Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6.26

54 files changed, 3832 insertions, 2466 deletions

diff --git a/drivers/net/wireless/ath5k/ath5k.h b/drivers/net/wireless/ath5k/ath5k.h
index 18223d9833f1..b21830771ea5 100644
--- a/drivers/net/wireless/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath5k/ath5k.h
@@ -140,7 +140,8 @@ enum ath5k_radio {
         AR5K_RF5110     = 0,
         AR5K_RF5111     = 1,
         AR5K_RF5112     = 2,
-        AR5K_RF5413     = 3,
+        AR5K_RF2413     = 3,
+        AR5K_RF5413     = 4,
 };
 
 /*
@@ -168,12 +169,15 @@ struct ath5k_srev_name {
 #define AR5K_SREV_VER_AR5212    0x50
 #define AR5K_SREV_VER_AR5213    0x55
 #define AR5K_SREV_VER_AR5213A   0x59
-#define AR5K_SREV_VER_AR2424    0xa0
-#define AR5K_SREV_VER_AR5424    0xa3
+#define AR5K_SREV_VER_AR2413    0x78
+#define AR5K_SREV_VER_AR2414    0x79
+#define AR5K_SREV_VER_AR2424    0xa0 /* PCI-E */
+#define AR5K_SREV_VER_AR5424    0xa3 /* PCI-E */
 #define AR5K_SREV_VER_AR5413    0xa4
 #define AR5K_SREV_VER_AR5414    0xa5
-#define AR5K_SREV_VER_AR5416    0xc0    /* ? */
-#define AR5K_SREV_VER_AR5418    0xca
+#define AR5K_SREV_VER_AR5416    0xc0 /* PCI-E */
+#define AR5K_SREV_VER_AR5418    0xca /* PCI-E */
+#define AR5K_SREV_VER_AR2425    0xe2 /* PCI-E */
 
 #define AR5K_SREV_RAD_5110      0x00
 #define AR5K_SREV_RAD_5111      0x10
@@ -183,8 +187,9 @@ struct ath5k_srev_name {
 #define AR5K_SREV_RAD_5112A     0x35
 #define AR5K_SREV_RAD_2112      0x40
 #define AR5K_SREV_RAD_2112A     0x45
+#define AR5K_SREV_RAD_SC0       0x56    /* Found on 2413/2414 */
 #define AR5K_SREV_RAD_SC1       0x63    /* Found on 5413/5414 */
-#define AR5K_SREV_RAD_SC2       0xa2    /* Found on 2424/5424 */
+#define AR5K_SREV_RAD_SC2       0xa2    /* Found on 2424-5/5424 */
 #define AR5K_SREV_RAD_5133      0xc0    /* MIMO found on 5418 */
 
 /* IEEE defs */
@@ -268,12 +273,13 @@ enum ath5k_driver_mode {
 #define SHPREAMBLE_FLAG(_ix) \
         (HAS_SHPREAMBLE(_ix) ? AR5K_SET_SHORT_PREAMBLE : 0)
 
+
 /****************\
   TX DEFINITIONS
 \****************/
 
 /*
- * Tx Descriptor
+ * TX Status
  */
 struct ath5k_tx_status {
         u16     ts_seqnum;
@@ -421,7 +427,7 @@ enum ath5k_dmasize {
 \****************/
 
 /*
- * Rx Descriptor
+ * RX Status
  */
 struct ath5k_rx_status {
         u16     rs_datalen;
@@ -452,8 +458,6 @@ struct ath5k_mib_stats {
 };
 
 
-
-
 /**************************\
  BEACON TIMERS DEFINITIONS
 \**************************/
@@ -495,29 +499,23 @@ struct ath5k_beacon_state {
 #define TSF_TO_TU(_tsf) (u32)((_tsf) >> 10)
 
 
-
 /********************\
   COMMON DEFINITIONS
 \********************/
 
 /*
- * Atheros descriptor
+ * Atheros hardware descriptor
+ * This is read and written to by the hardware
  */
 struct ath5k_desc {
-        u32     ds_link;
-        u32     ds_data;
-        u32     ds_ctl0;
-        u32     ds_ctl1;
-        u32     ds_hw[4];
+        u32     ds_link;        /* physical address of the next descriptor */
+        u32     ds_data;        /* physical address of data buffer (skb) */
 
         union {
-                struct ath5k_rx_status rx;
-                struct ath5k_tx_status tx;
-        } ds_us;
-
-#define ds_rxstat ds_us.rx
-#define ds_txstat ds_us.tx
-
+                struct ath5k_hw_5210_tx_desc    ds_tx5210;
+                struct ath5k_hw_5212_tx_desc    ds_tx5212;
+                struct ath5k_hw_all_rx_desc     ds_rx;
+        } ud;
 } __packed;
 
 #define AR5K_RXDESC_INTREQ      0x0020
@@ -961,6 +959,7 @@ struct ath5k_hw {
         u16                     ah_phy_revision;
         u16                     ah_radio_5ghz_revision;
         u16                     ah_radio_2ghz_revision;
+        u32                     ah_phy_spending;
 
         enum ath5k_version      ah_version;
         enum ath5k_radio        ah_radio;
@@ -1036,8 +1035,10 @@ struct ath5k_hw {
         int (*ah_setup_xtx_desc)(struct ath5k_hw *, struct ath5k_desc *,
                 unsigned int, unsigned int, unsigned int, unsigned int,
                 unsigned int, unsigned int);
-        int (*ah_proc_tx_desc)(struct ath5k_hw *, struct ath5k_desc *);
-        int (*ah_proc_rx_desc)(struct ath5k_hw *, struct ath5k_desc *);
+        int (*ah_proc_tx_desc)(struct ath5k_hw *, struct ath5k_desc *,
+                struct ath5k_tx_status *);
+        int (*ah_proc_rx_desc)(struct ath5k_hw *, struct ath5k_desc *,
+                struct ath5k_rx_status *);
 };
 
 /*
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 393b5f3c25a7..b5c0a0d7a81c 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -118,6 +118,8 @@ static struct ath5k_srev_name srev_names[] = {
         { "5212",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR5212 },
         { "5213",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR5213 },
         { "5213A",      AR5K_VERSION_VER,       AR5K_SREV_VER_AR5213A },
+        { "2413",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR2413 },
+        { "2414",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR2414 },
         { "2424",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR2424 },
         { "5424",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR5424 },
         { "5413",       AR5K_VERSION_VER,       AR5K_SREV_VER_AR5413 },
@@ -132,6 +134,7 @@ static struct ath5k_srev_name srev_names[] = {
         { "5112A",      AR5K_VERSION_RAD,       AR5K_SREV_RAD_5112A },
         { "2112",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_2112 },
         { "2112A",      AR5K_VERSION_RAD,       AR5K_SREV_RAD_2112A },
+        { "SChip",      AR5K_VERSION_RAD,       AR5K_SREV_RAD_SC0 },
         { "SChip",      AR5K_VERSION_RAD,       AR5K_SREV_RAD_SC1 },
         { "SChip",      AR5K_VERSION_RAD,       AR5K_SREV_RAD_SC2 },
         { "5133",       AR5K_VERSION_RAD,       AR5K_SREV_RAD_5133 },
@@ -280,7 +283,8 @@ static int 	ath5k_rx_start(struct ath5k_softc *sc);
 static void     ath5k_rx_stop(struct ath5k_softc *sc);
 static unsigned int ath5k_rx_decrypted(struct ath5k_softc *sc,
                                         struct ath5k_desc *ds,
-                                        struct sk_buff *skb);
+                                        struct sk_buff *skb,
+                                        struct ath5k_rx_status *rs);
 static void     ath5k_tasklet_rx(unsigned long data);
 /* Tx handling */
 static void     ath5k_tx_processq(struct ath5k_softc *sc,
@@ -1560,8 +1564,7 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
          */
         spin_lock_bh(&txq->lock);
         list_for_each_entry_safe(bf, bf0, &txq->q, list) {
-                ath5k_debug_printtxbuf(sc, bf, !sc->ah->ah_proc_tx_desc(sc->ah,
-                                        bf->desc));
+                ath5k_debug_printtxbuf(sc, bf);
 
                 ath5k_txbuf_free(sc, bf);
 
@@ -1686,20 +1689,20 @@ ath5k_rx_stop(struct ath5k_softc *sc)
 
 static unsigned int
 ath5k_rx_decrypted(struct ath5k_softc *sc, struct ath5k_desc *ds,
-                struct sk_buff *skb)
+                struct sk_buff *skb, struct ath5k_rx_status *rs)
 {
         struct ieee80211_hdr *hdr = (void *)skb->data;
         unsigned int keyix, hlen = ieee80211_get_hdrlen_from_skb(skb);
 
-        if (!(ds->ds_rxstat.rs_status & AR5K_RXERR_DECRYPT) &&
-                        ds->ds_rxstat.rs_keyix != AR5K_RXKEYIX_INVALID)
+        if (!(rs->rs_status & AR5K_RXERR_DECRYPT) &&
+                        rs->rs_keyix != AR5K_RXKEYIX_INVALID)
                 return RX_FLAG_DECRYPTED;
 
         /* Apparently when a default key is used to decrypt the packet
            the hw does not set the index used to decrypt.  In such cases
            get the index from the packet. */
         if ((le16_to_cpu(hdr->frame_control) & IEEE80211_FCTL_PROTECTED) &&
-                        !(ds->ds_rxstat.rs_status & AR5K_RXERR_DECRYPT) &&
+                        !(rs->rs_status & AR5K_RXERR_DECRYPT) &&
                         skb->len >= hlen + 4) {
                 keyix = skb->data[hlen + 3] >> 6;
 
@@ -1712,8 +1715,10 @@ ath5k_rx_decrypted(struct ath5k_softc *sc, struct ath5k_desc *ds,
 
 
 static void
-ath5k_check_ibss_hw_merge(struct ath5k_softc *sc, struct sk_buff *skb)
+ath5k_check_ibss_tsf(struct ath5k_softc *sc, struct sk_buff *skb,
+                     struct ieee80211_rx_status *rxs)
 {
+        u64 tsf, bc_tstamp;
         u32 hw_tu;
         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)skb->data;
 
@@ -1724,16 +1729,45 @@ ath5k_check_ibss_hw_merge(struct ath5k_softc *sc, struct sk_buff *skb)
             le16_to_cpu(mgmt->u.beacon.capab_info) & WLAN_CAPABILITY_IBSS &&
             memcmp(mgmt->bssid, sc->ah->ah_bssid, ETH_ALEN) == 0) {
                 /*
-                 * Received an IBSS beacon with the same BSSID. Hardware might
-                 * have updated the TSF, check if we need to update timers.
+                 * Received an IBSS beacon with the same BSSID. Hardware *must*
+                 * have updated the local TSF. We have to work around various
+                 * hardware bugs, though...
                  */
-                hw_tu = TSF_TO_TU(ath5k_hw_get_tsf64(sc->ah));
-                if (hw_tu >= sc->nexttbtt) {
-                        ath5k_beacon_update_timers(sc,
-                                le64_to_cpu(mgmt->u.beacon.timestamp));
+                tsf = ath5k_hw_get_tsf64(sc->ah);
+                bc_tstamp = le64_to_cpu(mgmt->u.beacon.timestamp);
+                hw_tu = TSF_TO_TU(tsf);
+
+                ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON,
+                        "beacon %llx mactime %llx (diff %lld) tsf now %llx\n",
+                        bc_tstamp, rxs->mactime,
+                        (rxs->mactime - bc_tstamp), tsf);
+
+                /*
+                 * Sometimes the HW will give us a wrong tstamp in the rx
+                 * status, causing the timestamp extension to go wrong.
+                 * (This seems to happen especially with beacon frames bigger
+                 * than 78 byte (incl. FCS))
+                 * But we know that the receive timestamp must be later than the
+                 * timestamp of the beacon since HW must have synced to that.
+                 *
+                 * NOTE: here we assume mactime to be after the frame was
+                 * received, not like mac80211 which defines it at the start.
+                 */
+                if (bc_tstamp > rxs->mactime) {
                         ATH5K_DBG_UNLIMIT(sc, ATH5K_DEBUG_BEACON,
-                                "detected HW merge from received beacon\n");
+                                "fixing mactime from %llx to %llx\n",
+                                rxs->mactime, tsf);
+                        rxs->mactime = tsf;
                 }
+
+                /*
+                 * Local TSF might have moved higher than our beacon timers,
+                 * in that case we have to update them to continue sending
+                 * beacons. This also takes care of synchronizing beacon sending
+                 * times with other stations.
+                 */
+                if (hw_tu >= sc->nexttbtt)
+                        ath5k_beacon_update_timers(sc, bc_tstamp);
         }
 }
 
@@ -1742,12 +1776,11 @@ static void
 ath5k_tasklet_rx(unsigned long data)
 {
         struct ieee80211_rx_status rxs = {};
+        struct ath5k_rx_status rs = {};
         struct sk_buff *skb;
         struct ath5k_softc *sc = (void *)data;
         struct ath5k_buf *bf;
         struct ath5k_desc *ds;
-        u16 len;
-        u8 stat;
         int ret;
         int hdrlen;
         int pad;
@@ -1770,7 +1803,7 @@ ath5k_tasklet_rx(unsigned long data)
                 if (unlikely(ds->ds_link == bf->daddr)) /* this is the end */
                         break;
 
-                ret = sc->ah->ah_proc_rx_desc(sc->ah, ds);
+                ret = sc->ah->ah_proc_rx_desc(sc->ah, ds, &rs);
                 if (unlikely(ret == -EINPROGRESS))
                         break;
                 else if (unlikely(ret)) {
@@ -1779,16 +1812,15 @@ ath5k_tasklet_rx(unsigned long data)
                         return;
                 }
 
-                if (unlikely(ds->ds_rxstat.rs_more)) {
+                if (unlikely(rs.rs_more)) {
                         ATH5K_WARN(sc, "unsupported jumbo\n");
                         goto next;
                 }
 
-                stat = ds->ds_rxstat.rs_status;
-                if (unlikely(stat)) {
-                        if (stat & AR5K_RXERR_PHY)
+                if (unlikely(rs.rs_status)) {
+                        if (rs.rs_status & AR5K_RXERR_PHY)
                                 goto next;
-                        if (stat & AR5K_RXERR_DECRYPT) {
+                        if (rs.rs_status & AR5K_RXERR_DECRYPT) {
                                 /*
                                  * Decrypt error.  If the error occurred
                                  * because there was no hardware key, then
@@ -1799,30 +1831,29 @@ ath5k_tasklet_rx(unsigned long data)
                                  *
                                  * XXX do key cache faulting
                                  */
-                                if (ds->ds_rxstat.rs_keyix ==
-                                                AR5K_RXKEYIX_INVALID &&
-                                                !(stat & AR5K_RXERR_CRC))
+                                if (rs.rs_keyix == AR5K_RXKEYIX_INVALID &&
+                                    !(rs.rs_status & AR5K_RXERR_CRC))
                                         goto accept;
                         }
-                        if (stat & AR5K_RXERR_MIC) {
+                        if (rs.rs_status & AR5K_RXERR_MIC) {
                                 rxs.flag |= RX_FLAG_MMIC_ERROR;
                                 goto accept;
                         }
 
                         /* let crypto-error packets fall through in MNTR */
-                        if ((stat & ~(AR5K_RXERR_DECRYPT|AR5K_RXERR_MIC)) ||
+                        if ((rs.rs_status &
+                                ~(AR5K_RXERR_DECRYPT|AR5K_RXERR_MIC)) ||
                                         sc->opmode != IEEE80211_IF_TYPE_MNTR)
                                 goto next;
                 }
 accept:
-                len = ds->ds_rxstat.rs_datalen;
-                pci_dma_sync_single_for_cpu(sc->pdev, bf->skbaddr, len,
-                                PCI_DMA_FROMDEVICE);
+                pci_dma_sync_single_for_cpu(sc->pdev, bf->skbaddr,
+                                rs.rs_datalen, PCI_DMA_FROMDEVICE);
                 pci_unmap_single(sc->pdev, bf->skbaddr, sc->rxbufsize,
                                 PCI_DMA_FROMDEVICE);
                 bf->skb = NULL;
 
-                skb_put(skb, len);
+                skb_put(skb, rs.rs_datalen);
 
                 /*
                  * the hardware adds a padding to 4 byte boundaries between
@@ -1844,8 +1875,19 @@ accept:
                  * 15bit only. that means TSF extension has to be done within
                  * 32768usec (about 32ms). it might be necessary to move this to
                  * the interrupt handler, like it is done in madwifi.
+                 *
+                 * Unfortunately we don't know when the hardware takes the rx
+                 * timestamp (beginning of phy frame, data frame, end of rx?).
+                 * The only thing we know is that it is hardware specific...
+                 * On AR5213 it seems the rx timestamp is at the end of the
+                 * frame, but i'm not sure.
+                 *
+                 * NOTE: mac80211 defines mactime at the beginning of the first
+                 * data symbol. Since we don't have any time references it's
+                 * impossible to comply to that. This affects IBSS merge only
+                 * right now, so it's not too bad...
                  */
-                rxs.mactime = ath5k_extend_tsf(sc->ah, ds->ds_rxstat.rs_tstamp);
+                rxs.mactime = ath5k_extend_tsf(sc->ah, rs.rs_tstamp);
                 rxs.flag |= RX_FLAG_TSFT;
 
                 rxs.freq = sc->curchan->center_freq;
@@ -1859,26 +1901,25 @@ accept:
                 /* noise floor in dBm, from the last noise calibration */
                 rxs.noise = sc->ah->ah_noise_floor;
                 /* signal level in dBm */
-                rxs.ssi = rxs.noise + ds->ds_rxstat.rs_rssi;
+                rxs.ssi = rxs.noise + rs.rs_rssi;
                 /*
                  * "signal" is actually displayed as Link Quality by iwconfig
                  * we provide a percentage based on rssi (assuming max rssi 64)
                  */
-                rxs.signal = ds->ds_rxstat.rs_rssi * 100 / 64;
+                rxs.signal = rs.rs_rssi * 100 / 64;
 
-                rxs.antenna = ds->ds_rxstat.rs_antenna;
-                rxs.rate_idx = ath5k_hw_to_driver_rix(sc,
-                        ds->ds_rxstat.rs_rate);
-                rxs.flag |= ath5k_rx_decrypted(sc, ds, skb);
+                rxs.antenna = rs.rs_antenna;
+                rxs.rate_idx = ath5k_hw_to_driver_rix(sc, rs.rs_rate);
+                rxs.flag |= ath5k_rx_decrypted(sc, ds, skb, &rs);
 
                 ath5k_debug_dump_skb(sc, skb, "RX  ", 0);
 
                 /* check beacons in IBSS mode */
                 if (sc->opmode == IEEE80211_IF_TYPE_IBSS)
-                        ath5k_check_ibss_hw_merge(sc, skb);
+                        ath5k_check_ibss_tsf(sc, skb, &rxs);
 
                 __ieee80211_rx(sc->hw, skb, &rxs);
-                sc->led_rxrate = ds->ds_rxstat.rs_rate;
+                sc->led_rxrate = rs.rs_rate;
                 ath5k_led_event(sc, ATH_LED_RX);
 next:
                 list_move_tail(&bf->list, &sc->rxbuf);
@@ -1897,6 +1938,7 @@ static void
 ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
 {
         struct ieee80211_tx_status txs = {};
+        struct ath5k_tx_status ts = {};
         struct ath5k_buf *bf, *bf0;
         struct ath5k_desc *ds;
         struct sk_buff *skb;
@@ -1909,7 +1951,7 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 /* TODO only one segment */
                 pci_dma_sync_single_for_cpu(sc->pdev, sc->desc_daddr,
                                 sc->desc_len, PCI_DMA_FROMDEVICE);
-                ret = sc->ah->ah_proc_tx_desc(sc->ah, ds);
+                ret = sc->ah->ah_proc_tx_desc(sc->ah, ds, &ts);
                 if (unlikely(ret == -EINPROGRESS))
                         break;
                 else if (unlikely(ret)) {
@@ -1924,17 +1966,16 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                                 PCI_DMA_TODEVICE);
 
                 txs.control = bf->ctl;
-                txs.retry_count = ds->ds_txstat.ts_shortretry +
-                        ds->ds_txstat.ts_longretry / 6;
-                if (unlikely(ds->ds_txstat.ts_status)) {
+                txs.retry_count = ts.ts_shortretry + ts.ts_longretry / 6;
+                if (unlikely(ts.ts_status)) {
                         sc->ll_stats.dot11ACKFailureCount++;
-                        if (ds->ds_txstat.ts_status & AR5K_TXERR_XRETRY)
+                        if (ts.ts_status & AR5K_TXERR_XRETRY)
                                 txs.excessive_retries = 1;
-                        else if (ds->ds_txstat.ts_status & AR5K_TXERR_FILT)
+                        else if (ts.ts_status & AR5K_TXERR_FILT)
                                 txs.flags |= IEEE80211_TX_STATUS_TX_FILTERED;
                 } else {
                         txs.flags |= IEEE80211_TX_STATUS_ACK;
-                        txs.ack_signal = ds->ds_txstat.ts_rssi;
+                        txs.ack_signal = ts.ts_rssi;
                 }
 
                 ieee80211_tx_status(sc->hw, skb, &txs);
@@ -2108,7 +2149,7 @@ ath5k_beacon_send(struct ath5k_softc *sc)
  * beacon timer registers.
  *
  * This is called in a variety of situations, e.g. when a beacon is received,
- * when a HW merge has been detected, but also when an new IBSS is created or
+ * when a TSF update has been detected, but also when an new IBSS is created or
  * when we otherwise know we have to update the timers, but we keep it in this
  * function to have it all together in one place.
  */
@@ -2208,7 +2249,7 @@ ath5k_beacon_update_timers(struct ath5k_softc *sc, u64 bc_tsf)
  * another AP to associate with.
  *
  * In IBSS mode we use a self-linked tx descriptor if possible. We enable SWBA
- * interrupts to detect HW merges only.
+ * interrupts to detect TSF updates only.
  *
  * AP mode is missing.
  */
@@ -2228,7 +2269,7 @@ ath5k_beacon_config(struct ath5k_softc *sc)
                  * hardware send the beacons automatically. We have to load it
                  * only once here.
                  * We use the SWBA interrupt only to keep track of the beacon
-                 * timers in order to detect HW merges (automatic TSF updates).
+                 * timers in order to detect automatic TSF updates.
                  */
                 ath5k_beaconq_config(sc);
 
@@ -2441,8 +2482,8 @@ ath5k_intr(int irq, void *dev_id)
                                 *
                                 * In IBSS mode we use this interrupt just to
                                 * keep track of the next TBTT (target beacon
-                                * transmission time) in order to detect hardware
-                                * merges (TSF updates).
+                                * transmission time) in order to detect wether
+                                * automatic TSF updates happened.
                                 */
                                 if (sc->opmode == IEEE80211_IF_TYPE_IBSS) {
                                          /* XXX: only if VEOL suppported */
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 05bf4fb8f907..41d5fa34b544 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -200,7 +200,8 @@ static ssize_t read_file_tsf(struct file *file, char __user *user_buf,
 {
         struct ath5k_softc *sc = file->private_data;
         char buf[100];
-        snprintf(buf, sizeof(buf), "0x%016llx\n", ath5k_hw_get_tsf64(sc->ah));
+        snprintf(buf, sizeof(buf), "0x%016llx\n",
+                 (unsigned long long)ath5k_hw_get_tsf64(sc->ah));
         return simple_read_from_buffer(user_buf, count, ppos, buf, 19);
 }
 
@@ -271,7 +272,8 @@ static ssize_t read_file_beacon(struct file *file, char __user *user_buf,
 
         tsf = ath5k_hw_get_tsf64(sc->ah);
         len += snprintf(buf+len, sizeof(buf)-len,
-                "TSF\t\t0x%016llx\tTU: %08x\n", tsf, TSF_TO_TU(tsf));
+                "TSF\t\t0x%016llx\tTU: %08x\n",
+                (unsigned long long)tsf, TSF_TO_TU(tsf));
 
         return simple_read_from_buffer(user_buf, count, ppos, buf, len);
 }
@@ -497,15 +499,18 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
 }
 
 static inline void
-ath5k_debug_printrxbuf(struct ath5k_buf *bf, int done)
+ath5k_debug_printrxbuf(struct ath5k_buf *bf, int done,
+                       struct ath5k_rx_status *rs)
 {
         struct ath5k_desc *ds = bf->desc;
+        struct ath5k_hw_all_rx_desc *rd = &ds->ud.ds_rx;
 
         printk(KERN_DEBUG "R (%p %llx) %08x %08x %08x %08x %08x %08x %c\n",
                 ds, (unsigned long long)bf->daddr,
-                ds->ds_link, ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
-                ds->ds_hw[0], ds->ds_hw[1],
-                !done ? ' ' : (ds->ds_rxstat.rs_status == 0) ? '*' : '!');
+                ds->ds_link, ds->ds_data,
+                rd->rx_ctl.rx_control_0, rd->rx_ctl.rx_control_1,
+                rd->u.rx_stat.rx_status_0, rd->u.rx_stat.rx_status_0,
+                !done ? ' ' : (rs->rs_status == 0) ? '*' : '!');
 }
 
 void
@@ -513,6 +518,7 @@ ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah)
 {
         struct ath5k_desc *ds;
         struct ath5k_buf *bf;
+        struct ath5k_rx_status rs = {};
         int status;
 
         if (likely(!(sc->debug.level & ATH5K_DEBUG_RESET)))
@@ -524,9 +530,9 @@ ath5k_debug_printrxbuffs(struct ath5k_softc *sc, struct ath5k_hw *ah)
         spin_lock_bh(&sc->rxbuflock);
         list_for_each_entry(bf, &sc->rxbuf, list) {
                 ds = bf->desc;
-                status = ah->ah_proc_rx_desc(ah, ds);
+                status = ah->ah_proc_rx_desc(ah, ds, &rs);
                 if (!status)
-                        ath5k_debug_printrxbuf(bf, status == 0);
+                        ath5k_debug_printrxbuf(bf, status == 0, &rs);
         }
         spin_unlock_bh(&sc->rxbuflock);
 }
@@ -550,19 +556,24 @@ ath5k_debug_dump_skb(struct ath5k_softc *sc,
 }
 
 void
-ath5k_debug_printtxbuf(struct ath5k_softc *sc,
-                        struct ath5k_buf *bf, int done)
+ath5k_debug_printtxbuf(struct ath5k_softc *sc, struct ath5k_buf *bf)
 {
         struct ath5k_desc *ds = bf->desc;
+        struct ath5k_hw_5212_tx_desc *td = &ds->ud.ds_tx5212;
+        struct ath5k_tx_status ts = {};
+        int done;
 
         if (likely(!(sc->debug.level & ATH5K_DEBUG_RESET)))
                 return;
 
+        done = sc->ah->ah_proc_tx_desc(sc->ah, bf->desc, &ts);
+
         printk(KERN_DEBUG "T (%p %llx) %08x %08x %08x %08x %08x %08x %08x "
                 "%08x %c\n", ds, (unsigned long long)bf->daddr, ds->ds_link,
-                ds->ds_data, ds->ds_ctl0, ds->ds_ctl1,
-                ds->ds_hw[0], ds->ds_hw[1], ds->ds_hw[2], ds->ds_hw[3],
-                !done ? ' ' : (ds->ds_txstat.ts_status == 0) ? '*' : '!');
+                ds->ds_data, td->tx_ctl.tx_control_0, td->tx_ctl.tx_control_1,
+                td->tx_ctl.tx_control_2, td->tx_ctl.tx_control_3,
+                td->tx_stat.tx_status_0, td->tx_stat.tx_status_1,
+                done ? ' ' : (ts.ts_status == 0) ? '*' : '!');
 }
 
 #endif /* ifdef CONFIG_ATH5K_DEBUG */
diff --git a/drivers/net/wireless/ath5k/debug.h b/drivers/net/wireless/ath5k/debug.h
index 8c0b5c57c76b..2cf8d18b10e3 100644
--- a/drivers/net/wireless/ath5k/debug.h
+++ b/drivers/net/wireless/ath5k/debug.h
@@ -160,8 +160,7 @@ ath5k_debug_dump_skb(struct ath5k_softc *sc,
                         struct sk_buff *skb, const char *prefix, int tx);
 
 void
-ath5k_debug_printtxbuf(struct ath5k_softc *sc,
-                        struct ath5k_buf *bf, int done);
+ath5k_debug_printtxbuf(struct ath5k_softc *sc, struct ath5k_buf *bf);
 
 #else /* no debugging */
 
@@ -199,8 +198,7 @@ ath5k_debug_dump_skb(struct ath5k_softc *sc,
                         struct sk_buff *skb, const char *prefix, int tx) {}
 
 static inline void
-ath5k_debug_printtxbuf(struct ath5k_softc *sc,
-                        struct ath5k_buf *bf, int done) {}
+ath5k_debug_printtxbuf(struct ath5k_softc *sc, struct ath5k_buf *bf) {}
 
 #endif /* ifdef CONFIG_ATH5K_DEBUG */
 
diff --git a/drivers/net/wireless/ath5k/hw.c b/drivers/net/wireless/ath5k/hw.c
index eec2b806a0de..a4e312d4226e 100644
--- a/drivers/net/wireless/ath5k/hw.c
+++ b/drivers/net/wireless/ath5k/hw.c
@@ -48,14 +48,18 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *, struct ath5k_desc *,
 static int ath5k_hw_setup_xr_tx_desc(struct ath5k_hw *, struct ath5k_desc *,
         unsigned int, unsigned int, unsigned int, unsigned int, unsigned int,
         unsigned int);
-static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *, struct ath5k_desc *);
+static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *, struct ath5k_desc *,
+                                         struct ath5k_tx_status *);
 static int ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *, struct ath5k_desc *,
         unsigned int, unsigned int, enum ath5k_pkt_type, unsigned int,
         unsigned int, unsigned int, unsigned int, unsigned int, unsigned int,
         unsigned int, unsigned int);
-static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *, struct ath5k_desc *);
-static int ath5k_hw_proc_new_rx_status(struct ath5k_hw *, struct ath5k_desc *);
-static int ath5k_hw_proc_old_rx_status(struct ath5k_hw *, struct ath5k_desc *);
+static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *, struct ath5k_desc *,
+                                         struct ath5k_tx_status *);
+static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *, struct ath5k_desc *,
+                                        struct ath5k_rx_status *);
+static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *, struct ath5k_desc *,
+                                        struct ath5k_rx_status *);
 static int ath5k_hw_get_capabilities(struct ath5k_hw *);
 
 static int ath5k_eeprom_init(struct ath5k_hw *);
@@ -174,9 +178,9 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
         }
 
         if (ah->ah_version == AR5K_AR5212)
-                ah->ah_proc_rx_desc = ath5k_hw_proc_new_rx_status;
+                ah->ah_proc_rx_desc = ath5k_hw_proc_5212_rx_status;
         else if (ah->ah_version <= AR5K_AR5211)
-                ah->ah_proc_rx_desc = ath5k_hw_proc_old_rx_status;
+                ah->ah_proc_rx_desc = ath5k_hw_proc_5210_rx_status;
 
         /* Bring device out of sleep and reset it's units */
         ret = ath5k_hw_nic_wakeup(ah, AR5K_INIT_MODE, true);
@@ -208,7 +212,7 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
 
         /* Identify single chip solutions */
         if((srev <= AR5K_SREV_VER_AR5414) &&
-        (srev >= AR5K_SREV_VER_AR2424)) {
+        (srev >= AR5K_SREV_VER_AR2413)) {
                 ah->ah_single_chip = true;
         } else {
                 ah->ah_single_chip = false;
@@ -223,10 +227,33 @@ struct ath5k_hw *ath5k_hw_attach(struct ath5k_softc *sc, u8 mac_version)
                 ah->ah_radio = AR5K_RF5110;
         } else if (ah->ah_radio_5ghz_revision < AR5K_SREV_RAD_5112) {
                 ah->ah_radio = AR5K_RF5111;
-        } else if (ah->ah_radio_5ghz_revision < AR5K_SREV_RAD_SC1) {
+                ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5111;
+        } else if (ah->ah_radio_5ghz_revision < AR5K_SREV_RAD_SC0) {
+
                 ah->ah_radio = AR5K_RF5112;
+
+                if (ah->ah_radio_5ghz_revision < AR5K_SREV_RAD_5112A) {
+                        ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5112;
+                } else {
+                        ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5112A;
+                }
+
+        } else if (ah->ah_radio_5ghz_revision < AR5K_SREV_RAD_SC1) {
+                ah->ah_radio = AR5K_RF2413;
+                ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5112A;
         } else {
+
                 ah->ah_radio = AR5K_RF5413;
+
+                if (ah->ah_mac_srev <= AR5K_SREV_VER_AR5424 &&
+                        ah->ah_mac_srev >= AR5K_SREV_VER_AR2424)
+                        ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5424;
+                else if (ah->ah_mac_srev >= AR5K_SREV_VER_AR2425)
+                        ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5112;
+                else
+                        ah->ah_phy_spending = AR5K_PHY_SPENDING_RF5112A;
+
+
         }
 
         ah->ah_phy = AR5K_PHY(0);
@@ -277,7 +304,8 @@ err:
  */
 static int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
 {
-        u32 turbo, mode, clock;
+        struct pci_dev *pdev = ah->ah_sc->pdev;
+        u32 turbo, mode, clock, bus_flags;
         int ret;
 
         turbo = 0;
@@ -354,9 +382,15 @@ static int ath5k_hw_nic_wakeup(struct ath5k_hw *ah, int flags, bool initial)
                                         AR5K_PHY_TURBO);
         }
 
-        /* ...reset chipset and PCI device */
-        if (ah->ah_single_chip == false && ath5k_hw_nic_reset(ah,
-                                AR5K_RESET_CTL_CHIP | AR5K_RESET_CTL_PCI)) {
+        /* reseting PCI on PCI-E cards results card to hang
+         * and always return 0xffff... so we ingore that flag
+         * for PCI-E cards */
+        bus_flags = (pdev->is_pcie) ? 0 : AR5K_RESET_CTL_PCI;
+
+        /* Reset chipset */
+        ret = ath5k_hw_nic_reset(ah, AR5K_RESET_CTL_PCU |
+                AR5K_RESET_CTL_BASEBAND | bus_flags);
+        if (ret) {
                 ATH5K_ERR(ah->ah_sc, "failed to reset the MAC Chip + PCI\n");
                 return -EIO;
         }
@@ -565,7 +599,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
         struct ieee80211_channel *channel, bool change_channel)
 {
         struct ath5k_eeprom_info *ee = &ah->ah_capabilities.cap_eeprom;
-        u32 data, s_seq, s_ant, s_led[3];
+        struct pci_dev *pdev = ah->ah_sc->pdev;
+        u32 data, s_seq, s_ant, s_led[3], dma_size;
         unsigned int i, mode, freq, ee_mode, ant[2];
         int ret;
 
@@ -617,7 +652,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
         if (ah->ah_version != AR5K_AR5210) {
                 if (ah->ah_radio != AR5K_RF5111 &&
                         ah->ah_radio != AR5K_RF5112 &&
-                        ah->ah_radio != AR5K_RF5413) {
+                        ah->ah_radio != AR5K_RF5413 &&
+                        ah->ah_radio != AR5K_RF2413) {
                         ATH5K_ERR(ah->ah_sc,
                                 "invalid phy radio: %u\n", ah->ah_radio);
                         return -EINVAL;
@@ -692,15 +728,26 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                 /*
                  * Write some more initial register settings
                  */
-                if (ah->ah_version > AR5K_AR5211){ /* found on 5213+ */
+                if (ah->ah_version == AR5K_AR5212) {
                         ath5k_hw_reg_write(ah, 0x0002a002, AR5K_PHY(11));
 
                         if (channel->hw_value == CHANNEL_G)
-                                ath5k_hw_reg_write(ah, 0x00f80d80, AR5K_PHY(83)); /* 0x00fc0ec0 */
+                                if (ah->ah_mac_srev < AR5K_SREV_VER_AR2413)
+                                        ath5k_hw_reg_write(ah, 0x00f80d80,
+                                                AR5K_PHY(83));
+                                else if (ah->ah_mac_srev < AR5K_SREV_VER_AR2424)
+                                        ath5k_hw_reg_write(ah, 0x00380140,
+                                                AR5K_PHY(83));
+                                else if (ah->ah_mac_srev < AR5K_SREV_VER_AR2425)
+                                        ath5k_hw_reg_write(ah, 0x00fc0ec0,
+                                                AR5K_PHY(83));
+                                else /* 2425 */
+                                        ath5k_hw_reg_write(ah, 0x00fc0fc0,
+                                                AR5K_PHY(83));
                         else
-                                ath5k_hw_reg_write(ah, 0x00000000, AR5K_PHY(83));
+                                ath5k_hw_reg_write(ah, 0x00000000,
+                                        AR5K_PHY(83));
 
-                        ath5k_hw_reg_write(ah, 0x000001b5, 0xa228); /* 0x000009b5 */
                         ath5k_hw_reg_write(ah, 0x000009b5, 0xa228);
                         ath5k_hw_reg_write(ah, 0x0000000f, 0x8060);
                         ath5k_hw_reg_write(ah, 0x00000000, 0xa254);
@@ -876,13 +923,24 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 
         /*
          * Set Rx/Tx DMA Configuration
-         *(passing dma size not available on 5210)
+         *
+         * Set maximum DMA size (512) except for PCI-E cards since
+         * it causes rx overruns and tx errors (tested on 5424 but since
+         * rx overruns also occur on 5416/5418 with madwifi we set 128
+         * for all PCI-E cards to be safe).
+         *
+         * In dumps this is 128 for allchips.
+         *
+         * XXX: need to check 5210 for this
+         * TODO: Check out tx triger level, it's always 64 on dumps but I
+         * guess we can tweak it and see how it goes ;-)
          */
+        dma_size = (pdev->is_pcie) ? AR5K_DMASIZE_128B : AR5K_DMASIZE_512B;
         if (ah->ah_version != AR5K_AR5210) {
-                AR5K_REG_WRITE_BITS(ah, AR5K_TXCFG, AR5K_TXCFG_SDMAMR,
-                                AR5K_DMASIZE_512B | AR5K_TXCFG_DMASIZE);
-                AR5K_REG_WRITE_BITS(ah, AR5K_RXCFG, AR5K_RXCFG_SDMAMW,
-                                AR5K_DMASIZE_512B);
+                AR5K_REG_WRITE_BITS(ah, AR5K_TXCFG,
+                        AR5K_TXCFG_SDMAMR, dma_size);
+                AR5K_REG_WRITE_BITS(ah, AR5K_RXCFG,
+                        AR5K_RXCFG_SDMAMW, dma_size);
         }
 
         /*
@@ -972,6 +1030,8 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
 
         /*
          * Set the 32MHz reference clock on 5212 phy clock sleep register
+         *
+         * TODO: Find out how to switch to external 32Khz clock to save power
          */
         if (ah->ah_version == AR5K_AR5212) {
                 ath5k_hw_reg_write(ah, AR5K_PHY_SCR_32MHZ, AR5K_PHY_SCR);
@@ -979,9 +1039,15 @@ int ath5k_hw_reset(struct ath5k_hw *ah, enum ieee80211_if_types op_mode,
                 ath5k_hw_reg_write(ah, AR5K_PHY_SCAL_32MHZ, AR5K_PHY_SCAL);
                 ath5k_hw_reg_write(ah, AR5K_PHY_SCLOCK_32MHZ, AR5K_PHY_SCLOCK);
                 ath5k_hw_reg_write(ah, AR5K_PHY_SDELAY_32MHZ, AR5K_PHY_SDELAY);
-                ath5k_hw_reg_write(ah, ah->ah_radio == AR5K_RF5111 ?
-                        AR5K_PHY_SPENDING_RF5111 : AR5K_PHY_SPENDING_RF5112,
-                        AR5K_PHY_SPENDING);
+                ath5k_hw_reg_write(ah, ah->ah_phy_spending, AR5K_PHY_SPENDING);
+        }
+
+        if (ah->ah_version == AR5K_AR5212) {
+                ath5k_hw_reg_write(ah, 0x000100aa, 0x8118);
+                ath5k_hw_reg_write(ah, 0x00003210, 0x811c);
+                ath5k_hw_reg_write(ah, 0x00000052, 0x8108);
+                if (ah->ah_mac_srev >= AR5K_SREV_VER_AR2413)
+                        ath5k_hw_reg_write(ah, 0x00000004, 0x8120);
         }
 
         /*
@@ -2228,8 +2294,8 @@ void ath5k_hw_set_associd(struct ath5k_hw *ah, const u8 *bssid, u16 assoc_id)
          * Set simple BSSID mask on 5212
          */
         if (ah->ah_version == AR5K_AR5212) {
-                ath5k_hw_reg_write(ah, 0xfffffff, AR5K_BSS_IDM0);
-                ath5k_hw_reg_write(ah, 0xfffffff, AR5K_BSS_IDM1);
+                ath5k_hw_reg_write(ah, 0xffffffff, AR5K_BSS_IDM0);
+                ath5k_hw_reg_write(ah, 0xffffffff, AR5K_BSS_IDM1);
         }
 
         /*
@@ -2374,6 +2440,8 @@ void ath5k_hw_start_rx_pcu(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
         AR5K_REG_DISABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
+
+        /* TODO: ANI Support */
 }
 
 /*
@@ -2383,6 +2451,8 @@ void ath5k_hw_stop_pcu_recv(struct ath5k_hw *ah)
 {
         ATH5K_TRACE(ah->ah_sc);
         AR5K_REG_ENABLE_BITS(ah, AR5K_DIAG_SW, AR5K_DIAG_SW_DIS_RX);
+
+        /* TODO: ANI Support */
 }
 
 /*
@@ -3456,10 +3526,10 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         unsigned int rtscts_rate, unsigned int rtscts_duration)
 {
         u32 frame_type;
-        struct ath5k_hw_2w_tx_desc *tx_desc;
+        struct ath5k_hw_2w_tx_ctl *tx_ctl;
         unsigned int frame_len;
 
-        tx_desc = (struct ath5k_hw_2w_tx_desc *)&desc->ds_ctl0;
+        tx_ctl = &desc->ud.ds_tx5210.tx_ctl;
 
         /*
          * Validate input
@@ -3478,12 +3548,8 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                 return -EINVAL;
         }
 
-        /* Clear status descriptor */
-        memset(desc->ds_hw, 0, sizeof(struct ath5k_hw_tx_status));
-
-        /* Initialize control descriptor */
-        tx_desc->tx_control_0 = 0;
-        tx_desc->tx_control_1 = 0;
+        /* Clear descriptor */
+        memset(&desc->ud.ds_tx5210, 0, sizeof(struct ath5k_hw_5210_tx_desc));
 
         /* Setup control descriptor */
 
@@ -3495,7 +3561,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         if (frame_len & ~AR5K_2W_TX_DESC_CTL0_FRAME_LEN)
                 return -EINVAL;
 
-        tx_desc->tx_control_0 = frame_len & AR5K_2W_TX_DESC_CTL0_FRAME_LEN;
+        tx_ctl->tx_control_0 = frame_len & AR5K_2W_TX_DESC_CTL0_FRAME_LEN;
 
         /* Verify and set buffer length */
 
@@ -3506,7 +3572,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         if (pkt_len & ~AR5K_2W_TX_DESC_CTL1_BUF_LEN)
                 return -EINVAL;
 
-        tx_desc->tx_control_1 = pkt_len & AR5K_2W_TX_DESC_CTL1_BUF_LEN;
+        tx_ctl->tx_control_1 = pkt_len & AR5K_2W_TX_DESC_CTL1_BUF_LEN;
 
         /*
          * Verify and set header length
@@ -3515,7 +3581,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         if (ah->ah_version == AR5K_AR5210) {
                 if (hdr_len & ~AR5K_2W_TX_DESC_CTL0_HEADER_LEN)
                         return -EINVAL;
-                tx_desc->tx_control_0 |=
+                tx_ctl->tx_control_0 |=
                         AR5K_REG_SM(hdr_len, AR5K_2W_TX_DESC_CTL0_HEADER_LEN);
         }
 
@@ -3531,19 +3597,19 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                         frame_type = type /*<< 2 ?*/;
                 }
 
-                tx_desc->tx_control_0 |=
+                tx_ctl->tx_control_0 |=
                         AR5K_REG_SM(frame_type, AR5K_2W_TX_DESC_CTL0_FRAME_TYPE) |
                         AR5K_REG_SM(tx_rate0, AR5K_2W_TX_DESC_CTL0_XMIT_RATE);
         } else {
-                tx_desc->tx_control_0 |=
+                tx_ctl->tx_control_0 |=
                         AR5K_REG_SM(tx_rate0, AR5K_2W_TX_DESC_CTL0_XMIT_RATE) |
                         AR5K_REG_SM(antenna_mode, AR5K_2W_TX_DESC_CTL0_ANT_MODE_XMIT);
-                tx_desc->tx_control_1 |=
+                tx_ctl->tx_control_1 |=
                         AR5K_REG_SM(type, AR5K_2W_TX_DESC_CTL1_FRAME_TYPE);
         }
 #define _TX_FLAGS(_c, _flag)                                            \
         if (flags & AR5K_TXDESC_##_flag)                                \
-                tx_desc->tx_control_##_c |=                             \
+                tx_ctl->tx_control_##_c |=                              \
                         AR5K_2W_TX_DESC_CTL##_c##_##_flag
 
         _TX_FLAGS(0, CLRDMASK);
@@ -3558,9 +3624,9 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
          * WEP crap
          */
         if (key_index != AR5K_TXKEYIX_INVALID) {
-                tx_desc->tx_control_0 |=
+                tx_ctl->tx_control_0 |=
                         AR5K_2W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
-                tx_desc->tx_control_1 |=
+                tx_ctl->tx_control_1 |=
                         AR5K_REG_SM(key_index,
                         AR5K_2W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX);
         }
@@ -3570,7 +3636,7 @@ ath5k_hw_setup_2word_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
          */
         if ((ah->ah_version == AR5K_AR5210) &&
                         (flags & (AR5K_TXDESC_RTSENA | AR5K_TXDESC_CTSENA)))
-                tx_desc->tx_control_1 |= rtscts_duration &
+                tx_ctl->tx_control_1 |= rtscts_duration &
                                 AR5K_2W_TX_DESC_CTL1_RTS_DURATION;
 
         return 0;
@@ -3586,13 +3652,11 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         unsigned int antenna_mode, unsigned int flags, unsigned int rtscts_rate,
         unsigned int rtscts_duration)
 {
-        struct ath5k_hw_4w_tx_desc *tx_desc;
-        struct ath5k_hw_tx_status *tx_status;
+        struct ath5k_hw_4w_tx_ctl *tx_ctl;
         unsigned int frame_len;
 
         ATH5K_TRACE(ah->ah_sc);
-        tx_desc = (struct ath5k_hw_4w_tx_desc *)&desc->ds_ctl0;
-        tx_status = (struct ath5k_hw_tx_status *)&desc->ds_hw[2];
+        tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
 
         /*
          * Validate input
@@ -3611,14 +3675,8 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
                 return -EINVAL;
         }
 
-        /* Clear status descriptor */
-        memset(tx_status, 0, sizeof(struct ath5k_hw_tx_status));
-
-        /* Initialize control descriptor */
-        tx_desc->tx_control_0 = 0;
-        tx_desc->tx_control_1 = 0;
-        tx_desc->tx_control_2 = 0;
-        tx_desc->tx_control_3 = 0;
+        /* Clear descriptor */
+        memset(&desc->ud.ds_tx5212, 0, sizeof(struct ath5k_hw_5212_tx_desc));
 
