_QOS_CTL_TID_MASK;
+        u8 tidno = skb->priority & IEEE80211_QOS_CTL_TID_MASK;
         return ATH_AN_2_TID(an, tidno);
 }
 
@@ -781,11 +772,6 @@ static u32 ath_lookup_rate(struct ath_softc *sc, struct ath_buf *bf,
         if (bt_aggr_limit)
                 aggr_limit = bt_aggr_limit;
 
-        /*
-         * h/w can accept aggregates up to 16 bit lengths (65535).
-         * The IE, however can hold up to 65536, which shows up here
-         * as zero. Ignore 65536 since we  are constrained by hw.
-         */
         if (tid->an->maxampdu)
                 aggr_limit = min(aggr_limit, tid->an->maxampdu);
 
@@ -1410,8 +1396,8 @@ int ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
          * has already been added.
          */
         if (sta->ht_cap.ht_supported) {
-                an->maxampdu = 1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
-                                     sta->ht_cap.ampdu_factor);
+                an->maxampdu = (1 << (IEEE80211_HT_MAX_AMPDU_FACTOR +
+                                      sta->ht_cap.ampdu_factor)) - 1;
                 density = ath9k_parse_mpdudensity(sta->ht_cap.ampdu_density);
                 an->mpdudensity = density;
         }
@@ -1790,6 +1776,9 @@ bool ath_drain_all_txq(struct ath_softc *sc)
                 if (!ATH_TXQ_SETUP(sc, i))
                         continue;
 
+                if (!sc->tx.txq[i].axq_depth)
+                        continue;
+
                 if (ath9k_hw_numtxpending(ah, sc->tx.txq[i].axq_qnum))
                         npend |= BIT(i);
         }
@@ -2753,6 +2742,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an)
         }
 }
 
+#ifdef CONFIG_ATH9K_TX99
+
 int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
                     struct ath_tx_control *txctl)
 {
@@ -2795,3 +2786,5 @@ int ath9k_tx99_send(struct ath_softc *sc, struct sk_buff *skb,
 
         return 0;
 }
+
+#endif /* CONFIG_ATH9K_TX99 */
diff --git a/drivers/net/wireless/ath/carl9170/debug.c b/drivers/net/wireless/ath/carl9170/debug.c
index 3d70cd277fd7..1c0af9cd9a85 100644
--- a/drivers/net/wireless/ath/carl9170/debug.c
+++ b/drivers/net/wireless/ath/carl9170/debug.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
index 349fa22a921a..4c8cdb097b65 100644
--- a/drivers/net/wireless/ath/carl9170/main.c
+++ b/drivers/net/wireless/ath/carl9170/main.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
@@ -1968,18 +1967,6 @@ static int carl9170_parse_eeprom(struct ar9170 *ar)
                 return -ENOMEM;
         ar->num_channels = chans;
 
-        /*
-         * I measured this, a bandswitch takes roughly
-         * 135 ms and a frequency switch about 80.
-         *
-         * FIXME: measure these values again once EEPROM settings
-         *        are used, that will influence them!
-         */
-        if (bands == 2)
-                ar->hw->channel_change_time = 135 * 1000;
-        else
-                ar->hw->channel_change_time = 80 * 1000;
-
         regulatory->current_rd = le16_to_cpu(ar->eeprom.reg_domain[0]);
 
         /* second part of wiphy init */
diff --git a/drivers/net/wireless/ath/carl9170/rx.c b/drivers/net/wireless/ath/carl9170/rx.c
index e935f61c7fad..536bc46a2912 100644
--- a/drivers/net/wireless/ath/carl9170/rx.c
+++ b/drivers/net/wireless/ath/carl9170/rx.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
@@ -520,6 +519,7 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
 {
         struct ieee80211_hdr *hdr = data;
         struct ieee80211_tim_ie *tim_ie;
+        struct ath_common *common = &ar->common;
         u8 *tim;
         u8 tim_len;
         bool cam;
@@ -527,17 +527,13 @@ static void carl9170_ps_beacon(struct ar9170 *ar, void *data, unsigned int len)
         if (likely(!(ar->hw->conf.flags & IEEE80211_CONF_PS)))
                 return;
 
-        /* check if this really is a beacon */
-        if (!ieee80211_is_beacon(hdr->frame_control))
-                return;
-
         /* min. beacon length + FCS_LEN */
         if (len <= 40 + FCS_LEN)
                 return;
 
+        /* check if this really is a beacon */
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, ar->common.curbssid) ||
-            !ar->common.curaid)
+        if (!ath_is_mybeacon(common, hdr) || !common->curaid)
                 return;
 
         ar->ps.last_beacon = jiffies;
@@ -602,8 +598,8 @@ static void carl9170_ba_check(struct ar9170 *ar, void *data, unsigned int len)
 
                 if (bar->start_seq_num == entry_bar->start_seq_num &&
                     TID_CHECK(bar->control, entry_bar->control) &&
-                    ether_addr_equal(bar->ra, entry_bar->ta) &&
-                    ether_addr_equal(bar->ta, entry_bar->ra)) {
+                    ether_addr_equal_64bits(bar->ra, entry_bar->ta) &&
+                    ether_addr_equal_64bits(bar->ta, entry_bar->ra)) {
                         struct ieee80211_tx_info *tx_info;
 
                         tx_info = IEEE80211_SKB_CB(entry_skb);
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c
index e3f696ee4d23..4cadfd48ffdf 100644
--- a/drivers/net/wireless/ath/carl9170/tx.c
+++ b/drivers/net/wireless/ath/carl9170/tx.c
@@ -37,7 +37,6 @@
  *    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/ath/main.c b/drivers/net/wireless/ath/main.c
index 8e99540cd90e..8b0ac14d5c32 100644
--- a/drivers/net/wireless/ath/main.c
+++ b/drivers/net/wireless/ath/main.c
@@ -59,6 +59,14 @@ struct sk_buff *ath_rxbuf_alloc(struct ath_common *common,
 }
 EXPORT_SYMBOL(ath_rxbuf_alloc);
 
+bool ath_is_mybeacon(struct ath_common *common, struct ieee80211_hdr *hdr)
+{
+        return ieee80211_is_beacon(hdr->frame_control) &&
+                !is_zero_ether_addr(common->curbssid) &&
+                ether_addr_equal_64bits(hdr->addr3, common->curbssid);
+}
+EXPORT_SYMBOL(ath_is_mybeacon);
+
 void ath_printk(const char *level, const struct ath_common* common,
                 const char *fmt, ...)
 {
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 1217c52ab28e..e5e905910db4 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -37,17 +37,18 @@ static int __ath_regd_init(struct ath_regulatory *reg);
 
 /* We enable active scan on these a case by case basis by regulatory domain */
 #define ATH9K_2GHZ_CH12_13      REG_RULE(2467-10, 2472+10, 40, 0, 20,\
-                                        NL80211_RRF_PASSIVE_SCAN)
+                                         NL80211_RRF_NO_IR)
 #define ATH9K_2GHZ_CH14         REG_RULE(2484-10, 2484+10, 40, 0, 20,\
-                                NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_OFDM)
+                                         NL80211_RRF_NO_IR | \
+                                         NL80211_RRF_NO_OFDM)
 
 /* We allow IBSS on these on a case by case basis by regulatory domain */
 #define ATH9K_5GHZ_5150_5350    REG_RULE(5150-10, 5350+10, 80, 0, 30,\
-                                NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 #define ATH9K_5GHZ_5470_5850    REG_RULE(5470-10, 5850+10, 80, 0, 30,\
-                                NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 #define ATH9K_5GHZ_5725_5850    REG_RULE(5725-10, 5850+10, 80, 0, 30,\
-                                NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 
 #define ATH9K_2GHZ_ALL          ATH9K_2GHZ_CH01_11, \
                                 ATH9K_2GHZ_CH12_13, \
@@ -113,6 +114,87 @@ static const struct ieee80211_regdomain ath_world_regdom_67_68_6A_6C = {
         }
 };
 
+static bool dynamic_country_user_possible(struct ath_regulatory *reg)
+{
+        if (config_enabled(CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING))
+                return true;
+
+        switch (reg->country_code) {
+        case CTRY_UNITED_STATES:
+        case CTRY_JAPAN1:
+        case CTRY_JAPAN2:
+        case CTRY_JAPAN3:
+        case CTRY_JAPAN4:
+        case CTRY_JAPAN5:
+        case CTRY_JAPAN6:
+        case CTRY_JAPAN7:
+        case CTRY_JAPAN8:
+        case CTRY_JAPAN9:
+        case CTRY_JAPAN10:
+        case CTRY_JAPAN11:
+        case CTRY_JAPAN12:
+        case CTRY_JAPAN13:
+        case CTRY_JAPAN14:
+        case CTRY_JAPAN15:
+        case CTRY_JAPAN16:
+        case CTRY_JAPAN17:
+        case CTRY_JAPAN18:
+        case CTRY_JAPAN19:
+        case CTRY_JAPAN20:
+        case CTRY_JAPAN21:
+        case CTRY_JAPAN22:
+        case CTRY_JAPAN23:
+        case CTRY_JAPAN24:
+        case CTRY_JAPAN25:
+        case CTRY_JAPAN26:
+        case CTRY_JAPAN27:
+        case CTRY_JAPAN28:
+        case CTRY_JAPAN29:
+        case CTRY_JAPAN30:
+        case CTRY_JAPAN31:
+        case CTRY_JAPAN32:
+        case CTRY_JAPAN33:
+        case CTRY_JAPAN34:
+        case CTRY_JAPAN35:
+        case CTRY_JAPAN36:
+        case CTRY_JAPAN37:
+        case CTRY_JAPAN38:
+        case CTRY_JAPAN39:
+        case CTRY_JAPAN40:
+        case CTRY_JAPAN41:
+        case CTRY_JAPAN42:
+        case CTRY_JAPAN43:
+        case CTRY_JAPAN44:
+        case CTRY_JAPAN45:
+        case CTRY_JAPAN46:
+        case CTRY_JAPAN47:
+        case CTRY_JAPAN48:
+        case CTRY_JAPAN49:
+        case CTRY_JAPAN50:
+        case CTRY_JAPAN51:
+        case CTRY_JAPAN52:
+        case CTRY_JAPAN53:
+        case CTRY_JAPAN54:
+        case CTRY_JAPAN55:
+        case CTRY_JAPAN56:
+        case CTRY_JAPAN57:
+        case CTRY_JAPAN58:
+        case CTRY_JAPAN59:
+                return false;
+        }
+
+        return true;
+}
+
+static bool ath_reg_dyn_country_user_allow(struct ath_regulatory *reg)
+{
+        if (!config_enabled(CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS))
+                return false;
+        if (!dynamic_country_user_possible(reg))
+                return false;
+        return true;
+}
+
 static inline bool is_wwr_sku(u16 regd)
 {
         return ((regd & COUNTRY_ERD_FLAG) != COUNTRY_ERD_FLAG) &&
@@ -177,118 +259,139 @@ static bool ath_is_radar_freq(u16 center_freq)
         return (center_freq >= 5260 && center_freq <= 5700);
 }
 
+static void ath_force_clear_no_ir_chan(struct wiphy *wiphy,
+                                       struct ieee80211_channel *ch)
+{
+        const struct ieee80211_reg_rule *reg_rule;
+
+        reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(ch->center_freq));
+        if (IS_ERR(reg_rule))
+                return;
+
+        if (!(reg_rule->flags & NL80211_RRF_NO_IR))
+                if (ch->flags & IEEE80211_CHAN_NO_IR)
+                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
+}
+
+static void ath_force_clear_no_ir_freq(struct wiphy *wiphy, u16 center_freq)
+{
+        struct ieee80211_channel *ch;
+
+        ch = ieee80211_get_channel(wiphy, center_freq);
+        if (!ch)
+                return;
+
+        ath_force_clear_no_ir_chan(wiphy, ch);
+}
+
+static void ath_force_no_ir_chan(struct ieee80211_channel *ch)
+{
+        ch->flags |= IEEE80211_CHAN_NO_IR;
+}
+
+static void ath_force_no_ir_freq(struct wiphy *wiphy, u16 center_freq)
+{
+        struct ieee80211_channel *ch;
+
+        ch = ieee80211_get_channel(wiphy, center_freq);
+        if (!ch)
+                return;
+
+        ath_force_no_ir_chan(ch);
+}
+
+static void
+__ath_reg_apply_beaconing_flags(struct wiphy *wiphy,
+                                struct ath_regulatory *reg,
+                                enum nl80211_reg_initiator initiator,
+                                struct ieee80211_channel *ch)
+{
+        if (ath_is_radar_freq(ch->center_freq) ||
+            (ch->flags & IEEE80211_CHAN_RADAR))
+                return;
+
+        switch (initiator) {
+        case NL80211_REGDOM_SET_BY_COUNTRY_IE:
+                ath_force_clear_no_ir_chan(wiphy, ch);
+                break;
+        case NL80211_REGDOM_SET_BY_USER:
+                if (ath_reg_dyn_country_user_allow(reg))
+                        ath_force_clear_no_ir_chan(wiphy, ch);
+                break;
+        default:
+                if (ch->beacon_found)
+                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
+        }
+}
+
 /*
- * N.B: These exception rules do not apply radar freqs.
+ * These exception rules do not apply radar frequencies.
  *
- * - We enable adhoc (or beaconing) if allowed by 11d
- * - We enable active scan if the channel is allowed by 11d
+ * - We enable initiating radiation if the country IE says its fine:
  * - If no country IE has been processed and a we determine we have
- *   received a beacon on a channel we can enable active scan and
- *   adhoc (or beaconing).
+ *   received a beacon on a channel we can enable initiating radiation.
  */
 static void
 ath_reg_apply_beaconing_flags(struct wiphy *wiphy,
+                              struct ath_regulatory *reg,
                               enum nl80211_reg_initiator initiator)
 {
         enum ieee80211_band band;
         struct ieee80211_supported_band *sband;
-        const struct ieee80211_reg_rule *reg_rule;
         struct ieee80211_channel *ch;
         unsigned int i;
 
         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-
                 if (!wiphy->bands[band])
                         continue;
-
                 sband = wiphy->bands[band];
-
                 for (i = 0; i < sband->n_channels; i++) {
-
                         ch = &sband->channels[i];
-
-                        if (ath_is_radar_freq(ch->center_freq) ||
-                            (ch->flags & IEEE80211_CHAN_RADAR))
-                                continue;
-
-                        if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                reg_rule = freq_reg_info(wiphy, ch->center_freq);
-                                if (IS_ERR(reg_rule))
-                                        continue;
-                                /*
-                                 * If 11d had a rule for this channel ensure
-                                 * we enable adhoc/beaconing if it allows us to
-                                 * use it. Note that we would have disabled it
-                                 * by applying our static world regdomain by
-                                 * default during init, prior to calling our
-                                 * regulatory_hint().
-                                 */
-                                if (!(reg_rule->flags &
-                                    NL80211_RRF_NO_IBSS))
-                                        ch->flags &=
-                                          ~IEEE80211_CHAN_NO_IBSS;
-                                if (!(reg_rule->flags &
-                                    NL80211_RRF_PASSIVE_SCAN))
-                                        ch->flags &=
-                                          ~IEEE80211_CHAN_PASSIVE_SCAN;
-                        } else {
-                                if (ch->beacon_found)
-                                        ch->flags &= ~(IEEE80211_CHAN_NO_IBSS |
-                                          IEEE80211_CHAN_PASSIVE_SCAN);
-                        }
+                        __ath_reg_apply_beaconing_flags(wiphy, reg,
+                                                        initiator, ch);
                 }
         }
-
 }
 
-/* Allows active scan scan on Ch 12 and 13 */
+/**
+ * ath_reg_apply_ir_flags()
+ * @wiphy: the wiphy to use
+ * @initiator: the regulatory hint initiator
+ *
+ * If no country IE has been received always enable passive scan
+ * and no-ibss on these channels. This is only done for specific
+ * regulatory SKUs.
+ *
+ * If a country IE has been received check its rule for this
+ * channel first before enabling active scan. The passive scan
+ * would have been enforced by the initial processing of our
+ * custom regulatory domain.
+ */
 static void
-ath_reg_apply_active_scan_flags(struct wiphy *wiphy,
-                                enum nl80211_reg_initiator initiator)
+ath_reg_apply_ir_flags(struct wiphy *wiphy,
+                       struct ath_regulatory *reg,
+                       enum nl80211_reg_initiator initiator)
 {
         struct ieee80211_supported_band *sband;
-        struct ieee80211_channel *ch;
-        const struct ieee80211_reg_rule *reg_rule;
 
         sband = wiphy->bands[IEEE80211_BAND_2GHZ];
         if (!sband)
                 return;
 
-        /*
-         * If no country IE has been received always enable active scan
-         * on these channels. This is only done for specific regulatory SKUs
-         */
-        if (initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                ch = &sband->channels[11]; /* CH 12 */
-                if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
-                ch = &sband->channels[12]; /* CH 13 */
-                if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
-                return;
-        }
-
-        /*
-         * If a country IE has been received check its rule for this
-         * channel first before enabling active scan. The passive scan
-         * would have been enforced by the initial processing of our
-         * custom regulatory domain.
-         */
-
-        ch = &sband->channels[11]; /* CH 12 */
-        reg_rule = freq_reg_info(wiphy, ch->center_freq);
-        if (!IS_ERR(reg_rule)) {
-                if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                        if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
-        }
-
-        ch = &sband->channels[12]; /* CH 13 */
-        reg_rule = freq_reg_info(wiphy, ch->center_freq);
-        if (!IS_ERR(reg_rule)) {
-                if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                        if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+        switch(initiator) {
+        case NL80211_REGDOM_SET_BY_COUNTRY_IE:
+                ath_force_clear_no_ir_freq(wiphy, 2467);
+                ath_force_clear_no_ir_freq(wiphy, 2472);
+                break;
+        case NL80211_REGDOM_SET_BY_USER:
+                if (!ath_reg_dyn_country_user_allow(reg))
+                        break;
+                ath_force_clear_no_ir_freq(wiphy, 2467);
+                ath_force_clear_no_ir_freq(wiphy, 2472);
+                break;
+        default:
+                ath_force_no_ir_freq(wiphy, 2467);
+                ath_force_no_ir_freq(wiphy, 2472);
         }
 }
 
@@ -320,8 +423,7 @@ static void ath_reg_apply_radar_flags(struct wiphy *wiphy)
                  */
                 if (!(ch->flags & IEEE80211_CHAN_DISABLED))
                         ch->flags |= IEEE80211_CHAN_RADAR |
-                                     IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_PASSIVE_SCAN;
+                                     IEEE80211_CHAN_NO_IR;
         }
 }
 
@@ -335,12 +437,15 @@ static void ath_reg_apply_world_flags(struct wiphy *wiphy,
         case 0x66:
         case 0x67:
         case 0x6C:
-                ath_reg_apply_beaconing_flags(wiphy, initiator);
+                ath_reg_apply_beaconing_flags(wiphy, reg, initiator);
                 break;
         case 0x68:
-                ath_reg_apply_beaconing_flags(wiphy, initiator);
-                ath_reg_apply_active_scan_flags(wiphy, initiator);
+                ath_reg_apply_beaconing_flags(wiphy, reg, initiator);
+                ath_reg_apply_ir_flags(wiphy, reg, initiator);
                 break;
+        default:
+                if (ath_reg_dyn_country_user_allow(reg))
+                        ath_reg_apply_beaconing_flags(wiphy, reg, initiator);
         }
 }
 
@@ -393,89 +498,6 @@ static void ath_reg_dyn_country(struct wiphy *wiphy,
                reg_initiator_name(request->initiator));
 }
 
-static bool dynamic_country_user_possible(struct ath_regulatory *reg)
-{
-        if (config_enabled(CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING))
-                return true;
-
-        switch (reg->country_code) {
-        case CTRY_UNITED_STATES:
-        case CTRY_JAPAN1:
-        case CTRY_JAPAN2:
-        case CTRY_JAPAN3:
-        case CTRY_JAPAN4:
-        case CTRY_JAPAN5:
-        case CTRY_JAPAN6:
-        case CTRY_JAPAN7:
-        case CTRY_JAPAN8:
-        case CTRY_JAPAN9:
-        case CTRY_JAPAN10:
-        case CTRY_JAPAN11:
-        case CTRY_JAPAN12:
-        case CTRY_JAPAN13:
-        case CTRY_JAPAN14:
-        case CTRY_JAPAN15:
-        case CTRY_JAPAN16:
-        case CTRY_JAPAN17:
-        case CTRY_JAPAN18:
-        case CTRY_JAPAN19:
-        case CTRY_JAPAN20:
-        case CTRY_JAPAN21:
-        case CTRY_JAPAN22:
-        case CTRY_JAPAN23:
-        case CTRY_JAPAN24:
-        case CTRY_JAPAN25:
-        case CTRY_JAPAN26:
-        case CTRY_JAPAN27:
-        case CTRY_JAPAN28:
-        case CTRY_JAPAN29:
-        case CTRY_JAPAN30:
-        case CTRY_JAPAN31:
-        case CTRY_JAPAN32:
-        case CTRY_JAPAN33:
-        case CTRY_JAPAN34:
-        case CTRY_JAPAN35:
-        case CTRY_JAPAN36:
-        case CTRY_JAPAN37:
-        case CTRY_JAPAN38:
-        case CTRY_JAPAN39:
-        case CTRY_JAPAN40:
-        case CTRY_JAPAN41:
-        case CTRY_JAPAN42:
-        case CTRY_JAPAN43:
-        case CTRY_JAPAN44:
-        case CTRY_JAPAN45:
-        case CTRY_JAPAN46:
-        case CTRY_JAPAN47:
-        case CTRY_JAPAN48:
-        case CTRY_JAPAN49:
-        case CTRY_JAPAN50:
-        case CTRY_JAPAN51:
-        case CTRY_JAPAN52:
-        case CTRY_JAPAN53:
-        case CTRY_JAPAN54:
-        case CTRY_JAPAN55:
-        case CTRY_JAPAN56:
-        case CTRY_JAPAN57:
-        case CTRY_JAPAN58:
-        case CTRY_JAPAN59:
-                return false;
-        }
-
-        return true;
-}
-
-static void ath_reg_dyn_country_user(struct wiphy *wiphy,
-                                     struct ath_regulatory *reg,
-                                     struct regulatory_request *request)
-{
-        if (!config_enabled(CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS))
-                return;
-        if (!dynamic_country_user_possible(reg))
-                return;
-        ath_reg_dyn_country(wiphy, reg, request);
-}
-
 void ath_reg_notifier_apply(struct wiphy *wiphy,
                             struct regulatory_request *request,
                             struct ath_regulatory *reg)
@@ -508,7 +530,8 @@ void ath_reg_notifier_apply(struct wiphy *wiphy,
         case NL80211_REGDOM_SET_BY_DRIVER:
                 break;
         case NL80211_REGDOM_SET_BY_USER:
-                ath_reg_dyn_country_user(wiphy, reg, request);
+                if (ath_reg_dyn_country_user_allow(reg))
+                        ath_reg_dyn_country(wiphy, reg, request);
                 break;
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
                 ath_reg_dyn_country(wiphy, reg, request);
@@ -609,7 +632,8 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
         const struct ieee80211_regdomain *regd;
 
         wiphy->reg_notifier = reg_notifier;
-        wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
+        wiphy->regulatory_flags |= REGULATORY_STRICT_REG |
+                                   REGULATORY_CUSTOM_REG;
 
         if (ath_is_world_regd(reg)) {
                 /*
@@ -617,7 +641,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
                  * saved on the wiphy orig_* parameters
                  */
                 regd = ath_world_regdomain(reg);
-                wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+                wiphy->regulatory_flags |= REGULATORY_COUNTRY_IE_FOLLOW_POWER;
         } else {
                 /*
                  * This gets applied in the case of the absence of CRDA,
@@ -626,6 +650,7 @@ ath_regd_init_wiphy(struct ath_regulatory *reg,
                  */
                 regd = ath_default_world_regdomain();
         }
+
         wiphy_apply_custom_regulatory(wiphy, regd);
         ath_reg_apply_radar_flags(wiphy);
         ath_reg_apply_world_flags(wiphy, NL80211_REGDOM_SET_BY_DRIVER, reg);
diff --git a/drivers/net/wireless/ath/wcn36xx/hal.h b/drivers/net/wireless/ath/wcn36xx/hal.h
index c02dbc618724..3c2ef0c32f72 100644
--- a/drivers/net/wireless/ath/wcn36xx/hal.h
+++ b/drivers/net/wireless/ath/wcn36xx/hal.h
@@ -2644,7 +2644,7 @@ struct wcn36xx_hal_trigger_ba_rsp_candidate {
         struct add_ba_info ba_info[STACFG_MAX_TC];
 } __packed;
 
-struct wcn36xx_hal_trigget_ba_req_candidate {
+struct wcn36xx_hal_trigger_ba_req_candidate {
         u8 sta_index;
         u8 tid_bitmap;
 } __packed;
diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
index 7839b31e4826..e64a6784079e 100644
--- a/drivers/net/wireless/ath/wcn36xx/main.c
+++ b/drivers/net/wireless/ath/wcn36xx/main.c
@@ -641,7 +641,8 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw,
                 dev_kfree_skb(skb);
         }
 
-        if (changed & BSS_CHANGED_BEACON_ENABLED) {
+        if (changed & BSS_CHANGED_BEACON_ENABLED ||
+            changed & BSS_CHANGED_BEACON) {
                 wcn36xx_dbg(WCN36XX_DBG_MAC,
                             "mac bss changed beacon enabled %d\n",
                             bss_conf->enable_beacon);
diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
index 366339421d4f..750626b0e22d 100644
--- a/drivers/net/wireless/ath/wcn36xx/smd.c
+++ b/drivers/net/wireless/ath/wcn36xx/smd.c
@@ -115,6 +115,22 @@ static void wcn36xx_smd_set_sta_ht_params(struct ieee80211_sta *sta,
         }
 }
 
+static void wcn36xx_smd_set_sta_default_ht_params(
+                struct wcn36xx_hal_config_sta_params *sta_params)
+{
+        sta_params->ht_capable = 1;
+        sta_params->tx_channel_width_set = 1;
+        sta_params->lsig_txop_protection = 1;
+        sta_params->max_ampdu_size = 3;
+        sta_params->max_ampdu_density = 5;
+        sta_params->max_amsdu_size = 0;
+        sta_params->sgi_20Mhz = 1;
+        sta_params->sgi_40mhz = 1;
+        sta_params->green_field_capable = 1;
+        sta_params->delayed_ba_support = 0;
+        sta_params->dsss_cck_mode_40mhz = 1;
+}
+
 static void wcn36xx_smd_set_sta_params(struct wcn36xx *wcn,
                 struct ieee80211_vif *vif,
                 struct ieee80211_sta *sta,
@@ -172,6 +188,7 @@ static void wcn36xx_smd_set_sta_params(struct wcn36xx *wcn,
                         sizeof(priv_sta->supported_rates));
         } else {
                 wcn36xx_set_default_rates(&sta_params->supported_rates);
+                wcn36xx_smd_set_sta_default_ht_params(sta_params);
         }
 }
 
@@ -1134,14 +1151,14 @@ int wcn36xx_smd_config_bss(struct wcn36xx *wcn, struct ieee80211_vif *vif,
                 /* STA */
                 bss->oper_mode = 1;
                 bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_MODE;
-        } else if (vif->type == NL80211_IFTYPE_AP) {
+        } else if (vif->type == NL80211_IFTYPE_AP ||
+                   vif->type == NL80211_IFTYPE_MESH_POINT) {
                 bss->bss_type = WCN36XX_HAL_INFRA_AP_MODE;
 
                 /* AP */
                 bss->oper_mode = 0;
                 bss->wcn36xx_hal_persona = WCN36XX_HAL_STA_SAP_MODE;
-        } else if (vif->type == NL80211_IFTYPE_ADHOC ||
-                   vif->type == NL80211_IFTYPE_MESH_POINT) {
+        } else if (vif->type == NL80211_IFTYPE_ADHOC) {
                 bss->bss_type = WCN36XX_HAL_IBSS_MODE;
 
                 /* STA */
@@ -1292,7 +1309,11 @@ int wcn36xx_smd_send_beacon(struct wcn36xx *wcn, struct ieee80211_vif *vif,
         memcpy(msg_body.bssid, vif->addr, ETH_ALEN);
 
         /* TODO need to find out why this is needed? */
-        msg_body.tim_ie_offset = tim_off+4;
+        if (vif->type == NL80211_IFTYPE_MESH_POINT)
+                /* mesh beacon don't need this, so push further down */
+                msg_body.tim_ie_offset = 256;
+        else
+                msg_body.tim_ie_offset = tim_off+4;
         msg_body.p2p_ie_offset = p2p_off;
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
 
@@ -1838,7 +1859,7 @@ out:
 int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index)
 {
         struct wcn36xx_hal_trigger_ba_req_msg msg_body;
-        struct wcn36xx_hal_trigget_ba_req_candidate *candidate;
+        struct wcn36xx_hal_trigger_ba_req_candidate *candidate;
         int ret = 0;
 
         mutex_lock(&wcn->hal_mutex);
@@ -1849,7 +1870,7 @@ int wcn36xx_smd_trigger_ba(struct wcn36xx *wcn, u8 sta_index)
         msg_body.header.len += sizeof(*candidate);
         PREPARE_HAL_BUF(wcn->hal_buf, msg_body);
 
-        candidate = (struct wcn36xx_hal_trigget_ba_req_candidate *)
+        candidate = (struct wcn36xx_hal_trigger_ba_req_candidate *)
                 (wcn->hal_buf + sizeof(msg_body));
         candidate->sta_index = sta_index;
         candidate->tid_bitmap = 1;
@@ -2039,22 +2060,28 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
         case WCN36XX_HAL_OTA_TX_COMPL_IND:
         case WCN36XX_HAL_MISSED_BEACON_IND:
         case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
-                mutex_lock(&wcn->hal_ind_mutex);
                 msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
-                if (msg_ind) {
-                        msg_ind->msg_len = len;
-                        msg_ind->msg = kmalloc(len, GFP_KERNEL);
-                        memcpy(msg_ind->msg, buf, len);
-                        list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
-                        queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
-                        wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
+                if (!msg_ind)
+                        goto nomem;
+                msg_ind->msg_len = len;
+                msg_ind->msg = kmalloc(len, GFP_KERNEL);
+                if (!msg_ind->msg) {
+                        kfree(msg_ind);
+nomem:
+                        /*
+                         * FIXME: Do something smarter then just
+                         * printing an error.
+                         */
+                        wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
+                                    msg_header->msg_type);
+                        break;
                 }
+                memcpy(msg_ind->msg, buf, len);
+                mutex_lock(&wcn->hal_ind_mutex);
+                list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
+                queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
                 mutex_unlock(&wcn->hal_ind_mutex);
-                if (msg_ind)
-                        break;
-                /* FIXME: Do something smarter then just printing an error. */
-                wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
-                            msg_header->msg_type);
+                wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
                 break;
         default:
                 wcn36xx_err("SMD_EVENT (%d) not supported\n",
diff --git a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
index 58b63833e8e7..8fa5cbace5ab 100644
--- a/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
+++ b/drivers/net/wireless/ath/wcn36xx/wcn36xx.h
@@ -54,7 +54,7 @@ enum wcn36xx_debug_mask {
 };
 
 #define wcn36xx_err(fmt, arg...)                                \
-        printk(KERN_ERR pr_fmt("ERROR " fmt), ##arg);
+        printk(KERN_ERR pr_fmt("ERROR " fmt), ##arg)
 
 #define wcn36xx_warn(fmt, arg...)                               \
         printk(KERN_WARNING pr_fmt("WARNING " fmt), ##arg)
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
index 8205d3e4ab66..10919f95a83c 100644
--- a/drivers/net/wireless/ath/wil6210/interrupt.c
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -156,6 +156,19 @@ void wil6210_enable_irq(struct wil6210_priv *wil)
         iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
                   offsetof(struct RGF_ICR, ICC));
 
+        /* interrupt moderation parameters */
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                /* disable interrupt moderation for monitor
+                 * to get better timestamp precision
+                 */
+                iowrite32(0, wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+        } else {
+                iowrite32(WIL6210_ITR_TRSH,
+                          wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+                iowrite32(BIT_DMA_ITR_CNT_CRL_EN,
+                          wil->csr + HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+        }
+
         wil6210_unmask_irq_pseudo(wil);
         wil6210_unmask_irq_tx(wil);
         wil6210_unmask_irq_rx(wil);
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index d505b2676a73..0b0975d88b43 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -21,6 +21,7 @@
 #include <linux/ip.h>
 #include <linux/ipv6.h>
 #include <net/ipv6.h>
+#include <linux/prefetch.h>
 
 #include "wil6210.h"
 #include "wmi.h"
@@ -377,6 +378,8 @@ static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
         }
         skb_trim(skb, dmalen);
 
+        prefetch(skb->data);
+
         wil_hex_dump_txrx("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
                           skb->data, skb_headlen(skb), false);
 
@@ -673,9 +676,12 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         if (skb->ip_summed != CHECKSUM_PARTIAL)
                 return 0;
 
+        d->dma.b11 = ETH_HLEN; /* MAC header length */
+
         switch (skb->protocol) {
         case cpu_to_be16(ETH_P_IP):
                 protocol = ip_hdr(skb)->protocol;
+                d->dma.b11 |= BIT(DMA_CFG_DESC_TX_OFFLOAD_CFG_L3T_IPV4_POS);
                 break;
         case cpu_to_be16(ETH_P_IPV6):
                 protocol = ipv6_hdr(skb)->nexthdr;
@@ -701,8 +707,6 @@ static int wil_tx_desc_offload_cksum_set(struct wil6210_priv *wil,
         }
 
         d->dma.ip_length = skb_network_header_len(skb);
-        d->dma.b11 = ETH_HLEN; /* MAC header length */
-        d->dma.b11 |= BIT(DMA_CFG_DESC_TX_OFFLOAD_CFG_L3T_IPV4_POS);
         /* Enable TCP/UDP checksum */
         d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_POS);
         /* Calculate pseudo-header */
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
index c4a51638736a..1f91eaf95bbe 100644
--- a/drivers/net/wireless/ath/wil6210/wil6210.h
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -39,6 +39,7 @@ static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
 #define WIL6210_MAX_TX_RINGS    (24) /* HW limit */
 #define WIL6210_MAX_CID         (8) /* HW limit */
 #define WIL6210_NAPI_BUDGET     (16) /* arbitrary */
+#define WIL6210_ITR_TRSH        (10000) /* arbitrary - about 15 IRQs/msec */
 
 /* Hardware definitions begin */
 
diff --git a/drivers/net/wireless/atmel.c b/drivers/net/wireless/atmel.c
index 0d950f209dae..bf93ea859f2d 100644
--- a/drivers/net/wireless/atmel.c
+++ b/drivers/net/wireless/atmel.c
@@ -28,8 +28,8 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with Atmel wireless lan drivers; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    along with Atmel wireless lan drivers; if not, see
+    <http://www.gnu.org/licenses/>.
 
     For all queries about this code, please contact the current author,
     Simon Kelley <simon@thekelleys.org.uk> and not Atmel Corporation.
@@ -39,7 +39,6 @@
 
 ******************************************************************************/
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 
 #include <linux/kernel.h>
@@ -4278,8 +4277,7 @@ static void atmel_wmem32(struct atmel_private *priv, u16 pos, u32 data)
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with AtmelMACFW; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    along with AtmelMACFW; if not, see <http://www.gnu.org/licenses/>.
 
 ****************************************************************************/
 /* This firmware should work on the 76C502 RFMD, RFMD_D, and RFMD_E        */
diff --git a/drivers/net/wireless/atmel.h b/drivers/net/wireless/atmel.h
index b9b3e5b76544..96f7318cbb04 100644
--- a/drivers/net/wireless/atmel.h
+++ b/drivers/net/wireless/atmel.h
@@ -15,8 +15,8 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with Atmel wireless lan drivers; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    along with Atmel wireless lan drivers; if not, see
+    <http://www.gnu.org/licenses/>.
 
 ******************************************************************************/
 
diff --git a/drivers/net/wireless/atmel_cs.c b/drivers/net/wireless/atmel_cs.c
index 522572219217..4cfb4d99ced0 100644
--- a/drivers/net/wireless/atmel_cs.c
+++ b/drivers/net/wireless/atmel_cs.c
@@ -24,15 +24,14 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with Atmel wireless lan drivers; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    along with Atmel wireless lan drivers; if not, see
+    <http://www.gnu.org/licenses/>.
 
 ******************************************************************************/
 
 #ifdef __IN_PCMCIA_PACKAGE__
 #include <pcmcia/k_compat.h>
 #endif
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/ptrace.h>
diff --git a/drivers/net/wireless/atmel_pci.c b/drivers/net/wireless/atmel_pci.c
index c1b159ebcffe..5cd97e3cbee3 100644
--- a/drivers/net/wireless/atmel_pci.c
+++ b/drivers/net/wireless/atmel_pci.c
@@ -15,14 +15,13 @@
     GNU General Public License for more details.
 
     You should have received a copy of the GNU General Public License
-    along with Atmel wireless lan drivers; if not, write to the Free Software
-    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+    along with Atmel wireless lan drivers; if not, see
+    <http://www.gnu.org/licenses/>.
 
 ******************************************************************************/
 #include <linux/pci.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/netdevice.h>
 #include "atmel.h"
 
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 7f3d461f7e8d..54376fddfaf9 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -731,8 +731,6 @@ enum b43_firmware_file_type {
 struct b43_request_fw_context {
         /* The device we are requesting the fw for. */
         struct b43_wldev *dev;
-        /* a completion event structure needed if this call is asynchronous */
-        struct completion fw_load_complete;
         /* a pointer to the firmware object */
         const struct firmware *blob;
         /* The type of firmware to request. */
@@ -809,6 +807,8 @@ enum {
 struct b43_wldev {
         struct b43_bus_dev *dev;
         struct b43_wl *wl;
+        /* a completion event structure needed if this call is asynchronous */
+        struct completion fw_load_complete;
 
         /* The device initialization status.
          * Use b43_status() to query. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index ccd24f0acb8d..c75237eb55a1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2070,6 +2070,7 @@ void b43_do_release_fw(struct b43_firmware_file *fw)
 
 static void b43_release_firmware(struct b43_wldev *dev)
 {
+        complete(&dev->fw_load_complete);
         b43_do_release_fw(&dev->fw.ucode);
         b43_do_release_fw(&dev->fw.pcm);
         b43_do_release_fw(&dev->fw.initvals);
@@ -2095,7 +2096,7 @@ static void b43_fw_cb(const struct firmware *firmware, void *context)
         struct b43_request_fw_context *ctx = context;
 
         ctx->blob = firmware;
-        complete(&ctx->fw_load_complete);
+        complete(&ctx->dev->fw_load_complete);
 }
 
 int b43_do_request_fw(struct b43_request_fw_context *ctx,
@@ -2142,7 +2143,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
         }
         if (async) {
                 /* do this part asynchronously */
-                init_completion(&ctx->fw_load_complete);
+                init_completion(&ctx->dev->fw_load_complete);
                 err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
                                               ctx->dev->dev->dev, GFP_KERNEL,
                                               ctx, b43_fw_cb);
@@ -2150,12 +2151,11 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                         pr_err("Unable to load firmware\n");
                         return err;
                 }
-                /* stall here until fw ready */
-                wait_for_completion(&ctx->fw_load_complete);
+                wait_for_completion(&ctx->dev->fw_load_complete);
                 if (ctx->blob)
                         goto fw_ready;
         /* On some ARM systems, the async request will fail, but the next sync
-         * request works. For this reason, we dall through here
+         * request works. For this reason, we fall through here
          */
         }
         err = request_firmware(&ctx->blob, ctx->fwname,
@@ -2424,6 +2424,7 @@ error:
 
 static int b43_one_core_attach(struct b43_bus_dev *dev, struct b43_wl *wl);
 static void b43_one_core_detach(struct b43_bus_dev *dev);
+static int b43_rng_init(struct b43_wl *wl);
 
 static void b43_request_firmware(struct work_struct *work)
 {
@@ -2475,6 +2476,10 @@ start_ieee80211:
                 goto err_one_core_detach;
         wl->hw_registred = true;
         b43_leds_register(wl->current_dev);
+
+        /* Register HW RNG driver */
+        b43_rng_init(wl);
+
         goto out;
 
 err_one_core_detach:
@@ -4636,9 +4641,6 @@ static void b43_wireless_core_exit(struct b43_wldev *dev)
         if (!dev || b43_status(dev) != B43_STAT_INITIALIZED)
                 return;
 
-        /* Unregister HW RNG driver */
-        b43_rng_exit(dev->wl);
-
         b43_set_status(dev, B43_STAT_UNINIT);
 
         /* Stop the microcode PSM. */
@@ -4795,9 +4797,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
-        /* Register HW RNG driver */
-        b43_rng_init(dev->wl);
-
 out:
         return err;
 
@@ -5464,6 +5463,9 @@ static void b43_bcma_remove(struct bcma_device *core)
 
         b43_one_core_detach(wldev->dev);
 
+        /* Unregister HW RNG driver */
+        b43_rng_exit(wl);
+
         b43_leds_unregister(wl);
 
         ieee80211_free_hw(wl->hw);
@@ -5541,6 +5543,9 @@ static void b43_ssb_remove(struct ssb_device *sdev)
 
         b43_one_core_detach(dev);
 
+        /* Unregister HW RNG driver */
+        b43_rng_exit(wl);
+
         if (list_empty(&wl->devlist)) {
                 b43_leds_unregister(wl);
                 /* Last core on the chip unregistered.
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 4ae63f4ddfb2..50e5ddb12fb3 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -821,10 +821,10 @@ void b43_rx(struct b43_wldev *dev, struct sk_buff *skb, const void *_rxhdr)
                  * channel number in b43. */
                 if (chanstat & B43_RX_CHAN_5GHZ) {
                         status.band = IEEE80211_BAND_5GHZ;
-                        status.freq = b43_freq_to_channel_5ghz(chanid);
+                        status.freq = b43_channel_to_freq_5ghz(chanid);
                 } else {
                         status.band = IEEE80211_BAND_2GHZ;
-                        status.freq = b43_freq_to_channel_2ghz(chanid);
+                        status.freq = b43_channel_to_freq_2ghz(chanid);
                 }
                 break;
         default:
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 572668821862..349c77605231 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -3919,6 +3919,7 @@ static void b43legacy_remove(struct ssb_device *dev)
          * as the ieee80211 unreg will destroy the workqueue. */
         cancel_work_sync(&wldev->restart_work);
         cancel_work_sync(&wl->firmware_load);
+        complete(&wldev->fw_load_complete);
 
         B43legacy_WARN_ON(!wl);
         if (!wldev->fw.ucode)
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index 54e36fcb3954..fcfed6b99a62 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -4,13 +4,12 @@ config BRCMUTIL
 config BRCMSMAC
         tristate "Broadcom IEEE802.11n PCIe SoftMAC WLAN driver"
         depends on MAC80211
-        depends on BCMA
+        depends on BCMA_POSSIBLE
+        select BCMA
         select NEW_LEDS if BCMA_DRIVER_GPIO
         select LEDS_CLASS if BCMA_DRIVER_GPIO
         select BRCMUTIL
         select FW_LOADER
-        select CRC_CCITT
-        select CRC8
         select CORDIC
         ---help---
           This module adds support for PCIe wireless adapters based on Broadcom
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/Makefile b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
index 8e9b1221b32c..57cddee03252 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/Makefile
+++ b/drivers/net/wireless/brcm80211/brcmfmac/Makefile
@@ -28,14 +28,15 @@ brcmfmac-objs += \
                 fweh.o \
                 fwsignal.o \
                 p2p.o \
-                dhd_cdc.o \
+                proto.o \
+                bcdc.o \
                 dhd_common.o \
                 dhd_linux.o \
+                nvram.o \
                 btcoex.o
 brcmfmac-$(CONFIG_BRCMFMAC_SDIO) += \
                 dhd_sdio.o \
                 bcmsdh.o \
-                bcmsdh_sdmmc.o \
                 sdio_chip.o
 brcmfmac-$(CONFIG_BRCMFMAC_USB) += \
                 usb.o
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
new file mode 100644
index 000000000000..c229210d50ba
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.c
@@ -0,0 +1,375 @@
+/*
+ * Copyright (c) 2010 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*******************************************************************************
+ * Communicates with the dongle by using dcmd codes.
+ * For certain dcmd codes, the dongle interprets string data from the host.
+ ******************************************************************************/
+
+#include <linux/types.h>
+#include <linux/netdevice.h>
+
+#include <brcmu_utils.h>
+#include <brcmu_wifi.h>
+
+#include "dhd.h"
+#include "dhd_bus.h"
+#include "fwsignal.h"
+#include "dhd_dbg.h"
+#include "tracepoint.h"
+#include "proto.h"
+#include "bcdc.h"
+
+struct brcmf_proto_bcdc_dcmd {
+        __le32 cmd;     /* dongle command value */
+        __le32 len;     /* lower 16: output buflen;
+                         * upper 16: input buflen (excludes header) */
+        __le32 flags;   /* flag defns given below */
+        __le32 status;  /* status code returned from the device */
+};
+
+/* BCDC flag definitions */
+#define BCDC_DCMD_ERROR         0x01            /* 1=cmd failed */
+#define BCDC_DCMD_SET           0x02            /* 0=get, 1=set cmd */
+#define BCDC_DCMD_IF_MASK       0xF000          /* I/F index */
+#define BCDC_DCMD_IF_SHIFT      12
+#define BCDC_DCMD_ID_MASK       0xFFFF0000      /* id an cmd pairing */
+#define BCDC_DCMD_ID_SHIFT      16              /* ID Mask shift bits */
+#define BCDC_DCMD_ID(flags)     \
+        (((flags) & BCDC_DCMD_ID_MASK) >> BCDC_DCMD_ID_SHIFT)
+
+/*
+ * BCDC header - Broadcom specific extension of CDC.
+ * Used on data packets to convey priority across USB.
+ */
+#define BCDC_HEADER_LEN         4
+#define BCDC_PROTO_VER          2       /* Protocol version */
+#define BCDC_FLAG_VER_MASK      0xf0    /* Protocol version mask */
+#define BCDC_FLAG_VER_SHIFT     4       /* Protocol version shift */
+#define BCDC_FLAG_SUM_GOOD      0x04    /* Good RX checksums */
+#define BCDC_FLAG_SUM_NEEDED    0x08    /* Dongle needs to do TX checksums */
+#define BCDC_PRIORITY_MASK      0x7
+#define BCDC_FLAG2_IF_MASK      0x0f    /* packet rx interface in APSTA */
+#define BCDC_FLAG2_IF_SHIFT     0
+
+#define BCDC_GET_IF_IDX(hdr) \
+        ((int)((((hdr)->flags2) & BCDC_FLAG2_IF_MASK) >> BCDC_FLAG2_IF_SHIFT))
+#define BCDC_SET_IF_IDX(hdr, idx) \
+        ((hdr)->flags2 = (((hdr)->flags2 & ~BCDC_FLAG2_IF_MASK) | \
+        ((idx) << BCDC_FLAG2_IF_SHIFT)))
+
+/**
+ * struct brcmf_proto_bcdc_header - BCDC header format
+ *
+ * @flags: flags contain protocol and checksum info.
+ * @priority: 802.1d priority and USB flow control info (bit 4:7).
+ * @flags2: additional flags containing dongle interface index.
+ * @data_offset: start of packet data. header is following by firmware signals.
+ */
+struct brcmf_proto_bcdc_header {
+        u8 flags;
+        u8 priority;
+        u8 flags2;
+        u8 data_offset;
+};
+
+/*
+ * maximum length of firmware signal data between
+ * the BCDC header and packet data in the tx path.
+ */
+#define BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES        12
+
+#define RETRIES 2 /* # of retries to retrieve matching dcmd response */
+#define BUS_HEADER_LEN  (16+64)         /* Must be atleast SDPCM_RESERVE
+                                         * (amount of header tha might be added)
+                                         * plus any space that might be needed
+                                         * for bus alignment padding.
+                                         */
+struct brcmf_bcdc {
+        u16 reqid;
+        u8 bus_header[BUS_HEADER_LEN];
+        struct brcmf_proto_bcdc_dcmd msg;
+        unsigned char buf[BRCMF_DCMD_MAXLEN];
+};
+
+
+static int
+brcmf_proto_bcdc_msg(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+                     uint len, bool set)
+{
+        struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+        struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+        u32 flags;
+
+        brcmf_dbg(BCDC, "Enter\n");
+
+        memset(msg, 0, sizeof(struct brcmf_proto_bcdc_dcmd));
+
+        msg->cmd = cpu_to_le32(cmd);
+        msg->len = cpu_to_le32(len);
+        flags = (++bcdc->reqid << BCDC_DCMD_ID_SHIFT);
+        if (set)
+                flags |= BCDC_DCMD_SET;
+        flags = (flags & ~BCDC_DCMD_IF_MASK) |
+                (ifidx << BCDC_DCMD_IF_SHIFT);
+        msg->flags = cpu_to_le32(flags);
+
+        if (buf)
+                memcpy(bcdc->buf, buf, len);
+
+        len += sizeof(*msg);
+        if (len > BRCMF_TX_IOCTL_MAX_MSG_SIZE)
+                len = BRCMF_TX_IOCTL_MAX_MSG_SIZE;
+
+        /* Send request */
+        return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&bcdc->msg, len);
+}
+
+static int brcmf_proto_bcdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
+{
+        int ret;
+        struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+
+        brcmf_dbg(BCDC, "Enter\n");
+        len += sizeof(struct brcmf_proto_bcdc_dcmd);
+        do {
+                ret = brcmf_bus_rxctl(drvr->bus_if, (unsigned char *)&bcdc->msg,
+                                      len);
+                if (ret < 0)
+                        break;
+        } while (BCDC_DCMD_ID(le32_to_cpu(bcdc->msg.flags)) != id);
+
+        return ret;
+}
+
+static int
+brcmf_proto_bcdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                            void *buf, uint len)
+{
+        struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+        struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+        void *info;
+        int ret = 0, retries = 0;
+        u32 id, flags;
+
+        brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+
+        ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, false);
+        if (ret < 0) {
+                brcmf_err("brcmf_proto_bcdc_msg failed w/status %d\n",
+                          ret);
+                goto done;
+        }
+
+retry:
+        /* wait for interrupt and get first fragment */
+        ret = brcmf_proto_bcdc_cmplt(drvr, bcdc->reqid, len);
+        if (ret < 0)
+                goto done;
+
+        flags = le32_to_cpu(msg->flags);
+        id = (flags & BCDC_DCMD_ID_MASK) >> BCDC_DCMD_ID_SHIFT;
+
+        if ((id < bcdc->reqid) && (++retries < RETRIES))
+                goto retry;
+        if (id != bcdc->reqid) {
+                brcmf_err("%s: unexpected request id %d (expected %d)\n",
+                          brcmf_ifname(drvr, ifidx), id, bcdc->reqid);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check info buffer */
+        info = (void *)&msg[1];
+
+        /* Copy info buffer */
+        if (buf) {
+                if (ret < (int)len)
+                        len = ret;
+                memcpy(buf, info, len);
+        }
+
+        /* Check the ERROR flag */
+        if (flags & BCDC_DCMD_ERROR)
+                ret = le32_to_cpu(msg->status);
+
+done:
+        return ret;
+}
+
+static int
+brcmf_proto_bcdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                          void *buf, uint len)
+{
+        struct brcmf_bcdc *bcdc = (struct brcmf_bcdc *)drvr->proto->pd;
+        struct brcmf_proto_bcdc_dcmd *msg = &bcdc->msg;
+        int ret = 0;
+        u32 flags, id;
+
+        brcmf_dbg(BCDC, "Enter, cmd %d len %d\n", cmd, len);
+
+        ret = brcmf_proto_bcdc_msg(drvr, ifidx, cmd, buf, len, true);
+        if (ret < 0)
+                goto done;
+
+        ret = brcmf_proto_bcdc_cmplt(drvr, bcdc->reqid, len);
+        if (ret < 0)
+                goto done;
+
+        flags = le32_to_cpu(msg->flags);
+        id = (flags & BCDC_DCMD_ID_MASK) >> BCDC_DCMD_ID_SHIFT;
+
+        if (id != bcdc->reqid) {
+                brcmf_err("%s: unexpected request id %d (expected %d)\n",
+                          brcmf_ifname(drvr, ifidx), id, bcdc->reqid);
+                ret = -EINVAL;
+                goto done;
+        }
+
+        /* Check the ERROR flag */
+        if (flags & BCDC_DCMD_ERROR)
+                ret = le32_to_cpu(msg->status);
+
+done:
+        return ret;
+}
+
+static void
+brcmf_proto_bcdc_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset,
+                         struct sk_buff *pktbuf)
+{
+        struct brcmf_proto_bcdc_header *h;
+
+        brcmf_dbg(BCDC, "Enter\n");
+
+        /* Push BDC header used to convey priority for buses that don't */
+        skb_push(pktbuf, BCDC_HEADER_LEN);
+
+        h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
+
+        h->flags = (BCDC_PROTO_VER << BCDC_FLAG_VER_SHIFT);
+        if (pktbuf->ip_summed == CHECKSUM_PARTIAL)
+                h->flags |= BCDC_FLAG_SUM_NEEDED;
+
+        h->priority = (pktbuf->priority & BCDC_PRIORITY_MASK);
+        h->flags2 = 0;
+        h->data_offset = offset;
+        BCDC_SET_IF_IDX(h, ifidx);
+        trace_brcmf_bcdchdr(pktbuf->data);
+}
+
+static int
+brcmf_proto_bcdc_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
+                         struct sk_buff *pktbuf)
+{
+        struct brcmf_proto_bcdc_header *h;
+
+        brcmf_dbg(BCDC, "Enter\n");
+
+        /* Pop BCDC header used to convey priority for buses that don't */
+        if (pktbuf->len <= BCDC_HEADER_LEN) {
+                brcmf_dbg(INFO, "rx data too short (%d <= %d)\n",
+                          pktbuf->len, BCDC_HEADER_LEN);
+                return -EBADE;
+        }
+
+        trace_brcmf_bcdchdr(pktbuf->data);
+        h = (struct brcmf_proto_bcdc_header *)(pktbuf->data);
+
+        *ifidx = BCDC_GET_IF_IDX(h);
+        if (*ifidx >= BRCMF_MAX_IFS) {
+                brcmf_err("rx data ifnum out of range (%d)\n", *ifidx);
+                return -EBADE;
+        }
+        /* The ifidx is the idx to map to matching netdev/ifp. When receiving
+         * events this is easy because it contains the bssidx which maps
+         * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
+         * bssidx 1 is used for p2p0 and no data can be received or
+         * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
+         */
+        if (*ifidx)
+                (*ifidx)++;
+
+        if (((h->flags & BCDC_FLAG_VER_MASK) >> BCDC_FLAG_VER_SHIFT) !=
+            BCDC_PROTO_VER) {
+                brcmf_err("%s: non-BCDC packet received, flags 0x%x\n",
+                          brcmf_ifname(drvr, *ifidx), h->flags);
+                return -EBADE;
+        }
+
+        if (h->flags & BCDC_FLAG_SUM_GOOD) {
+                brcmf_dbg(BCDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
+                          brcmf_ifname(drvr, *ifidx), h->flags);
+                pktbuf->ip_summed = CHECKSUM_UNNECESSARY;
+        }
+
+        pktbuf->priority = h->priority & BCDC_PRIORITY_MASK;
+
+        skb_pull(pktbuf, BCDC_HEADER_LEN);
+        if (do_fws)
+                brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
+        else
+                skb_pull(pktbuf, h->data_offset << 2);
+
+        if (pktbuf->len == 0)
+                return -ENODATA;
+        return 0;
+}
+
+static int
+brcmf_proto_bcdc_txdata(struct brcmf_pub *drvr, int ifidx, u8 offset,
+                        struct sk_buff *pktbuf)
+{
+        brcmf_proto_bcdc_hdrpush(drvr, ifidx, offset, pktbuf);
+        return brcmf_bus_txdata(drvr->bus_if, pktbuf);
+}
+
+
+int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr)
+{
+        struct brcmf_bcdc *bcdc;
+
+        bcdc = kzalloc(sizeof(*bcdc), GFP_ATOMIC);
+        if (!bcdc)
+                goto fail;
+
+        /* ensure that the msg buf directly follows the cdc msg struct */
+        if ((unsigned long)(&bcdc->msg + 1) != (unsigned long)bcdc->buf) {
+                brcmf_err("struct brcmf_proto_bcdc is not correctly defined\n");
+                goto fail;
+        }
+
+        drvr->proto->hdrpull = brcmf_proto_bcdc_hdrpull;
+        drvr->proto->query_dcmd = brcmf_proto_bcdc_query_dcmd;
+        drvr->proto->set_dcmd = brcmf_proto_bcdc_set_dcmd;
+        drvr->proto->txdata = brcmf_proto_bcdc_txdata;
+        drvr->proto->pd = bcdc;
+
+        drvr->hdrlen += BCDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
+        drvr->bus_if->maxctl = BRCMF_DCMD_MAXLEN +
+                        sizeof(struct brcmf_proto_bcdc_dcmd);
+        return 0;
+
+fail:
+        kfree(bcdc);
+        return -ENOMEM;
+}
+
+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr)
+{
+        kfree(drvr->proto->pd);
+        drvr->proto->pd = NULL;
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcdc.h b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.h
new file mode 100644
index 000000000000..17e8c039ff32
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcdc.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef BRCMFMAC_BCDC_H
+#define BRCMFMAC_BCDC_H
+
+
+int brcmf_proto_bcdc_attach(struct brcmf_pub *drvr);
+void brcmf_proto_bcdc_detach(struct brcmf_pub *drvr);
+
+
+#endif /* BRCMFMAC_BCDC_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index 3e10b801eee8..fa35b23bbaa7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -17,16 +17,23 @@
 
 #include <linux/types.h>
 #include <linux/netdevice.h>
-#include <linux/export.h>
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
 #include <linux/sched.h>
 #include <linux/completion.h>
 #include <linux/scatterlist.h>
 #include <linux/mmc/sdio.h>
+#include <linux/mmc/core.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
 #include <linux/mmc/card.h>
+#include <linux/mmc/host.h>
+#include <linux/platform_device.h>
 #include <linux/platform_data/brcmfmac-sdio.h>
+#include <linux/suspend.h>
+#include <linux/errno.h>
+#include <linux/module.h>
+#include <net/cfg80211.h>
 
 #include <defs.h>
 #include <brcm_hw_ids.h>
@@ -36,11 +43,19 @@
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
 #include "sdio_host.h"
+#include "sdio_chip.h"
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
 
+#define DMA_ALIGN_MASK  0x03
 
-static irqreturn_t brcmf_sdio_oob_irqhandler(int irq, void *dev_id)
+#define SDIO_FUNC1_BLOCKSIZE            64
+#define SDIO_FUNC2_BLOCKSIZE            512
+/* Maximum milliseconds to wait for F2 to come up */
+#define SDIO_WAIT_F2RDY 3000
+
+
+static irqreturn_t brcmf_sdiod_oob_irqhandler(int irq, void *dev_id)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev_id);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
@@ -55,27 +70,46 @@ static irqreturn_t brcmf_sdio_oob_irqhandler(int irq, void *dev_id)
                 sdiodev->irq_en = false;
         }
 
-        brcmf_sdbrcm_isr(sdiodev->bus);
+        brcmf_sdio_isr(sdiodev->bus);
 
         return IRQ_HANDLED;
 }
 
-static void brcmf_sdio_ib_irqhandler(struct sdio_func *func)
+static void brcmf_sdiod_ib_irqhandler(struct sdio_func *func)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(&func->dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
 
         brcmf_dbg(INTR, "IB intr triggered\n");
 
-        brcmf_sdbrcm_isr(sdiodev->bus);
+        brcmf_sdio_isr(sdiodev->bus);
 }
 
 /* dummy handler for SDIO function 2 interrupt */
-static void brcmf_sdio_dummy_irqhandler(struct sdio_func *func)
+static void brcmf_sdiod_dummy_irqhandler(struct sdio_func *func)
 {
 }
 
-int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
+static bool brcmf_sdiod_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
+{
+        bool is_err = false;
+#ifdef CONFIG_PM_SLEEP
+        is_err = atomic_read(&sdiodev->suspend);
+#endif
+        return is_err;
+}
+
+static void brcmf_sdiod_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
+                                       wait_queue_head_t *wq)
+{
+#ifdef CONFIG_PM_SLEEP
+        int retry = 0;
+        while (atomic_read(&sdiodev->suspend) && retry++ != 30)
+                wait_event_timeout(*wq, false, HZ/100);
+#endif
+}
+
+int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
         int ret = 0;
         u8 data;
@@ -85,7 +119,7 @@ int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
                 brcmf_dbg(SDIO, "Enter, register OOB IRQ %d\n",
                           sdiodev->pdata->oob_irq_nr);
                 ret = request_irq(sdiodev->pdata->oob_irq_nr,
-                                  brcmf_sdio_oob_irqhandler,
+                                  brcmf_sdiod_oob_irqhandler,
                                   sdiodev->pdata->oob_irq_flags,
                                   "brcmf_oob_intr",
                                   &sdiodev->func[1]->dev);
@@ -109,36 +143,36 @@ int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
                 sdio_claim_host(sdiodev->func[1]);
 
                 /* must configure SDIO_CCCR_IENx to enable irq */
-                data = brcmf_sdio_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
+                data = brcmf_sdiod_regrb(sdiodev, SDIO_CCCR_IENx, &ret);
                 data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
-                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
+                brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, data, &ret);
 
                 /* redirect, configure and enable io for interrupt signal */
                 data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
                 if (sdiodev->pdata->oob_irq_flags & IRQF_TRIGGER_HIGH)
                         data |= SDIO_SEPINT_ACT_HI;
-                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
+                brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, data, &ret);
 
                 sdio_release_host(sdiodev->func[1]);
         } else {
                 brcmf_dbg(SDIO, "Entering\n");
                 sdio_claim_host(sdiodev->func[1]);
-                sdio_claim_irq(sdiodev->func[1], brcmf_sdio_ib_irqhandler);
-                sdio_claim_irq(sdiodev->func[2], brcmf_sdio_dummy_irqhandler);
+                sdio_claim_irq(sdiodev->func[1], brcmf_sdiod_ib_irqhandler);
+                sdio_claim_irq(sdiodev->func[2], brcmf_sdiod_dummy_irqhandler);
                 sdio_release_host(sdiodev->func[1]);
         }
 
         return 0;
 }
 
-int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
+int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev)
 {
         brcmf_dbg(SDIO, "Entering\n");
 
         if ((sdiodev->pdata) && (sdiodev->pdata->oob_irq_supported)) {
                 sdio_claim_host(sdiodev->func[1]);
-                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
-                brcmf_sdio_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
+                brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_BRCM_SEPINT, 0, NULL);
+                brcmf_sdiod_regwb(sdiodev, SDIO_CCCR_IENx, 0, NULL);
                 sdio_release_host(sdiodev->func[1]);
 
                 if (sdiodev->oob_irq_requested) {
@@ -161,29 +195,150 @@ int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
         return 0;
 }
 
+static inline int brcmf_sdiod_f0_writeb(struct sdio_func *func,
+                                        uint regaddr, u8 byte)
+{
+        int err_ret;
+
+        /*
+         * Can only directly write to some F0 registers.
+         * Handle CCCR_IENx and CCCR_ABORT command
+         * as a special case.
+         */
+        if ((regaddr == SDIO_CCCR_ABORT) ||
+            (regaddr == SDIO_CCCR_IENx))
+                sdio_writeb(func, byte, regaddr, &err_ret);
+        else
+                sdio_f0_writeb(func, byte, regaddr, &err_ret);
+
+        return err_ret;
+}
+
+static int brcmf_sdiod_request_data(struct brcmf_sdio_dev *sdiodev, u8 fn,
+                                    u32 addr, u8 regsz, void *data, bool write)
+{
+        struct sdio_func *func;
+        int ret;
+
+        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
+                  write, fn, addr, regsz);
+
+        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
+        if (brcmf_sdiod_pm_resume_error(sdiodev))
+                return -EIO;
+
+        /* only allow byte access on F0 */
+        if (WARN_ON(regsz > 1 && !fn))
+                return -EINVAL;
+        func = sdiodev->func[fn];
+
+        switch (regsz) {
+        case sizeof(u8):
+                if (write) {
+                        if (fn)
+                                sdio_writeb(func, *(u8 *)data, addr, &ret);
+                        else
+                                ret = brcmf_sdiod_f0_writeb(func, addr,
+                                                            *(u8 *)data);
+                } else {
+                        if (fn)
+                                *(u8 *)data = sdio_readb(func, addr, &ret);
+                        else
+                                *(u8 *)data = sdio_f0_readb(func, addr, &ret);
+                }
+                break;
+        case sizeof(u16):
+                if (write)
+                        sdio_writew(func, *(u16 *)data, addr, &ret);
+                else
+                        *(u16 *)data = sdio_readw(func, addr, &ret);
+                break;
+        case sizeof(u32):
+                if (write)
+                        sdio_writel(func, *(u32 *)data, addr, &ret);
+                else
+                        *(u32 *)data = sdio_readl(func, addr, &ret);
+                break;
+        default:
+                brcmf_err("invalid size: %d\n", regsz);
+                break;
+        }
+
+        if (ret) {
+                /*
+                 * SleepCSR register access can fail when
+                 * waking up the device so reduce this noise
+                 * in the logs.
+                 */
+                if (addr != SBSDIO_FUNC1_SLEEPCSR)
+                        brcmf_err("failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", fn, addr, ret);
+                else
+                        brcmf_dbg(SDIO, "failed to %s data F%d@0x%05x, err: %d\n",
+                                  write ? "write" : "read", fn, addr, ret);
+        }
+        return ret;
+}
+
+static int brcmf_sdiod_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
+                                   u8 regsz, void *data, bool write)
+{
+        u8 func_num;
+        s32 retry = 0;
+        int ret;
+
+        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+                return -ENOMEDIUM;
+
+        /*
+         * figure out how to read the register based on address range
+         * 0x00 ~ 0x7FF: function 0 CCCR and FBR
+         * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
+         * The rest: function 1 silicon backplane core registers
+         */
+        if ((addr & ~REG_F0_REG_MASK) == 0)
+                func_num = SDIO_FUNC_0;
+        else
+                func_num = SDIO_FUNC_1;
+
+        do {
+                if (!write)
+                        memset(data, 0, regsz);
+                /* for retry wait for 1 ms till bus get settled down */
+                if (retry)
+                        usleep_range(1000, 2000);
+                ret = brcmf_sdiod_request_data(sdiodev, func_num, addr, regsz,
+                                               data, write);
+        } while (ret != 0 && ret != -ENOMEDIUM &&
+                 retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
+
+        if (ret == -ENOMEDIUM)
+                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+        else if (ret != 0)
+                brcmf_err("failed with %d\n", ret);
+
+        return ret;
+}
+
 static int
-brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
+brcmf_sdiod_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
 {
         int err = 0, i;
         u8 addr[3];
-        s32 retry;
+
+        if (sdiodev->bus_if->state == BRCMF_BUS_NOMEDIUM)
+                return -ENOMEDIUM;
 
         addr[0] = (address >> 8) & SBSDIO_SBADDRLOW_MASK;
         addr[1] = (address >> 16) & SBSDIO_SBADDRMID_MASK;
         addr[2] = (address >> 24) & SBSDIO_SBADDRHIGH_MASK;
 
         for (i = 0; i < 3; i++) {
-                retry = 0;
-                do {
-                        if (retry)
-                                usleep_range(1000, 2000);
-                        err = brcmf_sdioh_request_byte(sdiodev, SDIOH_WRITE,
-                                        SDIO_FUNC_1, SBSDIO_FUNC1_SBADDRLOW + i,
-                                        &addr[i]);
-                } while (err != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-
+                err = brcmf_sdiod_regrw_helper(sdiodev,
+                                               SBSDIO_FUNC1_SBADDRLOW + i,
+                                               sizeof(u8), &addr[i], true);
                 if (err) {
-                        brcmf_err("failed at addr:0x%0x\n",
+                        brcmf_err("failed at addr: 0x%0x\n",
                                   SBSDIO_FUNC1_SBADDRLOW + i);
                         break;
                 }
@@ -193,13 +348,13 @@ brcmf_sdcard_set_sbaddr_window(struct brcmf_sdio_dev *sdiodev, u32 address)
 }
 
 static int
-brcmf_sdio_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
+brcmf_sdiod_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
 {
         uint bar0 = *addr & ~SBSDIO_SB_OFT_ADDR_MASK;
         int err = 0;
 
         if (bar0 != sdiodev->sbwad) {
-                err = brcmf_sdcard_set_sbaddr_window(sdiodev, bar0);
+                err = brcmf_sdiod_set_sbaddr_window(sdiodev, bar0);
                 if (err)
                         return err;
 
@@ -214,62 +369,14 @@ brcmf_sdio_addrprep(struct brcmf_sdio_dev *sdiodev, uint width, u32 *addr)
         return 0;
 }
 
-int
-brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                        void *data, bool write)
-{
-        u8 func_num, reg_size;
-        s32 retry = 0;
-        int ret;
-
-        /*
-         * figure out how to read the register based on address range
-         * 0x00 ~ 0x7FF: function 0 CCCR and FBR
-         * 0x10000 ~ 0x1FFFF: function 1 miscellaneous registers
-         * The rest: function 1 silicon backplane core registers
-         */
-        if ((addr & ~REG_F0_REG_MASK) == 0) {
-                func_num = SDIO_FUNC_0;
-                reg_size = 1;
-        } else if ((addr & ~REG_F1_MISC_MASK) == 0) {
-                func_num = SDIO_FUNC_1;
-                reg_size = 1;
-        } else {
-                func_num = SDIO_FUNC_1;
-                reg_size = 4;
-
-                ret = brcmf_sdio_addrprep(sdiodev, reg_size, &addr);
-                if (ret)
-                        goto done;
-        }
-
-        do {
-                if (!write)
-                        memset(data, 0, reg_size);
-                if (retry)      /* wait for 1 ms till bus get settled down */
-                        usleep_range(1000, 2000);
-                if (reg_size == 1)
-                        ret = brcmf_sdioh_request_byte(sdiodev, write,
-                                                       func_num, addr, data);
-                else
-                        ret = brcmf_sdioh_request_word(sdiodev, write,
-                                                       func_num, addr, data, 4);
-        } while (ret != 0 && retry++ < SDIOH_API_ACCESS_RETRY_LIMIT);
-
-done:
-        if (ret != 0)
-                brcmf_err("failed with %d\n", ret);
-
-        return ret;
-}
-
-u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
 {
         u8 data;
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
-        retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          false);
         brcmf_dbg(SDIO, "data:0x%02x\n", data);
 
         if (ret)
@@ -278,52 +385,63 @@ u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
         return data;
 }
 
-u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
+u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret)
 {
         u32 data;
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x\n", addr);
-        retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, false);
+        retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
+        if (retval)
+                goto done;
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          false);
         brcmf_dbg(SDIO, "data:0x%08x\n", data);
 
+done:
         if (ret)
                 *ret = retval;
 
         return data;
 }
 
-void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
+void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr,
                       u8 data, int *ret)
 {
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x, data:0x%02x\n", addr, data);
-        retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
-
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          true);
         if (ret)
                 *ret = retval;
 }
 
-void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
+void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr,
                       u32 data, int *ret)
 {
         int retval;
 
         brcmf_dbg(SDIO, "addr:0x%08x, data:0x%08x\n", addr, data);
-        retval = brcmf_sdio_regrw_helper(sdiodev, addr, &data, true);
+        retval = brcmf_sdiod_addrprep(sdiodev, sizeof(data), &addr);
+        if (retval)
+                goto done;
+        retval = brcmf_sdiod_regrw_helper(sdiodev, addr, sizeof(data), &data,
+                                          true);
 
+done:
         if (ret)
                 *ret = retval;
 }
 
-static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
+static int brcmf_sdiod_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
                              bool write, u32 addr, struct sk_buff *pkt)
 {
         unsigned int req_sz;
+        int err;
 
-        brcmf_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_pm_resume_error(sdiodev))
+        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
+        if (brcmf_sdiod_pm_resume_error(sdiodev))
                 return -EIO;
 
         /* Single skb use the standard mmc interface */
@@ -331,22 +449,22 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
         req_sz &= (uint)~3;
 
         if (write)
-                return sdio_memcpy_toio(sdiodev->func[fn], addr,
-                                        ((u8 *)(pkt->data)),
-                                        req_sz);
+                err = sdio_memcpy_toio(sdiodev->func[fn], addr,
+                                       ((u8 *)(pkt->data)), req_sz);
         else if (fn == 1)
-                return sdio_memcpy_fromio(sdiodev->func[fn],
-                                          ((u8 *)(pkt->data)),
-                                          addr, req_sz);
+                err = sdio_memcpy_fromio(sdiodev->func[fn], ((u8 *)(pkt->data)),
+                                         addr, req_sz);
         else
                 /* function 2 read is FIFO operation */
-                return sdio_readsb(sdiodev->func[fn],
-                                   ((u8 *)(pkt->data)), addr,
-                                   req_sz);
+                err = sdio_readsb(sdiodev->func[fn], ((u8 *)(pkt->data)), addr,
+                                  req_sz);
+        if (err == -ENOMEDIUM)
+                brcmf_bus_change_state(sdiodev->bus_if, BRCMF_BUS_NOMEDIUM);
+        return err;
 }
 
 /**
- * brcmf_sdio_sglist_rw - SDIO interface function for block data access
+ * brcmf_sdiod_sglist_rw - SDIO interface function for block data access
  * @sdiodev: brcmfmac sdio device
  * @fn: SDIO function number
  * @write: direction flag
@@ -357,9 +475,9 @@ static int brcmf_sdio_buffrw(struct brcmf_sdio_dev *sdiodev, uint fn,
  * stack for block data access. It assumes that the skb passed down by the
  * caller has already been padded and aligned.
  */
-static int brcmf_sdio_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
-                                bool write, u32 addr,
-                                struct sk_buff_head *pktlist)
+static int brcmf_sdiod_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
+                                 bool write, u32 addr,
+                                 struct sk_buff_head *pktlist)
 {
         unsigned int req_sz, func_blk_sz, sg_cnt, sg_data_sz, pkt_offset;
         unsigned int max_req_sz, orig_offset, dst_offset;
@@ -377,8 +495,8 @@ static int brcmf_sdio_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
         if (!pktlist->qlen)
                 return -EINVAL;
 
-        brcmf_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
-        if (brcmf_pm_resume_error(sdiodev))
+        brcmf_sdiod_pm_resume_wait(sdiodev, &sdiodev->request_buffer_wait);
+        if (brcmf_sdiod_pm_resume_error(sdiodev))
                 return -EIO;
 
         target_list = pktlist;
@@ -485,7 +603,11 @@ static int brcmf_sdio_sglist_rw(struct brcmf_sdio_dev *sdiodev, uint fn,
                 mmc_wait_for_req(sdiodev->func[fn]->card->host, &mmc_req);
 
                 ret = mmc_cmd.error ? mmc_cmd.error : mmc_dat.error;
-                if (ret != 0) {
+                if (ret == -ENOMEDIUM) {
+                        brcmf_bus_change_state(sdiodev->bus_if,
+                                               BRCMF_BUS_NOMEDIUM);
+                        break;
+                } else if (ret != 0) {
                         brcmf_err("CMD53 sg block %s failed %d\n",
                                   write ? "write" : "read", ret);
                         ret = -EIO;
@@ -525,9 +647,7 @@ exit:
         return ret;
 }
 
-int
-brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, u8 *buf, uint nbytes)
+int brcmf_sdiod_recv_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
 {
         struct sk_buff *mypkt;
         int err;
@@ -539,7 +659,7 @@ brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                 return -EIO;
         }
 
-        err = brcmf_sdcard_recv_pkt(sdiodev, addr, fn, flags, mypkt);
+        err = brcmf_sdiod_recv_pkt(sdiodev, mypkt);
         if (!err)
                 memcpy(buf, mypkt->data, nbytes);
 
@@ -547,50 +667,47 @@ brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
         return err;
 }
 
-int
-brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff *pkt)
+int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt)
 {
-        uint width;
+        u32 addr = sdiodev->sbwad;
         int err = 0;
 
-        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
-                  fn, addr, pkt->len);
+        brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pkt->len);
 
-        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
+        err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
         if (err)
                 goto done;
 
-        err = brcmf_sdio_buffrw(sdiodev, fn, false, addr, pkt);
+        err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr, pkt);
 
 done:
         return err;
 }
 
-int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                            uint flags, struct sk_buff_head *pktq, uint totlen)
+int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
+                           struct sk_buff_head *pktq, uint totlen)
 {
         struct sk_buff *glom_skb;
         struct sk_buff *skb;
-        uint width;
+        u32 addr = sdiodev->sbwad;
         int err = 0;
 
-        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
-                  fn, addr, pktq->qlen);
+        brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n",
+                  addr, pktq->qlen);
 
-        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
+        err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
         if (err)
                 goto done;
 
         if (pktq->qlen == 1)
-                err = brcmf_sdio_buffrw(sdiodev, fn, false, addr, pktq->next);
+                err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+                                         pktq->next);
         else if (!sdiodev->sg_support) {
                 glom_skb = brcmu_pkt_buf_get_skb(totlen);
                 if (!glom_skb)
                         return -ENOMEM;
-                err = brcmf_sdio_buffrw(sdiodev, fn, false, addr, glom_skb);
+                err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+                                         glom_skb);
                 if (err)
                         goto done;
 
@@ -599,18 +716,17 @@ int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
                         skb_pull(glom_skb, skb->len);
                 }
         } else
-                err = brcmf_sdio_sglist_rw(sdiodev, fn, false, addr, pktq);
+                err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, false, addr,
+                                            pktq);
 
 done:
         return err;
 }
 
-int
-brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, u8 *buf, uint nbytes)
+int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes)
 {
         struct sk_buff *mypkt;
-        uint width;
+        u32 addr = sdiodev->sbwad;
         int err;
 
         mypkt = brcmu_pkt_buf_get_skb(nbytes);
@@ -622,48 +738,47 @@ brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
 
         memcpy(mypkt->data, buf, nbytes);
 
-        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
+        err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
 
         if (!err)
-                err = brcmf_sdio_buffrw(sdiodev, fn, true, addr, mypkt);
+                err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true, addr,
+                                         mypkt);
 
         brcmu_pkt_buf_free_skb(mypkt);
         return err;
 
 }
 
-int
-brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                      uint flags, struct sk_buff_head *pktq)
+int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
+                         struct sk_buff_head *pktq)
 {
         struct sk_buff *skb;
-        uint width;
+        u32 addr = sdiodev->sbwad;
         int err;
 
-        brcmf_dbg(SDIO, "fun = %d, addr = 0x%x, size = %d\n",
-                  fn, addr, pktq->qlen);
+        brcmf_dbg(SDIO, "addr = 0x%x, size = %d\n", addr, pktq->qlen);
 
-        width = (flags & SDIO_REQ_4BYTE) ? 4 : 2;
-        err = brcmf_sdio_addrprep(sdiodev, width, &addr);
+        err = brcmf_sdiod_addrprep(sdiodev, 4, &addr);
         if (err)
                 return err;
 
         if (pktq->qlen == 1 || !sdiodev->sg_support)
                 skb_queue_walk(pktq, skb) {
-                        err = brcmf_sdio_buffrw(sdiodev, fn, true, addr, skb);
+                        err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, true,
+                                                 addr, skb);
                         if (err)
                                 break;
                 }
         else
-                err = brcmf_sdio_sglist_rw(sdiodev, fn, true, addr, pktq);
+                err = brcmf_sdiod_sglist_rw(sdiodev, SDIO_FUNC_2, true, addr,
+                                            pktq);
 
         return err;
 }
 
 int
-brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
-                 u8 *data, uint size)
+brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+                  u8 *data, uint size)
 {
         int bcmerror = 0;
         struct sk_buff *pkt;
@@ -690,7 +805,7 @@ brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
         /* Do the transfer(s) */
         while (size) {
                 /* Set the backplane window to include the start address */
-                bcmerror = brcmf_sdcard_set_sbaddr_window(sdiodev, address);
+                bcmerror = brcmf_sdiod_set_sbaddr_window(sdiodev, address);
                 if (bcmerror)
                         break;
 
@@ -704,8 +819,8 @@ brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
                 skb_put(pkt, dsize);
                 if (write)
                         memcpy(pkt->data, data, dsize);
-                bcmerror = brcmf_sdio_buffrw(sdiodev, SDIO_FUNC_1, write,
-                                             sdaddr, pkt);
+                bcmerror = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_1, write,
+                                              sdaddr, pkt);
                 if (bcmerror) {
                         brcmf_err("membytes transfer failed\n");
                         break;
@@ -727,7 +842,7 @@ brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
         dev_kfree_skb(pkt);
 
         /* Return the window to backplane enumeration space for core access */
-        if (brcmf_sdcard_set_sbaddr_window(sdiodev, sdiodev->sbwad))
+        if (brcmf_sdiod_set_sbaddr_window(sdiodev, sdiodev->sbwad))
                 brcmf_err("FAILED to set window back to 0x%x\n",
                           sdiodev->sbwad);
 
@@ -736,67 +851,335 @@ brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
         return bcmerror;
 }
 
-int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn)
 {
         char t_func = (char)fn;
         brcmf_dbg(SDIO, "Enter\n");
 
         /* issue abort cmd52 command through F0 */
-        brcmf_sdioh_request_byte(sdiodev, SDIOH_WRITE, SDIO_FUNC_0,
-                                 SDIO_CCCR_ABORT, &t_func);
+        brcmf_sdiod_request_data(sdiodev, SDIO_FUNC_0, SDIO_CCCR_ABORT,
+                                 sizeof(t_func), &t_func, true);
 
         brcmf_dbg(SDIO, "Exit\n");
         return 0;
 }
 
-int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
+static int brcmf_sdiod_remove(struct brcmf_sdio_dev *sdiodev)
 {
-        u32 regs = 0;
+        if (sdiodev->bus) {
+                brcmf_sdio_remove(sdiodev->bus);
+                sdiodev->bus = NULL;
+        }
+
+        /* Disable Function 2 */
+        sdio_claim_host(sdiodev->func[2]);
+        sdio_disable_func(sdiodev->func[2]);
+        sdio_release_host(sdiodev->func[2]);
+
+        /* Disable Function 1 */
+        sdio_claim_host(sdiodev->func[1]);
+        sdio_disable_func(sdiodev->func[1]);
+        sdio_release_host(sdiodev->func[1]);
+
+        sdiodev->sbwad = 0;
+
+        return 0;
+}
+
+static int brcmf_sdiod_probe(struct brcmf_sdio_dev *sdiodev)
+{
+        struct sdio_func *func;
+        struct mmc_host *host;
+        uint max_blocks;
         int ret = 0;
 
-        ret = brcmf_sdioh_attach(sdiodev);
-        if (ret)
+        sdiodev->num_funcs = 2;
+
+        sdio_claim_host(sdiodev->func[1]);
+
+        ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
+        if (ret) {
+                brcmf_err("Failed to set F1 blocksize\n");
+                sdio_release_host(sdiodev->func[1]);
+                goto out;
+        }
+        ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
+        if (ret) {
+                brcmf_err("Failed to set F2 blocksize\n");
+                sdio_release_host(sdiodev->func[1]);
+                goto out;
+        }
+
+        /* increase F2 timeout */
+        sdiodev->func[2]->enable_timeout = SDIO_WAIT_F2RDY;
+
+        /* Enable Function 1 */
+        ret = sdio_enable_func(sdiodev->func[1]);
+        sdio_release_host(sdiodev->func[1]);
+        if (ret) {
+                brcmf_err("Failed to enable F1: err=%d\n", ret);
                 goto out;
+        }
 
-        regs = SI_ENUM_BASE;
+        /*
+         * determine host related variables after brcmf_sdiod_probe()
+         * as func->cur_blksize is properly set and F2 init has been
+         * completed successfully.
+         */
+        func = sdiodev->func[2];
+        host = func->card->host;
+        sdiodev->sg_support = host->max_segs > 1;
+        max_blocks = min_t(uint, host->max_blk_count, 511u);
+        sdiodev->max_request_size = min_t(uint, host->max_req_size,
+                                          max_blocks * func->cur_blksize);
+        sdiodev->max_segment_count = min_t(uint, host->max_segs,
+                                           SG_MAX_SINGLE_ALLOC);
+        sdiodev->max_segment_size = host->max_seg_size;
 
         /* try to attach to the target device */
-        sdiodev->bus = brcmf_sdbrcm_probe(regs, sdiodev);
+        sdiodev->bus = brcmf_sdio_probe(sdiodev);
         if (!sdiodev->bus) {
-                brcmf_err("device attach failed\n");
                 ret = -ENODEV;
                 goto out;
         }
 
 out:
         if (ret)
-                brcmf_sdio_remove(sdiodev);
+                brcmf_sdiod_remove(sdiodev);
 
         return ret;
 }
-EXPORT_SYMBOL(brcmf_sdio_probe);
 
-int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev)
+/* devices we support, null terminated */
+static const struct sdio_device_id brcmf_sdmmc_ids[] = {
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43143)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43241)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43362)},
+        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
+                     SDIO_DEVICE_ID_BROADCOM_4335_4339)},
+        { /* end: all zeroes */ },
+};
+MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
+
+static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
+
+
+static int brcmf_ops_sdio_probe(struct sdio_func *func,
+                                const struct sdio_device_id *id)
 {
-        sdiodev->bus_if->state = BRCMF_BUS_DOWN;
+        int err;
+        struct brcmf_sdio_dev *sdiodev;
+        struct brcmf_bus *bus_if;
 
-        if (sdiodev->bus) {
-                brcmf_sdbrcm_disconnect(sdiodev->bus);
-                sdiodev->bus = NULL;
+        brcmf_dbg(SDIO, "Enter\n");
+        brcmf_dbg(SDIO, "Class=%x\n", func->class);
+        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
+        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
+        brcmf_dbg(SDIO, "Function#: %d\n", func->num);
+
+        /* Consume func num 1 but dont do anything with it. */
+        if (func->num == 1)
+                return 0;
+
+        /* Ignore anything but func 2 */
+        if (func->num != 2)
+                return -ENODEV;
+
+        bus_if = kzalloc(sizeof(struct brcmf_bus), GFP_KERNEL);
+        if (!bus_if)
+                return -ENOMEM;
+        sdiodev = kzalloc(sizeof(struct brcmf_sdio_dev), GFP_KERNEL);
+        if (!sdiodev) {
+                kfree(bus_if);
+                return -ENOMEM;
         }
 
-        brcmf_sdioh_detach(sdiodev);
+        /* store refs to functions used. mmc_card does
+         * not hold the F0 function pointer.
+         */
+        sdiodev->func[0] = kmemdup(func, sizeof(*func), GFP_KERNEL);
+        sdiodev->func[0]->num = 0;
+        sdiodev->func[1] = func->card->sdio_func[0];
+        sdiodev->func[2] = func;
+
+        sdiodev->bus_if = bus_if;
+        bus_if->bus_priv.sdio = sdiodev;
+        bus_if->proto_type = BRCMF_PROTO_BCDC;
+        dev_set_drvdata(&func->dev, bus_if);
+        dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
+        sdiodev->dev = &sdiodev->func[1]->dev;
+        sdiodev->pdata = brcmfmac_sdio_pdata;
+
+        atomic_set(&sdiodev->suspend, false);
+        init_waitqueue_head(&sdiodev->request_word_wait);
+        init_waitqueue_head(&sdiodev->request_buffer_wait);
+
+        brcmf_dbg(SDIO, "F2 found, calling brcmf_sdiod_probe...\n");
+        err = brcmf_sdiod_probe(sdiodev);
+        if (err) {
+                brcmf_err("F2 error, probe failed %d...\n", err);
+                goto fail;
+        }
 
-        sdiodev->sbwad = 0;
+        brcmf_dbg(SDIO, "F2 init completed...\n");
+        return 0;
+
+fail:
+        dev_set_drvdata(&func->dev, NULL);
+        dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+        kfree(sdiodev->func[0]);
+        kfree(sdiodev);
+        kfree(bus_if);
+        return err;
+}
+
+static void brcmf_ops_sdio_remove(struct sdio_func *func)
+{
+        struct brcmf_bus *bus_if;
+        struct brcmf_sdio_dev *sdiodev;
+
+        brcmf_dbg(SDIO, "Enter\n");
+        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
+        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
+        brcmf_dbg(SDIO, "Function: %d\n", func->num);
+
+        if (func->num != 1 && func->num != 2)
+                return;
+
+        bus_if = dev_get_drvdata(&func->dev);
+        if (bus_if) {
+                sdiodev = bus_if->bus_priv.sdio;
+                brcmf_sdiod_remove(sdiodev);
+
+                dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
+                dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
+
+                kfree(bus_if);
+                kfree(sdiodev->func[0]);
+                kfree(sdiodev);
+        }
+
+        brcmf_dbg(SDIO, "Exit\n");
+}
+
+#ifdef CONFIG_PM_SLEEP
+static int brcmf_ops_sdio_suspend(struct device *dev)
+{
+        mmc_pm_flag_t sdio_flags;
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        int ret = 0;
+
+        brcmf_dbg(SDIO, "\n");
+
+        atomic_set(&sdiodev->suspend, true);
+
+        sdio_flags = sdio_get_host_pm_caps(sdiodev->func[1]);
+        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
+                brcmf_err("Host can't keep power while suspended\n");
+                return -EINVAL;
+        }
+
+        ret = sdio_set_host_pm_flags(sdiodev->func[1], MMC_PM_KEEP_POWER);
+        if (ret) {
+                brcmf_err("Failed to set pm_flags\n");
+                return ret;
+        }
+
+        brcmf_sdio_wd_timer(sdiodev->bus, 0);
+
+        return ret;
+}
+
+static int brcmf_ops_sdio_resume(struct device *dev)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+
+        brcmf_sdio_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
+        atomic_set(&sdiodev->suspend, false);
+        return 0;
+}
+
+static const struct dev_pm_ops brcmf_sdio_pm_ops = {
+        .suspend        = brcmf_ops_sdio_suspend,
+        .resume         = brcmf_ops_sdio_resume,
+};
+#endif  /* CONFIG_PM_SLEEP */
+
+static struct sdio_driver brcmf_sdmmc_driver = {
+        .probe = brcmf_ops_sdio_probe,
+        .remove = brcmf_ops_sdio_remove,
+        .name = BRCMFMAC_SDIO_PDATA_NAME,
+        .id_table = brcmf_sdmmc_ids,
+#ifdef CONFIG_PM_SLEEP
+        .drv = {
+                .pm = &brcmf_sdio_pm_ops,
+        },
+#endif  /* CONFIG_PM_SLEEP */
+};
+
+static int brcmf_sdio_pd_probe(struct platform_device *pdev)
+{
+        brcmf_dbg(SDIO, "Enter\n");
+
+        brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
+
+        if (brcmfmac_sdio_pdata->power_on)
+                brcmfmac_sdio_pdata->power_on();
 
         return 0;
 }
-EXPORT_SYMBOL(brcmf_sdio_remove);
 
-void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev, bool enable)
+static int brcmf_sdio_pd_remove(struct platform_device *pdev)
 {
-        if (enable)
-                brcmf_sdbrcm_wd_timer(sdiodev->bus, BRCMF_WD_POLL_MS);
+        brcmf_dbg(SDIO, "Enter\n");
+
+        if (brcmfmac_sdio_pdata->power_off)
+                brcmfmac_sdio_pdata->power_off();
+
+        sdio_unregister_driver(&brcmf_sdmmc_driver);
+
+        return 0;
+}
+
+static struct platform_driver brcmf_sdio_pd = {
+        .remove         = brcmf_sdio_pd_remove,
+        .driver         = {
+                .name   = BRCMFMAC_SDIO_PDATA_NAME,
+                .owner  = THIS_MODULE,
+        }
+};
+
+void brcmf_sdio_register(void)
+{
+        int ret;
+
+        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+        if (ret)
+                brcmf_err("sdio_register_driver failed: %d\n", ret);
+}
+
+void brcmf_sdio_exit(void)
+{
+        brcmf_dbg(SDIO, "Enter\n");
+
+        if (brcmfmac_sdio_pdata)
+                platform_driver_unregister(&brcmf_sdio_pd);
         else
-                brcmf_sdbrcm_wd_timer(sdiodev->bus, 0);
+                sdio_unregister_driver(&brcmf_sdmmc_driver);
+}
+
+void __init brcmf_sdio_init(void)
+{
+        int ret;
+
+        brcmf_dbg(SDIO, "Enter\n");
+
+        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
+        if (ret == -ENODEV)
+                brcmf_dbg(SDIO, "No platform data available.\n");
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
deleted file mode 100644
index abc9ceca70f3..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ /dev/null
@@ -1,539 +0,0 @@
-/*
- * Copyright (c) 2010 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include <linux/types.h>
-#include <linux/netdevice.h>
-#include <linux/mmc/sdio.h>
-#include <linux/mmc/core.h>
-#include <linux/mmc/sdio_func.h>
-#include <linux/mmc/sdio_ids.h>
-#include <linux/mmc/card.h>
-#include <linux/mmc/host.h>
-#include <linux/suspend.h>
-#include <linux/errno.h>
-#include <linux/sched.h>        /* request_irq() */
-#include <linux/module.h>
-#include <linux/platform_device.h>
-#include <linux/platform_data/brcmfmac-sdio.h>
-#include <net/cfg80211.h>
-
-#include <defs.h>
-#include <brcm_hw_ids.h>
-#include <brcmu_utils.h>
-#include <brcmu_wifi.h>
-#include "sdio_host.h"
-#include "sdio_chip.h"
-#include "dhd_dbg.h"
-#include "dhd_bus.h"
-
-#define SDIO_VENDOR_ID_BROADCOM         0x02d0
-
-#define DMA_ALIGN_MASK  0x03
-
-#define SDIO_FUNC1_BLOCKSIZE            64
-#define SDIO_FUNC2_BLOCKSIZE            512
-
-/* devices we support, null terminated */
-static const struct sdio_device_id brcmf_sdmmc_ids[] = {
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43143)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_43241)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4329)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4330)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM, SDIO_DEVICE_ID_BROADCOM_4334)},
-        {SDIO_DEVICE(SDIO_VENDOR_ID_BROADCOM,
-                     SDIO_DEVICE_ID_BROADCOM_4335_4339)},
-        { /* end: all zeroes */ },
-};
-MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
-
-static struct brcmfmac_sdio_platform_data *brcmfmac_sdio_pdata;
-
-
-bool
-brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
-{
-        bool is_err = false;
-#ifdef CONFIG_PM_SLEEP
-        is_err = atomic_read(&sdiodev->suspend);
-#endif
-        return is_err;
-}
-
-void
-brcmf_pm_resume_wait(struct brcmf_sdio_dev *sdiodev, wait_queue_head_t *wq)
-{
-#ifdef CONFIG_PM_SLEEP
-        int retry = 0;
-        while (atomic_read(&sdiodev->suspend) && retry++ != 30)
-                wait_event_timeout(*wq, false, HZ/100);
-#endif
-}
-
-static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
-                                            uint regaddr, u8 *byte)
-{
-        struct sdio_func *sdfunc = sdiodev->func[0];
-        int err_ret;
-
-        /*
-         * Can only directly write to some F0 registers.
-         * Handle F2 enable/disable and Abort command
-         * as a special case.
-         */
-        if (regaddr == SDIO_CCCR_IOEx) {
-                sdfunc = sdiodev->func[2];
-                if (sdfunc) {
-                        if (*byte & SDIO_FUNC_ENABLE_2) {
-                                /* Enable Function 2 */
-                                err_ret = sdio_enable_func(sdfunc);
-                                if (err_ret)
-                                        brcmf_err("enable F2 failed:%d\n",
-                                                  err_ret);
-                        } else {
-                                /* Disable Function 2 */
-                                err_ret = sdio_disable_func(sdfunc);
-                                if (err_ret)
-                                        brcmf_err("Disable F2 failed:%d\n",
-                                                  err_ret);
-                        }
-                } else {
-                        err_ret = -ENOENT;
-                }
-        } else if ((regaddr == SDIO_CCCR_ABORT) ||
-                   (regaddr == SDIO_CCCR_IENx)) {
-                sdfunc = kmemdup(sdiodev->func[0], sizeof(struct sdio_func),
-                                 GFP_KERNEL);
-                if (!sdfunc)
-                        return -ENOMEM;
-                sdfunc->num = 0;
-                sdio_writeb(sdfunc, *byte, regaddr, &err_ret);
-                kfree(sdfunc);
-        } else if (regaddr < 0xF0) {
-                brcmf_err("F0 Wr:0x%02x: write disallowed\n", regaddr);
-                err_ret = -EPERM;
-        } else {
-                sdio_f0_writeb(sdfunc, *byte, regaddr, &err_ret);
-        }
-
-        return err_ret;
-}
-
-int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw, uint func,
-                             uint regaddr, u8 *byte)
-{
-        int err_ret;
-
-        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x\n", rw, func, regaddr);
-
-        brcmf_pm_resume_wait(sdiodev, &sdiodev->request_byte_wait);
-        if (brcmf_pm_resume_error(sdiodev))
-                return -EIO;
-
-        if (rw && func == 0) {
-                /* handle F0 separately */
-                err_ret = brcmf_sdioh_f0_write_byte(sdiodev, regaddr, byte);
-        } else {
-                if (rw) /* CMD52 Write */
-                        sdio_writeb(sdiodev->func[func], *byte, regaddr,
-                                    &err_ret);
-                else if (func == 0) {
-                        *byte = sdio_f0_readb(sdiodev->func[func], regaddr,
-                                              &err_ret);
-                } else {
-                        *byte = sdio_readb(sdiodev->func[func], regaddr,
-                                           &err_ret);
-                }
-        }
-
-        if (err_ret)
-                brcmf_err("Failed to %s byte F%d:@0x%05x=%02x, Err: %d\n",
-                          rw ? "write" : "read", func, regaddr, *byte, err_ret);
-
-        return err_ret;
-}
-
-int brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev,
-                             uint rw, uint func, uint addr, u32 *word,
-                             uint nbytes)
-{
-        int err_ret = -EIO;
-
-        if (func == 0) {
-                brcmf_err("Only CMD52 allowed to F0\n");
-                return -EINVAL;
-        }
-
-        brcmf_dbg(SDIO, "rw=%d, func=%d, addr=0x%05x, nbytes=%d\n",
-                  rw, func, addr, nbytes);
-
-        brcmf_pm_resume_wait(sdiodev, &sdiodev->request_word_wait);
-        if (brcmf_pm_resume_error(sdiodev))
-                return -EIO;
-
-        if (rw) {               /* CMD52 Write */
-                if (nbytes == 4)
-                        sdio_writel(sdiodev->func[func], *word, addr,
-                                    &err_ret);
-                else if (nbytes == 2)
-                        sdio_writew(sdiodev->func[func], (*word & 0xFFFF),
-                                    addr, &err_ret);
-                else
-                        brcmf_err("Invalid nbytes: %d\n", nbytes);
-        } else {                /* CMD52 Read */
-                if (nbytes == 4)
-                        *word = sdio_readl(sdiodev->func[func], addr, &err_ret);
-                else if (nbytes == 2)
-                        *word = sdio_readw(sdiodev->func[func], addr,
-                                           &err_ret) & 0xFFFF;
-                else
-                        brcmf_err("Invalid nbytes: %d\n", nbytes);
-        }
-
-        if (err_ret)
-                brcmf_err("Failed to %s word, Err: 0x%08x\n",
-                          rw ? "write" : "read", err_ret);
-
-        return err_ret;
-}
-
-static int brcmf_sdioh_get_cisaddr(struct brcmf_sdio_dev *sdiodev, u32 regaddr)
-{
-        /* read 24 bits and return valid 17 bit addr */
-        int i, ret;
-        u32 scratch, regdata;
-        __le32 scratch_le;
-        u8 *ptr = (u8 *)&scratch_le;
-
-        for (i = 0; i < 3; i++) {
-                regdata = brcmf_sdio_regrl(sdiodev, regaddr, &ret);
-                if (ret != 0)
-                        brcmf_err("Can't read!\n");
-
-                *ptr++ = (u8) regdata;
-                regaddr++;
-        }
-
-        /* Only the lower 17-bits are valid */
-        scratch = le32_to_cpu(scratch_le);
-        scratch &= 0x0001FFFF;
-        return scratch;
-}
-
-static int brcmf_sdioh_enablefuncs(struct brcmf_sdio_dev *sdiodev)
-{
-        int err_ret;
-        u32 fbraddr;
-        u8 func;
-
-        brcmf_dbg(SDIO, "\n");
-
-        /* Get the Card's common CIS address */
-        sdiodev->func_cis_ptr[0] = brcmf_sdioh_get_cisaddr(sdiodev,
-                                                           SDIO_CCCR_CIS);
-        brcmf_dbg(SDIO, "Card's Common CIS Ptr = 0x%x\n",
-                  sdiodev->func_cis_ptr[0]);
-
-        /* Get the Card's function CIS (for each function) */
-        for (fbraddr = SDIO_FBR_BASE(1), func = 1;
-             func <= sdiodev->num_funcs; func++, fbraddr += SDIOD_FBR_SIZE) {
-                sdiodev->func_cis_ptr[func] =
-                    brcmf_sdioh_get_cisaddr(sdiodev, SDIO_FBR_CIS + fbraddr);
-                brcmf_dbg(SDIO, "Function %d CIS Ptr = 0x%x\n",
-                          func, sdiodev->func_cis_ptr[func]);
-        }
-
-        /* Enable Function 1 */
-        err_ret = sdio_enable_func(sdiodev->func[1]);
-        if (err_ret)
-                brcmf_err("Failed to enable F1 Err: 0x%08x\n", err_ret);
-
-        return false;
-}
-
-/*
- *      Public entry points & extern's
- */
-int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev)
-{
-        int err_ret = 0;
-
-        brcmf_dbg(SDIO, "\n");
-
-        sdiodev->num_funcs = 2;
-
-        sdio_claim_host(sdiodev->func[1]);
-
-        err_ret = sdio_set_block_size(sdiodev->func[1], SDIO_FUNC1_BLOCKSIZE);
-        if (err_ret) {
-                brcmf_err("Failed to set F1 blocksize\n");
-                goto out;
-        }
-
-        err_ret = sdio_set_block_size(sdiodev->func[2], SDIO_FUNC2_BLOCKSIZE);
-        if (err_ret) {
-                brcmf_err("Failed to set F2 blocksize\n");
-                goto out;
-        }
-
-        brcmf_sdioh_enablefuncs(sdiodev);
-
-out:
-        sdio_release_host(sdiodev->func[1]);
-        brcmf_dbg(SDIO, "Done\n");
-        return err_ret;
-}
-
-void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev)
-{
-        brcmf_dbg(SDIO, "\n");
-
-        /* Disable Function 2 */
-        sdio_claim_host(sdiodev->func[2]);
-        sdio_disable_func(sdiodev->func[2]);
-        sdio_release_host(sdiodev->func[2]);
-
-        /* Disable Function 1 */
-        sdio_claim_host(sdiodev->func[1]);
-        sdio_disable_func(sdiodev->func[1]);
-        sdio_release_host(sdiodev->func[1]);
-
-}
-
-static int brcmf_ops_sdio_probe(struct sdio_func *func,
-                                const struct sdio_device_id *id)
-{
-        int err;
-        struct brcmf_sdio_dev *sdiodev;
-        struct brcmf_bus *bus_if;
-        struct mmc_host *host;
-        uint max_blocks;
-
-        brcmf_dbg(SDIO, "Enter\n");
-        brcmf_dbg(SDIO, "Class=%x\n", func->class);
-        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
-        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
-        brcmf_dbg(SDIO, "Function#: %d\n", func->num);
-
-        /* Consume func num 1 but dont do anything with it. */
-        if (func->num == 1)
-                return 0;
-
-        /* Ignore anything but func 2 */
-        if (func->num != 2)
-                return -ENODEV;
-
-        bus_if = kzalloc(sizeof(struct brcmf_bus), GFP_KERNEL);
-        if (!bus_if)
-                return -ENOMEM;
-        sdiodev = kzalloc(sizeof(struct brcmf_sdio_dev), GFP_KERNEL);
-        if (!sdiodev) {
-                kfree(bus_if);
-                return -ENOMEM;
-        }
-
-        sdiodev->func[0] = func->card->sdio_func[0];
-        sdiodev->func[1] = func->card->sdio_func[0];
-        sdiodev->func[2] = func;
-
-        sdiodev->bus_if = bus_if;
-        bus_if->bus_priv.sdio = sdiodev;
-        dev_set_drvdata(&func->dev, bus_if);
-        dev_set_drvdata(&sdiodev->func[1]->dev, bus_if);
-        sdiodev->dev = &sdiodev->func[1]->dev;
-        sdiodev->pdata = brcmfmac_sdio_pdata;
-
-        atomic_set(&sdiodev->suspend, false);
-        init_waitqueue_head(&sdiodev->request_byte_wait);
-        init_waitqueue_head(&sdiodev->request_word_wait);
-        init_waitqueue_head(&sdiodev->request_buffer_wait);
-
-        brcmf_dbg(SDIO, "F2 found, calling brcmf_sdio_probe...\n");
-        err = brcmf_sdio_probe(sdiodev);
-        if (err) {
-                brcmf_err("F2 error, probe failed %d...\n", err);
-                goto fail;
-        }
-
-        /*
-         * determine host related variables after brcmf_sdio_probe()
-         * as func->cur_blksize is properly set and F2 init has been
-         * completed successfully.
-         */
-        host = func->card->host;
-        sdiodev->sg_support = host->max_segs > 1;
-        max_blocks = min_t(uint, host->max_blk_count, 511u);
-        sdiodev->max_request_size = min_t(uint, host->max_req_size,
-                                          max_blocks * func->cur_blksize);
-        sdiodev->max_segment_count = min_t(uint, host->max_segs,
-                                           SG_MAX_SINGLE_ALLOC);
-        sdiodev->max_segment_size = host->max_seg_size;
-        brcmf_dbg(SDIO, "F2 init completed...\n");
-        return 0;
-
-fail:
-        dev_set_drvdata(&func->dev, NULL);
-        dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
-        kfree(sdiodev);
-        kfree(bus_if);
-        return err;
-}
-
-static void brcmf_ops_sdio_remove(struct sdio_func *func)
-{
-        struct brcmf_bus *bus_if;
-        struct brcmf_sdio_dev *sdiodev;
-
-        brcmf_dbg(SDIO, "Enter\n");
-        brcmf_dbg(SDIO, "sdio vendor ID: 0x%04x\n", func->vendor);
-        brcmf_dbg(SDIO, "sdio device ID: 0x%04x\n", func->device);
-        brcmf_dbg(SDIO, "Function: %d\n", func->num);
-
-        if (func->num != 1 && func->num != 2)
-                return;
-
-        bus_if = dev_get_drvdata(&func->dev);
-        if (bus_if) {
-                sdiodev = bus_if->bus_priv.sdio;
-                brcmf_sdio_remove(sdiodev);
-
-                dev_set_drvdata(&sdiodev->func[1]->dev, NULL);
-                dev_set_drvdata(&sdiodev->func[2]->dev, NULL);
-
-                kfree(bus_if);
-                kfree(sdiodev);
-        }
-
-        brcmf_dbg(SDIO, "Exit\n");
-}
-
-#ifdef CONFIG_PM_SLEEP
-static int brcmf_sdio_suspend(struct device *dev)
-{
-        mmc_pm_flag_t sdio_flags;
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-        int ret = 0;
-
-        brcmf_dbg(SDIO, "\n");
-
-        atomic_set(&sdiodev->suspend, true);
-
-        sdio_flags = sdio_get_host_pm_caps(sdiodev->func[1]);
-        if (!(sdio_flags & MMC_PM_KEEP_POWER)) {
-                brcmf_err("Host can't keep power while suspended\n");
-                return -EINVAL;
-        }
-
-        ret = sdio_set_host_pm_flags(sdiodev->func[1], MMC_PM_KEEP_POWER);
-        if (ret) {
-                brcmf_err("Failed to set pm_flags\n");
-                return ret;
-        }
-
-        brcmf_sdio_wdtmr_enable(sdiodev, false);
-
-        return ret;
-}
-
-static int brcmf_sdio_resume(struct device *dev)
-{
-        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
-        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
-
-        brcmf_sdio_wdtmr_enable(sdiodev, true);
-        atomic_set(&sdiodev->suspend, false);
-        return 0;
-}
-
-static const struct dev_pm_ops brcmf_sdio_pm_ops = {
-        .suspend        = brcmf_sdio_suspend,
-        .resume         = brcmf_sdio_resume,
-};
-#endif  /* CONFIG_PM_SLEEP */
-
-static struct sdio_driver brcmf_sdmmc_driver = {
-        .probe = brcmf_ops_sdio_probe,
-        .remove = brcmf_ops_sdio_remove,
-        .name = BRCMFMAC_SDIO_PDATA_NAME,
-        .id_table = brcmf_sdmmc_ids,
-#ifdef CONFIG_PM_SLEEP
-        .drv = {
-                .pm = &brcmf_sdio_pm_ops,
-        },
-#endif  /* CONFIG_PM_SLEEP */
-};
-
-static int brcmf_sdio_pd_probe(struct platform_device *pdev)
-{
-        brcmf_dbg(SDIO, "Enter\n");
-
-        brcmfmac_sdio_pdata = dev_get_platdata(&pdev->dev);
-
-        if (brcmfmac_sdio_pdata->power_on)
-                brcmfmac_sdio_pdata->power_on();
-
-        return 0;
-}
-
-static int brcmf_sdio_pd_remove(struct platform_device *pdev)
-{
-        brcmf_dbg(SDIO, "Enter\n");
-
-        if (brcmfmac_sdio_pdata->power_off)
-                brcmfmac_sdio_pdata->power_off();
-
-        sdio_unregister_driver(&brcmf_sdmmc_driver);
-
-        return 0;
-}
-
-static struct platform_driver brcmf_sdio_pd = {
-        .remove         = brcmf_sdio_pd_remove,
-        .driver         = {
-                .name   = BRCMFMAC_SDIO_PDATA_NAME,
-                .owner  = THIS_MODULE,
-        }
-};
-
-void brcmf_sdio_register(void)
-{
-        int ret;
-
-        ret = sdio_register_driver(&brcmf_sdmmc_driver);
-        if (ret)
-                brcmf_err("sdio_register_driver failed: %d\n", ret);
-}
-
-void brcmf_sdio_exit(void)
-{
-        brcmf_dbg(SDIO, "Enter\n");
-
-        if (brcmfmac_sdio_pdata)
-                platform_driver_unregister(&brcmf_sdio_pd);
-        else
-                sdio_unregister_driver(&brcmf_sdmmc_driver);
-}
-
-void __init brcmf_sdio_init(void)
-{
-        int ret;
-
-        brcmf_dbg(SDIO, "Enter\n");
-
-        ret = platform_driver_probe(&brcmf_sdio_pd, brcmf_sdio_pd_probe);
-        if (ret == -ENODEV)
-                brcmf_dbg(SDIO, "No platform data available.\n");
-}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
index 899a2ada5b82..939d6b132922 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd.h
@@ -21,481 +21,33 @@
 #ifndef _BRCMF_H_
 #define _BRCMF_H_
 
-#define BRCMF_VERSION_STR               "4.218.248.5"
-
 #include "fweh.h"
 
-/*******************************************************************************
- * IO codes that are interpreted by dongle firmware
- ******************************************************************************/
-#define BRCMF_C_GET_VERSION                     1
-#define BRCMF_C_UP                              2
-#define BRCMF_C_DOWN                            3
-#define BRCMF_C_SET_PROMISC                     10
-#define BRCMF_C_GET_RATE                        12
-#define BRCMF_C_GET_INFRA                       19
-#define BRCMF_C_SET_INFRA                       20
-#define BRCMF_C_GET_AUTH                        21
-#define BRCMF_C_SET_AUTH                        22
-#define BRCMF_C_GET_BSSID                       23
-#define BRCMF_C_GET_SSID                        25
-#define BRCMF_C_SET_SSID                        26
-#define BRCMF_C_TERMINATED                      28
-#define BRCMF_C_GET_CHANNEL                     29
-#define BRCMF_C_SET_CHANNEL                     30
-#define BRCMF_C_GET_SRL                         31
-#define BRCMF_C_SET_SRL                         32
-#define BRCMF_C_GET_LRL                         33
-#define BRCMF_C_SET_LRL                         34
-#define BRCMF_C_GET_RADIO                       37
-#define BRCMF_C_SET_RADIO                       38
-#define BRCMF_C_GET_PHYTYPE                     39
-#define BRCMF_C_SET_KEY                         45
-#define BRCMF_C_SET_PASSIVE_SCAN                49
-#define BRCMF_C_SCAN                            50
-#define BRCMF_C_SCAN_RESULTS                    51
-#define BRCMF_C_DISASSOC                        52
-#define BRCMF_C_REASSOC                         53
-#define BRCMF_C_SET_ROAM_TRIGGER                55
-#define BRCMF_C_SET_ROAM_DELTA                  57
-#define BRCMF_C_GET_BCNPRD                      75
-#define BRCMF_C_SET_BCNPRD                      76
-#define BRCMF_C_GET_DTIMPRD                     77
-#define BRCMF_C_SET_DTIMPRD                     78
-#define BRCMF_C_SET_COUNTRY                     84
-#define BRCMF_C_GET_PM                          85
-#define BRCMF_C_SET_PM                          86
-#define BRCMF_C_GET_CURR_RATESET                114
-#define BRCMF_C_GET_AP                          117
-#define BRCMF_C_SET_AP                          118
-#define BRCMF_C_GET_RSSI                        127
-#define BRCMF_C_GET_WSEC                        133
-#define BRCMF_C_SET_WSEC                        134
-#define BRCMF_C_GET_PHY_NOISE                   135
-#define BRCMF_C_GET_BSS_INFO                    136
-#define BRCMF_C_GET_BANDLIST                    140
-#define BRCMF_C_SET_SCB_TIMEOUT                 158
-#define BRCMF_C_GET_PHYLIST                     180
-#define BRCMF_C_SET_SCAN_CHANNEL_TIME           185
-#define BRCMF_C_SET_SCAN_UNASSOC_TIME           187
-#define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON   201
-#define BRCMF_C_GET_VALID_CHANNELS              217
-#define BRCMF_C_GET_KEY_PRIMARY                 235
-#define BRCMF_C_SET_KEY_PRIMARY                 236
-#define BRCMF_C_SET_SCAN_PASSIVE_TIME           258
-#define BRCMF_C_GET_VAR                         262
-#define BRCMF_C_SET_VAR                         263
-
-/* phy types (returned by WLC_GET_PHYTPE) */
-#define WLC_PHY_TYPE_A          0
-#define WLC_PHY_TYPE_B          1
-#define WLC_PHY_TYPE_G          2
-#define WLC_PHY_TYPE_N          4
-#define WLC_PHY_TYPE_LP         5
-#define WLC_PHY_TYPE_SSN        6
-#define WLC_PHY_TYPE_HT         7
-#define WLC_PHY_TYPE_LCN        8
-#define WLC_PHY_TYPE_NULL       0xf
-
 #define TOE_TX_CSUM_OL          0x00000001
 #define TOE_RX_CSUM_OL          0x00000002
 
-#define BRCMF_BSS_INFO_VERSION  109 /* curr ver of brcmf_bss_info_le struct */
-
-/* size of brcmf_scan_params not including variable length array */
-#define BRCMF_SCAN_PARAMS_FIXED_SIZE 64
-
-/* masks for channel and ssid count */
-#define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff
-#define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16
-
-/* primary (ie tx) key */
-#define BRCMF_PRIMARY_KEY       (1 << 1)
-
 /* For supporting multiple interfaces */
 #define BRCMF_MAX_IFS   16
 
-#define DOT11_BSSTYPE_ANY                       2
 #define DOT11_MAX_DEFAULT_KEYS  4
 
-#define BRCMF_ESCAN_REQ_VERSION 1
-
-#define WLC_BSS_RSSI_ON_CHANNEL         0x0002
-
-#define BRCMF_MAXRATES_IN_SET           16      /* max # of rates in rateset */
-#define BRCMF_STA_ASSOC                 0x10            /* Associated */
-
-#define BRCMF_E_STATUS_SUCCESS                  0
-#define BRCMF_E_STATUS_FAIL                     1
-#define BRCMF_E_STATUS_TIMEOUT                  2
-#define BRCMF_E_STATUS_NO_NETWORKS              3
-#define BRCMF_E_STATUS_ABORT                    4
-#define BRCMF_E_STATUS_NO_ACK                   5
-#define BRCMF_E_STATUS_UNSOLICITED              6
-#define BRCMF_E_STATUS_ATTEMPT                  7
-#define BRCMF_E_STATUS_PARTIAL                  8
-#define BRCMF_E_STATUS_NEWSCAN                  9
-#define BRCMF_E_STATUS_NEWASSOC                 10
-#define BRCMF_E_STATUS_11HQUIET                 11
-#define BRCMF_E_STATUS_SUPPRESS                 12
-#define BRCMF_E_STATUS_NOCHANS                  13
-#define BRCMF_E_STATUS_CS_ABORT                 15
-#define BRCMF_E_STATUS_ERROR                    16
-
-#define BRCMF_E_REASON_INITIAL_ASSOC            0
-#define BRCMF_E_REASON_LOW_RSSI                 1
-#define BRCMF_E_REASON_DEAUTH                   2
-#define BRCMF_E_REASON_DISASSOC                 3
-#define BRCMF_E_REASON_BCNS_LOST                4
-#define BRCMF_E_REASON_MINTXRATE                9
-#define BRCMF_E_REASON_TXFAIL                   10
-
-#define BRCMF_E_REASON_LINK_BSSCFG_DIS          4
-#define BRCMF_E_REASON_FAST_ROAM_FAILED         5
-#define BRCMF_E_REASON_DIRECTED_ROAM            6
-#define BRCMF_E_REASON_TSPEC_REJECTED           7
-#define BRCMF_E_REASON_BETTER_AP                8
-
-#define BRCMF_E_PRUNE_ENCR_MISMATCH             1
-#define BRCMF_E_PRUNE_BCAST_BSSID               2
-#define BRCMF_E_PRUNE_MAC_DENY                  3
-#define BRCMF_E_PRUNE_MAC_NA                    4
-#define BRCMF_E_PRUNE_REG_PASSV                 5
-#define BRCMF_E_PRUNE_SPCT_MGMT                 6
-#define BRCMF_E_PRUNE_RADAR                     7
-#define BRCMF_E_RSN_MISMATCH                    8
-#define BRCMF_E_PRUNE_NO_COMMON_RATES           9
-#define BRCMF_E_PRUNE_BASIC_RATES               10
-#define BRCMF_E_PRUNE_CIPHER_NA                 12
-#define BRCMF_E_PRUNE_KNOWN_STA                 13
-#define BRCMF_E_PRUNE_WDS_PEER                  15
-#define BRCMF_E_PRUNE_QBSS_LOAD                 16
-#define BRCMF_E_PRUNE_HOME_AP                   17
-
-#define BRCMF_E_SUP_OTHER                       0
-#define BRCMF_E_SUP_DECRYPT_KEY_DATA            1
-#define BRCMF_E_SUP_BAD_UCAST_WEP128            2
-#define BRCMF_E_SUP_BAD_UCAST_WEP40             3
-#define BRCMF_E_SUP_UNSUP_KEY_LEN               4
-#define BRCMF_E_SUP_PW_KEY_CIPHER               5
-#define BRCMF_E_SUP_MSG3_TOO_MANY_IE            6
-#define BRCMF_E_SUP_MSG3_IE_MISMATCH            7
-#define BRCMF_E_SUP_NO_INSTALL_FLAG             8
-#define BRCMF_E_SUP_MSG3_NO_GTK                 9
-#define BRCMF_E_SUP_GRP_KEY_CIPHER              10
-#define BRCMF_E_SUP_GRP_MSG1_NO_GTK             11
-#define BRCMF_E_SUP_GTK_DECRYPT_FAIL            12
-#define BRCMF_E_SUP_SEND_FAIL                   13
-#define BRCMF_E_SUP_DEAUTH                      14
-
-#define BRCMF_E_IF_ADD                          1
-#define BRCMF_E_IF_DEL                          2
-#define BRCMF_E_IF_CHANGE                       3
-
-#define BRCMF_E_IF_FLAG_NOIF                    1
-
-#define BRCMF_E_IF_ROLE_STA                     0
-#define BRCMF_E_IF_ROLE_AP                      1
-#define BRCMF_E_IF_ROLE_WDS                     2
-
-#define BRCMF_E_LINK_BCN_LOSS                   1
-#define BRCMF_E_LINK_DISASSOC                   2
-#define BRCMF_E_LINK_ASSOC_REC                  3
-#define BRCMF_E_LINK_BSSCFG_DIS                 4
-
 /* Small, medium and maximum buffer size for dcmd
  */
 #define BRCMF_DCMD_SMLEN        256
 #define BRCMF_DCMD_MEDLEN       1536
 #define BRCMF_DCMD_MAXLEN       8192
 
-#define BRCMF_AMPDU_RX_REORDER_MAXFLOWS         256
-
-/* Pattern matching filter. Specifies an offset within received packets to
- * start matching, the pattern to match, the size of the pattern, and a bitmask
- * that indicates which bits within the pattern should be matched.
- */
-struct brcmf_pkt_filter_pattern_le {
-        /*
-         * Offset within received packet to start pattern matching.
-         * Offset '0' is the first byte of the ethernet header.
-         */
-        __le32 offset;
-        /* Size of the pattern.  Bitmask must be the same size.*/
-        __le32 size_bytes;
-        /*
-         * Variable length mask and pattern data. mask starts at offset 0.
-         * Pattern immediately follows mask.
-         */
-        u8 mask_and_pattern[1];
-};
-
-/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
-struct brcmf_pkt_filter_le {
-        __le32 id;              /* Unique filter id, specified by app. */
-        __le32 type;            /* Filter type (WL_PKT_FILTER_TYPE_xxx). */
-        __le32 negate_match;    /* Negate the result of filter matches */
-        union {                 /* Filter definitions */
-                struct brcmf_pkt_filter_pattern_le pattern; /* Filter pattern */
-        } u;
-};
-
-/* IOVAR "pkt_filter_enable" parameter. */
-struct brcmf_pkt_filter_enable_le {
-        __le32 id;              /* Unique filter id */
-        __le32 enable;          /* Enable/disable bool */
-};
-
-/* BSS info structure
- * Applications MUST CHECK ie_offset field and length field to access IEs and
- * next bss_info structure in a vector (in struct brcmf_scan_results)
+/* IOCTL from host to device are limited in lenght. A device can only handle
+ * ethernet frame size. This limitation is to be applied by protocol layer.
  */
-struct brcmf_bss_info_le {
-        __le32 version;         /* version field */
-        __le32 length;          /* byte length of data in this record,
-                                 * starting at version and including IEs
-                                 */
-        u8 BSSID[ETH_ALEN];
-        __le16 beacon_period;   /* units are Kusec */
-        __le16 capability;      /* Capability information */
-        u8 SSID_len;
-        u8 SSID[32];
-        struct {
-                __le32 count;   /* # rates in this set */
-                u8 rates[16]; /* rates in 500kbps units w/hi bit set if basic */
-        } rateset;              /* supported rates */
-        __le16 chanspec;        /* chanspec for bss */
-        __le16 atim_window;     /* units are Kusec */
-        u8 dtim_period; /* DTIM period */
-        __le16 RSSI;            /* receive signal strength (in dBm) */
-        s8 phy_noise;           /* noise (in dBm) */
-
-        u8 n_cap;               /* BSS is 802.11N Capable */
-        /* 802.11N BSS Capabilities (based on HT_CAP_*): */
-        __le32 nbss_cap;
-        u8 ctl_ch;              /* 802.11N BSS control channel number */
-        __le32 reserved32[1];   /* Reserved for expansion of BSS properties */
-        u8 flags;               /* flags */
-        u8 reserved[3]; /* Reserved for expansion of BSS properties */
-        u8 basic_mcs[MCSSET_LEN];       /* 802.11N BSS required MCS set */
+#define BRCMF_TX_IOCTL_MAX_MSG_SIZE     (ETH_FRAME_LEN+ETH_FCS_LEN)
 
-        __le16 ie_offset;       /* offset at which IEs start, from beginning */
-        __le32 ie_length;       /* byte length of Information Elements */
-        __le16 SNR;             /* average SNR of during frame reception */
-        /* Add new fields here */
-        /* variable length Information Elements */
-};
-
-struct brcm_rateset_le {
-        /* # rates in this set */
-        __le32 count;
-        /* rates in 500kbps units w/hi bit set if basic */
-        u8 rates[BRCMF_MAXRATES_IN_SET];
-};
-
-struct brcmf_ssid {
-        u32 SSID_len;
-        unsigned char SSID[32];
-};
-
-struct brcmf_ssid_le {
-        __le32 SSID_len;
-        unsigned char SSID[32];
-};
-
-struct brcmf_scan_params_le {
-        struct brcmf_ssid_le ssid_le;   /* default: {0, ""} */
-        u8 bssid[ETH_ALEN];     /* default: bcast */
-        s8 bss_type;            /* default: any,
-                                 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
-                                 */
-        u8 scan_type;   /* flags, 0 use default */
-        __le32 nprobes;   /* -1 use default, number of probes per channel */
-        __le32 active_time;     /* -1 use default, dwell time per channel for
-                                 * active scanning
-                                 */
-        __le32 passive_time;    /* -1 use default, dwell time per channel
-                                 * for passive scanning
-                                 */
-        __le32 home_time;       /* -1 use default, dwell time for the
-                                 * home channel between channel scans
-                                 */
-        __le32 channel_num;     /* count of channels and ssids that follow
-                                 *
-                                 * low half is count of channels in
-                                 * channel_list, 0 means default (use all
-                                 * available channels)
-                                 *
-                                 * high half is entries in struct brcmf_ssid
-                                 * array that follows channel_list, aligned for
-                                 * s32 (4 bytes) meaning an odd channel count
-                                 * implies a 2-byte pad between end of
-                                 * channel_list and first ssid
-                                 *
-                                 * if ssid count is zero, single ssid in the
-                                 * fixed parameter portion is assumed, otherwise
-                                 * ssid in the fixed portion is ignored
-                                 */
-        __le16 channel_list[1]; /* list of chanspecs */
-};
-
-struct brcmf_scan_results {
-        u32 buflen;
-        u32 version;
-        u32 count;
-        struct brcmf_bss_info_le bss_info_le[];
-};
-
-struct brcmf_escan_params_le {
-        __le32 version;
-        __le16 action;
-        __le16 sync_id;
-        struct brcmf_scan_params_le params_le;
-};
-
-struct brcmf_escan_result_le {
-        __le32 buflen;
-        __le32 version;
-        __le16 sync_id;
-        __le16 bss_count;
-        struct brcmf_bss_info_le bss_info_le;
-};
-
-#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(struct brcmf_escan_result_le) - \
-        sizeof(struct brcmf_bss_info_le))
-
-/* used for association with a specific BSSID and chanspec list */
-struct brcmf_assoc_params_le {
-        /* 00:00:00:00:00:00: broadcast scan */
-        u8 bssid[ETH_ALEN];
-        /* 0: all available channels, otherwise count of chanspecs in
-         * chanspec_list */
-        __le32 chanspec_num;
-        /* list of chanspecs */
-        __le16 chanspec_list[1];
-};
-
-/* used for join with or without a specific bssid and channel list */
-struct brcmf_join_params {
-        struct brcmf_ssid_le ssid_le;
-        struct brcmf_assoc_params_le params_le;
-};
-
-/* scan params for extended join */
-struct brcmf_join_scan_params_le {
-        u8 scan_type;           /* 0 use default, active or passive scan */
-        __le32 nprobes;         /* -1 use default, nr of probes per channel */
-        __le32 active_time;     /* -1 use default, dwell time per channel for
-                                 * active scanning
-                                 */
-        __le32 passive_time;    /* -1 use default, dwell time per channel
-                                 * for passive scanning
-                                 */
-        __le32 home_time;       /* -1 use default, dwell time for the home
-                                 * channel between channel scans
-                                 */
-};
-
-/* extended join params */
-struct brcmf_ext_join_params_le {
-        struct brcmf_ssid_le ssid_le;   /* {0, ""}: wildcard scan */
-        struct brcmf_join_scan_params_le scan_le;
-        struct brcmf_assoc_params_le assoc_le;
-};
-
-struct brcmf_wsec_key {
-        u32 index;              /* key index */
-        u32 len;                /* key length */
-        u8 data[WLAN_MAX_KEY_LEN];      /* key data */
-        u32 pad_1[18];
-        u32 algo;       /* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
-        u32 flags;      /* misc flags */
-        u32 pad_2[3];
-        u32 iv_initialized;     /* has IV been initialized already? */
-        u32 pad_3;
-        /* Rx IV */
-        struct {
-                u32 hi; /* upper 32 bits of IV */
-                u16 lo; /* lower 16 bits of IV */
-        } rxiv;
-        u32 pad_4[2];
-        u8 ea[ETH_ALEN];        /* per station */
-};
-
-/*
- * dongle requires same struct as above but with fields in little endian order
- */
-struct brcmf_wsec_key_le {
-        __le32 index;           /* key index */
-        __le32 len;             /* key length */
-        u8 data[WLAN_MAX_KEY_LEN];      /* key data */
-        __le32 pad_1[18];
-        __le32 algo;    /* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
-        __le32 flags;   /* misc flags */
-        __le32 pad_2[3];
-        __le32 iv_initialized;  /* has IV been initialized already? */
-        __le32 pad_3;
-        /* Rx IV */
-        struct {
-                __le32 hi;      /* upper 32 bits of IV */
-                __le16 lo;      /* lower 16 bits of IV */
-        } rxiv;
-        __le32 pad_4[2];
-        u8 ea[ETH_ALEN];        /* per station */
-};
-
-/* Used to get specific STA parameters */
-struct brcmf_scb_val_le {
-        __le32 val;
-        u8 ea[ETH_ALEN];
-};
-
-/* channel encoding */
-struct brcmf_channel_info_le {
-        __le32 hw_channel;
-        __le32 target_channel;
-        __le32 scan_channel;
-};
-
-struct brcmf_sta_info_le {
-        __le16  ver;            /* version of this struct */
-        __le16  len;            /* length in bytes of this structure */
-        __le16  cap;            /* sta's advertised capabilities */
-        __le32  flags;          /* flags defined below */
-        __le32  idle;           /* time since data pkt rx'd from sta */
-        u8      ea[ETH_ALEN];           /* Station address */
-        __le32  count;                  /* # rates in this set */
-        u8      rates[BRCMF_MAXRATES_IN_SET];   /* rates in 500kbps units */
-                                                /* w/hi bit set if basic */
-        __le32  in;             /* seconds elapsed since associated */
-        __le32  listen_interval_inms; /* Min Listen interval in ms for STA */
-        __le32  tx_pkts;        /* # of packets transmitted */
-        __le32  tx_failures;    /* # of packets failed */
-        __le32  rx_ucast_pkts;  /* # of unicast packets received */
-        __le32  rx_mcast_pkts;  /* # of multicast packets received */
-        __le32  tx_rate;        /* Rate of last successful tx frame */
-        __le32  rx_rate;        /* Rate of last successful rx frame */
-        __le32  rx_decrypt_succeeds;    /* # of packet decrypted successfully */
-        __le32  rx_decrypt_failures;    /* # of packet decrypted failed */
-};
-
-struct brcmf_chanspec_list {
-        __le32  count;          /* # of entries */
-        __le32  element[1];     /* variable length uint32 list */
-};
+#define BRCMF_AMPDU_RX_REORDER_MAXFLOWS         256
 
-/*
- * WLC_E_PROBRESP_MSG
- * WLC_E_P2P_PROBREQ_MSG
- * WLC_E_ACTION_FRAME_RX
+/* Length of firmware version string stored for
+ * ethtool driver info which uses 32 bytes as well.
  */
-struct brcmf_rx_mgmt_data {
-        __be16  version;
-        __be16  chanspec;
-        __be32  rssi;
-        __be32  mactime;
-        __be32  rate;
-};
+#define BRCMF_DRIVER_FIRMWARE_VERSION_LEN       32
 
 /* Bus independent dongle command */
 struct brcmf_dcmd {
@@ -535,7 +87,7 @@ struct brcmf_fws_info; /* firmware signalling info */
 struct brcmf_pub {
         /* Linkage ponters */
         struct brcmf_bus *bus_if;
-        struct brcmf_proto *prot;
+        struct brcmf_proto *proto;
         struct brcmf_cfg80211_info *config;
 
         /* Internal brcmf items */
@@ -544,7 +96,7 @@ struct brcmf_pub {
         u8 wme_dp;              /* wme discard priority */
 
         /* Dongle media info */
-        unsigned long drv_version;      /* Version of dongle-resident driver */
+        char fwver[BRCMF_DRIVER_FIRMWARE_VERSION_LEN];
         u8 mac[ETH_ALEN];               /* MAC address obtained from dongle */
 
         /* Multicast data packets sent to dongle */
@@ -566,14 +118,6 @@ struct brcmf_pub {
 #endif
 };
 
-struct brcmf_if_event {
-        u8 ifidx;
-        u8 action;
-        u8 flags;
-        u8 bssidx;
-        u8 role;
-};
-
 /* forward declarations */
 struct brcmf_cfg80211_vif;
 struct brcmf_fws_mac_descriptor;
@@ -635,16 +179,6 @@ int brcmf_netdev_wait_pend8021x(struct net_device *ndev);
 /* Return pointer to interface name */
 char *brcmf_ifname(struct brcmf_pub *drvr, int idx);
 
-/* Query dongle */
-int brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
-                               void *buf, uint len);
-int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
-                             void *buf, uint len);
-
-/* Remove any protocol-specific data header. */
-int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
-                        struct sk_buff *rxp);
-
 int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked);
 struct brcmf_if *brcmf_add_if(struct brcmf_pub *drvr, s32 bssidx, s32 ifidx,
                               char *name, u8 *mac_addr);
@@ -655,4 +189,7 @@ u32 brcmf_get_chip_info(struct brcmf_if *ifp);
 void brcmf_txfinalize(struct brcmf_pub *drvr, struct sk_buff *txp,
                       bool success);
 
+/* Sets dongle media info (drv_version, mac address). */
+int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
+
 #endif                          /* _BRCMF_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
index a6eb09e5d46f..c4535616064e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_bus.h
@@ -17,13 +17,23 @@
 #ifndef _BRCMF_BUS_H_
 #define _BRCMF_BUS_H_
 
+#include "dhd_dbg.h"
+
 /* The level of bus communication with the dongle */
 enum brcmf_bus_state {
+        BRCMF_BUS_UNKNOWN,      /* Not determined yet */
+        BRCMF_BUS_NOMEDIUM,     /* No medium access to dongle */
         BRCMF_BUS_DOWN,         /* Not ready for frame transfers */
         BRCMF_BUS_LOAD,         /* Download access only (CPU reset) */
         BRCMF_BUS_DATA          /* Ready for frame transfers */
 };
 
+/* The level of bus communication with the dongle */
+enum brcmf_bus_protocol_type {
+        BRCMF_PROTO_BCDC,
+        BRCMF_PROTO_MSGBUF
+};
+
 struct brcmf_bus_dcmd {
         char *name;
         char *param;
@@ -34,6 +44,7 @@ struct brcmf_bus_dcmd {
 /**
  * struct brcmf_bus_ops - bus callback operations.
  *
+ * @preinit: execute bus/device specific dongle init commands (optional).
  * @init: prepare for communication with dongle.
  * @stop: clear pending frames, disable data flow.
  * @txdata: send a data frame to the dongle. When the data
@@ -51,6 +62,7 @@ struct brcmf_bus_dcmd {
  * indicated otherwise these callbacks are mandatory.
  */
 struct brcmf_bus_ops {
+        int (*preinit)(struct device *dev);
         int (*init)(struct device *dev);
         void (*stop)(struct device *dev);
         int (*txdata)(struct device *dev, struct sk_buff *skb);
@@ -63,6 +75,7 @@ struct brcmf_bus_ops {
  * struct brcmf_bus - interface structure between common and bus layer
  *
  * @bus_priv: pointer to private bus device.
+ * @proto_type: protocol type, bcdc or msgbuf
  * @dev: device pointer of bus device.
  * @drvr: public driver information.
  * @state: operational state of the bus interface.
@@ -78,6 +91,7 @@ struct brcmf_bus {
                 struct brcmf_sdio_dev *sdio;
                 struct brcmf_usbdev *usb;
         } bus_priv;
+        enum brcmf_bus_protocol_type proto_type;
         struct device *dev;
         struct brcmf_pub *drvr;
         enum brcmf_bus_state state;
@@ -85,7 +99,6 @@ struct brcmf_bus {
         unsigned long tx_realloc;
         u32 chip;
         u32 chiprev;
-        struct list_head dcmd_list;
 
         struct brcmf_bus_ops *ops;
 };
@@ -93,6 +106,13 @@ struct brcmf_bus {
 /*
  * callback wrappers
  */
+static inline int brcmf_bus_preinit(struct brcmf_bus *bus)
+{
+        if (!bus->ops->preinit)
+                return 0;
+        return bus->ops->preinit(bus->dev);
+}
+
 static inline int brcmf_bus_init(struct brcmf_bus *bus)
 {
         return bus->ops->init(bus->dev);
@@ -128,6 +148,23 @@ struct pktq *brcmf_bus_gettxq(struct brcmf_bus *bus)
 
         return bus->ops->gettxq(bus->dev);
 }
+
+static inline bool brcmf_bus_ready(struct brcmf_bus *bus)
+{
+        return bus->state == BRCMF_BUS_LOAD || bus->state == BRCMF_BUS_DATA;
+}
+
+static inline void brcmf_bus_change_state(struct brcmf_bus *bus,
+                                          enum brcmf_bus_state new_state)
+{
+        /* NOMEDIUM is permanent */
+        if (bus->state == BRCMF_BUS_NOMEDIUM)
+                return;
+
+        brcmf_dbg(TRACE, "%d -> %d\n", bus->state, new_state);
+        bus->state = new_state;
+}
+
 /*
  * interface functions from common layer
  */
@@ -139,7 +176,7 @@ bool brcmf_c_prec_enq(struct device *dev, struct pktq *q, struct sk_buff *pkt,
 void brcmf_rx_frame(struct device *dev, struct sk_buff *rxp);
 
 /* Indication from bus module regarding presence/insertion of dongle. */
-int brcmf_attach(uint bus_hdrlen, struct device *dev);
+int brcmf_attach(struct device *dev);
 /* Indication from bus module regarding removal/absence of dongle */
 void brcmf_detach(struct device *dev);
 /* Indication from bus module that dongle should be reset */
@@ -151,6 +188,9 @@ void brcmf_txflowblock(struct device *dev, bool state);
 void brcmf_txcomplete(struct device *dev, struct sk_buff *txp, bool success);
 
 int brcmf_bus_start(struct device *dev);
+s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data,
+                                u32 len);
+void brcmf_bus_add_txhdrlen(struct device *dev, uint len);
 