         /* Setup control descriptor */
 
@@ -3630,7 +3688,7 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (frame_len & ~AR5K_4W_TX_DESC_CTL0_FRAME_LEN)
                 return -EINVAL;
 
-        tx_desc->tx_control_0 = frame_len & AR5K_4W_TX_DESC_CTL0_FRAME_LEN;
+        tx_ctl->tx_control_0 = frame_len & AR5K_4W_TX_DESC_CTL0_FRAME_LEN;
 
         /* Verify and set buffer length */
 
@@ -3641,20 +3699,20 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
         if (pkt_len & ~AR5K_4W_TX_DESC_CTL1_BUF_LEN)
                 return -EINVAL;
 
-        tx_desc->tx_control_1 = pkt_len & AR5K_4W_TX_DESC_CTL1_BUF_LEN;
+        tx_ctl->tx_control_1 = pkt_len & AR5K_4W_TX_DESC_CTL1_BUF_LEN;
 
-        tx_desc->tx_control_0 |=
+        tx_ctl->tx_control_0 |=
                 AR5K_REG_SM(tx_power, AR5K_4W_TX_DESC_CTL0_XMIT_POWER) |
                 AR5K_REG_SM(antenna_mode, AR5K_4W_TX_DESC_CTL0_ANT_MODE_XMIT);
-        tx_desc->tx_control_1 |= AR5K_REG_SM(type,
+        tx_ctl->tx_control_1 |= AR5K_REG_SM(type,
                                         AR5K_4W_TX_DESC_CTL1_FRAME_TYPE);
-        tx_desc->tx_control_2 = AR5K_REG_SM(tx_tries0 + AR5K_TUNE_HWTXTRIES,
+        tx_ctl->tx_control_2 = AR5K_REG_SM(tx_tries0 + AR5K_TUNE_HWTXTRIES,
                                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES0);
-        tx_desc->tx_control_3 = tx_rate0 & AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
+        tx_ctl->tx_control_3 = tx_rate0 & AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
 
 #define _TX_FLAGS(_c, _flag)                    \
         if (flags & AR5K_TXDESC_##_flag)        \
-                tx_desc->tx_control_##_c |=     \
+                tx_ctl->tx_control_##_c |=      \
                         AR5K_4W_TX_DESC_CTL##_c##_##_flag
 
         _TX_FLAGS(0, CLRDMASK);
@@ -3670,8 +3728,8 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
          * WEP crap
          */
         if (key_index != AR5K_TXKEYIX_INVALID) {
-                tx_desc->tx_control_0 |= AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
-                tx_desc->tx_control_1 |= AR5K_REG_SM(key_index,
+                tx_ctl->tx_control_0 |= AR5K_4W_TX_DESC_CTL0_ENCRYPT_KEY_VALID;
+                tx_ctl->tx_control_1 |= AR5K_REG_SM(key_index,
                                 AR5K_4W_TX_DESC_CTL1_ENCRYPT_KEY_INDEX);
         }
 
@@ -3682,9 +3740,9 @@ static int ath5k_hw_setup_4word_tx_desc(struct ath5k_hw *ah,
                 if ((flags & AR5K_TXDESC_RTSENA) &&
                                 (flags & AR5K_TXDESC_CTSENA))
                         return -EINVAL;
-                tx_desc->tx_control_2 |= rtscts_duration &
+                tx_ctl->tx_control_2 |= rtscts_duration &
                                 AR5K_4W_TX_DESC_CTL2_RTS_DURATION;
-                tx_desc->tx_control_3 |= AR5K_REG_SM(rtscts_rate,
+                tx_ctl->tx_control_3 |= AR5K_REG_SM(rtscts_rate,
                                 AR5K_4W_TX_DESC_CTL3_RTS_CTS_RATE);
         }
 
@@ -3699,7 +3757,7 @@ ath5k_hw_setup_xr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         unsigned int tx_rate1, u_int tx_tries1, u_int tx_rate2, u_int tx_tries2,
         unsigned int tx_rate3, u_int tx_tries3)
 {
-        struct ath5k_hw_4w_tx_desc *tx_desc;
+        struct ath5k_hw_4w_tx_ctl *tx_ctl;
 
         /*
          * Rates can be 0 as long as the retry count is 0 too.
@@ -3716,14 +3774,14 @@ ath5k_hw_setup_xr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
         }
 
         if (ah->ah_version == AR5K_AR5212) {
-                tx_desc = (struct ath5k_hw_4w_tx_desc *)&desc->ds_ctl0;
+                tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
 
 #define _XTX_TRIES(_n)                                                  \
         if (tx_tries##_n) {                                             \
-                tx_desc->tx_control_2 |=                                \
+                tx_ctl->tx_control_2 |=                         \
                     AR5K_REG_SM(tx_tries##_n,                           \
                     AR5K_4W_TX_DESC_CTL2_XMIT_TRIES##_n);               \
-                tx_desc->tx_control_3 |=                                \
+                tx_ctl->tx_control_3 |=                         \
                     AR5K_REG_SM(tx_rate##_n,                            \
                     AR5K_4W_TX_DESC_CTL3_XMIT_RATE##_n);                \
         }
@@ -3744,13 +3802,15 @@ ath5k_hw_setup_xr_tx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
  * Proccess the tx status descriptor on 5210/5211
  */
 static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
-                struct ath5k_desc *desc)
+                struct ath5k_desc *desc, struct ath5k_tx_status *ts)
 {
+        struct ath5k_hw_2w_tx_ctl *tx_ctl;
         struct ath5k_hw_tx_status *tx_status;
-        struct ath5k_hw_2w_tx_desc *tx_desc;
 
-        tx_desc = (struct ath5k_hw_2w_tx_desc *)&desc->ds_ctl0;
-        tx_status = (struct ath5k_hw_tx_status *)&desc->ds_hw[0];
+        ATH5K_TRACE(ah->ah_sc);
+
+        tx_ctl = &desc->ud.ds_tx5210.tx_ctl;
+        tx_status = &desc->ud.ds_tx5210.tx_stat;
 
         /* No frame has been send or error */
         if (unlikely((tx_status->tx_status_1 & AR5K_DESC_TX_STATUS1_DONE) == 0))
@@ -3759,32 +3819,32 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
         /*
          * Get descriptor status
          */
-        desc->ds_us.tx.ts_tstamp = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_tstamp = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP);
-        desc->ds_us.tx.ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT);
-        desc->ds_us.tx.ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT);
-        /*TODO: desc->ds_us.tx.ts_virtcol + test*/
-        desc->ds_us.tx.ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
+        /*TODO: ts->ts_virtcol + test*/
+        ts->ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
                 AR5K_DESC_TX_STATUS1_SEQ_NUM);
-        desc->ds_us.tx.ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
-        desc->ds_us.tx.ts_antenna = 1;
-        desc->ds_us.tx.ts_status = 0;
-        desc->ds_us.tx.ts_rate = AR5K_REG_MS(tx_desc->tx_control_0,
+        ts->ts_antenna = 1;
+        ts->ts_status = 0;
+        ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_0,
                 AR5K_2W_TX_DESC_CTL0_XMIT_RATE);
 
         if ((tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK) == 0){
                 if (tx_status->tx_status_0 &
                                 AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_XRETRY;
+                        ts->ts_status |= AR5K_TXERR_XRETRY;
 
                 if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_FIFO;
+                        ts->ts_status |= AR5K_TXERR_FIFO;
 
                 if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FILTERED)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_FILT;
+                        ts->ts_status |= AR5K_TXERR_FILT;
         }
 
         return 0;
@@ -3794,14 +3854,15 @@ static int ath5k_hw_proc_2word_tx_status(struct ath5k_hw *ah,
  * Proccess a tx descriptor on 5212
  */
 static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
-                struct ath5k_desc *desc)
+                struct ath5k_desc *desc, struct ath5k_tx_status *ts)
 {
+        struct ath5k_hw_4w_tx_ctl *tx_ctl;
         struct ath5k_hw_tx_status *tx_status;
-        struct ath5k_hw_4w_tx_desc *tx_desc;
 
         ATH5K_TRACE(ah->ah_sc);
-        tx_desc = (struct ath5k_hw_4w_tx_desc *)&desc->ds_ctl0;
-        tx_status = (struct ath5k_hw_tx_status *)&desc->ds_hw[2];
+
+        tx_ctl = &desc->ud.ds_tx5212.tx_ctl;
+        tx_status = &desc->ud.ds_tx5212.tx_stat;
 
         /* No frame has been send or error */
         if (unlikely((tx_status->tx_status_1 & AR5K_DESC_TX_STATUS1_DONE) == 0))
@@ -3810,42 +3871,42 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
         /*
          * Get descriptor status
          */
-        desc->ds_us.tx.ts_tstamp = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_tstamp = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_SEND_TIMESTAMP);
-        desc->ds_us.tx.ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_shortretry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_SHORT_RETRY_COUNT);
-        desc->ds_us.tx.ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
+        ts->ts_longretry = AR5K_REG_MS(tx_status->tx_status_0,
                 AR5K_DESC_TX_STATUS0_LONG_RETRY_COUNT);
-        desc->ds_us.tx.ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_seqnum = AR5K_REG_MS(tx_status->tx_status_1,
                 AR5K_DESC_TX_STATUS1_SEQ_NUM);
-        desc->ds_us.tx.ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
+        ts->ts_rssi = AR5K_REG_MS(tx_status->tx_status_1,
                 AR5K_DESC_TX_STATUS1_ACK_SIG_STRENGTH);
-        desc->ds_us.tx.ts_antenna = (tx_status->tx_status_1 &
+        ts->ts_antenna = (tx_status->tx_status_1 &
                 AR5K_DESC_TX_STATUS1_XMIT_ANTENNA) ? 2 : 1;
-        desc->ds_us.tx.ts_status = 0;
+        ts->ts_status = 0;
 
         switch (AR5K_REG_MS(tx_status->tx_status_1,
                         AR5K_DESC_TX_STATUS1_FINAL_TS_INDEX)) {
         case 0:
-                desc->ds_us.tx.ts_rate = tx_desc->tx_control_3 &
+                ts->ts_rate = tx_ctl->tx_control_3 &
                         AR5K_4W_TX_DESC_CTL3_XMIT_RATE0;
                 break;
         case 1:
-                desc->ds_us.tx.ts_rate = AR5K_REG_MS(tx_desc->tx_control_3,
+                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
                         AR5K_4W_TX_DESC_CTL3_XMIT_RATE1);
-                desc->ds_us.tx.ts_longretry +=AR5K_REG_MS(tx_desc->tx_control_2,
+                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES1);
                 break;
         case 2:
-                desc->ds_us.tx.ts_rate = AR5K_REG_MS(tx_desc->tx_control_3,
+                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
                         AR5K_4W_TX_DESC_CTL3_XMIT_RATE2);
-                desc->ds_us.tx.ts_longretry +=AR5K_REG_MS(tx_desc->tx_control_2,
+                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES2);
                 break;
         case 3:
-                desc->ds_us.tx.ts_rate = AR5K_REG_MS(tx_desc->tx_control_3,
+                ts->ts_rate = AR5K_REG_MS(tx_ctl->tx_control_3,
                         AR5K_4W_TX_DESC_CTL3_XMIT_RATE3);
-                desc->ds_us.tx.ts_longretry +=AR5K_REG_MS(tx_desc->tx_control_2,
+                ts->ts_longretry += AR5K_REG_MS(tx_ctl->tx_control_2,
                         AR5K_4W_TX_DESC_CTL2_XMIT_TRIES3);
                 break;
         }
@@ -3853,13 +3914,13 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
         if ((tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FRAME_XMIT_OK) == 0){
                 if (tx_status->tx_status_0 &
                                 AR5K_DESC_TX_STATUS0_EXCESSIVE_RETRIES)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_XRETRY;
+                        ts->ts_status |= AR5K_TXERR_XRETRY;
 
                 if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FIFO_UNDERRUN)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_FIFO;
+                        ts->ts_status |= AR5K_TXERR_FIFO;
 
                 if (tx_status->tx_status_0 & AR5K_DESC_TX_STATUS0_FILTERED)
-                        desc->ds_us.tx.ts_status |= AR5K_TXERR_FILT;
+                        ts->ts_status |= AR5K_TXERR_FILT;
         }
 
         return 0;
@@ -3875,31 +3936,27 @@ static int ath5k_hw_proc_4word_tx_status(struct ath5k_hw *ah,
 int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
                         u32 size, unsigned int flags)
 {
-        struct ath5k_rx_desc *rx_desc;
+        struct ath5k_hw_rx_ctl *rx_ctl;
 
         ATH5K_TRACE(ah->ah_sc);
-        rx_desc = (struct ath5k_rx_desc *)&desc->ds_ctl0;
+        rx_ctl = &desc->ud.ds_rx.rx_ctl;
 
         /*
-         *Clear ds_hw
+         * Clear the descriptor
          * If we don't clean the status descriptor,
          * while scanning we get too many results,
          * most of them virtual, after some secs
          * of scanning system hangs. M.F.
         */
-        memset(desc->ds_hw, 0, sizeof(desc->ds_hw));
-
-        /*Initialize rx descriptor*/
-        rx_desc->rx_control_0 = 0;
-        rx_desc->rx_control_1 = 0;
+        memset(&desc->ud.ds_rx, 0, sizeof(struct ath5k_hw_all_rx_desc));
 
         /* Setup descriptor */
-        rx_desc->rx_control_1 = size & AR5K_DESC_RX_CTL1_BUF_LEN;
-        if (unlikely(rx_desc->rx_control_1 != size))
+        rx_ctl->rx_control_1 = size & AR5K_DESC_RX_CTL1_BUF_LEN;
+        if (unlikely(rx_ctl->rx_control_1 != size))
                 return -EINVAL;
 
         if (flags & AR5K_RXDESC_INTREQ)
-                rx_desc->rx_control_1 |= AR5K_DESC_RX_CTL1_INTREQ;
+                rx_ctl->rx_control_1 |= AR5K_DESC_RX_CTL1_INTREQ;
 
         return 0;
 }
@@ -3907,67 +3964,68 @@ int ath5k_hw_setup_rx_desc(struct ath5k_hw *ah, struct ath5k_desc *desc,
 /*
  * Proccess the rx status descriptor on 5210/5211
  */
-static int ath5k_hw_proc_old_rx_status(struct ath5k_hw *ah,
-                struct ath5k_desc *desc)
+static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
+                struct ath5k_desc *desc, struct ath5k_rx_status *rs)
 {
-        struct ath5k_hw_old_rx_status *rx_status;
+        struct ath5k_hw_rx_status *rx_status;
 
-        rx_status = (struct ath5k_hw_old_rx_status *)&desc->ds_hw[0];
+        rx_status = &desc->ud.ds_rx.u.rx_stat;
 
         /* No frame received / not ready */
-        if (unlikely((rx_status->rx_status_1 & AR5K_OLD_RX_DESC_STATUS1_DONE)
+        if (unlikely((rx_status->rx_status_1 & AR5K_5210_RX_DESC_STATUS1_DONE)
                                 == 0))
                 return -EINPROGRESS;
 
         /*
          * Frame receive status
          */
-        desc->ds_us.rx.rs_datalen = rx_status->rx_status_0 &
-                AR5K_OLD_RX_DESC_STATUS0_DATA_LEN;
-        desc->ds_us.rx.rs_rssi = AR5K_REG_MS(rx_status->rx_status_0,
-                AR5K_OLD_RX_DESC_STATUS0_RECEIVE_SIGNAL);
-        desc->ds_us.rx.rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
-                AR5K_OLD_RX_DESC_STATUS0_RECEIVE_RATE);
-        desc->ds_us.rx.rs_antenna = rx_status->rx_status_0 &
-                AR5K_OLD_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        desc->ds_us.rx.rs_more = rx_status->rx_status_0 &
-                AR5K_OLD_RX_DESC_STATUS0_MORE;
-        desc->ds_us.rx.rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
-                AR5K_OLD_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
-        desc->ds_us.rx.rs_status = 0;
+        rs->rs_datalen = rx_status->rx_status_0 &
+                AR5K_5210_RX_DESC_STATUS0_DATA_LEN;
+        rs->rs_rssi = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL);
+        rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE);
+        rs->rs_antenna = rx_status->rx_status_0 &
+                AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA;
+        rs->rs_more = rx_status->rx_status_0 &
+                AR5K_5210_RX_DESC_STATUS0_MORE;
+        /* TODO: this timestamp is 13 bit, later on we assume 15 bit */
+        rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
+                AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
+        rs->rs_status = 0;
 
         /*
          * Key table status
          */
-        if (rx_status->rx_status_1 & AR5K_OLD_RX_DESC_STATUS1_KEY_INDEX_VALID)
-                desc->ds_us.rx.rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
-                        AR5K_OLD_RX_DESC_STATUS1_KEY_INDEX);
+        if (rx_status->rx_status_1 & AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_VALID)
+                rs->rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
+                        AR5K_5210_RX_DESC_STATUS1_KEY_INDEX);
         else
-                desc->ds_us.rx.rs_keyix = AR5K_RXKEYIX_INVALID;
+                rs->rs_keyix = AR5K_RXKEYIX_INVALID;
 
         /*
          * Receive/descriptor errors
          */
-        if ((rx_status->rx_status_1 & AR5K_OLD_RX_DESC_STATUS1_FRAME_RECEIVE_OK)
-                        == 0) {
-                if (rx_status->rx_status_1 & AR5K_OLD_RX_DESC_STATUS1_CRC_ERROR)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_CRC;
+        if ((rx_status->rx_status_1 &
+                        AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK) == 0) {
+                if (rx_status->rx_status_1 &
+                                AR5K_5210_RX_DESC_STATUS1_CRC_ERROR)
+                        rs->rs_status |= AR5K_RXERR_CRC;
 
                 if (rx_status->rx_status_1 &
-                                AR5K_OLD_RX_DESC_STATUS1_FIFO_OVERRUN)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_FIFO;
+                                AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN)
+                        rs->rs_status |= AR5K_RXERR_FIFO;
 
                 if (rx_status->rx_status_1 &
-                                AR5K_OLD_RX_DESC_STATUS1_PHY_ERROR) {
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_PHY;
-                        desc->ds_us.rx.rs_phyerr =
-                                AR5K_REG_MS(rx_status->rx_status_1,
-                                        AR5K_OLD_RX_DESC_STATUS1_PHY_ERROR);
+                                AR5K_5210_RX_DESC_STATUS1_PHY_ERROR) {
+                        rs->rs_status |= AR5K_RXERR_PHY;
+                        rs->rs_phyerr = AR5K_REG_MS(rx_status->rx_status_1,
+                                           AR5K_5210_RX_DESC_STATUS1_PHY_ERROR);
                 }
 
                 if (rx_status->rx_status_1 &
-                                AR5K_OLD_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_DECRYPT;
+                                AR5K_5210_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
+                        rs->rs_status |= AR5K_RXERR_DECRYPT;
         }
 
         return 0;
@@ -3976,71 +4034,72 @@ static int ath5k_hw_proc_old_rx_status(struct ath5k_hw *ah,
 /*
  * Proccess the rx status descriptor on 5212
  */
-static int ath5k_hw_proc_new_rx_status(struct ath5k_hw *ah,
-                struct ath5k_desc *desc)
+static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
+                struct ath5k_desc *desc, struct ath5k_rx_status *rs)
 {
-        struct ath5k_hw_new_rx_status *rx_status;
+        struct ath5k_hw_rx_status *rx_status;
         struct ath5k_hw_rx_error *rx_err;
 
         ATH5K_TRACE(ah->ah_sc);
-        rx_status = (struct ath5k_hw_new_rx_status *)&desc->ds_hw[0];
+        rx_status = &desc->ud.ds_rx.u.rx_stat;
 
         /* Overlay on error */
-        rx_err = (struct ath5k_hw_rx_error *)&desc->ds_hw[0];
+        rx_err = &desc->ud.ds_rx.u.rx_err;
 
         /* No frame received / not ready */
-        if (unlikely((rx_status->rx_status_1 & AR5K_NEW_RX_DESC_STATUS1_DONE)
+        if (unlikely((rx_status->rx_status_1 & AR5K_5212_RX_DESC_STATUS1_DONE)
                                 == 0))
                 return -EINPROGRESS;
 
         /*
          * Frame receive status
          */
-        desc->ds_us.rx.rs_datalen = rx_status->rx_status_0 &
-                AR5K_NEW_RX_DESC_STATUS0_DATA_LEN;
-        desc->ds_us.rx.rs_rssi = AR5K_REG_MS(rx_status->rx_status_0,
-                AR5K_NEW_RX_DESC_STATUS0_RECEIVE_SIGNAL);
-        desc->ds_us.rx.rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
-                AR5K_NEW_RX_DESC_STATUS0_RECEIVE_RATE);
-        desc->ds_us.rx.rs_antenna = rx_status->rx_status_0 &
-                AR5K_NEW_RX_DESC_STATUS0_RECEIVE_ANTENNA;
-        desc->ds_us.rx.rs_more = rx_status->rx_status_0 &
-                AR5K_NEW_RX_DESC_STATUS0_MORE;
-        desc->ds_us.rx.rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
-                AR5K_NEW_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
-        desc->ds_us.rx.rs_status = 0;
+        rs->rs_datalen = rx_status->rx_status_0 &
+                AR5K_5212_RX_DESC_STATUS0_DATA_LEN;
+        rs->rs_rssi = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL);
+        rs->rs_rate = AR5K_REG_MS(rx_status->rx_status_0,
+                AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE);
+        rs->rs_antenna = rx_status->rx_status_0 &
+                AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA;
+        rs->rs_more = rx_status->rx_status_0 &
+                AR5K_5212_RX_DESC_STATUS0_MORE;
+        rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
+                AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
+        rs->rs_status = 0;
 
         /*
          * Key table status
          */
-        if (rx_status->rx_status_1 & AR5K_NEW_RX_DESC_STATUS1_KEY_INDEX_VALID)
-                desc->ds_us.rx.rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
-                                AR5K_NEW_RX_DESC_STATUS1_KEY_INDEX);
+        if (rx_status->rx_status_1 & AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID)
+                rs->rs_keyix = AR5K_REG_MS(rx_status->rx_status_1,
+                                AR5K_5212_RX_DESC_STATUS1_KEY_INDEX);
         else
-                desc->ds_us.rx.rs_keyix = AR5K_RXKEYIX_INVALID;
+                rs->rs_keyix = AR5K_RXKEYIX_INVALID;
 
         /*
          * Receive/descriptor errors
          */
         if ((rx_status->rx_status_1 &
-                        AR5K_NEW_RX_DESC_STATUS1_FRAME_RECEIVE_OK) == 0) {
-                if (rx_status->rx_status_1 & AR5K_NEW_RX_DESC_STATUS1_CRC_ERROR)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_CRC;
+                        AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK) == 0) {
+                if (rx_status->rx_status_1 &
+                                AR5K_5212_RX_DESC_STATUS1_CRC_ERROR)
+                        rs->rs_status |= AR5K_RXERR_CRC;
 
                 if (rx_status->rx_status_1 &
-                                AR5K_NEW_RX_DESC_STATUS1_PHY_ERROR) {
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_PHY;
-                        desc->ds_us.rx.rs_phyerr =
-                                AR5K_REG_MS(rx_err->rx_error_1,
-                                        AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE);
+                                AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) {
+                        rs->rs_status |= AR5K_RXERR_PHY;
+                        rs->rs_phyerr = AR5K_REG_MS(rx_err->rx_error_1,
+                                           AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE);
                 }
 
                 if (rx_status->rx_status_1 &
-                                AR5K_NEW_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_DECRYPT;
+                                AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR)
+                        rs->rs_status |= AR5K_RXERR_DECRYPT;
 
-                if (rx_status->rx_status_1 & AR5K_NEW_RX_DESC_STATUS1_MIC_ERROR)
-                        desc->ds_us.rx.rs_status |= AR5K_RXERR_MIC;
+                if (rx_status->rx_status_1 &
+                                AR5K_5212_RX_DESC_STATUS1_MIC_ERROR)
+                        rs->rs_status |= AR5K_RXERR_MIC;
         }
 
         return 0;
diff --git a/drivers/net/wireless/ath5k/hw.h b/drivers/net/wireless/ath5k/hw.h
index d9a7c0973f53..64fca8dcb386 100644
--- a/drivers/net/wireless/ath5k/hw.h
+++ b/drivers/net/wireless/ath5k/hw.h
@@ -173,7 +173,10 @@ struct ath5k_eeprom_info {
  * (rX: reserved fields possibily used by future versions of the ar5k chipset)
  */
 
-struct ath5k_rx_desc {
+/*
+ * common hardware RX control descriptor
+ */
+struct ath5k_hw_rx_ctl {
         u32     rx_control_0; /* RX control word 0 */
 
 #define AR5K_DESC_RX_CTL0                       0x00000000
@@ -185,69 +188,63 @@ struct ath5k_rx_desc {
 } __packed;
 
 /*
- * 5210/5211 rx status descriptor
+ * common hardware RX status descriptor
+ * 5210/11 and 5212 differ only in the flags defined below
  */
-struct ath5k_hw_old_rx_status {
+struct ath5k_hw_rx_status {
         u32     rx_status_0; /* RX status word 0 */
-
-#define AR5K_OLD_RX_DESC_STATUS0_DATA_LEN               0x00000fff
-#define AR5K_OLD_RX_DESC_STATUS0_MORE                   0x00001000
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_RATE           0x00078000
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_RATE_S         15
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_SIGNAL         0x07f80000
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_SIGNAL_S       19
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_ANTENNA        0x38000000
-#define AR5K_OLD_RX_DESC_STATUS0_RECEIVE_ANTENNA_S      27
-
         u32     rx_status_1; /* RX status word 1 */
-
-#define AR5K_OLD_RX_DESC_STATUS1_DONE                   0x00000001
-#define AR5K_OLD_RX_DESC_STATUS1_FRAME_RECEIVE_OK       0x00000002
-#define AR5K_OLD_RX_DESC_STATUS1_CRC_ERROR              0x00000004
-#define AR5K_OLD_RX_DESC_STATUS1_FIFO_OVERRUN           0x00000008
-#define AR5K_OLD_RX_DESC_STATUS1_DECRYPT_CRC_ERROR      0x00000010
-#define AR5K_OLD_RX_DESC_STATUS1_PHY_ERROR              0x000000e0
-#define AR5K_OLD_RX_DESC_STATUS1_PHY_ERROR_S            5
-#define AR5K_OLD_RX_DESC_STATUS1_KEY_INDEX_VALID        0x00000100
-#define AR5K_OLD_RX_DESC_STATUS1_KEY_INDEX              0x00007e00
-#define AR5K_OLD_RX_DESC_STATUS1_KEY_INDEX_S            9
-#define AR5K_OLD_RX_DESC_STATUS1_RECEIVE_TIMESTAMP      0x0fff8000
-#define AR5K_OLD_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S    15
-#define AR5K_OLD_RX_DESC_STATUS1_KEY_CACHE_MISS         0x10000000
 } __packed;
 
+/* 5210/5211 */
+#define AR5K_5210_RX_DESC_STATUS0_DATA_LEN              0x00000fff
+#define AR5K_5210_RX_DESC_STATUS0_MORE                  0x00001000
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE          0x00078000
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_RATE_S        15
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x07f80000
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_SIGNAL_S      19
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA       0x38000000
+#define AR5K_5210_RX_DESC_STATUS0_RECEIVE_ANTENNA_S     27
+#define AR5K_5210_RX_DESC_STATUS1_DONE                  0x00000001
+#define AR5K_5210_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002
+#define AR5K_5210_RX_DESC_STATUS1_CRC_ERROR             0x00000004
+#define AR5K_5210_RX_DESC_STATUS1_FIFO_OVERRUN          0x00000008
+#define AR5K_5210_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000010
+#define AR5K_5210_RX_DESC_STATUS1_PHY_ERROR             0x000000e0
+#define AR5K_5210_RX_DESC_STATUS1_PHY_ERROR_S           5
+#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100
+#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX             0x00007e00
+#define AR5K_5210_RX_DESC_STATUS1_KEY_INDEX_S           9
+#define AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x0fff8000
+#define AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S   15
+#define AR5K_5210_RX_DESC_STATUS1_KEY_CACHE_MISS        0x10000000
+
+/* 5212 */
+#define AR5K_5212_RX_DESC_STATUS0_DATA_LEN              0x00000fff
+#define AR5K_5212_RX_DESC_STATUS0_MORE                  0x00001000
+#define AR5K_5212_RX_DESC_STATUS0_DECOMP_CRC_ERROR      0x00002000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE          0x000f8000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_RATE_S        15
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL        0x0ff00000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_SIGNAL_S      20
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA       0xf0000000
+#define AR5K_5212_RX_DESC_STATUS0_RECEIVE_ANTENNA_S     28
+#define AR5K_5212_RX_DESC_STATUS1_DONE                  0x00000001
+#define AR5K_5212_RX_DESC_STATUS1_FRAME_RECEIVE_OK      0x00000002
+#define AR5K_5212_RX_DESC_STATUS1_CRC_ERROR             0x00000004
+#define AR5K_5212_RX_DESC_STATUS1_DECRYPT_CRC_ERROR     0x00000008
+#define AR5K_5212_RX_DESC_STATUS1_PHY_ERROR             0x00000010
+#define AR5K_5212_RX_DESC_STATUS1_MIC_ERROR             0x00000020
+#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_VALID       0x00000100
+#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX             0x0000fe00
+#define AR5K_5212_RX_DESC_STATUS1_KEY_INDEX_S           9
+#define AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP     0x7fff0000
+#define AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S   16
+#define AR5K_5212_RX_DESC_STATUS1_KEY_CACHE_MISS        0x80000000
+
 /*
- * 5212 rx status descriptor
+ * common hardware RX error descriptor
  */
-struct ath5k_hw_new_rx_status {
-        u32     rx_status_0; /* RX status word 0 */
-
-#define AR5K_NEW_RX_DESC_STATUS0_DATA_LEN               0x00000fff
-#define AR5K_NEW_RX_DESC_STATUS0_MORE                   0x00001000
-#define AR5K_NEW_RX_DESC_STATUS0_DECOMP_CRC_ERROR       0x00002000
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_RATE           0x000f8000
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_RATE_S         15
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_SIGNAL         0x0ff00000
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_SIGNAL_S       20
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_ANTENNA        0xf0000000
-#define AR5K_NEW_RX_DESC_STATUS0_RECEIVE_ANTENNA_S      28
-
-        u32     rx_status_1; /* RX status word 1 */
-
-#define AR5K_NEW_RX_DESC_STATUS1_DONE                   0x00000001
-#define AR5K_NEW_RX_DESC_STATUS1_FRAME_RECEIVE_OK       0x00000002
-#define AR5K_NEW_RX_DESC_STATUS1_CRC_ERROR              0x00000004
-#define AR5K_NEW_RX_DESC_STATUS1_DECRYPT_CRC_ERROR      0x00000008
-#define AR5K_NEW_RX_DESC_STATUS1_PHY_ERROR              0x00000010
-#define AR5K_NEW_RX_DESC_STATUS1_MIC_ERROR              0x00000020
-#define AR5K_NEW_RX_DESC_STATUS1_KEY_INDEX_VALID        0x00000100
-#define AR5K_NEW_RX_DESC_STATUS1_KEY_INDEX              0x0000fe00
-#define AR5K_NEW_RX_DESC_STATUS1_KEY_INDEX_S            9
-#define AR5K_NEW_RX_DESC_STATUS1_RECEIVE_TIMESTAMP      0x7fff0000
-#define AR5K_NEW_RX_DESC_STATUS1_RECEIVE_TIMESTAMP_S    16
-#define AR5K_NEW_RX_DESC_STATUS1_KEY_CACHE_MISS         0x80000000
-} __packed;
-
 struct ath5k_hw_rx_error {
         u32     rx_error_0; /* RX error word 0 */
 
@@ -268,7 +265,10 @@ struct ath5k_hw_rx_error {
 #define AR5K_DESC_RX_PHY_ERROR_SERVICE          0xc0
 #define AR5K_DESC_RX_PHY_ERROR_TRANSMITOVR      0xe0
 
-struct ath5k_hw_2w_tx_desc {
+/*
+ * 5210/5211 hardware 2-word TX control descriptor
+ */
+struct ath5k_hw_2w_tx_ctl {
         u32     tx_control_0; /* TX control word 0 */
 
 #define AR5K_2W_TX_DESC_CTL0_FRAME_LEN          0x00000fff
@@ -314,9 +314,9 @@ struct ath5k_hw_2w_tx_desc {
 #define AR5K_AR5210_TX_DESC_FRAME_TYPE_PIFS     0x10
 
 /*
- * 5212 4-word tx control descriptor
+ * 5212 hardware 4-word TX control descriptor
  */
-struct ath5k_hw_4w_tx_desc {
+struct ath5k_hw_4w_tx_ctl {
         u32     tx_control_0; /* TX control word 0 */
 
 #define AR5K_4W_TX_DESC_CTL0_FRAME_LEN          0x00000fff
@@ -374,7 +374,7 @@ struct ath5k_hw_4w_tx_desc {
 } __packed;
 
 /*
- * Common tx status descriptor
+ * Common TX status descriptor
  */
 struct ath5k_hw_tx_status {
         u32     tx_status_0; /* TX status word 0 */
@@ -415,6 +415,34 @@ struct ath5k_hw_tx_status {
 
 
 /*
+ * 5210/5211 hardware TX descriptor
+ */
+struct ath5k_hw_5210_tx_desc {
+        struct ath5k_hw_2w_tx_ctl       tx_ctl;
+        struct ath5k_hw_tx_status       tx_stat;
+} __packed;
+
+/*
+ * 5212 hardware TX descriptor
+ */
+struct ath5k_hw_5212_tx_desc {
+        struct ath5k_hw_4w_tx_ctl       tx_ctl;
+        struct ath5k_hw_tx_status       tx_stat;
+} __packed;
+
+/*
+ * common hardware RX descriptor
+ */
+struct ath5k_hw_all_rx_desc {
+        struct ath5k_hw_rx_ctl                  rx_ctl;
+        union {
+                struct ath5k_hw_rx_status       rx_stat;
+                struct ath5k_hw_rx_error        rx_err;
+        } u;
+} __packed;
+
+
+/*
  * AR5K REGISTER ACCESS
  */
 
diff --git a/drivers/net/wireless/ath5k/initvals.c b/drivers/net/wireless/ath5k/initvals.c
index cfcb1fe7bd34..fdbab2f08178 100644
--- a/drivers/net/wireless/ath5k/initvals.c
+++ b/drivers/net/wireless/ath5k/initvals.c
@@ -678,8 +678,8 @@ static const struct ath5k_ini ar5212_ini[] = {
         { AR5K_PHY(644), 0x00806333 },
         { AR5K_PHY(645), 0x00106c10 },
         { AR5K_PHY(646), 0x009c4060 },
-        /*{ AR5K_PHY(647), 0x1483800a },*/ /* Old value */
         { AR5K_PHY(647), 0x1483800a },
+        /* { AR5K_PHY(648), 0x018830c6 },*/ /* 2413 */
         { AR5K_PHY(648), 0x01831061 },
         { AR5K_PHY(649), 0x00000400 },
         /*{ AR5K_PHY(650), 0x000001b5 },*/
@@ -1081,6 +1081,207 @@ static const struct ath5k_ini_mode rf5413_ini_mode_end[] = {
                 { 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0, 0xf3307ff0 } },
 };
 
+/* Initial mode-specific settings for RF2413/2414 (Written after ar5212_ini) */
+/* XXX: No dumps for turbog yet, so turbog is the same with g here with some
+ * minor tweaking based on dumps from other chips */
+static const struct ath5k_ini_mode rf2413_ini_mode_end[] = {
+        { AR5K_TXCFG,
+        /*            b         g           gTurbo */
+                { 0x00000015, 0x00000015, 0x00000015 } },
+        { AR5K_USEC_5211,
+                { 0x04e01395, 0x12e013ab, 0x098813cf } },
+        { AR5K_PHY(10),
+                { 0x05020000, 0x0a020001, 0x0a020001 } },
+        { AR5K_PHY(13),
+                { 0x00000e00, 0x00000e00, 0x00000e00 } },
+        { AR5K_PHY(14),
+                { 0x0000000a, 0x0000000a, 0x0000000a } },
+        { AR5K_PHY(18),
+                { 0x001a6a64, 0x001a6a64, 0x001a6a64 } },
+        { AR5K_PHY(20),
+                { 0x0de8b0da, 0x0c98b0da, 0x0c98b0da } },
+        { AR5K_PHY_SIG,
+                { 0x7ee80d2e, 0x7ec80d2e, 0x7ec80d2e } },
+        { AR5K_PHY_AGCCOARSE,
+                { 0x3137665e, 0x3139605e, 0x3139605e } },
+        { AR5K_PHY(27),
+                { 0x050cb081, 0x050cb081, 0x050cb081 } },
+        { AR5K_PHY_RX_DELAY,
+                { 0x0000044c, 0x00000898, 0x000007d0 } },
+        { AR5K_PHY_FRAME_CTL_5211,
+                { 0xf7b80d00, 0xf7b81000, 0xf7b81000 } },
+        { AR5K_PHY_CCKTXCTL,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY(642),
+                { 0xd03e6788, 0xd03e6788, 0xd03e6788 } },
+        { AR5K_PHY_GAIN_2GHZ,
+                { 0x0042c140, 0x0042c140, 0x0042c140 } },
+        { 0xa21c,
+                { 0x1863800a, 0x1883800a, 0x1883800a } },
+        { AR5K_DCU_FP,
+                { 0x000003e0, 0x000003e0, 0x000003e0 } },
+        { 0x8060,
+                { 0x0000000f, 0x0000000f, 0x0000000f } },
+        { 0x8118,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x811c,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8120,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8124,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8128,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x812c,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8130,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8134,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8138,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x813c,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0x8140,
+                { 0x800000a8, 0x800000a8, 0x800000a8 } },
+        { 0x8144,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY_AGC,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY(11),
+                { 0x0000a000, 0x0000a000, 0x0000a000 } },
+        { AR5K_PHY(15),
+                { 0x00200400, 0x00200400, 0x00200400 } },
+        { AR5K_PHY(19),
+                { 0x1284233c, 0x1284233c, 0x1284233c } },
+        { AR5K_PHY_SCR,
+                { 0x0000001f, 0x0000001f, 0x0000001f } },
+        { AR5K_PHY_SLMT,
+                { 0x00000080, 0x00000080, 0x00000080 } },
+        { AR5K_PHY_SCAL,
+                { 0x0000000e, 0x0000000e, 0x0000000e } },
+        { AR5K_PHY(86),
+                { 0x000000ff, 0x000000ff, 0x000000ff } },
+        { AR5K_PHY(96),
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY(97),
+                { 0x02800000, 0x02800000, 0x02800000 } },
+        { AR5K_PHY(104),
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY(120),
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { AR5K_PHY(121),
+                { 0xaaaaaaaa, 0xaaaaaaaa, 0xaaaaaaaa } },
+        { AR5K_PHY(122),
+                { 0x3c466478, 0x3c466478, 0x3c466478 } },
+        { AR5K_PHY(123),
+                { 0x000000aa, 0x000000aa, 0x000000aa } },
+        { AR5K_PHY_SCLOCK,
+                { 0x0000000c, 0x0000000c, 0x0000000c } },
+        { AR5K_PHY_SDELAY,
+                { 0x000000ff, 0x000000ff, 0x000000ff } },
+        { AR5K_PHY_SPENDING,
+                { 0x00000014, 0x00000014, 0x00000014 } },
+        { 0xa228,
+                { 0x000009b5, 0x000009b5, 0x000009b5 } },
+        { 0xa23c,
+                { 0x93c889af, 0x93c889af, 0x93c889af } },
+        { 0xa24c,
+                { 0x00000001, 0x00000001, 0x00000001 } },
+        { 0xa250,
+                { 0x0000a000, 0x0000a000, 0x0000a000 } },
+        { 0xa254,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa258,
+                { 0x0cc75380, 0x0cc75380, 0x0cc75380 } },
+        { 0xa25c,
+                { 0x0f0f0f01, 0x0f0f0f01, 0x0f0f0f01 } },
+        { 0xa260,
+                { 0x5f690f01, 0x5f690f01, 0x5f690f01 } },
+        { 0xa264,
+                { 0x00418a11, 0x00418a11, 0x00418a11 } },
+        { 0xa268,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa26c,
+                { 0x0c30c16a, 0x0c30c16a, 0x0c30c16a } },
+        { 0xa270,
+                { 0x00820820, 0x00820820, 0x00820820 } },
+        { 0xa274,
+                { 0x001b7caa, 0x001b7caa, 0x001b7caa } },
+        { 0xa278,
+                { 0x1ce739ce, 0x1ce739ce, 0x1ce739ce } },
+        { 0xa27c,
+                { 0x051701ce, 0x051701ce, 0x051701ce } },
+        { 0xa300,
+                { 0x18010000, 0x18010000, 0x18010000 } },
+        { 0xa304,
+                { 0x30032602, 0x30032602, 0x30032602 } },
+        { 0xa308,
+                { 0x48073e06, 0x48073e06, 0x48073e06 } },
+        { 0xa30c,
+                { 0x560b4c0a, 0x560b4c0a, 0x560b4c0a } },
+        { 0xa310,
+                { 0x641a600f, 0x641a600f, 0x641a600f } },
+        { 0xa314,
+                { 0x784f6e1b, 0x784f6e1b, 0x784f6e1b } },
+        { 0xa318,
+                { 0x868f7c5a, 0x868f7c5a, 0x868f7c5a } },
+        { 0xa31c,
+                { 0x8ecf865b, 0x8ecf865b, 0x8ecf865b } },
+        { 0xa320,
+                { 0x9d4f970f, 0x9d4f970f, 0x9d4f970f } },
+        { 0xa324,
+                { 0xa5cfa18f, 0xa5cfa18f, 0xa5cfa18f } },
+        { 0xa328,
+                { 0xb55faf1f, 0xb55faf1f, 0xb55faf1f } },
+        { 0xa32c,
+                { 0xbddfb99f, 0xbddfb99f, 0xbddfb99f } },
+        { 0xa330,
+                { 0xcd7fc73f, 0xcd7fc73f, 0xcd7fc73f } },
+        { 0xa334,
+                { 0xd5ffd1bf, 0xd5ffd1bf, 0xd5ffd1bf } },
+        { 0xa338,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa33c,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa340,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa344,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 0xa348,
+                { 0x3fffffff, 0x3fffffff, 0x3fffffff } },
+        { 0xa34c,
+                { 0x3fffffff, 0x3fffffff, 0x3fffffff } },
+        { 0xa350,
+                { 0x3fffffff, 0x3fffffff, 0x3fffffff } },
+        { 0xa354,
+                { 0x0003ffff, 0x0003ffff, 0x0003ffff } },
+        { 0xa358,
+                { 0x79a8aa1f, 0x79a8aa1f, 0x79a8aa1f } },
+        { 0xa35c,
+                { 0x066c420f, 0x066c420f, 0x066c420f } },
+        { 0xa360,
+                { 0x0f282207, 0x0f282207, 0x0f282207 } },
+        { 0xa364,
+                { 0x17601685, 0x17601685, 0x17601685 } },
+        { 0xa368,
+                { 0x1f801104, 0x1f801104, 0x1f801104 } },
+        { 0xa36c,
+                { 0x37a00c03, 0x37a00c03, 0x37a00c03 } },
+        { 0xa370,
+                { 0x3fc40883, 0x3fc40883, 0x3fc40883 } },
+        { 0xa374,
+                { 0x57c00803, 0x57c00803, 0x57c00803 } },
+        { 0xa378,
+                { 0x5fd80682, 0x5fd80682, 0x5fd80682 } },
+        { 0xa37c,
+                { 0x7fe00482, 0x7fe00482, 0x7fe00482 } },
+        { 0xa380,
+                { 0x7f3c7bba, 0x7f3c7bba, 0x7f3c7bba } },
+        { 0xa384,
+                { 0xf3307ff0, 0xf3307ff0, 0xf3307ff0 } },
+};
+
 /*
  * Initial BaseBand Gain settings for RF5111/5112 (AR5210 comes with
  * RF5110 only so initial BB Gain settings are included in AR5K_AR5210_INI)
@@ -1290,29 +1491,57 @@ int ath5k_hw_write_initvals(struct ath5k_hw *ah, u8 mode, bool change_channel)
 
                 /* Second set of mode-specific settings */
                 if (ah->ah_radio == AR5K_RF5111){
+
                         ath5k_hw_ini_mode_registers(ah,
                                         ARRAY_SIZE(ar5212_rf5111_ini_mode_end),
                                         ar5212_rf5111_ini_mode_end, mode);
+
                         /* Baseband gain table */
                         ath5k_hw_ini_registers(ah,
                                         ARRAY_SIZE(rf5111_ini_bbgain),
                                         rf5111_ini_bbgain, change_channel);
+
                 } else if (ah->ah_radio == AR5K_RF5112){
+
                         ath5k_hw_ini_mode_registers(ah,
                                         ARRAY_SIZE(ar5212_rf5112_ini_mode_end),
                                         ar5212_rf5112_ini_mode_end, mode);
-                        /* Baseband gain table */
+
                         ath5k_hw_ini_registers(ah,
                                         ARRAY_SIZE(rf5112_ini_bbgain),
                                         rf5112_ini_bbgain, change_channel);
+
                 } else if (ah->ah_radio == AR5K_RF5413){
+
                         ath5k_hw_ini_mode_registers(ah,
                                         ARRAY_SIZE(rf5413_ini_mode_end),
                                         rf5413_ini_mode_end, mode);
+
+                        ath5k_hw_ini_registers(ah,
+                                        ARRAY_SIZE(rf5112_ini_bbgain),
+                                        rf5112_ini_bbgain, change_channel);
+
+                } else if (ah->ah_radio == AR5K_RF2413) {
+
+                        if (mode < 2) {
+                                ATH5K_ERR(ah->ah_sc,
+                                        "unsupported channel mode: %d\n", mode);
+                                return -EINVAL;
+                        }
+                        mode = mode - 2;
+
+                        /* Override a setting from ar5212_ini */
+                        ath5k_hw_reg_write(ah, 0x018830c6, AR5K_PHY(648));
+
+                        ath5k_hw_ini_mode_registers(ah,
+                                        ARRAY_SIZE(rf2413_ini_mode_end),
+                                        rf2413_ini_mode_end, mode);
+
                         /* Baseband gain table */
                         ath5k_hw_ini_registers(ah,
                                         ARRAY_SIZE(rf5112_ini_bbgain),
                                         rf5112_ini_bbgain, change_channel);
+
                 }
         /* For AR5211 */
         } else if (ah->ah_version == AR5K_AR5211) {
diff --git a/drivers/net/wireless/ath5k/phy.c b/drivers/net/wireless/ath5k/phy.c
index 405195ffb24d..ee1dc0fc6ea2 100644
--- a/drivers/net/wireless/ath5k/phy.c
+++ b/drivers/net/wireless/ath5k/phy.c
@@ -666,6 +666,75 @@ static const struct ath5k_ini_rf rfregs_5413[] = {
             { 0x0000000e, 0x0000000e, 0x0000000e, 0x0000000e, 0x0000000e } },
 };
 