 #ifdef CONFIG_BRCMFMAC_SDIO
 void brcmf_sdio_exit(void);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
deleted file mode 100644
index dd85401063cb..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_cdc.c
+++ /dev/null
@@ -1,392 +0,0 @@
-/*
- * Copyright (c) 2010 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-/*******************************************************************************
- * Communicates with the dongle by using dcmd codes.
- * For certain dcmd codes, the dongle interprets string data from the host.
- ******************************************************************************/
-
-#include <linux/types.h>
-#include <linux/netdevice.h>
-
-#include <brcmu_utils.h>
-#include <brcmu_wifi.h>
-
-#include "dhd.h"
-#include "dhd_proto.h"
-#include "dhd_bus.h"
-#include "fwsignal.h"
-#include "dhd_dbg.h"
-#include "tracepoint.h"
-
-struct brcmf_proto_cdc_dcmd {
-        __le32 cmd;     /* dongle command value */
-        __le32 len;     /* lower 16: output buflen;
-                         * upper 16: input buflen (excludes header) */
-        __le32 flags;   /* flag defns given below */
-        __le32 status;  /* status code returned from the device */
-};
-
-/* Max valid buffer size that can be sent to the dongle */
-#define CDC_MAX_MSG_SIZE        (ETH_FRAME_LEN+ETH_FCS_LEN)
-
-/* CDC flag definitions */
-#define CDC_DCMD_ERROR          0x01    /* 1=cmd failed */
-#define CDC_DCMD_SET            0x02    /* 0=get, 1=set cmd */
-#define CDC_DCMD_IF_MASK        0xF000          /* I/F index */
-#define CDC_DCMD_IF_SHIFT       12
-#define CDC_DCMD_ID_MASK        0xFFFF0000      /* id an cmd pairing */
-#define CDC_DCMD_ID_SHIFT       16              /* ID Mask shift bits */
-#define CDC_DCMD_ID(flags)      \
-        (((flags) & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT)
-
-/*
- * BDC header - Broadcom specific extension of CDC.
- * Used on data packets to convey priority across USB.
- */
-#define BDC_HEADER_LEN          4
-#define BDC_PROTO_VER           2       /* Protocol version */
-#define BDC_FLAG_VER_MASK       0xf0    /* Protocol version mask */
-#define BDC_FLAG_VER_SHIFT      4       /* Protocol version shift */
-#define BDC_FLAG_SUM_GOOD       0x04    /* Good RX checksums */
-#define BDC_FLAG_SUM_NEEDED     0x08    /* Dongle needs to do TX checksums */
-#define BDC_PRIORITY_MASK       0x7
-#define BDC_FLAG2_IF_MASK       0x0f    /* packet rx interface in APSTA */
-#define BDC_FLAG2_IF_SHIFT      0
-
-#define BDC_GET_IF_IDX(hdr) \
-        ((int)((((hdr)->flags2) & BDC_FLAG2_IF_MASK) >> BDC_FLAG2_IF_SHIFT))
-#define BDC_SET_IF_IDX(hdr, idx) \
-        ((hdr)->flags2 = (((hdr)->flags2 & ~BDC_FLAG2_IF_MASK) | \
-        ((idx) << BDC_FLAG2_IF_SHIFT)))
-
-/**
- * struct brcmf_proto_bdc_header - BDC header format
- *
- * @flags: flags contain protocol and checksum info.
- * @priority: 802.1d priority and USB flow control info (bit 4:7).
- * @flags2: additional flags containing dongle interface index.
- * @data_offset: start of packet data. header is following by firmware signals.
- */
-struct brcmf_proto_bdc_header {
-        u8 flags;
-        u8 priority;
-        u8 flags2;
-        u8 data_offset;
-};
-
-/*
- * maximum length of firmware signal data between
- * the BDC header and packet data in the tx path.
- */
-#define BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES        12
-
-#define RETRIES 2 /* # of retries to retrieve matching dcmd response */
-#define BUS_HEADER_LEN  (16+64)         /* Must be atleast SDPCM_RESERVE
-                                         * (amount of header tha might be added)
-                                         * plus any space that might be needed
-                                         * for bus alignment padding.
-                                         */
-#define ROUND_UP_MARGIN 2048    /* Biggest bus block size possible for
-                                 * round off at the end of buffer
-                                 * Currently is SDIO
-                                 */
-
-struct brcmf_proto {
-        u16 reqid;
-        u8 bus_header[BUS_HEADER_LEN];
-        struct brcmf_proto_cdc_dcmd msg;
-        unsigned char buf[BRCMF_DCMD_MAXLEN + ROUND_UP_MARGIN];
-};
-
-static int brcmf_proto_cdc_msg(struct brcmf_pub *drvr)
-{
-        struct brcmf_proto *prot = drvr->prot;
-        int len = le32_to_cpu(prot->msg.len) +
-                        sizeof(struct brcmf_proto_cdc_dcmd);
-
-        brcmf_dbg(CDC, "Enter\n");
-
-        /* NOTE : cdc->msg.len holds the desired length of the buffer to be
-         *        returned. Only up to CDC_MAX_MSG_SIZE of this buffer area
-         *        is actually sent to the dongle
-         */
-        if (len > CDC_MAX_MSG_SIZE)
-                len = CDC_MAX_MSG_SIZE;
-
-        /* Send request */
-        return brcmf_bus_txctl(drvr->bus_if, (unsigned char *)&prot->msg, len);
-}
-
-static int brcmf_proto_cdc_cmplt(struct brcmf_pub *drvr, u32 id, u32 len)
-{
-        int ret;
-        struct brcmf_proto *prot = drvr->prot;
-
-        brcmf_dbg(CDC, "Enter\n");
-        len += sizeof(struct brcmf_proto_cdc_dcmd);
-        do {
-                ret = brcmf_bus_rxctl(drvr->bus_if, (unsigned char *)&prot->msg,
-                                      len);
-                if (ret < 0)
-                        break;
-        } while (CDC_DCMD_ID(le32_to_cpu(prot->msg.flags)) != id);
-
-        return ret;
-}
-
-int
-brcmf_proto_cdc_query_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
-                               void *buf, uint len)
-{
-        struct brcmf_proto *prot = drvr->prot;
-        struct brcmf_proto_cdc_dcmd *msg = &prot->msg;
-        void *info;
-        int ret = 0, retries = 0;
-        u32 id, flags;
-
-        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
-
-        memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
-
-        msg->cmd = cpu_to_le32(cmd);
-        msg->len = cpu_to_le32(len);
-        flags = (++prot->reqid << CDC_DCMD_ID_SHIFT);
-        flags = (flags & ~CDC_DCMD_IF_MASK) |
-                (ifidx << CDC_DCMD_IF_SHIFT);
-        msg->flags = cpu_to_le32(flags);
-
-        if (buf)
-                memcpy(prot->buf, buf, len);
-
-        ret = brcmf_proto_cdc_msg(drvr);
-        if (ret < 0) {
-                brcmf_err("brcmf_proto_cdc_msg failed w/status %d\n",
-                          ret);
-                goto done;
-        }
-
-retry:
-        /* wait for interrupt and get first fragment */
-        ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
-        if (ret < 0)
-                goto done;
-
-        flags = le32_to_cpu(msg->flags);
-        id = (flags & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT;
-
-        if ((id < prot->reqid) && (++retries < RETRIES))
-                goto retry;
-        if (id != prot->reqid) {
-                brcmf_err("%s: unexpected request id %d (expected %d)\n",
-                          brcmf_ifname(drvr, ifidx), id, prot->reqid);
-                ret = -EINVAL;
-                goto done;
-        }
-
-        /* Check info buffer */
-        info = (void *)&msg[1];
-
-        /* Copy info buffer */
-        if (buf) {
-                if (ret < (int)len)
-                        len = ret;
-                memcpy(buf, info, len);
-        }
-
-        /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR)
-                ret = le32_to_cpu(msg->status);
-
-done:
-        return ret;
-}
-
-int brcmf_proto_cdc_set_dcmd(struct brcmf_pub *drvr, int ifidx, uint cmd,
-                                 void *buf, uint len)
-{
-        struct brcmf_proto *prot = drvr->prot;
-        struct brcmf_proto_cdc_dcmd *msg = &prot->msg;
-        int ret = 0;
-        u32 flags, id;
-
-        brcmf_dbg(CDC, "Enter, cmd %d len %d\n", cmd, len);
-
-        memset(msg, 0, sizeof(struct brcmf_proto_cdc_dcmd));
-
-        msg->cmd = cpu_to_le32(cmd);
-        msg->len = cpu_to_le32(len);
-        flags = (++prot->reqid << CDC_DCMD_ID_SHIFT) | CDC_DCMD_SET;
-        flags = (flags & ~CDC_DCMD_IF_MASK) |
-                (ifidx << CDC_DCMD_IF_SHIFT);
-        msg->flags = cpu_to_le32(flags);
-
-        if (buf)
-                memcpy(prot->buf, buf, len);
-
-        ret = brcmf_proto_cdc_msg(drvr);
-        if (ret < 0)
-                goto done;
-
-        ret = brcmf_proto_cdc_cmplt(drvr, prot->reqid, len);
-        if (ret < 0)
-                goto done;
-
-        flags = le32_to_cpu(msg->flags);
-        id = (flags & CDC_DCMD_ID_MASK) >> CDC_DCMD_ID_SHIFT;
-
-        if (id != prot->reqid) {
-                brcmf_err("%s: unexpected request id %d (expected %d)\n",
-                          brcmf_ifname(drvr, ifidx), id, prot->reqid);
-                ret = -EINVAL;
-                goto done;
-        }
-
-        /* Check the ERROR flag */
-        if (flags & CDC_DCMD_ERROR)
-                ret = le32_to_cpu(msg->status);
-
-done:
-        return ret;
-}
-
-static bool pkt_sum_needed(struct sk_buff *skb)
-{
-        return skb->ip_summed == CHECKSUM_PARTIAL;
-}
-
-static void pkt_set_sum_good(struct sk_buff *skb, bool x)
-{
-        skb->ip_summed = (x ? CHECKSUM_UNNECESSARY : CHECKSUM_NONE);
-}
-
-void brcmf_proto_hdrpush(struct brcmf_pub *drvr, int ifidx, u8 offset,
-                         struct sk_buff *pktbuf)
-{
-        struct brcmf_proto_bdc_header *h;
-
-        brcmf_dbg(CDC, "Enter\n");
-
-        /* Push BDC header used to convey priority for buses that don't */
-        skb_push(pktbuf, BDC_HEADER_LEN);
-
-        h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
-
-        h->flags = (BDC_PROTO_VER << BDC_FLAG_VER_SHIFT);
-        if (pkt_sum_needed(pktbuf))
-                h->flags |= BDC_FLAG_SUM_NEEDED;
-
-        h->priority = (pktbuf->priority & BDC_PRIORITY_MASK);
-        h->flags2 = 0;
-        h->data_offset = offset;
-        BDC_SET_IF_IDX(h, ifidx);
-        trace_brcmf_bdchdr(pktbuf->data);
-}
-
-int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
-                        struct sk_buff *pktbuf)
-{
-        struct brcmf_proto_bdc_header *h;
-
-        brcmf_dbg(CDC, "Enter\n");
-
-        /* Pop BDC header used to convey priority for buses that don't */
-
-        if (pktbuf->len <= BDC_HEADER_LEN) {
-                brcmf_dbg(INFO, "rx data too short (%d <= %d)\n",
-                          pktbuf->len, BDC_HEADER_LEN);
-                return -EBADE;
-        }
-
-        trace_brcmf_bdchdr(pktbuf->data);
-        h = (struct brcmf_proto_bdc_header *)(pktbuf->data);
-
-        *ifidx = BDC_GET_IF_IDX(h);
-        if (*ifidx >= BRCMF_MAX_IFS) {
-                brcmf_err("rx data ifnum out of range (%d)\n", *ifidx);
-                return -EBADE;
-        }
-        /* The ifidx is the idx to map to matching netdev/ifp. When receiving
-         * events this is easy because it contains the bssidx which maps
-         * 1-on-1 to the netdev/ifp. But for data frames the ifidx is rcvd.
-         * bssidx 1 is used for p2p0 and no data can be received or
-         * transmitted on it. Therefor bssidx is ifidx + 1 if ifidx > 0
-         */
-        if (*ifidx)
-                (*ifidx)++;
-
-        if (((h->flags & BDC_FLAG_VER_MASK) >> BDC_FLAG_VER_SHIFT) !=
-            BDC_PROTO_VER) {
-                brcmf_err("%s: non-BDC packet received, flags 0x%x\n",
-                          brcmf_ifname(drvr, *ifidx), h->flags);
-                return -EBADE;
-        }
-
-        if (h->flags & BDC_FLAG_SUM_GOOD) {
-                brcmf_dbg(CDC, "%s: BDC rcv, good checksum, flags 0x%x\n",
-                          brcmf_ifname(drvr, *ifidx), h->flags);
-                pkt_set_sum_good(pktbuf, true);
-        }
-
-        pktbuf->priority = h->priority & BDC_PRIORITY_MASK;
-
-        skb_pull(pktbuf, BDC_HEADER_LEN);
-        if (do_fws)
-                brcmf_fws_hdrpull(drvr, *ifidx, h->data_offset << 2, pktbuf);
-        else
-                skb_pull(pktbuf, h->data_offset << 2);
-
-        if (pktbuf->len == 0)
-                return -ENODATA;
-        return 0;
-}
-
-int brcmf_proto_attach(struct brcmf_pub *drvr)
-{
-        struct brcmf_proto *cdc;
-
-        cdc = kzalloc(sizeof(struct brcmf_proto), GFP_ATOMIC);
-        if (!cdc)
-                goto fail;
-
-        /* ensure that the msg buf directly follows the cdc msg struct */
-        if ((unsigned long)(&cdc->msg + 1) != (unsigned long)cdc->buf) {
-                brcmf_err("struct brcmf_proto is not correctly defined\n");
-                goto fail;
-        }
-
-        drvr->prot = cdc;
-        drvr->hdrlen += BDC_HEADER_LEN + BRCMF_PROT_FW_SIGNAL_MAX_TXBYTES;
-        drvr->bus_if->maxctl = BRCMF_DCMD_MAXLEN +
-                        sizeof(struct brcmf_proto_cdc_dcmd) + ROUND_UP_MARGIN;
-        return 0;
-
-fail:
-        kfree(cdc);
-        return -ENOMEM;
-}
-
-/* ~NOTE~ What if another thread is waiting on the semaphore?  Holding it? */
-void brcmf_proto_detach(struct brcmf_pub *drvr)
-{
-        kfree(drvr->prot);
-        drvr->prot = NULL;
-}
-
-void brcmf_proto_stop(struct brcmf_pub *drvr)
-{
-        /* Nothing to do for CDC */
-}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
index 9431af2465f3..6a8983a1fb9c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_common.c
@@ -21,9 +21,9 @@
 #include <brcmu_utils.h>
 #include "dhd.h"
 #include "dhd_bus.h"
-#include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "fwil.h"
+#include "fwil_types.h"
 #include "tracepoint.h"
 
 #define PKTFILTER_BUF_SIZE              128
@@ -32,15 +32,6 @@
 #define BRCMF_DEFAULT_SCAN_UNASSOC_TIME 40
 #define BRCMF_DEFAULT_PACKET_FILTER     "100 0 0 0 0x01 0x00"
 
-#ifdef DEBUG
-static const char brcmf_version[] =
-        "Dongle Host Driver, version " BRCMF_VERSION_STR "\nCompiled on "
-        __DATE__ " at " __TIME__;
-#else
-static const char brcmf_version[] =
-        "Dongle Host Driver, version " BRCMF_VERSION_STR;
-#endif
-
 
 bool brcmf_c_prec_enq(struct device *dev, struct pktq *q,
                       struct sk_buff *pkt, int prec)
@@ -257,8 +248,6 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         u8 buf[BRCMF_DCMD_SMLEN];
         char *ptr;
         s32 err;
-        struct brcmf_bus_dcmd *cmdlst;
-        struct list_head *cur, *q;
 
         /* retreive mac address */
         err = brcmf_fil_iovar_data_get(ifp, "cur_etheraddr", ifp->mac_addr,
@@ -281,9 +270,14 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         }
         ptr = (char *)buf;
         strsep(&ptr, "\n");
+
         /* Print fw version info */
         brcmf_err("Firmware version = %s\n", buf);
 
+        /* locate firmware version number for ethtool */
+        ptr = strrchr(buf, ' ') + 1;
+        strlcpy(ifp->drvr->fwver, ptr, sizeof(ifp->drvr->fwver));
+
         /*
          * Setup timeout if Beacons are lost and roam is off to report
          * link down
@@ -342,17 +336,8 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp)
         brcmf_c_pktfilter_offload_enable(ifp, BRCMF_DEFAULT_PACKET_FILTER,
                                          0, true);
 
-        /* set bus specific command if there is any */
-        list_for_each_safe(cur, q, &ifp->drvr->bus_if->dcmd_list) {
-                cmdlst = list_entry(cur, struct brcmf_bus_dcmd, list);
-                if (cmdlst->name && cmdlst->param && cmdlst->param_len) {
-                        brcmf_fil_iovar_data_set(ifp, cmdlst->name,
-                                                 cmdlst->param,
-                                                 cmdlst->param_len);
-                }
-                list_del(cur);
-                kfree(cmdlst);
-        }
+        /* do bus specific preinit here */
+        err = brcmf_bus_preinit(ifp->drvr->bus_if);
 done:
         return err;
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
index 0f9e9057e7dd..03fe8aca4d32 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.c
@@ -22,7 +22,6 @@
 #include "dhd.h"
 #include "dhd_bus.h"
 #include "dhd_dbg.h"
-#include "tracepoint.h"
 
 static struct dentry *root_folder;
 
@@ -42,6 +41,40 @@ void brcmf_debugfs_exit(void)
         root_folder = NULL;
 }
 
+static
+ssize_t brcmf_debugfs_chipinfo_read(struct file *f, char __user *data,
+                                   size_t count, loff_t *ppos)
+{
+        struct brcmf_pub *drvr = f->private_data;
+        struct brcmf_bus *bus = drvr->bus_if;
+        char buf[40];
+        int res;
+
+        /* only allow read from start */
+        if (*ppos > 0)
+                return 0;
+
+        res = scnprintf(buf, sizeof(buf), "chip: %x(%u) rev %u\n",
+                        bus->chip, bus->chip, bus->chiprev);
+        return simple_read_from_buffer(data, count, ppos, buf, res);
+}
+
+static const struct file_operations brcmf_debugfs_chipinfo_ops = {
+        .owner = THIS_MODULE,
+        .open = simple_open,
+        .read = brcmf_debugfs_chipinfo_read
+};
+
+static int brcmf_debugfs_create_chipinfo(struct brcmf_pub *drvr)
+{
+        struct dentry *dentry =  drvr->dbgfs_dir;
+
+        if (!IS_ERR_OR_NULL(dentry))
+                debugfs_create_file("chipinfo", S_IRUGO, dentry, drvr,
+                                    &brcmf_debugfs_chipinfo_ops);
+        return 0;
+}
+
 int brcmf_debugfs_attach(struct brcmf_pub *drvr)
 {
         struct device *dev = drvr->bus_if->dev;
@@ -50,6 +83,7 @@ int brcmf_debugfs_attach(struct brcmf_pub *drvr)
                 return -ENODEV;
 
         drvr->dbgfs_dir = debugfs_create_dir(dev_name(dev), root_folder);
+        brcmf_debugfs_create_chipinfo(drvr);
         return PTR_ERR_OR_ZERO(drvr->dbgfs_dir);
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
index 0af1f5dc583a..ef52ed7abc69 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_dbg.h
@@ -33,7 +33,7 @@
 #define BRCMF_USB_VAL   0x00002000
 #define BRCMF_SCAN_VAL  0x00004000
 #define BRCMF_CONN_VAL  0x00008000
-#define BRCMF_CDC_VAL   0x00010000
+#define BRCMF_BCDC_VAL  0x00010000
 #define BRCMF_SDIO_VAL  0x00020000
 
 /* set default print format */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
index 64e9cff241b9..d4d966beb840 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_linux.c
@@ -24,13 +24,13 @@
 
 #include "dhd.h"
 #include "dhd_bus.h"
-#include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "fwil_types.h"
 #include "p2p.h"
 #include "wl_cfg80211.h"
 #include "fwil.h"
 #include "fwsignal.h"
+#include "proto.h"
 
 MODULE_AUTHOR("Broadcom Corporation");
 MODULE_DESCRIPTION("Broadcom 802.11 wireless LAN fullmac driver.");
@@ -592,28 +592,6 @@ static struct net_device_stats *brcmf_netdev_get_stats(struct net_device *ndev)
         return &ifp->stats;
 }
 
-/*
- * Set current toe component enables in toe_ol iovar,
- * and set toe global enable iovar
- */
-static int brcmf_toe_set(struct brcmf_if *ifp, u32 toe_ol)
-{
-        s32 err;
-
-        err = brcmf_fil_iovar_int_set(ifp, "toe_ol", toe_ol);
-        if (err < 0) {
-                brcmf_err("Setting toe_ol failed, %d\n", err);
-                return err;
-        }
-
-        err = brcmf_fil_iovar_int_set(ifp, "toe", (toe_ol != 0));
-        if (err < 0)
-                brcmf_err("Setting toe failed, %d\n", err);
-
-        return err;
-
-}
-
 static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
                                     struct ethtool_drvinfo *info)
 {
@@ -621,8 +599,8 @@ static void brcmf_ethtool_get_drvinfo(struct net_device *ndev,
         struct brcmf_pub *drvr = ifp->drvr;
 
         strlcpy(info->driver, KBUILD_MODNAME, sizeof(info->driver));
-        snprintf(info->version, sizeof(info->version), "%lu",
-                 drvr->drv_version);
+        snprintf(info->version, sizeof(info->version), "n/a");
+        strlcpy(info->fw_version, drvr->fwver, sizeof(info->fw_version));
         strlcpy(info->bus_info, dev_name(drvr->bus_if->dev),
                 sizeof(info->bus_info));
 }
@@ -631,124 +609,6 @@ static const struct ethtool_ops brcmf_ethtool_ops = {
         .get_drvinfo = brcmf_ethtool_get_drvinfo,
 };
 
-static int brcmf_ethtool(struct brcmf_if *ifp, void __user *uaddr)
-{
-        struct brcmf_pub *drvr = ifp->drvr;
-        struct ethtool_drvinfo info;
-        char drvname[sizeof(info.driver)];
-        u32 cmd;
-        struct ethtool_value edata;
-        u32 toe_cmpnt, csum_dir;
-        int ret;
-
-        brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
-
-        /* all ethtool calls start with a cmd word */
-        if (copy_from_user(&cmd, uaddr, sizeof(u32)))
-                return -EFAULT;
-
-        switch (cmd) {
-        case ETHTOOL_GDRVINFO:
-                /* Copy out any request driver name */
-                if (copy_from_user(&info, uaddr, sizeof(info)))
-                        return -EFAULT;
-                strncpy(drvname, info.driver, sizeof(info.driver));
-                drvname[sizeof(info.driver) - 1] = '\0';
-
-                /* clear struct for return */
-                memset(&info, 0, sizeof(info));
-                info.cmd = cmd;
-
-                /* if requested, identify ourselves */
-                if (strcmp(drvname, "?dhd") == 0) {
-                        sprintf(info.driver, "dhd");
-                        strcpy(info.version, BRCMF_VERSION_STR);
-                }
-                /* report dongle driver type */
-                else
-                        sprintf(info.driver, "wl");
-
-                sprintf(info.version, "%lu", drvr->drv_version);
-                if (copy_to_user(uaddr, &info, sizeof(info)))
-                        return -EFAULT;
-                brcmf_dbg(TRACE, "given %*s, returning %s\n",
-                          (int)sizeof(drvname), drvname, info.driver);
-                break;
-
-                /* Get toe offload components from dongle */
-        case ETHTOOL_GRXCSUM:
-        case ETHTOOL_GTXCSUM:
-                ret = brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_cmpnt);
-                if (ret < 0)
-                        return ret;
-
-                csum_dir =
-                    (cmd == ETHTOOL_GTXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
-
-                edata.cmd = cmd;
-                edata.data = (toe_cmpnt & csum_dir) ? 1 : 0;
-
-                if (copy_to_user(uaddr, &edata, sizeof(edata)))
-                        return -EFAULT;
-                break;
-
-                /* Set toe offload components in dongle */
-        case ETHTOOL_SRXCSUM:
-        case ETHTOOL_STXCSUM:
-                if (copy_from_user(&edata, uaddr, sizeof(edata)))
-                        return -EFAULT;
-
-                /* Read the current settings, update and write back */
-                ret = brcmf_fil_iovar_int_get(ifp, "toe_ol", &toe_cmpnt);
-                if (ret < 0)
-                        return ret;
-
-                csum_dir =
-                    (cmd == ETHTOOL_STXCSUM) ? TOE_TX_CSUM_OL : TOE_RX_CSUM_OL;
-
-                if (edata.data != 0)
-                        toe_cmpnt |= csum_dir;
-                else
-                        toe_cmpnt &= ~csum_dir;
-
-                ret = brcmf_toe_set(ifp, toe_cmpnt);
-                if (ret < 0)
-                        return ret;
-
-                /* If setting TX checksum mode, tell Linux the new mode */
-                if (cmd == ETHTOOL_STXCSUM) {
-                        if (edata.data)
-                                ifp->ndev->features |= NETIF_F_IP_CSUM;
-                        else
-                                ifp->ndev->features &= ~NETIF_F_IP_CSUM;
-                }
-
-                break;
-
-        default:
-                return -EOPNOTSUPP;
-        }
-
-        return 0;
-}
-
-static int brcmf_netdev_ioctl_entry(struct net_device *ndev, struct ifreq *ifr,
-                                    int cmd)
-{
-        struct brcmf_if *ifp = netdev_priv(ndev);
-        struct brcmf_pub *drvr = ifp->drvr;
-
-        brcmf_dbg(TRACE, "Enter, idx=%d, cmd=0x%04x\n", ifp->bssidx, cmd);
-
-        if (!drvr->iflist[ifp->bssidx])
-                return -1;
-
-        if (cmd == SIOCETHTOOL)
-                return brcmf_ethtool(ifp, ifr->ifr_data);
-
-        return -EOPNOTSUPP;
-}
-
 static int brcmf_netdev_stop(struct net_device *ndev)
 {
         struct brcmf_if *ifp = netdev_priv(ndev);
@@ -769,7 +629,6 @@ static int brcmf_netdev_open(struct net_device *ndev)
         struct brcmf_pub *drvr = ifp->drvr;
         struct brcmf_bus *bus_if = drvr->bus_if;
         u32 toe_ol;
-        s32 ret = 0;
 
         brcmf_dbg(TRACE, "Enter, idx=%d\n", ifp->bssidx);
 
@@ -788,21 +647,20 @@ static int brcmf_netdev_open(struct net_device *ndev)
         else
                 ndev->features &= ~NETIF_F_IP_CSUM;
 
-        /* Allow transmit calls */
-        netif_start_queue(ndev);
         if (brcmf_cfg80211_up(ndev)) {
                 brcmf_err("failed to bring up cfg80211\n");
-                return -1;
+                return -EIO;
         }
 
-        return ret;
+        /* Allow transmit calls */
+        netif_start_queue(ndev);
+        return 0;
 }
 
 static const struct net_device_ops brcmf_netdev_ops_pri = {
         .ndo_open = brcmf_netdev_open,
         .ndo_stop = brcmf_netdev_stop,
         .ndo_get_stats = brcmf_netdev_get_stats,
-        .ndo_do_ioctl = brcmf_netdev_ioctl_entry,
         .ndo_start_xmit = brcmf_netdev_start_xmit,
         .ndo_set_mac_address = brcmf_netdev_set_mac_address,
         .ndo_set_rx_mode = brcmf_netdev_set_multicast_list
@@ -844,7 +702,7 @@ int brcmf_net_attach(struct brcmf_if *ifp, bool rtnl_locked)
 
         brcmf_dbg(INFO, "%s: Broadcom Dongle Host Driver\n", ndev->name);
 
-        ndev->destructor = free_netdev;
+        ndev->destructor = brcmf_cfg80211_free_netdev;
         return 0;
 
 fail:
@@ -868,13 +726,6 @@ static int brcmf_net_p2p_stop(struct net_device *ndev)
         return brcmf_cfg80211_down(ndev);
 }
 
-static int brcmf_net_p2p_do_ioctl(struct net_device *ndev,
-                                  struct ifreq *ifr, int cmd)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-        return 0;
-}
-
 static netdev_tx_t brcmf_net_p2p_start_xmit(struct sk_buff *skb,
                                             struct net_device *ndev)
 {
@@ -887,7 +738,6 @@ static netdev_tx_t brcmf_net_p2p_start_xmit(struct sk_buff *skb,
 static const struct net_device_ops brcmf_netdev_ops_p2p = {
         .ndo_open = brcmf_net_p2p_open,
         .ndo_stop = brcmf_net_p2p_stop,
-        .ndo_do_ioctl = brcmf_net_p2p_do_ioctl,
         .ndo_start_xmit = brcmf_net_p2p_start_xmit
 };
 
@@ -1009,14 +859,12 @@ void brcmf_del_if(struct brcmf_pub *drvr, s32 bssidx)
                 }
                 /* unregister will take care of freeing it */
                 unregister_netdev(ifp->ndev);
-                if (bssidx == 0)
-                        brcmf_cfg80211_detach(drvr->config);
         } else {
                 kfree(ifp);
         }
 }
 
-int brcmf_attach(uint bus_hdrlen, struct device *dev)
+int brcmf_attach(struct device *dev)
 {
         struct brcmf_pub *drvr = NULL;
         int ret = 0;
@@ -1031,7 +879,7 @@ int brcmf_attach(uint bus_hdrlen, struct device *dev)
         mutex_init(&drvr->proto_block);
 
         /* Link to bus module */
-        drvr->hdrlen = bus_hdrlen;
+        drvr->hdrlen = 0;
         drvr->bus_if = dev_get_drvdata(dev);
         drvr->bus_if->drvr = drvr;
 
@@ -1048,8 +896,6 @@ int brcmf_attach(uint bus_hdrlen, struct device *dev)
         /* attach firmware event handler */
         brcmf_fweh_attach(drvr);
 
-        INIT_LIST_HEAD(&drvr->bus_if->dcmd_list);
-
         return ret;
 
 fail:
@@ -1088,7 +934,7 @@ int brcmf_bus_start(struct device *dev)
                 p2p_ifp = NULL;
 
         /* signal bus ready */
-        bus_if->state = BRCMF_BUS_DATA;
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_DATA);
 
         /* Bus is ready, do any initialization */
         ret = brcmf_c_preinit_dcmds(ifp);
@@ -1115,8 +961,7 @@ int brcmf_bus_start(struct device *dev)
 fail:
         if (ret < 0) {
                 brcmf_err("failed: %d\n", ret);
-                if (drvr->config)
-                        brcmf_cfg80211_detach(drvr->config);
+                brcmf_cfg80211_detach(drvr->config);
                 if (drvr->fws) {
                         brcmf_fws_del_interface(ifp);
                         brcmf_fws_deinit(drvr);
@@ -1138,14 +983,21 @@ fail:
         return 0;
 }
 
+void brcmf_bus_add_txhdrlen(struct device *dev, uint len)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_pub *drvr = bus_if->drvr;
+
+        if (drvr) {
+                drvr->hdrlen += len;
+        }
+}
+
 static void brcmf_bus_detach(struct brcmf_pub *drvr)
 {
         brcmf_dbg(TRACE, "Enter\n");
 
         if (drvr) {
-                /* Stop the protocol module */
-                brcmf_proto_stop(drvr);
-
                 /* Stop the bus module */
                 brcmf_bus_stop(drvr->bus_if);
         }
@@ -1177,6 +1029,8 @@ void brcmf_detach(struct device *dev)
         /* stop firmware event handling */
         brcmf_fweh_detach(drvr);
 
+        brcmf_bus_change_state(bus_if, BRCMF_BUS_DOWN);
+
         /* make sure primary interface removed last */
         for (i = BRCMF_MAX_IFS-1; i > -1; i--)
                 if (drvr->iflist[i]) {
@@ -1184,10 +1038,11 @@ void brcmf_detach(struct device *dev)
                         brcmf_del_if(drvr, i);
                 }
 
+        brcmf_cfg80211_detach(drvr->config);
+
         brcmf_bus_detach(drvr);
 
-        if (drvr->prot)
-                brcmf_proto_detach(drvr);
+        brcmf_proto_detach(drvr);
 
         brcmf_fws_deinit(drvr);
 
@@ -1196,6 +1051,14 @@ void brcmf_detach(struct device *dev)
         kfree(drvr);
 }
 
+s32 brcmf_iovar_data_set(struct device *dev, char *name, void *data, u32 len)
+{
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_if *ifp = bus_if->drvr->iflist[0];
+
+        return brcmf_fil_iovar_data_set(ifp, name, data, len);
+}
+
 static int brcmf_get_pend_8021x_cnt(struct brcmf_if *ifp)
 {
         return atomic_read(&ifp->pend_8021x_cnt);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h b/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
deleted file mode 100644
index 53c6e710f2cb..000000000000
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_proto.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (c) 2010 Broadcom Corporation
- *
- * Permission to use, copy, modify, and/or distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
- * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#ifndef _BRCMF_PROTO_H_
-#define _BRCMF_PROTO_H_
-
-/*
- * Exported from the brcmf protocol module (brcmf_cdc)
- */
-
-/* Linkage, sets prot link and updates hdrlen in pub */
-int brcmf_proto_attach(struct brcmf_pub *drvr);
-
-/* Unlink, frees allocated protocol memory (including brcmf_proto) */
-void brcmf_proto_detach(struct brcmf_pub *drvr);
-
-/* Stop protocol: sync w/dongle state. */
-void brcmf_proto_stop(struct brcmf_pub *drvr);
-
-/* Add any protocol-specific data header.
- * Caller must reserve prot_hdrlen prepend space.
- */
-void brcmf_proto_hdrpush(struct brcmf_pub *, int ifidx, u8 offset,
-                         struct sk_buff *txp);
-
-/* Sets dongle media info (drv_version, mac address). */
-int brcmf_c_preinit_dcmds(struct brcmf_if *ifp);
-
-#endif                          /* _BRCMF_PROTO_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index b02953c4ade7..3e991897d7ca 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -32,6 +32,7 @@
 #include <linux/debugfs.h>
 #include <linux/vmalloc.h>
 #include <linux/platform_data/brcmfmac-sdio.h>
+#include <linux/moduleparam.h>
 #include <asm/unaligned.h>
 #include <defs.h>
 #include <brcmu_wifi.h>
@@ -40,6 +41,7 @@
 #include <soc.h>
 #include "sdio_host.h"
 #include "sdio_chip.h"
+#include "nvram.h"
 
 #define DCMD_RESP_TIMEOUT  2000 /* In milli second */
 
@@ -110,6 +112,8 @@ struct rte_console {
 #define BRCMF_TXBOUND   20      /* Default for max tx frames in
                                  one scheduling */
 
+#define BRCMF_DEFAULT_TXGLOM_SIZE       32  /* max tx frames in glom chain */
+
 #define BRCMF_TXMINMAX  1       /* Max tx frames if rx still pending */
 
 #define MEMBLOCK        2048    /* Block size used for downloading
@@ -257,9 +261,6 @@ struct rte_console {
 #define MAX_HDR_READ    (1 << 6)
 #define MAX_RX_DATASZ   2048
 
-/* Maximum milliseconds to wait for F2 to come up */
-#define BRCMF_WAIT_F2RDY        3000
-
 /* Bump up limit on waiting for HT to account for first startup;
  * if the image is doing a CRC calculation before programming the PMU
  * for HT availability, it could take a couple hundred ms more, so
@@ -360,15 +361,15 @@ struct brcmf_sdio_hdrinfo {
         u16 len_left;
         u16 len_nxtfrm;
         u8 dat_offset;
+        bool lastfrm;
+        u16 tail_pad;
 };
 
 /* misc chip info needed by some of the routines */
 /* Private data for SDIO bus interaction */
 struct brcmf_sdio {
         struct brcmf_sdio_dev *sdiodev; /* sdio device handler */
-        struct chip_info *ci;   /* Chip info struct */
-        char *vars;             /* Variables (from CIS and/or other) */
-        uint varsz;             /* Size of variables buffer */
+        struct brcmf_chip *ci;  /* Chip info struct */
 
         u32 ramsize;            /* Size of RAM in SOCRAM (bytes) */
 
@@ -384,7 +385,7 @@ struct brcmf_sdio {
         u8 tx_seq;              /* Transmit sequence number (next) */
         u8 tx_max;              /* Maximum transmit sequence allowed */
 
-        u8 hdrbuf[MAX_HDR_READ + BRCMF_SDALIGN];
+        u8 *hdrbuf;             /* buffer for handling rx frame */
         u8 *rxhdr;              /* Header of current rx frame (in hdrbuf) */
         u8 rx_seq;              /* Receive sequence number (expected) */
         struct brcmf_sdio_hdrinfo cur_read;
@@ -455,6 +456,10 @@ struct brcmf_sdio {
         bool sleeping; /* SDIO bus sleeping */
 
         u8 tx_hdrlen;           /* sdio bus header length for tx packet */
+        bool txglom;            /* host tx glomming enable flag */
+        struct sk_buff *txglom_sgpad;   /* scatter-gather padding buffer */
+        u16 head_align;         /* buffer pointer alignment */
+        u16 sgentry_align;      /* scatter-gather buffer alignment */
 };
 
 /* clkstate */
@@ -479,6 +484,10 @@ static const uint max_roundup = 512;
 
 #define ALIGNMENT  4
 
+static int brcmf_sdio_txglomsz = BRCMF_DEFAULT_TXGLOM_SIZE;
+module_param_named(txglomsz, brcmf_sdio_txglomsz, int, 0);
+MODULE_PARM_DESC(txglomsz, "maximum tx packet chain size [SDIO]");
+
 enum brcmf_sdio_frmtype {
         BRCMF_SDIO_FT_NORMAL,
         BRCMF_SDIO_FT_SUPER,
@@ -499,6 +508,10 @@ enum brcmf_sdio_frmtype {
 #define BCM4334_NVRAM_NAME              "brcm/brcmfmac4334-sdio.txt"
 #define BCM4335_FIRMWARE_NAME           "brcm/brcmfmac4335-sdio.bin"
 #define BCM4335_NVRAM_NAME              "brcm/brcmfmac4335-sdio.txt"
+#define BCM43362_FIRMWARE_NAME          "brcm/brcmfmac43362-sdio.bin"
+#define BCM43362_NVRAM_NAME             "brcm/brcmfmac43362-sdio.txt"
+#define BCM4339_FIRMWARE_NAME           "brcm/brcmfmac4339-sdio.bin"
+#define BCM4339_NVRAM_NAME              "brcm/brcmfmac4339-sdio.txt"
 
 MODULE_FIRMWARE(BCM43143_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM43143_NVRAM_NAME);
@@ -514,6 +527,10 @@ MODULE_FIRMWARE(BCM4334_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4334_NVRAM_NAME);
 MODULE_FIRMWARE(BCM4335_FIRMWARE_NAME);
 MODULE_FIRMWARE(BCM4335_NVRAM_NAME);
+MODULE_FIRMWARE(BCM43362_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM43362_NVRAM_NAME);
+MODULE_FIRMWARE(BCM4339_FIRMWARE_NAME);
+MODULE_FIRMWARE(BCM4339_NVRAM_NAME);
 
 struct brcmf_firmware_names {
         u32 chipid;
@@ -537,11 +554,13 @@ static const struct brcmf_firmware_names brcmf_fwname_data[] = {
         { BCM4329_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4329) },
         { BCM4330_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4330) },
         { BCM4334_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4334) },
-        { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) }
+        { BCM4335_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4335) },
+        { BCM43362_CHIP_ID, 0xFFFFFFFE, BRCMF_FIRMWARE_NVRAM(BCM43362) },
+        { BCM4339_CHIP_ID, 0xFFFFFFFF, BRCMF_FIRMWARE_NVRAM(BCM4339) }
 };
 
 
-static const struct firmware *brcmf_sdbrcm_get_fw(struct brcmf_sdio *bus,
+static const struct firmware *brcmf_sdio_get_fw(struct brcmf_sdio *bus,
                                                   enum brcmf_firmware_type type)
 {
         const struct firmware *fw;
@@ -606,8 +625,8 @@ r_sdreg32(struct brcmf_sdio *bus, u32 *regvar, u32 offset)
         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
         int ret;
 
-        *regvar = brcmf_sdio_regrl(bus->sdiodev,
-                                   bus->ci->c_inf[idx].base + offset, &ret);
+        *regvar = brcmf_sdiod_regrl(bus->sdiodev,
+                                    bus->ci->c_inf[idx].base + offset, &ret);
 
         return ret;
 }
@@ -618,15 +637,15 @@ w_sdreg32(struct brcmf_sdio *bus, u32 regval, u32 reg_offset)
         u8 idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
         int ret;
 
-        brcmf_sdio_regwl(bus->sdiodev,
-                         bus->ci->c_inf[idx].base + reg_offset,
-                         regval, &ret);
+        brcmf_sdiod_regwl(bus->sdiodev,
+                          bus->ci->c_inf[idx].base + reg_offset,
+                          regval, &ret);
 
         return ret;
 }
 
 static int
-brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
+brcmf_sdio_kso_control(struct brcmf_sdio *bus, bool on)
 {
         u8 wr_val = 0, rd_val, cmp_val, bmask;
         int err = 0;
@@ -636,8 +655,8 @@ brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
 
         wr_val = (on << SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
         /* 1st KSO write goes to AOS wake up core if device is asleep  */
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-                         wr_val, &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                          wr_val, &err);
         if (err) {
                 brcmf_err("SDIO_AOS KSO write error: %d\n", err);
                 return err;
@@ -667,15 +686,15 @@ brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
                  * just one write attempt may fail,
                  * read it back until it matches written value
                  */
-                rd_val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-                                          &err);
+                rd_val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                           &err);
                 if (((rd_val & bmask) == cmp_val) && !err)
                         break;
                 brcmf_dbg(SDIO, "KSO wr/rd retry:%d (max: %d) ERR:%x\n",
                           try_cnt, MAX_KSO_ATTEMPTS, err);
                 udelay(KSO_WAIT_US);
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-                                 wr_val, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                  wr_val, &err);
         } while (try_cnt++ < MAX_KSO_ATTEMPTS);
 
         return err;
@@ -686,7 +705,7 @@ brcmf_sdbrcm_kso_control(struct brcmf_sdio *bus, bool on)
 #define HOSTINTMASK             (I_HMB_SW_MASK | I_CHIPACTIVE)
 
 /* Turn backplane clock on or off */
-static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
+static int brcmf_sdio_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 {
         int err;
         u8 clkctl, clkreq, devctl;
@@ -706,16 +725,16 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
                 clkreq =
                     bus->alp_only ? SBSDIO_ALP_AVAIL_REQ : SBSDIO_HT_AVAIL_REQ;
 
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                 clkreq, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  clkreq, &err);
                 if (err) {
                         brcmf_err("HT Avail request error: %d\n", err);
                         return -EBADE;
                 }
 
                 /* Check current status */
-                clkctl = brcmf_sdio_regrb(bus->sdiodev,
-                                          SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                clkctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
                 if (err) {
                         brcmf_err("HT Avail read error: %d\n", err);
                         return -EBADE;
@@ -724,8 +743,8 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
                 /* Go to pending and await interrupt if appropriate */
                 if (!SBSDIO_CLKAV(clkctl, bus->alp_only) && pendok) {
                         /* Allow only clock-available interrupt */
-                        devctl = brcmf_sdio_regrb(bus->sdiodev,
-                                                  SBSDIO_DEVICE_CTL, &err);
+                        devctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_DEVICE_CTL, &err);
                         if (err) {
                                 brcmf_err("Devctl error setting CA: %d\n",
                                           err);
@@ -733,28 +752,28 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
                         }
 
                         devctl |= SBSDIO_DEVCTL_CA_INT_ONLY;
-                        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-                                         devctl, &err);
+                        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+                                          devctl, &err);
                         brcmf_dbg(SDIO, "CLKCTL: set PENDING\n");
                         bus->clkstate = CLK_PENDING;
 
                         return 0;
                 } else if (bus->clkstate == CLK_PENDING) {
                         /* Cancel CA-only interrupt filter */
-                        devctl = brcmf_sdio_regrb(bus->sdiodev,
-                                                  SBSDIO_DEVICE_CTL, &err);
+                        devctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_DEVICE_CTL, &err);
                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
-                        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-                                         devctl, &err);
+                        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+                                          devctl, &err);
                 }
 
                 /* Otherwise, wait here (polling) for HT Avail */
                 timeout = jiffies +
                           msecs_to_jiffies(PMU_MAX_TRANSITION_DLY/1000);
                 while (!SBSDIO_CLKAV(clkctl, bus->alp_only)) {
-                        clkctl = brcmf_sdio_regrb(bus->sdiodev,
-                                                  SBSDIO_FUNC1_CHIPCLKCSR,
-                                                  &err);
+                        clkctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_FUNC1_CHIPCLKCSR,
+                                                   &err);
                         if (time_after(jiffies, timeout))
                                 break;
                         else
@@ -787,16 +806,16 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 
                 if (bus->clkstate == CLK_PENDING) {
                         /* Cancel CA-only interrupt filter */
-                        devctl = brcmf_sdio_regrb(bus->sdiodev,
-                                                  SBSDIO_DEVICE_CTL, &err);
+                        devctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_DEVICE_CTL, &err);
                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
-                        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-                                         devctl, &err);
+                        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+                                          devctl, &err);
                 }
 
                 bus->clkstate = CLK_SDONLY;
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                 clkreq, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  clkreq, &err);
                 brcmf_dbg(SDIO, "CLKCTL: turned OFF\n");
                 if (err) {
                         brcmf_err("Failed access turning clock off: %d\n",
@@ -808,7 +827,7 @@ static int brcmf_sdbrcm_htclk(struct brcmf_sdio *bus, bool on, bool pendok)
 }
 
 /* Change idle/active SD state */
-static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
+static int brcmf_sdio_sdclk(struct brcmf_sdio *bus, bool on)
 {
         brcmf_dbg(SDIO, "Enter\n");
 
@@ -821,7 +840,7 @@ static int brcmf_sdbrcm_sdclk(struct brcmf_sdio *bus, bool on)
 }
 
 /* Transition SD and backplane clock readiness */
-static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
+static int brcmf_sdio_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 {
 #ifdef DEBUG
         uint oldstate = bus->clkstate;
@@ -832,7 +851,7 @@ static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
         /* Early exit if we're already there */
         if (bus->clkstate == target) {
                 if (target == CLK_AVAIL) {
-                        brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
+                        brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
                         bus->activity = true;
                 }
                 return 0;
@@ -842,32 +861,32 @@ static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
         case CLK_AVAIL:
                 /* Make sure SD clock is available */
                 if (bus->clkstate == CLK_NONE)
-                        brcmf_sdbrcm_sdclk(bus, true);
+                        brcmf_sdio_sdclk(bus, true);
                 /* Now request HT Avail on the backplane */
-                brcmf_sdbrcm_htclk(bus, true, pendok);
-                brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
+                brcmf_sdio_htclk(bus, true, pendok);
+                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
                 bus->activity = true;
                 break;
 
         case CLK_SDONLY:
                 /* Remove HT request, or bring up SD clock */
                 if (bus->clkstate == CLK_NONE)
-                        brcmf_sdbrcm_sdclk(bus, true);
+                        brcmf_sdio_sdclk(bus, true);
                 else if (bus->clkstate == CLK_AVAIL)
-                        brcmf_sdbrcm_htclk(bus, false, false);
+                        brcmf_sdio_htclk(bus, false, false);
                 else
                         brcmf_err("request for %d -> %d\n",
                                   bus->clkstate, target);
-                brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
+                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
                 break;
 
         case CLK_NONE:
                 /* Make sure to remove HT request */
                 if (bus->clkstate == CLK_AVAIL)
-                        brcmf_sdbrcm_htclk(bus, false, false);
+                        brcmf_sdio_htclk(bus, false, false);
                 /* Now remove the SD clock */
-                brcmf_sdbrcm_sdclk(bus, false);
-                brcmf_sdbrcm_wd_timer(bus, 0);
+                brcmf_sdio_sdclk(bus, false);
+                brcmf_sdio_wd_timer(bus, 0);
                 break;
         }
 #ifdef DEBUG
@@ -878,7 +897,7 @@ static int brcmf_sdbrcm_clkctl(struct brcmf_sdio *bus, uint target, bool pendok)
 }
 
 static int
-brcmf_sdbrcm_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
+brcmf_sdio_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
 {
         int err = 0;
         brcmf_dbg(TRACE, "Enter\n");
@@ -901,13 +920,13 @@ brcmf_sdbrcm_bus_sleep(struct brcmf_sdio *bus, bool sleep, bool pendok)
                             brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol) &&
                             data_ok(bus)))
                                  return -EBUSY;
-                        err = brcmf_sdbrcm_kso_control(bus, false);
+                        err = brcmf_sdio_kso_control(bus, false);
                         /* disable watchdog */
                         if (!err)
-                                brcmf_sdbrcm_wd_timer(bus, 0);
+                                brcmf_sdio_wd_timer(bus, 0);
                 } else {
                         bus->idlecount = 0;
-                        err = brcmf_sdbrcm_kso_control(bus, true);
+                        err = brcmf_sdio_kso_control(bus, true);
                 }
                 if (!err) {
                         /* Change state */
@@ -925,16 +944,16 @@ end:
         /* control clocks */
         if (sleep) {
                 if (!bus->sr_enabled)
-                        brcmf_sdbrcm_clkctl(bus, CLK_NONE, pendok);
+                        brcmf_sdio_clkctl(bus, CLK_NONE, pendok);
         } else {
-                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, pendok);
+                brcmf_sdio_clkctl(bus, CLK_AVAIL, pendok);
         }
 
         return err;
 
 }
 
-static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
+static u32 brcmf_sdio_hostmail(struct brcmf_sdio *bus)
 {
         u32 intstatus = 0;
         u32 hmb_data;
@@ -1010,7 +1029,7 @@ static u32 brcmf_sdbrcm_hostmail(struct brcmf_sdio *bus)
         return intstatus;
 }
 
-static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
+static void brcmf_sdio_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 {
         uint retries = 0;
         u16 lastrbc;
@@ -1022,18 +1041,18 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
                   rtx ? ", send NAK" : "");
 
         if (abort)
-                brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
+                brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
 
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
-                         SFC_RF_TERM, &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+                          SFC_RF_TERM, &err);
         bus->sdcnt.f1regdata++;
 
         /* Wait until the packet has been flushed (device/FIFO stable) */
         for (lastrbc = retries = 0xffff; retries > 0; retries--) {
-                hi = brcmf_sdio_regrb(bus->sdiodev,
-                                      SBSDIO_FUNC1_RFRAMEBCHI, &err);
-                lo = brcmf_sdio_regrb(bus->sdiodev,
-                                      SBSDIO_FUNC1_RFRAMEBCLO, &err);
+                hi = brcmf_sdiod_regrb(bus->sdiodev,
+                                       SBSDIO_FUNC1_RFRAMEBCHI, &err);
+                lo = brcmf_sdiod_regrb(bus->sdiodev,
+                                       SBSDIO_FUNC1_RFRAMEBCLO, &err);
                 bus->sdcnt.f1regdata += 2;
 
                 if ((hi == 0) && (lo == 0))
@@ -1063,14 +1082,10 @@ static void brcmf_sdbrcm_rxfail(struct brcmf_sdio *bus, bool abort, bool rtx)
 
         /* Clear partial in any case */
         bus->cur_read.len = 0;
-
-        /* If we can't reach the device, signal failure */
-        if (err)
-                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
 }
 
 /* return total length of buffer chain */
-static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
+static uint brcmf_sdio_glom_len(struct brcmf_sdio *bus)
 {
         struct sk_buff *p;
         uint total;
@@ -1081,7 +1096,7 @@ static uint brcmf_sdbrcm_glom_len(struct brcmf_sdio *bus)
         return total;
 }
 
-static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
+static void brcmf_sdio_free_glom(struct brcmf_sdio *bus)
 {
         struct sk_buff *cur, *next;
 
@@ -1097,10 +1112,18 @@ static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
  * host and WiFi dongle which contains information needed for SDIO core and
  * firmware
  *
- * It consists of 2 parts: hw header and software header
+ * It consists of 3 parts: hardware header, hardware extension header and
+ * software header
  * hardware header (frame tag) - 4 bytes
  * Byte 0~1: Frame length
  * Byte 2~3: Checksum, bit-wise inverse of frame length
+ * hardware extension header - 8 bytes
+ * Tx glom mode only, N/A for Rx or normal Tx
+ * Byte 0~1: Packet length excluding hw frame tag
+ * Byte 2: Reserved
+ * Byte 3: Frame flags, bit 0: last frame indication
+ * Byte 4~5: Reserved
+ * Byte 6~7: Tail padding length
  * software header - 8 bytes
  * Byte 0: Rx/Tx sequence number
  * Byte 1: 4 MSB Channel number, 4 LSB arbitrary flag
@@ -1111,6 +1134,7 @@ static void brcmf_sdbrcm_free_glom(struct brcmf_sdio *bus)
  * Byte 6~7: Reserved
  */
 #define SDPCM_HWHDR_LEN                 4
+#define SDPCM_HWEXT_LEN                 8
 #define SDPCM_SWHDR_LEN                 8
 #define SDPCM_HDRLEN                    (SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN)
 /* software header */
@@ -1147,7 +1171,7 @@ static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
         u8 rx_seq, fc, tx_seq_max;
         u32 swheader;
 
-        trace_brcmf_sdpcm_hdr(false, header);
+        trace_brcmf_sdpcm_hdr(SDPCM_RX, header);
 
         /* hw header */
         len = get_unaligned_le16(header);
@@ -1160,7 +1184,7 @@ static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
         if ((u16)(~(len ^ checksum))) {
                 brcmf_err("HW header checksum error\n");
                 bus->sdcnt.rx_badhdr++;
-                brcmf_sdbrcm_rxfail(bus, false, false);
+                brcmf_sdio_rxfail(bus, false, false);
                 return -EIO;
         }
         if (len < SDPCM_HDRLEN) {
@@ -1192,7 +1216,7 @@ static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
             type != BRCMF_SDIO_FT_SUPER) {
                 brcmf_err("HW header length too long\n");
                 bus->sdcnt.rx_toolong++;
-                brcmf_sdbrcm_rxfail(bus, false, false);
+                brcmf_sdio_rxfail(bus, false, false);
                 rd->len = 0;
                 return -EPROTO;
         }
@@ -1211,7 +1235,7 @@ static int brcmf_sdio_hdparse(struct brcmf_sdio *bus, u8 *header,
         if (rd->dat_offset < SDPCM_HDRLEN || rd->dat_offset > rd->len) {
                 brcmf_err("seq %d: bad data offset\n", rx_seq);
                 bus->sdcnt.rx_badhdr++;
-                brcmf_sdbrcm_rxfail(bus, false, false);
+                brcmf_sdio_rxfail(bus, false, false);
                 rd->len = 0;
                 return -ENXIO;
         }
@@ -1260,25 +1284,34 @@ static inline void brcmf_sdio_update_hwhdr(u8 *header, u16 frm_length)
 static void brcmf_sdio_hdpack(struct brcmf_sdio *bus, u8 *header,
                               struct brcmf_sdio_hdrinfo *hd_info)
 {
-        u32 sw_header;
+        u32 hdrval;
+        u8 hdr_offset;
 
         brcmf_sdio_update_hwhdr(header, hd_info->len);
-
-        sw_header = bus->tx_seq;
-        sw_header |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
-                     SDPCM_CHANNEL_MASK;
-        sw_header |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
-                     SDPCM_DOFFSET_MASK;
-        *(((__le32 *)header) + 1) = cpu_to_le32(sw_header);
-        *(((__le32 *)header) + 2) = 0;
-        trace_brcmf_sdpcm_hdr(true, header);
+        hdr_offset = SDPCM_HWHDR_LEN;
+
+        if (bus->txglom) {
+                hdrval = (hd_info->len - hdr_offset) | (hd_info->lastfrm << 24);
+                *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
+                hdrval = (u16)hd_info->tail_pad << 16;
+                *(((__le32 *)(header + hdr_offset)) + 1) = cpu_to_le32(hdrval);
+                hdr_offset += SDPCM_HWEXT_LEN;
+        }
+
+        hdrval = hd_info->seq_num;
+        hdrval |= (hd_info->channel << SDPCM_CHANNEL_SHIFT) &
+                  SDPCM_CHANNEL_MASK;
+        hdrval |= (hd_info->dat_offset << SDPCM_DOFFSET_SHIFT) &
+                  SDPCM_DOFFSET_MASK;
+        *((__le32 *)(header + hdr_offset)) = cpu_to_le32(hdrval);
+        *(((__le32 *)(header + hdr_offset)) + 1) = 0;
+        trace_brcmf_sdpcm_hdr(SDPCM_TX + !!(bus->txglom), header);
 }
 
-static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
+static u8 brcmf_sdio_rxglom(struct brcmf_sdio *bus, u8 rxseq)
 {
         u16 dlen, totlen;
         u8 *dptr, num = 0;
-        u32 align = 0;
         u16 sublen;
         struct sk_buff *pfirst, *pnext;
 
@@ -1293,11 +1326,6 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         brcmf_dbg(SDIO, "start: glomd %p glom %p\n",
                   bus->glomd, skb_peek(&bus->glom));
 
-        if (bus->sdiodev->pdata)
-                align = bus->sdiodev->pdata->sd_sgentry_align;
-        if (align < 4)
-                align = 4;
-
         /* If there's a descriptor, generate the packet chain */
         if (bus->glomd) {
                 pfirst = pnext = NULL;
@@ -1321,9 +1349,9 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                                 pnext = NULL;
                                 break;
                         }
-                        if (sublen % align) {
+                        if (sublen % bus->sgentry_align) {
                                 brcmf_err("sublen %d not multiple of %d\n",
-                                          sublen, align);
+                                          sublen, bus->sgentry_align);
                         }
                         totlen += sublen;
 
@@ -1336,7 +1364,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         }
 
                         /* Allocate/chain packet for next subframe */
-                        pnext = brcmu_pkt_buf_get_skb(sublen + align);
+                        pnext = brcmu_pkt_buf_get_skb(sublen + bus->sgentry_align);
                         if (pnext == NULL) {
                                 brcmf_err("bcm_pkt_buf_get_skb failed, num %d len %d\n",
                                           num, sublen);
@@ -1345,7 +1373,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         skb_queue_tail(&bus->glom, pnext);
 
                         /* Adhere to start alignment requirements */
-                        pkt_align(pnext, sublen, align);
+                        pkt_align(pnext, sublen, bus->sgentry_align);
                 }
 
                 /* If all allocations succeeded, save packet chain
@@ -1360,7 +1388,7 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         }
                         pfirst = pnext = NULL;
                 } else {
-                        brcmf_sdbrcm_free_glom(bus);
+                        brcmf_sdio_free_glom(bus);
                         num = 0;
                 }
 
@@ -1383,16 +1411,15 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                 }
 
                 pfirst = skb_peek(&bus->glom);
-                dlen = (u16) brcmf_sdbrcm_glom_len(bus);
+                dlen = (u16) brcmf_sdio_glom_len(bus);
 
                 /* Do an SDIO read for the superframe.  Configurable iovar to
                  * read directly into the chained packet, or allocate a large
                  * packet and and copy into the chain.
                  */
                 sdio_claim_host(bus->sdiodev->func[1]);
-                errcode = brcmf_sdcard_recv_chain(bus->sdiodev,
-                                bus->sdiodev->sbwad,
-                                SDIO_FUNC_2, F2SYNC, &bus->glom, dlen);
+                errcode = brcmf_sdiod_recv_chain(bus->sdiodev,
+                                                 &bus->glom, dlen);
                 sdio_release_host(bus->sdiodev->func[1]);
                 bus->sdcnt.f2rxdata++;
 
@@ -1403,12 +1430,12 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
 
                         sdio_claim_host(bus->sdiodev->func[1]);
                         if (bus->glomerr++ < 3) {
-                                brcmf_sdbrcm_rxfail(bus, true, true);
+                                brcmf_sdio_rxfail(bus, true, true);
                         } else {
                                 bus->glomerr = 0;
-                                brcmf_sdbrcm_rxfail(bus, true, false);
+                                brcmf_sdio_rxfail(bus, true, false);
                                 bus->sdcnt.rxglomfail++;
-                                brcmf_sdbrcm_free_glom(bus);
+                                brcmf_sdio_free_glom(bus);
                         }
                         sdio_release_host(bus->sdiodev->func[1]);
                         return 0;
@@ -1456,12 +1483,12 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
                         if (bus->glomerr++ < 3) {
                                 /* Restore superframe header space */
                                 skb_push(pfirst, sfdoff);
-                                brcmf_sdbrcm_rxfail(bus, true, true);
+                                brcmf_sdio_rxfail(bus, true, true);
                         } else {
                                 bus->glomerr = 0;
-                                brcmf_sdbrcm_rxfail(bus, true, false);
+                                brcmf_sdio_rxfail(bus, true, false);
                                 bus->sdcnt.rxglomfail++;
-                                brcmf_sdbrcm_free_glom(bus);
+                                brcmf_sdio_free_glom(bus);
                         }
                         sdio_release_host(bus->sdiodev->func[1]);
                         bus->cur_read.len = 0;
@@ -1505,8 +1532,8 @@ static u8 brcmf_sdbrcm_rxglom(struct brcmf_sdio *bus, u8 rxseq)
         return num;
 }
 
-static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
-                                        bool *pending)
+static int brcmf_sdio_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
+                                     bool *pending)
 {
         DECLARE_WAITQUEUE(wait, current);
         int timeout = msecs_to_jiffies(DCMD_RESP_TIMEOUT);
@@ -1527,7 +1554,7 @@ static int brcmf_sdbrcm_dcmd_resp_wait(struct brcmf_sdio *bus, uint *condition,
         return timeout;
 }
 
-static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
+static int brcmf_sdio_dcmd_resp_wake(struct brcmf_sdio *bus)
 {
         if (waitqueue_active(&bus->dcmd_resp_wait))
                 wake_up_interruptible(&bus->dcmd_resp_wait);
@@ -1535,7 +1562,7 @@ static int brcmf_sdbrcm_dcmd_resp_wake(struct brcmf_sdio *bus)
         return 0;
 }
 static void
-brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
+brcmf_sdio_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
 {
         uint rdlen, pad;
         u8 *buf = NULL, *rbuf;
@@ -1549,9 +1576,9 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                 goto done;
 
         rbuf = bus->rxbuf;
-        pad = ((unsigned long)rbuf % BRCMF_SDALIGN);
+        pad = ((unsigned long)rbuf % bus->head_align);
         if (pad)
-                rbuf += (BRCMF_SDALIGN - pad);
+                rbuf += (bus->head_align - pad);
 
         /* Copy the already-read portion over */
         memcpy(buf, hdr, BRCMF_FIRSTREAD);
@@ -1565,19 +1592,15 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                 if ((pad <= bus->roundup) && (pad < bus->blocksize) &&
                     ((len + pad) < bus->sdiodev->bus_if->maxctl))
                         rdlen += pad;
-        } else if (rdlen % BRCMF_SDALIGN) {
-                rdlen += BRCMF_SDALIGN - (rdlen % BRCMF_SDALIGN);
+        } else if (rdlen % bus->head_align) {
+                rdlen += bus->head_align - (rdlen % bus->head_align);
         }
 
-        /* Satisfy length-alignment requirements */
-        if (rdlen & (ALIGNMENT - 1))
-                rdlen = roundup(rdlen, ALIGNMENT);
-
         /* Drop if the read is too big or it exceeds our maximum */
         if ((rdlen + BRCMF_FIRSTREAD) > bus->sdiodev->bus_if->maxctl) {
                 brcmf_err("%d-byte control read exceeds %d-byte buffer\n",
                           rdlen, bus->sdiodev->bus_if->maxctl);
-                brcmf_sdbrcm_rxfail(bus, false, false);
+                brcmf_sdio_rxfail(bus, false, false);
                 goto done;
         }
 
@@ -1585,15 +1608,12 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                 brcmf_err("%d-byte ctl frame (%d-byte ctl data) exceeds %d-byte limit\n",
                           len, len - doff, bus->sdiodev->bus_if->maxctl);
                 bus->sdcnt.rx_toolong++;
-                brcmf_sdbrcm_rxfail(bus, false, false);
+                brcmf_sdio_rxfail(bus, false, false);
                 goto done;
         }
 
         /* Read remain of frame body */
-        sdret = brcmf_sdcard_recv_buf(bus->sdiodev,
-                                bus->sdiodev->sbwad,
-                                SDIO_FUNC_2,
-                                F2SYNC, rbuf, rdlen);
+        sdret = brcmf_sdiod_recv_buf(bus->sdiodev, rbuf, rdlen);
         bus->sdcnt.f2rxdata++;
 
         /* Control frame failures need retransmission */
@@ -1601,7 +1621,7 @@ brcmf_sdbrcm_read_control(struct brcmf_sdio *bus, u8 *hdr, uint len, uint doff)
                 brcmf_err("read %d control bytes failed: %d\n",
                           rdlen, sdret);
                 bus->sdcnt.rxc_errors++;
-                brcmf_sdbrcm_rxfail(bus, true, true);
+                brcmf_sdio_rxfail(bus, true, true);
                 goto done;
         } else
                 memcpy(buf + BRCMF_FIRSTREAD, rbuf, rdlen);
@@ -1626,19 +1646,19 @@ gotpkt:
 
 done:
         /* Awake any waiters */
-        brcmf_sdbrcm_dcmd_resp_wake(bus);
+        brcmf_sdio_dcmd_resp_wake(bus);
 }
 
 /* Pad read to blocksize for efficiency */
-static void brcmf_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
+static void brcmf_sdio_pad(struct brcmf_sdio *bus, u16 *pad, u16 *rdlen)
 {
         if (bus->roundup && bus->blocksize && *rdlen > bus->blocksize) {
                 *pad = bus->blocksize - (*rdlen % bus->blocksize);
                 if (*pad <= bus->roundup && *pad < bus->blocksize &&
                     *rdlen + *pad + BRCMF_FIRSTREAD < MAX_RX_DATASZ)
                         *rdlen += *pad;
-        } else if (*rdlen % BRCMF_SDALIGN) {
-                *rdlen += BRCMF_SDALIGN - (*rdlen % BRCMF_SDALIGN);
+        } else if (*rdlen % bus->head_align) {
+                *rdlen += bus->head_align - (*rdlen % bus->head_align);
         }
 }
 
@@ -1658,8 +1678,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
         bus->rxpending = true;
 
         for (rd->seq_num = bus->rx_seq, rxleft = maxframes;
-             !bus->rxskip && rxleft &&
-             bus->sdiodev->bus_if->state != BRCMF_BUS_DOWN;
+             !bus->rxskip && rxleft && brcmf_bus_ready(bus->sdiodev->bus_if);
              rd->seq_num++, rxleft--) {
 
                 /* Handle glomming separately */
@@ -1667,7 +1686,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         u8 cnt;
                         brcmf_dbg(GLOM, "calling rxglom: glomd %p, glom %p\n",
                                   bus->glomd, skb_peek(&bus->glom));
-                        cnt = brcmf_sdbrcm_rxglom(bus, rd->seq_num);
+                        cnt = brcmf_sdio_rxglom(bus, rd->seq_num);
                         brcmf_dbg(GLOM, "rxglom returned %d\n", cnt);
                         rd->seq_num += cnt - 1;
                         rxleft = (rxleft > cnt) ? (rxleft - cnt) : 1;
@@ -1678,17 +1697,14 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                 /* read header first for unknow frame length */
                 sdio_claim_host(bus->sdiodev->func[1]);
                 if (!rd->len) {
-                        ret = brcmf_sdcard_recv_buf(bus->sdiodev,
-                                                      bus->sdiodev->sbwad,
-                                                      SDIO_FUNC_2, F2SYNC,
-                                                      bus->rxhdr,
-                                                      BRCMF_FIRSTREAD);
+                        ret = brcmf_sdiod_recv_buf(bus->sdiodev,
+                                                   bus->rxhdr, BRCMF_FIRSTREAD);
                         bus->sdcnt.f2rxhdrs++;
                         if (ret < 0) {
                                 brcmf_err("RXHEADER FAILED: %d\n",
                                           ret);
                                 bus->sdcnt.rx_hdrfail++;
-                                brcmf_sdbrcm_rxfail(bus, true, true);
+                                brcmf_sdio_rxfail(bus, true, true);
                                 sdio_release_host(bus->sdiodev->func[1]);
                                 continue;
                         }
@@ -1707,9 +1723,9 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         }
 
                         if (rd->channel == SDPCM_CONTROL_CHANNEL) {
-                                brcmf_sdbrcm_read_control(bus, bus->rxhdr,
-                                                          rd->len,
-                                                          rd->dat_offset);
+                                brcmf_sdio_read_control(bus, bus->rxhdr,
+                                                        rd->len,
+                                                        rd->dat_offset);
                                 /* prepare the descriptor for the next read */
                                 rd->len = rd->len_nxtfrm << 4;
                                 rd->len_nxtfrm = 0;
@@ -1723,23 +1739,22 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                         head_read = BRCMF_FIRSTREAD;
                 }
 
-                brcmf_pad(bus, &pad, &rd->len_left);
+                brcmf_sdio_pad(bus, &pad, &rd->len_left);
 
                 pkt = brcmu_pkt_buf_get_skb(rd->len_left + head_read +
-                                            BRCMF_SDALIGN);
+                                            bus->head_align);
                 if (!pkt) {
                         /* Give up on data, request rtx of events */
                         brcmf_err("brcmu_pkt_buf_get_skb failed\n");
-                        brcmf_sdbrcm_rxfail(bus, false,
+                        brcmf_sdio_rxfail(bus, false,
                                             RETRYCHAN(rd->channel));
                         sdio_release_host(bus->sdiodev->func[1]);
                         continue;
                 }
                 skb_pull(pkt, head_read);
-                pkt_align(pkt, rd->len_left, BRCMF_SDALIGN);
+                pkt_align(pkt, rd->len_left, bus->head_align);
 
-                ret = brcmf_sdcard_recv_pkt(bus->sdiodev, bus->sdiodev->sbwad,
-                                              SDIO_FUNC_2, F2SYNC, pkt);
+                ret = brcmf_sdiod_recv_pkt(bus->sdiodev, pkt);
                 bus->sdcnt.f2rxdata++;
                 sdio_release_host(bus->sdiodev->func[1]);
 
@@ -1748,7 +1763,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                                   rd->len, rd->channel, ret);
                         brcmu_pkt_buf_free_skb(pkt);
                         sdio_claim_host(bus->sdiodev->func[1]);
-                        brcmf_sdbrcm_rxfail(bus, true,
+                        brcmf_sdio_rxfail(bus, true,
                                             RETRYCHAN(rd->channel));
                         sdio_release_host(bus->sdiodev->func[1]);
                         continue;
@@ -1773,7 +1788,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                                           rd->len,
                                           roundup(rd_new.len, 16) >> 4);
                                 rd->len = 0;
-                                brcmf_sdbrcm_rxfail(bus, true, true);
+                                brcmf_sdio_rxfail(bus, true, true);
                                 sdio_release_host(bus->sdiodev->func[1]);
                                 brcmu_pkt_buf_free_skb(pkt);
                                 continue;
@@ -1795,7 +1810,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                                 /* Force retry w/normal header read */
                                 rd->len = 0;
                                 sdio_claim_host(bus->sdiodev->func[1]);
-                                brcmf_sdbrcm_rxfail(bus, false, true);
+                                brcmf_sdio_rxfail(bus, false, true);
                                 sdio_release_host(bus->sdiodev->func[1]);
                                 brcmu_pkt_buf_free_skb(pkt);
                                 continue;
@@ -1820,7 +1835,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
                                 brcmf_err("%s: glom superframe w/o "
                                           "descriptor!\n", __func__);
                                 sdio_claim_host(bus->sdiodev->func[1]);
-                                brcmf_sdbrcm_rxfail(bus, false, false);
+                                brcmf_sdio_rxfail(bus, false, false);
                                 sdio_release_host(bus->sdiodev->func[1]);
                         }
                         /* prepare the descriptor for the next read */
@@ -1864,13 +1879,36 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
 }
 
 static void
-brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
+brcmf_sdio_wait_event_wakeup(struct brcmf_sdio *bus)
 {
         if (waitqueue_active(&bus->ctrl_wait))
                 wake_up_interruptible(&bus->ctrl_wait);
         return;
 }
 
+static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
+{
+        u16 head_pad;
+        u8 *dat_buf;
+
+        dat_buf = (u8 *)(pkt->data);
+
+        /* Check head padding */
+        head_pad = ((unsigned long)dat_buf % bus->head_align);
+        if (head_pad) {
+                if (skb_headroom(pkt) < head_pad) {
+                        bus->sdiodev->bus_if->tx_realloc++;
+                        head_pad = 0;
+                        if (skb_cow(pkt, head_pad))
+                                return -ENOMEM;
+                }
+                skb_push(pkt, head_pad);
+                dat_buf = (u8 *)(pkt->data);
+                memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
+        }
+        return head_pad;
+}
+
 /**
  * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
  * bus layer usage.
@@ -1880,32 +1918,40 @@ brcmf_sdbrcm_wait_event_wakeup(struct brcmf_sdio *bus)
 /* bit mask of data length chopped from the previous packet */
 #define ALIGN_SKB_CHOP_LEN_MASK 0x7fff
 
-static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio_dev *sdiodev,
+static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio *bus,
                                     struct sk_buff_head *pktq,
-                                    struct sk_buff *pkt, uint chan)
+                                    struct sk_buff *pkt, u16 total_len)
 {
+        struct brcmf_sdio_dev *sdiodev;
         struct sk_buff *pkt_pad;
-        u16 tail_pad, tail_chop, sg_align;
+        u16 tail_pad, tail_chop, chain_pad;
         unsigned int blksize;
-        u8 *dat_buf;
-        int ntail;
+        bool lastfrm;
+        int ntail, ret;
 
+        sdiodev = bus->sdiodev;
         blksize = sdiodev->func[SDIO_FUNC_2]->cur_blksize;
-        sg_align = 4;
-        if (sdiodev->pdata && sdiodev->pdata->sd_sgentry_align > 4)
-                sg_align = sdiodev->pdata->sd_sgentry_align;
         /* sg entry alignment should be a divisor of block size */
-        WARN_ON(blksize % sg_align);
+        WARN_ON(blksize % bus->sgentry_align);
 
         /* Check tail padding */
-        pkt_pad = NULL;
-        tail_chop = pkt->len % sg_align;
-        tail_pad = sg_align - tail_chop;
-        tail_pad += blksize - (pkt->len + tail_pad) % blksize;
+        lastfrm = skb_queue_is_last(pktq, pkt);
+        tail_pad = 0;
+        tail_chop = pkt->len % bus->sgentry_align;
+        if (tail_chop)
+                tail_pad = bus->sgentry_align - tail_chop;
+        chain_pad = (total_len + tail_pad) % blksize;
+        if (lastfrm && chain_pad)
+                tail_pad += blksize - chain_pad;
         if (skb_tailroom(pkt) < tail_pad && pkt->len > blksize) {
-                pkt_pad = brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
+                pkt_pad = bus->txglom_sgpad;
+                if (pkt_pad == NULL)
+                          brcmu_pkt_buf_get_skb(tail_pad + tail_chop);
                 if (pkt_pad == NULL)
                         return -ENOMEM;
+                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_pad);
+                if (unlikely(ret < 0))
+                        return ret;
                 memcpy(pkt_pad->data,
                        pkt->data + pkt->len - tail_chop,
                        tail_chop);
@@ -1920,14 +1966,10 @@ static int brcmf_sdio_txpkt_prep_sg(struct brcmf_sdio_dev *sdiodev,
                                 return -ENOMEM;
                 if (skb_linearize(pkt))
                         return -ENOMEM;
-                dat_buf = (u8 *)(pkt->data);
                 __skb_put(pkt, tail_pad);
         }
 
-        if (pkt_pad)
-                return pkt->len + tail_chop;
-        else
-                return pkt->len - tail_pad;
+        return tail_pad;
 }
 
 /**
@@ -1946,58 +1988,66 @@ static int
 brcmf_sdio_txpkt_prep(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
                       uint chan)
 {
-        u16 head_pad, head_align;
+        u16 head_pad, total_len;
         struct sk_buff *pkt_next;
-        u8 *dat_buf;
-        int err;
+        u8 txseq;
+        int ret;
         struct brcmf_sdio_hdrinfo hd_info = {0};
 
-        /* SDIO ADMA requires at least 32 bit alignment */
-        head_align = 4;
-        if (bus->sdiodev->pdata && bus->sdiodev->pdata->sd_head_align > 4)
-                head_align = bus->sdiodev->pdata->sd_head_align;
+        txseq = bus->tx_seq;
+        total_len = 0;
+        skb_queue_walk(pktq, pkt_next) {
+                /* alignment packet inserted in previous
+                 * loop cycle can be skipped as it is
+                 * already properly aligned and does not
+                 * need an sdpcm header.
+                 */
+                if (*(u32 *)(pkt_next->cb) & ALIGN_SKB_FLAG)
+                        continue;
 
-        pkt_next = pktq->next;
-        dat_buf = (u8 *)(pkt_next->data);
+                /* align packet data pointer */
+                ret = brcmf_sdio_txpkt_hdalign(bus, pkt_next);
+                if (ret < 0)
+                        return ret;
+                head_pad = (u16)ret;
+                if (head_pad)
+                        memset(pkt_next->data, 0, head_pad + bus->tx_hdrlen);
 
-        /* Check head padding */
-        head_pad = ((unsigned long)dat_buf % head_align);
-        if (head_pad) {
-                if (skb_headroom(pkt_next) < head_pad) {
-                        bus->sdiodev->bus_if->tx_realloc++;
-                        head_pad = 0;
-                        if (skb_cow(pkt_next, head_pad))
-                                return -ENOMEM;
-                }
-                skb_push(pkt_next, head_pad);
-                dat_buf = (u8 *)(pkt_next->data);
-                memset(dat_buf, 0, head_pad + bus->tx_hdrlen);
-        }
+                total_len += pkt_next->len;
 
-        if (bus->sdiodev->sg_support && pktq->qlen > 1) {
-                err = brcmf_sdio_txpkt_prep_sg(bus->sdiodev, pktq,
-                                               pkt_next, chan);
-                if (err < 0)
-                        return err;
-                hd_info.len = (u16)err;
-        } else {
                 hd_info.len = pkt_next->len;
-        }
-
-        hd_info.channel = chan;
-        hd_info.dat_offset = head_pad + bus->tx_hdrlen;
-
-        /* Now fill the header */
-        brcmf_sdio_hdpack(bus, dat_buf, &hd_info);
-
-        if (BRCMF_BYTES_ON() &&
-            ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
-             (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
-                brcmf_dbg_hex_dump(true, pkt_next, hd_info.len, "Tx Frame:\n");
-        else if (BRCMF_HDRS_ON())
-                brcmf_dbg_hex_dump(true, pkt_next, head_pad + bus->tx_hdrlen,
-                                   "Tx Header:\n");
+                hd_info.lastfrm = skb_queue_is_last(pktq, pkt_next);
+                if (bus->txglom && pktq->qlen > 1) {
+                        ret = brcmf_sdio_txpkt_prep_sg(bus, pktq,
+                                                       pkt_next, total_len);
+                        if (ret < 0)
+                                return ret;
+                        hd_info.tail_pad = (u16)ret;
+                        total_len += (u16)ret;
+                }
 
+                hd_info.channel = chan;
+                hd_info.dat_offset = head_pad + bus->tx_hdrlen;
+                hd_info.seq_num = txseq++;
+
+                /* Now fill the header */
+                brcmf_sdio_hdpack(bus, pkt_next->data, &hd_info);
+
+                if (BRCMF_BYTES_ON() &&
+                    ((BRCMF_CTL_ON() && chan == SDPCM_CONTROL_CHANNEL) ||
+                     (BRCMF_DATA_ON() && chan != SDPCM_CONTROL_CHANNEL)))
+                        brcmf_dbg_hex_dump(true, pkt_next, hd_info.len,
+                                           "Tx Frame:\n");
+                else if (BRCMF_HDRS_ON())
+                        brcmf_dbg_hex_dump(true, pkt_next,
+                                           head_pad + bus->tx_hdrlen,
+                                           "Tx Header:\n");
+        }
+        /* Hardware length tag of the first packet should be total
+         * length of the chain (including padding)
+         */
+        if (bus->txglom)
+                brcmf_sdio_update_hwhdr(pktq->next->data, total_len);
         return 0;
 }
 
@@ -2015,6 +2065,7 @@ brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
 {
         u8 *hdr;
         u32 dat_offset;
+        u16 tail_pad;
         u32 dummy_flags, chop_len;
         struct sk_buff *pkt_next, *tmp, *pkt_prev;
 
@@ -2024,42 +2075,41 @@ brcmf_sdio_txpkt_postp(struct brcmf_sdio *bus, struct sk_buff_head *pktq)
                         chop_len = dummy_flags & ALIGN_SKB_CHOP_LEN_MASK;
                         if (chop_len) {
                                 pkt_prev = pkt_next->prev;
-                                memcpy(pkt_prev->data + pkt_prev->len,
-                                       pkt_next->data, chop_len);
                                 skb_put(pkt_prev, chop_len);
                         }
                         __skb_unlink(pkt_next, pktq);
                         brcmu_pkt_buf_free_skb(pkt_next);
                 } else {
-                        hdr = pkt_next->data + SDPCM_HWHDR_LEN;
+                        hdr = pkt_next->data + bus->tx_hdrlen - SDPCM_SWHDR_LEN;
                         dat_offset = le32_to_cpu(*(__le32 *)hdr);
                         dat_offset = (dat_offset & SDPCM_DOFFSET_MASK) >>
                                      SDPCM_DOFFSET_SHIFT;
                         skb_pull(pkt_next, dat_offset);
+                        if (bus->txglom) {
+                                tail_pad = le16_to_cpu(*(__le16 *)(hdr - 2));
+                                skb_trim(pkt_next, pkt_next->len - tail_pad);
+                        }
                 }
         }
 }
 
 /* Writes a HW/SW header into the packet and sends it. */
 /* Assumes: (a) header space already there, (b) caller holds lock */
-static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
-                              uint chan)
+static int brcmf_sdio_txpkt(struct brcmf_sdio *bus, struct sk_buff_head *pktq,
+                            uint chan)
 {
         int ret;
         int i;
-        struct sk_buff_head localq;
+        struct sk_buff *pkt_next, *tmp;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        __skb_queue_head_init(&localq);
-        __skb_queue_tail(&localq, pkt);
-        ret = brcmf_sdio_txpkt_prep(bus, &localq, chan);
+        ret = brcmf_sdio_txpkt_prep(bus, pktq, chan);
         if (ret)
                 goto done;
 
         sdio_claim_host(bus->sdiodev->func[1]);
-        ret = brcmf_sdcard_send_pkt(bus->sdiodev, bus->sdiodev->sbwad,
-                                    SDIO_FUNC_2, F2SYNC, &localq);
+        ret = brcmf_sdiod_send_pkt(bus->sdiodev, pktq);
         bus->sdcnt.f2txdata++;
 
         if (ret < 0) {
@@ -2068,57 +2118,71 @@ static int brcmf_sdbrcm_txpkt(struct brcmf_sdio *bus, struct sk_buff *pkt,
                           ret);
                 bus->sdcnt.tx_sderrs++;
 
-                brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
-                                 SFC_WF_TERM, NULL);
+                brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+                                  SFC_WF_TERM, NULL);
                 bus->sdcnt.f1regdata++;
 
                 for (i = 0; i < 3; i++) {
                         u8 hi, lo;
-                        hi = brcmf_sdio_regrb(bus->sdiodev,
-                                              SBSDIO_FUNC1_WFRAMEBCHI, NULL);
-                        lo = brcmf_sdio_regrb(bus->sdiodev,
-                                              SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+                        hi = brcmf_sdiod_regrb(bus->sdiodev,
+                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+                        lo = brcmf_sdiod_regrb(bus->sdiodev,
+                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
                         bus->sdcnt.f1regdata += 2;
                         if ((hi == 0) && (lo == 0))
                                 break;
                 }
-
         }
         sdio_release_host(bus->sdiodev->func[1]);
-        if (ret == 0)
-                bus->tx_seq = (bus->tx_seq + 1) % SDPCM_SEQ_WRAP;
 
 done:
-        brcmf_sdio_txpkt_postp(bus, &localq);
-        __skb_dequeue_tail(&localq);
-        brcmf_txcomplete(bus->sdiodev->dev, pkt, ret == 0);
+        brcmf_sdio_txpkt_postp(bus, pktq);
+        if (ret == 0)
+                bus->tx_seq = (bus->tx_seq + pktq->qlen) % SDPCM_SEQ_WRAP;
+        skb_queue_walk_safe(pktq, pkt_next, tmp) {
+                __skb_unlink(pkt_next, pktq);
+                brcmf_txcomplete(bus->sdiodev->dev, pkt_next, ret == 0);
+        }
         return ret;
 }
 
-static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
+static uint brcmf_sdio_sendfromq(struct brcmf_sdio *bus, uint maxframes)
 {
         struct sk_buff *pkt;
+        struct sk_buff_head pktq;
         u32 intstatus = 0;
-        int ret = 0, prec_out;
+        int ret = 0, prec_out, i;
         uint cnt = 0;
-        u8 tx_prec_map;
+        u8 tx_prec_map, pkt_num;
 
         brcmf_dbg(TRACE, "Enter\n");
 
         tx_prec_map = ~bus->flowcontrol;
 
         /* Send frames until the limit or some other event */
-        for (cnt = 0; (cnt < maxframes) && data_ok(bus); cnt++) {
+        for (cnt = 0; (cnt < maxframes) && data_ok(bus);) {
+                pkt_num = 1;
+                __skb_queue_head_init(&pktq);
+                if (bus->txglom)
+                        pkt_num = min_t(u8, bus->tx_max - bus->tx_seq,
+                                        brcmf_sdio_txglomsz);
+                pkt_num = min_t(u32, pkt_num,
+                                brcmu_pktq_mlen(&bus->txq, ~bus->flowcontrol));
                 spin_lock_bh(&bus->txqlock);
-                pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map, &prec_out);
-                if (pkt == NULL) {
-                        spin_unlock_bh(&bus->txqlock);
-                        break;
+                for (i = 0; i < pkt_num; i++) {
+                        pkt = brcmu_pktq_mdeq(&bus->txq, tx_prec_map,
+                                              &prec_out);
+                        if (pkt == NULL)
+                                break;
+                        __skb_queue_tail(&pktq, pkt);
                 }
                 spin_unlock_bh(&bus->txqlock);
+                if (i == 0)
+                        break;
 
-                ret = brcmf_sdbrcm_txpkt(bus, pkt, SDPCM_DATA_CHANNEL);
+                ret = brcmf_sdio_txpkt(bus, &pktq, SDPCM_DATA_CHANNEL);
+                cnt += i;
 
                 /* In poll mode, need to check for other events */
                 if (!bus->intr && cnt) {
@@ -2146,7 +2210,7 @@ static uint brcmf_sdbrcm_sendfromq(struct brcmf_sdio *bus, uint maxframes)
         return cnt;
 }
 
-static void brcmf_sdbrcm_bus_stop(struct device *dev)
+static void brcmf_sdio_bus_stop(struct device *dev)
 {
         u32 local_hostintmask;
         u8 saveclk;
@@ -2163,62 +2227,57 @@ static void brcmf_sdbrcm_bus_stop(struct device *dev)
                 bus->watchdog_tsk = NULL;
         }
 
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Enable clock for device interrupts */
-        brcmf_sdbrcm_bus_sleep(bus, false, false);
+        if (bus_if->state == BRCMF_BUS_DOWN) {
+                sdio_claim_host(sdiodev->func[1]);
+
+                /* Enable clock for device interrupts */
+                brcmf_sdio_bus_sleep(bus, false, false);
+
+                /* Disable and clear interrupts at the chip level also */
+                w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
+                local_hostintmask = bus->hostintmask;
+                bus->hostintmask = 0;
+
+                /* Force backplane clocks to assure F2 interrupt propagates */
+                saveclk = brcmf_sdiod_regrb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                            &err);
+                if (!err)
+                        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                          (saveclk | SBSDIO_FORCE_HT), &err);
+                if (err)
+                        brcmf_err("Failed to force clock for F2: err %d\n",
+                                  err);
 
-        /* Disable and clear interrupts at the chip level also */
-        w_sdreg32(bus, 0, offsetof(struct sdpcmd_regs, hostintmask));
-        local_hostintmask = bus->hostintmask;
-        bus->hostintmask = 0;
+                /* Turn off the bus (F2), free any pending packets */
+                brcmf_dbg(INTR, "disable SDIO interrupts\n");
+                sdio_disable_func(sdiodev->func[SDIO_FUNC_2]);
 
-        /* Change our idea of bus state */
-        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
+                /* Clear any pending interrupts now that F2 is disabled */
+                w_sdreg32(bus, local_hostintmask,
+                          offsetof(struct sdpcmd_regs, intstatus));
 
-        /* Force clocks on backplane to be sure F2 interrupt propagates */
-        saveclk = brcmf_sdio_regrb(bus->sdiodev,
-                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
-        if (!err) {
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                 (saveclk | SBSDIO_FORCE_HT), &err);
+                sdio_release_host(sdiodev->func[1]);
         }
-        if (err)
-                brcmf_err("Failed to force clock for F2: err %d\n", err);
-
-        /* Turn off the bus (F2), free any pending packets */
-        brcmf_dbg(INTR, "disable SDIO interrupts\n");
-        brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, SDIO_FUNC_ENABLE_1,
-                         NULL);
-
-        /* Clear any pending interrupts now that F2 is disabled */
-        w_sdreg32(bus, local_hostintmask,
-                  offsetof(struct sdpcmd_regs, intstatus));
-
-        /* Turn off the backplane clock (only) */
-        brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
-        sdio_release_host(bus->sdiodev->func[1]);
-
         /* Clear the data packet queues */
         brcmu_pktq_flush(&bus->txq, true, NULL, NULL);
 
         /* Clear any held glomming stuff */
         if (bus->glomd)
                 brcmu_pkt_buf_free_skb(bus->glomd);
-        brcmf_sdbrcm_free_glom(bus);
+        brcmf_sdio_free_glom(bus);
 
         /* Clear rx control and wake any waiters */
         spin_lock_bh(&bus->rxctl_lock);
         bus->rxlen = 0;
         spin_unlock_bh(&bus->rxctl_lock);
-        brcmf_sdbrcm_dcmd_resp_wake(bus);
+        brcmf_sdio_dcmd_resp_wake(bus);
 
         /* Reset some F2 state stuff */
         bus->rxskip = false;
         bus->tx_seq = bus->rx_seq = 0;
 }
 
-static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
+static inline void brcmf_sdio_clrintr(struct brcmf_sdio *bus)
 {
         unsigned long flags;
 
@@ -2243,7 +2302,7 @@ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
         addr = bus->ci->c_inf[idx].base +
                offsetof(struct sdpcmd_regs, intstatus);
 
-        ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, false);
+        val = brcmf_sdiod_regrl(bus->sdiodev, addr, &ret);
         bus->sdcnt.f1regdata++;
         if (ret != 0)
                 val = 0;
@@ -2253,7 +2312,7 @@ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
 
         /* Clear interrupts */
         if (val) {
-                ret = brcmf_sdio_regrw_helper(bus->sdiodev, addr, &val, true);
+                brcmf_sdiod_regwl(bus->sdiodev, addr, val, &ret);
                 bus->sdcnt.f1regdata++;
         }
 
@@ -2267,7 +2326,7 @@ static int brcmf_sdio_intr_rstatus(struct brcmf_sdio *bus)
         return ret;
 }
 
-static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
+static void brcmf_sdio_dpc(struct brcmf_sdio *bus)
 {
         u32 newstatus = 0;
         unsigned long intstatus;
@@ -2286,48 +2345,29 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
 
 #ifdef DEBUG
                 /* Check for inconsistent device control */
-                devctl = brcmf_sdio_regrb(bus->sdiodev,
-                                          SBSDIO_DEVICE_CTL, &err);
-                if (err) {
-                        brcmf_err("error reading DEVCTL: %d\n", err);
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                }
+                devctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                           SBSDIO_DEVICE_CTL, &err);
 #endif                          /* DEBUG */
 
                 /* Read CSR, if clock on switch to AVAIL, else ignore */
-                clkctl = brcmf_sdio_regrb(bus->sdiodev,
-                                          SBSDIO_FUNC1_CHIPCLKCSR, &err);
-                if (err) {
-                        brcmf_err("error reading CSR: %d\n",
-                                  err);
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                }
+                clkctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 
                 brcmf_dbg(SDIO, "DPC: PENDING, devctl 0x%02x clkctl 0x%02x\n",
                           devctl, clkctl);
 
                 if (SBSDIO_HTAV(clkctl)) {
-                        devctl = brcmf_sdio_regrb(bus->sdiodev,
-                                                  SBSDIO_DEVICE_CTL, &err);
-                        if (err) {
-                                brcmf_err("error reading DEVCTL: %d\n",
-                                          err);
-                                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                        }
+                        devctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                                   SBSDIO_DEVICE_CTL, &err);
                         devctl &= ~SBSDIO_DEVCTL_CA_INT_ONLY;
-                        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
-                                         devctl, &err);
-                        if (err) {
-                                brcmf_err("error writing DEVCTL: %d\n",
-                                          err);
-                                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-                        }
+                        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_DEVICE_CTL,
+                                          devctl, &err);
                         bus->clkstate = CLK_AVAIL;
                 }
         }
 
         /* Make sure backplane clock is on */
-        brcmf_sdbrcm_bus_sleep(bus, false, true);
+        brcmf_sdio_bus_sleep(bus, false, true);
 
         /* Pending interrupt indicates new device status */
         if (atomic_read(&bus->ipend) > 0) {
@@ -2358,7 +2398,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
         /* Handle host mailbox indication */
         if (intstatus & I_HMB_HOST_INT) {
                 intstatus &= ~I_HMB_HOST_INT;
-                intstatus |= brcmf_sdbrcm_hostmail(bus);
+                intstatus |= brcmf_sdio_hostmail(bus);
         }
 
         sdio_release_host(bus->sdiodev->func[1]);
@@ -2403,16 +2443,15 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                         set_bit(n, (unsigned long *)&bus->intstatus.counter);
         }
 
-        brcmf_sdbrcm_clrintr(bus);
+        brcmf_sdio_clrintr(bus);
 
         if (data_ok(bus) && bus->ctrl_frame_stat &&
                 (bus->clkstate == CLK_AVAIL)) {
                 int i;
 
                 sdio_claim_host(bus->sdiodev->func[1]);
-                err = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
-                        SDIO_FUNC_2, F2SYNC, bus->ctrl_frame_buf,
-                        (u32) bus->ctrl_frame_len);
+                err = brcmf_sdiod_send_buf(bus->sdiodev, bus->ctrl_frame_buf,
+                                           (u32)bus->ctrl_frame_len);
 
                 if (err < 0) {
                         /* On failure, abort the command and
@@ -2421,20 +2460,20 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                                   err);
                         bus->sdcnt.tx_sderrs++;
 
-                        brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
+                        brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
 
-                        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
-                                         SFC_WF_TERM, &err);
+                        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+                                          SFC_WF_TERM, &err);
                         bus->sdcnt.f1regdata++;
 
                         for (i = 0; i < 3; i++) {
                                 u8 hi, lo;
-                                hi = brcmf_sdio_regrb(bus->sdiodev,
-                                                      SBSDIO_FUNC1_WFRAMEBCHI,
-                                                      &err);
-                                lo = brcmf_sdio_regrb(bus->sdiodev,
-                                                      SBSDIO_FUNC1_WFRAMEBCLO,
-                                                      &err);
+                                hi = brcmf_sdiod_regrb(bus->sdiodev,
+                                                       SBSDIO_FUNC1_WFRAMEBCHI,
+                                                       &err);
+                                lo = brcmf_sdiod_regrb(bus->sdiodev,
+                                                       SBSDIO_FUNC1_WFRAMEBCLO,
+                                                       &err);
                                 bus->sdcnt.f1regdata += 2;
                                 if ((hi == 0) && (lo == 0))
                                         break;
@@ -2445,7 +2484,7 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                 }
                 sdio_release_host(bus->sdiodev->func[1]);
                 bus->ctrl_frame_stat = false;
-                brcmf_sdbrcm_wait_event_wakeup(bus);
+                brcmf_sdio_wait_event_wakeup(bus);
         }
         /* Send queued frames (limit 1 if rx may still be pending) */
         else if ((bus->clkstate == CLK_AVAIL) && !atomic_read(&bus->fcstate) &&
@@ -2453,13 +2492,12 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                  && data_ok(bus)) {
                 framecnt = bus->rxpending ? min(txlimit, bus->txminmax) :
                                             txlimit;
-                framecnt = brcmf_sdbrcm_sendfromq(bus, framecnt);
+                framecnt = brcmf_sdio_sendfromq(bus, framecnt);
                 txlimit -= framecnt;
         }
 
-        if ((bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) || (err != 0)) {
+        if (!brcmf_bus_ready(bus->sdiodev->bus_if) || (err != 0)) {
                 brcmf_err("failed backplane access over SDIO, halting operation\n");
-                bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
                 atomic_set(&bus->intstatus, 0);
         } else if (atomic_read(&bus->intstatus) ||
                    atomic_read(&bus->ipend) > 0 ||
@@ -2475,12 +2513,12 @@ static void brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
                 bus->activity = false;
                 brcmf_dbg(SDIO, "idle state\n");
                 sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdbrcm_bus_sleep(bus, true, false);
+                brcmf_sdio_bus_sleep(bus, true, false);
                 sdio_release_host(bus->sdiodev->func[1]);
         }
 }
 
-static struct pktq *brcmf_sdbrcm_bus_gettxq(struct device *dev)
+static struct pktq *brcmf_sdio_bus_gettxq(struct device *dev)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
@@ -2489,7 +2527,7 @@ static struct pktq *brcmf_sdbrcm_bus_gettxq(struct device *dev)
         return &bus->txq;
 }
 
-static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
+static int brcmf_sdio_bus_txdata(struct device *dev, struct sk_buff *pkt)
 {
         int ret = -EBADE;
         uint datalen, prec;
@@ -2545,7 +2583,7 @@ static int brcmf_sdbrcm_bus_txdata(struct device *dev, struct sk_buff *pkt)
 #ifdef DEBUG
 #define CONSOLE_LINE_MAX        192
 
-static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
+static int brcmf_sdio_readconsole(struct brcmf_sdio *bus)
 {
         struct brcmf_console *c = &bus->console;
         u8 line[CONSOLE_LINE_MAX], ch;
@@ -2558,8 +2596,8 @@ static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
 
         /* Read console log struct */
         addr = bus->console_addr + offsetof(struct rte_console, log_le);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
-                              sizeof(c->log_le));
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&c->log_le,
+                               sizeof(c->log_le));
         if (rv < 0)
                 return rv;
 
@@ -2584,7 +2622,7 @@ static int brcmf_sdbrcm_readconsole(struct brcmf_sdio *bus)
 
         /* Read the console buffer */
         addr = le32_to_cpu(c->log_le.buf);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, c->buf, c->bufsize);
         if (rv < 0)
                 return rv;
 
@@ -2622,14 +2660,13 @@ break2:
 }
 #endif                          /* DEBUG */
 
-static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
+static int brcmf_sdio_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
 {
         int i;
         int ret;
 
         bus->ctrl_frame_stat = false;
-        ret = brcmf_sdcard_send_buf(bus->sdiodev, bus->sdiodev->sbwad,
-                                    SDIO_FUNC_2, F2SYNC, frame, len);
+        ret = brcmf_sdiod_send_buf(bus->sdiodev, frame, len);
 
         if (ret < 0) {
                 /* On failure, abort the command and terminate the frame */
@@ -2637,18 +2674,18 @@ static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
                           ret);
                 bus->sdcnt.tx_sderrs++;
 
-                brcmf_sdcard_abort(bus->sdiodev, SDIO_FUNC_2);
+                brcmf_sdiod_abort(bus->sdiodev, SDIO_FUNC_2);
 
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
-                                 SFC_WF_TERM, NULL);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_FRAMECTRL,
+                                  SFC_WF_TERM, NULL);
                 bus->sdcnt.f1regdata++;
 
                 for (i = 0; i < 3; i++) {
                         u8 hi, lo;
-                        hi = brcmf_sdio_regrb(bus->sdiodev,
-                                              SBSDIO_FUNC1_WFRAMEBCHI, NULL);
-                        lo = brcmf_sdio_regrb(bus->sdiodev,
-                                              SBSDIO_FUNC1_WFRAMEBCLO, NULL);
+                        hi = brcmf_sdiod_regrb(bus->sdiodev,
+                                               SBSDIO_FUNC1_WFRAMEBCHI, NULL);
+                        lo = brcmf_sdiod_regrb(bus->sdiodev,
+                                               SBSDIO_FUNC1_WFRAMEBCLO, NULL);
                         bus->sdcnt.f1regdata += 2;
                         if (hi == 0 && lo == 0)
                                 break;
@@ -2662,10 +2699,10 @@ static int brcmf_tx_frame(struct brcmf_sdio *bus, u8 *frame, u16 len)
 }
 
 static int
-brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
+brcmf_sdio_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 {
         u8 *frame;
-        u16 len;
+        u16 len, pad;
         uint retries = 0;
         u8 doff = 0;
         int ret = -1;
@@ -2681,41 +2718,45 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
         len = (msglen += bus->tx_hdrlen);
 
         /* Add alignment padding (optional for ctl frames) */
-        doff = ((unsigned long)frame % BRCMF_SDALIGN);
+        doff = ((unsigned long)frame % bus->head_align);
         if (doff) {
                 frame -= doff;
                 len += doff;
                 msglen += doff;
                 memset(frame, 0, doff + bus->tx_hdrlen);
         }
-        /* precondition: doff < BRCMF_SDALIGN */
+        /* precondition: doff < bus->head_align */
         doff += bus->tx_hdrlen;
 
         /* Round send length to next SDIO block */
+        pad = 0;
         if (bus->roundup && bus->blocksize && (len > bus->blocksize)) {
-                u16 pad = bus->blocksize - (len % bus->blocksize);
-                if ((pad <= bus->roundup) && (pad < bus->blocksize))
-                        len += pad;
-        } else if (len % BRCMF_SDALIGN) {
-                len += BRCMF_SDALIGN - (len % BRCMF_SDALIGN);
+                pad = bus->blocksize - (len % bus->blocksize);
+                if ((pad > bus->roundup) || (pad >= bus->blocksize))
+                        pad = 0;
+        } else if (len % bus->head_align) {
+                pad = bus->head_align - (len % bus->head_align);
         }
-
-        /* Satisfy length-alignment requirements */
-        if (len & (ALIGNMENT - 1))
-                len = roundup(len, ALIGNMENT);
+        len += pad;
 
         /* precondition: IS_ALIGNED((unsigned long)frame, 2) */
 
         /* Make sure backplane clock is on */
         sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdbrcm_bus_sleep(bus, false, false);
+        brcmf_sdio_bus_sleep(bus, false, false);
         sdio_release_host(bus->sdiodev->func[1]);
 
         hd_info.len = (u16)msglen;
         hd_info.channel = SDPCM_CONTROL_CHANNEL;
         hd_info.dat_offset = doff;
+        hd_info.seq_num = bus->tx_seq;
+        hd_info.lastfrm = true;
+        hd_info.tail_pad = pad;
         brcmf_sdio_hdpack(bus, frame, &hd_info);
 
+        if (bus->txglom)
+                brcmf_sdio_update_hwhdr(frame, len);
+
         if (!data_ok(bus)) {
                 brcmf_dbg(INFO, "No bus credit bus->tx_max %d, bus->tx_seq %d\n",
                           bus->tx_max, bus->tx_seq);
@@ -2746,7 +2787,7 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
 
                 do {
                         sdio_claim_host(bus->sdiodev->func[1]);
-                        ret = brcmf_tx_frame(bus, frame, len);
+                        ret = brcmf_sdio_tx_frame(bus, frame, len);
                         sdio_release_host(bus->sdiodev->func[1]);
                 } while (ret < 0 && retries++ < TXRETRIES);
         }
@@ -2756,7 +2797,7 @@ brcmf_sdbrcm_bus_txctl(struct device *dev, unsigned char *msg, uint msglen)
                 bus->activity = false;
                 sdio_claim_host(bus->sdiodev->func[1]);
                 brcmf_dbg(INFO, "idle\n");
-                brcmf_sdbrcm_clkctl(bus, CLK_NONE, true);
+                brcmf_sdio_clkctl(bus, CLK_NONE, true);
                 sdio_release_host(bus->sdiodev->func[1]);
         }
 
@@ -2790,8 +2831,8 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
          * address of sdpcm_shared structure
          */
         sdio_claim_host(bus->sdiodev->func[1]);
-        brcmf_sdbrcm_bus_sleep(bus, false, false);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
+        brcmf_sdio_bus_sleep(bus, false, false);
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, shaddr, (u8 *)&addr_le, 4);
         sdio_release_host(bus->sdiodev->func[1]);
         if (rv < 0)
                 return rv;
@@ -2811,8 +2852,8 @@ static int brcmf_sdio_readshared(struct brcmf_sdio *bus,
         }
 
         /* Read hndrte_shared structure */
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
-                              sizeof(struct sdpcm_shared_le));
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr, (u8 *)&sh_le,
+                               sizeof(struct sdpcm_shared_le));
         if (rv < 0)
                 return rv;
 
@@ -2848,22 +2889,22 @@ static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
 
         /* obtain console information from device memory */
         addr = sh->console_addr + offsetof(struct rte_console, log_le);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
-                              (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
+                               (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_ptr = le32_to_cpu(sh_val);
 
         addr = sh->console_addr + offsetof(struct rte_console, log_le.buf_size);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
-                              (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
+                               (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_size = le32_to_cpu(sh_val);
 
         addr = sh->console_addr + offsetof(struct rte_console, log_le.idx);
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, addr,
-                              (u8 *)&sh_val, sizeof(u32));
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, addr,
+                               (u8 *)&sh_val, sizeof(u32));
         if (rv < 0)
                 return rv;
         console_index = le32_to_cpu(sh_val);
@@ -2877,8 +2918,8 @@ static int brcmf_sdio_dump_console(struct brcmf_sdio *bus,
 
         /* obtain the console data from device */
         conbuf[console_size] = '\0';
-        rv = brcmf_sdio_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
-                              console_size);
+        rv = brcmf_sdiod_ramrw(bus->sdiodev, false, console_ptr, (u8 *)conbuf,
+                               console_size);
         if (rv < 0)
                 goto done;
 
@@ -2915,8 +2956,8 @@ static int brcmf_sdio_trap_info(struct brcmf_sdio *bus, struct sdpcm_shared *sh,
                 return 0;
         }
 
-        error = brcmf_sdio_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
-                                 sizeof(struct brcmf_trap_info));
+        error = brcmf_sdiod_ramrw(bus->sdiodev, false, sh->trap_addr, (u8 *)&tr,
+                                  sizeof(struct brcmf_trap_info));
         if (error < 0)
                 return error;
 
@@ -2959,14 +3000,14 @@ static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
 
         sdio_claim_host(bus->sdiodev->func[1]);
         if (sh->assert_file_addr != 0) {
-                error = brcmf_sdio_ramrw(bus->sdiodev, false,
-                                         sh->assert_file_addr, (u8 *)file, 80);
+                error = brcmf_sdiod_ramrw(bus->sdiodev, false,
+                                          sh->assert_file_addr, (u8 *)file, 80);
                 if (error < 0)
                         return error;
         }
         if (sh->assert_exp_addr != 0) {
-                error = brcmf_sdio_ramrw(bus->sdiodev, false,
-                                         sh->assert_exp_addr, (u8 *)expr, 80);
+                error = brcmf_sdiod_ramrw(bus->sdiodev, false,
+                                          sh->assert_exp_addr, (u8 *)expr, 80);
                 if (error < 0)
                         return error;
         }
@@ -2978,7 +3019,7 @@ static int brcmf_sdio_assert_info(struct brcmf_sdio *bus,
         return simple_read_from_buffer(data, count, &pos, buf, res);
 }
 
-static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
+static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
 {
         int error;
         struct sdpcm_shared sh;
@@ -2999,8 +3040,8 @@ static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
         return 0;
 }
 
-static int brcmf_sdbrcm_died_dump(struct brcmf_sdio *bus, char __user *data,
-                                  size_t count, loff_t *ppos)
+static int brcmf_sdio_died_dump(struct brcmf_sdio *bus, char __user *data,
+                                size_t count, loff_t *ppos)
 {
         int error = 0;
         struct sdpcm_shared sh;
@@ -3041,7 +3082,7 @@ static ssize_t brcmf_sdio_forensic_read(struct file *f, char __user *data,
         struct brcmf_sdio *bus = f->private_data;
         int res;
 
-        res = brcmf_sdbrcm_died_dump(bus, data, count, ppos);
+        res = brcmf_sdio_died_dump(bus, data, count, ppos);
         if (res > 0)
                 *ppos += res;
         return (ssize_t)res;
@@ -3066,7 +3107,7 @@ static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
         brcmf_debugfs_create_sdio_count(drvr, &bus->sdcnt);
 }
 #else
-static int brcmf_sdbrcm_checkdied(struct brcmf_sdio *bus)
+static int brcmf_sdio_checkdied(struct brcmf_sdio *bus)
 {
         return 0;
 }
@@ -3077,7 +3118,7 @@ static void brcmf_sdio_debugfs_create(struct brcmf_sdio *bus)
 #endif /* DEBUG */
 
 static int
-brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
+brcmf_sdio_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
 {
         int timeleft;
         uint rxlen = 0;
@@ -3090,7 +3131,7 @@ brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
         brcmf_dbg(TRACE, "Enter\n");
 
         /* Wait until control frame is available */
-        timeleft = brcmf_sdbrcm_dcmd_resp_wait(bus, &bus->rxlen, &pending);
+        timeleft = brcmf_sdio_dcmd_resp_wait(bus, &bus->rxlen, &pending);
 
         spin_lock_bh(&bus->rxctl_lock);
         rxlen = bus->rxlen;
@@ -3107,13 +3148,13 @@ brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
                           rxlen, msglen);
         } else if (timeleft == 0) {
                 brcmf_err("resumed on timeout\n");
-                brcmf_sdbrcm_checkdied(bus);
+                brcmf_sdio_checkdied(bus);
         } else if (pending) {
                 brcmf_dbg(CTL, "cancelled\n");
                 return -ERESTARTSYS;
         } else {
                 brcmf_dbg(CTL, "resumed for unknown reason?\n");
-                brcmf_sdbrcm_checkdied(bus);
+                brcmf_sdio_checkdied(bus);
         }
 
         if (rxlen)
@@ -3124,46 +3165,69 @@ brcmf_sdbrcm_bus_rxctl(struct device *dev, unsigned char *msg, uint msglen)
         return rxlen ? (int)rxlen : -ETIMEDOUT;
 }
 
-static bool brcmf_sdbrcm_download_state(struct brcmf_sdio *bus, bool enter)
+#ifdef DEBUG
+static bool
+brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
+                        u8 *ram_data, uint ram_sz)
 {
-        struct chip_info *ci = bus->ci;
-
-        /* To enter download state, disable ARM and reset SOCRAM.
-         * To exit download state, simply reset ARM (default is RAM boot).
-         */
-        if (enter) {
-                bus->alp_only = true;
+        char *ram_cmp;
+        int err;
+        bool ret = true;
+        int address;
+        int offset;
+        int len;
 
-                brcmf_sdio_chip_enter_download(bus->sdiodev, ci);
-        } else {
-                if (!brcmf_sdio_chip_exit_download(bus->sdiodev, ci, bus->vars,
-                                                   bus->varsz))
-                        return false;
+        /* read back and verify */
+        brcmf_dbg(INFO, "Compare RAM dl & ul at 0x%08x; size=%d\n", ram_addr,
+                  ram_sz);
+        ram_cmp = kmalloc(MEMBLOCK, GFP_KERNEL);
+        /* do not proceed while no memory but  */
+        if (!ram_cmp)
+                return true;
 
-                /* Allow HT Clock now that the ARM is running. */
-                bus->alp_only = false;
-
-                bus->sdiodev->bus_if->state = BRCMF_BUS_LOAD;
+        address = ram_addr;
+        offset = 0;
+        while (offset < ram_sz) {
+                len = ((offset + MEMBLOCK) < ram_sz) ? MEMBLOCK :
+                      ram_sz - offset;
+                err = brcmf_sdiod_ramrw(sdiodev, false, address, ram_cmp, len);
+                if (err) {
+                        brcmf_err("error %d on reading %d membytes at 0x%08x\n",
+                                  err, len, address);
+                        ret = false;
+                        break;
+                } else if (memcmp(ram_cmp, &ram_data[offset], len)) {
+                        brcmf_err("Downloaded RAM image is corrupted, block offset is %d, len is %d\n",
+                                  offset, len);
+                        ret = false;
+                        break;
+                }
+                offset += len;
+                address += len;
         }
 
+        kfree(ram_cmp);
+
+        return ret;
+}
+#else   /* DEBUG */
+static bool
+brcmf_sdio_verifymemory(struct brcmf_sdio_dev *sdiodev, u32 ram_addr,
+                        u8 *ram_data, uint ram_sz)
+{
         return true;
 }
+#endif  /* DEBUG */
 
-static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
+static int brcmf_sdio_download_code_file(struct brcmf_sdio *bus,
+                                         const struct firmware *fw)
 {
-        const struct firmware *fw;
         int err;
         int offset;
         int address;
         int len;
 
-        fw = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_BIN);
-        if (fw == NULL)
-                return -ENOENT;
-
-        if (brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_ARM_CR4) !=
-            BRCMF_MAX_CORENUM)
-                memcpy(&bus->ci->rst_vec, fw->data, sizeof(bus->ci->rst_vec));
+        brcmf_dbg(TRACE, "Enter\n");
 
         err = 0;
         offset = 0;
@@ -3171,148 +3235,113 @@ static int brcmf_sdbrcm_download_code_file(struct brcmf_sdio *bus)
         while (offset < fw->size) {
                 len = ((offset + MEMBLOCK) < fw->size) ? MEMBLOCK :
                       fw->size - offset;
-                err = brcmf_sdio_ramrw(bus->sdiodev, true, address,
-                                       (u8 *)&fw->data[offset], len);
+                err = brcmf_sdiod_ramrw(bus->sdiodev, true, address,
+                                        (u8 *)&fw->data[offset], len);
                 if (err) {
                         brcmf_err("error %d on writing %d membytes at 0x%08x\n",
                                   err, len, address);
-                        goto failure;
+                        return err;
                 }
                 offset += len;
                 address += len;
         }
-
-failure:
-        release_firmware(fw);
+        if (!err)
+                if (!brcmf_sdio_verifymemory(bus->sdiodev, bus->ci->rambase,
+                                             (u8 *)fw->data, fw->size))
+                        err = -EIO;
 
         return err;
 }
 
-/*
- * ProcessVars:Takes a buffer of "<var>=<value>\n" lines read from a file
- * and ending in a NUL.
- * Removes carriage returns, empty lines, comment lines, and converts
- * newlines to NULs.
- * Shortens buffer as needed and pads with NULs.  End of buffer is marked
- * by two NULs.
-*/
-
-static int brcmf_process_nvram_vars(struct brcmf_sdio *bus,
-                                    const struct firmware *nv)
-{
-        char *varbuf;
-        char *dp;
-        bool findNewline;
-        int column;
-        int ret = 0;
-        uint buf_len, n, len;
-
-        len = nv->size;
-        varbuf = vmalloc(len);
-        if (!varbuf)
-                return -ENOMEM;
-
-        memcpy(varbuf, nv->data, len);
-        dp = varbuf;
-
-        findNewline = false;
-        column = 0;
-
-        for (n = 0; n < len; n++) {
-                if (varbuf[n] == 0)
-                        break;
-                if (varbuf[n] == '\r')
-                        continue;
-                if (findNewline && varbuf[n] != '\n')
-                        continue;
-                findNewline = false;
-                if (varbuf[n] == '#') {
-                        findNewline = true;
-                        continue;
-                }
-                if (varbuf[n] == '\n') {
-                        if (column == 0)
-                                continue;
-                        *dp++ = 0;
-                        column = 0;
-                        continue;
-                }
-                *dp++ = varbuf[n];
-                column++;
-        }
-        buf_len = dp - varbuf;
-        while (dp < varbuf + n)
-                *dp++ = 0;
-
-        kfree(bus->vars);
-        /* roundup needed for download to device */
-        bus->varsz = roundup(buf_len + 1, 4);
-        bus->vars = kmalloc(bus->varsz, GFP_KERNEL);
-        if (bus->vars == NULL) {
-                bus->varsz = 0;
-                ret = -ENOMEM;
-                goto err;
-        }
+static int brcmf_sdio_download_nvram(struct brcmf_sdio *bus,
+                                     const struct firmware *nv)
+{
+        void *vars;
+        u32 varsz;
+        int address;
+        int err;
 
-        /* copy the processed variables and add null termination */
-        memcpy(bus->vars, varbuf, buf_len);
-        bus->vars[buf_len] = 0;
-err:
-        vfree(varbuf);
-        return ret;
-}
+        brcmf_dbg(TRACE, "Enter\n");
 
-static int brcmf_sdbrcm_download_nvram(struct brcmf_sdio *bus)
-{
-        const struct firmware *nv;
-        int ret;
+        vars = brcmf_nvram_strip(nv, &varsz);
 
-        nv = brcmf_sdbrcm_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
-        if (nv == NULL)
-                return -ENOENT;
+        if (vars == NULL)
+                return -EINVAL;
 
-        ret = brcmf_process_nvram_vars(bus, nv);
+        address = bus->ci->ramsize - varsz + bus->ci->rambase;
+        err = brcmf_sdiod_ramrw(bus->sdiodev, true, address, vars, varsz);
+        if (err)
+                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
+                          err, varsz, address);
+        else if (!brcmf_sdio_verifymemory(bus->sdiodev, address, vars, varsz))
+                err = -EIO;
 
-        release_firmware(nv);
+        brcmf_nvram_free(vars);
 
-        return ret;
+        return err;
 }
 
-static int _brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
+static int brcmf_sdio_download_firmware(struct brcmf_sdio *bus)
 {
-        int bcmerror = -1;
+        int bcmerror = -EFAULT;
+        const struct firmware *fw;
+        u32 rstvec;
+
+        sdio_claim_host(bus->sdiodev->func[1]);
+        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
 
         /* Keep arm in reset */
-        if (!brcmf_sdbrcm_download_state(bus, true)) {
-                brcmf_err("error placing ARM core in reset\n");
+        brcmf_sdio_chip_enter_download(bus->sdiodev, bus->ci);
+
+        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_BIN);
+        if (fw == NULL) {
+                bcmerror = -ENOENT;
                 goto err;
         }
 
-        if (brcmf_sdbrcm_download_code_file(bus)) {
+        rstvec = get_unaligned_le32(fw->data);
+        brcmf_dbg(SDIO, "firmware rstvec: %x\n", rstvec);
+
+        bcmerror = brcmf_sdio_download_code_file(bus, fw);
+        release_firmware(fw);
+        if (bcmerror) {
                 brcmf_err("dongle image file download failed\n");
                 goto err;
         }
 
-        if (brcmf_sdbrcm_download_nvram(bus)) {
+        fw = brcmf_sdio_get_fw(bus, BRCMF_FIRMWARE_NVRAM);
+        if (fw == NULL) {
+                bcmerror = -ENOENT;
+                goto err;
+        }
+
+        bcmerror = brcmf_sdio_download_nvram(bus, fw);
+        release_firmware(fw);
+        if (bcmerror) {
                 brcmf_err("dongle nvram file download failed\n");
                 goto err;
         }
 
         /* Take arm out of reset */
-        if (!brcmf_sdbrcm_download_state(bus, false)) {
+        if (!brcmf_sdio_chip_exit_download(bus->sdiodev, bus->ci, rstvec)) {
                 brcmf_err("error getting out of ARM core reset\n");
                 goto err;
         }
 
+        /* Allow HT Clock now that the ARM is running. */
+        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_LOAD);
         bcmerror = 0;
 
 err:
+        brcmf_sdio_clkctl(bus, CLK_SDONLY, false);
+        sdio_release_host(bus->sdiodev->func[1]);
         return bcmerror;
 }
 
-static bool brcmf_sdbrcm_sr_capable(struct brcmf_sdio *bus)
+static bool brcmf_sdio_sr_capable(struct brcmf_sdio *bus)
 {
-        u32 addr, reg;
+        u32 addr, reg, pmu_cc3_mask = ~0;
+        int err;
 
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -3320,49 +3349,61 @@ static bool brcmf_sdbrcm_sr_capable(struct brcmf_sdio *bus)
         if (bus->ci->pmurev < 17)
                 return false;
 
-        /* read PMU chipcontrol register 3*/
-        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
-        brcmf_sdio_regwl(bus->sdiodev, addr, 3, NULL);
-        addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
-        reg = brcmf_sdio_regrl(bus->sdiodev, addr, NULL);
+        switch (bus->ci->chip) {
+        case BCM43241_CHIP_ID:
+        case BCM4335_CHIP_ID:
+        case BCM4339_CHIP_ID:
+                /* read PMU chipcontrol register 3 */
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_addr);
+                brcmf_sdiod_regwl(bus->sdiodev, addr, 3, NULL);
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, chipcontrol_data);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
+                return (reg & pmu_cc3_mask) != 0;
+        default:
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, pmucapabilities_ext);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, &err);
+                if ((reg & PCAPEXT_SR_SUPPORTED_MASK) == 0)
+                        return false;
 
-        return (bool)reg;
+                addr = CORE_CC_REG(bus->ci->c_inf[0].base, retention_ctl);
+                reg = brcmf_sdiod_regrl(bus->sdiodev, addr, NULL);
+                return (reg & (PMU_RCTL_MACPHY_DISABLE_MASK |
+                               PMU_RCTL_LOGIC_DISABLE_MASK)) == 0;
+        }
 }
 
-static void brcmf_sdbrcm_sr_init(struct brcmf_sdio *bus)
+static void brcmf_sdio_sr_init(struct brcmf_sdio *bus)
 {
         int err = 0;
         u8 val;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
-                               &err);
+        val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, &err);
         if (err) {
                 brcmf_err("error reading SBSDIO_FUNC1_WAKEUPCTRL\n");
                 return;
         }
 
         val |= 1 << SBSDIO_FUNC1_WCTRL_HTWAIT_SHIFT;
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL,
-                         val, &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_WAKEUPCTRL, val, &err);
         if (err) {
                 brcmf_err("error writing SBSDIO_FUNC1_WAKEUPCTRL\n");
                 return;
         }
 
         /* Add CMD14 Support */
-        brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
-                         (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
-                          SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
-                         &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SDIO_CCCR_BRCM_CARDCAP,
+                          (SDIO_CCCR_BRCM_CARDCAP_CMD14_SUPPORT |
+                           SDIO_CCCR_BRCM_CARDCAP_CMD14_EXT),
+                          &err);
         if (err) {
                 brcmf_err("error writing SDIO_CCCR_BRCM_CARDCAP\n");
                 return;
         }
 
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                         SBSDIO_FORCE_HT, &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                          SBSDIO_FORCE_HT, &err);
         if (err) {
                 brcmf_err("error writing SBSDIO_FUNC1_CHIPCLKCSR\n");
                 return;
@@ -3374,7 +3415,7 @@ static void brcmf_sdbrcm_sr_init(struct brcmf_sdio *bus)
 }
 
 /* enable KSO bit */
-static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
+static int brcmf_sdio_kso_init(struct brcmf_sdio *bus)
 {
         u8 val;
         int err = 0;
@@ -3385,8 +3426,7 @@ static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
         if (bus->ci->c_inf[1].rev < 12)
                 return 0;
 
-        val = brcmf_sdio_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-                               &err);
+        val = brcmf_sdiod_regrb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR, &err);
         if (err) {
                 brcmf_err("error reading SBSDIO_FUNC1_SLEEPCSR\n");
                 return err;
@@ -3395,8 +3435,8 @@ static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
         if (!(val & SBSDIO_FUNC1_SLEEPCSR_KSO_MASK)) {
                 val |= (SBSDIO_FUNC1_SLEEPCSR_KSO_EN <<
                         SBSDIO_FUNC1_SLEEPCSR_KSO_SHIFT);
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
-                                 val, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_SLEEPCSR,
+                                  val, &err);
                 if (err) {
                         brcmf_err("error writing SBSDIO_FUNC1_SLEEPCSR\n");
                         return err;
@@ -3407,31 +3447,70 @@ static int brcmf_sdbrcm_kso_init(struct brcmf_sdio *bus)
 }
 
 
-static bool
-brcmf_sdbrcm_download_firmware(struct brcmf_sdio *bus)
+static int brcmf_sdio_bus_preinit(struct device *dev)
 {
-        bool ret;
-
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        struct brcmf_bus *bus_if = dev_get_drvdata(dev);
+        struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
+        struct brcmf_sdio *bus = sdiodev->bus;
+        uint pad_size;
+        u32 value;
+        u8 idx;
+        int err;
 
-        ret = _brcmf_sdbrcm_download_firmware(bus) == 0;
+        /* the commands below use the terms tx and rx from
+         * a device perspective, ie. bus:txglom affects the
+         * bus transfers from device to host.
+         */
+        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
+        if (bus->ci->c_inf[idx].rev < 12) {
+                /* for sdio core rev < 12, disable txgloming */
+                value = 0;
+                err = brcmf_iovar_data_set(dev, "bus:txglom", &value,
+                                           sizeof(u32));
+        } else {
+                /* otherwise, set txglomalign */
+                value = 4;
+                if (sdiodev->pdata)
+                        value = sdiodev->pdata->sd_sgentry_align;
+                /* SDIO ADMA requires at least 32 bit alignment */
+                value = max_t(u32, value, 4);
+                err = brcmf_iovar_data_set(dev, "bus:txglomalign", &value,
+                                           sizeof(u32));
+        }
 
-        brcmf_sdbrcm_clkctl(bus, CLK_SDONLY, false);
+        if (err < 0)
+                goto done;
 
-        sdio_release_host(bus->sdiodev->func[1]);
+        bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
+        if (sdiodev->sg_support) {
+                bus->txglom = false;
+                value = 1;
+                pad_size = bus->sdiodev->func[2]->cur_blksize << 1;
+                bus->txglom_sgpad = brcmu_pkt_buf_get_skb(pad_size);
+                if (!bus->txglom_sgpad)
+                        brcmf_err("allocating txglom padding skb failed, reduced performance\n");
+
+                err = brcmf_iovar_data_set(bus->sdiodev->dev, "bus:rxglom",
+                                           &value, sizeof(u32));
+                if (err < 0) {
+                        /* bus:rxglom is allowed to fail */
+                        err = 0;
+                } else {
+                        bus->txglom = true;
+                        bus->tx_hdrlen += SDPCM_HWEXT_LEN;
+                }
+        }
+        brcmf_bus_add_txhdrlen(bus->sdiodev->dev, bus->tx_hdrlen);
 
-        return ret;
+done:
+        return err;
 }
 
-static int brcmf_sdbrcm_bus_init(struct device *dev)
+static int brcmf_sdio_bus_init(struct device *dev)
 {
         struct brcmf_bus *bus_if = dev_get_drvdata(dev);
         struct brcmf_sdio_dev *sdiodev = bus_if->bus_priv.sdio;
         struct brcmf_sdio *bus = sdiodev->bus;
-        unsigned long timeout;
-        u8 ready, enable;
         int err, ret = 0;
         u8 saveclk;
 
@@ -3439,8 +3518,11 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
 
         /* try to download image and nvram to the dongle */
         if (bus_if->state == BRCMF_BUS_DOWN) {
-                if (!(brcmf_sdbrcm_download_firmware(bus)))
-                        return -1;
+                bus->alp_only = true;
+                err = brcmf_sdio_download_firmware(bus);
+                if (err)
+                        return err;
+                bus->alp_only = false;
         }
 
         if (!bus->sdiodev->bus_if->drvr)
@@ -3448,21 +3530,21 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
 
         /* Start the watchdog timer */
         bus->sdcnt.tickcnt = 0;
-        brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
+        brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
 
         sdio_claim_host(bus->sdiodev->func[1]);
 
         /* Make sure backplane clock is on, needed to generate F2 interrupt */
-        brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
+        brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
         if (bus->clkstate != CLK_AVAIL)
                 goto exit;
 
         /* Force clocks on backplane to be sure F2 interrupt propagates */
-        saveclk = brcmf_sdio_regrb(bus->sdiodev,
-                                   SBSDIO_FUNC1_CHIPCLKCSR, &err);
+        saveclk = brcmf_sdiod_regrb(bus->sdiodev,
+                                    SBSDIO_FUNC1_CHIPCLKCSR, &err);
         if (!err) {
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                 (saveclk | SBSDIO_FORCE_HT), &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  (saveclk | SBSDIO_FORCE_HT), &err);
         }
         if (err) {
                 brcmf_err("Failed to force clock for F2: err %d\n", err);
@@ -3472,56 +3554,42 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
         /* Enable function 2 (frame transfers) */
         w_sdreg32(bus, SDPCM_PROT_VERSION << SMB_DATA_VERSION_SHIFT,
                   offsetof(struct sdpcmd_regs, tosbmailboxdata));
-        enable = (SDIO_FUNC_ENABLE_1 | SDIO_FUNC_ENABLE_2);
-
-        brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
+        err = sdio_enable_func(bus->sdiodev->func[SDIO_FUNC_2]);
 
-        timeout = jiffies + msecs_to_jiffies(BRCMF_WAIT_F2RDY);
-        ready = 0;
-        while (enable != ready) {
-                ready = brcmf_sdio_regrb(bus->sdiodev,
-                                         SDIO_CCCR_IORx, NULL);
-                if (time_after(jiffies, timeout))
-                        break;
-                else if (time_after(jiffies, timeout - BRCMF_WAIT_F2RDY + 50))
-                        /* prevent busy waiting if it takes too long */
-                        msleep_interruptible(20);
-        }
 
-        brcmf_dbg(INFO, "enable 0x%02x, ready 0x%02x\n", enable, ready);
+        brcmf_dbg(INFO, "enable F2: err=%d\n", err);
 
         /* If F2 successfully enabled, set core and enable interrupts */
-        if (ready == enable) {
+        if (!err) {
                 /* Set up the interrupt mask and enable interrupts */
                 bus->hostintmask = HOSTINTMASK;
                 w_sdreg32(bus, bus->hostintmask,
                           offsetof(struct sdpcmd_regs, hostintmask));
 
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_WATERMARK, 8, &err);
         } else {
                 /* Disable F2 again */
-                enable = SDIO_FUNC_ENABLE_1;
-                brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx, enable, NULL);
+                sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
                 ret = -ENODEV;
         }
 
-        if (brcmf_sdbrcm_sr_capable(bus)) {
-                brcmf_sdbrcm_sr_init(bus);
+        if (brcmf_sdio_sr_capable(bus)) {
+                brcmf_sdio_sr_init(bus);
         } else {
                 /* Restore previous clock setting */
-                brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                                 saveclk, &err);
+                brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                                  saveclk, &err);
         }
 
         if (ret == 0) {
-                ret = brcmf_sdio_intr_register(bus->sdiodev);
+                ret = brcmf_sdiod_intr_register(bus->sdiodev);
                 if (ret != 0)
                         brcmf_err("intr register failed:%d\n", ret);
         }
 
         /* If we didn't come up, turn off backplane clock */
-        if (bus_if->state != BRCMF_BUS_DATA)
-                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
+        if (ret != 0)
+                brcmf_sdio_clkctl(bus, CLK_NONE, false);
 
 exit:
         sdio_release_host(bus->sdiodev->func[1]);
@@ -3529,10 +3597,8 @@ exit:
         return ret;
 }
 
-void brcmf_sdbrcm_isr(void *arg)
+void brcmf_sdio_isr(struct brcmf_sdio *bus)
 {
-        struct brcmf_sdio *bus = (struct brcmf_sdio *) arg;
-
         brcmf_dbg(TRACE, "Enter\n");
 
         if (!bus) {
@@ -3540,7 +3606,7 @@ void brcmf_sdbrcm_isr(void *arg)
                 return;
         }
 
-        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+        if (!brcmf_bus_ready(bus->sdiodev->bus_if)) {
                 brcmf_err("bus is down. we have nothing to do\n");
                 return;
         }
@@ -3551,7 +3617,6 @@ void brcmf_sdbrcm_isr(void *arg)
         else
                 if (brcmf_sdio_intr_rstatus(bus)) {
                         brcmf_err("failed backplane access\n");
-                        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
                 }
 
         /* Disable additional interrupts (is this needed now)? */
@@ -3562,7 +3627,7 @@ void brcmf_sdbrcm_isr(void *arg)
         queue_work(bus->brcmf_wq, &bus->datawork);
 }
 
-static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
+static bool brcmf_sdio_bus_watchdog(struct brcmf_sdio *bus)
 {
 #ifdef DEBUG
         struct brcmf_bus *bus_if = dev_get_drvdata(bus->sdiodev->dev);
@@ -3586,9 +3651,9 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                                 u8 devpend;
 
                                 sdio_claim_host(bus->sdiodev->func[1]);
-                                devpend = brcmf_sdio_regrb(bus->sdiodev,
-                                                           SDIO_CCCR_INTx,
-                                                           NULL);
+                                devpend = brcmf_sdiod_regrb(bus->sdiodev,
+                                                            SDIO_CCCR_INTx,
+                                                            NULL);
                                 sdio_release_host(bus->sdiodev->func[1]);
                                 intstatus =
                                     devpend & (INTR_STATUS_FUNC1 |
@@ -3618,8 +3683,8 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                         bus->console.count -= bus->console_interval;
                         sdio_claim_host(bus->sdiodev->func[1]);
                         /* Make sure backplane clock is on */
-                        brcmf_sdbrcm_bus_sleep(bus, false, false);
-                        if (brcmf_sdbrcm_readconsole(bus) < 0)
+                        brcmf_sdio_bus_sleep(bus, false, false);
+                        if (brcmf_sdio_readconsole(bus) < 0)
                                 /* stop on error */
                                 bus->console_interval = 0;
                         sdio_release_host(bus->sdiodev->func[1]);
@@ -3633,11 +3698,11 @@ static bool brcmf_sdbrcm_bus_watchdog(struct brcmf_sdio *bus)
                         bus->idlecount = 0;
                         if (bus->activity) {
                                 bus->activity = false;
-                                brcmf_sdbrcm_wd_timer(bus, BRCMF_WD_POLL_MS);
+                                brcmf_sdio_wd_timer(bus, BRCMF_WD_POLL_MS);
                         } else {
                                 brcmf_dbg(SDIO, "idle\n");
                                 sdio_claim_host(bus->sdiodev->func[1]);
-                                brcmf_sdbrcm_bus_sleep(bus, true, false);
+                                brcmf_sdio_bus_sleep(bus, true, false);
                                 sdio_release_host(bus->sdiodev->func[1]);
                         }
                 }
@@ -3652,38 +3717,13 @@ static void brcmf_sdio_dataworker(struct work_struct *work)
                                               datawork);
 
         while (atomic_read(&bus->dpc_tskcnt)) {
-                brcmf_sdbrcm_dpc(bus);
+                brcmf_sdio_dpc(bus);
                 atomic_dec(&bus->dpc_tskcnt);
         }
 }
 
-static void brcmf_sdbrcm_release_malloc(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        kfree(bus->rxbuf);
-        bus->rxctl = bus->rxbuf = NULL;
-        bus->rxlen = 0;
-}
-
-static bool brcmf_sdbrcm_probe_malloc(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        if (bus->sdiodev->bus_if->maxctl) {
-                bus->rxblen =
-                    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
-                            ALIGNMENT) + BRCMF_SDALIGN;
-                bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
-                if (!(bus->rxbuf))
-                        return false;
-        }
-
-        return true;
-}
-
 static bool
-brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
+brcmf_sdio_probe_attach(struct brcmf_sdio *bus)
 {
         u8 clkctl = 0;
         int err = 0;
@@ -3691,23 +3731,21 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
         u32 reg_val;
         u32 drivestrength;
 
-        bus->alp_only = true;
-
         sdio_claim_host(bus->sdiodev->func[1]);
 
         pr_debug("F1 signature read @0x18000000=0x%4x\n",
-                 brcmf_sdio_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
+                 brcmf_sdiod_regrl(bus->sdiodev, SI_ENUM_BASE, NULL));
 
         /*
          * Force PLL off until brcmf_sdio_chip_attach()
          * programs PLL control regs
          */
 
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
-                         BRCMF_INIT_CLKCTL1, &err);
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR,
+                          BRCMF_INIT_CLKCTL1, &err);
         if (!err)
-                clkctl = brcmf_sdio_regrb(bus->sdiodev,
-                                          SBSDIO_FUNC1_CHIPCLKCSR, &err);
+                clkctl = brcmf_sdiod_regrb(bus->sdiodev,
+                                           SBSDIO_FUNC1_CHIPCLKCSR, &err);
 
         if (err || ((clkctl & ~SBSDIO_AVBITS) != BRCMF_INIT_CLKCTL1)) {
                 brcmf_err("ChipClkCSR access: err %d wrote 0x%02x read 0x%02x\n",
@@ -3715,12 +3753,17 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
                 goto fail;
         }
 
-        if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci, regsva)) {
+        /* SDIO register access works so moving
+         * state from UNKNOWN to DOWN.
+         */
+        brcmf_bus_change_state(bus->sdiodev->bus_if, BRCMF_BUS_DOWN);
+
+        if (brcmf_sdio_chip_attach(bus->sdiodev, &bus->ci)) {
                 brcmf_err("brcmf_sdio_chip_attach failed!\n");
                 goto fail;
         }
 
-        if (brcmf_sdbrcm_kso_init(bus)) {
+        if (brcmf_sdio_kso_init(bus)) {
                 brcmf_err("error enabling KSO\n");
                 goto fail;
         }
@@ -3739,33 +3782,33 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
         }
 
         /* Set card control so an SDIO card reset does a WLAN backplane reset */
-        reg_val = brcmf_sdio_regrb(bus->sdiodev,
-                                   SDIO_CCCR_BRCM_CARDCTRL, &err);
+        reg_val = brcmf_sdiod_regrb(bus->sdiodev,
+                                    SDIO_CCCR_BRCM_CARDCTRL, &err);
         if (err)
                 goto fail;
 
         reg_val |= SDIO_CCCR_BRCM_CARDCTRL_WLANRESET;
 
-        brcmf_sdio_regwb(bus->sdiodev,
-                         SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
+        brcmf_sdiod_regwb(bus->sdiodev,
+                          SDIO_CCCR_BRCM_CARDCTRL, reg_val, &err);
         if (err)
                 goto fail;
 
         /* set PMUControl so a backplane reset does PMU state reload */
         reg_addr = CORE_CC_REG(bus->ci->c_inf[0].base,
                                pmucontrol);
-        reg_val = brcmf_sdio_regrl(bus->sdiodev,
-                                   reg_addr,
-                                   &err);
+        reg_val = brcmf_sdiod_regrl(bus->sdiodev,
+                                    reg_addr,
+                                    &err);
         if (err)
                 goto fail;
 
         reg_val |= (BCMA_CC_PMU_CTL_RES_RELOAD << BCMA_CC_PMU_CTL_RES_SHIFT);
 
-        brcmf_sdio_regwl(bus->sdiodev,
-                         reg_addr,
-                         reg_val,
-                         &err);
+        brcmf_sdiod_regwl(bus->sdiodev,
+                          reg_addr,
+                          reg_val,
+                          &err);
         if (err)
                 goto fail;
 
@@ -3774,9 +3817,13 @@ brcmf_sdbrcm_probe_attach(struct brcmf_sdio *bus, u32 regsva)
 
         brcmu_pktq_init(&bus->txq, (PRIOMASK + 1), TXQLEN);
 
+        /* allocate header buffer */
+        bus->hdrbuf = kzalloc(MAX_HDR_READ + bus->head_align, GFP_KERNEL);
+        if (!bus->hdrbuf)
+                return false;
         /* Locate an appropriately-aligned portion of hdrbuf */
         bus->rxhdr = (u8 *) roundup((unsigned long)&bus->hdrbuf[0],
-                                    BRCMF_SDALIGN);
+                                    bus->head_align);
 
         /* Set the poll and/or interrupt flags */
         bus->intr = true;
@@ -3791,42 +3838,8 @@ fail:
         return false;
 }
 
-static bool brcmf_sdbrcm_probe_init(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        sdio_claim_host(bus->sdiodev->func[1]);
-
-        /* Disable F2 to clear any intermediate frame state on the dongle */
-        brcmf_sdio_regwb(bus->sdiodev, SDIO_CCCR_IOEx,
-                         SDIO_FUNC_ENABLE_1, NULL);
-
-        bus->sdiodev->bus_if->state = BRCMF_BUS_DOWN;
-        bus->rxflow = false;
-
-        /* Done with backplane-dependent accesses, can drop clock... */
-        brcmf_sdio_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
-
-        sdio_release_host(bus->sdiodev->func[1]);
-
-        /* ...and initialize clock/power states */
-        bus->clkstate = CLK_SDONLY;
-        bus->idletime = BRCMF_IDLE_INTERVAL;
-        bus->idleclock = BRCMF_IDLE_ACTIVE;
-
-        /* Query the F2 block size, set roundup accordingly */
-        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
-        bus->roundup = min(max_roundup, bus->blocksize);
-
-        /* SR state */
-        bus->sleeping = false;
-        bus->sr_enabled = false;
-
-        return true;
-}
-
 static int
-brcmf_sdbrcm_watchdog_thread(void *data)
+brcmf_sdio_watchdog_thread(void *data)
 {
         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
 
@@ -3836,7 +3849,7 @@ brcmf_sdbrcm_watchdog_thread(void *data)
                 if (kthread_should_stop())
                         break;
                 if (!wait_for_completion_interruptible(&bus->watchdog_wait)) {
-                        brcmf_sdbrcm_bus_watchdog(bus);
+                        brcmf_sdio_bus_watchdog(bus);
                         /* Count the tick for reference */
                         bus->sdcnt.tickcnt++;
                 } else
@@ -3846,7 +3859,7 @@ brcmf_sdbrcm_watchdog_thread(void *data)
 }
 
 static void
-brcmf_sdbrcm_watchdog(unsigned long data)
+brcmf_sdio_watchdog(unsigned long data)
 {
         struct brcmf_sdio *bus = (struct brcmf_sdio *)data;
 
@@ -3859,73 +3872,23 @@ brcmf_sdbrcm_watchdog(unsigned long data)
         }
 }
 
-static void brcmf_sdbrcm_release_dongle(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        if (bus->ci) {
-                sdio_claim_host(bus->sdiodev->func[1]);
-                brcmf_sdbrcm_clkctl(bus, CLK_AVAIL, false);
-                brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
-                sdio_release_host(bus->sdiodev->func[1]);
-                brcmf_sdio_chip_detach(&bus->ci);
-                if (bus->vars && bus->varsz)
-                        kfree(bus->vars);
-                bus->vars = NULL;
-        }
-
-        brcmf_dbg(TRACE, "Disconnected\n");
-}
-
-/* Detach and free everything */
-static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
-{
-        brcmf_dbg(TRACE, "Enter\n");
-
-        if (bus) {
-                /* De-register interrupt handler */
-                brcmf_sdio_intr_unregister(bus->sdiodev);
-
-                cancel_work_sync(&bus->datawork);
-                if (bus->brcmf_wq)
-                        destroy_workqueue(bus->brcmf_wq);
-
-                if (bus->sdiodev->bus_if->drvr) {
-                        brcmf_detach(bus->sdiodev->dev);
-                        brcmf_sdbrcm_release_dongle(bus);
-                }
-
-                brcmf_sdbrcm_release_malloc(bus);
-
-                kfree(bus);
-        }
-
-        brcmf_dbg(TRACE, "Disconnected\n");
-}
-
 static struct brcmf_bus_ops brcmf_sdio_bus_ops = {
-        .stop = brcmf_sdbrcm_bus_stop,
-        .init = brcmf_sdbrcm_bus_init,
-        .txdata = brcmf_sdbrcm_bus_txdata,
-        .txctl = brcmf_sdbrcm_bus_txctl,
-        .rxctl = brcmf_sdbrcm_bus_rxctl,
-        .gettxq = brcmf_sdbrcm_bus_gettxq,
+        .stop = brcmf_sdio_bus_stop,
+        .preinit = brcmf_sdio_bus_preinit,
+        .init = brcmf_sdio_bus_init,
+        .txdata = brcmf_sdio_bus_txdata,
+        .txctl = brcmf_sdio_bus_txctl,
+        .rxctl = brcmf_sdio_bus_rxctl,
+        .gettxq = brcmf_sdio_bus_gettxq,
 };
 
-void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
+struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev)
 {
         int ret;
         struct brcmf_sdio *bus;
-        struct brcmf_bus_dcmd *dlst;
-        u32 dngl_txglom;
-        u32 txglomalign = 0;
-        u8 idx;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* We make an assumption about address window mappings:
-         * regsva == SI_ENUM_BASE*/
-
         /* Allocate private bus interface state */
         bus = kzalloc(sizeof(struct brcmf_sdio), GFP_ATOMIC);
         if (!bus)
@@ -3939,6 +3902,18 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         bus->txminmax = BRCMF_TXMINMAX;
         bus->tx_seq = SDPCM_SEQ_WRAP - 1;
 
+        /* platform specific configuration:
+         *   alignments must be at least 4 bytes for ADMA
+         */
+        bus->head_align = ALIGNMENT;
+        bus->sgentry_align = ALIGNMENT;
+        if (sdiodev->pdata) {
+                if (sdiodev->pdata->sd_head_align > ALIGNMENT)
+                        bus->head_align = sdiodev->pdata->sd_head_align;
+                if (sdiodev->pdata->sd_sgentry_align > ALIGNMENT)
+                        bus->sgentry_align = sdiodev->pdata->sd_sgentry_align;
+        }
+
         INIT_WORK(&bus->datawork, brcmf_sdio_dataworker);
         bus->brcmf_wq = create_singlethread_workqueue("brcmf_wq");
         if (bus->brcmf_wq == NULL) {
@@ -3947,8 +3922,8 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         }
 
         /* attempt to attach to the dongle */
-        if (!(brcmf_sdbrcm_probe_attach(bus, regsva))) {
-                brcmf_err("brcmf_sdbrcm_probe_attach failed\n");
+        if (!(brcmf_sdio_probe_attach(bus))) {
+                brcmf_err("brcmf_sdio_probe_attach failed\n");
                 goto fail;
         }
 
@@ -3960,11 +3935,11 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         /* Set up the watchdog timer */
         init_timer(&bus->timer);
         bus->timer.data = (unsigned long)bus;
-        bus->timer.function = brcmf_sdbrcm_watchdog;
+        bus->timer.function = brcmf_sdio_watchdog;
 
         /* Initialize watchdog thread */
         init_completion(&bus->watchdog_wait);
-        bus->watchdog_tsk = kthread_run(brcmf_sdbrcm_watchdog_thread,
+        bus->watchdog_tsk = kthread_run(brcmf_sdio_watchdog_thread,
                                         bus, "brcmf_watchdog");
         if (IS_ERR(bus->watchdog_tsk)) {
                 pr_warn("brcmf_watchdog thread failed to start\n");
@@ -3983,50 +3958,52 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         bus->tx_hdrlen = SDPCM_HWHDR_LEN + SDPCM_SWHDR_LEN;
 
         /* Attach to the common layer, reserve hdr space */
-        ret = brcmf_attach(bus->tx_hdrlen, bus->sdiodev->dev);
+        ret = brcmf_attach(bus->sdiodev->dev);
         if (ret != 0) {
                 brcmf_err("brcmf_attach failed\n");
                 goto fail;
         }
 
         /* Allocate buffers */
-        if (!(brcmf_sdbrcm_probe_malloc(bus))) {
-                brcmf_err("brcmf_sdbrcm_probe_malloc failed\n");
-                goto fail;
+        if (bus->sdiodev->bus_if->maxctl) {
+                bus->rxblen =
+                    roundup((bus->sdiodev->bus_if->maxctl + SDPCM_HDRLEN),
+                            ALIGNMENT) + bus->head_align;
+                bus->rxbuf = kmalloc(bus->rxblen, GFP_ATOMIC);
+                if (!(bus->rxbuf)) {
+                        brcmf_err("rxbuf allocation failed\n");
+                        goto fail;
+                }
         }
 
-        if (!(brcmf_sdbrcm_probe_init(bus))) {
-                brcmf_err("brcmf_sdbrcm_probe_init failed\n");
-                goto fail;
-        }
+        sdio_claim_host(bus->sdiodev->func[1]);
+
+        /* Disable F2 to clear any intermediate frame state on the dongle */
+        sdio_disable_func(bus->sdiodev->func[SDIO_FUNC_2]);
+
+        bus->rxflow = false;
+
+        /* Done with backplane-dependent accesses, can drop clock... */
+        brcmf_sdiod_regwb(bus->sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, 0, NULL);
+
+        sdio_release_host(bus->sdiodev->func[1]);
+
+        /* ...and initialize clock/power states */
+        bus->clkstate = CLK_SDONLY;
+        bus->idletime = BRCMF_IDLE_INTERVAL;
+        bus->idleclock = BRCMF_IDLE_ACTIVE;
+
+        /* Query the F2 block size, set roundup accordingly */
+        bus->blocksize = bus->sdiodev->func[2]->cur_blksize;
+        bus->roundup = min(max_roundup, bus->blocksize);
+
+        /* SR state */
+        bus->sleeping = false;
+        bus->sr_enabled = false;
 
         brcmf_sdio_debugfs_create(bus);
         brcmf_dbg(INFO, "completed!!\n");
 
-        /* sdio bus core specific dcmd */
-        idx = brcmf_sdio_chip_getinfidx(bus->ci, BCMA_CORE_SDIO_DEV);
-        dlst = kzalloc(sizeof(struct brcmf_bus_dcmd), GFP_KERNEL);
-        if (dlst) {
-                if (bus->ci->c_inf[idx].rev < 12) {
-                        /* for sdio core rev < 12, disable txgloming */
-                        dngl_txglom = 0;
-                        dlst->name = "bus:txglom";
-                        dlst->param = (char *)&dngl_txglom;
-                        dlst->param_len = sizeof(u32);
-                } else {
-                        /* otherwise, set txglomalign */
-                        if (sdiodev->pdata)
-                                txglomalign = sdiodev->pdata->sd_sgentry_align;
-                        /* SDIO ADMA requires at least 32 bit alignment */
-                        if (txglomalign < 4)
-                                txglomalign = 4;
-                        dlst->name = "bus:txglomalign";
-                        dlst->param = (char *)&txglomalign;
-                        dlst->param_len = sizeof(u32);
-                }
-                list_add(&dlst->list, &bus->sdiodev->bus_if->dcmd_list);
-        }
-
         /* if firmware path present try to download and bring up bus */
         ret = brcmf_bus_start(bus->sdiodev->dev);
         if (ret != 0) {
@@ -4037,24 +4014,55 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
         return bus;
 
 fail:
-        brcmf_sdbrcm_release(bus);
+        brcmf_sdio_remove(bus);
         return NULL;
 }
 
-void brcmf_sdbrcm_disconnect(void *ptr)
+/* Detach and free everything */
+void brcmf_sdio_remove(struct brcmf_sdio *bus)
 {
-        struct brcmf_sdio *bus = (struct brcmf_sdio *)ptr;
-
         brcmf_dbg(TRACE, "Enter\n");
 
-        if (bus)
-                brcmf_sdbrcm_release(bus);
+        if (bus) {
+                /* De-register interrupt handler */
+                brcmf_sdiod_intr_unregister(bus->sdiodev);
+
+                cancel_work_sync(&bus->datawork);
+                if (bus->brcmf_wq)
+                        destroy_workqueue(bus->brcmf_wq);
+
+                if (bus->sdiodev->bus_if->drvr) {
+                        brcmf_detach(bus->sdiodev->dev);
+                }
+
+                if (bus->ci) {
+                        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN) {
+                                sdio_claim_host(bus->sdiodev->func[1]);
+                                brcmf_sdio_clkctl(bus, CLK_AVAIL, false);
+                                /* Leave the device in state where it is
+                                 * 'quiet'. This is done by putting it in
+                                 * download_state which essentially resets
+                                 * all necessary cores.
+                                 */
+                                msleep(20);
+                                brcmf_sdio_chip_enter_download(bus->sdiodev,
+                                                               bus->ci);
+                                brcmf_sdio_clkctl(bus, CLK_NONE, false);
+                                sdio_release_host(bus->sdiodev->func[1]);
+                        }
+                        brcmf_sdio_chip_detach(&bus->ci);
+                }
+
+                brcmu_pkt_buf_free_skb(bus->txglom_sgpad);
+                kfree(bus->rxbuf);
+                kfree(bus->hdrbuf);
+                kfree(bus);
+        }
 
         brcmf_dbg(TRACE, "Disconnected\n");
 }
 
-void
-brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
+void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick)
 {
         /* Totally stop the timer */
         if (!wdtick && bus->wd_timer_valid) {
@@ -4065,7 +4073,7 @@ brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick)
         }
 
         /* don't start the wd until fw is loaded */
-        if (bus->sdiodev->bus_if->state == BRCMF_BUS_DOWN)
+        if (bus->sdiodev->bus_if->state != BRCMF_BUS_DATA)
                 return;
 
         if (wdtick) {
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
index 14bc24dc5bae..51b53a73d074 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fweh.h
@@ -122,6 +122,52 @@ enum brcmf_fweh_event_code {
 #define BRCMF_EVENT_MSG_FLUSHTXQ        0x02
 #define BRCMF_EVENT_MSG_GROUP           0x04
 
+/* status field values in struct brcmf_event_msg */
+#define BRCMF_E_STATUS_SUCCESS                  0
+#define BRCMF_E_STATUS_FAIL                     1
+#define BRCMF_E_STATUS_TIMEOUT                  2
+#define BRCMF_E_STATUS_NO_NETWORKS              3
+#define BRCMF_E_STATUS_ABORT                    4
+#define BRCMF_E_STATUS_NO_ACK                   5
+#define BRCMF_E_STATUS_UNSOLICITED              6
+#define BRCMF_E_STATUS_ATTEMPT                  7
+#define BRCMF_E_STATUS_PARTIAL                  8
+#define BRCMF_E_STATUS_NEWSCAN                  9
+#define BRCMF_E_STATUS_NEWASSOC                 10
+#define BRCMF_E_STATUS_11HQUIET                 11
+#define BRCMF_E_STATUS_SUPPRESS                 12
+#define BRCMF_E_STATUS_NOCHANS                  13
+#define BRCMF_E_STATUS_CS_ABORT                 15
+#define BRCMF_E_STATUS_ERROR                    16
+
+/* reason field values in struct brcmf_event_msg */
+#define BRCMF_E_REASON_INITIAL_ASSOC            0
+#define BRCMF_E_REASON_LOW_RSSI                 1
+#define BRCMF_E_REASON_DEAUTH                   2
+#define BRCMF_E_REASON_DISASSOC                 3
+#define BRCMF_E_REASON_BCNS_LOST                4
+#define BRCMF_E_REASON_MINTXRATE                9
+#define BRCMF_E_REASON_TXFAIL                   10
+
+#define BRCMF_E_REASON_LINK_BSSCFG_DIS          4
+#define BRCMF_E_REASON_FAST_ROAM_FAILED         5
+#define BRCMF_E_REASON_DIRECTED_ROAM            6
+#define BRCMF_E_REASON_TSPEC_REJECTED           7
+#define BRCMF_E_REASON_BETTER_AP                8
+
+/* action field values for brcmf_ifevent */
+#define BRCMF_E_IF_ADD                          1
+#define BRCMF_E_IF_DEL                          2
+#define BRCMF_E_IF_CHANGE                       3
+
+/* flag field values for brcmf_ifevent */
+#define BRCMF_E_IF_FLAG_NOIF                    1
+
+/* role field values for brcmf_ifevent */
+#define BRCMF_E_IF_ROLE_STA                     0
+#define BRCMF_E_IF_ROLE_AP                      1
+#define BRCMF_E_IF_ROLE_WDS                     2
+
 /**
  * definitions for event packet validation.
  */
@@ -160,6 +206,14 @@ struct brcmf_event_msg {
         u8 bsscfgidx;
 };
 
+struct brcmf_if_event {
+        u8 ifidx;
+        u8 action;
+        u8 flags;
+        u8 bssidx;
+        u8 role;
+};
+
 typedef int (*brcmf_fweh_handler_t)(struct brcmf_if *ifp,
                                     const struct brcmf_event_msg *evtmsg,
                                     void *data);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
index 04f395930d86..22adbe311d20 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.c
@@ -27,6 +27,7 @@
 #include "dhd_dbg.h"
 #include "tracepoint.h"
 #include "fwil.h"
+#include "proto.h"
 
 
 #define MAX_HEX_DUMP_LEN        64
@@ -46,11 +47,9 @@ brcmf_fil_cmd_data(struct brcmf_if *ifp, u32 cmd, void *data, u32 len, bool set)
         if (data != NULL)
                 len = min_t(uint, len, BRCMF_DCMD_MAXLEN);
         if (set)
-                err = brcmf_proto_cdc_set_dcmd(drvr, ifp->ifidx, cmd, data,
-                                               len);
+                err = brcmf_proto_set_dcmd(drvr, ifp->ifidx, cmd, data, len);
         else
-                err = brcmf_proto_cdc_query_dcmd(drvr, ifp->ifidx, cmd, data,
-                                                 len);
+                err = brcmf_proto_query_dcmd(drvr, ifp->ifidx, cmd, data, len);
 
         if (err >= 0)
                 err = 0;
@@ -69,7 +68,7 @@ brcmf_fil_cmd_data_set(struct brcmf_if *ifp, u32 cmd, void *data, u32 len)
 
         brcmf_dbg(FIL, "cmd=%d, len=%d\n", cmd, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         err = brcmf_fil_cmd_data(ifp, cmd, data, len, true);
         mutex_unlock(&ifp->drvr->proto_block);
@@ -87,7 +86,7 @@ brcmf_fil_cmd_data_get(struct brcmf_if *ifp, u32 cmd, void *data, u32 len)
 
         brcmf_dbg(FIL, "cmd=%d, len=%d\n", cmd, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         mutex_unlock(&ifp->drvr->proto_block);
 
@@ -156,7 +155,7 @@ brcmf_fil_iovar_data_set(struct brcmf_if *ifp, char *name, void *data,
 
         brcmf_dbg(FIL, "name=%s, len=%d\n", name, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         buflen = brcmf_create_iovar(name, data, len, drvr->proto_buf,
                                     sizeof(drvr->proto_buf));
@@ -196,7 +195,7 @@ brcmf_fil_iovar_data_get(struct brcmf_if *ifp, char *name, void *data,
 
         brcmf_dbg(FIL, "name=%s, len=%d\n", name, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         mutex_unlock(&drvr->proto_block);
         return err;
@@ -279,7 +278,7 @@ brcmf_fil_bsscfg_data_set(struct brcmf_if *ifp, char *name,
 
         brcmf_dbg(FIL, "bssidx=%d, name=%s, len=%d\n", ifp->bssidx, name, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         buflen = brcmf_create_bsscfg(ifp->bssidx, name, data, len,
                                      drvr->proto_buf, sizeof(drvr->proto_buf));
@@ -318,7 +317,7 @@ brcmf_fil_bsscfg_data_get(struct brcmf_if *ifp, char *name,
         }
         brcmf_dbg(FIL, "bssidx=%d, name=%s, len=%d\n", ifp->bssidx, name, len);
         brcmf_dbg_hex_dump(BRCMF_FIL_ON(), data,
-                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data");
+                           min_t(uint, len, MAX_HEX_DUMP_LEN), "data\n");
 
         mutex_unlock(&drvr->proto_block);
         return err;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
index 16eb8202fb1e..77eae86e55c2 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil.h
@@ -17,6 +17,67 @@
 #ifndef _fwil_h_
 #define _fwil_h_
 
+/*******************************************************************************
+ * Dongle command codes that are interpreted by firmware
+ ******************************************************************************/
+#define BRCMF_C_GET_VERSION                     1
+#define BRCMF_C_UP                              2
+#define BRCMF_C_DOWN                            3
+#define BRCMF_C_SET_PROMISC                     10
+#define BRCMF_C_GET_RATE                        12
+#define BRCMF_C_GET_INFRA                       19
+#define BRCMF_C_SET_INFRA                       20
+#define BRCMF_C_GET_AUTH                        21
+#define BRCMF_C_SET_AUTH                        22
+#define BRCMF_C_GET_BSSID                       23
+#define BRCMF_C_GET_SSID                        25
+#define BRCMF_C_SET_SSID                        26
+#define BRCMF_C_TERMINATED                      28
+#define BRCMF_C_GET_CHANNEL                     29
+#define BRCMF_C_SET_CHANNEL                     30
+#define BRCMF_C_GET_SRL                         31
+#define BRCMF_C_SET_SRL                         32
+#define BRCMF_C_GET_LRL                         33
+#define BRCMF_C_SET_LRL                         34
+#define BRCMF_C_GET_RADIO                       37
+#define BRCMF_C_SET_RADIO                       38
+#define BRCMF_C_GET_PHYTYPE                     39
+#define BRCMF_C_SET_KEY                         45
+#define BRCMF_C_SET_PASSIVE_SCAN                49
+#define BRCMF_C_SCAN                            50
+#define BRCMF_C_SCAN_RESULTS                    51
+#define BRCMF_C_DISASSOC                        52
+#define BRCMF_C_REASSOC                         53
+#define BRCMF_C_SET_ROAM_TRIGGER                55
+#define BRCMF_C_SET_ROAM_DELTA                  57
+#define BRCMF_C_GET_BCNPRD                      75
+#define BRCMF_C_SET_BCNPRD                      76
+#define BRCMF_C_GET_DTIMPRD                     77
+#define BRCMF_C_SET_DTIMPRD                     78
+#define BRCMF_C_SET_COUNTRY                     84
+#define BRCMF_C_GET_PM                          85
+#define BRCMF_C_SET_PM                          86
+#define BRCMF_C_GET_CURR_RATESET                114
+#define BRCMF_C_GET_AP                          117
+#define BRCMF_C_SET_AP                          118
+#define BRCMF_C_GET_RSSI                        127
+#define BRCMF_C_GET_WSEC                        133
+#define BRCMF_C_SET_WSEC                        134
+#define BRCMF_C_GET_PHY_NOISE                   135
+#define BRCMF_C_GET_BSS_INFO                    136
+#define BRCMF_C_GET_BANDLIST                    140
+#define BRCMF_C_SET_SCB_TIMEOUT                 158
+#define BRCMF_C_GET_PHYLIST                     180
+#define BRCMF_C_SET_SCAN_CHANNEL_TIME           185
+#define BRCMF_C_SET_SCAN_UNASSOC_TIME           187
+#define BRCMF_C_SCB_DEAUTHENTICATE_FOR_REASON   201
+#define BRCMF_C_GET_VALID_CHANNELS              217
+#define BRCMF_C_GET_KEY_PRIMARY                 235
+#define BRCMF_C_SET_KEY_PRIMARY                 236
+#define BRCMF_C_SET_SCAN_PASSIVE_TIME           258
+#define BRCMF_C_GET_VAR                         262
+#define BRCMF_C_SET_VAR                         263
+
 s32 brcmf_fil_cmd_data_set(struct brcmf_if *ifp, u32 cmd, void *data, u32 len);
 s32 brcmf_fil_cmd_data_get(struct brcmf_if *ifp, u32 cmd, void *data, u32 len);
 s32 brcmf_fil_cmd_int_set(struct brcmf_if *ifp, u32 cmd, u32 data);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
index ecabb04f33c3..af17a5bc8b83 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h
@@ -29,6 +29,24 @@
 #define BRCMF_ARP_OL_HOST_AUTO_REPLY    0x00000004
 #define BRCMF_ARP_OL_PEER_AUTO_REPLY    0x00000008
 
+#define BRCMF_BSS_INFO_VERSION  109 /* curr ver of brcmf_bss_info_le struct */
+#define BRCMF_BSS_RSSI_ON_CHANNEL       0x0002
+
+#define BRCMF_STA_ASSOC                 0x10            /* Associated */
+
+/* size of brcmf_scan_params not including variable length array */
+#define BRCMF_SCAN_PARAMS_FIXED_SIZE    64
+
+/* masks for channel and ssid count */
+#define BRCMF_SCAN_PARAMS_COUNT_MASK    0x0000ffff
+#define BRCMF_SCAN_PARAMS_NSSID_SHIFT   16
+
+/* primary (ie tx) key */
+#define BRCMF_PRIMARY_KEY               (1 << 1)
+#define DOT11_BSSTYPE_ANY               2
+#define BRCMF_ESCAN_REQ_VERSION         1
+
+#define BRCMF_MAXRATES_IN_SET           16      /* max # of rates in rateset */
 
 enum brcmf_fil_p2p_if_types {
         BRCMF_FIL_P2P_IF_CLIENT,
@@ -90,4 +108,290 @@ enum brcmf_tdls_manual_ep_ops {
         BRCMF_TDLS_MANUAL_EP_DISCOVERY = 6
 };
 
+/* Pattern matching filter. Specifies an offset within received packets to
+ * start matching, the pattern to match, the size of the pattern, and a bitmask
+ * that indicates which bits within the pattern should be matched.
+ */
+struct brcmf_pkt_filter_pattern_le {
+        /*
+         * Offset within received packet to start pattern matching.
+         * Offset '0' is the first byte of the ethernet header.
+         */
+        __le32 offset;
+        /* Size of the pattern.  Bitmask must be the same size.*/
+        __le32 size_bytes;
+        /*
+         * Variable length mask and pattern data. mask starts at offset 0.
+         * Pattern immediately follows mask.
+         */
+        u8 mask_and_pattern[1];
+};
+
+/* IOVAR "pkt_filter_add" parameter. Used to install packet filters. */
+struct brcmf_pkt_filter_le {
+        __le32 id;              /* Unique filter id, specified by app. */
+        __le32 type;            /* Filter type (WL_PKT_FILTER_TYPE_xxx). */
+        __le32 negate_match;    /* Negate the result of filter matches */
+        union {                 /* Filter definitions */
+                struct brcmf_pkt_filter_pattern_le pattern; /* Filter pattern */
+        } u;
+};
+
+/* IOVAR "pkt_filter_enable" parameter. */
+struct brcmf_pkt_filter_enable_le {
+        __le32 id;              /* Unique filter id */
+        __le32 enable;          /* Enable/disable bool */
+};
+
+/* BSS info structure
+ * Applications MUST CHECK ie_offset field and length field to access IEs and
+ * next bss_info structure in a vector (in struct brcmf_scan_results)
+ */
+struct brcmf_bss_info_le {
+        __le32 version;         /* version field */
+        __le32 length;          /* byte length of data in this record,
+                                 * starting at version and including IEs
+                                 */
+        u8 BSSID[ETH_ALEN];
+        __le16 beacon_period;   /* units are Kusec */
+        __le16 capability;      /* Capability information */
+        u8 SSID_len;
+        u8 SSID[32];
+        struct {
+                __le32 count;   /* # rates in this set */
+                u8 rates[16]; /* rates in 500kbps units w/hi bit set if basic */
+        } rateset;              /* supported rates */
+        __le16 chanspec;        /* chanspec for bss */
+        __le16 atim_window;     /* units are Kusec */
+        u8 dtim_period; /* DTIM period */
+        __le16 RSSI;            /* receive signal strength (in dBm) */
+        s8 phy_noise;           /* noise (in dBm) */
+
+        u8 n_cap;               /* BSS is 802.11N Capable */
+        /* 802.11N BSS Capabilities (based on HT_CAP_*): */
+        __le32 nbss_cap;
+        u8 ctl_ch;              /* 802.11N BSS control channel number */
+        __le32 reserved32[1];   /* Reserved for expansion of BSS properties */
+        u8 flags;               /* flags */
+        u8 reserved[3]; /* Reserved for expansion of BSS properties */
+        u8 basic_mcs[MCSSET_LEN];       /* 802.11N BSS required MCS set */
+
+        __le16 ie_offset;       /* offset at which IEs start, from beginning */
+        __le32 ie_length;       /* byte length of Information Elements */
+        __le16 SNR;             /* average SNR of during frame reception */
+        /* Add new fields here */
+        /* variable length Information Elements */
+};
+
+struct brcm_rateset_le {
+        /* # rates in this set */
+        __le32 count;
+        /* rates in 500kbps units w/hi bit set if basic */
+        u8 rates[BRCMF_MAXRATES_IN_SET];
+};
+
+struct brcmf_ssid {
+        u32 SSID_len;
+        unsigned char SSID[32];
+};
+
+struct brcmf_ssid_le {
+        __le32 SSID_len;
+        unsigned char SSID[32];
+};
+
+struct brcmf_scan_params_le {
+        struct brcmf_ssid_le ssid_le;   /* default: {0, ""} */
+        u8 bssid[ETH_ALEN];     /* default: bcast */
+        s8 bss_type;            /* default: any,
+                                 * DOT11_BSSTYPE_ANY/INFRASTRUCTURE/INDEPENDENT
+                                 */
+        u8 scan_type;   /* flags, 0 use default */
+        __le32 nprobes;   /* -1 use default, number of probes per channel */
+        __le32 active_time;     /* -1 use default, dwell time per channel for
+                                 * active scanning
+                                 */
+        __le32 passive_time;    /* -1 use default, dwell time per channel
+                                 * for passive scanning
+                                 */
+        __le32 home_time;       /* -1 use default, dwell time for the
+                                 * home channel between channel scans
+                                 */
+        __le32 channel_num;     /* count of channels and ssids that follow
+                                 *
+                                 * low half is count of channels in
+                                 * channel_list, 0 means default (use all
+                                 * available channels)
+                                 *
+                                 * high half is entries in struct brcmf_ssid
+                                 * array that follows channel_list, aligned for
+                                 * s32 (4 bytes) meaning an odd channel count
+                                 * implies a 2-byte pad between end of
+                                 * channel_list and first ssid
+                                 *
+                                 * if ssid count is zero, single ssid in the
+                                 * fixed parameter portion is assumed, otherwise
+                                 * ssid in the fixed portion is ignored
+                                 */
+        __le16 channel_list[1]; /* list of chanspecs */
+};
+
+struct brcmf_scan_results {
+        u32 buflen;
+        u32 version;
+        u32 count;
+        struct brcmf_bss_info_le bss_info_le[];
+};
+
+struct brcmf_escan_params_le {
+        __le32 version;
+        __le16 action;
+        __le16 sync_id;
+        struct brcmf_scan_params_le params_le;
+};
+
+struct brcmf_escan_result_le {
+        __le32 buflen;
+        __le32 version;
+        __le16 sync_id;
+        __le16 bss_count;
+        struct brcmf_bss_info_le bss_info_le;
+};
+
+#define WL_ESCAN_RESULTS_FIXED_SIZE (sizeof(struct brcmf_escan_result_le) - \
+        sizeof(struct brcmf_bss_info_le))
+
+/* used for association with a specific BSSID and chanspec list */
+struct brcmf_assoc_params_le {
+        /* 00:00:00:00:00:00: broadcast scan */
+        u8 bssid[ETH_ALEN];
+        /* 0: all available channels, otherwise count of chanspecs in
+         * chanspec_list */
+        __le32 chanspec_num;
+        /* list of chanspecs */
+        __le16 chanspec_list[1];
+};
+
+/* used for join with or without a specific bssid and channel list */
+struct brcmf_join_params {
+        struct brcmf_ssid_le ssid_le;
+        struct brcmf_assoc_params_le params_le;
+};
+
+/* scan params for extended join */
+struct brcmf_join_scan_params_le {
+        u8 scan_type;           /* 0 use default, active or passive scan */
+        __le32 nprobes;         /* -1 use default, nr of probes per channel */
+        __le32 active_time;     /* -1 use default, dwell time per channel for
+                                 * active scanning
+                                 */
+        __le32 passive_time;    /* -1 use default, dwell time per channel
+                                 * for passive scanning
+                                 */
+        __le32 home_time;       /* -1 use default, dwell time for the home
+                                 * channel between channel scans
+                                 */
+};
+
+/* extended join params */
+struct brcmf_ext_join_params_le {
+        struct brcmf_ssid_le ssid_le;   /* {0, ""}: wildcard scan */
+        struct brcmf_join_scan_params_le scan_le;
+        struct brcmf_assoc_params_le assoc_le;
+};
+
+struct brcmf_wsec_key {
+        u32 index;              /* key index */
+        u32 len;                /* key length */
+        u8 data[WLAN_MAX_KEY_LEN];      /* key data */
+        u32 pad_1[18];
+        u32 algo;       /* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+        u32 flags;      /* misc flags */
+        u32 pad_2[3];
+        u32 iv_initialized;     /* has IV been initialized already? */
+        u32 pad_3;
+        /* Rx IV */
+        struct {
+                u32 hi; /* upper 32 bits of IV */
+                u16 lo; /* lower 16 bits of IV */
+        } rxiv;
+        u32 pad_4[2];
+        u8 ea[ETH_ALEN];        /* per station */
+};
+
+/*
+ * dongle requires same struct as above but with fields in little endian order
+ */
+struct brcmf_wsec_key_le {
+        __le32 index;           /* key index */
+        __le32 len;             /* key length */
+        u8 data[WLAN_MAX_KEY_LEN];      /* key data */
+        __le32 pad_1[18];
+        __le32 algo;    /* CRYPTO_ALGO_AES_CCM, CRYPTO_ALGO_WEP128, etc */
+        __le32 flags;   /* misc flags */
+        __le32 pad_2[3];
+        __le32 iv_initialized;  /* has IV been initialized already? */
+        __le32 pad_3;
+        /* Rx IV */
+        struct {
+                __le32 hi;      /* upper 32 bits of IV */
+                __le16 lo;      /* lower 16 bits of IV */
+        } rxiv;
+        __le32 pad_4[2];
+        u8 ea[ETH_ALEN];        /* per station */
+};
+
+/* Used to get specific STA parameters */
+struct brcmf_scb_val_le {
+        __le32 val;
+        u8 ea[ETH_ALEN];
+};
+
+/* channel encoding */
+struct brcmf_channel_info_le {
+        __le32 hw_channel;
+        __le32 target_channel;
+        __le32 scan_channel;
+};
+
+struct brcmf_sta_info_le {
+        __le16  ver;            /* version of this struct */
+        __le16  len;            /* length in bytes of this structure */
+        __le16  cap;            /* sta's advertised capabilities */
+        __le32  flags;          /* flags defined below */
+        __le32  idle;           /* time since data pkt rx'd from sta */
+        u8      ea[ETH_ALEN];           /* Station address */
+        __le32  count;                  /* # rates in this set */
+        u8      rates[BRCMF_MAXRATES_IN_SET];   /* rates in 500kbps units */
+                                                /* w/hi bit set if basic */
+        __le32  in;             /* seconds elapsed since associated */
+        __le32  listen_interval_inms; /* Min Listen interval in ms for STA */
+        __le32  tx_pkts;        /* # of packets transmitted */
+        __le32  tx_failures;    /* # of packets failed */
+        __le32  rx_ucast_pkts;  /* # of unicast packets received */
+        __le32  rx_mcast_pkts;  /* # of multicast packets received */
+        __le32  tx_rate;        /* Rate of last successful tx frame */
+        __le32  rx_rate;        /* Rate of last successful rx frame */
+        __le32  rx_decrypt_succeeds;    /* # of packet decrypted successfully */
+        __le32  rx_decrypt_failures;    /* # of packet decrypted failed */
+};
+
+struct brcmf_chanspec_list {
+        __le32  count;          /* # of entries */
+        __le32  element[1];     /* variable length uint32 list */
+};
+
+/*
+ * WLC_E_PROBRESP_MSG
+ * WLC_E_P2P_PROBREQ_MSG
+ * WLC_E_ACTION_FRAME_RX
+ */
+struct brcmf_rx_mgmt_data {
+        __be16  version;
+        __be16  chanspec;
+        __be32  rssi;
+        __be32  mactime;
+        __be32  rate;
+};
+
 #endif /* FWIL_TYPES_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
index d0cd0bf95c5a..c3e7d76dbf35 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
@@ -27,7 +27,6 @@
 #include <brcmu_utils.h>
 #include <brcmu_wifi.h>
 #include "dhd.h"
-#include "dhd_proto.h"
 #include "dhd_dbg.h"
 #include "dhd_bus.h"
 #include "fwil.h"
@@ -36,6 +35,7 @@
 #include "fwsignal.h"
 #include "p2p.h"
 #include "wl_cfg80211.h"
+#include "proto.h"
 
 /**
  * DOC: Firmware Signalling
@@ -105,6 +105,7 @@ static struct {
 };
 #undef BRCMF_FWS_TLV_DEF
 
+
 static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 {
         int i;
@@ -123,6 +124,12 @@ static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 #endif /* DEBUG */
 
 /*
+ * The PKTTAG tlv has additional bytes when firmware-signalling
+ * mode has REUSESEQ flag set.
+ */
+#define BRCMF_FWS_TYPE_SEQ_LEN                          2
+
+/*
  * flags used to enable tlv signalling from firmware.
  */
 #define BRCMF_FWS_FLAGS_RSSI_SIGNALS                    0x0001
@@ -147,8 +154,15 @@ static const char *brcmf_fws_get_tlv_name(enum brcmf_fws_tlv_type id)
 #define BRCMF_FWS_HTOD_FLAG_PKTFROMHOST                 0x01
 #define BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED               0x02
 
-#define BRCMF_FWS_RET_OK_NOSCHEDULE     0
-#define BRCMF_FWS_RET_OK_SCHEDULE       1
+#define BRCMF_FWS_RET_OK_NOSCHEDULE                     0
+#define BRCMF_FWS_RET_OK_SCHEDULE                       1
+
+#define BRCMF_FWS_MODE_REUSESEQ_SHIFT                   3       /* seq reuse */
+#define BRCMF_FWS_MODE_SET_REUSESEQ(x, val)     ((x) = \
+                ((x) & ~(1 << BRCMF_FWS_MODE_REUSESEQ_SHIFT)) | \
+                (((val) & 1) << BRCMF_FWS_MODE_REUSESEQ_SHIFT))
+#define BRCMF_FWS_MODE_GET_REUSESEQ(x)  \
+                (((x) >> BRCMF_FWS_MODE_REUSESEQ_SHIFT) & 1)
 
 /**
  * enum brcmf_fws_skb_state - indicates processing state of skb.
@@ -171,6 +185,7 @@ enum brcmf_fws_skb_state {
  * @bus_flags: 2 bytes reserved for bus specific parameters
  * @if_flags: holds interface index and packet related flags.
  * @htod: host to device packet identifier (used in PKTTAG tlv).
+ * @htod_seq: this 16-bit is original seq number for every suppress packet.
  * @state: transmit state of the packet.
  * @mac: descriptor related to destination for this packet.
  *
@@ -181,6 +196,7 @@ struct brcmf_skbuff_cb {
         u16 bus_flags;
         u16 if_flags;
         u32 htod;
+        u16 htod_seq;
         enum brcmf_fws_skb_state state;
         struct brcmf_fws_mac_descriptor *mac;
 };
@@ -257,6 +273,22 @@ struct brcmf_skbuff_cb {
                         BRCMF_SKB_HTOD_TAG_ ## field ## _MASK, \
                         BRCMF_SKB_HTOD_TAG_ ## field ## _SHIFT)
 
+#define BRCMF_SKB_HTOD_SEQ_FROMFW_MASK                  0x2000
+#define BRCMF_SKB_HTOD_SEQ_FROMFW_SHIFT                 13
+#define BRCMF_SKB_HTOD_SEQ_FROMDRV_MASK                 0x1000
+#define BRCMF_SKB_HTOD_SEQ_FROMDRV_SHIFT                12
+#define BRCMF_SKB_HTOD_SEQ_NR_MASK                      0x0fff
+#define BRCMF_SKB_HTOD_SEQ_NR_SHIFT                     0
+
+#define brcmf_skb_htod_seq_set_field(skb, field, value) \
+        brcmu_maskset16(&(brcmf_skbcb(skb)->htod_seq), \
+                        BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
+                        BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT, (value))
+#define brcmf_skb_htod_seq_get_field(skb, field) \
+        brcmu_maskget16(brcmf_skbcb(skb)->htod_seq, \
+                        BRCMF_SKB_HTOD_SEQ_ ## field ## _MASK, \
+                        BRCMF_SKB_HTOD_SEQ_ ## field ## _SHIFT)
+
 #define BRCMF_FWS_TXSTAT_GENERATION_MASK        0x80000000
 #define BRCMF_FWS_TXSTAT_GENERATION_SHIFT       31
 #define BRCMF_FWS_TXSTAT_FLAGS_MASK             0x78000000
@@ -265,8 +297,8 @@ struct brcmf_skbuff_cb {
 #define BRCMF_FWS_TXSTAT_FIFO_SHIFT             24
 #define BRCMF_FWS_TXSTAT_HSLOT_MASK             0x00FFFF00
 #define BRCMF_FWS_TXSTAT_HSLOT_SHIFT            8
-#define BRCMF_FWS_TXSTAT_PKTID_MASK             0x00FFFFFF
-#define BRCMF_FWS_TXSTAT_PKTID_SHIFT            0
+#define BRCMF_FWS_TXSTAT_FREERUN_MASK           0x000000FF
+#define BRCMF_FWS_TXSTAT_FREERUN_SHIFT          0
 
 #define brcmf_txstatus_get_field(txs, field) \
         brcmu_maskget32(txs, BRCMF_FWS_TXSTAT_ ## field ## _MASK, \
@@ -443,6 +475,7 @@ struct brcmf_fws_info {
         unsigned long borrow_defer_timestamp;
         bool bus_flow_blocked;
         bool creditmap_received;
+        u8 mode;
 };
 
 /*
@@ -805,20 +838,23 @@ static void brcmf_fws_cleanup(struct brcmf_fws_info *fws, int ifidx)
         brcmf_fws_hanger_cleanup(fws, matchfn, ifidx);
 }
 
-static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
+static u8 brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
 {
         struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
         u8 *wlh;
         u16 data_offset = 0;
         u8 fillers;
         __le32 pkttag = cpu_to_le32(brcmf_skbcb(skb)->htod);
+        __le16 pktseq = cpu_to_le16(brcmf_skbcb(skb)->htod_seq);
 
-        brcmf_dbg(TRACE, "enter: %s, idx=%d pkttag=0x%08X, hslot=%d\n",
+        brcmf_dbg(TRACE, "enter: %s, idx=%d hslot=%d htod %X seq %X\n",
                   entry->name, brcmf_skb_if_flags_get_field(skb, INDEX),
-                  le32_to_cpu(pkttag), (le32_to_cpu(pkttag) >> 8) & 0xffff);
+                  (le32_to_cpu(pkttag) >> 8) & 0xffff,
+                  brcmf_skbcb(skb)->htod, brcmf_skbcb(skb)->htod_seq);
         if (entry->send_tim_signal)
                 data_offset += 2 + BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN;
-
+        if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode))
+                data_offset += BRCMF_FWS_TYPE_SEQ_LEN;
         /* +2 is for Type[1] and Len[1] in TLV, plus TIM signal */
         data_offset += 2 + BRCMF_FWS_TYPE_PKTTAG_LEN;
         fillers = round_up(data_offset, 4) - data_offset;
@@ -830,7 +866,12 @@ static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
         wlh[0] = BRCMF_FWS_TYPE_PKTTAG;
         wlh[1] = BRCMF_FWS_TYPE_PKTTAG_LEN;
         memcpy(&wlh[2], &pkttag, sizeof(pkttag));
-        wlh += BRCMF_FWS_TYPE_PKTTAG_LEN + 2;
+        if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
+                wlh[1] += BRCMF_FWS_TYPE_SEQ_LEN;
+                memcpy(&wlh[2 + BRCMF_FWS_TYPE_PKTTAG_LEN], &pktseq,
+                       sizeof(pktseq));
+        }
+        wlh += wlh[1] + 2;
 
         if (entry->send_tim_signal) {
                 entry->send_tim_signal = 0;
@@ -846,9 +887,7 @@ static int brcmf_fws_hdrpush(struct brcmf_fws_info *fws, struct sk_buff *skb)
         if (fillers)
                 memset(wlh, BRCMF_FWS_TYPE_FILLER, fillers);
 
-        brcmf_proto_hdrpush(fws->drvr, brcmf_skb_if_flags_get_field(skb, INDEX),
-                            data_offset >> 2, skb);
-        return 0;
+        return (u8)(data_offset >> 2);
 }
 
 static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
@@ -856,10 +895,11 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
                                  int fifo, bool send_immediately)
 {
         struct sk_buff *skb;
-        struct brcmf_bus *bus;
         struct brcmf_skbuff_cb *skcb;
         s32 err;
         u32 len;
+        u8 data_offset;
+        int ifidx;
 
         /* check delayedQ and suppressQ in one call using bitmap */
         if (brcmu_pktq_mlen(&entry->psq, 3 << (fifo * 2)) == 0)
@@ -875,6 +915,7 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
                 /* create a dummy packet and sent that. The traffic          */
                 /* bitmap info will automatically be attached to that packet */
                 len = BRCMF_FWS_TYPE_PKTTAG_LEN + 2 +
+                      BRCMF_FWS_TYPE_SEQ_LEN +
                       BRCMF_FWS_TYPE_PENDING_TRAFFIC_BMP_LEN + 2 +
                       4 + fws->drvr->hdrlen;
                 skb = brcmu_pkt_buf_get_skb(len);
@@ -884,13 +925,13 @@ static bool brcmf_fws_tim_update(struct brcmf_fws_info *fws,
                 skcb = brcmf_skbcb(skb);
                 skcb->mac = entry;
                 skcb->state = BRCMF_FWS_SKBSTATE_TIM;
-                bus = fws->drvr->bus_if;
-                err = brcmf_fws_hdrpush(fws, skb);
-                if (err == 0) {
-                        brcmf_fws_unlock(fws);
-                        err = brcmf_bus_txdata(bus, skb);
-                        brcmf_fws_lock(fws);
-                }
+                skcb->htod = 0;
+                skcb->htod_seq = 0;
+                data_offset = brcmf_fws_hdrpush(fws, skb);
+                ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
+                brcmf_fws_unlock(fws);
+                err = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
+                brcmf_fws_lock(fws);
                 if (err)
                         brcmu_pkt_buf_free_skb(skb);
                 return true;
@@ -1172,8 +1213,13 @@ static int brcmf_fws_enq(struct brcmf_fws_info *fws,
 {
         int prec = 2 * fifo;
         u32 *qfull_stat = &fws->stats.delayq_full_error;
-
         struct brcmf_fws_mac_descriptor *entry;
+        struct pktq *pq;
+        struct sk_buff_head *queue;
+        struct sk_buff *p_head;
+        struct sk_buff *p_tail;
+        u32 fr_new;
+        u32 fr_compare;
 
         entry = brcmf_skbcb(p)->mac;
         if (entry == NULL) {
@@ -1185,9 +1231,55 @@ static int brcmf_fws_enq(struct brcmf_fws_info *fws,
         if (state == BRCMF_FWS_SKBSTATE_SUPPRESSED) {
                 prec += 1;
                 qfull_stat = &fws->stats.supprq_full_error;
-        }
 
-        if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
+                /* Fix out of order delivery of frames. Dont assume frame    */
+                /* can be inserted at the end, but look for correct position */
+                pq = &entry->psq;
+                if (pktq_full(pq) || pktq_pfull(pq, prec)) {
+                        *qfull_stat += 1;
+                        return -ENFILE;
+                }
+                queue = &pq->q[prec].skblist;
+
+                p_head = skb_peek(queue);
+                p_tail = skb_peek_tail(queue);
+                fr_new = brcmf_skb_htod_tag_get_field(p, FREERUN);
+
+                while (p_head != p_tail) {
+                        fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
+                                                                  FREERUN);
+                        /* be sure to handle wrap of 256 */
+                        if (((fr_new > fr_compare) &&
+                             ((fr_new - fr_compare) < 128)) ||
+                            ((fr_new < fr_compare) &&
+                             ((fr_compare - fr_new) > 128)))
+                                break;
+                        p_tail = skb_queue_prev(queue, p_tail);
+                }
+                /* Position found. Determine what to do */
+                if (p_tail == NULL) {
+                        /* empty list */
+                        __skb_queue_tail(queue, p);
+                } else {
+                        fr_compare = brcmf_skb_htod_tag_get_field(p_tail,
+                                                                  FREERUN);
+                        if (((fr_new > fr_compare) &&
+                             ((fr_new - fr_compare) < 128)) ||
+                            ((fr_new < fr_compare) &&
+                             ((fr_compare - fr_new) > 128))) {
+                                /* After tail */
+                                __skb_queue_after(queue, p_tail, p);
+                        } else {
+                                /* Before tail */
+                                __skb_insert(p, p_tail->prev, p_tail, queue);
+                        }
+                }
+
+                /* Complete the counters and statistics */
+                pq->len++;
+                if (pq->hi_prec < prec)
+                        pq->hi_prec = (u8) prec;
+        } else if (brcmu_pktq_penq(&entry->psq, prec, p) == NULL) {
                 *qfull_stat += 1;
                 return -ENFILE;
         }
@@ -1277,7 +1369,8 @@ done:
 }
 
 static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
-                                         struct sk_buff *skb, u32 genbit)
+                                         struct sk_buff *skb, u32 genbit,
+                                         u16 seq)
 {
         struct brcmf_fws_mac_descriptor *entry = brcmf_skbcb(skb)->mac;
         u32 hslot;
@@ -1297,9 +1390,19 @@ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
         entry->generation = genbit;
 
         ret = brcmf_proto_hdrpull(fws->drvr, false, &ifidx, skb);
-        if (ret == 0)
+        if (ret == 0) {
+                brcmf_skb_htod_tag_set_field(skb, GENERATION, genbit);
+                brcmf_skbcb(skb)->htod_seq = seq;
+                if (brcmf_skb_htod_seq_get_field(skb, FROMFW)) {
+                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 1);
+                        brcmf_skb_htod_seq_set_field(skb, FROMFW, 0);
+                } else {
+                        brcmf_skb_htod_seq_set_field(skb, FROMDRV, 0);
+                }
                 ret = brcmf_fws_enq(fws, BRCMF_FWS_SKBSTATE_SUPPRESSED, fifo,
                                     skb);
+        }
+
         if (ret != 0) {
                 /* suppress q is full or hdrpull failed, drop this packet */
                 brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &skb,
@@ -1317,7 +1420,7 @@ static int brcmf_fws_txstatus_suppressed(struct brcmf_fws_info *fws, int fifo,
 
 static int
 brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
-                           u32 genbit)
+                      u32 genbit, u16 seq)
 {
         u32 fifo;
         int ret;
@@ -1360,8 +1463,8 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         if (entry->suppressed && entry->suppr_transit_count)
                 entry->suppr_transit_count--;
 
-        brcmf_dbg(DATA, "%s flags %X htod %X\n", entry->name, skcb->if_flags,
-                  skcb->htod);
+        brcmf_dbg(DATA, "%s flags %d htod %X seq %X\n", entry->name, flags,
+                  skcb->htod, seq);
 
         /* pick up the implicit credit from this packet */
         fifo = brcmf_skb_htod_tag_get_field(skb, FIFO);
@@ -1374,7 +1477,8 @@ brcmf_fws_txs_process(struct brcmf_fws_info *fws, u8 flags, u32 hslot,
         brcmf_fws_macdesc_return_req_credit(skb);
 
         if (!remove_from_hanger)
-                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit);
+                ret = brcmf_fws_txstatus_suppressed(fws, fifo, skb, genbit,
+                                                    seq);
 
         if (remove_from_hanger || ret)
                 brcmf_txfinalize(fws->drvr, skb, true);
@@ -1406,10 +1510,12 @@ static int brcmf_fws_fifocreditback_indicate(struct brcmf_fws_info *fws,
 static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
 {
         __le32 status_le;
+        __le16 seq_le;
         u32 status;
         u32 hslot;
         u32 genbit;
         u8 flags;
+        u16 seq;
 
         fws->stats.txs_indicate++;
         memcpy(&status_le, data, sizeof(status_le));
@@ -1417,9 +1523,16 @@ static int brcmf_fws_txstatus_indicate(struct brcmf_fws_info *fws, u8 *data)
         flags = brcmf_txstatus_get_field(status, FLAGS);
         hslot = brcmf_txstatus_get_field(status, HSLOT);
         genbit = brcmf_txstatus_get_field(status, GENERATION);
+        if (BRCMF_FWS_MODE_GET_REUSESEQ(fws->mode)) {
+                memcpy(&seq_le, &data[BRCMF_FWS_TYPE_PKTTAG_LEN],
+                       sizeof(seq_le));
+                seq = le16_to_cpu(seq_le);
+        } else {
+                seq = 0;
+        }
 
         brcmf_fws_lock(fws);
-        brcmf_fws_txs_process(fws, flags, hslot, genbit);
+        brcmf_fws_txs_process(fws, flags, hslot, genbit, seq);
         brcmf_fws_unlock(fws);
         return BRCMF_FWS_RET_OK_NOSCHEDULE;
 }
@@ -1603,15 +1716,15 @@ int brcmf_fws_hdrpull(struct brcmf_pub *drvr, int ifidx, s16 signal_len,
         return 0;
 }
 
-static void brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
+static u8 brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
                                    struct sk_buff *p)
 {
         struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
         struct brcmf_fws_mac_descriptor *entry = skcb->mac;
         u8 flags;
 
-        brcmf_skb_if_flags_set_field(p, TRANSMIT, 1);
-        brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation);
+        if (skcb->state != BRCMF_FWS_SKBSTATE_SUPPRESSED)
+                brcmf_skb_htod_tag_set_field(p, GENERATION, entry->generation);
         flags = BRCMF_FWS_HTOD_FLAG_PKTFROMHOST;
         if (brcmf_skb_if_flags_get_field(p, REQUESTED)) {
                 /*
@@ -1621,7 +1734,7 @@ static void brcmf_fws_precommit_skb(struct brcmf_fws_info *fws, int fifo,
                 flags |= BRCMF_FWS_HTOD_FLAG_PKT_REQUESTED;
         }
         brcmf_skb_htod_tag_set_field(p, FLAGS, flags);
-        brcmf_fws_hdrpush(fws, p);
+        return brcmf_fws_hdrpush(fws, p);
 }
 
 static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
@@ -1652,7 +1765,7 @@ static void brcmf_fws_rollback_toq(struct brcmf_fws_info *fws,
                 fws->stats.rollback_failed++;
                 hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
                 brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED,
-                                      hslot, 0);
+                                      hslot, 0, 0);
         } else {
                 fws->stats.rollback_success++;
                 brcmf_fws_return_credits(fws, fifo, 1);
@@ -1689,20 +1802,21 @@ static int brcmf_fws_commit_skb(struct brcmf_fws_info *fws, int fifo,
 {
         struct brcmf_skbuff_cb *skcb = brcmf_skbcb(skb);
         struct brcmf_fws_mac_descriptor *entry;
-        struct brcmf_bus *bus = fws->drvr->bus_if;
         int rc;
         u8 ifidx;
+        u8 data_offset;
 
         entry = skcb->mac;
         if (IS_ERR(entry))
                 return PTR_ERR(entry);
 
-        brcmf_fws_precommit_skb(fws, fifo, skb);
+        data_offset = brcmf_fws_precommit_skb(fws, fifo, skb);
         entry->transit_count++;
         if (entry->suppressed)
                 entry->suppr_transit_count++;
+        ifidx = brcmf_skb_if_flags_get_field(skb, INDEX);
         brcmf_fws_unlock(fws);
-        rc = brcmf_bus_txdata(bus, skb);
+        rc = brcmf_proto_txdata(fws->drvr, ifidx, data_offset, skb);
         brcmf_fws_lock(fws);
         brcmf_dbg(DATA, "%s flags %X htod %X bus_tx %d\n", entry->name,
                   skcb->if_flags, skcb->htod, rc);
@@ -1732,6 +1846,8 @@ static int brcmf_fws_assign_htod(struct brcmf_fws_info *fws, struct sk_buff *p,
         struct brcmf_skbuff_cb *skcb = brcmf_skbcb(p);
         int rc, hslot;
 
+        skcb->htod = 0;
+        skcb->htod_seq = 0;
         hslot = brcmf_fws_hanger_get_free_slot(&fws->hanger);
         brcmf_skb_htod_tag_set_field(p, HSLOT, hslot);
         brcmf_skb_htod_tag_set_field(p, FREERUN, skcb->mac->seq[fifo]);
@@ -1757,7 +1873,7 @@ int brcmf_fws_process_skb(struct brcmf_if *ifp, struct sk_buff *skb)
         brcmf_dbg(DATA, "tx proto=0x%X\n", ntohs(eh->h_proto));
         /* determine the priority */
         if (!skb->priority)
-                skb->priority = cfg80211_classify8021d(skb);
+                skb->priority = cfg80211_classify8021d(skb, NULL);
 
         drvr->tx_multicast += !!multicast;
         if (pae)
@@ -1861,10 +1977,9 @@ static void brcmf_fws_dequeue_worker(struct work_struct *worker)
                                                         &skb, true);
                                 ifidx = brcmf_skb_if_flags_get_field(skb,
                                                                      INDEX);
-                                brcmf_proto_hdrpush(drvr, ifidx, 0, skb);
-                                /* Use bus module to send data frame */
+                                /* Use proto layer to send data frame */
                                 brcmf_fws_unlock(fws);
-                                ret = brcmf_bus_txdata(drvr->bus_if, skb);
+                                ret = brcmf_proto_txdata(drvr, ifidx, 0, skb);
                                 brcmf_fws_lock(fws);
                                 if (ret < 0)
                                         brcmf_txfinalize(drvr, skb, false);
@@ -1908,6 +2023,7 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
         struct brcmf_fws_info *fws;
         u32 tlv = BRCMF_FWS_FLAGS_RSSI_SIGNALS;
         int rc;
+        u32 mode;
 
         drvr->fws = kzalloc(sizeof(*(drvr->fws)), GFP_KERNEL);
         if (!drvr->fws) {
@@ -1966,6 +2082,18 @@ int brcmf_fws_init(struct brcmf_pub *drvr)
         if (brcmf_fil_iovar_int_set(drvr->iflist[0], "ampdu_hostreorder", 1))
                 brcmf_dbg(INFO, "enabling AMPDU host-reorder failed\n");
 
+        /* Enable seq number reuse, if supported */
+        if (brcmf_fil_iovar_int_get(drvr->iflist[0], "wlfc_mode", &mode) == 0) {
+                if (BRCMF_FWS_MODE_GET_REUSESEQ(mode)) {
+                        mode = 0;
+                        BRCMF_FWS_MODE_SET_REUSESEQ(mode, 1);
+                        if (brcmf_fil_iovar_int_set(drvr->iflist[0],
+                                                    "wlfc_mode", mode) == 0) {
+                                BRCMF_FWS_MODE_SET_REUSESEQ(fws->mode, 1);
+                        }
+                }
+        }
+
         brcmf_fws_hanger_init(&fws->hanger);
         brcmf_fws_macdesc_init(&fws->desc.other, NULL, 0);
         brcmf_fws_macdesc_set_name(fws, &fws->desc.other);
@@ -2022,7 +2150,7 @@ void brcmf_fws_bustxfail(struct brcmf_fws_info *fws, struct sk_buff *skb)
         }
         brcmf_fws_lock(fws);
         hslot = brcmf_skb_htod_tag_get_field(skb, HSLOT);
-        brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0);
+        brcmf_fws_txs_process(fws, BRCMF_FWS_TXSTATUS_HOST_TOSSED, hslot, 0, 0);
         brcmf_fws_unlock(fws);
 }
 
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.c b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
new file mode 100644
index 000000000000..d5ef86db631b
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/firmware.h>
+
+#include "nvram.h"
+
+/* brcmf_nvram_strip :Takes a buffer of "<var>=<value>\n" lines read from a file
+ * and ending in a NUL. Removes carriage returns, empty lines, comment lines,
+ * and converts newlines to NULs. Shortens buffer as needed and pads with NULs.
+ * End of buffer is completed with token identifying length of buffer.
+ */
+void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length)
+{
+        u8 *nvram;
+        u32 i;
+        u32 len;
+        u32 column;
+        u8 val;
+        bool comment;
+        u32 token;
+        __le32 token_le;
+
+        /* Alloc for extra 0 byte + roundup by 4 + length field */
+        nvram = kmalloc(nv->size + 1 + 3 + sizeof(token_le), GFP_KERNEL);
+        if (!nvram)
+                return NULL;
+
+        len = 0;
+        column = 0;
+        comment = false;
+        for (i = 0; i < nv->size; i++) {
+                val = nv->data[i];
+                if (val == 0)
+                        break;
+                if (val == '\r')
+                        continue;
+                if (comment && (val != '\n'))
+                        continue;
+                comment = false;
+                if (val == '#') {
+                        comment = true;
+                        continue;
+                }
+                if (val == '\n') {
+                        if (column == 0)
+                                continue;
+                        nvram[len] = 0;
+                        len++;
+                        column = 0;
+                        continue;
+                }
+                nvram[len] = val;
+                len++;
+                column++;
+        }
+        column = len;
+        *new_length = roundup(len + 1, 4);
+        while (column != *new_length) {
+                nvram[column] = 0;
+                column++;
+        }
+
+        token = *new_length / 4;
+        token = (~token << 16) | (token & 0x0000FFFF);
+        token_le = cpu_to_le32(token);
+
+        memcpy(&nvram[*new_length], &token_le, sizeof(token_le));
+        *new_length += sizeof(token_le);
+
+        return nvram;
+}
+
+void brcmf_nvram_free(void *nvram)
+{
+        kfree(nvram);
+}
+
+
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/nvram.h b/drivers/net/wireless/brcm80211/brcmfmac/nvram.h
new file mode 100644
index 000000000000..d454580928c9
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/nvram.h
@@ -0,0 +1,24 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef BRCMFMAC_NVRAM_H
+#define BRCMFMAC_NVRAM_H
+
+
+void *brcmf_nvram_strip(const struct firmware *nv, u32 *new_length);
+void brcmf_nvram_free(void *nvram);
+
+
+#endif /* BRCMFMAC_NVRAM_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
index 4a2293041821..fc4f98b275d7 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/p2p.c
@@ -812,7 +812,7 @@ static s32 brcmf_p2p_run_escan(struct brcmf_cfg80211_info *cfg,
                         struct ieee80211_channel *chan = request->channels[i];
 
                         if (chan->flags & (IEEE80211_CHAN_RADAR |
-                                           IEEE80211_CHAN_PASSIVE_SCAN))
+                                           IEEE80211_CHAN_NO_IR))
                                 continue;
 
                         chanspecs[i] = channel_to_chanspec(&p2p->cfg->d11inf,
@@ -1243,7 +1243,7 @@ bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
                                             IEEE80211_P2P_ATTR_DEVICE_ID,
                                             p2p_dev_addr, sizeof(p2p_dev_addr));
         if ((err >= 0) &&
-            (!memcmp(p2p_dev_addr, afx_hdl->tx_dst_addr, ETH_ALEN))) {
+            (ether_addr_equal(p2p_dev_addr, afx_hdl->tx_dst_addr))) {
                 if (!bi->ctl_ch) {
                         ch.chspec = le16_to_cpu(bi->chanspec);
                         cfg->d11inf.decchspec(&ch);
@@ -1380,8 +1380,7 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
                     (brcmf_p2p_gon_req_collision(p2p, (u8 *)e->addr))) {
                         if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL,
                                      &p2p->status) &&
-                            (memcmp(afx_hdl->tx_dst_addr, e->addr,
-                                    ETH_ALEN) == 0)) {
+                            (ether_addr_equal(afx_hdl->tx_dst_addr, e->addr))) {
                                 afx_hdl->peer_chan = ch.chnum;
                                 brcmf_dbg(INFO, "GON request: Peer found, channel=%d\n",
                                           afx_hdl->peer_chan);
@@ -1865,7 +1864,7 @@ s32 brcmf_p2p_notify_rx_mgmt_p2p_probereq(struct brcmf_if *ifp,
         cfg->d11inf.decchspec(&ch);
 
         if (test_bit(BRCMF_P2P_STATUS_FINDING_COMMON_CHANNEL, &p2p->status) &&
-            (memcmp(afx_hdl->tx_dst_addr, e->addr, ETH_ALEN) == 0)) {
+            (ether_addr_equal(afx_hdl->tx_dst_addr, e->addr))) {
                 afx_hdl->peer_chan = ch.chnum;
                 brcmf_dbg(INFO, "PROBE REQUEST: Peer found, channel=%d\n",
                           afx_hdl->peer_chan);
@@ -1956,21 +1955,21 @@ s32 brcmf_p2p_attach(struct brcmf_cfg80211_info *cfg)
                 err = brcmf_fil_iovar_int_set(pri_ifp, "p2p_disc", 1);
                 if (err < 0) {
                         brcmf_err("set p2p_disc error\n");
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
                 /* obtain bsscfg index for P2P discovery */
                 err = brcmf_fil_iovar_int_get(pri_ifp, "p2p_dev", &bssidx);
                 if (err < 0) {
                         brcmf_err("retrieving discover bsscfg index failed\n");
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
                 /* Verify that firmware uses same bssidx as driver !! */
                 if (p2p_ifp->bssidx != bssidx) {
                         brcmf_err("Incorrect bssidx=%d, compared to p2p_ifp->bssidx=%d\n",
                                   bssidx, p2p_ifp->bssidx);
-                        brcmf_free_vif(cfg, p2p_vif);
+                        brcmf_free_vif(p2p_vif);
                         goto exit;
                 }
 
@@ -1998,7 +1997,7 @@ void brcmf_p2p_detach(struct brcmf_p2p_info *p2p)
                 brcmf_p2p_cancel_remain_on_channel(vif->ifp);
                 brcmf_p2p_deinit_discovery(p2p);
                 /* remove discovery interface */
-                brcmf_free_vif(p2p->cfg, vif);
+                brcmf_free_vif(vif);
                 p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
         }
         /* just set it all to zero */
@@ -2223,7 +2222,7 @@ static struct wireless_dev *brcmf_p2p_create_p2pdev(struct brcmf_p2p_info *p2p,
         return &p2p_vif->wdev;
 
 fail:
-        brcmf_free_vif(p2p->cfg, p2p_vif);
+        brcmf_free_vif(p2p_vif);
         return ERR_PTR(err);
 }
 
@@ -2232,31 +2231,12 @@ fail:
  *
  * @vif: virtual interface object to delete.
  */
-static void brcmf_p2p_delete_p2pdev(struct brcmf_cfg80211_info *cfg,
+static void brcmf_p2p_delete_p2pdev(struct brcmf_p2p_info *p2p,
                                     struct brcmf_cfg80211_vif *vif)
 {
         cfg80211_unregister_wdev(&vif->wdev);
-        cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
-        brcmf_free_vif(cfg, vif);
-}
-
-/**
- * brcmf_p2p_free_p2p_if() - free up net device related data.
- *
- * @ndev: net device that needs to be freed.
- */
-static void brcmf_p2p_free_p2p_if(struct net_device *ndev)
-{
-        struct brcmf_cfg80211_info *cfg;
-        struct brcmf_cfg80211_vif *vif;
-        struct brcmf_if *ifp;
-
-        ifp = netdev_priv(ndev);
-        cfg = ifp->drvr->config;
-        vif = ifp->vif;
-
-        brcmf_free_vif(cfg, vif);
-        free_netdev(ifp->ndev);
+        p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif = NULL;
+        brcmf_free_vif(vif);
 }
 
 /**
@@ -2336,8 +2316,6 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
                 brcmf_err("Registering netdevice failed\n");
                 goto fail;
         }
-        /* override destructor */
-        ifp->ndev->destructor = brcmf_p2p_free_p2p_if;
 
         cfg->p2p.bss_idx[P2PAPI_BSSCFG_CONNECTION].vif = vif;
         /* Disable firmware roaming for P2P interface  */
@@ -2350,7 +2328,7 @@ struct wireless_dev *brcmf_p2p_add_vif(struct wiphy *wiphy, const char *name,
         return &ifp->vif->wdev;
 
 fail:
-        brcmf_free_vif(cfg, vif);
+        brcmf_free_vif(vif);
         return ERR_PTR(err);
 }
 
@@ -2359,8 +2337,6 @@ fail:
  *
  * @wiphy: wiphy device of interface.
  * @wdev: wireless device of interface.
- *
- * TODO: not yet supported.
  */
 int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
 {
@@ -2386,7 +2362,7 @@ int brcmf_p2p_del_vif(struct wiphy *wiphy, struct wireless_dev *wdev)
                 break;
 
         case NL80211_IFTYPE_P2P_DEVICE:
-                brcmf_p2p_delete_p2pdev(cfg, vif);
+                brcmf_p2p_delete_p2pdev(p2p, vif);
                 return 0;
         default:
                 return -ENOTSUPP;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/proto.c b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
new file mode 100644
index 000000000000..b6b464184946
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.c
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+
+ #include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+
+#include <brcmu_wifi.h>
+#include "dhd.h"
+#include "dhd_dbg.h"
+#include "proto.h"
+#include "bcdc.h"
+
+
+int brcmf_proto_attach(struct brcmf_pub *drvr)
+{
+        struct brcmf_proto *proto;
+
+        proto = kzalloc(sizeof(*proto), GFP_ATOMIC);
+        if (!proto)
+                goto fail;
+
+        drvr->proto = proto;
+        /* BCDC protocol is only protocol supported for the moment */
+        if (brcmf_proto_bcdc_attach(drvr))
+                goto fail;
+
+        if ((proto->txdata == NULL) || (proto->hdrpull == NULL) ||
+            (proto->query_dcmd == NULL) || (proto->set_dcmd == NULL)) {
+                brcmf_err("Not all proto handlers have been installed\n");
+                goto fail;
+        }
+        return 0;
+
+fail:
+        kfree(proto);
+        drvr->proto = NULL;
+        return -ENOMEM;
+}
+
+void brcmf_proto_detach(struct brcmf_pub *drvr)
+{
+        if (drvr->proto) {
+                brcmf_proto_bcdc_detach(drvr);
+                kfree(drvr->proto);
+                drvr->proto = NULL;
+        }
+}
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/proto.h b/drivers/net/wireless/brcm80211/brcmfmac/proto.h
new file mode 100644
index 000000000000..482fb0ba4a30
--- /dev/null
+++ b/drivers/net/wireless/brcm80211/brcmfmac/proto.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (c) 2013 Broadcom Corporation
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+#ifndef BRCMFMAC_PROTO_H
+#define BRCMFMAC_PROTO_H
+
+struct brcmf_proto {
+        int (*hdrpull)(struct brcmf_pub *drvr, bool do_fws, u8 *ifidx,
+                       struct sk_buff *skb);
+        int (*query_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd,
+                          void *buf, uint len);
+        int (*set_dcmd)(struct brcmf_pub *drvr, int ifidx, uint cmd, void *buf,
+                        uint len);
+        int (*txdata)(struct brcmf_pub *drvr, int ifidx, u8 offset,
+                      struct sk_buff *skb);
+        void *pd;
+};
+
+
+int brcmf_proto_attach(struct brcmf_pub *drvr);
+void brcmf_proto_detach(struct brcmf_pub *drvr);
+
+static inline int brcmf_proto_hdrpull(struct brcmf_pub *drvr, bool do_fws,
+                                      u8 *ifidx, struct sk_buff *skb)
+{
+        return drvr->proto->hdrpull(drvr, do_fws, ifidx, skb);
+}
+static inline int brcmf_proto_query_dcmd(struct brcmf_pub *drvr, int ifidx,
+                                         uint cmd, void *buf, uint len)
+{
+        return drvr->proto->query_dcmd(drvr, ifidx, cmd, buf, len);
+}
+static inline int brcmf_proto_set_dcmd(struct brcmf_pub *drvr, int ifidx,
+                                       uint cmd, void *buf, uint len)
+{
+        return drvr->proto->set_dcmd(drvr, ifidx, cmd, buf, len);
+}
+static inline int brcmf_proto_txdata(struct brcmf_pub *drvr, int ifidx,
+                                       u8 offset, struct sk_buff *skb)
+{
+        return drvr->proto->txdata(drvr, ifidx, offset, skb);
+}
+
+
+#endif /* BRCMFMAC_PROTO_H */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
index 2096a14ef1fb..82bf3c5d3cdc 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.c
@@ -19,6 +19,7 @@
 #include <linux/netdevice.h>
 #include <linux/mmc/card.h>
 #include <linux/mmc/sdio_func.h>
+#include <linux/mmc/sdio_ids.h>
 #include <linux/ssb/ssb_regs.h>
 #include <linux/bcma/bcma.h>
 
@@ -50,6 +51,9 @@
 #define BCM43143_CORE_ARM_BASE          0x18003000
 #define BCM43143_RAMSIZE                0x70000
 
+/* All D11 cores, ID 0x812 */
+#define BCM43xx_CORE_D11_BASE           0x18001000
+
 #define SBCOREREV(sbidh) \
         ((((sbidh) & SSB_IDHIGH_RCHI) >> SSB_IDHIGH_RCHI_SHIFT) | \
           ((sbidh) & SSB_IDHIGH_RCLO))
@@ -65,6 +69,10 @@
 /* ARM CR4 core specific control flag bits */
 #define ARMCR4_BCMA_IOCTL_CPUHALT       0x0020
 
+/* D11 core specific control flag bits */
+#define D11_BCMA_IOCTL_PHYCLOCKEN       0x0004
+#define D11_BCMA_IOCTL_PHYRESET         0x0008
+
 #define SDIOD_DRVSTR_KEY(chip, pmu)     (((chip) << 16) | (pmu))
 /* SDIO Pad drive strength to select value mappings */
 struct sdiod_drive_str {
@@ -83,6 +91,24 @@ static const struct sdiod_drive_str sdiod_drvstr_tab1_1v8[] = {
         {0, 0x1}
 };
 
+/* SDIO Drive Strength to sel value table for PMU Rev 13 (1.8v) */
+static const struct sdiod_drive_str sdiod_drive_strength_tab5_1v8[] = {
+        {6, 0x7},
+        {5, 0x6},
+        {4, 0x5},
+        {3, 0x4},
+        {2, 0x2},
+        {1, 0x1},
+        {0, 0x0}
+};
+
+/* SDIO Drive Strength to sel value table for PMU Rev 17 (1.8v) */
+static const struct sdiod_drive_str sdiod_drvstr_tab6_1v8[] = {
+        {3, 0x3},
+        {2, 0x2},
+        {1, 0x1},
+        {0, 0x0} };
+
 /* SDIO Drive Strength to sel value table for 43143 PMU Rev 17 (3.3V) */
 static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
         {16, 0x7},
@@ -92,7 +118,7 @@ static const struct sdiod_drive_str sdiod_drvstr_tab2_3v3[] = {
 };
 
 u8
-brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
+brcmf_sdio_chip_getinfidx(struct brcmf_chip *ci, u16 coreid)
 {
         u8 idx;
 
@@ -105,22 +131,22 @@ brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid)
 
 static u32
 brcmf_sdio_sb_corerev(struct brcmf_sdio_dev *sdiodev,
-                      struct chip_info *ci, u16 coreid)
+                      struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
 
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbidhigh),
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbidhigh),
+                                    NULL);
         return SBCOREREV(regdata);
 }
 
 static u32
 brcmf_sdio_ai_corerev(struct brcmf_sdio_dev *sdiodev,
-                      struct chip_info *ci, u16 coreid)
+                      struct brcmf_chip *ci, u16 coreid)
 {
         u8 idx;
 
@@ -131,7 +157,7 @@ brcmf_sdio_ai_corerev(struct brcmf_sdio_dev *sdiodev,
 
 static bool
 brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
-                       struct chip_info *ci, u16 coreid)
+                       struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
@@ -140,9 +166,9 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
         if (idx == BRCMF_MAX_CORENUM)
                 return false;
 
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                                    NULL);
         regdata &= (SSB_TMSLOW_RESET | SSB_TMSLOW_REJECT |
                     SSB_IMSTATE_REJECT | SSB_TMSLOW_CLOCK);
         return (SSB_TMSLOW_CLOCK == regdata);
@@ -150,7 +176,7 @@ brcmf_sdio_sb_iscoreup(struct brcmf_sdio_dev *sdiodev,
 
 static bool
 brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
-                       struct chip_info *ci, u16 coreid)
+                       struct brcmf_chip *ci, u16 coreid)
 {
         u32 regdata;
         u8 idx;
@@ -160,13 +186,13 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
         if (idx == BRCMF_MAX_CORENUM)
                 return false;
 
-        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
+                                    NULL);
         ret = (regdata & (BCMA_IOCTL_FGC | BCMA_IOCTL_CLK)) == BCMA_IOCTL_CLK;
 
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
+                                    NULL);
         ret = ret && ((regdata & BCMA_RESET_CTL_RESET) == 0);
 
         return ret;
@@ -174,7 +200,8 @@ brcmf_sdio_ai_iscoreup(struct brcmf_sdio_dev *sdiodev,
 
 static void
 brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid, u32 core_bits)
+                          struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                          u32 in_resetbits)
 {
         u32 regdata, base;
         u8 idx;
@@ -182,130 +209,126 @@ brcmf_sdio_sb_coredisable(struct brcmf_sdio_dev *sdiodev,
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
         base = ci->c_inf[idx].base;
 
-        regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
         if (regdata & SSB_TMSLOW_RESET)
                 return;
 
-        regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, CORE_SB(base, sbtmstatelow), NULL);
         if ((regdata & SSB_TMSLOW_CLOCK) != 0) {
                 /*
                  * set target reject and spin until busy is clear
                  * (preserve core-specific bits)
                  */
-                regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
-                                           NULL);
-                brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
-                                 regdata | SSB_TMSLOW_REJECT, NULL);
+                regdata = brcmf_sdiod_regrl(sdiodev,
+                                            CORE_SB(base, sbtmstatelow), NULL);
+                brcmf_sdiod_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
+                                  regdata | SSB_TMSLOW_REJECT, NULL);
 
-                regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
-                                           NULL);
+                regdata = brcmf_sdiod_regrl(sdiodev,
+                                            CORE_SB(base, sbtmstatelow), NULL);
                 udelay(1);
-                SPINWAIT((brcmf_sdio_regrl(sdiodev,
-                                           CORE_SB(base, sbtmstatehigh),
-                                           NULL) &
-                        SSB_TMSHIGH_BUSY), 100000);
-
-                regdata = brcmf_sdio_regrl(sdiodev,
-                                           CORE_SB(base, sbtmstatehigh),
-                                           NULL);
+                SPINWAIT((brcmf_sdiod_regrl(sdiodev,
+                                            CORE_SB(base, sbtmstatehigh),
+                                            NULL) &
+                          SSB_TMSHIGH_BUSY), 100000);
+
+                regdata = brcmf_sdiod_regrl(sdiodev,
+                                            CORE_SB(base, sbtmstatehigh),
+                                            NULL);
                 if (regdata & SSB_TMSHIGH_BUSY)
                         brcmf_err("core state still busy\n");
 
-                regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbidlow),
-                                           NULL);
+                regdata = brcmf_sdiod_regrl(sdiodev, CORE_SB(base, sbidlow),
+                                            NULL);
                 if (regdata & SSB_IDLOW_INITIATOR) {
-                        regdata = brcmf_sdio_regrl(sdiodev,
-                                                   CORE_SB(base, sbimstate),
-                                                   NULL);
+                        regdata = brcmf_sdiod_regrl(sdiodev,
+                                                    CORE_SB(base, sbimstate),
+                                                    NULL);
                         regdata |= SSB_IMSTATE_REJECT;
-                        brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbimstate),
-                                         regdata, NULL);
-                        regdata = brcmf_sdio_regrl(sdiodev,
-                                                   CORE_SB(base, sbimstate),
-                                                   NULL);
+                        brcmf_sdiod_regwl(sdiodev, CORE_SB(base, sbimstate),
+                                          regdata, NULL);
+                        regdata = brcmf_sdiod_regrl(sdiodev,
+                                                    CORE_SB(base, sbimstate),
+                                                    NULL);
                         udelay(1);
-                        SPINWAIT((brcmf_sdio_regrl(sdiodev,
-                                                   CORE_SB(base, sbimstate),
-                                                   NULL) &
-                                SSB_IMSTATE_BUSY), 100000);
+                        SPINWAIT((brcmf_sdiod_regrl(sdiodev,
+                                                    CORE_SB(base, sbimstate),
+                                                    NULL) &
+                                  SSB_IMSTATE_BUSY), 100000);
                 }
 
                 /* set reset and reject while enabling the clocks */
                 regdata = SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK |
                           SSB_TMSLOW_REJECT | SSB_TMSLOW_RESET;
-                brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
-                                 regdata, NULL);
-                regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbtmstatelow),
-                                           NULL);
+                brcmf_sdiod_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
+                                  regdata, NULL);
+                regdata = brcmf_sdiod_regrl(sdiodev,
+                                            CORE_SB(base, sbtmstatelow), NULL);
                 udelay(10);
 
                 /* clear the initiator reject bit */
-                regdata = brcmf_sdio_regrl(sdiodev, CORE_SB(base, sbidlow),
-                                           NULL);
+                regdata = brcmf_sdiod_regrl(sdiodev, CORE_SB(base, sbidlow),
+                                            NULL);
                 if (regdata & SSB_IDLOW_INITIATOR) {
-                        regdata = brcmf_sdio_regrl(sdiodev,
-                                                   CORE_SB(base, sbimstate),
-                                                   NULL);
+                        regdata = brcmf_sdiod_regrl(sdiodev,
+                                                    CORE_SB(base, sbimstate),
+                                                    NULL);
                         regdata &= ~SSB_IMSTATE_REJECT;
-                        brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbimstate),
-                                         regdata, NULL);
+                        brcmf_sdiod_regwl(sdiodev, CORE_SB(base, sbimstate),
+                                          regdata, NULL);
                 }
         }
 
         /* leave reset and reject asserted */
-        brcmf_sdio_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
-                         (SSB_TMSLOW_REJECT | SSB_TMSLOW_RESET), NULL);
+        brcmf_sdiod_regwl(sdiodev, CORE_SB(base, sbtmstatelow),
+                          (SSB_TMSLOW_REJECT | SSB_TMSLOW_RESET), NULL);
         udelay(1);
 }
 
 static void
 brcmf_sdio_ai_coredisable(struct brcmf_sdio_dev *sdiodev,
-                          struct chip_info *ci, u16 coreid, u32 core_bits)
+                          struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                          u32 in_resetbits)
 {
         u8 idx;
         u32 regdata;
+        u32 wrapbase;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
         if (idx == BRCMF_MAX_CORENUM)
                 return;
 
+        wrapbase = ci->c_inf[idx].wrapbase;
+
         /* if core is already in reset, just return */
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL);
         if ((regdata & BCMA_RESET_CTL_RESET) != 0)
                 return;
 
-        /* ensure no pending backplane operation
-         * 300uc should be sufficient for backplane ops to be finish
-         * extra 10ms is taken into account for firmware load stage
-         * after 10300us carry on disabling the core anyway
-         */
-        SPINWAIT(brcmf_sdio_regrl(sdiodev,
-                                  ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
-                                  NULL), 10300);
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   ci->c_inf[idx].wrapbase+BCMA_RESET_ST,
-                                   NULL);
-        if (regdata)
-                brcmf_err("disabling core 0x%x with reset status %x\n",
-                          coreid, regdata);
-
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                         BCMA_RESET_CTL_RESET, NULL);
-        udelay(1);
+        /* configure reset */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
+                          BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                         core_bits, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                   NULL);
+        /* put in reset */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_RESET_CTL,
+                          BCMA_RESET_CTL_RESET, NULL);
         usleep_range(10, 20);
 
+        /* wait till reset is 1 */
+        SPINWAIT(brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL) !=
+                 BCMA_RESET_CTL_RESET, 300);
+
+        /* post reset configure */
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, pre_resetbits |
+                          BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 }
 
 static void
 brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits)
+                        struct brcmf_chip *ci, u16 coreid,  u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits)
 {
         u32 regdata;
         u8 idx;
@@ -318,93 +341,91 @@ brcmf_sdio_sb_resetcore(struct brcmf_sdio_dev *sdiodev,
          * Must do the disable sequence first to work for
          * arbitrary current core state.
          */
-        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid, 0);
+        brcmf_sdio_sb_coredisable(sdiodev, ci, coreid, pre_resetbits,
+                                  in_resetbits);
 
         /*
          * Now do the initialization sequence.
          * set reset while enabling the clock and
          * forcing them on throughout the core
          */
-        brcmf_sdio_regwl(sdiodev,
-                         CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                         SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK | SSB_TMSLOW_RESET,
-                         NULL);
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                                   NULL);
+        brcmf_sdiod_regwl(sdiodev,
+                          CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                          SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK | SSB_TMSLOW_RESET,
+                          NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                                    NULL);
         udelay(1);
 
         /* clear any serror */
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
+                                    NULL);
         if (regdata & SSB_TMSHIGH_SERR)
-                brcmf_sdio_regwl(sdiodev,
-                                 CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
-                                 0, NULL);
+                brcmf_sdiod_regwl(sdiodev,
+                                  CORE_SB(ci->c_inf[idx].base, sbtmstatehigh),
+                                  0, NULL);
 
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbimstate),
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbimstate),
+                                    NULL);
         if (regdata & (SSB_IMSTATE_IBE | SSB_IMSTATE_TO))
-                brcmf_sdio_regwl(sdiodev,
-                                 CORE_SB(ci->c_inf[idx].base, sbimstate),
-                                 regdata & ~(SSB_IMSTATE_IBE | SSB_IMSTATE_TO),
-                                 NULL);
+                brcmf_sdiod_regwl(sdiodev,
+                                  CORE_SB(ci->c_inf[idx].base, sbimstate),
+                                  regdata & ~(SSB_IMSTATE_IBE | SSB_IMSTATE_TO),
+                                  NULL);
 
         /* clear reset and allow it to propagate throughout the core */
-        brcmf_sdio_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                         SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                                   NULL);
+        brcmf_sdiod_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                          SSB_TMSLOW_FGC | SSB_TMSLOW_CLOCK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                                    NULL);
         udelay(1);
 
         /* leave clock enabled */
-        brcmf_sdio_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                         SSB_TMSLOW_CLOCK, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
-                                   NULL);
+        brcmf_sdiod_regwl(sdiodev, CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                          SSB_TMSLOW_CLOCK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_SB(ci->c_inf[idx].base, sbtmstatelow),
+                                    NULL);
         udelay(1);
 }
 
 static void
 brcmf_sdio_ai_resetcore(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits)
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits)
 {
         u8 idx;
         u32 regdata;
+        u32 wrapbase;
 
         idx = brcmf_sdio_chip_getinfidx(ci, coreid);
         if (idx == BRCMF_MAX_CORENUM)
                 return;
 
+        wrapbase = ci->c_inf[idx].wrapbase;
+
         /* must disable first to work for arbitrary current core state */
-        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, core_bits);
-
-        /* now do initialization sequence */
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                         core_bits | BCMA_IOCTL_FGC | BCMA_IOCTL_CLK, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                   NULL);
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                         0, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   ci->c_inf[idx].wrapbase+BCMA_RESET_CTL,
-                                   NULL);
-        udelay(1);
+        brcmf_sdio_ai_coredisable(sdiodev, ci, coreid, pre_resetbits,
+                                  in_resetbits);
 
-        brcmf_sdio_regwl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                         core_bits | BCMA_IOCTL_CLK, NULL);
-        regdata = brcmf_sdio_regrl(sdiodev, ci->c_inf[idx].wrapbase+BCMA_IOCTL,
-                                   NULL);
-        udelay(1);
+        while (brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_RESET_CTL, NULL) &
+               BCMA_RESET_CTL_RESET) {
+                brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_RESET_CTL, 0, NULL);
+                usleep_range(40, 60);
+        }
+
+        brcmf_sdiod_regwl(sdiodev, wrapbase + BCMA_IOCTL, post_resetbits |
+                          BCMA_IOCTL_CLK, NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
 }
 
 #ifdef DEBUG
 /* safety check for chipinfo */
-static int brcmf_sdio_chip_cichk(struct chip_info *ci)
+static int brcmf_sdio_chip_cichk(struct brcmf_chip *ci)
 {
         u8 core_idx;
 
@@ -431,172 +452,213 @@ static int brcmf_sdio_chip_cichk(struct chip_info *ci)
         return 0;
 }
 #else   /* DEBUG */
-static inline int brcmf_sdio_chip_cichk(struct chip_info *ci)
+static inline int brcmf_sdio_chip_cichk(struct brcmf_chip *ci)
 {
         return 0;
 }
 #endif
 
 static int brcmf_sdio_chip_recognition(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci, u32 regs)
+                                       struct brcmf_chip *ci)
 {
         u32 regdata;
-        int ret;
+        u32 socitype;
 
         /* Get CC core rev
-         * Chipid is assume to be at offset 0 from regs arg
+         * Chipid is assume to be at offset 0 from SI_ENUM_BASE
          * For different chiptypes or old sdio hosts w/o chipcommon,
          * other ways of recognition should be added here.
          */
-        ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
-        ci->c_inf[0].base = regs;
-        regdata = brcmf_sdio_regrl(sdiodev,
-                                   CORE_CC_REG(ci->c_inf[0].base, chipid),
-                                   NULL);
+        regdata = brcmf_sdiod_regrl(sdiodev,
+                                    CORE_CC_REG(SI_ENUM_BASE, chipid),
+                                    NULL);
         ci->chip = regdata & CID_ID_MASK;
         ci->chiprev = (regdata & CID_REV_MASK) >> CID_REV_SHIFT;
         if (sdiodev->func[0]->device == SDIO_DEVICE_ID_BROADCOM_4335_4339 &&
             ci->chiprev >= 2)
                 ci->chip = BCM4339_CHIP_ID;
-        ci->socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
+        socitype = (regdata & CID_TYPE_MASK) >> CID_TYPE_SHIFT;
 
-        brcmf_dbg(INFO, "chipid=0x%x chiprev=%d\n", ci->chip, ci->chiprev);
+        brcmf_dbg(INFO, "found %s chip: id=0x%x, rev=%d\n",
+                  socitype == SOCI_SB ? "SB" : "AXI", ci->chip, ci->chiprev);
 
-        /* Address of cores for new chips should be added here */
-        switch (ci->chip) {
-        case BCM43143_CHIP_ID:
-                ci->c_inf[0].wrapbase = ci->c_inf[0].base + 0x00100000;
-                ci->c_inf[0].cib = 0x2b000000;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = BCM43143_CORE_BUS_BASE;
-                ci->c_inf[1].wrapbase = ci->c_inf[1].base + 0x00100000;
-                ci->c_inf[1].cib = 0x18000000;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = BCM43143_CORE_SOCRAM_BASE;
-                ci->c_inf[2].wrapbase = ci->c_inf[2].base + 0x00100000;
-                ci->c_inf[2].cib = 0x14000000;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = BCM43143_CORE_ARM_BASE;
-                ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
-                ci->c_inf[3].cib = 0x07000000;
-                ci->ramsize = BCM43143_RAMSIZE;
-                break;
-        case BCM43241_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2a084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x0e004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x14080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x07004211;
-                ci->ramsize = 0x90000;
-                break;
-        case BCM4329_CHIP_ID:
+        if (socitype == SOCI_SB) {
+                if (ci->chip != BCM4329_CHIP_ID) {
+                        brcmf_err("SB chip is not supported\n");
+                        return -ENODEV;
+                }
+                ci->iscoreup = brcmf_sdio_sb_iscoreup;
+                ci->corerev = brcmf_sdio_sb_corerev;
+                ci->coredisable = brcmf_sdio_sb_coredisable;
+                ci->resetcore = brcmf_sdio_sb_resetcore;
+
+                ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
+                ci->c_inf[0].base = SI_ENUM_BASE;
                 ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
                 ci->c_inf[1].base = BCM4329_CORE_BUS_BASE;
                 ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
                 ci->c_inf[2].base = BCM4329_CORE_SOCRAM_BASE;
                 ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
                 ci->c_inf[3].base = BCM4329_CORE_ARM_BASE;
+                ci->c_inf[4].id = BCMA_CORE_80211;
+                ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
                 ci->ramsize = BCM4329_RAMSIZE;
-                break;
-        case BCM4330_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x27004211;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x07004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x0d080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x03004211;
-                ci->ramsize = 0x48000;
-                break;
-        case BCM4334_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x29004211;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18002000;
-                ci->c_inf[1].wrapbase = 0x18102000;
-                ci->c_inf[1].cib = 0x0d004211;
-                ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
-                ci->c_inf[2].base = 0x18004000;
-                ci->c_inf[2].wrapbase = 0x18104000;
-                ci->c_inf[2].cib = 0x13080401;
-                ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
-                ci->c_inf[3].base = 0x18003000;
-                ci->c_inf[3].wrapbase = 0x18103000;
-                ci->c_inf[3].cib = 0x07004211;
-                ci->ramsize = 0x80000;
-                break;
-        case BCM4335_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2b084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18005000;
-                ci->c_inf[1].wrapbase = 0x18105000;
-                ci->c_inf[1].cib = 0x0f004211;
-                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
-                ci->c_inf[2].base = 0x18002000;
-                ci->c_inf[2].wrapbase = 0x18102000;
-                ci->c_inf[2].cib = 0x01084411;
-                ci->ramsize = 0xc0000;
-                ci->rambase = 0x180000;
-                break;
-        case BCM4339_CHIP_ID:
-                ci->c_inf[0].wrapbase = 0x18100000;
-                ci->c_inf[0].cib = 0x2e084411;
-                ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
-                ci->c_inf[1].base = 0x18005000;
-                ci->c_inf[1].wrapbase = 0x18105000;
-                ci->c_inf[1].cib = 0x15004211;
-                ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
-                ci->c_inf[2].base = 0x18002000;
-                ci->c_inf[2].wrapbase = 0x18102000;
-                ci->c_inf[2].cib = 0x04084411;
-                ci->ramsize = 0xc0000;
-                ci->rambase = 0x180000;
-                break;
-        default:
-                brcmf_err("chipid 0x%x is not supported\n", ci->chip);
-                return -ENODEV;
-        }
-
-        ret = brcmf_sdio_chip_cichk(ci);
-        if (ret)
-                return ret;
-
-        switch (ci->socitype) {
-        case SOCI_SB:
-                ci->iscoreup = brcmf_sdio_sb_iscoreup;
-                ci->corerev = brcmf_sdio_sb_corerev;
-                ci->coredisable = brcmf_sdio_sb_coredisable;
-                ci->resetcore = brcmf_sdio_sb_resetcore;
-                break;
-        case SOCI_AI:
+        } else if (socitype == SOCI_AI) {
                 ci->iscoreup = brcmf_sdio_ai_iscoreup;
                 ci->corerev = brcmf_sdio_ai_corerev;
                 ci->coredisable = brcmf_sdio_ai_coredisable;
                 ci->resetcore = brcmf_sdio_ai_resetcore;
-                break;
-        default:
-                brcmf_err("socitype %u not supported\n", ci->socitype);
+
+                ci->c_inf[0].id = BCMA_CORE_CHIPCOMMON;
+                ci->c_inf[0].base = SI_ENUM_BASE;
+
+                /* Address of cores for new chips should be added here */
+                switch (ci->chip) {
+                case BCM43143_CHIP_ID:
+                        ci->c_inf[0].wrapbase = ci->c_inf[0].base + 0x00100000;
+                        ci->c_inf[0].cib = 0x2b000000;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = BCM43143_CORE_BUS_BASE;
+                        ci->c_inf[1].wrapbase = ci->c_inf[1].base + 0x00100000;
+                        ci->c_inf[1].cib = 0x18000000;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = BCM43143_CORE_SOCRAM_BASE;
+                        ci->c_inf[2].wrapbase = ci->c_inf[2].base + 0x00100000;
+                        ci->c_inf[2].cib = 0x14000000;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = BCM43143_CORE_ARM_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->c_inf[3].cib = 0x07000000;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = BCM43143_RAMSIZE;
+                        break;
+                case BCM43241_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2a084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0e004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x14080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x07004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x90000;
+                        break;
+                case BCM4330_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x27004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x07004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x0d080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x03004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x48000;
+                        break;
+                case BCM4334_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x29004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0d004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x13080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x07004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x80000;
+                        break;
+                case BCM4335_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2b084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18005000;
+                        ci->c_inf[1].wrapbase = 0x18105000;
+                        ci->c_inf[1].cib = 0x0f004211;
+                        ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                        ci->c_inf[2].base = 0x18002000;
+                        ci->c_inf[2].wrapbase = 0x18102000;
+                        ci->c_inf[2].cib = 0x01084411;
+                        ci->c_inf[3].id = BCMA_CORE_80211;
+                        ci->c_inf[3].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->ramsize = 0xc0000;
+                        ci->rambase = 0x180000;
+                        break;
+                case BCM43362_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x27004211;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18002000;
+                        ci->c_inf[1].wrapbase = 0x18102000;
+                        ci->c_inf[1].cib = 0x0a004211;
+                        ci->c_inf[2].id = BCMA_CORE_INTERNAL_MEM;
+                        ci->c_inf[2].base = 0x18004000;
+                        ci->c_inf[2].wrapbase = 0x18104000;
+                        ci->c_inf[2].cib = 0x08080401;
+                        ci->c_inf[3].id = BCMA_CORE_ARM_CM3;
+                        ci->c_inf[3].base = 0x18003000;
+                        ci->c_inf[3].wrapbase = 0x18103000;
+                        ci->c_inf[3].cib = 0x03004211;
+                        ci->c_inf[4].id = BCMA_CORE_80211;
+                        ci->c_inf[4].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[4].wrapbase = ci->c_inf[4].base + 0x00100000;
+                        ci->ramsize = 0x3C000;
+                        break;
+                case BCM4339_CHIP_ID:
+                        ci->c_inf[0].wrapbase = 0x18100000;
+                        ci->c_inf[0].cib = 0x2e084411;
+                        ci->c_inf[1].id = BCMA_CORE_SDIO_DEV;
+                        ci->c_inf[1].base = 0x18005000;
+                        ci->c_inf[1].wrapbase = 0x18105000;
+                        ci->c_inf[1].cib = 0x15004211;
+                        ci->c_inf[2].id = BCMA_CORE_ARM_CR4;
+                        ci->c_inf[2].base = 0x18002000;
+                        ci->c_inf[2].wrapbase = 0x18102000;
+                        ci->c_inf[2].cib = 0x04084411;
+                        ci->c_inf[3].id = BCMA_CORE_80211;
+                        ci->c_inf[3].base = BCM43xx_CORE_D11_BASE;
+                        ci->c_inf[3].wrapbase = ci->c_inf[3].base + 0x00100000;
+                        ci->ramsize = 0xc0000;
+                        ci->rambase = 0x180000;
+                        break;
+                default:
+                        brcmf_err("AXI chip is not supported\n");
+                        return -ENODEV;
+                }
+        } else {
+                brcmf_err("chip backplane type %u is not supported\n",
+                          socitype);
                 return -ENODEV;
         }
 
-        return 0;
+        return brcmf_sdio_chip_cichk(ci);
 }
 
 static int
@@ -607,7 +669,7 @@ brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
 
         /* Try forcing SDIO core to do ALPAvail request only */
         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_ALP_AVAIL_REQ;
-        brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
         if (err) {
                 brcmf_err("error writing for HT off\n");
                 return err;
@@ -615,8 +677,8 @@ brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
 
         /* If register supported, wait for ALPAvail and then force ALP */
         /* This may take up to 15 milliseconds */
-        clkval = brcmf_sdio_regrb(sdiodev,
-                                  SBSDIO_FUNC1_CHIPCLKCSR, NULL);
+        clkval = brcmf_sdiod_regrb(sdiodev,
+                                   SBSDIO_FUNC1_CHIPCLKCSR, NULL);
 
         if ((clkval & ~SBSDIO_AVBITS) != clkset) {
                 brcmf_err("ChipClkCSR access: wrote 0x%02x read 0x%02x\n",
@@ -624,8 +686,8 @@ brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
                 return -EACCES;
         }
 
-        SPINWAIT(((clkval = brcmf_sdio_regrb(sdiodev,
-                                             SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
+        SPINWAIT(((clkval = brcmf_sdiod_regrb(sdiodev,
+                                              SBSDIO_FUNC1_CHIPCLKCSR, NULL)),
                         !SBSDIO_ALPAV(clkval)),
                         PMU_MAX_TRANSITION_DLY);
         if (!SBSDIO_ALPAV(clkval)) {
@@ -635,18 +697,18 @@ brcmf_sdio_chip_buscoreprep(struct brcmf_sdio_dev *sdiodev)
         }
 
         clkset = SBSDIO_FORCE_HW_CLKREQ_OFF | SBSDIO_FORCE_ALP;
-        brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
+        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_CHIPCLKCSR, clkset, &err);
         udelay(65);
 
         /* Also, disable the extra SDIO pull-ups */
-        brcmf_sdio_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
+        brcmf_sdiod_regwb(sdiodev, SBSDIO_FUNC1_SDIOPULLUP, 0, NULL);
 
         return 0;
 }
 
 static void
 brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
-                             struct chip_info *ci)
+                             struct brcmf_chip *ci)
 {
         u32 base = ci->c_inf[0].base;
 
@@ -654,16 +716,16 @@ brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
         ci->c_inf[0].rev = ci->corerev(sdiodev, ci, ci->c_inf[0].id);
 
         /* get chipcommon capabilites */
-        ci->c_inf[0].caps = brcmf_sdio_regrl(sdiodev,
-                                             CORE_CC_REG(base, capabilities),
-                                             NULL);
+        ci->c_inf[0].caps = brcmf_sdiod_regrl(sdiodev,
+                                              CORE_CC_REG(base, capabilities),
+                                              NULL);
 
         /* get pmu caps & rev */
         if (ci->c_inf[0].caps & CC_CAP_PMU) {
                 ci->pmucaps =
-                        brcmf_sdio_regrl(sdiodev,
-                                         CORE_CC_REG(base, pmucapabilities),
-                                         NULL);
+                        brcmf_sdiod_regrl(sdiodev,
+                                          CORE_CC_REG(base, pmucapabilities),
+                                          NULL);
                 ci->pmurev = ci->pmucaps & PCAP_REV_MASK;
         }
 
@@ -677,19 +739,18 @@ brcmf_sdio_chip_buscoresetup(struct brcmf_sdio_dev *sdiodev,
          * Make sure any on-chip ARM is off (in case strapping is wrong),
          * or downloaded code was already running.
          */
-        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0);
 }
 
 int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
-                           struct chip_info **ci_ptr, u32 regs)
+                           struct brcmf_chip **ci_ptr)
 {
         int ret;
-        struct chip_info *ci;
+        struct brcmf_chip *ci;
 
         brcmf_dbg(TRACE, "Enter\n");
 
-        /* alloc chip_info_t */
-        ci = kzalloc(sizeof(struct chip_info), GFP_ATOMIC);
+        ci = kzalloc(sizeof(*ci), GFP_ATOMIC);
         if (!ci)
                 return -ENOMEM;
 
@@ -697,16 +758,16 @@ int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
         if (ret != 0)
                 goto err;
 
-        ret = brcmf_sdio_chip_recognition(sdiodev, ci, regs);
+        ret = brcmf_sdio_chip_recognition(sdiodev, ci);
         if (ret != 0)
                 goto err;
 
         brcmf_sdio_chip_buscoresetup(sdiodev, ci);
 
-        brcmf_sdio_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopullup),
-                         0, NULL);
-        brcmf_sdio_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopulldown),
-                         0, NULL);
+        brcmf_sdiod_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopullup),
+                          0, NULL);
+        brcmf_sdiod_regwl(sdiodev, CORE_CC_REG(ci->c_inf[0].base, gpiopulldown),
+                          0, NULL);
 
         *ci_ptr = ci;
         return 0;
@@ -717,7 +778,7 @@ err:
 }
 
 void
-brcmf_sdio_chip_detach(struct chip_info **ci_ptr)
+brcmf_sdio_chip_detach(struct brcmf_chip **ci_ptr)
 {
         brcmf_dbg(TRACE, "Enter\n");
 
@@ -736,7 +797,7 @@ static char *brcmf_sdio_chip_name(uint chipid, char *buf, uint len)
 
 void
 brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
-                                  struct chip_info *ci, u32 drivestrength)
+                                  struct brcmf_chip *ci, u32 drivestrength)
 {
         const struct sdiod_drive_str *str_tab = NULL;
         u32 str_mask;
@@ -757,6 +818,11 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                 str_mask = 0x00003800;
                 str_shift = 11;
                 break;
+        case SDIOD_DRVSTR_KEY(BCM4334_CHIP_ID, 17):
+                str_tab = sdiod_drvstr_tab6_1v8;
+                str_mask = 0x00001800;
+                str_shift = 11;
+                break;
         case SDIOD_DRVSTR_KEY(BCM43143_CHIP_ID, 17):
                 /* note: 43143 does not support tristate */
                 i = ARRAY_SIZE(sdiod_drvstr_tab2_3v3) - 1;
@@ -769,6 +835,11 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                                   brcmf_sdio_chip_name(ci->chip, chn, 8),
                                   drivestrength);
                 break;
+        case SDIOD_DRVSTR_KEY(BCM43362_CHIP_ID, 13):
+                str_tab = sdiod_drive_strength_tab5_1v8;
+                str_mask = 0x00003800;
+                str_shift = 11;
+                break;
         default:
                 brcmf_err("No SDIO Drive strength init done for chip %s rev %d pmurev %d\n",
                           brcmf_sdio_chip_name(ci->chip, chn, 8),
@@ -784,119 +855,31 @@ brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
                         }
                 }
                 addr = CORE_CC_REG(base, chipcontrol_addr);
-                brcmf_sdio_regwl(sdiodev, addr, 1, NULL);
-                cc_data_temp = brcmf_sdio_regrl(sdiodev, addr, NULL);
+                brcmf_sdiod_regwl(sdiodev, addr, 1, NULL);
+                cc_data_temp = brcmf_sdiod_regrl(sdiodev, addr, NULL);
                 cc_data_temp &= ~str_mask;
                 drivestrength_sel <<= str_shift;
                 cc_data_temp |= drivestrength_sel;
-                brcmf_sdio_regwl(sdiodev, addr, cc_data_temp, NULL);
+                brcmf_sdiod_regwl(sdiodev, addr, cc_data_temp, NULL);
 
                 brcmf_dbg(INFO, "SDIO: %d mA (req=%d mA) drive strength selected, set to 0x%08x\n",
                           str_tab[i].strength, drivestrength, cc_data_temp);
         }
 }
 
-#ifdef DEBUG
-static bool
-brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
-                            char *nvram_dat, uint nvram_sz)
-{
-        char *nvram_ularray;
-        int err;
-        bool ret = true;
-
-        /* read back and verify */
-        brcmf_dbg(INFO, "Compare NVRAM dl & ul; size=%d\n", nvram_sz);
-        nvram_ularray = kmalloc(nvram_sz, GFP_KERNEL);
-        /* do not proceed while no memory but  */
-        if (!nvram_ularray)
-                return true;
-
-        /* Upload image to verify downloaded contents. */
-        memset(nvram_ularray, 0xaa, nvram_sz);
-
-        /* Read the vars list to temp buffer for comparison */
-        err = brcmf_sdio_ramrw(sdiodev, false, nvram_addr, nvram_ularray,
-                               nvram_sz);
-        if (err) {
-                brcmf_err("error %d on reading %d nvram bytes at 0x%08x\n",
-                          err, nvram_sz, nvram_addr);
-        } else if (memcmp(nvram_dat, nvram_ularray, nvram_sz)) {
-                brcmf_err("Downloaded NVRAM image is corrupted\n");
-                ret = false;
-        }
-        kfree(nvram_ularray);
-
-        return ret;
-}
-#else   /* DEBUG */
-static inline bool
-brcmf_sdio_chip_verifynvram(struct brcmf_sdio_dev *sdiodev, u32 nvram_addr,
-                            char *nvram_dat, uint nvram_sz)
-{
-        return true;
-}
-#endif  /* DEBUG */
-
-static bool brcmf_sdio_chip_writenvram(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci,
-                                       char *nvram_dat, uint nvram_sz)
-{
-        int err;
-        u32 nvram_addr;
-        u32 token;
-        __le32 token_le;
-
-        nvram_addr = (ci->ramsize - 4) - nvram_sz + ci->rambase;
-
-        /* Write the vars list */
-        err = brcmf_sdio_ramrw(sdiodev, true, nvram_addr, nvram_dat, nvram_sz);
-        if (err) {
-                brcmf_err("error %d on writing %d nvram bytes at 0x%08x\n",
-                          err, nvram_sz, nvram_addr);
-                return false;
-        }
-
-        if (!brcmf_sdio_chip_verifynvram(sdiodev, nvram_addr,
-                                         nvram_dat, nvram_sz))
-                return false;
-
-        /* generate token:
-         * nvram size, converted to words, in lower 16-bits, checksum
-         * in upper 16-bits.
-         */
-        token = nvram_sz / 4;
-        token = (~token << 16) | (token & 0x0000FFFF);
-        token_le = cpu_to_le32(token);
-
-        brcmf_dbg(INFO, "RAM size: %d\n", ci->ramsize);
-        brcmf_dbg(INFO, "nvram is placed at %d, size %d, token=0x%08x\n",
-                  nvram_addr, nvram_sz, token);
-
-        /* Write the length token to the last word */
-        if (brcmf_sdio_ramrw(sdiodev, true, (ci->ramsize - 4 + ci->rambase),
-                             (u8 *)&token_le, 4))
-                return false;
-
-        return true;
-}
-
 static void
 brcmf_sdio_chip_cm3_enterdl(struct brcmf_sdio_dev *sdiodev,
-                            struct chip_info *ci)
+                            struct brcmf_chip *ci)
 {
-        u32 zeros = 0;
-
-        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
-        ci->resetcore(sdiodev, ci, BCMA_CORE_INTERNAL_MEM, 0);
-
-        /* clear length token */
-        brcmf_sdio_ramrw(sdiodev, true, ci->ramsize - 4, (u8 *)&zeros, 4);
+        ci->coredisable(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_80211,
+                      D11_BCMA_IOCTL_PHYRESET | D11_BCMA_IOCTL_PHYCLOCKEN,
+                      D11_BCMA_IOCTL_PHYCLOCKEN, D11_BCMA_IOCTL_PHYCLOCKEN);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_INTERNAL_MEM, 0, 0, 0);
 }
 
-static bool
-brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
-                           char *nvram_dat, uint nvram_sz)
+static bool brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev,
+                                       struct brcmf_chip *ci)
 {
         u8 core_idx;
         u32 reg_addr;
@@ -906,56 +889,64 @@ brcmf_sdio_chip_cm3_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
                 return false;
         }
 
-        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
-                return false;
-
         /* clear all interrupts */
         core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
         reg_addr = ci->c_inf[core_idx].base;
         reg_addr += offsetof(struct sdpcmd_regs, intstatus);
-        brcmf_sdio_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+        brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
 
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CM3, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CM3, 0, 0, 0);
 
         return true;
 }
 
 static inline void
 brcmf_sdio_chip_cr4_enterdl(struct brcmf_sdio_dev *sdiodev,
-                            struct chip_info *ci)
+                            struct brcmf_chip *ci)
 {
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4,
-                      ARMCR4_BCMA_IOCTL_CPUHALT);
+        u8 idx;
+        u32 regdata;
+        u32 wrapbase;
+        idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CR4);
+
+        if (idx == BRCMF_MAX_CORENUM)
+                return;
+
+        wrapbase = ci->c_inf[idx].wrapbase;
+        regdata = brcmf_sdiod_regrl(sdiodev, wrapbase + BCMA_IOCTL, NULL);
+        regdata &= ARMCR4_BCMA_IOCTL_CPUHALT;
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, regdata,
+                      ARMCR4_BCMA_IOCTL_CPUHALT, ARMCR4_BCMA_IOCTL_CPUHALT);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_80211,
+                      D11_BCMA_IOCTL_PHYRESET | D11_BCMA_IOCTL_PHYCLOCKEN,
+                      D11_BCMA_IOCTL_PHYCLOCKEN, D11_BCMA_IOCTL_PHYCLOCKEN);
 }
 
-static bool
-brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
-                           char *nvram_dat, uint nvram_sz)
+static bool brcmf_sdio_chip_cr4_exitdl(struct brcmf_sdio_dev *sdiodev,
+                                       struct brcmf_chip *ci, u32 rstvec)
 {
         u8 core_idx;
         u32 reg_addr;
 
-        if (!brcmf_sdio_chip_writenvram(sdiodev, ci, nvram_dat, nvram_sz))
-                return false;
-
         /* clear all interrupts */
         core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_SDIO_DEV);
         reg_addr = ci->c_inf[core_idx].base;
         reg_addr += offsetof(struct sdpcmd_regs, intstatus);
-        brcmf_sdio_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
+        brcmf_sdiod_regwl(sdiodev, reg_addr, 0xFFFFFFFF, NULL);
 
         /* Write reset vector to address 0 */
-        brcmf_sdio_ramrw(sdiodev, true, 0, (void *)&ci->rst_vec,
-                         sizeof(ci->rst_vec));
+        brcmf_sdiod_ramrw(sdiodev, true, 0, (void *)&rstvec,
+                          sizeof(rstvec));
 
         /* restore ARM */
-        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, 0);
+        ci->resetcore(sdiodev, ci, BCMA_CORE_ARM_CR4, ARMCR4_BCMA_IOCTL_CPUHALT,
+                      0, 0);
 
         return true;
 }
 
 void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
-                                    struct chip_info *ci)
+                                    struct brcmf_chip *ci)
 {
         u8 arm_core_idx;
 
@@ -969,15 +960,13 @@ void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
 }
 
 bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
-                                   struct chip_info *ci, char *nvram_dat,
-                                   uint nvram_sz)
+                                   struct brcmf_chip *ci, u32 rstvec)
 {
         u8 arm_core_idx;
 
         arm_core_idx = brcmf_sdio_chip_getinfidx(ci, BCMA_CORE_ARM_CM3);
         if (BRCMF_MAX_CORENUM != arm_core_idx)
-                return brcmf_sdio_chip_cm3_exitdl(sdiodev, ci, nvram_dat,
-                                                  nvram_sz);
+                return brcmf_sdio_chip_cm3_exitdl(sdiodev, ci);
 
-        return brcmf_sdio_chip_cr4_exitdl(sdiodev, ci, nvram_dat, nvram_sz);
+        return brcmf_sdio_chip_cr4_exitdl(sdiodev, ci, rstvec);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
index 507c61c991fa..fb0614329ede 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_chip.h
@@ -54,15 +54,7 @@
 
 #define BRCMF_MAX_CORENUM       6
 
-/* SDIO device ID */
-#define SDIO_DEVICE_ID_BROADCOM_43143           43143
-#define SDIO_DEVICE_ID_BROADCOM_43241           0x4324
-#define SDIO_DEVICE_ID_BROADCOM_4329            0x4329
-#define SDIO_DEVICE_ID_BROADCOM_4330            0x4330
-#define SDIO_DEVICE_ID_BROADCOM_4334            0x4334
-#define SDIO_DEVICE_ID_BROADCOM_4335_4339       0x4335
-
-struct chip_core_info {
+struct brcmf_core {
         u16 id;
         u16 rev;
         u32 base;
@@ -71,27 +63,28 @@ struct chip_core_info {
         u32 cib;
 };
 
-struct chip_info {
+struct brcmf_chip {
         u32 chip;
         u32 chiprev;
-        u32 socitype;
         /* core info */
         /* always put chipcommon core at 0, bus core at 1 */
-        struct chip_core_info c_inf[BRCMF_MAX_CORENUM];
+        struct brcmf_core c_inf[BRCMF_MAX_CORENUM];
         u32 pmurev;
         u32 pmucaps;
         u32 ramsize;
         u32 rambase;
         u32 rst_vec;    /* reset vertor for ARM CR4 core */
 
-        bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+        bool (*iscoreup)(struct brcmf_sdio_dev *sdiodev, struct brcmf_chip *ci,
                          u16 coreid);
-        u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct chip_info *ci,
+        u32 (*corerev)(struct brcmf_sdio_dev *sdiodev, struct brcmf_chip *ci,
                          u16 coreid);
         void (*coredisable)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits);
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits);
         void (*resetcore)(struct brcmf_sdio_dev *sdiodev,
-                        struct chip_info *ci, u16 coreid, u32 core_bits);
+                        struct brcmf_chip *ci, u16 coreid, u32 pre_resetbits,
+                        u32 in_resetbits, u32 post_resetbits);
 };
 
 struct sbconfig {
@@ -224,15 +217,15 @@ struct sdpcmd_regs {
 };
 
 int brcmf_sdio_chip_attach(struct brcmf_sdio_dev *sdiodev,
-                           struct chip_info **ci_ptr, u32 regs);
-void brcmf_sdio_chip_detach(struct chip_info **ci_ptr);
+                           struct brcmf_chip **ci_ptr);
+void brcmf_sdio_chip_detach(struct brcmf_chip **ci_ptr);
 void brcmf_sdio_chip_drivestrengthinit(struct brcmf_sdio_dev *sdiodev,
-                                       struct chip_info *ci, u32 drivestrength);
-u8 brcmf_sdio_chip_getinfidx(struct chip_info *ci, u16 coreid);
+                                       struct brcmf_chip *ci,
+                                       u32 drivestrength);
+u8 brcmf_sdio_chip_getinfidx(struct brcmf_chip *ci, u16 coreid);
 void brcmf_sdio_chip_enter_download(struct brcmf_sdio_dev *sdiodev,
-                                    struct chip_info *ci);
+                                    struct brcmf_chip *ci);
 bool brcmf_sdio_chip_exit_download(struct brcmf_sdio_dev *sdiodev,
-                                   struct chip_info *ci, char *nvram_dat,
-                                   uint nvram_sz);
+                                   struct brcmf_chip *ci, u32 rstvec);
 
 #endif          /* _BRCMFMAC_SDIO_CHIP_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index fc0d4f0129db..092e9c824992 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -164,11 +164,9 @@ struct brcmf_sdio;
 struct brcmf_sdio_dev {
         struct sdio_func *func[SDIO_MAX_FUNCS];
         u8 num_funcs;                   /* Supported funcs on client */
-        u32 func_cis_ptr[SDIOD_MAX_IOFUNCS];
         u32 sbwad;                      /* Save backplane window address */
-        void *bus;
+        struct brcmf_sdio *bus;
         atomic_t suspend;               /* suspend flag */
-        wait_queue_head_t request_byte_wait;
         wait_queue_head_t request_word_wait;
         wait_queue_head_t request_buffer_wait;
         struct device *dev;
@@ -185,22 +183,19 @@ struct brcmf_sdio_dev {
 };
 
 /* Register/deregister interrupt handler. */
-int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev);
-int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdiod_intr_register(struct brcmf_sdio_dev *sdiodev);
+int brcmf_sdiod_intr_unregister(struct brcmf_sdio_dev *sdiodev);
 
 /* sdio device register access interface */
-u8 brcmf_sdio_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-u32 brcmf_sdio_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
-void brcmf_sdio_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
-                      int *ret);
-void brcmf_sdio_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
-                      int *ret);
-int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
-                            void *data, bool write);
+u8 brcmf_sdiod_regrb(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+u32 brcmf_sdiod_regrl(struct brcmf_sdio_dev *sdiodev, u32 addr, int *ret);
+void brcmf_sdiod_regwb(struct brcmf_sdio_dev *sdiodev, u32 addr, u8 data,
+                       int *ret);
+void brcmf_sdiod_regwl(struct brcmf_sdio_dev *sdiodev, u32 addr, u32 data,
+                       int *ret);
 
 /* Buffer transfer to/from device (client) core via cmd53.
  *   fn:       function number
- *   addr:     backplane address (i.e. >= regsva from attach)
  *   flags:    backplane width, address increment, sync/async
  *   buf:      pointer to memory data buffer
  *   nbytes:   number of bytes to transfer to/from buf
@@ -210,17 +205,14 @@ int brcmf_sdio_regrw_helper(struct brcmf_sdio_dev *sdiodev, u32 addr,
  * Returns 0 or error code.
  * NOTE: Async operation is not currently supported.
  */
-int brcmf_sdcard_send_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                          uint flags, struct sk_buff_head *pktq);
-int brcmf_sdcard_send_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                          uint flags, u8 *buf, uint nbytes);
-
-int brcmf_sdcard_recv_pkt(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                          uint flags, struct sk_buff *pkt);
-int brcmf_sdcard_recv_buf(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                          uint flags, u8 *buf, uint nbytes);
-int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
-                            uint flags, struct sk_buff_head *pktq, uint totlen);
+int brcmf_sdiod_send_pkt(struct brcmf_sdio_dev *sdiodev,
+                         struct sk_buff_head *pktq);
+int brcmf_sdiod_send_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes);
+
+int brcmf_sdiod_recv_pkt(struct brcmf_sdio_dev *sdiodev, struct sk_buff *pkt);
+int brcmf_sdiod_recv_buf(struct brcmf_sdio_dev *sdiodev, u8 *buf, uint nbytes);
+int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
+                           struct sk_buff_head *pktq, uint totlen);
 
 /* Flags bits */
 
@@ -236,43 +228,16 @@ int brcmf_sdcard_recv_chain(struct brcmf_sdio_dev *sdiodev, u32 addr, uint fn,
  *   nbytes:   number of bytes to transfer to/from buf
  * Returns 0 or error code.
  */
-int brcmf_sdcard_rwdata(struct brcmf_sdio_dev *sdiodev, uint rw, u32 addr,
-                        u8 *buf, uint nbytes);
-int brcmf_sdio_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
-                     u8 *data, uint size);
+int brcmf_sdiod_ramrw(struct brcmf_sdio_dev *sdiodev, bool write, u32 address,
+                      u8 *data, uint size);
 
 /* Issue an abort to the specified function */
-int brcmf_sdcard_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
-
-/* platform specific/high level functions */
-int brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
-int brcmf_sdio_remove(struct brcmf_sdio_dev *sdiodev);
-
-/* attach, return handler on success, NULL if failed.
- *  The handler shall be provided by all subsequent calls. No local cache
- *  cfghdl points to the starting address of pci device mapped memory
- */
-int brcmf_sdioh_attach(struct brcmf_sdio_dev *sdiodev);
-void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev);
-
-/* read or write one byte using cmd52 */
-int brcmf_sdioh_request_byte(struct brcmf_sdio_dev *sdiodev, uint rw, uint fnc,
-                             uint addr, u8 *byte);
-
-/* read or write 2/4 bytes using cmd53 */
-int brcmf_sdioh_request_word(struct brcmf_sdio_dev *sdiodev, uint rw, uint fnc,
-                             uint addr, u32 *word, uint nbyte);
-
-/* Watchdog timer interface for pm ops */
-void brcmf_sdio_wdtmr_enable(struct brcmf_sdio_dev *sdiodev, bool enable);
+int brcmf_sdiod_abort(struct brcmf_sdio_dev *sdiodev, uint fn);
 
-void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev);
-void brcmf_sdbrcm_disconnect(void *ptr);
-void brcmf_sdbrcm_isr(void *arg);
+struct brcmf_sdio *brcmf_sdio_probe(struct brcmf_sdio_dev *sdiodev);
+void brcmf_sdio_remove(struct brcmf_sdio *bus);
+void brcmf_sdio_isr(struct brcmf_sdio *bus);
 
-void brcmf_sdbrcm_wd_timer(struct brcmf_sdio *bus, uint wdtick);
+void brcmf_sdio_wd_timer(struct brcmf_sdio *bus, uint wdtick);
 
-void brcmf_pm_resume_wait(struct brcmf_sdio_dev *sdiodev,
-                          wait_queue_head_t *wq);
-bool brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev);
 #endif                          /* _BRCM_SDH_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
index 3c67529b9074..4d7d51f95716 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/tracepoint.h
@@ -89,7 +89,7 @@ TRACE_EVENT(brcmf_hexdump,
         TP_printk("hexdump [addr=%lx, length=%lu]", __entry->addr, __entry->len)
 );
 
-TRACE_EVENT(brcmf_bdchdr,
+TRACE_EVENT(brcmf_bcdchdr,
         TP_PROTO(void *data),
         TP_ARGS(data),
         TP_STRUCT__entry(
@@ -107,24 +107,35 @@ TRACE_EVENT(brcmf_bdchdr,
                 memcpy(__get_dynamic_array(signal),
                        (u8 *)data + 4, __entry->siglen);
         ),
-        TP_printk("bdc: prio=%d siglen=%d", __entry->prio, __entry->siglen)
+        TP_printk("bcdc: prio=%d siglen=%d", __entry->prio, __entry->siglen)
 );
 
+#ifndef SDPCM_RX
+#define SDPCM_RX        0
+#endif
+#ifndef SDPCM_TX
+#define SDPCM_TX        1
+#endif
+#ifndef SDPCM_GLOM
+#define SDPCM_GLOM      2
+#endif
+
 TRACE_EVENT(brcmf_sdpcm_hdr,
-        TP_PROTO(bool tx, void *data),
-        TP_ARGS(tx, data),
+        TP_PROTO(u8 dir, void *data),
+        TP_ARGS(dir, data),
         TP_STRUCT__entry(
-                __field(u8, tx)
+                __field(u8, dir)
                 __field(u16, len)
-                __array(u8, hdr, 12)
+                __dynamic_array(u8, hdr, dir == SDPCM_GLOM ? 20 : 12)
         ),
         TP_fast_assign(
-                memcpy(__entry->hdr, data, 12);
-                __entry->len = __entry->hdr[0] | (__entry->hdr[1] << 8);
-                __entry->tx = tx ? 1 : 0;
+                memcpy(__get_dynamic_array(hdr), data, dir == SDPCM_GLOM ? 20 : 12);
+                __entry->len = *(u8 *)data | (*((u8 *)data + 1) << 8);
+                __entry->dir = dir;
         ),
-        TP_printk("sdpcm: %s len %u, seq %d", __entry->tx ? "TX" : "RX",
-                  __entry->len, __entry->hdr[4])
+        TP_printk("sdpcm: %s len %u, seq %d",
+                  __entry->dir == SDPCM_RX ? "RX" : "TX",
+                  __entry->len, ((u8 *)__get_dynamic_array(hdr))[4])
 );
 
 #ifdef CONFIG_BRCM_TRACING
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index 422f44c63175..24f65cd53859 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -522,10 +522,10 @@ brcmf_usb_state_change(struct brcmf_usbdev_info *devinfo, int state)
         /* update state of upper layer */
         if (state == BRCMFMAC_USB_STATE_DOWN) {
                 brcmf_dbg(USB, "DBUS is down\n");
-                bcmf_bus->state = BRCMF_BUS_DOWN;
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DOWN);
         } else if (state == BRCMFMAC_USB_STATE_UP) {
                 brcmf_dbg(USB, "DBUS is up\n");
-                bcmf_bus->state = BRCMF_BUS_DATA;
+                brcmf_bus_change_state(bcmf_bus, BRCMF_BUS_DATA);
         } else {
                 brcmf_dbg(USB, "DBUS current state=%d\n", state);
         }
@@ -1253,9 +1253,10 @@ static int brcmf_usb_probe_cb(struct brcmf_usbdev_info *devinfo)
         bus->ops = &brcmf_usb_bus_ops;
         bus->chip = bus_pub->devid;
         bus->chiprev = bus_pub->chiprev;
+        bus->proto_type = BRCMF_PROTO_BCDC;
 
         /* Attach to the common driver interface */
-        ret = brcmf_attach(0, dev);
+        ret = brcmf_attach(dev);
         if (ret) {
                 brcmf_err("brcmf_attach failed\n");
                 goto fail;
@@ -1454,7 +1455,7 @@ static int brcmf_usb_resume(struct usb_interface *intf)
         struct brcmf_usbdev_info *devinfo = brcmf_usb_get_businfo(&usb->dev);
 
         brcmf_dbg(USB, "Enter\n");
-        if (!brcmf_attach(0, devinfo->dev))
+        if (!brcmf_attach(devinfo->dev))
                 return brcmf_bus_start(&usb->dev);
 
         return 0;
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
index 571f013cebbb..d7718a5fa2f0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.c
@@ -202,9 +202,9 @@ static struct ieee80211_supported_band __wl_band_5ghz_a = {
 
 /* This is to override regulatory domains defined in cfg80211 module (reg.c)
  * By default world regulatory domain defined in reg.c puts the flags
- * NL80211_RRF_PASSIVE_SCAN and NL80211_RRF_NO_IBSS for 5GHz channels (for
- * 36..48 and 149..165). With respect to these flags, wpa_supplicant doesn't
- * start p2p operations on 5GHz channels. All the changes in world regulatory
+ * NL80211_RRF_NO_IR for 5GHz channels (for * 36..48 and 149..165).
+ * With respect to these flags, wpa_supplicant doesn't * start p2p
+ * operations on 5GHz channels. All the changes in world regulatory
  * domain are to be done here.
  */
 static const struct ieee80211_regdomain brcmf_regdom = {
@@ -1095,10 +1095,10 @@ static void brcmf_link_down(struct brcmf_cfg80211_vif *vif)
                                              BRCMF_C_DISASSOC, NULL, 0);
                 if (err) {
                         brcmf_err("WLC_DISASSOC failed (%d)\n", err);
-                        cfg80211_disconnected(vif->wdev.netdev, 0,
-                                              NULL, 0, GFP_KERNEL);
                 }
                 clear_bit(BRCMF_VIF_STATUS_CONNECTED, &vif->sme_state);
+                cfg80211_disconnected(vif->wdev.netdev, 0, NULL, 0, GFP_KERNEL);
+
         }
         clear_bit(BRCMF_VIF_STATUS_CONNECTING, &vif->sme_state);
         clear_bit(BRCMF_SCAN_STATUS_SUPPRESS, &cfg->scan_status);
@@ -1758,6 +1758,7 @@ brcmf_cfg80211_disconnect(struct wiphy *wiphy, struct net_device *ndev,
                 return -EIO;
 
         clear_bit(BRCMF_VIF_STATUS_CONNECTED, &ifp->vif->sme_state);
+        cfg80211_disconnected(ndev, reason_code, NULL, 0, GFP_KERNEL);
 
         memcpy(&scbval.ea, &profile->bssid, ETH_ALEN);
         scbval.val = cpu_to_le32(reason_code);
@@ -2556,8 +2557,8 @@ brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
                 ch_bss.band == ch_bss_info_le.band &&
                 bss_info_le->SSID_len == bss->SSID_len &&
                 !memcmp(bss_info_le->SSID, bss->SSID, bss_info_le->SSID_len)) {
-                if ((bss->flags & WLC_BSS_RSSI_ON_CHANNEL) ==
-                        (bss_info_le->flags & WLC_BSS_RSSI_ON_CHANNEL)) {
+                if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) ==
+                        (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL)) {
                         s16 bss_rssi = le16_to_cpu(bss->RSSI);
                         s16 bss_info_rssi = le16_to_cpu(bss_info_le->RSSI);
 
@@ -2566,13 +2567,13 @@ brcmf_compare_update_same_bss(struct brcmf_cfg80211_info *cfg,
                         */
                         if (bss_info_rssi > bss_rssi)
                                 bss->RSSI = bss_info_le->RSSI;
-                } else if ((bss->flags & WLC_BSS_RSSI_ON_CHANNEL) &&
-                        (bss_info_le->flags & WLC_BSS_RSSI_ON_CHANNEL) == 0) {
+                } else if ((bss->flags & BRCMF_BSS_RSSI_ON_CHANNEL) &&
+                        (bss_info_le->flags & BRCMF_BSS_RSSI_ON_CHANNEL) == 0) {
                         /* preserve the on-channel rssi measurement
                         * if the new measurement is off channel
                         */
                         bss->RSSI = bss_info_le->RSSI;
-                        bss->flags |= WLC_BSS_RSSI_ON_CHANNEL;
+                        bss->flags |= BRCMF_BSS_RSSI_ON_CHANNEL;
                 }
                 return 1;
         }
@@ -2988,6 +2989,7 @@ brcmf_notify_sched_scan_results(struct brcmf_if *ifp,
                 }
 
                 set_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
+                cfg->escan_info.run = brcmf_run_escan;
                 err = brcmf_do_escan(cfg, wiphy, ifp, request);
                 if (err) {
                         clear_bit(BRCMF_SCAN_STATUS_BUSY, &cfg->scan_status);
@@ -3973,11 +3975,12 @@ brcmf_cfg80211_mgmt_frame_register(struct wiphy *wiphy,
 
 static int
 brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-                       struct ieee80211_channel *chan, bool offchan,
-                       unsigned int wait, const u8 *buf, size_t len,
-                       bool no_cck, bool dont_wait_for_ack, u64 *cookie)
+                       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 {
         struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
+        struct ieee80211_channel *chan = params->chan;
+        const u8 *buf = params->buf;
+        size_t len = params->len;
         const struct ieee80211_mgmt *mgmt;
         struct brcmf_cfg80211_vif *vif;
         s32 err = 0;
@@ -4341,7 +4344,7 @@ static struct wiphy *brcmf_setup_wiphy(struct device *phydev)
         wiphy->max_remain_on_channel_duration = 5000;
         brcmf_wiphy_pno_params(wiphy);
         brcmf_dbg(INFO, "Registering custom regulatory\n");
-        wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
+        wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
         wiphy_apply_custom_regulatory(wiphy, &brcmf_regdom);
         err = wiphy_register(wiphy);
         if (err < 0) {
@@ -4358,9 +4361,6 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
 {
         struct brcmf_cfg80211_vif *vif;
 
-        if (cfg->vif_cnt == BRCMF_IFACE_MAX_CNT)
-                return ERR_PTR(-ENOSPC);
-
         brcmf_dbg(TRACE, "allocating virtual interface (size=%zu)\n",
                   sizeof(*vif));
         vif = kzalloc(sizeof(*vif), GFP_KERNEL);
@@ -4377,21 +4377,25 @@ struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
         brcmf_init_prof(&vif->profile);
 
         list_add_tail(&vif->list, &cfg->vif_list);
-        cfg->vif_cnt++;
         return vif;
 }
 
-void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
-                    struct brcmf_cfg80211_vif *vif)
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif)
 {
         list_del(&vif->list);
-        cfg->vif_cnt--;
-
         kfree(vif);
-        if (!cfg->vif_cnt) {
-                wiphy_unregister(cfg->wiphy);
-                wiphy_free(cfg->wiphy);
-        }
+}
+
+void brcmf_cfg80211_free_netdev(struct net_device *ndev)
+{
+        struct brcmf_cfg80211_vif *vif;
+        struct brcmf_if *ifp;
+
+        ifp = netdev_priv(ndev);
+        vif = ifp->vif;
+
+        brcmf_free_vif(vif);
+        free_netdev(ndev);
 }
 
 static bool brcmf_is_linkup(const struct brcmf_event_msg *e)
@@ -4978,20 +4982,20 @@ cfg80211_p2p_attach_out:
         wl_deinit_priv(cfg);
 
 cfg80211_attach_out:
-        brcmf_free_vif(cfg, vif);
+        brcmf_free_vif(vif);
         return NULL;
 }
 
 void brcmf_cfg80211_detach(struct brcmf_cfg80211_info *cfg)
 {
-        struct brcmf_cfg80211_vif *vif;
-        struct brcmf_cfg80211_vif *tmp;
+        if (!cfg)
+                return;
 
-        wl_deinit_priv(cfg);
+        WARN_ON(!list_empty(&cfg->vif_list));
+        wiphy_unregister(cfg->wiphy);
         brcmf_btcoex_detach(cfg);
-        list_for_each_entry_safe(vif, tmp, &cfg->vif_list, list) {
-                brcmf_free_vif(cfg, vif);
-        }
+        wl_deinit_priv(cfg);
+        wiphy_free(cfg->wiphy);
 }
 
 static s32
@@ -5086,7 +5090,8 @@ dongle_scantime_out:
 }
 
 
-static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
+static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg,
+                                   u32 bw_cap[])
 {
         struct brcmf_if *ifp = netdev_priv(cfg_to_ndev(cfg));
         struct ieee80211_channel *band_chan_arr;
@@ -5099,7 +5104,6 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
         enum ieee80211_band band;
         u32 channel;
         u32 *n_cnt;
-        bool ht40_allowed;
         u32 index;
         u32 ht40_flag;
         bool update;
@@ -5132,18 +5136,17 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
                         array_size = ARRAY_SIZE(__wl_2ghz_channels);
                         n_cnt = &__wl_band_2ghz.n_channels;
                         band = IEEE80211_BAND_2GHZ;
-                        ht40_allowed = (bw_cap == WLC_N_BW_40ALL);
                 } else if (ch.band == BRCMU_CHAN_BAND_5G) {
                         band_chan_arr = __wl_5ghz_a_channels;
                         array_size = ARRAY_SIZE(__wl_5ghz_a_channels);
                         n_cnt = &__wl_band_5ghz_a.n_channels;
                         band = IEEE80211_BAND_5GHZ;
-                        ht40_allowed = !(bw_cap == WLC_N_BW_20ALL);
                 } else {
-                        brcmf_err("Invalid channel Sepc. 0x%x.\n", ch.chspec);
+                        brcmf_err("Invalid channel Spec. 0x%x.\n", ch.chspec);
                         continue;
                 }
-                if (!ht40_allowed && ch.bw == BRCMU_CHAN_BW_40)
+                if (!(bw_cap[band] & WLC_BW_40MHZ_BIT) &&
+                    ch.bw == BRCMU_CHAN_BW_40)
                         continue;
                 update = false;
                 for (j = 0; (j < *n_cnt && (*n_cnt < array_size)); j++) {
@@ -5161,7 +5164,10 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
                                 ieee80211_channel_to_frequency(ch.chnum, band);
                         band_chan_arr[index].hw_value = ch.chnum;
 
-                        if (ch.bw == BRCMU_CHAN_BW_40 && ht40_allowed) {
+                        brcmf_err("channel %d: f=%d bw=%d sb=%d\n",
+                                  ch.chnum, band_chan_arr[index].center_freq,
+                                  ch.bw, ch.sb);
+                        if (ch.bw == BRCMU_CHAN_BW_40) {
                                 /* assuming the order is HT20, HT40 Upper,
                                  * HT40 lower from chanspecs
                                  */
@@ -5197,10 +5203,10 @@ static s32 brcmf_construct_reginfo(struct brcmf_cfg80211_info *cfg, u32 bw_cap)
                                         if (channel & WL_CHAN_RADAR)
                                                 band_chan_arr[index].flags |=
                                                         (IEEE80211_CHAN_RADAR |
-                                                        IEEE80211_CHAN_NO_IBSS);
+                                                        IEEE80211_CHAN_NO_IR);
                                         if (channel & WL_CHAN_PASSIVE)
                                                 band_chan_arr[index].flags |=
-                                                    IEEE80211_CHAN_PASSIVE_SCAN;
+                                                    IEEE80211_CHAN_NO_IR;
                                 }
                         }
                         if (!update)
@@ -5212,6 +5218,46 @@ exit:
         return err;
 }
 
+static void brcmf_get_bwcap(struct brcmf_if *ifp, u32 bw_cap[])
+{
+        u32 band, mimo_bwcap;
+        int err;
+
+        band = WLC_BAND_2G;
+        err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+        if (!err) {
+                bw_cap[IEEE80211_BAND_2GHZ] = band;
+                band = WLC_BAND_5G;
+                err = brcmf_fil_iovar_int_get(ifp, "bw_cap", &band);
+                if (!err) {
+                        bw_cap[IEEE80211_BAND_5GHZ] = band;
+                        return;
+                }
+                WARN_ON(1);
+                return;
+        }
+        brcmf_dbg(INFO, "fallback to mimo_bw_cap info\n");
+        mimo_bwcap = 0;
+        err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &mimo_bwcap);
+        if (err)
+                /* assume 20MHz if firmware does not give a clue */
+                mimo_bwcap = WLC_N_BW_20ALL;
+
+        switch (mimo_bwcap) {
+        case WLC_N_BW_40ALL:
+                bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_40MHZ_BIT;
+                /* fall-thru */
+        case WLC_N_BW_20IN2G_40IN5G:
+                bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_40MHZ_BIT;
+                /* fall-thru */
+        case WLC_N_BW_20ALL:
+                bw_cap[IEEE80211_BAND_2GHZ] |= WLC_BW_20MHZ_BIT;
+                bw_cap[IEEE80211_BAND_5GHZ] |= WLC_BW_20MHZ_BIT;
+                break;
+        default:
+                brcmf_err("invalid mimo_bw_cap value\n");
+        }
+}
 
 static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
 {
@@ -5220,13 +5266,13 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         s32 phy_list;
         u32 band_list[3];
         u32 nmode;
-        u32 bw_cap = 0;
+        u32 bw_cap[2] = { 0, 0 };
         s8 phy;
         s32 err;
         u32 nband;
         s32 i;
-        struct ieee80211_supported_band *bands[IEEE80211_NUM_BANDS];
-        s32 index;
+        struct ieee80211_supported_band *bands[2] = { NULL, NULL };
+        struct ieee80211_supported_band *band;
 
         err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_PHYLIST,
                                      &phy_list, sizeof(phy_list));
@@ -5252,11 +5298,10 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         if (err) {
                 brcmf_err("nmode error (%d)\n", err);
         } else {
-                err = brcmf_fil_iovar_int_get(ifp, "mimo_bw_cap", &bw_cap);
-                if (err)
-                        brcmf_err("mimo_bw_cap error (%d)\n", err);
+                brcmf_get_bwcap(ifp, bw_cap);
         }
-        brcmf_dbg(INFO, "nmode=%d, mimo_bw_cap=%d\n", nmode, bw_cap);
+        brcmf_dbg(INFO, "nmode=%d, bw_cap=(%d, %d)\n", nmode,
+                  bw_cap[IEEE80211_BAND_2GHZ], bw_cap[IEEE80211_BAND_5GHZ]);
 
         err = brcmf_construct_reginfo(cfg, bw_cap);
         if (err) {
@@ -5265,40 +5310,33 @@ static s32 brcmf_update_wiphybands(struct brcmf_cfg80211_info *cfg)
         }
 
         nband = band_list[0];
-        memset(bands, 0, sizeof(bands));
 
         for (i = 1; i <= nband && i < ARRAY_SIZE(band_list); i++) {
-                index = -1;
+                band = NULL;
                 if ((band_list[i] == WLC_BAND_5G) &&
-                    (__wl_band_5ghz_a.n_channels > 0)) {
-                        index = IEEE80211_BAND_5GHZ;
-                        bands[index] = &__wl_band_5ghz_a;
-                        if ((bw_cap == WLC_N_BW_40ALL) ||
-                            (bw_cap == WLC_N_BW_20IN2G_40IN5G))
-                                bands[index]->ht_cap.cap |=
-                                                        IEEE80211_HT_CAP_SGI_40;
-                } else if ((band_list[i] == WLC_BAND_2G) &&
-                           (__wl_band_2ghz.n_channels > 0)) {
-                        index = IEEE80211_BAND_2GHZ;
-                        bands[index] = &__wl_band_2ghz;
-                        if (bw_cap == WLC_N_BW_40ALL)
-                                bands[index]->ht_cap.cap |=
-                                                        IEEE80211_HT_CAP_SGI_40;
-                }
+                    (__wl_band_5ghz_a.n_channels > 0))
+                        band = &__wl_band_5ghz_a;
+                else if ((band_list[i] == WLC_BAND_2G) &&
+                         (__wl_band_2ghz.n_channels > 0))
+                        band = &__wl_band_2ghz;
+                else
+                        continue;
 
-                if ((index >= 0) && nmode) {
-                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
-                        bands[index]->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
-                        bands[index]->ht_cap.ht_supported = true;
-                        bands[index]->ht_cap.ampdu_factor =
-                                                IEEE80211_HT_MAX_AMPDU_64K;
-                        bands[index]->ht_cap.ampdu_density =
-                                                IEEE80211_HT_MPDU_DENSITY_16;
-                        /* An HT shall support all EQM rates for one spatial
-                         * stream
-                         */
-                        bands[index]->ht_cap.mcs.rx_mask[0] = 0xff;
+                if (bw_cap[band->band] & WLC_BW_40MHZ_BIT) {
+                        band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_40;
+                        band->ht_cap.cap |= IEEE80211_HT_CAP_SUP_WIDTH_20_40;
                 }
+                band->ht_cap.cap |= IEEE80211_HT_CAP_SGI_20;
+                band->ht_cap.cap |= IEEE80211_HT_CAP_DSSSCCK40;
+                band->ht_cap.ht_supported = true;
+                band->ht_cap.ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K;
+                band->ht_cap.ampdu_density = IEEE80211_HT_MPDU_DENSITY_16;
+                /* An HT shall support all EQM rates for one spatial
+                 * stream
+                 */
+                band->ht_cap.mcs.rx_mask[0] = 0xff;
+                band->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+                bands[band->band] = band;
         }
 
         wiphy = cfg_to_wiphy(cfg);
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
index d9bdaf9a72d0..2dc6a074e8ed 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/wl_cfg80211.h
@@ -412,7 +412,6 @@ struct brcmf_cfg80211_info {
         struct work_struct escan_timeout_work;
         u8 *escan_ioctl_buf;
         struct list_head vif_list;
-        u8 vif_cnt;
         struct brcmf_cfg80211_vif_event vif_event;
         struct completion vif_disabled;
         struct brcmu_d11inf d11inf;
@@ -487,8 +486,7 @@ enum nl80211_iftype brcmf_cfg80211_get_iftype(struct brcmf_if *ifp);
 struct brcmf_cfg80211_vif *brcmf_alloc_vif(struct brcmf_cfg80211_info *cfg,
                                            enum nl80211_iftype type,
                                            bool pm_block);
-void brcmf_free_vif(struct brcmf_cfg80211_info *cfg,
-                    struct brcmf_cfg80211_vif *vif);
+void brcmf_free_vif(struct brcmf_cfg80211_vif *vif);
 
 s32 brcmf_vif_set_mgmt_ie(struct brcmf_cfg80211_vif *vif, s32 pktflag,
                           const u8 *vndr_ie_buf, u32 vndr_ie_len);
@@ -507,5 +505,6 @@ s32 brcmf_notify_escan_complete(struct brcmf_cfg80211_info *cfg,
                                 bool fw_abort);
 void brcmf_set_mpc(struct brcmf_if *ndev, int mpc);
 void brcmf_abort_scanning(struct brcmf_cfg80211_info *cfg);
+void brcmf_cfg80211_free_netdev(struct net_device *ndev);
 
 #endif                          /* _wl_cfg80211_h_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/channel.c b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
index cc87926f5055..635ae034c7e5 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/channel.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/channel.c
@@ -59,23 +59,18 @@
 
 #define BRCM_2GHZ_2412_2462     REG_RULE(2412-10, 2462+10, 40, 0, 19, 0)
 #define BRCM_2GHZ_2467_2472     REG_RULE(2467-10, 2472+10, 20, 0, 19, \
-                                         NL80211_RRF_PASSIVE_SCAN | \
-                                         NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 
 #define BRCM_5GHZ_5180_5240     REG_RULE(5180-10, 5240+10, 40, 0, 21, \
-                                         NL80211_RRF_PASSIVE_SCAN | \
-                                         NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 #define BRCM_5GHZ_5260_5320     REG_RULE(5260-10, 5320+10, 40, 0, 21, \
-                                         NL80211_RRF_PASSIVE_SCAN | \
                                          NL80211_RRF_DFS | \
-                                         NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 #define BRCM_5GHZ_5500_5700     REG_RULE(5500-10, 5700+10, 40, 0, 21, \
-                                         NL80211_RRF_PASSIVE_SCAN | \
                                          NL80211_RRF_DFS | \
-                                         NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 #define BRCM_5GHZ_5745_5825     REG_RULE(5745-10, 5825+10, 40, 0, 21, \
-                                         NL80211_RRF_PASSIVE_SCAN | \
-                                         NL80211_RRF_NO_IBSS)
+                                         NL80211_RRF_NO_IR)
 
 static const struct ieee80211_regdomain brcms_regdom_x2 = {
         .n_reg_rules = 6,
@@ -395,7 +390,7 @@ brcms_c_channel_set_chanspec(struct brcms_cm_info *wlc_cm, u16 chanspec,
                 brcms_c_set_gmode(wlc, wlc->protection->gmode_user, false);
 
         brcms_b_set_chanspec(wlc->hw, chanspec,
-                              !!(ch->flags & IEEE80211_CHAN_PASSIVE_SCAN),
+                              !!(ch->flags & IEEE80211_CHAN_NO_IR),
                               &txpwr);
 }
 
@@ -657,8 +652,8 @@ static void brcms_reg_apply_radar_flags(struct wiphy *wiphy)
                  */
                 if (!(ch->flags & IEEE80211_CHAN_DISABLED))
                         ch->flags |= IEEE80211_CHAN_RADAR |
-                                     IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_PASSIVE_SCAN;
+                                     IEEE80211_CHAN_NO_IR |
+                                     IEEE80211_CHAN_NO_IR;
         }
 }
 
@@ -684,18 +679,15 @@ brcms_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                 continue;
 
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                rule = freq_reg_info(wiphy, ch->center_freq);
+                                rule = freq_reg_info(wiphy,
+                                                     MHZ_TO_KHZ(ch->center_freq));
                                 if (IS_ERR(rule))
                                         continue;
 
-                                if (!(rule->flags & NL80211_RRF_NO_IBSS))
-                                        ch->flags &= ~IEEE80211_CHAN_NO_IBSS;
-                                if (!(rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                                        ch->flags &=
-                                                ~IEEE80211_CHAN_PASSIVE_SCAN;
+                                if (!(rule->flags & NL80211_RRF_NO_IR))
+                                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
                         } else if (ch->beacon_found) {
-                                ch->flags &= ~(IEEE80211_CHAN_NO_IBSS |
-                                               IEEE80211_CHAN_PASSIVE_SCAN);
+                                ch->flags &= ~IEEE80211_CHAN_NO_IR;
                         }
                 }
         }
@@ -775,8 +767,8 @@ void brcms_c_regd_init(struct brcms_c_info *wlc)
         }
 
         wlc->wiphy->reg_notifier = brcms_reg_notifier;
-        wlc->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
-                             WIPHY_FLAG_STRICT_REGULATORY;
+        wlc->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
+                                        REGULATORY_STRICT_REG;
         wiphy_apply_custom_regulatory(wlc->wiphy, regd->regdomain);
         brcms_reg_apply_beaconing_flags(wiphy, NL80211_REGDOM_SET_BY_DRIVER);
 }
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index edc5d105ff98..925034b80e9c 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -125,13 +125,13 @@ static struct ieee80211_channel brcms_2ghz_chantable[] = {
         CHAN2GHZ(10, 2457, IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(11, 2462, IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(12, 2467,
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
+                 IEEE80211_CHAN_NO_IR |
                  IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(13, 2472,
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
+                 IEEE80211_CHAN_NO_IR |
                  IEEE80211_CHAN_NO_HT40PLUS),
         CHAN2GHZ(14, 2484,
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_IBSS |
+                 IEEE80211_CHAN_NO_IR |
                  IEEE80211_CHAN_NO_HT40PLUS | IEEE80211_CHAN_NO_HT40MINUS |
                  IEEE80211_CHAN_NO_OFDM)
 };
@@ -144,51 +144,51 @@ static struct ieee80211_channel brcms_5ghz_nphy_chantable[] = {
         CHAN5GHZ(48, IEEE80211_CHAN_NO_HT40PLUS),
         /* UNII-2 */
         CHAN5GHZ(52,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(56,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(60,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(64,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         /* MID */
         CHAN5GHZ(100,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(104,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(108,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(112,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(116,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(120,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(124,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(128,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(132,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40MINUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40MINUS),
         CHAN5GHZ(136,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS),
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS),
         CHAN5GHZ(140,
-                 IEEE80211_CHAN_RADAR | IEEE80211_CHAN_NO_IBSS |
-                 IEEE80211_CHAN_PASSIVE_SCAN | IEEE80211_CHAN_NO_HT40PLUS |
+                 IEEE80211_CHAN_RADAR |
+                 IEEE80211_CHAN_NO_IR | IEEE80211_CHAN_NO_HT40PLUS |
                  IEEE80211_CHAN_NO_HT40MINUS),
         /* UNII-3 */
         CHAN5GHZ(149, IEEE80211_CHAN_NO_HT40MINUS),
@@ -1071,7 +1071,6 @@ static int ieee_hw_init(struct ieee80211_hw *hw)
         hw->max_rates = 2;      /* Primary rate and 1 fallback rate */
 
         /* channel change time is dependent on chip and band  */
-        hw->channel_change_time = 7 * 1000;
         hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
                                      BIT(NL80211_IFTYPE_AP) |
                                      BIT(NL80211_IFTYPE_ADHOC);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 8138f1cff4e5..9417cb5a2553 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -7108,7 +7108,6 @@ prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
                      struct sk_buff *p,
                      struct ieee80211_rx_status *rx_status)
 {
-        int preamble;
         int channel;
         u32 rspec;
         unsigned char *plcp;
@@ -7191,7 +7190,6 @@ prep_mac80211_status(struct brcms_c_info *wlc, struct d11rxhdr *rxh,
                         rx_status->rate_idx -= BRCMS_LEGACY_5G_RATE_OFFSET;
 
                 /* Determine short preamble and rate_idx */
-                preamble = 0;
                 if (is_cck_rate(rspec)) {
                         if (rxh->PhyRxStatus_0 & PRXS0_SHORTH)
                                 rx_status->flag |= RX_FLAG_SHORTPRE;
diff --git a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
index 84113ea16f84..6fa5d4863782 100644
--- a/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
+++ b/drivers/net/wireless/brcm80211/include/brcm_hw_ids.h
@@ -41,6 +41,7 @@
 #define BCM4331_CHIP_ID         0x4331
 #define BCM4334_CHIP_ID         0x4334
 #define BCM4335_CHIP_ID         0x4335
+#define BCM43362_CHIP_ID        43362
 #define BCM4339_CHIP_ID         0x4339
 
 #endif                          /* _BRCM_HW_IDS_H_ */
diff --git a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
index 0505cc065e0d..7ca2aa1035b2 100644
--- a/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
+++ b/drivers/net/wireless/brcm80211/include/brcmu_wifi.h
@@ -82,6 +82,20 @@
 #define WLC_N_BW_40ALL                  1
 #define WLC_N_BW_20IN2G_40IN5G          2
 