+/* RF2413/2414 mode-specific init registers */
+static const struct ath5k_ini_rf rfregs_2413[] = {
+        { 1, AR5K_RF_BUFFER_CONTROL_4,
+                { 0x00000020, 0x00000020, 0x00000020 } },
+        { 2, AR5K_RF_BUFFER_CONTROL_3,
+                { 0x02001408, 0x02001408, 0x02001408 } },
+        { 3, AR5K_RF_BUFFER_CONTROL_6,
+                { 0x00e020c0, 0x00e020c0, 0x00e020c0 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0xf0000000, 0xf0000000, 0xf0000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x03000000, 0x03000000, 0x03000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x40400000, 0x40400000, 0x40400000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x65050000, 0x65050000, 0x65050000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00420000, 0x00420000, 0x00420000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00b50000, 0x00b50000, 0x00b50000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00030000, 0x00030000, 0x00030000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00f70000, 0x00f70000, 0x00f70000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x009d0000, 0x009d0000, 0x009d0000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00220000, 0x00220000, 0x00220000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x04220000, 0x04220000, 0x04220000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00230018, 0x00230018, 0x00230018 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00280050, 0x00280050, 0x00280050 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x005000c3, 0x005000c3, 0x005000c3 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x0004007f, 0x0004007f, 0x0004007f } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000458, 0x00000458, 0x00000458 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x00000000, 0x00000000, 0x00000000 } },
+        { 6, AR5K_RF_BUFFER,
+                { 0x0000c000, 0x0000c000, 0x0000c000 } },
+        { 6, AR5K_RF_BUFFER_CONTROL_5,
+                { 0x00400230, 0x00400230, 0x00400230 } },
+        { 7, AR5K_RF_BUFFER,
+                { 0x00006400, 0x00006400, 0x00006400 } },
+        { 7, AR5K_RF_BUFFER,
+                { 0x00000800, 0x00000800, 0x00000800 } },
+        { 7, AR5K_RF_BUFFER_CONTROL_2,
+                { 0x0000000e, 0x0000000e, 0x0000000e } },
+};
 
 /* Initial RF Gain settings for RF5112 */
 static const struct ath5k_ini_rfgain rfgain_5112[] = {
@@ -805,6 +874,74 @@ static const struct ath5k_ini_rfgain rfgain_5413[] = {
         { AR5K_RF_GAIN(63),     { 0x000000f9, 0x000000f9 } },
 };
 
+/* Initial RF Gain settings for RF2413 */
+static const struct ath5k_ini_rfgain rfgain_2413[] = {
+        { AR5K_RF_GAIN(0), { 0x00000000 } },
+        { AR5K_RF_GAIN(1), { 0x00000040 } },
+        { AR5K_RF_GAIN(2), { 0x00000080 } },
+        { AR5K_RF_GAIN(3), { 0x00000181 } },
+        { AR5K_RF_GAIN(4), { 0x000001c1 } },
+        { AR5K_RF_GAIN(5), { 0x00000001 } },
+        { AR5K_RF_GAIN(6), { 0x00000041 } },
+        { AR5K_RF_GAIN(7), { 0x00000081 } },
+        { AR5K_RF_GAIN(8), { 0x00000168 } },
+        { AR5K_RF_GAIN(9), { 0x000001a8 } },
+        { AR5K_RF_GAIN(10), { 0x000001e8 } },
+        { AR5K_RF_GAIN(11), { 0x00000028 } },
+        { AR5K_RF_GAIN(12), { 0x00000068 } },
+        { AR5K_RF_GAIN(13), { 0x00000189 } },
+        { AR5K_RF_GAIN(14), { 0x000001c9 } },
+        { AR5K_RF_GAIN(15), { 0x00000009 } },
+        { AR5K_RF_GAIN(16), { 0x00000049 } },
+        { AR5K_RF_GAIN(17), { 0x00000089 } },
+        { AR5K_RF_GAIN(18), { 0x00000190 } },
+        { AR5K_RF_GAIN(19), { 0x000001d0 } },
+        { AR5K_RF_GAIN(20), { 0x00000010 } },
+        { AR5K_RF_GAIN(21), { 0x00000050 } },
+        { AR5K_RF_GAIN(22), { 0x00000090 } },
+        { AR5K_RF_GAIN(23), { 0x00000191 } },
+        { AR5K_RF_GAIN(24), { 0x000001d1 } },
+        { AR5K_RF_GAIN(25), { 0x00000011 } },
+        { AR5K_RF_GAIN(26), { 0x00000051 } },
+        { AR5K_RF_GAIN(27), { 0x00000091 } },
+        { AR5K_RF_GAIN(28), { 0x00000178 } },
+        { AR5K_RF_GAIN(29), { 0x000001b8 } },
+        { AR5K_RF_GAIN(30), { 0x000001f8 } },
+        { AR5K_RF_GAIN(31), { 0x00000038 } },
+        { AR5K_RF_GAIN(32), { 0x00000078 } },
+        { AR5K_RF_GAIN(33), { 0x00000199 } },
+        { AR5K_RF_GAIN(34), { 0x000001d9 } },
+        { AR5K_RF_GAIN(35), { 0x00000019 } },
+        { AR5K_RF_GAIN(36), { 0x00000059 } },
+        { AR5K_RF_GAIN(37), { 0x00000099 } },
+        { AR5K_RF_GAIN(38), { 0x000000d9 } },
+        { AR5K_RF_GAIN(39), { 0x000000f9 } },
+        { AR5K_RF_GAIN(40), { 0x000000f9 } },
+        { AR5K_RF_GAIN(41), { 0x000000f9 } },
+        { AR5K_RF_GAIN(42), { 0x000000f9 } },
+        { AR5K_RF_GAIN(43), { 0x000000f9 } },
+        { AR5K_RF_GAIN(44), { 0x000000f9 } },
+        { AR5K_RF_GAIN(45), { 0x000000f9 } },
+        { AR5K_RF_GAIN(46), { 0x000000f9 } },
+        { AR5K_RF_GAIN(47), { 0x000000f9 } },
+        { AR5K_RF_GAIN(48), { 0x000000f9 } },
+        { AR5K_RF_GAIN(49), { 0x000000f9 } },
+        { AR5K_RF_GAIN(50), { 0x000000f9 } },
+        { AR5K_RF_GAIN(51), { 0x000000f9 } },
+        { AR5K_RF_GAIN(52), { 0x000000f9 } },
+        { AR5K_RF_GAIN(53), { 0x000000f9 } },
+        { AR5K_RF_GAIN(54), { 0x000000f9 } },
+        { AR5K_RF_GAIN(55), { 0x000000f9 } },
+        { AR5K_RF_GAIN(56), { 0x000000f9 } },
+        { AR5K_RF_GAIN(57), { 0x000000f9 } },
+        { AR5K_RF_GAIN(58), { 0x000000f9 } },
+        { AR5K_RF_GAIN(59), { 0x000000f9 } },
+        { AR5K_RF_GAIN(60), { 0x000000f9 } },
+        { AR5K_RF_GAIN(61), { 0x000000f9 } },
+        { AR5K_RF_GAIN(62), { 0x000000f9 } },
+        { AR5K_RF_GAIN(63), { 0x000000f9 } },
+};
+
 static const struct ath5k_gain_opt rfgain_opt_5112 = {
         1,
         8,
@@ -955,7 +1092,6 @@ static s32 ath5k_hw_rfregs_gain_adjust(struct ath5k_hw *ah)
                 go = &rfgain_opt_5111;
                 break;
         case AR5K_RF5112:
-        case AR5K_RF5413: /* ??? */
                 go = &rfgain_opt_5112;
                 break;
         default:
@@ -1226,8 +1362,21 @@ static int ath5k_hw_rf5413_rfregs(struct ath5k_hw *ah,
 
         rf = ah->ah_rf_banks;
 
-        rf_ini = rfregs_5413;
-        rf_size = ARRAY_SIZE(rfregs_5413);
+        if (ah->ah_radio == AR5K_RF5413) {
+                rf_ini = rfregs_5413;
+                rf_size = ARRAY_SIZE(rfregs_5413);
+        } else if (ah->ah_radio == AR5K_RF2413) {
+                rf_ini = rfregs_2413;
+                rf_size = ARRAY_SIZE(rfregs_2413);
+                if (mode < 2) {
+                        ATH5K_ERR(ah->ah_sc,
+                                "invalid channel mode: %i\n", mode);
+                        return -EINVAL;
+                }
+                mode = mode - 2;
+        } else {
+                return -EINVAL;
+        }
 
         /* Copy values to modify them */
         for (i = 0; i < rf_size; i++) {
@@ -1286,6 +1435,10 @@ int ath5k_hw_rfregs(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 ah->ah_rf_banks_size = sizeof(rfregs_5413);
                 func = ath5k_hw_rf5413_rfregs;
                 break;
+        case AR5K_RF2413:
+                ah->ah_rf_banks_size = sizeof(rfregs_2413);
+                func = ath5k_hw_rf5413_rfregs;
+                break;
         default:
                 return -EINVAL;
         }
@@ -1324,6 +1477,11 @@ int ath5k_hw_rfgain(struct ath5k_hw *ah, unsigned int freq)
                 ath5k_rfg = rfgain_5413;
                 size = ARRAY_SIZE(rfgain_5413);
                 break;
+        case AR5K_RF2413:
+                ath5k_rfg = rfgain_2413;
+                size = ARRAY_SIZE(rfgain_2413);
+                freq = 0; /* only 2Ghz */
+                break;
         default:
                 return -EINVAL;
         }
@@ -1398,7 +1556,6 @@ int ath5k_hw_set_rfgain_opt(struct ath5k_hw *ah)
                 ah->ah_gain.g_active = 1;
                 break;
         case AR5K_RF5112:
-        case AR5K_RF5413: /* ??? */
                 ah->ah_gain.g_step_idx = rfgain_opt_5112.go_default;
                 ah->ah_gain.g_step =
                     &rfgain_opt_5112.go_step[ah->ah_gain.g_step_idx];
@@ -2019,6 +2176,15 @@ ath5k_hw_txpower(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                 return -EINVAL;
         }
 
+        /*
+         * RF2413 for some reason can't
+         * transmit anything if we call
+         * this funtion, so we skip it
+         * until we fix txpower.
+         */
+        if (ah->ah_radio == AR5K_RF2413)
+                return 0;
+
         /* Reset TX power values */
         memset(&ah->ah_txpower, 0, sizeof(ah->ah_txpower));
         ah->ah_txpower.txp_tpc = tpc;
diff --git a/drivers/net/wireless/ath5k/reg.h b/drivers/net/wireless/ath5k/reg.h
index 2f41c8398602..30629b3e37c2 100644
--- a/drivers/net/wireless/ath5k/reg.h
+++ b/drivers/net/wireless/ath5k/reg.h
@@ -1923,7 +1923,9 @@ after DFS is enabled */
 #define AR5K_PHY_SDELAY_32MHZ           0x000000ff
 #define AR5K_PHY_SPENDING               0x99f8
 #define AR5K_PHY_SPENDING_RF5111        0x00000018
-#define AR5K_PHY_SPENDING_RF5112        0x00000014
+#define AR5K_PHY_SPENDING_RF5112        0x00000014 /* <- i 've only seen this on 2425 dumps ! */
+#define AR5K_PHY_SPENDING_RF5112A       0x0000000e /* but since i only have 5112A-based chips */
+#define AR5K_PHY_SPENDING_RF5424        0x00000012 /* to test it might be also for old 5112.  */
 
 /*
  * Misc PHY/radio registers [5110 - 5111]
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 33459d61a717..d40be1568517 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -99,6 +99,8 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
+#define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
 
 /* SPROM boardflags_lo values */
@@ -587,15 +589,13 @@ struct b43_phy {
 
 /* Data structures for DMA transmission, per 80211 core. */
 struct b43_dma {
-        struct b43_dmaring *tx_ring0;
-        struct b43_dmaring *tx_ring1;
-        struct b43_dmaring *tx_ring2;
-        struct b43_dmaring *tx_ring3;
-        struct b43_dmaring *tx_ring4;
-        struct b43_dmaring *tx_ring5;
-
-        struct b43_dmaring *rx_ring0;
-        struct b43_dmaring *rx_ring3;   /* only available on core.rev < 5 */
+        struct b43_dmaring *tx_ring_AC_BK; /* Background */
+        struct b43_dmaring *tx_ring_AC_BE; /* Best Effort */
+        struct b43_dmaring *tx_ring_AC_VI; /* Video */
+        struct b43_dmaring *tx_ring_AC_VO; /* Voice */
+        struct b43_dmaring *tx_ring_mcast; /* Multicast */
+
+        struct b43_dmaring *rx_ring;
 };
 
 /* Context information for a noise calculation (Link Quality). */
@@ -621,6 +621,35 @@ struct b43_key {
         u8 algorithm;
 };
 
+/* SHM offsets to the QOS data structures for the 4 different queues. */
+#define B43_QOS_PARAMS(queue)   (B43_SHM_SH_EDCFQ + \
+                                 (B43_NR_QOSPARAMS * sizeof(u16) * (queue)))
+#define B43_QOS_BACKGROUND      B43_QOS_PARAMS(0)
+#define B43_QOS_BESTEFFORT      B43_QOS_PARAMS(1)
+#define B43_QOS_VIDEO           B43_QOS_PARAMS(2)
+#define B43_QOS_VOICE           B43_QOS_PARAMS(3)
+
+/* QOS parameter hardware data structure offsets. */
+#define B43_NR_QOSPARAMS        22
+enum {
+        B43_QOSPARAM_TXOP = 0,
+        B43_QOSPARAM_CWMIN,
+        B43_QOSPARAM_CWMAX,
+        B43_QOSPARAM_CWCUR,
+        B43_QOSPARAM_AIFS,
+        B43_QOSPARAM_BSLOTS,
+        B43_QOSPARAM_REGGAP,
+        B43_QOSPARAM_STATUS,
+};
+
+/* QOS parameters for a queue. */
+struct b43_qos_params {
+        /* The QOS parameters */
+        struct ieee80211_tx_queue_params p;
+        /* Does this need to get uploaded to hardware? */
+        bool need_hw_update;
+};
+
 struct b43_wldev;
 
 /* Data structure for the WLAN parts (802.11 cores) of the b43 chip. */
@@ -673,6 +702,12 @@ struct b43_wl {
         struct sk_buff *current_beacon;
         bool beacon0_uploaded;
         bool beacon1_uploaded;
+
+        /* The current QOS parameters for the 4 queues.
+         * This is protected by the irq_lock. */
+        struct b43_qos_params qos_params[4];
+        /* Workqueue for updating QOS parameters in hardware. */
+        struct work_struct qos_update_work;
 };
 
 /* In-memory representation of a cached microcode file. */
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 3dfb28a34be9..663aed4e9e05 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -38,6 +38,7 @@
 #include <linux/delay.h>
 #include <linux/skbuff.h>
 #include <linux/etherdevice.h>
+#include <asm/div64.h>
 
 
 /* 32bit DMA ops. */
@@ -291,52 +292,6 @@ static inline int request_slot(struct b43_dmaring *ring)
         return slot;
 }
 
-/* Mac80211-queue to b43-ring mapping */
-static struct b43_dmaring *priority_to_txring(struct b43_wldev *dev,
-                                              int queue_priority)
-{
-        struct b43_dmaring *ring;
-
-/*FIXME: For now we always run on TX-ring-1 */
-        return dev->dma.tx_ring1;
-
-        /* 0 = highest priority */
-        switch (queue_priority) {
-        default:
-                B43_WARN_ON(1);
-                /* fallthrough */
-        case 0:
-                ring = dev->dma.tx_ring3;
-                break;
-        case 1:
-                ring = dev->dma.tx_ring2;
-                break;
-        case 2:
-                ring = dev->dma.tx_ring1;
-                break;
-        case 3:
-                ring = dev->dma.tx_ring0;
-                break;
-        }
-
-        return ring;
-}
-
-/* b43-ring to mac80211-queue mapping */
-static inline int txring_to_priority(struct b43_dmaring *ring)
-{
-        static const u8 idx_to_prio[] = { 3, 2, 1, 0, };
-        unsigned int index;
-
-/*FIXME: have only one queue, for now */
-        return 0;
-
-        index = ring->index;
-        if (B43_WARN_ON(index >= ARRAY_SIZE(idx_to_prio)))
-                index = 0;
-        return idx_to_prio[index];
-}
-
 static u16 b43_dmacontroller_base(enum b43_dmatype type, int controller_idx)
 {
         static const u16 map64[] = {
@@ -924,16 +879,52 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
         goto out;
 }
 
+#define divide(a, b)    ({      \
+        typeof(a) __a = a;      \
+        do_div(__a, b);         \
+        __a;                    \
+  })
+
+#define modulo(a, b)    ({      \
+        typeof(a) __a = a;      \
+        do_div(__a, b);         \
+  })
+
 /* Main cleanup function. */
-static void b43_destroy_dmaring(struct b43_dmaring *ring)
+static void b43_destroy_dmaring(struct b43_dmaring *ring,
+                                const char *ringname)
 {
         if (!ring)
                 return;
 
-        b43dbg(ring->dev->wl, "DMA-%u 0x%04X (%s) max used slots: %d/%d\n",
-               (unsigned int)(ring->type),
-               ring->mmio_base,
-               (ring->tx) ? "TX" : "RX", ring->max_used_slots, ring->nr_slots);
+#ifdef CONFIG_B43_DEBUG
+        {
+                /* Print some statistics. */
+                u64 failed_packets = ring->nr_failed_tx_packets;
+                u64 succeed_packets = ring->nr_succeed_tx_packets;
+                u64 nr_packets = failed_packets + succeed_packets;
+                u64 permille_failed = 0, average_tries = 0;
+
+                if (nr_packets)
+                        permille_failed = divide(failed_packets * 1000, nr_packets);
+                if (nr_packets)
+                        average_tries = divide(ring->nr_total_packet_tries * 100, nr_packets);
+
+                b43dbg(ring->dev->wl, "DMA-%u %s: "
+                       "Used slots %d/%d, Failed frames %llu/%llu = %llu.%01llu%%, "
+                       "Average tries %llu.%02llu\n",
+                       (unsigned int)(ring->type), ringname,
+                       ring->max_used_slots,
+                       ring->nr_slots,
+                       (unsigned long long)failed_packets,
+                       (unsigned long long)nr_packets,
+                       (unsigned long long)divide(permille_failed, 10),
+                       (unsigned long long)modulo(permille_failed, 10),
+                       (unsigned long long)divide(average_tries, 100),
+                       (unsigned long long)modulo(average_tries, 100));
+        }
+#endif /* DEBUG */
+
         /* Device IRQs are disabled prior entering this function,
          * so no need to take care of concurrency with rx handler stuff.
          */
@@ -946,33 +937,26 @@ static void b43_destroy_dmaring(struct b43_dmaring *ring)
         kfree(ring);
 }
 
+#define destroy_ring(dma, ring) do {                            \
+        b43_destroy_dmaring((dma)->ring, __stringify(ring));    \
+        (dma)->ring = NULL;                                     \
+    } while (0)
+
 void b43_dma_free(struct b43_wldev *dev)
 {
         struct b43_dma *dma = &dev->dma;
 
-        b43_destroy_dmaring(dma->rx_ring3);
-        dma->rx_ring3 = NULL;
-        b43_destroy_dmaring(dma->rx_ring0);
-        dma->rx_ring0 = NULL;
-
-        b43_destroy_dmaring(dma->tx_ring5);
-        dma->tx_ring5 = NULL;
-        b43_destroy_dmaring(dma->tx_ring4);
-        dma->tx_ring4 = NULL;
-        b43_destroy_dmaring(dma->tx_ring3);
-        dma->tx_ring3 = NULL;
-        b43_destroy_dmaring(dma->tx_ring2);
-        dma->tx_ring2 = NULL;
-        b43_destroy_dmaring(dma->tx_ring1);
-        dma->tx_ring1 = NULL;
-        b43_destroy_dmaring(dma->tx_ring0);
-        dma->tx_ring0 = NULL;
+        destroy_ring(dma, rx_ring);
+        destroy_ring(dma, tx_ring_AC_BK);
+        destroy_ring(dma, tx_ring_AC_BE);
+        destroy_ring(dma, tx_ring_AC_VI);
+        destroy_ring(dma, tx_ring_AC_VO);
+        destroy_ring(dma, tx_ring_mcast);
 }
 
 int b43_dma_init(struct b43_wldev *dev)
 {
         struct b43_dma *dma = &dev->dma;
-        struct b43_dmaring *ring;
         int err;
         u64 dmamask;
         enum b43_dmatype type;
@@ -1002,83 +986,57 @@ int b43_dma_init(struct b43_wldev *dev)
 
         err = -ENOMEM;
         /* setup TX DMA channels. */
-        ring = b43_setup_dmaring(dev, 0, 1, type);
-        if (!ring)
+        dma->tx_ring_AC_BK = b43_setup_dmaring(dev, 0, 1, type);
+        if (!dma->tx_ring_AC_BK)
                 goto out;
-        dma->tx_ring0 = ring;
 
-        ring = b43_setup_dmaring(dev, 1, 1, type);
-        if (!ring)
-                goto err_destroy_tx0;
-        dma->tx_ring1 = ring;
+        dma->tx_ring_AC_BE = b43_setup_dmaring(dev, 1, 1, type);
+        if (!dma->tx_ring_AC_BE)
+                goto err_destroy_bk;
 
-        ring = b43_setup_dmaring(dev, 2, 1, type);
-        if (!ring)
-                goto err_destroy_tx1;
-        dma->tx_ring2 = ring;
+        dma->tx_ring_AC_VI = b43_setup_dmaring(dev, 2, 1, type);
+        if (!dma->tx_ring_AC_VI)
+                goto err_destroy_be;
 
-        ring = b43_setup_dmaring(dev, 3, 1, type);
-        if (!ring)
-                goto err_destroy_tx2;
-        dma->tx_ring3 = ring;
+        dma->tx_ring_AC_VO = b43_setup_dmaring(dev, 3, 1, type);
+        if (!dma->tx_ring_AC_VO)
+                goto err_destroy_vi;
 
-        ring = b43_setup_dmaring(dev, 4, 1, type);
-        if (!ring)
-                goto err_destroy_tx3;
-        dma->tx_ring4 = ring;
+        dma->tx_ring_mcast = b43_setup_dmaring(dev, 4, 1, type);
+        if (!dma->tx_ring_mcast)
+                goto err_destroy_vo;
 
-        ring = b43_setup_dmaring(dev, 5, 1, type);
-        if (!ring)
-                goto err_destroy_tx4;
-        dma->tx_ring5 = ring;
+        /* setup RX DMA channel. */
+        dma->rx_ring = b43_setup_dmaring(dev, 0, 0, type);
+        if (!dma->rx_ring)
+                goto err_destroy_mcast;
 
-        /* setup RX DMA channels. */
-        ring = b43_setup_dmaring(dev, 0, 0, type);
-        if (!ring)
-                goto err_destroy_tx5;
-        dma->rx_ring0 = ring;
-
-        if (dev->dev->id.revision < 5) {
-                ring = b43_setup_dmaring(dev, 3, 0, type);
-                if (!ring)
-                        goto err_destroy_rx0;
-                dma->rx_ring3 = ring;
-        }
+        /* No support for the TX status DMA ring. */
+        B43_WARN_ON(dev->dev->id.revision < 5);
 
         b43dbg(dev->wl, "%u-bit DMA initialized\n",
                (unsigned int)type);
         err = 0;
-      out:
+out:
         return err;
 
-      err_destroy_rx0:
-        b43_destroy_dmaring(dma->rx_ring0);
-        dma->rx_ring0 = NULL;
-      err_destroy_tx5:
-        b43_destroy_dmaring(dma->tx_ring5);
-        dma->tx_ring5 = NULL;
-      err_destroy_tx4:
-        b43_destroy_dmaring(dma->tx_ring4);
-        dma->tx_ring4 = NULL;
-      err_destroy_tx3:
-        b43_destroy_dmaring(dma->tx_ring3);
-        dma->tx_ring3 = NULL;
-      err_destroy_tx2:
-        b43_destroy_dmaring(dma->tx_ring2);
-        dma->tx_ring2 = NULL;
-      err_destroy_tx1:
-        b43_destroy_dmaring(dma->tx_ring1);
-        dma->tx_ring1 = NULL;
-      err_destroy_tx0:
-        b43_destroy_dmaring(dma->tx_ring0);
-        dma->tx_ring0 = NULL;
-        goto out;
+err_destroy_mcast:
+        destroy_ring(dma, tx_ring_mcast);
+err_destroy_vo:
+        destroy_ring(dma, tx_ring_AC_VO);
+err_destroy_vi:
+        destroy_ring(dma, tx_ring_AC_VI);
+err_destroy_be:
+        destroy_ring(dma, tx_ring_AC_BE);
+err_destroy_bk:
+        destroy_ring(dma, tx_ring_AC_BK);
+        return err;
 }
 
 /* Generate a cookie for the TX header. */
 static u16 generate_cookie(struct b43_dmaring *ring, int slot)
 {
-        u16 cookie = 0x1000;
+        u16 cookie;
 
         /* Use the upper 4 bits of the cookie as
          * DMA controller ID and store the slot number
@@ -1088,30 +1046,9 @@ static u16 generate_cookie(struct b43_dmaring *ring, int slot)
          * It can also not be 0xFFFF because that is special
          * for multicast frames.
          */
-        switch (ring->index) {
-        case 0:
-                cookie = 0x1000;
-                break;
-        case 1:
-                cookie = 0x2000;
-                break;
-        case 2:
-                cookie = 0x3000;
-                break;
-        case 3:
-                cookie = 0x4000;
-                break;
-        case 4:
-                cookie = 0x5000;
-                break;
-        case 5:
-                cookie = 0x6000;
-                break;
-        default:
-                B43_WARN_ON(1);
-        }
+        cookie = (((u16)ring->index + 1) << 12);
         B43_WARN_ON(slot & ~0x0FFF);
-        cookie |= (u16) slot;
+        cookie |= (u16)slot;
 
         return cookie;
 }
@@ -1125,22 +1062,19 @@ struct b43_dmaring *parse_cookie(struct b43_wldev *dev, u16 cookie, int *slot)
 
         switch (cookie & 0xF000) {
         case 0x1000:
-                ring = dma->tx_ring0;
+                ring = dma->tx_ring_AC_BK;
                 break;
         case 0x2000:
-                ring = dma->tx_ring1;
+                ring = dma->tx_ring_AC_BE;
                 break;
         case 0x3000:
-                ring = dma->tx_ring2;
+                ring = dma->tx_ring_AC_VI;
                 break;
         case 0x4000:
-                ring = dma->tx_ring3;
+                ring = dma->tx_ring_AC_VO;
                 break;
         case 0x5000:
-                ring = dma->tx_ring4;
-                break;
-        case 0x6000:
-                ring = dma->tx_ring5;
+                ring = dma->tx_ring_mcast;
                 break;
         default:
                 B43_WARN_ON(1);
@@ -1272,6 +1206,37 @@ static inline int should_inject_overflow(struct b43_dmaring *ring)
         return 0;
 }
 
+/* Static mapping of mac80211's queues (priorities) to b43 DMA rings. */
+static struct b43_dmaring * select_ring_by_priority(struct b43_wldev *dev,
+                                                    u8 queue_prio)
+{
+        struct b43_dmaring *ring;
+
+        if (b43_modparam_qos) {
+                /* 0 = highest priority */
+                switch (queue_prio) {
+                default:
+                        B43_WARN_ON(1);
+                        /* fallthrough */
+                case 0:
+                        ring = dev->dma.tx_ring_AC_VO;
+                        break;
+                case 1:
+                        ring = dev->dma.tx_ring_AC_VI;
+                        break;
+                case 2:
+                        ring = dev->dma.tx_ring_AC_BE;
+                        break;
+                case 3:
+                        ring = dev->dma.tx_ring_AC_BK;
+                        break;
+                }
+        } else
+                ring = dev->dma.tx_ring_AC_BE;
+
+        return ring;
+}
+
 int b43_dma_tx(struct b43_wldev *dev,
                struct sk_buff *skb, struct ieee80211_tx_control *ctl)
 {
@@ -1288,13 +1253,13 @@ int b43_dma_tx(struct b43_wldev *dev,
         hdr = (struct ieee80211_hdr *)skb->data;
         if (ctl->flags & IEEE80211_TXCTL_SEND_AFTER_DTIM) {
                 /* The multicast ring will be sent after the DTIM */
-                ring = dev->dma.tx_ring4;
+                ring = dev->dma.tx_ring_mcast;
                 /* Set the more-data bit. Ucode will clear it on
                  * the last frame for us. */
                 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
         } else {
                 /* Decide by priority where to put this frame. */
-                ring = priority_to_txring(dev, ctl->queue);
+                ring = select_ring_by_priority(dev, ctl->queue);
         }
 
         spin_lock_irqsave(&ring->lock, flags);
@@ -1309,6 +1274,11 @@ int b43_dma_tx(struct b43_wldev *dev,
          * That would be a mac80211 bug. */
         B43_WARN_ON(ring->stopped);
 
+        /* Assign the queue number to the ring (if not already done before)
+         * so TX status handling can use it. The queue to ring mapping is
+         * static, so we don't need to store it per frame. */
+        ring->queue_prio = ctl->queue;
+
         err = dma_tx_fragment(ring, skb, ctl);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
@@ -1325,7 +1295,7 @@ int b43_dma_tx(struct b43_wldev *dev,
         if ((free_slots(ring) < SLOTS_PER_PACKET) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
-                ieee80211_stop_queue(dev->wl->hw, txring_to_priority(ring));
+                ieee80211_stop_queue(dev->wl->hw, ctl->queue);
                 ring->stopped = 1;
                 if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
                         b43dbg(dev->wl, "Stopped TX ring %d\n", ring->index);
@@ -1337,6 +1307,38 @@ out_unlock:
         return err;
 }
 
+static void b43_fill_txstatus_report(struct b43_dmaring *ring,
+                                    struct ieee80211_tx_status *report,
+                                    const struct b43_txstatus *status)
+{
+        bool frame_failed = 0;
+
+        if (status->acked) {
+                /* The frame was ACKed. */
+                report->flags |= IEEE80211_TX_STATUS_ACK;
+        } else {
+                /* The frame was not ACKed... */
+                if (!(report->control.flags & IEEE80211_TXCTL_NO_ACK)) {
+                        /* ...but we expected an ACK. */
+                        frame_failed = 1;
+                        report->excessive_retries = 1;
+                }
+        }
+        if (status->frame_count == 0) {
+                /* The frame was not transmitted at all. */
+                report->retry_count = 0;
+        } else {
+                report->retry_count = status->frame_count - 1;
+#ifdef CONFIG_B43_DEBUG
+                if (frame_failed)
+                        ring->nr_failed_tx_packets++;
+                else
+                        ring->nr_succeed_tx_packets++;
+                ring->nr_total_packet_tries += status->frame_count;
+#endif /* DEBUG */
+        }
+}
+
 void b43_dma_handle_txstatus(struct b43_wldev *dev,
                              const struct b43_txstatus *status)
 {
@@ -1371,18 +1373,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
                          * status of the transmission.
                          * Some fields of txstat are already filled in dma_tx().
                          */
-                        if (status->acked) {
-                                meta->txstat.flags |= IEEE80211_TX_STATUS_ACK;
-                        } else {
-                                if (!(meta->txstat.control.flags
-                                      & IEEE80211_TXCTL_NO_ACK))
-                                        meta->txstat.excessive_retries = 1;
-                        }
-                        if (status->frame_count == 0) {
-                                /* The frame was not transmitted at all. */
-                                meta->txstat.retry_count = 0;
-                        } else
-                                meta->txstat.retry_count = status->frame_count - 1;
+                        b43_fill_txstatus_report(ring, &(meta->txstat), status);
                         ieee80211_tx_status_irqsafe(dev->wl->hw, meta->skb,
                                                     &(meta->txstat));
                         /* skb is freed by ieee80211_tx_status_irqsafe() */
@@ -1404,7 +1395,7 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         dev->stats.last_tx = jiffies;
         if (ring->stopped) {
                 B43_WARN_ON(free_slots(ring) < SLOTS_PER_PACKET);
-                ieee80211_wake_queue(dev->wl->hw, txring_to_priority(ring));
+                ieee80211_wake_queue(dev->wl->hw, ring->queue_prio);
                 ring->stopped = 0;
                 if (b43_debug(dev, B43_DBG_DMAVERBOSE)) {
                         b43dbg(dev->wl, "Woke up TX ring %d\n", ring->index);
@@ -1425,7 +1416,7 @@ void b43_dma_get_tx_stats(struct b43_wldev *dev,
 
         for (i = 0; i < nr_queues; i++) {
                 data = &(stats->data[i]);
-                ring = priority_to_txring(dev, i);
+                ring = select_ring_by_priority(dev, i);
 
                 spin_lock_irqsave(&ring->lock, flags);
                 data->len = ring->used_slots / SLOTS_PER_PACKET;
@@ -1451,25 +1442,6 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
         sync_descbuffer_for_cpu(ring, meta->dmaaddr, ring->rx_buffersize);
         skb = meta->skb;
 
-        if (ring->index == 3) {
-                /* We received an xmit status. */
-                struct b43_hwtxstatus *hw = (struct b43_hwtxstatus *)skb->data;
-                int i = 0;
-
-                while (hw->cookie == 0) {
-                        if (i > 100)
-                                break;
-                        i++;
-                        udelay(2);
-                        barrier();
-                }
-                b43_handle_hwtxstatus(ring->dev, hw);
-                /* recycle the descriptor buffer. */
-                sync_descbuffer_for_device(ring, meta->dmaaddr,
-                                           ring->rx_buffersize);
-
-                return;
-        }
         rxhdr = (struct b43_rxhdr_fw4 *)skb->data;
         len = le16_to_cpu(rxhdr->frame_len);
         if (len == 0) {
@@ -1526,7 +1498,7 @@ static void dma_rx(struct b43_dmaring *ring, int *slot)
         skb_pull(skb, ring->frameoffset);
 
         b43_rx(ring->dev, skb, rxhdr);
-      drop:
+drop:
         return;
 }
 
@@ -1572,21 +1544,19 @@ static void b43_dma_tx_resume_ring(struct b43_dmaring *ring)
 void b43_dma_tx_suspend(struct b43_wldev *dev)
 {
         b43_power_saving_ctl_bits(dev, B43_PS_AWAKE);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring0);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring1);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring2);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring3);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring4);
-        b43_dma_tx_suspend_ring(dev->dma.tx_ring5);
+        b43_dma_tx_suspend_ring(dev->dma.tx_ring_AC_BK);
+        b43_dma_tx_suspend_ring(dev->dma.tx_ring_AC_BE);
+        b43_dma_tx_suspend_ring(dev->dma.tx_ring_AC_VI);
+        b43_dma_tx_suspend_ring(dev->dma.tx_ring_AC_VO);
+        b43_dma_tx_suspend_ring(dev->dma.tx_ring_mcast);
 }
 
 void b43_dma_tx_resume(struct b43_wldev *dev)
 {
-        b43_dma_tx_resume_ring(dev->dma.tx_ring5);
-        b43_dma_tx_resume_ring(dev->dma.tx_ring4);
-        b43_dma_tx_resume_ring(dev->dma.tx_ring3);
-        b43_dma_tx_resume_ring(dev->dma.tx_ring2);
-        b43_dma_tx_resume_ring(dev->dma.tx_ring1);
-        b43_dma_tx_resume_ring(dev->dma.tx_ring0);
+        b43_dma_tx_resume_ring(dev->dma.tx_ring_mcast);
+        b43_dma_tx_resume_ring(dev->dma.tx_ring_AC_VO);
+        b43_dma_tx_resume_ring(dev->dma.tx_ring_AC_VI);
+        b43_dma_tx_resume_ring(dev->dma.tx_ring_AC_BE);
+        b43_dma_tx_resume_ring(dev->dma.tx_ring_AC_BK);
         b43_power_saving_ctl_bits(dev, 0);
 }
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index c0d6b69e6501..ea27085dec0e 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -245,6 +245,9 @@ struct b43_dmaring {
         enum b43_dmatype type;
         /* Boolean. Is this ring stopped at ieee80211 level? */
         bool stopped;
+        /* The QOS priority assigned to this ring. Only used for TX rings.
+         * This is the mac80211 "queue" value. */
+        u8 queue_prio;
         /* Lock, only used for TX. */
         spinlock_t lock;
         struct b43_wldev *dev;
@@ -253,7 +256,13 @@ struct b43_dmaring {
         int max_used_slots;
         /* Last time we injected a ring overflow. */
         unsigned long last_injected_overflow;
-#endif                          /* CONFIG_B43_DEBUG */
+        /* Statistics: Number of successfully transmitted packets */
+        u64 nr_succeed_tx_packets;
+        /* Statistics: Number of failed TX packets */
+        u64 nr_failed_tx_packets;
+        /* Statistics: Total number of TX plus all retries. */
+        u64 nr_total_packet_tries;
+#endif /* CONFIG_B43_DEBUG */
 };
 
 static inline u32 b43_dma_read(struct b43_dmaring *ring, u16 offset)
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index f745308faaad..694e29570e5d 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -78,6 +78,11 @@ static int modparam_nohwcrypt;
 module_param_named(nohwcrypt, modparam_nohwcrypt, int, 0444);
 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
 
+int b43_modparam_qos = 1;
+module_param_named(qos, b43_modparam_qos, int, 0444);
+MODULE_PARM_DESC(qos, "Enable QOS support (default on)");
+
+
 static const struct ssb_device_id b43_ssb_tbl[] = {
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 5),
         SSB_DEVICE(SSB_VENDOR_BROADCOM, SSB_DEV_80211, 6),
@@ -1589,11 +1594,10 @@ static void b43_interrupt_tasklet(struct b43_wldev *dev)
 
         /* Check the DMA reason registers for received data. */
         if (dma_reason[0] & B43_DMAIRQ_RX_DONE)
-                b43_dma_rx(dev->dma.rx_ring0);
-        if (dma_reason[3] & B43_DMAIRQ_RX_DONE)
-                b43_dma_rx(dev->dma.rx_ring3);
+                b43_dma_rx(dev->dma.rx_ring);
         B43_WARN_ON(dma_reason[1] & B43_DMAIRQ_RX_DONE);
         B43_WARN_ON(dma_reason[2] & B43_DMAIRQ_RX_DONE);
+        B43_WARN_ON(dma_reason[3] & B43_DMAIRQ_RX_DONE);
         B43_WARN_ON(dma_reason[4] & B43_DMAIRQ_RX_DONE);
         B43_WARN_ON(dma_reason[5] & B43_DMAIRQ_RX_DONE);
 
@@ -2708,10 +2712,178 @@ out:
         return NETDEV_TX_OK;
 }
 
+/* Locking: wl->irq_lock */
+static void b43_qos_params_upload(struct b43_wldev *dev,
+                                  const struct ieee80211_tx_queue_params *p,
+                                  u16 shm_offset)
+{
+        u16 params[B43_NR_QOSPARAMS];
+        int cw_min, cw_max, aifs, bslots, tmp;
+        unsigned int i;
+
+        const u16 aCWmin = 0x0001;
+        const u16 aCWmax = 0x03FF;
+
+        /* Calculate the default values for the parameters, if needed. */
+        switch (shm_offset) {
+        case B43_QOS_VOICE:
+                aifs = (p->aifs == -1) ? 2 : p->aifs;
+                cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 4 - 1) : p->cw_min;
+                cw_max = (p->cw_max == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_max;
+                break;
+        case B43_QOS_VIDEO:
+                aifs = (p->aifs == -1) ? 2 : p->aifs;
+                cw_min = (p->cw_min == 0) ? ((aCWmin + 1) / 2 - 1) : p->cw_min;
+                cw_max = (p->cw_max == 0) ? aCWmin : p->cw_max;
+                break;
+        case B43_QOS_BESTEFFORT:
+                aifs = (p->aifs == -1) ? 3 : p->aifs;
+                cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
+                cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
+                break;
+        case B43_QOS_BACKGROUND:
+                aifs = (p->aifs == -1) ? 7 : p->aifs;
+                cw_min = (p->cw_min == 0) ? aCWmin : p->cw_min;
+                cw_max = (p->cw_max == 0) ? aCWmax : p->cw_max;
+                break;
+        default:
+                B43_WARN_ON(1);
+                return;
+        }
+        if (cw_min <= 0)
+                cw_min = aCWmin;
+        if (cw_max <= 0)
+                cw_max = aCWmin;
+        bslots = b43_read16(dev, B43_MMIO_RNG) % cw_min;
+
+        memset(&params, 0, sizeof(params));
+
+        params[B43_QOSPARAM_TXOP] = p->txop * 32;
+        params[B43_QOSPARAM_CWMIN] = cw_min;
+        params[B43_QOSPARAM_CWMAX] = cw_max;
+        params[B43_QOSPARAM_CWCUR] = cw_min;
+        params[B43_QOSPARAM_AIFS] = aifs;
+        params[B43_QOSPARAM_BSLOTS] = bslots;
+        params[B43_QOSPARAM_REGGAP] = bslots + aifs;
+
+        for (i = 0; i < ARRAY_SIZE(params); i++) {
+                if (i == B43_QOSPARAM_STATUS) {
+                        tmp = b43_shm_read16(dev, B43_SHM_SHARED,
+                                             shm_offset + (i * 2));
+                        /* Mark the parameters as updated. */
+                        tmp |= 0x100;
+                        b43_shm_write16(dev, B43_SHM_SHARED,
+                                        shm_offset + (i * 2),
+                                        tmp);
+                } else {
+                        b43_shm_write16(dev, B43_SHM_SHARED,
+                                        shm_offset + (i * 2),
+                                        params[i]);
+                }
+        }
+}
+
+/* Update the QOS parameters in hardware. */
+static void b43_qos_update(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        struct b43_qos_params *params;
+        unsigned long flags;
+        unsigned int i;
+
+        /* Mapping of mac80211 queues to b43 SHM offsets. */
+        static const u16 qos_shm_offsets[] = {
+                [0] = B43_QOS_VOICE,
+                [1] = B43_QOS_VIDEO,
+                [2] = B43_QOS_BESTEFFORT,
+                [3] = B43_QOS_BACKGROUND,
+        };
+        BUILD_BUG_ON(ARRAY_SIZE(qos_shm_offsets) != ARRAY_SIZE(wl->qos_params));
+
+        b43_mac_suspend(dev);
+        spin_lock_irqsave(&wl->irq_lock, flags);
+
+        for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
+                params = &(wl->qos_params[i]);
+                if (params->need_hw_update) {
+                        b43_qos_params_upload(dev, &(params->p),
+                                              qos_shm_offsets[i]);
+                        params->need_hw_update = 0;
+                }
+        }
+
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+        b43_mac_enable(dev);
+}
+
+static void b43_qos_clear(struct b43_wl *wl)
+{
+        struct b43_qos_params *params;
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++) {
+                params = &(wl->qos_params[i]);
+
+                memset(&(params->p), 0, sizeof(params->p));
+                params->p.aifs = -1;
+                params->need_hw_update = 1;
+        }
+}
+
+/* Initialize the core's QOS capabilities */
+static void b43_qos_init(struct b43_wldev *dev)
+{
+        struct b43_wl *wl = dev->wl;
+        unsigned int i;
+
+        /* Upload the current QOS parameters. */
+        for (i = 0; i < ARRAY_SIZE(wl->qos_params); i++)
+                wl->qos_params[i].need_hw_update = 1;
+        b43_qos_update(dev);
+
+        /* Enable QOS support. */
+        b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
+        b43_write16(dev, B43_MMIO_IFSCTL,
+                    b43_read16(dev, B43_MMIO_IFSCTL)
+                    | B43_MMIO_IFSCTL_USE_EDCF);
+}
+
+static void b43_qos_update_work(struct work_struct *work)
+{
+        struct b43_wl *wl = container_of(work, struct b43_wl, qos_update_work);
+        struct b43_wldev *dev;
+
+        mutex_lock(&wl->mutex);
+        dev = wl->current_dev;
+        if (likely(dev && (b43_status(dev) >= B43_STAT_INITIALIZED)))
+                b43_qos_update(dev);
+        mutex_unlock(&wl->mutex);
+}
+
 static int b43_op_conf_tx(struct ieee80211_hw *hw,
-                          int queue,
+                          int _queue,
                           const struct ieee80211_tx_queue_params *params)
 {
+        struct b43_wl *wl = hw_to_b43_wl(hw);
+        unsigned long flags;
+        unsigned int queue = (unsigned int)_queue;
+        struct b43_qos_params *p;
+
+        if (queue >= ARRAY_SIZE(wl->qos_params)) {
+                /* Queue not available or don't support setting
+                 * params on this queue. Return success to not
+                 * confuse mac80211. */
+                return 0;
+        }
+
+        spin_lock_irqsave(&wl->irq_lock, flags);
+        p = &(wl->qos_params[queue]);
+        memcpy(&(p->p), params, sizeof(p->p));
+        p->need_hw_update = 1;
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+
+        queue_work(hw->workqueue, &wl->qos_update_work);
+
         return 0;
 }
 
@@ -3732,6 +3904,7 @@ static int b43_op_start(struct ieee80211_hw *hw)
         memset(wl->mac_addr, 0, ETH_ALEN);
         wl->filter_flags = 0;
         wl->radiotap_enabled = 0;
+        b43_qos_clear(wl);
 
         /* First register RFkill.
          * LEDs that are registered later depend on it. */
@@ -3773,6 +3946,7 @@ static void b43_op_stop(struct ieee80211_hw *hw)
         struct b43_wldev *dev = wl->current_dev;
 
         b43_rfkill_exit(dev);
+        cancel_work_sync(&(wl->qos_update_work));
 
         mutex_lock(&wl->mutex);
         if (b43_status(dev) >= B43_STAT_STARTED)
@@ -3835,6 +4009,16 @@ static int b43_op_ibss_beacon_update(struct ieee80211_hw *hw,
         return 0;
 }
 
+static void b43_op_sta_notify(struct ieee80211_hw *hw,
+                              struct ieee80211_vif *vif,
+                              enum sta_notify_cmd notify_cmd,
+                              const u8 *addr)
+{
+        struct b43_wl *wl = hw_to_b43_wl(hw);
+
+        B43_WARN_ON(!vif || wl->vif != vif);
+}
+
 static const struct ieee80211_ops b43_hw_ops = {
         .tx                     = b43_op_tx,
         .conf_tx                = b43_op_conf_tx,
@@ -3851,6 +4035,7 @@ static const struct ieee80211_ops b43_hw_ops = {
         .set_retry_limit        = b43_op_set_retry_limit,
         .set_tim                = b43_op_beacon_set_tim,
         .beacon_update          = b43_op_ibss_beacon_update,
+        .sta_notify             = b43_op_sta_notify,
 };
 
 /* Hard-reset the chip. Do not call this directly.
@@ -4122,7 +4307,7 @@ static int b43_wireless_init(struct ssb_device *dev)
         hw->max_signal = 100;
         hw->max_rssi = -110;
         hw->max_noise = -110;
-        hw->queues = 1;         /* FIXME: hardware has more queues */
+        hw->queues = b43_modparam_qos ? 4 : 1;
         SET_IEEE80211_DEV(hw, dev->dev);
         if (is_valid_ether_addr(sprom->et1mac))
                 SET_IEEE80211_PERM_ADDR(hw, sprom->et1mac);
@@ -4138,6 +4323,7 @@ static int b43_wireless_init(struct ssb_device *dev)
         spin_lock_init(&wl->shm_lock);
         mutex_init(&wl->mutex);
         INIT_LIST_HEAD(&wl->devlist);
+        INIT_WORK(&wl->qos_update_work, b43_qos_update_work);
 
         ssb_set_devtypedata(dev, wl);
         b43info(wl, "Broadcom %04X WLAN found\n", dev->bus->chip_id);
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 24a79f5d6ff5..1197975f9207 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -38,6 +38,10 @@
 /* Magic helper macro to pad structures. Ignore those above. It's magic. */
 #define PAD_BYTES(nr_bytes)             P4D_BYTES( __LINE__ , (nr_bytes))
 