+#define WLC_BW_20MHZ_BIT                BIT(0)
+#define WLC_BW_40MHZ_BIT                BIT(1)
+#define WLC_BW_80MHZ_BIT                BIT(2)
+#define WLC_BW_160MHZ_BIT               BIT(3)
+
+/* Bandwidth capabilities */
+#define WLC_BW_CAP_20MHZ                (WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_40MHZ                (WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_80MHZ                (WLC_BW_80MHZ_BIT|WLC_BW_40MHZ_BIT| \
+                                         WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_160MHZ               (WLC_BW_160MHZ_BIT|WLC_BW_80MHZ_BIT| \
+                                         WLC_BW_40MHZ_BIT|WLC_BW_20MHZ_BIT)
+#define WLC_BW_CAP_UNRESTRICTED         0xFF
+
 /* band types */
 #define WLC_BAND_AUTO                   0       /* auto-select */
 #define WLC_BAND_5G                     1       /* 5 Ghz */
diff --git a/drivers/net/wireless/cw1200/cw1200_sdio.c b/drivers/net/wireless/cw1200/cw1200_sdio.c
index ebdcdf44f155..d3acc85932a5 100644
--- a/drivers/net/wireless/cw1200/cw1200_sdio.c
+++ b/drivers/net/wireless/cw1200/cw1200_sdio.c
@@ -108,9 +108,9 @@ static irqreturn_t cw1200_gpio_irq(int irq, void *dev_id)
         struct hwbus_priv *self = dev_id;
 
         if (self->core) {
-                sdio_claim_host(self->func);
+                cw1200_sdio_lock(self);
                 cw1200_irq_handler(self->core);
-                sdio_release_host(self->func);
+                cw1200_sdio_unlock(self);
                 return IRQ_HANDLED;
         } else {
                 return IRQ_NONE;
diff --git a/drivers/net/wireless/cw1200/fwio.c b/drivers/net/wireless/cw1200/fwio.c
index acdff0f7f952..5a9ffd3a6a6c 100644
--- a/drivers/net/wireless/cw1200/fwio.c
+++ b/drivers/net/wireless/cw1200/fwio.c
@@ -14,7 +14,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/vmalloc.h>
 #include <linux/sched.h>
 #include <linux/firmware.h>
diff --git a/drivers/net/wireless/cw1200/main.c b/drivers/net/wireless/cw1200/main.c
index 090f01577dd2..3e78cc3ccb78 100644
--- a/drivers/net/wireless/cw1200/main.c
+++ b/drivers/net/wireless/cw1200/main.c
@@ -21,7 +21,6 @@
  */
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
@@ -302,7 +301,6 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr,
 
         hw->wiphy->flags |= WIPHY_FLAG_AP_UAPSD;
 
-        hw->channel_change_time = 1000; /* TODO: find actual value */
         hw->queues = 4;
 
         priv->rts_threshold = -1;
diff --git a/drivers/net/wireless/cw1200/pm.c b/drivers/net/wireless/cw1200/pm.c
index b37abb9f0453..6907c8fd4578 100644
--- a/drivers/net/wireless/cw1200/pm.c
+++ b/drivers/net/wireless/cw1200/pm.c
@@ -225,7 +225,7 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
                 cw1200_set_pm(priv, &priv->powersave_mode);
                 if (wait_event_interruptible_timeout(priv->ps_mode_switch_done,
                                                      !priv->ps_mode_switch_in_progress, 1*HZ) <= 0) {
-                        goto revert3;
+                        goto revert4;
                 }
         }
 
@@ -254,11 +254,11 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         /* Stop serving thread */
         if (cw1200_bh_suspend(priv))
-                goto revert4;
+                goto revert5;
 
         ret = timer_pending(&priv->mcast_timeout);
         if (ret)
-                goto revert5;
+                goto revert6;
 
         /* Store suspend state */
         pm_state->suspend_state = state;
@@ -280,9 +280,9 @@ int cw1200_wow_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan)
 
         return 0;
 
-revert5:
+revert6:
         WARN_ON(cw1200_bh_resume(priv));
-revert4:
+revert5:
         cw1200_resume_work(priv, &priv->bss_loss_work,
                            state->bss_loss_tmo);
         cw1200_resume_work(priv, &priv->join_timeout,
@@ -291,6 +291,7 @@ revert4:
                            state->direct_probe);
         cw1200_resume_work(priv, &priv->link_id_gc_work,
                            state->link_id_gc);
+revert4:
         kfree(state);
 revert3:
         wsm_set_udp_port_filter(priv, &cw1200_udp_port_filter_off);
diff --git a/drivers/net/wireless/cw1200/scan.c b/drivers/net/wireless/cw1200/scan.c
index ee3c19037aac..9afcd4ce3368 100644
--- a/drivers/net/wireless/cw1200/scan.c
+++ b/drivers/net/wireless/cw1200/scan.c
@@ -173,8 +173,9 @@ void cw1200_scan_work(struct work_struct *work)
                         cw1200_set_pm(priv, &priv->powersave_mode);
 
                 if (priv->scan.status < 0)
-                        wiphy_dbg(priv->hw->wiphy, "[SCAN] Scan failed (%d).\n",
-                                  priv->scan.status);
+                        wiphy_warn(priv->hw->wiphy,
+                                   "[SCAN] Scan failed (%d).\n",
+                                   priv->scan.status);
                 else if (priv->scan.req)
                         wiphy_dbg(priv->hw->wiphy,
                                   "[SCAN] Scan completed.\n");
@@ -197,9 +198,9 @@ void cw1200_scan_work(struct work_struct *work)
                         if ((*it)->band != first->band)
                                 break;
                         if (((*it)->flags ^ first->flags) &
-                                        IEEE80211_CHAN_PASSIVE_SCAN)
+                                        IEEE80211_CHAN_NO_IR)
                                 break;
-                        if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                        if (!(first->flags & IEEE80211_CHAN_NO_IR) &&
                             (*it)->max_power != first->max_power)
                                 break;
                 }
@@ -210,7 +211,7 @@ void cw1200_scan_work(struct work_struct *work)
                 else
                         scan.max_tx_rate = WSM_TRANSMIT_RATE_1;
                 scan.num_probes =
-                        (first->flags & IEEE80211_CHAN_PASSIVE_SCAN) ? 0 : 2;
+                        (first->flags & IEEE80211_CHAN_NO_IR) ? 0 : 2;
                 scan.num_ssids = priv->scan.n_ssids;
                 scan.ssids = &priv->scan.ssids[0];
                 scan.num_channels = it - priv->scan.curr;
@@ -233,7 +234,7 @@ void cw1200_scan_work(struct work_struct *work)
                 }
                 for (i = 0; i < scan.num_channels; ++i) {
                         scan.ch[i].number = priv->scan.curr[i]->hw_value;
-                        if (priv->scan.curr[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
+                        if (priv->scan.curr[i]->flags & IEEE80211_CHAN_NO_IR) {
                                 scan.ch[i].min_chan_time = 50;
                                 scan.ch[i].max_chan_time = 100;
                         } else {
@@ -241,7 +242,7 @@ void cw1200_scan_work(struct work_struct *work)
                                 scan.ch[i].max_chan_time = 25;
                         }
                 }
-                if (!(first->flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                if (!(first->flags & IEEE80211_CHAN_NO_IR) &&
                     priv->scan.output_power != first->max_power) {
                         priv->scan.output_power = first->max_power;
                         wsm_set_output_power(priv,
diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c
index 010b252be584..103f7bce8932 100644
--- a/drivers/net/wireless/cw1200/sta.c
+++ b/drivers/net/wireless/cw1200/sta.c
@@ -13,6 +13,7 @@
 #include <linux/sched.h>
 #include <linux/firmware.h>
 #include <linux/module.h>
+#include <linux/etherdevice.h>
 
 #include "cw1200.h"
 #include "sta.h"
@@ -555,8 +556,8 @@ u64 cw1200_prepare_multicast(struct ieee80211_hw *hw,
                 pr_debug("[STA] multicast: %pM\n", ha->addr);
                 memcpy(&priv->multicast_filter.macaddrs[count],
                        ha->addr, ETH_ALEN);
-                if (memcmp(ha->addr, broadcast_ipv4, ETH_ALEN) &&
-                    memcmp(ha->addr, broadcast_ipv6, ETH_ALEN))
+                if (!ether_addr_equal(ha->addr, broadcast_ipv4) &&
+                    !ether_addr_equal(ha->addr, broadcast_ipv6))
                         priv->has_multicast_subscription = true;
                 count++;
         }
diff --git a/drivers/net/wireless/cw1200/txrx.c b/drivers/net/wireless/cw1200/txrx.c
index e824d4d4a18d..0bd541175ecd 100644
--- a/drivers/net/wireless/cw1200/txrx.c
+++ b/drivers/net/wireless/cw1200/txrx.c
@@ -1166,8 +1166,7 @@ void cw1200_rx_cb(struct cw1200_common *priv,
                         return;
         } else if (ieee80211_is_beacon(frame->frame_control) &&
                    !arg->status && priv->vif &&
-                   !memcmp(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid,
-                           ETH_ALEN)) {
+                   ether_addr_equal(ieee80211_get_SA(frame), priv->vif->bss_conf.bssid)) {
                 const u8 *tim_ie;
                 u8 *ies = ((struct ieee80211_mgmt *)
                           (skb->data))->u.beacon.variable;
diff --git a/drivers/net/wireless/hostap/hostap_80211_rx.c b/drivers/net/wireless/hostap/hostap_80211_rx.c
index d39e3e24077b..599f30f22841 100644
--- a/drivers/net/wireless/hostap/hostap_80211_rx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_rx.c
@@ -563,7 +563,7 @@ hostap_rx_frame_wds(local_info_t *local, struct ieee80211_hdr *hdr, u16 fc,
 
         /* Possible WDS frame: either IEEE 802.11 compliant (if FromDS)
          * or own non-standard frame with 4th address after payload */
-        if (memcmp(hdr->addr1, local->dev->dev_addr, ETH_ALEN) != 0 &&
+        if (!ether_addr_equal(hdr->addr1, local->dev->dev_addr) &&
             (hdr->addr1[0] != 0xff || hdr->addr1[1] != 0xff ||
              hdr->addr1[2] != 0xff || hdr->addr1[3] != 0xff ||
              hdr->addr1[4] != 0xff || hdr->addr1[5] != 0xff)) {
@@ -622,12 +622,12 @@ static int hostap_is_eapol_frame(local_info_t *local, struct sk_buff *skb)
         /* check that the frame is unicast frame to us */
         if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
             IEEE80211_FCTL_TODS &&
-            memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0 &&
-            memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
+            ether_addr_equal(hdr->addr1, dev->dev_addr) &&
+            ether_addr_equal(hdr->addr3, dev->dev_addr)) {
                 /* ToDS frame with own addr BSSID and DA */
         } else if ((fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) ==
                    IEEE80211_FCTL_FROMDS &&
-                   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
+                   ether_addr_equal(hdr->addr1, dev->dev_addr)) {
                 /* FromDS frame with own addr as DA */
         } else
                 return 0;
diff --git a/drivers/net/wireless/hostap/hostap_80211_tx.c b/drivers/net/wireless/hostap/hostap_80211_tx.c
index 344a981a052e..8bde77689469 100644
--- a/drivers/net/wireless/hostap/hostap_80211_tx.c
+++ b/drivers/net/wireless/hostap/hostap_80211_tx.c
@@ -1,5 +1,6 @@
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <linux/etherdevice.h>
 
 #include "hostap_80211.h"
 #include "hostap_common.h"
@@ -103,8 +104,7 @@ netdev_tx_t hostap_data_start_xmit(struct sk_buff *skb,
                         return NETDEV_TX_OK;
                 } else if (local->iw_mode == IW_MODE_INFRA &&
                            (local->wds_type & HOSTAP_WDS_AP_CLIENT) &&
-                           memcmp(skb->data + ETH_ALEN, dev->dev_addr,
-                                  ETH_ALEN) != 0) {
+                           !ether_addr_equal(skb->data + ETH_ALEN, dev->dev_addr)) {
                         /* AP client mode: send frames with foreign src addr
                          * using 4-addr WDS frames */
                         use_wds = WDS_COMPLIANT_FRAME;
diff --git a/drivers/net/wireless/hostap/hostap_ap.c b/drivers/net/wireless/hostap/hostap_ap.c
index d6033a8e5dea..d36e252d2ccb 100644
--- a/drivers/net/wireless/hostap/hostap_ap.c
+++ b/drivers/net/wireless/hostap/hostap_ap.c
@@ -24,6 +24,7 @@
 #include <linux/slab.h>
 #include <linux/export.h>
 #include <linux/moduleparam.h>
+#include <linux/etherdevice.h>
 
 #include "hostap_wlan.h"
 #include "hostap.h"
@@ -106,13 +107,12 @@ static void ap_sta_hash_del(struct ap_data *ap, struct sta_info *sta)
 
         s = ap->sta_hash[STA_HASH(sta->addr)];
         if (s == NULL) return;
-        if (memcmp(s->addr, sta->addr, ETH_ALEN) == 0) {
+        if (ether_addr_equal(s->addr, sta->addr)) {
                 ap->sta_hash[STA_HASH(sta->addr)] = s->hnext;
                 return;
         }
 
-        while (s->hnext != NULL && memcmp(s->hnext->addr, sta->addr, ETH_ALEN)
-               != 0)
+        while (s->hnext != NULL && !ether_addr_equal(s->hnext->addr, sta->addr))
                 s = s->hnext;
         if (s->hnext != NULL)
                 s->hnext = s->hnext->hnext;
@@ -435,7 +435,7 @@ int ap_control_del_mac(struct mac_restrictions *mac_restrictions, u8 *mac)
              ptr != &mac_restrictions->mac_list; ptr = ptr->next) {
                 entry = list_entry(ptr, struct mac_entry, list);
 
-                if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
+                if (ether_addr_equal(entry->addr, mac)) {
                         list_del(ptr);
                         kfree(entry);
                         mac_restrictions->entries--;
@@ -459,7 +459,7 @@ static int ap_control_mac_deny(struct mac_restrictions *mac_restrictions,
 
         spin_lock_bh(&mac_restrictions->lock);
         list_for_each_entry(entry, &mac_restrictions->mac_list, list) {
-                if (memcmp(entry->addr, mac, ETH_ALEN) == 0) {
+                if (ether_addr_equal(entry->addr, mac)) {
                         found = 1;
                         break;
                 }
@@ -957,7 +957,7 @@ static struct sta_info* ap_get_sta(struct ap_data *ap, u8 *sta)
         struct sta_info *s;
 
         s = ap->sta_hash[STA_HASH(sta)];
-        while (s != NULL && memcmp(s->addr, sta, ETH_ALEN) != 0)
+        while (s != NULL && !ether_addr_equal(s->addr, sta))
                 s = s->hnext;
         return s;
 }
@@ -1391,7 +1391,7 @@ static void handle_authen(local_info_t *local, struct sk_buff *skb,
         status_code = __le16_to_cpu(*pos);
         pos++;
 
-        if (memcmp(dev->dev_addr, hdr->addr2, ETH_ALEN) == 0 ||
+        if (ether_addr_equal(dev->dev_addr, hdr->addr2) ||
             ap_control_mac_deny(&ap->mac_restrictions, hdr->addr2)) {
                 txt = "authentication denied";
                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
@@ -1935,7 +1935,7 @@ static void handle_pspoll(local_info_t *local,
         PDEBUG(DEBUG_PS2, "handle_pspoll: BSSID=%pM, TA=%pM PWRMGT=%d\n",
                hdr->addr1, hdr->addr2, !!ieee80211_has_pm(hdr->frame_control));
 
-        if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
+        if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) {
                 PDEBUG(DEBUG_AP,
                        "handle_pspoll - addr1(BSSID)=%pM not own MAC\n",
                        hdr->addr1);
@@ -2230,7 +2230,7 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
                         goto done;
                 }
 
-                if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
+                if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) {
                         PDEBUG(DEBUG_AP, "handle_ap_item - addr1(BSSID)=%pM"
                                " not own MAC\n", hdr->addr1);
                         goto done;
@@ -2267,13 +2267,13 @@ static void handle_ap_item(local_info_t *local, struct sk_buff *skb,
                 goto done;
         }
 
-        if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN)) {
+        if (!ether_addr_equal(hdr->addr1, dev->dev_addr)) {
                 PDEBUG(DEBUG_AP, "handle_ap_item - addr1(DA)=%pM"
                        " not own MAC\n", hdr->addr1);
                 goto done;
         }
 
-        if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN)) {
+        if (!ether_addr_equal(hdr->addr3, dev->dev_addr)) {
                 PDEBUG(DEBUG_AP, "handle_ap_item - addr3(BSSID)=%pM"
                        " not own MAC\n", hdr->addr3);
                 goto done;
@@ -3035,7 +3035,7 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                 if (!wds) {
                         /* FromDS frame - not for us; probably
                          * broadcast/multicast in another BSS - drop */
-                        if (memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
+                        if (ether_addr_equal(hdr->addr1, dev->dev_addr)) {
                                 printk(KERN_DEBUG "Odd.. FromDS packet "
                                        "received with own BSSID\n");
                                 hostap_dump_rx_80211(dev->name, skb, rx_stats);
@@ -3044,7 +3044,7 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                         goto out;
                 }
         } else if (stype == IEEE80211_STYPE_NULLFUNC && sta == NULL &&
-                   memcmp(hdr->addr1, dev->dev_addr, ETH_ALEN) == 0) {
+                   ether_addr_equal(hdr->addr1, dev->dev_addr)) {
 
                 if (local->hostapd) {
                         prism2_rx_80211(local->apdev, skb, rx_stats,
@@ -3073,7 +3073,7 @@ ap_rx_ret hostap_handle_sta_rx(local_info_t *local, struct net_device *dev,
                 /* If BSSID (Addr3) is foreign, this frame is a normal
                  * broadcast frame from an IBSS network. Drop it silently.
                  * If BSSID is own, report the dropping of this frame. */
-                if (memcmp(hdr->addr3, dev->dev_addr, ETH_ALEN) == 0) {
+                if (ether_addr_equal(hdr->addr3, dev->dev_addr)) {
                         printk(KERN_DEBUG "%s: dropped received packet from %pM"
                                " with no ToDS flag "
                                "(type=0x%02x, subtype=0x%02x)\n", dev->name,
diff --git a/drivers/net/wireless/hostap/hostap_cs.c b/drivers/net/wireless/hostap/hostap_cs.c
index 56cd01ca8ad0..9f825f2620da 100644
--- a/drivers/net/wireless/hostap/hostap_cs.c
+++ b/drivers/net/wireless/hostap/hostap_cs.c
@@ -1,7 +1,6 @@
 #define PRISM2_PCCARD
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c
index c275dc1623fe..6df3ee561d52 100644
--- a/drivers/net/wireless/hostap/hostap_hw.c
+++ b/drivers/net/wireless/hostap/hostap_hw.c
@@ -2175,7 +2175,7 @@ static void hostap_tx_callback(local_info_t *local,
         struct hostap_tx_callback_info *cb;
 
         /* Make sure that frame was from us. */
-        if (memcmp(txdesc->addr2, local->dev->dev_addr, ETH_ALEN)) {
+        if (!ether_addr_equal(txdesc->addr2, local->dev->dev_addr)) {
                 printk(KERN_DEBUG "%s: TX callback - foreign frame\n",
                        local->dev->name);
                 return;
diff --git a/drivers/net/wireless/hostap/hostap_ioctl.c b/drivers/net/wireless/hostap/hostap_ioctl.c
index e5090309824e..3e5fa7872b64 100644
--- a/drivers/net/wireless/hostap/hostap_ioctl.c
+++ b/drivers/net/wireless/hostap/hostap_ioctl.c
@@ -655,7 +655,7 @@ static int hostap_join_ap(struct net_device *dev)
                 if (!local->last_scan_results)
                         break;
                 entry = &local->last_scan_results[i];
-                if (memcmp(local->preferred_ap, entry->bssid, ETH_ALEN) == 0) {
+                if (ether_addr_equal(local->preferred_ap, entry->bssid)) {
                         req.channel = entry->chid;
                         break;
                 }
@@ -1978,7 +1978,7 @@ static inline int prism2_translate_scan(local_info_t *local,
                 list_for_each(ptr, &local->bss_list) {
                         struct hostap_bss_info *bss;
                         bss = list_entry(ptr, struct hostap_bss_info, list);
-                        if (memcmp(bss->bssid, scan->bssid, ETH_ALEN) == 0) {
+                        if (ether_addr_equal(bss->bssid, scan->bssid)) {
                                 bss->included = 1;
                                 current_ev = __prism2_translate_scan(
                                         local, info, scan, bss, current_ev,
@@ -2567,7 +2567,7 @@ static int prism2_ioctl_priv_prism2_param(struct net_device *dev,
                 local->passive_scan_interval = value;
                 if (timer_pending(&local->passive_scan_timer))
                         del_timer(&local->passive_scan_timer);
-                if (value > 0) {
+                if (value > 0 && value < INT_MAX / HZ) {
                         local->passive_scan_timer.expires = jiffies +
                                 local->passive_scan_interval * HZ;
                         add_timer(&local->passive_scan_timer);
diff --git a/drivers/net/wireless/hostap/hostap_main.c b/drivers/net/wireless/hostap/hostap_main.c
index a1257c92afc4..67db34e56d7e 100644
--- a/drivers/net/wireless/hostap/hostap_main.c
+++ b/drivers/net/wireless/hostap/hostap_main.c
@@ -155,8 +155,7 @@ int prism2_wds_add(local_info_t *local, u8 *remote_addr,
 
                 if (prism2_wds_special_addr(iface->u.wds.remote_addr))
                         empty = iface;
-                else if (memcmp(iface->u.wds.remote_addr, remote_addr,
-                                ETH_ALEN) == 0) {
+                else if (ether_addr_equal(iface->u.wds.remote_addr, remote_addr)) {
                         match = iface;
                         break;
                 }
@@ -214,8 +213,7 @@ int prism2_wds_del(local_info_t *local, u8 *remote_addr,
                 if (iface->type != HOSTAP_INTERFACE_WDS)
                         continue;
 
-                if (memcmp(iface->u.wds.remote_addr, remote_addr,
-                           ETH_ALEN) == 0) {
+                if (ether_addr_equal(iface->u.wds.remote_addr, remote_addr)) {
                         selected = iface;
                         break;
                 }
@@ -1085,7 +1083,7 @@ int prism2_sta_deauth(local_info_t *local, u16 reason)
 
         if (local->iw_mode != IW_MODE_INFRA ||
             is_zero_ether_addr(local->bssid) ||
-            memcmp(local->bssid, "\x44\x44\x44\x44\x44\x44", ETH_ALEN) == 0)
+            ether_addr_equal(local->bssid, "\x44\x44\x44\x44\x44\x44"))
                 return 0;
 
         ret = prism2_sta_send_mgmt(local, local->bssid, IEEE80211_STYPE_DEAUTH,
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 05ca3402dca7..91158e2e961c 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -5,7 +5,6 @@
  * Andy Warner <andyw@pobox.com> */
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/hostap/hostap_plx.c b/drivers/net/wireless/hostap/hostap_plx.c
index c3d067ee4db9..3bf530d9a40f 100644
--- a/drivers/net/wireless/hostap/hostap_plx.c
+++ b/drivers/net/wireless/hostap/hostap_plx.c
@@ -8,7 +8,6 @@
 
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/if.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index f8ab193009cd..3aba49259ef1 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1930,10 +1930,10 @@ static int ipw2100_wdev_init(struct net_device *dev)
                         bg_band->channels[i].max_power = geo->bg[i].max_power;
                         if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
                                 bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
                                 bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
                                 bg_band->channels[i].flags |=
                                         IEEE80211_CHAN_RADAR;
@@ -6362,7 +6362,6 @@ out:
                                    &ipw2100_attribute_group);
 
                 free_libipw(dev, 0);
-                pci_set_drvdata(pci_dev, NULL);
         }
 
         pci_iounmap(pci_dev, ioaddr);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 81903e33d5b1..139326065bd9 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -3012,7 +3012,7 @@ static void ipw_remove_current_network(struct ipw_priv *priv)
         spin_lock_irqsave(&priv->ieee->lock, flags);
         list_for_each_safe(element, safe, &priv->ieee->network_list) {
                 network = list_entry(element, struct libipw_network, list);
-                if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
+                if (ether_addr_equal(network->bssid, priv->bssid)) {
                         list_del(element);
                         list_add_tail(&network->list,
                                       &priv->ieee->network_free_list);
@@ -3921,7 +3921,7 @@ static u8 ipw_add_station(struct ipw_priv *priv, u8 * bssid)
         int i;
 
         for (i = 0; i < priv->num_stations; i++) {
-                if (!memcmp(priv->stations[i], bssid, ETH_ALEN)) {
+                if (ether_addr_equal(priv->stations[i], bssid)) {
                         /* Another node is active in network */
                         priv->missed_adhoc_beacons = 0;
                         if (!(priv->config & CFG_STATIC_CHANNEL))
@@ -3953,7 +3953,7 @@ static u8 ipw_find_station(struct ipw_priv *priv, u8 * bssid)
         int i;
 
         for (i = 0; i < priv->num_stations; i++)
-                if (!memcmp(priv->stations[i], bssid, ETH_ALEN))
+                if (ether_addr_equal(priv->stations[i], bssid))
                         return i;
 
         return IPW_INVALID_STATION;
@@ -5622,7 +5622,7 @@ static int ipw_find_adhoc_network(struct ipw_priv *priv,
                 return 0;
         }
 
-        if (!memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
+        if (ether_addr_equal(network->bssid, priv->bssid)) {
                 IPW_DEBUG_MERGE("Network '%s (%pM)' excluded "
                                 "because of the same BSSID match: %pM"
                                 ".\n", print_ssid(ssid, network->ssid,
@@ -5849,7 +5849,7 @@ static int ipw_best_network(struct ipw_priv *priv,
         }
 
         if ((priv->config & CFG_STATIC_BSSID) &&
-            memcmp(network->bssid, priv->bssid, ETH_ALEN)) {
+            !ether_addr_equal(network->bssid, priv->bssid)) {
                 IPW_DEBUG_ASSOC("Network '%s (%pM)' excluded "
                                 "because of BSSID mismatch: %pM.\n",
                                 print_ssid(ssid, network->ssid,
@@ -6988,7 +6988,7 @@ static int ipw_qos_handle_probe_response(struct ipw_priv *priv,
         }
         if ((priv->status & STATUS_ASSOCIATED) &&
             (priv->ieee->iw_mode == IW_MODE_ADHOC) && (active_network == 0)) {
-                if (memcmp(network->bssid, priv->bssid, ETH_ALEN))
+                if (!ether_addr_equal(network->bssid, priv->bssid))
                         if (network->capability & WLAN_CAPABILITY_IBSS)
                                 if ((network->ssid_len ==
                                      priv->assoc_network->ssid_len) &&
@@ -8210,29 +8210,29 @@ static int is_network_packet(struct ipw_priv *priv,
         switch (priv->ieee->iw_mode) {
         case IW_MODE_ADHOC:     /* Header: Dest. | Source    | BSSID */
                 /* packets from our adapter are dropped (echo) */
-                if (!memcmp(header->addr2, priv->net_dev->dev_addr, ETH_ALEN))
+                if (ether_addr_equal(header->addr2, priv->net_dev->dev_addr))
                         return 0;
 
                 /* {broad,multi}cast packets to our BSSID go through */
                 if (is_multicast_ether_addr(header->addr1))
-                        return !memcmp(header->addr3, priv->bssid, ETH_ALEN);
+                        return ether_addr_equal(header->addr3, priv->bssid);
 
                 /* packets to our adapter go through */
-                return !memcmp(header->addr1, priv->net_dev->dev_addr,
-                               ETH_ALEN);
+                return ether_addr_equal(header->addr1,
+                                        priv->net_dev->dev_addr);
 
         case IW_MODE_INFRA:     /* Header: Dest. | BSSID | Source */
                 /* packets from our adapter are dropped (echo) */
-                if (!memcmp(header->addr3, priv->net_dev->dev_addr, ETH_ALEN))
+                if (ether_addr_equal(header->addr3, priv->net_dev->dev_addr))
                         return 0;
 
                 /* {broad,multi}cast packets to our BSS go through */
                 if (is_multicast_ether_addr(header->addr1))
-                        return !memcmp(header->addr2, priv->bssid, ETH_ALEN);
+                        return ether_addr_equal(header->addr2, priv->bssid);
 
                 /* packets to our adapter go through */
-                return !memcmp(header->addr1, priv->net_dev->dev_addr,
-                               ETH_ALEN);
+                return ether_addr_equal(header->addr1,
+                                        priv->net_dev->dev_addr);
         }
 
         return 1;
@@ -8260,7 +8260,7 @@ static  int is_duplicate_packet(struct ipw_priv *priv,
                         list_for_each(p, &priv->ibss_mac_hash[index]) {
                                 entry =
                                     list_entry(p, struct ipw_ibss_seq, list);
-                                if (!memcmp(entry->mac, mac, ETH_ALEN))
+                                if (ether_addr_equal(entry->mac, mac))
                                         break;
                         }
                         if (p == &priv->ibss_mac_hash[index]) {
@@ -8329,7 +8329,7 @@ static void ipw_handle_mgmt_packet(struct ipw_priv *priv,
               IEEE80211_STYPE_PROBE_RESP) ||
              (WLAN_FC_GET_STYPE(le16_to_cpu(header->frame_ctl)) ==
               IEEE80211_STYPE_BEACON))) {
-                if (!memcmp(header->addr3, priv->bssid, ETH_ALEN))
+                if (ether_addr_equal(header->addr3, priv->bssid))
                         ipw_add_station(priv, header->addr2);
         }
 
@@ -9045,7 +9045,7 @@ static int ipw_wx_set_wap(struct net_device *dev,
         }
 
         priv->config |= CFG_STATIC_BSSID;
-        if (!memcmp(priv->bssid, wrqu->ap_addr.sa_data, ETH_ALEN)) {
+        if (ether_addr_equal(priv->bssid, wrqu->ap_addr.sa_data)) {
                 IPW_DEBUG_WX("BSSID set to current BSSID.\n");
                 mutex_unlock(&priv->mutex);
                 return 0;
@@ -11472,10 +11472,10 @@ static int ipw_wdev_init(struct net_device *dev)
                         bg_band->channels[i].max_power = geo->bg[i].max_power;
                         if (geo->bg[i].flags & LIBIPW_CH_PASSIVE_ONLY)
                                 bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->bg[i].flags & LIBIPW_CH_NO_IBSS)
                                 bg_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->bg[i].flags & LIBIPW_CH_RADAR_DETECT)
                                 bg_band->channels[i].flags |=
                                         IEEE80211_CHAN_RADAR;
@@ -11511,10 +11511,10 @@ static int ipw_wdev_init(struct net_device *dev)
                         a_band->channels[i].max_power = geo->a[i].max_power;
                         if (geo->a[i].flags & LIBIPW_CH_PASSIVE_ONLY)
                                 a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_PASSIVE_SCAN;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->a[i].flags & LIBIPW_CH_NO_IBSS)
                                 a_band->channels[i].flags |=
-                                        IEEE80211_CHAN_NO_IBSS;
+                                        IEEE80211_CHAN_NO_IR;
                         if (geo->a[i].flags & LIBIPW_CH_RADAR_DETECT)
                                 a_band->channels[i].flags |=
                                         IEEE80211_CHAN_RADAR;
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.h b/drivers/net/wireless/ipw2x00/ipw2200.h
index 570d6fb88967..aa301d1eee3c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.h
+++ b/drivers/net/wireless/ipw2x00/ipw2200.h
@@ -29,7 +29,6 @@
 
 #include <linux/module.h>
 #include <linux/moduleparam.h>
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
 
diff --git a/drivers/net/wireless/ipw2x00/libipw_rx.c b/drivers/net/wireless/ipw2x00/libipw_rx.c
index 9ffe65931b29..a586a85bfcfe 100644
--- a/drivers/net/wireless/ipw2x00/libipw_rx.c
+++ b/drivers/net/wireless/ipw2x00/libipw_rx.c
@@ -874,13 +874,13 @@ void libipw_rx_any(struct libipw_device *ieee,
         switch (ieee->iw_mode) {
         case IW_MODE_ADHOC:
                 /* our BSS and not from/to DS */
-                if (memcmp(hdr->addr3, ieee->bssid, ETH_ALEN) == 0)
+                if (ether_addr_equal(hdr->addr3, ieee->bssid))
                 if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == 0) {
                         /* promisc: get all */
                         if (ieee->dev->flags & IFF_PROMISC)
                                 is_packet_for_us = 1;
                         /* to us */
-                        else if (memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN) == 0)
+                        else if (ether_addr_equal(hdr->addr1, ieee->dev->dev_addr))
                                 is_packet_for_us = 1;
                         /* mcast */
                         else if (is_multicast_ether_addr(hdr->addr1))
@@ -889,18 +889,18 @@ void libipw_rx_any(struct libipw_device *ieee,
                 break;
         case IW_MODE_INFRA:
                 /* our BSS (== from our AP) and from DS */
-                if (memcmp(hdr->addr2, ieee->bssid, ETH_ALEN) == 0)
+                if (ether_addr_equal(hdr->addr2, ieee->bssid))
                 if ((fc & (IEEE80211_FCTL_TODS+IEEE80211_FCTL_FROMDS)) == IEEE80211_FCTL_FROMDS) {
                         /* promisc: get all */
                         if (ieee->dev->flags & IFF_PROMISC)
                                 is_packet_for_us = 1;
                         /* to us */
-                        else if (memcmp(hdr->addr1, ieee->dev->dev_addr, ETH_ALEN) == 0)
+                        else if (ether_addr_equal(hdr->addr1, ieee->dev->dev_addr))
                                 is_packet_for_us = 1;
                         /* mcast */
                         else if (is_multicast_ether_addr(hdr->addr1)) {
                                 /* not our own packet bcasted from AP */
-                                if (memcmp(hdr->addr3, ieee->dev->dev_addr, ETH_ALEN))
+                                if (!ether_addr_equal(hdr->addr3, ieee->dev->dev_addr))
                                         is_packet_for_us = 1;
                         }
                 }
@@ -1468,7 +1468,7 @@ static inline int is_same_network(struct libipw_network *src,
          * as one network */
         return ((src->ssid_len == dst->ssid_len) &&
                 (src->channel == dst->channel) &&
-                ether_addr_equal(src->bssid, dst->bssid) &&
+                ether_addr_equal_64bits(src->bssid, dst->bssid) &&
                 !memcmp(src->ssid, dst->ssid, src->ssid_len));
 }
 
diff --git a/drivers/net/wireless/iwlegacy/3945-debug.c b/drivers/net/wireless/iwlegacy/3945-debug.c
index f767dd106b09..c1b4441fb8b2 100644
--- a/drivers/net/wireless/iwlegacy/3945-debug.c
+++ b/drivers/net/wireless/iwlegacy/3945-debug.c
@@ -48,7 +48,7 @@ il3945_stats_flag(struct il_priv *il, char *buf, int bufsz)
         return p;
 }
 
-ssize_t
+static ssize_t
 il3945_ucode_rx_stats_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -313,7 +313,7 @@ il3945_ucode_rx_stats_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-ssize_t
+static ssize_t
 il3945_ucode_tx_stats_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -403,7 +403,7 @@ il3945_ucode_tx_stats_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-ssize_t
+static ssize_t
 il3945_ucode_general_stats_read(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index dea3b50d68b9..0487461ae4da 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -1595,7 +1595,7 @@ il3945_get_channels_for_scan(struct il_priv *il, enum ieee80211_band band,
                  *  and use long active_dwell time.
                  */
                 if (!is_active || il_is_channel_passive(ch_info) ||
-                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
+                    (chan->flags & IEEE80211_CHAN_NO_IR)) {
                         scan_ch->type = 0;      /* passive */
                         if (IL_UCODE_API(il->ucode_ver) == 1)
                                 scan_ch->active_dwell =
@@ -2396,8 +2396,7 @@ __il3945_up(struct il_priv *il)
                 clear_bit(S_RFKILL, &il->status);
         else {
                 set_bit(S_RFKILL, &il->status);
-                IL_WARN("Radio disabled by HW RF Kill switch\n");
-                return -ENODEV;
+                return -ERFKILL;
         }
 
         _il_wr(il, CSR_INT, 0xFFFFFFFF);
@@ -3575,9 +3574,9 @@ il3945_setup_mac(struct il_priv *il)
         hw->wiphy->interface_modes =
             BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
 
-        hw->wiphy->flags |=
-            WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS |
-            WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
+                                       REGULATORY_DISABLE_BEACON_HINTS;
 
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
diff --git a/drivers/net/wireless/iwlegacy/3945-rs.c b/drivers/net/wireless/iwlegacy/3945-rs.c
index aea667b430c3..9a45f6f626f6 100644
--- a/drivers/net/wireless/iwlegacy/3945-rs.c
+++ b/drivers/net/wireless/iwlegacy/3945-rs.c
@@ -25,7 +25,6 @@
  *****************************************************************************/
 
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index f09e257759d5..d37a6fd90d40 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -26,7 +26,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
@@ -466,10 +465,10 @@ il3945_is_network_packet(struct il_priv *il, struct ieee80211_hdr *header)
         switch (il->iw_mode) {
         case NL80211_IFTYPE_ADHOC:      /* Header: Dest. | Source    | BSSID */
                 /* packets to our IBSS update information */
-                return ether_addr_equal(header->addr3, il->bssid);
+                return ether_addr_equal_64bits(header->addr3, il->bssid);
         case NL80211_IFTYPE_STATION:    /* Header: Dest. | AP{BSSID} | Source */
                 /* packets to our IBSS update information */
-                return ether_addr_equal(header->addr2, il->bssid);
+                return ether_addr_equal_64bits(header->addr2, il->bssid);
         default:
                 return 1;
         }
diff --git a/drivers/net/wireless/iwlegacy/4965-debug.c b/drivers/net/wireless/iwlegacy/4965-debug.c
index c8153fc64f74..e0597bfdddb8 100644
--- a/drivers/net/wireless/iwlegacy/4965-debug.c
+++ b/drivers/net/wireless/iwlegacy/4965-debug.c
@@ -55,7 +55,7 @@ il4965_stats_flag(struct il_priv *il, char *buf, int bufsz)
         return p;
 }
 
-ssize_t
+static ssize_t
 il4965_ucode_rx_stats_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -467,7 +467,7 @@ il4965_ucode_rx_stats_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-ssize_t
+static ssize_t
 il4965_ucode_tx_stats_read(struct file *file, char __user *user_buf,
                            size_t count, loff_t *ppos)
 {
@@ -633,7 +633,7 @@ il4965_ucode_tx_stats_read(struct file *file, char __user *user_buf,
         return ret;
 }
 
-ssize_t
+static ssize_t
 il4965_ucode_general_stats_read(struct file *file, char __user *user_buf,
                                 size_t count, loff_t *ppos)
 {
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 3982ab76f375..43f488a8cda2 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -805,7 +805,7 @@ il4965_get_channels_for_scan(struct il_priv *il, struct ieee80211_vif *vif,
                 }
 
                 if (!is_active || il_is_channel_passive(ch_info) ||
-                    (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                    (chan->flags & IEEE80211_CHAN_NO_IR))
                         scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
                 else
                         scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
@@ -5778,9 +5778,9 @@ il4965_mac_setup_register(struct il_priv *il, u32 max_probe_length)
         hw->wiphy->interface_modes =
             BIT(NL80211_IFTYPE_STATION) | BIT(NL80211_IFTYPE_ADHOC);
 
-        hw->wiphy->flags |=
-            WIPHY_FLAG_CUSTOM_REGULATORY | WIPHY_FLAG_DISABLE_BEACON_HINTS |
-            WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
+                                       REGULATORY_DISABLE_BEACON_HINTS;
 
         /*
          * For now, disable PS by default because it affects
diff --git a/drivers/net/wireless/iwlegacy/4965-rs.c b/drivers/net/wireless/iwlegacy/4965-rs.c
index 3ccbaf791b48..4d5e33259ca8 100644
--- a/drivers/net/wireless/iwlegacy/4965-rs.c
+++ b/drivers/net/wireless/iwlegacy/4965-rs.c
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlegacy/4965.c b/drivers/net/wireless/iwlegacy/4965.c
index 777a578294bd..fe47db9c20cd 100644
--- a/drivers/net/wireless/iwlegacy/4965.c
+++ b/drivers/net/wireless/iwlegacy/4965.c
@@ -26,7 +26,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index b03e22ef5462..02e8233ccf29 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -33,7 +33,6 @@
 #include <linux/slab.h>
 #include <linux/types.h>
 #include <linux/lockdep.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -3445,10 +3444,10 @@ il_init_geos(struct il_priv *il)
 
                 if (il_is_channel_valid(ch)) {
                         if (!(ch->flags & EEPROM_CHANNEL_IBSS))
-                                geo_ch->flags |= IEEE80211_CHAN_NO_IBSS;
+                                geo_ch->flags |= IEEE80211_CHAN_NO_IR;
 
                         if (!(ch->flags & EEPROM_CHANNEL_ACTIVE))
-                                geo_ch->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                                geo_ch->flags |= IEEE80211_CHAN_NO_IR;
 
                         if (ch->flags & EEPROM_CHANNEL_RADAR)
                                 geo_ch->flags |= IEEE80211_CHAN_RADAR;
@@ -3746,10 +3745,10 @@ il_full_rxon_required(struct il_priv *il)
 
         /* These items are only settable from the full RXON command */
         CHK(!il_is_associated(il));
-        CHK(!ether_addr_equal(staging->bssid_addr, active->bssid_addr));
-        CHK(!ether_addr_equal(staging->node_addr, active->node_addr));
-        CHK(!ether_addr_equal(staging->wlap_bssid_addr,
-                              active->wlap_bssid_addr));
+        CHK(!ether_addr_equal_64bits(staging->bssid_addr, active->bssid_addr));
+        CHK(!ether_addr_equal_64bits(staging->node_addr, active->node_addr));
+        CHK(!ether_addr_equal_64bits(staging->wlap_bssid_addr,
+                                     active->wlap_bssid_addr));
         CHK_NEQ(staging->dev_type, active->dev_type);
         CHK_NEQ(staging->channel, active->channel);
         CHK_NEQ(staging->air_propagation, active->air_propagation);
diff --git a/drivers/net/wireless/iwlegacy/debug.c b/drivers/net/wireless/iwlegacy/debug.c
index eff26501d60a..344010153196 100644
--- a/drivers/net/wireless/iwlegacy/debug.c
+++ b/drivers/net/wireless/iwlegacy/debug.c
@@ -31,7 +31,7 @@
 
 #include "common.h"
 
-void
+static void
 il_clear_traffic_stats(struct il_priv *il)
 {
         memset(&il->tx_stats, 0, sizeof(struct traffic_stats));
@@ -567,12 +567,12 @@ il_dbgfs_channels_read(struct file *file, char __user *user_buf, size_t count,
                                       flags & IEEE80211_CHAN_RADAR ?
                                       " (IEEE 802.11h required)" : "",
                                       ((channels[i].
-                                        flags & IEEE80211_CHAN_NO_IBSS) ||
+                                        flags & IEEE80211_CHAN_NO_IR) ||
                                        (channels[i].
                                         flags & IEEE80211_CHAN_RADAR)) ? "" :
                                       ", IBSS",
                                       channels[i].
-                                      flags & IEEE80211_CHAN_PASSIVE_SCAN ?
+                                      flags & IEEE80211_CHAN_NO_IR ?
                                       "passive only" : "active/passive");
         }
         supp_band = il_get_hw_mode(il, IEEE80211_BAND_5GHZ);
@@ -594,12 +594,12 @@ il_dbgfs_channels_read(struct file *file, char __user *user_buf, size_t count,
                                       flags & IEEE80211_CHAN_RADAR ?
                                       " (IEEE 802.11h required)" : "",
                                       ((channels[i].
-                                        flags & IEEE80211_CHAN_NO_IBSS) ||
+                                        flags & IEEE80211_CHAN_NO_IR) ||
                                        (channels[i].
                                         flags & IEEE80211_CHAN_RADAR)) ? "" :
                                       ", IBSS",
                                       channels[i].
-                                      flags & IEEE80211_CHAN_PASSIVE_SCAN ?
+                                      flags & IEEE80211_CHAN_NO_IR ?
                                       "passive only" : "active/passive");
         }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
diff --git a/drivers/net/wireless/iwlwifi/dvm/agn.h b/drivers/net/wireless/iwlwifi/dvm/agn.h
index 23d5f0275ce9..562772d85102 100644
--- a/drivers/net/wireless/iwlwifi/dvm/agn.h
+++ b/drivers/net/wireless/iwlwifi/dvm/agn.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.c b/drivers/net/wireless/iwlwifi/dvm/calib.c
index 1b0f0d502568..be1086c87157 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/calib.h b/drivers/net/wireless/iwlwifi/dvm/calib.h
index cfddde194940..aeae4e80ea40 100644
--- a/drivers/net/wireless/iwlwifi/dvm/calib.h
+++ b/drivers/net/wireless/iwlwifi/dvm/calib.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/commands.h b/drivers/net/wireless/iwlwifi/dvm/commands.h
index ebdac909f0cd..751ae1d10b7f 100644
--- a/drivers/net/wireless/iwlwifi/dvm/commands.h
+++ b/drivers/net/wireless/iwlwifi/dvm/commands.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
index d94f8ab15004..d2fe2596d54e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -352,12 +352,12 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                                         channels[i].max_power,
                                         channels[i].flags & IEEE80211_CHAN_RADAR ?
                                         " (IEEE 802.11h required)" : "",
-                                        ((channels[i].flags & IEEE80211_CHAN_NO_IBSS)
+                                        ((channels[i].flags & IEEE80211_CHAN_NO_IR)
                                         || (channels[i].flags &
                                         IEEE80211_CHAN_RADAR)) ? "" :
                                         ", IBSS",
                                         channels[i].flags &
-                                        IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        IEEE80211_CHAN_NO_IR ?
                                         "passive only" : "active/passive");
         }
         supp_band = iwl_get_hw_mode(priv, IEEE80211_BAND_5GHZ);
@@ -375,12 +375,12 @@ static ssize_t iwl_dbgfs_channels_read(struct file *file, char __user *user_buf,
                                         channels[i].max_power,
                                         channels[i].flags & IEEE80211_CHAN_RADAR ?
                                         " (IEEE 802.11h required)" : "",
-                                        ((channels[i].flags & IEEE80211_CHAN_NO_IBSS)
+                                        ((channels[i].flags & IEEE80211_CHAN_NO_IR)
                                         || (channels[i].flags &
                                         IEEE80211_CHAN_RADAR)) ? "" :
                                         ", IBSS",
                                         channels[i].flags &
-                                        IEEE80211_CHAN_PASSIVE_SCAN ?
+                                        IEEE80211_CHAN_NO_IR ?
                                         "passive only" : "active/passive");
         }
         ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
index 7434d9edf3b7..3441f70d0ff9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/dev.h
+++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c
index 352c6cb7b4f1..7b140e487deb 100644
--- a/drivers/net/wireless/iwlwifi/dvm/devices.c
+++ b/drivers/net/wireless/iwlwifi/dvm/devices.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.c b/drivers/net/wireless/iwlwifi/dvm/led.c
index 33c7e15d24f5..ca4d6692cc4e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.c
+++ b/drivers/net/wireless/iwlwifi/dvm/led.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -27,7 +27,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/netdevice.h>
diff --git a/drivers/net/wireless/iwlwifi/dvm/led.h b/drivers/net/wireless/iwlwifi/dvm/led.h
index 8749dcfe695f..6a0817d9c4fa 100644
--- a/drivers/net/wireless/iwlwifi/dvm/led.h
+++ b/drivers/net/wireless/iwlwifi/dvm/led.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/lib.c b/drivers/net/wireless/iwlwifi/dvm/lib.c
index 3d5bdc4217a8..576f7ee38ca5 100644
--- a/drivers/net/wireless/iwlwifi/dvm/lib.c
+++ b/drivers/net/wireless/iwlwifi/dvm/lib.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,6 @@
 #include <linux/etherdevice.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/sched.h>
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
index cae4d3182e33..c24d1d3d55f6 100644
--- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -28,7 +28,6 @@
  *****************************************************************************/
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
@@ -155,9 +154,9 @@ int iwlagn_mac_setup_register(struct iwl_priv *priv,
                         ARRAY_SIZE(iwlagn_iface_combinations_dualmode);
         }
 
-        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
-                            WIPHY_FLAG_DISABLE_BEACON_HINTS |
-                            WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
+                                       REGULATORY_DISABLE_BEACON_HINTS;
 
 #ifdef CONFIG_PM_SLEEP
         if (priv->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
@@ -322,12 +321,6 @@ static void iwlagn_mac_stop(struct ieee80211_hw *hw)
 
         flush_workqueue(priv->workqueue);
 
-        /* User space software may expect getting rfkill changes
-         * even if interface is down, trans->down will leave the RF
-         * kill interrupt enabled
-         */
-        iwl_trans_stop_hw(priv->trans, false);
-
         IWL_DEBUG_MAC80211(priv, "leave\n");
 }
 
@@ -413,9 +406,8 @@ static bool iwl_resume_status_fn(struct iwl_notif_wait_data *notif_wait,
 {
         struct iwl_resume_data *resume_data = data;
         struct iwl_priv *priv = resume_data->priv;
-        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 
-        if (len - 4 != sizeof(*resume_data->cmd)) {
+        if (iwl_rx_packet_payload_len(pkt) != sizeof(*resume_data->cmd)) {
                 IWL_ERR(priv, "rx wrong size data\n");
                 return true;
         }
diff --git a/drivers/net/wireless/iwlwifi/dvm/main.c b/drivers/net/wireless/iwlwifi/dvm/main.c
index 7aad766865cf..ba1b1ea54252 100644
--- a/drivers/net/wireless/iwlwifi/dvm/main.c
+++ b/drivers/net/wireless/iwlwifi/dvm/main.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -1313,7 +1313,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         }
 
         /* Reset chip to save power until we load uCode during "up". */
-        iwl_trans_stop_hw(priv->trans, false);
+        iwl_trans_stop_device(priv->trans);
 
         priv->nvm_data = iwl_parse_eeprom_data(priv->trans->dev, priv->cfg,
                                                   priv->eeprom_blob,
@@ -1458,7 +1458,7 @@ static void iwl_op_mode_dvm_stop(struct iwl_op_mode *op_mode)
 
         dev_kfree_skb(priv->beacon_skb);
 
-        iwl_trans_stop_hw(priv->trans, true);
+        iwl_trans_op_mode_leave(priv->trans);
         ieee80211_free_hw(priv->hw);
 }
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.c b/drivers/net/wireless/iwlwifi/dvm/power.c
index 77cb59712235..b4e61417013a 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.c
+++ b/drivers/net/wireless/iwlwifi/dvm/power.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -30,7 +30,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 #include <net/mac80211.h>
 #include "iwl-io.h"
 #include "iwl-debug.h"
diff --git a/drivers/net/wireless/iwlwifi/dvm/power.h b/drivers/net/wireless/iwlwifi/dvm/power.h
index 7b03e1342d47..570d3a5e4670 100644
--- a/drivers/net/wireless/iwlwifi/dvm/power.h
+++ b/drivers/net/wireless/iwlwifi/dvm/power.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.c b/drivers/net/wireless/iwlwifi/dvm/rs.c
index b647e506564c..0977d93b529d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/iwlwifi/dvm/rs.h b/drivers/net/wireless/iwlwifi/dvm/rs.h
index 26fc550cd68c..bdd5644a400b 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/dvm/rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -389,13 +389,6 @@ struct iwl_lq_sta {
         u8 last_bt_traffic;
 };
 
-static inline u8 num_of_ant(u8 mask)
-{
-        return  !!((mask) & ANT_A) +
-                !!((mask) & ANT_B) +
-                !!((mask) & ANT_C);
-}
-
 static inline u8 first_antenna(u8 mask)
 {
         if (mask & ANT_A)
diff --git a/drivers/net/wireless/iwlwifi/dvm/rx.c b/drivers/net/wireless/iwlwifi/dvm/rx.c
index d71776dd1e6a..7a1bc1c547e1 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portionhelp of the ieee80211 subsystem header files.
@@ -205,8 +205,7 @@ static int iwlagn_rx_pm_debug_statistics_notif(struct iwl_priv *priv,
                                              struct iwl_device_cmd *cmd)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u32 __maybe_unused len =
-                le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        u32 __maybe_unused len = iwl_rx_packet_len(pkt);
         IWL_DEBUG_RADIO(priv, "Dumping %d bytes of unhandled "
                         "notification for PM_DEBUG_STATISTIC_NOTIFIC:\n", len);
         iwl_print_hex_dump(priv, IWL_DL_RADIO, pkt->data, len);
@@ -457,7 +456,7 @@ static int iwlagn_rx_statistics(struct iwl_priv *priv,
         const int reg_recalib_period = 60;
         int change;
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        u32 len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        u32 len = iwl_rx_packet_payload_len(pkt);
         __le32 *flag;
         struct statistics_general_common *common;
         struct statistics_rx_non_phy *rx_non_phy;
@@ -467,8 +466,6 @@ static int iwlagn_rx_statistics(struct iwl_priv *priv,
         struct statistics_tx *tx;
         struct statistics_bt_activity *bt_activity;
 
-        len -= sizeof(struct iwl_cmd_header); /* skip header */
-
         IWL_DEBUG_RX(priv, "Statistics notification received (%d bytes).\n",
                      len);
 
diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c
index d7ce2f12a907..503a81e58185 100644
--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c
+++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/dvm/scan.c b/drivers/net/wireless/iwlwifi/dvm/scan.c
index 35e0ee8b4e5b..be98b913ed58 100644
--- a/drivers/net/wireless/iwlwifi/dvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/dvm/scan.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -544,7 +544,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                 channel = chan->hw_value;
                 scan_ch->channel = cpu_to_le16(channel);
 
-                if (!is_active || (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                if (!is_active || (chan->flags & IEEE80211_CHAN_NO_IR))
                         scan_ch->type = SCAN_CHANNEL_TYPE_PASSIVE;
                 else
                         scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
diff --git a/drivers/net/wireless/iwlwifi/dvm/sta.c b/drivers/net/wireless/iwlwifi/dvm/sta.c
index c3c13ce96eb0..c0d070c5df5e 100644
--- a/drivers/net/wireless/iwlwifi/dvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/dvm/sta.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.c b/drivers/net/wireless/iwlwifi/dvm/tt.c
index fbeee081ee2f..058c5892c427 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -30,7 +30,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 #include <net/mac80211.h>
 #include "iwl-io.h"
 #include "iwl-modparams.h"
diff --git a/drivers/net/wireless/iwlwifi/dvm/tt.h b/drivers/net/wireless/iwlwifi/dvm/tt.h
index 9356c4b908ca..507726534b84 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tt.h
+++ b/drivers/net/wireless/iwlwifi/dvm/tt.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index 1fef5240e6ad..a6839dfcb82d 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -29,7 +29,6 @@
 
 #include <linux/kernel.h>
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/ieee80211.h>
 #include "iwl-io.h"
@@ -368,6 +367,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
                 goto drop_unlock_priv;
 
         memset(dev_cmd, 0, sizeof(*dev_cmd));
+        dev_cmd->hdr.cmd = REPLY_TX;
         tx_cmd = (struct iwl_tx_cmd *) dev_cmd->payload;
 
         /* Total # bytes to be transmitted */
diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
index 63637949a146..cf03ef5619d9 100644
--- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
+++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
@@ -2,7 +2,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -28,7 +28,6 @@
  *****************************************************************************/
 
 #include <linux/kernel.h>
-#include <linux/init.h>
 
 #include "iwl-io.h"
 #include "iwl-agn-hw.h"
@@ -389,7 +388,6 @@ static bool iwlagn_wait_calib(struct iwl_notif_wait_data *notif_wait,
 {
         struct iwl_priv *priv = data;
         struct iwl_calib_hdr *hdr;
-        int len;
 
         if (pkt->hdr.cmd != CALIBRATION_RES_NOTIFICATION) {
                 WARN_ON(pkt->hdr.cmd != CALIBRATION_COMPLETE_NOTIFICATION);
@@ -397,12 +395,8 @@ static bool iwlagn_wait_calib(struct iwl_notif_wait_data *notif_wait,
         }
 
         hdr = (struct iwl_calib_hdr *)pkt->data;
-        len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
 
-        /* reduce the size by the length field itself */
-        len -= sizeof(__le32);
-
-        if (iwl_calib_set(priv, hdr, len))
+        if (iwl_calib_set(priv, hdr, iwl_rx_packet_payload_len(pkt)))
                 IWL_ERR(priv, "Failed to record calibration data %d\n",
                         hdr->op_code);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 0d2afe098afc..854ba84ccb73 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-2000.c b/drivers/net/wireless/iwlwifi/iwl-2000.c
index c727ec7c90a6..3e63323637f3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-2000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-2000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index ecc01e1a61a1..6674f2c4541c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index 8ac305be68f4..8048de90233f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
index 3c34a72a5d64..2a59da2ff87a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -108,7 +108,7 @@ static const struct iwl_base_params iwl7000_base_params = {
 };
 
 static const struct iwl_ht_params iwl7000_ht_params = {
-        .use_rts_for_aggregation = true, /* use rts/cts protection */
+        .stbc = true,
         .ht40_bands = BIT(IEEE80211_BAND_2GHZ) | BIT(IEEE80211_BAND_5GHZ),
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
index 6d73f943cefa..7f37fb86837b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-hw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-config.h b/drivers/net/wireless/iwlwifi/iwl-config.h
index 03fd9aa8bfda..1ced525157dc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-config.h
+++ b/drivers/net/wireless/iwlwifi/iwl-config.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -129,6 +129,12 @@ enum iwl_led_mode {
 #define ANT_BC          (ANT_B | ANT_C)
 #define ANT_ABC         (ANT_A | ANT_B | ANT_C)
 
+static inline u8 num_of_ant(u8 mask)
+{
+        return  !!((mask) & ANT_A) +
+                !!((mask) & ANT_B) +
+                !!((mask) & ANT_C);
+}
 
 /*
  * @max_ll_items: max number of OTP blocks
@@ -156,12 +162,14 @@ struct iwl_base_params {
 };
 
 /*
+ * @stbc: support Tx STBC and 1*SS Rx STBC
  * @use_rts_for_aggregation: use rts/cts protection for HT traffic
  * @ht40_bands: bitmap of bands (using %IEEE80211_BAND_*) that support HT40
  */
 struct iwl_ht_params {
         enum ieee80211_smps_mode smps_mode;
         const bool ht_greenfield_support; /* if used set to true */
+        const bool stbc;
         bool use_rts_for_aggregation;
         u8 ht40_bands;
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
index da4eca8b3007..9d325516c42d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-csr.h
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -198,7 +198,8 @@
                                  CSR_INT_BIT_RF_KILL | \
                                  CSR_INT_BIT_SW_RX   | \
                                  CSR_INT_BIT_WAKEUP  | \
-                                 CSR_INT_BIT_ALIVE)
+                                 CSR_INT_BIT_ALIVE   | \
+                                 CSR_INT_BIT_RX_PERIODIC)
 
 /* interrupt flags in FH (flow handler) (PCI busmaster DMA) */
 #define CSR_FH_INT_BIT_ERR       (1 << 31) /* Error */
diff --git a/drivers/net/wireless/iwlwifi/iwl-debug.h b/drivers/net/wireless/iwlwifi/iwl-debug.h
index b2bb32a781dd..a75aac986a23 100644
--- a/drivers/net/wireless/iwlwifi/iwl-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-debug.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.c b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
index 8f61c717f619..23e7351e02de 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.c
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2009 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2009 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-devtrace.h b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
index 684c416d3493..78bd41bf34b0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-devtrace.h
+++ b/drivers/net/wireless/iwlwifi/iwl-devtrace.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2009 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2009 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index ff570027e9dd..c3728163be46 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -322,6 +322,41 @@ static void set_sec_offset(struct iwl_firmware_pieces *pieces,
         pieces->img[type].sec[sec].offset = offset;
 }
 
+static int iwl_store_cscheme(struct iwl_fw *fw, const u8 *data, const u32 len)
+{
+        int i, j;
+        struct iwl_fw_cscheme_list *l = (struct iwl_fw_cscheme_list *)data;
+        struct iwl_fw_cipher_scheme *fwcs;
+        struct ieee80211_cipher_scheme *cs;
+        u32 cipher;
+
+        if (len < sizeof(*l) ||
+            len < sizeof(l->size) + l->size * sizeof(l->cs[0]))
+                return -EINVAL;
+
+        for (i = 0, j = 0; i < IWL_UCODE_MAX_CS && i < l->size; i++) {
+                fwcs = &l->cs[j];
+                cipher = le32_to_cpu(fwcs->cipher);
+
+                /* we skip schemes with zero cipher suite selector */
+                if (!cipher)
+                        continue;
+
+                cs = &fw->cs[j++];
+                cs->cipher = cipher;
+                cs->iftype = BIT(NL80211_IFTYPE_STATION);
+                cs->hdr_len = fwcs->hdr_len;
+                cs->pn_len = fwcs->pn_len;
+                cs->pn_off = fwcs->pn_off;
+                cs->key_idx_off = fwcs->key_idx_off;
+                cs->key_idx_mask = fwcs->key_idx_mask;
+                cs->key_idx_shift = fwcs->key_idx_shift;
+                cs->mic_len = fwcs->mic_len;
+        }
+
+        return 0;
+}
+
 /*
  * Gets uCode section from tlv.
  */
@@ -729,6 +764,10 @@ static int iwl_parse_tlv_firmware(struct iwl_drv *drv,
                                 return -EINVAL;
                         }
                         break;
+                case IWL_UCODE_TLV_CSCHEME:
+                        if (iwl_store_cscheme(&drv->fw, tlv_data, tlv_len))
+                                goto invalid_tlv_len;
+                        break;
                 default:
                         IWL_DEBUG_INFO(drv, "unknown TLV: %d\n", tlv_type);
                         break;
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.h b/drivers/net/wireless/iwlwifi/iwl-drv.h
index 429337a2b9a1..592c01e11013 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.h
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -67,7 +67,7 @@
 /* for all modules */
 #define DRV_NAME        "iwlwifi"
 #define IWLWIFI_VERSION "in-tree:"
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2013 Intel Corporation"
+#define DRV_COPYRIGHT   "Copyright(c) 2003- 2014 Intel Corporation"
 #define DRV_AUTHOR     "<ilw@linux.intel.com>"
 
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
index 4c887f365908..c44cf1149648 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -614,10 +614,10 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                         channel->flags = IEEE80211_CHAN_NO_HT40;
 
                         if (!(eeprom_ch->flags & EEPROM_CHANNEL_IBSS))
-                                channel->flags |= IEEE80211_CHAN_NO_IBSS;
+                                channel->flags |= IEEE80211_CHAN_NO_IR;
 
                         if (!(eeprom_ch->flags & EEPROM_CHANNEL_ACTIVE))
-                                channel->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                                channel->flags |= IEEE80211_CHAN_NO_IR;
 
                         if (eeprom_ch->flags & EEPROM_CHANNEL_RADAR)
                                 channel->flags |= IEEE80211_CHAN_RADAR;
@@ -751,6 +751,13 @@ void iwl_init_ht_hw_capab(const struct iwl_cfg *cfg,
         ht_info->ht_supported = true;
         ht_info->cap = IEEE80211_HT_CAP_DSSSCCK40;
 
+        if (cfg->ht_params->stbc) {
+                ht_info->cap |= (1 << IEEE80211_HT_CAP_RX_STBC_SHIFT);
+
+                if (tx_chains > 1)
+                        ht_info->cap |= IEEE80211_HT_CAP_TX_STBC;
+        }
+
         if (iwlwifi_mod_params.amsdu_size_8K)
                 ht_info->cap |= IEEE80211_HT_CAP_MAX_AMSDU;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
index d73304a23ec2..e3c7deafabe6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-parse.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
index e5f2e362ab0b..25d0105741db 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
index 8e941f8bd7d6..a6d3bdf82cdd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom-read.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fh.h b/drivers/net/wireless/iwlwifi/iwl-fh.h
index 484d318245fb..9564ae173d06 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fh.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fh.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw-file.h b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
index 6c6c35c5228c..88e2d6eb569f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw-file.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw-file.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -125,6 +125,7 @@ enum iwl_ucode_tlv_type {
         IWL_UCODE_TLV_SECURE_SEC_INIT   = 25,
         IWL_UCODE_TLV_SECURE_SEC_WOWLAN = 26,
         IWL_UCODE_TLV_NUM_OF_CPU        = 27,
+        IWL_UCODE_TLV_CSCHEME           = 28,
 };
 
 struct iwl_ucode_tlv {
diff --git a/drivers/net/wireless/iwlwifi/iwl-fw.h b/drivers/net/wireless/iwlwifi/iwl-fw.h
index 75db087120c3..5f1493c44097 100644
--- a/drivers/net/wireless/iwlwifi/iwl-fw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-fw.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -92,6 +92,9 @@
  * @IWL_UCODE_TLV_FLAGS_STA_KEY_CMD: new ADD_STA and ADD_STA_KEY command API
  * @IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD: support device wide power command
  *      containing CAM (Continuous Active Mode) indication.
+ * @IWL_UCODE_TLV_FLAGS_P2P_PS: P2P client power save is supported (only on a
+ *      single bound interface).
+ * @IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD: P2P client supports uAPSD power save
  */
 enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_PAN                 = BIT(0),
@@ -113,7 +116,9 @@ enum iwl_ucode_tlv_flag {
         IWL_UCODE_TLV_FLAGS_SCHED_SCAN          = BIT(17),
         IWL_UCODE_TLV_FLAGS_STA_KEY_CMD         = BIT(19),
         IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD       = BIT(20),
+        IWL_UCODE_TLV_FLAGS_P2P_PS              = BIT(21),
         IWL_UCODE_TLV_FLAGS_UAPSD_SUPPORT       = BIT(24),
+        IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD        = BIT(26),
 };
 
 /* The default calibrate table size if not specified by firmware file */
@@ -209,6 +214,44 @@ enum iwl_fw_phy_cfg {
         FW_PHY_CFG_RX_CHAIN = 0xf << FW_PHY_CFG_RX_CHAIN_POS,
 };
 
+#define IWL_UCODE_MAX_CS                1
+
+/**
+ * struct iwl_fw_cipher_scheme - a cipher scheme supported by FW.
+ * @cipher: a cipher suite selector
+ * @flags: cipher scheme flags (currently reserved for a future use)
+ * @hdr_len: a size of MPDU security header
+ * @pn_len: a size of PN
+ * @pn_off: an offset of pn from the beginning of the security header
+ * @key_idx_off: an offset of key index byte in the security header
+ * @key_idx_mask: a bit mask of key_idx bits
+ * @key_idx_shift: bit shift needed to get key_idx
+ * @mic_len: mic length in bytes
+ * @hw_cipher: a HW cipher index used in host commands
+ */
+struct iwl_fw_cipher_scheme {
+        __le32 cipher;
+        u8 flags;
+        u8 hdr_len;
+        u8 pn_len;
+        u8 pn_off;
+        u8 key_idx_off;
+        u8 key_idx_mask;
+        u8 key_idx_shift;
+        u8 mic_len;
+        u8 hw_cipher;
+} __packed;
+
+/**
+ * struct iwl_fw_cscheme_list - a cipher scheme list
+ * @size: a number of entries
+ * @cs: cipher scheme entries
+ */
+struct iwl_fw_cscheme_list {
+        u8 size;
+        struct iwl_fw_cipher_scheme cs[];
+} __packed;
+
 /**
  * struct iwl_fw - variables associated with the firmware
  *
@@ -224,6 +267,7 @@ enum iwl_fw_phy_cfg {
  * @inst_evtlog_size: event log size for runtime ucode.
  * @inst_errlog_ptr: error log offfset for runtime ucode.
  * @mvm_fw: indicates this is MVM firmware
+ * @cipher_scheme: optional external cipher scheme.
  */
 struct iwl_fw {
         u32 ucode_ver;
@@ -243,6 +287,8 @@ struct iwl_fw {
         u32 phy_config;
 
         bool mvm_fw;
+
+        struct ieee80211_cipher_scheme cs[IWL_UCODE_MAX_CS];
 };
 
 static inline u8 iwl_fw_valid_tx_ant(const struct iwl_fw *fw)
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.c b/drivers/net/wireless/iwlwifi/iwl-io.c
index ad8e19a56eca..f98175a0d35b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.c
+++ b/drivers/net/wireless/iwlwifi/iwl-io.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-io.h b/drivers/net/wireless/iwlwifi/iwl-io.h
index 63d10ec08dbc..c339c1bed080 100644
--- a/drivers/net/wireless/iwlwifi/iwl-io.h
+++ b/drivers/net/wireless/iwlwifi/iwl-io.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project.
  *
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index a1f580c0c6c6..0a84ade7edac 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
index 940b8a9d5285..b5bc959b1dfe 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
index 2e2f1c8c99f9..95af97a6c2cf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
+++ b/drivers/net/wireless/iwlwifi/iwl-notif-wait.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
index b76a9a8fc0b3..f06f4cbe1317 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -223,10 +223,10 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg,
                         channel->flags |= IEEE80211_CHAN_NO_160MHZ;
 
                 if (!(ch_flags & NVM_CHANNEL_IBSS))
-                        channel->flags |= IEEE80211_CHAN_NO_IBSS;
+                        channel->flags |= IEEE80211_CHAN_NO_IR;
 
                 if (!(ch_flags & NVM_CHANNEL_ACTIVE))
-                        channel->flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                        channel->flags |= IEEE80211_CHAN_NO_IR;
 
                 if (ch_flags & NVM_CHANNEL_RADAR)
                         channel->flags |= IEEE80211_CHAN_RADAR;
@@ -263,13 +263,19 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                                   struct iwl_nvm_data *data,
                                   struct ieee80211_sta_vht_cap *vht_cap)
 {
+        int num_ants = num_of_ant(data->valid_rx_ant);
+
         vht_cap->vht_supported = true;
 
         vht_cap->cap = IEEE80211_VHT_CAP_SHORT_GI_80 |
                        IEEE80211_VHT_CAP_RXSTBC_1 |
                        IEEE80211_VHT_CAP_SU_BEAMFORMEE_CAPABLE |
+                       3 << IEEE80211_VHT_CAP_BEAMFORMEE_STS_SHIFT |
                        7 << IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_SHIFT;
 
+        if (num_ants > 1)
+                vht_cap->cap |= IEEE80211_VHT_CAP_TXSTBC;
+
         if (iwlwifi_mod_params.amsdu_size_8K)
                 vht_cap->cap |= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991;
 
@@ -283,7 +289,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg,
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 12 |
                             IEEE80211_VHT_MCS_NOT_SUPPORTED << 14);
 
-        if (data->valid_rx_ant == 1 || cfg->rx_with_siso_diversity) {
+        if (num_ants == 1 ||
+            cfg->rx_with_siso_diversity) {
                 vht_cap->cap |= IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
                                 IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
                 /* this works because NOT_SUPPORTED == 3 */
diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
index 3325059c52d4..0c4399aba8c6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2008 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-op-mode.h b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
index 976448a57d02..b5be51f3cd3d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-op-mode.h
+++ b/drivers/net/wireless/iwlwifi/iwl-op-mode.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -155,14 +155,12 @@ void iwl_opmode_deregister(const char *name);
 
 /**
  * struct iwl_op_mode - operational mode
+ * @ops - pointer to its own ops
  *
  * This holds an implementation of the mac80211 / fw API.
- *
- * @ops - pointer to its own ops
  */
 struct iwl_op_mode {
         const struct iwl_op_mode_ops *ops;
-        const struct iwl_trans *trans;
 
         char op_mode_specific[0] __aligned(sizeof(void *));
 };
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.c b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
index 1a405ae6a9c5..fa77d63a277a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.c
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-phy-db.h b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
index ce983af79644..9ee18d0d2d01 100644
--- a/drivers/net/wireless/iwlwifi/iwl-phy-db.h
+++ b/drivers/net/wireless/iwlwifi/iwl-phy-db.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/iwl-prph.h b/drivers/net/wireless/iwlwifi/iwl-prph.h
index a70c7b9d9bad..100bd0d79681 100644
--- a/drivers/net/wireless/iwlwifi/iwl-prph.h
+++ b/drivers/net/wireless/iwlwifi/iwl-prph.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -102,6 +102,9 @@
 /* Device system time */
 #define DEVICE_SYSTEM_TIME_REG 0xA0206C
 
+/* Device NMI register */
+#define DEVICE_SET_NMI_REG 0x00a01c30
+
 /*****************************************************************************
  *                        7000/3000 series SHR DTS addresses                 *
  *****************************************************************************/
@@ -274,4 +277,8 @@ static inline unsigned int SCD_QUEUE_STATUS_BITS(unsigned int chnl)
 
 /*********************** END TX SCHEDULER *************************************/
 
+/* Oscillator clock */
+#define OSC_CLK                         (0xa04068)
+#define OSC_CLK_FORCE_CONTROL           (0x8)
+
 #endif                          /* __iwl_prph_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans.h b/drivers/net/wireless/iwlwifi/iwl-trans.h
index 143292b4dbbf..1f065cf4a4ba 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans.h
+++ b/drivers/net/wireless/iwlwifi/iwl-trans.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -70,6 +70,7 @@
 #include "iwl-debug.h"
 #include "iwl-config.h"
 #include "iwl-fw.h"
+#include "iwl-op-mode.h"
 
 /**
  * DOC: Transport layer - what is it ?
@@ -100,8 +101,7 @@
  *         start_fw
  *
  *      5) Then when finished (or reset):
- *         stop_fw (a.k.a. stop device for the moment)
- *         stop_hw
+ *         stop_device
  *
  *      6) Eventually, the free function will be called.
  */
@@ -176,6 +176,16 @@ struct iwl_rx_packet {
         u8 data[];
 } __packed;
 
+static inline u32 iwl_rx_packet_len(const struct iwl_rx_packet *pkt)
+{
+        return le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+}
+
+static inline u32 iwl_rx_packet_payload_len(const struct iwl_rx_packet *pkt)
+{
+        return iwl_rx_packet_len(pkt) - sizeof(pkt->hdr);
+}
+
 /**
  * enum CMD_MODE - how to send the host commands ?
  *
@@ -318,6 +328,24 @@ enum iwl_d3_status {
 };
 
 /**
+ * enum iwl_trans_status: transport status flags
+ * @STATUS_SYNC_HCMD_ACTIVE: a SYNC command is being processed
+ * @STATUS_DEVICE_ENABLED: APM is enabled
+ * @STATUS_TPOWER_PMI: the device might be asleep (need to wake it up)
+ * @STATUS_INT_ENABLED: interrupts are enabled
+ * @STATUS_RFKILL: the HW RFkill switch is in KILL position
+ * @STATUS_FW_ERROR: the fw is in error state
+ */
+enum iwl_trans_status {
+        STATUS_SYNC_HCMD_ACTIVE,
+        STATUS_DEVICE_ENABLED,
+        STATUS_TPOWER_PMI,
+        STATUS_INT_ENABLED,
+        STATUS_RFKILL,
+        STATUS_FW_ERROR,
+};
+
+/**
  * struct iwl_trans_config - transport configuration
  *
  * @op_mode: pointer to the upper layer.
@@ -361,9 +389,7 @@ struct iwl_trans;
  *
  * @start_hw: starts the HW- from that point on, the HW can send interrupts
  *      May sleep
- * @stop_hw: stops the HW- from that point on, the HW will be in low power but
- *      will still issue interrupt if the HW RF kill is triggered unless
- *      op_mode_leaving is true.
+ * @op_mode_leave: Turn off the HW RF kill indication if on
  *      May sleep
  * @start_fw: allocates and inits all the resources for the transport
  *      layer. Also kick a fw image.
@@ -371,8 +397,11 @@ struct iwl_trans;
  * @fw_alive: called when the fw sends alive notification. If the fw provides
  *      the SCD base address in SRAM, then provide it here, or 0 otherwise.
  *      May sleep
- * @stop_device:stops the whole device (embedded CPU put to reset)
- *      May sleep
+ * @stop_device: stops the whole device (embedded CPU put to reset) and stops
+ *      the HW. From that point on, the HW will be in low power but will still
+ *      issue interrupt if the HW RF kill is triggered. This callback must do
+ *      the right thing and not crash even if start_hw() was called but not
+ *      start_fw(). May sleep
  * @d3_suspend: put the device into the correct mode for WoWLAN during
  *      suspend. This is optional, if not implemented WoWLAN will not be
  *      supported. This callback may sleep.
@@ -418,7 +447,7 @@ struct iwl_trans;
 struct iwl_trans_ops {
 
         int (*start_hw)(struct iwl_trans *iwl_trans);
-        void (*stop_hw)(struct iwl_trans *iwl_trans, bool op_mode_leaving);
+        void (*op_mode_leave)(struct iwl_trans *iwl_trans);
         int (*start_fw)(struct iwl_trans *trans, const struct fw_img *fw,
                         bool run_in_rfkill);
         void (*fw_alive)(struct iwl_trans *trans, u32 scd_addr);
@@ -479,6 +508,7 @@ enum iwl_trans_state {
  * @ops - pointer to iwl_trans_ops
  * @op_mode - pointer to the op_mode
  * @cfg - pointer to the configuration
+ * @status: a bit-mask of transport status flags
  * @dev - pointer to struct device * that represents the device
  * @hw_id: a u32 with the ID of the device / subdevice.
  *      Set during transport allocation.
@@ -499,6 +529,7 @@ struct iwl_trans {
         struct iwl_op_mode *op_mode;
         const struct iwl_cfg *cfg;
         enum iwl_trans_state state;
+        unsigned long status;
 
         struct device *dev;
         u32 hw_rev;
@@ -540,15 +571,14 @@ static inline int iwl_trans_start_hw(struct iwl_trans *trans)
         return trans->ops->start_hw(trans);
 }
 
-static inline void iwl_trans_stop_hw(struct iwl_trans *trans,
-                                     bool op_mode_leaving)
+static inline void iwl_trans_op_mode_leave(struct iwl_trans *trans)
 {
         might_sleep();
 
-        trans->ops->stop_hw(trans, op_mode_leaving);
+        if (trans->ops->op_mode_leave)
+                trans->ops->op_mode_leave(trans);
 
-        if (op_mode_leaving)
-                trans->op_mode = NULL;
+        trans->op_mode = NULL;
 
         trans->state = IWL_TRANS_NO_FW;
 }
@@ -570,6 +600,7 @@ static inline int iwl_trans_start_fw(struct iwl_trans *trans,
 
         WARN_ON_ONCE(!trans->rx_mpdu_cmd);
 
+        clear_bit(STATUS_FW_ERROR, &trans->status);
         return trans->ops->start_fw(trans, fw, run_in_rfkill);
 }
 
@@ -601,6 +632,13 @@ static inline int iwl_trans_send_cmd(struct iwl_trans *trans,
 {
         int ret;
 
+        if (unlikely(!(cmd->flags & CMD_SEND_IN_RFKILL) &&
+                     test_bit(STATUS_RFKILL, &trans->status)))
+                return -ERFKILL;
+
+        if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
+                return -EIO;
+
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE)) {
                 IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
                 return -EIO;
@@ -640,6 +678,9 @@ static inline void iwl_trans_free_tx_cmd(struct iwl_trans *trans,
 static inline int iwl_trans_tx(struct iwl_trans *trans, struct sk_buff *skb,
                                struct iwl_device_cmd *dev_cmd, int queue)
 {
+        if (unlikely(test_bit(STATUS_FW_ERROR, &trans->status)))
+                return -EIO;
+
         if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
                 IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
 
@@ -657,9 +698,6 @@ static inline void iwl_trans_reclaim(struct iwl_trans *trans, int queue,
 
 static inline void iwl_trans_txq_disable(struct iwl_trans *trans, int queue)
 {
-        if (unlikely(trans->state != IWL_TRANS_FW_ALIVE))
-                IWL_ERR(trans, "%s bad state = %d", __func__, trans->state);
-
         trans->ops->txq_disable(trans, queue);
 }
 
@@ -760,7 +798,8 @@ static inline u32 iwl_trans_write_mem32(struct iwl_trans *trans, u32 addr,
 
 static inline void iwl_trans_set_pmi(struct iwl_trans *trans, bool state)
 {
-        trans->ops->set_pmi(trans, state);
+        if (trans->ops->set_pmi)
+                trans->ops->set_pmi(trans, state);
 }
 
 static inline void
@@ -780,6 +819,16 @@ iwl_trans_release_nic_access(struct iwl_trans *trans, unsigned long *flags)
         __release(nic_access);
 }
 
+static inline void iwl_trans_fw_error(struct iwl_trans *trans)
+{
+        if (WARN_ON_ONCE(!trans->op_mode))
+                return;
+
+        /* prevent double restarts due to the same erroneous FW */
+        if (!test_and_set_bit(STATUS_FW_ERROR, &trans->status))
+                iwl_op_mode_nic_error(trans->op_mode);
+}
+
 /*****************************************************
 * driver (transport) register/unregister functions
 ******************************************************/
diff --git a/drivers/net/wireless/iwlwifi/mvm/Makefile b/drivers/net/wireless/iwlwifi/mvm/Makefile
index 6d73817850ce..f98ec2b23898 100644
--- a/drivers/net/wireless/iwlwifi/mvm/Makefile
+++ b/drivers/net/wireless/iwlwifi/mvm/Makefile
@@ -1,10 +1,10 @@
 obj-$(CONFIG_IWLMVM)   += iwlmvm.o
 iwlmvm-y += fw.o mac80211.o nvm.o ops.o phy-ctxt.o mac-ctxt.o
-iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o
+iwlmvm-y += utils.o rx.o tx.o binding.o quota.o sta.o sf.o
 iwlmvm-y += scan.o time-event.o rs.o
 iwlmvm-y += power.o power_legacy.o bt-coex.o
 iwlmvm-y += led.o tt.o
-iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o
+iwlmvm-$(CONFIG_IWLWIFI_DEBUGFS) += debugfs.o debugfs-vif.o
 iwlmvm-$(CONFIG_PM_SLEEP) += d3.o
 
 ccflags-y += -D__CHECK_ENDIAN__ -I$(src)/../
diff --git a/drivers/net/wireless/iwlwifi/mvm/binding.c b/drivers/net/wireless/iwlwifi/mvm/binding.c
index 93fd1457954b..a1376539d2dc 100644
--- a/drivers/net/wireless/iwlwifi/mvm/binding.c
+++ b/drivers/net/wireless/iwlwifi/mvm/binding.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -183,15 +183,29 @@ int iwl_mvm_binding_add_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
                 return -EINVAL;
 
+        /*
+         * Update SF - Disable if needed. if this fails, SF might still be on
+         * while many macs are bound, which is forbidden - so fail the binding.
+         */
+        if (iwl_mvm_sf_update(mvm, vif, false))
+                return -EINVAL;
+
         return iwl_mvm_binding_update(mvm, vif, mvmvif->phy_ctxt, true);
 }
 
 int iwl_mvm_binding_remove_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        int ret;
 
         if (WARN_ON_ONCE(!mvmvif->phy_ctxt))
                 return -EINVAL;
 
-        return iwl_mvm_binding_update(mvm, vif, mvmvif->phy_ctxt, false);
+        ret = iwl_mvm_binding_update(mvm, vif, mvmvif->phy_ctxt, false);
+
+        if (!ret)
+                if (iwl_mvm_sf_update(mvm, vif, true))
+                        IWL_ERR(mvm, "Failed to update SF state\n");
+
+        return ret;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
index 75b72a956552..76cde6ce6551 100644
--- a/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
+++ b/drivers/net/wireless/iwlwifi/mvm/bt-coex.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -294,9 +294,9 @@ static const __le64 iwl_ci_mask[][3] = {
                 cpu_to_le64(0x0)
         },
         {
-                cpu_to_le64(0xFE00000000ULL),
+                cpu_to_le64(0xFFC0000000ULL),
                 cpu_to_le64(0x0ULL),
-                cpu_to_le64(0x0)
+                cpu_to_le64(0x0ULL)
         },
 };
 
@@ -396,7 +396,8 @@ int iwl_send_bt_init_conf(struct iwl_mvm *mvm)
                                             BT_VALID_ANT_ISOLATION |
                                             BT_VALID_ANT_ISOLATION_THRS |
                                             BT_VALID_TXTX_DELTA_FREQ_THRS |
-                                            BT_VALID_TXRX_MAX_FREQ_0);
+                                            BT_VALID_TXRX_MAX_FREQ_0 |
+                                            BT_VALID_SYNC_TO_SCO);
 
         if (mvm->cfg->bt_shared_single_ant)
                 memcpy(&bt_cmd->decision_lut, iwl_single_shared_ant,
@@ -514,7 +515,7 @@ static int iwl_mvm_bt_coex_reduced_txp(struct iwl_mvm *mvm, u8 sta_id,
         if (IS_ERR_OR_NULL(sta))
                 return 0;
 
-        mvmsta = (void *)sta->drv_priv;
+        mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
         /* nothing to do */
         if (mvmsta->bt_reduced_txpower == enable)
@@ -846,7 +847,7 @@ static void iwl_mvm_bt_rssi_iterator(void *_data, u8 *mac,
         if (IS_ERR_OR_NULL(sta))
                 return;
 
-        mvmsta = (void *)sta->drv_priv;
+        mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
         data->num_bss_ifaces++;
 
@@ -917,11 +918,11 @@ void iwl_mvm_bt_rssi_event(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 u16 iwl_mvm_bt_coex_agg_time_limit(struct iwl_mvm *mvm,
                                    struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         enum iwl_bt_coex_lut_type lut_type;
 
         if (le32_to_cpu(mvm->last_bt_notif.bt_activity_grading) <
-            BT_LOW_TRAFFIC)
+            BT_HIGH_TRAFFIC)
                 return LINK_QUAL_AGG_TIME_LIMIT_DEF;
 
         lut_type = iwl_get_coex_type(mvm, mvmsta->vif);
@@ -936,7 +937,7 @@ u16 iwl_mvm_bt_coex_agg_time_limit(struct iwl_mvm *mvm,
 bool iwl_mvm_bt_coex_is_mimo_allowed(struct iwl_mvm *mvm,
                                      struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
         if (le32_to_cpu(mvm->last_bt_notif.bt_activity_grading) <
             BT_HIGH_TRAFFIC)
diff --git a/drivers/net/wireless/iwlwifi/mvm/constants.h b/drivers/net/wireless/iwlwifi/mvm/constants.h
index 4b6d670c3509..036857698565 100644
--- a/drivers/net/wireless/iwlwifi/mvm/constants.h
+++ b/drivers/net/wireless/iwlwifi/mvm/constants.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/d3.c b/drivers/net/wireless/iwlwifi/mvm/d3.c
index b9b81e881dd0..f36a7ee0267f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/d3.c
+++ b/drivers/net/wireless/iwlwifi/mvm/d3.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -886,8 +886,7 @@ static int iwl_mvm_get_last_nonqos_seq(struct iwl_mvm *mvm,
         if (err)
                 return err;
 
-        size = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        size -= sizeof(cmd.resp_pkt->hdr);
+        size = iwl_rx_packet_payload_len(cmd.resp_pkt);
         if (size < sizeof(__le16)) {
                 err = -EINVAL;
         } else {
@@ -1211,15 +1210,10 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         if (ret)
                 goto out;
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-        len = le32_to_cpu(d3_cfg_cmd.resp_pkt->len_n_flags) &
-                FH_RSCSR_FRAME_SIZE_MSK;
-        if (len >= sizeof(u32) * 2) {
+        len = iwl_rx_packet_payload_len(d3_cfg_cmd.resp_pkt);
+        if (len >= sizeof(u32)) {
                 mvm->d3_test_pme_ptr =
                         le32_to_cpup((__le32 *)d3_cfg_cmd.resp_pkt->data);
-        } else if (test) {
-                /* in test mode we require the pointer */
-                ret = -EIO;
-                goto out;
         }
 #endif
         iwl_free_resp(&d3_cfg_cmd);
@@ -1231,10 +1225,11 @@ static int __iwl_mvm_suspend(struct ieee80211_hw *hw,
         mvm->aux_sta.sta_id = old_aux_sta_id;
         mvm_ap_sta->sta_id = old_ap_sta_id;
         mvmvif->ap_sta_id = old_ap_sta_id;
- out_noreset:
-        kfree(key_data.rsc_tsc);
+
         if (ret < 0)
                 ieee80211_restart_hw(mvm->hw);
+ out_noreset:
+        kfree(key_data.rsc_tsc);
 
         mutex_unlock(&mvm->mutex);
 
@@ -1537,10 +1532,16 @@ static bool iwl_mvm_setup_connection_keep(struct iwl_mvm *mvm,
         struct iwl_mvm_d3_gtk_iter_data gtkdata = {
                 .status = status,
         };
+        u32 disconnection_reasons =
+                IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_MISSED_BEACON |
+                IWL_WOWLAN_WAKEUP_BY_DISCONNECTION_ON_DEAUTH;
 
         if (!status || !vif->bss_conf.bssid)
                 return false;
 
+        if (le32_to_cpu(status->wakeup_reasons) & disconnection_reasons)
+                return false;
+
         /* find last GTK that we used initially, if any */
         gtkdata.find_phase = true;
         ieee80211_iter_keys(mvm->hw, vif,
@@ -1665,8 +1666,8 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
         else
                 status_size = sizeof(struct iwl_wowlan_status_v4);
 
-        len = le32_to_cpu(cmd.resp_pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (len - sizeof(struct iwl_cmd_header) < status_size) {
+        len = iwl_rx_packet_payload_len(cmd.resp_pkt);
+        if (len < status_size) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out_free_resp;
         }
@@ -1701,8 +1702,7 @@ static bool iwl_mvm_query_wakeup_reasons(struct iwl_mvm *mvm,
                 status.wake_packet = status_v4->wake_packet;
         }
 
-        if (len - sizeof(struct iwl_cmd_header) !=
-            status_size + ALIGN(status.wake_packet_bufsize, 4)) {
+        if (len != status_size + ALIGN(status.wake_packet_bufsize, 4)) {
                 IWL_ERR(mvm, "Invalid WoWLAN status response!\n");
                 goto out_free_resp;
         }
@@ -1805,6 +1805,10 @@ static int __iwl_mvm_resume(struct iwl_mvm *mvm, bool test)
         iwl_mvm_read_d3_sram(mvm);
 
         keep = iwl_mvm_query_wakeup_reasons(mvm, vif);
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+        if (keep)
+                mvm->keep_vif = vif;
+#endif
         /* has unlocked the mutex, so skip that */
         goto out;
 
@@ -1861,6 +1865,7 @@ static int iwl_mvm_d3_test_open(struct inode *inode, struct file *file)
                 return err;
         }
         mvm->d3_test_active = true;
+        mvm->keep_vif = NULL;
         return 0;
 }
 
@@ -1871,10 +1876,14 @@ static ssize_t iwl_mvm_d3_test_read(struct file *file, char __user *user_buf,
         u32 pme_asserted;
 
         while (true) {
-                pme_asserted = iwl_trans_read_mem32(mvm->trans,
-                                                    mvm->d3_test_pme_ptr);
-                if (pme_asserted)
-                        break;
+                /* read pme_ptr if available */
+                if (mvm->d3_test_pme_ptr) {
+                        pme_asserted = iwl_trans_read_mem32(mvm->trans,
+                                                mvm->d3_test_pme_ptr);
+                        if (pme_asserted)
+                                break;
+                }
+
                 if (msleep_interruptible(100))
                         break;
         }
@@ -1885,6 +1894,10 @@ static ssize_t iwl_mvm_d3_test_read(struct file *file, char __user *user_buf,
 static void iwl_mvm_d3_test_disconn_work_iter(void *_data, u8 *mac,
                                               struct ieee80211_vif *vif)
 {
+        /* skip the one we keep connection on */
+        if (_data == vif)
+                return;
+
         if (vif->type == NL80211_IFTYPE_STATION)
                 ieee80211_connection_loss(vif);
 }
@@ -1911,7 +1924,7 @@ static int iwl_mvm_d3_test_release(struct inode *inode, struct file *file)
 
         ieee80211_iterate_active_interfaces_atomic(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
-                iwl_mvm_d3_test_disconn_work_iter, NULL);
+                iwl_mvm_d3_test_disconn_work_iter, mvm->keep_vif);
 
         ieee80211_wake_queues(mvm->hw);
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
new file mode 100644
index 000000000000..0e29cd83a06a
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs-vif.c
@@ -0,0 +1,546 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include "mvm.h"
+#include "debugfs.h"
+
+static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
+                                 struct ieee80211_vif *vif,
+                                 enum iwl_dbgfs_pm_mask param, int val)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_dbgfs_pm *dbgfs_pm = &mvmvif->dbgfs_pm;
+
+        dbgfs_pm->mask |= param;
+
+        switch (param) {
+        case MVM_DEBUGFS_PM_KEEP_ALIVE: {
+                struct ieee80211_hw *hw = mvm->hw;
+                int dtimper = hw->conf.ps_dtim_period ?: 1;
+                int dtimper_msec = dtimper * vif->bss_conf.beacon_int;
+
+                IWL_DEBUG_POWER(mvm, "debugfs: set keep_alive= %d sec\n", val);
+                if (val * MSEC_PER_SEC < 3 * dtimper_msec)
+                        IWL_WARN(mvm,
+                                 "debugfs: keep alive period (%ld msec) is less than minimum required (%d msec)\n",
+                                 val * MSEC_PER_SEC, 3 * dtimper_msec);
+                dbgfs_pm->keep_alive_seconds = val;
+                break;
+        }
+        case MVM_DEBUGFS_PM_SKIP_OVER_DTIM:
+                IWL_DEBUG_POWER(mvm, "skip_over_dtim %s\n",
+                                val ? "enabled" : "disabled");
+                dbgfs_pm->skip_over_dtim = val;
+                break;
+        case MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS:
+                IWL_DEBUG_POWER(mvm, "skip_dtim_periods=%d\n", val);
+                dbgfs_pm->skip_dtim_periods = val;
+                break;
+        case MVM_DEBUGFS_PM_RX_DATA_TIMEOUT:
+                IWL_DEBUG_POWER(mvm, "rx_data_timeout=%d\n", val);
+                dbgfs_pm->rx_data_timeout = val;
+                break;
+        case MVM_DEBUGFS_PM_TX_DATA_TIMEOUT:
+                IWL_DEBUG_POWER(mvm, "tx_data_timeout=%d\n", val);
+                dbgfs_pm->tx_data_timeout = val;
+                break;
+        case MVM_DEBUGFS_PM_DISABLE_POWER_OFF:
+                IWL_DEBUG_POWER(mvm, "disable_power_off=%d\n", val);
+                dbgfs_pm->disable_power_off = val;
+                break;
+        case MVM_DEBUGFS_PM_LPRX_ENA:
+                IWL_DEBUG_POWER(mvm, "lprx %s\n", val ? "enabled" : "disabled");
+                dbgfs_pm->lprx_ena = val;
+                break;
+        case MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD:
+                IWL_DEBUG_POWER(mvm, "lprx_rssi_threshold=%d\n", val);
+                dbgfs_pm->lprx_rssi_threshold = val;
+                break;
+        case MVM_DEBUGFS_PM_SNOOZE_ENABLE:
+                IWL_DEBUG_POWER(mvm, "snooze_enable=%d\n", val);
+                dbgfs_pm->snooze_ena = val;
+                break;
+        case MVM_DEBUGFS_PM_UAPSD_MISBEHAVING:
+                IWL_DEBUG_POWER(mvm, "uapsd_misbehaving_enable=%d\n", val);
+                dbgfs_pm->uapsd_misbehaving = val;
+                break;
+        }
+}
+
+static ssize_t iwl_dbgfs_pm_params_write(struct ieee80211_vif *vif, char *buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        enum iwl_dbgfs_pm_mask param;
+        int val, ret;
+
+        if (!strncmp("keep_alive=", buf, 11)) {
+                if (sscanf(buf + 11, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_KEEP_ALIVE;
+        } else if (!strncmp("skip_over_dtim=", buf, 15)) {
+                if (sscanf(buf + 15, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SKIP_OVER_DTIM;
+        } else if (!strncmp("skip_dtim_periods=", buf, 18)) {
+                if (sscanf(buf + 18, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS;
+        } else if (!strncmp("rx_data_timeout=", buf, 16)) {
+                if (sscanf(buf + 16, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_RX_DATA_TIMEOUT;
+        } else if (!strncmp("tx_data_timeout=", buf, 16)) {
+                if (sscanf(buf + 16, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_TX_DATA_TIMEOUT;
+        } else if (!strncmp("disable_power_off=", buf, 18) &&
+                   !(mvm->fw->ucode_capa.flags &
+                     IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD)) {
+                if (sscanf(buf + 18, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_DISABLE_POWER_OFF;
+        } else if (!strncmp("lprx=", buf, 5)) {
+                if (sscanf(buf + 5, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_LPRX_ENA;
+        } else if (!strncmp("lprx_rssi_threshold=", buf, 20)) {
+                if (sscanf(buf + 20, "%d", &val) != 1)
+                        return -EINVAL;
+                if (val > POWER_LPRX_RSSI_THRESHOLD_MAX || val <
+                    POWER_LPRX_RSSI_THRESHOLD_MIN)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD;
+        } else if (!strncmp("snooze_enable=", buf, 14)) {
+                if (sscanf(buf + 14, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_SNOOZE_ENABLE;
+        } else if (!strncmp("uapsd_misbehaving=", buf, 18)) {
+                if (sscanf(buf + 18, "%d", &val) != 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_PM_UAPSD_MISBEHAVING;
+        } else {
+                return -EINVAL;
+        }
+
+        mutex_lock(&mvm->mutex);
+        iwl_dbgfs_update_pm(mvm, vif, param, val);
+        ret = iwl_mvm_power_update_mode(mvm, vif);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        char buf[512];
+        int bufsz = sizeof(buf);
+        int pos;
+
+        pos = iwl_mvm_power_dbgfs_read(mvm, vif, buf, bufsz);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
+                                         char __user *user_buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        u8 ap_sta_id;
+        struct ieee80211_chanctx_conf *chanctx_conf;
+        char buf[512];
+        int bufsz = sizeof(buf);
+        int pos = 0;
+        int i;
+
+        mutex_lock(&mvm->mutex);
+
+        ap_sta_id = mvmvif->ap_sta_id;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "mac id/color: %d / %d\n",
+                         mvmvif->id, mvmvif->color);
+        pos += scnprintf(buf+pos, bufsz-pos, "bssid: %pM\n",
+                         vif->bss_conf.bssid);
+        pos += scnprintf(buf+pos, bufsz-pos, "QoS:\n");
+        for (i = 0; i < ARRAY_SIZE(mvmvif->queue_params); i++)
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "\t%d: txop:%d - cw_min:%d - cw_max = %d - aifs = %d upasd = %d\n",
+                                 i, mvmvif->queue_params[i].txop,
+                                 mvmvif->queue_params[i].cw_min,
+                                 mvmvif->queue_params[i].cw_max,
+                                 mvmvif->queue_params[i].aifs,
+                                 mvmvif->queue_params[i].uapsd);
+
+        if (vif->type == NL80211_IFTYPE_STATION &&
+            ap_sta_id != IWL_MVM_STATION_COUNT) {
+                struct ieee80211_sta *sta;
+
+                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
+                                                lockdep_is_held(&mvm->mutex));
+                if (!IS_ERR_OR_NULL(sta)) {
+                        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+
+                        pos += scnprintf(buf+pos, bufsz-pos,
+                                         "ap_sta_id %d - reduced Tx power %d\n",
+                                         ap_sta_id,
+                                         mvm_sta->bt_reduced_txpower);
+                }
+        }
+
+        rcu_read_lock();
+        chanctx_conf = rcu_dereference(vif->chanctx_conf);
+        if (chanctx_conf)
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "idle rx chains %d, active rx chains: %d\n",
+                                 chanctx_conf->rx_chains_static,
+                                 chanctx_conf->rx_chains_dynamic);
+        rcu_read_unlock();
+
+        mutex_unlock(&mvm->mutex);
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
+                                enum iwl_dbgfs_bf_mask param, int value)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_dbgfs_bf *dbgfs_bf = &mvmvif->dbgfs_bf;
+
+        dbgfs_bf->mask |= param;
+
+        switch (param) {
+        case MVM_DEBUGFS_BF_ENERGY_DELTA:
+                dbgfs_bf->bf_energy_delta = value;
+                break;
+        case MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA:
+                dbgfs_bf->bf_roaming_energy_delta = value;
+                break;
+        case MVM_DEBUGFS_BF_ROAMING_STATE:
+                dbgfs_bf->bf_roaming_state = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMP_THRESHOLD:
+                dbgfs_bf->bf_temp_threshold = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMP_FAST_FILTER:
+                dbgfs_bf->bf_temp_fast_filter = value;
+                break;
+        case MVM_DEBUGFS_BF_TEMP_SLOW_FILTER:
+                dbgfs_bf->bf_temp_slow_filter = value;
+                break;
+        case MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER:
+                dbgfs_bf->bf_enable_beacon_filter = value;
+                break;
+        case MVM_DEBUGFS_BF_DEBUG_FLAG:
+                dbgfs_bf->bf_debug_flag = value;
+                break;
+        case MVM_DEBUGFS_BF_ESCAPE_TIMER:
+                dbgfs_bf->bf_escape_timer = value;
+                break;
+        case MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT:
+                dbgfs_bf->ba_enable_beacon_abort = value;
+                break;
+        case MVM_DEBUGFS_BA_ESCAPE_TIMER:
+                dbgfs_bf->ba_escape_timer = value;
+                break;
+        }
+}
+
+static ssize_t iwl_dbgfs_bf_params_write(struct ieee80211_vif *vif, char *buf,
+                                         size_t count, loff_t *ppos)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = mvmvif->mvm;
+        enum iwl_dbgfs_bf_mask param;
+        int value, ret = 0;
+
+        if (!strncmp("bf_energy_delta=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ENERGY_DELTA_MIN ||
+                    value > IWL_BF_ENERGY_DELTA_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ENERGY_DELTA;
+        } else if (!strncmp("bf_roaming_energy_delta=", buf, 24)) {
+                if (sscanf(buf+24, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ROAMING_ENERGY_DELTA_MIN ||
+                    value > IWL_BF_ROAMING_ENERGY_DELTA_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA;
+        } else if (!strncmp("bf_roaming_state=", buf, 17)) {
+                if (sscanf(buf+17, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ROAMING_STATE_MIN ||
+                    value > IWL_BF_ROAMING_STATE_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ROAMING_STATE;
+        } else if (!strncmp("bf_temp_threshold=", buf, 18)) {
+                if (sscanf(buf+18, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMP_THRESHOLD_MIN ||
+                    value > IWL_BF_TEMP_THRESHOLD_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMP_THRESHOLD;
+        } else if (!strncmp("bf_temp_fast_filter=", buf, 20)) {
+                if (sscanf(buf+20, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMP_FAST_FILTER_MIN ||
+                    value > IWL_BF_TEMP_FAST_FILTER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMP_FAST_FILTER;
+        } else if (!strncmp("bf_temp_slow_filter=", buf, 20)) {
+                if (sscanf(buf+20, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_TEMP_SLOW_FILTER_MIN ||
+                    value > IWL_BF_TEMP_SLOW_FILTER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_TEMP_SLOW_FILTER;
+        } else if (!strncmp("bf_enable_beacon_filter=", buf, 24)) {
+                if (sscanf(buf+24, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER;
+        } else if (!strncmp("bf_debug_flag=", buf, 14)) {
+                if (sscanf(buf+14, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_DEBUG_FLAG;
+        } else if (!strncmp("bf_escape_timer=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BF_ESCAPE_TIMER_MIN ||
+                    value > IWL_BF_ESCAPE_TIMER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BF_ESCAPE_TIMER;
+        } else if (!strncmp("ba_escape_timer=", buf, 16)) {
+                if (sscanf(buf+16, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < IWL_BA_ESCAPE_TIMER_MIN ||
+                    value > IWL_BA_ESCAPE_TIMER_MAX)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BA_ESCAPE_TIMER;
+        } else if (!strncmp("ba_enable_beacon_abort=", buf, 23)) {
+                if (sscanf(buf+23, "%d", &value) != 1)
+                        return -EINVAL;
+                if (value < 0 || value > 1)
+                        return -EINVAL;
+                param = MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT;
+        } else {
+                return -EINVAL;
+        }
+
+        mutex_lock(&mvm->mutex);
+        iwl_dbgfs_update_bf(vif, param, value);
+        if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value)
+                ret = iwl_mvm_disable_beacon_filter(mvm, vif);
+        else
+                ret = iwl_mvm_enable_beacon_filter(mvm, vif);
+        mutex_unlock(&mvm->mutex);
+
+        return ret ?: count;
+}
+
+static ssize_t iwl_dbgfs_bf_params_read(struct file *file,
+                                        char __user *user_buf,
+                                        size_t count, loff_t *ppos)
+{
+        struct ieee80211_vif *vif = file->private_data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[256];
+        int pos = 0;
+        const size_t bufsz = sizeof(buf);
+        struct iwl_beacon_filter_cmd cmd = {
+                IWL_BF_CMD_CONFIG_DEFAULTS,
+                .bf_enable_beacon_filter =
+                        cpu_to_le32(IWL_BF_ENABLE_BEACON_FILTER_DEFAULT),
+                .ba_enable_beacon_abort =
+                        cpu_to_le32(IWL_BA_ENABLE_BEACON_ABORT_DEFAULT),
+        };
+
+        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
+        if (mvmvif->bf_data.bf_enabled)
+                cmd.bf_enable_beacon_filter = cpu_to_le32(1);
+        else
+                cmd.bf_enable_beacon_filter = 0;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_energy_delta = %d\n",
+                         le32_to_cpu(cmd.bf_energy_delta));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_energy_delta = %d\n",
+                         le32_to_cpu(cmd.bf_roaming_energy_delta));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_state = %d\n",
+                         le32_to_cpu(cmd.bf_roaming_state));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_threshold = %d\n",
+                         le32_to_cpu(cmd.bf_temp_threshold));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_fast_filter = %d\n",
+                         le32_to_cpu(cmd.bf_temp_fast_filter));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_slow_filter = %d\n",
+                         le32_to_cpu(cmd.bf_temp_slow_filter));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_enable_beacon_filter = %d\n",
+                         le32_to_cpu(cmd.bf_enable_beacon_filter));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_debug_flag = %d\n",
+                         le32_to_cpu(cmd.bf_debug_flag));
+        pos += scnprintf(buf+pos, bufsz-pos, "bf_escape_timer = %d\n",
+                         le32_to_cpu(cmd.bf_escape_timer));
+        pos += scnprintf(buf+pos, bufsz-pos, "ba_escape_timer = %d\n",
+                         le32_to_cpu(cmd.ba_escape_timer));
+        pos += scnprintf(buf+pos, bufsz-pos, "ba_enable_beacon_abort = %d\n",
+                         le32_to_cpu(cmd.ba_enable_beacon_abort));
+
+        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+}
+
+#define MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz, struct ieee80211_vif)
+#define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct ieee80211_vif)
+#define MVM_DEBUGFS_ADD_FILE_VIF(name, parent, mode) do {               \
+                if (!debugfs_create_file(#name, mode, parent, vif,      \
+                                         &iwl_dbgfs_##name##_ops))      \
+                        goto err;                                       \
+        } while (0)
+
+MVM_DEBUGFS_READ_FILE_OPS(mac_params);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params, 32);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params, 256);
+
+void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct dentry *dbgfs_dir = vif->debugfs_dir;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        char buf[100];
+
+        /*
+         * Check if debugfs directory already exist before creating it.
+         * This may happen when, for example, resetting hw or suspend-resume
+         */
+        if (!dbgfs_dir || mvmvif->dbgfs_dir)
+                return;
+
+        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
+        mvmvif->mvm = mvm;
+
+        if (!mvmvif->dbgfs_dir) {
+                IWL_ERR(mvm, "Failed to create debugfs directory under %s\n",
+                        dbgfs_dir->d_name.name);
+                return;
+        }
+
+        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
+            ((vif->type == NL80211_IFTYPE_STATION && !vif->p2p) ||
+             (vif->type == NL80211_IFTYPE_STATION && vif->p2p &&
+              mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PS)))
+                MVM_DEBUGFS_ADD_FILE_VIF(pm_params, mvmvif->dbgfs_dir, S_IWUSR |
+                                         S_IRUSR);
+
+        MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir,
+                                 S_IRUSR);
+
+        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
+            mvmvif == mvm->bf_allowed_vif)
+                MVM_DEBUGFS_ADD_FILE_VIF(bf_params, mvmvif->dbgfs_dir,
+                                         S_IRUSR | S_IWUSR);
+
+        /*
+         * Create symlink for convenience pointing to interface specific
+         * debugfs entries for the driver. For example, under
+         * /sys/kernel/debug/iwlwifi/0000\:02\:00.0/iwlmvm/
+         * find
+         * netdev:wlan0 -> ../../../ieee80211/phy0/netdev:wlan0/iwlmvm/
+         */
+        snprintf(buf, 100, "../../../%s/%s/%s/%s",
+                 dbgfs_dir->d_parent->d_parent->d_name.name,
+                 dbgfs_dir->d_parent->d_name.name,
+                 dbgfs_dir->d_name.name,
+                 mvmvif->dbgfs_dir->d_name.name);
+
+        mvmvif->dbgfs_slink = debugfs_create_symlink(dbgfs_dir->d_name.name,
+                                                     mvm->debugfs_dir, buf);
+        if (!mvmvif->dbgfs_slink)
+                IWL_ERR(mvm, "Can't create debugfs symbolic link under %s\n",
+                        dbgfs_dir->d_name.name);
+        return;
+err:
+        IWL_ERR(mvm, "Can't create debugfs entity\n");
+}
+
+void iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        debugfs_remove(mvmvif->dbgfs_slink);
+        mvmvif->dbgfs_slink = NULL;
+
+        debugfs_remove_recursive(mvmvif->dbgfs_dir);
+        mvmvif->dbgfs_dir = NULL;
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index a8fe6b41f9a3..369d4c90e669 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -63,30 +63,18 @@
 #include "mvm.h"
 #include "sta.h"
 #include "iwl-io.h"
+#include "iwl-prph.h"
+#include "debugfs.h"
 
-struct iwl_dbgfs_mvm_ctx {
-        struct iwl_mvm *mvm;
-        struct ieee80211_vif *vif;
-};
-
-static ssize_t iwl_dbgfs_tx_flush_write(struct file *file,
-                                        const char __user *user_buf,
+static ssize_t iwl_dbgfs_tx_flush_write(struct iwl_mvm *mvm, char *buf,
                                         size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
-
-        char buf[16];
-        int buf_size, ret;
+        int ret;
         u32 scd_q_msk;
 
         if (!mvm->ucode_loaded || mvm->cur_ucode != IWL_UCODE_REGULAR)
                 return -EIO;
 
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-
         if (sscanf(buf, "%x", &scd_q_msk) != 1)
                 return -EINVAL;
 
@@ -99,24 +87,15 @@ static ssize_t iwl_dbgfs_tx_flush_write(struct file *file,
         return ret;
 }
 
-static ssize_t iwl_dbgfs_sta_drain_write(struct file *file,
-                                         const char __user *user_buf,
+static ssize_t iwl_dbgfs_sta_drain_write(struct iwl_mvm *mvm, char *buf,
                                          size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
         struct ieee80211_sta *sta;
-
-        char buf[8];
-        int buf_size, sta_id, drain, ret;
+        int sta_id, drain, ret;
 
         if (!mvm->ucode_loaded || mvm->cur_ucode != IWL_UCODE_REGULAR)
                 return -EIO;
 
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-
         if (sscanf(buf, "%d %d", &sta_id, &drain) != 2)
                 return -EINVAL;
         if (sta_id < 0 || sta_id >= IWL_MVM_STATION_COUNT)
@@ -144,73 +123,57 @@ static ssize_t iwl_dbgfs_sram_read(struct file *file, char __user *user_buf,
 {
         struct iwl_mvm *mvm = file->private_data;
         const struct fw_img *img;
-        int ofs, len, pos = 0;
-        size_t bufsz, ret;
-        char *buf;
+        unsigned int ofs, len;
+        size_t ret;
         u8 *ptr;
 
         if (!mvm->ucode_loaded)
                 return -EINVAL;
 
         /* default is to dump the entire data segment */
-        if (!mvm->dbgfs_sram_offset && !mvm->dbgfs_sram_len) {
-                img = &mvm->fw->img[mvm->cur_ucode];
-                ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
-                len = img->sec[IWL_UCODE_SECTION_DATA].len;
-        } else {
+        img = &mvm->fw->img[mvm->cur_ucode];
+        ofs = img->sec[IWL_UCODE_SECTION_DATA].offset;
+        len = img->sec[IWL_UCODE_SECTION_DATA].len;
+
+        if (mvm->dbgfs_sram_len) {
                 ofs = mvm->dbgfs_sram_offset;
                 len = mvm->dbgfs_sram_len;
         }
 
-        bufsz = len * 4 + 256;
-        buf = kzalloc(bufsz, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
         ptr = kzalloc(len, GFP_KERNEL);
-        if (!ptr) {
-                kfree(buf);
+        if (!ptr)
                 return -ENOMEM;
-        }
-
-        pos += scnprintf(buf + pos, bufsz - pos, "sram_len: 0x%x\n", len);
-        pos += scnprintf(buf + pos, bufsz - pos, "sram_offset: 0x%x\n", ofs);
 
         iwl_trans_read_mem_bytes(mvm->trans, ofs, ptr, len);
-        for (ofs = 0; ofs < len; ofs += 16) {
-                pos += scnprintf(buf + pos, bufsz - pos, "0x%.4x ", ofs);
-                hex_dump_to_buffer(ptr + ofs, 16, 16, 1, buf + pos,
-                                   bufsz - pos, false);
-                pos += strlen(buf + pos);
-                if (bufsz - pos > 0)
-                        buf[pos++] = '\n';
-        }
 
-        ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
+        ret = simple_read_from_buffer(user_buf, count, ppos, ptr, len);
 
-        kfree(buf);
         kfree(ptr);
 
         return ret;
 }
 
-static ssize_t iwl_dbgfs_sram_write(struct file *file,
-                                    const char __user *user_buf, size_t count,
-                                    loff_t *ppos)
+static ssize_t iwl_dbgfs_sram_write(struct iwl_mvm *mvm, char *buf,
+                                    size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
-        char buf[64];
-        int buf_size;
+        const struct fw_img *img;
         u32 offset, len;
+        u32 img_offset, img_len;
+
+        if (!mvm->ucode_loaded)
+                return -EINVAL;
 
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) -  1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
+        img = &mvm->fw->img[mvm->cur_ucode];
+        img_offset = img->sec[IWL_UCODE_SECTION_DATA].offset;
+        img_len = img->sec[IWL_UCODE_SECTION_DATA].len;
 
         if (sscanf(buf, "%x,%x", &offset, &len) == 2) {
                 if ((offset & 0x3) || (len & 0x3))
                         return -EINVAL;
+
+                if (offset + len > img_offset + img_len)
+                        return -EINVAL;
+
                 mvm->dbgfs_sram_offset = offset;
                 mvm->dbgfs_sram_len = len;
         } else {
@@ -267,22 +230,14 @@ static ssize_t iwl_dbgfs_disable_power_off_read(struct file *file,
         return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
 }
 
-static ssize_t iwl_dbgfs_disable_power_off_write(struct file *file,
-                                                 const char __user *user_buf,
+static ssize_t iwl_dbgfs_disable_power_off_write(struct iwl_mvm *mvm, char *buf,
                                                  size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
-        char buf[64] = {};
-        int ret;
-        int val;
+        int ret, val;
 
         if (!mvm->ucode_loaded)
                 return -EIO;
 
-        count = min_t(size_t, count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, count))
-                return -EFAULT;
-
         if (!strncmp("disable_power_off_d0=", buf, 21)) {
                 if (sscanf(buf + 21, "%d", &val) != 1)
                         return -EINVAL;
@@ -302,212 +257,6 @@ static ssize_t iwl_dbgfs_disable_power_off_write(struct file *file,
         return ret ?: count;
 }
 
-static void iwl_dbgfs_update_pm(struct iwl_mvm *mvm,
-                                 struct ieee80211_vif *vif,
-                                 enum iwl_dbgfs_pm_mask param, int val)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_dbgfs_pm *dbgfs_pm = &mvmvif->dbgfs_pm;
-
-        dbgfs_pm->mask |= param;
-
-        switch (param) {
-        case MVM_DEBUGFS_PM_KEEP_ALIVE: {
-                struct ieee80211_hw *hw = mvm->hw;
-                int dtimper = hw->conf.ps_dtim_period ?: 1;
-                int dtimper_msec = dtimper * vif->bss_conf.beacon_int;
-
-                IWL_DEBUG_POWER(mvm, "debugfs: set keep_alive= %d sec\n", val);
-                if (val * MSEC_PER_SEC < 3 * dtimper_msec) {
-                        IWL_WARN(mvm,
-                                 "debugfs: keep alive period (%ld msec) is less than minimum required (%d msec)\n",
-                                 val * MSEC_PER_SEC, 3 * dtimper_msec);
-                }
-                dbgfs_pm->keep_alive_seconds = val;
-                break;
-        }
-        case MVM_DEBUGFS_PM_SKIP_OVER_DTIM:
-                IWL_DEBUG_POWER(mvm, "skip_over_dtim %s\n",
-                                val ? "enabled" : "disabled");
-                dbgfs_pm->skip_over_dtim = val;
-                break;
-        case MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS:
-                IWL_DEBUG_POWER(mvm, "skip_dtim_periods=%d\n", val);
-                dbgfs_pm->skip_dtim_periods = val;
-                break;
-        case MVM_DEBUGFS_PM_RX_DATA_TIMEOUT:
-                IWL_DEBUG_POWER(mvm, "rx_data_timeout=%d\n", val);
-                dbgfs_pm->rx_data_timeout = val;
-                break;
-        case MVM_DEBUGFS_PM_TX_DATA_TIMEOUT:
-                IWL_DEBUG_POWER(mvm, "tx_data_timeout=%d\n", val);
-                dbgfs_pm->tx_data_timeout = val;
-                break;
-        case MVM_DEBUGFS_PM_DISABLE_POWER_OFF:
-                IWL_DEBUG_POWER(mvm, "disable_power_off=%d\n", val);
-                dbgfs_pm->disable_power_off = val;
-                break;
-        case MVM_DEBUGFS_PM_LPRX_ENA:
-                IWL_DEBUG_POWER(mvm, "lprx %s\n", val ? "enabled" : "disabled");
-                dbgfs_pm->lprx_ena = val;
-                break;
-        case MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD:
-                IWL_DEBUG_POWER(mvm, "lprx_rssi_threshold=%d\n", val);
-                dbgfs_pm->lprx_rssi_threshold = val;
-                break;
-        case MVM_DEBUGFS_PM_SNOOZE_ENABLE:
-                IWL_DEBUG_POWER(mvm, "snooze_enable=%d\n", val);
-                dbgfs_pm->snooze_ena = val;
-                break;
-        }
-}
-
-static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct ieee80211_vif *vif = file->private_data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        enum iwl_dbgfs_pm_mask param;
-        char buf[32] = {};
-        int val;
-        int ret;
-
-        count = min_t(size_t, count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, count))
-                return -EFAULT;
-
-        if (!strncmp("keep_alive=", buf, 11)) {
-                if (sscanf(buf + 11, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_KEEP_ALIVE;
-        } else if (!strncmp("skip_over_dtim=", buf, 15)) {
-                if (sscanf(buf + 15, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_SKIP_OVER_DTIM;
-        } else if (!strncmp("skip_dtim_periods=", buf, 18)) {
-                if (sscanf(buf + 18, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_SKIP_DTIM_PERIODS;
-        } else if (!strncmp("rx_data_timeout=", buf, 16)) {
-                if (sscanf(buf + 16, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_RX_DATA_TIMEOUT;
-        } else if (!strncmp("tx_data_timeout=", buf, 16)) {
-                if (sscanf(buf + 16, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_TX_DATA_TIMEOUT;
-        } else if (!strncmp("disable_power_off=", buf, 18) &&
-                   !(mvm->fw->ucode_capa.flags &
-                     IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD)) {
-                if (sscanf(buf + 18, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_DISABLE_POWER_OFF;
-        } else if (!strncmp("lprx=", buf, 5)) {
-                if (sscanf(buf + 5, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_LPRX_ENA;
-        } else if (!strncmp("lprx_rssi_threshold=", buf, 20)) {
-                if (sscanf(buf + 20, "%d", &val) != 1)
-                        return -EINVAL;
-                if (val > POWER_LPRX_RSSI_THRESHOLD_MAX || val <
-                    POWER_LPRX_RSSI_THRESHOLD_MIN)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD;
-        } else if (!strncmp("snooze_enable=", buf, 14)) {
-                if (sscanf(buf + 14, "%d", &val) != 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_PM_SNOOZE_ENABLE;
-        } else {
-                return -EINVAL;
-        }
-
-        mutex_lock(&mvm->mutex);
-        iwl_dbgfs_update_pm(mvm, vif, param, val);
-        ret = iwl_mvm_power_update_mode(mvm, vif);
-        mutex_unlock(&mvm->mutex);
-
-        return ret ?: count;
-}
-
-static ssize_t iwl_dbgfs_pm_params_read(struct file *file,
-                                        char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct ieee80211_vif *vif = file->private_data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        char buf[512];
-        int bufsz = sizeof(buf);
-        int pos;
-
-        pos = iwl_mvm_power_dbgfs_read(mvm, vif, buf, bufsz);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-}
-
-static ssize_t iwl_dbgfs_mac_params_read(struct file *file,
-                                         char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct ieee80211_vif *vif = file->private_data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        u8 ap_sta_id;
-        struct ieee80211_chanctx_conf *chanctx_conf;
-        char buf[512];
-        int bufsz = sizeof(buf);
-        int pos = 0;
-        int i;
-
-        mutex_lock(&mvm->mutex);
-
-        ap_sta_id = mvmvif->ap_sta_id;
-
-        pos += scnprintf(buf+pos, bufsz-pos, "mac id/color: %d / %d\n",
-                         mvmvif->id, mvmvif->color);
-        pos += scnprintf(buf+pos, bufsz-pos, "bssid: %pM\n",
-                         vif->bss_conf.bssid);
-        pos += scnprintf(buf+pos, bufsz-pos, "QoS:\n");
-        for (i = 0; i < ARRAY_SIZE(mvmvif->queue_params); i++) {
-                pos += scnprintf(buf+pos, bufsz-pos,
-                                 "\t%d: txop:%d - cw_min:%d - cw_max = %d - aifs = %d upasd = %d\n",
-                                 i, mvmvif->queue_params[i].txop,
-                                 mvmvif->queue_params[i].cw_min,
-                                 mvmvif->queue_params[i].cw_max,
-                                 mvmvif->queue_params[i].aifs,
-                                 mvmvif->queue_params[i].uapsd);
-        }
-
-        if (vif->type == NL80211_IFTYPE_STATION &&
-            ap_sta_id != IWL_MVM_STATION_COUNT) {
-                struct ieee80211_sta *sta;
-                struct iwl_mvm_sta *mvm_sta;
-
-                sta = rcu_dereference_protected(mvm->fw_id_to_mac_id[ap_sta_id],
-                                                lockdep_is_held(&mvm->mutex));
-                mvm_sta = (void *)sta->drv_priv;
-                pos += scnprintf(buf+pos, bufsz-pos,
-                                 "ap_sta_id %d - reduced Tx power %d\n",
-                                 ap_sta_id, mvm_sta->bt_reduced_txpower);
-        }
-
-        rcu_read_lock();
-        chanctx_conf = rcu_dereference(vif->chanctx_conf);
-        if (chanctx_conf) {
-                pos += scnprintf(buf+pos, bufsz-pos,
-                                 "idle rx chains %d, active rx chains: %d\n",
-                                 chanctx_conf->rx_chains_static,
-                                 chanctx_conf->rx_chains_dynamic);
-        }
-        rcu_read_unlock();
-
-        mutex_unlock(&mvm->mutex);
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-}
-
 #define BT_MBOX_MSG(_notif, _num, _field)                                    \
         ((le32_to_cpu((_notif)->mbox_msg[(_num)]) & BT_MBOX##_num##_##_field)\
         >> BT_MBOX##_num##_##_field##_POS)
@@ -783,11 +532,9 @@ static ssize_t iwl_dbgfs_fw_rx_stats_read(struct file *file,
 }
 #undef PRINT_STAT_LE32
 
-static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
-                                          const char __user *user_buf,
+static ssize_t iwl_dbgfs_fw_restart_write(struct iwl_mvm *mvm, char *buf,
                                           size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
         int ret;
 
         mutex_lock(&mvm->mutex);
@@ -804,6 +551,14 @@ static ssize_t iwl_dbgfs_fw_restart_write(struct file *file,
         return count;
 }
 
+static ssize_t iwl_dbgfs_fw_nmi_write(struct iwl_mvm *mvm, char *buf,
+                                      size_t count, loff_t *ppos)
+{
+        iwl_write_prph(mvm->trans, DEVICE_SET_NMI_REG, 1);
+
+        return count;
+}
+
 static ssize_t
 iwl_dbgfs_scan_ant_rxchain_read(struct file *file,
                                 char __user *user_buf,
@@ -828,21 +583,11 @@ iwl_dbgfs_scan_ant_rxchain_read(struct file *file,
 }
 
 static ssize_t
-iwl_dbgfs_scan_ant_rxchain_write(struct file *file,
-                                 const char __user *user_buf,
+iwl_dbgfs_scan_ant_rxchain_write(struct iwl_mvm *mvm, char *buf,
                                  size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
-        char buf[8];
-        int buf_size;
         u8 scan_rx_ant;
 
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) - 1);
-
-        /* get the argument from the user and check if it is valid */
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
         if (sscanf(buf, "%hhx", &scan_rx_ant) != 1)
                 return -EINVAL;
         if (scan_rx_ant > ANT_ABC)
@@ -850,228 +595,17 @@ iwl_dbgfs_scan_ant_rxchain_write(struct file *file,
         if (scan_rx_ant & ~iwl_fw_valid_rx_ant(mvm->fw))
                 return -EINVAL;
 
-        /* change the rx antennas for scan command */
         mvm->scan_rx_ant = scan_rx_ant;
 
         return count;
 }
 
-
-static void iwl_dbgfs_update_bf(struct ieee80211_vif *vif,
-                                enum iwl_dbgfs_bf_mask param, int value)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_dbgfs_bf *dbgfs_bf = &mvmvif->dbgfs_bf;
-
-        dbgfs_bf->mask |= param;
-
-        switch (param) {
-        case MVM_DEBUGFS_BF_ENERGY_DELTA:
-                dbgfs_bf->bf_energy_delta = value;
-                break;
-        case MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA:
-                dbgfs_bf->bf_roaming_energy_delta = value;
-                break;
-        case MVM_DEBUGFS_BF_ROAMING_STATE:
-                dbgfs_bf->bf_roaming_state = value;
-                break;
-        case MVM_DEBUGFS_BF_TEMP_THRESHOLD:
-                dbgfs_bf->bf_temp_threshold = value;
-                break;
-        case MVM_DEBUGFS_BF_TEMP_FAST_FILTER:
-                dbgfs_bf->bf_temp_fast_filter = value;
-                break;
-        case MVM_DEBUGFS_BF_TEMP_SLOW_FILTER:
-                dbgfs_bf->bf_temp_slow_filter = value;
-                break;
-        case MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER:
-                dbgfs_bf->bf_enable_beacon_filter = value;
-                break;
-        case MVM_DEBUGFS_BF_DEBUG_FLAG:
-                dbgfs_bf->bf_debug_flag = value;
-                break;
-        case MVM_DEBUGFS_BF_ESCAPE_TIMER:
-                dbgfs_bf->bf_escape_timer = value;
-                break;
-        case MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT:
-                dbgfs_bf->ba_enable_beacon_abort = value;
-                break;
-        case MVM_DEBUGFS_BA_ESCAPE_TIMER:
-                dbgfs_bf->ba_escape_timer = value;
-                break;
-        }
-}
-
-static ssize_t iwl_dbgfs_bf_params_write(struct file *file,
-                                         const char __user *user_buf,
-                                         size_t count, loff_t *ppos)
-{
-        struct ieee80211_vif *vif = file->private_data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        struct iwl_mvm *mvm = mvmvif->dbgfs_data;
-        enum iwl_dbgfs_bf_mask param;
-        char buf[256];
-        int buf_size;
-        int value;
-        int ret = 0;
-
-        memset(buf, 0, sizeof(buf));
-        buf_size = min(count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, buf_size))
-                return -EFAULT;
-
-        if (!strncmp("bf_energy_delta=", buf, 16)) {
-                if (sscanf(buf+16, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_ENERGY_DELTA_MIN ||
-                    value > IWL_BF_ENERGY_DELTA_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_ENERGY_DELTA;
-        } else if (!strncmp("bf_roaming_energy_delta=", buf, 24)) {
-                if (sscanf(buf+24, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_ROAMING_ENERGY_DELTA_MIN ||
-                    value > IWL_BF_ROAMING_ENERGY_DELTA_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_ROAMING_ENERGY_DELTA;
-        } else if (!strncmp("bf_roaming_state=", buf, 17)) {
-                if (sscanf(buf+17, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_ROAMING_STATE_MIN ||
-                    value > IWL_BF_ROAMING_STATE_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_ROAMING_STATE;
-        } else if (!strncmp("bf_temp_threshold=", buf, 18)) {
-                if (sscanf(buf+18, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_TEMP_THRESHOLD_MIN ||
-                    value > IWL_BF_TEMP_THRESHOLD_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_TEMP_THRESHOLD;
-        } else if (!strncmp("bf_temp_fast_filter=", buf, 20)) {
-                if (sscanf(buf+20, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_TEMP_FAST_FILTER_MIN ||
-                    value > IWL_BF_TEMP_FAST_FILTER_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_TEMP_FAST_FILTER;
-        } else if (!strncmp("bf_temp_slow_filter=", buf, 20)) {
-                if (sscanf(buf+20, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_TEMP_SLOW_FILTER_MIN ||
-                    value > IWL_BF_TEMP_SLOW_FILTER_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_TEMP_SLOW_FILTER;
-        } else if (!strncmp("bf_enable_beacon_filter=", buf, 24)) {
-                if (sscanf(buf+24, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < 0 || value > 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER;
-        } else if (!strncmp("bf_debug_flag=", buf, 14)) {
-                if (sscanf(buf+14, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < 0 || value > 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_DEBUG_FLAG;
-        } else if (!strncmp("bf_escape_timer=", buf, 16)) {
-                if (sscanf(buf+16, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BF_ESCAPE_TIMER_MIN ||
-                    value > IWL_BF_ESCAPE_TIMER_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BF_ESCAPE_TIMER;
-        } else if (!strncmp("ba_escape_timer=", buf, 16)) {
-                if (sscanf(buf+16, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < IWL_BA_ESCAPE_TIMER_MIN ||
-                    value > IWL_BA_ESCAPE_TIMER_MAX)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BA_ESCAPE_TIMER;
-        } else if (!strncmp("ba_enable_beacon_abort=", buf, 23)) {
-                if (sscanf(buf+23, "%d", &value) != 1)
-                        return -EINVAL;
-                if (value < 0 || value > 1)
-                        return -EINVAL;
-                param = MVM_DEBUGFS_BA_ENABLE_BEACON_ABORT;
-        } else {
-                return -EINVAL;
-        }
-
-        mutex_lock(&mvm->mutex);
-        iwl_dbgfs_update_bf(vif, param, value);
-        if (param == MVM_DEBUGFS_BF_ENABLE_BEACON_FILTER && !value) {
-                ret = iwl_mvm_disable_beacon_filter(mvm, vif);
-        } else {
-                ret = iwl_mvm_enable_beacon_filter(mvm, vif);
-        }
-        mutex_unlock(&mvm->mutex);
-
-        return ret ?: count;
-}
-
-static ssize_t iwl_dbgfs_bf_params_read(struct file *file,
-                                        char __user *user_buf,
-                                        size_t count, loff_t *ppos)
-{
-        struct ieee80211_vif *vif = file->private_data;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        char buf[256];
-        int pos = 0;
-        const size_t bufsz = sizeof(buf);
-        struct iwl_beacon_filter_cmd cmd = {
-                IWL_BF_CMD_CONFIG_DEFAULTS,
-                .bf_enable_beacon_filter =
-                        cpu_to_le32(IWL_BF_ENABLE_BEACON_FILTER_DEFAULT),
-                .ba_enable_beacon_abort =
-                        cpu_to_le32(IWL_BA_ENABLE_BEACON_ABORT_DEFAULT),
-        };
-
-        iwl_mvm_beacon_filter_debugfs_parameters(vif, &cmd);
-        if (mvmvif->bf_data.bf_enabled)
-                cmd.bf_enable_beacon_filter = cpu_to_le32(1);
-        else
-                cmd.bf_enable_beacon_filter = 0;
-
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_energy_delta = %d\n",
-                         le32_to_cpu(cmd.bf_energy_delta));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_energy_delta = %d\n",
-                         le32_to_cpu(cmd.bf_roaming_energy_delta));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_roaming_state = %d\n",
-                         le32_to_cpu(cmd.bf_roaming_state));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_threshold = %d\n",
-                         le32_to_cpu(cmd.bf_temp_threshold));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_fast_filter = %d\n",
-                         le32_to_cpu(cmd.bf_temp_fast_filter));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_temp_slow_filter = %d\n",
-                         le32_to_cpu(cmd.bf_temp_slow_filter));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_enable_beacon_filter = %d\n",
-                         le32_to_cpu(cmd.bf_enable_beacon_filter));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_debug_flag = %d\n",
-                         le32_to_cpu(cmd.bf_debug_flag));
-        pos += scnprintf(buf+pos, bufsz-pos, "bf_escape_timer = %d\n",
-                         le32_to_cpu(cmd.bf_escape_timer));
-        pos += scnprintf(buf+pos, bufsz-pos, "ba_escape_timer = %d\n",
-                         le32_to_cpu(cmd.ba_escape_timer));
-        pos += scnprintf(buf+pos, bufsz-pos, "ba_enable_beacon_abort = %d\n",
-                         le32_to_cpu(cmd.ba_enable_beacon_abort));
-
-        return simple_read_from_buffer(user_buf, count, ppos, buf, pos);
-}
-
 #ifdef CONFIG_PM_SLEEP
-static ssize_t iwl_dbgfs_d3_sram_write(struct file *file,
-                                       const char __user *user_buf,
+static ssize_t iwl_dbgfs_d3_sram_write(struct iwl_mvm *mvm, char *buf,
                                        size_t count, loff_t *ppos)
 {
-        struct iwl_mvm *mvm = file->private_data;
-        char buf[8] = {};
         int store;
 
-        count = min_t(size_t, count, sizeof(buf) - 1);
-        if (copy_from_user(buf, user_buf, count))
-                return -EFAULT;
-
         if (sscanf(buf, "%d", &store) != 1)
                 return -EINVAL;
 
@@ -1124,61 +658,33 @@ static ssize_t iwl_dbgfs_d3_sram_read(struct file *file, char __user *user_buf,
 }
 #endif
 
-#define MVM_DEBUGFS_READ_FILE_OPS(name)                                 \
-static const struct file_operations iwl_dbgfs_##name##_ops = {  \
-        .read = iwl_dbgfs_##name##_read,                                \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
-}
-
-#define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name)                           \
-static const struct file_operations iwl_dbgfs_##name##_ops = {  \
-        .write = iwl_dbgfs_##name##_write,                              \
-        .read = iwl_dbgfs_##name##_read,                                \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
-};
-
-#define MVM_DEBUGFS_WRITE_FILE_OPS(name)                                \
-static const struct file_operations iwl_dbgfs_##name##_ops = {  \
-        .write = iwl_dbgfs_##name##_write,                              \
-        .open = simple_open,                                            \
-        .llseek = generic_file_llseek,                                  \
-};
-
+#define MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_WRITE_FILE_OPS(name, bufsz, struct iwl_mvm)
+#define MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz) \
+        _MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, bufsz, struct iwl_mvm)
 #define MVM_DEBUGFS_ADD_FILE(name, parent, mode) do {                   \
                 if (!debugfs_create_file(#name, mode, parent, mvm,      \
                                          &iwl_dbgfs_##name##_ops))      \
                         goto err;                                       \
         } while (0)
 
-#define MVM_DEBUGFS_ADD_FILE_VIF(name, parent, mode) do {               \
-                if (!debugfs_create_file(#name, mode, parent, vif,      \
-                                         &iwl_dbgfs_##name##_ops))      \
-                        goto err;                                       \
-        } while (0)
-
 /* Device wide debugfs entries */
-MVM_DEBUGFS_WRITE_FILE_OPS(tx_flush);
-MVM_DEBUGFS_WRITE_FILE_OPS(sta_drain);
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(sram);
+MVM_DEBUGFS_WRITE_FILE_OPS(tx_flush, 16);
+MVM_DEBUGFS_WRITE_FILE_OPS(sta_drain, 8);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(sram, 64);
 MVM_DEBUGFS_READ_FILE_OPS(stations);
 MVM_DEBUGFS_READ_FILE_OPS(bt_notif);
 MVM_DEBUGFS_READ_FILE_OPS(bt_cmd);
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(disable_power_off);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(disable_power_off, 64);
 MVM_DEBUGFS_READ_FILE_OPS(fw_rx_stats);
-MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart);
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_restart, 10);
+MVM_DEBUGFS_WRITE_FILE_OPS(fw_nmi, 10);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(scan_ant_rxchain, 8);
 
 #ifdef CONFIG_PM_SLEEP
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram);
+MVM_DEBUGFS_READ_WRITE_FILE_OPS(d3_sram, 8);
 #endif
 
-/* Interface specific debugfs entries */
-MVM_DEBUGFS_READ_FILE_OPS(mac_params);
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(pm_params);
-MVM_DEBUGFS_READ_WRITE_FILE_OPS(bf_params);
-
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
 {
         char buf[100];
@@ -1196,6 +702,7 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                                      S_IRUSR | S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(fw_rx_stats, mvm->debugfs_dir, S_IRUSR);
         MVM_DEBUGFS_ADD_FILE(fw_restart, mvm->debugfs_dir, S_IWUSR);
+        MVM_DEBUGFS_ADD_FILE(fw_nmi, mvm->debugfs_dir, S_IWUSR);
         MVM_DEBUGFS_ADD_FILE(scan_ant_rxchain, mvm->debugfs_dir,
                              S_IWUSR | S_IRUSR);
 #ifdef CONFIG_PM_SLEEP
@@ -1206,6 +713,19 @@ int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir)
                 goto err;
 #endif
 
+        if (!debugfs_create_blob("nvm_hw", S_IRUSR,
+                                  mvm->debugfs_dir, &mvm->nvm_hw_blob))
+                goto err;
+        if (!debugfs_create_blob("nvm_sw", S_IRUSR,
+                                  mvm->debugfs_dir, &mvm->nvm_sw_blob))
+                goto err;
+        if (!debugfs_create_blob("nvm_calib", S_IRUSR,
+                                  mvm->debugfs_dir, &mvm->nvm_calib_blob))
+                goto err;
+        if (!debugfs_create_blob("nvm_prod", S_IRUSR,
+                                  mvm->debugfs_dir, &mvm->nvm_prod_blob))
+                goto err;
+
         /*
          * Create a symlink with mac80211. It will be removed when mac80211
          * exists (before the opmode exists which removes the target.)
@@ -1221,72 +741,3 @@ err:
         IWL_ERR(mvm, "Can't create the mvm debugfs directory\n");
         return -ENOMEM;
 }
-
-void iwl_mvm_vif_dbgfs_register(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
-{
-        struct dentry *dbgfs_dir = vif->debugfs_dir;
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        char buf[100];
-
-        /*
-         * Check if debugfs directory already exist before creating it.
-         * This may happen when, for example, resetting hw or suspend-resume
-         */
-        if (!dbgfs_dir || mvmvif->dbgfs_dir)
-                return;
-
-        mvmvif->dbgfs_dir = debugfs_create_dir("iwlmvm", dbgfs_dir);
-        mvmvif->dbgfs_data = mvm;
-
-        if (!mvmvif->dbgfs_dir) {
-                IWL_ERR(mvm, "Failed to create debugfs directory under %s\n",
-                        dbgfs_dir->d_name.name);
-                return;
-        }
-
-        if (iwlmvm_mod_params.power_scheme != IWL_POWER_SCHEME_CAM &&
-            vif->type == NL80211_IFTYPE_STATION && !vif->p2p)
-                MVM_DEBUGFS_ADD_FILE_VIF(pm_params, mvmvif->dbgfs_dir, S_IWUSR |
-                                         S_IRUSR);
-
-        MVM_DEBUGFS_ADD_FILE_VIF(mac_params, mvmvif->dbgfs_dir,
-                                 S_IRUSR);
-
-        if (vif->type == NL80211_IFTYPE_STATION && !vif->p2p &&
-            mvmvif == mvm->bf_allowed_vif)
-                MVM_DEBUGFS_ADD_FILE_VIF(bf_params, mvmvif->dbgfs_dir,
-                                         S_IRUSR | S_IWUSR);
-
-        /*
-         * Create symlink for convenience pointing to interface specific
-         * debugfs entries for the driver. For example, under
-         * /sys/kernel/debug/iwlwifi/0000\:02\:00.0/iwlmvm/
-         * find
-         * netdev:wlan0 -> ../../../ieee80211/phy0/netdev:wlan0/iwlmvm/
-         */
-        snprintf(buf, 100, "../../../%s/%s/%s/%s",
-                 dbgfs_dir->d_parent->d_parent->d_name.name,
-                 dbgfs_dir->d_parent->d_name.name,
-                 dbgfs_dir->d_name.name,
-                 mvmvif->dbgfs_dir->d_name.name);
-
-        mvmvif->dbgfs_slink = debugfs_create_symlink(dbgfs_dir->d_name.name,
-                                                     mvm->debugfs_dir, buf);
-        if (!mvmvif->dbgfs_slink)
-                IWL_ERR(mvm, "Can't create debugfs symbolic link under %s\n",
-                        dbgfs_dir->d_name.name);
-        return;
-err:
-        IWL_ERR(mvm, "Can't create debugfs entity\n");
-}
-
-void iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
-{
-        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-
-        debugfs_remove(mvmvif->dbgfs_slink);
-        mvmvif->dbgfs_slink = NULL;
-
-        debugfs_remove_recursive(mvmvif->dbgfs_dir);
-        mvmvif->dbgfs_dir = NULL;
-}
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.h b/drivers/net/wireless/iwlwifi/mvm/debugfs.h
new file mode 100644
index 000000000000..e3a9774af495
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.h
@@ -0,0 +1,101 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+
+#define MVM_DEBUGFS_READ_FILE_OPS(name)                                 \
+static const struct file_operations iwl_dbgfs_##name##_ops = {          \
+        .read = iwl_dbgfs_##name##_read,                                \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+}
+
+#define MVM_DEBUGFS_WRITE_WRAPPER(name, buflen, argtype)                \
+static ssize_t _iwl_dbgfs_##name##_write(struct file *file,             \
+                                         const char __user *user_buf,   \
+                                         size_t count, loff_t *ppos)    \
+{                                                                       \
+        argtype *arg = file->private_data;                              \
+        char buf[buflen] = {};                                          \
+        size_t buf_size = min(count, sizeof(buf) -  1);                 \
+                                                                        \
+        if (copy_from_user(buf, user_buf, buf_size))                    \
+                return -EFAULT;                                         \
+                                                                        \
+        return iwl_dbgfs_##name##_write(arg, buf, buf_size, ppos);      \
+}                                                                       \
+
+#define _MVM_DEBUGFS_READ_WRITE_FILE_OPS(name, buflen, argtype)         \
+MVM_DEBUGFS_WRITE_WRAPPER(name, buflen, argtype)                        \
+static const struct file_operations iwl_dbgfs_##name##_ops = {          \
+        .write = _iwl_dbgfs_##name##_write,                             \
+        .read = iwl_dbgfs_##name##_read,                                \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+};
+
+#define _MVM_DEBUGFS_WRITE_FILE_OPS(name, buflen, argtype)              \
+MVM_DEBUGFS_WRITE_WRAPPER(name, buflen, argtype)                        \
+static const struct file_operations iwl_dbgfs_##name##_ops = {          \
+        .write = _iwl_dbgfs_##name##_write,                             \
+        .open = simple_open,                                            \
+        .llseek = generic_file_llseek,                                  \
+};
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
index 4ea5e24ca92d..1b4e54d416b0 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-bt-coex.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -127,6 +127,7 @@ enum iwl_bt_coex_valid_bit_msk {
         BT_VALID_ANT_ISOLATION_THRS     = BIT(15),
         BT_VALID_TXTX_DELTA_FREQ_THRS   = BIT(16),
         BT_VALID_TXRX_MAX_FREQ_0        = BIT(17),
+        BT_VALID_SYNC_TO_SCO            = BIT(18),
 };
 
 /**
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
index 4e7dd8cf87dc..8415ff312d0e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-d3.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
index 39c3148bdfa8..c405cda1025f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-mac.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
index 5cb93ae5cd2f..884c08725308 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-power.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -85,6 +85,8 @@
  *              PBW Snoozing enabled
  * @POWER_FLAGS_ADVANCE_PM_ENA_MSK: Advanced PM (uAPSD) enable mask
  * @POWER_FLAGS_LPRX_ENA_MSK: Low Power RX enable.
+ * @POWER_FLAGS_AP_UAPSD_MISBEHAVING_ENA_MSK: AP/GO's uAPSD misbehaving
+ *              detection enablement
 */
 enum iwl_power_flags {
         POWER_FLAGS_POWER_SAVE_ENA_MSK          = BIT(0),
@@ -94,6 +96,7 @@ enum iwl_power_flags {
         POWER_FLAGS_BT_SCO_ENA                  = BIT(8),
         POWER_FLAGS_ADVANCE_PM_ENA_MSK          = BIT(9),
         POWER_FLAGS_LPRX_ENA_MSK                = BIT(11),
+        POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK   = BIT(12),
 };
 
 #define IWL_POWER_VEC_SIZE 5
@@ -228,6 +231,19 @@ struct iwl_mac_power_cmd {
         u8 reserved;
 } __packed;
 
+/*
+ * struct iwl_uapsd_misbehaving_ap_notif - FW sends this notification when
+ * associated AP is identified as improperly implementing uAPSD protocol.
+ * PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78
+ * @sta_id: index of station in uCode's station table - associated AP ID in
+ *          this context.
+ */
+struct iwl_uapsd_misbehaving_ap_notif {
+        __le32 sta_id;
+        u8 mac_id;
+        u8 reserved[3];
+} __packed;
+
 /**
  * struct iwl_beacon_filter_cmd
  * REPLY_BEACON_FILTERING_CMD = 0xd2 (command)
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
index 538f1c7a5966..85057219cc43 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-rs.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -281,8 +281,31 @@ enum {
 /* # entries in rate scale table to support Tx retries */
 #define  LQ_MAX_RETRY_NUM 16
 
-/* Link quality command flags, only this one is available */
-#define  LQ_FLAG_SET_STA_TLC_RTS_MSK    BIT(0)
+/* Link quality command flags bit fields */
+
+/* Bit 0: (0) Don't use RTS (1) Use RTS */
+#define LQ_FLAG_USE_RTS_POS             0
+#define LQ_FLAG_USE_RTS_MSK             (1 << LQ_FLAG_USE_RTS_POS)
+
+/* Bit 1-3: LQ command color. Used to match responses to LQ commands */
+#define LQ_FLAG_COLOR_POS               1
+#define LQ_FLAG_COLOR_MSK               (7 << LQ_FLAG_COLOR_POS)
+
+/* Bit 4-5: Tx RTS BW Signalling
+ * (0) No RTS BW signalling
+ * (1) Static BW signalling
+ * (2) Dynamic BW signalling
+ */
+#define LQ_FLAG_RTS_BW_SIG_POS          4
+#define LQ_FLAG_RTS_BW_SIG_NONE         (0 << LQ_FLAG_RTS_BW_SIG_POS)
+#define LQ_FLAG_RTS_BW_SIG_STATIC       (1 << LQ_FLAG_RTS_BW_SIG_POS)
+#define LQ_FLAG_RTS_BW_SIG_DYNAMIC      (2 << LQ_FLAG_RTS_BW_SIG_POS)
+
+/* Bit 6: (0) No dynamic BW selection (1) Allow dynamic BW selection
+ * Dyanmic BW selection allows Tx with narrower BW then requested in rates
+ */
+#define LQ_FLAG_DYNAMIC_BW_POS          6
+#define LQ_FLAG_DYNAMIC_BW_MSK          (1 << LQ_FLAG_DYNAMIC_BW_POS)
 
 /**
  * struct iwl_lq_cmd - link quality command
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
index c3782b48ded1..73cbba7424f2 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-scan.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -530,14 +530,13 @@ struct iwl_scan_offload_schedule {
 /*
  * iwl_scan_offload_flags
  *
- * IWL_SCAN_OFFLOAD_FLAG_FILTER_SSID: filter mode - upload every beacon or match
- *      ssid list.
+ * IWL_SCAN_OFFLOAD_FLAG_PASS_ALL: pass all results - no filtering.
  * IWL_SCAN_OFFLOAD_FLAG_CACHED_CHANNEL: add cached channels to partial scan.
  * IWL_SCAN_OFFLOAD_FLAG_ENERGY_SCAN: use energy based scan before partial scan
  *      on A band.
  */
 enum iwl_scan_offload_flags {
-        IWL_SCAN_OFFLOAD_FLAG_FILTER_SSID       = BIT(0),
+        IWL_SCAN_OFFLOAD_FLAG_PASS_ALL          = BIT(0),
         IWL_SCAN_OFFLOAD_FLAG_CACHED_CHANNEL    = BIT(2),
         IWL_SCAN_OFFLOAD_FLAG_ENERGY_SCAN       = BIT(3),
 };
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
index 4aca5933a65d..1b60fdff6a56 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-sta.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -97,9 +97,6 @@ enum iwl_sta_flags {
                                            STA_FLG_FLG_ANT_B),
 
         STA_FLG_PS                      = BIT(8),
-        STA_FLG_INVALID                 = BIT(9),
-        STA_FLG_DLP_EN                  = BIT(10),
-        STA_FLG_SET_ALL_KEYS            = BIT(11),
         STA_FLG_DRAIN_FLOW              = BIT(12),
         STA_FLG_PAN                     = BIT(13),
         STA_FLG_CLASS_AUTH              = BIT(14),
@@ -138,7 +135,14 @@ enum iwl_sta_flags {
 
 /**
  * enum iwl_sta_key_flag - key flags for the ADD_STA host command
- * @STA_KEY_FLG_EN_MSK: mask for encryption algorithm
+ * @STA_KEY_FLG_NO_ENC: no encryption
+ * @STA_KEY_FLG_WEP: WEP encryption algorithm
+ * @STA_KEY_FLG_CCM: CCMP encryption algorithm
+ * @STA_KEY_FLG_TKIP: TKIP encryption algorithm
+ * @STA_KEY_FLG_EXT: extended cipher algorithm (depends on the FW support)
+ * @STA_KEY_FLG_CMAC: CMAC encryption algorithm
+ * @STA_KEY_FLG_ENC_UNKNOWN: unknown encryption algorithm
+ * @STA_KEY_FLG_EN_MSK: mask for encryption algorithmi value
  * @STA_KEY_FLG_WEP_KEY_MAP: wep is either a group key (0 - legacy WEP) or from
  *      station info array (1 - n 1X mode)
  * @STA_KEY_FLG_KEYID_MSK: the index of the key
@@ -152,6 +156,7 @@ enum iwl_sta_key_flag {
         STA_KEY_FLG_WEP                 = (1 << 0),
         STA_KEY_FLG_CCM                 = (2 << 0),
         STA_KEY_FLG_TKIP                = (3 << 0),
+        STA_KEY_FLG_EXT                 = (4 << 0),
         STA_KEY_FLG_CMAC                = (6 << 0),
         STA_KEY_FLG_ENC_UNKNOWN         = (7 << 0),
         STA_KEY_FLG_EN_MSK              = (7 << 0),
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
index d606197bde8f..b674c2a2b51c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api-tx.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -132,6 +132,7 @@ enum iwl_tx_flags {
 #define TX_CMD_SEC_WEP                  0x01
 #define TX_CMD_SEC_CCM                  0x02
 #define TX_CMD_SEC_TKIP                 0x03
+#define TX_CMD_SEC_EXT                  0x04
 #define TX_CMD_SEC_MSK                  0x07
 #define TX_CMD_SEC_WEP_KEY_IDX_POS      6
 #define TX_CMD_SEC_WEP_KEY_IDX_MSK      0xc0
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw-api.h b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
index bad5a552dd8d..989d7dbdca6c 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw-api.h
+++ b/drivers/net/wireless/iwlwifi/mvm/fw-api.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -141,6 +141,7 @@ enum {
 
         /* Power - legacy power table command */
         POWER_TABLE_CMD = 0x77,
+        PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION = 0x78,
 
         /* Thermal Throttling*/
         REPLY_THERMAL_MNG_BACKOFF = 0x7e,
@@ -183,6 +184,7 @@ enum {
         BT_PROFILE_NOTIFICATION = 0xce,
         BT_COEX_CI = 0x5d,
 
+        REPLY_SF_CFG_CMD = 0xd1,
         REPLY_BEACON_FILTERING_CMD = 0xd2,
 
         REPLY_DEBUG_CMD = 0xf0,
@@ -1052,6 +1054,7 @@ enum iwl_mvm_rx_status {
         RX_MPDU_RES_STATUS_SEC_WEP_ENC                  = (1 << 8),
         RX_MPDU_RES_STATUS_SEC_CCM_ENC                  = (2 << 8),
         RX_MPDU_RES_STATUS_SEC_TKIP_ENC                 = (3 << 8),
+        RX_MPDU_RES_STATUS_SEC_EXT_ENC                  = (4 << 8),
         RX_MPDU_RES_STATUS_SEC_CCM_CMAC_ENC             = (6 << 8),
         RX_MPDU_RES_STATUS_SEC_ENC_ERR                  = (7 << 8),
         RX_MPDU_RES_STATUS_SEC_ENC_MSK                  = (7 << 8),
@@ -1131,6 +1134,7 @@ struct iwl_set_calib_default_cmd {
 } __packed; /* PHY_CALIB_OVERRIDE_VALUES_S */
 
 #define MAX_PORT_ID_NUM 2
+#define MAX_MCAST_FILTERING_ADDRESSES 256
 
 /**
  * struct iwl_mcast_filter_cmd - configure multicast filter.
@@ -1363,4 +1367,65 @@ struct iwl_notif_statistics { /* STATISTICS_NTFY_API_S_VER_8 */
         struct mvm_statistics_general general;
 } __packed;
 
+/***********************************
+ * Smart Fifo API
+ ***********************************/
+/* Smart Fifo state */
+enum iwl_sf_state {
+        SF_LONG_DELAY_ON = 0, /* should never be called by driver */
+        SF_FULL_ON,
+        SF_UNINIT,
+        SF_INIT_OFF,
+        SF_HW_NUM_STATES
+};
+
+/* Smart Fifo possible scenario */
+enum iwl_sf_scenario {
+        SF_SCENARIO_SINGLE_UNICAST,
+        SF_SCENARIO_AGG_UNICAST,
+        SF_SCENARIO_MULTICAST,
+        SF_SCENARIO_BA_RESP,
+        SF_SCENARIO_TX_RESP,
+        SF_NUM_SCENARIO
+};
+
+#define SF_TRANSIENT_STATES_NUMBER 2    /* SF_LONG_DELAY_ON and SF_FULL_ON */
+#define SF_NUM_TIMEOUT_TYPES 2          /* Aging timer and Idle timer */
+
+/* smart FIFO default values */
+#define SF_W_MARK_SISO 4096
+#define SF_W_MARK_MIMO2 8192
+#define SF_W_MARK_MIMO3 6144
+#define SF_W_MARK_LEGACY 4096
+#define SF_W_MARK_SCAN 4096
+
+/* SF Scenarios timers for FULL_ON state (aligned to 32 uSec) */
+#define SF_SINGLE_UNICAST_IDLE_TIMER 320        /* 300 uSec  */
+#define SF_SINGLE_UNICAST_AGING_TIMER 2016      /* 2 mSec */
+#define SF_AGG_UNICAST_IDLE_TIMER 320           /* 300 uSec */
+#define SF_AGG_UNICAST_AGING_TIMER 2016         /* 2 mSec */
+#define SF_MCAST_IDLE_TIMER 2016                /* 2 mSec */
+#define SF_MCAST_AGING_TIMER 10016              /* 10 mSec */
+#define SF_BA_IDLE_TIMER 320                    /* 300 uSec */
+#define SF_BA_AGING_TIMER 2016                  /* 2 mSec */
+#define SF_TX_RE_IDLE_TIMER 320                 /* 300 uSec */
+#define SF_TX_RE_AGING_TIMER 2016               /* 2 mSec */
+
+#define SF_LONG_DELAY_AGING_TIMER 1000000       /* 1 Sec */
+
+/**
+ * Smart Fifo configuration command.
+ * @state: smart fifo state, types listed in iwl_sf_sate.
+ * @watermark: Minimum allowed availabe free space in RXF for transient state.
+ * @long_delay_timeouts: aging and idle timer values for each scenario
+ * in long delay state.
+ * @full_on_timeouts: timer values for each scenario in full on state.
+ */
+struct iwl_sf_cfg_cmd {
+        enum iwl_sf_state state;
+        __le32 watermark[SF_TRANSIENT_STATES_NUMBER];
+        __le32 long_delay_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+        __le32 full_on_timeouts[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES];
+} __packed; /* SF_CFG_API_S_VER_2 */
+
 #endif /* __fw_api_h__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c b/drivers/net/wireless/iwlwifi/mvm/fw.c
index 70e5297646b2..c03d39541f9e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -241,7 +241,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 
         lockdep_assert_held(&mvm->mutex);
 
-        if (mvm->init_ucode_complete)
+        if (WARN_ON_ONCE(mvm->init_ucode_complete))
                 return 0;
 
         iwl_init_notification_wait(&mvm->notif_wait,
@@ -287,7 +287,8 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
                 IWL_DEBUG_RF_KILL(mvm,
                                   "jump over all phy activities due to RF kill\n");
                 iwl_remove_notification(&mvm->notif_wait, &calib_wait);
-                return 1;
+                ret = 1;
+                goto out;
         }
 
         /* Send TX valid antennas before triggering calibrations */
@@ -319,9 +320,7 @@ int iwl_run_init_mvm_ucode(struct iwl_mvm *mvm, bool read_nvm)
 error:
         iwl_remove_notification(&mvm->notif_wait, &calib_wait);
 out:
-        if (!iwlmvm_mod_params.init_dbg) {
-                iwl_trans_stop_device(mvm->trans);
-        } else if (!mvm->nvm_data) {
+        if (iwlmvm_mod_params.init_dbg && !mvm->nvm_data) {
                 /* we want to debug INIT and we have no NVM - fake */
                 mvm->nvm_data = kzalloc(sizeof(struct iwl_nvm_data) +
                                         sizeof(struct ieee80211_channel) +
@@ -370,11 +369,16 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                                 ret = -ERFKILL;
                         goto error;
                 }
-                /* should stop & start HW since that INIT image just loaded */
-                iwl_trans_stop_hw(mvm->trans, false);
-                ret = iwl_trans_start_hw(mvm->trans);
-                if (ret)
-                        return ret;
+                if (!iwlmvm_mod_params.init_dbg) {
+                        /*
+                         * should stop and start HW since that INIT
+                         * image just loaded
+                         */
+                        iwl_trans_stop_device(mvm->trans);
+                        ret = iwl_trans_start_hw(mvm->trans);
+                        if (ret)
+                                return ret;
+                }
         }
 
         if (iwlmvm_mod_params.init_dbg)
@@ -386,6 +390,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm)
                 goto error;
         }
 
+        ret = iwl_mvm_sf_update(mvm, NULL, false);
+        if (ret)
+                IWL_ERR(mvm, "Failed to initialize Smart Fifo\n");
+
         ret = iwl_send_tx_ant_cfg(mvm, iwl_fw_valid_tx_ant(mvm->fw));
         if (ret)
                 goto error;
diff --git a/drivers/net/wireless/iwlwifi/mvm/led.c b/drivers/net/wireless/iwlwifi/mvm/led.c
index 2269a9e5cc67..6b4ea6bf8ffe 100644
--- a/drivers/net/wireless/iwlwifi/mvm/led.c
+++ b/drivers/net/wireless/iwlwifi/mvm/led.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -103,7 +103,7 @@ int iwl_mvm_leds_init(struct iwl_mvm *mvm)
                 return 0;
         default:
                 return -EINVAL;
-        };
+        }
 
         mvm->led.name = kasprintf(GFP_KERNEL, "%s-led",
                                    wiphy_name(mvm->hw->wiphy));
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
index f41f9b079831..ba723d50939a 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac-ctxt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -69,10 +69,10 @@
 #include "mvm.h"
 
 const u8 iwl_mvm_ac_to_tx_fifo[] = {
-        IWL_MVM_TX_FIFO_BK,
-        IWL_MVM_TX_FIFO_BE,
-        IWL_MVM_TX_FIFO_VI,
         IWL_MVM_TX_FIFO_VO,
+        IWL_MVM_TX_FIFO_VI,
+        IWL_MVM_TX_FIFO_BE,
+        IWL_MVM_TX_FIFO_BK,
 };
 
 struct iwl_mvm_mac_iface_iterator_data {
@@ -85,35 +85,15 @@ struct iwl_mvm_mac_iface_iterator_data {
         bool found_vif;
 };
 
-static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
-                                       struct ieee80211_vif *vif)
+static void iwl_mvm_mac_tsf_id_iter(void *_data, u8 *mac,
+                                    struct ieee80211_vif *vif)
 {
         struct iwl_mvm_mac_iface_iterator_data *data = _data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-        u32 ac;
 
-        /* Iterator may already find the interface being added -- skip it */
-        if (vif == data->vif) {
-                data->found_vif = true;
+        /* Skip the interface for which we are trying to assign a tsf_id  */
+        if (vif == data->vif)
                 return;
-        }
-
-        /* Mark the queues used by the vif */
-        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
-                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
-                        __set_bit(vif->hw_queue[ac], data->used_hw_queues);
-
-        if (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE)
-                __set_bit(vif->cab_queue, data->used_hw_queues);
-
-        /*
-         * Mark MAC IDs as used by clearing the available bit, and
-         * (below) mark TSFs as used if their existing use is not
-         * compatible with the new interface type.
-         * No locking or atomic bit operations are needed since the
-         * data is on the stack of the caller function.
-         */
-        __clear_bit(mvmvif->id, data->available_mac_ids);
 
         /*
          * The TSF is a hardware/firmware resource, there are 4 and
@@ -135,21 +115,26 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
         case NL80211_IFTYPE_STATION:
                 /*
                  * The new interface is client, so if the existing one
-                 * we're iterating is an AP, the TSF should be used to
+                 * we're iterating is an AP, and both interfaces have the
+                 * same beacon interval, the same TSF should be used to
                  * avoid drift between the new client and existing AP,
                  * the existing AP will get drift updates from the new
                  * client context in this case
                  */
                 if (vif->type == NL80211_IFTYPE_AP) {
                         if (data->preferred_tsf == NUM_TSF_IDS &&
-                            test_bit(mvmvif->tsf_id, data->available_tsf_ids))
+                            test_bit(mvmvif->tsf_id, data->available_tsf_ids) &&
+                            (vif->bss_conf.beacon_int ==
+                             data->vif->bss_conf.beacon_int)) {
                                 data->preferred_tsf = mvmvif->tsf_id;
-                        return;
+                                return;
+                        }
                 }
                 break;
         case NL80211_IFTYPE_AP:
                 /*
-                 * The new interface is AP/GO, so should get drift
+                 * The new interface is AP/GO, so in case both interfaces
+                 * have the same beacon interval, it should get drift
                  * updates from an existing client or use the same
                  * TSF as an existing GO. There's no drift between
                  * TSFs internally but if they used different TSFs
@@ -159,9 +144,12 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
                 if (vif->type == NL80211_IFTYPE_STATION ||
                     vif->type == NL80211_IFTYPE_AP) {
                         if (data->preferred_tsf == NUM_TSF_IDS &&
-                            test_bit(mvmvif->tsf_id, data->available_tsf_ids))
+                            test_bit(mvmvif->tsf_id, data->available_tsf_ids) &&
+                            (vif->bss_conf.beacon_int ==
+                             data->vif->bss_conf.beacon_int)) {
                                 data->preferred_tsf = mvmvif->tsf_id;
-                        return;
+                                return;
+                        }
                 }
                 break;
         default:
@@ -187,6 +175,39 @@ static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
                 data->preferred_tsf = NUM_TSF_IDS;
 }
 
+static void iwl_mvm_mac_iface_iterator(void *_data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_mac_iface_iterator_data *data = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        u32 ac;
+
+        /* Iterator may already find the interface being added -- skip it */
+        if (vif == data->vif) {
+                data->found_vif = true;
+                return;
+        }
+
+        /* Mark the queues used by the vif */
+        for (ac = 0; ac < IEEE80211_NUM_ACS; ac++)
+                if (vif->hw_queue[ac] != IEEE80211_INVAL_HW_QUEUE)
+                        __set_bit(vif->hw_queue[ac], data->used_hw_queues);
+
+        if (vif->cab_queue != IEEE80211_INVAL_HW_QUEUE)
+                __set_bit(vif->cab_queue, data->used_hw_queues);
+
+        /* Mark MAC IDs as used by clearing the available bit, and
+         * (below) mark TSFs as used if their existing use is not
+         * compatible with the new interface type.
+         * No locking or atomic bit operations are needed since the
+         * data is on the stack of the caller function.
+         */
+        __clear_bit(mvmvif->id, data->available_mac_ids);
+
+        /* find a suitable tsf_id */
+        iwl_mvm_mac_tsf_id_iter(_data, mac, vif);
+}
+
 /*
  * Get the mask of the queus used by the vif
  */
@@ -205,6 +226,29 @@ u32 iwl_mvm_mac_get_queues_mask(struct iwl_mvm *mvm,
         return qmask;
 }
 
+void iwl_mvm_mac_ctxt_recalc_tsf_id(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm_mac_iface_iterator_data data = {
+                .mvm = mvm,
+                .vif = vif,
+                .available_tsf_ids = { (1 << NUM_TSF_IDS) - 1 },
+                /* no preference yet */
+                .preferred_tsf = NUM_TSF_IDS,
+        };
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_RESUME_ALL,
+                iwl_mvm_mac_tsf_id_iter, &data);
+
+        if (data.preferred_tsf != NUM_TSF_IDS)
+                mvmvif->tsf_id = data.preferred_tsf;
+        else if (!test_bit(mvmvif->tsf_id, data.available_tsf_ids))
+                mvmvif->tsf_id = find_first_bit(data.available_tsf_ids,
+                                                NUM_TSF_IDS);
+}
+
 static int iwl_mvm_mac_ctxt_allocate_resources(struct iwl_mvm *mvm,
                                                struct ieee80211_vif *vif)
 {
@@ -488,6 +532,40 @@ static void iwl_mvm_ack_rates(struct iwl_mvm *mvm,
         *ofdm_rates = ofdm;
 }
 
+static void iwl_mvm_mac_ctxt_set_ht_flags(struct iwl_mvm *mvm,
+                                         struct ieee80211_vif *vif,
+                                         struct iwl_mac_ctx_cmd *cmd)
+{
+        /* for both sta and ap, ht_operation_mode hold the protection_mode */
+        u8 protection_mode = vif->bss_conf.ht_operation_mode &
+                                 IEEE80211_HT_OP_MODE_PROTECTION;
+        /* The fw does not distinguish between ht and fat */
+        u32 ht_flag = MAC_PROT_FLG_HT_PROT | MAC_PROT_FLG_FAT_PROT;
+
+        IWL_DEBUG_RATE(mvm, "protection mode set to %d\n", protection_mode);
+        /*
+         * See section 9.23.3.1 of IEEE 80211-2012.
+         * Nongreenfield HT STAs Present is not supported.
+         */
+        switch (protection_mode) {
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
+                break;
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
+        case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
+                cmd->protection_flags |= cpu_to_le32(ht_flag);
+                break;
+        case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
+                /* Protect when channel wider than 20MHz */
+                if (vif->bss_conf.chandef.width > NL80211_CHAN_WIDTH_20)
+                        cmd->protection_flags |= cpu_to_le32(ht_flag);
+                break;
+        default:
+                IWL_ERR(mvm, "Illegal protection mode %d\n",
+                        protection_mode);
+                break;
+        }
+}
+
 static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                                         struct ieee80211_vif *vif,
                                         struct iwl_mac_ctx_cmd *cmd,
@@ -495,6 +573,8 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
 {
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         struct ieee80211_chanctx_conf *chanctx;
+        bool ht_enabled = !!(vif->bss_conf.ht_operation_mode &
+                             IEEE80211_HT_OP_MODE_PROTECTION);
         u8 cck_ack_rates, ofdm_ack_rates;
         int i;
 
@@ -550,18 +630,23 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                 cpu_to_le32(vif->bss_conf.use_short_slot ?
                             MAC_FLG_SHORT_SLOT : 0);
 
-        for (i = 0; i < AC_NUM; i++) {
-                cmd->ac[i].cw_min = cpu_to_le16(mvmvif->queue_params[i].cw_min);
-                cmd->ac[i].cw_max = cpu_to_le16(mvmvif->queue_params[i].cw_max);
-                cmd->ac[i].aifsn = mvmvif->queue_params[i].aifs;
-                cmd->ac[i].edca_txop =
+        for (i = 0; i < IEEE80211_NUM_ACS; i++) {
+                u8 txf = iwl_mvm_ac_to_tx_fifo[i];
+
+                cmd->ac[txf].cw_min =
+                        cpu_to_le16(mvmvif->queue_params[i].cw_min);
+                cmd->ac[txf].cw_max =
+                        cpu_to_le16(mvmvif->queue_params[i].cw_max);
+                cmd->ac[txf].edca_txop =
                         cpu_to_le16(mvmvif->queue_params[i].txop * 32);
-                cmd->ac[i].fifos_mask = BIT(iwl_mvm_ac_to_tx_fifo[i]);
+                cmd->ac[txf].aifsn = mvmvif->queue_params[i].aifs;
+                cmd->ac[txf].fifos_mask = BIT(txf);
         }
 
         /* in AP mode, the MCAST FIFO takes the EDCA params from VO */
         if (vif->type == NL80211_IFTYPE_AP)
-                cmd->ac[AC_VO].fifos_mask |= BIT(IWL_MVM_TX_FIFO_MCAST);
+                cmd->ac[IWL_MVM_TX_FIFO_VO].fifos_mask |=
+                        BIT(IWL_MVM_TX_FIFO_MCAST);
 
         if (vif->bss_conf.qos)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_UPDATE_EDCA);
@@ -573,16 +658,13 @@ static void iwl_mvm_mac_ctxt_cmd_common(struct iwl_mvm *mvm,
                         cmd->protection_flags |=
                                 cpu_to_le32(MAC_PROT_FLG_SELF_CTS_EN);
         }
-
-        /*
-         * I think that we should enable these 2 flags regardless the HT PROT
-         * fields in the HT IE, but I am not sure. Someone knows whom to ask?...
-         */
-        if (vif->bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
+        IWL_DEBUG_RATE(mvm, "use_cts_prot %d, ht_operation_mode %d\n",
+                       vif->bss_conf.use_cts_prot,
+                       vif->bss_conf.ht_operation_mode);
+        if (vif->bss_conf.chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
                 cmd->qos_flags |= cpu_to_le32(MAC_QOS_FLG_TGN);
-                cmd->protection_flags |= cpu_to_le32(MAC_PROT_FLG_HT_PROT |
-                                                     MAC_PROT_FLG_FAT_PROT);
-        }
+        if (ht_enabled)
+                iwl_mvm_mac_ctxt_set_ht_flags(mvm, vif, cmd);
 
         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP);
 }
@@ -974,7 +1056,7 @@ static void iwl_mvm_mac_ctxt_cmd_fill_ap(struct iwl_mvm *mvm,
                         iwl_mvm_mac_ap_iterator, &data);
 
                 if (data.beacon_device_ts) {
-                        u32 rand = (prandom_u32() % (80 - 20)) + 20;
+                        u32 rand = (prandom_u32() % (64 - 36)) + 36;
                         mvmvif->ap_beacon_time = data.beacon_device_ts +
                                 ieee80211_tu_to_usec(data.beacon_int * rand /
                                                      100);
@@ -1153,10 +1235,18 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 static void iwl_mvm_beacon_loss_iterator(void *_data, u8 *mac,
                                          struct ieee80211_vif *vif)
 {
-        u16 *id = _data;
+        struct iwl_missed_beacons_notif *missed_beacons = _data;
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
 
-        if (mvmvif->id == *id)
+        if (mvmvif->id != (u16)le32_to_cpu(missed_beacons->mac_id))
+                return;
+
+        /*
+         * TODO: the threshold should be adjusted based on latency conditions,
+         * and/or in case of a CS flow on one of the other AP vifs.
+         */
+        if (le32_to_cpu(missed_beacons->consec_missed_beacons_since_last_rx) >
+             IWL_MVM_MISSED_BEACONS_THRESHOLD)
                 ieee80211_beacon_loss(vif);
 }
 
@@ -1165,12 +1255,19 @@ int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
                                     struct iwl_device_cmd *cmd)
 {
         struct iwl_rx_packet *pkt = rxb_addr(rxb);
-        struct iwl_missed_beacons_notif *missed_beacons = (void *)pkt->data;
-        u16 id = (u16)le32_to_cpu(missed_beacons->mac_id);
+        struct iwl_missed_beacons_notif *mb = (void *)pkt->data;
+
+        IWL_DEBUG_INFO(mvm,
+                       "missed bcn mac_id=%u, consecutive=%u (%u, %u, %u)\n",
+                       le32_to_cpu(mb->mac_id),
+                       le32_to_cpu(mb->consec_missed_beacons),
+                       le32_to_cpu(mb->consec_missed_beacons_since_last_rx),
+                       le32_to_cpu(mb->num_recvd_beacons),
+                       le32_to_cpu(mb->num_expected_beacons));
 
         ieee80211_iterate_active_interfaces_atomic(mvm->hw,
                                                    IEEE80211_IFACE_ITER_NORMAL,
                                                    iwl_mvm_beacon_loss_iterator,
-                                                   &id);
+                                                   mb);
         return 0;
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
index 74bc2c8af06d..c49b5073c251 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -199,9 +199,9 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         if (IWL_UCODE_API(mvm->fw->ucode_ver) >= 8)
                 hw->wiphy->interface_modes |= BIT(NL80211_IFTYPE_ADHOC);
 
-        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY |
-                            WIPHY_FLAG_DISABLE_BEACON_HINTS |
-                            WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->flags |= WIPHY_FLAG_IBSS_RSN;
+        hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG |
+                                       REGULATORY_DISABLE_BEACON_HINTS;
 
         hw->wiphy->iface_combinations = iwl_mvm_iface_combinations;
         hw->wiphy->n_iface_combinations =
@@ -256,10 +256,17 @@ int iwl_mvm_mac_setup_register(struct iwl_mvm *mvm)
         }
 
         hw->wiphy->features |= NL80211_FEATURE_P2P_GO_CTWIN |
-                               NL80211_FEATURE_P2P_GO_OPPPS;
+                               NL80211_FEATURE_P2P_GO_OPPPS |
+                               NL80211_FEATURE_LOW_PRIORITY_SCAN;
 
         mvm->rts_threshold = IEEE80211_MAX_RTS_THRESHOLD;
 
+        /* currently FW API supports only one optional cipher scheme */
+        if (mvm->fw->cs[0].cipher) {
+                mvm->hw->n_cipher_schemes = 1;
+                mvm->hw->cipher_schemes = &mvm->fw->cs[0];
+        }
+
 #ifdef CONFIG_PM_SLEEP
         if (mvm->fw->img[IWL_UCODE_WOWLAN].sec[0].len &&
             mvm->trans->ops->d3_suspend &&
@@ -398,7 +405,6 @@ static void iwl_mvm_cleanup_iterator(void *data, u8 *mac,
 static void iwl_mvm_restart_cleanup(struct iwl_mvm *mvm)
 {
         iwl_trans_stop_device(mvm->trans);
-        iwl_trans_stop_hw(mvm->trans, false);
 
         mvm->scan_status = IWL_MVM_SCAN_NONE;
 
@@ -470,7 +476,6 @@ static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
         cancel_work_sync(&mvm->roc_done_wk);
 
         iwl_trans_stop_device(mvm->trans);
-        iwl_trans_stop_hw(mvm->trans, false);
 
         iwl_mvm_async_handlers_purge(mvm);
         /* async_handlers_list is empty and will stay empty: HW is stopped */
@@ -487,17 +492,6 @@ static void iwl_mvm_mac_stop(struct ieee80211_hw *hw)
         cancel_work_sync(&mvm->async_handlers_wk);
 }
 
-static void iwl_mvm_pm_disable_iterator(void *data, u8 *mac,
-                                        struct ieee80211_vif *vif)
-{
-        struct iwl_mvm *mvm = data;
-        int ret;
-
-        ret = iwl_mvm_power_disable(mvm, vif);
-        if (ret)
-                IWL_ERR(mvm, "failed to disable power management\n");
-}
-
 static void iwl_mvm_power_update_iterator(void *data, u8 *mac,
                                           struct ieee80211_vif *vif)
 {
@@ -520,6 +514,20 @@ static struct iwl_mvm_phy_ctxt *iwl_mvm_get_free_phy_ctxt(struct iwl_mvm *mvm)
         return NULL;
 }
 
+static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                                s8 tx_power)
+{
+        /* FW is in charge of regulatory enforcement */
+        struct iwl_reduce_tx_power_cmd reduce_txpwr_cmd = {
+                .mac_context_id = iwl_mvm_vif_from_mac80211(vif)->id,
+                .pwr_restriction = cpu_to_le16(tx_power),
+        };
+
+        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, CMD_SYNC,
+                                    sizeof(reduce_txpwr_cmd),
+                                    &reduce_txpwr_cmd);
+}
+
 static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
                                      struct ieee80211_vif *vif)
 {
@@ -540,26 +548,9 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         if (ret)
                 goto out_unlock;
 
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * If new interface added, disable PM on existing interface.
-         * P2P device is a special case, since it is handled by FW similary to
-         * scan. If P2P deviced is added, PM remains enabled on existing
-         * interface.
-         * Note: the method below does not count the new interface being added
-         * at this moment.
-         */
+        /* Counting number of interfaces is needed for legacy PM */
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count++;
-        if (mvm->vif_count > 1) {
-                IWL_DEBUG_MAC80211(mvm,
-                                   "Disable power on existing interfaces\n");
-                ieee80211_iterate_active_interfaces_atomic(
-                                            mvm->hw,
-                                            IEEE80211_IFACE_ITER_NORMAL,
-                                            iwl_mvm_pm_disable_iterator, mvm);
-        }
 
         /*
          * The AP binding flow can be done only after the beacon
@@ -590,11 +581,7 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
         if (ret)
                 goto out_release;
 
-        /*
-         * Update power state on the new interface. Admittedly, based on
-         * mac80211 logics this power update will disable power management
-         */
-        iwl_mvm_power_update_mode(mvm, vif);
+        iwl_mvm_power_disable(mvm, vif);
 
         /* beacon filtering */
         ret = iwl_mvm_disable_beacon_filter(mvm, vif);
@@ -655,9 +642,12 @@ static int iwl_mvm_mac_add_interface(struct ieee80211_hw *hw,
  out_release:
         if (vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
+
+        /* TODO: remove this when legacy PM will be discarded */
         ieee80211_iterate_active_interfaces(
                 mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
                 iwl_mvm_power_update_iterator, mvm);
+
         iwl_mvm_mac_ctxt_release(mvm, vif);
  out_unlock:
         mutex_unlock(&mvm->mutex);
@@ -743,21 +733,13 @@ static void iwl_mvm_mac_remove_interface(struct ieee80211_hw *hw,
                 mvmvif->phy_ctxt = NULL;
         }
 
-        /*
-         * TODO: remove this temporary code.
-         * Currently MVM FW supports power management only on single MAC.
-         * Check if only one additional interface remains after removing
-         * current one. Update power mode on the remaining interface.
-         */
         if (mvm->vif_count && vif->type != NL80211_IFTYPE_P2P_DEVICE)
                 mvm->vif_count--;
-        IWL_DEBUG_MAC80211(mvm, "Currently %d interfaces active\n",
-                           mvm->vif_count);
-        if (mvm->vif_count == 1) {
-                ieee80211_iterate_active_interfaces(
-                                        mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
-                                        iwl_mvm_power_update_iterator, mvm);
-        }
+
+        /* TODO: remove this when legacy PM will be discarded */
+        ieee80211_iterate_active_interfaces(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_power_update_iterator, mvm);
 
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
@@ -766,23 +748,91 @@ out_release:
         mutex_unlock(&mvm->mutex);
 }
 
-static int iwl_mvm_set_tx_power(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
-                                s8 tx_power)
+static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
 {
-        /* FW is in charge of regulatory enforcement */
-        struct iwl_reduce_tx_power_cmd reduce_txpwr_cmd = {
-                .mac_context_id = iwl_mvm_vif_from_mac80211(vif)->id,
-                .pwr_restriction = cpu_to_le16(tx_power),
+        return 0;
+}
+
+struct iwl_mvm_mc_iter_data {
+        struct iwl_mvm *mvm;
+        int port_id;
+};
+
+static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_mc_iter_data *data = _data;
+        struct iwl_mvm *mvm = data->mvm;
+        struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd;
+        int ret, len;
+
+        /* if we don't have free ports, mcast frames will be dropped */
+        if (WARN_ON_ONCE(data->port_id >= MAX_PORT_ID_NUM))
+                return;
+
+        if (vif->type != NL80211_IFTYPE_STATION ||
+            !vif->bss_conf.assoc)
+                return;
+
+        cmd->port_id = data->port_id++;
+        memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN);
+        len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4);
+
+        ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC, len, cmd);
+        if (ret)
+                IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret);
+}
+
+static void iwl_mvm_recalc_multicast(struct iwl_mvm *mvm)
+{
+        struct iwl_mvm_mc_iter_data iter_data = {
+                .mvm = mvm,
         };
 
-        return iwl_mvm_send_cmd_pdu(mvm, REDUCE_TX_POWER_CMD, CMD_SYNC,
-                                    sizeof(reduce_txpwr_cmd),
-                                    &reduce_txpwr_cmd);
+        lockdep_assert_held(&mvm->mutex);
+
+        if (WARN_ON_ONCE(!mvm->mcast_filter_cmd))
+                return;
+
+        ieee80211_iterate_active_interfaces(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_mc_iface_iterator, &iter_data);
 }
 
-static int iwl_mvm_mac_config(struct ieee80211_hw *hw, u32 changed)
+static u64 iwl_mvm_prepare_multicast(struct ieee80211_hw *hw,
+                                     struct netdev_hw_addr_list *mc_list)
 {
-        return 0;
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mcast_filter_cmd *cmd;
+        struct netdev_hw_addr *addr;
+        int addr_count = netdev_hw_addr_list_count(mc_list);
+        bool pass_all = false;
+        int len;
+
+        if (addr_count > MAX_MCAST_FILTERING_ADDRESSES) {
+                pass_all = true;
+                addr_count = 0;
+        }
+
+        len = roundup(sizeof(*cmd) + addr_count * ETH_ALEN, 4);
+        cmd = kzalloc(len, GFP_ATOMIC);
+        if (!cmd)
+                return 0;
+
+        if (pass_all) {
+                cmd->pass_all = 1;
+                return (u64)(unsigned long)cmd;
+        }
+
+        netdev_hw_addr_list_for_each(addr, mc_list) {
+                IWL_DEBUG_MAC80211(mvm, "mcast addr (%d): %pM\n",
+                                   cmd->count, addr->addr);
+                memcpy(&cmd->addr_list[cmd->count * ETH_ALEN],
+                       addr->addr, ETH_ALEN);
+                cmd->count++;
+        }
+
+        return (u64)(unsigned long)cmd;
 }
 
 static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
@@ -790,21 +840,22 @@ static void iwl_mvm_configure_filter(struct ieee80211_hw *hw,
                                      unsigned int *total_flags,
                                      u64 multicast)
 {
-        *total_flags = 0;
-}
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mcast_filter_cmd *cmd = (void *)(unsigned long)multicast;
 
-static int iwl_mvm_configure_mcast_filter(struct iwl_mvm *mvm,
-                                          struct ieee80211_vif *vif)
-{
-        struct iwl_mcast_filter_cmd mcast_filter_cmd = {
-                .pass_all = 1,
-        };
+        mutex_lock(&mvm->mutex);
 
-        memcpy(mcast_filter_cmd.bssid, vif->bss_conf.bssid, ETH_ALEN);
+        /* replace previous configuration */
+        kfree(mvm->mcast_filter_cmd);
+        mvm->mcast_filter_cmd = cmd;
 
-        return iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_SYNC,
-                                    sizeof(mcast_filter_cmd),
-                                    &mcast_filter_cmd);
+        if (!cmd)
+                goto out;
+
+        iwl_mvm_recalc_multicast(mvm);
+out:
+        mutex_unlock(&mvm->mutex);
+        *total_flags = 0;
 }
 
 static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
@@ -815,6 +866,14 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
         struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
         int ret;
 
+        /*
+         * Re-calculate the tsf id, as the master-slave relations depend on the
+         * beacon interval, which was not known when the station interface was
+         * added.
+         */
+        if (changes & BSS_CHANGED_ASSOC && bss_conf->assoc)
+                iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
+
         ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
         if (ret)
                 IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
@@ -827,7 +886,6 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update quotas\n");
                                 return;
                         }
-                        iwl_mvm_configure_mcast_filter(mvm, vif);
 
                         if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART,
                                      &mvm->status)) {
@@ -849,7 +907,17 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 iwl_mvm_protect_session(mvm, vif, dur, dur,
                                                         5 * dur);
                         }
+
+                        iwl_mvm_sf_update(mvm, vif, false);
+                        iwl_mvm_power_vif_assoc(mvm, vif);
                 } else if (mvmvif->ap_sta_id != IWL_MVM_STATION_COUNT) {
+                        /*
+                         * If update fails - SF might be running in associated
+                         * mode while disassociated - which is forbidden.
+                         */
+                        WARN_ONCE(iwl_mvm_sf_update(mvm, vif, false),
+                                  "Failed to update SF upon disassociation\n");
+
                         /* remove AP station now that the MAC is unassoc */
                         ret = iwl_mvm_rm_sta_id(mvm, vif, mvmvif->ap_sta_id);
                         if (ret)
@@ -861,6 +929,8 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update quotas\n");
                 }
 
+                iwl_mvm_recalc_multicast(mvm);
+
                 /* reset rssi values */
                 mvmvif->bf_data.ave_beacon_signal = 0;
 
@@ -874,6 +944,8 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                                 IWL_ERR(mvm, "failed to update power mode\n");
                 }
                 iwl_mvm_bt_coex_vif_change(mvm);
+                iwl_mvm_update_smps(mvm, vif, IWL_MVM_SMPS_REQ_TT,
+                                    IEEE80211_SMPS_AUTOMATIC);
         } else if (changes & BSS_CHANGED_BEACON_INFO) {
                 /*
                  * We received a beacon _after_ association so
@@ -881,7 +953,8 @@ static void iwl_mvm_bss_info_changed_station(struct iwl_mvm *mvm,
                  */
                 iwl_mvm_remove_time_event(mvm, mvmvif,
                                           &mvmvif->time_event_data);
-        } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_QOS)) {
+        } else if (changes & (BSS_CHANGED_PS | BSS_CHANGED_P2P_PS |
+                              BSS_CHANGED_QOS)) {
                 ret = iwl_mvm_power_update_mode(mvm, vif);
                 if (ret)
                         IWL_ERR(mvm, "failed to update power mode\n");
@@ -916,6 +989,13 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (ret)
                 goto out_unlock;
 
+        /*
+         * Re-calculate the tsf id, as the master-slave relations depend on the
+         * beacon interval, which was not known when the AP interface was added.
+         */
+        if (vif->type == NL80211_IFTYPE_AP)
+                iwl_mvm_mac_ctxt_recalc_tsf_id(mvm, vif);
+
         /* Add the mac context */
         ret = iwl_mvm_mac_ctxt_add(mvm, vif);
         if (ret)
@@ -934,9 +1014,16 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         if (ret)
                 goto out_unbind;
 
+        /* must be set before quota calculations */
+        mvmvif->ap_ibss_active = true;
+
+        /* power updated needs to be done before quotas */
+        mvm->bound_vif_cnt++;
+        iwl_mvm_power_update_binding(mvm, vif, true);
+
         ret = iwl_mvm_update_quotas(mvm, vif);
         if (ret)
-                goto out_rm_bcast;
+                goto out_quota_failed;
 
         /* Need to update the P2P Device MAC (only GO, IBSS is single vif) */
         if (vif->p2p && mvm->p2p_device_vif)
@@ -947,7 +1034,10 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw,
         mutex_unlock(&mvm->mutex);
         return 0;
 
-out_rm_bcast:
+out_quota_failed:
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
+        mvmvif->ap_ibss_active = false;
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
 out_unbind:
         iwl_mvm_binding_remove_vif(mvm, vif);
@@ -979,6 +1069,10 @@ static void iwl_mvm_stop_ap_ibss(struct ieee80211_hw *hw,
         iwl_mvm_update_quotas(mvm, NULL);
         iwl_mvm_send_rm_bcast_sta(mvm, &mvmvif->bcast_sta);
         iwl_mvm_binding_remove_vif(mvm, vif);
+
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
+
         iwl_mvm_mac_ctxt_remove(mvm, vif);
 
         mutex_unlock(&mvm->mutex);
@@ -990,6 +1084,22 @@ iwl_mvm_bss_info_changed_ap_ibss(struct iwl_mvm *mvm,
                                  struct ieee80211_bss_conf *bss_conf,
                                  u32 changes)
 {
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        enum ieee80211_bss_change ht_change = BSS_CHANGED_ERP_CTS_PROT |
+                                              BSS_CHANGED_HT |
+                                              BSS_CHANGED_BANDWIDTH;
+        int ret;
+
+        /* Changes will be applied when the AP/IBSS is started */
+        if (!mvmvif->ap_ibss_active)
+                return;
+
+        if (changes & ht_change) {
+                ret = iwl_mvm_mac_ctxt_changed(mvm, vif);
+                if (ret)
+                        IWL_ERR(mvm, "failed to update MAC %pM\n", vif->addr);
+        }
+
         /* Need to send a new beacon template to the FW */
         if (changes & BSS_CHANGED_BEACON) {
                 if (iwl_mvm_mac_ctxt_beacon_changed(mvm, vif))
@@ -1080,7 +1190,7 @@ static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
                                    struct ieee80211_sta *sta)
 {
         struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
         switch (cmd) {
         case STA_NOTIFY_SLEEP:
@@ -1102,6 +1212,28 @@ static void iwl_mvm_mac_sta_notify(struct ieee80211_hw *hw,
         }
 }
 
+static void iwl_mvm_sta_pre_rcu_remove(struct ieee80211_hw *hw,
+                                       struct ieee80211_vif *vif,
+                                       struct ieee80211_sta *sta)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+        struct iwl_mvm_sta *mvm_sta = (void *)sta->drv_priv;
+
+        /*
+         * This is called before mac80211 does RCU synchronisation,
+         * so here we already invalidate our internal RCU-protected
+         * station pointer. The rest of the code will thus no longer
+         * be able to find the station this way, and we don't rely
+         * on further RCU synchronisation after the sta_state()
+         * callback deleted the station.
+         */
+        mutex_lock(&mvm->mutex);
+        if (sta == rcu_access_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id]))
+                rcu_assign_pointer(mvm->fw_id_to_mac_id[mvm_sta->sta_id],
+                                   ERR_PTR(-ENOENT));
+        mutex_unlock(&mvm->mutex);
+}
+
 static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_sta *sta,
@@ -1149,7 +1281,8 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw,
                 ret = iwl_mvm_update_sta(mvm, vif, sta);
                 if (ret == 0)
                         iwl_mvm_rs_rate_init(mvm, sta,
-                                             mvmvif->phy_ctxt->channel->band);
+                                             mvmvif->phy_ctxt->channel->band,
+                                             true);
         } else if (old_state == IEEE80211_STA_ASSOC &&
                    new_state == IEEE80211_STA_AUTHORIZED) {
                 /* enable beacon filtering */
@@ -1187,6 +1320,17 @@ static int iwl_mvm_mac_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
         return 0;
 }
 
+static void iwl_mvm_sta_rc_update(struct ieee80211_hw *hw,
+                                  struct ieee80211_vif *vif,
+                                  struct ieee80211_sta *sta, u32 changed)
+{
+        struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw);
+
+        if (vif->type == NL80211_IFTYPE_STATION &&
+            changed & IEEE80211_RC_NSS_CHANGED)
+                iwl_mvm_sf_update(mvm, vif, false);
+}
+
 static int iwl_mvm_mac_conf_tx(struct ieee80211_hw *hw,
                                struct ieee80211_vif *vif, u16 ac,
                                const struct ieee80211_tx_queue_params *params)
@@ -1309,7 +1453,12 @@ static int iwl_mvm_mac_set_key(struct ieee80211_hw *hw,
                  */
                 return 0;
         default:
-                return -EOPNOTSUPP;
+                /* currently FW supports only one optional cipher scheme */
+                if (hw->n_cipher_schemes &&
+                    hw->cipher_schemes->cipher == key->cipher)
+                        key->flags |= IEEE80211_KEY_FLAG_PUT_IV_SPACE;
+                else
+                        return -EOPNOTSUPP;
         }
 
         mutex_lock(&mvm->mutex);
@@ -1515,7 +1664,7 @@ static int iwl_mvm_add_chanctx(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->def,
+        ret = iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
                                        ctx->rx_chains_static,
                                        ctx->rx_chains_dynamic);
         if (ret) {
@@ -1553,13 +1702,14 @@ static void iwl_mvm_change_chanctx(struct ieee80211_hw *hw,
         if (WARN_ONCE((phy_ctxt->ref > 1) &&
                       (changed & ~(IEEE80211_CHANCTX_CHANGE_WIDTH |
                                    IEEE80211_CHANCTX_CHANGE_RX_CHAINS |
-                                   IEEE80211_CHANCTX_CHANGE_RADAR)),
+                                   IEEE80211_CHANCTX_CHANGE_RADAR |
+                                   IEEE80211_CHANCTX_CHANGE_MIN_WIDTH)),
                       "Cannot change PHY. Ref=%d, changed=0x%X\n",
                       phy_ctxt->ref, changed))
                 return;
 
         mutex_lock(&mvm->mutex);
-        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->def,
+        iwl_mvm_phy_ctxt_changed(mvm, phy_ctxt, &ctx->min_def,
                                  ctx->rx_chains_static,
                                  ctx->rx_chains_dynamic);
         iwl_mvm_bt_coex_vif_change(mvm);
@@ -1602,7 +1752,13 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
                 goto out_unlock;
 
         /*
-         * Setting the quota at this stage is only required for monitor
+         * Power state must be updated before quotas,
+         * otherwise fw will complain.
+         */
+        mvm->bound_vif_cnt++;
+        iwl_mvm_power_update_binding(mvm, vif, true);
+
+        /* Setting the quota at this stage is only required for monitor
          * interfaces. For the other types, the bss_info changed flow
          * will handle quota settings.
          */
@@ -1617,6 +1773,8 @@ static int iwl_mvm_assign_vif_chanctx(struct ieee80211_hw *hw,
 
  out_remove_binding:
         iwl_mvm_binding_remove_vif(mvm, vif);
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
  out_unlock:
         mutex_unlock(&mvm->mutex);
         if (ret)
@@ -1648,6 +1806,9 @@ static void iwl_mvm_unassign_vif_chanctx(struct ieee80211_hw *hw,
         }
 
         iwl_mvm_binding_remove_vif(mvm, vif);
+        mvm->bound_vif_cnt--;
+        iwl_mvm_power_update_binding(mvm, vif, false);
+
 out_unlock:
         mvmvif->phy_ctxt = NULL;
         mutex_unlock(&mvm->mutex);
@@ -1744,14 +1905,17 @@ struct ieee80211_ops iwl_mvm_hw_ops = {
         .add_interface = iwl_mvm_mac_add_interface,
         .remove_interface = iwl_mvm_mac_remove_interface,
         .config = iwl_mvm_mac_config,
+        .prepare_multicast = iwl_mvm_prepare_multicast,
         .configure_filter = iwl_mvm_configure_filter,
         .bss_info_changed = iwl_mvm_bss_info_changed,
         .hw_scan = iwl_mvm_mac_hw_scan,
         .cancel_hw_scan = iwl_mvm_mac_cancel_hw_scan,
+        .sta_pre_rcu_remove = iwl_mvm_sta_pre_rcu_remove,
         .sta_state = iwl_mvm_mac_sta_state,
         .sta_notify = iwl_mvm_mac_sta_notify,
         .allow_buffered_frames = iwl_mvm_mac_allow_buffered_frames,
         .set_rts_threshold = iwl_mvm_mac_set_rts_threshold,
+        .sta_rc_update = iwl_mvm_sta_rc_update,
         .conf_tx = iwl_mvm_mac_conf_tx,
         .mgd_prepare_tx = iwl_mvm_mac_mgd_prepare_tx,
         .sched_scan_start = iwl_mvm_mac_sched_scan_start,
diff --git a/drivers/net/wireless/iwlwifi/mvm/mvm.h b/drivers/net/wireless/iwlwifi/mvm/mvm.h
index fed21ef4162d..e4ead86f06d6 100644
--- a/drivers/net/wireless/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/iwlwifi/mvm/mvm.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -81,6 +81,7 @@
 #define IWL_MVM_MAX_ADDRESSES           5
 /* RSSI offset for WkP */
 #define IWL_RSSI_OFFSET 50
+#define IWL_MVM_MISSED_BEACONS_THRESHOLD 8
 
 enum iwl_mvm_tx_fifo {
         IWL_MVM_TX_FIFO_BK = 0,
@@ -163,6 +164,8 @@ struct iwl_mvm_power_ops {
                                  struct ieee80211_vif *vif);
         int (*power_update_device_mode)(struct iwl_mvm *mvm);
         int (*power_disable)(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+        void (*power_update_binding)(struct iwl_mvm *mvm,
+                                     struct ieee80211_vif *vif, bool assign);
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         int (*power_dbgfs_read)(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                                 char *buf, int bufsz);
@@ -181,6 +184,7 @@ enum iwl_dbgfs_pm_mask {
         MVM_DEBUGFS_PM_LPRX_ENA = BIT(6),
         MVM_DEBUGFS_PM_LPRX_RSSI_THRESHOLD = BIT(7),
         MVM_DEBUGFS_PM_SNOOZE_ENABLE = BIT(8),
+        MVM_DEBUGFS_PM_UAPSD_MISBEHAVING = BIT(9),
 };
 
 struct iwl_dbgfs_pm {
@@ -193,6 +197,7 @@ struct iwl_dbgfs_pm {
         bool lprx_ena;
         u32 lprx_rssi_threshold;
         bool snooze_ena;
+        bool uapsd_misbehaving;
         int mask;
 };
 
@@ -269,8 +274,8 @@ struct iwl_mvm_vif_bf_data {
  * @bcast_sta: station used for broadcast packets. Used by the following
  *  vifs: P2P_DEVICE, GO and AP.
  * @beacon_skb: the skb used to hold the AP/GO beacon template
- * @smps_requests: the requests of of differents parts of the driver, regard
-        the desired smps mode.
+ * @smps_requests: the SMPS requests of differents parts of the driver,
+ *      combined on update to yield the overall request to mac80211.
  */
 struct iwl_mvm_vif {
         u16 id;
@@ -323,14 +328,19 @@ struct iwl_mvm_vif {
 #endif
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
+        struct iwl_mvm *mvm;
         struct dentry *dbgfs_dir;
         struct dentry *dbgfs_slink;
-        void *dbgfs_data;
         struct iwl_dbgfs_pm dbgfs_pm;
         struct iwl_dbgfs_bf dbgfs_bf;
 #endif
 
         enum ieee80211_smps_mode smps_requests[NUM_IWL_MVM_SMPS_REQ];
+
+        /* FW identified misbehaving AP */
+        u8 uapsd_misbehaving_bssid[ETH_ALEN];
+
+        bool pm_prevented;
 };
 
 static inline struct iwl_mvm_vif *
@@ -479,6 +489,7 @@ struct iwl_mvm {
         /* Scan status, cmd (pre-allocated) and auxiliary station */
         enum iwl_scan_status scan_status;
         struct iwl_scan_cmd *scan_cmd;
+        struct iwl_mcast_filter_cmd *mcast_filter_cmd;
 
         /* rx chain antennas set through debugfs for the scan command */
         u8 scan_rx_ant;
@@ -489,11 +500,19 @@ struct iwl_mvm {
         u8 scan_last_antenna_idx; /* to toggle TX between antennas */
         u8 mgmt_last_antenna_idx;
 
+        /* last smart fifo state that was successfully sent to firmware */
+        enum iwl_sf_state sf_state;
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         struct dentry *debugfs_dir;
         u32 dbgfs_sram_offset, dbgfs_sram_len;
         bool disable_power_off;
         bool disable_power_off_d3;
+
+        struct debugfs_blob_wrapper nvm_hw_blob;
+        struct debugfs_blob_wrapper nvm_sw_blob;
+        struct debugfs_blob_wrapper nvm_calib_blob;
+        struct debugfs_blob_wrapper nvm_prod_blob;
 #endif
 
         struct iwl_mvm_phy_ctxt phy_ctxts[NUM_PHY_CTX];
@@ -507,12 +526,6 @@ struct iwl_mvm {
          */
         unsigned long fw_key_table[BITS_TO_LONGS(STA_KEY_MAX_NUM)];
 
-        /*
-         * This counter of created interfaces is referenced only in conjunction
-         * with FW limitation related to power management. Currently PM is
-         * supported only on a single interface.
-         * IMPORTANT: this variable counts all interfaces except P2P device.
-         */
         u8 vif_count;
 
         /* -1 for always, 0 for never, >0 for that many times */
@@ -531,6 +544,7 @@ struct iwl_mvm {
         bool store_d3_resume_sram;
         void *d3_resume_sram;
         u32 d3_test_pme_ptr;
+        struct ieee80211_vif *keep_vif;
 #endif
 #endif
 
@@ -554,6 +568,11 @@ struct iwl_mvm {
         u8 aux_queue;
         u8 first_agg_queue;
         u8 last_agg_queue;
+
+        u8 bound_vif_cnt;
+
+        /* Indicate if device power save is allowed */
+        bool ps_prevented;
 };
 
 /* Extract MVM priv from op_mode and _hw */
@@ -693,6 +712,8 @@ int iwl_mvm_rx_beacon_notif(struct iwl_mvm *mvm,
 int iwl_mvm_rx_missed_beacons_notif(struct iwl_mvm *mvm,
                                     struct iwl_rx_cmd_buffer *rxb,
                                     struct iwl_device_cmd *cmd);
+void iwl_mvm_mac_ctxt_recalc_tsf_id(struct iwl_mvm *mvm,
+                                    struct ieee80211_vif *vif);
 
 /* Bindings */
 int iwl_mvm_binding_add_vif(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
@@ -750,8 +771,7 @@ iwl_mvm_vif_dbgfs_clean(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 
 /* rate scaling */
-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
-                        u8 flags, bool init);
+int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init);
 
 /* power managment */
 static inline int iwl_mvm_power_update_mode(struct iwl_mvm *mvm,
@@ -773,6 +793,19 @@ static inline int iwl_mvm_power_update_device_mode(struct iwl_mvm *mvm)
         return 0;
 }
 
+static inline void iwl_mvm_power_update_binding(struct iwl_mvm *mvm,
+                                                struct ieee80211_vif *vif,
+                                                bool assign)
+{
+        if (mvm->pm_ops->power_update_binding)
+                mvm->pm_ops->power_update_binding(mvm, vif, assign);
+}
+
+void iwl_mvm_power_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif);
+int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
+                                             struct iwl_rx_cmd_buffer *rxb,
+                                             struct iwl_device_cmd *cmd);
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 static inline int iwl_mvm_power_dbgfs_read(struct iwl_mvm *mvm,
                                             struct ieee80211_vif *vif,
@@ -864,4 +897,8 @@ void iwl_mvm_tt_initialize(struct iwl_mvm *mvm);
 void iwl_mvm_tt_exit(struct iwl_mvm *mvm);
 void iwl_mvm_set_hw_ctkill_state(struct iwl_mvm *mvm, bool state);
 
+/* smart fifo */
+int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
+                      bool added_vif);
+
 #endif /* __IWL_MVM_H__ */
diff --git a/drivers/net/wireless/iwlwifi/mvm/nvm.c b/drivers/net/wireless/iwlwifi/mvm/nvm.c
index 2beffd028b67..35b71af78d02 100644
--- a/drivers/net/wireless/iwlwifi/mvm/nvm.c
+++ b/drivers/net/wireless/iwlwifi/mvm/nvm.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -367,16 +367,17 @@ static int iwl_mvm_read_external_nvm(struct iwl_mvm *mvm)
                         break;
                 }
 
+                if (WARN(section_id >= NVM_NUM_OF_SECTIONS,
+                         "Invalid NVM section ID %d\n", section_id)) {
+                        ret = -EINVAL;
+                        break;
+                }
+
                 temp = kmemdup(file_sec->data, section_size, GFP_KERNEL);
                 if (!temp) {
                         ret = -ENOMEM;
                         break;
                 }
-                if (WARN_ON(section_id >= NVM_NUM_OF_SECTIONS)) {
-                        IWL_ERR(mvm, "Invalid NVM section ID\n");
-                        ret = -EINVAL;
-                        break;
-                }
                 mvm->nvm_sections[section_id].data = temp;
                 mvm->nvm_sections[section_id].length = section_size;
 
@@ -391,17 +392,16 @@ out:
 /* Loads the NVM data stored in mvm->nvm_sections into the NIC */
 int iwl_mvm_load_nvm_to_nic(struct iwl_mvm *mvm)
 {
-        int i, ret;
-        u16 section_id;
+        int i, ret = 0;
         struct iwl_nvm_section *sections = mvm->nvm_sections;
 
         IWL_DEBUG_EEPROM(mvm->trans->dev, "'Write to NVM\n");
 
-        for (i = 0; i < ARRAY_SIZE(nvm_to_read); i++) {
-                section_id = nvm_to_read[i];
-                ret = iwl_nvm_write_section(mvm, section_id,
-                                            sections[section_id].data,
-                                            sections[section_id].length);
+        for (i = 0; i < ARRAY_SIZE(mvm->nvm_sections); i++) {
+                if (!mvm->nvm_sections[i].data || !mvm->nvm_sections[i].length)
+                        continue;
+                ret = iwl_nvm_write_section(mvm, i, sections[i].data,
+                                            sections[i].length);
                 if (ret < 0) {
                         IWL_ERR(mvm, "iwl_mvm_send_cmd failed: %d\n", ret);
                         break;
@@ -443,6 +443,29 @@ int iwl_nvm_init(struct iwl_mvm *mvm)
                         }
                         mvm->nvm_sections[section].data = temp;
                         mvm->nvm_sections[section].length = ret;
+
+#ifdef CONFIG_IWLWIFI_DEBUGFS
+                        switch (section) {
+                        case NVM_SECTION_TYPE_HW:
+                                mvm->nvm_hw_blob.data = temp;
+                                mvm->nvm_hw_blob.size = ret;
+                                break;
+                        case NVM_SECTION_TYPE_SW:
+                                mvm->nvm_sw_blob.data = temp;
+                                mvm->nvm_sw_blob.size  = ret;
+                                break;
+                        case NVM_SECTION_TYPE_CALIBRATION:
+                                mvm->nvm_calib_blob.data = temp;
+                                mvm->nvm_calib_blob.size  = ret;
+                                break;
+                        case NVM_SECTION_TYPE_PRODUCTION:
+                                mvm->nvm_prod_blob.data = temp;
+                                mvm->nvm_prod_blob.size  = ret;
+                                break;
+                        default:
+                                WARN(1, "section: %d", section);
+                        }
+#endif
                 }
                 kfree(nvm_buffer);
                 if (ret < 0)
diff --git a/drivers/net/wireless/iwlwifi/mvm/ops.c b/drivers/net/wireless/iwlwifi/mvm/ops.c
index d86083c6f445..a3d43de342d7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/iwlwifi/mvm/ops.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -236,6 +236,8 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = {
                    false),
 
         RX_HANDLER(REPLY_ERROR, iwl_mvm_rx_fw_error, false),
+        RX_HANDLER(PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION,
+                   iwl_mvm_power_uapsd_misbehaving_ap_notif, false),
 };
 #undef RX_HANDLER
 #define CMD(x) [x] = #x
@@ -307,10 +309,12 @@ static const char *iwl_mvm_cmd_strings[REPLY_MAX] = {
         CMD(BT_PROFILE_NOTIFICATION),
         CMD(BT_CONFIG),
         CMD(MCAST_FILTER_CMD),
+        CMD(REPLY_SF_CFG_CMD),
         CMD(REPLY_BEACON_FILTERING_CMD),
         CMD(REPLY_THERMAL_MNG_BACKOFF),
         CMD(MAC_PM_POWER_TABLE),
         CMD(BT_COEX_CI),
+        CMD(PSM_UAPSD_AP_MISBEHAVING_NOTIFICATION),
 };
 #undef CMD
 
@@ -341,7 +345,6 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
         op_mode = hw->priv;
         op_mode->ops = &iwl_mvm_ops;
-        op_mode->trans = trans;
 
         mvm = IWL_OP_MODE_GET_MVM(op_mode);
         mvm->dev = trans->dev;
@@ -359,6 +362,7 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
                 mvm->aux_queue = 11;
                 mvm->first_agg_queue = 12;
         }
+        mvm->sf_state = SF_UNINIT;
 
         mutex_init(&mvm->mutex);
         spin_lock_init(&mvm->async_handlers_lock);
@@ -424,7 +428,9 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
          * there is no need to unnecessarily power up the NIC at driver load
          */
         if (iwlwifi_mod_params.nvm_file) {
-                        iwl_nvm_init(mvm);
+                err = iwl_nvm_init(mvm);
+                if (err)
+                        goto out_free;
         } else {
                 err = iwl_trans_start_hw(mvm->trans);
                 if (err)
@@ -432,16 +438,13 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
                 mutex_lock(&mvm->mutex);
                 err = iwl_run_init_mvm_ucode(mvm, true);
+                iwl_trans_stop_device(trans);
                 mutex_unlock(&mvm->mutex);
                 /* returns 0 if successful, 1 if success but in rfkill */
                 if (err < 0 && !iwlmvm_mod_params.init_dbg) {
                         IWL_ERR(mvm, "Failed to run INIT ucode: %d\n", err);
                         goto out_free;
                 }
-
-                /* Stop the hw after the ALIVE and NVM has been read */
-                if (!iwlmvm_mod_params.init_dbg)
-                        iwl_trans_stop_hw(mvm->trans, false);
         }
 
         scan_size = sizeof(struct iwl_scan_cmd) +
@@ -470,11 +473,12 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_cfg *cfg,
 
  out_unregister:
         ieee80211_unregister_hw(mvm->hw);
+        iwl_mvm_leds_exit(mvm);
  out_free:
         iwl_phy_db_free(mvm->phy_db);
         kfree(mvm->scan_cmd);
         if (!iwlwifi_mod_params.nvm_file)
-                iwl_trans_stop_hw(trans, true);
+                iwl_trans_op_mode_leave(trans);
         ieee80211_free_hw(mvm->hw);
         return NULL;
 }
@@ -491,12 +495,14 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         ieee80211_unregister_hw(mvm->hw);
 
         kfree(mvm->scan_cmd);
+        kfree(mvm->mcast_filter_cmd);
+        mvm->mcast_filter_cmd = NULL;
 
 #if defined(CONFIG_PM_SLEEP) && defined(CONFIG_IWLWIFI_DEBUGFS)
         kfree(mvm->d3_resume_sram);
 #endif
 
-        iwl_trans_stop_hw(mvm->trans, true);
+        iwl_trans_op_mode_leave(mvm->trans);
 
         iwl_phy_db_free(mvm->phy_db);
         mvm->phy_db = NULL;
@@ -661,6 +667,8 @@ static void iwl_mvm_set_hw_rfkill_state(struct iwl_op_mode *op_mode, bool state)
         else
                 clear_bit(IWL_MVM_STATUS_HW_RFKILL, &mvm->status);
 
+        if (state && mvm->cur_ucode != IWL_UCODE_INIT)
+                iwl_trans_stop_device(mvm->trans);
         wiphy_rfkill_set_hw_state(mvm->hw->wiphy, iwl_mvm_is_radio_killed(mvm));
 }
 
diff --git a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
index a8652ddd6bed..b7268c0b3333 100644
--- a/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/phy-ctxt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/power.c b/drivers/net/wireless/iwlwifi/mvm/power.c
index 550824aa84ea..d9eab3b7bb9f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -64,7 +64,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
-#include <linux/init.h>
 
 #include <net/mac80211.h>
 
@@ -186,6 +185,92 @@ static void iwl_mvm_power_log(struct iwl_mvm *mvm,
         }
 }
 
+static void iwl_mvm_power_configure_uapsd(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          struct iwl_mac_power_cmd *cmd)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        enum ieee80211_ac_numbers ac;
+        bool tid_found = false;
+
+        for (ac = IEEE80211_AC_VO; ac <= IEEE80211_AC_BK; ac++) {
+                if (!mvmvif->queue_params[ac].uapsd)
+                        continue;
+
+                if (mvm->cur_ucode != IWL_UCODE_WOWLAN)
+                        cmd->flags |=
+                                cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
+
+                cmd->uapsd_ac_flags |= BIT(ac);
+
+                /* QNDP TID - the highest TID with no admission control */
+                if (!tid_found && !mvmvif->queue_params[ac].acm) {
+                        tid_found = true;
+                        switch (ac) {
+                        case IEEE80211_AC_VO:
+                                cmd->qndp_tid = 6;
+                                break;
+                        case IEEE80211_AC_VI:
+                                cmd->qndp_tid = 5;
+                                break;
+                        case IEEE80211_AC_BE:
+                                cmd->qndp_tid = 0;
+                                break;
+                        case IEEE80211_AC_BK:
+                                cmd->qndp_tid = 1;
+                                break;
+                        }
+                }
+        }
+
+        if (!(cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)))
+                return;
+
+        cmd->flags |= cpu_to_le16(POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK);
+
+        if (cmd->uapsd_ac_flags == (BIT(IEEE80211_AC_VO) |
+                                    BIT(IEEE80211_AC_VI) |
+                                    BIT(IEEE80211_AC_BE) |
+                                    BIT(IEEE80211_AC_BK))) {
+                cmd->flags |= cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
+                cmd->snooze_interval = cpu_to_le16(IWL_MVM_PS_SNOOZE_INTERVAL);
+                cmd->snooze_window = (mvm->cur_ucode == IWL_UCODE_WOWLAN) ?
+                        cpu_to_le16(IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW) :
+                        cpu_to_le16(IWL_MVM_PS_SNOOZE_WINDOW);
+        }
+
+        cmd->uapsd_max_sp = IWL_UAPSD_MAX_SP;
+
+        if (mvm->cur_ucode == IWL_UCODE_WOWLAN || cmd->flags &
+            cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
+                cmd->rx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_WOWLAN_PS_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
+        } else {
+                cmd->rx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_RX_DATA_TIMEOUT);
+                cmd->tx_data_timeout_uapsd =
+                        cpu_to_le32(IWL_MVM_UAPSD_TX_DATA_TIMEOUT);
+        }
+
+        if (cmd->flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
+                cmd->heavy_tx_thld_packets =
+                        IWL_MVM_PS_SNOOZE_HEAVY_TX_THLD_PACKETS;
+                cmd->heavy_rx_thld_packets =
+                        IWL_MVM_PS_SNOOZE_HEAVY_RX_THLD_PACKETS;
+        } else {
+                cmd->heavy_tx_thld_packets =
+                        IWL_MVM_PS_HEAVY_TX_THLD_PACKETS;
+                cmd->heavy_rx_thld_packets =
+                        IWL_MVM_PS_HEAVY_RX_THLD_PACKETS;
+        }
+        cmd->heavy_tx_thld_percentage =
+                IWL_MVM_PS_HEAVY_TX_THLD_PERCENT;
+        cmd->heavy_rx_thld_percentage =
+                IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
+}
+
 static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                                     struct ieee80211_vif *vif,
                                     struct iwl_mac_power_cmd *cmd)
@@ -198,8 +283,7 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
         bool radar_detect = false;
         struct iwl_mvm_vif *mvmvif __maybe_unused =
                 iwl_mvm_vif_from_mac80211(vif);
-        enum ieee80211_ac_numbers ac;
-        bool tid_found = false;
+        bool allow_uapsd = true;
 
         cmd->id_and_color = cpu_to_le32(FW_CMD_ID_AND_COLOR(mvmvif->id,
                                                             mvmvif->color));
@@ -217,7 +301,8 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
         keep_alive = DIV_ROUND_UP(keep_alive, MSEC_PER_SEC);
         cmd->keep_alive_seconds = cpu_to_le16(keep_alive);
 
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM)
+        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM ||
+            mvm->ps_prevented)
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_SAVE_ENA_MSK);
@@ -227,7 +312,7 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
             mvmvif->dbgfs_pm.disable_power_off)
                 cmd->flags &= cpu_to_le16(~POWER_FLAGS_POWER_SAVE_ENA_MSK);
 #endif
-        if (!vif->bss_conf.ps)
+        if (!vif->bss_conf.ps || mvmvif->pm_prevented)
                 return;
 
         cmd->flags |= cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK);
@@ -269,81 +354,24 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                         cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
         }
 
-        for (ac = IEEE80211_AC_VO; ac <= IEEE80211_AC_BK; ac++) {
-                if (!mvmvif->queue_params[ac].uapsd)
-                        continue;
-
-                if (mvm->cur_ucode != IWL_UCODE_WOWLAN)
-                        cmd->flags |=
-                                cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK);
-
-                cmd->uapsd_ac_flags |= BIT(ac);
+        if (!memcmp(mvmvif->uapsd_misbehaving_bssid, vif->bss_conf.bssid,
+                    ETH_ALEN))
+                allow_uapsd = false;
 
-                /* QNDP TID - the highest TID with no admission control */
-                if (!tid_found && !mvmvif->queue_params[ac].acm) {
-                        tid_found = true;
-                        switch (ac) {
-                        case IEEE80211_AC_VO:
-                                cmd->qndp_tid = 6;
-                                break;
-                        case IEEE80211_AC_VI:
-                                cmd->qndp_tid = 5;
-                                break;
-                        case IEEE80211_AC_BE:
-                                cmd->qndp_tid = 0;
-                                break;
-                        case IEEE80211_AC_BK:
-                                cmd->qndp_tid = 1;
-                                break;
-                        }
-                }
-        }
-
-        if (cmd->flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
-                if (cmd->uapsd_ac_flags == (BIT(IEEE80211_AC_VO) |
-                                            BIT(IEEE80211_AC_VI) |
-                                            BIT(IEEE80211_AC_BE) |
-                                            BIT(IEEE80211_AC_BK))) {
-                        cmd->flags |= cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK);
-                        cmd->snooze_interval =
-                                cpu_to_le16(IWL_MVM_PS_SNOOZE_INTERVAL);
-                        cmd->snooze_window =
-                                (mvm->cur_ucode == IWL_UCODE_WOWLAN) ?
-                                cpu_to_le16(IWL_MVM_WOWLAN_PS_SNOOZE_WINDOW) :
-                                cpu_to_le16(IWL_MVM_PS_SNOOZE_WINDOW);
-                }
-
-                cmd->uapsd_max_sp = IWL_UAPSD_MAX_SP;
-
-                if (mvm->cur_ucode == IWL_UCODE_WOWLAN || cmd->flags &
-                    cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
-                        cmd->rx_data_timeout_uapsd =
-                                cpu_to_le32(IWL_MVM_WOWLAN_PS_RX_DATA_TIMEOUT);
-                        cmd->tx_data_timeout_uapsd =
-                                cpu_to_le32(IWL_MVM_WOWLAN_PS_TX_DATA_TIMEOUT);
-                } else {
-                        cmd->rx_data_timeout_uapsd =
-                                cpu_to_le32(IWL_MVM_UAPSD_RX_DATA_TIMEOUT);
-                        cmd->tx_data_timeout_uapsd =
-                                cpu_to_le32(IWL_MVM_UAPSD_TX_DATA_TIMEOUT);
-                }
+        if (vif->p2p &&
+            !(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PS_UAPSD))
+                allow_uapsd = false;
+        /*
+         * Avoid using uAPSD if P2P client is associated to GO that uses
+         * opportunistic power save. This is due to current FW limitation.
+         */
+        if (vif->p2p &&
+            vif->bss_conf.p2p_noa_attr.oppps_ctwindow &
+            IEEE80211_P2P_OPPPS_ENABLE_BIT)
+                allow_uapsd = false;
 
-                if (cmd->flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
-                        cmd->heavy_tx_thld_packets =
-                                IWL_MVM_PS_SNOOZE_HEAVY_TX_THLD_PACKETS;
-                        cmd->heavy_rx_thld_packets =
-                                IWL_MVM_PS_SNOOZE_HEAVY_RX_THLD_PACKETS;
-                } else {
-                        cmd->heavy_tx_thld_packets =
-                                IWL_MVM_PS_HEAVY_TX_THLD_PACKETS;
-                        cmd->heavy_rx_thld_packets =
-                                IWL_MVM_PS_HEAVY_RX_THLD_PACKETS;
-                }
-                cmd->heavy_tx_thld_percentage =
-                        IWL_MVM_PS_HEAVY_TX_THLD_PERCENT;
-                cmd->heavy_rx_thld_percentage =
-                        IWL_MVM_PS_HEAVY_RX_THLD_PERCENT;
-        }
+        if (allow_uapsd)
+                iwl_mvm_power_configure_uapsd(mvm, vif, cmd);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_KEEP_ALIVE)
@@ -381,6 +409,13 @@ static void iwl_mvm_power_build_cmd(struct iwl_mvm *mvm,
                         cmd->flags &=
                                 cpu_to_le16(~POWER_FLAGS_SNOOZE_ENA_MSK);
         }
+        if (mvmvif->dbgfs_pm.mask & MVM_DEBUGFS_PM_UAPSD_MISBEHAVING) {
+                u16 flag = POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK;
+                if (mvmvif->dbgfs_pm.uapsd_misbehaving)
+                        cmd->flags |= cpu_to_le16(flag);
+                else
+                        cmd->flags &= cpu_to_le16(flag);
+        }
 #endif /* CONFIG_IWLWIFI_DEBUGFS */
 }
 
@@ -391,18 +426,11 @@ static int iwl_mvm_power_mac_update_mode(struct iwl_mvm *mvm,
         bool ba_enable;
         struct iwl_mac_power_cmd cmd = {};
 
-        if (vif->type != NL80211_IFTYPE_STATION || vif->p2p)
+        if (vif->type != NL80211_IFTYPE_STATION)
                 return 0;
 
-        /*
-         * TODO: The following vif_count verification is temporary condition.
-         * Avoid power mode update if more than one interface is currently
-         * active. Remove this condition when FW will support power management
-         * on multiple MACs.
-         */
-        IWL_DEBUG_POWER(mvm, "Currently %d interfaces active\n",
-                        mvm->vif_count);
-        if (mvm->vif_count > 1)
+        if (vif->p2p &&
+            !(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_P2P_PS))
                 return 0;
 
         iwl_mvm_power_build_cmd(mvm, vif, &cmd);
@@ -446,7 +474,7 @@ static int iwl_mvm_power_mac_disable(struct iwl_mvm *mvm,
                                     sizeof(cmd), &cmd);
 }
 
-static int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
+static int _iwl_mvm_power_update_device(struct iwl_mvm *mvm, bool force_disable)
 {
         struct iwl_device_power_cmd cmd = {
                 .flags = cpu_to_le16(DEVICE_POWER_FLAGS_POWER_SAVE_ENA_MSK),
@@ -455,7 +483,8 @@ static int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
         if (!(mvm->fw->ucode_capa.flags & IWL_UCODE_TLV_FLAGS_DEVICE_PS_CMD))
                 return 0;
 
-        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM)
+        if (iwlmvm_mod_params.power_scheme == IWL_POWER_SCHEME_CAM ||
+            force_disable)
                 cmd.flags |= cpu_to_le16(DEVICE_POWER_FLAGS_CAM_MSK);
 
 #ifdef CONFIG_IWLWIFI_DEBUGFS
@@ -472,6 +501,78 @@ static int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
                                     &cmd);
 }
 
+static int iwl_mvm_power_update_device(struct iwl_mvm *mvm)
+{
+        return _iwl_mvm_power_update_device(mvm, false);
+}
+
+void iwl_mvm_power_vif_assoc(struct iwl_mvm *mvm, struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (memcmp(vif->bss_conf.bssid, mvmvif->uapsd_misbehaving_bssid,
+                   ETH_ALEN))
+                memset(mvmvif->uapsd_misbehaving_bssid, 0, ETH_ALEN);
+}
+
+static void iwl_mvm_power_uapsd_misbehav_ap_iterator(void *_data, u8 *mac,
+                                                     struct ieee80211_vif *vif)
+{
+        u8 *ap_sta_id = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        /* The ap_sta_id is not expected to change during current association
+         * so no explicit protection is needed
+         */
+        if (mvmvif->ap_sta_id == *ap_sta_id)
+                memcpy(mvmvif->uapsd_misbehaving_bssid, vif->bss_conf.bssid,
+                       ETH_ALEN);
+}
+
+int iwl_mvm_power_uapsd_misbehaving_ap_notif(struct iwl_mvm *mvm,
+                                             struct iwl_rx_cmd_buffer *rxb,
+                                             struct iwl_device_cmd *cmd)
+{
+        struct iwl_rx_packet *pkt = rxb_addr(rxb);
+        struct iwl_uapsd_misbehaving_ap_notif *notif = (void *)pkt->data;
+        u8 ap_sta_id = le32_to_cpu(notif->sta_id);
+
+        ieee80211_iterate_active_interfaces_atomic(
+                mvm->hw, IEEE80211_IFACE_ITER_NORMAL,
+                iwl_mvm_power_uapsd_misbehav_ap_iterator, &ap_sta_id);
+
+        return 0;
+}
+
+static void iwl_mvm_power_binding_iterator(void *_data, u8 *mac,
+                                           struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+        struct iwl_mvm *mvm = _data;
+        int ret;
+
+        mvmvif->pm_prevented = (mvm->bound_vif_cnt <= 1) ? false : true;
+
+        ret = iwl_mvm_power_mac_update_mode(mvm, vif);
+        WARN_ONCE(ret, "Failed to update power parameters on a specific vif\n");
+}
+
+static void _iwl_mvm_power_update_binding(struct iwl_mvm *mvm,
+                                          struct ieee80211_vif *vif,
+                                          bool assign)
+{
+        if (vif->type == NL80211_IFTYPE_MONITOR) {
+                int ret = _iwl_mvm_power_update_device(mvm, assign);
+                mvm->ps_prevented = assign;
+                WARN_ONCE(ret, "Failed to update power device state\n");
+        }
+
+        ieee80211_iterate_active_interfaces(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_power_binding_iterator,
+                                            mvm);
+}
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 static int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
                                         struct ieee80211_vif *vif, char *buf,
@@ -494,70 +595,58 @@ static int iwl_mvm_power_mac_dbgfs_read(struct iwl_mvm *mvm,
         pos += scnprintf(buf+pos, bufsz-pos, "keep_alive = %d\n",
                          le16_to_cpu(cmd.keep_alive_seconds));
 
-        if (cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)) {
-                pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
-                                 (cmd.flags &
-                                 cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ?
-                                 1 : 0);
-                pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
-                                 cmd.skip_dtim_periods);
-                if (!(cmd.flags &
-                      cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK))) {
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "rx_data_timeout = %d\n",
-                                         le32_to_cpu(cmd.rx_data_timeout));
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "tx_data_timeout = %d\n",
-                                         le32_to_cpu(cmd.tx_data_timeout));
-                }
-                if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "lprx_rssi_threshold = %d\n",
-                                         cmd.lprx_rssi_threshold);
-                if (cmd.flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)) {
-                        pos +=
-                        scnprintf(buf+pos, bufsz-pos,
-                                  "rx_data_timeout_uapsd = %d\n",
-                                  le32_to_cpu(cmd.rx_data_timeout_uapsd));
-                        pos +=
-                        scnprintf(buf+pos, bufsz-pos,
-                                  "tx_data_timeout_uapsd = %d\n",
-                                  le32_to_cpu(cmd.tx_data_timeout_uapsd));
-                        pos += scnprintf(buf+pos, bufsz-pos, "qndp_tid = %d\n",
-                                         cmd.qndp_tid);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "uapsd_ac_flags = 0x%x\n",
-                                         cmd.uapsd_ac_flags);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "uapsd_max_sp = %d\n",
-                                         cmd.uapsd_max_sp);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "heavy_tx_thld_packets = %d\n",
-                                         cmd.heavy_tx_thld_packets);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "heavy_rx_thld_packets = %d\n",
-                                         cmd.heavy_rx_thld_packets);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "heavy_tx_thld_percentage = %d\n",
-                                         cmd.heavy_tx_thld_percentage);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "heavy_rx_thld_percentage = %d\n",
-                                         cmd.heavy_rx_thld_percentage);
-                        pos +=
-                        scnprintf(buf+pos, bufsz-pos, "snooze_enable = %d\n",
-                                  (cmd.flags &
-                                   cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) ?
-                                  1 : 0);
-                }
-                if (cmd.flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)) {
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "snooze_interval = %d\n",
-                                         cmd.snooze_interval);
-                        pos += scnprintf(buf+pos, bufsz-pos,
-                                         "snooze_window = %d\n",
-                                         cmd.snooze_window);
-                }
+        if (!(cmd.flags & cpu_to_le16(POWER_FLAGS_POWER_MANAGEMENT_ENA_MSK)))
+                return pos;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "skip_over_dtim = %d\n",
+                         (cmd.flags &
+                         cpu_to_le16(POWER_FLAGS_SKIP_OVER_DTIM_MSK)) ? 1 : 0);
+        pos += scnprintf(buf+pos, bufsz-pos, "skip_dtim_periods = %d\n",
+                         cmd.skip_dtim_periods);
+        if (!(cmd.flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK))) {
+                pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.rx_data_timeout));
+                pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout = %d\n",
+                                 le32_to_cpu(cmd.tx_data_timeout));
         }
+        if (cmd.flags & cpu_to_le16(POWER_FLAGS_LPRX_ENA_MSK))
+                pos += scnprintf(buf+pos, bufsz-pos,
+                                 "lprx_rssi_threshold = %d\n",
+                                 cmd.lprx_rssi_threshold);
+
+        if (!(cmd.flags & cpu_to_le16(POWER_FLAGS_ADVANCE_PM_ENA_MSK)))
+                return pos;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "rx_data_timeout_uapsd = %d\n",
+                         le32_to_cpu(cmd.rx_data_timeout_uapsd));
+        pos += scnprintf(buf+pos, bufsz-pos, "tx_data_timeout_uapsd = %d\n",
+                         le32_to_cpu(cmd.tx_data_timeout_uapsd));
+        pos += scnprintf(buf+pos, bufsz-pos, "qndp_tid = %d\n", cmd.qndp_tid);
+        pos += scnprintf(buf+pos, bufsz-pos, "uapsd_ac_flags = 0x%x\n",
+                         cmd.uapsd_ac_flags);
+        pos += scnprintf(buf+pos, bufsz-pos, "uapsd_max_sp = %d\n",
+                         cmd.uapsd_max_sp);
+        pos += scnprintf(buf+pos, bufsz-pos, "heavy_tx_thld_packets = %d\n",
+                         cmd.heavy_tx_thld_packets);
+        pos += scnprintf(buf+pos, bufsz-pos, "heavy_rx_thld_packets = %d\n",
+                         cmd.heavy_rx_thld_packets);
+        pos += scnprintf(buf+pos, bufsz-pos, "heavy_tx_thld_percentage = %d\n",
+                         cmd.heavy_tx_thld_percentage);
+        pos += scnprintf(buf+pos, bufsz-pos, "heavy_rx_thld_percentage = %d\n",
+                         cmd.heavy_rx_thld_percentage);
+        pos += scnprintf(buf+pos, bufsz-pos, "uapsd_misbehaving_enable = %d\n",
+                         (cmd.flags &
+                          cpu_to_le16(POWER_FLAGS_UAPSD_MISBEHAVING_ENA_MSK)) ?
+                         1 : 0);
+
+        if (!(cmd.flags & cpu_to_le16(POWER_FLAGS_SNOOZE_ENA_MSK)))
+                return pos;
+
+        pos += scnprintf(buf+pos, bufsz-pos, "snooze_interval = %d\n",
+                         cmd.snooze_interval);
+        pos += scnprintf(buf+pos, bufsz-pos, "snooze_window = %d\n",
+                         cmd.snooze_window);
+
         return pos;
 }
 
@@ -654,6 +743,7 @@ const struct iwl_mvm_power_ops pm_mac_ops = {
         .power_update_mode = iwl_mvm_power_mac_update_mode,
         .power_update_device_mode = iwl_mvm_power_update_device,
         .power_disable = iwl_mvm_power_mac_disable,
+        .power_update_binding = _iwl_mvm_power_update_binding,
 #ifdef CONFIG_IWLWIFI_DEBUGFS
         .power_dbgfs_read = iwl_mvm_power_mac_dbgfs_read,
 #endif
diff --git a/drivers/net/wireless/iwlwifi/mvm/power_legacy.c b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
index 2ce79bad5845..ef712ae5bc62 100644
--- a/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
+++ b/drivers/net/wireless/iwlwifi/mvm/power_legacy.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/quota.c b/drivers/net/wireless/iwlwifi/mvm/quota.c
index 17e2bc827f9a..ce5db6c4ef7e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/quota.c
+++ b/drivers/net/wireless/iwlwifi/mvm/quota.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -217,8 +217,7 @@ int iwl_mvm_update_quotas(struct iwl_mvm *mvm, struct ieee80211_vif *newvif)
                 } else {
                         cmd.quotas[idx].quota =
                                 cpu_to_le32(quota * data.n_interfaces[i]);
-                        cmd.quotas[idx].max_duration =
-                                cpu_to_le32(IWL_MVM_MAX_QUOTA);
+                        cmd.quotas[idx].max_duration = cpu_to_le32(0);
                 }
                 idx++;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.c b/drivers/net/wireless/iwlwifi/mvm/rs.c
index a0b4cc8d9c3b..6abf74e1351f 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -24,7 +24,6 @@
  *
  *****************************************************************************/
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <net/mac80211.h>
@@ -42,33 +41,37 @@
 
 #define RS_NAME "iwl-mvm-rs"
 
-#define NUM_TRY_BEFORE_ANT_TOGGLE 1
-#define IWL_NUMBER_TRY      1
-#define IWL_HT_NUMBER_TRY   3
+#define NUM_TRY_BEFORE_ANT_TOGGLE       1
+#define RS_LEGACY_RETRIES_PER_RATE      1
+#define RS_HT_VHT_RETRIES_PER_RATE      2
+#define RS_HT_VHT_RETRIES_PER_RATE_TW   1
+#define RS_INITIAL_MIMO_NUM_RATES       3
+#define RS_INITIAL_SISO_NUM_RATES       3
+#define RS_INITIAL_LEGACY_NUM_RATES     LINK_QUAL_MAX_RETRY_NUM
+#define RS_SECONDARY_LEGACY_NUM_RATES   LINK_QUAL_MAX_RETRY_NUM
+#define RS_SECONDARY_SISO_NUM_RATES     3
+#define RS_SECONDARY_SISO_RETRIES       1
 
 #define IWL_RATE_MAX_WINDOW             62      /* # tx in history window */
-#define IWL_RATE_MIN_FAILURE_TH         6       /* min failures to calc tpt */
+#define IWL_RATE_MIN_FAILURE_TH         3       /* min failures to calc tpt */
 #define IWL_RATE_MIN_SUCCESS_TH         8       /* min successes to calc tpt */
 
 /* max allowed rate miss before sync LQ cmd */
 #define IWL_MISSED_RATE_MAX             15
-/* max time to accum history 2 seconds */
-#define IWL_RATE_SCALE_FLUSH_INTVL   (3*HZ)
+#define RS_STAY_IN_COLUMN_TIMEOUT       (5*HZ)
+
 
 static u8 rs_ht_to_legacy[] = {
-        [IWL_RATE_1M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_2M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_5M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_11M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_6M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_9M_INDEX] = IWL_RATE_6M_INDEX,
-        [IWL_RATE_12M_INDEX] = IWL_RATE_9M_INDEX,
-        [IWL_RATE_18M_INDEX] = IWL_RATE_12M_INDEX,
-        [IWL_RATE_24M_INDEX] = IWL_RATE_18M_INDEX,
-        [IWL_RATE_36M_INDEX] = IWL_RATE_24M_INDEX,
-        [IWL_RATE_48M_INDEX] = IWL_RATE_36M_INDEX,
-        [IWL_RATE_54M_INDEX] = IWL_RATE_48M_INDEX,
-        [IWL_RATE_60M_INDEX] = IWL_RATE_54M_INDEX,
+        [IWL_RATE_MCS_0_INDEX] = IWL_RATE_6M_INDEX,
+        [IWL_RATE_MCS_1_INDEX] = IWL_RATE_9M_INDEX,
+        [IWL_RATE_MCS_2_INDEX] = IWL_RATE_12M_INDEX,
+        [IWL_RATE_MCS_3_INDEX] = IWL_RATE_18M_INDEX,
+        [IWL_RATE_MCS_4_INDEX] = IWL_RATE_24M_INDEX,
+        [IWL_RATE_MCS_5_INDEX] = IWL_RATE_36M_INDEX,
+        [IWL_RATE_MCS_6_INDEX] = IWL_RATE_48M_INDEX,
+        [IWL_RATE_MCS_7_INDEX] = IWL_RATE_54M_INDEX,
+        [IWL_RATE_MCS_8_INDEX] = IWL_RATE_54M_INDEX,
+        [IWL_RATE_MCS_9_INDEX] = IWL_RATE_54M_INDEX,
 };
 
 static const u8 ant_toggle_lookup[] = {
@@ -126,6 +129,196 @@ static const struct iwl_rs_rate_info iwl_rates[IWL_RATE_COUNT] = {
         IWL_DECLARE_MCS_RATE(9),                 /* MCS 9 */
 };
 
+enum rs_action {
+        RS_ACTION_STAY = 0,
+        RS_ACTION_DOWNSCALE = -1,
+        RS_ACTION_UPSCALE = 1,
+};
+
+enum rs_column_mode {
+        RS_INVALID = 0,
+        RS_LEGACY,
+        RS_SISO,
+        RS_MIMO2,
+};
+
+#define MAX_NEXT_COLUMNS 5
+#define MAX_COLUMN_CHECKS 3
+
+typedef bool (*allow_column_func_t) (struct iwl_mvm *mvm,
+                                     struct ieee80211_sta *sta,
+                                     struct iwl_scale_tbl_info *tbl);
+
+struct rs_tx_column {
+        enum rs_column_mode mode;
+        u8 ant;
+        bool sgi;
+        enum rs_column next_columns[MAX_NEXT_COLUMNS];
+        allow_column_func_t checks[MAX_COLUMN_CHECKS];
+};
+
+static bool rs_mimo_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                          struct iwl_scale_tbl_info *tbl)
+{
+        if (!sta->ht_cap.ht_supported)
+                return false;
+
+        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
+                return false;
+
+        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 2)
+                return false;
+
+        if (!iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
+                return false;
+
+        return true;
+}
+
+static bool rs_siso_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                          struct iwl_scale_tbl_info *tbl)
+{
+        if (!sta->ht_cap.ht_supported)
+                return false;
+
+        return true;
+}
+
+static bool rs_sgi_allow(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
+                         struct iwl_scale_tbl_info *tbl)
+{
+        struct rs_rate *rate = &tbl->rate;
+        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
+        struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
+
+        if (is_ht20(rate) && (ht_cap->cap &
+                             IEEE80211_HT_CAP_SGI_20))
+                return true;
+        if (is_ht40(rate) && (ht_cap->cap &
+                             IEEE80211_HT_CAP_SGI_40))
+                return true;
+        if (is_ht80(rate) && (vht_cap->cap &
+                             IEEE80211_VHT_CAP_SHORT_GI_80))
+                return true;
+
+        return false;
+}
+
+static const struct rs_tx_column rs_tx_columns[] = {
+        [RS_COLUMN_LEGACY_ANT_A] = {
+                .mode = RS_LEGACY,
+                .ant = ANT_A,
+                .next_columns = {
+                        RS_COLUMN_LEGACY_ANT_B,
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+        },
+        [RS_COLUMN_LEGACY_ANT_B] = {
+                .mode = RS_LEGACY,
+                .ant = ANT_B,
+                .next_columns = {
+                        RS_COLUMN_LEGACY_ANT_A,
+                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+        },
+        [RS_COLUMN_SISO_ANT_A] = {
+                .mode = RS_SISO,
+                .ant = ANT_A,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_siso_allow,
+                },
+        },
+        [RS_COLUMN_SISO_ANT_B] = {
+                .mode = RS_SISO,
+                .ant = ANT_B,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_SISO_ANT_B_SGI,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_siso_allow,
+                },
+        },
+        [RS_COLUMN_SISO_ANT_A_SGI] = {
+                .mode = RS_SISO,
+                .ant = ANT_A,
+                .sgi = true,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_B_SGI,
+                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_siso_allow,
+                        rs_sgi_allow,
+                },
+        },
+        [RS_COLUMN_SISO_ANT_B_SGI] = {
+                .mode = RS_SISO,
+                .ant = ANT_B,
+                .sgi = true,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_SISO_ANT_B,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_siso_allow,
+                        rs_sgi_allow,
+                },
+        },
+        [RS_COLUMN_MIMO2] = {
+                .mode = RS_MIMO2,
+                .ant = ANT_AB,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_A,
+                        RS_COLUMN_MIMO2_SGI,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_mimo_allow,
+                },
+        },
+        [RS_COLUMN_MIMO2_SGI] = {
+                .mode = RS_MIMO2,
+                .ant = ANT_AB,
+                .sgi = true,
+                .next_columns = {
+                        RS_COLUMN_SISO_ANT_A_SGI,
+                        RS_COLUMN_MIMO2,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                        RS_COLUMN_INVALID,
+                },
+                .checks = {
+                        rs_mimo_allow,
+                        rs_sgi_allow,
+                },
+        },
+};
+
 static inline u8 rs_extract_rate(u32 rate_n_flags)
 {
         /* also works for HT because bits 7:6 are zero there */
@@ -163,28 +356,19 @@ static int iwl_hwrate_to_plcp_idx(u32 rate_n_flags)
                                 return idx;
         }
 
-        return -1;
+        return IWL_RATE_INVALID;
 }
 
 static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                                    struct sk_buff *skb,
                                    struct ieee80211_sta *sta,
                                    struct iwl_lq_sta *lq_sta);
-static void rs_fill_link_cmd(struct iwl_mvm *mvm,
-                             struct ieee80211_sta *sta,
-                             struct iwl_lq_sta *lq_sta, u32 rate_n_flags);
+static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
+                           struct ieee80211_sta *sta,
+                           struct iwl_lq_sta *lq_sta,
+                           const struct rs_rate *initial_rate);
 static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search);
 
-
-#ifdef CONFIG_MAC80211_DEBUGFS
-static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags);
-#else
-static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags)
-{}
-#endif
-
 /**
  * The following tables contain the expected throughput metrics for all rates
  *
@@ -264,6 +448,52 @@ static const struct iwl_rate_mcs_info iwl_rate_mcs[IWL_RATE_COUNT] = {
 
 #define MCS_INDEX_PER_STREAM    (8)
 
+static const char *rs_pretty_ant(u8 ant)
+{
+        static const char * const ant_name[] = {
+                [ANT_NONE] = "None",
+                [ANT_A]    = "A",
+                [ANT_B]    = "B",
+                [ANT_AB]   = "AB",
+                [ANT_C]    = "C",
+                [ANT_AC]   = "AC",
+                [ANT_BC]   = "BC",
+                [ANT_ABC]  = "ABC",
+        };
+
+        if (ant > ANT_ABC)
+                return "UNKNOWN";
+
+        return ant_name[ant];
+}
+
+static const char *rs_pretty_lq_type(enum iwl_table_type type)
+{
+        static const char * const lq_types[] = {
+                [LQ_NONE] = "NONE",
+                [LQ_LEGACY_A] = "LEGACY_A",
+                [LQ_LEGACY_G] = "LEGACY_G",
+                [LQ_HT_SISO] = "HT SISO",
+                [LQ_HT_MIMO2] = "HT MIMO",
+                [LQ_VHT_SISO] = "VHT SISO",
+                [LQ_VHT_MIMO2] = "VHT MIMO",
+        };
+
+        if (type < LQ_NONE || type >= LQ_MAX)
+                return "UNKNOWN";
+
+        return lq_types[type];
+}
+
+static inline void rs_dump_rate(struct iwl_mvm *mvm, const struct rs_rate *rate,
+                                const char *prefix)
+{
+        IWL_DEBUG_RATE(mvm, "%s: (%s: %d) ANT: %s BW: %d SGI: %d\n",
+                       prefix, rs_pretty_lq_type(rate->type),
+                       rate->index, rs_pretty_ant(rate->ant),
+                       rate->bw, rate->sgi);
+}
+
 static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
 {
         window->data = 0;
@@ -271,7 +501,6 @@ static void rs_rate_scale_clear_window(struct iwl_rate_scale_data *window)
         window->success_ratio = IWL_INVALID_VALUE;
         window->counter = 0;
         window->average_tpt = IWL_INVALID_VALUE;
-        window->stamp = 0;
 }
 
 static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
@@ -279,30 +508,6 @@ static inline u8 rs_is_valid_ant(u8 valid_antenna, u8 ant_type)
         return (ant_type & valid_antenna) == ant_type;
 }
 
-#ifdef CONFIG_MAC80211_DEBUGFS
-/**
- * Program the device to use fixed rate for frame transmit
- * This is for debugging/testing only
- * once the device start use fixed rate, we need to reload the module
- * to being back the normal operation.
- */
-static void rs_program_fix_rate(struct iwl_mvm *mvm,
-                                struct iwl_lq_sta *lq_sta)
-{
-        lq_sta->active_legacy_rate = 0x0FFF;    /* 1 - 54 MBits, includes CCK */
-        lq_sta->active_siso_rate   = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
-        lq_sta->active_mimo2_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
-
-        IWL_DEBUG_RATE(mvm, "sta_id %d rate 0x%X\n",
-                       lq_sta->lq.sta_id, lq_sta->dbg_fixed_rate);
-
-        if (lq_sta->dbg_fixed_rate) {
-                rs_fill_link_cmd(NULL, NULL, lq_sta, lq_sta->dbg_fixed_rate);
-                iwl_mvm_send_lq_cmd(lq_sta->drv, &lq_sta->lq, CMD_ASYNC, false);
-        }
-}
-#endif
-
 static int rs_tl_turn_on_agg_for_tid(struct iwl_mvm *mvm,
                                       struct iwl_lq_sta *lq_data, u8 tid,
                                       struct ieee80211_sta *sta)
@@ -428,192 +633,168 @@ static int rs_collect_tx_data(struct iwl_scale_tbl_info *tbl,
         else
                 window->average_tpt = IWL_INVALID_VALUE;
 
-        /* Tag this window as having been updated */
-        window->stamp = jiffies;
-
         return 0;
 }
 
-/*
- * Fill uCode API rate_n_flags field, based on "search" or "active" table.
- */
-/* FIXME:RS:remove this function and put the flags statically in the table */
-static u32 rate_n_flags_from_tbl(struct iwl_mvm *mvm,
-                                 struct iwl_scale_tbl_info *tbl, int index)
+/* Convert rs_rate object into ucode rate bitmask */
+static u32 ucode_rate_from_rs_rate(struct iwl_mvm *mvm,
+                                  struct rs_rate *rate)
 {
-        u32 rate_n_flags = 0;
+        u32 ucode_rate = 0;
+        int index = rate->index;
 
-        rate_n_flags |= ((tbl->ant_type << RATE_MCS_ANT_POS) &
+        ucode_rate |= ((rate->ant << RATE_MCS_ANT_POS) &
                          RATE_MCS_ANT_ABC_MSK);
 
-        if (is_legacy(tbl->lq_type)) {
-                rate_n_flags |= iwl_rates[index].plcp;
+        if (is_legacy(rate)) {
+                ucode_rate |= iwl_rates[index].plcp;
                 if (index >= IWL_FIRST_CCK_RATE && index <= IWL_LAST_CCK_RATE)
-                        rate_n_flags |= RATE_MCS_CCK_MSK;
-                return rate_n_flags;
+                        ucode_rate |= RATE_MCS_CCK_MSK;
+                return ucode_rate;
         }
 
-        if (is_ht(tbl->lq_type)) {
+        if (is_ht(rate)) {
                 if (index < IWL_FIRST_HT_RATE || index > IWL_LAST_HT_RATE) {
                         IWL_ERR(mvm, "Invalid HT rate index %d\n", index);
                         index = IWL_LAST_HT_RATE;
                 }
-                rate_n_flags |= RATE_MCS_HT_MSK;
+                ucode_rate |= RATE_MCS_HT_MSK;
 
-                if (is_ht_siso(tbl->lq_type))
-                        rate_n_flags |= iwl_rates[index].plcp_ht_siso;
-                else if (is_ht_mimo2(tbl->lq_type))
-                        rate_n_flags |= iwl_rates[index].plcp_ht_mimo2;
+                if (is_ht_siso(rate))
+                        ucode_rate |= iwl_rates[index].plcp_ht_siso;
+                else if (is_ht_mimo2(rate))
+                        ucode_rate |= iwl_rates[index].plcp_ht_mimo2;
                 else
                         WARN_ON_ONCE(1);
-        } else if (is_vht(tbl->lq_type)) {
+        } else if (is_vht(rate)) {
                 if (index < IWL_FIRST_VHT_RATE || index > IWL_LAST_VHT_RATE) {
                         IWL_ERR(mvm, "Invalid VHT rate index %d\n", index);
                         index = IWL_LAST_VHT_RATE;
                 }
-                rate_n_flags |= RATE_MCS_VHT_MSK;
-                if (is_vht_siso(tbl->lq_type))
-                        rate_n_flags |= iwl_rates[index].plcp_vht_siso;
-                else if (is_vht_mimo2(tbl->lq_type))
-                        rate_n_flags |= iwl_rates[index].plcp_vht_mimo2;
+                ucode_rate |= RATE_MCS_VHT_MSK;
+                if (is_vht_siso(rate))
+                        ucode_rate |= iwl_rates[index].plcp_vht_siso;
+                else if (is_vht_mimo2(rate))
+                        ucode_rate |= iwl_rates[index].plcp_vht_mimo2;
                 else
                         WARN_ON_ONCE(1);
 
         } else {
-                IWL_ERR(mvm, "Invalid tbl->lq_type %d\n", tbl->lq_type);
+                IWL_ERR(mvm, "Invalid rate->type %d\n", rate->type);
         }
 
-        rate_n_flags |= tbl->bw;
-        if (tbl->is_SGI)
-                rate_n_flags |= RATE_MCS_SGI_MSK;
+        ucode_rate |= rate->bw;
+        if (rate->sgi)
+                ucode_rate |= RATE_MCS_SGI_MSK;
 
-        return rate_n_flags;
+        return ucode_rate;
 }
 
-/*
- * Interpret uCode API's rate_n_flags format,
- * fill "search" or "active" tx mode table.
- */
-static int rs_get_tbl_info_from_mcs(const u32 rate_n_flags,
-                                    enum ieee80211_band band,
-                                    struct iwl_scale_tbl_info *tbl,
-                                    int *rate_idx)
+/* Convert a ucode rate into an rs_rate object */
+static int rs_rate_from_ucode_rate(const u32 ucode_rate,
+                                   enum ieee80211_band band,
+                                   struct rs_rate *rate)
 {
-        u32 ant_msk = (rate_n_flags & RATE_MCS_ANT_ABC_MSK);
-        u8 num_of_ant = get_num_of_ant_from_rate(rate_n_flags);
+        u32 ant_msk = ucode_rate & RATE_MCS_ANT_ABC_MSK;
+        u8 num_of_ant = get_num_of_ant_from_rate(ucode_rate);
         u8 nss;
 
-        memset(tbl, 0, offsetof(struct iwl_scale_tbl_info, win));
-        *rate_idx = iwl_hwrate_to_plcp_idx(rate_n_flags);
+        memset(rate, 0, sizeof(*rate));
+        rate->index = iwl_hwrate_to_plcp_idx(ucode_rate);
 
-        if (*rate_idx  == IWL_RATE_INVALID) {
-                *rate_idx = -1;
+        if (rate->index == IWL_RATE_INVALID)
                 return -EINVAL;
-        }
-        tbl->is_SGI = 0;        /* default legacy setup */
-        tbl->bw = 0;
-        tbl->ant_type = (ant_msk >> RATE_MCS_ANT_POS);
-        tbl->lq_type = LQ_NONE;
-        tbl->max_search = IWL_MAX_SEARCH;
+
+        rate->ant = (ant_msk >> RATE_MCS_ANT_POS);
 
         /* Legacy */
-        if (!(rate_n_flags & RATE_MCS_HT_MSK) &&
-            !(rate_n_flags & RATE_MCS_VHT_MSK)) {
+        if (!(ucode_rate & RATE_MCS_HT_MSK) &&
+            !(ucode_rate & RATE_MCS_VHT_MSK)) {
                 if (num_of_ant == 1) {
                         if (band == IEEE80211_BAND_5GHZ)
-                                tbl->lq_type = LQ_LEGACY_A;
+                                rate->type = LQ_LEGACY_A;
                         else
-                                tbl->lq_type = LQ_LEGACY_G;
+                                rate->type = LQ_LEGACY_G;
                 }
 
                 return 0;
         }
 
         /* HT or VHT */
-        if (rate_n_flags & RATE_MCS_SGI_MSK)
-                tbl->is_SGI = 1;
+        if (ucode_rate & RATE_MCS_SGI_MSK)
+                rate->sgi = true;
 
-        tbl->bw = rate_n_flags & RATE_MCS_CHAN_WIDTH_MSK;
+        rate->bw = ucode_rate & RATE_MCS_CHAN_WIDTH_MSK;
 
-        if (rate_n_flags & RATE_MCS_HT_MSK) {
-                nss = ((rate_n_flags & RATE_HT_MCS_NSS_MSK) >>
+        if (ucode_rate & RATE_MCS_HT_MSK) {
+                nss = ((ucode_rate & RATE_HT_MCS_NSS_MSK) >>
                        RATE_HT_MCS_NSS_POS) + 1;
 
                 if (nss == 1) {
-                        tbl->lq_type = LQ_HT_SISO;
+                        rate->type = LQ_HT_SISO;
                         WARN_ON_ONCE(num_of_ant != 1);
                 } else if (nss == 2) {
-                        tbl->lq_type = LQ_HT_MIMO2;
+                        rate->type = LQ_HT_MIMO2;
                         WARN_ON_ONCE(num_of_ant != 2);
                 } else {
                         WARN_ON_ONCE(1);
                 }
-        } else if (rate_n_flags & RATE_MCS_VHT_MSK) {
-                nss = ((rate_n_flags & RATE_VHT_MCS_NSS_MSK) >>
+        } else if (ucode_rate & RATE_MCS_VHT_MSK) {
+                nss = ((ucode_rate & RATE_VHT_MCS_NSS_MSK) >>
                        RATE_VHT_MCS_NSS_POS) + 1;
 
                 if (nss == 1) {
-                        tbl->lq_type = LQ_VHT_SISO;
+                        rate->type = LQ_VHT_SISO;
                         WARN_ON_ONCE(num_of_ant != 1);
                 } else if (nss == 2) {
-                        tbl->lq_type = LQ_VHT_MIMO2;
+                        rate->type = LQ_VHT_MIMO2;
                         WARN_ON_ONCE(num_of_ant != 2);
                 } else {
                         WARN_ON_ONCE(1);
                 }
         }
 
-        WARN_ON_ONCE(tbl->bw == RATE_MCS_CHAN_WIDTH_160);
-        WARN_ON_ONCE(tbl->bw == RATE_MCS_CHAN_WIDTH_80 &&
-                     !is_vht(tbl->lq_type));
+        WARN_ON_ONCE(rate->bw == RATE_MCS_CHAN_WIDTH_160);
+        WARN_ON_ONCE(rate->bw == RATE_MCS_CHAN_WIDTH_80 &&
+                     !is_vht(rate));
 
         return 0;
 }
 
 /* switch to another antenna/antennas and return 1 */
 /* if no other valid antenna found, return 0 */
-static int rs_toggle_antenna(u32 valid_ant, u32 *rate_n_flags,
-                             struct iwl_scale_tbl_info *tbl)
+static int rs_toggle_antenna(u32 valid_ant, struct rs_rate *rate)
 {
         u8 new_ant_type;
 
-        if (!tbl->ant_type || tbl->ant_type > ANT_ABC)
+        if (!rate->ant || rate->ant > ANT_ABC)
                 return 0;
 
-        if (!rs_is_valid_ant(valid_ant, tbl->ant_type))
+        if (!rs_is_valid_ant(valid_ant, rate->ant))
                 return 0;
 
-        new_ant_type = ant_toggle_lookup[tbl->ant_type];
+        new_ant_type = ant_toggle_lookup[rate->ant];
 
-        while ((new_ant_type != tbl->ant_type) &&
+        while ((new_ant_type != rate->ant) &&
                !rs_is_valid_ant(valid_ant, new_ant_type))
                 new_ant_type = ant_toggle_lookup[new_ant_type];
 
-        if (new_ant_type == tbl->ant_type)
+        if (new_ant_type == rate->ant)
                 return 0;
 
-        tbl->ant_type = new_ant_type;
-        *rate_n_flags &= ~RATE_MCS_ANT_ABC_MSK;
-        *rate_n_flags |= new_ant_type << RATE_MCS_ANT_POS;
+        rate->ant = new_ant_type;
+
         return 1;
 }
 
-/**
- * rs_get_supported_rates - get the available rates
- *
- * if management frame or broadcast frame only return
- * basic available rates.
- *
- */
 static u16 rs_get_supported_rates(struct iwl_lq_sta *lq_sta,
-                                  struct ieee80211_hdr *hdr,
-                                  enum iwl_table_type rate_type)
+                                  struct rs_rate *rate)
 {
-        if (is_legacy(rate_type))
+        if (is_legacy(rate))
                 return lq_sta->active_legacy_rate;
-        else if (is_siso(rate_type))
+        else if (is_siso(rate))
                 return lq_sta->active_siso_rate;
-        else if (is_mimo2(rate_type))
+        else if (is_mimo2(rate))
                 return lq_sta->active_mimo2_rate;
 
         WARN_ON_ONCE(1);
@@ -628,7 +809,7 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
 
         /* 802.11A or ht walks to the next literal adjacent rate in
          * the rate table */
-        if (is_a_band(rate_type) || !is_legacy(rate_type)) {
+        if (is_type_a_band(rate_type) || !is_type_legacy(rate_type)) {
                 int i;
                 u32 mask;
 
@@ -676,73 +857,80 @@ static u16 rs_get_adjacent_rate(struct iwl_mvm *mvm, u8 index, u16 rate_mask,
         return (high << 8) | low;
 }
 
-static u32 rs_get_lower_rate(struct iwl_lq_sta *lq_sta,
-                             struct iwl_scale_tbl_info *tbl,
-                             u8 scale_index, u8 ht_possible)
+static inline bool rs_rate_supported(struct iwl_lq_sta *lq_sta,
+                                     struct rs_rate *rate)
 {
-        s32 low;
-        u16 rate_mask;
+        return BIT(rate->index) & rs_get_supported_rates(lq_sta, rate);
+}
+
+/* Get the next supported lower rate in the current column.
+ * Return true if bottom rate in the current column was reached
+ */
+static bool rs_get_lower_rate_in_column(struct iwl_lq_sta *lq_sta,
+                                        struct rs_rate *rate)
+{
+        u8 low;
         u16 high_low;
-        u8 switch_to_legacy = 0;
+        u16 rate_mask;
         struct iwl_mvm *mvm = lq_sta->drv;
 
-        /* check if we need to switch from HT to legacy rates.
-         * assumption is that mandatory rates (1Mbps or 6Mbps)
-         * are always supported (spec demand) */
-        if (!is_legacy(tbl->lq_type) && (!ht_possible || !scale_index)) {
-                switch_to_legacy = 1;
-                scale_index = rs_ht_to_legacy[scale_index];
-                if (lq_sta->band == IEEE80211_BAND_5GHZ)
-                        tbl->lq_type = LQ_LEGACY_A;
-                else
-                        tbl->lq_type = LQ_LEGACY_G;
+        rate_mask = rs_get_supported_rates(lq_sta, rate);
+        high_low = rs_get_adjacent_rate(mvm, rate->index, rate_mask,
+                                        rate->type);
+        low = high_low & 0xff;
 
-                if (num_of_ant(tbl->ant_type) > 1)
-                        tbl->ant_type =
-                            first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
+        /* Bottom rate of column reached */
+        if (low == IWL_RATE_INVALID)
+                return true;
 
-                tbl->bw = 0;
-                tbl->is_SGI = 0;
-                tbl->max_search = IWL_MAX_SEARCH;
-        }
+        rate->index = low;
+        return false;
+}
 
-        rate_mask = rs_get_supported_rates(lq_sta, NULL, tbl->lq_type);
+/* Get the next rate to use following a column downgrade */
+static void rs_get_lower_rate_down_column(struct iwl_lq_sta *lq_sta,
+                                          struct rs_rate *rate)
+{
+        struct iwl_mvm *mvm = lq_sta->drv;
 
-        /* Mask with station rate restriction */
-        if (is_legacy(tbl->lq_type)) {
-                /* supp_rates has no CCK bits in A mode */
+        if (is_legacy(rate)) {
+                /* No column to downgrade from Legacy */
+                return;
+        } else if (is_siso(rate)) {
+                /* Downgrade to Legacy if we were in SISO */
                 if (lq_sta->band == IEEE80211_BAND_5GHZ)
-                        rate_mask  = (u16)(rate_mask &
-                           (lq_sta->supp_rates << IWL_FIRST_OFDM_RATE));
+                        rate->type = LQ_LEGACY_A;
                 else
-                        rate_mask = (u16)(rate_mask & lq_sta->supp_rates);
-        }
+                        rate->type = LQ_LEGACY_G;
 
-        /* If we switched from HT to legacy, check current rate */
-        if (switch_to_legacy && (rate_mask & (1 << scale_index))) {
-                low = scale_index;
-                goto out;
+                rate->bw = RATE_MCS_CHAN_WIDTH_20;
+
+                WARN_ON_ONCE(rate->index < IWL_RATE_MCS_0_INDEX &&
+                             rate->index > IWL_RATE_MCS_9_INDEX);
+
+                rate->index = rs_ht_to_legacy[rate->index];
+        } else {
+                /* Downgrade to SISO with same MCS if in MIMO  */
+                rate->type = is_vht_mimo2(rate) ?
+                        LQ_VHT_SISO : LQ_HT_SISO;
         }
 
-        high_low = rs_get_adjacent_rate(lq_sta->drv, scale_index, rate_mask,
-                                        tbl->lq_type);
-        low = high_low & 0xff;
 
-        if (low == IWL_RATE_INVALID)
-                low = scale_index;
+        if (num_of_ant(rate->ant) > 1)
+                rate->ant = first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
 
-out:
-        return rate_n_flags_from_tbl(lq_sta->drv, tbl, low);
+        /* Relevant in both switching to SISO or Legacy */
+        rate->sgi = false;
+
+        if (!rs_rate_supported(lq_sta, rate))
+                rs_get_lower_rate_in_column(lq_sta, rate);
 }
 
-/*
- * Simple function to compare two rate scale table types
- */
-static bool table_type_matches(struct iwl_scale_tbl_info *a,
-                               struct iwl_scale_tbl_info *b)
+/* Simple function to compare two rate scale table types */
+static inline bool rs_rate_match(struct rs_rate *a,
+                                 struct rs_rate *b)
 {
-        return (a->lq_type == b->lq_type) && (a->ant_type == b->ant_type) &&
-                (a->is_SGI == b->is_SGI);
+        return (a->type == b->type) && (a->ant == b->ant) && (a->sgi == b->sgi);
 }
 
 static u32 rs_ch_width_from_mac_flags(enum mac80211_rate_control_flags flags)
@@ -766,7 +954,7 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
 {
         int legacy_success;
         int retries;
-        int rs_index, mac_index, i;
+        int mac_index, i;
         struct iwl_lq_sta *lq_sta = priv_sta;
         struct iwl_lq_cmd *table;
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
@@ -774,13 +962,10 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
         struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         enum mac80211_rate_control_flags mac_flags;
-        u32 tx_rate;
-        struct iwl_scale_tbl_info tbl_type;
+        u32 ucode_rate;
+        struct rs_rate rate;
         struct iwl_scale_tbl_info *curr_tbl, *other_tbl, *tmp_tbl;
 
-        IWL_DEBUG_RATE_LIMIT(mvm,
-                             "get frame ack response, update rate scale window\n");
-
         /* Treat uninitialized rate scaling data same as non-existing. */
         if (!lq_sta) {
                 IWL_DEBUG_RATE(mvm, "Station rate scaling not created yet.\n");
@@ -808,10 +993,10 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
          * to a new "search" mode (which might become the new "active" mode).
          */
         table = &lq_sta->lq;
-        tx_rate = le32_to_cpu(table->rs_table[0]);
-        rs_get_tbl_info_from_mcs(tx_rate, info->band, &tbl_type, &rs_index);
+        ucode_rate = le32_to_cpu(table->rs_table[0]);
+        rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
         if (info->band == IEEE80211_BAND_5GHZ)
-                rs_index -= IWL_FIRST_OFDM_RATE;
+                rate.index -= IWL_FIRST_OFDM_RATE;
         mac_flags = info->status.rates[0].flags;
         mac_index = info->status.rates[0].idx;
         /* For HT packets, map MCS to PLCP */
@@ -834,19 +1019,19 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
 
         /* Here we actually compare this rate to the latest LQ command */
         if ((mac_index < 0) ||
-            (tbl_type.is_SGI != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
-            (tbl_type.bw != rs_ch_width_from_mac_flags(mac_flags)) ||
-            (tbl_type.ant_type != info->status.antenna) ||
-            (!!(tx_rate & RATE_MCS_HT_MSK) !=
+            (rate.sgi != !!(mac_flags & IEEE80211_TX_RC_SHORT_GI)) ||
+            (rate.bw != rs_ch_width_from_mac_flags(mac_flags)) ||
+            (rate.ant != info->status.antenna) ||
+            (!!(ucode_rate & RATE_MCS_HT_MSK) !=
              !!(mac_flags & IEEE80211_TX_RC_MCS)) ||
-            (!!(tx_rate & RATE_MCS_VHT_MSK) !=
+            (!!(ucode_rate & RATE_MCS_VHT_MSK) !=
              !!(mac_flags & IEEE80211_TX_RC_VHT_MCS)) ||
-            (!!(tx_rate & RATE_HT_MCS_GF_MSK) !=
+            (!!(ucode_rate & RATE_HT_MCS_GF_MSK) !=
              !!(mac_flags & IEEE80211_TX_RC_GREEN_FIELD)) ||
-            (rs_index != mac_index)) {
+            (rate.index != mac_index)) {
                 IWL_DEBUG_RATE(mvm,
                                "initial rate %d does not match %d (0x%x)\n",
-                               mac_index, rs_index, tx_rate);
+                               mac_index, rate.index, ucode_rate);
                 /*
                  * Since rates mis-match, the last LQ command may have failed.
                  * After IWL_MISSED_RATE_MAX mis-matches, resync the uCode with
@@ -855,7 +1040,10 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                 lq_sta->missed_rate_counter++;
                 if (lq_sta->missed_rate_counter > IWL_MISSED_RATE_MAX) {
                         lq_sta->missed_rate_counter = 0;
-                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, CMD_ASYNC, false);
+                        IWL_DEBUG_RATE(mvm,
+                                       "Too many rates mismatch. Send sync LQ. rs_state %d\n",
+                                       lq_sta->rs_state);
+                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
                 }
                 /* Regardless, ignore this status info for outdated rate */
                 return;
@@ -864,28 +1052,23 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                 lq_sta->missed_rate_counter = 0;
 
         /* Figure out if rate scale algorithm is in active or search table */
-        if (table_type_matches(&tbl_type,
-                               &(lq_sta->lq_info[lq_sta->active_tbl]))) {
+        if (rs_rate_match(&rate,
+                          &(lq_sta->lq_info[lq_sta->active_tbl].rate))) {
                 curr_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
                 other_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
-        } else if (table_type_matches(
-                        &tbl_type, &lq_sta->lq_info[1 - lq_sta->active_tbl])) {
+        } else if (rs_rate_match(&rate,
+                         &lq_sta->lq_info[1 - lq_sta->active_tbl].rate)) {
                 curr_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
                 other_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
         } else {
                 IWL_DEBUG_RATE(mvm,
                                "Neither active nor search matches tx rate\n");
                 tmp_tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                IWL_DEBUG_RATE(mvm, "active- lq:%x, ant:%x, SGI:%d\n",
-                               tmp_tbl->lq_type, tmp_tbl->ant_type,
-                               tmp_tbl->is_SGI);
+                rs_dump_rate(mvm, &tmp_tbl->rate, "ACTIVE");
                 tmp_tbl = &(lq_sta->lq_info[1 - lq_sta->active_tbl]);
-                IWL_DEBUG_RATE(mvm, "search- lq:%x, ant:%x, SGI:%d\n",
-                               tmp_tbl->lq_type, tmp_tbl->ant_type,
-                               tmp_tbl->is_SGI);
-                IWL_DEBUG_RATE(mvm, "actual- lq:%x, ant:%x, SGI:%d\n",
-                               tbl_type.lq_type, tbl_type.ant_type,
-                               tbl_type.is_SGI);
+                rs_dump_rate(mvm, &tmp_tbl->rate, "SEARCH");
+                rs_dump_rate(mvm, &rate, "ACTUAL");
+
                 /*
                  * no matching table found, let's by-pass the data collection
                  * and continue to perform rate scale to find the rate table
@@ -902,15 +1085,14 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
          * first index into rate scale table.
          */
         if (info->flags & IEEE80211_TX_STAT_AMPDU) {
-                tx_rate = le32_to_cpu(table->rs_table[0]);
-                rs_get_tbl_info_from_mcs(tx_rate, info->band, &tbl_type,
-                                         &rs_index);
-                rs_collect_tx_data(curr_tbl, rs_index,
+                ucode_rate = le32_to_cpu(table->rs_table[0]);
+                rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
+                rs_collect_tx_data(curr_tbl, rate.index,
                                    info->status.ampdu_len,
                                    info->status.ampdu_ack_len);
 
                 /* Update success/fail counts if not searching for new mode */
-                if (lq_sta->stay_in_tbl) {
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
                         lq_sta->total_success += info->status.ampdu_ack_len;
                         lq_sta->total_failed += (info->status.ampdu_len -
                                         info->status.ampdu_ack_len);
@@ -927,31 +1109,31 @@ static void rs_tx_status(void *mvm_r, struct ieee80211_supported_band *sband,
                 legacy_success = !!(info->flags & IEEE80211_TX_STAT_ACK);
                 /* Collect data for each rate used during failed TX attempts */
                 for (i = 0; i <= retries; ++i) {
-                        tx_rate = le32_to_cpu(table->rs_table[i]);
-                        rs_get_tbl_info_from_mcs(tx_rate, info->band,
-                                                 &tbl_type, &rs_index);
+                        ucode_rate = le32_to_cpu(table->rs_table[i]);
+                        rs_rate_from_ucode_rate(ucode_rate, info->band, &rate);
                         /*
                          * Only collect stats if retried rate is in the same RS
                          * table as active/search.
                          */
-                        if (table_type_matches(&tbl_type, curr_tbl))
+                        if (rs_rate_match(&rate, &curr_tbl->rate))
                                 tmp_tbl = curr_tbl;
-                        else if (table_type_matches(&tbl_type, other_tbl))
+                        else if (rs_rate_match(&rate, &other_tbl->rate))
                                 tmp_tbl = other_tbl;
                         else
                                 continue;
-                        rs_collect_tx_data(tmp_tbl, rs_index, 1,
+
+                        rs_collect_tx_data(tmp_tbl, rate.index, 1,
                                            i < retries ? 0 : legacy_success);
                 }
 
                 /* Update success/fail counts if not searching for new mode */
-                if (lq_sta->stay_in_tbl) {
+                if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
                         lq_sta->total_success += legacy_success;
                         lq_sta->total_failed += retries + (1 - legacy_success);
                 }
         }
         /* The last TX rate is cached in lq_sta; it's set in if/else above */
-        lq_sta->last_rate_n_flags = tx_rate;
+        lq_sta->last_rate_n_flags = ucode_rate;
 done:
         /* See if there's a better rate or modulation mode to try. */
         if (sta && sta->supp_rates[sband->band])
@@ -969,8 +1151,8 @@ done:
 static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
                                  struct iwl_lq_sta *lq_sta)
 {
-        IWL_DEBUG_RATE(mvm, "we are staying in the same table\n");
-        lq_sta->stay_in_tbl = 1;        /* only place this gets set */
+        IWL_DEBUG_RATE(mvm, "Moving to RS_STATE_STAY_IN_COLUMN\n");
+        lq_sta->rs_state = RS_STATE_STAY_IN_COLUMN;
         if (is_legacy) {
                 lq_sta->table_count_limit = IWL_LEGACY_TABLE_COUNT;
                 lq_sta->max_failure_limit = IWL_LEGACY_FAILURE_LIMIT;
@@ -984,37 +1166,31 @@ static void rs_set_stay_in_table(struct iwl_mvm *mvm, u8 is_legacy,
         lq_sta->total_failed = 0;
         lq_sta->total_success = 0;
         lq_sta->flush_timer = jiffies;
-        lq_sta->action_counter = 0;
+        lq_sta->visited_columns = 0;
 }
 
-/*
- * Find correct throughput table for given mode of modulation
- */
-static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
-                                      struct iwl_scale_tbl_info *tbl)
+static s32 *rs_get_expected_tpt_table(struct iwl_lq_sta *lq_sta,
+                                      const struct rs_tx_column *column,
+                                      u32 bw)
 {
         /* Used to choose among HT tables */
         s32 (*ht_tbl_pointer)[IWL_RATE_COUNT];
 
-        /* Check for invalid LQ type */
-        if (WARN_ON_ONCE(!is_legacy(tbl->lq_type) && !is_ht(tbl->lq_type) &&
-                         !(is_vht(tbl->lq_type)))) {
-                tbl->expected_tpt = expected_tpt_legacy;
-                return;
-        }
+        if (WARN_ON_ONCE(column->mode != RS_LEGACY &&
+                         column->mode != RS_SISO &&
+                         column->mode != RS_MIMO2))
+                return expected_tpt_legacy;
 
         /* Legacy rates have only one table */
-        if (is_legacy(tbl->lq_type)) {
-                tbl->expected_tpt = expected_tpt_legacy;
-                return;
-        }
+        if (column->mode == RS_LEGACY)
+                return expected_tpt_legacy;
 
         ht_tbl_pointer = expected_tpt_mimo2_20MHz;
         /* Choose among many HT tables depending on number of streams
          * (SISO/MIMO2), channel width (20/40/80), SGI, and aggregation
          * status */
-        if (is_siso(tbl->lq_type)) {
-                switch (tbl->bw) {
+        if (column->mode == RS_SISO) {
+                switch (bw) {
                 case RATE_MCS_CHAN_WIDTH_20:
                         ht_tbl_pointer = expected_tpt_siso_20MHz;
                         break;
@@ -1027,8 +1203,8 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 default:
                         WARN_ON_ONCE(1);
                 }
-        } else if (is_mimo2(tbl->lq_type)) {
-                switch (tbl->bw) {
+        } else if (column->mode == RS_MIMO2) {
+                switch (bw) {
                 case RATE_MCS_CHAN_WIDTH_20:
                         ht_tbl_pointer = expected_tpt_mimo2_20MHz;
                         break;
@@ -1045,14 +1221,23 @@ static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
                 WARN_ON_ONCE(1);
         }
 
-        if (!tbl->is_SGI && !lq_sta->is_agg)            /* Normal */
-                tbl->expected_tpt = ht_tbl_pointer[0];
-        else if (tbl->is_SGI && !lq_sta->is_agg)        /* SGI */
-                tbl->expected_tpt = ht_tbl_pointer[1];
-        else if (!tbl->is_SGI && lq_sta->is_agg)        /* AGG */
-                tbl->expected_tpt = ht_tbl_pointer[2];
+        if (!column->sgi && !lq_sta->is_agg)            /* Normal */
+                return ht_tbl_pointer[0];
+        else if (column->sgi && !lq_sta->is_agg)        /* SGI */
+                return ht_tbl_pointer[1];
+        else if (!column->sgi && lq_sta->is_agg)        /* AGG */
+                return ht_tbl_pointer[2];
         else                                            /* AGG+SGI */
-                tbl->expected_tpt = ht_tbl_pointer[3];
+                return ht_tbl_pointer[3];
+}
+
+static void rs_set_expected_tpt_table(struct iwl_lq_sta *lq_sta,
+                                      struct iwl_scale_tbl_info *tbl)
+{
+        struct rs_rate *rate = &tbl->rate;
+        const struct rs_tx_column *column = &rs_tx_columns[tbl->column];
+
+        tbl->expected_tpt = rs_get_expected_tpt_table(lq_sta, column, rate->bw);
 }
 
 /*
@@ -1089,7 +1274,7 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
 
         while (1) {
                 high_low = rs_get_adjacent_rate(mvm, rate, rate_mask,
-                                                tbl->lq_type);
+                                                tbl->rate.type);
 
                 low = high_low & 0xff;
                 high = (high_low >> 8) & 0xff;
@@ -1110,7 +1295,7 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
                  *    "active" throughput (under perfect conditions).
                  */
                 if ((((100 * tpt_tbl[rate]) > lq_sta->last_tpt) &&
-                     ((active_sr > IWL_RATE_DECREASE_TH) &&
+                     ((active_sr > RS_SR_FORCE_DECREASE) &&
                       (active_sr <= IWL_RATE_HIGH_TH) &&
                       (tpt_tbl[rate] <= active_tpt))) ||
                     ((active_sr >= IWL_RATE_SCALE_SWITCH) &&
@@ -1157,417 +1342,14 @@ static s32 rs_get_best_rate(struct iwl_mvm *mvm,
         return new_rate;
 }
 
-/* Move to the next action and wrap around to the first action in case
- * we're at the last action. Assumes actions start at 0.
- */
-static inline void rs_move_next_action(struct iwl_scale_tbl_info *tbl,
-                                       u8 last_action)
-{
-        BUILD_BUG_ON(IWL_LEGACY_FIRST_ACTION != 0);
-        BUILD_BUG_ON(IWL_SISO_FIRST_ACTION != 0);
-        BUILD_BUG_ON(IWL_MIMO2_FIRST_ACTION != 0);
-
-        tbl->action = (tbl->action + 1) % (last_action + 1);
-}
-
-static void rs_set_bw_from_sta(struct iwl_scale_tbl_info *tbl,
-                               struct ieee80211_sta *sta)
+static u32 rs_bw_from_sta_bw(struct ieee80211_sta *sta)
 {
         if (sta->bandwidth >= IEEE80211_STA_RX_BW_80)
-                tbl->bw = RATE_MCS_CHAN_WIDTH_80;
+                return RATE_MCS_CHAN_WIDTH_80;
         else if (sta->bandwidth >= IEEE80211_STA_RX_BW_40)
-                tbl->bw = RATE_MCS_CHAN_WIDTH_40;
-        else
-                tbl->bw = RATE_MCS_CHAN_WIDTH_20;
-}
-
-static bool rs_sgi_allowed(struct iwl_scale_tbl_info *tbl,
-                           struct ieee80211_sta *sta)
-{
-        struct ieee80211_sta_ht_cap *ht_cap = &sta->ht_cap;
-        struct ieee80211_sta_vht_cap *vht_cap = &sta->vht_cap;
-
-        if (is_ht20(tbl) && (ht_cap->cap &
-                             IEEE80211_HT_CAP_SGI_20))
-                return true;
-        if (is_ht40(tbl) && (ht_cap->cap &
-                             IEEE80211_HT_CAP_SGI_40))
-                return true;
-        if (is_ht80(tbl) && (vht_cap->cap &
-                             IEEE80211_VHT_CAP_SHORT_GI_80))
-                return true;
-
-        return false;
-}
-
-/*
- * Set up search table for MIMO2
- */
-static int rs_switch_to_mimo2(struct iwl_mvm *mvm,
-                             struct iwl_lq_sta *lq_sta,
-                             struct ieee80211_sta *sta,
-                             struct iwl_scale_tbl_info *tbl, int index)
-{
-        u16 rate_mask;
-        s32 rate;
-
-        if (!sta->ht_cap.ht_supported)
-                return -1;
-
-        if (sta->smps_mode == IEEE80211_SMPS_STATIC)
-                return -1;
-
-        /* Need both Tx chains/antennas to support MIMO */
-        if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) < 2)
-                return -1;
-
-        IWL_DEBUG_RATE(mvm, "LQ: try to switch to MIMO2\n");
-
-        tbl->lq_type = lq_sta->is_vht ? LQ_VHT_MIMO2 : LQ_HT_MIMO2;
-        tbl->action = 0;
-        tbl->max_search = IWL_MAX_SEARCH;
-        rate_mask = lq_sta->active_mimo2_rate;
-
-        rs_set_bw_from_sta(tbl, sta);
-        rs_set_expected_tpt_table(lq_sta, tbl);
-
-        rate = rs_get_best_rate(mvm, lq_sta, tbl, rate_mask, index);
-
-        IWL_DEBUG_RATE(mvm, "LQ: MIMO2 best rate %d mask %X\n",
-                       rate, rate_mask);
-        if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
-                IWL_DEBUG_RATE(mvm, "Can't switch with index %d rate mask %x\n",
-                               rate, rate_mask);
-                return -1;
-        }
-        tbl->current_rate = rate_n_flags_from_tbl(mvm, tbl, rate);
-
-        IWL_DEBUG_RATE(mvm, "LQ: Switch to new mcs %X index\n",
-                       tbl->current_rate);
-        return 0;
-}
-
-/*
- * Set up search table for SISO
- */
-static int rs_switch_to_siso(struct iwl_mvm *mvm,
-                             struct iwl_lq_sta *lq_sta,
-                             struct ieee80211_sta *sta,
-                             struct iwl_scale_tbl_info *tbl, int index)
-{
-        u16 rate_mask;
-        s32 rate;
-
-        if (!sta->ht_cap.ht_supported)
-                return -1;
-
-        IWL_DEBUG_RATE(mvm, "LQ: try to switch to SISO\n");
-
-        tbl->lq_type = lq_sta->is_vht ? LQ_VHT_SISO : LQ_HT_SISO;
-        tbl->action = 0;
-        tbl->max_search = IWL_MAX_SEARCH;
-        rate_mask = lq_sta->active_siso_rate;
-
-        rs_set_bw_from_sta(tbl, sta);
-        rs_set_expected_tpt_table(lq_sta, tbl);
-        rate = rs_get_best_rate(mvm, lq_sta, tbl, rate_mask, index);
-
-        IWL_DEBUG_RATE(mvm, "LQ: get best rate %d mask %X\n", rate, rate_mask);
-        if ((rate == IWL_RATE_INVALID) || !((1 << rate) & rate_mask)) {
-                IWL_DEBUG_RATE(mvm,
-                               "can not switch with index %d rate mask %x\n",
-                               rate, rate_mask);
-                return -1;
-        }
-        tbl->current_rate = rate_n_flags_from_tbl(mvm, tbl, rate);
-        IWL_DEBUG_RATE(mvm, "LQ: Switch to new mcs %X index\n",
-                       tbl->current_rate);
-        return 0;
-}
-
-/*
- * Try to switch to new modulation mode from legacy
- */
-static int rs_move_legacy_other(struct iwl_mvm *mvm,
-                                struct iwl_lq_sta *lq_sta,
-                                struct ieee80211_sta *sta,
-                                int index)
-{
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-        struct iwl_rate_scale_data *window = &(tbl->win[index]);
-        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
-                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action;
-        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        u8 tx_chains_num = num_of_ant(valid_tx_ant);
-        int ret;
-        u8 update_search_tbl_counter = 0;
-
-        start_action = tbl->action;
-        while (1) {
-                lq_sta->action_counter++;
-                switch (tbl->action) {
-                case IWL_LEGACY_SWITCH_ANTENNA:
-                        IWL_DEBUG_RATE(mvm, "LQ: Legacy toggle Antenna\n");
-
-                        if (tx_chains_num <= 1)
-                                break;
-
-                        /* Don't change antenna if success has been great */
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO)
-                                break;
-
-                        /* Set up search table to try other antenna */
-                        memcpy(search_tbl, tbl, sz);
-
-                        if (rs_toggle_antenna(valid_tx_ant,
-                                              &search_tbl->current_rate,
-                                              search_tbl)) {
-                                update_search_tbl_counter = 1;
-                                rs_set_expected_tpt_table(lq_sta, search_tbl);
-                                goto out;
-                        }
-                        break;
-                case IWL_LEGACY_SWITCH_SISO:
-                        IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to SISO\n");
-
-                        /* Set up search table to try SISO */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-                        ret = rs_switch_to_siso(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret) {
-                                lq_sta->action_counter = 0;
-                                goto out;
-                        }
-
-                        break;
-                case IWL_LEGACY_SWITCH_MIMO2:
-                        IWL_DEBUG_RATE(mvm, "LQ: Legacy switch to MIMO2\n");
-
-                        /* Set up search table to try MIMO */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-
-                        search_tbl->ant_type = ANT_AB;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo2(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret) {
-                                lq_sta->action_counter = 0;
-                                goto out;
-                        }
-                        break;
-                default:
-                        WARN_ON_ONCE(1);
-                }
-                rs_move_next_action(tbl, IWL_LEGACY_LAST_ACTION);
-
-                if (tbl->action == start_action)
-                        break;
-        }
-        search_tbl->lq_type = LQ_NONE;
-        return 0;
-
-out:
-        lq_sta->search_better_tbl = 1;
-        rs_move_next_action(tbl, IWL_LEGACY_LAST_ACTION);
-        if (update_search_tbl_counter)
-                search_tbl->action = tbl->action;
-        return 0;
-}
-
-/*
- * Try to switch to new modulation mode from SISO
- */
-static int rs_move_siso_to_other(struct iwl_mvm *mvm,
-                                 struct iwl_lq_sta *lq_sta,
-                                 struct ieee80211_sta *sta, int index)
-{
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-        struct iwl_rate_scale_data *window = &(tbl->win[index]);
-        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
-                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action;
-        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        u8 tx_chains_num = num_of_ant(valid_tx_ant);
-        u8 update_search_tbl_counter = 0;
-        int ret;
-
-        if (tbl->action == IWL_SISO_SWITCH_MIMO2 &&
-            !iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta))
-                tbl->action = IWL_SISO_SWITCH_ANTENNA;
-
-        start_action = tbl->action;
-        while (1) {
-                lq_sta->action_counter++;
-                switch (tbl->action) {
-                case IWL_SISO_SWITCH_ANTENNA:
-                        IWL_DEBUG_RATE(mvm, "LQ: SISO toggle Antenna\n");
-                        if (tx_chains_num <= 1)
-                                break;
-
-                        if (window->success_ratio >= IWL_RS_GOOD_RATIO &&
-                            BT_MBOX_MSG(&mvm->last_bt_notif, 3,
-                                        TRAFFIC_LOAD) == 0)
-                                break;
-
-                        memcpy(search_tbl, tbl, sz);
-                        if (rs_toggle_antenna(valid_tx_ant,
-                                              &search_tbl->current_rate,
-                                              search_tbl)) {
-                                update_search_tbl_counter = 1;
-                                goto out;
-                        }
-                        break;
-                case IWL_SISO_SWITCH_MIMO2:
-                        IWL_DEBUG_RATE(mvm, "LQ: SISO switch to MIMO2\n");
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = 0;
-
-                        search_tbl->ant_type = ANT_AB;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_mimo2(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-                        break;
-                case IWL_SISO_SWITCH_GI:
-                        if (!rs_sgi_allowed(tbl, sta))
-                                break;
-
-                        IWL_DEBUG_RATE(mvm, "LQ: SISO toggle SGI/NGI\n");
-
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = !tbl->is_SGI;
-                        rs_set_expected_tpt_table(lq_sta, search_tbl);
-                        if (tbl->is_SGI) {
-                                s32 tpt = lq_sta->last_tpt / 100;
-                                if (tpt >= search_tbl->expected_tpt[index])
-                                        break;
-                        }
-                        search_tbl->current_rate =
-                                rate_n_flags_from_tbl(mvm, search_tbl, index);
-                        update_search_tbl_counter = 1;
-                        goto out;
-                default:
-                        WARN_ON_ONCE(1);
-                }
-                rs_move_next_action(tbl, IWL_SISO_LAST_ACTION);
-
-                if (tbl->action == start_action)
-                        break;
-        }
-        search_tbl->lq_type = LQ_NONE;
-        return 0;
-
- out:
-        lq_sta->search_better_tbl = 1;
-        rs_move_next_action(tbl, IWL_SISO_LAST_ACTION);
-        if (update_search_tbl_counter)
-                search_tbl->action = tbl->action;
-
-        return 0;
-}
-
-/*
- * Try to switch to new modulation mode from MIMO2
- */
-static int rs_move_mimo2_to_other(struct iwl_mvm *mvm,
-                                 struct iwl_lq_sta *lq_sta,
-                                 struct ieee80211_sta *sta, int index)
-{
-        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-        struct iwl_scale_tbl_info *search_tbl =
-                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
-        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
-                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
-        u8 start_action;
-        u8 valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        u8 update_search_tbl_counter = 0;
-        int ret;
-
-        start_action = tbl->action;
-        while (1) {
-                lq_sta->action_counter++;
-                switch (tbl->action) {
-                case IWL_MIMO2_SWITCH_SISO_A:
-                case IWL_MIMO2_SWITCH_SISO_B:
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO2 switch to SISO\n");
-
-                        /* Set up new search table for SISO */
-                        memcpy(search_tbl, tbl, sz);
-
-                        if (tbl->action == IWL_MIMO2_SWITCH_SISO_A)
-                                search_tbl->ant_type = ANT_A;
-                        else /* tbl->action == IWL_MIMO2_SWITCH_SISO_B */
-                                search_tbl->ant_type = ANT_B;
-
-                        if (!rs_is_valid_ant(valid_tx_ant,
-                                             search_tbl->ant_type))
-                                break;
-
-                        ret = rs_switch_to_siso(mvm, lq_sta, sta,
-                                                 search_tbl, index);
-                        if (!ret)
-                                goto out;
-
-                        break;
-
-                case IWL_MIMO2_SWITCH_GI:
-                        if (!rs_sgi_allowed(tbl, sta))
-                                break;
-
-                        IWL_DEBUG_RATE(mvm, "LQ: MIMO2 toggle SGI/NGI\n");
-
-                        /* Set up new search table for MIMO2 */
-                        memcpy(search_tbl, tbl, sz);
-                        search_tbl->is_SGI = !tbl->is_SGI;
-                        rs_set_expected_tpt_table(lq_sta, search_tbl);
-                        /*
-                         * If active table already uses the fastest possible
-                         * modulation (dual stream with short guard interval),
-                         * and it's working well, there's no need to look
-                         * for a better type of modulation!
-                         */
-                        if (tbl->is_SGI) {
-                                s32 tpt = lq_sta->last_tpt / 100;
-                                if (tpt >= search_tbl->expected_tpt[index])
-                                        break;
-                        }
-                        search_tbl->current_rate =
-                                rate_n_flags_from_tbl(mvm, search_tbl, index);
-                        update_search_tbl_counter = 1;
-                        goto out;
-                default:
-                        WARN_ON_ONCE(1);
-                }
-                rs_move_next_action(tbl, IWL_MIMO2_LAST_ACTION);
-
-                if (tbl->action == start_action)
-                        break;
-        }
-        search_tbl->lq_type = LQ_NONE;
-        return 0;
- out:
-        lq_sta->search_better_tbl = 1;
-        rs_move_next_action(tbl, IWL_MIMO2_LAST_ACTION);
-        if (update_search_tbl_counter)
-                search_tbl->action = tbl->action;
+                return RATE_MCS_CHAN_WIDTH_40;
 