+
+extern int b43_modparam_qos;
+
+
 /* Lightweight function to convert a frequency (in Mhz) to a channel number. */
 static inline u8 b43_freq_to_channel_5ghz(int freq)
 {
diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index 187c11bee0f1..ec10a8e182f9 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -705,30 +705,3 @@ void b43_tx_resume(struct b43_wldev *dev)
 {
         b43_dma_tx_resume(dev);
 }
-
-#if 0
-static void upload_qos_parms(struct b43_wldev *dev,
-                             const u16 * parms, u16 offset)
-{
-        int i;
-
-        for (i = 0; i < B43_NR_QOSPARMS; i++) {
-                b43_shm_write16(dev, B43_SHM_SHARED,
-                                offset + (i * 2), parms[i]);
-        }
-}
-#endif
-
-/* Initialize the QoS parameters */
-void b43_qos_init(struct b43_wldev *dev)
-{
-        /* FIXME: This function must probably be called from the mac80211
-         * config callback. */
-        return;
-
-        b43_hf_write(dev, b43_hf_read(dev) | B43_HF_EDCF);
-        //FIXME kill magic
-        b43_write16(dev, 0x688, b43_read16(dev, 0x688) | 0x4);
-
-        /*TODO: We might need some stack support here to get the values. */
-}
diff --git a/drivers/net/wireless/b43/xmit.h b/drivers/net/wireless/b43/xmit.h
index 41765039552b..bf58a8a85258 100644
--- a/drivers/net/wireless/b43/xmit.h
+++ b/drivers/net/wireless/b43/xmit.h
@@ -302,18 +302,6 @@ void b43_handle_hwtxstatus(struct b43_wldev *dev,
 void b43_tx_suspend(struct b43_wldev *dev);
 void b43_tx_resume(struct b43_wldev *dev);
 
-#define B43_NR_QOSPARMS         22
-enum {
-        B43_QOSPARM_TXOP = 0,
-        B43_QOSPARM_CWMIN,
-        B43_QOSPARM_CWMAX,
-        B43_QOSPARM_CWCUR,
-        B43_QOSPARM_AIFS,
-        B43_QOSPARM_BSLOTS,
-        B43_QOSPARM_REGGAP,
-        B43_QOSPARM_STATUS,
-};
-void b43_qos_init(struct b43_wldev *dev);
 
 /* Helper functions for converting the key-table index from "firmware-format"
  * to "raw-format" and back. The firmware API changed for this at some revision.
diff --git a/drivers/net/wireless/iwlwifi/Kconfig b/drivers/net/wireless/iwlwifi/Kconfig
index 24c3e3ddafc6..5b7c0160e1fa 100644
--- a/drivers/net/wireless/iwlwifi/Kconfig
+++ b/drivers/net/wireless/iwlwifi/Kconfig
@@ -1,7 +1,12 @@
+config IWLCORE
+        tristate "Intel Wireless Wifi Core"
+        depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
+
 config IWL4965
         tristate "Intel Wireless WiFi 4965AGN"
         depends on PCI && MAC80211 && WLAN_80211 && EXPERIMENTAL
         select FW_LOADER
+        select IWLCORE
         ---help---
           Select to build the driver supporting the:
 
diff --git a/drivers/net/wireless/iwlwifi/Makefile b/drivers/net/wireless/iwlwifi/Makefile
index 3bbd38358d53..6b85cca9b3f1 100644
--- a/drivers/net/wireless/iwlwifi/Makefile
+++ b/drivers/net/wireless/iwlwifi/Makefile
@@ -1,3 +1,6 @@
+obj-$(CONFIG_IWLCORE)   += iwlcore.o
+iwlcore-objs            = iwl-core.o
+
 obj-$(CONFIG_IWL3945)   += iwl3945.o
 iwl3945-objs            = iwl3945-base.o iwl-3945.o iwl-3945-rs.o
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-commands.h b/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
index 20fbb32c33bd..8b7ef9f1b57b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-commands.h
@@ -666,26 +666,26 @@ struct iwl3945_rx_frame_hdr {
         u8 payload[0];
 } __attribute__ ((packed));
 
-#define RX_RES_STATUS_NO_CRC32_ERROR    __constant_cpu_to_le32(1 << 0)
-#define RX_RES_STATUS_NO_RXE_OVERFLOW   __constant_cpu_to_le32(1 << 1)
-
-#define RX_RES_PHY_FLAGS_BAND_24_MSK    __constant_cpu_to_le16(1 << 0)
-#define RX_RES_PHY_FLAGS_MOD_CCK_MSK            __constant_cpu_to_le16(1 << 1)
-#define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     __constant_cpu_to_le16(1 << 2)
-#define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        __constant_cpu_to_le16(1 << 3)
-#define RX_RES_PHY_FLAGS_ANTENNA_MSK            __constant_cpu_to_le16(0xf0)
-
-#define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
-#define RX_RES_STATUS_SEC_TYPE_NONE     (0x0 << 8)
-#define RX_RES_STATUS_SEC_TYPE_WEP      (0x1 << 8)
-#define RX_RES_STATUS_SEC_TYPE_CCMP     (0x2 << 8)
-#define RX_RES_STATUS_SEC_TYPE_TKIP     (0x3 << 8)
-
-#define RX_RES_STATUS_DECRYPT_TYPE_MSK  (0x3 << 11)
-#define RX_RES_STATUS_NOT_DECRYPT       (0x0 << 11)
-#define RX_RES_STATUS_DECRYPT_OK        (0x3 << 11)
-#define RX_RES_STATUS_BAD_ICV_MIC       (0x1 << 11)
-#define RX_RES_STATUS_BAD_KEY_TTAK      (0x2 << 11)
+#define RX_RES_STATUS_NO_CRC32_ERROR    __constant_cpu_to_le32(1 << 0)
+#define RX_RES_STATUS_NO_RXE_OVERFLOW   __constant_cpu_to_le32(1 << 1)
+
+#define RX_RES_PHY_FLAGS_BAND_24_MSK    __constant_cpu_to_le16(1 << 0)
+#define RX_RES_PHY_FLAGS_MOD_CCK_MSK            __constant_cpu_to_le16(1 << 1)
+#define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     __constant_cpu_to_le16(1 << 2)
+#define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        __constant_cpu_to_le16(1 << 3)
+#define RX_RES_PHY_FLAGS_ANTENNA_MSK            __constant_cpu_to_le16(0xf0)
+
+#define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
+#define RX_RES_STATUS_SEC_TYPE_NONE     (0x0 << 8)
+#define RX_RES_STATUS_SEC_TYPE_WEP      (0x1 << 8)
+#define RX_RES_STATUS_SEC_TYPE_CCMP     (0x2 << 8)
+#define RX_RES_STATUS_SEC_TYPE_TKIP     (0x3 << 8)
+
+#define RX_RES_STATUS_DECRYPT_TYPE_MSK  (0x3 << 11)
+#define RX_RES_STATUS_NOT_DECRYPT       (0x0 << 11)
+#define RX_RES_STATUS_DECRYPT_OK        (0x3 << 11)
+#define RX_RES_STATUS_BAD_ICV_MIC       (0x1 << 11)
+#define RX_RES_STATUS_BAD_KEY_TTAK      (0x2 << 11)
 
 struct iwl3945_rx_frame_end {
         __le32 status;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-core.h b/drivers/net/wireless/iwlwifi/iwl-3945-core.h
new file mode 100644
index 000000000000..bc12f97ba0b1
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-core.h
@@ -0,0 +1,80 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * Tomas Winkler <tomas.winkler@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2008 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_3945_dev_h__
+#define __iwl_3945_dev_h__
+
+#define IWL_PCI_DEVICE(dev, subdev, cfg) \
+        .vendor = PCI_VENDOR_ID_INTEL,  .device = (dev), \
+        .subvendor = PCI_ANY_ID, .subdevice = (subdev), \
+        .driver_data = (kernel_ulong_t)&(cfg)
+
+#define IWL_SKU_G       0x1
+#define IWL_SKU_A       0x2
+
+struct iwl_3945_cfg {
+        const char *name;
+        const char *fw_name;
+        unsigned int sku;
+};
+
+#endif /* __iwl_dev_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-debug.h b/drivers/net/wireless/iwlwifi/iwl-3945-debug.h
index f853c6b9f76e..28ecfe8d39a3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-debug.h
@@ -40,6 +40,15 @@ do { if (iwl3945_debug_level & (level)) \
 do { if ((iwl3945_debug_level & (level)) && net_ratelimit()) \
   printk(KERN_ERR DRV_NAME": %c %s " fmt, \
          in_interrupt() ? 'I' : 'U', __FUNCTION__ , ## args); } while (0)
+
+static inline void iwl3945_print_hex_dump(int level, void *p, u32 len)
+{
+        if (!(iwl3945_debug_level & level))
+                return;
+
+        print_hex_dump(KERN_DEBUG, "iwl data: ", DUMP_PREFIX_OFFSET, 16, 1,
+                        p, len, 1);
+}
 #else
 static inline void IWL_DEBUG(int level, const char *fmt, ...)
 {
@@ -47,7 +56,12 @@ static inline void IWL_DEBUG(int level, const char *fmt, ...)
 static inline void IWL_DEBUG_LIMIT(int level, const char *fmt, ...)
 {
 }
-#endif                          /* CONFIG_IWL3945_DEBUG */
+static inline void iwl3945_print_hex_dump(int level, void *p, u32 len)
+{
+}
+#endif  /* CONFIG_IWL3945_DEBUG */
+
+
 
 /*
  * To use the debug system;
@@ -143,6 +157,7 @@ static inline void IWL_DEBUG_LIMIT(int level, const char *fmt, ...)
         IWL_DEBUG_LIMIT(IWL_DL_ASSOC | IWL_DL_INFO, f, ## a)
 #define IWL_DEBUG_HT(f, a...) IWL_DEBUG(IWL_DL_HT, f, ## a)
 #define IWL_DEBUG_STATS(f, a...) IWL_DEBUG(IWL_DL_STATS, f, ## a)
+#define IWL_DEBUG_STATS_LIMIT(f, a...) IWL_DEBUG_LIMIT(IWL_DL_STATS, f, ## a)
 #define IWL_DEBUG_TX_REPLY(f, a...) IWL_DEBUG(IWL_DL_TX_REPLY, f, ## a)
 #define IWL_DEBUG_QOS(f, a...)   IWL_DEBUG(IWL_DL_QOS, f, ## a)
 #define IWL_DEBUG_RADIO(f, a...)  IWL_DEBUG(IWL_DL_RADIO, f, ## a)
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
index 6693767adc9f..7dc19136f41a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-hw.h
@@ -321,180 +321,6 @@ struct iwl3945_eeprom {
 #define PCI_REG_WUM8       0x0E8
 #define PCI_CFG_PMC_PME_FROM_D3COLD_SUPPORT         (0x80000000)
 
-/*=== CSR (control and status registers) ===*/
-#define CSR_BASE    (0x000)
-
-#define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
-#define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
-#define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
-#define CSR_INT_MASK            (CSR_BASE+0x00c) /* host interrupt enable */
-#define CSR_FH_INT_STATUS       (CSR_BASE+0x010) /* busmaster int status/ack*/
-#define CSR_GPIO_IN             (CSR_BASE+0x018) /* read external chip pins */
-#define CSR_RESET               (CSR_BASE+0x020) /* busmaster enable, NMI, etc*/
-#define CSR_GP_CNTRL            (CSR_BASE+0x024)
-
-/*
- * Hardware revision info
- * Bit fields:
- * 31-8:  Reserved
- *  7-4:  Type of device:  0x0 = 4965, 0xd = 3945
- *  3-2:  Revision step:  0 = A, 1 = B, 2 = C, 3 = D
- *  1-0:  "Dash" value, as in A-1, etc.
- */
-#define CSR_HW_REV              (CSR_BASE+0x028)
-
-/* EEPROM reads */
-#define CSR_EEPROM_REG          (CSR_BASE+0x02c)
-#define CSR_EEPROM_GP           (CSR_BASE+0x030)
-#define CSR_GP_UCODE            (CSR_BASE+0x044)
-#define CSR_UCODE_DRV_GP1       (CSR_BASE+0x054)
-#define CSR_UCODE_DRV_GP1_SET   (CSR_BASE+0x058)
-#define CSR_UCODE_DRV_GP1_CLR   (CSR_BASE+0x05c)
-#define CSR_UCODE_DRV_GP2       (CSR_BASE+0x060)
-#define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
-
-/* Analog phase-lock-loop configuration (3945 only)
- * Set bit 24. */
-#define CSR_ANA_PLL_CFG         (CSR_BASE+0x20c)
-
-/* Bits for CSR_HW_IF_CONFIG_REG */
-#define CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MB         (0x00000100)
-#define CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MM         (0x00000200)
-#define CSR_HW_IF_CONFIG_REG_BIT_SKU_MRC            (0x00000400)
-#define CSR_HW_IF_CONFIG_REG_BIT_BOARD_TYPE         (0x00000800)
-#define CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A    (0x00000000)
-#define CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B    (0x00001000)
-#define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM     (0x00200000)
-
-/* interrupt flags in INTA, set by uCode or hardware (e.g. dma),
- * acknowledged (reset) by host writing "1" to flagged bits. */
-#define CSR_INT_BIT_FH_RX        (1 << 31) /* Rx DMA, cmd responses, FH_INT[17:16] */
-#define CSR_INT_BIT_HW_ERR       (1 << 29) /* DMA hardware error FH_INT[31] */
-#define CSR_INT_BIT_DNLD         (1 << 28) /* uCode Download */
-#define CSR_INT_BIT_FH_TX        (1 << 27) /* Tx DMA FH_INT[1:0] */
-#define CSR_INT_BIT_SCD          (1 << 26) /* TXQ pointer advanced */
-#define CSR_INT_BIT_SW_ERR       (1 << 25) /* uCode error */
-#define CSR_INT_BIT_RF_KILL      (1 << 7)  /* HW RFKILL switch GP_CNTRL[27] toggled */
-#define CSR_INT_BIT_CT_KILL      (1 << 6)  /* Critical temp (chip too hot) rfkill */
-#define CSR_INT_BIT_SW_RX        (1 << 3)  /* Rx, command responses, 3945 */
-#define CSR_INT_BIT_WAKEUP       (1 << 1)  /* NIC controller waking up (pwr mgmt) */
-#define CSR_INT_BIT_ALIVE        (1 << 0)  /* uCode interrupts once it initializes */
-
-#define CSR_INI_SET_MASK        (CSR_INT_BIT_FH_RX   | \
-                                 CSR_INT_BIT_HW_ERR  | \
-                                 CSR_INT_BIT_FH_TX   | \
-                                 CSR_INT_BIT_SW_ERR  | \
-                                 CSR_INT_BIT_RF_KILL | \
-                                 CSR_INT_BIT_SW_RX   | \
-                                 CSR_INT_BIT_WAKEUP  | \
-                                 CSR_INT_BIT_ALIVE)
-
-/* interrupt flags in FH (flow handler) (PCI busmaster DMA) */
-#define CSR_FH_INT_BIT_ERR       (1 << 31) /* Error */
-#define CSR_FH_INT_BIT_HI_PRIOR  (1 << 30) /* High priority Rx, bypass coalescing */
-#define CSR_FH_INT_BIT_RX_CHNL2  (1 << 18) /* Rx channel 2 (3945 only) */
-#define CSR_FH_INT_BIT_RX_CHNL1  (1 << 17) /* Rx channel 1 */
-#define CSR_FH_INT_BIT_RX_CHNL0  (1 << 16) /* Rx channel 0 */
-#define CSR_FH_INT_BIT_TX_CHNL6  (1 << 6)  /* Tx channel 6 (3945 only) */
-#define CSR_FH_INT_BIT_TX_CHNL1  (1 << 1)  /* Tx channel 1 */
-#define CSR_FH_INT_BIT_TX_CHNL0  (1 << 0)  /* Tx channel 0 */
-
-#define CSR_FH_INT_RX_MASK      (CSR_FH_INT_BIT_HI_PRIOR | \
-                                 CSR_FH_INT_BIT_RX_CHNL2 | \
-                                 CSR_FH_INT_BIT_RX_CHNL1 | \
-                                 CSR_FH_INT_BIT_RX_CHNL0)
-
-#define CSR_FH_INT_TX_MASK      (CSR_FH_INT_BIT_TX_CHNL6 | \
-                                 CSR_FH_INT_BIT_TX_CHNL1 | \
-                                 CSR_FH_INT_BIT_TX_CHNL0)
-
-
-/* RESET */
-#define CSR_RESET_REG_FLAG_NEVO_RESET                (0x00000001)
-#define CSR_RESET_REG_FLAG_FORCE_NMI                 (0x00000002)
-#define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
-#define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
-#define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
-
-/* GP (general purpose) CONTROL */
-#define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
-#define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
-#define CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ         (0x00000008)
-#define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
-
-#define CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN           (0x00000001)
-
-#define CSR_GP_CNTRL_REG_MSK_POWER_SAVE_TYPE         (0x07000000)
-#define CSR_GP_CNTRL_REG_FLAG_MAC_POWER_SAVE         (0x04000000)
-#define CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW          (0x08000000)
-
-
-/* EEPROM REG */
-#define CSR_EEPROM_REG_READ_VALID_MSK   (0x00000001)
-#define CSR_EEPROM_REG_BIT_CMD          (0x00000002)
-
-/* EEPROM GP */
-#define CSR_EEPROM_GP_VALID_MSK         (0x00000006)
-#define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
-#define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
-
-/* UCODE DRV GP */
-#define CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP             (0x00000001)
-#define CSR_UCODE_SW_BIT_RFKILL                     (0x00000002)
-#define CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED           (0x00000004)
-#define CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT      (0x00000008)
-
-/* GPIO */
-#define CSR_GPIO_IN_BIT_AUX_POWER                   (0x00000200)
-#define CSR_GPIO_IN_VAL_VAUX_PWR_SRC                (0x00000000)
-#define CSR_GPIO_IN_VAL_VMAIN_PWR_SRC           CSR_GPIO_IN_BIT_AUX_POWER
-
-/* GI Chicken Bits */
-#define CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
-#define CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER  (0x20000000)
-
-/* CSR_ANA_PLL_CFG */
-#define CSR_ANA_PLL_CFG_SH              (0x00880300)
-
-/*=== HBUS (Host-side Bus) ===*/
-#define HBUS_BASE       (0x400)
-
-/*
- * Registers for accessing device's internal SRAM memory (e.g. SCD SRAM
- * structures, error log, event log, verifying uCode load).
- * First write to address register, then read from or write to data register
- * to complete the job.  Once the address register is set up, accesses to
- * data registers auto-increment the address by one dword.
- * Bit usage for address registers (read or write):
- *  0-31:  memory address within device
- */
-#define HBUS_TARG_MEM_RADDR     (HBUS_BASE+0x00c)
-#define HBUS_TARG_MEM_WADDR     (HBUS_BASE+0x010)
-#define HBUS_TARG_MEM_WDAT      (HBUS_BASE+0x018)
-#define HBUS_TARG_MEM_RDAT      (HBUS_BASE+0x01c)
-
-/*
- * Registers for accessing device's internal peripheral registers
- * (e.g. SCD, BSM, etc.).  First write to address register,
- * then read from or write to data register to complete the job.
- * Bit usage for address registers (read or write):
- *  0-15:  register address (offset) within device
- * 24-25:  (# bytes - 1) to read or write (e.g. 3 for dword)
- */
-#define HBUS_TARG_PRPH_WADDR    (HBUS_BASE+0x044)
-#define HBUS_TARG_PRPH_RADDR    (HBUS_BASE+0x048)
-#define HBUS_TARG_PRPH_WDAT     (HBUS_BASE+0x04c)
-#define HBUS_TARG_PRPH_RDAT     (HBUS_BASE+0x050)
-
-/*
- * Per-Tx-queue write pointer (index, really!) (3945 and 4965).
- * Indicates index to next TFD that driver will fill (1 past latest filled).
- * Bit usage:
- *  0-7:  queue write index
- * 11-8:  queue selector
- */
-#define HBUS_TARG_WRPTR         (HBUS_BASE+0x060)
-
 /* SCD (3945 Tx Frame Scheduler) */
 #define SCD_BASE                        (CSR_BASE + 0x2E00)
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
index a8223c4cc97c..08604eb8291b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.c
@@ -158,9 +158,9 @@ static void iwl3945_clear_window(struct iwl3945_rate_scale_data *window)
 {
         window->data = 0;
         window->success_counter = 0;
-        window->success_ratio = IWL_INVALID_VALUE;
+        window->success_ratio = -1;
         window->counter = 0;
-        window->average_tpt = IWL_INVALID_VALUE;
+        window->average_tpt = IWL_INV_TPT;
         window->stamp = 0;
 }
 
@@ -459,22 +459,23 @@ static void rs_tx_status(void *priv_rate,
         struct iwl3945_rs_sta *rs_sta;
         struct ieee80211_supported_band *sband;
 
+        IWL_DEBUG_RATE("enter\n");
+
         sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
 
-        IWL_DEBUG_RATE("enter\n");
 
         retries = tx_resp->retry_count;
-        /* FIXME : this is wrong */
-        first_index = &sband->bitrates[0] - tx_resp->control.tx_rate;
+        first_index = tx_resp->control.tx_rate->hw_value;
         if ((first_index < 0) || (first_index >= IWL_RATE_COUNT)) {
                 IWL_DEBUG_RATE("leave: Rate out of bounds: %d\n", first_index);
                 return;
         }
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, hdr->addr1);
         if (!sta || !sta->rate_ctrl_priv) {
-                if (sta)
-                        sta_info_put(sta);
+                rcu_read_unlock();
                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
                 return;
         }
@@ -547,7 +548,7 @@ static void rs_tx_status(void *priv_rate,
 
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
-        sta_info_put(sta);
+        rcu_read_unlock();
 
         IWL_DEBUG_RATE("leave\n");
 
@@ -633,7 +634,7 @@ static u16 iwl3945_get_adjacent_rate(struct iwl3945_rs_sta *rs_sta,
  *
  */
 static void rs_get_rate(void *priv_rate, struct net_device *dev,
-                        struct ieee80211_supported_band *band,
+                        struct ieee80211_supported_band *sband,
                         struct sk_buff *skb,
                         struct rate_selection *sel)
 {
@@ -643,9 +644,9 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         int index;
         struct iwl3945_rs_sta *rs_sta;
         struct iwl3945_rate_scale_data *window = NULL;
-        int current_tpt = IWL_INVALID_VALUE;
-        int low_tpt = IWL_INVALID_VALUE;
-        int high_tpt = IWL_INVALID_VALUE;
+        int current_tpt = IWL_INV_TPT;
+        int low_tpt = IWL_INV_TPT;
+        int high_tpt = IWL_INV_TPT;
         u32 fail_count;
         s8 scale_action = 0;
         unsigned long flags;
@@ -658,6 +659,8 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
 
         IWL_DEBUG_RATE("enter\n");
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, hdr->addr1);
 
         /* Send management frames and broadcast/multicast data using lowest
@@ -667,16 +670,15 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
             is_multicast_ether_addr(hdr->addr1) ||
             !sta || !sta->rate_ctrl_priv) {
                 IWL_DEBUG_RATE("leave: No STA priv data to update!\n");
-                sel->rate = rate_lowest(local, band, sta);
-                if (sta)
-                        sta_info_put(sta);
+                sel->rate = rate_lowest(local, sband, sta);
+                rcu_read_unlock();
                 return;
         }
 
-        rate_mask = sta->supp_rates[band->band];
+        rate_mask = sta->supp_rates[sband->band];
         index = min(sta->last_txrate_idx & 0xffff, IWL_RATE_COUNT - 1);
 
-        if (priv->band == IEEE80211_BAND_5GHZ)
+        if (sband->band == IEEE80211_BAND_5GHZ)
                 rate_mask = rate_mask << IWL_FIRST_OFDM_RATE;
 
         rs_sta = (void *)sta->rate_ctrl_priv;
@@ -708,7 +710,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
 
         if (((fail_count <= IWL_RATE_MIN_FAILURE_TH) &&
              (window->success_counter < IWL_RATE_MIN_SUCCESS_TH))) {
-                window->average_tpt = IWL_INVALID_VALUE;
+                window->average_tpt = IWL_INV_TPT;
                 spin_unlock_irqrestore(&rs_sta->lock, flags);
 
                 IWL_DEBUG_RATE("Invalid average_tpt on rate %d: "
@@ -727,7 +729,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         current_tpt = window->average_tpt;
 
         high_low = iwl3945_get_adjacent_rate(rs_sta, index, rate_mask,
-                                             band->band);
+                                             sband->band);
         low = high_low & 0xff;
         high = (high_low >> 8) & 0xff;
 
@@ -744,19 +746,16 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         if ((window->success_ratio < IWL_RATE_DECREASE_TH) || !current_tpt) {
                 IWL_DEBUG_RATE("decrease rate because of low success_ratio\n");
                 scale_action = -1;
-        } else if ((low_tpt == IWL_INVALID_VALUE) &&
-                   (high_tpt == IWL_INVALID_VALUE))
+        } else if ((low_tpt == IWL_INV_TPT) && (high_tpt == IWL_INV_TPT))
                 scale_action = 1;
-        else if ((low_tpt != IWL_INVALID_VALUE) &&
-                   (high_tpt != IWL_INVALID_VALUE)
-                   && (low_tpt < current_tpt)
-                   && (high_tpt < current_tpt)) {
+        else if ((low_tpt != IWL_INV_TPT) && (high_tpt != IWL_INV_TPT) &&
+                 (low_tpt < current_tpt) && (high_tpt < current_tpt)) {
                 IWL_DEBUG_RATE("No action -- low [%d] & high [%d] < "
                                "current_tpt [%d]\n",
                                low_tpt, high_tpt, current_tpt);
                 scale_action = 0;
         } else {
-                if (high_tpt != IWL_INVALID_VALUE) {
+                if (high_tpt != IWL_INV_TPT) {
                         if (high_tpt > current_tpt)
                                 scale_action = 1;
                         else {
@@ -764,7 +763,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
                                     ("decrease rate because of high tpt\n");
                                 scale_action = -1;
                         }
-                } else if (low_tpt != IWL_INVALID_VALUE) {
+                } else if (low_tpt != IWL_INV_TPT) {
                         if (low_tpt > current_tpt) {
                                 IWL_DEBUG_RATE
                                     ("decrease rate because of low tpt\n");
@@ -806,16 +805,16 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
  out:
 
         sta->last_txrate_idx = index;
-        if (priv->band == IEEE80211_BAND_5GHZ)
+        if (sband->band == IEEE80211_BAND_5GHZ)
                 sta->txrate_idx = sta->last_txrate_idx - IWL_FIRST_OFDM_RATE;
         else
                 sta->txrate_idx = sta->last_txrate_idx;
 
-        sta_info_put(sta);
+        rcu_read_unlock();
 
         IWL_DEBUG_RATE("leave: %d\n", index);
 
-        sel->rate = &priv->ieee_rates[index];
+        sel->rate = &sband->bitrates[sta->txrate_idx];
 }
 
 static struct rate_control_ops rs_ops = {
@@ -843,13 +842,15 @@ int iwl3945_fill_rs_info(struct ieee80211_hw *hw, char *buf, u8 sta_id)
         unsigned long now = jiffies;
         u32 max_time = 0;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, priv->stations[sta_id].sta.sta.addr);
         if (!sta || !sta->rate_ctrl_priv) {
-                if (sta) {
-                        sta_info_put(sta);
+                if (sta)
                         IWL_DEBUG_RATE("leave - no private rate data!\n");
-                } else
+                else
                         IWL_DEBUG_RATE("leave - no station!\n");
+                rcu_read_unlock();
                 return sprintf(buf, "station %d not found\n", sta_id);
         }
 
@@ -890,7 +891,7 @@ int iwl3945_fill_rs_info(struct ieee80211_hw *hw, char *buf, u8 sta_id)
                 i = j;
         }
         spin_unlock_irqrestore(&rs_sta->lock, flags);
-        sta_info_put(sta);
+        rcu_read_unlock();
 
         /* Display the average rate of all samples taken.
          *
@@ -927,11 +928,12 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
                 return;
         }
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, priv->stations[sta_id].sta.sta.addr);
         if (!sta || !sta->rate_ctrl_priv) {
-                if (sta)
-                        sta_info_put(sta);
                 IWL_DEBUG_RATE("leave - no private rate data!\n");
+                rcu_read_unlock();
                 return;
         }
 
@@ -958,7 +960,7 @@ void iwl3945_rate_scale_init(struct ieee80211_hw *hw, s32 sta_id)
                 break;
         }
 
-        sta_info_put(sta);
+        rcu_read_unlock();
         spin_unlock_irqrestore(&rs_sta->lock, flags);
 
         rssi = priv->last_rx_rssi;
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945-rs.h b/drivers/net/wireless/iwlwifi/iwl-3945-rs.h
index d5e9220f871d..b082a093ee26 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945-rs.h
@@ -36,8 +36,8 @@ struct iwl3945_rate_info {
         u8 next_rs;             /* next rate used in rs algo */
         u8 prev_rs_tgg;         /* previous rate used in TGG rs algo */
         u8 next_rs_tgg;         /* next rate used in TGG rs algo */
-        u8 table_rs_index;      /* index in rate scale table cmd */
-        u8 prev_table_rs;       /* prev in rate table cmd */
+        u8 table_rs_index;      /* index in rate scale table cmd */
+        u8 prev_table_rs;       /* prev in rate table cmd */
 };
 
 /*
@@ -159,7 +159,7 @@ enum {
 
 #define IWL_RATES_MASK ((1 << IWL_RATE_COUNT) - 1)
 
-#define IWL_INVALID_VALUE    -1
+#define IWL_INV_TPT    -1
 
 #define IWL_MIN_RSSI_VAL                 -100
 #define IWL_MAX_RSSI_VAL                    0
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 82d282730b75..50a641c0c5b7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -39,6 +39,7 @@
 #include <asm/unaligned.h>
 #include <net/mac80211.h>
 
+#include "iwl-3945-core.h"
 #include "iwl-3945.h"
 #include "iwl-helpers.h"
 #include "iwl-3945-rs.h"
@@ -183,6 +184,16 @@ void iwl3945_disable_events(struct iwl3945_priv *priv)
 
 }
 
+static int iwl3945_hwrate_to_plcp_idx(u8 plcp)
+{
+        int idx;
+
+        for (idx = 0; idx < IWL_RATE_COUNT; idx++)
+                if (iwl3945_rates[idx].plcp == plcp)
+                        return idx;
+        return -1;
+}
+
 /**
  * iwl3945_get_antenna_flags - Get antenna flags for RXON command
  * @priv: eeprom and antenna fields are used to determine antenna flags
@@ -216,14 +227,126 @@ __le32 iwl3945_get_antenna_flags(const struct iwl3945_priv *priv)
         return 0;               /* "diversity" is default if error */
 }
 
+#ifdef CONFIG_IWL3945_DEBUG
+#define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
+
+static const char *iwl3945_get_tx_fail_reason(u32 status)
+{
+        switch (status & TX_STATUS_MSK) {
+        case TX_STATUS_SUCCESS:
+                return "SUCCESS";
+                TX_STATUS_ENTRY(SHORT_LIMIT);
+                TX_STATUS_ENTRY(LONG_LIMIT);
+                TX_STATUS_ENTRY(FIFO_UNDERRUN);
+                TX_STATUS_ENTRY(MGMNT_ABORT);
+                TX_STATUS_ENTRY(NEXT_FRAG);
+                TX_STATUS_ENTRY(LIFE_EXPIRE);
+                TX_STATUS_ENTRY(DEST_PS);
+                TX_STATUS_ENTRY(ABORTED);
+                TX_STATUS_ENTRY(BT_RETRY);
+                TX_STATUS_ENTRY(STA_INVALID);
+                TX_STATUS_ENTRY(FRAG_DROPPED);
+                TX_STATUS_ENTRY(TID_DISABLE);
+                TX_STATUS_ENTRY(FRAME_FLUSHED);
+                TX_STATUS_ENTRY(INSUFFICIENT_CF_POLL);
+                TX_STATUS_ENTRY(TX_LOCKED);
+                TX_STATUS_ENTRY(NO_BEACON_ON_RADAR);
+        }
+
+        return "UNKNOWN";
+}
+#else
+static inline const char *iwl3945_get_tx_fail_reason(u32 status)
+{
+        return "";
+}
+#endif
+
+
+/**
+ * iwl3945_tx_queue_reclaim - Reclaim Tx queue entries already Tx'd
+ *
+ * When FW advances 'R' index, all entries between old and new 'R' index
+ * need to be reclaimed. As result, some free space forms. If there is
+ * enough free space (> low mark), wake the stack that feeds us.
+ */
+static void iwl3945_tx_queue_reclaim(struct iwl3945_priv *priv,
+                                     int txq_id, int index)
+{
+        struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
+        struct iwl3945_queue *q = &txq->q;
+        struct iwl3945_tx_info *tx_info;
+
+        BUG_ON(txq_id == IWL_CMD_QUEUE_NUM);
+
+        for (index = iwl_queue_inc_wrap(index, q->n_bd); q->read_ptr != index;
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+
+                tx_info = &txq->txb[txq->q.read_ptr];
+                ieee80211_tx_status_irqsafe(priv->hw, tx_info->skb[0],
+                                            &tx_info->status);
+                tx_info->skb[0] = NULL;
+                iwl3945_hw_txq_free_tfd(priv, txq);
+        }
+
+        if (iwl3945_queue_space(q) > q->low_mark && (txq_id >= 0) &&
+                        (txq_id != IWL_CMD_QUEUE_NUM) &&
+                        priv->mac80211_registered)
+                ieee80211_wake_queue(priv->hw, txq_id);
+}
+
+/**
+ * iwl3945_rx_reply_tx - Handle Tx response
+ */
+static void iwl3945_rx_reply_tx(struct iwl3945_priv *priv,
+                            struct iwl3945_rx_mem_buffer *rxb)
+{
+        struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
+        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
+        int txq_id = SEQ_TO_QUEUE(sequence);
+        int index = SEQ_TO_INDEX(sequence);
+        struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
+        struct ieee80211_tx_status *tx_status;
+        struct iwl3945_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
+        u32  status = le32_to_cpu(tx_resp->status);
+        int rate_idx;
+
+        if ((index >= txq->q.n_bd) || (iwl3945_x2_queue_used(&txq->q, index) == 0)) {
+                IWL_ERROR("Read index for DMA queue txq_id (%d) index %d "
+                          "is out of range [0-%d] %d %d\n", txq_id,
+                          index, txq->q.n_bd, txq->q.write_ptr,
+                          txq->q.read_ptr);
+                return;
+        }
+
+        tx_status = &(txq->txb[txq->q.read_ptr].status);
+
+        tx_status->retry_count = tx_resp->failure_frame;
+        /* tx_status->rts_retry_count = tx_resp->failure_rts; */
+        tx_status->flags = ((status & TX_STATUS_MSK) == TX_STATUS_SUCCESS) ?
+                                IEEE80211_TX_STATUS_ACK : 0;
+
+        IWL_DEBUG_TX("Tx queue %d Status %s (0x%08x) plcp rate %d retries %d\n",
+                        txq_id, iwl3945_get_tx_fail_reason(status), status,
+                        tx_resp->rate, tx_resp->failure_frame);
+
+        rate_idx = iwl3945_hwrate_to_plcp_idx(tx_resp->rate);
+        tx_status->control.tx_rate = &priv->ieee_rates[rate_idx];
+        IWL_DEBUG_TX_REPLY("Tx queue reclaim %d\n", index);
+        iwl3945_tx_queue_reclaim(priv, txq_id, index);
+
+        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
+                IWL_ERROR("TODO:  Implement Tx ABORT REQUIRED!!!\n");
+}
+
+
+
 /*****************************************************************************
  *
  * Intel PRO/Wireless 3945ABG/BG Network Connection
  *
  *  RX handler implementations
  *
- *  Used by iwl-base.c
- *
  *****************************************************************************/
 
 void iwl3945_hw_rx_statistics(struct iwl3945_priv *priv, struct iwl3945_rx_mem_buffer *rxb)
@@ -238,6 +361,156 @@ void iwl3945_hw_rx_statistics(struct iwl3945_priv *priv, struct iwl3945_rx_mem_b
         priv->last_statistics_time = jiffies;
 }
 
+/******************************************************************************
+ *
+ * Misc. internal state and helper functions
+ *
+ ******************************************************************************/
+#ifdef CONFIG_IWL3945_DEBUG
+
+/**
+ * iwl3945_report_frame - dump frame to syslog during debug sessions
+ *
+ * You may hack this function to show different aspects of received frames,
+ * including selective frame dumps.
+ * group100 parameter selects whether to show 1 out of 100 good frames.
+ */
+static void iwl3945_dbg_report_frame(struct iwl3945_priv *priv,
+                      struct iwl3945_rx_packet *pkt,
+                      struct ieee80211_hdr *header, int group100)
+{
+        u32 to_us;
+        u32 print_summary = 0;
+        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
+        u32 hundred = 0;
+        u32 dataframe = 0;
+        u16 fc;
+        u16 seq_ctl;
+        u16 channel;
+        u16 phy_flags;
+        u16 length;
+        u16 status;
+        u16 bcn_tmr;
+        u32 tsf_low;
+        u64 tsf;
+        u8 rssi;
+        u8 agc;
+        u16 sig_avg;
+        u16 noise_diff;
+        struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
+        struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
+        struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
+        u8 *data = IWL_RX_DATA(pkt);
+
+        /* MAC header */
+        fc = le16_to_cpu(header->frame_control);
+        seq_ctl = le16_to_cpu(header->seq_ctrl);
+
+        /* metadata */
+        channel = le16_to_cpu(rx_hdr->channel);
+        phy_flags = le16_to_cpu(rx_hdr->phy_flags);
+        length = le16_to_cpu(rx_hdr->len);
+
+        /* end-of-frame status and timestamp */
+        status = le32_to_cpu(rx_end->status);
+        bcn_tmr = le32_to_cpu(rx_end->beacon_timestamp);
+        tsf_low = le64_to_cpu(rx_end->timestamp) & 0x0ffffffff;
+        tsf = le64_to_cpu(rx_end->timestamp);
+
+        /* signal statistics */
+        rssi = rx_stats->rssi;
+        agc = rx_stats->agc;
+        sig_avg = le16_to_cpu(rx_stats->sig_avg);
+        noise_diff = le16_to_cpu(rx_stats->noise_diff);
+
+        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
+
+        /* if data frame is to us and all is good,
+         *   (optionally) print summary for only 1 out of every 100 */
+        if (to_us && (fc & ~IEEE80211_FCTL_PROTECTED) ==
+            (IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
+                dataframe = 1;
+                if (!group100)
+                        print_summary = 1;      /* print each frame */
+                else if (priv->framecnt_to_us < 100) {
+                        priv->framecnt_to_us++;
+                        print_summary = 0;
+                } else {
+                        priv->framecnt_to_us = 0;
+                        print_summary = 1;
+                        hundred = 1;
+                }
+        } else {
+                /* print summary for all other frames */
+                print_summary = 1;
+        }
+
+        if (print_summary) {
+                char *title;
+                u32 rate;
+
+                if (hundred)
+                        title = "100Frames";
+                else if (fc & IEEE80211_FCTL_RETRY)
+                        title = "Retry";
+                else if (ieee80211_is_assoc_response(fc))
+                        title = "AscRsp";
+                else if (ieee80211_is_reassoc_response(fc))
+                        title = "RasRsp";
+                else if (ieee80211_is_probe_response(fc)) {
+                        title = "PrbRsp";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_beacon(fc)) {
+                        title = "Beacon";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_atim(fc))
+                        title = "ATIM";
+                else if (ieee80211_is_auth(fc))
+                        title = "Auth";
+                else if (ieee80211_is_deauth(fc))
+                        title = "DeAuth";
+                else if (ieee80211_is_disassoc(fc))
+                        title = "DisAssoc";
+                else
+                        title = "Frame";
+
+                rate = iwl3945_hwrate_to_plcp_idx(rx_hdr->rate);
+                if (rate == -1)
+                        rate = 0;
+                else
+                        rate = iwl3945_rates[rate].ieee / 2;
+
+                /* print frame summary.
+                 * MAC addresses show just the last byte (for brevity),
+                 *    but you can hack it to show more, if you'd like to. */
+                if (dataframe)
+                        IWL_DEBUG_RX("%s: mhd=0x%04x, dst=0x%02x, "
+                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
+                                     title, fc, header->addr1[5],
+                                     length, rssi, channel, rate);
+                else {
+                        /* src/dst addresses assume managed mode */
+                        IWL_DEBUG_RX("%s: 0x%04x, dst=0x%02x, "
+                                     "src=0x%02x, rssi=%u, tim=%lu usec, "
+                                     "phy=0x%02x, chnl=%d\n",
+                                     title, fc, header->addr1[5],
+                                     header->addr3[5], rssi,
+                                     tsf_low - priv->scan_start_tsf,
+                                     phy_flags, channel);
+                }
+        }
+        if (print_dump)
+                iwl3945_print_hex_dump(IWL_DL_RX, data, length);
+}
+#else
+static inline void iwl3945_dbg_report_frame(struct iwl3945_priv *priv,
+                      struct iwl3945_rx_packet *pkt,
+                      struct ieee80211_hdr *header, int group100)
+{
+}
+#endif
+
+
 static void iwl3945_add_radiotap(struct iwl3945_priv *priv,
                                  struct sk_buff *skb,
                                  struct iwl3945_rx_frame_hdr *rx_hdr,
@@ -376,24 +649,28 @@ static void iwl3945_handle_data_packet(struct iwl3945_priv *priv, int is_data,
 static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
                                 struct iwl3945_rx_mem_buffer *rxb)
 {
+        struct ieee80211_hdr *header;
+        struct ieee80211_rx_status rx_status;
         struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
         struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
         struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
         struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        struct ieee80211_hdr *header;
+        int snr;
         u16 rx_stats_sig_avg = le16_to_cpu(rx_stats->sig_avg);
         u16 rx_stats_noise_diff = le16_to_cpu(rx_stats->noise_diff);
-        struct ieee80211_rx_status stats = {
-                .mactime = le64_to_cpu(rx_end->timestamp),
-                .freq = ieee80211chan2mhz(le16_to_cpu(rx_hdr->channel)),
-                .band = (rx_hdr->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ,
-                .antenna = 0,
-                .rate_idx = iwl3945_rate_index_from_plcp(rx_hdr->rate),
-                .flag = 0,
-        };
         u8 network_packet;
-        int snr;
+
+        rx_status.antenna = 0;
+        rx_status.flag = 0;
+        rx_status.mactime = le64_to_cpu(rx_end->timestamp);
+        rx_status.freq = ieee80211chan2mhz(le16_to_cpu(rx_hdr->channel));
+        rx_status.band = (rx_hdr->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+
+        rx_status.rate_idx = iwl3945_hwrate_to_plcp_idx(rx_hdr->rate);
+
+        if (rx_status.band == IEEE80211_BAND_5GHZ)
+                rx_status.rate_idx -= IWL_FIRST_OFDM_RATE;
 
         if ((unlikely(rx_stats->phy_count > 20))) {
                 IWL_DEBUG_DROP
@@ -409,12 +686,12 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
         }
 
         if (priv->iw_mode == IEEE80211_IF_TYPE_MNTR) {
-                iwl3945_handle_data_packet(priv, 1, rxb, &stats);
+                iwl3945_handle_data_packet(priv, 1, rxb, &rx_status);
                 return;
         }
 
         /* Convert 3945's rssi indicator to dBm */
-        stats.ssi = rx_stats->rssi - IWL_RSSI_OFFSET;
+        rx_status.ssi = rx_stats->rssi - IWL_RSSI_OFFSET;
 
         /* Set default noise value to -127 */
         if (priv->last_rx_noise == 0)
@@ -430,50 +707,47 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
          *   signal-to-noise ratio (SNR) is (sig_avg / noise_diff).
          * Convert linear SNR to dB SNR, then subtract that from rssi dBm
          *   to obtain noise level in dBm.
-         * Calculate stats.signal (quality indicator in %) based on SNR. */
+         * Calculate rx_status.signal (quality indicator in %) based on SNR. */
         if (rx_stats_noise_diff) {
                 snr = rx_stats_sig_avg / rx_stats_noise_diff;
-                stats.noise = stats.ssi - iwl3945_calc_db_from_ratio(snr);
-                stats.signal = iwl3945_calc_sig_qual(stats.ssi, stats.noise);
+                rx_status.noise = rx_status.ssi -
+                                        iwl3945_calc_db_from_ratio(snr);
+                rx_status.signal = iwl3945_calc_sig_qual(rx_status.ssi,
+                                                         rx_status.noise);
 
         /* If noise info not available, calculate signal quality indicator (%)
          *   using just the dBm signal level. */
         } else {
-                stats.noise = priv->last_rx_noise;
-                stats.signal = iwl3945_calc_sig_qual(stats.ssi, 0);
+                rx_status.noise = priv->last_rx_noise;
+                rx_status.signal = iwl3945_calc_sig_qual(rx_status.ssi, 0);
         }
 
 
         IWL_DEBUG_STATS("Rssi %d noise %d qual %d sig_avg %d noise_diff %d\n",
-                        stats.ssi, stats.noise, stats.signal,
+                        rx_status.ssi, rx_status.noise, rx_status.signal,
                         rx_stats_sig_avg, rx_stats_noise_diff);
 
-        /* can be covered by iwl3945_report_frame() in most cases */
-/*      IWL_DEBUG_RX("RX status: 0x%08X\n", rx_end->status); */
-
         header = (struct ieee80211_hdr *)IWL_RX_DATA(pkt);
 
         network_packet = iwl3945_is_network_packet(priv, header);
 
-#ifdef CONFIG_IWL3945_DEBUG
-        if (iwl3945_debug_level & IWL_DL_STATS && net_ratelimit())
-                IWL_DEBUG_STATS
-                    ("[%c] %d RSSI: %d Signal: %u, Noise: %u, Rate: %u\n",
-                     network_packet ? '*' : ' ',
-                     le16_to_cpu(rx_hdr->channel),
-                     stats.ssi, stats.ssi,
-                     stats.ssi, stats.rate_idx);
+        IWL_DEBUG_STATS_LIMIT("[%c] %d RSSI:%d Signal:%u, Noise:%u, Rate:%u\n",
+                              network_packet ? '*' : ' ',
+                              le16_to_cpu(rx_hdr->channel),
+                              rx_status.ssi, rx_status.ssi,
+                              rx_status.ssi, rx_status.rate_idx);
 
+#ifdef CONFIG_IWL3945_DEBUG
         if (iwl3945_debug_level & (IWL_DL_RX))
                 /* Set "1" to report good data frames in groups of 100 */
-                iwl3945_report_frame(priv, pkt, header, 1);
+                iwl3945_dbg_report_frame(priv, pkt, header, 1);
 #endif
 
         if (network_packet) {
                 priv->last_beacon_time = le32_to_cpu(rx_end->beacon_timestamp);
                 priv->last_tsf = le64_to_cpu(rx_end->timestamp);
-                priv->last_rx_rssi = stats.ssi;
-                priv->last_rx_noise = stats.noise;
+                priv->last_rx_rssi = rx_status.ssi;
+                priv->last_rx_noise = rx_status.noise;
         }
 
         switch (le16_to_cpu(header->frame_control) & IEEE80211_FCTL_FTYPE) {
@@ -560,7 +834,7 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
                         }
                 }
 