-        return 0;
+        return RATE_MCS_CHAN_WIDTH_20;
 }
 
 /*
@@ -1591,13 +1373,13 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
         tbl = &(lq_sta->lq_info[active_tbl]);
 
         /* If we've been disallowing search, see if we should now allow it */
-        if (lq_sta->stay_in_tbl) {
+        if (lq_sta->rs_state == RS_STATE_STAY_IN_COLUMN) {
                 /* Elapsed time using current modulation mode */
                 if (lq_sta->flush_timer)
                         flush_interval_passed =
                                 time_after(jiffies,
                                            (unsigned long)(lq_sta->flush_timer +
-                                                IWL_RATE_SCALE_FLUSH_INTVL));
+                                                RS_STAY_IN_COLUMN_TIMEOUT));
 
                 /*
                  * Check if we should allow search for new modulation mode.
@@ -1619,10 +1401,14 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                                      flush_interval_passed);
 
                         /* Allow search for new mode */
-                        lq_sta->stay_in_tbl = 0;        /* only place reset */
+                        lq_sta->rs_state = RS_STATE_SEARCH_CYCLE_STARTED;
+                        IWL_DEBUG_RATE(mvm,
+                                       "Moving to RS_STATE_SEARCH_CYCLE_STARTED\n");
                         lq_sta->total_failed = 0;
                         lq_sta->total_success = 0;
                         lq_sta->flush_timer = 0;
+                        /* mark the current column as visited */
+                        lq_sta->visited_columns = BIT(tbl->column);
                 /*
                  * Else if we've used this modulation mode enough repetitions
                  * (regardless of elapsed time or success/failure), reset
@@ -1646,7 +1432,8 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
                 /* If transitioning to allow "search", reset all history
                  * bitmaps and stats in active table (this will become the new
                  * "search" table). */
-                if (!lq_sta->stay_in_tbl) {
+                if (lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_STARTED) {
+                        IWL_DEBUG_RATE(mvm, "Clearing up window stats\n");
                         for (i = 0; i < IWL_RATE_COUNT; i++)
                                 rs_rate_scale_clear_window(&(tbl->win[i]));
                 }
@@ -1659,15 +1446,10 @@ static void rs_stay_in_table(struct iwl_lq_sta *lq_sta, bool force_search)
 static void rs_update_rate_tbl(struct iwl_mvm *mvm,
                                struct ieee80211_sta *sta,
                                struct iwl_lq_sta *lq_sta,
-                               struct iwl_scale_tbl_info *tbl,
-                               int index)
+                               struct rs_rate *rate)
 {
-        u32 rate;
-
-        /* Update uCode's rate table. */
-        rate = rate_n_flags_from_tbl(mvm, tbl, index);
-        rs_fill_link_cmd(mvm, sta, lq_sta, rate);
-        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, CMD_ASYNC, false);
+        rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
+        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
 }
 
 static u8 rs_get_tid(struct iwl_lq_sta *lq_data,
@@ -1686,6 +1468,250 @@ static u8 rs_get_tid(struct iwl_lq_sta *lq_data,
         return tid;
 }
 
+static enum rs_column rs_get_next_column(struct iwl_mvm *mvm,
+                                         struct iwl_lq_sta *lq_sta,
+                                         struct ieee80211_sta *sta,
+                                         struct iwl_scale_tbl_info *tbl)
+{
+        int i, j, n;
+        enum rs_column next_col_id;
+        const struct rs_tx_column *curr_col = &rs_tx_columns[tbl->column];
+        const struct rs_tx_column *next_col;
+        allow_column_func_t allow_func;
+        u8 valid_ants = iwl_fw_valid_tx_ant(mvm->fw);
+        s32 *expected_tpt_tbl;
+        s32 tpt, max_expected_tpt;
+
+        for (i = 0; i < MAX_NEXT_COLUMNS; i++) {
+                next_col_id = curr_col->next_columns[i];
+
+                if (next_col_id == RS_COLUMN_INVALID)
+                        continue;
+
+                if (lq_sta->visited_columns & BIT(next_col_id)) {
+                        IWL_DEBUG_RATE(mvm, "Skip already visited column %d\n",
+                                       next_col_id);
+                        continue;
+                }
+
+                next_col = &rs_tx_columns[next_col_id];
+
+                if (!rs_is_valid_ant(valid_ants, next_col->ant)) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d as ANT config isn't supported by chip. valid_ants 0x%x column ant 0x%x\n",
+                                       next_col_id, valid_ants, next_col->ant);
+                        continue;
+                }
+
+                for (j = 0; j < MAX_COLUMN_CHECKS; j++) {
+                        allow_func = next_col->checks[j];
+                        if (allow_func && !allow_func(mvm, sta, tbl))
+                                break;
+                }
+
+                if (j != MAX_COLUMN_CHECKS) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d: not allowed (check %d failed)\n",
+                                       next_col_id, j);
+
+                        continue;
+                }
+
+                tpt = lq_sta->last_tpt / 100;
+                expected_tpt_tbl = rs_get_expected_tpt_table(lq_sta, next_col,
+                                                             tbl->rate.bw);
+                if (WARN_ON_ONCE(!expected_tpt_tbl))
+                        continue;
+
+                max_expected_tpt = 0;
+                for (n = 0; n < IWL_RATE_COUNT; n++)
+                        if (expected_tpt_tbl[n] > max_expected_tpt)
+                                max_expected_tpt = expected_tpt_tbl[n];
+
+                if (tpt >= max_expected_tpt) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Skip column %d: can't beat current TPT. Max expected %d current %d\n",
+                                       next_col_id, max_expected_tpt, tpt);
+                        continue;
+                }
+
+                break;
+        }
+
+        if (i == MAX_NEXT_COLUMNS)
+                return RS_COLUMN_INVALID;
+
+        IWL_DEBUG_RATE(mvm, "Found potential column %d\n", next_col_id);
+
+        return next_col_id;
+}
+
+static int rs_switch_to_column(struct iwl_mvm *mvm,
+                               struct iwl_lq_sta *lq_sta,
+                               struct ieee80211_sta *sta,
+                               enum rs_column col_id)
+{
+        struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
+        struct iwl_scale_tbl_info *search_tbl =
+                                &(lq_sta->lq_info[(1 - lq_sta->active_tbl)]);
+        struct rs_rate *rate = &search_tbl->rate;
+        const struct rs_tx_column *column = &rs_tx_columns[col_id];
+        const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column];
+        u32 sz = (sizeof(struct iwl_scale_tbl_info) -
+                  (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT));
+        u16 rate_mask = 0;
+        u32 rate_idx = 0;
+
+        memcpy(search_tbl, tbl, sz);
+
+        rate->sgi = column->sgi;
+        rate->ant = column->ant;
+
+        if (column->mode == RS_LEGACY) {
+                if (lq_sta->band == IEEE80211_BAND_5GHZ)
+                        rate->type = LQ_LEGACY_A;
+                else
+                        rate->type = LQ_LEGACY_G;
+
+                rate_mask = lq_sta->active_legacy_rate;
+        } else if (column->mode == RS_SISO) {
+                rate->type = lq_sta->is_vht ? LQ_VHT_SISO : LQ_HT_SISO;
+                rate_mask = lq_sta->active_siso_rate;
+        } else if (column->mode == RS_MIMO2) {
+                rate->type = lq_sta->is_vht ? LQ_VHT_MIMO2 : LQ_HT_MIMO2;
+                rate_mask = lq_sta->active_mimo2_rate;
+        } else {
+                WARN_ON_ONCE("Bad column mode");
+        }
+
+        rate->bw = rs_bw_from_sta_bw(sta);
+        search_tbl->column = col_id;
+        rs_set_expected_tpt_table(lq_sta, search_tbl);
+
+        lq_sta->visited_columns |= BIT(col_id);
+
+        /* Get the best matching rate if we're changing modes. e.g.
+         * SISO->MIMO, LEGACY->SISO, MIMO->SISO
+         */
+        if (curr_column->mode != column->mode) {
+                rate_idx = rs_get_best_rate(mvm, lq_sta, search_tbl,
+                                            rate_mask, rate->index);
+
+                if ((rate_idx == IWL_RATE_INVALID) ||
+                    !(BIT(rate_idx) & rate_mask)) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "can not switch with index %d"
+                                       " rate mask %x\n",
+                                       rate_idx, rate_mask);
+
+                        goto err;
+                }
+
+                rate->index = rate_idx;
+        }
+
+        IWL_DEBUG_RATE(mvm, "Switched to column %d: Index %d\n",
+                       col_id, rate->index);
+
+        return 0;
+
+err:
+        rate->type = LQ_NONE;
+        return -1;
+}
+
+static enum rs_action rs_get_rate_action(struct iwl_mvm *mvm,
+                                         struct iwl_scale_tbl_info *tbl,
+                                         s32 sr, int low, int high,
+                                         int current_tpt,
+                                         int low_tpt, int high_tpt)
+{
+        enum rs_action action = RS_ACTION_STAY;
+
+        /* Too many failures, decrease rate */
+        if ((sr <= RS_SR_FORCE_DECREASE) || (current_tpt == 0)) {
+                IWL_DEBUG_RATE(mvm,
+                               "decrease rate because of low SR\n");
+                action = RS_ACTION_DOWNSCALE;
+        /* No throughput measured yet for adjacent rates; try increase. */
+        } else if ((low_tpt == IWL_INVALID_VALUE) &&
+                   (high_tpt == IWL_INVALID_VALUE)) {
+                if (high != IWL_RATE_INVALID && sr >= IWL_RATE_INCREASE_TH) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Good SR and no high rate measurement. "
+                                       "Increase rate\n");
+                        action = RS_ACTION_UPSCALE;
+                } else if (low != IWL_RATE_INVALID) {
+                        IWL_DEBUG_RATE(mvm,
+                                       "Remain in current rate\n");
+                        action = RS_ACTION_STAY;
+                }
+        }
+
+        /* Both adjacent throughputs are measured, but neither one has better
+         * throughput; we're using the best rate, don't change it!
+         */
+        else if ((low_tpt != IWL_INVALID_VALUE) &&
+                 (high_tpt != IWL_INVALID_VALUE) &&
+                 (low_tpt < current_tpt) &&
+                 (high_tpt < current_tpt)) {
+                IWL_DEBUG_RATE(mvm,
+                               "Both high and low are worse. "
+                               "Maintain rate\n");
+                action = RS_ACTION_STAY;
+        }
+
+        /* At least one adjacent rate's throughput is measured,
+         * and may have better performance.
+         */
+        else {
+                /* Higher adjacent rate's throughput is measured */
+                if (high_tpt != IWL_INVALID_VALUE) {
+                        /* Higher rate has better throughput */
+                        if (high_tpt > current_tpt &&
+                            sr >= IWL_RATE_INCREASE_TH) {
+                                IWL_DEBUG_RATE(mvm,
+                                               "Higher rate is better and good "
+                                               "SR. Increate rate\n");
+                                action = RS_ACTION_UPSCALE;
+                        } else {
+                                IWL_DEBUG_RATE(mvm,
+                                               "Higher rate isn't better OR "
+                                               "no good SR. Maintain rate\n");
+                                action = RS_ACTION_STAY;
+                        }
+
+                /* Lower adjacent rate's throughput is measured */
+                } else if (low_tpt != IWL_INVALID_VALUE) {
+                        /* Lower rate has better throughput */
+                        if (low_tpt > current_tpt) {
+                                IWL_DEBUG_RATE(mvm,
+                                               "Lower rate is better. "
+                                               "Decrease rate\n");
+                                action = RS_ACTION_DOWNSCALE;
+                        } else if (sr >= IWL_RATE_INCREASE_TH) {
+                                IWL_DEBUG_RATE(mvm,
+                                               "Lower rate isn't better and "
+                                               "good SR. Increase rate\n");
+                                action = RS_ACTION_UPSCALE;
+                        }
+                }
+        }
+
+        /* Sanity check; asked for decrease, but success rate or throughput
+         * has been good at old rate.  Don't change it.
+         */
+        if ((action == RS_ACTION_DOWNSCALE) && (low != IWL_RATE_INVALID) &&
+            ((sr > IWL_RATE_HIGH_TH) ||
+             (current_tpt > (100 * tbl->expected_tpt[low])))) {
+                IWL_DEBUG_RATE(mvm,
+                               "Sanity check failed. Maintain rate\n");
+                action = RS_ACTION_STAY;
+        }
+
+        return action;
+}
+
 /*
  * Do rate scaling and search for new modulation mode.
  */
@@ -1705,20 +1731,19 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         int low_tpt = IWL_INVALID_VALUE;
         int high_tpt = IWL_INVALID_VALUE;
         u32 fail_count;
-        s8 scale_action = 0;
+        enum rs_action scale_action = RS_ACTION_STAY;
         u16 rate_mask;
         u8 update_lq = 0;
         struct iwl_scale_tbl_info *tbl, *tbl1;
-        u16 rate_scale_index_msk = 0;
         u8 active_tbl = 0;
         u8 done_search = 0;
         u16 high_low;
         s32 sr;
         u8 tid = IWL_MAX_TID_COUNT;
+        u8 prev_agg = lq_sta->is_agg;
         struct iwl_mvm_sta *sta_priv = (void *)sta->drv_priv;
         struct iwl_mvm_tid_data *tid_data;
-
-        IWL_DEBUG_RATE(mvm, "rate scale calculate new rate for skb\n");
+        struct rs_rate *rate;
 
         /* Send management frames and NO_ACK data using lowest rate. */
         /* TODO: this could probably be improved.. */
@@ -1726,8 +1751,6 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
             info->flags & IEEE80211_TX_CTL_NO_ACK)
                 return;
 
-        lq_sta->supp_rates = sta->supp_rates[lq_sta->band];
-
         tid = rs_get_tid(lq_sta, hdr);
         if ((tid != IWL_MAX_TID_COUNT) &&
             (lq_sta->tx_agg_tid_en & (1 << tid))) {
@@ -1751,45 +1774,29 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 active_tbl = 1 - lq_sta->active_tbl;
 
         tbl = &(lq_sta->lq_info[active_tbl]);
+        rate = &tbl->rate;
+
+        if (prev_agg != lq_sta->is_agg) {
+                IWL_DEBUG_RATE(mvm,
+                               "Aggregation changed: prev %d current %d. Update expected TPT table\n",
+                               prev_agg, lq_sta->is_agg);
+                rs_set_expected_tpt_table(lq_sta, tbl);
+        }
 
         /* current tx rate */
         index = lq_sta->last_txrate_idx;
 
-        IWL_DEBUG_RATE(mvm, "Rate scale index %d for type %d\n", index,
-                       tbl->lq_type);
-
         /* rates available for this association, and for modulation mode */
-        rate_mask = rs_get_supported_rates(lq_sta, hdr, tbl->lq_type);
+        rate_mask = rs_get_supported_rates(lq_sta, rate);
 
-        IWL_DEBUG_RATE(mvm, "mask 0x%04X\n", rate_mask);
-
-        /* mask with station rate restriction */
-        if (is_legacy(tbl->lq_type)) {
-                if (lq_sta->band == IEEE80211_BAND_5GHZ)
-                        /* supp_rates has no CCK bits in A mode */
-                        rate_scale_index_msk = (u16) (rate_mask &
-                                (lq_sta->supp_rates << IWL_FIRST_OFDM_RATE));
-                else
-                        rate_scale_index_msk = (u16) (rate_mask &
-                                                      lq_sta->supp_rates);
-
-        } else {
-                rate_scale_index_msk = rate_mask;
-        }
-
-        if (!rate_scale_index_msk)
-                rate_scale_index_msk = rate_mask;
-
-        if (!((1 << index) & rate_scale_index_msk)) {
+        if (!(BIT(index) & rate_mask)) {
                 IWL_ERR(mvm, "Current Rate is not valid\n");
                 if (lq_sta->search_better_tbl) {
                         /* revert to active table if search table is not valid*/
-                        tbl->lq_type = LQ_NONE;
+                        rate->type = LQ_NONE;
                         lq_sta->search_better_tbl = 0;
                         tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                        /* get "active" rate info */
-                        index = iwl_hwrate_to_plcp_idx(tbl->current_rate);
-                        rs_update_rate_tbl(mvm, sta, lq_sta, tbl, index);
+                        rs_update_rate_tbl(mvm, sta, lq_sta, &tbl->rate);
                 }
                 return;
         }
@@ -1806,6 +1813,9 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                 index = lq_sta->max_rate_idx;
                 update_lq = 1;
                 window = &(tbl->win[index]);
+                IWL_DEBUG_RATE(mvm,
+                               "Forcing user max rate %d\n",
+                               index);
                 goto lq_update;
         }
 
@@ -1822,8 +1832,9 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         if ((fail_count < IWL_RATE_MIN_FAILURE_TH) &&
             (window->success_counter < IWL_RATE_MIN_SUCCESS_TH)) {
                 IWL_DEBUG_RATE(mvm,
-                               "LQ: still below TH. succ=%d total=%d for index %d\n",
-                               window->success_counter, window->counter, index);
+                               "(%s: %d): Test Window: succ %d total %d\n",
+                               rs_pretty_lq_type(rate->type),
+                               index, window->success_counter, window->counter);
 
                 /* Can't calculate this yet; not enough history */
                 window->average_tpt = IWL_INVALID_VALUE;
@@ -1838,8 +1849,6 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
          * actual average throughput */
         if (window->average_tpt != ((window->success_ratio *
                         tbl->expected_tpt[index] + 64) / 128)) {
-                IWL_ERR(mvm,
-                        "expected_tpt should have been calculated by now\n");
                 window->average_tpt = ((window->success_ratio *
                                         tbl->expected_tpt[index] + 64) / 128);
         }
@@ -1851,34 +1860,33 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
                  * continuing to use the setup that we've been trying. */
                 if (window->average_tpt > lq_sta->last_tpt) {
                         IWL_DEBUG_RATE(mvm,
-                                       "LQ: SWITCHING TO NEW TABLE suc=%d cur-tpt=%d old-tpt=%d\n",
+                                       "SWITCHING TO NEW TABLE SR: %d "
+                                       "cur-tpt %d old-tpt %d\n",
                                        window->success_ratio,
                                        window->average_tpt,
                                        lq_sta->last_tpt);
 
-                        if (!is_legacy(tbl->lq_type))
-                                lq_sta->enable_counter = 1;
-
                         /* Swap tables; "search" becomes "active" */
                         lq_sta->active_tbl = active_tbl;
                         current_tpt = window->average_tpt;
                 /* Else poor success; go back to mode in "active" table */
                 } else {
                         IWL_DEBUG_RATE(mvm,
-                                       "LQ: GOING BACK TO THE OLD TABLE suc=%d cur-tpt=%d old-tpt=%d\n",
+                                       "GOING BACK TO THE OLD TABLE: SR %d "
+                                       "cur-tpt %d old-tpt %d\n",
                                        window->success_ratio,
                                        window->average_tpt,
                                        lq_sta->last_tpt);
 
                         /* Nullify "search" table */
-                        tbl->lq_type = LQ_NONE;
+                        rate->type = LQ_NONE;
 
                         /* Revert to "active" table */
                         active_tbl = lq_sta->active_tbl;
                         tbl = &(lq_sta->lq_info[active_tbl]);
 
                         /* Revert to "active" rate and throughput info */
-                        index = iwl_hwrate_to_plcp_idx(tbl->current_rate);
+                        index = tbl->rate.index;
                         current_tpt = lq_sta->last_tpt;
 
                         /* Need to set up a new rate table in uCode */
@@ -1894,8 +1902,7 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
 
         /* (Else) not in search of better modulation mode, try for better
          * starting rate, while staying in this mode. */
-        high_low = rs_get_adjacent_rate(mvm, index, rate_scale_index_msk,
-                                        tbl->lq_type);
+        high_low = rs_get_adjacent_rate(mvm, index, rate_mask, rate->type);
         low = high_low & 0xff;
         high = (high_low >> 8) & 0xff;
 
@@ -1913,118 +1920,58 @@ static void rs_rate_scale_perform(struct iwl_mvm *mvm,
         if (high != IWL_RATE_INVALID)
                 high_tpt = tbl->win[high].average_tpt;
 
-        scale_action = 0;
-
-        /* Too many failures, decrease rate */
-        if ((sr <= IWL_RATE_DECREASE_TH) || (current_tpt == 0)) {
-                IWL_DEBUG_RATE(mvm,
-                               "decrease rate because of low success_ratio\n");
-                scale_action = -1;
-        /* No throughput measured yet for adjacent rates; try increase. */
-        } else if ((low_tpt == IWL_INVALID_VALUE) &&
-                   (high_tpt == IWL_INVALID_VALUE)) {
-                if (high != IWL_RATE_INVALID && sr >= IWL_RATE_INCREASE_TH)
-                        scale_action = 1;
-                else if (low != IWL_RATE_INVALID)
-                        scale_action = 0;
-        }
-
-        /* Both adjacent throughputs are measured, but neither one has better
-         * throughput; we're using the best rate, don't change it! */
-        else if ((low_tpt != IWL_INVALID_VALUE) &&
-                 (high_tpt != IWL_INVALID_VALUE) &&
-                 (low_tpt < current_tpt) &&
-                 (high_tpt < current_tpt))
-                scale_action = 0;
-
-        /* At least one adjacent rate's throughput is measured,
-         * and may have better performance. */
-        else {
-                /* Higher adjacent rate's throughput is measured */
-                if (high_tpt != IWL_INVALID_VALUE) {
-                        /* Higher rate has better throughput */
-                        if (high_tpt > current_tpt &&
-                            sr >= IWL_RATE_INCREASE_TH) {
-                                scale_action = 1;
-                        } else {
-                                scale_action = 0;
-                        }
-
-                /* Lower adjacent rate's throughput is measured */
-                } else if (low_tpt != IWL_INVALID_VALUE) {
-                        /* Lower rate has better throughput */
-                        if (low_tpt > current_tpt) {
-                                IWL_DEBUG_RATE(mvm,
-                                               "decrease rate because of low tpt\n");
-                                scale_action = -1;
-                        } else if (sr >= IWL_RATE_INCREASE_TH) {
-                                scale_action = 1;
-                        }
-                }
-        }
-
-        /* Sanity check; asked for decrease, but success rate or throughput
-         * has been good at old rate.  Don't change it. */
-        if ((scale_action == -1) && (low != IWL_RATE_INVALID) &&
-            ((sr > IWL_RATE_HIGH_TH) ||
-             (current_tpt > (100 * tbl->expected_tpt[low]))))
-                scale_action = 0;
+        IWL_DEBUG_RATE(mvm,
+                       "(%s: %d): cur_tpt %d SR %d low %d high %d low_tpt %d high_tpt %d\n",
+                       rs_pretty_lq_type(rate->type), index, current_tpt, sr,
+                       low, high, low_tpt, high_tpt);
 
-        if ((le32_to_cpu(mvm->last_bt_notif.bt_activity_grading) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && (is_mimo(tbl->lq_type))) {
-                if (lq_sta->last_bt_traffic >
-                    le32_to_cpu(mvm->last_bt_notif.bt_activity_grading)) {
-                        /*
-                         * don't set scale_action, don't want to scale up if
-                         * the rate scale doesn't otherwise think that is a
-                         * good idea.
-                         */
-                } else if (lq_sta->last_bt_traffic <=
-                           le32_to_cpu(mvm->last_bt_notif.bt_activity_grading)) {
-                        scale_action = -1;
-                }
-        }
-        lq_sta->last_bt_traffic =
-                le32_to_cpu(mvm->last_bt_notif.bt_activity_grading);
+        scale_action = rs_get_rate_action(mvm, tbl, sr, low, high,
+                                          current_tpt, low_tpt, high_tpt);
 
-        if ((le32_to_cpu(mvm->last_bt_notif.bt_activity_grading) >=
-             IWL_BT_COEX_TRAFFIC_LOAD_HIGH) && is_mimo(tbl->lq_type)) {
-                /* search for a new modulation */
+        /* Force a search in case BT doesn't like us being in MIMO */
+        if (is_mimo(rate) &&
+            !iwl_mvm_bt_coex_is_mimo_allowed(mvm, sta)) {
+                IWL_DEBUG_RATE(mvm,
+                               "BT Coex forbids MIMO. Search for new config\n");
                 rs_stay_in_table(lq_sta, true);
                 goto lq_update;
         }
 
         switch (scale_action) {
-        case -1:
+        case RS_ACTION_DOWNSCALE:
                 /* Decrease starting rate, update uCode's rate table */
                 if (low != IWL_RATE_INVALID) {
                         update_lq = 1;
                         index = low;
+                } else {
+                        IWL_DEBUG_RATE(mvm,
+                                       "At the bottom rate. Can't decrease\n");
                 }
 
                 break;
-        case 1:
+        case RS_ACTION_UPSCALE:
                 /* Increase starting rate, update uCode's rate table */
                 if (high != IWL_RATE_INVALID) {
                         update_lq = 1;
                         index = high;
+                } else {
+                        IWL_DEBUG_RATE(mvm,
+                                       "At the top rate. Can't increase\n");
                 }
 
                 break;
-        case 0:
+        case RS_ACTION_STAY:
                 /* No change */
         default:
                 break;
         }
 
-        IWL_DEBUG_RATE(mvm,
-                       "choose rate scale index %d action %d low %d high %d type %d\n",
-                       index, scale_action, low, high, tbl->lq_type);
-
 lq_update:
         /* Replace uCode's rate table for the destination station. */
-        if (update_lq)
-                rs_update_rate_tbl(mvm, sta, lq_sta, tbl, index);
+        if (update_lq) {
+                tbl->rate.index = index;
+                rs_update_rate_tbl(mvm, sta, lq_sta, &tbl->rate);
+        }
 
         rs_stay_in_table(lq_sta, false);
 
@@ -2035,20 +1982,29 @@ lq_update:
          * 3)  Allowing a new search
          */
         if (!update_lq && !done_search &&
-            !lq_sta->stay_in_tbl && window->counter) {
+            lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_STARTED
+            && window->counter) {
+                enum rs_column next_column;
+
                 /* Save current throughput to compare with "search" throughput*/
                 lq_sta->last_tpt = current_tpt;
 
-                /* Select a new "search" modulation mode to try.
-                 * If one is found, set up the new "search" table. */
-                if (is_legacy(tbl->lq_type))
-                        rs_move_legacy_other(mvm, lq_sta, sta, index);
-                else if (is_siso(tbl->lq_type))
-                        rs_move_siso_to_other(mvm, lq_sta, sta, index);
-                else if (is_mimo2(tbl->lq_type))
-                        rs_move_mimo2_to_other(mvm, lq_sta, sta, index);
-                else
-                        WARN_ON_ONCE(1);
+                IWL_DEBUG_RATE(mvm,
+                               "Start Search: update_lq %d done_search %d rs_state %d win->counter %d\n",
+                               update_lq, done_search, lq_sta->rs_state,
+                               window->counter);
+
+                next_column = rs_get_next_column(mvm, lq_sta, sta, tbl);
+                if (next_column != RS_COLUMN_INVALID) {
+                        int ret = rs_switch_to_column(mvm, lq_sta, sta,
+                                                      next_column);
+                        if (!ret)
+                                lq_sta->search_better_tbl = 1;
+                } else {
+                        IWL_DEBUG_RATE(mvm,
+                                       "No more columns to explore in search cycle. Go to RS_STATE_SEARCH_CYCLE_ENDED\n");
+                        lq_sta->rs_state = RS_STATE_SEARCH_CYCLE_ENDED;
+                }
 
                 /* If new "search" mode was selected, set up in uCode table */
                 if (lq_sta->search_better_tbl) {
@@ -2058,36 +2014,31 @@ lq_update:
                                 rs_rate_scale_clear_window(&(tbl->win[i]));
 
                         /* Use new "search" start rate */
-                        index = iwl_hwrate_to_plcp_idx(tbl->current_rate);
+                        index = tbl->rate.index;
 
-                        IWL_DEBUG_RATE(mvm,
-                                       "Switch current  mcs: %X index: %d\n",
-                                       tbl->current_rate, index);
-                        rs_fill_link_cmd(mvm, sta, lq_sta, tbl->current_rate);
-                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, CMD_ASYNC, false);
+                        rs_dump_rate(mvm, &tbl->rate,
+                                     "Switch to SEARCH TABLE:");
+                        rs_fill_lq_cmd(mvm, sta, lq_sta, &tbl->rate);
+                        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, false);
                 } else {
                         done_search = 1;
                 }
         }
 
-        if (done_search && !lq_sta->stay_in_tbl) {
+        if (done_search && lq_sta->rs_state == RS_STATE_SEARCH_CYCLE_ENDED) {
                 /* If the "active" (non-search) mode was legacy,
                  * and we've tried switching antennas,
                  * but we haven't been able to try HT modes (not available),
                  * stay with best antenna legacy modulation for a while
                  * before next round of mode comparisons. */
                 tbl1 = &(lq_sta->lq_info[lq_sta->active_tbl]);
-                if (is_legacy(tbl1->lq_type) && !sta->ht_cap.ht_supported &&
-                    lq_sta->action_counter > tbl1->max_search) {
+                if (is_legacy(&tbl1->rate) && !sta->ht_cap.ht_supported) {
                         IWL_DEBUG_RATE(mvm, "LQ: STAY in legacy table\n");
                         rs_set_stay_in_table(mvm, 1, lq_sta);
-                }
-
+                } else {
                 /* If we're in an HT mode, and all 3 mode switch actions
                  * have been tried and compared, stay in this best modulation
                  * mode for a while before next round of mode comparisons. */
-                if (lq_sta->enable_counter &&
-                    (lq_sta->action_counter >= tbl1->max_search)) {
                         if ((lq_sta->last_tpt > IWL_AGG_TPT_THREHOLD) &&
                             (lq_sta->tx_agg_tid_en & (1 << tid)) &&
                             (tid != IWL_MAX_TID_COUNT)) {
@@ -2105,7 +2056,6 @@ lq_update:
         }
 
 out:
-        tbl->current_rate = rate_n_flags_from_tbl(mvm, tbl, index);
         lq_sta->last_txrate_idx = index;
 }
 
@@ -2126,12 +2076,12 @@ out:
 static void rs_initialize_lq(struct iwl_mvm *mvm,
                              struct ieee80211_sta *sta,
                              struct iwl_lq_sta *lq_sta,
-                             enum ieee80211_band band)
+                             enum ieee80211_band band,
+                             bool init)
 {
         struct iwl_scale_tbl_info *tbl;
-        int rate_idx;
+        struct rs_rate *rate;
         int i;
-        u32 rate;
         u8 active_tbl = 0;
         u8 valid_tx_ant;
 
@@ -2148,27 +2098,30 @@ static void rs_initialize_lq(struct iwl_mvm *mvm,
                 active_tbl = 1 - lq_sta->active_tbl;
 
         tbl = &(lq_sta->lq_info[active_tbl]);
+        rate = &tbl->rate;
 
         if ((i < 0) || (i >= IWL_RATE_COUNT))
                 i = 0;
 
-        rate = iwl_rates[i].plcp;
-        tbl->ant_type = first_antenna(valid_tx_ant);
-        rate |= tbl->ant_type << RATE_MCS_ANT_POS;
-
-        if (i >= IWL_FIRST_CCK_RATE && i <= IWL_LAST_CCK_RATE)
-                rate |= RATE_MCS_CCK_MSK;
+        rate->index = i;
+        rate->ant = first_antenna(valid_tx_ant);
+        rate->sgi = false;
+        rate->bw = RATE_MCS_CHAN_WIDTH_20;
+        if (band == IEEE80211_BAND_5GHZ)
+                rate->type = LQ_LEGACY_A;
+        else
+                rate->type = LQ_LEGACY_G;
 
-        rs_get_tbl_info_from_mcs(rate, band, tbl, &rate_idx);
-        if (!rs_is_valid_ant(valid_tx_ant, tbl->ant_type))
-                rs_toggle_antenna(valid_tx_ant, &rate, tbl);
+        WARN_ON_ONCE(rate->ant != ANT_A && rate->ant != ANT_B);
+        if (rate->ant == ANT_A)
+                tbl->column = RS_COLUMN_LEGACY_ANT_A;
+        else
+                tbl->column = RS_COLUMN_LEGACY_ANT_B;
 
-        rate = rate_n_flags_from_tbl(mvm, tbl, rate_idx);
-        tbl->current_rate = rate;
         rs_set_expected_tpt_table(lq_sta, tbl);
-        rs_fill_link_cmd(NULL, NULL, lq_sta, rate);
+        rs_fill_lq_cmd(mvm, sta, lq_sta, rate);
         /* TODO restore station should remember the lq cmd */
-        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, CMD_SYNC, true);
+        iwl_mvm_send_lq_cmd(mvm, &lq_sta->lq, init);
 }
 
 static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
@@ -2182,8 +2135,6 @@ static void rs_get_rate(void *mvm_r, struct ieee80211_sta *sta, void *mvm_sta,
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         struct iwl_lq_sta *lq_sta = mvm_sta;
 
-        IWL_DEBUG_RATE_LIMIT(mvm, "rate scale calculate new rate for skb\n");
-
         /* Get max rate if user set max rate */
         if (lq_sta) {
                 lq_sta->max_rate_idx = txrc->max_rate_idx;
@@ -2242,11 +2193,59 @@ static int rs_vht_highest_rx_mcs_index(struct ieee80211_sta_vht_cap *vht_cap,
         return -1;
 }
 
+static void rs_vht_set_enabled_rates(struct ieee80211_sta *sta,
+                                     struct ieee80211_sta_vht_cap *vht_cap,
+                                     struct iwl_lq_sta *lq_sta)
+{
+        int i;
+        int highest_mcs = rs_vht_highest_rx_mcs_index(vht_cap, 1);
+
+        if (highest_mcs >= IWL_RATE_MCS_0_INDEX) {
+                for (i = IWL_RATE_MCS_0_INDEX; i <= highest_mcs; i++) {
+                        if (i == IWL_RATE_9M_INDEX)
+                                continue;
+
+                        /* Disable MCS9 as a workaround */
+                        if (i == IWL_RATE_MCS_9_INDEX)
+                                continue;
+
+                        /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
+                        if (i == IWL_RATE_MCS_9_INDEX &&
+                            sta->bandwidth == IEEE80211_STA_RX_BW_20)
+                                continue;
+
+                        lq_sta->active_siso_rate |= BIT(i);
+                }
+        }
+
+        if (sta->rx_nss < 2)
+                return;
+
+        highest_mcs = rs_vht_highest_rx_mcs_index(vht_cap, 2);
+        if (highest_mcs >= IWL_RATE_MCS_0_INDEX) {
+                for (i = IWL_RATE_MCS_0_INDEX; i <= highest_mcs; i++) {
+                        if (i == IWL_RATE_9M_INDEX)
+                                continue;
+
+                        /* Disable MCS9 as a workaround */
+                        if (i == IWL_RATE_MCS_9_INDEX)
+                                continue;
+
+                        /* VHT MCS9 isn't valid for 20Mhz for NSS=1,2 */
+                        if (i == IWL_RATE_MCS_9_INDEX &&
+                            sta->bandwidth == IEEE80211_STA_RX_BW_20)
+                                continue;
+
+                        lq_sta->active_mimo2_rate |= BIT(i);
+                }
+        }
+}
+
 /*
  * Called after adding a new station to initialize rate scaling
  */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          enum ieee80211_band band)
+                          enum ieee80211_band band, bool init)
 {
         int i, j;
         struct ieee80211_hw *hw = mvm->hw;
@@ -2259,6 +2258,8 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
         sta_priv = (struct iwl_mvm_sta *)sta->drv_priv;
         lq_sta = &sta_priv->lq_sta;
+        memset(lq_sta, 0, sizeof(*lq_sta));
+
         sband = hw->wiphy->bands[band];
 
         lq_sta->lq.sta_id = sta_priv->sta_id;
@@ -2268,7 +2269,6 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
                         rs_rate_scale_clear_window(&lq_sta->lq_info[j].win[i]);
 
         lq_sta->flush_timer = 0;
-        lq_sta->supp_rates = sta->supp_rates[sband->band];
 
         IWL_DEBUG_RATE(mvm,
                        "LQ: *** rate scale station global init for station %d ***\n",
@@ -2308,27 +2308,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
 
                 lq_sta->is_vht = false;
         } else {
-                int highest_mcs = rs_vht_highest_rx_mcs_index(vht_cap, 1);
-                if (highest_mcs >= IWL_RATE_MCS_0_INDEX) {
-                        for (i = IWL_RATE_MCS_0_INDEX; i <= highest_mcs; i++) {
-                                if (i == IWL_RATE_9M_INDEX)
-                                        continue;
-
-                                lq_sta->active_siso_rate |= BIT(i);
-                        }
-                }
-
-                highest_mcs = rs_vht_highest_rx_mcs_index(vht_cap, 2);
-                if (highest_mcs >= IWL_RATE_MCS_0_INDEX) {
-                        for (i = IWL_RATE_MCS_0_INDEX; i <= highest_mcs; i++) {
-                                if (i == IWL_RATE_9M_INDEX)
-                                        continue;
-
-                                lq_sta->active_mimo2_rate |= BIT(i);
-                        }
-                }
-
-                /* TODO: avoid MCS9 in 20Mhz which isn't valid for 11ac */
+                rs_vht_set_enabled_rates(sta, vht_cap, lq_sta);
                 lq_sta->is_vht = true;
         }
 
@@ -2341,15 +2321,7 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         /* These values will be overridden later */
         lq_sta->lq.single_stream_ant_msk =
                 first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
-        lq_sta->lq.dual_stream_ant_msk =
-                iwl_fw_valid_tx_ant(mvm->fw) &
-                ~first_antenna(iwl_fw_valid_tx_ant(mvm->fw));
-        if (!lq_sta->lq.dual_stream_ant_msk) {
-                lq_sta->lq.dual_stream_ant_msk = ANT_AB;
-        } else if (num_of_ant(iwl_fw_valid_tx_ant(mvm->fw)) == 2) {
-                lq_sta->lq.dual_stream_ant_msk =
-                        iwl_fw_valid_tx_ant(mvm->fw);
-        }
+        lq_sta->lq.dual_stream_ant_msk = ANT_AB;
 
         /* as default allow aggregation for all tids */
         lq_sta->tx_agg_tid_en = IWL_AGG_ALL_TID;
@@ -2364,121 +2336,184 @@ void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
         lq_sta->dbg_fixed_rate = 0;
 #endif
 
-        rs_initialize_lq(mvm, sta, lq_sta, band);
+        rs_initialize_lq(mvm, sta, lq_sta, band, init);
 }
 
-static void rs_fill_link_cmd(struct iwl_mvm *mvm,
-                             struct ieee80211_sta *sta,
-                             struct iwl_lq_sta *lq_sta, u32 new_rate)
+static void rs_rate_update(void *mvm_r,
+                           struct ieee80211_supported_band *sband,
+                           struct cfg80211_chan_def *chandef,
+                           struct ieee80211_sta *sta, void *priv_sta,
+                           u32 changed)
+{
+        u8 tid;
+        struct iwl_op_mode *op_mode  =
+                        (struct iwl_op_mode *)mvm_r;
+        struct iwl_mvm *mvm = IWL_OP_MODE_GET_MVM(op_mode);
+
+        /* Stop any ongoing aggregations as rs starts off assuming no agg */
+        for (tid = 0; tid < IWL_MAX_TID_COUNT; tid++)
+                ieee80211_stop_tx_ba_session(sta, tid);
+
+        iwl_mvm_rs_rate_init(mvm, sta, sband->band, false);
+}
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+static void rs_build_rates_table_from_fixed(struct iwl_mvm *mvm,
+                                            struct iwl_lq_cmd *lq_cmd,
+                                            enum ieee80211_band band,
+                                            u32 ucode_rate)
+{
+        struct rs_rate rate;
+        int i;
+        int num_rates = ARRAY_SIZE(lq_cmd->rs_table);
+        __le32 ucode_rate_le32 = cpu_to_le32(ucode_rate);
+
+        for (i = 0; i < num_rates; i++)
+                lq_cmd->rs_table[i] = ucode_rate_le32;
+
+        rs_rate_from_ucode_rate(ucode_rate, band, &rate);
+
+        if (is_mimo(&rate))
+                lq_cmd->mimo_delim = num_rates - 1;
+        else
+                lq_cmd->mimo_delim = 0;
+}
+#endif /* CONFIG_MAC80211_DEBUGFS */
+
+static void rs_fill_rates_for_column(struct iwl_mvm *mvm,
+                                     struct iwl_lq_sta *lq_sta,
+                                     struct rs_rate *rate,
+                                     __le32 *rs_table, int *rs_table_index,
+                                     int num_rates, int num_retries,
+                                     u8 valid_tx_ant, bool toggle_ant)
+{
+        int i, j;
+        __le32 ucode_rate;
+        bool bottom_reached = false;
+        int prev_rate_idx = rate->index;
+        int end = LINK_QUAL_MAX_RETRY_NUM;
+        int index = *rs_table_index;
+
+        for (i = 0; i < num_rates && index < end; i++) {
+                ucode_rate = cpu_to_le32(ucode_rate_from_rs_rate(mvm, rate));
+                for (j = 0; j < num_retries && index < end; j++, index++)
+                        rs_table[index] = ucode_rate;
+
+                if (toggle_ant)
+                        rs_toggle_antenna(valid_tx_ant, rate);
+
+                prev_rate_idx = rate->index;
+                bottom_reached = rs_get_lower_rate_in_column(lq_sta, rate);
+                if (bottom_reached && !is_legacy(rate))
+                        break;
+        }
+
+        if (!bottom_reached)
+                rate->index = prev_rate_idx;
+
+        *rs_table_index = index;
+}
+
+/* Building the rate table is non trivial. When we're in MIMO2/VHT/80Mhz/SGI
+ * column the rate table should look like this:
+ *
+ * rate[0] 0x400D019 VHT | ANT: AB BW: 80Mhz MCS: 9 NSS: 2 SGI
+ * rate[1] 0x400D019 VHT | ANT: AB BW: 80Mhz MCS: 9 NSS: 2 SGI
+ * rate[2] 0x400D018 VHT | ANT: AB BW: 80Mhz MCS: 8 NSS: 2 SGI
+ * rate[3] 0x400D018 VHT | ANT: AB BW: 80Mhz MCS: 8 NSS: 2 SGI
+ * rate[4] 0x400D017 VHT | ANT: AB BW: 80Mhz MCS: 7 NSS: 2 SGI
+ * rate[5] 0x400D017 VHT | ANT: AB BW: 80Mhz MCS: 7 NSS: 2 SGI
+ * rate[6] 0x4005007 VHT | ANT: A BW: 80Mhz MCS: 7 NSS: 1 NGI
+ * rate[7] 0x4009006 VHT | ANT: B BW: 80Mhz MCS: 6 NSS: 1 NGI
+ * rate[8] 0x4005005 VHT | ANT: A BW: 80Mhz MCS: 5 NSS: 1 NGI
+ * rate[9] 0x800B Legacy | ANT: B Rate: 36 Mbps
+ * rate[10] 0x4009 Legacy | ANT: A Rate: 24 Mbps
+ * rate[11] 0x8007 Legacy | ANT: B Rate: 18 Mbps
+ * rate[12] 0x4005 Legacy | ANT: A Rate: 12 Mbps
+ * rate[13] 0x800F Legacy | ANT: B Rate: 9 Mbps
+ * rate[14] 0x400D Legacy | ANT: A Rate: 6 Mbps
+ * rate[15] 0x800D Legacy | ANT: B Rate: 6 Mbps
+ */
+static void rs_build_rates_table(struct iwl_mvm *mvm,
+                                 struct iwl_lq_sta *lq_sta,
+                                 const struct rs_rate *initial_rate)
 {
-        struct iwl_scale_tbl_info tbl_type;
-        int index = 0;
-        int rate_idx;
-        int repeat_rate = 0;
-        u8 ant_toggle_cnt = 0;
-        u8 use_ht_possible = 1;
+        struct rs_rate rate;
+        int num_rates, num_retries, index = 0;
         u8 valid_tx_ant = 0;
         struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
+        bool toggle_ant = false;
 
-        /* Override starting rate (index 0) if needed for debug purposes */
-        rs_dbgfs_set_mcs(lq_sta, &new_rate);
+        memcpy(&rate, initial_rate, sizeof(rate));
 
-        /* Interpret new_rate (rate_n_flags) */
-        rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
-                                 &tbl_type, &rate_idx);
+        valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
 
-        /* How many times should we repeat the initial rate? */
-        if (is_legacy(tbl_type.lq_type)) {
-                ant_toggle_cnt = 1;
-                repeat_rate = IWL_NUMBER_TRY;
+        if (is_siso(&rate)) {
+                num_rates = RS_INITIAL_SISO_NUM_RATES;
+                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
+        } else if (is_mimo(&rate)) {
+                num_rates = RS_INITIAL_MIMO_NUM_RATES;
+                num_retries = RS_HT_VHT_RETRIES_PER_RATE;
         } else {
-                repeat_rate = min(IWL_HT_NUMBER_TRY,
-                                  LINK_QUAL_AGG_DISABLE_START_DEF - 1);
+                num_rates = RS_INITIAL_LEGACY_NUM_RATES;
+                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+                toggle_ant = true;
         }
 
-        lq_cmd->mimo_delim = is_mimo(tbl_type.lq_type) ? 1 : 0;
-
-        /* Fill 1st table entry (index 0) */
-        lq_cmd->rs_table[index] = cpu_to_le32(new_rate);
-
-        if (num_of_ant(tbl_type.ant_type) == 1)
-                lq_cmd->single_stream_ant_msk = tbl_type.ant_type;
-        else if (num_of_ant(tbl_type.ant_type) == 2)
-                lq_cmd->dual_stream_ant_msk = tbl_type.ant_type;
-        /* otherwise we don't modify the existing value */
-
-        index++;
-        repeat_rate--;
-        if (mvm)
-                valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-
-        /* Fill rest of rate table */
-        while (index < LINK_QUAL_MAX_RETRY_NUM) {
-                /* Repeat initial/next rate.
-                 * For legacy IWL_NUMBER_TRY == 1, this loop will not execute.
-                 * For HT IWL_HT_NUMBER_TRY == 3, this executes twice. */
-                while (repeat_rate > 0 && (index < LINK_QUAL_MAX_RETRY_NUM)) {
-                        if (is_legacy(tbl_type.lq_type)) {
-                                if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE)
-                                        ant_toggle_cnt++;
-                                else if (mvm &&
-                                         rs_toggle_antenna(valid_tx_ant,
-                                                        &new_rate, &tbl_type))
-                                        ant_toggle_cnt = 1;
-                        }
+        rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
+                                 num_rates, num_retries, valid_tx_ant,
+                                 toggle_ant);
 
-                        /* Override next rate if needed for debug purposes */
-                        rs_dbgfs_set_mcs(lq_sta, &new_rate);
+        rs_get_lower_rate_down_column(lq_sta, &rate);
 
-                        /* Fill next table entry */
-                        lq_cmd->rs_table[index] =
-                                        cpu_to_le32(new_rate);
-                        repeat_rate--;
-                        index++;
-                }
+        if (is_siso(&rate)) {
+                num_rates = RS_SECONDARY_SISO_NUM_RATES;
+                num_retries = RS_SECONDARY_SISO_RETRIES;
+        } else if (is_legacy(&rate)) {
+                num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
+                num_retries = RS_LEGACY_RETRIES_PER_RATE;
+        } else {
+                WARN_ON_ONCE(1);
+        }
 
-                rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, &tbl_type,
-                                         &rate_idx);
-
-                /* Indicate to uCode which entries might be MIMO.
-                 * If initial rate was MIMO, this will finally end up
-                 * as (IWL_HT_NUMBER_TRY * 2), after 2nd pass, otherwise 0. */
-                if (is_mimo(tbl_type.lq_type))
-                        lq_cmd->mimo_delim = index;
-
-                /* Get next rate */
-                new_rate = rs_get_lower_rate(lq_sta, &tbl_type, rate_idx,
-                                             use_ht_possible);
-
-                /* How many times should we repeat the next rate? */
-                if (is_legacy(tbl_type.lq_type)) {
-                        if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE)
-                                ant_toggle_cnt++;
-                        else if (mvm &&
-                                 rs_toggle_antenna(valid_tx_ant,
-                                                   &new_rate, &tbl_type))
-                                ant_toggle_cnt = 1;
-
-                        repeat_rate = IWL_NUMBER_TRY;
-                } else {
-                        repeat_rate = IWL_HT_NUMBER_TRY;
-                }
+        toggle_ant = true;
 
-                /* Don't allow HT rates after next pass.
-                 * rs_get_lower_rate() will change type to LQ_LEGACY_A
-                 * or LQ_LEGACY_G.
-                 */
-                use_ht_possible = 0;
+        rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
+                                 num_rates, num_retries, valid_tx_ant,
+                                 toggle_ant);
 
-                /* Override next rate if needed for debug purposes */
-                rs_dbgfs_set_mcs(lq_sta, &new_rate);
+        rs_get_lower_rate_down_column(lq_sta, &rate);
 
-                /* Fill next table entry */
-                lq_cmd->rs_table[index] = cpu_to_le32(new_rate);
+        num_rates = RS_SECONDARY_LEGACY_NUM_RATES;
+        num_retries = RS_LEGACY_RETRIES_PER_RATE;
 
-                index++;
-                repeat_rate--;
-        }
+        rs_fill_rates_for_column(mvm, lq_sta, &rate, lq_cmd->rs_table, &index,
+                                 num_rates, num_retries, valid_tx_ant,
+                                 toggle_ant);
+
+}
+
+static void rs_fill_lq_cmd(struct iwl_mvm *mvm,
+                           struct ieee80211_sta *sta,
+                           struct iwl_lq_sta *lq_sta,
+                           const struct rs_rate *initial_rate)
+{
+        struct iwl_lq_cmd *lq_cmd = &lq_sta->lq;
+        u8 ant = initial_rate->ant;
+
+#ifdef CONFIG_MAC80211_DEBUGFS
+        if (lq_sta->dbg_fixed_rate) {
+                rs_build_rates_table_from_fixed(mvm, lq_cmd,
+                                                lq_sta->band,
+                                                lq_sta->dbg_fixed_rate);
+                ant = (lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK) >>
+                        RATE_MCS_ANT_POS;
+        } else
+#endif
+                rs_build_rates_table(mvm, lq_sta, initial_rate);
+
+        if (num_of_ant(ant) == 1)
+                lq_cmd->single_stream_ant_msk = ant;
 
         lq_cmd->agg_frame_cnt_limit = LINK_QUAL_AGG_FRAME_LIMIT_DEF;
         lq_cmd->agg_disable_start_th = LINK_QUAL_AGG_DISABLE_START_DEF;
@@ -2512,31 +2547,83 @@ static void rs_free_sta(void *mvm_r, struct ieee80211_sta *sta,
 }
 
 #ifdef CONFIG_MAC80211_DEBUGFS
-static void rs_dbgfs_set_mcs(struct iwl_lq_sta *lq_sta,
-                             u32 *rate_n_flags)
+static int rs_pretty_print_rate(char *buf, const u32 rate)
 {
-        struct iwl_mvm *mvm;
-        u8 valid_tx_ant;
-        u8 ant_sel_tx;
 
-        mvm = lq_sta->drv;
-        valid_tx_ant = iwl_fw_valid_tx_ant(mvm->fw);
-        if (lq_sta->dbg_fixed_rate) {
-                ant_sel_tx =
-                  ((lq_sta->dbg_fixed_rate & RATE_MCS_ANT_ABC_MSK)
-                  >> RATE_MCS_ANT_POS);
-                if ((valid_tx_ant & ant_sel_tx) == ant_sel_tx) {
-                        *rate_n_flags = lq_sta->dbg_fixed_rate;
-                        IWL_DEBUG_RATE(mvm, "Fixed rate ON\n");
-                } else {
-                        lq_sta->dbg_fixed_rate = 0;
-                        IWL_ERR(mvm,
-                                "Invalid antenna selection 0x%X, Valid is 0x%X\n",
-                                ant_sel_tx, valid_tx_ant);
-                        IWL_DEBUG_RATE(mvm, "Fixed rate OFF\n");
-                }
+        char *type, *bw;
+        u8 mcs = 0, nss = 0;
+        u8 ant = (rate & RATE_MCS_ANT_ABC_MSK) >> RATE_MCS_ANT_POS;
+
+        if (!(rate & RATE_MCS_HT_MSK) &&
+            !(rate & RATE_MCS_VHT_MSK)) {
+                int index = iwl_hwrate_to_plcp_idx(rate);
+
+                return sprintf(buf, "Legacy | ANT: %s Rate: %s Mbps\n",
+                               rs_pretty_ant(ant),
+                               index == IWL_RATE_INVALID ? "BAD" :
+                               iwl_rate_mcs[index].mbps);
+        }
+
+        if (rate & RATE_MCS_VHT_MSK) {
+                type = "VHT";
+                mcs = rate & RATE_VHT_MCS_RATE_CODE_MSK;
+                nss = ((rate & RATE_VHT_MCS_NSS_MSK)
+                       >> RATE_VHT_MCS_NSS_POS) + 1;
+        } else if (rate & RATE_MCS_HT_MSK) {
+                type = "HT";
+                mcs = rate & RATE_HT_MCS_INDEX_MSK;
         } else {
-                IWL_DEBUG_RATE(mvm, "Fixed rate OFF\n");
+                type = "Unknown"; /* shouldn't happen */
+        }
+
+        switch (rate & RATE_MCS_CHAN_WIDTH_MSK) {
+        case RATE_MCS_CHAN_WIDTH_20:
+                bw = "20Mhz";
+                break;
+        case RATE_MCS_CHAN_WIDTH_40:
+                bw = "40Mhz";
+                break;
+        case RATE_MCS_CHAN_WIDTH_80:
+                bw = "80Mhz";
+                break;
+        case RATE_MCS_CHAN_WIDTH_160:
+                bw = "160Mhz";
+                break;
+        default:
+                bw = "BAD BW";
+        }
+
+        return sprintf(buf, "%s | ANT: %s BW: %s MCS: %d NSS: %d %s%s%s%s%s\n",
+                       type, rs_pretty_ant(ant), bw, mcs, nss,
+                       (rate & RATE_MCS_SGI_MSK) ? "SGI " : "NGI ",
+                       (rate & RATE_MCS_STBC_MSK) ? "STBC " : "",
+                       (rate & RATE_MCS_LDPC_MSK) ? "LDPC " : "",
+                       (rate & RATE_MCS_BF_MSK) ? "BF " : "",
+                       (rate & RATE_MCS_ZLF_MSK) ? "ZLF " : "");
+}
+
+/**
+ * Program the device to use fixed rate for frame transmit
+ * This is for debugging/testing only
+ * once the device start use fixed rate, we need to reload the module
+ * to being back the normal operation.
+ */
+static void rs_program_fix_rate(struct iwl_mvm *mvm,
+                                struct iwl_lq_sta *lq_sta)
+{
+        lq_sta->active_legacy_rate = 0x0FFF;    /* 1 - 54 MBits, includes CCK */
+        lq_sta->active_siso_rate   = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
+        lq_sta->active_mimo2_rate  = 0x1FD0;    /* 6 - 60 MBits, no 9, no CCK */
+
+        IWL_DEBUG_RATE(mvm, "sta_id %d rate 0x%X\n",
+                       lq_sta->lq.sta_id, lq_sta->dbg_fixed_rate);
+
+        if (lq_sta->dbg_fixed_rate) {
+                struct rs_rate rate;
+                rs_rate_from_ucode_rate(lq_sta->dbg_fixed_rate,
+                                        lq_sta->band, &rate);
+                rs_fill_lq_cmd(mvm, NULL, lq_sta, &rate);
+                iwl_mvm_send_lq_cmd(lq_sta->drv, &lq_sta->lq, false);
         }
 }
 
@@ -2572,15 +2659,14 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
         char *buff;
         int desc = 0;
         int i = 0;
-        int index = 0;
         ssize_t ret;
 
         struct iwl_lq_sta *lq_sta = file->private_data;
         struct iwl_mvm *mvm;
         struct iwl_scale_tbl_info *tbl = &(lq_sta->lq_info[lq_sta->active_tbl]);
-
+        struct rs_rate *rate = &tbl->rate;
         mvm = lq_sta->drv;
-        buff = kmalloc(1024, GFP_KERNEL);
+        buff = kmalloc(2048, GFP_KERNEL);
         if (!buff)
                 return -ENOMEM;
 
@@ -2595,23 +2681,23 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
             (iwl_fw_valid_tx_ant(mvm->fw) & ANT_B) ? "ANT_B," : "",
             (iwl_fw_valid_tx_ant(mvm->fw) & ANT_C) ? "ANT_C" : "");
         desc += sprintf(buff+desc, "lq type %s\n",
-                        (is_legacy(tbl->lq_type)) ? "legacy" :
-                        is_vht(tbl->lq_type) ? "VHT" : "HT");
-        if (is_ht(tbl->lq_type)) {
+                        (is_legacy(rate)) ? "legacy" :
+                        is_vht(rate) ? "VHT" : "HT");
+        if (!is_legacy(rate)) {
                 desc += sprintf(buff+desc, " %s",
-                   (is_siso(tbl->lq_type)) ? "SISO" : "MIMO2");
+                   (is_siso(rate)) ? "SISO" : "MIMO2");
                    desc += sprintf(buff+desc, " %s",
-                                   (is_ht20(tbl)) ? "20MHz" :
-                                   (is_ht40(tbl)) ? "40MHz" :
-                                   (is_ht80(tbl)) ? "80Mhz" : "BAD BW");
+                                   (is_ht20(rate)) ? "20MHz" :
+                                   (is_ht40(rate)) ? "40MHz" :
+                                   (is_ht80(rate)) ? "80Mhz" : "BAD BW");
                    desc += sprintf(buff+desc, " %s %s\n",
-                                   (tbl->is_SGI) ? "SGI" : "",
+                                   (rate->sgi) ? "SGI" : "NGI",
                                    (lq_sta->is_agg) ? "AGG on" : "");
         }
         desc += sprintf(buff+desc, "last tx rate=0x%X\n",
                         lq_sta->last_rate_n_flags);
         desc += sprintf(buff+desc,
-                        "general: flags=0x%X mimo-d=%d s-ant0x%x d-ant=0x%x\n",
+                        "general: flags=0x%X mimo-d=%d s-ant=0x%x d-ant=0x%x\n",
                         lq_sta->lq.flags,
                         lq_sta->lq.mimo_delim,
                         lq_sta->lq.single_stream_ant_msk,
@@ -2631,19 +2717,10 @@ static ssize_t rs_sta_dbgfs_scale_table_read(struct file *file,
                         lq_sta->lq.initial_rate_index[3]);
 
         for (i = 0; i < LINK_QUAL_MAX_RETRY_NUM; i++) {
-                index = iwl_hwrate_to_plcp_idx(
-                        le32_to_cpu(lq_sta->lq.rs_table[i]));
-                if (is_legacy(tbl->lq_type)) {
-                        desc += sprintf(buff+desc, " rate[%d] 0x%X %smbps\n",
-                                        i, le32_to_cpu(lq_sta->lq.rs_table[i]),
-                                        iwl_rate_mcs[index].mbps);
-                } else {
-                        desc += sprintf(buff+desc,
-                                        " rate[%d] 0x%X %smbps (%s)\n",
-                                        i, le32_to_cpu(lq_sta->lq.rs_table[i]),
-                                        iwl_rate_mcs[index].mbps,
-                                        iwl_rate_mcs[index].mcs);
-                }
+                u32 r = le32_to_cpu(lq_sta->lq.rs_table[i]);
+
+                desc += sprintf(buff+desc, " rate[%d] 0x%X ", i, r);
+                desc += rs_pretty_print_rate(buff+desc, r);
         }
 
         ret = simple_read_from_buffer(user_buf, count, ppos, buff, desc);
@@ -2665,6 +2742,7 @@ static ssize_t rs_sta_dbgfs_stats_table_read(struct file *file,
         int i, j;
         ssize_t ret;
         struct iwl_scale_tbl_info *tbl;
+        struct rs_rate *rate;
         struct iwl_lq_sta *lq_sta = file->private_data;
 
         buff = kmalloc(1024, GFP_KERNEL);
@@ -2673,16 +2751,17 @@ static ssize_t rs_sta_dbgfs_stats_table_read(struct file *file,
 
         for (i = 0; i < LQ_SIZE; i++) {
                 tbl = &(lq_sta->lq_info[i]);
+                rate = &tbl->rate;
                 desc += sprintf(buff+desc,
                                 "%s type=%d SGI=%d BW=%s DUP=0\n"
-                                "rate=0x%X\n",
+                                "index=%d\n",
                                 lq_sta->active_tbl == i ? "*" : "x",
-                                tbl->lq_type,
-                                tbl->is_SGI,
-                                is_ht20(tbl) ? "20Mhz" :
-                                is_ht40(tbl) ? "40Mhz" :
-                                is_ht80(tbl) ? "80Mhz" : "ERR",
-                                tbl->current_rate);
+                                rate->type,
+                                rate->sgi,
+                                is_ht20(rate) ? "20Mhz" :
+                                is_ht40(rate) ? "40Mhz" :
+                                is_ht80(rate) ? "80Mhz" : "ERR",
+                                rate->index);
                 for (j = 0; j < IWL_RATE_COUNT; j++) {
                         desc += sprintf(buff+desc,
                                 "counter=%d success=%d %%=%d\n",
@@ -2746,6 +2825,7 @@ static struct rate_control_ops rs_mvm_ops = {
         .free = rs_free,
         .alloc_sta = rs_alloc_sta,
         .free_sta = rs_free_sta,
+        .rate_update = rs_rate_update,
 #ifdef CONFIG_MAC80211_DEBUGFS
         .add_sta_debugfs = rs_add_debugfs,
         .remove_sta_debugfs = rs_remove_debugfs,
@@ -2778,13 +2858,13 @@ int iwl_mvm_tx_protection(struct iwl_mvm *mvm, struct iwl_mvm_sta *mvmsta,
 
         if (enable) {
                 if (mvmsta->tx_protection == 0)
-                        lq->flags |= LQ_FLAG_SET_STA_TLC_RTS_MSK;
+                        lq->flags |= LQ_FLAG_USE_RTS_MSK;
                 mvmsta->tx_protection++;
         } else {
                 mvmsta->tx_protection--;
                 if (mvmsta->tx_protection == 0)
-                        lq->flags &= ~LQ_FLAG_SET_STA_TLC_RTS_MSK;
+                        lq->flags &= ~LQ_FLAG_USE_RTS_MSK;
         }
 
-        return iwl_mvm_send_lq_cmd(mvm, lq, CMD_ASYNC, false);
+        return iwl_mvm_send_lq_cmd(mvm, lq, false);
 }
diff --git a/drivers/net/wireless/iwlwifi/mvm/rs.h b/drivers/net/wireless/iwlwifi/mvm/rs.h
index 5d5344f7070b..7bc6404f6986 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rs.h
+++ b/drivers/net/wireless/iwlwifi/mvm/rs.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify it
  * under the terms of version 2 of the GNU General Public License as
@@ -155,38 +155,7 @@ enum {
 #define IWL_RATE_SCALE_SWITCH           10880   /*  85% */
 #define IWL_RATE_HIGH_TH                10880   /*  85% */
 #define IWL_RATE_INCREASE_TH            6400    /*  50% */
-#define IWL_RATE_DECREASE_TH            1920    /*  15% */
-
-/* possible actions when in legacy mode */
-enum {
-        IWL_LEGACY_SWITCH_ANTENNA,
-        IWL_LEGACY_SWITCH_SISO,
-        IWL_LEGACY_SWITCH_MIMO2,
-        IWL_LEGACY_FIRST_ACTION = IWL_LEGACY_SWITCH_ANTENNA,
-        IWL_LEGACY_LAST_ACTION = IWL_LEGACY_SWITCH_MIMO2,
-};
-
-/* possible actions when in siso mode */
-enum {
-        IWL_SISO_SWITCH_ANTENNA,
-        IWL_SISO_SWITCH_MIMO2,
-        IWL_SISO_SWITCH_GI,
-        IWL_SISO_FIRST_ACTION = IWL_SISO_SWITCH_ANTENNA,
-        IWL_SISO_LAST_ACTION = IWL_SISO_SWITCH_GI,
-};
-
-/* possible actions when in mimo mode */
-enum {
-        IWL_MIMO2_SWITCH_SISO_A,
-        IWL_MIMO2_SWITCH_SISO_B,
-        IWL_MIMO2_SWITCH_GI,
-        IWL_MIMO2_FIRST_ACTION = IWL_MIMO2_SWITCH_SISO_A,
-        IWL_MIMO2_LAST_ACTION = IWL_MIMO2_SWITCH_GI,
-};
-
-#define IWL_MAX_SEARCH IWL_MIMO2_LAST_ACTION
-
-#define IWL_ACTION_LIMIT                3       /* # possible actions */
+#define RS_SR_FORCE_DECREASE            1920    /*  15% */
 
 #define LINK_QUAL_AGG_TIME_LIMIT_DEF    (4000) /* 4 milliseconds */
 #define LINK_QUAL_AGG_TIME_LIMIT_MAX    (8000)
@@ -224,22 +193,45 @@ enum iwl_table_type {
         LQ_MAX,
 };
 
-#define is_legacy(tbl) (((tbl) == LQ_LEGACY_G) || ((tbl) == LQ_LEGACY_A))
-#define is_ht_siso(tbl) ((tbl) == LQ_HT_SISO)
-#define is_ht_mimo2(tbl) ((tbl) == LQ_HT_MIMO2)
-#define is_vht_siso(tbl) ((tbl) == LQ_VHT_SISO)
-#define is_vht_mimo2(tbl) ((tbl) == LQ_VHT_MIMO2)
-#define is_siso(tbl) (is_ht_siso(tbl) || is_vht_siso(tbl))
-#define is_mimo2(tbl) (is_ht_mimo2(tbl) || is_vht_mimo2(tbl))
-#define is_mimo(tbl) (is_mimo2(tbl))
-#define is_ht(tbl) (is_ht_siso(tbl) || is_ht_mimo2(tbl))
-#define is_vht(tbl) (is_vht_siso(tbl) || is_vht_mimo2(tbl))
-#define is_a_band(tbl) ((tbl) == LQ_LEGACY_A)
-#define is_g_band(tbl) ((tbl) == LQ_LEGACY_G)
-
-#define is_ht20(tbl) (tbl->bw == RATE_MCS_CHAN_WIDTH_20)
-#define is_ht40(tbl) (tbl->bw == RATE_MCS_CHAN_WIDTH_40)
-#define is_ht80(tbl) (tbl->bw == RATE_MCS_CHAN_WIDTH_80)
+struct rs_rate {
+        int index;
+        enum iwl_table_type type;
+        u8 ant;
+        u32 bw;
+        bool sgi;
+};
+
+
+#define is_type_legacy(type) (((type) == LQ_LEGACY_G) || \
+                              ((type) == LQ_LEGACY_A))
+#define is_type_ht_siso(type) ((type) == LQ_HT_SISO)
+#define is_type_ht_mimo2(type) ((type) == LQ_HT_MIMO2)
+#define is_type_vht_siso(type) ((type) == LQ_VHT_SISO)
+#define is_type_vht_mimo2(type) ((type) == LQ_VHT_MIMO2)
+#define is_type_siso(type) (is_type_ht_siso(type) || is_type_vht_siso(type))
+#define is_type_mimo2(type) (is_type_ht_mimo2(type) || is_type_vht_mimo2(type))
+#define is_type_mimo(type) (is_type_mimo2(type))
+#define is_type_ht(type) (is_type_ht_siso(type) || is_type_ht_mimo2(type))
+#define is_type_vht(type) (is_type_vht_siso(type) || is_type_vht_mimo2(type))
+#define is_type_a_band(type) ((type) == LQ_LEGACY_A)
+#define is_type_g_band(type) ((type) == LQ_LEGACY_G)
+
+#define is_legacy(rate)       is_type_legacy((rate)->type)
+#define is_ht_siso(rate)      is_type_ht_siso((rate)->type)
+#define is_ht_mimo2(rate)     is_type_ht_mimo2((rate)->type)
+#define is_vht_siso(rate)     is_type_vht_siso((rate)->type)
+#define is_vht_mimo2(rate)    is_type_vht_mimo2((rate)->type)
+#define is_siso(rate)         is_type_siso((rate)->type)
+#define is_mimo2(rate)        is_type_mimo2((rate)->type)
+#define is_mimo(rate)         is_type_mimo((rate)->type)
+#define is_ht(rate)           is_type_ht((rate)->type)
+#define is_vht(rate)          is_type_vht((rate)->type)
+#define is_a_band(rate)       is_type_a_band((rate)->type)
+#define is_g_band(rate)       is_type_g_band((rate)->type)
+
+#define is_ht20(rate)         ((rate)->bw == RATE_MCS_CHAN_WIDTH_20)
+#define is_ht40(rate)         ((rate)->bw == RATE_MCS_CHAN_WIDTH_40)
+#define is_ht80(rate)         ((rate)->bw == RATE_MCS_CHAN_WIDTH_80)
 
 #define IWL_MAX_MCS_DISPLAY_SIZE        12
 
@@ -257,7 +249,23 @@ struct iwl_rate_scale_data {
         s32 success_ratio;      /* per-cent * 128  */
         s32 counter;            /* number of frames attempted */
         s32 average_tpt;        /* success ratio * expected throughput */
-        unsigned long stamp;
+};
+
+/* Possible Tx columns
+ * Tx Column = a combo of legacy/siso/mimo x antenna x SGI
+ */
+enum rs_column {
+        RS_COLUMN_LEGACY_ANT_A = 0,
+        RS_COLUMN_LEGACY_ANT_B,
+        RS_COLUMN_SISO_ANT_A,
+        RS_COLUMN_SISO_ANT_B,
+        RS_COLUMN_SISO_ANT_A_SGI,
+        RS_COLUMN_SISO_ANT_B_SGI,
+        RS_COLUMN_MIMO2,
+        RS_COLUMN_MIMO2_SGI,
+
+        RS_COLUMN_LAST = RS_COLUMN_MIMO2_SGI,
+        RS_COLUMN_INVALID,
 };
 
 /**
@@ -267,17 +275,18 @@ struct iwl_rate_scale_data {
  * one for "active", and one for "search".
  */
 struct iwl_scale_tbl_info {
-        enum iwl_table_type lq_type;
-        u8 ant_type;
-        u8 is_SGI;      /* 1 = short guard interval */
-        u32 bw;         /* channel bandwidth; RATE_MCS_CHAN_WIDTH_XX */
-        u8 action;      /* change modulation; IWL_[LEGACY/SISO/MIMO]_SWITCH_* */
-        u8 max_search;  /* maximun number of tables we can search */
+        struct rs_rate rate;
+        enum rs_column column;
         s32 *expected_tpt;      /* throughput metrics; expected_tpt_G, etc. */
-        u32 current_rate;  /* rate_n_flags, uCode API format */
         struct iwl_rate_scale_data win[IWL_RATE_COUNT]; /* rate histories */
 };
 
+enum {
+        RS_STATE_SEARCH_CYCLE_STARTED,
+        RS_STATE_SEARCH_CYCLE_ENDED,
+        RS_STATE_STAY_IN_COLUMN,
+};
+
 /**
  * struct iwl_lq_sta -- driver's rate scaling private structure
  *
@@ -285,8 +294,7 @@ struct iwl_scale_tbl_info {
  */
 struct iwl_lq_sta {
         u8 active_tbl;          /* index of active table, range 0-1 */
-        u8 enable_counter;      /* indicates HT mode */
-        u8 stay_in_tbl;         /* 1: disallow, 0: allow search for new mode */
+        u8 rs_state;            /* RS_STATE_* */
         u8 search_better_tbl;   /* 1: currently trying alternate mode */
         s32 last_tpt;
 
@@ -299,12 +307,13 @@ struct iwl_lq_sta {
         u32 total_success;      /* total successful frames, any/all rates */
         u64 flush_timer;        /* time staying in mode before new search */
 
-        u8 action_counter;      /* # mode-switch actions tried */
+        u32 visited_columns;    /* Bitmask marking which Tx columns were
+                                 * explored during a search cycle
+                                 */
         bool is_vht;
         enum ieee80211_band band;
 
         /* The following are bitmaps of rates; IWL_RATE_6M_MASK, etc. */
-        u32 supp_rates;
         u16 active_legacy_rate;
         u16 active_siso_rate;
         u16 active_mimo2_rate;
@@ -328,32 +337,11 @@ struct iwl_lq_sta {
         u32 last_rate_n_flags;
         /* packets destined for this STA are aggregated */
         u8 is_agg;
-        /* BT traffic this sta was last updated in */
-        u8 last_bt_traffic;
-};
-
-enum iwl_bt_coex_profile_traffic_load {
-        IWL_BT_COEX_TRAFFIC_LOAD_NONE           = 0,
-        IWL_BT_COEX_TRAFFIC_LOAD_LOW            = 1,
-        IWL_BT_COEX_TRAFFIC_LOAD_HIGH           = 2,
-        IWL_BT_COEX_TRAFFIC_LOAD_CONTINUOUS     = 3,
-/*
- * There are no more even though below is a u8, the
- * indication from the BT device only has two bits.
- */
 };
 
-
-static inline u8 num_of_ant(u8 mask)
-{
-        return  !!((mask) & ANT_A) +
-                !!((mask) & ANT_B) +
-                !!((mask) & ANT_C);
-}
-
 /* Initialize station's rate scaling information after adding station */
 void iwl_mvm_rs_rate_init(struct iwl_mvm *mvm, struct ieee80211_sta *sta,
-                          enum ieee80211_band band);
+                          enum ieee80211_band band, bool init);
 
 /**
  * iwl_rate_control_register - Register the rate control algorithm callbacks
diff --git a/drivers/net/wireless/iwlwifi/mvm/rx.c b/drivers/net/wireless/iwlwifi/mvm/rx.c
index 3a1f3982109d..a85b60f7e67e 100644
--- a/drivers/net/wireless/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/rx.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -251,6 +251,12 @@ static u32 iwl_mvm_set_mac80211_rx_flag(struct iwl_mvm *mvm,
                 stats->flag |= RX_FLAG_DECRYPTED;
                 return 0;
 
+        case RX_MPDU_RES_STATUS_SEC_EXT_ENC:
+                if (!(rx_pkt_status & RX_MPDU_RES_STATUS_MIC_OK))
+                        return -1;
+                stats->flag |= RX_FLAG_DECRYPTED;
+                return 0;
+
         default:
                 IWL_ERR(mvm, "Unhandled alg: 0x%x\n", rx_pkt_status);
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/scan.c b/drivers/net/wireless/iwlwifi/mvm/scan.c
index dff7592e1ff8..0e0007960612 100644
--- a/drivers/net/wireless/iwlwifi/mvm/scan.c
+++ b/drivers/net/wireless/iwlwifi/mvm/scan.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -70,6 +70,9 @@
 
 #define IWL_PLCP_QUIET_THRESH 1
 #define IWL_ACTIVE_QUIET_TIME 10
+#define LONG_OUT_TIME_PERIOD 600
+#define SHORT_OUT_TIME_PERIOD 200
+#define SUSPEND_TIME_PERIOD 100
 
 static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
 {
@@ -87,20 +90,22 @@ static inline __le16 iwl_mvm_scan_rx_chain(struct iwl_mvm *mvm)
         return cpu_to_le16(rx_chain);
 }
 
-static inline __le32 iwl_mvm_scan_max_out_time(struct ieee80211_vif *vif)
+static inline __le32 iwl_mvm_scan_max_out_time(struct ieee80211_vif *vif,
+                                               u32 flags, bool is_assoc)
 {
-        if (vif->bss_conf.assoc)
-                return cpu_to_le32(200 * 1024);
-        else
+        if (!is_assoc)
                 return 0;
+        if (flags & NL80211_SCAN_FLAG_LOW_PRIORITY)
+                return cpu_to_le32(ieee80211_tu_to_usec(SHORT_OUT_TIME_PERIOD));
+        return cpu_to_le32(ieee80211_tu_to_usec(LONG_OUT_TIME_PERIOD));
 }
 
-static inline __le32 iwl_mvm_scan_suspend_time(struct ieee80211_vif *vif)
+static inline __le32 iwl_mvm_scan_suspend_time(struct ieee80211_vif *vif,
+                                               bool is_assoc)
 {
-        if (!vif->bss_conf.assoc)
+        if (!is_assoc)
                 return 0;
-
-        return cpu_to_le32(ieee80211_tu_to_usec(vif->bss_conf.beacon_int));
+        return cpu_to_le32(ieee80211_tu_to_usec(SUSPEND_TIME_PERIOD));
 }
 
 static inline __le32
@@ -192,7 +197,7 @@ static void iwl_mvm_scan_fill_channels(struct iwl_scan_cmd *cmd,
         for (i = 0; i < cmd->channel_count; i++) {
                 chan->channel = cpu_to_le16(req->channels[i]->hw_value);
                 chan->type = cpu_to_le32(type);
-                if (req->channels[i]->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                if (req->channels[i]->flags & IEEE80211_CHAN_NO_IR)
                         chan->type &= cpu_to_le32(~SCAN_CHANNEL_TYPE_ACTIVE);
                 chan->active_dwell = cpu_to_le16(active_dwell);
                 chan->passive_dwell = cpu_to_le16(passive_dwell);
@@ -262,6 +267,15 @@ static u16 iwl_mvm_fill_probe_req(struct ieee80211_mgmt *frame, const u8 *ta,
         return (u16)len;
 }
 
+static void iwl_mvm_vif_assoc_iterator(void *data, u8 *mac,
+                                       struct ieee80211_vif *vif)
+{
+        bool *is_assoc = data;
+
+        if (vif->bss_conf.assoc)
+                *is_assoc = true;
+}
+
 int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                          struct ieee80211_vif *vif,
                          struct cfg80211_scan_request *req)
@@ -274,6 +288,7 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
                 .dataflags = { IWL_HCMD_DFL_NOCOPY, },
         };
         struct iwl_scan_cmd *cmd = mvm->scan_cmd;
+        bool is_assoc = false;
         int ret;
         u32 status;
         int ssid_len = 0;
@@ -289,13 +304,17 @@ int iwl_mvm_scan_request(struct iwl_mvm *mvm,
         memset(cmd, 0, sizeof(struct iwl_scan_cmd) +
                mvm->fw->ucode_capa.max_probe_length +
                (MAX_NUM_SCAN_CHANNELS * sizeof(struct iwl_scan_channel)));
-
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_vif_assoc_iterator,
+                                            &is_assoc);
         cmd->channel_count = (u8)req->n_channels;
         cmd->quiet_time = cpu_to_le16(IWL_ACTIVE_QUIET_TIME);
         cmd->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
         cmd->rxchain_sel_flags = iwl_mvm_scan_rx_chain(mvm);
-        cmd->max_out_time = iwl_mvm_scan_max_out_time(vif);
-        cmd->suspend_time = iwl_mvm_scan_suspend_time(vif);
+        cmd->max_out_time = iwl_mvm_scan_max_out_time(vif, req->flags,
+                                                      is_assoc);
+        cmd->suspend_time = iwl_mvm_scan_suspend_time(vif, is_assoc);
         cmd->rxon_flags = iwl_mvm_scan_rxon_flags(req);
         cmd->filter_flags = cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
                                         MAC_FILTER_IN_BEACON);
@@ -454,13 +473,18 @@ void iwl_mvm_cancel_scan(struct iwl_mvm *mvm)
         if (mvm->scan_status == IWL_MVM_SCAN_NONE)
                 return;
 
+        if (iwl_mvm_is_radio_killed(mvm)) {
+                ieee80211_scan_completed(mvm->hw, true);
+                mvm->scan_status = IWL_MVM_SCAN_NONE;
+                return;
+        }
+
         iwl_init_notification_wait(&mvm->notif_wait, &wait_scan_abort,
                                    scan_abort_notif,
                                    ARRAY_SIZE(scan_abort_notif),
                                    iwl_mvm_scan_abort_notif, NULL);
 
-        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD,
-                                   CMD_SYNC | CMD_SEND_IN_RFKILL, 0, NULL);
+        ret = iwl_mvm_send_cmd_pdu(mvm, SCAN_ABORT_CMD, CMD_SYNC, 0, NULL);
         if (ret) {
                 IWL_ERR(mvm, "Couldn't send SCAN_ABORT_CMD: %d\n", ret);
                 /* mac80211's state will be cleaned in the fw_restart flow */
@@ -522,6 +546,12 @@ static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
                                struct cfg80211_sched_scan_request *req,
                                struct iwl_scan_offload_cmd *scan)
 {
+        bool is_assoc = false;
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                            IEEE80211_IFACE_ITER_NORMAL,
+                                            iwl_mvm_vif_assoc_iterator,
+                                            &is_assoc);
         scan->channel_count =
                 mvm->nvm_data->bands[IEEE80211_BAND_2GHZ].n_channels +
                 mvm->nvm_data->bands[IEEE80211_BAND_5GHZ].n_channels;
@@ -529,8 +559,9 @@ static void iwl_build_scan_cmd(struct iwl_mvm *mvm,
         scan->quiet_plcp_th = cpu_to_le16(IWL_PLCP_QUIET_THRESH);
         scan->good_CRC_th = IWL_GOOD_CRC_TH_DEFAULT;
         scan->rx_chain = iwl_mvm_scan_rx_chain(mvm);
-        scan->max_out_time = cpu_to_le32(200 * 1024);
-        scan->suspend_time = iwl_mvm_scan_suspend_time(vif);
+        scan->max_out_time = iwl_mvm_scan_max_out_time(vif, req->flags,
+                                                       is_assoc);
+        scan->suspend_time = iwl_mvm_scan_suspend_time(vif, is_assoc);
         scan->filter_flags |= cpu_to_le32(MAC_FILTER_ACCEPT_GRP |
                                           MAC_FILTER_IN_BEACON);
         scan->scan_type = cpu_to_le32(SCAN_TYPE_BACKGROUND);
@@ -642,7 +673,7 @@ static void iwl_build_channel_cfg(struct iwl_mvm *mvm,
                 channels->iter_count[index] = cpu_to_le16(1);
                 channels->iter_interval[index] = 0;
 
-                if (!(s_band->channels[i].flags & IEEE80211_CHAN_PASSIVE_SCAN))
+                if (!(s_band->channels[i].flags & IEEE80211_CHAN_NO_IR))
                         channels->type[index] |=
                                 cpu_to_le32(IWL_SCAN_OFFLOAD_CHANNEL_ACTIVE);
 
@@ -817,11 +848,10 @@ int iwl_mvm_sched_scan_start(struct iwl_mvm *mvm,
                 IWL_DEBUG_SCAN(mvm,
                                "Sending scheduled scan with filtering, filter len %d\n",
                                req->n_match_sets);
-                scan_req.flags |=
-                                cpu_to_le16(IWL_SCAN_OFFLOAD_FLAG_FILTER_SSID);
         } else {
                 IWL_DEBUG_SCAN(mvm,
                                "Sending Scheduled scan without filtering\n");
+                scan_req.flags |= cpu_to_le16(IWL_SCAN_OFFLOAD_FLAG_PASS_ALL);
         }
 
         return iwl_mvm_send_cmd_pdu(mvm, SCAN_OFFLOAD_REQUEST_CMD, CMD_SYNC,
diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c b/drivers/net/wireless/iwlwifi/mvm/sf.c
new file mode 100644
index 000000000000..8401627c0030
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
@@ -0,0 +1,291 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called COPYING.
+ *
+ * Contact Information:
+ *  Intel Linux Wireless <ilw@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+#include "mvm.h"
+
+/* For counting bound interfaces */
+struct iwl_mvm_active_iface_iterator_data {
+        struct ieee80211_vif *ignore_vif;
+        u8 sta_vif_ap_sta_id;
+        enum iwl_sf_state sta_vif_state;
+        int num_active_macs;
+};
+
+/*
+ * Count bound interfaces which are not p2p, besides data->ignore_vif.
+ * data->station_vif will point to one bound vif of type station, if exists.
+ */
+static void iwl_mvm_bound_iface_iterator(void *_data, u8 *mac,
+                                         struct ieee80211_vif *vif)
+{
+        struct iwl_mvm_active_iface_iterator_data *data = _data;
+        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+
+        if (vif == data->ignore_vif || !mvmvif->phy_ctxt ||
+            vif->type == NL80211_IFTYPE_P2P_DEVICE)
+                return;
+
+        data->num_active_macs++;
+
+        if (vif->type == NL80211_IFTYPE_STATION) {
+                data->sta_vif_ap_sta_id = mvmvif->ap_sta_id;
+                if (vif->bss_conf.assoc)
+                        data->sta_vif_state = SF_FULL_ON;
+                else
+                        data->sta_vif_state = SF_INIT_OFF;
+        }
+}
+
+/*
+ * Aging and idle timeouts for the different possible scenarios
+ * in SF_FULL_ON state.
+ */
+static const __le32 sf_full_timeout[SF_NUM_SCENARIO][SF_NUM_TIMEOUT_TYPES] = {
+        {
+                cpu_to_le32(SF_SINGLE_UNICAST_AGING_TIMER),
+                cpu_to_le32(SF_SINGLE_UNICAST_IDLE_TIMER)
+        },
+        {
+                cpu_to_le32(SF_AGG_UNICAST_AGING_TIMER),
+                cpu_to_le32(SF_AGG_UNICAST_IDLE_TIMER)
+        },
+        {
+                cpu_to_le32(SF_MCAST_AGING_TIMER),
+                cpu_to_le32(SF_MCAST_IDLE_TIMER)
+        },
+        {
+                cpu_to_le32(SF_BA_AGING_TIMER),
+                cpu_to_le32(SF_BA_IDLE_TIMER)
+        },
+        {
+                cpu_to_le32(SF_TX_RE_AGING_TIMER),
+                cpu_to_le32(SF_TX_RE_IDLE_TIMER)
+        },
+};
+
+static void iwl_mvm_fill_sf_command(struct iwl_sf_cfg_cmd *sf_cmd,
+                                    struct ieee80211_sta *sta)
+{
+        int i, j, watermark;
+
+        sf_cmd->watermark[SF_LONG_DELAY_ON] = cpu_to_le32(SF_W_MARK_SCAN);
+
+        /*
+         * If we are in association flow - check antenna configuration
+         * capabilities of the AP station, and choose the watermark accordingly.
+         */
+        if (sta) {
+                if (sta->ht_cap.ht_supported || sta->vht_cap.vht_supported) {
+                        switch (sta->rx_nss) {
+                        case 1:
+                                watermark = SF_W_MARK_SISO;
+                                break;
+                        case 2:
+                                watermark = SF_W_MARK_MIMO2;
+                                break;
+                        default:
+                                watermark = SF_W_MARK_MIMO3;
+                                break;
+                        }
+                } else {
+                        watermark = SF_W_MARK_LEGACY;
+                }
+        /* default watermark value for unassociated mode. */
+        } else {
+                watermark = SF_W_MARK_MIMO2;
+        }
+        sf_cmd->watermark[SF_FULL_ON] = cpu_to_le32(watermark);
+
+        for (i = 0; i < SF_NUM_SCENARIO; i++) {
+                for (j = 0; j < SF_NUM_TIMEOUT_TYPES; j++) {
+                        sf_cmd->long_delay_timeouts[i][j] =
+                                        cpu_to_le32(SF_LONG_DELAY_AGING_TIMER);
+                }
+        }
+        BUILD_BUG_ON(sizeof(sf_full_timeout) !=
+                     sizeof(__le32) * SF_NUM_SCENARIO * SF_NUM_TIMEOUT_TYPES);
+
+        memcpy(sf_cmd->full_on_timeouts, sf_full_timeout,
+               sizeof(sf_full_timeout));
+}
+
+static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 sta_id,
+                             enum iwl_sf_state new_state)
+{
+        struct iwl_sf_cfg_cmd sf_cmd = {
+                .state = new_state,
+        };
+        struct ieee80211_sta *sta;
+        int ret = 0;
+
+        /*
+         * If an associated AP sta changed its antenna configuration, the state
+         * will remain FULL_ON but SF parameters need to be reconsidered.
+         */
+        if (new_state != SF_FULL_ON && mvm->sf_state == new_state)
+                return 0;
+
+        switch (new_state) {
+        case SF_UNINIT:
+                break;
+        case SF_FULL_ON:
+                if (sta_id == IWL_MVM_STATION_COUNT) {
+                        IWL_ERR(mvm,
+                                "No station: Cannot switch SF to FULL_ON\n");
+                        return -EINVAL;
+                }
+                rcu_read_lock();
+                sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
+                if (IS_ERR_OR_NULL(sta)) {
+                        IWL_ERR(mvm, "Invalid station id\n");
+                        rcu_read_unlock();
+                        return -EINVAL;
+                }
+                iwl_mvm_fill_sf_command(&sf_cmd, sta);
+                rcu_read_unlock();
+                break;
+        case SF_INIT_OFF:
+                iwl_mvm_fill_sf_command(&sf_cmd, NULL);
+                break;
+        default:
+                WARN_ONCE(1, "Invalid state: %d. not sending Smart Fifo cmd\n",
+                          new_state);
+                return -EINVAL;
+        }
+
+        ret = iwl_mvm_send_cmd_pdu(mvm, REPLY_SF_CFG_CMD, CMD_ASYNC,
+                                   sizeof(sf_cmd), &sf_cmd);
+        if (!ret)
+                mvm->sf_state = new_state;
+
+        return ret;
+}
+
+/*
+ * Update Smart fifo:
+ * Count bound interfaces that are not to be removed, ignoring p2p devices,
+ * and set new state accordingly.
+ */
+int iwl_mvm_sf_update(struct iwl_mvm *mvm, struct ieee80211_vif *changed_vif,
+                      bool remove_vif)
+{
+        enum iwl_sf_state new_state;
+        u8 sta_id = IWL_MVM_STATION_COUNT;
+        struct iwl_mvm_vif *mvmvif = NULL;
+        struct iwl_mvm_active_iface_iterator_data data = {
+                .ignore_vif = changed_vif,
+                .sta_vif_state = SF_UNINIT,
+                .sta_vif_ap_sta_id = IWL_MVM_STATION_COUNT,
+        };
+
+        if (IWL_UCODE_API(mvm->fw->ucode_ver) < 8)
+                return 0;
+
+        /*
+         * Ignore the call if we are in HW Restart flow, or if the handled
+         * vif is a p2p device.
+         */
+        if (test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) ||
+            (changed_vif && changed_vif->type == NL80211_IFTYPE_P2P_DEVICE))
+                return 0;
+
+        ieee80211_iterate_active_interfaces_atomic(mvm->hw,
+                                                   IEEE80211_IFACE_ITER_NORMAL,
+                                                   iwl_mvm_bound_iface_iterator,
+                                                   &data);
+
+        /* If changed_vif exists and is not to be removed, add to the count */
+        if (changed_vif && !remove_vif)
+                data.num_active_macs++;
+
+        switch (data.num_active_macs) {
+        case 0:
+                /* If there are no active macs - change state to SF_INIT_OFF */
+                new_state = SF_INIT_OFF;
+                break;
+        case 1:
+                if (remove_vif) {
+                        /* The one active mac left is of type station
+                         * and we filled the relevant data during iteration
+                         */
+                        new_state = data.sta_vif_state;
+                        sta_id = data.sta_vif_ap_sta_id;
+                } else {
+                        if (WARN_ON(!changed_vif))
+                                return -EINVAL;
+                        if (changed_vif->type != NL80211_IFTYPE_STATION) {
+                                new_state = SF_UNINIT;
+                        } else if (changed_vif->bss_conf.assoc) {
+                                mvmvif = iwl_mvm_vif_from_mac80211(changed_vif);
+                                sta_id = mvmvif->ap_sta_id;
+                                new_state = SF_FULL_ON;
+                        } else {
+                                new_state = SF_INIT_OFF;
+                        }
+                }
+                break;
+        default:
+                /* If there are multiple active macs - change to SF_UNINIT */
+                new_state = SF_UNINIT;
+        }
+        return iwl_mvm_sf_config(mvm, sta_id, new_state);
+}
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.c b/drivers/net/wireless/iwlwifi/mvm/sta.c
index 329952363a54..ec1812133235 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -452,8 +452,15 @@ void iwl_mvm_sta_drained_wk(struct work_struct *wk)
                         rcu_dereference_protected(mvm->fw_id_to_mac_id[sta_id],
                                                   lockdep_is_held(&mvm->mutex));
 
-                /* This station is in use */
-                if (!IS_ERR(sta))
+                /*
+                 * This station is in use or RCU-removed; the latter happens in
+                 * managed mode, where mac80211 removes the station before we
+                 * can remove it from firmware (we can only do that after the
+                 * MAC is marked unassociated), and possibly while the deauth
+                 * frame to disconnect from the AP is still queued. Then, the
+                 * station pointer is -ENOENT when the last skb is reclaimed.
+                 */
+                if (!IS_ERR(sta) || PTR_ERR(sta) == -ENOENT)
                         continue;
 
                 if (PTR_ERR(sta) == -EINVAL) {
@@ -840,7 +847,7 @@ static const u8 tid_to_ac[] = {
 int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                              struct ieee80211_sta *sta, u16 tid, u16 *ssn)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data;
         int txq_id;
 
@@ -895,7 +902,7 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, u16 tid, u8 buf_size)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         int queue, fifo, ret;
         u16 ssn;
@@ -932,26 +939,13 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         IWL_DEBUG_HT(mvm, "Tx aggregation enabled on ra = %pM tid = %d\n",
                      sta->addr, tid);
 
-        if (mvm->cfg->ht_params->use_rts_for_aggregation) {
-                /*
-                 * switch to RTS/CTS if it is the prefer protection
-                 * method for HT traffic
-                 * this function also sends the LQ command
-                 */
-                return iwl_mvm_tx_protection(mvm, mvmsta, true);
-                /*
-                 * TODO: remove the TLC_RTS flag when we tear down the last
-                 * AGG session (agg_tids_count in DVM)
-                 */
-        }
-
-        return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.lq, CMD_ASYNC, false);
+        return iwl_mvm_send_lq_cmd(mvm, &mvmsta->lq_sta.lq, false);
 }
 
 int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, u16 tid)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         u16 txq_id;
         int err;
@@ -1023,7 +1017,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
 int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
                             struct ieee80211_sta *sta, u16 tid)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         u16 txq_id;
         enum iwl_mvm_agg_state old_state;
@@ -1123,8 +1117,8 @@ static int iwl_mvm_send_sta_key(struct iwl_mvm *mvm,
                 memcpy(cmd.key, keyconf->key, keyconf->keylen);
                 break;
         default:
-                WARN_ON(1);
-                return -EINVAL;
+                key_flags |= cpu_to_le16(STA_KEY_FLG_EXT);
+                memcpy(cmd.key, keyconf->key, keyconf->keylen);
         }
 
         if (!(keyconf->flags & IEEE80211_KEY_FLAG_PAIRWISE))
@@ -1288,8 +1282,8 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm,
                                            0, NULL, CMD_SYNC);
                 break;
         default:
-                IWL_ERR(mvm, "Unknown cipher %x\n", keyconf->cipher);
-                ret = -EINVAL;
+                ret = iwl_mvm_send_sta_key(mvm, mvm_sta, keyconf,
+                                           sta_id, 0, NULL, CMD_SYNC);
         }
 
         if (ret)
@@ -1416,7 +1410,7 @@ void iwl_mvm_update_tkip_key(struct iwl_mvm *mvm,
 void iwl_mvm_sta_modify_ps_wake(struct iwl_mvm *mvm,
                                 struct ieee80211_sta *sta)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd_v6 cmd = {
                 .add_modify = STA_MODE_MODIFY,
                 .sta_id = mvmsta->sta_id,
@@ -1438,7 +1432,7 @@ void iwl_mvm_sta_modify_sleep_tx_count(struct iwl_mvm *mvm,
         u16 sleep_state_flags =
                 (reason == IEEE80211_FRAME_RELEASE_UAPSD) ?
                         STA_SLEEP_STATE_UAPSD : STA_SLEEP_STATE_PS_POLL;
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_add_sta_cmd_v6 cmd = {
                 .add_modify = STA_MODE_MODIFY,
                 .sta_id = mvmsta->sta_id,
diff --git a/drivers/net/wireless/iwlwifi/mvm/sta.h b/drivers/net/wireless/iwlwifi/mvm/sta.h
index 4dfc359a4bdd..4968d0237dc5 100644
--- a/drivers/net/wireless/iwlwifi/mvm/sta.h
+++ b/drivers/net/wireless/iwlwifi/mvm/sta.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -298,6 +298,12 @@ struct iwl_mvm_sta {
         bool tt_tx_protection;
 };
 
+static inline struct iwl_mvm_sta *
+iwl_mvm_sta_from_mac80211(struct ieee80211_sta *sta)
+{
+        return (void *)sta->drv_priv;
+}
+
 /**
  * struct iwl_mvm_int_sta - representation of an internal station (auxiliary or
  * broadcast)
diff --git a/drivers/net/wireless/iwlwifi/mvm/testmode.h b/drivers/net/wireless/iwlwifi/mvm/testmode.h
index eb74391d91ca..0241665925f7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/testmode.h
+++ b/drivers/net/wireless/iwlwifi/mvm/testmode.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.c b/drivers/net/wireless/iwlwifi/mvm/time-event.c
index 95ce4b601fef..b4c2abaa297b 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.c
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -249,12 +249,12 @@ static bool iwl_mvm_time_event_response(struct iwl_notif_wait_data *notif_wait,
                 container_of(notif_wait, struct iwl_mvm, notif_wait);
         struct iwl_mvm_time_event_data *te_data = data;
         struct iwl_time_event_resp *resp;
-        int resp_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+        int resp_len = iwl_rx_packet_payload_len(pkt);
 
         if (WARN_ON(pkt->hdr.cmd != TIME_EVENT_CMD))
                 return true;
 
-        if (WARN_ON_ONCE(resp_len != sizeof(pkt->hdr) + sizeof(*resp))) {
+        if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
                 IWL_ERR(mvm, "Invalid TIME_EVENT_CMD response\n");
                 return true;
         }
diff --git a/drivers/net/wireless/iwlwifi/mvm/time-event.h b/drivers/net/wireless/iwlwifi/mvm/time-event.h
index d9c8d6cfa2db..4a61c8c02372 100644
--- a/drivers/net/wireless/iwlwifi/mvm/time-event.h
+++ b/drivers/net/wireless/iwlwifi/mvm/time-event.h
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
diff --git a/drivers/net/wireless/iwlwifi/mvm/tt.c b/drivers/net/wireless/iwlwifi/mvm/tt.c
index 1f3282dff513..3afa6b6bf835 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tt.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tt.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2013 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -340,7 +340,7 @@ static void check_exit_ctkill(struct work_struct *work)
 
         iwl_trans_start_hw(mvm->trans);
         temp = check_nic_temperature(mvm);
-        iwl_trans_stop_hw(mvm->trans, false);
+        iwl_trans_stop_device(mvm->trans);
 
         if (temp < MIN_TEMPERATURE || temp > MAX_TEMPERATURE) {
                 IWL_DEBUG_TEMP(mvm, "Failed to measure NIC temperature\n");
@@ -388,7 +388,7 @@ static void iwl_mvm_tt_tx_protection(struct iwl_mvm *mvm, bool enable)
                                                 lockdep_is_held(&mvm->mutex));
                 if (IS_ERR_OR_NULL(sta))
                         continue;
-                mvmsta = (void *)sta->drv_priv;
+                mvmsta = iwl_mvm_sta_from_mac80211(sta);
                 if (enable == mvmsta->tt_tx_protection)
                         continue;
                 err = iwl_mvm_tx_protection(mvm, mvmsta, enable);
diff --git a/drivers/net/wireless/iwlwifi/mvm/tx.c b/drivers/net/wireless/iwlwifi/mvm/tx.c
index 43d97c33a75a..90378c217bc7 100644
--- a/drivers/net/wireless/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/mvm/tx.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -253,8 +253,7 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm,
                 memcpy(&tx_cmd->key[3], keyconf->key, keyconf->keylen);
                 break;
         default:
-                IWL_ERR(mvm, "Unknown encode cipher %x\n", keyconf->cipher);
-                break;
+                tx_cmd->sec_ctl |= TX_CMD_SEC_EXT;
         }
 }
 
@@ -276,6 +275,7 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
                 return NULL;
 
         memset(dev_cmd, 0, sizeof(*dev_cmd));
+        dev_cmd->hdr.cmd = TX_CMD;
         tx_cmd = (struct iwl_tx_cmd *)dev_cmd->payload;
 
         if (info->control.hw_key)
@@ -361,7 +361,7 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         u8 txq_id = info->hw_queue;
         bool is_data_qos = false, is_ampdu = false;
 
-        mvmsta = (void *)sta->drv_priv;
+        mvmsta = iwl_mvm_sta_from_mac80211(sta);
         fc = hdr->frame_control;
 
         if (WARN_ON_ONCE(!mvmsta))
@@ -390,7 +390,6 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
                 seq_number &= IEEE80211_SCTL_SEQ;
                 hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
                 hdr->seq_ctrl |= cpu_to_le16(seq_number);
-                seq_number += 0x10;
                 is_data_qos = true;
                 is_ampdu = info->flags & IEEE80211_TX_CTL_AMPDU;
         }
@@ -407,13 +406,13 @@ int iwl_mvm_tx_skb(struct iwl_mvm *mvm, struct sk_buff *skb,
         }
 
         IWL_DEBUG_TX(mvm, "TX to [%d|%d] Q:%d - seq: 0x%x\n", mvmsta->sta_id,
-                     tid, txq_id, seq_number);
+                     tid, txq_id, IEEE80211_SEQ_TO_SN(seq_number));
 
         if (iwl_trans_tx(mvm->trans, skb, dev_cmd, txq_id))
                 goto drop_unlock_sta;
 
         if (is_data_qos && !ieee80211_has_morefrags(fc))
-                mvmsta->tid_data[tid].seq_number = seq_number;
+                mvmsta->tid_data[tid].seq_number = seq_number + 0x10;
 
         spin_unlock(&mvmsta->lock);
 
@@ -432,7 +431,7 @@ drop:
 static void iwl_mvm_check_ratid_empty(struct iwl_mvm *mvm,
                                       struct ieee80211_sta *sta, u8 tid)
 {
-        struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+        struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
         struct iwl_mvm_tid_data *tid_data = &mvmsta->tid_data[tid];
         struct ieee80211_vif *vif = mvmsta->vif;
 
@@ -662,7 +661,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 
         if (!IS_ERR_OR_NULL(sta)) {
-                mvmsta = (void *)sta->drv_priv;
+                mvmsta = iwl_mvm_sta_from_mac80211(sta);
 
                 if (tid != IWL_TID_NON_QOS) {
                         struct iwl_mvm_tid_data *tid_data =
@@ -704,7 +703,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                          */
                         spin_lock_bh(&mvmsta->lock);
                         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
-                        if (IS_ERR_OR_NULL(sta)) {
+                        if (!sta || PTR_ERR(sta) == -EBUSY) {
                                 /*
                                  * Station disappeared in the meantime:
                                  * so we are draining.
@@ -713,7 +712,7 @@ static void iwl_mvm_rx_tx_cmd_single(struct iwl_mvm *mvm,
                                 schedule_work(&mvm->sta_drained_wk);
                         }
                         spin_unlock_bh(&mvmsta->lock);
-                } else if (!mvmsta) {
+                } else if (!mvmsta && PTR_ERR(sta) == -EBUSY) {
                         /* Tx response without STA, so we are draining */
                         set_bit(sta_id, mvm->sta_drained);
                         schedule_work(&mvm->sta_drained_wk);
@@ -793,7 +792,7 @@ static void iwl_mvm_rx_tx_cmd_agg(struct iwl_mvm *mvm,
         sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
 
         if (!WARN_ON_ONCE(IS_ERR_OR_NULL(sta))) {
-                struct iwl_mvm_sta *mvmsta = (void *)sta->drv_priv;
+                struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
                 mvmsta->tid_data[tid].rate_n_flags =
                         le32_to_cpu(tx_resp->initial_rate);
         }
@@ -849,7 +848,7 @@ int iwl_mvm_rx_ba_notif(struct iwl_mvm *mvm, struct iwl_rx_cmd_buffer *rxb,
                 return 0;
         }
 
-        mvmsta = (void *)sta->drv_priv;
+        mvmsta = iwl_mvm_sta_from_mac80211(sta);
         tid_data = &mvmsta->tid_data[tid];
 
         if (WARN_ONCE(tid_data->txq_id != scd_flow, "Q %d, tid %d, flow %d",
diff --git a/drivers/net/wireless/iwlwifi/mvm/utils.c b/drivers/net/wireless/iwlwifi/mvm/utils.c
index ed69e9b78e82..a4a5e25623c3 100644
--- a/drivers/net/wireless/iwlwifi/mvm/utils.c
+++ b/drivers/net/wireless/iwlwifi/mvm/utils.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2012 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -168,8 +168,8 @@ int iwl_mvm_send_cmd_status(struct iwl_mvm *mvm, struct iwl_host_cmd *cmd,
                 goto out_free_resp;
         }
 
-        resp_len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
-        if (WARN_ON_ONCE(resp_len != sizeof(pkt->hdr) + sizeof(*resp))) {
+        resp_len = iwl_rx_packet_payload_len(pkt);
+        if (WARN_ON_ONCE(resp_len != sizeof(*resp))) {
                 ret = -EIO;
                 goto out_free_resp;
         }
@@ -486,22 +486,18 @@ void iwl_mvm_dump_sram(struct iwl_mvm *mvm)
  * this case to clear the state indicating that station creation is in
  * progress.
  */
-int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq,
-                        u8 flags, bool init)
+int iwl_mvm_send_lq_cmd(struct iwl_mvm *mvm, struct iwl_lq_cmd *lq, bool init)
 {
         struct iwl_host_cmd cmd = {
                 .id = LQ_CMD,
                 .len = { sizeof(struct iwl_lq_cmd), },
-                .flags = flags,
+                .flags = init ? CMD_SYNC : CMD_ASYNC,
                 .data = { lq, },
         };
 
         if (WARN_ON(lq->sta_id == IWL_MVM_STATION_COUNT))
                 return -EINVAL;
 
-        if (WARN_ON(init && (cmd.flags & CMD_ASYNC)))
-                return -EINVAL;
-
         return iwl_mvm_send_cmd(mvm, &cmd);
 }
 
@@ -522,6 +518,11 @@ void iwl_mvm_update_smps(struct iwl_mvm *mvm, struct ieee80211_vif *vif,
         int i;
 
         lockdep_assert_held(&mvm->mutex);
+
+        /* SMPS is irrelevant for NICs that don't have at least 2 RX antenna */
+        if (num_of_ant(iwl_fw_valid_rx_ant(mvm->fw)) == 1)
+                return;
+
         mvmvif = iwl_mvm_vif_from_mac80211(vif);
         mvmvif->smps_requests[req_type] = smps_request;
         for (i = 0; i < NUM_IWL_MVM_SMPS_REQ; i++) {
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index e6272546395a..3040924f5f3c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -297,6 +297,9 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x08B2, 0x4370, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4360, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x5070, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5072, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5170, iwl7260_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B1, 0x5770, iwl7260_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x4020, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B1, 0x402A, iwl7260_2n_cfg)},
         {IWL_PCI_DEVICE(0x08B2, 0x4220, iwl7260_2n_cfg)},
@@ -350,6 +353,8 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
         {IWL_PCI_DEVICE(0x08B4, 0x8270, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8470, iwl3160_2ac_cfg)},
         {IWL_PCI_DEVICE(0x08B3, 0x8570, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x1070, iwl3160_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x08B3, 0x1170, iwl3160_2ac_cfg)},
 
 /* 7265 Series */
         {IWL_PCI_DEVICE(0x095A, 0x5010, iwl7265_2ac_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/pcie/internal.h b/drivers/net/wireless/iwlwifi/pcie/internal.h
index 051268c037b1..e851f26fd44c 100644
--- a/drivers/net/wireless/iwlwifi/pcie/internal.h
+++ b/drivers/net/wireless/iwlwifi/pcie/internal.h
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -256,13 +256,13 @@ iwl_pcie_get_scratchbuf_dma(struct iwl_txq *txq, int idx)
  * @hw_base: pci hardware address support
  * @ucode_write_complete: indicates that the ucode has been copied.
  * @ucode_write_waitq: wait queue for uCode load
- * @status - transport specific status flags
  * @cmd_queue - command queue number
  * @rx_buf_size_8k: 8 kB RX buffer size
  * @bc_table_dword: true if the BC table expects DWORD (as opposed to bytes)
  * @rx_page_order: page order for receive buffer size
  * @wd_timeout: queue watchdog timeout (jiffies)
  * @reg_lock: protect hw register access
+ * @cmd_in_flight: true when we have a host command in flight
  */
 struct iwl_trans_pcie {
         struct iwl_rxq rxq;
@@ -274,7 +274,6 @@ struct iwl_trans_pcie {
         __le32 *ict_tbl;
         dma_addr_t ict_tbl_dma;
         int ict_index;
-        u32 inta;
         bool use_ict;
         struct isr_statistics isr_stats;
 
@@ -296,7 +295,6 @@ struct iwl_trans_pcie {
         wait_queue_head_t ucode_write_waitq;
         wait_queue_head_t wait_command_queue;
 
-        unsigned long status;
         u8 cmd_queue;
         u8 cmd_fifo;
         u8 n_no_reclaim_cmds;
@@ -313,24 +311,7 @@ struct iwl_trans_pcie {
 
         /*protect hw register */
         spinlock_t reg_lock;
-};
-
-/**
- * enum iwl_pcie_status: status of the PCIe transport
- * @STATUS_HCMD_ACTIVE: a SYNC command is being processed
- * @STATUS_DEVICE_ENABLED: APM is enabled
- * @STATUS_TPOWER_PMI: the device might be asleep (need to wake it up)
- * @STATUS_INT_ENABLED: interrupts are enabled
- * @STATUS_RFKILL: the HW RFkill switch is in KILL position
- * @STATUS_FW_ERROR: the fw is in error state
- */
-enum iwl_pcie_status {
-        STATUS_HCMD_ACTIVE,
-        STATUS_DEVICE_ENABLED,
-        STATUS_TPOWER_PMI,
-        STATUS_INT_ENABLED,
-        STATUS_RFKILL,
-        STATUS_FW_ERROR,
+        bool cmd_in_flight;
 };
 
 #define IWL_TRANS_GET_PCIE_TRANS(_iwl_trans) \
@@ -363,7 +344,7 @@ void iwl_pcie_rx_free(struct iwl_trans *trans);
 /*****************************************************
 * ICT - interrupt handling
 ******************************************************/
-irqreturn_t iwl_pcie_isr_ict(int irq, void *data);
+irqreturn_t iwl_pcie_isr(int irq, void *data);
 int iwl_pcie_alloc_ict(struct iwl_trans *trans);
 void iwl_pcie_free_ict(struct iwl_trans *trans);
 void iwl_pcie_reset_ict(struct iwl_trans *trans);
@@ -399,8 +380,7 @@ void iwl_pcie_dump_csr(struct iwl_trans *trans);
 ******************************************************/
 static inline void iwl_disable_interrupts(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        clear_bit(STATUS_INT_ENABLED, &trans_pcie->status);
+        clear_bit(STATUS_INT_ENABLED, &trans->status);
 
         /* disable interrupts from uCode/NIC to host */
         iwl_write32(trans, CSR_INT_MASK, 0x00000000);
@@ -417,14 +397,18 @@ static inline void iwl_enable_interrupts(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         IWL_DEBUG_ISR(trans, "Enabling interrupts\n");
-        set_bit(STATUS_INT_ENABLED, &trans_pcie->status);
+        set_bit(STATUS_INT_ENABLED, &trans->status);
+        trans_pcie->inta_mask = CSR_INI_SET_MASK;
         iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
 }
 
 static inline void iwl_enable_rfkill_int(struct iwl_trans *trans)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+
         IWL_DEBUG_ISR(trans, "Enabling rfkill interrupt\n");
-        iwl_write32(trans, CSR_INT_MASK, CSR_INT_BIT_RF_KILL);
+        trans_pcie->inta_mask = CSR_INT_BIT_RF_KILL;
+        iwl_write32(trans, CSR_INT_MASK, trans_pcie->inta_mask);
 }
 
 static inline void iwl_wake_queue(struct iwl_trans *trans,
@@ -477,12 +461,31 @@ static inline bool iwl_is_rfkill_set(struct iwl_trans *trans)
                 CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW);
 }
 
-static inline void iwl_nic_error(struct iwl_trans *trans)
+static inline void __iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans,
+                                                  u32 reg, u32 mask, u32 value)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u32 v;
+
+#ifdef CONFIG_IWLWIFI_DEBUG
+        WARN_ON_ONCE(value & ~mask);
+#endif
+
+        v = iwl_read32(trans, reg);
+        v &= ~mask;
+        v |= value;
+        iwl_write32(trans, reg, v);
+}
 
-        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
-        iwl_op_mode_nic_error(trans->op_mode);
+static inline void __iwl_trans_pcie_clear_bit(struct iwl_trans *trans,
+                                              u32 reg, u32 mask)
+{
+        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, 0);
+}
+
+static inline void __iwl_trans_pcie_set_bit(struct iwl_trans *trans,
+                                            u32 reg, u32 mask)
+{
+        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, mask);
 }
 
 #endif /* __iwl_trans_int_pcie_h__ */
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index be3995afa9d0..08c23d497a02 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -148,10 +148,9 @@ int iwl_pcie_rx_stop(struct iwl_trans *trans)
 static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
                                     struct iwl_rxq *rxq)
 {
-        unsigned long flags;
         u32 reg;
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
 
         if (rxq->need_update == 0)
                 goto exit_unlock;
@@ -162,11 +161,8 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
                 rxq->write_actual = (rxq->write & ~0x7);
                 iwl_write32(trans, FH_RSCSR_CHNL0_WPTR, rxq->write_actual);
         } else {
-                struct iwl_trans_pcie *trans_pcie =
-                        IWL_TRANS_GET_PCIE_TRANS(trans);
-
                 /* If power-saving is in use, make sure device is awake */
-                if (test_bit(STATUS_TPOWER_PMI, &trans_pcie->status)) {
+                if (test_bit(STATUS_TPOWER_PMI, &trans->status)) {
                         reg = iwl_read32(trans, CSR_UCODE_DRV_GP1);
 
                         if (reg & CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP) {
@@ -193,7 +189,7 @@ static void iwl_pcie_rxq_inc_wr_ptr(struct iwl_trans *trans,
         rxq->need_update = 0;
 
  exit_unlock:
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 }
 
 /*
@@ -212,7 +208,6 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_rx_mem_buffer *rxb;
-        unsigned long flags;
 
         /*
          * If the device isn't enabled - not need to try to add buffers...
@@ -222,10 +217,10 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
          * stopped, we cannot access the HW (in particular not prph).
          * So don't try to restock if the APM has been already stopped.
          */
-        if (!test_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status))
+        if (!test_bit(STATUS_DEVICE_ENABLED, &trans->status))
                 return;
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         while ((iwl_rxq_space(rxq) > 0) && (rxq->free_count)) {
                 /* The overwritten rxb must be a used one */
                 rxb = rxq->queue[rxq->write];
@@ -242,7 +237,7 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
                 rxq->write = (rxq->write + 1) & RX_QUEUE_MASK;
                 rxq->free_count--;
         }
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
         /* If the pre-allocated buffer pool is dropping low, schedule to
          * refill it */
         if (rxq->free_count <= RX_LOW_WATERMARK)
@@ -251,9 +246,9 @@ static void iwl_pcie_rxq_restock(struct iwl_trans *trans)
         /* If we've added more space for the firmware to place data, tell it.
          * Increment device's write pointer in multiples of 8. */
         if (rxq->write_actual != (rxq->write & ~0x7)) {
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
                 rxq->need_update = 1;
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
                 iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
         }
 }
@@ -273,16 +268,15 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_rx_mem_buffer *rxb;
         struct page *page;
-        unsigned long flags;
         gfp_t gfp_mask = priority;
 
         while (1) {
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
                 if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         return;
                 }
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
 
                 if (rxq->free_count > RX_LOW_WATERMARK)
                         gfp_mask |= __GFP_NOWARN;
@@ -311,17 +305,17 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                         return;
                 }
 
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
 
                 if (list_empty(&rxq->rx_used)) {
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         __free_pages(page, trans_pcie->rx_page_order);
                         return;
                 }
                 rxb = list_first_entry(&rxq->rx_used, struct iwl_rx_mem_buffer,
                                        list);
                 list_del(&rxb->list);
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
 
                 BUG_ON(rxb->page);
                 rxb->page = page;
@@ -332,9 +326,9 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                                      DMA_FROM_DEVICE);
                 if (dma_mapping_error(trans->dev, rxb->page_dma)) {
                         rxb->page = NULL;
-                        spin_lock_irqsave(&rxq->lock, flags);
+                        spin_lock(&rxq->lock);
                         list_add(&rxb->list, &rxq->rx_used);
-                        spin_unlock_irqrestore(&rxq->lock, flags);
+                        spin_unlock(&rxq->lock);
                         __free_pages(page, trans_pcie->rx_page_order);
                         return;
                 }
@@ -343,12 +337,12 @@ static void iwl_pcie_rxq_alloc_rbs(struct iwl_trans *trans, gfp_t priority)
                 /* and also 256 byte aligned! */
                 BUG_ON(rxb->page_dma & DMA_BIT_MASK(8));
 
-                spin_lock_irqsave(&rxq->lock, flags);
+                spin_lock(&rxq->lock);
 
                 list_add_tail(&rxb->list, &rxq->rx_free);
                 rxq->free_count++;
 
-                spin_unlock_irqrestore(&rxq->lock, flags);
+                spin_unlock(&rxq->lock);
         }
 }
 
@@ -382,13 +376,12 @@ static void iwl_pcie_rxq_free_rbs(struct iwl_trans *trans)
 static void iwl_pcie_rx_replenish(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
         iwl_pcie_rxq_alloc_rbs(trans, GFP_KERNEL);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_pcie_rxq_restock(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
 static void iwl_pcie_rx_replenish_now(struct iwl_trans *trans)
@@ -514,7 +507,6 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         int i, err;
-        unsigned long flags;
 
         if (!rxq->bd) {
                 err = iwl_pcie_rx_alloc(trans);
@@ -522,7 +514,7 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
                         return err;
         }
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
 
         INIT_WORK(&trans_pcie->rx_replenish, iwl_pcie_rx_replenish_work);
 
@@ -538,16 +530,16 @@ int iwl_pcie_rx_init(struct iwl_trans *trans)
         rxq->read = rxq->write = 0;
         rxq->write_actual = 0;
         memset(rxq->rb_stts, 0, sizeof(*rxq->rb_stts));
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 
         iwl_pcie_rx_replenish(trans);
 
         iwl_pcie_rx_hw_init(trans, rxq);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         rxq->need_update = 1;
         iwl_pcie_rxq_inc_wr_ptr(trans, rxq);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         return 0;
 }
@@ -556,7 +548,6 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
-        unsigned long flags;
 
         /*if rxq->bd is NULL, it means that nothing has been allocated,
          * exit now */
@@ -567,9 +558,9 @@ void iwl_pcie_rx_free(struct iwl_trans *trans)
 
         cancel_work_sync(&trans_pcie->rx_replenish);
 
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         iwl_pcie_rxq_free_rbs(trans);
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 
         dma_free_coherent(trans->dev, sizeof(__le32) * RX_QUEUE_SIZE,
                           rxq->bd, rxq->bd_dma);
@@ -592,7 +583,6 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_rxq *rxq = &trans_pcie->rxq;
         struct iwl_txq *txq = &trans_pcie->txq[trans_pcie->cmd_queue];
-        unsigned long flags;
         bool page_stolen = false;
         int max_len = PAGE_SIZE << trans_pcie->rx_page_order;
         u32 offset = 0;
@@ -625,7 +615,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                         rxcb._offset, get_cmd_string(trans_pcie, pkt->hdr.cmd),
                         pkt->hdr.cmd);
 
-                len = le32_to_cpu(pkt->len_n_flags) & FH_RSCSR_FRAME_SIZE_MSK;
+                len = iwl_rx_packet_len(pkt);
                 len += sizeof(u32); /* account for status word */
                 trace_iwlwifi_dev_rx(trans->dev, trans, pkt, len);
                 trace_iwlwifi_dev_rx_data(trans->dev, trans, pkt, len);
@@ -694,7 +684,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
         /* Reuse the page if possible. For notification packets and
          * SKBs that fail to Rx correctly, add them back into the
          * rx_free list for reuse later. */
-        spin_lock_irqsave(&rxq->lock, flags);
+        spin_lock(&rxq->lock);
         if (rxb->page != NULL) {
                 rxb->page_dma =
                         dma_map_page(trans->dev, rxb->page, 0,
@@ -715,7 +705,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
                 }
         } else
                 list_add_tail(&rxb->list, &rxq->rx_used);
-        spin_unlock_irqrestore(&rxq->lock, flags);
+        spin_unlock(&rxq->lock);
 }
 
 /*
@@ -791,7 +781,7 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
                              APMS_CLK_VAL_MRB_FUNC_MODE) ||
              (iwl_read_prph(trans, APMG_PS_CTRL_REG) &
                             APMG_PS_CTRL_VAL_RESET_REQ))) {
-                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+                clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
                 iwl_op_mode_wimax_active(trans->op_mode);
                 wake_up(&trans_pcie->wait_command_queue);
                 return;
@@ -800,14 +790,95 @@ static void iwl_pcie_irq_handle_error(struct iwl_trans *trans)
         iwl_pcie_dump_csr(trans);
         iwl_dump_fh(trans, NULL);
 
-        /* set the ERROR bit before we wake up the caller */
-        set_bit(STATUS_FW_ERROR, &trans_pcie->status);
-        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
-        wake_up(&trans_pcie->wait_command_queue);
-
         local_bh_disable();
-        iwl_nic_error(trans);
+        /* The STATUS_FW_ERROR bit is set in this function. This must happen
+         * before we wake up the command caller, to ensure a proper cleanup. */
+        iwl_trans_fw_error(trans);
         local_bh_enable();
+
+        clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
+        wake_up(&trans_pcie->wait_command_queue);
+}
+
+static u32 iwl_pcie_int_cause_non_ict(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u32 inta;
+
+        lockdep_assert_held(&trans_pcie->irq_lock);
+
+        trace_iwlwifi_dev_irq(trans->dev);
+
+        /* Discover which interrupts are active/pending */
+        inta = iwl_read32(trans, CSR_INT);
+
+        /* the thread will service interrupts and re-enable them */
+        return inta;
+}
+
+/* a device (PCI-E) page is 4096 bytes long */
+#define ICT_SHIFT       12
+#define ICT_SIZE        (1 << ICT_SHIFT)
+#define ICT_COUNT       (ICT_SIZE / sizeof(u32))
+
+/* interrupt handler using ict table, with this interrupt driver will
+ * stop using INTA register to get device's interrupt, reading this register
+ * is expensive, device will write interrupts in ICT dram table, increment
+ * index then will fire interrupt to driver, driver will OR all ICT table
+ * entries from current index up to table entry with 0 value. the result is
+ * the interrupt we need to service, driver will set the entries back to 0 and
+ * set index.
+ */
+static u32 iwl_pcie_int_cause_ict(struct iwl_trans *trans)
+{
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
+        u32 inta;
+        u32 val = 0;
+        u32 read;
+
+        trace_iwlwifi_dev_irq(trans->dev);
+
+        /* Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC. */
+        read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
+        trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index, read);
+        if (!read)
+                return 0;
+
+        /*
+         * Collect all entries up to the first 0, starting from ict_index;
+         * note we already read at ict_index.
+         */
+        do {
+                val |= read;
+                IWL_DEBUG_ISR(trans, "ICT index %d value 0x%08X\n",
+                                trans_pcie->ict_index, read);
+                trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
+                trans_pcie->ict_index =
+                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
+
+                read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
+                trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
+                                           read);
+        } while (read);
+
+        /* We should not get this value, just ignore it. */
+        if (val == 0xffffffff)
+                val = 0;
+
+        /*
+         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
+         * (bit 15 before shifting it to 31) to clear when using interrupt
+         * coalescing. fortunately, bits 18 and 19 stay set when this happens
+         * so we use them to decide on the real state of the Rx bit.
+         * In order words, bit 15 is set if bit 18 or bit 19 are set.
+         */
+        if (val & 0xC0000)
+                val |= 0x8000;
+
+        inta = (0xff & val) | ((0xff00 & val) << 16);
+        return inta;
 }
 
 irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
@@ -817,12 +888,61 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
         struct isr_statistics *isr_stats = &trans_pcie->isr_stats;
         u32 inta = 0;
         u32 handled = 0;
-        unsigned long flags;
         u32 i;
 
         lock_map_acquire(&trans->sync_cmd_lockdep_map);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
+
+        /* dram interrupt table not set yet,
+         * use legacy interrupt.
+         */
+        if (likely(trans_pcie->use_ict))
+                inta = iwl_pcie_int_cause_ict(trans);
+        else
+                inta = iwl_pcie_int_cause_non_ict(trans);
+
+        if (iwl_have_debug_level(IWL_DL_ISR)) {
+                IWL_DEBUG_ISR(trans,
+                              "ISR inta 0x%08x, enabled 0x%08x(sw), enabled(hw) 0x%08x, fh 0x%08x\n",
+                              inta, trans_pcie->inta_mask,
+                              iwl_read32(trans, CSR_INT_MASK),
+                              iwl_read32(trans, CSR_FH_INT_STATUS));
+                if (inta & (~trans_pcie->inta_mask))
+                        IWL_DEBUG_ISR(trans,
+                                      "We got a masked interrupt (0x%08x)\n",
+                                      inta & (~trans_pcie->inta_mask));
+        }
+
+        inta &= trans_pcie->inta_mask;
+
+        /*
+         * Ignore interrupt if there's nothing in NIC to service.
+         * This may be due to IRQ shared with another device,
+         * or due to sporadic interrupts thrown from our NIC.
+         */
+        if (unlikely(!inta)) {
+                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
+                /*
+                 * Re-enable interrupts here since we don't
+                 * have anything to service
+                 */
+                if (test_bit(STATUS_INT_ENABLED, &trans->status))
+                        iwl_enable_interrupts(trans);
+                spin_unlock(&trans_pcie->irq_lock);
+                lock_map_release(&trans->sync_cmd_lockdep_map);
+                return IRQ_NONE;
+        }
+
+        if (unlikely(inta == 0xFFFFFFFF || (inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
+                /*
+                 * Hardware disappeared. It might have
+                 * already raised an interrupt.
+                 */
+                IWL_WARN(trans, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
+                spin_unlock(&trans_pcie->irq_lock);
+                goto out;
+        }
 
         /* Ack/clear/reset pending uCode interrupts.
          * Note:  Some bits in CSR_INT are "OR" of bits in CSR_FH_INT_STATUS,
@@ -835,19 +955,13 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
          * hardware bugs here by ACKing all the possible interrupts so that
          * interrupt coalescing can still be achieved.
          */
-        iwl_write32(trans, CSR_INT,
-                    trans_pcie->inta | ~trans_pcie->inta_mask);
-
-        inta = trans_pcie->inta;
+        iwl_write32(trans, CSR_INT, inta | ~trans_pcie->inta_mask);
 
         if (iwl_have_debug_level(IWL_DL_ISR))
                 IWL_DEBUG_ISR(trans, "inta 0x%08x, enabled 0x%08x\n",
                               inta, iwl_read32(trans, CSR_INT_MASK));
 
-        /* saved interrupt in inta variable now we can reset trans_pcie->inta */
-        trans_pcie->inta = 0;
-
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* Now service all interrupt bits discovered above. */
         if (inta & CSR_INT_BIT_HW_ERR) {
@@ -894,14 +1008,14 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
                 iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
                 if (hw_rfkill) {
-                        set_bit(STATUS_RFKILL, &trans_pcie->status);
-                        if (test_and_clear_bit(STATUS_HCMD_ACTIVE,
-                                               &trans_pcie->status))
+                        set_bit(STATUS_RFKILL, &trans->status);
+                        if (test_and_clear_bit(STATUS_SYNC_HCMD_ACTIVE,
+                                               &trans->status))
                                 IWL_DEBUG_RF_KILL(trans,
                                                   "Rfkill while SYNC HCMD in flight\n");
                         wake_up(&trans_pcie->wait_command_queue);
                 } else {
-                        clear_bit(STATUS_RFKILL, &trans_pcie->status);
+                        clear_bit(STATUS_RFKILL, &trans->status);
                 }
 
                 handled |= CSR_INT_BIT_RF_KILL;
@@ -1005,7 +1119,7 @@ irqreturn_t iwl_pcie_irq_handler(int irq, void *dev_id)
 
         /* Re-enable all interrupts */
         /* only Re-enable if disabled by irq */
-        if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status))
+        if (test_bit(STATUS_INT_ENABLED, &trans->status))
                 iwl_enable_interrupts(trans);
         /* Re-enable RF_KILL if it occurred */
         else if (handled & CSR_INT_BIT_RF_KILL)
@@ -1022,11 +1136,6 @@ out:
  *
  ******************************************************************************/
 
-/* a device (PCI-E) page is 4096 bytes long */
-#define ICT_SHIFT       12
-#define ICT_SIZE        (1 << ICT_SHIFT)
-#define ICT_COUNT       (ICT_SIZE / sizeof(u32))
-
 /* Free dram table */
 void iwl_pcie_free_ict(struct iwl_trans *trans)
 {
@@ -1051,7 +1160,7 @@ int iwl_pcie_alloc_ict(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
 
         trans_pcie->ict_tbl =
-                dma_alloc_coherent(trans->dev, ICT_SIZE,
+                dma_zalloc_coherent(trans->dev, ICT_SIZE,
                                    &trans_pcie->ict_tbl_dma,
                                    GFP_KERNEL);
         if (!trans_pcie->ict_tbl)
@@ -1063,17 +1172,10 @@ int iwl_pcie_alloc_ict(struct iwl_trans *trans)
                 return -EINVAL;
         }
 
-        IWL_DEBUG_ISR(trans, "ict dma addr %Lx\n",
-                      (unsigned long long)trans_pcie->ict_tbl_dma);
-
-        IWL_DEBUG_ISR(trans, "ict vir addr %p\n", trans_pcie->ict_tbl);
-
-        /* reset table and index to all 0 */
-        memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
-        trans_pcie->ict_index = 0;
+        IWL_DEBUG_ISR(trans, "ict dma addr %Lx ict vir addr %p\n",
+                      (unsigned long long)trans_pcie->ict_tbl_dma,
+                      trans_pcie->ict_tbl);
 
-        /* add periodic RX interrupt */
-        trans_pcie->inta_mask |= CSR_INT_BIT_RX_PERIODIC;
         return 0;
 }
 
@@ -1084,12 +1186,11 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 val;
-        unsigned long flags;
 
         if (!trans_pcie->ict_tbl)
                 return;
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
 
         memset(trans_pcie->ict_tbl, 0, ICT_SIZE);
@@ -1106,124 +1207,26 @@ void iwl_pcie_reset_ict(struct iwl_trans *trans)
         trans_pcie->ict_index = 0;
         iwl_write32(trans, CSR_INT, trans_pcie->inta_mask);
         iwl_enable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
 /* Device is going down disable ict interrupt usage */
 void iwl_pcie_disable_ict(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         trans_pcie->use_ict = false;
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 }
 
-/* legacy (non-ICT) ISR. Assumes that trans_pcie->irq_lock is held */
-static irqreturn_t iwl_pcie_isr(int irq, void *data)
+irqreturn_t iwl_pcie_isr(int irq, void *data)
 {
         struct iwl_trans *trans = data;
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        u32 inta, inta_mask;
-        irqreturn_t ret = IRQ_NONE;
-
-        lockdep_assert_held(&trans_pcie->irq_lock);
-
-        trace_iwlwifi_dev_irq(trans->dev);
-
-        /* Disable (but don't clear!) interrupts here to avoid
-         *    back-to-back ISRs and sporadic interrupts from our NIC.
-         * If we have something to service, the irq thread will re-enable ints.
-         * If we *don't* have something, we'll re-enable before leaving here. */
-        inta_mask = iwl_read32(trans, CSR_INT_MASK);
-        iwl_write32(trans, CSR_INT_MASK, 0x00000000);
-
-        /* Discover which interrupts are active/pending */
-        inta = iwl_read32(trans, CSR_INT);
-
-        if (inta & (~inta_mask)) {
-                IWL_DEBUG_ISR(trans,
-                              "We got a masked interrupt (0x%08x)...Ack and ignore\n",
-                              inta & (~inta_mask));
-                iwl_write32(trans, CSR_INT, inta & (~inta_mask));
-                inta &= inta_mask;
-        }
-
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        if (!inta) {
-                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        if ((inta == 0xFFFFFFFF) || ((inta & 0xFFFFFFF0) == 0xa5a5a5a0)) {
-                /* Hardware disappeared. It might have already raised
-                 * an interrupt */
-                IWL_WARN(trans, "HARDWARE GONE?? INTA == 0x%08x\n", inta);
-                return IRQ_HANDLED;
-        }
-
-        if (iwl_have_debug_level(IWL_DL_ISR))
-                IWL_DEBUG_ISR(trans,
-                              "ISR inta 0x%08x, enabled 0x%08x, fh 0x%08x\n",
-                              inta, inta_mask,
-                              iwl_read32(trans, CSR_FH_INT_STATUS));
-
-        trans_pcie->inta |= inta;
-        /* the thread will service interrupts and re-enable them */
-        if (likely(inta))
-                return IRQ_WAKE_THREAD;
-
-        ret = IRQ_HANDLED;
-
-none:
-        /* re-enable interrupts here since we don't have anything to service. */
-        /* only Re-enable if disabled by irq  and no schedules tasklet. */
-        if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-            !trans_pcie->inta)
-                iwl_enable_interrupts(trans);
-
-        return ret;
-}
-
-/* interrupt handler using ict table, with this interrupt driver will
- * stop using INTA register to get device's interrupt, reading this register
- * is expensive, device will write interrupts in ICT dram table, increment
- * index then will fire interrupt to driver, driver will OR all ICT table
- * entries from current index up to table entry with 0 value. the result is
- * the interrupt we need to service, driver will set the entries back to 0 and
- * set index.
- */
-irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
-{
-        struct iwl_trans *trans = data;
-        struct iwl_trans_pcie *trans_pcie;
-        u32 inta;
-        u32 val = 0;
-        u32 read;
-        unsigned long flags;
-        irqreturn_t ret = IRQ_NONE;
 
         if (!trans)
                 return IRQ_NONE;
 
-        trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
-
-        /* dram interrupt table not set yet,
-         * use legacy interrupt.
-         */
-        if (unlikely(!trans_pcie->use_ict)) {
-                ret = iwl_pcie_isr(irq, data);
-                spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-                return ret;
-        }
-
-        trace_iwlwifi_dev_irq(trans->dev);
-
         /* Disable (but don't clear!) interrupts here to avoid
          * back-to-back ISRs and sporadic interrupts from our NIC.
          * If we have something to service, the tasklet will re-enable ints.
@@ -1231,73 +1234,5 @@ irqreturn_t iwl_pcie_isr_ict(int irq, void *data)
          */
         iwl_write32(trans, CSR_INT_MASK, 0x00000000);
 
-        /* Ignore interrupt if there's nothing in NIC to service.
-         * This may be due to IRQ shared with another device,
-         * or due to sporadic interrupts thrown from our NIC. */
-        read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
-        trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index, read);
-        if (!read) {
-                IWL_DEBUG_ISR(trans, "Ignore interrupt, inta == 0\n");
-                goto none;
-        }
-
-        /*
-         * Collect all entries up to the first 0, starting from ict_index;
-         * note we already read at ict_index.
-         */
-        do {
-                val |= read;
-                IWL_DEBUG_ISR(trans, "ICT index %d value 0x%08X\n",
-                                trans_pcie->ict_index, read);
-                trans_pcie->ict_tbl[trans_pcie->ict_index] = 0;
-                trans_pcie->ict_index =
-                        iwl_queue_inc_wrap(trans_pcie->ict_index, ICT_COUNT);
-
-                read = le32_to_cpu(trans_pcie->ict_tbl[trans_pcie->ict_index]);
-                trace_iwlwifi_dev_ict_read(trans->dev, trans_pcie->ict_index,
-                                           read);
-        } while (read);
-
-        /* We should not get this value, just ignore it. */
-        if (val == 0xffffffff)
-                val = 0;
-
-        /*
-         * this is a w/a for a h/w bug. the h/w bug may cause the Rx bit
-         * (bit 15 before shifting it to 31) to clear when using interrupt
-         * coalescing. fortunately, bits 18 and 19 stay set when this happens
-         * so we use them to decide on the real state of the Rx bit.
-         * In order words, bit 15 is set if bit 18 or bit 19 are set.
-         */
-        if (val & 0xC0000)
-                val |= 0x8000;
-
-        inta = (0xff & val) | ((0xff00 & val) << 16);
-        IWL_DEBUG_ISR(trans, "ISR inta 0x%08x, enabled(sw) 0x%08x ict 0x%08x\n",
-                      inta, trans_pcie->inta_mask, val);
-        if (iwl_have_debug_level(IWL_DL_ISR))
-                IWL_DEBUG_ISR(trans, "enabled(hw) 0x%08x\n",
-                              iwl_read32(trans, CSR_INT_MASK));
-
-        inta &= trans_pcie->inta_mask;
-        trans_pcie->inta |= inta;
-
-        /* iwl_pcie_tasklet() will service interrupts and re-enable them */
-        if (likely(inta)) {
-                spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-                return IRQ_WAKE_THREAD;
-        }
-
-        ret = IRQ_HANDLED;
-
- none:
-        /* re-enable interrupts here since we don't have anything to service.
-         * only Re-enable if disabled by irq.
-         */
-        if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
-            !trans_pcie->inta)
-                iwl_enable_interrupts(trans);
-
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-        return ret;
+        return IRQ_WAKE_THREAD;
 }
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index cde9c16f6e4f..f9507807b486 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -5,7 +5,7 @@
  *
  * GPL LICENSE SUMMARY
  *
- * Copyright(c) 2007 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of version 2 of the GNU General Public License as
@@ -30,7 +30,7 @@
  *
  * BSD LICENSE
  *
- * Copyright(c) 2005 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved.
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -75,33 +75,6 @@
 #include "iwl-agn-hw.h"
 #include "internal.h"
 
-static void __iwl_trans_pcie_set_bits_mask(struct iwl_trans *trans,
-                                                  u32 reg, u32 mask, u32 value)
-{
-        u32 v;
-
-#ifdef CONFIG_IWLWIFI_DEBUG
-        WARN_ON_ONCE(value & ~mask);
-#endif
-
-        v = iwl_read32(trans, reg);
-        v &= ~mask;
-        v |= value;
-        iwl_write32(trans, reg, v);
-}
-
-static inline void __iwl_trans_pcie_clear_bit(struct iwl_trans *trans,
-                                              u32 reg, u32 mask)
-{
-        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, 0);
-}
-
-static inline void __iwl_trans_pcie_set_bit(struct iwl_trans *trans,
-                                            u32 reg, u32 mask)
-{
-        __iwl_trans_pcie_set_bits_mask(trans, reg, mask, mask);
-}
-
 static void iwl_pcie_set_pwr(struct iwl_trans *trans, bool vaux)
 {
         if (vaux && pci_pme_capable(to_pci_dev(trans->dev), PCI_D3cold))
@@ -150,7 +123,6 @@ static void iwl_pcie_apm_config(struct iwl_trans *trans)
  */
 static int iwl_pcie_apm_init(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret = 0;
         IWL_DEBUG_INFO(trans, "Init card's basic functions\n");
 
@@ -206,6 +178,28 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
                 goto out;
         }
 
+        if (trans->cfg->host_interrupt_operation_mode) {
+                /*
+                 * This is a bit of an abuse - This is needed for 7260 / 3160
+                 * only check host_interrupt_operation_mode even if this is
+                 * not related to host_interrupt_operation_mode.
+                 *
+                 * Enable the oscillator to count wake up time for L1 exit. This
+                 * consumes slightly more power (100uA) - but allows to be sure
+                 * that we wake up from L1 on time.
+                 *
+                 * This looks weird: read twice the same register, discard the
+                 * value, set a bit, and yet again, read that same register
+                 * just to discard the value. But that's the way the hardware
+                 * seems to like it.
+                 */
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_set_bits_prph(trans, OSC_CLK, OSC_CLK_FORCE_CONTROL);
+                iwl_read_prph(trans, OSC_CLK);
+                iwl_read_prph(trans, OSC_CLK);
+        }
+
         /*
          * Enable DMA clock and wait for it to stabilize.
          *
@@ -223,7 +217,7 @@ static int iwl_pcie_apm_init(struct iwl_trans *trans)
         /* Clear the interrupt in APMG if the NIC is in RFKILL */
         iwl_write_prph(trans, APMG_RTC_INT_STT_REG, APMG_RTC_INT_STT_RFKILL);
 
-        set_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status);
+        set_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
 out:
         return ret;
@@ -249,10 +243,9 @@ static int iwl_pcie_apm_stop_master(struct iwl_trans *trans)
 
 static void iwl_pcie_apm_stop(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         IWL_DEBUG_INFO(trans, "Stop card, put in low power state\n");
 
-        clear_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status);
+        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
 
         /* Stop device's DMA activity */
         iwl_pcie_apm_stop_master(trans);
@@ -273,13 +266,12 @@ static void iwl_pcie_apm_stop(struct iwl_trans *trans)
 static int iwl_pcie_nic_init(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
 
         /* nic_init */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_pcie_apm_init(trans);
 
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_set_pwr(trans, false);
 
@@ -582,7 +574,6 @@ static int iwl_pcie_load_given_ucode(struct iwl_trans *trans,
 static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                                    const struct fw_img *fw, bool run_in_rfkill)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         bool hw_rfkill;
 
@@ -592,16 +583,14 @@ static int iwl_trans_pcie_start_fw(struct iwl_trans *trans,
                 return -EIO;
         }
 
-        clear_bit(STATUS_FW_ERROR, &trans_pcie->status);
-
         iwl_enable_rfkill_int(trans);
 
         /* If platform's RF_KILL switch is NOT set to KILL */
         hw_rfkill = iwl_is_rfkill_set(trans);
         if (hw_rfkill)
-                set_bit(STATUS_RFKILL, &trans_pcie->status);
+                set_bit(STATUS_RFKILL, &trans->status);
         else
-                clear_bit(STATUS_RFKILL, &trans_pcie->status);
+                clear_bit(STATUS_RFKILL, &trans->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
         if (hw_rfkill && !run_in_rfkill)
                 return -ERFKILL;
@@ -640,12 +629,14 @@ static void iwl_trans_pcie_fw_alive(struct iwl_trans *trans, u32 scd_addr)
 static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        unsigned long flags;
+        bool hw_rfkill, was_hw_rfkill;
+
+        was_hw_rfkill = iwl_is_rfkill_set(trans);
 
         /* tell the device to stop sending interrupts */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* device going down, Stop using ICT table */
         iwl_pcie_disable_ict(trans);
@@ -657,7 +648,7 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
          * restart. So don't process again if the device is
          * already dead.
          */
-        if (test_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status)) {
+        if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
                 iwl_pcie_tx_stop(trans);
                 iwl_pcie_rx_stop(trans);
 
@@ -677,21 +668,45 @@ static void iwl_trans_pcie_stop_device(struct iwl_trans *trans)
         /* Upon stop, the APM issues an interrupt if HW RF kill is set.
          * Clean again the interrupt here
          */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
-
-        iwl_enable_rfkill_int(trans);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* stop and reset the on-board processor */
         iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_NEVO_RESET);
 
         /* clear all status bits */
-        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
-        clear_bit(STATUS_INT_ENABLED, &trans_pcie->status);
-        clear_bit(STATUS_DEVICE_ENABLED, &trans_pcie->status);
-        clear_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
-        clear_bit(STATUS_RFKILL, &trans_pcie->status);
+        clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
+        clear_bit(STATUS_INT_ENABLED, &trans->status);
+        clear_bit(STATUS_DEVICE_ENABLED, &trans->status);
+        clear_bit(STATUS_TPOWER_PMI, &trans->status);
+        clear_bit(STATUS_RFKILL, &trans->status);
+
+        /*
+         * Even if we stop the HW, we still want the RF kill
+         * interrupt
+         */
+        iwl_enable_rfkill_int(trans);
+
+        /*
+         * Check again since the RF kill state may have changed while
+         * all the interrupts were disabled, in this case we couldn't
+         * receive the RF kill interrupt and update the state in the
+         * op_mode.
+         * Don't call the op_mode if the rkfill state hasn't changed.
+         * This allows the op_mode to call stop_device from the rfkill
+         * notification without endless recursion. Under very rare
+         * circumstances, we might have a small recursion if the rfkill
+         * state changed exactly now while we were called from stop_device.
+         * This is very unlikely but can happen and is supported.
+         */
+        hw_rfkill = iwl_is_rfkill_set(trans);
+        if (hw_rfkill)
+                set_bit(STATUS_RFKILL, &trans->status);
+        else
+                clear_bit(STATUS_RFKILL, &trans->status);
+        if (hw_rfkill != was_hw_rfkill)
+                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 }
 
 static void iwl_trans_pcie_d3_suspend(struct iwl_trans *trans, bool test)
@@ -776,7 +791,6 @@ static int iwl_trans_pcie_d3_resume(struct iwl_trans *trans,
 
 static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         bool hw_rfkill;
         int err;
 
@@ -787,7 +801,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         }
 
         /* Reset the entire device */
-        iwl_set_bit(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
+        iwl_write32(trans, CSR_RESET, CSR_RESET_REG_FLAG_SW_RESET);
 
         usleep_range(10, 15);
 
@@ -798,53 +812,30 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
 
         hw_rfkill = iwl_is_rfkill_set(trans);
         if (hw_rfkill)
-                set_bit(STATUS_RFKILL, &trans_pcie->status);
+                set_bit(STATUS_RFKILL, &trans->status);
         else
-                clear_bit(STATUS_RFKILL, &trans_pcie->status);
+                clear_bit(STATUS_RFKILL, &trans->status);
         iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
 
         return 0;
 }
 
-static void iwl_trans_pcie_stop_hw(struct iwl_trans *trans,
-                                   bool op_mode_leaving)
+static void iwl_trans_pcie_op_mode_leave(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-        bool hw_rfkill;
-        unsigned long flags;
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        /* disable interrupts - don't enable HW RF kill interrupt */
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_apm_stop(trans);
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
         iwl_disable_interrupts(trans);
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         iwl_pcie_disable_ict(trans);
-
-        if (!op_mode_leaving) {
-                /*
-                 * Even if we stop the HW, we still want the RF kill
-                 * interrupt
-                 */
-                iwl_enable_rfkill_int(trans);
-
-                /*
-                 * Check again since the RF kill state may have changed while
-                 * all the interrupts were disabled, in this case we couldn't
-                 * receive the RF kill interrupt and update the state in the
-                 * op_mode.
-                 */
-                hw_rfkill = iwl_is_rfkill_set(trans);
-                if (hw_rfkill)
-                        set_bit(STATUS_RFKILL, &trans_pcie->status);
-                else
-                        clear_bit(STATUS_RFKILL, &trans_pcie->status);
-                iwl_op_mode_hw_rf_kill(trans->op_mode, hw_rfkill);
-        }
 }
 
 static void iwl_trans_pcie_write8(struct iwl_trans *trans, u32 ofs, u8 val)
@@ -928,12 +919,10 @@ void iwl_trans_pcie_free(struct iwl_trans *trans)
 
 static void iwl_trans_pcie_set_pmi(struct iwl_trans *trans, bool state)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
         if (state)
-                set_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
+                set_bit(STATUS_TPOWER_PMI, &trans->status);
         else
-                clear_bit(STATUS_TPOWER_PMI, &trans_pcie->status);
+                clear_bit(STATUS_TPOWER_PMI, &trans->status);
 }
 
 static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
@@ -944,6 +933,9 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
 
         spin_lock_irqsave(&trans_pcie->reg_lock, *flags);
 
+        if (trans_pcie->cmd_in_flight)
+                goto out;
+
         /* this bit wakes up the NIC */
         __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
                                  CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
@@ -983,6 +975,7 @@ static bool iwl_trans_pcie_grab_nic_access(struct iwl_trans *trans, bool silent,
                 }
         }
 
+out:
         /*
          * Fool sparse by faking we release the lock - sparse will
          * track nic_access anyway.
@@ -1004,6 +997,9 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          */
         __acquire(&trans_pcie->reg_lock);
 
+        if (trans_pcie->cmd_in_flight)
+                goto out;
+
         __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
                                    CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
         /*
@@ -1013,6 +1009,7 @@ static void iwl_trans_pcie_release_nic_access(struct iwl_trans *trans,
          * scheduled on different CPUs (after we drop reg_lock).
          */
         mmiowb();
+out:
         spin_unlock_irqrestore(&trans_pcie->reg_lock, *flags);
 }
 
@@ -1457,7 +1454,7 @@ static int iwl_trans_pcie_dbgfs_register(struct iwl_trans *trans,
 
 static const struct iwl_trans_ops trans_ops_pcie = {
         .start_hw = iwl_trans_pcie_start_hw,
-        .stop_hw = iwl_trans_pcie_stop_hw,
+        .op_mode_leave = iwl_trans_pcie_op_mode_leave,
         .fw_alive = iwl_trans_pcie_fw_alive,
         .start_fw = iwl_trans_pcie_start_fw,
         .stop_device = iwl_trans_pcie_stop_device,
@@ -1609,7 +1606,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
         if (iwl_pcie_alloc_ict(trans))
                 goto out_free_cmd_pool;
 
-        err = request_threaded_irq(pdev->irq, iwl_pcie_isr_ict,
+        err = request_threaded_irq(pdev->irq, iwl_pcie_isr,
                                    iwl_pcie_irq_handler,
                                    IRQF_SHARED, DRV_NAME, trans);
         if (err) {
diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c b/drivers/net/wireless/iwlwifi/pcie/tx.c
index 0adde919a258..3d549008b3e2 100644
--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
@@ -1,6 +1,6 @@
 /******************************************************************************
  *
- * Copyright(c) 2003 - 2013 Intel Corporation. All rights reserved.
+ * Copyright(c) 2003 - 2014 Intel Corporation. All rights reserved.
  *
  * Portions of this file are derived from the ipw3945 project, as well
  * as portions of the ieee80211 subsystem header files.
@@ -207,7 +207,7 @@ static void iwl_pcie_txq_stuck_timer(unsigned long data)
                 IWL_ERR(trans, "scratch %d = 0x%08x\n", i,
                         le32_to_cpu(txq->scratchbufs[i].scratch));
 
-        iwl_nic_error(trans);
+        iwl_trans_fw_error(trans);
 }
 
 /*
@@ -289,21 +289,21 @@ static void iwl_pcie_txq_inval_byte_cnt_tbl(struct iwl_trans *trans,
  */
 void iwl_pcie_txq_inc_wr_ptr(struct iwl_trans *trans, struct iwl_txq *txq)
 {
+        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         u32 reg = 0;
         int txq_id = txq->q.id;
 
         if (txq->need_update == 0)
                 return;
 
-        if (trans->cfg->base_params->shadow_reg_enable) {
+        if (trans->cfg->base_params->shadow_reg_enable ||
+            txq_id == trans_pcie->cmd_queue) {
                 /* shadow register enabled */
                 iwl_write32(trans, HBUS_TARG_WRPTR,
                             txq->q.write_ptr | (txq_id << 8));
         } else {
-                struct iwl_trans_pcie *trans_pcie =
-                        IWL_TRANS_GET_PCIE_TRANS(trans);
                 /* if we're trying to save power */
-                if (test_bit(STATUS_TPOWER_PMI, &trans_pcie->status)) {
+                if (test_bit(STATUS_TPOWER_PMI, &trans->status)) {
                         /* wake up nic if it's powered down ...
                          * uCode will wake up, and interrupt us again, so next
                          * time we'll skip this part. */
@@ -739,10 +739,9 @@ int iwl_pcie_tx_stop(struct iwl_trans *trans)
 {
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ch, txq_id, ret;
-        unsigned long flags;
 
         /* Turn off all Tx DMA fifos */
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
 
         iwl_pcie_txq_set_sched(trans, 0);
 
@@ -759,13 +758,19 @@ int iwl_pcie_tx_stop(struct iwl_trans *trans)
                                 iwl_read_direct32(trans,
                                                   FH_TSSR_TX_STATUS_REG));
         }
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
-        if (!trans_pcie->txq) {
-                IWL_WARN(trans,
-                         "Stopping tx queues that aren't allocated...\n");
+        /*
+         * This function can be called before the op_mode disabled the
+         * queues. This happens when we have an rfkill interrupt.
+         * Since we stop Tx altogether - mark the queues as stopped.
+         */
+        memset(trans_pcie->queue_stopped, 0, sizeof(trans_pcie->queue_stopped));
+        memset(trans_pcie->queue_used, 0, sizeof(trans_pcie->queue_used));
+
+        /* This can happen: start_hw, stop_device */
+        if (!trans_pcie->txq)
                 return 0;
-        }
 
         /* Unmap DMA from host system and free skb's */
         for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
@@ -867,7 +872,6 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int ret;
         int txq_id, slots_num;
-        unsigned long flags;
         bool alloc = false;
 
         if (!trans_pcie->txq) {
@@ -877,7 +881,7 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
                 alloc = true;
         }
 
-        spin_lock_irqsave(&trans_pcie->irq_lock, flags);
+        spin_lock(&trans_pcie->irq_lock);
 
         /* Turn off all Tx DMA fifos */
         iwl_write_prph(trans, SCD_TXFACT, 0);
@@ -886,7 +890,7 @@ int iwl_pcie_tx_init(struct iwl_trans *trans)
         iwl_write_direct32(trans, FH_KW_MEM_ADDR_REG,
                            trans_pcie->kw.dma >> 4);
 
-        spin_unlock_irqrestore(&trans_pcie->irq_lock, flags);
+        spin_unlock(&trans_pcie->irq_lock);
 
         /* Alloc and init all Tx queues, including the command queue (#4/#9) */
         for (txq_id = 0; txq_id < trans->cfg->base_params->num_of_queues;
@@ -1005,6 +1009,7 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         struct iwl_txq *txq = &trans_pcie->txq[txq_id];
         struct iwl_queue *q = &txq->q;
+        unsigned long flags;
         int nfreed = 0;
 
         lockdep_assert_held(&txq->lock);
@@ -1023,10 +1028,20 @@ static void iwl_pcie_cmdq_reclaim(struct iwl_trans *trans, int txq_id, int idx)
                 if (nfreed++ > 0) {
                         IWL_ERR(trans, "HCMD skipped: index (%d) %d %d\n",
                                 idx, q->write_ptr, q->read_ptr);
-                        iwl_nic_error(trans);
+                        iwl_trans_fw_error(trans);
                 }
         }
 
+        if (q->read_ptr == q->write_ptr) {
+                spin_lock_irqsave(&trans_pcie->reg_lock, flags);
+                WARN_ON(!trans_pcie->cmd_in_flight);
+                trans_pcie->cmd_in_flight = false;
+                __iwl_trans_pcie_clear_bit(trans,
+                                           CSR_GP_CNTRL,
+                                           CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+        }
+
         iwl_pcie_txq_progress(trans_pcie, txq);
 }
 
@@ -1143,8 +1158,15 @@ void iwl_trans_pcie_txq_disable(struct iwl_trans *trans, int txq_id)
                         SCD_TX_STTS_QUEUE_OFFSET(txq_id);
         static const u32 zero_val[4] = {};
 
+        /*
+         * Upon HW Rfkill - we stop the device, and then stop the queues
+         * in the op_mode. Just for the sake of the simplicity of the op_mode,
+         * allow the op_mode to call txq_disable after it already called
+         * stop_device.
+         */
         if (!test_and_clear_bit(txq_id, trans_pcie->queue_used)) {
-                WARN_ONCE(1, "queue %d not used", txq_id);
+                WARN_ONCE(test_bit(STATUS_DEVICE_ENABLED, &trans->status),
+                          "queue %d not used", txq_id);
                 return;
         }
 
@@ -1178,12 +1200,13 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         struct iwl_queue *q = &txq->q;
         struct iwl_device_cmd *out_cmd;
         struct iwl_cmd_meta *out_meta;
+        unsigned long flags;
         void *dup_buf = NULL;
         dma_addr_t phys_addr;
         int idx;
         u16 copy_size, cmd_size, scratch_size;
         bool had_nocopy = false;
-        int i;
+        int i, ret;
         u32 cmd_pos;
         const u8 *cmddata[IWL_MAX_CMD_TBS_PER_TFD];
         u16 cmdlen[IWL_MAX_CMD_TBS_PER_TFD];
@@ -1381,10 +1404,38 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
         if (q->read_ptr == q->write_ptr && trans_pcie->wd_timeout)
                 mod_timer(&txq->stuck_timer, jiffies + trans_pcie->wd_timeout);
 
+        spin_lock_irqsave(&trans_pcie->reg_lock, flags);
+
+        /*
+         * wake up the NIC to make sure that the firmware will see the host
+         * command - we will let the NIC sleep once all the host commands
+         * returned.
+         */
+        if (!trans_pcie->cmd_in_flight) {
+                trans_pcie->cmd_in_flight = true;
+                __iwl_trans_pcie_set_bit(trans, CSR_GP_CNTRL,
+                                         CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                ret = iwl_poll_bit(trans, CSR_GP_CNTRL,
+                                   CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN,
+                                   (CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY |
+                                    CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP),
+                                   15000);
+                if (ret < 0) {
+                        __iwl_trans_pcie_clear_bit(trans, CSR_GP_CNTRL,
+                                   CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ);
+                        spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+                        trans_pcie->cmd_in_flight = false;
+                        idx = -EIO;
+                        goto out;
+                }
+        }
+
         /* Increment and update queue's write index */
         q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         iwl_pcie_txq_inc_wr_ptr(trans, txq);
 
+        spin_unlock_irqrestore(&trans_pcie->reg_lock, flags);
+
  out:
         spin_unlock_bh(&txq->lock);
  free_dup_buf:
@@ -1449,12 +1500,12 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
         iwl_pcie_cmdq_reclaim(trans, txq_id, index);
 
         if (!(meta->flags & CMD_ASYNC)) {
-                if (!test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status)) {
+                if (!test_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status)) {
                         IWL_WARN(trans,
                                  "HCMD_ACTIVE already clear for command %s\n",
                                  get_cmd_string(trans_pcie, cmd->hdr.cmd));
                 }
-                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+                clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
                 IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command %s\n",
                                get_cmd_string(trans_pcie, cmd->hdr.cmd));
                 wake_up(&trans_pcie->wait_command_queue);
@@ -1466,7 +1517,6 @@ void iwl_pcie_hcmd_complete(struct iwl_trans *trans,
 }
 
 #define HOST_COMPLETE_TIMEOUT   (2 * HZ)
-#define COMMAND_POKE_TIMEOUT    (HZ / 10)
 
 static int iwl_pcie_send_hcmd_async(struct iwl_trans *trans,
                                     struct iwl_host_cmd *cmd)
@@ -1494,13 +1544,12 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
         struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
         int cmd_idx;
         int ret;
-        int timeout = HOST_COMPLETE_TIMEOUT;
 
         IWL_DEBUG_INFO(trans, "Attempting to send sync command %s\n",
                        get_cmd_string(trans_pcie, cmd->id));
 
-        if (WARN(test_and_set_bit(STATUS_HCMD_ACTIVE,
-                                  &trans_pcie->status),
+        if (WARN(test_and_set_bit(STATUS_SYNC_HCMD_ACTIVE,
+                                  &trans->status),
                  "Command %s: a command is already active!\n",
                  get_cmd_string(trans_pcie, cmd->id)))
                 return -EIO;
@@ -1511,64 +1560,39 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
         cmd_idx = iwl_pcie_enqueue_hcmd(trans, cmd);
         if (cmd_idx < 0) {
                 ret = cmd_idx;
-                clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
+                clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
                 IWL_ERR(trans,
                         "Error sending %s: enqueue_hcmd failed: %d\n",
                         get_cmd_string(trans_pcie, cmd->id), ret);
                 return ret;
         }
 
-        while (timeout > 0) {
-                unsigned long flags;
-
-                timeout -= COMMAND_POKE_TIMEOUT;
-                ret = wait_event_timeout(trans_pcie->wait_command_queue,
-                                         !test_bit(STATUS_HCMD_ACTIVE,
-                                                   &trans_pcie->status),
-                                         COMMAND_POKE_TIMEOUT);
-                if (ret)
-                        break;
-                /* poke the device - it may have lost the command */
-                if (iwl_trans_grab_nic_access(trans, true, &flags)) {
-                        iwl_trans_release_nic_access(trans, &flags);
-                        IWL_DEBUG_INFO(trans,
-                                       "Tried to wake NIC for command %s\n",
-                                       get_cmd_string(trans_pcie, cmd->id));
-                } else {
-                        IWL_ERR(trans, "Failed to poke NIC for command %s\n",
-                                get_cmd_string(trans_pcie, cmd->id));
-                        break;
-                }
-        }
-
+        ret = wait_event_timeout(trans_pcie->wait_command_queue,
+                                 !test_bit(STATUS_SYNC_HCMD_ACTIVE,
+                                           &trans->status),
+                                 HOST_COMPLETE_TIMEOUT);
         if (!ret) {
-                if (test_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status)) {
-                        struct iwl_txq *txq =
-                                &trans_pcie->txq[trans_pcie->cmd_queue];
-                        struct iwl_queue *q = &txq->q;
+                struct iwl_txq *txq = &trans_pcie->txq[trans_pcie->cmd_queue];
+                struct iwl_queue *q = &txq->q;
 
-                        IWL_ERR(trans,
-                                "Error sending %s: time out after %dms.\n",
-                                get_cmd_string(trans_pcie, cmd->id),
-                                jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
+                IWL_ERR(trans, "Error sending %s: time out after %dms.\n",
+                        get_cmd_string(trans_pcie, cmd->id),
+                        jiffies_to_msecs(HOST_COMPLETE_TIMEOUT));
 
-                        IWL_ERR(trans,
-                                "Current CMD queue read_ptr %d write_ptr %d\n",
-                                q->read_ptr, q->write_ptr);
+                IWL_ERR(trans, "Current CMD queue read_ptr %d write_ptr %d\n",
+                        q->read_ptr, q->write_ptr);
 
-                        clear_bit(STATUS_HCMD_ACTIVE, &trans_pcie->status);
-                        IWL_DEBUG_INFO(trans,
-                                       "Clearing HCMD_ACTIVE for command %s\n",
-                                       get_cmd_string(trans_pcie, cmd->id));
-                        ret = -ETIMEDOUT;
+                clear_bit(STATUS_SYNC_HCMD_ACTIVE, &trans->status);
+                IWL_DEBUG_INFO(trans, "Clearing HCMD_ACTIVE for command %s\n",
+                               get_cmd_string(trans_pcie, cmd->id));
+                ret = -ETIMEDOUT;
 
-                        iwl_nic_error(trans);
+                iwl_trans_fw_error(trans);
 
-                        goto cancel;
-                }
+                goto cancel;
         }
 
-        if (test_bit(STATUS_FW_ERROR, &trans_pcie->status)) {
+        if (test_bit(STATUS_FW_ERROR, &trans->status)) {
                 IWL_ERR(trans, "FW error in SYNC CMD %s\n",
                         get_cmd_string(trans_pcie, cmd->id));
                 dump_stack();
@@ -1577,7 +1601,7 @@ static int iwl_pcie_send_hcmd_sync(struct iwl_trans *trans,
         }
 
         if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
-            test_bit(STATUS_RFKILL, &trans_pcie->status)) {
+            test_bit(STATUS_RFKILL, &trans->status)) {
                 IWL_DEBUG_RF_KILL(trans, "RFKILL in SYNC CMD... no rsp\n");
                 ret = -ERFKILL;
                 goto cancel;
@@ -1614,13 +1638,8 @@ cancel:
 
 int iwl_trans_pcie_send_hcmd(struct iwl_trans *trans, struct iwl_host_cmd *cmd)
 {
-        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-
-        if (test_bit(STATUS_FW_ERROR, &trans_pcie->status))
-                return -EIO;
-
         if (!(cmd->flags & CMD_SEND_IN_RFKILL) &&
-            test_bit(STATUS_RFKILL, &trans_pcie->status)) {
+            test_bit(STATUS_RFKILL, &trans->status)) {
                 IWL_DEBUG_RF_KILL(trans, "Dropping CMD 0x%x: RF KILL\n",
                                   cmd->id);
                 return -ERFKILL;
@@ -1674,7 +1693,6 @@ int iwl_trans_pcie_tx(struct iwl_trans *trans, struct sk_buff *skb,
         txq->entries[q->write_ptr].skb = skb;
         txq->entries[q->write_ptr].cmd = dev_cmd;
 
-        dev_cmd->hdr.cmd = REPLY_TX;
         dev_cmd->hdr.sequence =
                 cpu_to_le16((u16)(QUEUE_TO_SEQ(txq_id) |
                             INDEX_TO_SEQ(q->write_ptr)));
diff --git a/drivers/net/wireless/libertas/README b/drivers/net/wireless/libertas/README
index 91f2ca90c70f..1a554a685e91 100644
--- a/drivers/net/wireless/libertas/README
+++ b/drivers/net/wireless/libertas/README
@@ -8,9 +8,8 @@
  Ltd. under the terms of the GNU General Public License Version 2, June 1991
  (the "License").  You may use, redistribute and/or modify this File in
  accordance with the terms and conditions of the License, a copy of which
- is available along with the File in the license.txt file or by writing to
- the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
- 02111-1307 or on the worldwide web at http://www.gnu.org/licenses/gpl.txt.
+ is available along with the File in the license.txt file or on the worldwide
+ web at http://www.gnu.org/licenses/gpl.txt.
 
  THE FILE IS DISTRIBUTED AS-IS, WITHOUT WARRANTY OF ANY KIND, AND THE
  IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
diff --git a/drivers/net/wireless/libertas/cfg.c b/drivers/net/wireless/libertas/cfg.c
index 116f4aba08d6..32f75007a825 100644
--- a/drivers/net/wireless/libertas/cfg.c
+++ b/drivers/net/wireless/libertas/cfg.c
@@ -1268,14 +1268,9 @@ static struct cfg80211_scan_request *
 _new_connect_scan_req(struct wiphy *wiphy, struct cfg80211_connect_params *sme)
 {
         struct cfg80211_scan_request *creq = NULL;
-        int i, n_channels = 0;
+        int i, n_channels = ieee80211_get_num_supported_channels(wiphy);
         enum ieee80211_band band;
 
-        for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
-                if (wiphy->bands[band])
-                        n_channels += wiphy->bands[band]->n_channels;
-        }
-
         creq = kzalloc(sizeof(*creq) + sizeof(struct cfg80211_ssid) +
                        n_channels * sizeof(void *),
                        GFP_ATOMIC);
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index 991238afd1b6..58c6ee5de98f 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -849,7 +849,7 @@ static void if_sdio_finish_power_on(struct if_sdio_card *card)
                         card->started = true;
                         /* Tell PM core that we don't need the card to be
                          * powered now */
-                        pm_runtime_put_noidle(&func->dev);
+                        pm_runtime_put(&func->dev);
                 }
         }
 
@@ -907,8 +907,8 @@ static int if_sdio_power_on(struct if_sdio_card *card)
         sdio_release_host(func);
         ret = if_sdio_prog_firmware(card);
         if (ret) {
-                sdio_disable_func(func);
-                return ret;
+                sdio_claim_host(func);
+                goto disable;
         }
 
         return 0;
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index 83669151bb82..f11728a866ff 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -93,7 +93,6 @@ static void free_if_spi_card(struct if_spi_card *card)
                 list_del(&packet->list);
                 kfree(packet);
         }
-        spi_set_drvdata(card->spi, NULL);
         kfree(card);
 }
 
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index a1b32ee9594a..69d4c3179d04 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -159,10 +159,15 @@ static const struct ieee80211_regdomain hwsim_world_regdom_custom_02 = {
         .reg_rules = {
                 REG_RULE(2412-10, 2462+10, 40, 0, 20, 0),
                 REG_RULE(5725-10, 5850+10, 40, 0, 30,
-                        NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS),
+                         NL80211_RRF_NO_IR),
         }
 };
 
+static const struct ieee80211_regdomain *hwsim_world_regdom_custom[] = {
+        &hwsim_world_regdom_custom_01,
+        &hwsim_world_regdom_custom_02,
+};
+
 struct hwsim_vif_priv {
         u32 magic;
         u8 bssid[ETH_ALEN];
@@ -321,8 +326,52 @@ static const struct ieee80211_rate hwsim_rates[] = {
         { .bitrate = 540 }
 };
 
+static const struct ieee80211_iface_limit hwsim_if_limits[] = {
+        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
+        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
+#ifdef CONFIG_MAC80211_MESH
+                                 BIT(NL80211_IFTYPE_MESH_POINT) |
+#endif
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_P2P_GO) },
+        { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
+};
+
+static const struct ieee80211_iface_limit hwsim_if_dfs_limits[] = {
+        { .max = 8, .types = BIT(NL80211_IFTYPE_AP) },
+};
+
+static const struct ieee80211_iface_combination hwsim_if_comb[] = {
+        {
+                .limits = hwsim_if_limits,
+                .n_limits = ARRAY_SIZE(hwsim_if_limits),
+                .max_interfaces = 2048,
+                .num_different_channels = 1,
+        },
+        {
+                .limits = hwsim_if_dfs_limits,
+                .n_limits = ARRAY_SIZE(hwsim_if_dfs_limits),
+                .max_interfaces = 8,
+                .num_different_channels = 1,
+                .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) |
+                                       BIT(NL80211_CHAN_WIDTH_20) |
+                                       BIT(NL80211_CHAN_WIDTH_40) |
+                                       BIT(NL80211_CHAN_WIDTH_80) |
+                                       BIT(NL80211_CHAN_WIDTH_160),
+        }
+};
+
 static spinlock_t hwsim_radio_lock;
 static struct list_head hwsim_radios;
+static int hwsim_radio_idx;
+
+static struct platform_driver mac80211_hwsim_driver = {
+        .driver = {
+                .name = "mac80211_hwsim",
+                .owner = THIS_MODULE,
+        },
+};
 
 struct mac80211_hwsim_data {
         struct list_head list;
@@ -332,8 +381,10 @@ struct mac80211_hwsim_data {
         struct ieee80211_channel channels_2ghz[ARRAY_SIZE(hwsim_channels_2ghz)];
         struct ieee80211_channel channels_5ghz[ARRAY_SIZE(hwsim_channels_5ghz)];
         struct ieee80211_rate rates[ARRAY_SIZE(hwsim_rates)];
+        struct ieee80211_iface_combination if_combination;
 
         struct mac_address addresses[2];
+        int channels, idx;
 
         struct ieee80211_channel *tmp_chan;
         struct delayed_work roc_done;
@@ -353,7 +404,6 @@ struct mac80211_hwsim_data {
         } ps;
         bool ps_poll_pending;
         struct dentry *debugfs;
-        struct dentry *debugfs_ps;
 
         struct sk_buff_head pending;    /* packets pending */
         /*
@@ -362,7 +412,6 @@ struct mac80211_hwsim_data {
          * radio can be in more then one group.
          */
         u64 group;
-        struct dentry *debugfs_group;
 
         int power_level;
 
@@ -403,21 +452,179 @@ static struct genl_family hwsim_genl_family = {
 /* MAC80211_HWSIM netlink policy */
 
 static struct nla_policy hwsim_genl_policy[HWSIM_ATTR_MAX + 1] = {
-        [HWSIM_ATTR_ADDR_RECEIVER] = { .type = NLA_UNSPEC,
-                                       .len = 6*sizeof(u8) },
-        [HWSIM_ATTR_ADDR_TRANSMITTER] = { .type = NLA_UNSPEC,
-                                          .len = 6*sizeof(u8) },
+        [HWSIM_ATTR_ADDR_RECEIVER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
+        [HWSIM_ATTR_ADDR_TRANSMITTER] = { .type = NLA_UNSPEC, .len = ETH_ALEN },
         [HWSIM_ATTR_FRAME] = { .type = NLA_BINARY,
                                .len = IEEE80211_MAX_DATA_LEN },
         [HWSIM_ATTR_FLAGS] = { .type = NLA_U32 },
         [HWSIM_ATTR_RX_RATE] = { .type = NLA_U32 },
         [HWSIM_ATTR_SIGNAL] = { .type = NLA_U32 },
         [HWSIM_ATTR_TX_INFO] = { .type = NLA_UNSPEC,
-                                 .len = IEEE80211_TX_MAX_RATES*sizeof(
-                                        struct hwsim_tx_rate)},
+                                 .len = IEEE80211_TX_MAX_RATES *
+                                        sizeof(struct hwsim_tx_rate)},
         [HWSIM_ATTR_COOKIE] = { .type = NLA_U64 },
+        [HWSIM_ATTR_CHANNELS] = { .type = NLA_U32 },
+        [HWSIM_ATTR_RADIO_ID] = { .type = NLA_U32 },
+        [HWSIM_ATTR_REG_HINT_ALPHA2] = { .type = NLA_STRING, .len = 2 },
+        [HWSIM_ATTR_REG_CUSTOM_REG] = { .type = NLA_U32 },
+        [HWSIM_ATTR_REG_STRICT_REG] = { .type = NLA_FLAG },
 };
 
+static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
+                                    struct sk_buff *skb,
+                                    struct ieee80211_channel *chan);
+
+/* sysfs attributes */
+static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+        struct sk_buff *skb;
+        struct ieee80211_pspoll *pspoll;
+
+        if (!vp->assoc)
+                return;
+
+        wiphy_debug(data->hw->wiphy,
+                    "%s: send PS-Poll to %pM for aid %d\n",
+                    __func__, vp->bssid, vp->aid);
+
+        skb = dev_alloc_skb(sizeof(*pspoll));
+        if (!skb)
+                return;
+        pspoll = (void *) skb_put(skb, sizeof(*pspoll));
+        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
+                                            IEEE80211_STYPE_PSPOLL |
+                                            IEEE80211_FCTL_PM);
+        pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
+        memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
+        memcpy(pspoll->ta, mac, ETH_ALEN);
+
+        rcu_read_lock();
+        mac80211_hwsim_tx_frame(data->hw, skb,
+                                rcu_dereference(vif->chanctx_conf)->def.chan);
+        rcu_read_unlock();
+}
+
+static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
+                                struct ieee80211_vif *vif, int ps)
+{
+        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+        struct sk_buff *skb;
+        struct ieee80211_hdr *hdr;
+
+        if (!vp->assoc)
+                return;
+
+        wiphy_debug(data->hw->wiphy,
+                    "%s: send data::nullfunc to %pM ps=%d\n",
+                    __func__, vp->bssid, ps);
+
+        skb = dev_alloc_skb(sizeof(*hdr));
+        if (!skb)
+                return;
+        hdr = (void *) skb_put(skb, sizeof(*hdr) - ETH_ALEN);
+        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
+                                         IEEE80211_STYPE_NULLFUNC |
+                                         (ps ? IEEE80211_FCTL_PM : 0));
+        hdr->duration_id = cpu_to_le16(0);
+        memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
+        memcpy(hdr->addr2, mac, ETH_ALEN);
+        memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+
+        rcu_read_lock();
+        mac80211_hwsim_tx_frame(data->hw, skb,
+                                rcu_dereference(vif->chanctx_conf)->def.chan);
+        rcu_read_unlock();
+}
+
+
+static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
+                                   struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        hwsim_send_nullfunc(data, mac, vif, 1);
+}
+
+static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
+                                      struct ieee80211_vif *vif)
+{
+        struct mac80211_hwsim_data *data = dat;
+        hwsim_send_nullfunc(data, mac, vif, 0);
+}
+
+static int hwsim_fops_ps_read(void *dat, u64 *val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        *val = data->ps;
+        return 0;
+}
+
+static int hwsim_fops_ps_write(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        enum ps_mode old_ps;
+
+        if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
+            val != PS_MANUAL_POLL)
+                return -EINVAL;
+
+        old_ps = data->ps;
+        data->ps = val;
+
+        if (val == PS_MANUAL_POLL) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_ps_poll, data);
+                data->ps_poll_pending = true;
+        } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_nullfunc_ps,
+                                                    data);
+        } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
+                ieee80211_iterate_active_interfaces(data->hw,
+                                                    IEEE80211_IFACE_ITER_NORMAL,
+                                                    hwsim_send_nullfunc_no_ps,
+                                                    data);
+        }
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
+                        "%llu\n");
+
+static int hwsim_write_simulate_radar(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+
+        ieee80211_radar_detected(data->hw);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_simulate_radar, NULL,
+                        hwsim_write_simulate_radar, "%llu\n");
+
+static int hwsim_fops_group_read(void *dat, u64 *val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        *val = data->group;
+        return 0;
+}
+
+static int hwsim_fops_group_write(void *dat, u64 val)
+{
+        struct mac80211_hwsim_data *data = dat;
+        data->group = val;
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_group,
+                        hwsim_fops_group_read, hwsim_fops_group_write,
+                        "%llx\n");
+
 static netdev_tx_t hwsim_mon_xmit(struct sk_buff *skb,
                                         struct net_device *dev)
 {
@@ -641,7 +848,7 @@ static void mac80211_hwsim_tx_frame_nl(struct ieee80211_hw *hw,
         }
 
         if (nla_put(skb, HWSIM_ATTR_ADDR_TRANSMITTER,
-                    sizeof(struct mac_address), data->addresses[1].addr))
+                    ETH_ALEN, data->addresses[1].addr))
                 goto nla_put_failure;
 
         /* We get the skb->data */
@@ -880,7 +1087,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
                 return;
         }
 
-        if (channels == 1) {
+        if (data->channels == 1) {
                 channel = data->channel;
         } else if (txi->hw_queue == 4) {
                 channel = data->tmp_chan;
@@ -908,7 +1115,7 @@ static void mac80211_hwsim_tx(struct ieee80211_hw *hw,
         if (control->sta)
                 hwsim_check_sta_magic(control->sta);
 
-        if (rctbl)
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
                 ieee80211_get_tx_rates(txi->control.vif, control->sta, skb,
                                        txi->control.rates,
                                        ARRAY_SIZE(txi->control.rates));
@@ -1015,7 +1222,7 @@ static void mac80211_hwsim_tx_frame(struct ieee80211_hw *hw,
 {
         u32 _pid = ACCESS_ONCE(wmediumd_portid);
 
-        if (rctbl) {
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE) {
                 struct ieee80211_tx_info *txi = IEEE80211_SKB_CB(skb);
                 ieee80211_get_tx_rates(txi->control.vif, NULL, skb,
                                        txi->control.rates,
@@ -1052,7 +1259,7 @@ static void mac80211_hwsim_beacon_tx(void *arg, u8 *mac,
         if (skb == NULL)
                 return;
         info = IEEE80211_SKB_CB(skb);
-        if (rctbl)
+        if (hw->flags & IEEE80211_HW_SUPPORTS_RC_TABLE)
                 ieee80211_get_tx_rates(vif, NULL, skb,
                                        info->control.rates,
                                        ARRAY_SIZE(info->control.rates));
@@ -1143,7 +1350,7 @@ static int mac80211_hwsim_config(struct ieee80211_hw *hw, u32 changed)
 
         data->channel = conf->chandef.chan;
 
-        WARN_ON(data->channel && channels > 1);
+        WARN_ON(data->channel && data->channels > 1);
 
         data->power_level = conf->power_level;
         if (!data->started || !data->beacon_int)
@@ -1390,8 +1597,6 @@ static const struct nla_policy hwsim_testmode_policy[HWSIM_TM_ATTR_MAX + 1] = {
         [HWSIM_TM_ATTR_PS] = { .type = NLA_U32 },
 };
 
-static int hwsim_fops_ps_write(void *dat, u64 val);
-
 static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw,
                                        struct ieee80211_vif *vif,
                                        void *data, int len)
@@ -1493,7 +1698,7 @@ static void hw_scan_work(struct work_struct *work)
                     req->channels[hwsim->scan_chan_idx]->center_freq);
 
         hwsim->tmp_chan = req->channels[hwsim->scan_chan_idx];
-        if (hwsim->tmp_chan->flags & IEEE80211_CHAN_PASSIVE_SCAN ||
+        if (hwsim->tmp_chan->flags & IEEE80211_CHAN_NO_IR ||
             !req->n_ssids) {
                 dwell = 120;
         } else {
@@ -1702,8 +1907,7 @@ static void mac80211_hwsim_unassign_vif_chanctx(struct ieee80211_hw *hw,
         hwsim_check_chanctx_magic(ctx);
 }
 
-static struct ieee80211_ops mac80211_hwsim_ops =
-{
+static const struct ieee80211_ops mac80211_hwsim_ops = {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
         .stop = mac80211_hwsim_stop,
@@ -1728,208 +1932,290 @@ static struct ieee80211_ops mac80211_hwsim_ops =
         .set_tsf = mac80211_hwsim_set_tsf,
 };
 
+static struct ieee80211_ops mac80211_hwsim_mchan_ops;
 
-static void mac80211_hwsim_free(void)
+static int mac80211_hwsim_create_radio(int channels, const char *reg_alpha2,
+                                       const struct ieee80211_regdomain *regd,
+                                       bool reg_strict)
 {
-        struct list_head tmplist, *i, *tmp;
-        struct mac80211_hwsim_data *data, *tmpdata;
-
-        INIT_LIST_HEAD(&tmplist);
+        int err;
+        u8 addr[ETH_ALEN];
+        struct mac80211_hwsim_data *data;
+        struct ieee80211_hw *hw;
+        enum ieee80211_band band;
+        const struct ieee80211_ops *ops = &mac80211_hwsim_ops;
+        int idx;
 
         spin_lock_bh(&hwsim_radio_lock);
-        list_for_each_safe(i, tmp, &hwsim_radios)
-                list_move(i, &tmplist);
+        idx = hwsim_radio_idx++;
         spin_unlock_bh(&hwsim_radio_lock);
 
-        list_for_each_entry_safe(data, tmpdata, &tmplist, list) {
-                debugfs_remove(data->debugfs_group);
-                debugfs_remove(data->debugfs_ps);
-                debugfs_remove(data->debugfs);
-                ieee80211_unregister_hw(data->hw);
-                device_release_driver(data->dev);
-                device_unregister(data->dev);
-                ieee80211_free_hw(data->hw);
+        if (channels > 1)
+                ops = &mac80211_hwsim_mchan_ops;
+        hw = ieee80211_alloc_hw(sizeof(*data), ops);
+        if (!hw) {
+                printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw failed\n");
+                err = -ENOMEM;
+                goto failed;
+        }
+        data = hw->priv;
+        data->hw = hw;
+
+        data->dev = device_create(hwsim_class, NULL, 0, hw, "hwsim%d", idx);
+        if (IS_ERR(data->dev)) {
+                printk(KERN_DEBUG
+                       "mac80211_hwsim: device_create failed (%ld)\n",
+                       PTR_ERR(data->dev));
+                err = -ENOMEM;
+                goto failed_drvdata;
+        }
+        data->dev->driver = &mac80211_hwsim_driver.driver;
+        err = device_bind_driver(data->dev);
+        if (err != 0) {
+                printk(KERN_DEBUG "mac80211_hwsim: device_bind_driver failed (%d)\n",
+                       err);
+                goto failed_hw;
         }
-        class_destroy(hwsim_class);
-}
-
-static struct platform_driver mac80211_hwsim_driver = {
-        .driver = {
-                .name = "mac80211_hwsim",
-                .owner = THIS_MODULE,
-        },
-};
-
-static const struct net_device_ops hwsim_netdev_ops = {
-        .ndo_start_xmit         = hwsim_mon_xmit,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_set_mac_address    = eth_mac_addr,
-        .ndo_validate_addr      = eth_validate_addr,
-};
-
-static void hwsim_mon_setup(struct net_device *dev)
-{
-        dev->netdev_ops = &hwsim_netdev_ops;
-        dev->destructor = free_netdev;
-        ether_setup(dev);
-        dev->tx_queue_len = 0;
-        dev->type = ARPHRD_IEEE80211_RADIOTAP;
-        memset(dev->dev_addr, 0, ETH_ALEN);
-        dev->dev_addr[0] = 0x12;
-}
 
+        skb_queue_head_init(&data->pending);
 
-static void hwsim_send_ps_poll(void *dat, u8 *mac, struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
-        struct sk_buff *skb;
-        struct ieee80211_pspoll *pspoll;
+        SET_IEEE80211_DEV(hw, data->dev);
+        memset(addr, 0, ETH_ALEN);
+        addr[0] = 0x02;
+        addr[3] = idx >> 8;
+        addr[4] = idx;
+        memcpy(data->addresses[0].addr, addr, ETH_ALEN);
+        memcpy(data->addresses[1].addr, addr, ETH_ALEN);
+        data->addresses[1].addr[0] |= 0x40;
+        hw->wiphy->n_addresses = 2;
+        hw->wiphy->addresses = data->addresses;
+
+        data->channels = channels;
+        data->idx = idx;
+
+        if (data->channels > 1) {
+                hw->wiphy->max_scan_ssids = 255;
+                hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
+                hw->wiphy->max_remain_on_channel_duration = 1000;
+                /* For channels > 1 DFS is not allowed */
+                hw->wiphy->n_iface_combinations = 1;
+                hw->wiphy->iface_combinations = &data->if_combination;
+                data->if_combination = hwsim_if_comb[0];
+                data->if_combination.num_different_channels = data->channels;
+        } else {
+                hw->wiphy->iface_combinations = hwsim_if_comb;
+                hw->wiphy->n_iface_combinations = ARRAY_SIZE(hwsim_if_comb);
+        }
 
-        if (!vp->assoc)
-                return;
+        INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
+        INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
+
+        hw->queues = 5;
+        hw->offchannel_tx_hw_queue = 4;
+        hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                     BIT(NL80211_IFTYPE_AP) |
+                                     BIT(NL80211_IFTYPE_P2P_CLIENT) |
+                                     BIT(NL80211_IFTYPE_P2P_GO) |
+                                     BIT(NL80211_IFTYPE_ADHOC) |
+                                     BIT(NL80211_IFTYPE_MESH_POINT) |
+                                     BIT(NL80211_IFTYPE_P2P_DEVICE);
+
+        hw->flags = IEEE80211_HW_MFP_CAPABLE |
+                    IEEE80211_HW_SIGNAL_DBM |
+                    IEEE80211_HW_SUPPORTS_STATIC_SMPS |
+                    IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
+                    IEEE80211_HW_AMPDU_AGGREGATION |
+                    IEEE80211_HW_WANT_MONITOR_VIF |
+                    IEEE80211_HW_QUEUE_CONTROL |
+                    IEEE80211_HW_SUPPORTS_HT_CCK_RATES;
+        if (rctbl)
+                hw->flags |= IEEE80211_HW_SUPPORTS_RC_TABLE;
+
+        hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
+                            WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
+                            WIPHY_FLAG_AP_UAPSD;
+        hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
+
+        /* ask mac80211 to reserve space for magic */
+        hw->vif_data_size = sizeof(struct hwsim_vif_priv);
+        hw->sta_data_size = sizeof(struct hwsim_sta_priv);
+        hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
+
+        memcpy(data->channels_2ghz, hwsim_channels_2ghz,
+                sizeof(hwsim_channels_2ghz));
+        memcpy(data->channels_5ghz, hwsim_channels_5ghz,
+                sizeof(hwsim_channels_5ghz));
+        memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
+
+        for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
+                struct ieee80211_supported_band *sband = &data->bands[band];
+                switch (band) {
+                case IEEE80211_BAND_2GHZ:
+                        sband->channels = data->channels_2ghz;
+                        sband->n_channels = ARRAY_SIZE(hwsim_channels_2ghz);
+                        sband->bitrates = data->rates;
+                        sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
+                        break;
+                case IEEE80211_BAND_5GHZ:
+                        sband->channels = data->channels_5ghz;
+                        sband->n_channels = ARRAY_SIZE(hwsim_channels_5ghz);
+                        sband->bitrates = data->rates + 4;
+                        sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
+                        break;
+                default:
+                        continue;
+                }
 
-        wiphy_debug(data->hw->wiphy,
-                    "%s: send PS-Poll to %pM for aid %d\n",
-                    __func__, vp->bssid, vp->aid);
+                sband->ht_cap.ht_supported = true;
+                sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
+                                    IEEE80211_HT_CAP_GRN_FLD |
+                                    IEEE80211_HT_CAP_SGI_40 |
+                                    IEEE80211_HT_CAP_DSSSCCK40;
+                sband->ht_cap.ampdu_factor = 0x3;
+                sband->ht_cap.ampdu_density = 0x6;
+                memset(&sband->ht_cap.mcs, 0,
+                       sizeof(sband->ht_cap.mcs));
+                sband->ht_cap.mcs.rx_mask[0] = 0xff;
+                sband->ht_cap.mcs.rx_mask[1] = 0xff;
+                sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
+
+                hw->wiphy->bands[band] = sband;
+
+                sband->vht_cap.vht_supported = true;
+                sband->vht_cap.cap =
+                        IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+                        IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
+                        IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ |
+                        IEEE80211_VHT_CAP_RXLDPC |
+                        IEEE80211_VHT_CAP_SHORT_GI_80 |
+                        IEEE80211_VHT_CAP_SHORT_GI_160 |
+                        IEEE80211_VHT_CAP_TXSTBC |
+                        IEEE80211_VHT_CAP_RXSTBC_1 |
+                        IEEE80211_VHT_CAP_RXSTBC_2 |
+                        IEEE80211_VHT_CAP_RXSTBC_3 |
+                        IEEE80211_VHT_CAP_RXSTBC_4 |
+                        IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
+                sband->vht_cap.vht_mcs.rx_mcs_map =
+                        cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_8 << 0 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 2 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 6 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 8 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
+                                    IEEE80211_VHT_MCS_SUPPORT_0_8 << 14);
+                sband->vht_cap.vht_mcs.tx_mcs_map =
+                        sband->vht_cap.vht_mcs.rx_mcs_map;
+        }
 
-        skb = dev_alloc_skb(sizeof(*pspoll));
-        if (!skb)
-                return;
-        pspoll = (void *) skb_put(skb, sizeof(*pspoll));
-        pspoll->frame_control = cpu_to_le16(IEEE80211_FTYPE_CTL |
-                                            IEEE80211_STYPE_PSPOLL |
-                                            IEEE80211_FCTL_PM);
-        pspoll->aid = cpu_to_le16(0xc000 | vp->aid);
-        memcpy(pspoll->bssid, vp->bssid, ETH_ALEN);
-        memcpy(pspoll->ta, mac, ETH_ALEN);
+        /* By default all radios belong to the first group */
+        data->group = 1;
+        mutex_init(&data->mutex);
 
-        rcu_read_lock();
-        mac80211_hwsim_tx_frame(data->hw, skb,
-                                rcu_dereference(vif->chanctx_conf)->def.chan);
-        rcu_read_unlock();
-}
+        /* Enable frame retransmissions for lossy channels */
+        hw->max_rates = 4;
+        hw->max_rate_tries = 11;
 
-static void hwsim_send_nullfunc(struct mac80211_hwsim_data *data, u8 *mac,
-                                struct ieee80211_vif *vif, int ps)
-{
-        struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
-        struct sk_buff *skb;
-        struct ieee80211_hdr *hdr;
+        if (reg_strict)
+                hw->wiphy->regulatory_flags |= REGULATORY_STRICT_REG;
+        if (regd) {
+                hw->wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+                wiphy_apply_custom_regulatory(hw->wiphy, regd);
+                /* give the regulatory workqueue a chance to run */
+                schedule_timeout_interruptible(1);
+        }
 
-        if (!vp->assoc)
-                return;
+        err = ieee80211_register_hw(hw);
+        if (err < 0) {
+                printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
+                       err);
+                goto failed_hw;
+        }
 
-        wiphy_debug(data->hw->wiphy,
-                    "%s: send data::nullfunc to %pM ps=%d\n",
-                    __func__, vp->bssid, ps);
+        wiphy_debug(hw->wiphy, "hwaddr %pM registered\n", hw->wiphy->perm_addr);
 
-        skb = dev_alloc_skb(sizeof(*hdr));
-        if (!skb)
-                return;
-        hdr = (void *) skb_put(skb, sizeof(*hdr) - ETH_ALEN);
-        hdr->frame_control = cpu_to_le16(IEEE80211_FTYPE_DATA |
-                                         IEEE80211_STYPE_NULLFUNC |
-                                         (ps ? IEEE80211_FCTL_PM : 0));
-        hdr->duration_id = cpu_to_le16(0);
-        memcpy(hdr->addr1, vp->bssid, ETH_ALEN);
-        memcpy(hdr->addr2, mac, ETH_ALEN);
-        memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+        if (reg_alpha2)
+                regulatory_hint(hw->wiphy, reg_alpha2);
 
-        rcu_read_lock();
-        mac80211_hwsim_tx_frame(data->hw, skb,
-                                rcu_dereference(vif->chanctx_conf)->def.chan);
-        rcu_read_unlock();
-}
+        data->debugfs = debugfs_create_dir("hwsim", hw->wiphy->debugfsdir);
+        debugfs_create_file("ps", 0666, data->debugfs, data, &hwsim_fops_ps);
+        debugfs_create_file("group", 0666, data->debugfs, data,
+                            &hwsim_fops_group);
+        if (data->channels == 1)
+                debugfs_create_file("dfs_simulate_radar", 0222,
+                                    data->debugfs,
+                                    data, &hwsim_simulate_radar);
 
+        tasklet_hrtimer_init(&data->beacon_timer,
+                             mac80211_hwsim_beacon,
+                             CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS);
 
-static void hwsim_send_nullfunc_ps(void *dat, u8 *mac,
-                                   struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        hwsim_send_nullfunc(data, mac, vif, 1);
-}
+        spin_lock_bh(&hwsim_radio_lock);
+        list_add_tail(&data->list, &hwsim_radios);
+        spin_unlock_bh(&hwsim_radio_lock);
 
+        return idx;
 
-static void hwsim_send_nullfunc_no_ps(void *dat, u8 *mac,
-                                      struct ieee80211_vif *vif)
-{
-        struct mac80211_hwsim_data *data = dat;
-        hwsim_send_nullfunc(data, mac, vif, 0);
+failed_hw:
+        device_unregister(data->dev);
+failed_drvdata:
+        ieee80211_free_hw(hw);
+failed:
+        return err;
 }
 
-
-static int hwsim_fops_ps_read(void *dat, u64 *val)
+static void mac80211_hwsim_destroy_radio(struct mac80211_hwsim_data *data)
 {
-        struct mac80211_hwsim_data *data = dat;
-        *val = data->ps;
-        return 0;
+        debugfs_remove_recursive(data->debugfs);
+        ieee80211_unregister_hw(data->hw);
+        device_release_driver(data->dev);
+        device_unregister(data->dev);
+        ieee80211_free_hw(data->hw);
 }
 
-static int hwsim_fops_ps_write(void *dat, u64 val)
+static void mac80211_hwsim_free(void)
 {
-        struct mac80211_hwsim_data *data = dat;
-        enum ps_mode old_ps;
-
-        if (val != PS_DISABLED && val != PS_ENABLED && val != PS_AUTO_POLL &&
-            val != PS_MANUAL_POLL)
-                return -EINVAL;
-
-        old_ps = data->ps;
-        data->ps = val;
+        struct mac80211_hwsim_data *data;
 
-        if (val == PS_MANUAL_POLL) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_ps_poll, data);
-                data->ps_poll_pending = true;
-        } else if (old_ps == PS_DISABLED && val != PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_ps,
-                                                    data);
-        } else if (old_ps != PS_DISABLED && val == PS_DISABLED) {
-                ieee80211_iterate_active_interfaces(data->hw,
-                                                    IEEE80211_IFACE_ITER_NORMAL,
-                                                    hwsim_send_nullfunc_no_ps,
-                                                    data);
+        spin_lock_bh(&hwsim_radio_lock);
+        while ((data = list_first_entry_or_null(&hwsim_radios,
+                                                struct mac80211_hwsim_data,
+                                                list))) {
+                list_del(&data->list);
+                spin_unlock_bh(&hwsim_radio_lock);
+                mac80211_hwsim_destroy_radio(data);
+                spin_lock_bh(&hwsim_radio_lock);
         }
-
-        return 0;
+        spin_unlock_bh(&hwsim_radio_lock);
+        class_destroy(hwsim_class);
 }
 
-DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_ps, hwsim_fops_ps_read, hwsim_fops_ps_write,
-                        "%llu\n");
-
-
-static int hwsim_fops_group_read(void *dat, u64 *val)
-{
-        struct mac80211_hwsim_data *data = dat;
-        *val = data->group;
-        return 0;
-}
+static const struct net_device_ops hwsim_netdev_ops = {
+        .ndo_start_xmit         = hwsim_mon_xmit,
+        .ndo_change_mtu         = eth_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
 
-static int hwsim_fops_group_write(void *dat, u64 val)
+static void hwsim_mon_setup(struct net_device *dev)
 {
-        struct mac80211_hwsim_data *data = dat;
-        data->group = val;
-        return 0;
+        dev->netdev_ops = &hwsim_netdev_ops;
+        dev->destructor = free_netdev;
+        ether_setup(dev);
+        dev->tx_queue_len = 0;
+        dev->type = ARPHRD_IEEE80211_RADIOTAP;
+        memset(dev->dev_addr, 0, ETH_ALEN);
+        dev->dev_addr[0] = 0x12;
 }
 
-DEFINE_SIMPLE_ATTRIBUTE(hwsim_fops_group,
-                        hwsim_fops_group_read, hwsim_fops_group_write,
-                        "%llx\n");
-
-static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(
-                             struct mac_address *addr)
+static struct mac80211_hwsim_data *get_hwsim_data_ref_from_addr(const u8 *addr)
 {
         struct mac80211_hwsim_data *data;
         bool _found = false;
 
         spin_lock_bh(&hwsim_radio_lock);
         list_for_each_entry(data, &hwsim_radios, list) {
-                if (memcmp(data->addresses[1].addr, addr,
-                          sizeof(struct mac_address)) == 0) {
+                if (memcmp(data->addresses[1].addr, addr, ETH_ALEN) == 0) {
                         _found = true;
                         break;
                 }
@@ -1952,27 +2238,26 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
         struct hwsim_tx_rate *tx_attempts;
         unsigned long ret_skb_ptr;
         struct sk_buff *skb, *tmp;
-        struct mac_address *src;
+        const u8 *src;
         unsigned int hwsim_flags;
-
         int i;
         bool found = false;
 
+        if (info->snd_portid != wmediumd_portid)
+                return -EINVAL;
+
         if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] ||
-           !info->attrs[HWSIM_ATTR_FLAGS] ||
-           !info->attrs[HWSIM_ATTR_COOKIE] ||
-           !info->attrs[HWSIM_ATTR_TX_INFO])
+            !info->attrs[HWSIM_ATTR_FLAGS] ||
+            !info->attrs[HWSIM_ATTR_COOKIE] ||
+            !info->attrs[HWSIM_ATTR_TX_INFO])
                 goto out;
 
-        src = (struct mac_address *)nla_data(
-                                   info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
+        src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
         hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
-
         ret_skb_ptr = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
 
         data2 = get_hwsim_data_ref_from_addr(src);
-
-        if (data2 == NULL)
+        if (!data2)
                 goto out;
 
         /* look for the skb matching the cookie passed back from user */
@@ -2029,38 +2314,37 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
 
         struct mac80211_hwsim_data *data2;
         struct ieee80211_rx_status rx_status;
-        struct mac_address *dst;
+        const u8 *dst;
         int frame_data_len;
-        char *frame_data;
+        void *frame_data;
         struct sk_buff *skb = NULL;
 
+        if (info->snd_portid != wmediumd_portid)
+                return -EINVAL;
+
         if (!info->attrs[HWSIM_ATTR_ADDR_RECEIVER] ||
             !info->attrs[HWSIM_ATTR_FRAME] ||
             !info->attrs[HWSIM_ATTR_RX_RATE] ||
             !info->attrs[HWSIM_ATTR_SIGNAL])
                 goto out;
 
-        dst = (struct mac_address *)nla_data(
-                                   info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
-
+        dst = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_RECEIVER]);
         frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
-        frame_data = (char *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
+        frame_data = (void *)nla_data(info->attrs[HWSIM_ATTR_FRAME]);
 
         /* Allocate new skb here */
         skb = alloc_skb(frame_data_len, GFP_KERNEL);
         if (skb == NULL)
                 goto err;
 
-        if (frame_data_len <= IEEE80211_MAX_DATA_LEN) {
-                /* Copy the data */
-                memcpy(skb_put(skb, frame_data_len), frame_data,
-                       frame_data_len);
-        } else
+        if (frame_data_len > IEEE80211_MAX_DATA_LEN)
                 goto err;
 
-        data2 = get_hwsim_data_ref_from_addr(dst);
+        /* Copy the data */
+        memcpy(skb_put(skb, frame_data_len), frame_data, frame_data_len);
 
-        if (data2 == NULL)
+        data2 = get_hwsim_data_ref_from_addr(dst);
+        if (!data2)
                 goto out;
 
         /* check if radio is configured properly */
@@ -2068,7 +2352,7 @@ static int hwsim_cloned_frame_received_nl(struct sk_buff *skb_2,
         if (data2->idle || !data2->started)
                 goto out;
 
-        /*A frame is received from user space*/
+        /* A frame is received from user space */
         memset(&rx_status, 0, sizeof(rx_status));
         rx_status.freq = data2->channel->center_freq;
         rx_status.band = data2->channel->band;
@@ -2090,8 +2374,24 @@ out:
 static int hwsim_register_received_nl(struct sk_buff *skb_2,
                                       struct genl_info *info)
 {
-        if (info == NULL)
-                goto out;
+        struct mac80211_hwsim_data *data;
+        int chans = 1;
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry(data, &hwsim_radios, list)
+                chans = max(chans, data->channels);
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        /* In the future we should revise the userspace API and allow it
+         * to set a flag that it does support multi-channel, then we can
+         * let this pass conditionally on the flag.
+         * For current userspace, prohibit it since it won't work right.
+         */
+        if (chans > 1)
+                return -EOPNOTSUPP;
+
+        if (wmediumd_portid)
+                return -EBUSY;
 
         wmediumd_portid = info->snd_portid;
 
@@ -2099,9 +2399,53 @@ static int hwsim_register_received_nl(struct sk_buff *skb_2,
                "switching to wmediumd mode with pid %d\n", info->snd_portid);
 
         return 0;
-out:
-        printk(KERN_DEBUG "mac80211_hwsim: error occurred in %s\n", __func__);
-        return -EINVAL;
+}
+
+static int hwsim_create_radio_nl(struct sk_buff *msg, struct genl_info *info)
+{
+        unsigned int chans = channels;
+        const char *alpha2 = NULL;
+        const struct ieee80211_regdomain *regd = NULL;
+        bool reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
+
+        if (info->attrs[HWSIM_ATTR_CHANNELS])
+                chans = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
+        if (info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2])
+                alpha2 = nla_data(info->attrs[HWSIM_ATTR_REG_HINT_ALPHA2]);
+
+        if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) {
+                u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]);
+
+                if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom))
+                        return -EINVAL;
+                regd = hwsim_world_regdom_custom[idx];
+        }
+
+        return mac80211_hwsim_create_radio(chans, alpha2, regd, reg_strict);
+}
+
+static int hwsim_destroy_radio_nl(struct sk_buff *msg, struct genl_info *info)
+{
+        struct mac80211_hwsim_data *data;
+        int idx;
+
+        if (!info->attrs[HWSIM_ATTR_RADIO_ID])
+                return -EINVAL;
+        idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]);
+
+        spin_lock_bh(&hwsim_radio_lock);
+        list_for_each_entry(data, &hwsim_radios, list) {
+                if (data->idx != idx)
+                        continue;
+                list_del(&data->list);
+                spin_unlock_bh(&hwsim_radio_lock);
+                mac80211_hwsim_destroy_radio(data);
+                return 0;
+        }
+        spin_unlock_bh(&hwsim_radio_lock);
+
+        return -ENODEV;
 }
 
 /* Generic Netlink operations array */
@@ -2122,6 +2466,18 @@ static const struct genl_ops hwsim_ops[] = {
                 .policy = hwsim_genl_policy,
                 .doit = hwsim_tx_info_frame_received_nl,
         },
+        {
+                .cmd = HWSIM_CMD_CREATE_RADIO,
+                .policy = hwsim_genl_policy,
+                .doit = hwsim_create_radio_nl,
+                .flags = GENL_ADMIN_PERM,
+        },
+        {
+                .cmd = HWSIM_CMD_DESTROY_RADIO,
+                .policy = hwsim_genl_policy,
+                .doit = hwsim_destroy_radio_nl,
+                .flags = GENL_ADMIN_PERM,
+        },
 };
 
 static int mac80211_hwsim_netlink_notify(struct notifier_block *nb,
@@ -2150,10 +2506,6 @@ static int hwsim_init_netlink(void)
 {
         int rc;
 
-        /* userspace test API hasn't been adjusted for multi-channel */
-        if (channels > 1)
-                return 0;
-
         printk(KERN_INFO "mac80211_hwsim: initializing netlink\n");
 
         rc = genl_register_family_with_ops(&hwsim_genl_family, hwsim_ops);
@@ -2173,77 +2525,36 @@ failure:
 
 static void hwsim_exit_netlink(void)
 {
-        int ret;
-
-        /* userspace test API hasn't been adjusted for multi-channel */
-        if (channels > 1)
-                return;
-
-        printk(KERN_INFO "mac80211_hwsim: closing netlink\n");
         /* unregister the notifier */
         netlink_unregister_notifier(&hwsim_netlink_notifier);
         /* unregister the family */
-        ret = genl_unregister_family(&hwsim_genl_family);
-        if (ret)
-                printk(KERN_DEBUG "mac80211_hwsim: "
-                       "unregister family %i\n", ret);
+        genl_unregister_family(&hwsim_genl_family);
 }
 
-static const struct ieee80211_iface_limit hwsim_if_limits[] = {
-        { .max = 1, .types = BIT(NL80211_IFTYPE_ADHOC) },
-        { .max = 2048,  .types = BIT(NL80211_IFTYPE_STATION) |
-                                 BIT(NL80211_IFTYPE_P2P_CLIENT) |
-#ifdef CONFIG_MAC80211_MESH
-                                 BIT(NL80211_IFTYPE_MESH_POINT) |
-#endif
-                                 BIT(NL80211_IFTYPE_AP) |
-                                 BIT(NL80211_IFTYPE_P2P_GO) },
-        { .max = 1, .types = BIT(NL80211_IFTYPE_P2P_DEVICE) },
-};
-
-static struct ieee80211_iface_combination hwsim_if_comb = {
-        .limits = hwsim_if_limits,
-        .n_limits = ARRAY_SIZE(hwsim_if_limits),
-        .max_interfaces = 2048,
-        .num_different_channels = 1,
-};
-
 static int __init init_mac80211_hwsim(void)
 {
-        int i, err = 0;
-        u8 addr[ETH_ALEN];
-        struct mac80211_hwsim_data *data;
-        struct ieee80211_hw *hw;
-        enum ieee80211_band band;
+        int i, err;
 
-        if (radios < 1 || radios > 100)
+        if (radios < 0 || radios > 100)
                 return -EINVAL;
 
         if (channels < 1)
                 return -EINVAL;
 
-        if (channels > 1) {
-                hwsim_if_comb.num_different_channels = channels;
-                mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
-                mac80211_hwsim_ops.cancel_hw_scan =
-                        mac80211_hwsim_cancel_hw_scan;
-                mac80211_hwsim_ops.sw_scan_start = NULL;
-                mac80211_hwsim_ops.sw_scan_complete = NULL;
-                mac80211_hwsim_ops.remain_on_channel =
-                        mac80211_hwsim_roc;
-                mac80211_hwsim_ops.cancel_remain_on_channel =
-                        mac80211_hwsim_croc;
-                mac80211_hwsim_ops.add_chanctx =
-                        mac80211_hwsim_add_chanctx;
-                mac80211_hwsim_ops.remove_chanctx =
-                        mac80211_hwsim_remove_chanctx;
-                mac80211_hwsim_ops.change_chanctx =
-                        mac80211_hwsim_change_chanctx;
-                mac80211_hwsim_ops.assign_vif_chanctx =
-                        mac80211_hwsim_assign_vif_chanctx;
-                mac80211_hwsim_ops.unassign_vif_chanctx =
-                        mac80211_hwsim_unassign_vif_chanctx;
-        }
+        mac80211_hwsim_mchan_ops = mac80211_hwsim_ops;
+        mac80211_hwsim_mchan_ops.hw_scan = mac80211_hwsim_hw_scan;
+        mac80211_hwsim_mchan_ops.cancel_hw_scan = mac80211_hwsim_cancel_hw_scan;
+        mac80211_hwsim_mchan_ops.sw_scan_start = NULL;
+        mac80211_hwsim_mchan_ops.sw_scan_complete = NULL;
+        mac80211_hwsim_mchan_ops.remain_on_channel = mac80211_hwsim_roc;
+        mac80211_hwsim_mchan_ops.cancel_remain_on_channel = mac80211_hwsim_croc;
+        mac80211_hwsim_mchan_ops.add_chanctx = mac80211_hwsim_add_chanctx;
+        mac80211_hwsim_mchan_ops.remove_chanctx = mac80211_hwsim_remove_chanctx;
+        mac80211_hwsim_mchan_ops.change_chanctx = mac80211_hwsim_change_chanctx;
+        mac80211_hwsim_mchan_ops.assign_vif_chanctx =
+                mac80211_hwsim_assign_vif_chanctx;
+        mac80211_hwsim_mchan_ops.unassign_vif_chanctx =
+                mac80211_hwsim_unassign_vif_chanctx;
 
         spin_lock_init(&hwsim_radio_lock);
         INIT_LIST_HEAD(&hwsim_radios);
@@ -2255,348 +2566,116 @@ static int __init init_mac80211_hwsim(void)
         hwsim_class = class_create(THIS_MODULE, "mac80211_hwsim");
         if (IS_ERR(hwsim_class)) {
                 err = PTR_ERR(hwsim_class);
-                goto failed_unregister_driver;
+                goto out_unregister_driver;
         }
 
-        memset(addr, 0, ETH_ALEN);
-        addr[0] = 0x02;
-
         for (i = 0; i < radios; i++) {
-                printk(KERN_DEBUG "mac80211_hwsim: Initializing radio %d\n",
-                       i);
-                hw = ieee80211_alloc_hw(sizeof(*data), &mac80211_hwsim_ops);
-                if (!hw) {
-                        printk(KERN_DEBUG "mac80211_hwsim: ieee80211_alloc_hw "
-                               "failed\n");
-                        err = -ENOMEM;
-                        goto failed;
-                }
-                data = hw->priv;
-                data->hw = hw;
-
-                data->dev = device_create(hwsim_class, NULL, 0, hw,
-                                          "hwsim%d", i);
-                if (IS_ERR(data->dev)) {
-                        printk(KERN_DEBUG
-                               "mac80211_hwsim: device_create failed (%ld)\n",
-                               PTR_ERR(data->dev));
-                        err = -ENOMEM;
-                        goto failed_drvdata;
-                }
-                data->dev->driver = &mac80211_hwsim_driver.driver;
-                err = device_bind_driver(data->dev);
-                if (err != 0) {
-                        printk(KERN_DEBUG
-                               "mac80211_hwsim: device_bind_driver failed (%d)\n",
-                               err);
-                        goto failed_hw;
-                }
-
-                skb_queue_head_init(&data->pending);
+                const char *reg_alpha2 = NULL;
+                const struct ieee80211_regdomain *regd = NULL;
+                bool reg_strict = false;
 
-                SET_IEEE80211_DEV(hw, data->dev);
-                addr[3] = i >> 8;
-                addr[4] = i;
-                memcpy(data->addresses[0].addr, addr, ETH_ALEN);
-                memcpy(data->addresses[1].addr, addr, ETH_ALEN);
-                data->addresses[1].addr[0] |= 0x40;
-                hw->wiphy->n_addresses = 2;
-                hw->wiphy->addresses = data->addresses;
-
-                hw->wiphy->iface_combinations = &hwsim_if_comb;
-                hw->wiphy->n_iface_combinations = 1;
-
-                if (channels > 1) {
-                        hw->wiphy->max_scan_ssids = 255;
-                        hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
-                        hw->wiphy->max_remain_on_channel_duration = 1000;
-                }
-
-                INIT_DELAYED_WORK(&data->roc_done, hw_roc_done);
-                INIT_DELAYED_WORK(&data->hw_scan, hw_scan_work);
-
-                hw->channel_change_time = 1;
-                hw->queues = 5;
-                hw->offchannel_tx_hw_queue = 4;
-                hw->wiphy->interface_modes =
-                        BIT(NL80211_IFTYPE_STATION) |
-                        BIT(NL80211_IFTYPE_AP) |
-                        BIT(NL80211_IFTYPE_P2P_CLIENT) |
-                        BIT(NL80211_IFTYPE_P2P_GO) |
-                        BIT(NL80211_IFTYPE_ADHOC) |
-                        BIT(NL80211_IFTYPE_MESH_POINT) |
-                        BIT(NL80211_IFTYPE_P2P_DEVICE);
-
-                hw->flags = IEEE80211_HW_MFP_CAPABLE |
-                            IEEE80211_HW_SIGNAL_DBM |
-                            IEEE80211_HW_SUPPORTS_STATIC_SMPS |
-                            IEEE80211_HW_SUPPORTS_DYNAMIC_SMPS |
-                            IEEE80211_HW_AMPDU_AGGREGATION |
-                            IEEE80211_HW_WANT_MONITOR_VIF |
-                            IEEE80211_HW_QUEUE_CONTROL;
-                if (rctbl)
-                        hw->flags |= IEEE80211_HW_SUPPORTS_RC_TABLE;
-
-                hw->wiphy->flags |= WIPHY_FLAG_SUPPORTS_TDLS |
-                                    WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL |
-                                    WIPHY_FLAG_AP_UAPSD;
-                hw->wiphy->features |= NL80211_FEATURE_ACTIVE_MONITOR;
-
-                /* ask mac80211 to reserve space for magic */
-                hw->vif_data_size = sizeof(struct hwsim_vif_priv);
-                hw->sta_data_size = sizeof(struct hwsim_sta_priv);
-                hw->chanctx_data_size = sizeof(struct hwsim_chanctx_priv);
-
-                memcpy(data->channels_2ghz, hwsim_channels_2ghz,
-                        sizeof(hwsim_channels_2ghz));
-                memcpy(data->channels_5ghz, hwsim_channels_5ghz,
-                        sizeof(hwsim_channels_5ghz));
-                memcpy(data->rates, hwsim_rates, sizeof(hwsim_rates));
-
-                for (band = IEEE80211_BAND_2GHZ; band < IEEE80211_NUM_BANDS; band++) {
-                        struct ieee80211_supported_band *sband = &data->bands[band];
-                        switch (band) {
-                        case IEEE80211_BAND_2GHZ:
-                                sband->channels = data->channels_2ghz;
-                                sband->n_channels =
-                                        ARRAY_SIZE(hwsim_channels_2ghz);
-                                sband->bitrates = data->rates;
-                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates);
-                                break;
-                        case IEEE80211_BAND_5GHZ:
-                                sband->channels = data->channels_5ghz;
-                                sband->n_channels =
-                                        ARRAY_SIZE(hwsim_channels_5ghz);
-                                sband->bitrates = data->rates + 4;
-                                sband->n_bitrates = ARRAY_SIZE(hwsim_rates) - 4;
-                                break;
-                        default:
-                                continue;
-                        }
-
-                        sband->ht_cap.ht_supported = true;
-                        sband->ht_cap.cap = IEEE80211_HT_CAP_SUP_WIDTH_20_40 |
-                                IEEE80211_HT_CAP_GRN_FLD |
-                                IEEE80211_HT_CAP_SGI_40 |
-                                IEEE80211_HT_CAP_DSSSCCK40;
-                        sband->ht_cap.ampdu_factor = 0x3;
-                        sband->ht_cap.ampdu_density = 0x6;
-                        memset(&sband->ht_cap.mcs, 0,
-                               sizeof(sband->ht_cap.mcs));
-                        sband->ht_cap.mcs.rx_mask[0] = 0xff;
-                        sband->ht_cap.mcs.rx_mask[1] = 0xff;
-                        sband->ht_cap.mcs.tx_params = IEEE80211_HT_MCS_TX_DEFINED;
-
-                        hw->wiphy->bands[band] = sband;
-
-                        sband->vht_cap.vht_supported = true;
-                        sband->vht_cap.cap =
-                                IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
-                                IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ |
-                                IEEE80211_VHT_CAP_RXLDPC |
-                                IEEE80211_VHT_CAP_SHORT_GI_80 |
-                                IEEE80211_VHT_CAP_SHORT_GI_160 |
-                                IEEE80211_VHT_CAP_TXSTBC |
-                                IEEE80211_VHT_CAP_RXSTBC_1 |
-                                IEEE80211_VHT_CAP_RXSTBC_2 |
-                                IEEE80211_VHT_CAP_RXSTBC_3 |
-                                IEEE80211_VHT_CAP_RXSTBC_4 |
-                                IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK;
-                        sband->vht_cap.vht_mcs.rx_mcs_map =
-                                cpu_to_le16(IEEE80211_VHT_MCS_SUPPORT_0_8 << 0 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 2 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 4 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 6 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 8 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 10 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_9 << 12 |
-                                            IEEE80211_VHT_MCS_SUPPORT_0_8 << 14);
-                        sband->vht_cap.vht_mcs.tx_mcs_map =
-                                sband->vht_cap.vht_mcs.rx_mcs_map;
-                }
-                /* By default all radios are belonging to the first group */
-                data->group = 1;
-                mutex_init(&data->mutex);
-
-                /* Enable frame retransmissions for lossy channels */
-                hw->max_rates = 4;
-                hw->max_rate_tries = 11;
-
-                /* Work to be done prior to ieee80211_register_hw() */
                 switch (regtest) {
-                case HWSIM_REGTEST_DISABLED:
-                case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
-                case HWSIM_REGTEST_DRIVER_REG_ALL:
                 case HWSIM_REGTEST_DIFF_COUNTRY:
-                        /*
-                         * Nothing to be done for driver regulatory domain
-                         * hints prior to ieee80211_register_hw()
-                         */
-                        break;
-                case HWSIM_REGTEST_WORLD_ROAM:
-                        if (i == 0) {
-                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        }
-                        break;
-                case HWSIM_REGTEST_CUSTOM_WORLD:
-                        hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                        wiphy_apply_custom_regulatory(hw->wiphy,
-                                &hwsim_world_regdom_custom_01);
-                        break;
-                case HWSIM_REGTEST_CUSTOM_WORLD_2:
-                        if (i == 0) {
-                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        } else if (i == 1) {
-                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_02);
-                        }
-                        break;
-                case HWSIM_REGTEST_STRICT_ALL:
-                        hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
-                        break;
-                case HWSIM_REGTEST_STRICT_FOLLOW:
-                case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
-                        if (i == 0)
-                                hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
-                        break;
-                case HWSIM_REGTEST_ALL:
-                        if (i == 0) {
-                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_01);
-                        } else if (i == 1) {
-                                hw->wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-                                wiphy_apply_custom_regulatory(hw->wiphy,
-                                        &hwsim_world_regdom_custom_02);
-                        } else if (i == 4)
-                                hw->wiphy->flags |= WIPHY_FLAG_STRICT_REGULATORY;
-                        break;
-                default:
-                        break;
-                }
-
-                /* give the regulatory workqueue a chance to run */
-                if (regtest)
-                        schedule_timeout_interruptible(1);
-                err = ieee80211_register_hw(hw);
-                if (err < 0) {
-                        printk(KERN_DEBUG "mac80211_hwsim: "
-                               "ieee80211_register_hw failed (%d)\n", err);
-                        goto failed_hw;
-                }
-
-                /* Work to be done after to ieee80211_register_hw() */
-                switch (regtest) {
-                case HWSIM_REGTEST_WORLD_ROAM:
-                case HWSIM_REGTEST_DISABLED:
+                        if (i < ARRAY_SIZE(hwsim_alpha2s))
+                                reg_alpha2 = hwsim_alpha2s[i];
                         break;
                 case HWSIM_REGTEST_DRIVER_REG_FOLLOW:
                         if (!i)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                                reg_alpha2 = hwsim_alpha2s[0];
                         break;
-                case HWSIM_REGTEST_DRIVER_REG_ALL:
                 case HWSIM_REGTEST_STRICT_ALL:
-                        regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                        reg_strict = true;
+                case HWSIM_REGTEST_DRIVER_REG_ALL:
+                        reg_alpha2 = hwsim_alpha2s[0];
                         break;
-                case HWSIM_REGTEST_DIFF_COUNTRY:
-                        if (i < ARRAY_SIZE(hwsim_alpha2s))
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[i]);
+                case HWSIM_REGTEST_WORLD_ROAM:
+                        if (i == 0)
+                                regd = &hwsim_world_regdom_custom_01;
                         break;
                 case HWSIM_REGTEST_CUSTOM_WORLD:
+                        regd = &hwsim_world_regdom_custom_01;
+                        break;
                 case HWSIM_REGTEST_CUSTOM_WORLD_2:
-                        /*
-                         * Nothing to be done for custom world regulatory
-                         * domains after to ieee80211_register_hw
-                         */
+                        if (i == 0)
+                                regd = &hwsim_world_regdom_custom_01;
+                        else if (i == 1)
+                                regd = &hwsim_world_regdom_custom_02;
                         break;
                 case HWSIM_REGTEST_STRICT_FOLLOW:
-                        if (i == 0)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
+                        if (i == 0) {
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[0];
+                        }
                         break;
                 case HWSIM_REGTEST_STRICT_AND_DRIVER_REG:
-                        if (i == 0)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
-                        else if (i == 1)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[1]);
+                        if (i == 0) {
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[0];
+                        } else if (i == 1) {
+                                reg_alpha2 = hwsim_alpha2s[1];
+                        }
                         break;
                 case HWSIM_REGTEST_ALL:
-                        if (i == 2)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[0]);
-                        else if (i == 3)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[1]);
-                        else if (i == 4)
-                                regulatory_hint(hw->wiphy, hwsim_alpha2s[2]);
+                        switch (i) {
+                        case 0:
+                                regd = &hwsim_world_regdom_custom_01;
+                                break;
+                        case 1:
+                                regd = &hwsim_world_regdom_custom_02;
+                                break;
+                        case 2:
+                                reg_alpha2 = hwsim_alpha2s[0];
+                                break;
+                        case 3:
+                                reg_alpha2 = hwsim_alpha2s[1];
+                                break;
+                        case 4:
+                                reg_strict = true;
+                                reg_alpha2 = hwsim_alpha2s[2];
+                                break;
+                        }
                         break;
                 default:
                         break;
                 }
 
-                wiphy_debug(hw->wiphy, "hwaddr %pm registered\n",
-                            hw->wiphy->perm_addr);
-
-                data->debugfs = debugfs_create_dir("hwsim",
-                                                   hw->wiphy->debugfsdir);
-                data->debugfs_ps = debugfs_create_file("ps", 0666,
-                                                       data->debugfs, data,
-                                                       &hwsim_fops_ps);
-                data->debugfs_group = debugfs_create_file("group", 0666,
-                                                        data->debugfs, data,
-                                                        &hwsim_fops_group);
-
-                tasklet_hrtimer_init(&data->beacon_timer,
-                                     mac80211_hwsim_beacon,
-                                     CLOCK_REALTIME, HRTIMER_MODE_ABS);
-
-                list_add_tail(&data->list, &hwsim_radios);
+                err = mac80211_hwsim_create_radio(channels, reg_alpha2,
+                                                  regd, reg_strict);
+                if (err < 0)
+                        goto out_free_radios;
         }
 
         hwsim_mon = alloc_netdev(0, "hwsim%d", hwsim_mon_setup);
         if (hwsim_mon == NULL) {
                 err = -ENOMEM;
-                goto failed;
+                goto out_free_radios;
         }
 
         rtnl_lock();
-
         err = dev_alloc_name(hwsim_mon, hwsim_mon->name);
-        if (err < 0)
-                goto failed_mon;
-
+        if (err < 0) {
+                rtnl_unlock();
+                goto out_free_radios;
+        }
 
         err = register_netdevice(hwsim_mon);
-        if (err < 0)
-                goto failed_mon;
-
+        if (err < 0) {
+                rtnl_unlock();
+                goto out_free_mon;
+        }
         rtnl_unlock();
 
         err = hwsim_init_netlink();
         if (err < 0)
-                goto failed_nl;
+                goto out_free_mon;
 
         return 0;
 
-failed_nl:
-        printk(KERN_DEBUG "mac_80211_hwsim: failed initializing netlink\n");
-        return err;
-
-failed_mon:
-        rtnl_unlock();
+out_free_mon:
         free_netdev(hwsim_mon);
+out_free_radios:
         mac80211_hwsim_free();
-        return err;
-
-failed_hw:
-        device_unregister(data->dev);
-failed_drvdata:
-        ieee80211_free_hw(hw);
-failed:
-        mac80211_hwsim_free();
-failed_unregister_driver:
+out_unregister_driver:
         platform_driver_unregister(&mac80211_hwsim_driver);
         return err;
 }
diff --git a/drivers/net/wireless/mac80211_hwsim.h b/drivers/net/wireless/mac80211_hwsim.h
index afaad5a443b6..2747cce5a269 100644
--- a/drivers/net/wireless/mac80211_hwsim.h
+++ b/drivers/net/wireless/mac80211_hwsim.h
@@ -65,6 +65,9 @@ enum hwsim_tx_control_flags {
  * kernel, uses:
  *      %HWSIM_ATTR_ADDR_TRANSMITTER, %HWSIM_ATTR_FLAGS,
  *      %HWSIM_ATTR_TX_INFO, %HWSIM_ATTR_SIGNAL, %HWSIM_ATTR_COOKIE
+ * @HWSIM_CMD_CREATE_RADIO: create a new radio with the given parameters,
+ *      returns the radio ID (>= 0) or negative on errors
+ * @HWSIM_CMD_DESTROY_RADIO: destroy a radio
  * @__HWSIM_CMD_MAX: enum limit
  */
 enum {
@@ -72,6 +75,8 @@ enum {
         HWSIM_CMD_REGISTER,
         HWSIM_CMD_FRAME,
         HWSIM_CMD_TX_INFO_FRAME,
+        HWSIM_CMD_CREATE_RADIO,
+        HWSIM_CMD_DESTROY_RADIO,
         __HWSIM_CMD_MAX,
 };
 #define HWSIM_CMD_MAX (_HWSIM_CMD_MAX - 1)
@@ -94,6 +99,14 @@ enum {
         space
  * @HWSIM_ATTR_TX_INFO: ieee80211_tx_rate array
  * @HWSIM_ATTR_COOKIE: sk_buff cookie to identify the frame
+ * @HWSIM_ATTR_CHANNELS: u32 attribute used with the %HWSIM_CMD_CREATE_RADIO
+ *      command giving the number of channels supported by the new radio
+ * @HWSIM_ATTR_RADIO_ID: u32 attribute used with %HWSIM_CMD_DESTROY_RADIO
+ *      only to destroy a radio
+ * @HWSIM_ATTR_REG_HINT_ALPHA2: alpha2 for regulatoro driver hint
+ *      (nla string, length 2)
+ * @HWSIM_ATTR_REG_CUSTOM_REG: custom regulatory domain index (u32 attribute)
+ * @HWSIM_ATTR_REG_STRICT_REG: request REGULATORY_STRICT_REG (flag attribute)
  * @__HWSIM_ATTR_MAX: enum limit
  */
 
@@ -108,6 +121,11 @@ enum {
         HWSIM_ATTR_SIGNAL,
         HWSIM_ATTR_TX_INFO,
         HWSIM_ATTR_COOKIE,
+        HWSIM_ATTR_CHANNELS,
+        HWSIM_ATTR_RADIO_ID,
+        HWSIM_ATTR_REG_HINT_ALPHA2,
+        HWSIM_ATTR_REG_CUSTOM_REG,
+        HWSIM_ATTR_REG_STRICT_REG,
         __HWSIM_ATTR_MAX,
 };
 #define HWSIM_ATTR_MAX (__HWSIM_ATTR_MAX - 1)
diff --git a/drivers/net/wireless/mwifiex/11n.c b/drivers/net/wireless/mwifiex/11n.c
index 0b803c05cab3..6261f8c53d44 100644
--- a/drivers/net/wireless/mwifiex/11n.c
+++ b/drivers/net/wireless/mwifiex/11n.c
@@ -483,7 +483,7 @@ mwifiex_get_ba_tbl(struct mwifiex_private *priv, int tid, u8 *ra)
 
         spin_lock_irqsave(&priv->tx_ba_stream_tbl_lock, flags);
         list_for_each_entry(tx_ba_tsr_tbl, &priv->tx_ba_stream_tbl_ptr, list) {
-                if (!memcmp(tx_ba_tsr_tbl->ra, ra, ETH_ALEN) &&
+                if (ether_addr_equal_unaligned(tx_ba_tsr_tbl->ra, ra) &&
                     tx_ba_tsr_tbl->tid == tid) {
                         spin_unlock_irqrestore(&priv->tx_ba_stream_tbl_lock,
                                                flags);
diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c
index 1214c587fd08..63211707f939 100644
--- a/drivers/net/wireless/mwifiex/11n_aggr.c
+++ b/drivers/net/wireless/mwifiex/11n_aggr.c
@@ -69,9 +69,9 @@ mwifiex_11n_form_amsdu_pkt(struct sk_buff *skb_aggr,
         memcpy(&tx_header->eth803_hdr, skb_src->data, dt_offset);
 
         /* Copy SNAP header */
-        snap.snap_type =
-                le16_to_cpu(*(__le16 *) ((u8 *)skb_src->data + dt_offset));
-        dt_offset += sizeof(u16);
+        snap.snap_type = ((struct ethhdr *)skb_src->data)->h_proto;
+
+        dt_offset += sizeof(__be16);
 
         memcpy(&tx_header->rfc1042_hdr, &snap, sizeof(struct rfc_1042_hdr));
 
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index f7ff4725506a..ecdf34505b54 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -31,12 +31,12 @@ config MWIFIEX_PCIE
           mwifiex_pcie.
 
 config MWIFIEX_USB
-        tristate "Marvell WiFi-Ex Driver for USB8797"
+        tristate "Marvell WiFi-Ex Driver for USB8797/8897"
         depends on MWIFIEX && USB
         select FW_LOADER
         ---help---
           This adds support for wireless adapters based on Marvell
-          Avastar 88W8797 chipset with USB interface.
+          8797/8897 chipset with USB interface.
 
           If you choose to build it as a module, it will be called
           mwifiex_usb.
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index aeaea0e3b4c4..8bfc07cd330e 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -50,24 +50,24 @@ static const struct ieee80211_regdomain mwifiex_world_regdom_custom = {
                 REG_RULE(2412-10, 2462+10, 40, 3, 20, 0),
                 /* Channel 12 - 13 */
                 REG_RULE(2467-10, 2472+10, 20, 3, 20,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS),
+                         NL80211_RRF_NO_IR),
                 /* Channel 14 */
                 REG_RULE(2484-10, 2484+10, 20, 3, 20,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS |
+                         NL80211_RRF_NO_IR |
                          NL80211_RRF_NO_OFDM),
                 /* Channel 36 - 48 */
                 REG_RULE(5180-10, 5240+10, 40, 3, 20,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS),
+                         NL80211_RRF_NO_IR),
                 /* Channel 149 - 165 */
                 REG_RULE(5745-10, 5825+10, 40, 3, 20,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS),
+                         NL80211_RRF_NO_IR),
                 /* Channel 52 - 64 */
                 REG_RULE(5260-10, 5320+10, 40, 3, 30,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS |
+                         NL80211_RRF_NO_IR |
                          NL80211_RRF_DFS),
                 /* Channel 100 - 140 */
                 REG_RULE(5500-10, 5700+10, 40, 3, 30,
-                         NL80211_RRF_PASSIVE_SCAN | NL80211_RRF_NO_IBSS |
+                         NL80211_RRF_NO_IR |
                          NL80211_RRF_DFS),
         }
 };
@@ -184,10 +184,10 @@ mwifiex_form_mgmt_frame(struct sk_buff *skb, const u8 *buf, size_t len)
  */
 static int
 mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
-                         struct ieee80211_channel *chan, bool offchan,
-                         unsigned int wait, const u8 *buf, size_t len,
-                         bool no_cck, bool dont_wait_for_ack, u64 *cookie)
+                         struct cfg80211_mgmt_tx_params *params, u64 *cookie)
 {
+        const u8 *buf = params->buf;
+        size_t len = params->len;
         struct sk_buff *skb;
         u16 pkt_len;
         const struct ieee80211_mgmt *mgmt;
@@ -222,6 +222,7 @@ mwifiex_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
         tx_info = MWIFIEX_SKB_TXCB(skb);
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
+        tx_info->pkt_len = pkt_len;
 
         mwifiex_form_mgmt_frame(skb, buf, len);
         mwifiex_queue_tx_pkt(priv, skb);
@@ -537,23 +538,33 @@ static void mwifiex_reg_notifier(struct wiphy *wiphy,
                                  struct regulatory_request *request)
 {
         struct mwifiex_adapter *adapter = mwifiex_cfg80211_get_adapter(wiphy);
+        struct mwifiex_private *priv = mwifiex_get_priv(adapter,
+                                                        MWIFIEX_BSS_ROLE_ANY);
 
         wiphy_dbg(wiphy, "info: cfg80211 regulatory domain callback for %c%c\n",
                   request->alpha2[0], request->alpha2[1]);
 
-        memcpy(adapter->country_code, request->alpha2, sizeof(request->alpha2));
-
         switch (request->initiator) {
         case NL80211_REGDOM_SET_BY_DRIVER:
         case NL80211_REGDOM_SET_BY_CORE:
         case NL80211_REGDOM_SET_BY_USER:
-                break;
-                /* Todo: apply driver specific changes in channel flags based
-                   on the request initiator if necessary. */
         case NL80211_REGDOM_SET_BY_COUNTRY_IE:
                 break;
+        default:
+                wiphy_err(wiphy, "unknown regdom initiator: %d\n",
+                          request->initiator);
+                return;
+        }
+
+        /* Don't send world or same regdom info to firmware */
+        if (strncmp(request->alpha2, "00", 2) &&
+            strncmp(request->alpha2, adapter->country_code,
+                    sizeof(request->alpha2))) {
+                memcpy(adapter->country_code, request->alpha2,
+                       sizeof(request->alpha2));
+                mwifiex_send_domain_info_cmd_fw(wiphy);
+                mwifiex_dnld_txpwr_table(priv);
         }
-        mwifiex_send_domain_info_cmd_fw(wiphy);
 }
 
 /*
@@ -1170,10 +1181,10 @@ static int mwifiex_cfg80211_set_bitrate_mask(struct wiphy *wiphy,
         else
                 bitmap_rates[1] = mask->control[band].legacy;
 
-        /* Fill MCS rates */
-        bitmap_rates[2] = mask->control[band].mcs[0];
+        /* Fill HT MCS rates */
+        bitmap_rates[2] = mask->control[band].ht_mcs[0];
         if (priv->adapter->hw_dev_mcs_support == HT_STREAM_2X2)
-                bitmap_rates[2] |= mask->control[band].mcs[1] << 8;
+                bitmap_rates[2] |= mask->control[band].ht_mcs[1] << 8;
 
         return mwifiex_send_cmd_sync(priv, HostCmd_CMD_TX_RATE_CFG,
                                      HostCmd_ACT_GEN_SET, 0, bitmap_rates);
@@ -1968,7 +1979,7 @@ mwifiex_cfg80211_scan(struct wiphy *wiphy,
                 user_scan_cfg->chan_list[i].chan_number = chan->hw_value;
                 user_scan_cfg->chan_list[i].radio_type = chan->band;
 
-                if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                if (chan->flags & IEEE80211_CHAN_NO_IR)
                         user_scan_cfg->chan_list[i].scan_type =
                                                 MWIFIEX_SCAN_TYPE_PASSIVE;
                 else
@@ -2438,7 +2449,7 @@ static int mwifiex_cfg80211_suspend(struct wiphy *wiphy,
                        ETH_ALEN);
                 mef_entry->filter[filt_num].byte_seq[MWIFIEX_MEF_MAX_BYTESEQ] =
                                                                 ETH_ALEN;
-                mef_entry->filter[filt_num].offset = 14;
+                mef_entry->filter[filt_num].offset = 28;
                 mef_entry->filter[filt_num].filt_type = TYPE_EQ;
                 if (filt_num)
                         mef_entry->filter[filt_num].filt_action = TYPE_OR;
@@ -2666,6 +2677,7 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         struct wiphy *wiphy;
         struct mwifiex_private *priv = adapter->priv[MWIFIEX_BSS_TYPE_STA];
         u8 *country_code;
+        u32 thr, retry;
 
         /* create a new wiphy for use with cfg80211 */
         wiphy = wiphy_new(&mwifiex_cfg80211_ops,
@@ -2702,9 +2714,10 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
         wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
                         WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD |
                         WIPHY_FLAG_AP_UAPSD |
-                        WIPHY_FLAG_CUSTOM_REGULATORY |
-                        WIPHY_FLAG_STRICT_REGULATORY |
                         WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL;
+        wiphy->regulatory_flags |=
+                        REGULATORY_CUSTOM_REG |
+                        REGULATORY_STRICT_REG;
 
         wiphy_apply_custom_regulatory(wiphy, &mwifiex_world_regdom_custom);
 
@@ -2754,6 +2767,19 @@ int mwifiex_register_cfg80211(struct mwifiex_adapter *adapter)
                                    country_code);
         }
 
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, FRAG_THRESH_I, &thr);
+        wiphy->frag_threshold = thr;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, RTS_THRESH_I, &thr);
+        wiphy->rts_threshold = thr;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, SHORT_RETRY_LIM_I, &retry);
+        wiphy->retry_short = (u8) retry;
+        mwifiex_send_cmd_sync(priv, HostCmd_CMD_802_11_SNMP_MIB,
+                              HostCmd_ACT_GEN_GET, LONG_RETRY_LIM_I, &retry);
+        wiphy->retry_long = (u8) retry;
+
         adapter->wiphy = wiphy;
         return ret;
 }
diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
index e47f4e3012b8..1ddc8b2e3722 100644
--- a/drivers/net/wireless/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/mwifiex/cmdevt.c
@@ -312,14 +312,14 @@ static int mwifiex_dnld_sleep_confirm_cmd(struct mwifiex_adapter *adapter)
         }
         if (GET_BSS_ROLE(mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY))
             == MWIFIEX_BSS_ROLE_STA) {
-                if (!sleep_cfm_buf->resp_ctrl)
+                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl))
                         /* Response is not needed for sleep
                            confirm command */
                         adapter->ps_state = PS_STATE_SLEEP;
                 else
                         adapter->ps_state = PS_STATE_SLEEP_CFM;
 
-                if (!sleep_cfm_buf->resp_ctrl &&
+                if (!le16_to_cpu(sleep_cfm_buf->resp_ctrl) &&
                     (adapter->is_hs_configured &&
                      !adapter->sleep_period.period)) {
                         adapter->pm_wakeup_card_req = true;
diff --git a/drivers/net/wireless/mwifiex/decl.h b/drivers/net/wireless/mwifiex/decl.h
index 5c85d7803d00..3a21bd03d6db 100644
--- a/drivers/net/wireless/mwifiex/decl.h
+++ b/drivers/net/wireless/mwifiex/decl.h
@@ -130,6 +130,7 @@ struct mwifiex_txinfo {
         u8 flags;
         u8 bss_num;
         u8 bss_type;
+        u32 pkt_len;
 };
 
 enum mwifiex_wmm_ac_e {
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index c8385ec77a86..5fa932d5f905 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -30,7 +30,7 @@ struct rfc_1042_hdr {
         u8 llc_ssap;
         u8 llc_ctrl;
         u8 snap_oui[3];
-        u16 snap_type;
+        __be16 snap_type;
 };
 
 struct rx_packet_hdr {
@@ -226,7 +226,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
 
 /* HW_SPEC fw_cap_info */
 
-#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(13)|BIT(14)))
+#define ISSUPP_11ACENABLED(fw_cap_info) (fw_cap_info & (BIT(12)|BIT(13)))
 
 #define GET_VHTCAP_CHWDSET(vht_cap_info)    ((vht_cap_info >> 2) & 0x3)
 #define GET_VHTNSSMCS(mcs_mapset, nss) ((mcs_mapset >> (2 * (nss - 1))) & 0x3)
@@ -468,8 +468,6 @@ enum P2P_MODES {
 #define MWIFIEX_CRITERIA_UNICAST        BIT(1)
 #define MWIFIEX_CRITERIA_MULTICAST      BIT(3)
 
-#define CFG_DATA_TYPE_CAL               2
-
 struct mwifiex_ie_types_header {
         __le16 type;
         __le16 len;
@@ -610,12 +608,12 @@ struct mwifiex_ie_types_tsf_timestamp {
 struct mwifiex_cf_param_set {
         u8 cfp_cnt;
         u8 cfp_period;
-        u16 cfp_max_duration;
-        u16 cfp_duration_remaining;
+        __le16 cfp_max_duration;
+        __le16 cfp_duration_remaining;
 } __packed;
 
 struct mwifiex_ibss_param_set {
-        u16 atim_window;
+        __le16 atim_window;
 } __packed;
 
 struct mwifiex_ie_types_ss_param_set {
@@ -627,7 +625,7 @@ struct mwifiex_ie_types_ss_param_set {
 } __packed;
 
 struct mwifiex_fh_param_set {
-        u16 dwell_time;
+        __le16 dwell_time;
         u8 hop_set;
         u8 hop_pattern;
         u8 hop_index;
@@ -684,10 +682,10 @@ struct host_cmd_ds_802_11_key_material {
 } __packed;
 
 struct host_cmd_ds_gen {
-        u16 command;
-        u16 size;
-        u16 seq_num;
-        u16 result;
+        __le16 command;
+        __le16 size;
+        __le16 seq_num;
+        __le16 result;
 };
 
 #define S_DS_GEN        sizeof(struct host_cmd_ds_gen)
@@ -820,8 +818,8 @@ struct ieee_types_cf_param_set {
         u8 len;
         u8 cfp_cnt;
         u8 cfp_period;
-        u16 cfp_max_duration;
-        u16 cfp_duration_remaining;
+        __le16 cfp_max_duration;
+        __le16 cfp_duration_remaining;
 } __packed;
 
 struct ieee_types_ibss_param_set {
@@ -957,7 +955,7 @@ struct mwifiex_hs_config_param {
 } __packed;
 
 struct hs_activate_param {
-        u16 resp_ctrl;
+        __le16 resp_ctrl;
 } __packed;
 
 struct host_cmd_ds_802_11_hs_cfg_enh {
@@ -1131,7 +1129,7 @@ struct host_cmd_ds_802_11_bg_scan_query {
 } __packed;
 
 struct host_cmd_ds_802_11_bg_scan_query_rsp {
-        u32 report_condition;
+        __le32 report_condition;
         struct host_cmd_ds_802_11_scan_rsp scan_resp;
 } __packed;
 
@@ -1230,7 +1228,7 @@ struct mwifiex_ie_types_wmm_queue_status {
         struct mwifiex_ie_types_header header;
         u8 queue_index;
         u8 disabled;
-        u16 medium_time;
+        __le16 medium_time;
         u8 flow_required;
         u8 flow_created;
         u32 reserved;
@@ -1310,7 +1308,7 @@ struct mwifiex_ie_types_vht_oper {
         u8 chan_center_freq_1;
         u8 chan_center_freq_2;
         /* Basic MCS set map, each 2 bits stands for a NSS */
-        u16 basic_mcs_map;
+        __le16 basic_mcs_map;
 } __packed;
 
 struct mwifiex_ie_types_wmmcap {
@@ -1592,12 +1590,6 @@ struct mwifiex_ie_list {
         struct mwifiex_ie ie_list[MAX_MGMT_IE_INDEX];
 } __packed;
 
-struct host_cmd_ds_802_11_cfg_data {
-        __le16 action;
-        __le16 type;
-        __le16 data_len;
-} __packed;
-
 struct coalesce_filt_field_param {
         u8 operation;
         u8 operand_len;
@@ -1678,7 +1670,6 @@ struct host_cmd_ds_command {
                 struct host_cmd_ds_sys_config uap_sys_config;
                 struct host_cmd_ds_sta_deauth sta_deauth;
                 struct host_cmd_11ac_vht_cfg vht_cfg;
-                struct host_cmd_ds_802_11_cfg_data cfg_data;
                 struct host_cmd_ds_coalesce_cfg coalesce_cfg;
         } params;
 } __packed;
diff --git a/drivers/net/wireless/mwifiex/init.c b/drivers/net/wireless/mwifiex/init.c
index 6499117fce43..1d0a817f2bf0 100644
--- a/drivers/net/wireless/mwifiex/init.c
+++ b/drivers/net/wireless/mwifiex/init.c
@@ -643,7 +643,8 @@ mwifiex_shutdown_drv(struct mwifiex_adapter *adapter)
                         if (priv)
                                 priv->stats.rx_dropped++;
 
-                        adapter->if_ops.data_complete(adapter, skb);
+                        dev_kfree_skb_any(skb);
+                        adapter->if_ops.data_complete(adapter);
                 }
         }
 
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 8bb8988c435c..4d79761b9c87 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -648,6 +648,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
         tx_info = MWIFIEX_SKB_TXCB(skb);
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
+        tx_info->pkt_len = skb->len;
 
         /* Record the current time the packet was queued; used to
          * determine the amount of time the packet was queued in
@@ -749,7 +750,7 @@ static u16
 mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
                                 void *accel_priv)
 {
-        skb->priority = cfg80211_classify8021d(skb);
+        skb->priority = cfg80211_classify8021d(skb, NULL);
         return mwifiex_1d_to_wmm_queue[skb->priority];
 }
 
@@ -992,12 +993,8 @@ int mwifiex_remove_card(struct mwifiex_adapter *adapter, struct semaphore *sem)
                 rtnl_unlock();
         }
 
-        priv = adapter->priv[0];
-        if (!priv || !priv->wdev)
-                goto exit_remove;
-
-        wiphy_unregister(priv->wdev->wiphy);
-        wiphy_free(priv->wdev->wiphy);
+        wiphy_unregister(adapter->wiphy);
+        wiphy_free(adapter->wiphy);
 
         mwifiex_terminate_workqueue(adapter);
 
diff --git a/drivers/net/wireless/mwifiex/main.h b/drivers/net/wireless/mwifiex/main.h
index 1d72f13adb9d..d8ad554ce39f 100644
--- a/drivers/net/wireless/mwifiex/main.h
+++ b/drivers/net/wireless/mwifiex/main.h
@@ -32,6 +32,7 @@
 #include <net/lib80211.h>
 #include <linux/firmware.h>
 #include <linux/ctype.h>
+#include <linux/of.h>
 
 #include "decl.h"
 #include "ioctl.h"
@@ -615,7 +616,7 @@ struct mwifiex_if_ops {
         void (*cleanup_mpa_buf) (struct mwifiex_adapter *);
         int (*cmdrsp_complete) (struct mwifiex_adapter *, struct sk_buff *);
         int (*event_complete) (struct mwifiex_adapter *, struct sk_buff *);
-        int (*data_complete) (struct mwifiex_adapter *, struct sk_buff *);
+        int (*data_complete) (struct mwifiex_adapter *);
         int (*init_fw_port) (struct mwifiex_adapter *);
         int (*dnld_fw) (struct mwifiex_adapter *, struct mwifiex_fw_image *);
         void (*card_reset) (struct mwifiex_adapter *);
@@ -739,6 +740,7 @@ struct mwifiex_adapter {
         u8 scan_delay_cnt;
         u8 empty_tx_q_cnt;
         const struct firmware *cal_data;
+        struct device_node *dt_node;
 
         /* 11AC */
         u32 is_hw_11ac_capable;
@@ -1151,6 +1153,9 @@ void mwifiex_uap_del_sta_data(struct mwifiex_private *priv,
 void mwifiex_11h_process_join(struct mwifiex_private *priv, u8 **buffer,
                               struct mwifiex_bssdescriptor *bss_desc);
 int mwifiex_11h_handle_event_chanswann(struct mwifiex_private *priv);
+int mwifiex_dnld_dt_cfgdata(struct mwifiex_private *priv,
+                            struct device_node *node, const char *prefix);
+void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv);
 
 extern const struct ethtool_ops mwifiex_ethtool_ops;
 
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 8cf7d50a7603..0a8a26e10f01 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -515,14 +515,14 @@ mwifiex_scan_create_channel_list(struct mwifiex_private *priv,
                                 scan_chan_list[chan_idx].max_scan_time =
                                         cpu_to_le16((u16) user_scan_in->
                                         chan_list[0].scan_time);
-                        else if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                        else if (ch->flags & IEEE80211_CHAN_NO_IR)
                                 scan_chan_list[chan_idx].max_scan_time =
                                         cpu_to_le16(adapter->passive_scan_time);
                         else
                                 scan_chan_list[chan_idx].max_scan_time =
                                         cpu_to_le16(adapter->active_scan_time);
 
-                        if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
+                        if (ch->flags & IEEE80211_CHAN_NO_IR)
                                 scan_chan_list[chan_idx].chan_scan_mode_bitmap
                                         |= MWIFIEX_PASSIVE_SCAN;
                         else
@@ -1681,7 +1681,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 const u8 *ie_buf;
                 size_t ie_len;
                 u16 channel = 0;
-                u64 fw_tsf = 0;
+                __le64 fw_tsf = 0;
                 u16 beacon_size = 0;
                 u32 curr_bcn_bytes;
                 u32 freq;
@@ -1815,7 +1815,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                               ie_buf, ie_len, rssi, GFP_KERNEL);
                                 bss_priv = (struct mwifiex_bss_priv *)bss->priv;
                                 bss_priv->band = band;
-                                bss_priv->fw_tsf = fw_tsf;
+                                bss_priv->fw_tsf = le64_to_cpu(fw_tsf);
                                 if (priv->media_connected &&
                                     !memcmp(bssid,
                                             priv->curr_bss_params.bss_descriptor
diff --git a/drivers/net/wireless/mwifiex/sta_cmd.c b/drivers/net/wireless/mwifiex/sta_cmd.c
index 2181ee283d82..9208a8816b80 100644
--- a/drivers/net/wireless/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/mwifiex/sta_cmd.c
@@ -354,7 +354,7 @@ mwifiex_cmd_802_11_hs_cfg(struct mwifiex_private *priv,
         }
         if (hs_activate) {
                 hs_cfg->action = cpu_to_le16(HS_ACTIVATE);
-                hs_cfg->params.hs_activate.resp_ctrl = RESP_NEEDED;
+                hs_cfg->params.hs_activate.resp_ctrl = cpu_to_le16(RESP_NEEDED);
         } else {
                 hs_cfg->action = cpu_to_le16(HS_CONFIGURE);
                 hs_cfg->params.hs_config.conditions = hscfg_param->conditions;
@@ -1156,30 +1156,62 @@ static u32 mwifiex_parse_cal_cfg(u8 *src, size_t len, u8 *dst)
         return d - dst;
 }
 
+int mwifiex_dnld_dt_cfgdata(struct mwifiex_private *priv,
+                            struct device_node *node, const char *prefix)
+{
+#ifdef CONFIG_OF
+        struct property *prop;
+        size_t len = strlen(prefix);
+        int ret;
+
+        /* look for all matching property names */
+        for_each_property_of_node(node, prop) {
+                if (len > strlen(prop->name) ||
+                    strncmp(prop->name, prefix, len))
+                        continue;
+
+                /* property header is 6 bytes, data must fit in cmd buffer */
+                if (prop && prop->value && prop->length > 6 &&
+                    prop->length <= MWIFIEX_SIZE_OF_CMD_BUFFER - S_DS_GEN) {
+                        ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_CFG_DATA,
+                                                    HostCmd_ACT_GEN_SET, 0,
+                                                    prop);
+                        if (ret)
+                                return ret;
+                }
+        }
+#endif
+        return 0;
+}
+
 /* This function prepares command of set_cfg_data. */
 static int mwifiex_cmd_cfg_data(struct mwifiex_private *priv,
-                                struct host_cmd_ds_command *cmd,
-                                u16 cmd_action)
+                                struct host_cmd_ds_command *cmd, void *data_buf)
 {
-        struct host_cmd_ds_802_11_cfg_data *cfg_data = &cmd->params.cfg_data;
         struct mwifiex_adapter *adapter = priv->adapter;
-        u32 len, cal_data_offset;
-        u8 *tmp_cmd = (u8 *)cmd;
+        struct property *prop = data_buf;
+        u32 len;
+        u8 *data = (u8 *)cmd + S_DS_GEN;
+        int ret;
 
-        cal_data_offset = S_DS_GEN + sizeof(*cfg_data);
-        if ((adapter->cal_data->data) && (adapter->cal_data->size > 0))
+        if (prop) {
+                len = prop->length;
+                ret = of_property_read_u8_array(adapter->dt_node, prop->name,
+                                                data, len);
+                if (ret)
+                        return ret;
+                dev_dbg(adapter->dev,
+                        "download cfg_data from device tree: %s\n", prop->name);
+        } else if (adapter->cal_data->data && adapter->cal_data->size > 0) {
                 len = mwifiex_parse_cal_cfg((u8 *)adapter->cal_data->data,
-                                            adapter->cal_data->size,
-                                            (u8 *)(tmp_cmd + cal_data_offset));
-        else
+                                            adapter->cal_data->size, data);
+                dev_dbg(adapter->dev, "download cfg_data from config file\n");
+        } else {
                 return -1;
-
-        cfg_data->action = cpu_to_le16(cmd_action);
-        cfg_data->type = cpu_to_le16(CFG_DATA_TYPE_CAL);
-        cfg_data->data_len = cpu_to_le16(len);
+        }
 
         cmd->command = cpu_to_le16(HostCmd_CMD_CFG_DATA);
-        cmd->size = cpu_to_le16(S_DS_GEN + sizeof(*cfg_data) + len);
+        cmd->size = cpu_to_le16(S_DS_GEN + len);
 
         return 0;
 }
@@ -1267,7 +1299,7 @@ int mwifiex_sta_prepare_cmd(struct mwifiex_private *priv, uint16_t cmd_no,
                 ret = mwifiex_cmd_get_hw_spec(priv, cmd_ptr);
                 break;
         case HostCmd_CMD_CFG_DATA:
-                ret = mwifiex_cmd_cfg_data(priv, cmd_ptr, cmd_action);
+                ret = mwifiex_cmd_cfg_data(priv, cmd_ptr, data_buf);
                 break;
         case HostCmd_CMD_MAC_CONTROL:
                 ret = mwifiex_cmd_mac_control(priv, cmd_ptr, cmd_action,
@@ -1527,7 +1559,19 @@ int mwifiex_sta_init_cmd(struct mwifiex_private *priv, u8 first_sta)
                 if (ret)
                         return -1;
 
-                /* Download calibration data to firmware */
+                /* Download calibration data to firmware.
+                 * The cal-data can be read from device tree and/or
+                 * a configuration file and downloaded to firmware.
+                 */
+                adapter->dt_node =
+                                of_find_node_by_name(NULL, "marvell_cfgdata");
+                if (adapter->dt_node) {
+                        ret = mwifiex_dnld_dt_cfgdata(priv, adapter->dt_node,
+                                                      "marvell,caldata");
+                        if (ret)
+                                return -1;
+                }
+
                 if (adapter->cal_data) {
                         ret = mwifiex_send_cmd_sync(priv, HostCmd_CMD_CFG_DATA,
                                                 HostCmd_ACT_GEN_SET, 0, NULL);
diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
index 2675ca7f8d14..24523e4015cb 100644
--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
@@ -338,8 +338,7 @@ static int mwifiex_get_power_level(struct mwifiex_private *priv, void *data_buf)
         if (!data_buf)
                 return -1;
 
-        pg_tlv_hdr = (struct mwifiex_types_power_group *)
-                ((u8 *) data_buf + sizeof(struct host_cmd_ds_txpwr_cfg));
+        pg_tlv_hdr = (struct mwifiex_types_power_group *)((u8 *)data_buf);
         pg = (struct mwifiex_power_group *)
                 ((u8 *) pg_tlv_hdr + sizeof(struct mwifiex_types_power_group));
         length = le16_to_cpu(pg_tlv_hdr->length);
@@ -383,19 +382,25 @@ static int mwifiex_ret_tx_power_cfg(struct mwifiex_private *priv,
         struct mwifiex_types_power_group *pg_tlv_hdr;
         struct mwifiex_power_group *pg;
         u16 action = le16_to_cpu(txp_cfg->action);
+        u16 tlv_buf_left;
 
-        switch (action) {
-        case HostCmd_ACT_GEN_GET:
-                pg_tlv_hdr = (struct mwifiex_types_power_group *)
-                        ((u8 *) txp_cfg +
-                         sizeof(struct host_cmd_ds_txpwr_cfg));
+        pg_tlv_hdr = (struct mwifiex_types_power_group *)
+                ((u8 *)txp_cfg +
+                 sizeof(struct host_cmd_ds_txpwr_cfg));
 
-                pg = (struct mwifiex_power_group *)
-                        ((u8 *) pg_tlv_hdr +
-                         sizeof(struct mwifiex_types_power_group));
+        pg = (struct mwifiex_power_group *)
+                ((u8 *)pg_tlv_hdr +
+                 sizeof(struct mwifiex_types_power_group));
 
+        tlv_buf_left = le16_to_cpu(resp->size) - S_DS_GEN - sizeof(*txp_cfg);
+        if (tlv_buf_left <
+                        le16_to_cpu(pg_tlv_hdr->length) + sizeof(*pg_tlv_hdr))
+                return 0;
+
+        switch (action) {
+        case HostCmd_ACT_GEN_GET:
                 if (adapter->hw_status == MWIFIEX_HW_STATUS_INITIALIZING)
-                        mwifiex_get_power_level(priv, txp_cfg);
+                        mwifiex_get_power_level(priv, pg_tlv_hdr);
 
                 priv->tx_power_level = (u16) pg->power_min;
                 break;
@@ -404,14 +409,6 @@ static int mwifiex_ret_tx_power_cfg(struct mwifiex_private *priv,
                 if (!le32_to_cpu(txp_cfg->mode))
                         break;
 
-                pg_tlv_hdr = (struct mwifiex_types_power_group *)
-                        ((u8 *) txp_cfg +
-                         sizeof(struct host_cmd_ds_txpwr_cfg));
-
-                pg = (struct mwifiex_power_group *)
-                        ((u8 *) pg_tlv_hdr +
-                         sizeof(struct mwifiex_types_power_group));
-
                 if (pg->power_max == pg->power_min)
                         priv->tx_power_level = (u16) pg->power_min;
                 break;
@@ -785,8 +782,7 @@ static int mwifiex_ret_ibss_coalescing_status(struct mwifiex_private *priv,
         }
 
         /* If BSSID is diff, modify current BSS parameters */
-        if (memcmp(priv->curr_bss_params.bss_descriptor.mac_address,
-                   ibss_coal_resp->bssid, ETH_ALEN)) {
+        if (!ether_addr_equal(priv->curr_bss_params.bss_descriptor.mac_address, ibss_coal_resp->bssid)) {
                 /* BSSID */
                 memcpy(priv->curr_bss_params.bss_descriptor.mac_address,
                        ibss_coal_resp->bssid, ETH_ALEN);
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index a09398fe9e2a..c5cb2ed19ec2 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -184,6 +184,16 @@ int mwifiex_fill_new_bss_desc(struct mwifiex_private *priv,
         return mwifiex_update_bss_desc_with_ie(priv->adapter, bss_desc);
 }
 
+void mwifiex_dnld_txpwr_table(struct mwifiex_private *priv)
+{
+        if (priv->adapter->dt_node) {
+                char txpwr[] = {"marvell,00_txpwrlimit"};
+
+                memcpy(&txpwr[8], priv->adapter->country_code, 2);
+                mwifiex_dnld_dt_cfgdata(priv, priv->adapter->dt_node, txpwr);
+        }
+}
+
 static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                                       struct cfg80211_bss *bss)
 {
@@ -205,6 +215,14 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                 return 0;
         }
 
+        if (!strncmp(priv->adapter->country_code, &country_ie[2], 2)) {
+                rcu_read_unlock();
+                wiphy_dbg(priv->wdev->wiphy,
+                          "11D: skip setting domain info in FW\n");
+                return 0;
+        }
+        memcpy(priv->adapter->country_code, &country_ie[2], 2);
+
         domain_info->country_code[0] = country_ie[2];
         domain_info->country_code[1] = country_ie[3];
         domain_info->country_code[2] = ' ';
@@ -226,6 +244,8 @@ static int mwifiex_process_country_ie(struct mwifiex_private *priv,
                 return -1;
         }
 
+        mwifiex_dnld_txpwr_table(priv);
+
         return 0;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sta_rx.c b/drivers/net/wireless/mwifiex/sta_rx.c
index bb22664923ef..4651d676df38 100644
--- a/drivers/net/wireless/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/mwifiex/sta_rx.c
@@ -36,12 +36,12 @@ mwifiex_discard_gratuitous_arp(struct mwifiex_private *priv,
                                struct sk_buff *skb)
 {
         const struct mwifiex_arp_eth_header *arp;
-        struct ethhdr *eth_hdr;
+        struct ethhdr *eth;
         struct ipv6hdr *ipv6;
         struct icmp6hdr *icmpv6;
 
-        eth_hdr = (struct ethhdr *)skb->data;
-        switch (ntohs(eth_hdr->h_proto)) {
+        eth = (struct ethhdr *)skb->data;
+        switch (ntohs(eth->h_proto)) {
         case ETH_P_ARP:
                 arp = (void *)(skb->data + sizeof(struct ethhdr));
                 if (arp->hdr.ar_op == htons(ARPOP_REPLY) ||
@@ -87,16 +87,19 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
         struct rx_packet_hdr *rx_pkt_hdr;
         struct rxpd *local_rx_pd;
         int hdr_chop;
-        struct ethhdr *eth_hdr;
-        u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+        struct ethhdr *eth;
 
         local_rx_pd = (struct rxpd *) (skb->data);
 
         rx_pkt_hdr = (void *)local_rx_pd +
                      le16_to_cpu(local_rx_pd->rx_pkt_offset);
 
-        if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
-                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
+        if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+                     sizeof(bridge_tunnel_header))) ||
+            (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+                     sizeof(rfc1042_header)) &&
+             ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&
+             ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) {
                 /*
                  *  Replace the 803 header and rfc1042 header (llc/snap) with an
                  *    EthernetII header, keep the src/dst and snap_type
@@ -106,7 +109,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
                  *  To create the Ethernet II, just move the src, dst address
                  *    right before the snap_type.
                  */
-                eth_hdr = (struct ethhdr *)
+                eth = (struct ethhdr *)
                         ((u8 *) &rx_pkt_hdr->eth803_hdr
                          + sizeof(rx_pkt_hdr->eth803_hdr) +
                          sizeof(rx_pkt_hdr->rfc1042_hdr)
@@ -114,14 +117,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
                          - sizeof(rx_pkt_hdr->eth803_hdr.h_source)
                          - sizeof(rx_pkt_hdr->rfc1042_hdr.snap_type));
 
-                memcpy(eth_hdr->h_source, rx_pkt_hdr->eth803_hdr.h_source,
-                       sizeof(eth_hdr->h_source));
-                memcpy(eth_hdr->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
-                       sizeof(eth_hdr->h_dest));
+                memcpy(eth->h_source, rx_pkt_hdr->eth803_hdr.h_source,
+                       sizeof(eth->h_source));
+                memcpy(eth->h_dest, rx_pkt_hdr->eth803_hdr.h_dest,
+                       sizeof(eth->h_dest));
 
                 /* Chop off the rxpd + the excess memory from the 802.2/llc/snap
                    header that was removed. */
-                hdr_chop = (u8 *) eth_hdr - (u8 *) local_rx_pd;
+                hdr_chop = (u8 *) eth - (u8 *) local_rx_pd;
         } else {
                 /* Chop off the rxpd */
                 hdr_chop = (u8 *) &rx_pkt_hdr->eth803_hdr -
@@ -185,12 +188,7 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
                         "wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
                         skb->len, rx_pkt_offset, rx_pkt_length);
                 priv->stats.rx_dropped++;
-
-                if (adapter->if_ops.data_complete)
-                        adapter->if_ops.data_complete(adapter, skb);
-                else
-                        dev_kfree_skb_any(skb);
-
+                dev_kfree_skb_any(skb);
                 return ret;
         }
 
@@ -226,7 +224,7 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
          * directly to os. Don't pass thru rx reordering
          */
         if (!IS_11N_ENABLED(priv) ||
-            memcmp(priv->curr_addr, rx_pkt_hdr->eth803_hdr.h_dest, ETH_ALEN)) {
+            !ether_addr_equal_unaligned(priv->curr_addr, rx_pkt_hdr->eth803_hdr.h_dest)) {
                 mwifiex_process_rx_packet(priv, skb);
                 return ret;
         }
@@ -244,12 +242,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
         ret = mwifiex_11n_rx_reorder_pkt(priv, seq_num, local_rx_pd->priority,
                                          ta, (u8) rx_pkt_type, skb);
 
-        if (ret || (rx_pkt_type == PKT_TYPE_BAR)) {
-                if (adapter->if_ops.data_complete)
-                        adapter->if_ops.data_complete(adapter, skb);
-                else
-                        dev_kfree_skb_any(skb);
-        }
+        if (ret || (rx_pkt_type == PKT_TYPE_BAR))
+                dev_kfree_skb_any(skb);
 
         if (ret)
                 priv->stats.rx_dropped++;
diff --git a/drivers/net/wireless/mwifiex/sta_tx.c b/drivers/net/wireless/mwifiex/sta_tx.c
index 7b581af24f5f..354d64c9606f 100644
--- a/drivers/net/wireless/mwifiex/sta_tx.c
+++ b/drivers/net/wireless/mwifiex/sta_tx.c
@@ -148,6 +148,7 @@ int mwifiex_send_null_packet(struct mwifiex_private *priv, u8 flags)
         tx_info = MWIFIEX_SKB_TXCB(skb);
         tx_info->bss_num = priv->bss_num;
         tx_info->bss_type = priv->bss_type;
+        tx_info->pkt_len = data_len - (sizeof(struct txpd) + INTF_HEADER_LEN);
         skb_reserve(skb, sizeof(struct txpd) + INTF_HEADER_LEN);
         skb_push(skb, sizeof(struct txpd));
 
diff --git a/drivers/net/wireless/mwifiex/txrx.c b/drivers/net/wireless/mwifiex/txrx.c
index 8f923d0d2ba6..37f26afd4314 100644
--- a/drivers/net/wireless/mwifiex/txrx.c
+++ b/drivers/net/wireless/mwifiex/txrx.c
@@ -40,6 +40,7 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
                 mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY);
         struct rxpd *local_rx_pd;
         struct mwifiex_rxinfo *rx_info = MWIFIEX_SKB_RXCB(skb);
+        int ret;
 
         local_rx_pd = (struct rxpd *) (skb->data);
         /* Get the BSS number from rxpd, get corresponding priv */
@@ -58,9 +59,15 @@ int mwifiex_handle_rx_packet(struct mwifiex_adapter *adapter,
         rx_info->bss_type = priv->bss_type;
 
         if (priv->bss_role == MWIFIEX_BSS_ROLE_UAP)
-                return mwifiex_process_uap_rx_packet(priv, skb);
+                ret = mwifiex_process_uap_rx_packet(priv, skb);
+        else
+                ret = mwifiex_process_sta_rx_packet(priv, skb);
+
+        /* Decrement RX pending counter for each packet */
+        if (adapter->if_ops.data_complete)
+                adapter->if_ops.data_complete(adapter);
 
-        return mwifiex_process_sta_rx_packet(priv, skb);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(mwifiex_handle_rx_packet);
 
@@ -105,7 +112,7 @@ int mwifiex_process_tx(struct mwifiex_private *priv, struct sk_buff *skb,
 
         switch (ret) {
         case -ENOSR:
-                dev_err(adapter->dev, "data: -ENOSR is returned\n");
+                dev_dbg(adapter->dev, "data: -ENOSR is returned\n");
                 break;
         case -EBUSY:
                 if ((GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) &&
@@ -168,7 +175,7 @@ int mwifiex_write_data_complete(struct mwifiex_adapter *adapter,
         mwifiex_set_trans_start(priv->netdev);
         if (!status) {
                 priv->stats.tx_packets++;
-                priv->stats.tx_bytes += skb->len;
+                priv->stats.tx_bytes += tx_info->pkt_len;
                 if (priv->tx_timeout_cnt)
                         priv->tx_timeout_cnt = 0;
         } else {
diff --git a/drivers/net/wireless/mwifiex/uap_txrx.c b/drivers/net/wireless/mwifiex/uap_txrx.c
index 92f76d655e6c..3c74eb254927 100644
--- a/drivers/net/wireless/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/mwifiex/uap_txrx.c
@@ -98,7 +98,6 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
         int hdr_chop;
         struct timeval tv;
         struct ethhdr *p_ethhdr;
-        u8 rfc1042_eth_hdr[ETH_ALEN] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
 
         uap_rx_pd = (struct uap_rxpd *)(skb->data);
         rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset);
@@ -112,8 +111,12 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
                 return;
         }
 
-        if (!memcmp(&rx_pkt_hdr->rfc1042_hdr,
-                    rfc1042_eth_hdr, sizeof(rfc1042_eth_hdr))) {
+        if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
+                     sizeof(bridge_tunnel_header))) ||
+            (!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
+                     sizeof(rfc1042_header)) &&
+             ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_AARP &&
+             ntohs(rx_pkt_hdr->rfc1042_hdr.snap_type) != ETH_P_IPX)) {
                 /* Replace the 803 header and rfc1042 header (llc/snap) with
                  * an Ethernet II header, keep the src/dst and snap_type
                  * (ethertype).
@@ -144,7 +147,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
                 hdr_chop = (u8 *)&rx_pkt_hdr->eth803_hdr - (u8 *)uap_rx_pd;
         }
 
-        /* Chop off the leading header bytes so the it points
+        /* Chop off the leading header bytes so that it points
          * to the start of either the reconstructed EthII frame
          * or the 802.2/llc/snap frame.
          */
@@ -176,6 +179,19 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
         tx_info->bss_type = priv->bss_type;
         tx_info->flags |= MWIFIEX_BUF_FLAG_BRIDGED_PKT;
 
+        if (is_unicast_ether_addr(rx_pkt_hdr->eth803_hdr.h_dest)) {
+                /* Update bridge packet statistics as the
+                 * packet is not going to kernel/upper layer.
+                 */
+                priv->stats.rx_bytes += skb->len;
+                priv->stats.rx_packets++;
+
+                /* Sending bridge packet to TX queue, so save the packet
+                 * length in TXCB to update statistics in TX complete.
+                 */
+                tx_info->pkt_len = skb->len;
+        }
+
         do_gettimeofday(&tv);
         skb->tstamp = timeval_to_ktime(tv);
         mwifiex_wmm_add_buf_txqueue(priv, skb);
@@ -264,12 +280,7 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
                         skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset),
                         le16_to_cpu(uap_rx_pd->rx_pkt_length));
                 priv->stats.rx_dropped++;
-
-                if (adapter->if_ops.data_complete)
-                        adapter->if_ops.data_complete(adapter, skb);
-                else
-                        dev_kfree_skb_any(skb);
-
+                dev_kfree_skb_any(skb);
                 return 0;
         }
 
@@ -323,12 +334,8 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
                                          uap_rx_pd->priority, ta, pkt_type,
                                          skb);
 
-        if (ret || (rx_pkt_type == PKT_TYPE_BAR)) {
-                if (adapter->if_ops.data_complete)
-                        adapter->if_ops.data_complete(adapter, skb);
-                else
-                        dev_kfree_skb_any(skb);
-        }
+        if (ret || (rx_pkt_type == PKT_TYPE_BAR))
+                dev_kfree_skb_any(skb);
 
         if (ret)
                 priv->stats.rx_dropped++;
diff --git a/drivers/net/wireless/mwifiex/usb.c b/drivers/net/wireless/mwifiex/usb.c
index edf5b7a24900..e8ebbd4bc3cd 100644
--- a/drivers/net/wireless/mwifiex/usb.c
+++ b/drivers/net/wireless/mwifiex/usb.c
@@ -22,15 +22,21 @@
 
 #define USB_VERSION     "1.0"
 
-static const char usbdriver_name[] = "usb8797";
+static const char usbdriver_name[] = "usb8xxx";
 
 static struct mwifiex_if_ops usb_ops;
 static struct semaphore add_remove_card_sem;
 static struct usb_card_rec *usb_card;
 
 static struct usb_device_id mwifiex_usb_table[] = {
-        {USB_DEVICE(USB8797_VID, USB8797_PID_1)},
-        {USB_DEVICE_AND_INTERFACE_INFO(USB8797_VID, USB8797_PID_2,
+        /* 8797 */
+        {USB_DEVICE(USB8XXX_VID, USB8797_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8797_PID_2,
+                                       USB_CLASS_VENDOR_SPEC,
+                                       USB_SUBCLASS_VENDOR_SPEC, 0xff)},
+        /* 8897 */
+        {USB_DEVICE(USB8XXX_VID, USB8897_PID_1)},
+        {USB_DEVICE_AND_INTERFACE_INFO(USB8XXX_VID, USB8897_PID_2,
                                        USB_CLASS_VENDOR_SPEC,
                                        USB_SUBCLASS_VENDOR_SPEC, 0xff)},
         { }     /* Terminating entry */
@@ -343,10 +349,20 @@ static int mwifiex_usb_probe(struct usb_interface *intf,
                  id_vendor, id_product, bcd_device);
 
         /* PID_1 is used for firmware downloading only */
-        if (id_product == USB8797_PID_1)
-                card->usb_boot_state = USB8797_FW_DNLD;
-        else
-                card->usb_boot_state = USB8797_FW_READY;
+        switch (id_product) {
+        case USB8797_PID_1:
+        case USB8897_PID_1:
+                card->usb_boot_state = USB8XXX_FW_DNLD;
+                break;
+        case USB8797_PID_2:
+        case USB8897_PID_2:
+                card->usb_boot_state = USB8XXX_FW_READY;
+                break;
+        default:
+                pr_warning("unknown id_product %#x\n", id_product);
+                card->usb_boot_state = USB8XXX_FW_DNLD;
+                break;
+        }
 
         card->udev = udev;
         card->intf = intf;
@@ -755,9 +771,20 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
 
         card->adapter = adapter;
         adapter->dev = &card->udev->dev;
-        strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
         usb_card = card;
 
+        switch (le16_to_cpu(card->udev->descriptor.idProduct)) {
+        case USB8897_PID_1:
+        case USB8897_PID_2:
+                strcpy(adapter->fw_name, USB8897_DEFAULT_FW_NAME);
+                break;
+        case USB8797_PID_1:
+        case USB8797_PID_2:
+        default:
+                strcpy(adapter->fw_name, USB8797_DEFAULT_FW_NAME);
+                break;
+        }
+
         return 0;
 }
 
@@ -773,7 +800,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
 {
         int ret = 0;
         u8 *firmware = fw->fw_buf, *recv_buff;
-        u32 retries = USB8797_FW_MAX_RETRY, dlen;
+        u32 retries = USB8XXX_FW_MAX_RETRY, dlen;
         u32 fw_seqnum = 0, tlen = 0, dnld_cmd = 0;
         struct fw_data *fwdata;
         struct fw_sync_header sync_fw;
@@ -875,7 +902,7 @@ static int mwifiex_prog_fw_w_helper(struct mwifiex_adapter *adapter,
                                 continue;
                         }
 
-                        retries = USB8797_FW_MAX_RETRY;
+                        retries = USB8XXX_FW_MAX_RETRY;
                         break;
                 }
                 fw_seqnum++;
@@ -899,13 +926,13 @@ static int mwifiex_usb_dnld_fw(struct mwifiex_adapter *adapter,
         int ret;
         struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
 
-        if (card->usb_boot_state == USB8797_FW_DNLD) {
+        if (card->usb_boot_state == USB8XXX_FW_DNLD) {
                 ret = mwifiex_prog_fw_w_helper(adapter, fw);
                 if (ret)
                         return -1;
 
                 /* Boot state changes after successful firmware download */
-                if (card->usb_boot_state == USB8797_FW_DNLD)
+                if (card->usb_boot_state == USB8XXX_FW_DNLD)
                         return -1;
         }
 
@@ -938,11 +965,9 @@ static int mwifiex_usb_cmd_event_complete(struct mwifiex_adapter *adapter,
         return 0;
 }
 
-static int mwifiex_usb_data_complete(struct mwifiex_adapter *adapter,
-                                     struct sk_buff *skb)
+static int mwifiex_usb_data_complete(struct mwifiex_adapter *adapter)
 {
         atomic_dec(&adapter->rx_pending);
-        dev_kfree_skb_any(skb);
 
         return 0;
 }
@@ -1041,4 +1066,5 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell WiFi-Ex USB Driver version" USB_VERSION);
 MODULE_VERSION(USB_VERSION);
 MODULE_LICENSE("GPL v2");
-MODULE_FIRMWARE("mrvl/usb8797_uapsta.bin");
+MODULE_FIRMWARE(USB8797_DEFAULT_FW_NAME);
+MODULE_FIRMWARE(USB8897_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/usb.h b/drivers/net/wireless/mwifiex/usb.h
index 98c4316cd1a9..15b73d12e998 100644
--- a/drivers/net/wireless/mwifiex/usb.h
+++ b/drivers/net/wireless/mwifiex/usb.h
@@ -22,19 +22,23 @@
 
 #include <linux/usb.h>
 
-#define USB8797_VID             0x1286
+#define USB8XXX_VID             0x1286
+
 #define USB8797_PID_1           0x2043
 #define USB8797_PID_2           0x2044
+#define USB8897_PID_1           0x2045
+#define USB8897_PID_2           0x2046
 
-#define USB8797_FW_DNLD         1
-#define USB8797_FW_READY        2
-#define USB8797_FW_MAX_RETRY    3
+#define USB8XXX_FW_DNLD         1
+#define USB8XXX_FW_READY        2
+#define USB8XXX_FW_MAX_RETRY    3
 
 #define MWIFIEX_TX_DATA_URB     6
 #define MWIFIEX_RX_DATA_URB     6
 #define MWIFIEX_USB_TIMEOUT     100
 
 #define USB8797_DEFAULT_FW_NAME "mrvl/usb8797_uapsta.bin"
+#define USB8897_DEFAULT_FW_NAME "mrvl/usb8897_uapsta.bin"
 
 #define FW_DNLD_TX_BUF_SIZE     620
 #define FW_DNLD_RX_BUF_SIZE     2048
diff --git a/drivers/net/wireless/mwifiex/util.c b/drivers/net/wireless/mwifiex/util.c
index 5d9e150f4111..9b82e225880c 100644
--- a/drivers/net/wireless/mwifiex/util.c
+++ b/drivers/net/wireless/mwifiex/util.c
@@ -191,6 +191,9 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
         if (!skb)
                 return -1;
 
+        priv->stats.rx_bytes += skb->len;
+        priv->stats.rx_packets++;
+
         skb->dev = priv->netdev;
         skb->protocol = eth_type_trans(skb, priv->netdev);
         skb->ip_summed = CHECKSUM_NONE;
@@ -217,8 +220,6 @@ int mwifiex_recv_packet(struct mwifiex_private *priv, struct sk_buff *skb)
             (skb->truesize > MWIFIEX_RX_DATA_BUF_SIZE))
                 skb->truesize += (skb->len - MWIFIEX_RX_DATA_BUF_SIZE);
 
-        priv->stats.rx_bytes += skb->len;
-        priv->stats.rx_packets++;
         if (in_interrupt())
                 netif_rx(skb);
         else
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index b953ad621e0b..4987c3f942ce 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -9,7 +9,6 @@
  * warranty of any kind, whether express or implied.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
@@ -1258,7 +1257,7 @@ mwl8k_capture_bssid(struct mwl8k_priv *priv, struct ieee80211_hdr *wh)
 {
         return priv->capture_beacon &&
                 ieee80211_is_beacon(wh->frame_control) &&
-                ether_addr_equal(wh->addr3, priv->capture_bssid);
+                ether_addr_equal_64bits(wh->addr3, priv->capture_bssid);
 }
 
 static inline void mwl8k_save_beacon(struct ieee80211_hw *hw,
@@ -5893,8 +5892,6 @@ static int mwl8k_firmware_load_success(struct mwl8k_priv *priv)
 
         hw->extra_tx_headroom -= priv->ap_fw ? REDUCED_TX_HEADROOM : 0;
 
-        hw->channel_change_time = 10;
-
         hw->queues = MWL8K_TX_WMM_QUEUES;
 
         /* Set rssi values to dBm */
diff --git a/drivers/net/wireless/orinoco/hermes.c b/drivers/net/wireless/orinoco/hermes.c
index 75c15bc7b34c..43790fbea0e0 100644
--- a/drivers/net/wireless/orinoco/hermes.c
+++ b/drivers/net/wireless/orinoco/hermes.c
@@ -40,7 +40,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 
 #include "hermes.h"
diff --git a/drivers/net/wireless/orinoco/orinoco_cs.c b/drivers/net/wireless/orinoco/orinoco_cs.c
index d21d95939316..c0a27377d9e2 100644
--- a/drivers/net/wireless/orinoco/orinoco_cs.c
+++ b/drivers/net/wireless/orinoco/orinoco_cs.c
@@ -15,7 +15,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
diff --git a/drivers/net/wireless/orinoco/orinoco_usb.c b/drivers/net/wireless/orinoco/orinoco_usb.c
index bdfe637953f4..f9805c9353d2 100644
--- a/drivers/net/wireless/orinoco/orinoco_usb.c
+++ b/drivers/net/wireless/orinoco/orinoco_usb.c
@@ -52,7 +52,6 @@
 #include <linux/signal.h>
 #include <linux/errno.h>
 #include <linux/poll.h>
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/fcntl.h>
 #include <linux/spinlock.h>
diff --git a/drivers/net/wireless/orinoco/spectrum_cs.c b/drivers/net/wireless/orinoco/spectrum_cs.c
index e2264bc12ebf..b60048c95e0a 100644
--- a/drivers/net/wireless/orinoco/spectrum_cs.c
+++ b/drivers/net/wireless/orinoco/spectrum_cs.c
@@ -23,7 +23,6 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/delay.h>
 #include <pcmcia/cistpl.h>
 #include <pcmcia/cisreg.h>
diff --git a/drivers/net/wireless/p54/eeprom.c b/drivers/net/wireless/p54/eeprom.c
index d43e3740e45d..0fe67d2da208 100644
--- a/drivers/net/wireless/p54/eeprom.c
+++ b/drivers/net/wireless/p54/eeprom.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <linux/sort.h>
diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c
index b3879fbf5368..bc065e8e348b 100644
--- a/drivers/net/wireless/p54/fwio.c
+++ b/drivers/net/wireless/p54/fwio.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
diff --git a/drivers/net/wireless/p54/led.c b/drivers/net/wireless/p54/led.c
index 3837e1eec5f4..1f6fd5ff5531 100644
--- a/drivers/net/wireless/p54/led.c
+++ b/drivers/net/wireless/p54/led.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 067e6f2fd050..eede90b63f84 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
@@ -757,7 +756,6 @@ struct ieee80211_hw *p54_init_common(size_t priv_data_len)
                                       BIT(NL80211_IFTYPE_AP) |
                                       BIT(NL80211_IFTYPE_MESH_POINT);
 
-        dev->channel_change_time = 1000;        /* TODO: find actual value */
         priv->beacon_req_id = cpu_to_le32(0);
         priv->tx_stats[P54_QUEUE_BEACON].limit = 1;
         priv->tx_stats[P54_QUEUE_FWSCAN].limit = 1;
diff --git a/drivers/net/wireless/p54/net2280.h b/drivers/net/wireless/p54/net2280.h
index e3ed893b5aaf..aedfaf24f386 100644
--- a/drivers/net/wireless/p54/net2280.h
+++ b/drivers/net/wireless/p54/net2280.h
@@ -20,8 +20,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index f9a07b0d83ac..d411de409050 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -13,7 +13,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
 #include <linux/firmware.h>
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index e328d3058c41..6e635cfa24c8 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -12,7 +12,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index f95de0d16216..153c61539ec8 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -17,7 +17,6 @@
  */
 
 #include <linux/export.h>
-#include <linux/init.h>
 #include <linux/firmware.h>
 #include <linux/etherdevice.h>
 #include <asm/div64.h>
@@ -308,7 +307,7 @@ static void p54_pspoll_workaround(struct p54_common *priv, struct sk_buff *skb)
                 return;
 
         /* only consider beacons from the associated BSSID */
-        if (!ether_addr_equal(hdr->addr3, priv->bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, priv->bssid))
                 return;
 
         tim = p54_find_ie(skb, WLAN_EID_TIM);
@@ -587,7 +586,7 @@ static void p54_rx_stats(struct p54_common *priv, struct sk_buff *skb)
         chan = priv->curchan;
         if (chan) {
                 struct survey_info *survey = &priv->survey[chan->hw_value];
-                survey->noise = clamp_t(s8, priv->noise, -128, 127);
+                survey->noise = clamp(priv->noise, -128, 127);
                 survey->channel_time = priv->survey_raw.active;
                 survey->channel_time_tx = priv->survey_raw.tx;
                 survey->channel_time_busy = priv->survey_raw.tx +
diff --git a/drivers/net/wireless/prism54/isl_38xx.c b/drivers/net/wireless/prism54/isl_38xx.c
index 02fc67bccbd0..333c1a2f882e 100644
--- a/drivers/net/wireless/prism54/isl_38xx.c
+++ b/drivers/net/wireless/prism54/isl_38xx.c
@@ -12,8 +12,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/isl_38xx.h b/drivers/net/wireless/prism54/isl_38xx.h
index 19c33d313734..547ab885610b 100644
--- a/drivers/net/wireless/prism54/isl_38xx.h
+++ b/drivers/net/wireless/prism54/isl_38xx.h
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/isl_ioctl.c b/drivers/net/wireless/prism54/isl_ioctl.c
index 8863a6cb2388..78fa64d3f223 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.c
+++ b/drivers/net/wireless/prism54/isl_ioctl.c
@@ -14,8 +14,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
@@ -25,6 +24,7 @@
 #include <linux/if_arp.h>
 #include <linux/slab.h>
 #include <linux/pci.h>
+#include <linux/etherdevice.h>
 
 #include <asm/uaccess.h>
 
@@ -1861,7 +1861,7 @@ prism54_del_mac(struct net_device *ndev, struct iw_request_info *info,
         if (mutex_lock_interruptible(&acl->lock))
                 return -ERESTARTSYS;
         list_for_each_entry(entry, &acl->mac_list, _list) {
-                if (memcmp(entry->addr, addr->sa_data, ETH_ALEN) == 0) {
+                if (ether_addr_equal(entry->addr, addr->sa_data)) {
                         list_del(&entry->_list);
                         acl->size--;
                         kfree(entry);
diff --git a/drivers/net/wireless/prism54/isl_ioctl.h b/drivers/net/wireless/prism54/isl_ioctl.h
index a34bceb6e3cd..842a2549facc 100644
--- a/drivers/net/wireless/prism54/isl_ioctl.h
+++ b/drivers/net/wireless/prism54/isl_ioctl.h
@@ -13,8 +13,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/isl_oid.h b/drivers/net/wireless/prism54/isl_oid.h
index 59e31258d450..83fec557997e 100644
--- a/drivers/net/wireless/prism54/isl_oid.h
+++ b/drivers/net/wireless/prism54/isl_oid.h
@@ -13,8 +13,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
index e05d9b4c8317..931cf440ff18 100644
--- a/drivers/net/wireless/prism54/islpci_dev.c
+++ b/drivers/net/wireless/prism54/islpci_dev.c
@@ -13,8 +13,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
@@ -914,7 +913,6 @@ islpci_setup(struct pci_dev *pdev)
       do_islpci_free_memory:
         islpci_free_memory(priv);
       do_free_netdev:
-        pci_set_drvdata(pdev, NULL);
         free_netdev(ndev);
         priv = NULL;
         return NULL;
diff --git a/drivers/net/wireless/prism54/islpci_dev.h b/drivers/net/wireless/prism54/islpci_dev.h
index c40403877f97..f6f088e05fe4 100644
--- a/drivers/net/wireless/prism54/islpci_dev.h
+++ b/drivers/net/wireless/prism54/islpci_dev.h
@@ -14,8 +14,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/islpci_eth.c b/drivers/net/wireless/prism54/islpci_eth.c
index 799e148d0370..674658f2e6ef 100644
--- a/drivers/net/wireless/prism54/islpci_eth.c
+++ b/drivers/net/wireless/prism54/islpci_eth.c
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/islpci_eth.h b/drivers/net/wireless/prism54/islpci_eth.h
index 6ca30a5b7bfb..80f50f1bc6f2 100644
--- a/drivers/net/wireless/prism54/islpci_eth.h
+++ b/drivers/net/wireless/prism54/islpci_eth.h
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/islpci_hotplug.c b/drivers/net/wireless/prism54/islpci_hotplug.c
index 9e68e0cb718e..1105a12dbde8 100644
--- a/drivers/net/wireless/prism54/islpci_hotplug.c
+++ b/drivers/net/wireless/prism54/islpci_hotplug.c
@@ -12,8 +12,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
@@ -199,7 +198,6 @@ prism54_probe(struct pci_dev *pdev, const struct pci_device_id *id)
       do_unregister_netdev:
         unregister_netdev(ndev);
         islpci_free_memory(priv);
-        pci_set_drvdata(pdev, NULL);
         free_netdev(ndev);
         priv = NULL;
       do_pci_clear_mwi:
@@ -247,7 +245,6 @@ prism54_remove(struct pci_dev *pdev)
         /* free the PCI memory and unmap the remapped page */
         islpci_free_memory(priv);
 
-        pci_set_drvdata(pdev, NULL);
         free_netdev(ndev);
         priv = NULL;
 
diff --git a/drivers/net/wireless/prism54/islpci_mgt.c b/drivers/net/wireless/prism54/islpci_mgt.c
index 9f19cceab487..0de14dfa68cc 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.c
+++ b/drivers/net/wireless/prism54/islpci_mgt.c
@@ -12,8 +12,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/islpci_mgt.h b/drivers/net/wireless/prism54/islpci_mgt.h
index 0db93db9b675..700c434c8803 100644
--- a/drivers/net/wireless/prism54/islpci_mgt.h
+++ b/drivers/net/wireless/prism54/islpci_mgt.h
@@ -12,8 +12,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/oid_mgt.c b/drivers/net/wireless/prism54/oid_mgt.c
index 056af38e72e3..47b34bfe890a 100644
--- a/drivers/net/wireless/prism54/oid_mgt.c
+++ b/drivers/net/wireless/prism54/oid_mgt.c
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/oid_mgt.h b/drivers/net/wireless/prism54/oid_mgt.h
index 92c8a2d4acd8..cf5141df8474 100644
--- a/drivers/net/wireless/prism54/oid_mgt.h
+++ b/drivers/net/wireless/prism54/oid_mgt.h
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/prism54/prismcompat.h b/drivers/net/wireless/prism54/prismcompat.h
index aa1d1747784f..bc1401eb4b9d 100644
--- a/drivers/net/wireless/prism54/prismcompat.h
+++ b/drivers/net/wireless/prism54/prismcompat.h
@@ -11,8 +11,7 @@
  *  GNU General Public License for more details.
  *
  *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the Free Software
- *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  */
 
diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c
index 9b557a1bb7f8..cbf0a589d32a 100644
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -17,8 +17,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  * Changes:
  * Arnaldo Carvalho de Melo <acme@conectiva.com.br> - 08/08/2000
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 8169a85c4498..5028557aa18a 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -15,8 +15,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  *
  *  Portions of this file are based on NDISwrapper project,
  *  Copyright (C) 2003-2005 Pontus Fuchs, Giridhar Pemmasani
@@ -27,7 +26,6 @@
 // #define      VERBOSE                 // more; success messages
 
 #include <linux/module.h>
-#include <linux/init.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 38ed9a3e44c8..4ccfef5094e0 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -26,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.h b/drivers/net/wireless/rt2x00/rt2400pci.h
index e4b07f0aa3cc..0fd3a9d01a60 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.h
+++ b/drivers/net/wireless/rt2x00/rt2400pci.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 0ac5c589ddce..abc5f56f29fe 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -26,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/pci.h>
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.h b/drivers/net/wireless/rt2x00/rt2500pci.h
index 9c10068e4987..573e87bcc553 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.h
+++ b/drivers/net/wireless/rt2x00/rt2500pci.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 85acc79f68b8..9f16824cd1bc 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -26,7 +24,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.h b/drivers/net/wireless/rt2x00/rt2500usb.h
index 1b91a4cef965..afba0739c3b8 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.h
+++ b/drivers/net/wireless/rt2x00/rt2500usb.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index aab6b5e4f5dd..a394a9a95919 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -21,9 +21,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 776aff3678ff..b8f5b06006c4 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -24,9 +24,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -5462,15 +5460,14 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
 
         rt2800_bbp_write(rt2x00dev, 68, 0x0b);
 
-        rt2800_bbp_write(rt2x00dev, 69, 0x12);
+        rt2800_bbp_write(rt2x00dev, 69, 0x0d);
+        rt2800_bbp_write(rt2x00dev, 70, 0x06);
         rt2800_bbp_write(rt2x00dev, 73, 0x13);
         rt2800_bbp_write(rt2x00dev, 75, 0x46);
         rt2800_bbp_write(rt2x00dev, 76, 0x28);
 
         rt2800_bbp_write(rt2x00dev, 77, 0x59);
 
-        rt2800_bbp_write(rt2x00dev, 70, 0x0a);
-
         rt2800_bbp_write(rt2x00dev, 79, 0x13);
         rt2800_bbp_write(rt2x00dev, 80, 0x05);
         rt2800_bbp_write(rt2x00dev, 81, 0x33);
@@ -5513,6 +5510,7 @@ static void rt2800_init_bbp_53xx(struct rt2x00_dev *rt2x00dev)
         if (rt2x00_rt(rt2x00dev, RT5392)) {
                 rt2800_bbp_write(rt2x00dev, 134, 0xd0);
                 rt2800_bbp_write(rt2x00dev, 135, 0xf6);
+                rt2800_bbp_write(rt2x00dev, 148, 0x84);
         }
 
         rt2800_disable_unused_dac_adc(rt2x00dev);
@@ -6453,7 +6451,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 10, 0x53);
         rt2800_rfcsr_write(rt2x00dev, 11, 0x4a);
-        rt2800_rfcsr_write(rt2x00dev, 12, 0xc6);
+        rt2800_rfcsr_write(rt2x00dev, 12, 0x46);
         rt2800_rfcsr_write(rt2x00dev, 13, 0x9f);
         rt2800_rfcsr_write(rt2x00dev, 14, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 15, 0x00);
@@ -6466,7 +6464,8 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 22, 0x20);
         rt2800_rfcsr_write(rt2x00dev, 23, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 24, 0x00);
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+        if (rt2x00_is_usb(rt2x00dev) &&
+            rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
                 rt2800_rfcsr_write(rt2x00dev, 25, 0x80);
         else
                 rt2800_rfcsr_write(rt2x00dev, 25, 0xc0);
@@ -6486,10 +6485,7 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
         rt2800_rfcsr_write(rt2x00dev, 38, 0x85);
         rt2800_rfcsr_write(rt2x00dev, 39, 0x1b);
 
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
-        else
-                rt2800_rfcsr_write(rt2x00dev, 40, 0x4b);
+        rt2800_rfcsr_write(rt2x00dev, 40, 0x0b);
         rt2800_rfcsr_write(rt2x00dev, 41, 0xbb);
         rt2800_rfcsr_write(rt2x00dev, 42, 0xd2);
         rt2800_rfcsr_write(rt2x00dev, 43, 0x9a);
@@ -6510,16 +6506,26 @@ static void rt2800_init_rfcsr_5390(struct rt2x00_dev *rt2x00dev)
                 rt2800_rfcsr_write(rt2x00dev, 53, 0x84);
         rt2800_rfcsr_write(rt2x00dev, 54, 0x78);
         rt2800_rfcsr_write(rt2x00dev, 55, 0x44);
-        rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
+                rt2800_rfcsr_write(rt2x00dev, 56, 0x42);
+        else
+                rt2800_rfcsr_write(rt2x00dev, 56, 0x22);
         rt2800_rfcsr_write(rt2x00dev, 57, 0x80);
         rt2800_rfcsr_write(rt2x00dev, 58, 0x7f);
         rt2800_rfcsr_write(rt2x00dev, 59, 0x8f);
 
         rt2800_rfcsr_write(rt2x00dev, 60, 0x45);
-        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F))
-                rt2800_rfcsr_write(rt2x00dev, 61, 0xd1);
-        else
-                rt2800_rfcsr_write(rt2x00dev, 61, 0xdd);
+        if (rt2x00_rt_rev_gte(rt2x00dev, RT5390, REV_RT5390F)) {
+                if (rt2x00_is_usb(rt2x00dev))
+                        rt2800_rfcsr_write(rt2x00dev, 61, 0xd1);
+                else
+                        rt2800_rfcsr_write(rt2x00dev, 61, 0xd5);
+        } else {
+                if (rt2x00_is_usb(rt2x00dev))
+                        rt2800_rfcsr_write(rt2x00dev, 61, 0xdd);
+                else
+                        rt2800_rfcsr_write(rt2x00dev, 61, 0xb5);
+        }
         rt2800_rfcsr_write(rt2x00dev, 62, 0x00);
         rt2800_rfcsr_write(rt2x00dev, 63, 0x00);
 
@@ -6602,7 +6608,6 @@ static void rt2800_init_rfcsr_5592(struct rt2x00_dev *rt2x00dev)
 
         rt2800_rfcsr_write(rt2x00dev, 1, 0x3F);
         rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
-        rt2800_rfcsr_write(rt2x00dev, 3, 0x08);
         rt2800_rfcsr_write(rt2x00dev, 5, 0x10);
         rt2800_rfcsr_write(rt2x00dev, 6, 0xE4);
         rt2800_rfcsr_write(rt2x00dev, 7, 0x00);
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h
index a94ba447e63c..3019db637a4b 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.h
+++ b/drivers/net/wireless/rt2x00/rt2800lib.h
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef RT2800LIB_H
diff --git a/drivers/net/wireless/rt2x00/rt2800mmio.c b/drivers/net/wireless/rt2x00/rt2800mmio.c
index a8cc736b5063..de4790b41be7 100644
--- a/drivers/net/wireless/rt2x00/rt2800mmio.c
+++ b/drivers/net/wireless/rt2x00/rt2800mmio.c
@@ -19,9 +19,7 @@
  *      GNU General Public License for more details.
  *
  *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the
- *      Free Software Foundation, Inc.,
- *      59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *      along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*      Module: rt2800mmio
diff --git a/drivers/net/wireless/rt2x00/rt2800mmio.h b/drivers/net/wireless/rt2x00/rt2800mmio.h
index 6a10de3eee3e..b63312ce3f27 100644
--- a/drivers/net/wireless/rt2x00/rt2800mmio.h
+++ b/drivers/net/wireless/rt2x00/rt2800mmio.h
@@ -19,9 +19,7 @@
  *      GNU General Public License for more details.
  *
  *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the
- *      Free Software Foundation, Inc.,
- *      59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *      along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*      Module: rt2800mmio
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index b504455b4fec..a5b32ca2cf0f 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -20,9 +20,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.h b/drivers/net/wireless/rt2x00/rt2800pci.h
index a81c9ee281c0..9dfef4607d6b 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.h
+++ b/drivers/net/wireless/rt2x00/rt2800pci.h
@@ -20,9 +20,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800soc.c b/drivers/net/wireless/rt2x00/rt2800soc.c
index 1359227ca411..f6d1bf5be006 100644
--- a/drivers/net/wireless/rt2x00/rt2800soc.c
+++ b/drivers/net/wireless/rt2x00/rt2800soc.c
@@ -19,9 +19,7 @@
  *      GNU General Public License for more details.
  *
  *      You should have received a copy of the GNU General Public License
- *      along with this program; if not, write to the
- *      Free Software Foundation, Inc.,
- *      59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *      along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*      Module: rt2800soc
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index a81ceb61d746..caddc1b427a9 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -18,9 +18,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -31,7 +29,6 @@
 
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -992,6 +989,7 @@ static struct usb_device_id rt2800usb_device_table[] = {
         { USB_DEVICE(0x07d1, 0x3c15) },
         { USB_DEVICE(0x07d1, 0x3c16) },
         { USB_DEVICE(0x07d1, 0x3c17) },
+        { USB_DEVICE(0x2001, 0x3317) },
         { USB_DEVICE(0x2001, 0x3c1b) },
         /* Draytek */
         { USB_DEVICE(0x07fa, 0x7712) },
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.h b/drivers/net/wireless/rt2x00/rt2800usb.h
index 671ea3592610..ea7cac095997 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.h
+++ b/drivers/net/wireless/rt2x00/rt2800usb.h
@@ -17,9 +17,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index e4ba2ce0f212..e3b885d8f7db 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -15,9 +15,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00config.c b/drivers/net/wireless/rt2x00/rt2x00config.c
index 8cb43f8f3efc..1122dc44c9fd 100644
--- a/drivers/net/wireless/rt2x00/rt2x00config.c
+++ b/drivers/net/wireless/rt2x00/rt2x00config.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00crypto.c b/drivers/net/wireless/rt2x00/rt2x00crypto.c
index 3db0d99d9da7..a2fd05ba25ca 100644
--- a/drivers/net/wireless/rt2x00/rt2x00crypto.c
+++ b/drivers/net/wireless/rt2x00/rt2x00crypto.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 7f7baae5ae02..2e3d1645e68b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.h b/drivers/net/wireless/rt2x00/rt2x00debug.h
index e11d39bdfef7..e65712c235bd 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.h
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index 9dd92a700442..2bde6729f5e6 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -567,10 +565,10 @@ static void rt2x00lib_rxdone_check_ba(struct rt2x00_dev *rt2x00dev,
 
 #undef TID_CHECK
 
-                if (!ether_addr_equal(ba->ra, entry->ta))
+                if (!ether_addr_equal_64bits(ba->ra, entry->ta))
                         continue;
 
-                if (!ether_addr_equal(ba->ta, entry->ra))
+                if (!ether_addr_equal_64bits(ba->ta, entry->ra))
                         continue;
 
                 /* Mark BAR since we received the according BA */
diff --git a/drivers/net/wireless/rt2x00/rt2x00dump.h b/drivers/net/wireless/rt2x00/rt2x00dump.h
index 063ebcce97f8..4c0e01b5d515 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dump.h
+++ b/drivers/net/wireless/rt2x00/rt2x00dump.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00firmware.c b/drivers/net/wireless/rt2x00/rt2x00firmware.c
index 1b4254b4272d..fbae2799e3ee 100644
--- a/drivers/net/wireless/rt2x00/rt2x00firmware.c
+++ b/drivers/net/wireless/rt2x00/rt2x00firmware.c
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.c b/drivers/net/wireless/rt2x00/rt2x00leds.c
index 997a6c89e66e..c681d04b506c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.c
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00leds.h b/drivers/net/wireless/rt2x00/rt2x00leds.h
index 3b46f0c3332a..b2c5269570da 100644
--- a/drivers/net/wireless/rt2x00/rt2x00leds.h
+++ b/drivers/net/wireless/rt2x00/rt2x00leds.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00lib.h b/drivers/net/wireless/rt2x00/rt2x00lib.h
index 7f40ab8e1bd8..fb7c349ccc9c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00lib.h
+++ b/drivers/net/wireless/rt2x00/rt2x00lib.h
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00link.c b/drivers/net/wireless/rt2x00/rt2x00link.c
index c2b3b6629188..9b941c0c1264 100644
--- a/drivers/net/wireless/rt2x00/rt2x00link.c
+++ b/drivers/net/wireless/rt2x00/rt2x00link.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 2183e7978399..ddeb5a709aa3 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.c b/drivers/net/wireless/rt2x00/rt2x00mmio.c
index 64b06c6abe58..6f236ea180aa 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mmio.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00mmio.h b/drivers/net/wireless/rt2x00/rt2x00mmio.h
index cda3dbcf7ead..701c3127efb9 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mmio.h
+++ b/drivers/net/wireless/rt2x00/rt2x00mmio.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 25da20e7e1f3..d93db4b0371b 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -156,8 +154,6 @@ exit_release_regions:
 exit_disable_device:
         pci_disable_device(pci_dev);
 
-        pci_set_drvdata(pci_dev, NULL);
-
         return retval;
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_probe);
@@ -177,7 +173,6 @@ void rt2x00pci_remove(struct pci_dev *pci_dev)
         /*
          * Free the PCI device data.
          */
-        pci_set_drvdata(pci_dev, NULL);
         pci_disable_device(pci_dev);
         pci_release_regions(pci_dev);
 }
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.h b/drivers/net/wireless/rt2x00/rt2x00pci.h
index 60d90b20f8b9..bc0ca5f58f38 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.h
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index a5d38e8ad9e4..5642ccceca7c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -15,9 +15,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index ebe117224979..c48125be0e34 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00reg.h b/drivers/net/wireless/rt2x00/rt2x00reg.h
index 6f867eec49cc..3cc541d13d67 100644
--- a/drivers/net/wireless/rt2x00/rt2x00reg.h
+++ b/drivers/net/wireless/rt2x00/rt2x00reg.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.c b/drivers/net/wireless/rt2x00/rt2x00soc.c
index 9271a5fce0a8..69a0cdadb07f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00soc.c
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.c
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00soc.h b/drivers/net/wireless/rt2x00/rt2x00soc.h
index 474cbfc1efc7..9948d355e9a4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00soc.h
+++ b/drivers/net/wireless/rt2x00/rt2x00soc.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 4e121627925d..10572452cc21 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -14,9 +14,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.h b/drivers/net/wireless/rt2x00/rt2x00usb.h
index 323ca7b2b095..e7bcf62347d5 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.h
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index a5b69cb49012..24402984ee57 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -27,7 +25,6 @@
 #include <linux/crc-itu-t.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rt2x00/rt61pci.h b/drivers/net/wireless/rt2x00/rt61pci.h
index 9bc6b6044e34..1442075a8382 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.h
+++ b/drivers/net/wireless/rt2x00/rt61pci.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 1baf9c896dcd..a140170b1eb3 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
@@ -27,7 +25,6 @@
 #include <linux/crc-itu-t.h>
 #include <linux/delay.h>
 #include <linux/etherdevice.h>
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rt2x00/rt73usb.h b/drivers/net/wireless/rt2x00/rt73usb.h
index 7577e0ba3877..4a4f235466d1 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.h
+++ b/drivers/net/wireless/rt2x00/rt73usb.h
@@ -13,9 +13,7 @@
         GNU General Public License for more details.
 