-                iwl3945_handle_data_packet(priv, 0, rxb, &stats);
+                iwl3945_handle_data_packet(priv, 0, rxb, &rx_status);
                 break;
 
         case IEEE80211_FTYPE_CTL:
@@ -577,7 +851,7 @@ static void iwl3945_rx_reply_rx(struct iwl3945_priv *priv,
                                        print_mac(mac2, header->addr2),
                                        print_mac(mac3, header->addr3));
                 else
-                        iwl3945_handle_data_packet(priv, 1, rxb, &stats);
+                        iwl3945_handle_data_packet(priv, 1, rxb, &rx_status);
                 break;
         }
         }
@@ -993,19 +1267,19 @@ int iwl3945_hw_nic_init(struct iwl3945_priv *priv)
         if (rev_id & PCI_CFG_REV_ID_BIT_RTP)
                 IWL_DEBUG_INFO("RTP type \n");
         else if (rev_id & PCI_CFG_REV_ID_BIT_BASIC_SKU) {
-                IWL_DEBUG_INFO("ALM-MB type\n");
+                IWL_DEBUG_INFO("3945 RADIO-MB type\n");
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MB);
+                            CSR39_HW_IF_CONFIG_REG_BIT_3945_MB);
         } else {
-                IWL_DEBUG_INFO("ALM-MM type\n");
+                IWL_DEBUG_INFO("3945 RADIO-MM type\n");
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_ALMAGOR_MM);
+                            CSR39_HW_IF_CONFIG_REG_BIT_3945_MM);
         }
 
         if (EEPROM_SKU_CAP_OP_MODE_MRC == priv->eeprom.sku_cap) {
                 IWL_DEBUG_INFO("SKU OP mode is mrc\n");
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_SKU_MRC);
+                            CSR39_HW_IF_CONFIG_REG_BIT_SKU_MRC);
         } else
                 IWL_DEBUG_INFO("SKU OP mode is basic\n");
 
@@ -1013,24 +1287,24 @@ int iwl3945_hw_nic_init(struct iwl3945_priv *priv)
                 IWL_DEBUG_INFO("3945ABG revision is 0x%X\n",
                                priv->eeprom.board_revision);
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BIT_BOARD_TYPE);
+                            CSR39_HW_IF_CONFIG_REG_BIT_BOARD_TYPE);
         } else {
                 IWL_DEBUG_INFO("3945ABG revision is 0x%X\n",
                                priv->eeprom.board_revision);
                 iwl3945_clear_bit(priv, CSR_HW_IF_CONFIG_REG,
-                              CSR_HW_IF_CONFIG_REG_BIT_BOARD_TYPE);
+                              CSR39_HW_IF_CONFIG_REG_BIT_BOARD_TYPE);
         }
 
         if (priv->eeprom.almgor_m_version <= 1) {
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A);
+                            CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A);
                 IWL_DEBUG_INFO("Card M type A version is 0x%X\n",
                                priv->eeprom.almgor_m_version);
         } else {
                 IWL_DEBUG_INFO("Card M type B version is 0x%X\n",
                                priv->eeprom.almgor_m_version);
                 iwl3945_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                            CSR_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B);
+                            CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B);
         }
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -2348,6 +2622,7 @@ unsigned int iwl3945_hw_get_beacon_cmd(struct iwl3945_priv *priv,
 
 void iwl3945_hw_rx_handler_setup(struct iwl3945_priv *priv)
 {
+        priv->rx_handlers[REPLY_TX] = iwl3945_rx_reply_tx;
         priv->rx_handlers[REPLY_3945_RX] = iwl3945_rx_reply_rx;
 }
 
@@ -2362,9 +2637,25 @@ void iwl3945_hw_cancel_deferred_work(struct iwl3945_priv *priv)
         cancel_delayed_work(&priv->thermal_periodic);
 }
 
+static struct iwl_3945_cfg iwl3945_bg_cfg = {
+        .name = "3945BG",
+        .fw_name = "iwlwifi-3945" IWL3945_UCODE_API ".ucode",
+        .sku = IWL_SKU_G,
+};
+
+static struct iwl_3945_cfg iwl3945_abg_cfg = {
+        .name = "3945ABG",
+        .fw_name = "iwlwifi-3945" IWL3945_UCODE_API ".ucode",
+        .sku = IWL_SKU_A|IWL_SKU_G,
+};
+
 struct pci_device_id iwl3945_hw_card_ids[] = {
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4222)},
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4227)},
+        {IWL_PCI_DEVICE(0x4222, 0x1005, iwl3945_bg_cfg)},
+        {IWL_PCI_DEVICE(0x4222, 0x1034, iwl3945_bg_cfg)},
+        {IWL_PCI_DEVICE(0x4222, 0x1044, iwl3945_bg_cfg)},
+        {IWL_PCI_DEVICE(0x4227, 0x1014, iwl3945_bg_cfg)},
+        {IWL_PCI_DEVICE(0x4222, PCI_ANY_ID, iwl3945_abg_cfg)},
+        {IWL_PCI_DEVICE(0x4227, PCI_ANY_ID, iwl3945_abg_cfg)},
         {0}
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.h b/drivers/net/wireless/iwlwifi/iwl-3945.h
index dde389d31637..0ab22d366d93 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.h
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.h
@@ -40,10 +40,17 @@
 extern struct pci_device_id iwl3945_hw_card_ids[];
 
 #define DRV_NAME        "iwl3945"
-#include "iwl-3945-hw.h"
+#include "iwl-csr.h"
 #include "iwl-prph.h"
+#include "iwl-3945-hw.h"
 #include "iwl-3945-debug.h"
 
+/* Change firmware file name, using "-" and incrementing number,
+ *   *only* when uCode interface or architecture changes so that it
+ *   is not compatible with earlier drivers.
+ * This number will also appear in << 8 position of 1st dword of uCode file */
+#define IWL3945_UCODE_API "-1"
+
 /* Default noise level to report when noise measurement is not available.
  *   This may be because we're:
  *   1)  Not associated (4965, no beacon statistics being sent to driver)
@@ -109,6 +116,9 @@ struct iwl3945_queue {
                                 * space less than this */
 } __attribute__ ((packed));
 
+int iwl3945_queue_space(const struct iwl3945_queue *q);
+int iwl3945_x2_queue_used(const struct iwl3945_queue *q, int i);
+
 #define MAX_NUM_OF_TBS          (20)
 
 /* One for each TFD */
@@ -558,16 +568,6 @@ extern int iwl3945_is_network_packet(struct iwl3945_priv *priv,
                                  struct ieee80211_hdr *header);
 extern int iwl3945_power_init_handle(struct iwl3945_priv *priv);
 extern int iwl3945_eeprom_init(struct iwl3945_priv *priv);
-#ifdef CONFIG_IWL3945_DEBUG
-extern void iwl3945_report_frame(struct iwl3945_priv *priv,
-                             struct iwl3945_rx_packet *pkt,
-                             struct ieee80211_hdr *header, int group100);
-#else
-static inline void iwl3945_report_frame(struct iwl3945_priv *priv,
-                                    struct iwl3945_rx_packet *pkt,
-                                    struct ieee80211_hdr *header,
-                                    int group100) {}
-#endif
 extern void iwl3945_handle_data_packet_monitor(struct iwl3945_priv *priv,
                                            struct iwl3945_rx_mem_buffer *rxb,
                                            void *data, short len,
@@ -691,6 +691,7 @@ struct iwl3945_priv {
         struct ieee80211_hw *hw;
         struct ieee80211_channel *ieee_channels;
         struct ieee80211_rate *ieee_rates;
+        struct iwl_3945_cfg *cfg; /* device configuration */
 
         /* temporary frame storage list */
         struct list_head free_frames;
@@ -800,7 +801,6 @@ struct iwl3945_priv {
         struct iwl3945_tx_queue txq[IWL_MAX_NUM_QUEUES];
 
         unsigned long status;
-        u32 config;
 
         int last_rx_rssi;       /* From Rx packet statisitics */
         int last_rx_noise;      /* From beacon statistics */
@@ -830,7 +830,6 @@ struct iwl3945_priv {
         int is_open;
 
         u8 mac80211_registered;
-        int is_abg;
 
         u32 notif_missed_beacons;
 
@@ -950,16 +949,6 @@ static inline int is_channel_ibss(const struct iwl3945_channel_info *ch)
         return ((ch->flags & EEPROM_CHANNEL_IBSS)) ? 1 : 0;
 }
 
-static inline int iwl3945_rate_index_from_plcp(int plcp)
-{
-        int i;
-
-        for (i = 0; i < IWL_RATE_COUNT; i++)
-                if (iwl3945_rates[i].plcp == plcp)
-                        return i;
-        return -1;
-}
-
 extern const struct iwl3945_channel_info *iwl3945_get_channel_info(
         const struct iwl3945_priv *priv, enum ieee80211_band band, u16 channel);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-commands.h b/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
index b21ffea325cf..327eabce182c 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-commands.h
@@ -875,26 +875,26 @@ struct iwl4965_rx_frame_hdr {
         u8 payload[0];
 } __attribute__ ((packed));
 
-#define RX_RES_STATUS_NO_CRC32_ERROR    __constant_cpu_to_le32(1 << 0)
-#define RX_RES_STATUS_NO_RXE_OVERFLOW   __constant_cpu_to_le32(1 << 1)
-
-#define RX_RES_PHY_FLAGS_BAND_24_MSK    __constant_cpu_to_le16(1 << 0)
-#define RX_RES_PHY_FLAGS_MOD_CCK_MSK            __constant_cpu_to_le16(1 << 1)
-#define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     __constant_cpu_to_le16(1 << 2)
-#define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        __constant_cpu_to_le16(1 << 3)
-#define RX_RES_PHY_FLAGS_ANTENNA_MSK            __constant_cpu_to_le16(0xf0)
-
-#define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
-#define RX_RES_STATUS_SEC_TYPE_NONE     (0x0 << 8)
-#define RX_RES_STATUS_SEC_TYPE_WEP      (0x1 << 8)
-#define RX_RES_STATUS_SEC_TYPE_CCMP     (0x2 << 8)
-#define RX_RES_STATUS_SEC_TYPE_TKIP     (0x3 << 8)
-
-#define RX_RES_STATUS_DECRYPT_TYPE_MSK  (0x3 << 11)
-#define RX_RES_STATUS_NOT_DECRYPT       (0x0 << 11)
-#define RX_RES_STATUS_DECRYPT_OK        (0x3 << 11)
-#define RX_RES_STATUS_BAD_ICV_MIC       (0x1 << 11)
-#define RX_RES_STATUS_BAD_KEY_TTAK      (0x2 << 11)
+#define RX_RES_STATUS_NO_CRC32_ERROR    __constant_cpu_to_le32(1 << 0)
+#define RX_RES_STATUS_NO_RXE_OVERFLOW   __constant_cpu_to_le32(1 << 1)
+
+#define RX_RES_PHY_FLAGS_BAND_24_MSK    __constant_cpu_to_le16(1 << 0)
+#define RX_RES_PHY_FLAGS_MOD_CCK_MSK            __constant_cpu_to_le16(1 << 1)
+#define RX_RES_PHY_FLAGS_SHORT_PREAMBLE_MSK     __constant_cpu_to_le16(1 << 2)
+#define RX_RES_PHY_FLAGS_NARROW_BAND_MSK        __constant_cpu_to_le16(1 << 3)
+#define RX_RES_PHY_FLAGS_ANTENNA_MSK            __constant_cpu_to_le16(0xf0)
+
+#define RX_RES_STATUS_SEC_TYPE_MSK      (0x7 << 8)
+#define RX_RES_STATUS_SEC_TYPE_NONE     (0x0 << 8)
+#define RX_RES_STATUS_SEC_TYPE_WEP      (0x1 << 8)
+#define RX_RES_STATUS_SEC_TYPE_CCMP     (0x2 << 8)
+#define RX_RES_STATUS_SEC_TYPE_TKIP     (0x3 << 8)
+
+#define RX_RES_STATUS_DECRYPT_TYPE_MSK  (0x3 << 11)
+#define RX_RES_STATUS_NOT_DECRYPT       (0x0 << 11)
+#define RX_RES_STATUS_DECRYPT_OK        (0x3 << 11)
+#define RX_RES_STATUS_BAD_ICV_MIC       (0x1 << 11)
+#define RX_RES_STATUS_BAD_KEY_TTAK      (0x2 << 11)
 
 struct iwl4965_rx_frame_end {
         __le32 status;
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-debug.h b/drivers/net/wireless/iwlwifi/iwl-4965-debug.h
index 36696bbf170c..baf07c715cf8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-debug.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-debug.h
@@ -40,15 +40,30 @@ do { if (iwl4965_debug_level & (level)) \
 do { if ((iwl4965_debug_level & (level)) && net_ratelimit()) \
   printk(KERN_ERR DRV_NAME": %c %s " fmt, \
          in_interrupt() ? 'I' : 'U', __FUNCTION__ , ## args); } while (0)
+
+static inline void iwl4965_print_hex_dump(int level, void *p, u32 len)
+{
+        if (!(iwl4965_debug_level & level))
+                return;
+
+        print_hex_dump(KERN_DEBUG, "iwl data: ", DUMP_PREFIX_OFFSET, 16, 1,
+                        p, len, 1);
+}
 #else
+
 static inline void IWL_DEBUG(int level, const char *fmt, ...)
 {
 }
 static inline void IWL_DEBUG_LIMIT(int level, const char *fmt, ...)
 {
 }
+static inline void iwl4965_print_hex_dump(int level, void *p, u32 len)
+{
+}
 #endif                          /* CONFIG_IWL4965_DEBUG */
 
+
+
 /*
  * To use the debug system;
  *
@@ -143,6 +158,7 @@ static inline void IWL_DEBUG_LIMIT(int level, const char *fmt, ...)
         IWL_DEBUG_LIMIT(IWL_DL_ASSOC | IWL_DL_INFO, f, ## a)
 #define IWL_DEBUG_HT(f, a...) IWL_DEBUG(IWL_DL_HT, f, ## a)
 #define IWL_DEBUG_STATS(f, a...) IWL_DEBUG(IWL_DL_STATS, f, ## a)
+#define IWL_DEBUG_STATS_LIMIT(f, a...) IWL_DEBUG_LIMIT(IWL_DL_STATS, f, ## a)
 #define IWL_DEBUG_TX_REPLY(f, a...) IWL_DEBUG(IWL_DL_TX_REPLY, f, ## a)
 #define IWL_DEBUG_QOS(f, a...)   IWL_DEBUG(IWL_DL_QOS, f, ## a)
 #define IWL_DEBUG_RADIO(f, a...)  IWL_DEBUG(IWL_DL_RADIO, f, ## a)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
index cc726215ab93..24413a479a3f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-hw.h
@@ -410,181 +410,6 @@ struct iwl4965_eeprom {
 #define PCI_REG_WUM8       0x0E8
 #define PCI_CFG_PMC_PME_FROM_D3COLD_SUPPORT         (0x80000000)
 
-/*=== CSR (control and status registers) ===*/
-#define CSR_BASE    (0x000)
-
-#define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
-#define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
-#define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
-#define CSR_INT_MASK            (CSR_BASE+0x00c) /* host interrupt enable */
-#define CSR_FH_INT_STATUS       (CSR_BASE+0x010) /* busmaster int status/ack*/
-#define CSR_GPIO_IN             (CSR_BASE+0x018) /* read external chip pins */
-#define CSR_RESET               (CSR_BASE+0x020) /* busmaster enable, NMI, etc*/
-#define CSR_GP_CNTRL            (CSR_BASE+0x024)
-
-/*
- * Hardware revision info
- * Bit fields:
- * 31-8:  Reserved
- *  7-4:  Type of device:  0x0 = 4965, 0xd = 3945
- *  3-2:  Revision step:  0 = A, 1 = B, 2 = C, 3 = D
- *  1-0:  "Dash" value, as in A-1, etc.
- *
- * NOTE:  Revision step affects calculation of CCK txpower for 4965.
- */
-#define CSR_HW_REV              (CSR_BASE+0x028)
-
-/* EEPROM reads */
-#define CSR_EEPROM_REG          (CSR_BASE+0x02c)
-#define CSR_EEPROM_GP           (CSR_BASE+0x030)
-#define CSR_GP_UCODE            (CSR_BASE+0x044)
-#define CSR_UCODE_DRV_GP1       (CSR_BASE+0x054)
-#define CSR_UCODE_DRV_GP1_SET   (CSR_BASE+0x058)
-#define CSR_UCODE_DRV_GP1_CLR   (CSR_BASE+0x05c)
-#define CSR_UCODE_DRV_GP2       (CSR_BASE+0x060)
-#define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
-
-/*
- * Indicates hardware rev, to determine CCK backoff for txpower calculation.
- * Bit fields:
- *  3-2:  0 = A, 1 = B, 2 = C, 3 = D step
- */
-#define CSR_HW_REV_WA_REG       (CSR_BASE+0x22C)
-
-/* Hardware interface configuration bits */
-#define CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R       (0x00000010)
-#define CSR_HW_IF_CONFIG_REG_MSK_BOARD_VER      (0x00000C00)
-#define CSR_HW_IF_CONFIG_REG_BIT_MAC_SI         (0x00000100)
-#define CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI       (0x00000200)
-#define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM (0x00200000)
-
-/* interrupt flags in INTA, set by uCode or hardware (e.g. dma),
- * acknowledged (reset) by host writing "1" to flagged bits. */
-#define CSR_INT_BIT_FH_RX        (1 << 31) /* Rx DMA, cmd responses, FH_INT[17:16] */
-#define CSR_INT_BIT_HW_ERR       (1 << 29) /* DMA hardware error FH_INT[31] */
-#define CSR_INT_BIT_DNLD         (1 << 28) /* uCode Download */
-#define CSR_INT_BIT_FH_TX        (1 << 27) /* Tx DMA FH_INT[1:0] */
-#define CSR_INT_BIT_SCD          (1 << 26) /* TXQ pointer advanced */
-#define CSR_INT_BIT_SW_ERR       (1 << 25) /* uCode error */
-#define CSR_INT_BIT_RF_KILL      (1 << 7)  /* HW RFKILL switch GP_CNTRL[27] toggled */
-#define CSR_INT_BIT_CT_KILL      (1 << 6)  /* Critical temp (chip too hot) rfkill */
-#define CSR_INT_BIT_SW_RX        (1 << 3)  /* Rx, command responses, 3945 */
-#define CSR_INT_BIT_WAKEUP       (1 << 1)  /* NIC controller waking up (pwr mgmt) */
-#define CSR_INT_BIT_ALIVE        (1 << 0)  /* uCode interrupts once it initializes */
-
-#define CSR_INI_SET_MASK        (CSR_INT_BIT_FH_RX   | \
-                                 CSR_INT_BIT_HW_ERR  | \
-                                 CSR_INT_BIT_FH_TX   | \
-                                 CSR_INT_BIT_SW_ERR  | \
-                                 CSR_INT_BIT_RF_KILL | \
-                                 CSR_INT_BIT_SW_RX   | \
-                                 CSR_INT_BIT_WAKEUP  | \
-                                 CSR_INT_BIT_ALIVE)
-
-/* interrupt flags in FH (flow handler) (PCI busmaster DMA) */
-#define CSR_FH_INT_BIT_ERR       (1 << 31) /* Error */
-#define CSR_FH_INT_BIT_HI_PRIOR  (1 << 30) /* High priority Rx, bypass coalescing */
-#define CSR_FH_INT_BIT_RX_CHNL1  (1 << 17) /* Rx channel 1 */
-#define CSR_FH_INT_BIT_RX_CHNL0  (1 << 16) /* Rx channel 0 */
-#define CSR_FH_INT_BIT_TX_CHNL1  (1 << 1)  /* Tx channel 1 */
-#define CSR_FH_INT_BIT_TX_CHNL0  (1 << 0)  /* Tx channel 0 */
-
-#define CSR_FH_INT_RX_MASK      (CSR_FH_INT_BIT_HI_PRIOR | \
-                                 CSR_FH_INT_BIT_RX_CHNL1 | \
-                                 CSR_FH_INT_BIT_RX_CHNL0)
-
-#define CSR_FH_INT_TX_MASK      (CSR_FH_INT_BIT_TX_CHNL1 | \
-                                 CSR_FH_INT_BIT_TX_CHNL0)
-
-
-/* RESET */
-#define CSR_RESET_REG_FLAG_NEVO_RESET                (0x00000001)
-#define CSR_RESET_REG_FLAG_FORCE_NMI                 (0x00000002)
-#define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
-#define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
-#define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
-
-/* GP (general purpose) CONTROL */
-#define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
-#define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
-#define CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ         (0x00000008)
-#define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
-
-#define CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN           (0x00000001)
-
-#define CSR_GP_CNTRL_REG_MSK_POWER_SAVE_TYPE         (0x07000000)
-#define CSR_GP_CNTRL_REG_FLAG_MAC_POWER_SAVE         (0x04000000)
-#define CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW          (0x08000000)
-
-
-/* EEPROM REG */
-#define CSR_EEPROM_REG_READ_VALID_MSK   (0x00000001)
-#define CSR_EEPROM_REG_BIT_CMD          (0x00000002)
-
-/* EEPROM GP */
-#define CSR_EEPROM_GP_VALID_MSK         (0x00000006)
-#define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
-#define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
-
-/* UCODE DRV GP */
-#define CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP             (0x00000001)
-#define CSR_UCODE_SW_BIT_RFKILL                     (0x00000002)
-#define CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED           (0x00000004)
-#define CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT      (0x00000008)
-
-/* GPIO */
-#define CSR_GPIO_IN_BIT_AUX_POWER                   (0x00000200)
-#define CSR_GPIO_IN_VAL_VAUX_PWR_SRC                (0x00000000)
-#define CSR_GPIO_IN_VAL_VMAIN_PWR_SRC           CSR_GPIO_IN_BIT_AUX_POWER
-
-/* GI Chicken Bits */
-#define CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
-#define CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER  (0x20000000)
-
-/*=== HBUS (Host-side Bus) ===*/
-#define HBUS_BASE       (0x400)
-
-/*
- * Registers for accessing device's internal SRAM memory (e.g. SCD SRAM
- * structures, error log, event log, verifying uCode load).
- * First write to address register, then read from or write to data register
- * to complete the job.  Once the address register is set up, accesses to
- * data registers auto-increment the address by one dword.
- * Bit usage for address registers (read or write):
- *  0-31:  memory address within device
- */
-#define HBUS_TARG_MEM_RADDR     (HBUS_BASE+0x00c)
-#define HBUS_TARG_MEM_WADDR     (HBUS_BASE+0x010)
-#define HBUS_TARG_MEM_WDAT      (HBUS_BASE+0x018)
-#define HBUS_TARG_MEM_RDAT      (HBUS_BASE+0x01c)
-
-/*
- * Registers for accessing device's internal peripheral registers
- * (e.g. SCD, BSM, etc.).  First write to address register,
- * then read from or write to data register to complete the job.
- * Bit usage for address registers (read or write):
- *  0-15:  register address (offset) within device
- * 24-25:  (# bytes - 1) to read or write (e.g. 3 for dword)
- */
-#define HBUS_TARG_PRPH_WADDR    (HBUS_BASE+0x044)
-#define HBUS_TARG_PRPH_RADDR    (HBUS_BASE+0x048)
-#define HBUS_TARG_PRPH_WDAT     (HBUS_BASE+0x04c)
-#define HBUS_TARG_PRPH_RDAT     (HBUS_BASE+0x050)
-
-/*
- * Per-Tx-queue write pointer (index, really!) (3945 and 4965).
- * Driver sets this to indicate index to next TFD that driver will fill
- * (1 past latest filled).
- * Bit usage:
- *  0-7:  queue write index (0-255)
- * 11-8:  queue selector (0-15)
- */
-#define HBUS_TARG_WRPTR         (HBUS_BASE+0x060)
-
-#define HBUS_TARG_MBX_C         (HBUS_BASE+0x030)
-
-#define HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED         (0x00000004)
-
 #define TFD_QUEUE_SIZE_MAX      (256)
 
 #define IWL_NUM_SCAN_RATES         (2)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
index 48a6a85355ec..25e73864c2a4 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.c
@@ -570,7 +570,7 @@ static int rs_get_tbl_info_from_mcs(const struct iwl4965_rate *mcs_rate,
         int index;
         u32 ant_msk;
 
-        index = iwl4965_rate_index_from_plcp(mcs_rate->rate_n_flags);
+        index = iwl4965_hwrate_to_plcp_idx(mcs_rate->rate_n_flags);
 
         if (index  == IWL_RATE_INVALID) {
                 *rate_idx = -1;
@@ -823,6 +823,7 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
         struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data;
         struct iwl4965_priv *priv = (struct iwl4965_priv *)priv_rate;
         struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
+        struct ieee80211_hw *hw = local_to_hw(local);
         struct iwl4965_rate_scale_data *window = NULL;
         struct iwl4965_rate_scale_data *search_win = NULL;
         struct iwl4965_rate tx_mcs;
@@ -847,23 +848,22 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
         if (retries > 15)
                 retries = 15;
 
+        rcu_read_lock();
 
         sta = sta_info_get(local, hdr->addr1);
 
-        if (!sta || !sta->rate_ctrl_priv) {
-                if (sta)
-                        sta_info_put(sta);
-                return;
-        }
+        if (!sta || !sta->rate_ctrl_priv)
+                goto out;
+
 
         lq_sta = (struct iwl4965_lq_sta *)sta->rate_ctrl_priv;
 
         if (!priv->lq_mngr.lq_ready)
-                return;
+                goto out;
 
         if ((priv->iw_mode == IEEE80211_IF_TYPE_IBSS) &&
             !lq_sta->ibss_sta_added)
-                return;
+                goto out;
 
         table = &lq_sta->lq;
         active_index = lq_sta->active_tbl;
@@ -884,17 +884,6 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
         search_win = (struct iwl4965_rate_scale_data *)
             &(search_tbl->win[0]);
 
-        tx_mcs.rate_n_flags = tx_resp->control.tx_rate->hw_value;
-
-        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band,
-                                  &tbl_type, &rs_index);
-        if ((rs_index < 0) || (rs_index >= IWL_RATE_COUNT)) {
-                IWL_DEBUG_RATE("bad rate index at: %d rate 0x%X\n",
-                             rs_index, tx_mcs.rate_n_flags);
-                sta_info_put(sta);
-                return;
-        }
-
         /*
          * Ignore this Tx frame response if its initial rate doesn't match
          * that of latest Link Quality command.  There may be stragglers
@@ -903,14 +892,29 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
          * to check "search" mode, or a prior "search" mode after we've moved
          * to a new "search" mode (which might become the new "active" mode).
          */
-        if (retries &&
-            (tx_mcs.rate_n_flags !=
-                                le32_to_cpu(table->rs_table[0].rate_n_flags))) {
-                IWL_DEBUG_RATE("initial rate does not match 0x%x 0x%x\n",
-                                tx_mcs.rate_n_flags,
-                                le32_to_cpu(table->rs_table[0].rate_n_flags));
-                sta_info_put(sta);
-                return;
+        tx_mcs.rate_n_flags = le32_to_cpu(table->rs_table[0].rate_n_flags);
+        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band, &tbl_type, &rs_index);
+        if (priv->band == IEEE80211_BAND_5GHZ)
+                rs_index -= IWL_FIRST_OFDM_RATE;
+
+        if ((tx_resp->control.tx_rate == NULL) ||
+            (tbl_type.is_SGI ^
+                !!(tx_resp->control.flags & IEEE80211_TXCTL_SHORT_GI)) ||
+            (tbl_type.is_fat ^
+                !!(tx_resp->control.flags & IEEE80211_TXCTL_40_MHZ_WIDTH)) ||
+            (tbl_type.is_dup ^
+                !!(tx_resp->control.flags & IEEE80211_TXCTL_DUP_DATA)) ||
+            (tbl_type.antenna_type ^
+                tx_resp->control.antenna_sel_tx) ||
+            (!!(tx_mcs.rate_n_flags & RATE_MCS_HT_MSK) ^
+                !!(tx_resp->control.flags & IEEE80211_TXCTL_OFDM_HT)) ||
+            (!!(tx_mcs.rate_n_flags & RATE_MCS_GF_MSK) ^
+                !!(tx_resp->control.flags & IEEE80211_TXCTL_GREEN_FIELD)) ||
+            (hw->wiphy->bands[priv->band]->bitrates[rs_index].bitrate !=
+                tx_resp->control.tx_rate->bitrate)) {
+                IWL_DEBUG_RATE("initial rate does not match 0x%x\n",
+                                tx_mcs.rate_n_flags);
+                goto out;
         }
 
         /* Update frame history window with "failure" for each Tx retry. */
@@ -959,14 +963,8 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
          * if Tx was successful first try, use original rate,
          * else look up the rate that was, finally, successful.
          */
-        if (!tx_resp->retry_count)
-                tx_mcs.rate_n_flags = tx_resp->control.tx_rate->hw_value;
-        else
-                tx_mcs.rate_n_flags =
-                        le32_to_cpu(table->rs_table[index].rate_n_flags);
-
-        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band,
-                                  &tbl_type, &rs_index);
+        tx_mcs.rate_n_flags = le32_to_cpu(table->rs_table[index].rate_n_flags);
+        rs_get_tbl_info_from_mcs(&tx_mcs, priv->band, &tbl_type, &rs_index);
 
         /* Update frame history window with "success" if Tx got ACKed ... */
         if (tx_resp->flags & IEEE80211_TX_STATUS_ACK)
@@ -1025,7 +1023,8 @@ static void rs_tx_status(void *priv_rate, struct net_device *dev,
 
         /* See if there's a better rate or modulation mode to try. */
         rs_rate_scale_perform(priv, dev, hdr, sta);
-        sta_info_put(sta);
+out:
+        rcu_read_unlock();
         return;
 }
 
@@ -1921,7 +1920,7 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
                         tbl = &(lq_sta->lq_info[active_tbl]);
 
                         /* Revert to "active" rate and throughput info */
-                        index = iwl4965_rate_index_from_plcp(
+                        index = iwl4965_hwrate_to_plcp_idx(
                                 tbl->current_rate.rate_n_flags);
                         current_tpt = lq_sta->last_tpt;
 
@@ -2077,7 +2076,7 @@ static void rs_rate_scale_perform(struct iwl4965_priv *priv,
                                 rs_rate_scale_clear_window(&(tbl->win[i]));
 
                         /* Use new "search" start rate */
-                        index = iwl4965_rate_index_from_plcp(
+                        index = iwl4965_hwrate_to_plcp_idx(
                                         tbl->current_rate.rate_n_flags);
 
                         IWL_DEBUG_HT("Switch current  mcs: %X index: %d\n",
@@ -2219,6 +2218,8 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
 
         IWL_DEBUG_RATE_LIMIT("rate scale calculate new rate for skb\n");
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, hdr->addr1);
 
         /* Send management frames and broadcast/multicast data using lowest
@@ -2227,9 +2228,7 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
         if (!ieee80211_is_data(fc) || is_multicast_ether_addr(hdr->addr1) ||
             !sta || !sta->rate_ctrl_priv) {
                 sel->rate = rate_lowest(local, sband, sta);
-                if (sta)
-                        sta_info_put(sta);
-                return;
+                goto out;
         }
 
         lq_sta = (struct iwl4965_lq_sta *)sta->rate_ctrl_priv;
@@ -2256,14 +2255,15 @@ static void rs_get_rate(void *priv_rate, struct net_device *dev,
                         goto done;
         }
 
- done:
+done:
         if ((i < 0) || (i > IWL_RATE_COUNT)) {
                 sel->rate = rate_lowest(local, sband, sta);
-                return;
+                goto out;
         }
-        sta_info_put(sta);
 
         sel->rate = &priv->ieee_rates[i];
+out:
+        rcu_read_unlock();
 }
 
 static void *rs_alloc_sta(void *priv, gfp_t gfp)
@@ -2735,13 +2735,15 @@ int iwl4965_fill_rs_info(struct ieee80211_hw *hw, char *buf, u8 sta_id)
         u32 max_time = 0;
         u8 lq_type, antenna;
 
+        rcu_read_lock();
+
         sta = sta_info_get(local, priv->stations[sta_id].sta.sta.addr);
         if (!sta || !sta->rate_ctrl_priv) {
-                if (sta) {
-                        sta_info_put(sta);
+                if (sta)
                         IWL_DEBUG_RATE("leave - no private rate data!\n");
-                } else
+                else
                         IWL_DEBUG_RATE("leave - no station!\n");
+                rcu_read_unlock();
                 return sprintf(buf, "station %d not found\n", sta_id);
         }
 
@@ -2808,7 +2810,7 @@ int iwl4965_fill_rs_info(struct ieee80211_hw *hw, char *buf, u8 sta_id)
                          "active_search %d rate index %d\n", lq_type, antenna,
                          lq_sta->search_better_tbl, sta->last_txrate_idx);
 
-        sta_info_put(sta);
+        rcu_read_unlock();
         return cnt;
 }
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965-rs.h b/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
index 13b6c72eeb73..911f21396fd0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965-rs.h
@@ -259,7 +259,7 @@ static inline u8 iwl4965_get_prev_ieee_rate(u8 rate_index)
         return rate;
 }
 
-extern int iwl4965_rate_index_from_plcp(int plcp);
+extern int iwl4965_hwrate_to_plcp_idx(u32 rate_n_flags);
 
 /**
  * iwl4965_fill_rs_info - Fill an output text buffer with the rate representation
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index a9c30bcb65b8..2f01a490c9ee 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -38,6 +38,7 @@
 #include <linux/etherdevice.h>
 #include <asm/unaligned.h>
 
+#include "iwl-core.h"
 #include "iwl-4965.h"
 #include "iwl-helpers.h"
 
@@ -122,6 +123,64 @@ static u8 is_single_stream(struct iwl4965_priv *priv)
         return 0;
 }
 
+int iwl4965_hwrate_to_plcp_idx(u32 rate_n_flags)
+{
+        int idx = 0;
+
+        /* 4965 HT rate format */
+        if (rate_n_flags & RATE_MCS_HT_MSK) {
+                idx = (rate_n_flags & 0xff);
+
+                if (idx >= IWL_RATE_MIMO_6M_PLCP)
+                        idx = idx - IWL_RATE_MIMO_6M_PLCP;
+
+                idx += IWL_FIRST_OFDM_RATE;
+                /* skip 9M not supported in ht*/
+                if (idx >= IWL_RATE_9M_INDEX)
+                        idx += 1;
+                if ((idx >= IWL_FIRST_OFDM_RATE) && (idx <= IWL_LAST_OFDM_RATE))
+                        return idx;
+
+        /* 4965 legacy rate format, search for match in table */
+        } else {
+                for (idx = 0; idx < ARRAY_SIZE(iwl4965_rates); idx++)
+                        if (iwl4965_rates[idx].plcp == (rate_n_flags & 0xFF))
+                                return idx;
+        }
+
+        return -1;
+}
+
+/**
+ * translate ucode response to mac80211 tx status control values
+ */
+void iwl4965_hwrate_to_tx_control(struct iwl4965_priv *priv, u32 rate_n_flags,
+                                  struct ieee80211_tx_control *control)
+{
+        int rate_index;
+
+        control->antenna_sel_tx =
+                ((rate_n_flags & RATE_MCS_ANT_AB_MSK) >> RATE_MCS_ANT_A_POS);
+        if (rate_n_flags & RATE_MCS_HT_MSK)
+                control->flags |= IEEE80211_TXCTL_OFDM_HT;
+        if (rate_n_flags & RATE_MCS_GF_MSK)
+                control->flags |= IEEE80211_TXCTL_GREEN_FIELD;
+        if (rate_n_flags & RATE_MCS_FAT_MSK)
+                control->flags |= IEEE80211_TXCTL_40_MHZ_WIDTH;
+        if (rate_n_flags & RATE_MCS_DUP_MSK)
+                control->flags |= IEEE80211_TXCTL_DUP_DATA;
+        if (rate_n_flags & RATE_MCS_SGI_MSK)
+                control->flags |= IEEE80211_TXCTL_SHORT_GI;
+        /* since iwl4965_hwrate_to_plcp_idx is band indifferent, we always use
+         * IEEE80211_BAND_2GHZ band as it contains all the rates */
+        rate_index = iwl4965_hwrate_to_plcp_idx(rate_n_flags);
+        if (rate_index == -1)
+                control->tx_rate = NULL;
+        else
+                control->tx_rate =
+                        &priv->bands[IEEE80211_BAND_2GHZ].bitrates[rate_index];
+}
+
 /*
  * Determine how many receiver/antenna chains to use.
  * More provides better reception via diversity.  Fewer saves power.
@@ -546,9 +605,9 @@ int iwl4965_hw_nic_init(struct iwl4965_priv *priv)
         /* set CSR_HW_CONFIG_REG for uCode use */
 
         iwl4965_set_bit(priv, CSR_HW_IF_CONFIG_REG,
-                        CSR_HW_IF_CONFIG_REG_BIT_KEDRON_R |
-                        CSR_HW_IF_CONFIG_REG_BIT_RADIO_SI |
-                        CSR_HW_IF_CONFIG_REG_BIT_MAC_SI);
+                        CSR49_HW_IF_CONFIG_REG_BIT_4965_R |
+                        CSR49_HW_IF_CONFIG_REG_BIT_RADIO_SI |
+                        CSR49_HW_IF_CONFIG_REG_BIT_MAC_SI);
 
         rc = iwl4965_grab_nic_access(priv);
         if (rc < 0) {
@@ -3523,6 +3582,160 @@ static void iwl4965_update_ps_mode(struct iwl4965_priv *priv, u16 ps_bit, u8 *ad
                 }
         }
 }
+#ifdef CONFIG_IWL4965_DEBUG
+
+/**
+ * iwl4965_dbg_report_frame - dump frame to syslog during debug sessions
+ *
+ * You may hack this function to show different aspects of received frames,
+ * including selective frame dumps.
+ * group100 parameter selects whether to show 1 out of 100 good frames.
+ *
+ * TODO:  This was originally written for 3945, need to audit for
+ *        proper operation with 4965.
+ */
+static void iwl4965_dbg_report_frame(struct iwl4965_priv *priv,
+                      struct iwl4965_rx_packet *pkt,
+                      struct ieee80211_hdr *header, int group100)
+{
+        u32 to_us;
+        u32 print_summary = 0;
+        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
+        u32 hundred = 0;
+        u32 dataframe = 0;
+        u16 fc;
+        u16 seq_ctl;
+        u16 channel;
+        u16 phy_flags;
+        int rate_sym;
+        u16 length;
+        u16 status;
+        u16 bcn_tmr;
+        u32 tsf_low;
+        u64 tsf;
+        u8 rssi;
+        u8 agc;
+        u16 sig_avg;
+        u16 noise_diff;
+        struct iwl4965_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
+        struct iwl4965_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
+        struct iwl4965_rx_frame_end *rx_end = IWL_RX_END(pkt);
+        u8 *data = IWL_RX_DATA(pkt);
+
+        if (likely(!(iwl4965_debug_level & IWL_DL_RX)))
+                return;
+
+        /* MAC header */
+        fc = le16_to_cpu(header->frame_control);
+        seq_ctl = le16_to_cpu(header->seq_ctrl);
+
+        /* metadata */
+        channel = le16_to_cpu(rx_hdr->channel);
+        phy_flags = le16_to_cpu(rx_hdr->phy_flags);
+        rate_sym = rx_hdr->rate;
+        length = le16_to_cpu(rx_hdr->len);
+
+        /* end-of-frame status and timestamp */
+        status = le32_to_cpu(rx_end->status);
+        bcn_tmr = le32_to_cpu(rx_end->beacon_timestamp);
+        tsf_low = le64_to_cpu(rx_end->timestamp) & 0x0ffffffff;
+        tsf = le64_to_cpu(rx_end->timestamp);
+
+        /* signal statistics */
+        rssi = rx_stats->rssi;
+        agc = rx_stats->agc;
+        sig_avg = le16_to_cpu(rx_stats->sig_avg);
+        noise_diff = le16_to_cpu(rx_stats->noise_diff);
+
+        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
+
+        /* if data frame is to us and all is good,
+         *   (optionally) print summary for only 1 out of every 100 */
+        if (to_us && (fc & ~IEEE80211_FCTL_PROTECTED) ==
+            (IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
+                dataframe = 1;
+                if (!group100)
+                        print_summary = 1;      /* print each frame */
+                else if (priv->framecnt_to_us < 100) {
+                        priv->framecnt_to_us++;
+                        print_summary = 0;
+                } else {
+                        priv->framecnt_to_us = 0;
+                        print_summary = 1;
+                        hundred = 1;
+                }
+        } else {
+                /* print summary for all other frames */
+                print_summary = 1;
+        }
+
+        if (print_summary) {
+                char *title;
+                int rate_idx;
+                u32 bitrate;
+
+                if (hundred)
+                        title = "100Frames";
+                else if (fc & IEEE80211_FCTL_RETRY)
+                        title = "Retry";
+                else if (ieee80211_is_assoc_response(fc))
+                        title = "AscRsp";
+                else if (ieee80211_is_reassoc_response(fc))
+                        title = "RasRsp";
+                else if (ieee80211_is_probe_response(fc)) {
+                        title = "PrbRsp";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_beacon(fc)) {
+                        title = "Beacon";
+                        print_dump = 1; /* dump frame contents */
+                } else if (ieee80211_is_atim(fc))
+                        title = "ATIM";
+                else if (ieee80211_is_auth(fc))
+                        title = "Auth";
+                else if (ieee80211_is_deauth(fc))
+                        title = "DeAuth";
+                else if (ieee80211_is_disassoc(fc))
+                        title = "DisAssoc";
+                else
+                        title = "Frame";
+
+                rate_idx = iwl4965_hwrate_to_plcp_idx(rate_sym);
+                if (unlikely(rate_idx == -1))
+                        bitrate = 0;
+                else
+                        bitrate = iwl4965_rates[rate_idx].ieee / 2;
+
+                /* print frame summary.
+                 * MAC addresses show just the last byte (for brevity),
+                 *    but you can hack it to show more, if you'd like to. */
+                if (dataframe)
+                        IWL_DEBUG_RX("%s: mhd=0x%04x, dst=0x%02x, "
+                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
+                                     title, fc, header->addr1[5],
+                                     length, rssi, channel, bitrate);
+                else {
+                        /* src/dst addresses assume managed mode */
+                        IWL_DEBUG_RX("%s: 0x%04x, dst=0x%02x, "
+                                     "src=0x%02x, rssi=%u, tim=%lu usec, "
+                                     "phy=0x%02x, chnl=%d\n",
+                                     title, fc, header->addr1[5],
+                                     header->addr3[5], rssi,
+                                     tsf_low - priv->scan_start_tsf,
+                                     phy_flags, channel);
+                }
+        }
+        if (print_dump)
+                iwl4965_print_hex_dump(IWL_DL_RX, data, length);
+}
+#else
+static inline void iwl4965_dbg_report_frame(struct iwl4965_priv *priv,
+                                            struct iwl4965_rx_packet *pkt,
+                                            struct ieee80211_hdr *header,
+                                            int group100)
+{
+}
+#endif
+
 
 #define IWL_DELAY_NEXT_SCAN_AFTER_ASSOC (HZ*6)
 
@@ -3531,6 +3744,8 @@ static void iwl4965_update_ps_mode(struct iwl4965_priv *priv, u16 ps_bit, u8 *ad
 static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                                 struct iwl4965_rx_mem_buffer *rxb)
 {
+        struct ieee80211_hdr *header;
+        struct ieee80211_rx_status rx_status;
         struct iwl4965_rx_packet *pkt = (void *)rxb->skb->data;
         /* Use phy data (Rx signal strength, etc.) contained within
          *   this rx packet for legacy frames,
@@ -3541,27 +3756,29 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                 (struct iwl4965_rx_phy_res *)&priv->last_phy_res[1];
         __le32 *rx_end;
         unsigned int len = 0;
-        struct ieee80211_hdr *header;
         u16 fc;
-        struct ieee80211_rx_status stats = {
-                .mactime = le64_to_cpu(rx_start->timestamp),
-                .freq = ieee80211chan2mhz(le16_to_cpu(rx_start->channel)),
-                .band =
-                        (rx_start->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
-                        IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ,
-                .antenna = 0,
-                .rate_idx = iwl4965_rate_index_from_plcp(
-                                le32_to_cpu(rx_start->rate_n_flags)),
-                .flag = 0,
-        };
         u8 network_packet;
 
+        rx_status.mactime = le64_to_cpu(rx_start->timestamp);
+        rx_status.freq = ieee80211chan2mhz(le16_to_cpu(rx_start->channel));
+        rx_status.band = (rx_start->phy_flags & RX_RES_PHY_FLAGS_BAND_24_MSK) ?
+                                IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ;
+        rx_status.rate_idx = iwl4965_hwrate_to_plcp_idx(
+                                        le32_to_cpu(rx_start->rate_n_flags));
+
+        if (rx_status.band == IEEE80211_BAND_5GHZ)
+                rx_status.rate_idx -= IWL_FIRST_OFDM_RATE;
+
+        rx_status.antenna = 0;
+        rx_status.flag = 0;
+
         if ((unlikely(rx_start->cfg_phy_cnt > 20))) {
                 IWL_DEBUG_DROP
                         ("dsp size out of range [0,20]: "
                          "%d/n", rx_start->cfg_phy_cnt);
                 return;
         }
+
         if (!include_phy) {
                 if (priv->last_phy_res[0])
                         rx_start = (struct iwl4965_rx_phy_res *)
@@ -3580,7 +3797,7 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                                                   + rx_start->cfg_phy_cnt);
 
                 len = le16_to_cpu(rx_start->byte_count);
-                rx_end = (__le32 *) (pkt->u.raw + rx_start->cfg_phy_cnt +
+                rx_end = (__le32 *)(pkt->u.raw + rx_start->cfg_phy_cnt +
                                   sizeof(struct iwl4965_rx_phy_res) + len);
         } else {
                 struct iwl4965_rx_mpdu_res_start *amsdu =
@@ -3603,7 +3820,7 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
         priv->ucode_beacon_time = le32_to_cpu(rx_start->beacon_time_stamp);
 
         /* Find max signal strength (dBm) among 3 antenna/receiver chains */
-        stats.ssi = iwl4965_calc_rssi(rx_start);
+        rx_status.ssi = iwl4965_calc_rssi(rx_start);
 
         /* Meaningful noise values are available only from beacon statistics,
          *   which are gathered only when associated, and indicate noise
@@ -3611,32 +3828,29 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
          * Ignore these noise values while scanning (other channels) */
         if (iwl4965_is_associated(priv) &&
             !test_bit(STATUS_SCANNING, &priv->status)) {
-                stats.noise = priv->last_rx_noise;
-                stats.signal = iwl4965_calc_sig_qual(stats.ssi, stats.noise);
+                rx_status.noise = priv->last_rx_noise;
+                rx_status.signal = iwl4965_calc_sig_qual(rx_status.ssi,
+                                                         rx_status.noise);
         } else {
-                stats.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
-                stats.signal = iwl4965_calc_sig_qual(stats.ssi, 0);
+                rx_status.noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
+                rx_status.signal = iwl4965_calc_sig_qual(rx_status.ssi, 0);
         }
 
         /* Reset beacon noise level if not associated. */
         if (!iwl4965_is_associated(priv))
                 priv->last_rx_noise = IWL_NOISE_MEAS_NOT_AVAILABLE;
 