         You should have received a copy of the GNU General Public License
-        along with this program; if not, write to the
-        Free Software Foundation, Inc.,
-        59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+        along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /*
diff --git a/drivers/net/wireless/rtl818x/rtl8180/dev.c b/drivers/net/wireless/rtl818x/rtl8180/dev.c
index a91506b12a62..8ec17aad0e52 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/dev.c
@@ -15,7 +15,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/pci.h>
 #include <linux/slab.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
index dc845693f321..b1bfee738937 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/grf5101.c
@@ -19,7 +19,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/max2820.c b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
index a63c443c3c6f..eebf23976524 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/max2820.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/max2820.c
@@ -18,7 +18,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
index ee638d0749d6..d60a5f399022 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/rtl8225.c
@@ -15,7 +15,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
index 7614d9ccc729..959b049827de 100644
--- a/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
+++ b/drivers/net/wireless/rtl818x/rtl8180/sa2400.c
@@ -19,7 +19,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <net/mac80211.h>
diff --git a/drivers/net/wireless/rtl818x/rtl8187/dev.c b/drivers/net/wireless/rtl818x/rtl8187/dev.c
index 9a6edb0c014e..fd78df813a85 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/dev.c
@@ -20,7 +20,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <linux/slab.h>
 #include <linux/delay.h>
@@ -416,7 +415,7 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
         struct rtl8187_rx_info *info;
         int ret = 0;
 
-        while (skb_queue_len(&priv->rx_queue) < 16) {
+        while (skb_queue_len(&priv->rx_queue) < 32) {
                 skb = __dev_alloc_skb(RTL8187_MAX_RX, GFP_KERNEL);
                 if (!skb) {
                         ret = -ENOMEM;
diff --git a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
index a26193a04447..5ecf18ed67b8 100644
--- a/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187/rtl8225.c
@@ -16,7 +16,6 @@
  * published by the Free Software Foundation.
  */
 
-#include <linux/init.h>
 #include <linux/usb.h>
 #include <net/mac80211.h>
 
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index ff784072fb42..93bb384eb001 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -353,7 +353,6 @@ static void _rtl_init_mac80211(struct ieee80211_hw *hw)
 
         /* TODO: Correct this value for our hw */
         /* TODO: define these hard code value */
-        hw->channel_change_time = 100;
         hw->max_listen_interval = 10;
         hw->max_rate_tries = 4;
         /* hw->max_rates = 1; */
@@ -1293,7 +1292,7 @@ void rtl_beacon_statistic(struct ieee80211_hw *hw, struct sk_buff *skb)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         rtlpriv->link_info.bcn_rx_inperiod++;
@@ -1437,7 +1436,8 @@ void rtl_watchdog_wq_callback(void *data)
                         /* if we can't recv beacon for 6s, we should
                          * reconnect this AP
                          */
-                        if (rtlpriv->link_info.roam_times >= 3) {
+                        if ((rtlpriv->link_info.roam_times >= 3) &&
+                            !is_zero_ether_addr(rtlpriv->mac80211.bssid)) {
                                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                                          "AP off, try to reconnect now\n");
                                 rtlpriv->link_info.roam_times = 0;
@@ -1780,7 +1780,7 @@ void rtl_recognize_peer(struct ieee80211_hw *hw, u8 *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         if (rtl_find_221_ie(hw, data, len))
diff --git a/drivers/net/wireless/rtlwifi/cam.c b/drivers/net/wireless/rtlwifi/cam.c
index 0e510f73041a..0276153c72cc 100644
--- a/drivers/net/wireless/rtlwifi/cam.c
+++ b/drivers/net/wireless/rtlwifi/cam.c
@@ -295,7 +295,7 @@ u8 rtl_cam_get_free_entry(struct ieee80211_hw *hw, u8 *sta_addr)
         /* Does STA already exist? */
         for (i = 4; i < TOTAL_CAM_ENTRY; i++) {
                 addr = rtlpriv->sec.hwsec_cam_sta_addr[i];
-                if (memcmp(addr, sta_addr, ETH_ALEN) == 0)
+                if (ether_addr_equal_unaligned(addr, sta_addr))
                         return i;
         }
         /* Get a free CAM entry. */
@@ -335,7 +335,7 @@ void rtl_cam_del_entry(struct ieee80211_hw *hw, u8 *sta_addr)
                 addr = rtlpriv->sec.hwsec_cam_sta_addr[i];
                 bitmap = (rtlpriv->sec.hwsec_cam_bitmap) >> i;
                 if (((bitmap & BIT(0)) == BIT(0)) &&
-                    (memcmp(addr, sta_addr, ETH_ALEN) == 0)) {
+                    (ether_addr_equal_unaligned(addr, sta_addr))) {
                         /* Remove from HW Security CAM */
                         eth_zero_addr(rtlpriv->sec.hwsec_cam_sta_addr[i]);
                         rtlpriv->sec.hwsec_cam_bitmap &= ~(BIT(0) << i);
diff --git a/drivers/net/wireless/rtlwifi/core.c b/drivers/net/wireless/rtlwifi/core.c
index 210ce7cd94d8..2d337a0c3df0 100644
--- a/drivers/net/wireless/rtlwifi/core.c
+++ b/drivers/net/wireless/rtlwifi/core.c
@@ -46,10 +46,20 @@ void rtl_fw_cb(const struct firmware *firmware, void *context)
                          "Firmware callback routine entered!\n");
         complete(&rtlpriv->firmware_loading_complete);
         if (!firmware) {
+                if (rtlpriv->cfg->alt_fw_name) {
+                        err = request_firmware(&firmware,
+                                               rtlpriv->cfg->alt_fw_name,
+                                               rtlpriv->io.dev);
+                        pr_info("Loading alternative firmware %s\n",
+                                rtlpriv->cfg->alt_fw_name);
+                        if (!err)
+                                goto found_alt;
+                }
                 pr_err("Firmware %s not available\n", rtlpriv->cfg->fw_name);
                 rtlpriv->max_fw_size = 0;
                 return;
         }
+found_alt:
         if (firmware->size > rtlpriv->max_fw_size) {
                 RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG,
                          "Firmware is too big!\n");
@@ -184,6 +194,7 @@ static int rtl_op_add_interface(struct ieee80211_hw *hw,
                                         rtlpriv->cfg->maps
                                         [RTL_IBSS_INT_MASKS]);
                 }
+                mac->link_state = MAC80211_LINKED;
                 break;
         case NL80211_IFTYPE_ADHOC:
                 RT_TRACE(rtlpriv, COMP_MAC80211, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 5a53195d016b..d7aa165fe677 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -688,8 +688,6 @@ static void _rtl_receive_one(struct ieee80211_hw *hw, struct sk_buff *skb,
                 rtlpriv->stats.rxbytesunicast += skb->len;
         }
 
-        rtl_is_special_data(hw, skb, false);
-
         if (ieee80211_is_data(fc)) {
                 rtlpriv->cfg->ops->led_control(hw, LED_CTL_RX);
 
diff --git a/drivers/net/wireless/rtlwifi/ps.c b/drivers/net/wireless/rtlwifi/ps.c
index 0d81f766fd0f..deedae3c5449 100644
--- a/drivers/net/wireless/rtlwifi/ps.c
+++ b/drivers/net/wireless/rtlwifi/ps.c
@@ -478,7 +478,7 @@ void rtl_swlps_beacon(struct ieee80211_hw *hw, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         rtlpriv->psc.last_beacon = jiffies;
@@ -923,7 +923,7 @@ void rtl_p2p_info(struct ieee80211_hw *hw, void *data, unsigned int len)
                 return;
 
         /* and only beacons from the associated BSSID, please */
-        if (!ether_addr_equal(hdr->addr3, rtlpriv->mac80211.bssid))
+        if (!ether_addr_equal_64bits(hdr->addr3, rtlpriv->mac80211.bssid))
                 return;
 
         /* check if this really is a beacon */
diff --git a/drivers/net/wireless/rtlwifi/regd.c b/drivers/net/wireless/rtlwifi/regd.c
index d7d0d4948b01..a4eb9b271438 100644
--- a/drivers/net/wireless/rtlwifi/regd.c
+++ b/drivers/net/wireless/rtlwifi/regd.c
@@ -59,30 +59,26 @@ static struct country_code_to_enum_rd allCountries[] = {
  */
 #define RTL819x_2GHZ_CH12_13    \
         REG_RULE(2467-10, 2472+10, 40, 0, 20,\
-        NL80211_RRF_PASSIVE_SCAN)
+                 NL80211_RRF_NO_IR)
 
 #define RTL819x_2GHZ_CH14       \
         REG_RULE(2484-10, 2484+10, 40, 0, 20, \
-        NL80211_RRF_PASSIVE_SCAN | \
-        NL80211_RRF_NO_OFDM)
+                 NL80211_RRF_NO_IR | NL80211_RRF_NO_OFDM)
 
 /* 5G chan 36 - chan 64*/
 #define RTL819x_5GHZ_5150_5350  \
         REG_RULE(5150-10, 5350+10, 40, 0, 30, \
-        NL80211_RRF_PASSIVE_SCAN | \
-        NL80211_RRF_NO_IBSS)
+                 NL80211_RRF_NO_IR)
 
 /* 5G chan 100 - chan 165*/
 #define RTL819x_5GHZ_5470_5850  \
         REG_RULE(5470-10, 5850+10, 40, 0, 30, \
-        NL80211_RRF_PASSIVE_SCAN | \
-        NL80211_RRF_NO_IBSS)
+                 NL80211_RRF_NO_IR)
 
 /* 5G chan 149 - chan 165*/
 #define RTL819x_5GHZ_5725_5850  \
         REG_RULE(5725-10, 5850+10, 40, 0, 30, \
-        NL80211_RRF_PASSIVE_SCAN | \
-        NL80211_RRF_NO_IBSS)
+                 NL80211_RRF_NO_IR)
 
 #define RTL819x_5GHZ_ALL        \
         (RTL819x_5GHZ_5150_5350, RTL819x_5GHZ_5470_5850)
@@ -172,7 +168,8 @@ static void _rtl_reg_apply_beaconing_flags(struct wiphy *wiphy,
                             (ch->flags & IEEE80211_CHAN_RADAR))
                                 continue;
                         if (initiator == NL80211_REGDOM_SET_BY_COUNTRY_IE) {
-                                reg_rule = freq_reg_info(wiphy, ch->center_freq);
+                                reg_rule = freq_reg_info(wiphy,
+                                                         MHZ_TO_KHZ(ch->center_freq));
                                 if (IS_ERR(reg_rule))
                                         continue;
 
@@ -185,16 +182,11 @@ static void _rtl_reg_apply_beaconing_flags(struct wiphy *wiphy,
                                  *regulatory_hint().
                                  */
 
-                                if (!(reg_rule->flags & NL80211_RRF_NO_IBSS))
-                                        ch->flags &= ~IEEE80211_CHAN_NO_IBSS;
-                                if (!(reg_rule->
-                                     flags & NL80211_RRF_PASSIVE_SCAN))
-                                        ch->flags &=
-                                            ~IEEE80211_CHAN_PASSIVE_SCAN;
+                                if (!(reg_rule->flags & NL80211_RRF_NO_IR))
+                                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
                         } else {
                                 if (ch->beacon_found)
-                                        ch->flags &= ~(IEEE80211_CHAN_NO_IBSS |
-                                                  IEEE80211_CHAN_PASSIVE_SCAN);
+                                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
                         }
                 }
         }
@@ -219,11 +211,11 @@ static void _rtl_reg_apply_active_scan_flags(struct wiphy *wiphy,
          */
         if (initiator != NL80211_REGDOM_SET_BY_COUNTRY_IE) {
                 ch = &sband->channels[11];      /* CH 12 */
-                if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                if (ch->flags & IEEE80211_CHAN_NO_IR)
+                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
                 ch = &sband->channels[12];      /* CH 13 */
-                if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                        ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                if (ch->flags & IEEE80211_CHAN_NO_IR)
+                        ch->flags &= ~IEEE80211_CHAN_NO_IR;
                 return;
         }
 
@@ -235,19 +227,19 @@ static void _rtl_reg_apply_active_scan_flags(struct wiphy *wiphy,
          */
 
         ch = &sband->channels[11];      /* CH 12 */
-        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(ch->center_freq));
         if (!IS_ERR(reg_rule)) {
-                if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                        if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                if (!(reg_rule->flags & NL80211_RRF_NO_IR))
+                        if (ch->flags & IEEE80211_CHAN_NO_IR)
+                                ch->flags &= ~IEEE80211_CHAN_NO_IR;
         }
 
         ch = &sband->channels[12];      /* CH 13 */
-        reg_rule = freq_reg_info(wiphy, ch->center_freq);
+        reg_rule = freq_reg_info(wiphy, MHZ_TO_KHZ(ch->center_freq));
         if (!IS_ERR(reg_rule)) {
-                if (!(reg_rule->flags & NL80211_RRF_PASSIVE_SCAN))
-                        if (ch->flags & IEEE80211_CHAN_PASSIVE_SCAN)
-                                ch->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
+                if (!(reg_rule->flags & NL80211_RRF_NO_IR))
+                        if (ch->flags & IEEE80211_CHAN_NO_IR)
+                                ch->flags &= ~IEEE80211_CHAN_NO_IR;
         }
 }
 
@@ -284,8 +276,7 @@ static void _rtl_reg_apply_radar_flags(struct wiphy *wiphy)
                  */
                 if (!(ch->flags & IEEE80211_CHAN_DISABLED))
                         ch->flags |= IEEE80211_CHAN_RADAR |
-                            IEEE80211_CHAN_NO_IBSS |
-                            IEEE80211_CHAN_PASSIVE_SCAN;
+                                     IEEE80211_CHAN_NO_IR;
         }
 }
 
@@ -354,9 +345,9 @@ static int _rtl_regd_init_wiphy(struct rtl_regulatory *reg,
 
         wiphy->reg_notifier = reg_notifier;
 
-        wiphy->flags |= WIPHY_FLAG_CUSTOM_REGULATORY;
-        wiphy->flags &= ~WIPHY_FLAG_STRICT_REGULATORY;
-        wiphy->flags &= ~WIPHY_FLAG_DISABLE_BEACON_HINTS;
+        wiphy->regulatory_flags |= REGULATORY_CUSTOM_REG;
+        wiphy->regulatory_flags &= ~REGULATORY_STRICT_REG;
+        wiphy->regulatory_flags &= ~REGULATORY_DISABLE_BEACON_HINTS;
 
         regd = _rtl_regdomain_select(reg);
         wiphy_apply_custom_regulatory(wiphy, regd);
diff --git a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
index 21a5cf060677..a6184b6e1d57 100644
--- a/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8188ee/dm.c
@@ -1078,7 +1078,7 @@ static void rtl88e_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
                                 rtldm->swing_flag_ofdm = true;
                         }
 
-                        if (rtldm->swing_idx_cck != rtldm->swing_idx_cck) {
+                        if (rtldm->swing_idx_cck_cur != rtldm->swing_idx_cck) {
                                 rtldm->swing_idx_cck_cur = rtldm->swing_idx_cck;
                                 rtldm->swing_flag_cck = true;
                         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
index e9caa5d4cff0..eb78fd8607f7 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
@@ -158,6 +158,42 @@ static const u8 cckswing_table_ch14[CCK_TABLE_SIZE][8] = {
         {0x09, 0x08, 0x07, 0x04, 0x00, 0x00, 0x00, 0x00}
 };
 
+static u32 power_index_reg[6] = {0xc90, 0xc91, 0xc92, 0xc98, 0xc99, 0xc9a};
+
+void dm_restorepowerindex(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8      index;
+
+        for (index = 0; index < 6; index++)
+                rtl_write_byte(rtlpriv, power_index_reg[index],
+                               rtlpriv->dm.powerindex_backup[index]);
+}
+EXPORT_SYMBOL_GPL(dm_restorepowerindex);
+
+void dm_writepowerindex(struct ieee80211_hw *hw, u8 value)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 index;
+
+        for (index = 0; index < 6; index++)
+                rtl_write_byte(rtlpriv, power_index_reg[index], value);
+}
+EXPORT_SYMBOL_GPL(dm_writepowerindex);
+
+void dm_savepowerindex(struct ieee80211_hw *hw)
+{
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        u8 index;
+        u8 tmp;
+
+        for (index = 0; index < 6; index++) {
+                tmp = rtl_read_byte(rtlpriv, power_index_reg[index]);
+                rtlpriv->dm.powerindex_backup[index] = tmp;
+        }
+}
+EXPORT_SYMBOL_GPL(dm_savepowerindex);
+
 static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -180,7 +216,12 @@ static void rtl92c_dm_diginit(struct ieee80211_hw *hw)
         dm_digtable->back_range_max = DM_DIG_BACKOFF_MAX;
         dm_digtable->back_range_min = DM_DIG_BACKOFF_MIN;
         dm_digtable->pre_cck_pd_state = CCK_PD_STAGE_MAX;
-        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_MAX;
+        dm_digtable->cur_cck_pd_state = CCK_PD_STAGE_LowRssi;
+
+        dm_digtable->forbidden_igi = DM_DIG_MIN;
+        dm_digtable->large_fa_hit = 0;
+        dm_digtable->recover_cnt = 0;
+        dm_digtable->dig_dynamic_min  = 0x25;
 }
 
 static u8 rtl92c_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
@@ -206,7 +247,9 @@ static u8 rtl92c_dm_initial_gain_min_pwdb(struct ieee80211_hw *hw)
                 rssi_val_min = rtlpriv->dm.entry_min_undec_sm_pwdb;
         }
 
-        return (u8) rssi_val_min;
+        if (rssi_val_min > 100)
+                rssi_val_min = 100;
+        return (u8)rssi_val_min;
 }
 
 static void rtl92c_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
@@ -224,9 +267,17 @@ static void rtl92c_dm_false_alarm_counter_statistics(struct ieee80211_hw *hw)
 
         ret_value = rtl_get_bbreg(hw, ROFDM_PHYCOUNTER3, MASKDWORD);
         falsealm_cnt->cnt_mcs_fail = (ret_value & 0xffff);
+
+         ret_value = rtl_get_bbreg(hw, ROFDM0_FRAMESYNC, MASKDWORD);
+        falsealm_cnt->cnt_fast_fsync_fail = (ret_value & 0xffff);
+        falsealm_cnt->cnt_sb_search_fail = ((ret_value & 0xffff0000) >> 16);
+
         falsealm_cnt->cnt_ofdm_fail = falsealm_cnt->cnt_parity_fail +
-            falsealm_cnt->cnt_rate_illegal +
-            falsealm_cnt->cnt_crc8_fail + falsealm_cnt->cnt_mcs_fail;
+                                      falsealm_cnt->cnt_rate_illegal +
+                                      falsealm_cnt->cnt_crc8_fail +
+                                      falsealm_cnt->cnt_mcs_fail +
+                                      falsealm_cnt->cnt_fast_fsync_fail +
+                                      falsealm_cnt->cnt_sb_search_fail;
 
         rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT, BIT(14), 1);
         ret_value = rtl_get_bbreg(hw, RCCK0_FACOUNTERLOWER, MASKBYTE0);
@@ -271,12 +322,14 @@ static void rtl92c_dm_ctrl_initgain_by_fa(struct ieee80211_hw *hw)
                 value_igi++;
         else if (rtlpriv->falsealm_cnt.cnt_all >= DM_DIG_FA_TH2)
                 value_igi += 2;
+
         if (value_igi > DM_DIG_FA_UPPER)
                 value_igi = DM_DIG_FA_UPPER;
         else if (value_igi < DM_DIG_FA_LOWER)
                 value_igi = DM_DIG_FA_LOWER;
+
         if (rtlpriv->falsealm_cnt.cnt_all > 10000)
-                value_igi = 0x32;
+                value_igi = DM_DIG_FA_UPPER;
 
         dm_digtable->cur_igvalue = value_igi;
         rtl92c_dm_write_dig(hw);
@@ -286,32 +339,80 @@ static void rtl92c_dm_ctrl_initgain_by_rssi(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct dig_t *digtable = &rtlpriv->dm_digtable;
+        u32 isbt;
+
+        /* modify DIG lower bound, deal with abnorally large false alarm */
+        if (rtlpriv->falsealm_cnt.cnt_all > 10000) {
+                digtable->large_fa_hit++;
+                if (digtable->forbidden_igi < digtable->cur_igvalue) {
+                        digtable->forbidden_igi = digtable->cur_igvalue;
+                        digtable->large_fa_hit = 1;
+                }
 
-        if (rtlpriv->falsealm_cnt.cnt_all > digtable->fa_highthresh) {
-                if ((digtable->back_val - 2) < digtable->back_range_min)
-                        digtable->back_val = digtable->back_range_min;
-                else
-                        digtable->back_val -= 2;
-        } else if (rtlpriv->falsealm_cnt.cnt_all < digtable->fa_lowthresh) {
-                if ((digtable->back_val + 2) > digtable->back_range_max)
-                        digtable->back_val = digtable->back_range_max;
-                else
-                        digtable->back_val += 2;
+                if (digtable->large_fa_hit >= 3) {
+                        if ((digtable->forbidden_igi + 1) >
+                            digtable->rx_gain_max)
+                                digtable->rx_gain_min = digtable->rx_gain_max;
+                        else
+                                digtable->rx_gain_min = (digtable->forbidden_igi + 1);
+                        digtable->recover_cnt = 3600; /* 3600=2hr */
+                }
+        } else {
+                /* Recovery mechanism for IGI lower bound */
+                if (digtable->recover_cnt != 0) {
+                        digtable->recover_cnt--;
+                } else {
+                        if (digtable->large_fa_hit == 0) {
+                                if ((digtable->forbidden_igi-1) < DM_DIG_MIN) {
+                                        digtable->forbidden_igi = DM_DIG_MIN;
+                                        digtable->rx_gain_min = DM_DIG_MIN;
+                                } else {
+                                        digtable->forbidden_igi--;
+                                        digtable->rx_gain_min = digtable->forbidden_igi + 1;
+                                }
+                        } else if (digtable->large_fa_hit == 3) {
+                                digtable->large_fa_hit = 0;
+                        }
+                }
+        }
+        if (rtlpriv->falsealm_cnt.cnt_all < 250) {
+                isbt = rtl_read_byte(rtlpriv, 0x4fd) & 0x01;
+
+                if (!isbt) {
+                        if (rtlpriv->falsealm_cnt.cnt_all >
+                            digtable->fa_lowthresh) {
+                                if ((digtable->back_val - 2) <
+                                   digtable->back_range_min)
+                                        digtable->back_val = digtable->back_range_min;
+                                else
+                                        digtable->back_val -= 2;
+                        } else if (rtlpriv->falsealm_cnt.cnt_all <
+                                   digtable->fa_lowthresh) {
+                                if ((digtable->back_val + 2) >
+                                    digtable->back_range_max)
+                                        digtable->back_val = digtable->back_range_max;
+                                else
+                                        digtable->back_val += 2;
+                        }
+                } else {
+                        digtable->back_val = DM_DIG_BACKOFF_DEFAULT;
+                }
+        } else {
+                /* Adjust initial gain by false alarm */
+                if (rtlpriv->falsealm_cnt.cnt_all > 1000)
+                        digtable->cur_igvalue = digtable->pre_igvalue + 2;
+                else if (rtlpriv->falsealm_cnt.cnt_all > 750)
+                        digtable->cur_igvalue = digtable->pre_igvalue + 1;
+                else if (rtlpriv->falsealm_cnt.cnt_all < 500)
+                        digtable->cur_igvalue = digtable->pre_igvalue - 1;
         }
 
-        if ((digtable->rssi_val_min + 10 - digtable->back_val) >
-            digtable->rx_gain_max)
+        /* Check initial gain by upper/lower bound */
+        if (digtable->cur_igvalue > digtable->rx_gain_max)
                 digtable->cur_igvalue = digtable->rx_gain_max;
-        else if ((digtable->rssi_val_min + 10 -
-                  digtable->back_val) < digtable->rx_gain_min)
-                digtable->cur_igvalue = digtable->rx_gain_min;
-        else
-                digtable->cur_igvalue = digtable->rssi_val_min + 10 -
-                    digtable->back_val;
 
-        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE,
-                 "rssi_val_min = %x back_val %x\n",
-                 digtable->rssi_val_min, digtable->back_val);
+        if (digtable->cur_igvalue < digtable->rx_gain_min)
+                digtable->cur_igvalue = digtable->rx_gain_min;
 
         rtl92c_dm_write_dig(hw);
 }
@@ -329,7 +430,7 @@ static void rtl92c_dm_initial_gain_multi_sta(struct ieee80211_hw *hw)
                 multi_sta = true;
 
         if (!multi_sta ||
-            dm_digtable->cursta_cstate != DIG_STA_DISCONNECT) {
+            dm_digtable->cursta_cstate == DIG_STA_DISCONNECT) {
                 initialized = false;
                 dm_digtable->dig_ext_port_stage = DIG_EXT_PORT_STAGE_MAX;
                 return;
@@ -375,7 +476,6 @@ static void rtl92c_dm_initial_gain_sta(struct ieee80211_hw *hw)
         RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE,
                  "presta_cstate = %x, cursta_cstate = %x\n",
                  dm_digtable->presta_cstate, dm_digtable->cursta_cstate);
-
         if (dm_digtable->presta_cstate == dm_digtable->cursta_cstate ||
             dm_digtable->cursta_cstate == DIG_STA_BEFORE_CONNECT ||
             dm_digtable->cursta_cstate == DIG_STA_CONNECT) {
@@ -383,6 +483,8 @@ static void rtl92c_dm_initial_gain_sta(struct ieee80211_hw *hw)
                 if (dm_digtable->cursta_cstate != DIG_STA_DISCONNECT) {
                         dm_digtable->rssi_val_min =
                             rtl92c_dm_initial_gain_min_pwdb(hw);
+                        if (dm_digtable->rssi_val_min > 100)
+                                dm_digtable->rssi_val_min = 100;
                         rtl92c_dm_ctrl_initgain_by_rssi(hw);
                 }
         } else {
@@ -398,11 +500,12 @@ static void rtl92c_dm_initial_gain_sta(struct ieee80211_hw *hw)
 static void rtl92c_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
 
         if (dm_digtable->cursta_cstate == DIG_STA_CONNECT) {
                 dm_digtable->rssi_val_min = rtl92c_dm_initial_gain_min_pwdb(hw);
+                if (dm_digtable->rssi_val_min > 100)
+                        dm_digtable->rssi_val_min = 100;
 
                 if (dm_digtable->pre_cck_pd_state == CCK_PD_STAGE_LowRssi) {
                         if (dm_digtable->rssi_val_min <= 25)
@@ -424,48 +527,14 @@ static void rtl92c_dm_cck_packet_detection_thresh(struct ieee80211_hw *hw)
         }
 
         if (dm_digtable->pre_cck_pd_state != dm_digtable->cur_cck_pd_state) {
-                if (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) {
-                        if (rtlpriv->falsealm_cnt.cnt_cck_fail > 800)
-                                dm_digtable->cur_cck_fa_state =
-                                    CCK_FA_STAGE_High;
-                        else
-                                dm_digtable->cur_cck_fa_state = CCK_FA_STAGE_Low;
-
-                        if (dm_digtable->pre_cck_fa_state !=
-                            dm_digtable->cur_cck_fa_state) {
-                                if (dm_digtable->cur_cck_fa_state ==
-                                    CCK_FA_STAGE_Low)
-                                        rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2,
-                                                      0x83);
-                                else
-                                        rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2,
-                                                      0xcd);
-
-                                dm_digtable->pre_cck_fa_state =
-                                    dm_digtable->cur_cck_fa_state;
-                        }
-
-                        rtl_set_bbreg(hw, RCCK0_SYSTEM, MASKBYTE1, 0x40);
-
-                        if (IS_92C_SERIAL(rtlhal->version))
-                                rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT,
-                                              MASKBYTE2, 0xd7);
-                } else {
+                if ((dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_LowRssi) ||
+                    (dm_digtable->cur_cck_pd_state == CCK_PD_STAGE_MAX))
+                        rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0x83);
+                else
                         rtl_set_bbreg(hw, RCCK0_CCA, MASKBYTE2, 0xcd);
-                        rtl_set_bbreg(hw, RCCK0_SYSTEM, MASKBYTE1, 0x47);
 
-                        if (IS_92C_SERIAL(rtlhal->version))
-                                rtl_set_bbreg(hw, RCCK0_FALSEALARMREPORT,
-                                              MASKBYTE2, 0xd3);
-                }
                 dm_digtable->pre_cck_pd_state = dm_digtable->cur_cck_pd_state;
         }
-
-        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE, "CCKPDStage=%x\n",
-                 dm_digtable->cur_cck_pd_state);
-
-        RT_TRACE(rtlpriv, COMP_DIG, DBG_TRACE, "is92C=%x\n",
-                 IS_92C_SERIAL(rtlhal->version));
 }
 
 static void rtl92c_dm_ctrl_initgain_by_twoport(struct ieee80211_hw *hw)
@@ -482,6 +551,8 @@ static void rtl92c_dm_ctrl_initgain_by_twoport(struct ieee80211_hw *hw)
         else
                 dm_digtable->cursta_cstate = DIG_STA_DISCONNECT;
 
+        dm_digtable->curmultista_cstate = DIG_MULTISTA_DISCONNECT;
+
         rtl92c_dm_initial_gain_sta(hw);
         rtl92c_dm_initial_gain_multi_sta(hw);
         rtl92c_dm_cck_packet_detection_thresh(hw);
@@ -493,23 +564,26 @@ static void rtl92c_dm_ctrl_initgain_by_twoport(struct ieee80211_hw *hw)
 static void rtl92c_dm_dig(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
-        struct dig_t *dm_digtable = &rtlpriv->dm_digtable;
 
         if (rtlpriv->dm.dm_initialgain_enable == false)
                 return;
-        if (dm_digtable->dig_enable_flag == false)
+        if (!(rtlpriv->dm.dm_flag & DYNAMIC_FUNC_DIG))
                 return;
 
         rtl92c_dm_ctrl_initgain_by_twoport(hw);
-
 }
 
 static void rtl92c_dm_init_dynamic_txpower(struct ieee80211_hw *hw)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
-        rtlpriv->dm.dynamic_txpower_enable = false;
-
+        if (rtlpriv->rtlhal.interface == INTF_USB &&
+            rtlpriv->rtlhal.board_type & 0x1) {
+                dm_savepowerindex(hw);
+                rtlpriv->dm.dynamic_txpower_enable = true;
+        } else {
+                rtlpriv->dm.dynamic_txpower_enable = false;
+        }
         rtlpriv->dm.last_dtp_lvl = TXHIGHPWRLEVEL_NORMAL;
         rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_NORMAL;
 }
@@ -524,9 +598,14 @@ void rtl92c_dm_write_dig(struct ieee80211_hw *hw)
                  dm_digtable->cur_igvalue, dm_digtable->pre_igvalue,
                  dm_digtable->back_val);
 
-        dm_digtable->cur_igvalue += 2;
-        if (dm_digtable->cur_igvalue > 0x3f)
-                dm_digtable->cur_igvalue = 0x3f;
+        if (rtlpriv->rtlhal.interface == INTF_USB &&
+            !dm_digtable->dig_enable_flag) {
+                dm_digtable->pre_igvalue = 0x17;
+                return;
+        }
+        dm_digtable->cur_igvalue -= 1;
+        if (dm_digtable->cur_igvalue < DM_DIG_MIN)
+                dm_digtable->cur_igvalue = DM_DIG_MIN;
 
         if (dm_digtable->pre_igvalue != dm_digtable->cur_igvalue) {
                 rtl_set_bbreg(hw, ROFDM0_XAAGCCORE1, 0x7f,
@@ -536,11 +615,47 @@ void rtl92c_dm_write_dig(struct ieee80211_hw *hw)
 
                 dm_digtable->pre_igvalue = dm_digtable->cur_igvalue;
         }
+        RT_TRACE(rtlpriv, COMP_DIG, DBG_WARNING,
+                 "dig values 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
+                 dm_digtable->cur_igvalue, dm_digtable->pre_igvalue,
+                 dm_digtable->rssi_val_min, dm_digtable->back_val,
+                 dm_digtable->rx_gain_max, dm_digtable->rx_gain_min,
+                 dm_digtable->large_fa_hit, dm_digtable->forbidden_igi);
 }
 EXPORT_SYMBOL(rtl92c_dm_write_dig);
 
 static void rtl92c_dm_pwdb_monitor(struct ieee80211_hw *hw)
 {
+        struct rtl_priv *rtlpriv = rtl_priv(hw);
+        struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
+        long tmpentry_max_pwdb = 0, tmpentry_min_pwdb = 0xff;
+
+        if (mac->link_state != MAC80211_LINKED)
+                return;
+
+        if (mac->opmode == NL80211_IFTYPE_ADHOC ||
+            mac->opmode == NL80211_IFTYPE_AP) {
+                /* TODO: Handle ADHOC and AP Mode */
+        }
+
+        if (tmpentry_max_pwdb != 0)
+                rtlpriv->dm.entry_max_undec_sm_pwdb = tmpentry_max_pwdb;
+        else
+                rtlpriv->dm.entry_max_undec_sm_pwdb = 0;
+
+        if (tmpentry_min_pwdb != 0xff)
+                rtlpriv->dm.entry_min_undec_sm_pwdb = tmpentry_min_pwdb;
+        else
+                rtlpriv->dm.entry_min_undec_sm_pwdb = 0;
+
+/* TODO:
+ *      if (mac->opmode == NL80211_IFTYPE_STATION) {
+ *              if (rtlpriv->rtlhal.fw_ready) {
+ *                      u32 param = (u32)(rtlpriv->dm.undec_sm_pwdb << 16);
+ *                      rtl8192c_set_rssi_cmd(hw, param);
+ *              }
+ *      }
+ */
 }
 
 void rtl92c_dm_init_edca_turbo(struct ieee80211_hw *hw)
@@ -750,6 +865,7 @@ static void rtl92c_dm_txpower_tracking_callback_thermalmeter(struct ieee80211_hw
                                 rtlpriv->dm.ofdm_index[i] = ofdm_index_old[i];
                         rtlpriv->dm.cck_index = cck_index_old;
                 }
+                /* Handle USB High PA boards */
 
                 delta = (thermalvalue > rtlpriv->dm.thermalvalue) ?
                     (thermalvalue - rtlpriv->dm.thermalvalue) :
@@ -1140,22 +1256,22 @@ void rtl92c_dm_rf_saving(struct ieee80211_hw *hw, u8 bforce_in_normal)
 {
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct ps_t *dm_pstable = &rtlpriv->dm_pstable;
-        static u8 initialize;
-        static u32 reg_874, reg_c70, reg_85c, reg_a74;
 
-        if (initialize == 0) {
-                reg_874 = (rtl_get_bbreg(hw, RFPGA0_XCD_RFINTERFACESW,
-                                         MASKDWORD) & 0x1CC000) >> 14;
+        if (!rtlpriv->reg_init) {
+                rtlpriv->reg_874 = (rtl_get_bbreg(hw,
+                                                  RFPGA0_XCD_RFINTERFACESW,
+                                                  MASKDWORD) & 0x1CC000) >> 14;
 
-                reg_c70 = (rtl_get_bbreg(hw, ROFDM0_AGCPARAMETER1,
-                                         MASKDWORD) & BIT(3)) >> 3;
+                rtlpriv->reg_c70 = (rtl_get_bbreg(hw, ROFDM0_AGCPARAMETER1,
+                                    MASKDWORD) & BIT(3)) >> 3;
 
-                reg_85c = (rtl_get_bbreg(hw, RFPGA0_XCD_SWITCHCONTROL,
-                                         MASKDWORD) & 0xFF000000) >> 24;
+                rtlpriv->reg_85c = (rtl_get_bbreg(hw, RFPGA0_XCD_SWITCHCONTROL,
+                                    MASKDWORD) & 0xFF000000) >> 24;
 
-                reg_a74 = (rtl_get_bbreg(hw, 0xa74, MASKDWORD) & 0xF000) >> 12;
+                rtlpriv->reg_a74 = (rtl_get_bbreg(hw, 0xa74, MASKDWORD) &
+                                    0xF000) >> 12;
 
-                initialize = 1;
+                rtlpriv->reg_init = true;
         }
 
         if (!bforce_in_normal) {
@@ -1192,12 +1308,12 @@ void rtl92c_dm_rf_saving(struct ieee80211_hw *hw, u8 bforce_in_normal)
                         rtl_set_bbreg(hw, 0x818, BIT(28), 0x1);
                 } else {
                         rtl_set_bbreg(hw, RFPGA0_XCD_RFINTERFACESW,
-                                      0x1CC000, reg_874);
+                                      0x1CC000, rtlpriv->reg_874);
                         rtl_set_bbreg(hw, ROFDM0_AGCPARAMETER1, BIT(3),
-                                      reg_c70);
+                                      rtlpriv->reg_c70);
                         rtl_set_bbreg(hw, RFPGA0_XCD_SWITCHCONTROL, 0xFF000000,
-                                      reg_85c);
-                        rtl_set_bbreg(hw, 0xa74, 0xF000, reg_a74);
+                                      rtlpriv->reg_85c);
+                        rtl_set_bbreg(hw, 0xa74, 0xF000, rtlpriv->reg_a74);
                         rtl_set_bbreg(hw, 0x818, BIT(28), 0x0);
                 }
 
@@ -1213,6 +1329,7 @@ static void rtl92c_dm_dynamic_bb_powersaving(struct ieee80211_hw *hw)
         struct rtl_mac *mac = rtl_mac(rtl_priv(hw));
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
 
+        /* Determine the minimum RSSI */
         if (((mac->link_state == MAC80211_NOLINK)) &&
             (rtlpriv->dm.entry_min_undec_sm_pwdb == 0)) {
                 dm_pstable->rssi_val_min = 0;
@@ -1241,6 +1358,7 @@ static void rtl92c_dm_dynamic_bb_powersaving(struct ieee80211_hw *hw)
                          dm_pstable->rssi_val_min);
         }
 
+        /* Power Saving for 92C */
         if (IS_92C_SERIAL(rtlhal->version))
                 ;/* rtl92c_dm_1r_cca(hw); */
         else
@@ -1252,12 +1370,23 @@ void rtl92c_dm_init(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
 
         rtlpriv->dm.dm_type = DM_TYPE_BYDRIVER;
+        rtlpriv->dm.dm_flag = DYNAMIC_FUNC_DISABLE | DYNAMIC_FUNC_DIG;
+        rtlpriv->dm.undec_sm_pwdb = -1;
+        rtlpriv->dm.undec_sm_cck = -1;
+        rtlpriv->dm.dm_initialgain_enable = true;
         rtl92c_dm_diginit(hw);
+
+        rtlpriv->dm.dm_flag |= HAL_DM_HIPWR_DISABLE;
         rtl92c_dm_init_dynamic_txpower(hw);
+
         rtl92c_dm_init_edca_turbo(hw);
         rtl92c_dm_init_rate_adaptive_mask(hw);
+        rtlpriv->dm.dm_flag |= DYNAMIC_FUNC_SS;
         rtl92c_dm_initialize_txpower_tracking(hw);
         rtl92c_dm_init_dynamic_bb_powersaving(hw);
+
+        rtlpriv->dm.ofdm_pkt_cnt = 0;
+        rtlpriv->dm.dm_rssi_sel = RSSI_DEFAULT;
 }
 EXPORT_SYMBOL(rtl92c_dm_init);
 
@@ -1308,7 +1437,7 @@ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw)
         }
 
         if (undec_sm_pwdb >= TX_POWER_NEAR_FIELD_THRESH_LVL2) {
-                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_LEVEL1;
+                rtlpriv->dm.dynamic_txhighpower_lvl = TXHIGHPWRLEVEL_LEVEL2;
                 RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
                          "TXHIGHPWRLEVEL_LEVEL1 (TxPwr=0x0)\n");
         } else if ((undec_sm_pwdb < (TX_POWER_NEAR_FIELD_THRESH_LVL2 - 3)) &&
@@ -1328,8 +1457,16 @@ void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw)
                          "PHY_SetTxPowerLevel8192S() Channel = %d\n",
                          rtlphy->current_channel);
                 rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
+                if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                    TXHIGHPWRLEVEL_NORMAL)
+                        dm_restorepowerindex(hw);
+                else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                         TXHIGHPWRLEVEL_LEVEL1)
+                        dm_writepowerindex(hw, 0x14);
+                else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                         TXHIGHPWRLEVEL_LEVEL2)
+                        dm_writepowerindex(hw, 0x10);
         }
-
         rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
 }
 
@@ -1400,12 +1537,6 @@ u8 rtl92c_bt_rssi_state_change(struct ieee80211_hw *hw)
         else
                 curr_bt_rssi_state &= (~BT_RSSI_STATE_SPECIAL_LOW);
 
-        /* Set Tx Power according to BT status. */
-        if (undec_sm_pwdb >= 30)
-                curr_bt_rssi_state |=  BT_RSSI_STATE_TXPOWER_LOW;
-        else if (undec_sm_pwdb < 25)
-                curr_bt_rssi_state &= (~BT_RSSI_STATE_TXPOWER_LOW);
-
         /* Check BT state related to BT_Idle in B/G mode. */
         if (undec_sm_pwdb < 15)
                 curr_bt_rssi_state |=  BT_RSSI_STATE_BG_EDCA_LOW;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
index 518e208c0180..4f232a063636 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.h
@@ -91,6 +91,17 @@
 #define TX_POWER_NEAR_FIELD_THRESH_LVL2         74
 #define TX_POWER_NEAR_FIELD_THRESH_LVL1         67
 
+#define DYNAMIC_FUNC_DISABLE                    0x0
+#define DYNAMIC_FUNC_DIG                        BIT(0)
+#define DYNAMIC_FUNC_HP                         BIT(1)
+#define DYNAMIC_FUNC_SS                         BIT(2) /*Tx Power Tracking*/
+#define DYNAMIC_FUNC_BT                         BIT(3)
+#define DYNAMIC_FUNC_ANT_DIV                    BIT(4)
+
+#define RSSI_CCK                                0
+#define RSSI_OFDM                               1
+#define RSSI_DEFAULT                            2
+
 struct swat_t {
         u8 failure_cnt;
         u8 try_flag;
@@ -167,5 +178,8 @@ void rtl92c_phy_lc_calibrate(struct ieee80211_hw *hw);
 void rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw, bool recovery);
 void rtl92c_dm_dynamic_txpower(struct ieee80211_hw *hw);
 void rtl92c_dm_bt_coexist(struct ieee80211_hw *hw);
+void dm_savepowerindex(struct ieee80211_hw *hw);
+void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
+void dm_restorepowerindex(struct ieee80211_hw *hw);
 
 #endif
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 0c0e78263a66..9e32ac8a4425 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -1147,6 +1147,12 @@ static void _rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw,
                 0x522, 0x550, 0x551, 0x040
         };
 
+        u32 iqk_bb_reg_92C[9] = {
+                0xc04, 0xc08, 0x874, 0xb68,
+                0xb6c, 0x870, 0x860, 0x864,
+                0x800
+        };
+
         const u32 retrycount = 2;
 
         if (t == 0) {
@@ -1157,6 +1163,8 @@ static void _rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw,
                                                 rtlphy->adda_backup, 16);
                 _rtl92c_phy_save_mac_registers(hw, iqk_mac_reg,
                                                rtlphy->iqk_mac_backup);
+                _rtl92c_phy_save_adda_registers(hw, iqk_bb_reg_92C,
+                                                rtlphy->iqk_bb_backup, 9);
         }
         _rtl92c_phy_path_adda_on(hw, adda_reg, true, is2t);
         if (t == 0) {
@@ -1167,14 +1175,18 @@ static void _rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw,
 
         if (!rtlphy->rfpi_enable)
                 _rtl92c_phy_pi_mode_switch(hw, true);
-        if (t == 0) {
-                rtlphy->reg_c04 = rtl_get_bbreg(hw, 0xc04, MASKDWORD);
-                rtlphy->reg_c08 = rtl_get_bbreg(hw, 0xc08, MASKDWORD);
-                rtlphy->reg_874 = rtl_get_bbreg(hw, 0x874, MASKDWORD);
-        }
+
+        rtl_set_bbreg(hw, 0x800, BIT(24), 0x0);
+
         rtl_set_bbreg(hw, 0xc04, MASKDWORD, 0x03a05600);
         rtl_set_bbreg(hw, 0xc08, MASKDWORD, 0x000800e4);
         rtl_set_bbreg(hw, 0x874, MASKDWORD, 0x22204000);
+
+        rtl_set_bbreg(hw, 0x870, BIT(10), 0x1);
+        rtl_set_bbreg(hw, 0x870, BIT(26), 0x1);
+        rtl_set_bbreg(hw, 0x860, BIT(10), 0x0);
+        rtl_set_bbreg(hw, 0x864, BIT(10), 0x0);
+
         if (is2t) {
                 rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00010000);
                 rtl_set_bbreg(hw, 0x844, MASKDWORD, 0x00010000);
@@ -1239,13 +1251,9 @@ static void _rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw,
                                         0x3FF0000) >> 16;
                 }
         }
-        rtl_set_bbreg(hw, 0xc04, MASKDWORD, rtlphy->reg_c04);
-        rtl_set_bbreg(hw, 0x874, MASKDWORD, rtlphy->reg_874);
-        rtl_set_bbreg(hw, 0xc08, MASKDWORD, rtlphy->reg_c08);
+
         rtl_set_bbreg(hw, 0xe28, MASKDWORD, 0);
-        rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00032ed3);
-        if (is2t)
-                rtl_set_bbreg(hw, 0x844, MASKDWORD, 0x00032ed3);
+
         if (t != 0) {
                 if (!rtlphy->rfpi_enable)
                         _rtl92c_phy_pi_mode_switch(hw, false);
@@ -1253,6 +1261,15 @@ static void _rtl92c_phy_iq_calibrate(struct ieee80211_hw *hw,
                                                   rtlphy->adda_backup, 16);
                 _rtl92c_phy_reload_mac_registers(hw, iqk_mac_reg,
                                                  rtlphy->iqk_mac_backup);
+                _rtl92c_phy_reload_adda_registers(hw, iqk_bb_reg_92C,
+                                                  rtlphy->iqk_bb_backup, 9);
+
+                rtl_set_bbreg(hw, 0x840, MASKDWORD, 0x00032ed3);
+                if (is2t)
+                        rtl_set_bbreg(hw, 0x844, MASKDWORD, 0x00032ed3);
+
+                rtl_set_bbreg(hw, 0xe30, MASKDWORD, 0x01008c00);
+                rtl_set_bbreg(hw, 0xe34, MASKDWORD, 0x01008c00);
         }
 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
index 16a0b9e59acf..c16209a336ea 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.c
@@ -101,6 +101,15 @@ void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw)
                          "PHY_SetTxPowerLevel8192S() Channel = %d\n",
                          rtlphy->current_channel);
                 rtl92c_phy_set_txpower_level(hw, rtlphy->current_channel);
+                if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                    TXHIGHPWRLEVEL_NORMAL)
+                        dm_restorepowerindex(hw);
+                else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                         TXHIGHPWRLEVEL_LEVEL1)
+                        dm_writepowerindex(hw, 0x14);
+                else if (rtlpriv->dm.dynamic_txhighpower_lvl ==
+                         TXHIGHPWRLEVEL_LEVEL2)
+                        dm_writepowerindex(hw, 0x10);
         }
 
         rtlpriv->dm.last_dtp_lvl = rtlpriv->dm.dynamic_txhighpower_lvl;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
index d947e7d350bb..fafa6bac2a3f 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/dm.h
@@ -30,3 +30,6 @@
 #include "../rtl8192ce/dm.h"
 
 void rtl92cu_dm_dynamic_txpower(struct ieee80211_hw *hw);
+void dm_savepowerindex(struct ieee80211_hw *hw);
+void dm_writepowerindex(struct ieee80211_hw *hw, u8 value);
+void dm_restorepowerindex(struct ieee80211_hw *hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
index 189ba124a8c6..468bf73cc883 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
@@ -1022,7 +1022,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
         if (ppsc->rfpwr_state == ERFON) {
                 rtl92c_phy_set_rfpath_switch(hw, 1);
                 if (iqk_initialized) {
-                        rtl92c_phy_iq_calibrate(hw, false);
+                        rtl92c_phy_iq_calibrate(hw, true);
                 } else {
                         rtl92c_phy_iq_calibrate(hw, false);
                         iqk_initialized = true;
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
index 34e56308301e..0c09240eadcc 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/phy.c
@@ -120,6 +120,7 @@ bool rtl92cu_phy_bb_config(struct ieee80211_hw *hw)
         struct rtl_priv *rtlpriv = rtl_priv(hw);
         struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
         u16 regval;
+        u32 regval32;
         u8 b_reg_hwparafile = 1;
 
         _rtl92c_phy_init_bb_rf_register_definition(hw);
@@ -135,8 +136,11 @@ bool rtl92cu_phy_bb_config(struct ieee80211_hw *hw)
         } else if (IS_HARDWARE_TYPE_8192CU(rtlhal)) {
                 rtl_write_byte(rtlpriv, REG_SYS_FUNC_EN, FEN_USBA | FEN_USBD |
                                FEN_BB_GLB_RSTn | FEN_BBRSTB);
-                rtl_write_byte(rtlpriv, REG_LDOHCI12_CTRL, 0x0f);
         }
+        regval32 = rtl_read_dword(rtlpriv, 0x87c);
+        rtl_write_dword(rtlpriv, 0x87c, regval32 & (~BIT(31)));
+        if (IS_HARDWARE_TYPE_8192CU(rtlhal))
+                rtl_write_byte(rtlpriv, REG_LDOHCI12_CTRL, 0x0f);
         rtl_write_byte(rtlpriv, REG_AFE_XTAL_CTRL + 1, 0x80);
         if (b_reg_hwparafile == 1)
                 rtstatus = _rtl92c_phy_bb8192c_config_parafile(hw);
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
index 2119313a737b..b878d56d2f4d 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/rf.c
@@ -85,17 +85,15 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
         if (mac->act_scanning) {
                 tx_agc[RF90_PATH_A] = 0x3f3f3f3f;
                 tx_agc[RF90_PATH_B] = 0x3f3f3f3f;
-                if (turbo_scanoff) {
-                        for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
-                                tx_agc[idx1] = ppowerlevel[idx1] |
-                                    (ppowerlevel[idx1] << 8) |
-                                    (ppowerlevel[idx1] << 16) |
-                                    (ppowerlevel[idx1] << 24);
-                                if (rtlhal->interface == INTF_USB) {
-                                        if (tx_agc[idx1] > 0x20 &&
-                                            rtlefuse->external_pa)
-                                                tx_agc[idx1] = 0x20;
-                                }
+                for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
+                        tx_agc[idx1] = ppowerlevel[idx1] |
+                            (ppowerlevel[idx1] << 8) |
+                            (ppowerlevel[idx1] << 16) |
+                            (ppowerlevel[idx1] << 24);
+                        if (rtlhal->interface == INTF_USB) {
+                                if (tx_agc[idx1] > 0x20 &&
+                                    rtlefuse->external_pa)
+                                        tx_agc[idx1] = 0x20;
                         }
                 }
         } else {
@@ -107,7 +105,7 @@ void rtl92cu_phy_rf6052_set_cck_txpower(struct ieee80211_hw *hw,
                            TXHIGHPWRLEVEL_LEVEL2) {
                         tx_agc[RF90_PATH_A] = 0x00000000;
                         tx_agc[RF90_PATH_B] = 0x00000000;
-                } else{
+                } else {
                         for (idx1 = RF90_PATH_A; idx1 <= RF90_PATH_B; idx1++) {
                                 tx_agc[idx1] = ppowerlevel[idx1] |
                                     (ppowerlevel[idx1] << 8) |
@@ -373,7 +371,12 @@ static void _rtl92c_write_ofdm_power_reg(struct ieee80211_hw *hw,
                             regoffset == RTXAGC_B_MCS07_MCS04)
                                 regoffset = 0xc98;
                         for (i = 0; i < 3; i++) {
-                                writeVal = (writeVal > 6) ? (writeVal - 6) : 0;
+                                if (i != 2)
+                                        writeVal = (writeVal > 8) ?
+                                                   (writeVal - 8) : 0;
+                                else
+                                        writeVal = (writeVal > 6) ?
+                                                   (writeVal - 6) : 0;
                                 rtl_write_byte(rtlpriv, (u32)(regoffset + i),
                                               (u8)writeVal);
                         }
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index 9936de716ad5..c61311084d7e 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -50,6 +50,9 @@ MODULE_AUTHOR("Larry Finger	<Larry.Finger@lwfinger.net>");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Realtek 8192C/8188C 802.11n USB wireless");
 MODULE_FIRMWARE("rtlwifi/rtl8192cufw.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8192cufw_A.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8192cufw_B.bin");
+MODULE_FIRMWARE("rtlwifi/rtl8192cufw_TMSC.bin");
 
 static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
 {
@@ -69,14 +72,21 @@ static int rtl92cu_init_sw_vars(struct ieee80211_hw *hw)
                          "Can't alloc buffer for fw\n");
                 return 1;
         }
-
+        if (IS_VENDOR_UMC_A_CUT(rtlpriv->rtlhal.version) &&
+            !IS_92C_SERIAL(rtlpriv->rtlhal.version)) {
+                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_A.bin";
+        } else if (IS_81xxC_VENDOR_UMC_B_CUT(rtlpriv->rtlhal.version)) {
+                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_B.bin";
+        } else {
+                rtlpriv->cfg->fw_name = "rtlwifi/rtl8192cufw_TMSC.bin";
+        }
+        /* provide name of alternative file */
+        rtlpriv->cfg->alt_fw_name = "rtlwifi/rtl8192cufw.bin";
         pr_info("Loading firmware %s\n", rtlpriv->cfg->fw_name);
         rtlpriv->max_fw_size = 0x4000;
         err = request_firmware_nowait(THIS_MODULE, 1,
                                       rtlpriv->cfg->fw_name, rtlpriv->io.dev,
                                       GFP_KERNEL, hw, rtl_fw_cb);
-
-
         return err;
 }
 
@@ -307,6 +317,7 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
         {RTL_USB_DEVICE(0x0bda, 0x5088, rtl92cu_hal_cfg)}, /*Thinkware-CC&C*/
         {RTL_USB_DEVICE(0x0df6, 0x0052, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
         {RTL_USB_DEVICE(0x0df6, 0x005c, rtl92cu_hal_cfg)}, /*Sitecom - Edimax*/
+        {RTL_USB_DEVICE(0x0df6, 0x0077, rtl92cu_hal_cfg)}, /*Sitecom-WLA2100V2*/
         {RTL_USB_DEVICE(0x0eb0, 0x9071, rtl92cu_hal_cfg)}, /*NO Brand - Etop*/
         {RTL_USB_DEVICE(0x4856, 0x0091, rtl92cu_hal_cfg)}, /*NetweeN - Feixun*/
         /* HP - Lite-On ,8188CUS Slim Combo */
diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/table.c b/drivers/net/wireless/rtlwifi/rtl8192cu/table.c
index 966be519edb8..7903c154de00 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/table.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/table.c
@@ -36,7 +36,7 @@ u32 RTL8192CUPHY_REG_2TARRAY[RTL8192CUPHY_REG_2TARRAY_LENGTH] = {
         0x804, 0x00000003,
         0x808, 0x0000fc00,
         0x80c, 0x0000000a,
-        0x810, 0x10005388,
+        0x810, 0x10000330,
         0x814, 0x020c3d10,
         0x818, 0x02200385,
         0x81c, 0x00000000,
@@ -110,22 +110,22 @@ u32 RTL8192CUPHY_REG_2TARRAY[RTL8192CUPHY_REG_2TARRAY_LENGTH] = {
         0xc44, 0x000100b7,
         0xc48, 0xec020107,
         0xc4c, 0x007f037f,
-        0xc50, 0x6954341e,
+        0xc50, 0x69543420,
         0xc54, 0x43bc0094,
-        0xc58, 0x6954341e,
+        0xc58, 0x69543420,
         0xc5c, 0x433c0094,
         0xc60, 0x00000000,
         0xc64, 0x5116848b,
         0xc68, 0x47c00bff,
         0xc6c, 0x00000036,
         0xc70, 0x2c7f000d,
-        0xc74, 0x0186115b,
+        0xc74, 0x2186115b,
         0xc78, 0x0000001f,
         0xc7c, 0x00b99612,
         0xc80, 0x40000100,
         0xc84, 0x20f60000,
         0xc88, 0x40000100,
-        0xc8c, 0x20200000,
+        0xc8c, 0xa0e40000,
         0xc90, 0x00121820,
         0xc94, 0x00000000,
         0xc98, 0x00121820,
@@ -226,7 +226,7 @@ u32 RTL8192CUPHY_REG_1TARRAY[RTL8192CUPHY_REG_1TARRAY_LENGTH] = {
         0x804, 0x00000001,
         0x808, 0x0000fc00,
         0x80c, 0x0000000a,
-        0x810, 0x10005388,
+        0x810, 0x10000330,
         0x814, 0x020c3d10,
         0x818, 0x02200385,
         0x81c, 0x00000000,
@@ -300,9 +300,9 @@ u32 RTL8192CUPHY_REG_1TARRAY[RTL8192CUPHY_REG_1TARRAY_LENGTH] = {
         0xc44, 0x000100b7,
         0xc48, 0xec020107,
         0xc4c, 0x007f037f,
-        0xc50, 0x6954341e,
+        0xc50, 0x69543420,
         0xc54, 0x43bc0094,
-        0xc58, 0x6954341e,
+        0xc58, 0x69543420,
         0xc5c, 0x433c0094,
         0xc60, 0x00000000,
         0xc64, 0x5116848b,
@@ -340,7 +340,7 @@ u32 RTL8192CUPHY_REG_1TARRAY[RTL8192CUPHY_REG_1TARRAY_LENGTH] = {
         0xce4, 0x00000000,
         0xce8, 0x37644302,
         0xcec, 0x2f97d40c,
-        0xd00, 0x00080740,
+        0xd00, 0x00000740,
         0xd04, 0x00020401,
         0xd08, 0x0000907f,
         0xd0c, 0x20010201,
@@ -633,17 +633,17 @@ u32 RTL8192CURADIOA_2TARRAY[RTL8192CURADIOA_2TARRAYLENGTH] = {
         0x012, 0x00071000,
         0x012, 0x000b0000,
         0x012, 0x000fc000,
-        0x013, 0x000287af,
+        0x013, 0x000287b3,
         0x013, 0x000244b7,
         0x013, 0x000204ab,
         0x013, 0x0001c49f,
         0x013, 0x00018493,
-        0x013, 0x00014297,
-        0x013, 0x00010295,
-        0x013, 0x0000c298,
-        0x013, 0x0000819c,
-        0x013, 0x000040a8,
-        0x013, 0x0000001c,
+        0x013, 0x0001429b,
+        0x013, 0x00010299,
+        0x013, 0x0000c29c,
+        0x013, 0x000081a0,
+        0x013, 0x000040ac,
+        0x013, 0x00000020,
         0x014, 0x0001944c,
         0x014, 0x00059444,
         0x014, 0x0009944c,
@@ -932,10 +932,10 @@ u32 RTL8192CUMAC_2T_ARRAY[RTL8192CUMAC_2T_ARRAYLENGTH] = {
         0x608, 0x0000000e,
         0x609, 0x0000002a,
         0x652, 0x00000020,
-        0x63c, 0x0000000a,
-        0x63d, 0x0000000e,
-        0x63e, 0x0000000a,
-        0x63f, 0x0000000e,
+        0x63c, 0x00000008,
+        0x63d, 0x00000008,
+        0x63e, 0x0000000c,
+        0x63f, 0x0000000c,
         0x66e, 0x00000005,
         0x700, 0x00000021,
         0x701, 0x00000043,
diff --git a/drivers/net/wireless/rtlwifi/stats.c b/drivers/net/wireless/rtlwifi/stats.c
index 8ed31744a054..4f083fc1d360 100644
--- a/drivers/net/wireless/rtlwifi/stats.c
+++ b/drivers/net/wireless/rtlwifi/stats.c
@@ -176,6 +176,7 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
         struct rtl_sta_info *drv_priv = NULL;
         struct ieee80211_sta *sta = NULL;
         long undec_sm_pwdb;
+        long undec_sm_cck;
 
         rcu_read_lock();
         if (rtlpriv->mac80211.opmode != NL80211_IFTYPE_STATION)
@@ -185,12 +186,16 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
         if (sta) {
                 drv_priv = (struct rtl_sta_info *) sta->drv_priv;
                 undec_sm_pwdb = drv_priv->rssi_stat.undec_sm_pwdb;
+                undec_sm_cck = drv_priv->rssi_stat.undec_sm_cck;
         } else {
                 undec_sm_pwdb = rtlpriv->dm.undec_sm_pwdb;
+                undec_sm_cck = rtlpriv->dm.undec_sm_cck;
         }
 
         if (undec_sm_pwdb < 0)
                 undec_sm_pwdb = pstatus->rx_pwdb_all;
+        if (undec_sm_cck < 0)
+                undec_sm_cck = pstatus->rx_pwdb_all;
         if (pstatus->rx_pwdb_all > (u32) undec_sm_pwdb) {
                 undec_sm_pwdb = (((undec_sm_pwdb) *
                       (RX_SMOOTH_FACTOR - 1)) +
@@ -200,6 +205,15 @@ static void rtl_process_pwdb(struct ieee80211_hw *hw, struct rtl_stats *pstatus)
                 undec_sm_pwdb = (((undec_sm_pwdb) * (RX_SMOOTH_FACTOR - 1)) +
                      (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
         }
+        if (pstatus->rx_pwdb_all > (u32) undec_sm_cck) {
+                undec_sm_cck = (((undec_sm_pwdb) *
+                      (RX_SMOOTH_FACTOR - 1)) +
+                     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+                undec_sm_cck = undec_sm_cck + 1;
+        } else {
+                undec_sm_pwdb = (((undec_sm_cck) * (RX_SMOOTH_FACTOR - 1)) +
+                     (pstatus->rx_pwdb_all)) / (RX_SMOOTH_FACTOR);
+        }
 
         if (sta) {
                 drv_priv->rssi_stat.undec_sm_pwdb = undec_sm_pwdb;
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index 6e2b5c5c83c8..4933f02ce1d5 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -475,14 +475,14 @@ static void _rtl_usb_rx_process_agg(struct ieee80211_hw *hw,
                         rtlpriv->stats.rxbytesunicast +=  skb->len;
                 }
 
-                rtl_is_special_data(hw, skb, false);
-
                 if (ieee80211_is_data(fc)) {
                         rtlpriv->cfg->ops->led_control(hw, LED_CTL_RX);
 
                         if (unicast)
                                 rtlpriv->link_info.num_rx_inperiod++;
                 }
+                /* static bcn for roaming */
+                rtl_beacon_statistic(hw, skb);
         }
 }
 
@@ -517,8 +517,6 @@ static void _rtl_usb_rx_process_noagg(struct ieee80211_hw *hw,
                         rtlpriv->stats.rxbytesunicast +=  skb->len;
                 }
 
-                rtl_is_special_data(hw, skb, false);
-
                 if (ieee80211_is_data(fc)) {
                         rtlpriv->cfg->ops->led_control(hw, LED_CTL_RX);
 
@@ -553,7 +551,7 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         }
 }
 
-#define __RX_SKB_MAX_QUEUED     32
+#define __RX_SKB_MAX_QUEUED     64
 
 static void _rtl_rx_work(unsigned long param)
 {
diff --git a/drivers/net/wireless/rtlwifi/wifi.h b/drivers/net/wireless/rtlwifi/wifi.h
index 0c65386fa30d..8c647391bedf 100644
--- a/drivers/net/wireless/rtlwifi/wifi.h
+++ b/drivers/net/wireless/rtlwifi/wifi.h
@@ -1033,6 +1033,7 @@ struct rtl_ht_agg {
 
 struct rssi_sta {
         long undec_sm_pwdb;
+        long undec_sm_cck;
 };
 
 struct rtl_tid_data {
@@ -1323,8 +1324,10 @@ struct fast_ant_training {
 struct rtl_dm {
         /*PHY status for Dynamic Management */
         long entry_min_undec_sm_pwdb;
+        long undec_sm_cck;
         long undec_sm_pwdb;     /*out dm */
         long entry_max_undec_sm_pwdb;
+        s32 ofdm_pkt_cnt;
         bool dm_initialgain_enable;
         bool dynamic_txpower_enable;
         bool current_turbo_edca;
@@ -1339,6 +1342,7 @@ struct rtl_dm {
         bool inform_fw_driverctrldm;
         bool current_mrc_switch;
         u8 txpowercount;
+        u8 powerindex_backup[6];
 
         u8 thermalvalue_rxgain;
         u8 thermalvalue_iqk;
@@ -1350,7 +1354,9 @@ struct rtl_dm {
         bool done_txpower;
         u8 dynamic_txhighpower_lvl;     /*Tx high power level */
         u8 dm_flag;             /*Indicate each dynamic mechanism's status. */
+        u8 dm_flag_tmp;
         u8 dm_type;
+        u8 dm_rssi_sel;
         u8 txpower_track_control;
         bool interrupt_migration;
         bool disable_tx_int;
@@ -1804,6 +1810,7 @@ struct rtl_hal_cfg {
         bool write_readback;
         char *name;
         char *fw_name;
+        char *alt_fw_name;
         struct rtl_hal_ops *ops;
         struct rtl_mod_params *mod_params;
         struct rtl_hal_usbint_cfg *usb_interface_cfg;
@@ -1948,6 +1955,7 @@ struct dig_t {
         u8 pre_ccastate;
         u8 cur_ccasate;
         u8 large_fa_hit;
+        u8 dig_dynamic_min;
         u8 forbidden_igi;
         u8 dig_state;
         u8 dig_highpwrstate;
@@ -2028,22 +2036,15 @@ struct rtl_priv {
         struct dig_t dm_digtable;
         struct ps_t dm_pstable;
 
-        /* section shared by individual drivers */
-        union {
-                struct {        /* data buffer pointer for USB reads */
-                        __le32 *usb_data;
-                        int usb_data_index;
-                        bool initialized;
-                };
-                struct {        /* section for 8723ae */
-                        bool reg_init;  /* true if regs saved */
-                        u32 reg_874;
-                        u32 reg_c70;
-                        u32 reg_85c;
-                        u32 reg_a74;
-                        bool bt_operation_on;
-                };
-        };
+        u32 reg_874;
+        u32 reg_c70;
+        u32 reg_85c;
+        u32 reg_a74;
+        bool reg_init;  /* true if regs saved */
+        bool bt_operation_on;
+        __le32 *usb_data;
+        int usb_data_index;
+        bool initialized;
         bool enter_ps;  /* true when entering PS */
         u8 rate_mask[5];
 
diff --git a/drivers/net/wireless/ti/wl1251/acx.c b/drivers/net/wireless/ti/wl1251/acx.c
index db6430c1a084..5a4ec56c83d0 100644
--- a/drivers/net/wireless/ti/wl1251/acx.c
+++ b/drivers/net/wireless/ti/wl1251/acx.c
@@ -18,10 +18,8 @@ int wl1251_acx_frame_rates(struct wl1251 *wl, u8 ctrl_rate, u8 ctrl_mod,
         wl1251_debug(DEBUG_ACX, "acx frame rates");
 
         rates = kzalloc(sizeof(*rates), GFP_KERNEL);
-        if (!rates) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!rates)
+                return -ENOMEM;
 
         rates->tx_ctrl_frame_rate = ctrl_rate;
         rates->tx_ctrl_frame_mod = ctrl_mod;
@@ -49,10 +47,8 @@ int wl1251_acx_station_id(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx dot11_station_id");
 
         mac = kzalloc(sizeof(*mac), GFP_KERNEL);
-        if (!mac) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!mac)
+                return -ENOMEM;
 
         for (i = 0; i < ETH_ALEN; i++)
                 mac->mac[i] = wl->mac_addr[ETH_ALEN - 1 - i];
@@ -74,10 +70,8 @@ int wl1251_acx_default_key(struct wl1251 *wl, u8 key_id)
         wl1251_debug(DEBUG_ACX, "acx dot11_default_key (%d)", key_id);
 
         default_key = kzalloc(sizeof(*default_key), GFP_KERNEL);
-        if (!default_key) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!default_key)
+                return -ENOMEM;
 
         default_key->id = key_id;
 
@@ -104,10 +98,8 @@ int wl1251_acx_wake_up_conditions(struct wl1251 *wl, u8 wake_up_event,
         wl1251_debug(DEBUG_ACX, "acx wake up conditions");
 
         wake_up = kzalloc(sizeof(*wake_up), GFP_KERNEL);
-        if (!wake_up) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!wake_up)
+                return -ENOMEM;
 
         wake_up->wake_up_event = wake_up_event;
         wake_up->listen_interval = listen_interval;
@@ -132,16 +124,13 @@ int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth)
         wl1251_debug(DEBUG_ACX, "acx sleep auth");
 
         auth = kzalloc(sizeof(*auth), GFP_KERNEL);
-        if (!auth) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!auth)
+                return -ENOMEM;
 
         auth->sleep_auth = sleep_auth;
 
         ret = wl1251_cmd_configure(wl, ACX_SLEEP_AUTH, auth, sizeof(*auth));
 
-out:
         kfree(auth);
         return ret;
 }
@@ -154,10 +143,8 @@ int wl1251_acx_fw_version(struct wl1251 *wl, char *buf, size_t len)
         wl1251_debug(DEBUG_ACX, "acx fw rev");
 
         rev = kzalloc(sizeof(*rev), GFP_KERNEL);
-        if (!rev) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!rev)
+                return -ENOMEM;
 
         ret = wl1251_cmd_interrogate(wl, ACX_FW_REV, rev, sizeof(*rev));
         if (ret < 0) {
@@ -191,10 +178,8 @@ int wl1251_acx_tx_power(struct wl1251 *wl, int power)
                 return -EINVAL;
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->current_tx_power = power * 10;
 
@@ -209,7 +194,7 @@ out:
         return ret;
 }
 
-int wl1251_acx_feature_cfg(struct wl1251 *wl)
+int wl1251_acx_feature_cfg(struct wl1251 *wl, u32 data_flow_options)
 {
         struct acx_feature_config *feature;
         int ret;
@@ -217,13 +202,11 @@ int wl1251_acx_feature_cfg(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx feature cfg");
 
         feature = kzalloc(sizeof(*feature), GFP_KERNEL);
-        if (!feature) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!feature)
+                return -ENOMEM;
 
-        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE are disabled */
-        feature->data_flow_options = 0;
+        /* DF_ENCRYPTION_DISABLE and DF_SNIFF_MODE_ENABLE can be set */
+        feature->data_flow_options = data_flow_options;
         feature->options = 0;
 
         ret = wl1251_cmd_configure(wl, ACX_FEATURE_CFG,
@@ -261,10 +244,8 @@ int wl1251_acx_data_path_params(struct wl1251 *wl,
         wl1251_debug(DEBUG_ACX, "acx data path params");
 
         params = kzalloc(sizeof(*params), GFP_KERNEL);
-        if (!params) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!params)
+                return -ENOMEM;
 
         params->rx_packet_ring_chunk_size = DP_RX_PACKET_RING_CHUNK_SIZE;
         params->tx_packet_ring_chunk_size = DP_TX_PACKET_RING_CHUNK_SIZE;
@@ -309,10 +290,8 @@ int wl1251_acx_rx_msdu_life_time(struct wl1251 *wl, u32 life_time)
         wl1251_debug(DEBUG_ACX, "acx rx msdu life time");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->lifetime = life_time;
         ret = wl1251_cmd_configure(wl, DOT11_RX_MSDU_LIFE_TIME,
@@ -335,10 +314,8 @@ int wl1251_acx_rx_config(struct wl1251 *wl, u32 config, u32 filter)
         wl1251_debug(DEBUG_ACX, "acx rx config");
 
         rx_config = kzalloc(sizeof(*rx_config), GFP_KERNEL);
-        if (!rx_config) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!rx_config)
+                return -ENOMEM;
 
         rx_config->config_options = config;
         rx_config->filter_options = filter;
@@ -363,10 +340,8 @@ int wl1251_acx_pd_threshold(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx data pd threshold");
 
         pd = kzalloc(sizeof(*pd), GFP_KERNEL);
-        if (!pd) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!pd)
+                return -ENOMEM;
 
         /* FIXME: threshold value not set */
 
@@ -389,10 +364,8 @@ int wl1251_acx_slot(struct wl1251 *wl, enum acx_slot_type slot_time)
         wl1251_debug(DEBUG_ACX, "acx slot");
 
         slot = kzalloc(sizeof(*slot), GFP_KERNEL);
-        if (!slot) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!slot)
+                return -ENOMEM;
 
         slot->wone_index = STATION_WONE_INDEX;
         slot->slot_time = slot_time;
@@ -408,7 +381,8 @@ out:
         return ret;
 }
 
-int wl1251_acx_group_address_tbl(struct wl1251 *wl)
+int wl1251_acx_group_address_tbl(struct wl1251 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len)
 {
         struct acx_dot11_grp_addr_tbl *acx;
         int ret;
@@ -416,15 +390,13 @@ int wl1251_acx_group_address_tbl(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx group address tbl");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         /* MAC filtering */
-        acx->enabled = 0;
-        acx->num_groups = 0;
-        memset(acx->mac_table, 0, ADDRESS_GROUP_MAX_LEN);
+        acx->enabled = enable;
+        acx->num_groups = mc_list_len;
+        memcpy(acx->mac_table, mc_list, mc_list_len * ETH_ALEN);
 
         ret = wl1251_cmd_configure(wl, DOT11_GROUP_ADDRESS_TBL,
                                    acx, sizeof(*acx));
@@ -444,10 +416,8 @@ int wl1251_acx_service_period_timeout(struct wl1251 *wl)
         int ret;
 
         rx_timeout = kzalloc(sizeof(*rx_timeout), GFP_KERNEL);
-        if (!rx_timeout) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!rx_timeout)
+                return -ENOMEM;
 
         wl1251_debug(DEBUG_ACX, "acx service period timeout");
 
@@ -475,10 +445,8 @@ int wl1251_acx_rts_threshold(struct wl1251 *wl, u16 rts_threshold)
         wl1251_debug(DEBUG_ACX, "acx rts threshold");
 
         rts = kzalloc(sizeof(*rts), GFP_KERNEL);
-        if (!rts) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!rts)
+                return -ENOMEM;
 
         rts->threshold = rts_threshold;
 
@@ -501,10 +469,8 @@ int wl1251_acx_beacon_filter_opt(struct wl1251 *wl, bool enable_filter)
         wl1251_debug(DEBUG_ACX, "acx beacon filter opt");
 
         beacon_filter = kzalloc(sizeof(*beacon_filter), GFP_KERNEL);
-        if (!beacon_filter) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!beacon_filter)
+                return -ENOMEM;
 
         beacon_filter->enable = enable_filter;
         beacon_filter->max_num_beacons = 0;
@@ -530,10 +496,8 @@ int wl1251_acx_beacon_filter_table(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx beacon filter table");
 
         ie_table = kzalloc(sizeof(*ie_table), GFP_KERNEL);
-        if (!ie_table) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!ie_table)
+                return -ENOMEM;
 
         /* configure default beacon pass-through rules */
         ie_table->num_ie = 1;
@@ -560,10 +524,8 @@ int wl1251_acx_conn_monit_params(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx connection monitor parameters");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->synch_fail_thold = SYNCH_FAIL_DEFAULT_THRESHOLD;
         acx->bss_lose_timeout = NO_BEACON_DEFAULT_TIMEOUT;
@@ -589,10 +551,8 @@ int wl1251_acx_sg_enable(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx sg enable");
 
         pta = kzalloc(sizeof(*pta), GFP_KERNEL);
-        if (!pta) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!pta)
+                return -ENOMEM;
 
         pta->enable = SG_ENABLE;
 
@@ -615,10 +575,8 @@ int wl1251_acx_sg_cfg(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx sg cfg");
 
         param = kzalloc(sizeof(*param), GFP_KERNEL);
-        if (!param) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!param)
+                return -ENOMEM;
 
         /* BT-WLAN coext parameters */
         param->min_rate = RATE_INDEX_24MBPS;
@@ -669,10 +627,8 @@ int wl1251_acx_cca_threshold(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx cca threshold");
 
         detection = kzalloc(sizeof(*detection), GFP_KERNEL);
-        if (!detection) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!detection)
+                return -ENOMEM;
 
         detection->rx_cca_threshold = CCA_THRSH_DISABLE_ENERGY_D;
         detection->tx_energy_detection = 0;
@@ -682,7 +638,6 @@ int wl1251_acx_cca_threshold(struct wl1251 *wl)
         if (ret < 0)
                 wl1251_warning("failed to set cca threshold: %d", ret);
 
-out:
         kfree(detection);
         return ret;
 }
@@ -695,10 +650,8 @@ int wl1251_acx_bcn_dtim_options(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx bcn dtim options");
 
         bb = kzalloc(sizeof(*bb), GFP_KERNEL);
-        if (!bb) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!bb)
+                return -ENOMEM;
 
         bb->beacon_rx_timeout = BCN_RX_TIMEOUT_DEF_VALUE;
         bb->broadcast_timeout = BROADCAST_RX_TIMEOUT_DEF_VALUE;
@@ -724,10 +677,8 @@ int wl1251_acx_aid(struct wl1251 *wl, u16 aid)
         wl1251_debug(DEBUG_ACX, "acx aid");
 
         acx_aid = kzalloc(sizeof(*acx_aid), GFP_KERNEL);
-        if (!acx_aid) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx_aid)
+                return -ENOMEM;
 
         acx_aid->aid = aid;
 
@@ -750,10 +701,8 @@ int wl1251_acx_event_mbox_mask(struct wl1251 *wl, u32 event_mask)
         wl1251_debug(DEBUG_ACX, "acx event mbox mask");
 
         mask = kzalloc(sizeof(*mask), GFP_KERNEL);
-        if (!mask) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!mask)
+                return -ENOMEM;
 
         /* high event mask is unused */
         mask->high_event_mask = 0xffffffff;
@@ -805,10 +754,8 @@ int wl1251_acx_set_preamble(struct wl1251 *wl, enum acx_preamble_type preamble)
         wl1251_debug(DEBUG_ACX, "acx_set_preamble");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->preamble = preamble;
 
@@ -832,10 +779,8 @@ int wl1251_acx_cts_protect(struct wl1251 *wl,
         wl1251_debug(DEBUG_ACX, "acx_set_ctsprotect");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->ctsprotect = ctsprotect;
 
@@ -856,10 +801,8 @@ int wl1251_acx_tsf_info(struct wl1251 *wl, u64 *mactime)
         int ret;
 
         tsf_info = kzalloc(sizeof(*tsf_info), GFP_KERNEL);
-        if (!tsf_info) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!tsf_info)
+                return -ENOMEM;
 
         ret = wl1251_cmd_interrogate(wl, ACX_TSF_INFO,
                                      tsf_info, sizeof(*tsf_info));
@@ -900,19 +843,22 @@ int wl1251_acx_rate_policies(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx rate policies");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         /* configure one default (one-size-fits-all) rate class */
-        acx->rate_class_cnt = 1;
+        acx->rate_class_cnt = 2;
         acx->rate_class[0].enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
         acx->rate_class[0].short_retry_limit = ACX_RATE_RETRY_LIMIT;
         acx->rate_class[0].long_retry_limit = ACX_RATE_RETRY_LIMIT;
         acx->rate_class[0].aflags = 0;
 
+        /* no-retry rate class */
+        acx->rate_class[1].enabled_rates = ACX_RATE_MASK_UNSPECIFIED;
+        acx->rate_class[1].short_retry_limit = 0;
+        acx->rate_class[1].long_retry_limit = 0;
+        acx->rate_class[1].aflags = 0;
+
         ret = wl1251_cmd_configure(wl, ACX_RATE_POLICY, acx, sizeof(*acx));
         if (ret < 0) {
                 wl1251_warning("Setting of rate policies failed: %d", ret);
@@ -932,10 +878,8 @@ int wl1251_acx_mem_cfg(struct wl1251 *wl)
         wl1251_debug(DEBUG_ACX, "acx mem cfg");
 
         mem_conf = kzalloc(sizeof(*mem_conf), GFP_KERNEL);
-        if (!mem_conf) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!mem_conf)
+                return -ENOMEM;
 
         /* memory config */
         mem_conf->mem_config.num_stations = cpu_to_le16(DEFAULT_NUM_STATIONS);
@@ -979,10 +923,8 @@ int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim)
         wl1251_debug(DEBUG_ACX, "acx tbtt and dtim");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->tbtt = tbtt;
         acx->dtim = dtim;
@@ -1008,10 +950,8 @@ int wl1251_acx_bet_enable(struct wl1251 *wl, enum wl1251_acx_bet_mode mode,
         wl1251_debug(DEBUG_ACX, "acx bet enable");
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->enable = mode;
         acx->max_consecutive = max_consecutive;
@@ -1027,6 +967,32 @@ out:
         return ret;
 }
 
+int wl1251_acx_arp_ip_filter(struct wl1251 *wl, bool enable, __be32 address)
+{
+        struct wl1251_acx_arp_filter *acx;
+        int ret;
+
+        wl1251_debug(DEBUG_ACX, "acx arp ip filter, enable: %d", enable);
+
+        acx = kzalloc(sizeof(*acx), GFP_KERNEL);
+        if (!acx)
+                return -ENOMEM;
+
+        acx->version = ACX_IPV4_VERSION;
+        acx->enable = enable;
+
+        if (enable)
+                memcpy(acx->address, &address, ACX_IPV4_ADDR_SIZE);
+
+        ret = wl1251_cmd_configure(wl, ACX_ARP_IP_FILTER,
+                                   acx, sizeof(*acx));
+        if (ret < 0)
+                wl1251_warning("failed to set arp ip filter: %d", ret);
+
+        kfree(acx);
+        return ret;
+}
+
 int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
                       u8 aifs, u16 txop)
 {
@@ -1037,11 +1003,8 @@ int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
                      "aifs %d txop %d", ac, cw_min, cw_max, aifs, txop);
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->ac = ac;
         acx->cw_min = cw_min;
@@ -1073,11 +1036,8 @@ int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
                      ps_scheme, ack_policy);
 
         acx = kzalloc(sizeof(*acx), GFP_KERNEL);
-
-        if (!acx) {
-                ret = -ENOMEM;
-                goto out;
-        }
+        if (!acx)
+                return -ENOMEM;
 
         acx->queue = queue;
         acx->type = type;
diff --git a/drivers/net/wireless/ti/wl1251/acx.h b/drivers/net/wireless/ti/wl1251/acx.h
index c2ba100f9b1a..2bdec38699f4 100644
--- a/drivers/net/wireless/ti/wl1251/acx.h
+++ b/drivers/net/wireless/ti/wl1251/acx.h
@@ -350,8 +350,8 @@ struct acx_slot {
 } __packed;
 
 
-#define ADDRESS_GROUP_MAX       (8)
-#define ADDRESS_GROUP_MAX_LEN   (ETH_ALEN * ADDRESS_GROUP_MAX)
+#define ACX_MC_ADDRESS_GROUP_MAX        (8)
+#define ACX_MC_ADDRESS_GROUP_MAX_LEN    (ETH_ALEN * ACX_MC_ADDRESS_GROUP_MAX)
 
 struct acx_dot11_grp_addr_tbl {
         struct acx_header header;
@@ -359,7 +359,7 @@ struct acx_dot11_grp_addr_tbl {
         u8 enabled;
         u8 num_groups;
         u8 pad[2];
-        u8 mac_table[ADDRESS_GROUP_MAX_LEN];
+        u8 mac_table[ACX_MC_ADDRESS_GROUP_MAX_LEN];
 } __packed;
 
 
@@ -1232,6 +1232,20 @@ struct wl1251_acx_bet_enable {
         u8 padding[2];
 } __packed;
 
+#define ACX_IPV4_VERSION 4
+#define ACX_IPV6_VERSION 6
+#define ACX_IPV4_ADDR_SIZE 4
+struct wl1251_acx_arp_filter {
+        struct acx_header header;
+        u8 version;     /* The IP version: 4 - IPv4, 6 - IPv6.*/
+        u8 enable;      /* 1 - ARP filtering is enabled, 0 - disabled */
+        u8 padding[2];
+        u8 address[16]; /* The IP address used to filter ARP packets.
+                           ARP packets that do not match this address are
+                           dropped. When the IP Version is 4, the last 12
+                           bytes of the the address are ignored. */
+} __attribute__((packed));
+
 struct wl1251_acx_ac_cfg {
         struct acx_header header;
 
@@ -1440,7 +1454,7 @@ int wl1251_acx_wake_up_conditions(struct wl1251 *wl, u8 wake_up_event,
 int wl1251_acx_sleep_auth(struct wl1251 *wl, u8 sleep_auth);
 int wl1251_acx_fw_version(struct wl1251 *wl, char *buf, size_t len);
 int wl1251_acx_tx_power(struct wl1251 *wl, int power);
-int wl1251_acx_feature_cfg(struct wl1251 *wl);
+int wl1251_acx_feature_cfg(struct wl1251 *wl, u32 data_flow_options);
 int wl1251_acx_mem_map(struct wl1251 *wl,
                        struct acx_header *mem_map, size_t len);
 int wl1251_acx_data_path_params(struct wl1251 *wl,
@@ -1449,7 +1463,8 @@ int wl1251_acx_rx_msdu_life_time(struct wl1251 *wl, u32 life_time);
 int wl1251_acx_rx_config(struct wl1251 *wl, u32 config, u32 filter);
 int wl1251_acx_pd_threshold(struct wl1251 *wl);
 int wl1251_acx_slot(struct wl1251 *wl, enum acx_slot_type slot_time);
-int wl1251_acx_group_address_tbl(struct wl1251 *wl);
+int wl1251_acx_group_address_tbl(struct wl1251 *wl, bool enable,
+                                 void *mc_list, u32 mc_list_len);
 int wl1251_acx_service_period_timeout(struct wl1251 *wl);
 int wl1251_acx_rts_threshold(struct wl1251 *wl, u16 rts_threshold);
 int wl1251_acx_beacon_filter_opt(struct wl1251 *wl, bool enable_filter);
@@ -1473,6 +1488,7 @@ int wl1251_acx_mem_cfg(struct wl1251 *wl);
 int wl1251_acx_wr_tbtt_and_dtim(struct wl1251 *wl, u16 tbtt, u8 dtim);
 int wl1251_acx_bet_enable(struct wl1251 *wl, enum wl1251_acx_bet_mode mode,
                           u8 max_consecutive);
+int wl1251_acx_arp_ip_filter(struct wl1251 *wl, bool enable, __be32 address);
 int wl1251_acx_ac_cfg(struct wl1251 *wl, u8 ac, u8 cw_min, u16 cw_max,
                       u8 aifs, u16 txop);
 int wl1251_acx_tid_cfg(struct wl1251 *wl, u8 queue,
diff --git a/drivers/net/wireless/ti/wl1251/boot.c b/drivers/net/wireless/ti/wl1251/boot.c
index a2e5241382da..2000cd536077 100644
--- a/drivers/net/wireless/ti/wl1251/boot.c
+++ b/drivers/net/wireless/ti/wl1251/boot.c
@@ -299,7 +299,8 @@ int wl1251_boot_run_firmware(struct wl1251 *wl)
                 ROAMING_TRIGGER_LOW_RSSI_EVENT_ID |
                 ROAMING_TRIGGER_REGAINED_RSSI_EVENT_ID |
                 REGAINED_BSS_EVENT_ID | BT_PTA_SENSE_EVENT_ID |
-                BT_PTA_PREDICTION_EVENT_ID | JOIN_EVENT_COMPLETE_ID;
+                BT_PTA_PREDICTION_EVENT_ID | JOIN_EVENT_COMPLETE_ID |
+                PS_REPORT_EVENT_ID;
 
         ret = wl1251_event_unmask(wl);
         if (ret < 0) {
diff --git a/drivers/net/wireless/ti/wl1251/cmd.c b/drivers/net/wireless/ti/wl1251/cmd.c
index 6822b845efc1..223649bcaa5a 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.c
+++ b/drivers/net/wireless/ti/wl1251/cmd.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/crc7.h>
+#include <linux/etherdevice.h>
 
 #include "wl1251.h"
 #include "reg.h"
@@ -203,11 +204,11 @@ out:
         return ret;
 }
 
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable)
 {
         struct cmd_enabledisable_path *cmd;
         int ret;
-        u16 cmd_rx, cmd_tx;
+        u16 cmd_rx;
 
         wl1251_debug(DEBUG_CMD, "cmd data path");
 
@@ -219,13 +220,10 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
 
         cmd->channel = channel;
 
-        if (enable) {
+        if (enable)
                 cmd_rx = CMD_ENABLE_RX;
-                cmd_tx = CMD_ENABLE_TX;
-        } else {
+        else
                 cmd_rx = CMD_DISABLE_RX;
-                cmd_tx = CMD_DISABLE_TX;
-        }
 
         ret = wl1251_cmd_send(wl, cmd_rx, cmd, sizeof(*cmd));
         if (ret < 0) {
@@ -237,17 +235,38 @@ int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable)
         wl1251_debug(DEBUG_BOOT, "rx %s cmd channel %d",
                      enable ? "start" : "stop", channel);
 
+out:
+        kfree(cmd);
+        return ret;
+}
+
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable)
+{
+        struct cmd_enabledisable_path *cmd;
+        int ret;
+        u16 cmd_tx;
+
+        wl1251_debug(DEBUG_CMD, "cmd data path");
+
+        cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
+        if (!cmd)
+                return -ENOMEM;
+
+        cmd->channel = channel;
+
+        if (enable)
+                cmd_tx = CMD_ENABLE_TX;
+        else
+                cmd_tx = CMD_DISABLE_TX;
+
         ret = wl1251_cmd_send(wl, cmd_tx, cmd, sizeof(*cmd));
-        if (ret < 0) {
+        if (ret < 0)
                 wl1251_error("tx %s cmd for channel %d failed",
                              enable ? "start" : "stop", channel);
-                goto out;
-        }
-
-        wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
-                     enable ? "start" : "stop", channel);
+        else
+                wl1251_debug(DEBUG_BOOT, "tx %s cmd channel %d",
+                             enable ? "start" : "stop", channel);
 
-out:
         kfree(cmd);
         return ret;
 }
@@ -410,7 +429,9 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
         struct wl1251_cmd_scan *cmd;
         int i, ret = 0;
 
-        wl1251_debug(DEBUG_CMD, "cmd scan");
+        wl1251_debug(DEBUG_CMD, "cmd scan channels %d", n_channels);
+
+        WARN_ON(n_channels > SCAN_MAX_NUM_OF_CHANNELS);
 
         cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
         if (!cmd)
@@ -421,6 +442,13 @@ int wl1251_cmd_scan(struct wl1251 *wl, u8 *ssid, size_t ssid_len,
                                                     CFG_RX_MGMT_EN |
                                                     CFG_RX_BCN_EN);
         cmd->params.scan_options = 0;
+        /*
+         * Use high priority scan when not associated to prevent fw issue
+         * causing never-ending scans (sometimes 20+ minutes).
+         * Note: This bug may be caused by the fw's DTIM handling.
+         */
+        if (is_zero_ether_addr(wl->bssid))
+                cmd->params.scan_options |= WL1251_SCAN_OPT_PRIORITY_HIGH;
         cmd->params.num_channels = n_channels;
         cmd->params.num_probe_requests = n_probes;
         cmd->params.tx_rate = cpu_to_le16(1 << 1); /* 2 Mbps */
diff --git a/drivers/net/wireless/ti/wl1251/cmd.h b/drivers/net/wireless/ti/wl1251/cmd.h
index ee4f2b391822..d824ff978311 100644
--- a/drivers/net/wireless/ti/wl1251/cmd.h
+++ b/drivers/net/wireless/ti/wl1251/cmd.h
@@ -35,7 +35,8 @@ int wl1251_cmd_interrogate(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_configure(struct wl1251 *wl, u16 id, void *buf, size_t len);
 int wl1251_cmd_vbm(struct wl1251 *wl, u8 identity,
                    void *bitmap, u16 bitmap_len, u8 bitmap_control);
-int wl1251_cmd_data_path(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_rx(struct wl1251 *wl, u8 channel, bool enable);
+int wl1251_cmd_data_path_tx(struct wl1251 *wl, u8 channel, bool enable);
 int wl1251_cmd_join(struct wl1251 *wl, u8 bss_type, u8 channel,
                     u16 beacon_interval, u8 dtim_interval);
 int wl1251_cmd_ps_mode(struct wl1251 *wl, u8 ps_mode);
@@ -167,6 +168,11 @@ struct cmd_read_write_memory {
 #define CMDMBOX_HEADER_LEN 4
 #define CMDMBOX_INFO_ELEM_HEADER_LEN 4
 
+#define WL1251_SCAN_OPT_PASSIVE         1
+#define WL1251_SCAN_OPT_5GHZ_BAND       2
+#define WL1251_SCAN_OPT_TRIGGERD_SCAN   4
+#define WL1251_SCAN_OPT_PRIORITY_HIGH   8
+
 #define WL1251_SCAN_MIN_DURATION 30000
 #define WL1251_SCAN_MAX_DURATION 60000
 
diff --git a/drivers/net/wireless/ti/wl1251/event.c b/drivers/net/wireless/ti/wl1251/event.c
index 74ae8e1c2e33..db0105313745 100644
--- a/drivers/net/wireless/ti/wl1251/event.c
+++ b/drivers/net/wireless/ti/wl1251/event.c
@@ -46,6 +46,43 @@ static int wl1251_event_scan_complete(struct wl1251 *wl,
         return ret;
 }
 
+#define WL1251_PSM_ENTRY_RETRIES  3
+static int wl1251_event_ps_report(struct wl1251 *wl,
+                                  struct event_mailbox *mbox)
+{
+        int ret = 0;
+
+        wl1251_debug(DEBUG_EVENT, "ps status: %x", mbox->ps_status);
+
+        switch (mbox->ps_status) {
+        case EVENT_ENTER_POWER_SAVE_FAIL:
+                wl1251_debug(DEBUG_PSM, "PSM entry failed");
+
+                if (wl->station_mode != STATION_POWER_SAVE_MODE) {
+                        /* remain in active mode */
+                        wl->psm_entry_retry = 0;
+                        break;
+                }
+
+                if (wl->psm_entry_retry < WL1251_PSM_ENTRY_RETRIES) {
+                        wl->psm_entry_retry++;
+                        ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
+                } else {
+                        wl1251_error("Power save entry failed, giving up");
+                        wl->psm_entry_retry = 0;
+                }
+                break;
+        case EVENT_ENTER_POWER_SAVE_SUCCESS:
+        case EVENT_EXIT_POWER_SAVE_FAIL:
+        case EVENT_EXIT_POWER_SAVE_SUCCESS:
+        default:
+                wl->psm_entry_retry = 0;
+                break;
+        }
+
+        return 0;
+}
+
 static void wl1251_event_mbox_dump(struct event_mailbox *mbox)
 {
         wl1251_debug(DEBUG_EVENT, "MBOX DUMP:");
@@ -80,7 +117,14 @@ static int wl1251_event_process(struct wl1251 *wl, struct event_mailbox *mbox)
                 }
         }
 
-        if (vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
+        if (vector & PS_REPORT_EVENT_ID) {
+                wl1251_debug(DEBUG_EVENT, "PS_REPORT_EVENT");
+                ret = wl1251_event_ps_report(wl, mbox);
+                if (ret < 0)
+                        return ret;
+        }
+
+        if (wl->vif && vector & SYNCHRONIZATION_TIMEOUT_EVENT_ID) {
                 wl1251_debug(DEBUG_EVENT, "SYNCHRONIZATION_TIMEOUT_EVENT");
 
                 /* indicate to the stack, that beacons have been lost */
diff --git a/drivers/net/wireless/ti/wl1251/event.h b/drivers/net/wireless/ti/wl1251/event.h
index 30eb5d150bf7..88570a5cd042 100644
--- a/drivers/net/wireless/ti/wl1251/event.h
+++ b/drivers/net/wireless/ti/wl1251/event.h
@@ -112,6 +112,13 @@ struct event_mailbox {
         u8 padding[19];
 } __packed;
 
+enum {
+        EVENT_ENTER_POWER_SAVE_FAIL = 0,
+        EVENT_ENTER_POWER_SAVE_SUCCESS,
+        EVENT_EXIT_POWER_SAVE_FAIL,
+        EVENT_EXIT_POWER_SAVE_SUCCESS,
+};
+
 int wl1251_event_unmask(struct wl1251 *wl);
 void wl1251_event_mbox_config(struct wl1251 *wl);
 int wl1251_event_handle(struct wl1251 *wl, u8 mbox);
diff --git a/drivers/net/wireless/ti/wl1251/init.c b/drivers/net/wireless/ti/wl1251/init.c
index 89b43d35473c..1d799bffaa9f 100644
--- a/drivers/net/wireless/ti/wl1251/init.c
+++ b/drivers/net/wireless/ti/wl1251/init.c
@@ -33,7 +33,7 @@ int wl1251_hw_init_hwenc_config(struct wl1251 *wl)
 {
         int ret;
 
-        ret = wl1251_acx_feature_cfg(wl);
+        ret = wl1251_acx_feature_cfg(wl, 0);
         if (ret < 0) {
                 wl1251_warning("couldn't set feature config");
                 return ret;
@@ -127,7 +127,7 @@ int wl1251_hw_init_phy_config(struct wl1251 *wl)
         if (ret < 0)
                 return ret;
 
-        ret = wl1251_acx_group_address_tbl(wl);
+        ret = wl1251_acx_group_address_tbl(wl, true, NULL, 0);
         if (ret < 0)
                 return ret;
 
@@ -394,8 +394,13 @@ int wl1251_hw_init(struct wl1251 *wl)
         if (ret < 0)
                 goto out_free_data_path;
 
-        /* Enable data path */
-        ret = wl1251_cmd_data_path(wl, wl->channel, 1);
+        /* Enable rx data path */
+        ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+        if (ret < 0)
+                goto out_free_data_path;
+
+        /* Enable tx data path */
+        ret = wl1251_cmd_data_path_tx(wl, wl->channel, 1);
         if (ret < 0)
                 goto out_free_data_path;
 
diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c
index 3291ffa95273..757e25784a8a 100644
--- a/drivers/net/wireless/ti/wl1251/main.c
+++ b/drivers/net/wireless/ti/wl1251/main.c
@@ -28,6 +28,7 @@
 #include <linux/etherdevice.h>
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
+#include <linux/netdevice.h>
 
 #include "wl1251.h"
 #include "wl12xx_80211.h"
@@ -479,10 +480,13 @@ static void wl1251_op_stop(struct ieee80211_hw *hw)
         wl->next_tx_complete = 0;
         wl->elp = false;
         wl->station_mode = STATION_ACTIVE_MODE;
+        wl->psm_entry_retry = 0;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
         wl->rssi_thold = 0;
         wl->channel = WL1251_DEFAULT_CHANNEL;
+        wl->monitor_present = false;
+        wl->joined = false;
 
         wl1251_debugfs_reset(wl);
 
@@ -521,7 +525,7 @@ static int wl1251_op_add_interface(struct ieee80211_hw *hw,
                 goto out;
         }
 
-        if (memcmp(wl->mac_addr, vif->addr, ETH_ALEN)) {
+        if (!ether_addr_equal_unaligned(wl->mac_addr, vif->addr)) {
                 memcpy(wl->mac_addr, vif->addr, ETH_ALEN);
                 SET_IEEE80211_PERM_ADDR(wl->hw, wl->mac_addr);
                 ret = wl1251_acx_station_id(wl);
@@ -542,6 +546,7 @@ static void wl1251_op_remove_interface(struct ieee80211_hw *hw,
         mutex_lock(&wl->mutex);
         wl1251_debug(DEBUG_MAC80211, "mac80211 remove interface");
         wl->vif = NULL;
+        memset(wl->bssid, 0, ETH_ALEN);
         mutex_unlock(&wl->mutex);
 }
 
@@ -566,6 +571,11 @@ static int wl1251_build_qos_null_data(struct wl1251 *wl)
                                        sizeof(template));
 }
 
+static bool wl1251_can_do_pm(struct ieee80211_conf *conf, struct wl1251 *wl)
+{
+        return (conf->flags & IEEE80211_CONF_PS) && !wl->monitor_present;
+}
+
 static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct wl1251 *wl = hw->priv;
@@ -575,8 +585,10 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
         channel = ieee80211_frequency_to_channel(
                         conf->chandef.chan->center_freq);
 
-        wl1251_debug(DEBUG_MAC80211, "mac80211 config ch %d psm %s power %d",
+        wl1251_debug(DEBUG_MAC80211,
+                     "mac80211 config ch %d monitor %s psm %s power %d",
                      channel,
+                     conf->flags & IEEE80211_CONF_MONITOR ? "on" : "off",
                      conf->flags & IEEE80211_CONF_PS ? "on" : "off",
                      conf->power_level);
 
@@ -586,16 +598,44 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
         if (ret < 0)
                 goto out;
 
+        if (changed & IEEE80211_CONF_CHANGE_MONITOR) {
+                u32 mode;
+
+                if (conf->flags & IEEE80211_CONF_MONITOR) {
+                        wl->monitor_present = true;
+                        mode = DF_SNIFF_MODE_ENABLE | DF_ENCRYPTION_DISABLE;
+                } else {
+                        wl->monitor_present = false;
+                        mode = 0;
+                }
+
+                ret = wl1251_acx_feature_cfg(wl, mode);
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         if (channel != wl->channel) {
                 wl->channel = channel;
 
-                ret = wl1251_join(wl, wl->bss_type, wl->channel,
-                                  wl->beacon_int, wl->dtim_period);
+                /*
+                 * Use ENABLE_RX command for channel switching when no
+                 * interface is present (monitor mode only).
+                 * This leaves the tx path disabled in firmware, whereas
+                 * the usual JOIN command seems to transmit some frames
+                 * at firmware level.
+                 */
+                if (wl->vif == NULL) {
+                        wl->joined = false;
+                        ret = wl1251_cmd_data_path_rx(wl, wl->channel, 1);
+                } else {
+                        ret = wl1251_join(wl, wl->bss_type, wl->channel,
+                                          wl->beacon_int, wl->dtim_period);
+                }
                 if (ret < 0)
                         goto out_sleep;
         }
 
-        if (conf->flags & IEEE80211_CONF_PS && !wl->psm_requested) {
+        if (wl1251_can_do_pm(conf, wl) && !wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm enabled");
 
                 wl->psm_requested = true;
@@ -611,8 +651,7 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 ret = wl1251_ps_set_mode(wl, STATION_POWER_SAVE_MODE);
                 if (ret < 0)
                         goto out_sleep;
-        } else if (!(conf->flags & IEEE80211_CONF_PS) &&
-                   wl->psm_requested) {
+        } else if (!wl1251_can_do_pm(conf, wl) && wl->psm_requested) {
                 wl1251_debug(DEBUG_PSM, "psm disabled");
 
                 wl->psm_requested = false;
@@ -648,6 +687,16 @@ static int wl1251_op_config(struct ieee80211_hw *hw, u32 changed)
                 wl->power_level = conf->power_level;
         }
 
+        /*
+         * Tell stack that connection is lost because hw encryption isn't
+         * supported in monitor mode.
+         * This requires temporary enabling of the hw connection monitor flag
+         */
+        if ((changed & IEEE80211_CONF_CHANGE_MONITOR) && wl->vif) {
+                wl->hw->flags |= IEEE80211_HW_CONNECTION_MONITOR;
+                ieee80211_connection_loss(wl->vif);
+        }
+
 out_sleep:
         wl1251_ps_elp_sleep(wl);
 
@@ -657,6 +706,44 @@ out:
         return ret;
 }
 
+struct wl1251_filter_params {
+        bool enabled;
+        int mc_list_length;
+        u8 mc_list[ACX_MC_ADDRESS_GROUP_MAX][ETH_ALEN];
+};
+
+static u64 wl1251_op_prepare_multicast(struct ieee80211_hw *hw,
+                                       struct netdev_hw_addr_list *mc_list)
+{
+        struct wl1251_filter_params *fp;
+        struct netdev_hw_addr *ha;
+        struct wl1251 *wl = hw->priv;
+
+        if (unlikely(wl->state == WL1251_STATE_OFF))
+                return 0;
+
+        fp = kzalloc(sizeof(*fp), GFP_ATOMIC);
+        if (!fp) {
+                wl1251_error("Out of memory setting filters.");
+                return 0;
+        }
+
+        /* update multicast filtering parameters */
+        fp->mc_list_length = 0;
+        if (netdev_hw_addr_list_count(mc_list) > ACX_MC_ADDRESS_GROUP_MAX) {
+                fp->enabled = false;
+        } else {
+                fp->enabled = true;
+                netdev_hw_addr_list_for_each(ha, mc_list) {
+                        memcpy(fp->mc_list[fp->mc_list_length],
+                                        ha->addr, ETH_ALEN);
+                        fp->mc_list_length++;
+                }
+        }
+
+        return (u64)(unsigned long)fp;
+}
+
 #define WL1251_SUPPORTED_FILTERS (FIF_PROMISC_IN_BSS | \
                                   FIF_ALLMULTI | \
                                   FIF_FCSFAIL | \
@@ -667,8 +754,9 @@ out:
 
 static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
                                        unsigned int changed,
-                                       unsigned int *total,u64 multicast)
+                                       unsigned int *total, u64 multicast)
 {
+        struct wl1251_filter_params *fp = (void *)(unsigned long)multicast;
         struct wl1251 *wl = hw->priv;
         int ret;
 
@@ -677,9 +765,11 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
         *total &= WL1251_SUPPORTED_FILTERS;
         changed &= WL1251_SUPPORTED_FILTERS;
 
-        if (changed == 0)
+        if (changed == 0) {
                 /* no filters which we support changed */
+                kfree(fp);
                 return;
+        }
 
         mutex_lock(&wl->mutex);
 
@@ -716,6 +806,15 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if (*total & FIF_ALLMULTI || *total & FIF_PROMISC_IN_BSS)
+                ret = wl1251_acx_group_address_tbl(wl, false, NULL, 0);
+        else if (fp)
+                ret = wl1251_acx_group_address_tbl(wl, fp->enabled,
+                                                   fp->mc_list,
+                                                   fp->mc_list_length);
+        if (ret < 0)
+                goto out;
+
         /* send filters to firmware */
         wl1251_acx_rx_config(wl, wl->rx_config, wl->rx_filter);
 
@@ -723,6 +822,7 @@ static void wl1251_op_configure_filter(struct ieee80211_hw *hw,
 
 out:
         mutex_unlock(&wl->mutex);
+        kfree(fp);
 }
 
 /* HW encryption */
@@ -802,12 +902,12 @@ static int wl1251_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 
         mutex_lock(&wl->mutex);
 
-        ret = wl1251_ps_elp_wakeup(wl);
-        if (ret < 0)
-                goto out_unlock;
-
         switch (cmd) {
         case SET_KEY:
+                if (wl->monitor_present) {
+                        ret = -EOPNOTSUPP;
+                        goto out_unlock;
+                }
                 wl_cmd->key_action = KEY_ADD_OR_REPLACE;
                 break;
         case DISABLE_KEY:
@@ -818,6 +918,10 @@ static int wl1251_op_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
                 break;
         }
 
+        ret = wl1251_ps_elp_wakeup(wl);
+        if (ret < 0)
+                goto out_unlock;
+
         ret = wl1251_set_key_type(wl, wl_cmd, cmd, key, addr);
         if (ret < 0) {
                 wl1251_error("Set KEY type failed");
@@ -930,6 +1034,7 @@ static int wl1251_op_hw_scan(struct ieee80211_hw *hw,
         ret = wl1251_cmd_scan(wl, ssid, ssid_len, req->channels,
                               req->n_channels, WL1251_SCAN_NUM_PROBES);
         if (ret < 0) {
+                wl1251_debug(DEBUG_SCAN, "scan failed %d", ret);
                 wl->scanning = false;
                 goto out_idle;
         }
@@ -977,6 +1082,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
 {
         struct wl1251 *wl = hw->priv;
         struct sk_buff *beacon, *skb;
+        bool enable;
         int ret;
 
         wl1251_debug(DEBUG_MAC80211, "mac80211 bss info changed");
@@ -1023,6 +1129,9 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
         }
 
         if (changed & BSS_CHANGED_ASSOC) {
+                /* Disable temporary enabled hw connection monitor flag */
+                wl->hw->flags &= ~IEEE80211_HW_CONNECTION_MONITOR;
+
                 if (bss_conf->assoc) {
                         wl->beacon_int = bss_conf->beacon_int;
 
@@ -1075,6 +1184,17 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw,
                 }
         }
 
+        if (changed & BSS_CHANGED_ARP_FILTER) {
+                __be32 addr = bss_conf->arp_addr_list[0];
+                WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS);
+
+                enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc;
+                wl1251_acx_arp_ip_filter(wl, enable, addr);
+
+                if (ret < 0)
+                        goto out_sleep;
+        }
+
         if (changed & BSS_CHANGED_BEACON) {
                 beacon = ieee80211_beacon_get(hw, vif);
                 if (!beacon)
@@ -1245,6 +1365,7 @@ static const struct ieee80211_ops wl1251_ops = {
         .add_interface = wl1251_op_add_interface,
         .remove_interface = wl1251_op_remove_interface,
         .config = wl1251_op_config,
+        .prepare_multicast = wl1251_op_prepare_multicast,
         .configure_filter = wl1251_op_configure_filter,
         .tx = wl1251_op_tx,
         .set_key = wl1251_op_set_key,
@@ -1347,7 +1468,6 @@ int wl1251_init_ieee80211(struct wl1251 *wl)
 
         /* unit us */
         /* FIXME: find a proper value */
-        wl->hw->channel_change_time = 10000;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
@@ -1401,7 +1521,10 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
 
         INIT_DELAYED_WORK(&wl->elp_work, wl1251_elp_work);
         wl->channel = WL1251_DEFAULT_CHANNEL;
+        wl->monitor_present = false;
+        wl->joined = false;
         wl->scanning = false;
+        wl->bss_type = MAX_BSS_TYPE;
         wl->default_key = 0;
         wl->listen_int = 1;
         wl->rx_counter = 0;
@@ -1413,6 +1536,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void)
         wl->elp = false;
         wl->station_mode = STATION_ACTIVE_MODE;
         wl->psm_requested = false;
+        wl->psm_entry_retry = 0;
         wl->tx_queue_stopped = false;
         wl->power_level = WL1251_DEFAULT_POWER_LEVEL;
         wl->rssi_thold = 0;
@@ -1478,3 +1602,4 @@ MODULE_DESCRIPTION("TI wl1251 Wireles LAN Driver Core");
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Kalle Valo <kvalo@adurom.com>");
 MODULE_FIRMWARE(WL1251_FW_NAME);
+MODULE_FIRMWARE(WL1251_NVS_NAME);
diff --git a/drivers/net/wireless/ti/wl1251/rx.c b/drivers/net/wireless/ti/wl1251/rx.c
index 23289d49dd31..123c4bb50e0a 100644
--- a/drivers/net/wireless/ti/wl1251/rx.c
+++ b/drivers/net/wireless/ti/wl1251/rx.c
@@ -83,7 +83,7 @@ static void wl1251_rx_status(struct wl1251 *wl,
 
         status->flag |= RX_FLAG_MACTIME_START;
 
-        if (desc->flags & RX_DESC_ENCRYPTION_MASK) {
+        if (!wl->monitor_present && (desc->flags & RX_DESC_ENCRYPTION_MASK)) {
                 status->flag |= RX_FLAG_IV_STRIPPED | RX_FLAG_MMIC_STRIPPED;
 
                 if (likely(!(desc->flags & RX_DESC_DECRYPT_FAIL)))
diff --git a/drivers/net/wireless/ti/wl1251/tx.c b/drivers/net/wireless/ti/wl1251/tx.c
index 28121c590a2b..81de83c6fcf6 100644
--- a/drivers/net/wireless/ti/wl1251/tx.c
+++ b/drivers/net/wireless/ti/wl1251/tx.c
@@ -28,6 +28,7 @@
 #include "tx.h"
 #include "ps.h"
 #include "io.h"
+#include "event.h"
 
 static bool wl1251_tx_double_buffer_busy(struct wl1251 *wl, u32 data_out_count)
 {
@@ -89,8 +90,12 @@ static void wl1251_tx_control(struct tx_double_buffer_desc *tx_hdr,
         /* 802.11 packets */
         tx_hdr->control.packet_type = 0;
 
-        if (control->flags & IEEE80211_TX_CTL_NO_ACK)
+        /* Also disable retry and ACK policy for injected packets */
+        if ((control->flags & IEEE80211_TX_CTL_NO_ACK) ||
+            (control->flags & IEEE80211_TX_CTL_INJECTED)) {
+                tx_hdr->control.rate_policy = 1;
                 tx_hdr->control.ack_policy = 1;
+        }
 
         tx_hdr->control.tx_complete = 1;
 
@@ -277,6 +282,26 @@ static void wl1251_tx_trigger(struct wl1251 *wl)
                 TX_STATUS_DATA_OUT_COUNT_MASK;
 }
 
+static void enable_tx_for_packet_injection(struct wl1251 *wl)
+{
+        int ret;
+
+        ret = wl1251_cmd_join(wl, BSS_TYPE_STA_BSS, wl->channel,
+                              wl->beacon_int, wl->dtim_period);
+        if (ret < 0) {
+                wl1251_warning("join failed");
+                return;
+        }
+
+        ret = wl1251_event_wait(wl, JOIN_EVENT_COMPLETE_ID, 100);
+        if (ret < 0) {
+                wl1251_warning("join timeout");
+                return;
+        }
+
+        wl->joined = true;
+}
+
 /* caller must hold wl->mutex */
 static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
 {
@@ -287,6 +312,9 @@ static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
         info = IEEE80211_SKB_CB(skb);
 
         if (info->control.hw_key) {
+                if (unlikely(wl->monitor_present))
+                        return -EINVAL;
+
                 idx = info->control.hw_key->hw_key_idx;
                 if (unlikely(wl->default_key != idx)) {
                         ret = wl1251_acx_default_key(wl, idx);
@@ -295,6 +323,10 @@ static int wl1251_tx_frame(struct wl1251 *wl, struct sk_buff *skb)
                 }
         }
 
+        /* Enable tx path in monitor mode for packet injection */
+        if ((wl->vif == NULL) && !wl->joined)
+                enable_tx_for_packet_injection(wl);
+
         ret = wl1251_tx_path_status(wl);
         if (ret < 0)
                 return ret;
@@ -394,6 +426,7 @@ static void wl1251_tx_packet_cb(struct wl1251 *wl,
         info = IEEE80211_SKB_CB(skb);
 
         if (!(info->flags & IEEE80211_TX_CTL_NO_ACK) &&
+            !(info->flags & IEEE80211_TX_CTL_INJECTED) &&
             (result->status == TX_SUCCESS))
                 info->flags |= IEEE80211_TX_STAT_ACK;
 
diff --git a/drivers/net/wireless/ti/wl1251/wl1251.h b/drivers/net/wireless/ti/wl1251/wl1251.h
index 2c3bd1bff3f6..235617a7716d 100644
--- a/drivers/net/wireless/ti/wl1251/wl1251.h
+++ b/drivers/net/wireless/ti/wl1251/wl1251.h
@@ -93,6 +93,7 @@ enum {
         } while (0)
 
 #define WL1251_DEFAULT_RX_CONFIG (CFG_UNI_FILTER_EN |   \
+                                  CFG_MC_FILTER_EN |    \
                                   CFG_BSSID_FILTER_EN)
 
 #define WL1251_DEFAULT_RX_FILTER (CFG_RX_PRSP_EN |  \
@@ -303,6 +304,8 @@ struct wl1251 {
         u8 bss_type;
         u8 listen_int;
         int channel;
+        bool monitor_present;
+        bool joined;
 
         void *target_mem_map;
         struct acx_data_path_params_resp *data_path;
@@ -368,6 +371,9 @@ struct wl1251 {
         /* PSM mode requested */
         bool psm_requested;
 
+        /* retry counter for PSM entries */
+        u8 psm_entry_retry;
+
         u16 beacon_int;
         u8 dtim_period;
 
diff --git a/drivers/net/wireless/ti/wl12xx/scan.c b/drivers/net/wireless/ti/wl12xx/scan.c
index 4a0bbb13806b..7541bd1a4a4b 100644
--- a/drivers/net/wireless/ti/wl12xx/scan.c
+++ b/drivers/net/wireless/ti/wl12xx/scan.c
@@ -47,7 +47,7 @@ static int wl1271_get_scan_channels(struct wl1271 *wl,
                      * In active scans, we only scan channels not
                      * marked as passive.
                      */
-                    (passive || !(flags & IEEE80211_CHAN_PASSIVE_SCAN))) {
+                    (passive || !(flags & IEEE80211_CHAN_NO_IR))) {
                         wl1271_debug(DEBUG_SCAN, "band %d, center_freq %d ",
                                      req->channels[i]->band,
                                      req->channels[i]->center_freq);
diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
index 34d9dfff2ad3..9b2ecf52449f 100644
--- a/drivers/net/wireless/ti/wlcore/cmd.c
+++ b/drivers/net/wireless/ti/wlcore/cmd.c
@@ -1688,7 +1688,7 @@ int wlcore_cmd_regdomain_config_locked(struct wl1271 *wl)
 
                         if (channel->flags & (IEEE80211_CHAN_DISABLED |
                                               IEEE80211_CHAN_RADAR |
-                                              IEEE80211_CHAN_PASSIVE_SCAN))
+                                              IEEE80211_CHAN_NO_IR))
                                 continue;
 
                         ch_bit_idx = wlcore_get_reg_conf_ch_idx(b, ch);
diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
index 0368b9cbfb89..b46b3116cc55 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -91,8 +91,7 @@ static void wl1271_reg_notify(struct wiphy *wiphy,
                         continue;
 
                 if (ch->flags & IEEE80211_CHAN_RADAR)
-                        ch->flags |= IEEE80211_CHAN_NO_IBSS |
-                                     IEEE80211_CHAN_PASSIVE_SCAN;
+                        ch->flags |= IEEE80211_CHAN_NO_IR;
 
         }
 
@@ -4458,6 +4457,16 @@ static void wl1271_op_bss_info_changed(struct ieee80211_hw *hw,
         if (ret < 0)
                 goto out;
 
+        if ((changed & BSS_CHANGED_TXPOWER) &&
+            bss_conf->txpower != wlvif->power_level) {
+
+                ret = wl1271_acx_tx_power(wl, wlvif, bss_conf->txpower);
+                if (ret < 0)
+                        goto out;
+
+                wlvif->power_level = bss_conf->txpower;
+        }
+
         if (is_ap)
                 wl1271_bss_info_changed_ap(wl, vif, bss_conf, changed);
         else
@@ -5711,7 +5720,6 @@ static int wl1271_init_ieee80211(struct wl1271 *wl)
 
         /* unit us */
         /* FIXME: find a proper value */
-        wl->hw->channel_change_time = 10000;
         wl->hw->max_listen_interval = wl->conf.conn.max_listen_interval;
 
         wl->hw->flags = IEEE80211_HW_SIGNAL_DBM |
diff --git a/drivers/net/wireless/ti/wlcore/scan.c b/drivers/net/wireless/ti/wlcore/scan.c
index 7ed86203304b..1e3d51cd673a 100644
--- a/drivers/net/wireless/ti/wlcore/scan.c
+++ b/drivers/net/wireless/ti/wlcore/scan.c
@@ -188,16 +188,14 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                 flags = req_channels[i]->flags;
 
                 if (force_passive)
-                        flags |= IEEE80211_CHAN_PASSIVE_SCAN;
+                        flags |= IEEE80211_CHAN_NO_IR;
 
                 if ((req_channels[i]->band == band) &&
                     !(flags & IEEE80211_CHAN_DISABLED) &&
                     (!!(flags & IEEE80211_CHAN_RADAR) == radar) &&
                     /* if radar is set, we ignore the passive flag */
                     (radar ||
-                     !!(flags & IEEE80211_CHAN_PASSIVE_SCAN) == passive)) {
-
-
+                     !!(flags & IEEE80211_CHAN_NO_IR) == passive)) {
                         if (flags & IEEE80211_CHAN_RADAR) {
                                 channels[j].flags |= SCAN_CHANNEL_FLAGS_DFS;
 
@@ -220,7 +218,7 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                             (band == IEEE80211_BAND_2GHZ) &&
                             (channels[j].channel >= 12) &&
                             (channels[j].channel <= 14) &&
-                            (flags & IEEE80211_CHAN_PASSIVE_SCAN) &&
+                            (flags & IEEE80211_CHAN_NO_IR) &&
                             !force_passive) {
                                 /* pactive channels treated as DFS */
                                 channels[j].flags = SCAN_CHANNEL_FLAGS_DFS;
@@ -243,8 +241,8 @@ wlcore_scan_get_channels(struct wl1271 *wl,
                                      max_dwell_time_active,
                                      flags & IEEE80211_CHAN_RADAR ?
                                         ", DFS" : "",
-                                     flags & IEEE80211_CHAN_PASSIVE_SCAN ?
-                                        ", PASSIVE" : "");
+                                     flags & IEEE80211_CHAN_NO_IR ?
+                                        ", NO-IR" : "");
                         j++;
                 }
         }
diff --git a/drivers/net/wireless/wl3501_cs.c b/drivers/net/wireless/wl3501_cs.c
index 38d2089f338a..d24d4a958c67 100644
--- a/drivers/net/wireless/wl3501_cs.c
+++ b/drivers/net/wireless/wl3501_cs.c
@@ -29,7 +29,6 @@
 
 #include <linux/delay.h>
 #include <linux/types.h>
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
@@ -44,6 +43,7 @@
 #include <linux/string.h>
 #include <linux/wireless.h>
 #include <linux/ieee80211.h>
+#include <linux/etherdevice.h>
 
 #include <net/iw_handler.h>
 
@@ -673,8 +673,7 @@ static void wl3501_mgmt_scan_confirm(struct wl3501_card *this, u16 addr)
                                 matchflag = 1;
                         if (matchflag) {
                                 for (i = 0; i < this->bss_cnt; i++) {
-                                        if (!memcmp(this->bss_set[i].bssid,
-                                                    sig.bssid, ETH_ALEN)) {
+                                        if (ether_addr_equal_unaligned(this->bss_set[i].bssid, sig.bssid)) {
                                                 matchflag = 0;
                                                 break;
                                         }
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index 71ab320fae82..73a49b868035 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 /* This file implements all the hardware specific functions for the ZD1211
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 7ab922209b25..b03786c9f3aa 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _ZD_CHIP_H
diff --git a/drivers/net/wireless/zd1211rw/zd_def.h b/drivers/net/wireless/zd1211rw/zd_def.h
index 9a1b013f81be..41bd755bc135 100644
--- a/drivers/net/wireless/zd1211rw/zd_def.h
+++ b/drivers/net/wireless/zd1211rw/zd_def.h
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _ZD_DEF_H
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index c6208a7988e4..e7af261e9198 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -16,8 +16,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/netdevice.h>
@@ -533,9 +532,8 @@ void zd_mac_tx_failed(struct urb *urb)
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
 
                 /* we skip all frames not matching the reported destination */
-                if (unlikely(memcmp(tx_hdr->addr1, tx_status->mac, ETH_ALEN))) {
+                if (unlikely(!ether_addr_equal(tx_hdr->addr1, tx_status->mac)))
                         continue;
-                }
 
                 /* we skip all frames not matching the reported final rate */
 
@@ -998,7 +996,7 @@ static int filter_ack(struct ieee80211_hw *hw, struct ieee80211_hdr *rx_hdr,
                     continue;
 
                 tx_hdr = (struct ieee80211_hdr *)skb->data;
-                if (likely(!memcmp(tx_hdr->addr2, rx_hdr->addr1, ETH_ALEN)))
+                if (likely(ether_addr_equal(tx_hdr->addr2, rx_hdr->addr1)))
                 {
                         found = 1;
                         break;
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index c01eca859f95..5a484235308f 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _ZD_MAC_H
diff --git a/drivers/net/wireless/zd1211rw/zd_rf.c b/drivers/net/wireless/zd1211rw/zd_rf.c
index c875ee05e22e..dc179c414518 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/errno.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_rf.h b/drivers/net/wireless/zd1211rw/zd_rf.h
index 725b7c99b23d..8f14e25e1041 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf.h
+++ b/drivers/net/wireless/zd1211rw/zd_rf.h
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _ZD_RF_H
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_al2230.c b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
index 12babcb633c3..99aed7d78952 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_al2230.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_al7230b.c b/drivers/net/wireless/zd1211rw/zd_rf_al7230b.c
index 385c670d1293..5fea485be574 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_al7230b.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_al7230b.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c b/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
index 784d9ccb8fef..a93f657a41c7 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_rf2959.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
index c4d324e19c24..61b924027356 100644
--- a/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
+++ b/drivers/net/wireless/zd1211rw/zd_rf_uw2453.c
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 84d94f572a46..a912dc051111 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -15,8 +15,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.h b/drivers/net/wireless/zd1211rw/zd_usb.h
index 45e3bb28a01c..a9075f225178 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.h
+++ b/drivers/net/wireless/zd1211rw/zd_usb.h
@@ -14,8 +14,7 @@
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
 #ifndef _ZD_USB_H