-#ifdef CONFIG_IWL4965_DEBUG
-        /* TODO:  Parts of iwl4965_report_frame are broken for 4965 */
-        if (iwl4965_debug_level & (IWL_DL_RX))
-                /* Set "1" to report good data frames in groups of 100 */
-                iwl4965_report_frame(priv, pkt, header, 1);
-
-        if (iwl4965_debug_level & (IWL_DL_RX | IWL_DL_STATS))
-        IWL_DEBUG_RX("Rssi %d, noise %d, qual %d, TSF %lu\n",
-                stats.ssi, stats.noise, stats.signal,
-                 (long unsigned int)le64_to_cpu(rx_start->timestamp));
-#endif
+        /* Set "1" to report good data frames in groups of 100 */
+        /* FIXME: need to optimze the call: */
+        iwl4965_dbg_report_frame(priv, pkt, header, 1);
+
+        IWL_DEBUG_STATS_LIMIT("Rssi %d, noise %d, qual %d, TSF %llu\n",
+                              rx_status.ssi, rx_status.noise, rx_status.signal,
+                              rx_status.mactime);
 
         network_packet = iwl4965_is_network_packet(priv, header);
         if (network_packet) {
-                priv->last_rx_rssi = stats.ssi;
+                priv->last_rx_rssi = rx_status.ssi;
                 priv->last_beacon_time =  priv->ucode_beacon_time;
                 priv->last_tsf = le64_to_cpu(rx_start->timestamp);
         }
@@ -3739,7 +3953,7 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                                 return;
                         }
                 }
-                iwl4965_handle_data_packet(priv, 0, include_phy, rxb, &stats);
+                iwl4965_handle_data_packet(priv, 0, include_phy, rxb, &rx_status);
                 break;
 
         case IEEE80211_FTYPE_CTL:
@@ -3748,7 +3962,7 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                 case IEEE80211_STYPE_BACK_REQ:
                         IWL_DEBUG_HT("IEEE80211_STYPE_BACK_REQ arrived\n");
                         iwl4965_handle_data_packet(priv, 0, include_phy,
-                                                rxb, &stats);
+                                                rxb, &rx_status);
                         break;
                 default:
                         break;
@@ -3778,7 +3992,7 @@ static void iwl4965_rx_reply_rx(struct iwl4965_priv *priv,
                                        print_mac(mac3, header->addr3));
                 else
                         iwl4965_handle_data_packet(priv, 1, include_phy, rxb,
-                                                   &stats);
+                                                   &rx_status);
                 break;
         }
         default:
@@ -3900,11 +4114,10 @@ static int iwl4965_tx_status_reply_compressed_ba(struct iwl4965_priv *priv,
         tx_status->flags |= IEEE80211_TX_STATUS_AMPDU;
         tx_status->ampdu_ack_map = successes;
         tx_status->ampdu_ack_len = agg->frame_count;
-        /* FIXME Wrong rate
-        tx_status->control.tx_rate = agg->rate_n_flags;
-        */
+        iwl4965_hwrate_to_tx_control(priv, agg->rate_n_flags,
+                                     &tx_status->control);
 
-        IWL_DEBUG_TX_REPLY("Bitmap %llx\n", bitmap);
+        IWL_DEBUG_TX_REPLY("Bitmap %llx\n", (unsigned long long)bitmap);
 
         return 0;
 }
@@ -3925,16 +4138,23 @@ static void iwl4965_tx_queue_stop_scheduler(struct iwl4965_priv *priv,
 
 /**
  * txq_id must be greater than IWL_BACK_QUEUE_FIRST_ID
+ * priv->lock must be held by the caller
  */
 static int iwl4965_tx_queue_agg_disable(struct iwl4965_priv *priv, u16 txq_id,
                                         u16 ssn_idx, u8 tx_fifo)
 {
+        int ret = 0;
+
         if (IWL_BACK_QUEUE_FIRST_ID > txq_id) {
                 IWL_WARNING("queue number too small: %d, must be > %d\n",
                                 txq_id, IWL_BACK_QUEUE_FIRST_ID);
                 return -EINVAL;
         }
 
+        ret = iwl4965_grab_nic_access(priv);
+        if (ret)
+                return ret;
+
         iwl4965_tx_queue_stop_scheduler(priv, txq_id);
 
         iwl4965_clear_bits_prph(priv, KDR_SCD_QUEUECHAIN_SEL, (1 << txq_id));
@@ -3948,6 +4168,8 @@ static int iwl4965_tx_queue_agg_disable(struct iwl4965_priv *priv, u16 txq_id,
         iwl4965_txq_ctx_deactivate(priv, txq_id);
         iwl4965_tx_queue_set_status(priv, &priv->txq[txq_id], tx_fifo, 0);
 
+        iwl4965_release_nic_access(priv);
+
         return 0;
 }
 
@@ -4040,12 +4262,12 @@ static void iwl4965_rx_reply_compressed_ba(struct iwl4965_priv *priv,
                            "%d, scd_ssn = %d\n",
                            ba_resp->tid,
                            ba_resp->seq_ctl,
-                           ba_resp->bitmap,
+                           (unsigned long long)ba_resp->bitmap,
                            ba_resp->scd_flow,
                            ba_resp->scd_ssn);
         IWL_DEBUG_TX_REPLY("DAT start_idx = %d, bitmap = 0x%llx \n",
                            agg->start_idx,
-                           agg->bitmap);
+                           (unsigned long long)agg->bitmap);
 
         /* Update driver's record of ACK vs. not for each frame in window */
         iwl4965_tx_status_reply_compressed_ba(priv, agg, ba_resp);
@@ -4232,7 +4454,7 @@ static u8 iwl4965_is_channel_extension(struct iwl4965_priv *priv,
         if (!is_channel_valid(ch_info))
                 return 0;
 
-        if (extension_chan_offset == IWL_EXT_CHANNEL_OFFSET_AUTO)
+        if (extension_chan_offset == IWL_EXT_CHANNEL_OFFSET_NONE)
                 return 0;
 
         if ((ch_info->fat_extension_channel == extension_chan_offset) ||
@@ -4249,7 +4471,7 @@ static u8 iwl4965_is_fat_tx_allowed(struct iwl4965_priv *priv,
 
         if ((!iwl_ht_conf->is_ht) ||
            (iwl_ht_conf->supported_chan_width != IWL_CHANNEL_WIDTH_40MHZ) ||
-           (iwl_ht_conf->extension_chan_offset == IWL_EXT_CHANNEL_OFFSET_AUTO))
+           (iwl_ht_conf->extension_chan_offset == IWL_EXT_CHANNEL_OFFSET_NONE))
                 return 0;
 
         if (sta_ht_inf) {
@@ -4294,9 +4516,7 @@ void iwl4965_set_rxon_ht(struct iwl4965_priv *priv, struct iwl_ht_info *ht_info)
         case IWL_EXT_CHANNEL_OFFSET_BELOW:
                 rxon->flags |= RXON_FLG_CTRL_CHANNEL_LOC_HI_MSK;
                 break;
-        case IWL_EXT_CHANNEL_OFFSET_AUTO:
-                rxon->flags &= ~RXON_FLG_CHANNEL_MODE_MIXED_MSK;
-                break;
+        case IWL_EXT_CHANNEL_OFFSET_NONE:
         default:
                 rxon->flags &= ~RXON_FLG_CHANNEL_MODE_MIXED_MSK;
                 break;
@@ -4419,7 +4639,7 @@ static int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, const u8 *da,
         int tx_fifo;
         int txq_id;
         int ssn = -1;
-        int rc = 0;
+        int ret = 0;
         unsigned long flags;
         struct iwl4965_tid_data *tid_data;
         DECLARE_MAC_BUF(mac);
@@ -4452,12 +4672,12 @@ static int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, const u8 *da,
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 
         *start_seq_num = ssn;
-        rc = iwl4965_tx_queue_agg_enable(priv, txq_id, tx_fifo,
-                                           sta_id, tid, ssn);
-        if (rc)
-                return rc;
+        ret = iwl4965_tx_queue_agg_enable(priv, txq_id, tx_fifo,
+                                          sta_id, tid, ssn);
+        if (ret)
+                return ret;
 
-        rc = 0;
+        ret = 0;
         if (tid_data->tfds_in_queue == 0) {
                 printk(KERN_ERR "HW queue is empty\n");
                 tid_data->agg.state = IWL_AGG_ON;
@@ -4467,7 +4687,7 @@ static int iwl4965_mac_ht_tx_agg_start(struct ieee80211_hw *hw, const u8 *da,
                                 tid_data->tfds_in_queue);
                 tid_data->agg.state = IWL_EMPTYING_HW_QUEUE_ADDBA;
         }
-        return rc;
+        return ret;
 }
 
 static int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, const u8 *da,
@@ -4477,7 +4697,7 @@ static int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, const u8 *da,
         struct iwl4965_priv *priv = hw->priv;
         int tx_fifo_id, txq_id, sta_id, ssn = -1;
         struct iwl4965_tid_data *tid_data;
-        int rc, write_ptr, read_ptr;
+        int ret, write_ptr, read_ptr;
         unsigned long flags;
         DECLARE_MAC_BUF(mac);
 
@@ -4517,17 +4737,11 @@ static int iwl4965_mac_ht_tx_agg_stop(struct ieee80211_hw *hw, const u8 *da,
         priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF;
 
         spin_lock_irqsave(&priv->lock, flags);
-        rc = iwl4965_grab_nic_access(priv);
-        if (rc) {
-                spin_unlock_irqrestore(&priv->lock, flags);
-                return rc;
-        }
-        rc = iwl4965_tx_queue_agg_disable(priv, txq_id, ssn, tx_fifo_id);
-        iwl4965_release_nic_access(priv);
+        ret = iwl4965_tx_queue_agg_disable(priv, txq_id, ssn, tx_fifo_id);
         spin_unlock_irqrestore(&priv->lock, flags);
 
-        if (rc)
-                return rc;
+        if (ret)
+                return ret;
 
         ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, da, tid);
 
@@ -4610,9 +4824,15 @@ void iwl4965_hw_cancel_deferred_work(struct iwl4965_priv *priv)
         cancel_delayed_work(&priv->init_alive_start);
 }
 
+static struct iwl_cfg iwl4965_agn_cfg = {
+        .name = "4965AGN",
+        .fw_name = "iwlwifi-4965" IWL4965_UCODE_API ".ucode",
+        .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
+};
+
 struct pci_device_id iwl4965_hw_card_ids[] = {
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4229)},
-        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x4230)},
+        {IWL_PCI_DEVICE(0x4229, PCI_ANY_ID, iwl4965_agn_cfg)},
+        {IWL_PCI_DEVICE(0x4230, PCI_ANY_ID, iwl4965_agn_cfg)},
         {0}
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.h b/drivers/net/wireless/iwlwifi/iwl-4965.h
index ce17e4fec838..057fa15d62fd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.h
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.h
@@ -41,9 +41,17 @@ extern struct pci_device_id iwl4965_hw_card_ids[];
 
 #define DRV_NAME        "iwl4965"
 #include "iwl-4965-hw.h"
+#include "iwl-csr.h"
 #include "iwl-prph.h"
 #include "iwl-4965-debug.h"
 
+/* Change firmware file name, using "-" and incrementing number,
+ *   *only* when uCode interface or architecture changes so that it
+ *   is not compatible with earlier drivers.
+ * This number will also appear in << 8 position of 1st dword of uCode file */
+#define IWL4965_UCODE_API "-1"
+
+
 /* Default noise level to report when noise measurement is not available.
  *   This may be because we're:
  *   1)  Not associated (4965, no beacon statistics being sent to driver)
@@ -633,16 +641,6 @@ extern int iwl4965_is_network_packet(struct iwl4965_priv *priv,
                                  struct ieee80211_hdr *header);
 extern int iwl4965_power_init_handle(struct iwl4965_priv *priv);
 extern int iwl4965_eeprom_init(struct iwl4965_priv *priv);
-#ifdef CONFIG_IWL4965_DEBUG
-extern void iwl4965_report_frame(struct iwl4965_priv *priv,
-                             struct iwl4965_rx_packet *pkt,
-                             struct ieee80211_hdr *header, int group100);
-#else
-static inline void iwl4965_report_frame(struct iwl4965_priv *priv,
-                                    struct iwl4965_rx_packet *pkt,
-                                    struct ieee80211_hdr *header,
-                                    int group100) {}
-#endif
 extern void iwl4965_handle_data_packet_monitor(struct iwl4965_priv *priv,
                                            struct iwl4965_rx_mem_buffer *rxb,
                                            void *data, short len,
@@ -767,6 +765,9 @@ extern int iwl4965_set_fat_chan_info(struct iwl4965_priv *priv,
                                 const struct iwl4965_eeprom_channel *eeprom_ch,
                                 u8 fat_extension_channel);
 extern void iwl4965_rf_kill_ct_config(struct iwl4965_priv *priv);
+extern void iwl4965_hwrate_to_tx_control(struct iwl4965_priv *priv,
+                                         u32 rate_n_flags,
+                                         struct ieee80211_tx_control *control);
 
 #ifdef CONFIG_IWL4965_HT
 void iwl4965_init_ht_hw_capab(struct ieee80211_ht_info *ht_info,
@@ -808,11 +809,10 @@ struct iwl4965_kw {
 #define IWL_OPERATION_MODE_MIXED    2
 #define IWL_OPERATION_MODE_20MHZ    3
 
-#define IWL_EXT_CHANNEL_OFFSET_AUTO   0
-#define IWL_EXT_CHANNEL_OFFSET_ABOVE  1
-#define IWL_EXT_CHANNEL_OFFSET_       2
-#define IWL_EXT_CHANNEL_OFFSET_BELOW  3
-#define IWL_EXT_CHANNEL_OFFSET_MAX    4
+#define IWL_EXT_CHANNEL_OFFSET_NONE      0
+#define IWL_EXT_CHANNEL_OFFSET_ABOVE     1
+#define IWL_EXT_CHANNEL_OFFSET_RESERVE1  2
+#define IWL_EXT_CHANNEL_OFFSET_BELOW     3
 
 #define NRG_NUM_PREV_STAT_L     20
 #define NUM_RX_CHAINS           (3)
@@ -974,6 +974,7 @@ struct iwl4965_priv {
         struct ieee80211_hw *hw;
         struct ieee80211_channel *ieee_channels;
         struct ieee80211_rate *ieee_rates;
+        struct iwl_cfg *cfg;
 
         /* temporary frame storage list */
         struct list_head free_frames;
@@ -1104,7 +1105,6 @@ struct iwl4965_priv {
         u32 scd_base_addr;      /* scheduler sram base address */
 
         unsigned long status;
-        u32 config;
 
         int last_rx_rssi;       /* From Rx packet statisitics */
         int last_rx_noise;      /* From beacon statistics */
@@ -1134,7 +1134,6 @@ struct iwl4965_priv {
         int is_open;
 
         u8 mac80211_registered;
-        int is_abg;
 
         u32 notif_missed_beacons;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
new file mode 100644
index 000000000000..675b34b696b4
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -0,0 +1,47 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * Tomas Winkler <tomas.winkler@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *****************************************************************************/
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/version.h>
+
+#include "iwl-4965-debug.h"
+#include "iwl-core.h"
+
+MODULE_DESCRIPTION("iwl core");
+MODULE_VERSION(IWLWIFI_VERSION);
+MODULE_AUTHOR(DRV_COPYRIGHT);
+MODULE_LICENSE("GPL/BSD");
+
+#ifdef CONFIG_IWL4965_DEBUG
+u32 iwl4965_debug_level;
+EXPORT_SYMBOL(iwl4965_debug_level);
+#endif
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
new file mode 100644
index 000000000000..bdd32f891683
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -0,0 +1,84 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * Tomas Winkler <tomas.winkler@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2008 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_core_h__
+#define __iwl_core_h__
+
+#define IWLWIFI_VERSION "1.2.26k"
+#define DRV_COPYRIGHT   "Copyright(c) 2003-2008 Intel Corporation"
+
+#define IWL_PCI_DEVICE(dev, subdev, cfg) \
+        .vendor = PCI_VENDOR_ID_INTEL,  .device = (dev), \
+        .subvendor = PCI_ANY_ID, .subdevice = (subdev), \
+        .driver_data = (kernel_ulong_t)&(cfg)
+
+#define IWL_SKU_G       0x1
+#define IWL_SKU_A       0x2
+#define IWL_SKU_N       0x8
+
+struct iwl_cfg {
+        const char *name;
+        const char *fw_name;
+        unsigned int sku;
+};
+
+#endif /* __iwl_core_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-csr.h b/drivers/net/wireless/iwlwifi/iwl-csr.h
new file mode 100644
index 000000000000..7016e5b41c58
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-csr.h
@@ -0,0 +1,259 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2005 - 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * James P. Ketrenos <ipw2100-admin@linux.intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2007 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
+ *****************************************************************************/
+/*=== CSR (control and status registers) ===*/
+#define CSR_BASE    (0x000)
+
+#define CSR_HW_IF_CONFIG_REG    (CSR_BASE+0x000) /* hardware interface config */
+#define CSR_INT_COALESCING      (CSR_BASE+0x004) /* accum ints, 32-usec units */
+#define CSR_INT                 (CSR_BASE+0x008) /* host interrupt status/ack */
+#define CSR_INT_MASK            (CSR_BASE+0x00c) /* host interrupt enable */
+#define CSR_FH_INT_STATUS       (CSR_BASE+0x010) /* busmaster int status/ack*/
+#define CSR_GPIO_IN             (CSR_BASE+0x018) /* read external chip pins */
+#define CSR_RESET               (CSR_BASE+0x020) /* busmaster enable, NMI, etc*/
+#define CSR_GP_CNTRL            (CSR_BASE+0x024)
+
+/*
+ * Hardware revision info
+ * Bit fields:
+ * 31-8:  Reserved
+ *  7-4:  Type of device:  0x0 = 4965, 0xd = 3945
+ *  3-2:  Revision step:  0 = A, 1 = B, 2 = C, 3 = D
+ *  1-0:  "Dash" value, as in A-1, etc.
+ *
+ * NOTE:  Revision step affects calculation of CCK txpower for 4965.
+ */
+#define CSR_HW_REV              (CSR_BASE+0x028)
+
+/* EEPROM reads */
+#define CSR_EEPROM_REG          (CSR_BASE+0x02c)
+#define CSR_EEPROM_GP           (CSR_BASE+0x030)
+#define CSR_GP_UCODE            (CSR_BASE+0x044)
+#define CSR_UCODE_DRV_GP1       (CSR_BASE+0x054)
+#define CSR_UCODE_DRV_GP1_SET   (CSR_BASE+0x058)
+#define CSR_UCODE_DRV_GP1_CLR   (CSR_BASE+0x05c)
+#define CSR_UCODE_DRV_GP2       (CSR_BASE+0x060)
+#define CSR_GIO_CHICKEN_BITS    (CSR_BASE+0x100)
+
+/* Analog phase-lock-loop configuration (3945 only)
+ * Set bit 24. */
+#define CSR_ANA_PLL_CFG         (CSR_BASE+0x20c)
+/*
+ * Indicates hardware rev, to determine CCK backoff for txpower calculation.
+ * Bit fields:
+ *  3-2:  0 = A, 1 = B, 2 = C, 3 = D step
+ */
+#define CSR_HW_REV_WA_REG       (CSR_BASE+0x22C)
+
+/* Bits for CSR_HW_IF_CONFIG_REG */
+#define CSR49_HW_IF_CONFIG_REG_BIT_4965_R       (0x00000010)
+#define CSR49_HW_IF_CONFIG_REG_MSK_BOARD_VER    (0x00000C00)
+#define CSR49_HW_IF_CONFIG_REG_BIT_MAC_SI               (0x00000100)
+#define CSR49_HW_IF_CONFIG_REG_BIT_RADIO_SI     (0x00000200)
+
+#define CSR39_HW_IF_CONFIG_REG_BIT_3945_MB         (0x00000100)
+#define CSR39_HW_IF_CONFIG_REG_BIT_3945_MM         (0x00000200)
+#define CSR39_HW_IF_CONFIG_REG_BIT_SKU_MRC            (0x00000400)
+#define CSR39_HW_IF_CONFIG_REG_BIT_BOARD_TYPE         (0x00000800)
+#define CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_A    (0x00000000)
+#define CSR39_HW_IF_CONFIG_REG_BITS_SILICON_TYPE_B    (0x00001000)
+
+#define CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM     (0x00200000)
+
+/* interrupt flags in INTA, set by uCode or hardware (e.g. dma),
+ * acknowledged (reset) by host writing "1" to flagged bits. */
+#define CSR_INT_BIT_FH_RX        (1 << 31) /* Rx DMA, cmd responses, FH_INT[17:16] */
+#define CSR_INT_BIT_HW_ERR       (1 << 29) /* DMA hardware error FH_INT[31] */
+#define CSR_INT_BIT_DNLD         (1 << 28) /* uCode Download */
+#define CSR_INT_BIT_FH_TX        (1 << 27) /* Tx DMA FH_INT[1:0] */
+#define CSR_INT_BIT_SCD          (1 << 26) /* TXQ pointer advanced */
+#define CSR_INT_BIT_SW_ERR       (1 << 25) /* uCode error */
+#define CSR_INT_BIT_RF_KILL      (1 << 7)  /* HW RFKILL switch GP_CNTRL[27] toggled */
+#define CSR_INT_BIT_CT_KILL      (1 << 6)  /* Critical temp (chip too hot) rfkill */
+#define CSR_INT_BIT_SW_RX        (1 << 3)  /* Rx, command responses, 3945 */
+#define CSR_INT_BIT_WAKEUP       (1 << 1)  /* NIC controller waking up (pwr mgmt) */
+#define CSR_INT_BIT_ALIVE        (1 << 0)  /* uCode interrupts once it initializes */
+
+#define CSR_INI_SET_MASK        (CSR_INT_BIT_FH_RX   | \
+                                 CSR_INT_BIT_HW_ERR  | \
+                                 CSR_INT_BIT_FH_TX   | \
+                                 CSR_INT_BIT_SW_ERR  | \
+                                 CSR_INT_BIT_RF_KILL | \
+                                 CSR_INT_BIT_SW_RX   | \
+                                 CSR_INT_BIT_WAKEUP  | \
+                                 CSR_INT_BIT_ALIVE)
+
+/* interrupt flags in FH (flow handler) (PCI busmaster DMA) */
+#define CSR_FH_INT_BIT_ERR       (1 << 31) /* Error */
+#define CSR_FH_INT_BIT_HI_PRIOR  (1 << 30) /* High priority Rx, bypass coalescing */
+#define CSR39_FH_INT_BIT_RX_CHNL2  (1 << 18) /* Rx channel 2 (3945 only) */
+#define CSR_FH_INT_BIT_RX_CHNL1  (1 << 17) /* Rx channel 1 */
+#define CSR_FH_INT_BIT_RX_CHNL0  (1 << 16) /* Rx channel 0 */
+#define CSR39_FH_INT_BIT_TX_CHNL6  (1 << 6)  /* Tx channel 6 (3945 only) */
+#define CSR_FH_INT_BIT_TX_CHNL1  (1 << 1)  /* Tx channel 1 */
+#define CSR_FH_INT_BIT_TX_CHNL0  (1 << 0)  /* Tx channel 0 */
+
+#define CSR39_FH_INT_RX_MASK    (CSR_FH_INT_BIT_HI_PRIOR | \
+                                 CSR39_FH_INT_BIT_RX_CHNL2 | \
+                                 CSR_FH_INT_BIT_RX_CHNL1 | \
+                                 CSR_FH_INT_BIT_RX_CHNL0)
+
+
+#define CSR39_FH_INT_TX_MASK    (CSR39_FH_INT_BIT_TX_CHNL6 | \
+                                 CSR_FH_INT_BIT_TX_CHNL1 | \
+                                 CSR_FH_INT_BIT_TX_CHNL0)
+
+#define CSR49_FH_INT_RX_MASK    (CSR_FH_INT_BIT_HI_PRIOR | \
+                                 CSR_FH_INT_BIT_RX_CHNL1 | \
+                                 CSR_FH_INT_BIT_RX_CHNL0)
+
+#define CSR49_FH_INT_TX_MASK    (CSR_FH_INT_BIT_TX_CHNL1 | \
+                                 CSR_FH_INT_BIT_TX_CHNL0)
+
+
+/* RESET */
+#define CSR_RESET_REG_FLAG_NEVO_RESET                (0x00000001)
+#define CSR_RESET_REG_FLAG_FORCE_NMI                 (0x00000002)
+#define CSR_RESET_REG_FLAG_SW_RESET                  (0x00000080)
+#define CSR_RESET_REG_FLAG_MASTER_DISABLED           (0x00000100)
+#define CSR_RESET_REG_FLAG_STOP_MASTER               (0x00000200)
+
+/* GP (general purpose) CONTROL */
+#define CSR_GP_CNTRL_REG_FLAG_MAC_CLOCK_READY        (0x00000001)
+#define CSR_GP_CNTRL_REG_FLAG_INIT_DONE              (0x00000004)
+#define CSR_GP_CNTRL_REG_FLAG_MAC_ACCESS_REQ         (0x00000008)
+#define CSR_GP_CNTRL_REG_FLAG_GOING_TO_SLEEP         (0x00000010)
+
+#define CSR_GP_CNTRL_REG_VAL_MAC_ACCESS_EN           (0x00000001)
+
+#define CSR_GP_CNTRL_REG_MSK_POWER_SAVE_TYPE         (0x07000000)
+#define CSR_GP_CNTRL_REG_FLAG_MAC_POWER_SAVE         (0x04000000)
+#define CSR_GP_CNTRL_REG_FLAG_HW_RF_KILL_SW          (0x08000000)
+
+
+/* EEPROM REG */
+#define CSR_EEPROM_REG_READ_VALID_MSK   (0x00000001)
+#define CSR_EEPROM_REG_BIT_CMD          (0x00000002)
+
+/* EEPROM GP */
+#define CSR_EEPROM_GP_VALID_MSK         (0x00000006)
+#define CSR_EEPROM_GP_BAD_SIGNATURE     (0x00000000)
+#define CSR_EEPROM_GP_IF_OWNER_MSK      (0x00000180)
+
+/* UCODE DRV GP */
+#define CSR_UCODE_DRV_GP1_BIT_MAC_SLEEP             (0x00000001)
+#define CSR_UCODE_SW_BIT_RFKILL                     (0x00000002)
+#define CSR_UCODE_DRV_GP1_BIT_CMD_BLOCKED           (0x00000004)
+#define CSR_UCODE_DRV_GP1_REG_BIT_CT_KILL_EXIT      (0x00000008)
+
+/* GPIO */
+#define CSR_GPIO_IN_BIT_AUX_POWER                   (0x00000200)
+#define CSR_GPIO_IN_VAL_VAUX_PWR_SRC                (0x00000000)
+#define CSR_GPIO_IN_VAL_VMAIN_PWR_SRC           CSR_GPIO_IN_BIT_AUX_POWER
+
+/* GI Chicken Bits */
+#define CSR_GIO_CHICKEN_BITS_REG_BIT_L1A_NO_L0S_RX  (0x00800000)
+#define CSR_GIO_CHICKEN_BITS_REG_BIT_DIS_L0S_EXIT_TIMER  (0x20000000)
+
+/*=== HBUS (Host-side Bus) ===*/
+#define HBUS_BASE       (0x400)
+/*
+ * Registers for accessing device's internal SRAM memory (e.g. SCD SRAM
+ * structures, error log, event log, verifying uCode load).
+ * First write to address register, then read from or write to data register
+ * to complete the job.  Once the address register is set up, accesses to
+ * data registers auto-increment the address by one dword.
+ * Bit usage for address registers (read or write):
+ *  0-31:  memory address within device
+ */
+#define HBUS_TARG_MEM_RADDR     (HBUS_BASE+0x00c)
+#define HBUS_TARG_MEM_WADDR     (HBUS_BASE+0x010)
+#define HBUS_TARG_MEM_WDAT      (HBUS_BASE+0x018)
+#define HBUS_TARG_MEM_RDAT      (HBUS_BASE+0x01c)
+
+/*
+ * Registers for accessing device's internal peripheral registers
+ * (e.g. SCD, BSM, etc.).  First write to address register,
+ * then read from or write to data register to complete the job.
+ * Bit usage for address registers (read or write):
+ *  0-15:  register address (offset) within device
+ * 24-25:  (# bytes - 1) to read or write (e.g. 3 for dword)
+ */
+#define HBUS_TARG_PRPH_WADDR    (HBUS_BASE+0x044)
+#define HBUS_TARG_PRPH_RADDR    (HBUS_BASE+0x048)
+#define HBUS_TARG_PRPH_WDAT     (HBUS_BASE+0x04c)
+#define HBUS_TARG_PRPH_RDAT     (HBUS_BASE+0x050)
+
+/*
+ * Per-Tx-queue write pointer (index, really!) (3945 and 4965).
+ * Indicates index to next TFD that driver will fill (1 past latest filled).
+ * Bit usage:
+ *  0-7:  queue write index
+ * 11-8:  queue selector
+ */
+#define HBUS_TARG_WRPTR         (HBUS_BASE+0x060)
+#define HBUS_TARG_MBX_C         (HBUS_BASE+0x030)
+
+#define HBUS_TARG_MBX_C_REG_BIT_CMD_BLOCKED         (0x00000004)
+
+
+
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.c b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
new file mode 100644
index 000000000000..0064387dea91
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.c
@@ -0,0 +1,205 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * Tomas Winkler <tomas.winkler@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2008 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/version.h>
+#include <linux/init.h>
+
+#include <net/mac80211.h>
+
+#include "iwl-4965-commands.h"
+#include "iwl-4965.h"
+#include "iwl-core.h"
+#include "iwl-4965-debug.h"
+#include "iwl-eeprom.h"
+#include "iwl-4965-io.h"
+
+/******************************************************************************
+ *
+ * EEPROM related functions
+ *
+******************************************************************************/
+
+int iwlcore_eeprom_verify_signature(struct iwl4965_priv *priv)
+{
+        u32 gp = iwl4965_read32(priv, CSR_EEPROM_GP);
+        if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
+                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
+                return -ENOENT;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(iwlcore_eeprom_verify_signature);
+
+/*
+ * The device's EEPROM semaphore prevents conflicts between driver and uCode
+ * when accessing the EEPROM; each access is a series of pulses to/from the
+ * EEPROM chip, not a single event, so even reads could conflict if they
+ * weren't arbitrated by the semaphore.
+ */
+int iwlcore_eeprom_acquire_semaphore(struct iwl4965_priv *priv)
+{
+        u16 count;
+        int ret;
+
+        for (count = 0; count < EEPROM_SEM_RETRY_LIMIT; count++) {
+                /* Request semaphore */
+                iwl4965_set_bit(priv, CSR_HW_IF_CONFIG_REG,
+                        CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+
+                /* See if we got it */
+                ret = iwl4965_poll_bit(priv, CSR_HW_IF_CONFIG_REG,
+                                        CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                        CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM,
+                                        EEPROM_SEM_TIMEOUT);
+                if (ret >= 0) {
+                        IWL_DEBUG_IO("Acquired semaphore after %d tries.\n",
+                                count+1);
+                        return ret;
+                }
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(iwlcore_eeprom_acquire_semaphore);
+
+void iwlcore_eeprom_release_semaphore(struct iwl4965_priv *priv)
+{
+        iwl4965_clear_bit(priv, CSR_HW_IF_CONFIG_REG,
+                CSR_HW_IF_CONFIG_REG_BIT_EEPROM_OWN_SEM);
+
+}
+EXPORT_SYMBOL(iwlcore_eeprom_release_semaphore);
+
+
+/**
+ * iwl_eeprom_init - read EEPROM contents
+ *
+ * Load the EEPROM contents from adapter into priv->eeprom
+ *
+ * NOTE:  This routine uses the non-debug IO access functions.
+ */
+int iwl_eeprom_init(struct iwl4965_priv *priv)
+{
+        u16 *e = (u16 *)&priv->eeprom;
+        u32 gp = iwl4965_read32(priv, CSR_EEPROM_GP);
+        u32 r;
+        int sz = sizeof(priv->eeprom);
+        int ret;
+        int i;
+        u16 addr;
+
+        /* The EEPROM structure has several padding buffers within it
+         * and when adding new EEPROM maps is subject to programmer errors
+         * which may be very difficult to identify without explicitly
+         * checking the resulting size of the eeprom map. */
+        BUILD_BUG_ON(sizeof(priv->eeprom) != IWL_EEPROM_IMAGE_SIZE);
+
+        if ((gp & CSR_EEPROM_GP_VALID_MSK) == CSR_EEPROM_GP_BAD_SIGNATURE) {
+                IWL_ERROR("EEPROM not found, EEPROM_GP=0x%08x", gp);
+                return -ENOENT;
+        }
+
+        /* Make sure driver (instead of uCode) is allowed to read EEPROM */
+        ret = priv->cfg->ops->lib->eeprom_ops.acquire_semaphore(priv);
+        if (ret < 0) {
+                IWL_ERROR("Failed to acquire EEPROM semaphore.\n");
+                return -ENOENT;
+        }
+
+        /* eeprom is an array of 16bit values */
+        for (addr = 0; addr < sz; addr += sizeof(u16)) {
+                _iwl4965_write32(priv, CSR_EEPROM_REG, addr << 1);
+                _iwl4965_clear_bit(priv, CSR_EEPROM_REG, CSR_EEPROM_REG_BIT_CMD);
+
+                for (i = 0; i < IWL_EEPROM_ACCESS_TIMEOUT;
+                                        i += IWL_EEPROM_ACCESS_DELAY) {
+                        r = _iwl4965_read_direct32(priv, CSR_EEPROM_REG);
+                        if (r & CSR_EEPROM_REG_READ_VALID_MSK)
+                                break;
+                        udelay(IWL_EEPROM_ACCESS_DELAY);
+                }
+
+                if (!(r & CSR_EEPROM_REG_READ_VALID_MSK)) {
+                        IWL_ERROR("Time out reading EEPROM[%d]", addr);
+                        ret = -ETIMEDOUT;
+                        goto done;
+                }
+                e[addr / 2] = le16_to_cpu((__force __le16)(r >> 16));
+        }
+        ret = 0;
+
+done:
+        priv->cfg->ops->lib->eeprom_ops.release_semaphore(priv);
+        return ret;
+}
+EXPORT_SYMBOL(iwl_eeprom_init);
+
+
+void iwl_eeprom_get_mac(const struct iwl4965_priv *priv, u8 *mac)
+{
+        memcpy(mac, priv->eeprom.mac_address, 6);
+}
+EXPORT_SYMBOL(iwl_eeprom_get_mac);
+
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
new file mode 100644
index 000000000000..7827566dcc8b
--- /dev/null
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -0,0 +1,399 @@
+/******************************************************************************
+ *
+ * This file is provided under a dual BSD/GPLv2 license.  When using or
+ * redistributing this file, you may do so under either license.
+ *
+ * GPL LICENSE SUMMARY
+ *
+ * Copyright(c) 2008 Intel Corporation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of version 2 of the GNU General Public License as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110,
+ * USA
+ *
+ * The full GNU General Public License is included in this distribution
+ * in the file called LICENSE.GPL.
+ *
+ * Contact Information:
+ * Tomas Winkler <tomas.winkler@intel.com>
+ * Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
+ *
+ * BSD LICENSE
+ *
+ * Copyright(c) 2005 - 2008 Intel Corporation. All rights reserved.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *  * Neither the name Intel Corporation nor the names of its
+ *    contributors may be used to endorse or promote products derived
+ *    from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *****************************************************************************/
+
+#ifndef __iwl_eeprom_h__
+#define __iwl_eeprom_h__
+
+struct iwl4965_priv;
+
+/*
+ * EEPROM access time values:
+ *
+ * Driver initiates EEPROM read by writing byte address << 1 to CSR_EEPROM_REG,
+ *   then clearing (with subsequent read/modify/write) CSR_EEPROM_REG bit
+ *   CSR_EEPROM_REG_BIT_CMD (0x2).
+ * Driver then polls CSR_EEPROM_REG for CSR_EEPROM_REG_READ_VALID_MSK (0x1).
+ * When polling, wait 10 uSec between polling loops, up to a maximum 5000 uSec.
+ * Driver reads 16-bit value from bits 31-16 of CSR_EEPROM_REG.
+ */
+#define IWL_EEPROM_ACCESS_TIMEOUT       5000 /* uSec */
+#define IWL_EEPROM_ACCESS_DELAY         10   /* uSec */
+
+#define IWL_EEPROM_SEM_TIMEOUT          10   /* milliseconds */
+#define IWL_EEPROM_SEM_RETRY_LIMIT      1000 /* number of attempts (not time) */
+
+
+/*
+ * Regulatory channel usage flags in EEPROM struct iwl4965_eeprom_channel.flags.
+ *
+ * IBSS and/or AP operation is allowed *only* on those channels with
+ * (VALID && IBSS && ACTIVE && !RADAR).  This restriction is in place because
+ * RADAR detection is not supported by the 4965 driver, but is a
+ * requirement for establishing a new network for legal operation on channels
+ * requiring RADAR detection or restricting ACTIVE scanning.
+ *
+ * NOTE:  "WIDE" flag does not indicate anything about "FAT" 40 MHz channels.
+ *        It only indicates that 20 MHz channel use is supported; FAT channel
+ *        usage is indicated by a separate set of regulatory flags for each
+ *        FAT channel pair.
+ *
+ * NOTE:  Using a channel inappropriately will result in a uCode error!
+ */
+#define IWL_NUM_TX_CALIB_GROUPS 5
+enum {
+        EEPROM_CHANNEL_VALID = (1 << 0),        /* usable for this SKU/geo */
+        EEPROM_CHANNEL_IBSS = (1 << 1),         /* usable as an IBSS channel */
+        /* Bit 2 Reserved */
+        EEPROM_CHANNEL_ACTIVE = (1 << 3),       /* active scanning allowed */
+        EEPROM_CHANNEL_RADAR = (1 << 4),        /* radar detection required */
+        EEPROM_CHANNEL_WIDE = (1 << 5),         /* 20 MHz channel okay */
+        EEPROM_CHANNEL_NARROW = (1 << 6),       /* 10 MHz channel (not used) */
+        EEPROM_CHANNEL_DFS = (1 << 7),  /* dynamic freq selection candidate */
+};
+
+/* SKU Capabilities */
+#define EEPROM_SKU_CAP_SW_RF_KILL_ENABLE                (1 << 0)
+#define EEPROM_SKU_CAP_HW_RF_KILL_ENABLE                (1 << 1)
+
+/* *regulatory* channel data format in eeprom, one for each channel.
+ * There are separate entries for FAT (40 MHz) vs. normal (20 MHz) channels. */
+struct iwl4965_eeprom_channel {
+        u8 flags;               /* EEPROM_CHANNEL_* flags copied from EEPROM */
+        s8 max_power_avg;       /* max power (dBm) on this chnl, limit 31 */
+} __attribute__ ((packed));
+
+/* 4965 has two radio transmitters (and 3 radio receivers) */
+#define EEPROM_TX_POWER_TX_CHAINS      (2)
+
+/* 4965 has room for up to 8 sets of txpower calibration data */
+#define EEPROM_TX_POWER_BANDS          (8)
+
+/* 4965 factory calibration measures txpower gain settings for
+ * each of 3 target output levels */
+#define EEPROM_TX_POWER_MEASUREMENTS   (3)
+
+#define EEPROM_4965_TX_POWER_VERSION        (2)
+
+/* 4965 driver does not work with txpower calibration version < 5.
+ * Look for this in calib_version member of struct iwl4965_eeprom. */
+#define EEPROM_TX_POWER_VERSION_NEW    (5)
+
+
+/*
+ * 4965 factory calibration data for one txpower level, on one channel,
+ * measured on one of the 2 tx chains (radio transmitter and associated
+ * antenna).  EEPROM contains:
+ *
+ * 1)  Temperature (degrees Celsius) of device when measurement was made.
+ *
+ * 2)  Gain table index used to achieve the target measurement power.
+ *     This refers to the "well-known" gain tables (see iwl-4965-hw.h).
+ *
+ * 3)  Actual measured output power, in half-dBm ("34" = 17 dBm).
+ *
+ * 4)  RF power amplifier detector level measurement (not used).
+ */
+struct iwl4965_eeprom_calib_measure {
+        u8 temperature;         /* Device temperature (Celsius) */
+        u8 gain_idx;            /* Index into gain table */
+        u8 actual_pow;          /* Measured RF output power, half-dBm */
+        s8 pa_det;              /* Power amp detector level (not used) */
+} __attribute__ ((packed));
+
+
+/*
+ * 4965 measurement set for one channel.  EEPROM contains:
+ *
+ * 1)  Channel number measured
+ *
+ * 2)  Measurements for each of 3 power levels for each of 2 radio transmitters
+ *     (a.k.a. "tx chains") (6 measurements altogether)
+ */
+struct iwl4965_eeprom_calib_ch_info {
+        u8 ch_num;
+        struct iwl4965_eeprom_calib_measure
+                measurements[EEPROM_TX_POWER_TX_CHAINS]
+                        [EEPROM_TX_POWER_MEASUREMENTS];
+} __attribute__ ((packed));
+
+/*
+ * 4965 txpower subband info.
+ *
+ * For each frequency subband, EEPROM contains the following:
+ *
+ * 1)  First and last channels within range of the subband.  "0" values
+ *     indicate that this sample set is not being used.
+ *
+ * 2)  Sample measurement sets for 2 channels close to the range endpoints.
+ */
+struct iwl4965_eeprom_calib_subband_info {
+        u8 ch_from;     /* channel number of lowest channel in subband */
+        u8 ch_to;       /* channel number of highest channel in subband */
+        struct iwl4965_eeprom_calib_ch_info ch1;
+        struct iwl4965_eeprom_calib_ch_info ch2;
+} __attribute__ ((packed));
+
+
+/*
+ * 4965 txpower calibration info.  EEPROM contains:
+ *
+ * 1)  Factory-measured saturation power levels (maximum levels at which
+ *     tx power amplifier can output a signal without too much distortion).
+ *     There is one level for 2.4 GHz band and one for 5 GHz band.  These
+ *     values apply to all channels within each of the bands.
+ *
+ * 2)  Factory-measured power supply voltage level.  This is assumed to be
+ *     constant (i.e. same value applies to all channels/bands) while the
+ *     factory measurements are being made.
+ *
+ * 3)  Up to 8 sets of factory-measured txpower calibration values.
+ *     These are for different frequency ranges, since txpower gain
+ *     characteristics of the analog radio circuitry vary with frequency.
+ *
+ *     Not all sets need to be filled with data;
+ *     struct iwl4965_eeprom_calib_subband_info contains range of channels
+ *     (0 if unused) for each set of data.
+ */
+struct iwl4965_eeprom_calib_info {
+        u8 saturation_power24;  /* half-dBm (e.g. "34" = 17 dBm) */
+        u8 saturation_power52;  /* half-dBm */
+        s16 voltage;            /* signed */
+        struct iwl4965_eeprom_calib_subband_info
+                band_info[EEPROM_TX_POWER_BANDS];
+} __attribute__ ((packed));
+
+
+
+/*
+ * 4965 EEPROM map
+ */
+struct iwl4965_eeprom {
+        u8 reserved0[16];
+#define EEPROM_DEVICE_ID                    (2*0x08)    /* 2 bytes */
+        u16 device_id;          /* abs.ofs: 16 */
+        u8 reserved1[2];
+#define EEPROM_PMC                          (2*0x0A)    /* 2 bytes */
+        u16 pmc;                /* abs.ofs: 20 */
+        u8 reserved2[20];
+#define EEPROM_MAC_ADDRESS                  (2*0x15)    /* 6  bytes */
+        u8 mac_address[6];      /* abs.ofs: 42 */
+        u8 reserved3[58];
+#define EEPROM_BOARD_REVISION               (2*0x35)    /* 2  bytes */
+        u16 board_revision;     /* abs.ofs: 106 */
+        u8 reserved4[11];
+#define EEPROM_BOARD_PBA_NUMBER             (2*0x3B+1)  /* 9  bytes */
+        u8 board_pba_number[9]; /* abs.ofs: 119 */
+        u8 reserved5[8];
+#define EEPROM_VERSION                      (2*0x44)    /* 2  bytes */
+        u16 version;            /* abs.ofs: 136 */
+#define EEPROM_SKU_CAP                      (2*0x45)    /* 1  bytes */
+        u8 sku_cap;             /* abs.ofs: 138 */
+#define EEPROM_LEDS_MODE                    (2*0x45+1)  /* 1  bytes */
+        u8 leds_mode;           /* abs.ofs: 139 */
+#define EEPROM_OEM_MODE                     (2*0x46)    /* 2  bytes */
+        u16 oem_mode;
+#define EEPROM_WOWLAN_MODE                  (2*0x47)    /* 2  bytes */
+        u16 wowlan_mode;        /* abs.ofs: 142 */
+#define EEPROM_LEDS_TIME_INTERVAL           (2*0x48)    /* 2  bytes */
+        u16 leds_time_interval; /* abs.ofs: 144 */
+#define EEPROM_LEDS_OFF_TIME                (2*0x49)    /* 1  bytes */
+        u8 leds_off_time;       /* abs.ofs: 146 */
+#define EEPROM_LEDS_ON_TIME                 (2*0x49+1)  /* 1  bytes */
+        u8 leds_on_time;        /* abs.ofs: 147 */
+#define EEPROM_ALMGOR_M_VERSION             (2*0x4A)    /* 1  bytes */
+        u8 almgor_m_version;    /* abs.ofs: 148 */
+#define EEPROM_ANTENNA_SWITCH_TYPE          (2*0x4A+1)  /* 1  bytes */
+        u8 antenna_switch_type; /* abs.ofs: 149 */
+        u8 reserved6[8];
+#define EEPROM_4965_BOARD_REVISION          (2*0x4F)    /* 2 bytes */
+        u16 board_revision_4965;        /* abs.ofs: 158 */
+        u8 reserved7[13];
+#define EEPROM_4965_BOARD_PBA               (2*0x56+1)  /* 9 bytes */
+        u8 board_pba_number_4965[9];    /* abs.ofs: 173 */
+        u8 reserved8[10];
+#define EEPROM_REGULATORY_SKU_ID            (2*0x60)    /* 4  bytes */
+        u8 sku_id[4];           /* abs.ofs: 192 */
+
+/*
+ * Per-channel regulatory data.
+ *
+ * Each channel that *might* be supported by 3945 or 4965 has a fixed location
+ * in EEPROM containing EEPROM_CHANNEL_* usage flags (LSB) and max regulatory
+ * txpower (MSB).
+ *
+ * Entries immediately below are for 20 MHz channel width.  FAT (40 MHz)
+ * channels (only for 4965, not supported by 3945) appear later in the EEPROM.
+ *
+ * 2.4 GHz channels 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14
+ */
+#define EEPROM_REGULATORY_BAND_1            (2*0x62)    /* 2  bytes */
+        u16 band_1_count;       /* abs.ofs: 196 */
+#define EEPROM_REGULATORY_BAND_1_CHANNELS   (2*0x63)    /* 28 bytes */
+        struct iwl4965_eeprom_channel band_1_channels[14]; /* abs.ofs: 196 */
+
+/*
+ * 4.9 GHz channels 183, 184, 185, 187, 188, 189, 192, 196,
+ * 5.0 GHz channels 7, 8, 11, 12, 16
+ * (4915-5080MHz) (none of these is ever supported)
+ */
+#define EEPROM_REGULATORY_BAND_2            (2*0x71)    /* 2  bytes */
+        u16 band_2_count;       /* abs.ofs: 226 */
+#define EEPROM_REGULATORY_BAND_2_CHANNELS   (2*0x72)    /* 26 bytes */
+        struct iwl4965_eeprom_channel band_2_channels[13]; /* abs.ofs: 228 */
+
+/*
+ * 5.2 GHz channels 34, 36, 38, 40, 42, 44, 46, 48, 52, 56, 60, 64
+ * (5170-5320MHz)
+ */
+#define EEPROM_REGULATORY_BAND_3            (2*0x7F)    /* 2  bytes */
+        u16 band_3_count;       /* abs.ofs: 254 */
+#define EEPROM_REGULATORY_BAND_3_CHANNELS   (2*0x80)    /* 24 bytes */
+        struct iwl4965_eeprom_channel band_3_channels[12]; /* abs.ofs: 256 */
+
+/*
+ * 5.5 GHz channels 100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140
+ * (5500-5700MHz)
+ */
+#define EEPROM_REGULATORY_BAND_4            (2*0x8C)    /* 2  bytes */
+        u16 band_4_count;       /* abs.ofs: 280 */
+#define EEPROM_REGULATORY_BAND_4_CHANNELS   (2*0x8D)    /* 22 bytes */
+        struct iwl4965_eeprom_channel band_4_channels[11]; /* abs.ofs: 282 */
+
+/*
+ * 5.7 GHz channels 145, 149, 153, 157, 161, 165
+ * (5725-5825MHz)
+ */
+#define EEPROM_REGULATORY_BAND_5            (2*0x98)    /* 2  bytes */
+        u16 band_5_count;       /* abs.ofs: 304 */
+#define EEPROM_REGULATORY_BAND_5_CHANNELS   (2*0x99)    /* 12 bytes */
+        struct iwl4965_eeprom_channel band_5_channels[6]; /* abs.ofs: 306 */
+
+        u8 reserved10[2];
+
+
+/*
+ * 2.4 GHz FAT channels 1 (5), 2 (6), 3 (7), 4 (8), 5 (9), 6 (10), 7 (11)
+ *
+ * The channel listed is the center of the lower 20 MHz half of the channel.
+ * The overall center frequency is actually 2 channels (10 MHz) above that,
+ * and the upper half of each FAT channel is centered 4 channels (20 MHz) away
+ * from the lower half; e.g. the upper half of FAT channel 1 is channel 5,
+ * and the overall FAT channel width centers on channel 3.
+ *
+ * NOTE:  The RXON command uses 20 MHz channel numbers to specify the
+ *        control channel to which to tune.  RXON also specifies whether the
+ *        control channel is the upper or lower half of a FAT channel.
+ *
+ * NOTE:  4965 does not support FAT channels on 2.4 GHz.
+ */
+#define EEPROM_REGULATORY_BAND_24_FAT_CHANNELS (2*0xA0) /* 14 bytes */
+        struct iwl4965_eeprom_channel band_24_channels[7]; /* abs.ofs: 320 */
+        u8 reserved11[2];
+
+/*
+ * 5.2 GHz FAT channels 36 (40), 44 (48), 52 (56), 60 (64),
+ * 100 (104), 108 (112), 116 (120), 124 (128), 132 (136), 149 (153), 157 (161)
+ */
+#define EEPROM_REGULATORY_BAND_52_FAT_CHANNELS (2*0xA8) /* 22 bytes */
+        struct iwl4965_eeprom_channel band_52_channels[11]; /* abs.ofs: 336 */
+        u8 reserved12[6];
+
+/*
+ * 4965 driver requires txpower calibration format version 5 or greater.
+ * Driver does not work with txpower calibration version < 5.
+ * This value is simply a 16-bit number, no major/minor versions here.
+ */
+#define EEPROM_CALIB_VERSION_OFFSET            (2*0xB6) /* 2 bytes */
+        u16 calib_version;      /* abs.ofs: 364 */
+        u8 reserved13[2];
+        u8 reserved14[96];      /* abs.ofs: 368 */
+
+/*
+ * 4965 Txpower calibration data.
+ */
+#define EEPROM_IWL_CALIB_TXPOWER_OFFSET        (2*0xE8) /* 48  bytes */
+        struct iwl4965_eeprom_calib_info calib_info;    /* abs.ofs: 464 */
+
+        u8 reserved16[140];     /* fill out to full 1024 byte block */
+
+
+} __attribute__ ((packed));
+
+#define IWL_EEPROM_IMAGE_SIZE 1024
+
+/* End of EEPROM */
+
+struct iwl_eeprom_ops {
+        int (*verify_signature) (struct iwl4965_priv *priv);
+        int (*acquire_semaphore) (struct iwl4965_priv *priv);
+        void (*release_semaphore) (struct iwl4965_priv *priv);
+};
+
+
+void iwl_eeprom_get_mac(const struct iwl4965_priv *priv, u8 *mac);
+int iwl_eeprom_init(struct iwl4965_priv *priv);
+
+int iwlcore_eeprom_verify_signature(struct iwl4965_priv *priv);
+int iwlcore_eeprom_acquire_semaphore(struct iwl4965_priv *priv);
+void iwlcore_eeprom_release_semaphore(struct iwl4965_priv *priv);
+
+#endif  /* __iwl_eeprom_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-helpers.h b/drivers/net/wireless/iwlwifi/iwl-helpers.h
index 8993cca81b40..736b88881b03 100644
--- a/drivers/net/wireless/iwlwifi/iwl-helpers.h
+++ b/drivers/net/wireless/iwlwifi/iwl-helpers.h
@@ -254,6 +254,26 @@ static inline u8 iwl_get_dma_hi_address(dma_addr_t addr)
         return sizeof(addr) > sizeof(u32) ? (addr >> 16) >> 16 : 0;
 }
 
+/**
+ * iwl_queue_inc_wrap - increment queue index, wrap back to beginning
+ * @index -- current index
+ * @n_bd -- total number of entries in queue (must be power of 2)
+ */
+static inline int iwl_queue_inc_wrap(int index, int n_bd)
+{
+        return ++index & (n_bd - 1);
+}
+
+/**
+ * iwl_queue_dec_wrap - decrement queue index, wrap back to end
+ * @index -- current index
+ * @n_bd -- total number of entries in queue (must be power of 2)
+ */
+static inline int iwl_queue_dec_wrap(int index, int n_bd)
+{
+        return --index & (n_bd - 1);
+}
+
 /* TODO: Move fw_desc functions to iwl-pci.ko */
 static inline void iwl_free_fw_desc(struct pci_dev *pci_dev,
                                     struct fw_desc *desc)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 0fab832ce8c2..ecf749c2dc0a 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -46,6 +46,7 @@
 
 #include <asm/div64.h>
 
+#include "iwl-3945-core.h"
 #include "iwl-3945.h"
 #include "iwl-helpers.h"
 
@@ -95,11 +96,6 @@ int iwl3945_param_queues_num = IWL_MAX_NUM_QUEUES; /* def: 8 Tx queues */
 #define DRV_COPYRIGHT   "Copyright(c) 2003-2007 Intel Corporation"
 #define DRV_VERSION     IWLWIFI_VERSION
 
-/* Change firmware file name, using "-" and incrementing number,
- *   *only* when uCode interface or architecture changes so that it
- *   is not compatible with earlier drivers.
- * This number will also appear in << 8 position of 1st dword of uCode file */
-#define IWL3945_UCODE_API "-1"
 
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_VERSION(DRV_VERSION);
@@ -162,17 +158,6 @@ static const char *iwl3945_escape_essid(const char *essid, u8 essid_len)
         return escaped;
 }
 
-static void iwl3945_print_hex_dump(int level, void *p, u32 len)
-{
-#ifdef CONFIG_IWL3945_DEBUG
-        if (!(iwl3945_debug_level & level))
-                return;
-
-        print_hex_dump(KERN_DEBUG, "iwl data: ", DUMP_PREFIX_OFFSET, 16, 1,
-                        p, len, 1);
-#endif
-}
-
 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
  * DMA services
  *
@@ -198,7 +183,7 @@ static void iwl3945_print_hex_dump(int level, void *p, u32 len)
  * (#0-3) for data tx via EDCA.  An additional 2 HCCA queues are unused.
  ***************************************************/
 
-static int iwl3945_queue_space(const struct iwl3945_queue *q)
+int iwl3945_queue_space(const struct iwl3945_queue *q)
 {
         int s = q->read_ptr - q->write_ptr;
 
@@ -214,33 +199,14 @@ static int iwl3945_queue_space(const struct iwl3945_queue *q)
         return s;
 }
 
-/**
- * iwl3945_queue_inc_wrap - increment queue index, wrap back to beginning
- * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
- */
-static inline int iwl3945_queue_inc_wrap(int index, int n_bd)
-{
-        return ++index & (n_bd - 1);
-}
-
-/**
- * iwl3945_queue_dec_wrap - increment queue index, wrap back to end
- * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
- */
-static inline int iwl3945_queue_dec_wrap(int index, int n_bd)
-{
-        return --index & (n_bd - 1);
-}
-
-static inline int x2_queue_used(const struct iwl3945_queue *q, int i)
+int iwl3945_x2_queue_used(const struct iwl3945_queue *q, int i)
 {
         return q->write_ptr > q->read_ptr ?
                 (i >= q->read_ptr && i < q->write_ptr) :
                 !(i < q->read_ptr && i >= q->write_ptr);
 }
 
+
 static inline u8 get_cmd_index(struct iwl3945_queue *q, u32 index, int is_huge)
 {
         /* This is for scan command, the big buffer at end of command array */
@@ -261,8 +227,8 @@ static int iwl3945_queue_init(struct iwl3945_priv *priv, struct iwl3945_queue *q
         q->n_window = slots_num;
         q->id = id;
 
-        /* count must be power-of-two size, otherwise iwl3945_queue_inc_wrap
-         * and iwl3945_queue_dec_wrap are broken. */
+        /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
+         * and iwl_queue_dec_wrap are broken. */
         BUG_ON(!is_power_of_2(count));
 
         /* slots_num must be power-of-two size, otherwise
@@ -362,7 +328,7 @@ int iwl3945_tx_queue_init(struct iwl3945_priv *priv,
         txq->need_update = 0;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
-         * iwl3945_queue_inc_wrap and iwl3945_queue_dec_wrap are broken. */
+         * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 
         /* Initialize queue high/low-water, head/tail indexes */
@@ -393,7 +359,7 @@ void iwl3945_tx_queue_free(struct iwl3945_priv *priv, struct iwl3945_tx_queue *t
 
         /* first, empty all BD's */
         for (; q->write_ptr != q->read_ptr;
-             q->read_ptr = iwl3945_queue_inc_wrap(q->read_ptr, q->n_bd))
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
                 iwl3945_hw_txq_free_tfd(priv, txq);
 
         len = sizeof(struct iwl3945_cmd) * q->n_window;
@@ -732,7 +698,7 @@ static int iwl3945_enqueue_hcmd(struct iwl3945_priv *priv, struct iwl3945_host_c
         txq->need_update = 1;
 
         /* Increment and update queue's write index */
-        q->write_ptr = iwl3945_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         ret = iwl3945_tx_queue_update_write_ptr(priv, txq);
 
         spin_unlock_irqrestore(&priv->hcmd_lock, flags);
@@ -1630,151 +1596,6 @@ int iwl3945_eeprom_init(struct iwl3945_priv *priv)
         return 0;
 }
 
-/******************************************************************************
- *
- * Misc. internal state and helper functions
- *
- ******************************************************************************/
-#ifdef CONFIG_IWL3945_DEBUG
-
-/**
- * iwl3945_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good frames.
- */
-void iwl3945_report_frame(struct iwl3945_priv *priv,
-                      struct iwl3945_rx_packet *pkt,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        u16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        int rate_sym;
-        u16 length;
-        u16 status;
-        u16 bcn_tmr;
-        u32 tsf_low;
-        u64 tsf;
-        u8 rssi;
-        u8 agc;
-        u16 sig_avg;
-        u16 noise_diff;
-        struct iwl3945_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
-        struct iwl3945_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
-        struct iwl3945_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        u8 *data = IWL_RX_DATA(pkt);
-
-        /* MAC header */
-        fc = le16_to_cpu(header->frame_control);
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(rx_hdr->channel);
-        phy_flags = le16_to_cpu(rx_hdr->phy_flags);
-        rate_sym = rx_hdr->rate;
-        length = le16_to_cpu(rx_hdr->len);
-
-        /* end-of-frame status and timestamp */
-        status = le32_to_cpu(rx_end->status);
-        bcn_tmr = le32_to_cpu(rx_end->beacon_timestamp);
-        tsf_low = le64_to_cpu(rx_end->timestamp) & 0x0ffffffff;
-        tsf = le64_to_cpu(rx_end->timestamp);
-
-        /* signal statistics */
-        rssi = rx_stats->rssi;
-        agc = rx_stats->agc;
-        sig_avg = le16_to_cpu(rx_stats->sig_avg);
-        noise_diff = le16_to_cpu(rx_stats->noise_diff);
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~IEEE80211_FCTL_PROTECTED) ==
-            (IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                u32 rate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (fc & IEEE80211_FCTL_RETRY)
-                        title = "Retry";
-                else if (ieee80211_is_assoc_response(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_response(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_response(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate = iwl3945_rate_index_from_plcp(rate_sym);
-                if (rate == -1)
-                        rate = 0;
-                else
-                        rate = iwl3945_rates[rate].ieee / 2;
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX("%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
-                                     title, fc, header->addr1[5],
-                                     length, rssi, channel, rate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX("%s: 0x%04x, dst=0x%02x, "
-                                     "src=0x%02x, rssi=%u, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, fc, header->addr1[5],
-                                     header->addr3[5], rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl3945_print_hex_dump(IWL_DL_RX, data, length);
-}
-#endif
-
 static void iwl3945_unset_hw_setting(struct iwl3945_priv *priv)
 {
         if (priv->hw_setting.shared_virt)
@@ -2242,34 +2063,6 @@ int iwl3945_is_network_packet(struct iwl3945_priv *priv, struct ieee80211_hdr *h
         return 1;
 }
 
-#define TX_STATUS_ENTRY(x) case TX_STATUS_FAIL_ ## x: return #x
-
-static const char *iwl3945_get_tx_fail_reason(u32 status)
-{
-        switch (status & TX_STATUS_MSK) {
-        case TX_STATUS_SUCCESS:
-                return "SUCCESS";
-                TX_STATUS_ENTRY(SHORT_LIMIT);
-                TX_STATUS_ENTRY(LONG_LIMIT);
-                TX_STATUS_ENTRY(FIFO_UNDERRUN);
-                TX_STATUS_ENTRY(MGMNT_ABORT);
-                TX_STATUS_ENTRY(NEXT_FRAG);
-                TX_STATUS_ENTRY(LIFE_EXPIRE);
-                TX_STATUS_ENTRY(DEST_PS);
-                TX_STATUS_ENTRY(ABORTED);
-                TX_STATUS_ENTRY(BT_RETRY);
-                TX_STATUS_ENTRY(STA_INVALID);
-                TX_STATUS_ENTRY(FRAG_DROPPED);
-                TX_STATUS_ENTRY(TID_DISABLE);
-                TX_STATUS_ENTRY(FRAME_FLUSHED);
-                TX_STATUS_ENTRY(INSUFFICIENT_CF_POLL);
-                TX_STATUS_ENTRY(TX_LOCKED);
-                TX_STATUS_ENTRY(NO_BEACON_ON_RADAR);
-        }
-
-        return "UNKNOWN";
-}
-
 /**
  * iwl3945_scan_cancel - Cancel any currently executing HW scan
  *
@@ -2957,7 +2750,7 @@ static int iwl3945_tx_skb(struct iwl3945_priv *priv,
                            ieee80211_get_hdrlen(fc));
 
         /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl3945_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         rc = iwl3945_tx_queue_update_write_ptr(priv, txq);
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -3317,125 +3110,6 @@ static int iwl3945_get_measurement(struct iwl3945_priv *priv,
 }
 #endif
 
-static void iwl3945_txstatus_to_ieee(struct iwl3945_priv *priv,
-                                 struct iwl3945_tx_info *tx_sta)
-{
-
-        tx_sta->status.ack_signal = 0;
-        tx_sta->status.excessive_retries = 0;
-        tx_sta->status.queue_length = 0;
-        tx_sta->status.queue_number = 0;
-
-        if (in_interrupt())
-                ieee80211_tx_status_irqsafe(priv->hw,
-                                            tx_sta->skb[0], &(tx_sta->status));
-        else
-                ieee80211_tx_status(priv->hw,
-                                    tx_sta->skb[0], &(tx_sta->status));
-
-        tx_sta->skb[0] = NULL;
-}
-
-/**
- * iwl3945_tx_queue_reclaim - Reclaim Tx queue entries already Tx'd
- *
- * When FW advances 'R' index, all entries between old and new 'R' index
- * need to be reclaimed. As result, some free space forms. If there is
- * enough free space (> low mark), wake the stack that feeds us.
- */
-static int iwl3945_tx_queue_reclaim(struct iwl3945_priv *priv, int txq_id, int index)
-{
-        struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
-        struct iwl3945_queue *q = &txq->q;
-        int nfreed = 0;
-
-        if ((index >= q->n_bd) || (x2_queue_used(q, index) == 0)) {
-                IWL_ERROR("Read index for DMA queue txq id (%d), index %d, "
-                          "is out of range [0-%d] %d %d.\n", txq_id,
-                          index, q->n_bd, q->write_ptr, q->read_ptr);
-                return 0;
-        }
-
-        for (index = iwl3945_queue_inc_wrap(index, q->n_bd);
-                q->read_ptr != index;
-                q->read_ptr = iwl3945_queue_inc_wrap(q->read_ptr, q->n_bd)) {
-                if (txq_id != IWL_CMD_QUEUE_NUM) {
-                        iwl3945_txstatus_to_ieee(priv,
-                                        &(txq->txb[txq->q.read_ptr]));
-                        iwl3945_hw_txq_free_tfd(priv, txq);
-                } else if (nfreed > 1) {
-                        IWL_ERROR("HCMD skipped: index (%d) %d %d\n", index,
-                                        q->write_ptr, q->read_ptr);
-                        queue_work(priv->workqueue, &priv->restart);
-                }
-                nfreed++;
-        }
-
-        if (iwl3945_queue_space(q) > q->low_mark && (txq_id >= 0) &&
-                        (txq_id != IWL_CMD_QUEUE_NUM) &&
-                        priv->mac80211_registered)
-                ieee80211_wake_queue(priv->hw, txq_id);
-
-
-        return nfreed;
-}
-
-static int iwl3945_is_tx_success(u32 status)
-{
-        return (status & 0xFF) == 0x1;
-}
-
-/******************************************************************************
- *
- * Generic RX handler implementations
- *
- ******************************************************************************/
-/**
- * iwl3945_rx_reply_tx - Handle Tx response
- */
-static void iwl3945_rx_reply_tx(struct iwl3945_priv *priv,
-                            struct iwl3945_rx_mem_buffer *rxb)
-{
-        struct iwl3945_rx_packet *pkt = (void *)rxb->skb->data;
-        u16 sequence = le16_to_cpu(pkt->hdr.sequence);
-        int txq_id = SEQ_TO_QUEUE(sequence);
-        int index = SEQ_TO_INDEX(sequence);
-        struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
-        struct ieee80211_tx_status *tx_status;
-        struct iwl3945_tx_resp *tx_resp = (void *)&pkt->u.raw[0];
-        u32  status = le32_to_cpu(tx_resp->status);
-
-        if ((index >= txq->q.n_bd) || (x2_queue_used(&txq->q, index) == 0)) {
-                IWL_ERROR("Read index for DMA queue txq_id (%d) index %d "
-                          "is out of range [0-%d] %d %d\n", txq_id,
-                          index, txq->q.n_bd, txq->q.write_ptr,
-                          txq->q.read_ptr);
-                return;
-        }
-
-        tx_status = &(txq->txb[txq->q.read_ptr].status);
-
-        tx_status->retry_count = tx_resp->failure_frame;
-        tx_status->queue_number = status;
-        tx_status->queue_length = tx_resp->bt_kill_count;
-        tx_status->queue_length |= tx_resp->failure_rts;
-
-        tx_status->flags =
-            iwl3945_is_tx_success(status) ? IEEE80211_TX_STATUS_ACK : 0;
-
-        IWL_DEBUG_TX("Tx queue %d Status %s (0x%08x) plcp rate %d retries %d\n",
-                        txq_id, iwl3945_get_tx_fail_reason(status), status,
-                        tx_resp->rate, tx_resp->failure_frame);
-
-        IWL_DEBUG_TX_REPLY("Tx queue reclaim %d\n", index);
-        if (index != -1)
-                iwl3945_tx_queue_reclaim(priv, txq_id, index);
-
-        if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
-                IWL_ERROR("TODO:  Implement Tx ABORT REQUIRED!!!\n");
-}
-
-
 static void iwl3945_rx_reply_alive(struct iwl3945_priv *priv,
                                struct iwl3945_rx_mem_buffer *rxb)
 {
@@ -3782,13 +3456,44 @@ static void iwl3945_setup_rx_handlers(struct iwl3945_priv *priv)
         priv->rx_handlers[SCAN_COMPLETE_NOTIFICATION] =
             iwl3945_rx_scan_complete_notif;
         priv->rx_handlers[CARD_STATE_NOTIFICATION] = iwl3945_rx_card_state_notif;
-        priv->rx_handlers[REPLY_TX] = iwl3945_rx_reply_tx;
 
         /* Set up hardware specific Rx handlers */
         iwl3945_hw_rx_handler_setup(priv);
 }
 
 /**
+ * iwl3945_cmd_queue_reclaim - Reclaim CMD queue entries
+ * When FW advances 'R' index, all entries between old and new 'R' index
+ * need to be reclaimed.
+ */
+static void iwl3945_cmd_queue_reclaim(struct iwl3945_priv *priv,
+                                      int txq_id, int index)
+{
+        struct iwl3945_tx_queue *txq = &priv->txq[txq_id];
+        struct iwl3945_queue *q = &txq->q;
+        int nfreed = 0;
+
+        if ((index >= q->n_bd) || (iwl3945_x2_queue_used(q, index) == 0)) {
+                IWL_ERROR("Read index for DMA queue txq id (%d), index %d, "
+                          "is out of range [0-%d] %d %d.\n", txq_id,
+                          index, q->n_bd, q->write_ptr, q->read_ptr);
+                return;
+        }
+
+        for (index = iwl_queue_inc_wrap(index, q->n_bd); q->read_ptr != index;
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+                if (nfreed > 1) {
+                        IWL_ERROR("HCMD skipped: index (%d) %d %d\n", index,
+                                        q->write_ptr, q->read_ptr);
+                        queue_work(priv->workqueue, &priv->restart);
+                        break;
+                }
+                nfreed++;
+        }
+}
+
+
+/**
  * iwl3945_tx_cmd_complete - Pull unused buffers off the queue and reclaim them
  * @rxb: Rx buffer to reclaim
  *
@@ -3807,12 +3512,6 @@ static void iwl3945_tx_cmd_complete(struct iwl3945_priv *priv,
         int cmd_index;
         struct iwl3945_cmd *cmd;
 
-        /* If a Tx command is being handled and it isn't in the actual
-         * command queue then there a command routing bug has been introduced
-         * in the queue management code. */
-        if (txq_id != IWL_CMD_QUEUE_NUM)
-                IWL_ERROR("Error wrong command queue %d command id 0x%X\n",
-                          txq_id, pkt->hdr.cmd);
         BUG_ON(txq_id != IWL_CMD_QUEUE_NUM);
 
         cmd_index = get_cmd_index(&priv->txq[IWL_CMD_QUEUE_NUM].q, index, huge);
@@ -3826,7 +3525,7 @@ static void iwl3945_tx_cmd_complete(struct iwl3945_priv *priv,
                    !cmd->meta.u.callback(priv, cmd, rxb->skb))
                 rxb->skb = NULL;
 
-        iwl3945_tx_queue_reclaim(priv, txq_id, index);
+        iwl3945_cmd_queue_reclaim(priv, txq_id, index);
 
         if (!(cmd->meta.flags & CMD_ASYNC)) {
                 clear_bit(STATUS_HCMD_ACTIVE, &priv->status);
@@ -4506,8 +4205,7 @@ static void iwl3945_dump_nic_error_log(struct iwl3945_priv *priv)
 
         if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
                 IWL_ERROR("Start IWL Error Log Dump:\n");
-                IWL_ERROR("Status: 0x%08lX, Config: %08X count: %d\n",
-                          priv->status, priv->config, count);
+                IWL_ERROR("Status: 0x%08lX, count: %d\n", priv->status, count);
         }
 
         IWL_ERROR("Desc       Time       asrtPC  blink2 "
@@ -4727,9 +4425,9 @@ static void iwl3945_irq_tasklet(struct iwl3945_priv *priv)
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
          * reading CSR_INT. */
-        if (inta_fh & CSR_FH_INT_RX_MASK)
+        if (inta_fh & CSR39_FH_INT_RX_MASK)
                 inta |= CSR_INT_BIT_FH_RX;
-        if (inta_fh & CSR_FH_INT_TX_MASK)
+        if (inta_fh & CSR39_FH_INT_TX_MASK)
                 inta |= CSR_INT_BIT_FH_TX;
 
         /* Now service all interrupt bits discovered above. */
@@ -5119,11 +4817,12 @@ static int iwl3945_init_channel_map(struct iwl3945_priv *priv)
                         ch_info->scan_power = eeprom_ch_info[ch].max_power_avg;
                         ch_info->min_power = 0;
 
-                        IWL_DEBUG_INFO("Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x"
+                        IWL_DEBUG_INFO("Ch. %d [%sGHz] %s%s%s%s%s%s%s(0x%02x"
                                        " %ddBm): Ad-Hoc %ssupported\n",
                                        ch_info->channel,
                                        is_channel_a_band(ch_info) ?
                                        "5.2" : "2.4",
+                                       CHECK_AND_PRINT(VALID),
                                        CHECK_AND_PRINT(IBSS),
                                        CHECK_AND_PRINT(ACTIVE),
                                        CHECK_AND_PRINT(RADAR),
@@ -5333,7 +5032,7 @@ static void iwl3945_init_hw_rates(struct iwl3945_priv *priv,
 static int iwl3945_init_geos(struct iwl3945_priv *priv)
 {
         struct iwl3945_channel_info *ch;
-        struct ieee80211_supported_band *band;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *channels;
         struct ieee80211_channel *geo_ch;
         struct ieee80211_rate *rates;
@@ -5351,7 +5050,7 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
         if (!channels)
                 return -ENOMEM;
 
-        rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_MAX_RATES + 1)),
+        rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_RATE_COUNT + 1)),
                         GFP_KERNEL);
         if (!rates) {
                 kfree(channels);
@@ -5359,38 +5058,38 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
         }
 
         /* 5.2GHz channels start after the 2.4GHz channels */
-        band = &priv->bands[IEEE80211_BAND_5GHZ];
-        band->channels = &channels[ARRAY_SIZE(iwl3945_eeprom_band_1)];
-        band->bitrates = &rates[4];
-        band->n_bitrates = 8;   /* just OFDM */
-
-        band = &priv->bands[IEEE80211_BAND_2GHZ];
-        band->channels = channels;
-        band->bitrates = rates;
-        band->n_bitrates = 12;  /* OFDM & CCK */
+        sband = &priv->bands[IEEE80211_BAND_5GHZ];
+        sband->channels = &channels[ARRAY_SIZE(iwl3945_eeprom_band_1)];
+        /* just OFDM */
+        sband->bitrates = &rates[IWL_FIRST_OFDM_RATE];
+        sband->n_bitrates = IWL_RATE_COUNT - IWL_FIRST_OFDM_RATE;
+
+        sband = &priv->bands[IEEE80211_BAND_2GHZ];
+        sband->channels = channels;
+        /* OFDM & CCK */
+        sband->bitrates = rates;
+        sband->n_bitrates = IWL_RATE_COUNT;
 
         priv->ieee_channels = channels;
         priv->ieee_rates = rates;
 
         iwl3945_init_hw_rates(priv, rates);
 
-        for (i = 0, geo_ch = channels; i < priv->channel_count; i++) {
+        for (i = 0;  i < priv->channel_count; i++) {
                 ch = &priv->channel_info[i];
 
-                if (!is_channel_valid(ch)) {
-                        IWL_DEBUG_INFO("Channel %d [%sGHz] is restricted -- "
-                                    "skipping.\n",
-                                    ch->channel, is_channel_a_band(ch) ?
-                                    "5.2" : "2.4");
+                /* FIXME: might be removed if scan is OK*/
+                if (!is_channel_valid(ch))
                         continue;
-                }
 
                 if (is_channel_a_band(ch))
-                        geo_ch = &priv->bands[IEEE80211_BAND_5GHZ].channels[priv->bands[IEEE80211_BAND_5GHZ].n_channels++];
+                        sband =  &priv->bands[IEEE80211_BAND_5GHZ];
                 else
-                        geo_ch = &priv->bands[IEEE80211_BAND_2GHZ].channels[priv->bands[IEEE80211_BAND_2GHZ].n_channels++];
+                        sband =  &priv->bands[IEEE80211_BAND_2GHZ];
 
-                geo_ch->center_freq = ieee80211chan2mhz(ch->channel);
+                geo_ch = &sband->channels[sband->n_channels++];
+
+                geo_ch->center_freq = ieee80211_channel_to_frequency(ch->channel);
                 geo_ch->max_power = ch->max_power_avg;
                 geo_ch->max_antenna_gain = 0xff;
                 geo_ch->hw_value = ch->channel;
@@ -5408,16 +5107,28 @@ static int iwl3945_init_geos(struct iwl3945_priv *priv)
                         if (ch->max_power_avg > priv->max_channel_txpower_limit)
                                 priv->max_channel_txpower_limit =
                                     ch->max_power_avg;
-                } else
+                } else {
                         geo_ch->flags |= IEEE80211_CHAN_DISABLED;
+                }
+
+                /* Save flags for reg domain usage */
+                geo_ch->orig_flags = geo_ch->flags;
+
+                IWL_DEBUG_INFO("Channel %d Freq=%d[%sGHz] %s flag=0%X\n",
+                                ch->channel, geo_ch->center_freq,
+                                is_channel_a_band(ch) ?  "5.2" : "2.4",
+                                geo_ch->flags & IEEE80211_CHAN_DISABLED ?
+                                "restricted" : "valid",
+                                 geo_ch->flags);
         }
 
-        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) && priv->is_abg) {
+        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
+             priv->cfg->sku & IWL_SKU_A) {
                 printk(KERN_INFO DRV_NAME
                        ": Incorrectly detected BG card as ABG.  Please send "
                        "your PCI ID 0x%04X:0x%04X to maintainer.\n",
                        priv->pci_dev->device, priv->pci_dev->subsystem_device);
-                priv->is_abg = 0;
+                 priv->cfg->sku &= ~IWL_SKU_A;
         }
 
         printk(KERN_INFO DRV_NAME
@@ -5764,7 +5475,7 @@ static int iwl3945_read_ucode(struct iwl3945_priv *priv)
         int ret = 0;
         const struct firmware *ucode_raw;
         /* firmware file name contains uCode/driver compatibility version */
-        const char *name = "iwlwifi-3945" IWL3945_UCODE_API ".ucode";
+        const char *name = priv->cfg->fw_name;
         u8 *src;
         size_t len;
         u32 ver, inst_size, data_size, init_size, init_data_size, boot_size;
@@ -7152,6 +6863,12 @@ static int iwl3945_mac_config_interface(struct ieee80211_hw *hw,
         if (conf == NULL)
                 return -EIO;
 
+        if (priv->vif != vif) {
+                IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
+                mutex_unlock(&priv->mutex);
+                return 0;
+        }
+
         /* XXX: this MUST use conf->mac_addr */
 
         if ((priv->iw_mode == IEEE80211_IF_TYPE_AP) &&
@@ -7176,17 +6893,6 @@ static int iwl3945_mac_config_interface(struct ieee80211_hw *hw,
         if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
             !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
  */
-        if (unlikely(test_bit(STATUS_SCANNING, &priv->status))) {
-                IWL_DEBUG_MAC80211("leave - scanning\n");
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
-
-        if (priv->vif != vif) {
-                IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
 
         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
                 if (!conf->bssid) {
@@ -7884,31 +7590,6 @@ static DEVICE_ATTR(measurement, S_IRUSR | S_IWUSR,
                    show_measurement, store_measurement);
 #endif /* CONFIG_IWL3945_SPECTRUM_MEASUREMENT */
 
-static ssize_t show_rate(struct device *d,
-                         struct device_attribute *attr, char *buf)
-{
-        struct iwl3945_priv *priv = dev_get_drvdata(d);
-        unsigned long flags;
-        int i;
-
-        spin_lock_irqsave(&priv->sta_lock, flags);
-        if (priv->iw_mode == IEEE80211_IF_TYPE_STA)
-                i = priv->stations[IWL_AP_ID].current_rate.s.rate;
-        else
-                i = priv->stations[IWL_STA_ID].current_rate.s.rate;
-        spin_unlock_irqrestore(&priv->sta_lock, flags);
-
-        i = iwl3945_rate_index_from_plcp(i);
-        if (i == -1)
-                return sprintf(buf, "0\n");
-
-        return sprintf(buf, "%d%s\n",
-                       (iwl3945_rates[i].ieee >> 1),
-                       (iwl3945_rates[i].ieee & 0x1) ? ".5" : "");
-}
-
-static DEVICE_ATTR(rate, S_IRUSR, show_rate, NULL);
-
 static ssize_t store_retry_rate(struct device *d,
                                 struct device_attribute *attr,
                                 const char *buf, size_t count)
@@ -8199,7 +7880,6 @@ static struct attribute *iwl3945_sysfs_entries[] = {
         &dev_attr_measurement.attr,
 #endif
         &dev_attr_power_level.attr,
-        &dev_attr_rate.attr,
         &dev_attr_retry_rate.attr,
         &dev_attr_rf_kill.attr,
         &dev_attr_rs_window.attr,
@@ -8238,9 +7918,9 @@ static struct ieee80211_ops iwl3945_hw_ops = {
 static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         int err = 0;
-        u32 pci_id;
         struct iwl3945_priv *priv;
         struct ieee80211_hw *hw;
+        struct iwl_3945_cfg *cfg = (struct iwl_3945_cfg *)(ent->driver_data);
         int i;
         DECLARE_MAC_BUF(mac);
 
@@ -8276,6 +7956,7 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         priv->hw = hw;
 
         priv->pci_dev = pdev;
+        priv->cfg = cfg;
 
         /* Select antenna (may be helpful if only one antenna is connected) */
         priv->antenna = (enum iwl3945_antenna)iwl3945_param_antenna;
@@ -8365,32 +8046,8 @@ static int iwl3945_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
 
         priv->iw_mode = IEEE80211_IF_TYPE_STA;
 
-        pci_id =
-            (priv->pci_dev->device << 16) | priv->pci_dev->subsystem_device;
-
-        switch (pci_id) {
-        case 0x42221005:        /* 0x4222 0x8086 0x1005 is BG SKU */
-        case 0x42221034:        /* 0x4222 0x8086 0x1034 is BG SKU */
-        case 0x42271014:        /* 0x4227 0x8086 0x1014 is BG SKU */
-        case 0x42221044:        /* 0x4222 0x8086 0x1044 is BG SKU */
-                priv->is_abg = 0;
-                break;
-
-        /*
-         * Rest are assumed ABG SKU -- if this is not the
-         * case then the card will get the wrong 'Detected'
-         * line in the kernel log however the code that
-         * initializes the GEO table will detect no A-band
-         * channels and remove the is_abg mask.
-         */
-        default:
-                priv->is_abg = 1;
-                break;
-        }
-
         printk(KERN_INFO DRV_NAME
-               ": Detected Intel PRO/Wireless 3945%sBG Network Connection\n",
-               priv->is_abg ? "A" : "");
+                ": Detected Intel Wireless WiFi Link %s\n", priv->cfg->name);
 
         /* Device-specific setup */
         if (iwl3945_hw_set_hw_setting(priv)) {
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 20d012d4f37e..28c64c39ef02 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -45,13 +45,10 @@
 
 #include <asm/div64.h>
 
+#include "iwl-core.h"
 #include "iwl-4965.h"
 #include "iwl-helpers.h"
 
-#ifdef CONFIG_IWL4965_DEBUG
-u32 iwl4965_debug_level;
-#endif
-
 static int iwl4965_tx_queue_update_write_ptr(struct iwl4965_priv *priv,
                                   struct iwl4965_tx_queue *txq);
 
@@ -90,15 +87,8 @@ int iwl4965_param_amsdu_size_8K;   /* def: enable 8K amsdu size */
 #define VS
 #endif
 
-#define IWLWIFI_VERSION "1.2.26k" VD VS
-#define DRV_COPYRIGHT   "Copyright(c) 2003-2007 Intel Corporation"
-#define DRV_VERSION     IWLWIFI_VERSION
+#define DRV_VERSION     IWLWIFI_VERSION VD VS
 
-/* Change firmware file name, using "-" and incrementing number,
- *   *only* when uCode interface or architecture changes so that it
- *   is not compatible with earlier drivers.
- * This number will also appear in << 8 position of 1st dword of uCode file */
-#define IWL4965_UCODE_API "-1"
 
 MODULE_DESCRIPTION(DRV_DESCRIPTION);
 MODULE_VERSION(DRV_VERSION);
@@ -161,17 +151,6 @@ static const char *iwl4965_escape_essid(const char *essid, u8 essid_len)
         return escaped;
 }
 
-static void iwl4965_print_hex_dump(int level, void *p, u32 len)
-{
-#ifdef CONFIG_IWL4965_DEBUG
-        if (!(iwl4965_debug_level & level))
-                return;
-
-        print_hex_dump(KERN_DEBUG, "iwl data: ", DUMP_PREFIX_OFFSET, 16, 1,
-                        p, len, 1);
-#endif
-}
-
 /*************** DMA-QUEUE-GENERAL-FUNCTIONS  *****
  * DMA services
  *
@@ -215,25 +194,6 @@ int iwl4965_queue_space(const struct iwl4965_queue *q)
         return s;
 }
 
-/**
- * iwl4965_queue_inc_wrap - increment queue index, wrap back to beginning
- * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
- */
-static inline int iwl4965_queue_inc_wrap(int index, int n_bd)
-{
-        return ++index & (n_bd - 1);
-}
-
-/**
- * iwl4965_queue_dec_wrap - decrement queue index, wrap back to end
- * @index -- current index
- * @n_bd -- total number of entries in queue (must be power of 2)
- */
-static inline int iwl4965_queue_dec_wrap(int index, int n_bd)
-{
-        return --index & (n_bd - 1);
-}
 
 static inline int x2_queue_used(const struct iwl4965_queue *q, int i)
 {
@@ -262,8 +222,8 @@ static int iwl4965_queue_init(struct iwl4965_priv *priv, struct iwl4965_queue *q
         q->n_window = slots_num;
         q->id = id;
 
-        /* count must be power-of-two size, otherwise iwl4965_queue_inc_wrap
-         * and iwl4965_queue_dec_wrap are broken. */
+        /* count must be power-of-two size, otherwise iwl_queue_inc_wrap
+         * and iwl_queue_dec_wrap are broken. */
         BUG_ON(!is_power_of_2(count));
 
         /* slots_num must be power-of-two size, otherwise
@@ -363,7 +323,7 @@ int iwl4965_tx_queue_init(struct iwl4965_priv *priv,
         txq->need_update = 0;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
-         * iwl4965_queue_inc_wrap and iwl4965_queue_dec_wrap are broken. */
+         * iwl_queue_inc_wrap and iwl_queue_dec_wrap are broken. */
         BUILD_BUG_ON(TFD_QUEUE_SIZE_MAX & (TFD_QUEUE_SIZE_MAX - 1));
 
         /* Initialize queue's high/low-water marks, and head/tail indexes */
@@ -394,7 +354,7 @@ void iwl4965_tx_queue_free(struct iwl4965_priv *priv, struct iwl4965_tx_queue *t
 
         /* first, empty all BD's */
         for (; q->write_ptr != q->read_ptr;
-             q->read_ptr = iwl4965_queue_inc_wrap(q->read_ptr, q->n_bd))
+             q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd))
                 iwl4965_hw_txq_free_tfd(priv, txq);
 
         len = sizeof(struct iwl4965_cmd) * q->n_window;
@@ -735,7 +695,7 @@ static int iwl4965_enqueue_hcmd(struct iwl4965_priv *priv, struct iwl4965_host_c
         ret = iwl4965_tx_queue_update_wr_ptr(priv, txq, 0);
 
         /* Increment and update queue's write index */
-        q->write_ptr = iwl4965_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         iwl4965_tx_queue_update_write_ptr(priv, txq);
 
         spin_unlock_irqrestore(&priv->hcmd_lock, flags);
@@ -1551,34 +1511,6 @@ unsigned int iwl4965_fill_beacon_frame(struct iwl4965_priv *priv,
         return priv->ibss_beacon->len;
 }
 
-int iwl4965_rate_index_from_plcp(int plcp)
-{
-        int i = 0;
-
-        /* 4965 HT rate format */
-        if (plcp & RATE_MCS_HT_MSK) {
-                i = (plcp & 0xff);
-
-                if (i >= IWL_RATE_MIMO_6M_PLCP)
-                        i = i - IWL_RATE_MIMO_6M_PLCP;
-
-                i += IWL_FIRST_OFDM_RATE;
-                /* skip 9M not supported in ht*/
-                if (i >= IWL_RATE_9M_INDEX)
-                        i += 1;
-                if ((i >= IWL_FIRST_OFDM_RATE) &&
-                    (i <= IWL_LAST_OFDM_RATE))
-                        return i;
-
-        /* 4965 legacy rate format, search for match in table */
-        } else {
-                for (i = 0; i < ARRAY_SIZE(iwl4965_rates); i++)
-                        if (iwl4965_rates[i].plcp == (plcp &0xFF))
-                                return i;
-        }
-        return -1;
-}
-
 static u8 iwl4965_rate_get_lowest_plcp(int rate_mask)
 {
         u8 i;
@@ -1712,148 +1644,6 @@ done:
  * Misc. internal state and helper functions
  *
  ******************************************************************************/
-#ifdef CONFIG_IWL4965_DEBUG
-
-/**
- * iwl4965_report_frame - dump frame to syslog during debug sessions
- *
- * You may hack this function to show different aspects of received frames,
- * including selective frame dumps.
- * group100 parameter selects whether to show 1 out of 100 good frames.
- *
- * TODO:  This was originally written for 3945, need to audit for
- *        proper operation with 4965.
- */
-void iwl4965_report_frame(struct iwl4965_priv *priv,
-                      struct iwl4965_rx_packet *pkt,
-                      struct ieee80211_hdr *header, int group100)
-{
-        u32 to_us;
-        u32 print_summary = 0;
-        u32 print_dump = 0;     /* set to 1 to dump all frames' contents */
-        u32 hundred = 0;
-        u32 dataframe = 0;
-        u16 fc;
-        u16 seq_ctl;
-        u16 channel;
-        u16 phy_flags;
-        int rate_sym;
-        u16 length;
-        u16 status;
-        u16 bcn_tmr;
-        u32 tsf_low;
-        u64 tsf;
-        u8 rssi;
-        u8 agc;
-        u16 sig_avg;
-        u16 noise_diff;
-        struct iwl4965_rx_frame_stats *rx_stats = IWL_RX_STATS(pkt);
-        struct iwl4965_rx_frame_hdr *rx_hdr = IWL_RX_HDR(pkt);
-        struct iwl4965_rx_frame_end *rx_end = IWL_RX_END(pkt);
-        u8 *data = IWL_RX_DATA(pkt);
-
-        /* MAC header */
-        fc = le16_to_cpu(header->frame_control);
-        seq_ctl = le16_to_cpu(header->seq_ctrl);
-
-        /* metadata */
-        channel = le16_to_cpu(rx_hdr->channel);
-        phy_flags = le16_to_cpu(rx_hdr->phy_flags);
-        rate_sym = rx_hdr->rate;
-        length = le16_to_cpu(rx_hdr->len);
-
-        /* end-of-frame status and timestamp */
-        status = le32_to_cpu(rx_end->status);
-        bcn_tmr = le32_to_cpu(rx_end->beacon_timestamp);
-        tsf_low = le64_to_cpu(rx_end->timestamp) & 0x0ffffffff;
-        tsf = le64_to_cpu(rx_end->timestamp);
-
-        /* signal statistics */
-        rssi = rx_stats->rssi;
-        agc = rx_stats->agc;
-        sig_avg = le16_to_cpu(rx_stats->sig_avg);
-        noise_diff = le16_to_cpu(rx_stats->noise_diff);
-
-        to_us = !compare_ether_addr(header->addr1, priv->mac_addr);
-
-        /* if data frame is to us and all is good,
-         *   (optionally) print summary for only 1 out of every 100 */
-        if (to_us && (fc & ~IEEE80211_FCTL_PROTECTED) ==
-            (IEEE80211_FCTL_FROMDS | IEEE80211_FTYPE_DATA)) {
-                dataframe = 1;
-                if (!group100)
-                        print_summary = 1;      /* print each frame */
-                else if (priv->framecnt_to_us < 100) {
-                        priv->framecnt_to_us++;
-                        print_summary = 0;
-                } else {
-                        priv->framecnt_to_us = 0;
-                        print_summary = 1;
-                        hundred = 1;
-                }
-        } else {
-                /* print summary for all other frames */
-                print_summary = 1;
-        }
-
-        if (print_summary) {
-                char *title;
-                u32 rate;
-
-                if (hundred)
-                        title = "100Frames";
-                else if (fc & IEEE80211_FCTL_RETRY)
-                        title = "Retry";
-                else if (ieee80211_is_assoc_response(fc))
-                        title = "AscRsp";
-                else if (ieee80211_is_reassoc_response(fc))
-                        title = "RasRsp";
-                else if (ieee80211_is_probe_response(fc)) {
-                        title = "PrbRsp";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_beacon(fc)) {
-                        title = "Beacon";
-                        print_dump = 1; /* dump frame contents */
-                } else if (ieee80211_is_atim(fc))
-                        title = "ATIM";
-                else if (ieee80211_is_auth(fc))
-                        title = "Auth";
-                else if (ieee80211_is_deauth(fc))
-                        title = "DeAuth";
-                else if (ieee80211_is_disassoc(fc))
-                        title = "DisAssoc";
-                else
-                        title = "Frame";
-
-                rate = iwl4965_rate_index_from_plcp(rate_sym);
-                if (rate == -1)
-                        rate = 0;
-                else
-                        rate = iwl4965_rates[rate].ieee / 2;
-
-                /* print frame summary.
-                 * MAC addresses show just the last byte (for brevity),
-                 *    but you can hack it to show more, if you'd like to. */
-                if (dataframe)
-                        IWL_DEBUG_RX("%s: mhd=0x%04x, dst=0x%02x, "
-                                     "len=%u, rssi=%d, chnl=%d, rate=%u, \n",
-                                     title, fc, header->addr1[5],
-                                     length, rssi, channel, rate);
-                else {
-                        /* src/dst addresses assume managed mode */
-                        IWL_DEBUG_RX("%s: 0x%04x, dst=0x%02x, "
-                                     "src=0x%02x, rssi=%u, tim=%lu usec, "
-                                     "phy=0x%02x, chnl=%d\n",
-                                     title, fc, header->addr1[5],
-                                     header->addr3[5], rssi,
-                                     tsf_low - priv->scan_start_tsf,
-                                     phy_flags, channel);
-                }
-        }
-        if (print_dump)
-                iwl4965_print_hex_dump(IWL_DL_RX, data, length);
-}
-#endif
 
 static void iwl4965_unset_hw_setting(struct iwl4965_priv *priv)
 {
@@ -3088,7 +2878,7 @@ static int iwl4965_tx_skb(struct iwl4965_priv *priv,
         iwl4965_tx_queue_update_wr_ptr(priv, txq, len);
 
         /* Tell device the write index *just past* this latest filled TFD */
-        q->write_ptr = iwl4965_queue_inc_wrap(q->write_ptr, q->n_bd);
+        q->write_ptr = iwl_queue_inc_wrap(q->write_ptr, q->n_bd);
         rc = iwl4965_tx_queue_update_write_ptr(priv, txq);
         spin_unlock_irqrestore(&priv->lock, flags);
 
@@ -3482,9 +3272,9 @@ int iwl4965_tx_queue_reclaim(struct iwl4965_priv *priv, int txq_id, int index)
                 return 0;
         }
 
-        for (index = iwl4965_queue_inc_wrap(index, q->n_bd);
+        for (index = iwl_queue_inc_wrap(index, q->n_bd);
                 q->read_ptr != index;
-                q->read_ptr = iwl4965_queue_inc_wrap(q->read_ptr, q->n_bd)) {
+                q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
                 if (txq_id != IWL_CMD_QUEUE_NUM) {
                         iwl4965_txstatus_to_ieee(priv,
                                         &(txq->txb[txq->q.read_ptr]));
@@ -3591,9 +3381,9 @@ static int iwl4965_tx_status_reply_tx(struct iwl4965_priv *priv,
                 tx_status->control.flags &= ~IEEE80211_TXCTL_AMPDU;
                 tx_status->flags = iwl4965_is_tx_success(status)?
                         IEEE80211_TX_STATUS_ACK : 0;
-                /* FIXME Wrong Rate
-                tx_status->control.tx_rate =
-                                iwl4965_hw_get_rate_n_flags(tx_resp->rate_n_flags); */
+                iwl4965_hwrate_to_tx_control(priv,
+                                             le32_to_cpu(tx_resp->rate_n_flags),
+                                             &tx_status->control);
                 /* FIXME: code repetition end */
 
                 IWL_DEBUG_TX_REPLY("1 Frame 0x%x failure :%d\n",
@@ -3729,7 +3519,7 @@ static void iwl4965_rx_reply_tx(struct iwl4965_priv *priv,
 
                 if (txq->q.read_ptr != (scd_ssn & 0xff)) {
                         int freed;
-                        index = iwl4965_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
+                        index = iwl_queue_dec_wrap(scd_ssn & 0xff, txq->q.n_bd);
                         IWL_DEBUG_TX_REPLY("Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl4965_tx_queue_reclaim(priv, txq_id, index);
@@ -3750,9 +3540,10 @@ static void iwl4965_rx_reply_tx(struct iwl4965_priv *priv,
         tx_status->queue_number = status;
         tx_status->queue_length = tx_resp->bt_kill_count;
         tx_status->queue_length |= tx_resp->failure_rts;
-
         tx_status->flags =
             iwl4965_is_tx_success(status) ? IEEE80211_TX_STATUS_ACK : 0;
+        iwl4965_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
+                                     &tx_status->control);
 
         IWL_DEBUG_TX("Tx queue %d Status %s (0x%08x) rate_n_flags 0x%x "
                      "retries %d\n", txq_id, iwl4965_get_tx_fail_reason(status),
@@ -4886,8 +4677,7 @@ static void iwl4965_dump_nic_error_log(struct iwl4965_priv *priv)
 
         if (ERROR_START_OFFSET <= count * ERROR_ELEM_SIZE) {
                 IWL_ERROR("Start IWL Error Log Dump:\n");
-                IWL_ERROR("Status: 0x%08lX, Config: %08X count: %d\n",
-                          priv->status, priv->config, count);
+                IWL_ERROR("Status: 0x%08lX, count: %d\n", priv->status, count);
         }
 
         desc = iwl4965_read_targ_mem(priv, base + 1 * sizeof(u32));
@@ -5099,9 +4889,9 @@ static void iwl4965_irq_tasklet(struct iwl4965_priv *priv)
          * atomic, make sure that inta covers all the interrupts that
          * we've discovered, even if FH interrupt came in just after
          * reading CSR_INT. */
-        if (inta_fh & CSR_FH_INT_RX_MASK)
+        if (inta_fh & CSR49_FH_INT_RX_MASK)
                 inta |= CSR_INT_BIT_FH_RX;
-        if (inta_fh & CSR_FH_INT_TX_MASK)
+        if (inta_fh & CSR49_FH_INT_TX_MASK)
                 inta |= CSR_INT_BIT_FH_TX;
 
         /* Now service all interrupt bits discovered above. */
@@ -5502,11 +5292,12 @@ static int iwl4965_init_channel_map(struct iwl4965_priv *priv)
                         ch_info->scan_power = eeprom_ch_info[ch].max_power_avg;
                         ch_info->min_power = 0;
 
-                        IWL_DEBUG_INFO("Ch. %d [%sGHz] %s%s%s%s%s%s(0x%02x"
+                        IWL_DEBUG_INFO("Ch. %d [%sGHz] %s%s%s%s%s%s%s(0x%02x"
                                        " %ddBm): Ad-Hoc %ssupported\n",
                                        ch_info->channel,
                                        is_channel_a_band(ch_info) ?
                                        "5.2" : "2.4",
+                                       CHECK_AND_PRINT(VALID),
                                        CHECK_AND_PRINT(IBSS),
                                        CHECK_AND_PRINT(ACTIVE),
                                        CHECK_AND_PRINT(RADAR),
@@ -5749,7 +5540,7 @@ static void iwl4965_init_hw_rates(struct iwl4965_priv *priv,
 static int iwl4965_init_geos(struct iwl4965_priv *priv)
 {
         struct iwl4965_channel_info *ch;
-        struct ieee80211_supported_band *band;
+        struct ieee80211_supported_band *sband;
         struct ieee80211_channel *channels;
         struct ieee80211_channel *geo_ch;
         struct ieee80211_rate *rates;
@@ -5767,7 +5558,7 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
         if (!channels)
                 return -ENOMEM;
 
-        rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_MAX_RATES + 1)),
+        rates = kzalloc((sizeof(struct ieee80211_rate) * (IWL_RATE_COUNT + 1)),
                         GFP_KERNEL);
         if (!rates) {
                 kfree(channels);
@@ -5775,42 +5566,42 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
         }
 
         /* 5.2GHz channels start after the 2.4GHz channels */
-        band = &priv->bands[IEEE80211_BAND_5GHZ];
-        band->channels = &channels[ARRAY_SIZE(iwl4965_eeprom_band_1)];
-        band->bitrates = &rates[4];
-        band->n_bitrates = 8;   /* just OFDM */
+        sband = &priv->bands[IEEE80211_BAND_5GHZ];
+        sband->channels = &channels[ARRAY_SIZE(iwl4965_eeprom_band_1)];
+        /* just OFDM */
+        sband->bitrates = &rates[IWL_FIRST_OFDM_RATE];
+        sband->n_bitrates = IWL_RATE_COUNT - IWL_FIRST_OFDM_RATE;
 
-        iwl4965_init_ht_hw_capab(&band->ht_info, IEEE80211_BAND_5GHZ);
+        iwl4965_init_ht_hw_capab(&sband->ht_info, IEEE80211_BAND_5GHZ);
 
-        band = &priv->bands[IEEE80211_BAND_2GHZ];
-        band->channels = channels;
-        band->bitrates = rates;
-        band->n_bitrates = 12;  /* OFDM & CCK */
+        sband = &priv->bands[IEEE80211_BAND_2GHZ];
+        sband->channels = channels;
+        /* OFDM & CCK */
+        sband->bitrates = rates;
+        sband->n_bitrates = IWL_RATE_COUNT;
 
-        iwl4965_init_ht_hw_capab(&band->ht_info, IEEE80211_BAND_2GHZ);
+        iwl4965_init_ht_hw_capab(&sband->ht_info, IEEE80211_BAND_2GHZ);
 
         priv->ieee_channels = channels;
         priv->ieee_rates = rates;
 
         iwl4965_init_hw_rates(priv, rates);
 
-        for (i = 0, geo_ch = channels; i < priv->channel_count; i++) {
+        for (i = 0;  i < priv->channel_count; i++) {
                 ch = &priv->channel_info[i];
 
-                if (!is_channel_valid(ch)) {
-                        IWL_DEBUG_INFO("Channel %d [%sGHz] is restricted -- "
-                                    "skipping.\n",
-                                    ch->channel, is_channel_a_band(ch) ?
-                                    "5.2" : "2.4");
+                /* FIXME: might be removed if scan is OK */
+                if (!is_channel_valid(ch))
                         continue;
-                }
 
-                if (is_channel_a_band(ch)) {
-                        geo_ch = &priv->bands[IEEE80211_BAND_5GHZ].channels[priv->bands[IEEE80211_BAND_5GHZ].n_channels++];
-                } else
-                        geo_ch = &priv->bands[IEEE80211_BAND_2GHZ].channels[priv->bands[IEEE80211_BAND_2GHZ].n_channels++];
+                if (is_channel_a_band(ch))
+                        sband =  &priv->bands[IEEE80211_BAND_5GHZ];
+                else
+                        sband =  &priv->bands[IEEE80211_BAND_2GHZ];
+
+                geo_ch = &sband->channels[sband->n_channels++];
 
-                geo_ch->center_freq = ieee80211chan2mhz(ch->channel);
+                geo_ch->center_freq = ieee80211_channel_to_frequency(ch->channel);
                 geo_ch->max_power = ch->max_power_avg;
                 geo_ch->max_antenna_gain = 0xff;
                 geo_ch->hw_value = ch->channel;
@@ -5828,16 +5619,28 @@ static int iwl4965_init_geos(struct iwl4965_priv *priv)
                         if (ch->max_power_avg > priv->max_channel_txpower_limit)
                                 priv->max_channel_txpower_limit =
                                     ch->max_power_avg;
-                } else
+                } else {
                         geo_ch->flags |= IEEE80211_CHAN_DISABLED;
+                }
+
+                /* Save flags for reg domain usage */
+                geo_ch->orig_flags = geo_ch->flags;
+
+                IWL_DEBUG_INFO("Channel %d Freq=%d[%sGHz] %s flag=0%X\n",
+                                ch->channel, geo_ch->center_freq,
+                                is_channel_a_band(ch) ?  "5.2" : "2.4",
+                                geo_ch->flags & IEEE80211_CHAN_DISABLED ?
+                                "restricted" : "valid",
+                                 geo_ch->flags);
         }
 
-        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) && priv->is_abg) {
+        if ((priv->bands[IEEE80211_BAND_5GHZ].n_channels == 0) &&
+             priv->cfg->sku & IWL_SKU_A) {
                 printk(KERN_INFO DRV_NAME
                        ": Incorrectly detected BG card as ABG.  Please send "
                        "your PCI ID 0x%04X:0x%04X to maintainer.\n",
                        priv->pci_dev->device, priv->pci_dev->subsystem_device);
-                priv->is_abg = 0;
+                priv->cfg->sku &= ~IWL_SKU_A;
         }
 
         printk(KERN_INFO DRV_NAME
@@ -6186,7 +5989,7 @@ static int iwl4965_read_ucode(struct iwl4965_priv *priv)
         struct iwl4965_ucode *ucode;
         int ret;
         const struct firmware *ucode_raw;
-        const char *name = "iwlwifi-4965" IWL4965_UCODE_API ".ucode";
+        const char *name = priv->cfg->fw_name;
         u8 *src;
         size_t len;
         u32 ver, inst_size, data_size, init_size, init_data_size, boot_size;
@@ -7596,6 +7399,12 @@ static int iwl4965_mac_config_interface(struct ieee80211_hw *hw,
         if (conf == NULL)
                 return -EIO;
 
+        if (priv->vif != vif) {
+                IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
+                mutex_unlock(&priv->mutex);
+                return 0;
+        }
+
         if ((priv->iw_mode == IEEE80211_IF_TYPE_AP) &&
             (!conf->beacon || !conf->ssid_len)) {
                 IWL_DEBUG_MAC80211
@@ -7618,17 +7427,6 @@ static int iwl4965_mac_config_interface(struct ieee80211_hw *hw,
         if (unlikely(test_bit(STATUS_SCANNING, &priv->status)) &&
             !(priv->hw->flags & IEEE80211_HW_NO_PROBE_FILTERING)) {
  */
-        if (unlikely(test_bit(STATUS_SCANNING, &priv->status))) {
-                IWL_DEBUG_MAC80211("leave - scanning\n");
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
-
-        if (priv->vif != vif) {
-                IWL_DEBUG_MAC80211("leave - priv->vif != vif\n");
-                mutex_unlock(&priv->mutex);
-                return 0;
-        }
 
         if (priv->iw_mode == IEEE80211_IF_TYPE_AP) {
                 if (!conf->bssid) {
@@ -8127,15 +7925,21 @@ static void iwl4965_ht_info_fill(struct ieee80211_conf *conf,
         iwl_conf->is_green_field = !!(ht_conf->cap & IEEE80211_HT_CAP_GRN_FLD);
         iwl_conf->max_amsdu_size =
                 !!(ht_conf->cap & IEEE80211_HT_CAP_MAX_AMSDU);
+
         iwl_conf->supported_chan_width =
                 !!(ht_conf->cap & IEEE80211_HT_CAP_SUP_WIDTH);
+        iwl_conf->extension_chan_offset =
+                ht_bss_conf->bss_cap & IEEE80211_HT_IE_CHA_SEC_OFFSET;
+        /* If no above or below channel supplied disable FAT channel */
+        if (iwl_conf->extension_chan_offset != IWL_EXT_CHANNEL_OFFSET_ABOVE &&
+            iwl_conf->extension_chan_offset != IWL_EXT_CHANNEL_OFFSET_BELOW)
+                iwl_conf->supported_chan_width = 0;
+
         iwl_conf->tx_mimo_ps_mode =
                 (u8)((ht_conf->cap & IEEE80211_HT_CAP_MIMO_PS) >> 2);
         memcpy(iwl_conf->supp_mcs_set, ht_conf->supp_mcs_set, 16);
 
         iwl_conf->control_channel = ht_bss_conf->primary_channel;
-        iwl_conf->extension_chan_offset =
-                ht_bss_conf->bss_cap & IEEE80211_HT_IE_CHA_SEC_OFFSET;
         iwl_conf->tx_chan_width =
                 !!(ht_bss_conf->bss_cap & IEEE80211_HT_IE_CHA_WIDTH);
         iwl_conf->ht_protection =
@@ -8776,6 +8580,7 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         int err = 0;
         struct iwl4965_priv *priv;
         struct ieee80211_hw *hw;
+        struct iwl_cfg *cfg = (struct iwl_cfg *)(ent->driver_data);
         int i;
         DECLARE_MAC_BUF(mac);
 
@@ -8809,6 +8614,7 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
         priv = hw->priv;
         priv->hw = hw;
+        priv->cfg = cfg;
 
         priv->pci_dev = pdev;
         priv->antenna = (enum iwl4965_antenna)iwl4965_param_antenna;
@@ -8911,8 +8717,9 @@ static int iwl4965_pci_probe(struct pci_dev *pdev, const struct pci_device_id *e
         /* Choose which receivers/antennas to use */
         iwl4965_set_rxon_chain(priv);
 
+
         printk(KERN_INFO DRV_NAME
-               ": Detected Intel Wireless WiFi Link 4965AGN\n");
+                ": Detected Intel Wireless WiFi Link %s\n", priv->cfg->name);
 
         /* Device-specific setup */
         if (iwl4965_hw_set_hw_setting(priv)) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index 75f6191e718d..7fe37bedf313 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -349,11 +349,7 @@ static int assoc_helper_wpa_keys(struct lbs_private *priv,
 
         if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
                 clear_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags);
-                ret = lbs_prepare_and_send_command(priv,
-                                        CMD_802_11_KEY_MATERIAL,
-                                        CMD_ACT_SET,
-                                        CMD_OPTION_WAITFORRSP,
-                                        0, assoc_req);
+                ret = lbs_cmd_802_11_key_material(priv, CMD_ACT_SET, assoc_req);
                 assoc_req->flags = flags;
         }
 
@@ -363,11 +359,7 @@ static int assoc_helper_wpa_keys(struct lbs_private *priv,
         if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags)) {
                 clear_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags);
 
-                ret = lbs_prepare_and_send_command(priv,
-                                        CMD_802_11_KEY_MATERIAL,
-                                        CMD_ACT_SET,
-                                        CMD_OPTION_WAITFORRSP,
-                                        0, assoc_req);
+                ret = lbs_cmd_802_11_key_material(priv, CMD_ACT_SET, assoc_req);
                 assoc_req->flags = flags;
         }
 
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 3f9074df91e4..445c6dc09786 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -338,75 +338,103 @@ int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
         return ret;
 }
 
-static void set_one_wpa_key(struct MrvlIEtype_keyParamSet * pkeyparamset,
-                            struct enc_key * pkey)
+static void set_one_wpa_key(struct MrvlIEtype_keyParamSet *keyparam,
+                            struct enc_key *key)
 {
         lbs_deb_enter(LBS_DEB_CMD);
 
-        if (pkey->flags & KEY_INFO_WPA_ENABLED) {
-                pkeyparamset->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
-        }
-        if (pkey->flags & KEY_INFO_WPA_UNICAST) {
-                pkeyparamset->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
-        }
-        if (pkey->flags & KEY_INFO_WPA_MCAST) {
-                pkeyparamset->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
-        }
+        if (key->flags & KEY_INFO_WPA_ENABLED)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_ENABLED);
+        if (key->flags & KEY_INFO_WPA_UNICAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_UNICAST);
+        if (key->flags & KEY_INFO_WPA_MCAST)
+                keyparam->keyinfo |= cpu_to_le16(KEY_INFO_WPA_MCAST);
+
+        keyparam->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
+        keyparam->keytypeid = cpu_to_le16(key->type);
+        keyparam->keylen = cpu_to_le16(key->len);
+        memcpy(keyparam->key, key->key, key->len);
 
-        pkeyparamset->type = cpu_to_le16(TLV_TYPE_KEY_MATERIAL);
-        pkeyparamset->keytypeid = cpu_to_le16(pkey->type);
-        pkeyparamset->keylen = cpu_to_le16(pkey->len);
-        memcpy(pkeyparamset->key, pkey->key, pkey->len);
-        pkeyparamset->length = cpu_to_le16(  sizeof(pkeyparamset->keytypeid)
-                                                + sizeof(pkeyparamset->keyinfo)
-                                                + sizeof(pkeyparamset->keylen)
-                                                + sizeof(pkeyparamset->key));
+        /* Length field doesn't include the {type,length} header */
+        keyparam->length = cpu_to_le16(sizeof(*keyparam) - 4);
         lbs_deb_leave(LBS_DEB_CMD);
 }
 
-static int lbs_cmd_802_11_key_material(struct lbs_private *priv,
-                                        struct cmd_ds_command *cmd,
-                                        u16 cmd_action,
-                                        u32 cmd_oid, void *pdata_buf)
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc)
 {
-        struct cmd_ds_802_11_key_material *pkeymaterial =
-            &cmd->params.keymaterial;
-        struct assoc_request * assoc_req = pdata_buf;
+        struct cmd_ds_802_11_key_material cmd;
         int ret = 0;
         int index = 0;
 
         lbs_deb_enter(LBS_DEB_CMD);
 
-        cmd->command = cpu_to_le16(CMD_802_11_KEY_MATERIAL);
-        pkeymaterial->action = cpu_to_le16(cmd_action);
+        cmd.action = cpu_to_le16(cmd_action);
+        cmd.hdr.size = cpu_to_le16(sizeof(cmd));
 
         if (cmd_action == CMD_ACT_GET) {
-                cmd->size = cpu_to_le16(S_DS_GEN + sizeof (pkeymaterial->action));
-                ret = 0;
-                goto done;
-        }
+                cmd.hdr.size = cpu_to_le16(S_DS_GEN + 2);
+        } else {
+                memset(cmd.keyParamSet, 0, sizeof(cmd.keyParamSet));
 
-        memset(&pkeymaterial->keyParamSet, 0, sizeof(pkeymaterial->keyParamSet));
+                if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_unicast_key);
+                        index++;
+                }
 
-        if (test_bit(ASSOC_FLAG_WPA_UCAST_KEY, &assoc_req->flags)) {
-                set_one_wpa_key(&pkeymaterial->keyParamSet[index],
-                                &assoc_req->wpa_unicast_key);
-                index++;
-        }
+                if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc->flags)) {
+                        set_one_wpa_key(&cmd.keyParamSet[index],
+                                        &assoc->wpa_mcast_key);
+                        index++;
+                }
 
-        if (test_bit(ASSOC_FLAG_WPA_MCAST_KEY, &assoc_req->flags)) {
-                set_one_wpa_key(&pkeymaterial->keyParamSet[index],
-                                &assoc_req->wpa_mcast_key);
-                index++;
+                /* The common header and as many keys as we included */
+                cmd.hdr.size = cpu_to_le16(offsetof(typeof(cmd),
+                                                    keyParamSet[index]));
         }
+        ret = lbs_cmd_with_response(priv, CMD_802_11_KEY_MATERIAL, &cmd);
+        /* Copy the returned key to driver private data */
+        if (!ret && cmd_action == CMD_ACT_GET) {
+                void *buf_ptr = cmd.keyParamSet;
+                void *resp_end = &(&cmd)[1];
+
+                while (buf_ptr < resp_end) {
+                        struct MrvlIEtype_keyParamSet *keyparam = buf_ptr;
+                        struct enc_key *key;
+                        uint16_t param_set_len = le16_to_cpu(keyparam->length);
+                        uint16_t key_len = le16_to_cpu(keyparam->keylen);
+                        uint16_t key_flags = le16_to_cpu(keyparam->keyinfo);
+                        uint16_t key_type = le16_to_cpu(keyparam->keytypeid);
+                        void *end;
+
+                        end = (void *)keyparam + sizeof(keyparam->type)
+                                + sizeof(keyparam->length) + param_set_len;
+
+                        /* Make sure we don't access past the end of the IEs */
+                        if (end > resp_end)
+                                break;
 
-        cmd->size = cpu_to_le16(  S_DS_GEN
-                                + sizeof (pkeymaterial->action)
-                                + (index * sizeof(struct MrvlIEtype_keyParamSet)));
+                        if (key_flags & KEY_INFO_WPA_UNICAST)
+                                key = &priv->wpa_unicast_key;
+                        else if (key_flags & KEY_INFO_WPA_MCAST)
+                                key = &priv->wpa_mcast_key;
+                        else
+                                break;
 
-        ret = 0;
+                        /* Copy returned key into driver */
+                        memset(key, 0, sizeof(struct enc_key));
+                        if (key_len > sizeof(key->key))
+                                break;
+                        key->type = key_type;
+                        key->flags = key_flags;
+                        key->len = key_len;
+                        memcpy(key->key, keyparam->key, key->len);
+
+                        buf_ptr = end + 1;
+                }
+        }
 
-done:
         lbs_deb_leave_args(LBS_DEB_CMD, "ret %d", ret);
         return ret;
 }
@@ -1354,10 +1382,6 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = lbs_cmd_802_11_ps_mode(priv, cmdptr, cmd_action);
                 break;
 
-        case CMD_802_11_SCAN:
-                ret = lbs_cmd_80211_scan(priv, cmdptr, pdata_buf);
-                break;
-
         case CMD_MAC_CONTROL:
                 ret = lbs_cmd_mac_control(priv, cmdptr);
                 break;
@@ -1435,11 +1459,6 @@ int lbs_prepare_and_send_command(struct lbs_private *priv,
                 ret = lbs_cmd_80211_ad_hoc_stop(priv, cmdptr);
                 break;
 
-        case CMD_802_11_KEY_MATERIAL:
-                ret = lbs_cmd_802_11_key_material(priv, cmdptr, cmd_action,
-                                cmd_oid, pdata_buf);
-                break;
-
         case CMD_802_11_PAIRWISE_TSC:
                 break;
         case CMD_802_11_GROUP_TSC:
diff --git a/drivers/net/wireless/libertas/cmd.h b/drivers/net/wireless/libertas/cmd.h
index b9ab85cc7913..d250e6bc0609 100644
--- a/drivers/net/wireless/libertas/cmd.h
+++ b/drivers/net/wireless/libertas/cmd.h
@@ -57,5 +57,7 @@ int lbs_cmd_802_11_set_wep(struct lbs_private *priv, uint16_t cmd_action,
                            struct assoc_request *assoc);
 int lbs_cmd_802_11_enable_rsn(struct lbs_private *priv, uint16_t cmd_action,
                               uint16_t *enable);
+int lbs_cmd_802_11_key_material(struct lbs_private *priv, uint16_t cmd_action,
+                                struct assoc_request *assoc);
 
 #endif /* _LBS_CMD_H */
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 5d90b83f28eb..15e4ebdcd477 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -204,61 +204,6 @@ static int lbs_ret_802_11_snmp_mib(struct lbs_private *priv,
         return 0;
 }
 
-static int lbs_ret_802_11_key_material(struct lbs_private *priv,
-                                        struct cmd_ds_command *resp)
-{
-        struct cmd_ds_802_11_key_material *pkeymaterial =
-            &resp->params.keymaterial;
-        u16 action = le16_to_cpu(pkeymaterial->action);
-
-        lbs_deb_enter(LBS_DEB_CMD);
-
-        /* Copy the returned key to driver private data */
-        if (action == CMD_ACT_GET) {
-                u8 * buf_ptr = (u8 *) &pkeymaterial->keyParamSet;
-                u8 * resp_end = (u8 *) (resp + le16_to_cpu(resp->size));
-
-                while (buf_ptr < resp_end) {
-                        struct MrvlIEtype_keyParamSet * pkeyparamset =
-                            (struct MrvlIEtype_keyParamSet *) buf_ptr;
-                        struct enc_key * pkey;
-                        u16 param_set_len = le16_to_cpu(pkeyparamset->length);
-                        u16 key_len = le16_to_cpu(pkeyparamset->keylen);
-                        u16 key_flags = le16_to_cpu(pkeyparamset->keyinfo);
-                        u16 key_type = le16_to_cpu(pkeyparamset->keytypeid);
-                        u8 * end;
-
-                        end = (u8 *) pkeyparamset + sizeof (pkeyparamset->type)
-                                                  + sizeof (pkeyparamset->length)
-                                                  + param_set_len;
-                        /* Make sure we don't access past the end of the IEs */
-                        if (end > resp_end)
-                                break;
-
-                        if (key_flags & KEY_INFO_WPA_UNICAST)
-                                pkey = &priv->wpa_unicast_key;
-                        else if (key_flags & KEY_INFO_WPA_MCAST)
-                                pkey = &priv->wpa_mcast_key;
-                        else
-                                break;
-
-                        /* Copy returned key into driver */
-                        memset(pkey, 0, sizeof(struct enc_key));
-                        if (key_len > sizeof(pkey->key))
-                                break;
-                        pkey->type = key_type;
-                        pkey->flags = key_flags;
-                        pkey->len = key_len;
-                        memcpy(pkey->key, pkeyparamset->key, pkey->len);
-
-                        buf_ptr = end + 1;
-                }
-        }
-
-        lbs_deb_enter(LBS_DEB_CMD);
-        return 0;
-}
-
 static int lbs_ret_802_11_mac_address(struct lbs_private *priv,
                                        struct cmd_ds_command *resp)
 {
@@ -407,10 +352,6 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_reg_access(priv, respcmd, resp);
                 break;
 
-        case CMD_RET(CMD_802_11_SCAN):
-                ret = lbs_ret_80211_scan(priv, resp);
-                break;
-
         case CMD_RET(CMD_802_11_GET_LOG):
                 ret = lbs_ret_get_log(priv, resp);
                 break;
@@ -475,10 +416,6 @@ static inline int handle_cmd_response(struct lbs_private *priv,
                 ret = lbs_ret_80211_ad_hoc_stop(priv, resp);
                 break;
 
-        case CMD_RET(CMD_802_11_KEY_MATERIAL):
-                ret = lbs_ret_802_11_key_material(priv, resp);
-                break;
-
         case CMD_RET(CMD_802_11_EEPROM_ACCESS):
                 ret = lbs_ret_802_11_eeprom_access(priv, resp);
                 break;
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index d35b015b6657..56bc1aa2bb00 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -174,9 +174,11 @@ struct cmd_ds_802_11_subscribe_event {
  * Define data structure for CMD_802_11_SCAN
  */
 struct cmd_ds_802_11_scan {
-        u8 bsstype;
-        u8 bssid[ETH_ALEN];
-        u8 tlvbuffer[1];
+        struct cmd_header hdr;
+
+        uint8_t bsstype;
+        uint8_t bssid[ETH_ALEN];
+        uint8_t tlvbuffer[0];
 #if 0
         mrvlietypes_ssidparamset_t ssidParamSet;
         mrvlietypes_chanlistparamset_t ChanListParamSet;
@@ -185,9 +187,11 @@ struct cmd_ds_802_11_scan {
 };
 
 struct cmd_ds_802_11_scan_rsp {
+        struct cmd_header hdr;
+
         __le16 bssdescriptsize;
-        u8 nr_sets;
-        u8 bssdesc_and_tlvbuffer[1];
+        uint8_t nr_sets;
+        uint8_t bssdesc_and_tlvbuffer[0];
 };
 
 struct cmd_ds_802_11_get_log {
@@ -572,6 +576,8 @@ struct cmd_ds_host_sleep {
 } __attribute__ ((packed));
 
 struct cmd_ds_802_11_key_material {
+        struct cmd_header hdr;
+
         __le16 action;
         struct MrvlIEtype_keyParamSet keyParamSet[2];
 } __attribute__ ((packed));
@@ -689,8 +695,6 @@ struct cmd_ds_command {
         /* command Body */
         union {
                 struct cmd_ds_802_11_ps_mode psmode;
-                struct cmd_ds_802_11_scan scan;
-                struct cmd_ds_802_11_scan_rsp scanresp;
                 struct cmd_ds_mac_control macctrl;
                 struct cmd_ds_802_11_associate associate;
                 struct cmd_ds_802_11_deauthenticate deauth;
@@ -712,7 +716,6 @@ struct cmd_ds_command {
                 struct cmd_ds_802_11_rssi_rsp rssirsp;
                 struct cmd_ds_802_11_disassociate dassociate;
                 struct cmd_ds_802_11_mac_address macadd;
-                struct cmd_ds_802_11_key_material keymaterial;
                 struct cmd_ds_mac_reg_access macreg;
                 struct cmd_ds_bbp_reg_access bbpreg;
                 struct cmd_ds_rf_reg_access rfreg;
diff --git a/drivers/net/wireless/libertas/scan.c b/drivers/net/wireless/libertas/scan.c
index 7d4f3afa8cc5..99f11a56d84e 100644
--- a/drivers/net/wireless/libertas/scan.c
+++ b/drivers/net/wireless/libertas/scan.c
@@ -20,6 +20,7 @@
 #include "dev.h"
 #include "scan.h"
 #include "join.h"
+#include "cmd.h"
 
 //! Approximate amount of data needed to pass a scan result back to iwlist
 #define MAX_SCAN_CELL_SIZE  (IW_EV_ADDR_LEN             \
@@ -39,10 +40,9 @@
 //! Memory needed to store a max number/size SSID TLV for a firmware scan
 #define SSID_TLV_MAX_SIZE  (1 * sizeof(struct mrvlietypes_ssidparamset))
 
-//! Maximum memory needed for a lbs_scan_cmd_config with all TLVs at max
-#define MAX_SCAN_CFG_ALLOC (sizeof(struct lbs_scan_cmd_config)  \
-                            + CHAN_TLV_MAX_SIZE                 \
-                            + SSID_TLV_MAX_SIZE)
+//! Maximum memory needed for a cmd_ds_802_11_scan with all TLVs at max
+#define MAX_SCAN_CFG_ALLOC (sizeof(struct cmd_ds_802_11_scan)   \
+                            + CHAN_TLV_MAX_SIZE + SSID_TLV_MAX_SIZE)
 
 //! The maximum number of channels the firmware can scan per command
 #define MRVDRV_MAX_CHANNELS_PER_SCAN   14
@@ -61,11 +61,8 @@
 //! Scan time specified in the channel TLV for each channel for active scans
 #define MRVDRV_ACTIVE_SCAN_CHAN_TIME   100
 
-static const u8 zeromac[ETH_ALEN] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
-static const u8 bcastmac[ETH_ALEN] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-
-
-
+static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
+                              struct cmd_header *resp);
 
 /*********************************************************************/
 /*                                                                   */
@@ -90,7 +87,7 @@ static void lbs_unset_basic_rate_flags(u8 *rates, size_t len)
 }
 
 
-static inline void clear_bss_descriptor (struct bss_descriptor * bss)
+static inline void clear_bss_descriptor(struct bss_descriptor *bss)
 {
         /* Don't blow away ->list, just BSS data */
         memset(bss, 0, offsetof(struct bss_descriptor, list));
@@ -104,7 +101,8 @@ static inline void clear_bss_descriptor (struct bss_descriptor * bss)
  *
  *  @return         0: ssid is same, otherwise is different
  */
-int lbs_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len)
+int lbs_ssid_cmp(uint8_t *ssid1, uint8_t ssid1_len, uint8_t *ssid2,
+                 uint8_t ssid2_len)
 {
         if (ssid1_len != ssid2_len)
                 return -1;
@@ -113,73 +111,66 @@ int lbs_ssid_cmp(u8 *ssid1, u8 ssid1_len, u8 *ssid2, u8 ssid2_len)
 }
 
 static inline int match_bss_no_security(struct lbs_802_11_security *secinfo,
-                        struct bss_descriptor * match_bss)
+                                        struct bss_descriptor *match_bss)
 {
-        if (   !secinfo->wep_enabled
-            && !secinfo->WPAenabled
+        if (!secinfo->wep_enabled  && !secinfo->WPAenabled
             && !secinfo->WPA2enabled
             && match_bss->wpa_ie[0] != MFIE_TYPE_GENERIC
             && match_bss->rsn_ie[0] != MFIE_TYPE_RSN
-            && !(match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
+            && !(match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
-        }
-        return 0;
+        else
+                return 0;
 }
 
 static inline int match_bss_static_wep(struct lbs_802_11_security *secinfo,
-                        struct bss_descriptor * match_bss)
+                                       struct bss_descriptor *match_bss)
 {
-        if ( secinfo->wep_enabled
-           && !secinfo->WPAenabled
-           && !secinfo->WPA2enabled
-           && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
+        if (secinfo->wep_enabled && !secinfo->WPAenabled
+            && !secinfo->WPA2enabled
+            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
-        }
-        return 0;
+        else
+                return 0;
 }
 
 static inline int match_bss_wpa(struct lbs_802_11_security *secinfo,
-                        struct bss_descriptor * match_bss)
+                                struct bss_descriptor *match_bss)
 {
-        if (  !secinfo->wep_enabled
-           && secinfo->WPAenabled
-           && (match_bss->wpa_ie[0] == MFIE_TYPE_GENERIC)
-           /* privacy bit may NOT be set in some APs like LinkSys WRT54G
-              && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
-            */
-           ) {
+        if (!secinfo->wep_enabled && secinfo->WPAenabled
+            && (match_bss->wpa_ie[0] == MFIE_TYPE_GENERIC)
+            /* privacy bit may NOT be set in some APs like LinkSys WRT54G
+            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY) */
+           )
                 return 1;
-        }
-        return 0;
+        else
+                return 0;
 }
 
 static inline int match_bss_wpa2(struct lbs_802_11_security *secinfo,
-                        struct bss_descriptor * match_bss)
+                                 struct bss_descriptor *match_bss)
 {
-        if (  !secinfo->wep_enabled
-           && secinfo->WPA2enabled
-           && (match_bss->rsn_ie[0] == MFIE_TYPE_RSN)
-           /* privacy bit may NOT be set in some APs like LinkSys WRT54G
-              && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
-            */
-           ) {
+        if (!secinfo->wep_enabled && secinfo->WPA2enabled
+            && (match_bss->rsn_ie[0] == MFIE_TYPE_RSN)
+            /* privacy bit may NOT be set in some APs like LinkSys WRT54G
+            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY) */
+           )
                 return 1;
-        }
-        return 0;
+        else
+                return 0;
 }
 
 static inline int match_bss_dynamic_wep(struct lbs_802_11_security *secinfo,
-                        struct bss_descriptor * match_bss)
+                                        struct bss_descriptor *match_bss)
 {
-        if (  !secinfo->wep_enabled
-           && !secinfo->WPAenabled
-           && !secinfo->WPA2enabled
-           && (match_bss->wpa_ie[0] != MFIE_TYPE_GENERIC)
-           && (match_bss->rsn_ie[0] != MFIE_TYPE_RSN)
-           && (match_bss->capability & WLAN_CAPABILITY_PRIVACY)) {
+        if (!secinfo->wep_enabled && !secinfo->WPAenabled
+            && !secinfo->WPA2enabled
+            && (match_bss->wpa_ie[0] != MFIE_TYPE_GENERIC)
+            && (match_bss->rsn_ie[0] != MFIE_TYPE_RSN)
+            && (match_bss->capability & WLAN_CAPABILITY_PRIVACY))
                 return 1;
-        }
-        return 0;
+        else
+                return 0;
 }
 
 static inline int is_same_network(struct bss_descriptor *src,
@@ -214,7 +205,7 @@ static inline int is_same_network(struct bss_descriptor *src,
  *  @return        Index in scantable, or error code if negative
  */
 static int is_network_compatible(struct lbs_private *priv,
-                struct bss_descriptor * bss, u8 mode)
+                                 struct bss_descriptor *bss, uint8_t mode)
 {
         int matched = 0;
 
@@ -228,43 +219,39 @@ static int is_network_compatible(struct lbs_private *priv,
         } else if ((matched = match_bss_static_wep(&priv->secinfo, bss))) {
                 goto done;
         } else if ((matched = match_bss_wpa(&priv->secinfo, bss))) {
-                lbs_deb_scan(
-                       "is_network_compatible() WPA: wpa_ie 0x%x "
-                       "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
-                       "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
-                       priv->secinfo.wep_enabled ? "e" : "d",
-                       priv->secinfo.WPAenabled ? "e" : "d",
-                       priv->secinfo.WPA2enabled ? "e" : "d",
-                       (bss->capability & WLAN_CAPABILITY_PRIVACY));
+                lbs_deb_scan("is_network_compatible() WPA: wpa_ie 0x%x "
+                             "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
+                             "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
+                             priv->secinfo.wep_enabled ? "e" : "d",
+                             priv->secinfo.WPAenabled ? "e" : "d",
+                             priv->secinfo.WPA2enabled ? "e" : "d",
+                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
                 goto done;
         } else if ((matched = match_bss_wpa2(&priv->secinfo, bss))) {
-                lbs_deb_scan(
-                       "is_network_compatible() WPA2: wpa_ie 0x%x "
-                       "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
-                       "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
-                       priv->secinfo.wep_enabled ? "e" : "d",
-                       priv->secinfo.WPAenabled ? "e" : "d",
-                       priv->secinfo.WPA2enabled ? "e" : "d",
-                       (bss->capability & WLAN_CAPABILITY_PRIVACY));
+                lbs_deb_scan("is_network_compatible() WPA2: wpa_ie 0x%x "
+                             "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s "
+                             "privacy 0x%x\n", bss->wpa_ie[0], bss->rsn_ie[0],
+                             priv->secinfo.wep_enabled ? "e" : "d",
+                             priv->secinfo.WPAenabled ? "e" : "d",
+                             priv->secinfo.WPA2enabled ? "e" : "d",
+                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
                 goto done;
         } else if ((matched = match_bss_dynamic_wep(&priv->secinfo, bss))) {
-                lbs_deb_scan(
-                       "is_network_compatible() dynamic WEP: "
-                       "wpa_ie 0x%x wpa2_ie 0x%x privacy 0x%x\n",
-                       bss->wpa_ie[0], bss->rsn_ie[0],
-                       (bss->capability & WLAN_CAPABILITY_PRIVACY));
+                lbs_deb_scan("is_network_compatible() dynamic WEP: "
+                             "wpa_ie 0x%x wpa2_ie 0x%x privacy 0x%x\n",
+                             bss->wpa_ie[0], bss->rsn_ie[0],
+                             (bss->capability & WLAN_CAPABILITY_PRIVACY));
                 goto done;
         }
 
         /* bss security settings don't match those configured on card */
-        lbs_deb_scan(
-               "is_network_compatible() FAILED: wpa_ie 0x%x "
-               "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s privacy 0x%x\n",
-               bss->wpa_ie[0], bss->rsn_ie[0],
-               priv->secinfo.wep_enabled ? "e" : "d",
-               priv->secinfo.WPAenabled ? "e" : "d",
-               priv->secinfo.WPA2enabled ? "e" : "d",
-               (bss->capability & WLAN_CAPABILITY_PRIVACY));
+        lbs_deb_scan("is_network_compatible() FAILED: wpa_ie 0x%x "
+                     "wpa2_ie 0x%x WEP %s WPA %s WPA2 %s privacy 0x%x\n",
+                     bss->wpa_ie[0], bss->rsn_ie[0],
+                     priv->secinfo.wep_enabled ? "e" : "d",
+                     priv->secinfo.WPAenabled ? "e" : "d",
+                     priv->secinfo.WPA2enabled ? "e" : "d",
+                     (bss->capability & WLAN_CAPABILITY_PRIVACY));
 
 done:
         lbs_deb_leave_args(LBS_DEB_SCAN, "matched: %d", matched);
@@ -311,16 +298,15 @@ void lbs_scan_worker(struct work_struct *work)
  *  @return              void
  */
 static int lbs_scan_create_channel_list(struct lbs_private *priv,
-                                          struct chanscanparamset * scanchanlist,
-                                          u8 filteredscan)
+                                        struct chanscanparamset *scanchanlist,
+                                        uint8_t filteredscan)
 {
-
         struct region_channel *scanregion;
         struct chan_freq_power *cfp;
         int rgnidx;
         int chanidx;
         int nextchan;
-        u8 scantype;
+        uint8_t scantype;
 
         chanidx = 0;
 
@@ -331,9 +317,8 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
         scantype = CMD_SCAN_TYPE_ACTIVE;
 
         for (rgnidx = 0; rgnidx < ARRAY_SIZE(priv->region_channel); rgnidx++) {
-                if (priv->enable11d &&
-                    (priv->connect_status != LBS_CONNECTED) &&
-                    (priv->mesh_connect_status != LBS_CONNECTED)) {
+                if (priv->enable11d && (priv->connect_status != LBS_CONNECTED)
+                    && (priv->mesh_connect_status != LBS_CONNECTED)) {
                         /* Scan all the supported chan for the first scan */
                         if (!priv->universal_channel[rgnidx].valid)
                                 continue;
@@ -348,45 +333,30 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
                         scanregion = &priv->region_channel[rgnidx];
                 }
 
-                for (nextchan = 0;
-                     nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
+                for (nextchan = 0; nextchan < scanregion->nrcfp; nextchan++, chanidx++) {
+                        struct chanscanparamset *chan = &scanchanlist[chanidx];
 
                         cfp = scanregion->CFP + nextchan;
 
-                        if (priv->enable11d) {
-                                scantype =
-                                    lbs_get_scan_type_11d(cfp->channel,
-                                                           &priv->
-                                                           parsed_region_chan);
-                        }
+                        if (priv->enable11d)
+                                scantype = lbs_get_scan_type_11d(cfp->channel,
+                                                                 &priv->parsed_region_chan);
 
-                        switch (scanregion->band) {
-                        case BAND_B:
-                        case BAND_G:
-                        default:
-                                scanchanlist[chanidx].radiotype =
-                                    CMD_SCAN_RADIO_TYPE_BG;
-                                break;
-                        }
+                        if (scanregion->band == BAND_B || scanregion->band == BAND_G)
+                                chan->radiotype = CMD_SCAN_RADIO_TYPE_BG;
 
                         if (scantype == CMD_SCAN_TYPE_PASSIVE) {
-                                scanchanlist[chanidx].maxscantime =
-                                    cpu_to_le16(MRVDRV_PASSIVE_SCAN_CHAN_TIME);
-                                scanchanlist[chanidx].chanscanmode.passivescan =
-                                    1;
+                                chan->maxscantime = cpu_to_le16(MRVDRV_PASSIVE_SCAN_CHAN_TIME);
+                                chan->chanscanmode.passivescan = 1;
                         } else {
-                                scanchanlist[chanidx].maxscantime =
-                                    cpu_to_le16(MRVDRV_ACTIVE_SCAN_CHAN_TIME);
-                                scanchanlist[chanidx].chanscanmode.passivescan =
-                                    0;
+                                chan->maxscantime = cpu_to_le16(MRVDRV_ACTIVE_SCAN_CHAN_TIME);
+                                chan->chanscanmode.passivescan = 0;
                         }
 
-                        scanchanlist[chanidx].channumber = cfp->channel;
+                        chan->channumber = cfp->channel;
 
-                        if (filteredscan) {
-                                scanchanlist[chanidx].chanscanmode.
-                                    disablechanfilt = 1;
-                        }
+                        if (filteredscan)
+                                chan->chanscanmode.disablechanfilt = 1;
                 }
         }
         return chanidx;
@@ -400,11 +370,11 @@ static int lbs_scan_create_channel_list(struct lbs_private *priv,
  * length          06 00
  * ssid            4d 4e 54 45 53 54
  */
-static int lbs_scan_add_ssid_tlv(u8 *tlv,
-        const struct lbs_ioctl_user_scan_cfg *user_cfg)
+static int lbs_scan_add_ssid_tlv(uint8_t *tlv,
+                                 const struct lbs_ioctl_user_scan_cfg *user_cfg)
 {
-        struct mrvlietypes_ssidparamset *ssid_tlv =
-                (struct mrvlietypes_ssidparamset *)tlv;
+        struct mrvlietypes_ssidparamset *ssid_tlv = (void *)tlv;
+
         ssid_tlv->header.type = cpu_to_le16(TLV_TYPE_SSID);
         ssid_tlv->header.len = cpu_to_le16(user_cfg->ssid_len);
         memcpy(ssid_tlv->ssid, user_cfg->ssid, user_cfg->ssid_len);
@@ -437,13 +407,12 @@ static int lbs_scan_add_ssid_tlv(u8 *tlv,
  * channel 13      00 0d 00 00 00 64 00
  *
  */
-static int lbs_scan_add_chanlist_tlv(u8 *tlv,
-        struct chanscanparamset *chan_list,
-        int chan_count)
+static int lbs_scan_add_chanlist_tlv(uint8_t *tlv,
+                                     struct chanscanparamset *chan_list,
+                                     int chan_count)
 {
-        size_t size = sizeof(struct chanscanparamset) * chan_count;
-        struct mrvlietypes_chanlistparamset *chan_tlv =
-                (struct mrvlietypes_chanlistparamset *) tlv;
+        size_t size = sizeof(struct chanscanparamset) *chan_count;
+        struct mrvlietypes_chanlistparamset *chan_tlv = (void *)tlv;
 
         chan_tlv->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
         memcpy(chan_tlv->chanscanparam, chan_list, size);
@@ -462,11 +431,10 @@ static int lbs_scan_add_chanlist_tlv(u8 *tlv,
  * The rates are in lbs_bg_rates[], but for the 802.11b
  * rates the high bit isn't set.
  */
-static int lbs_scan_add_rates_tlv(u8 *tlv)
+static int lbs_scan_add_rates_tlv(uint8_t *tlv)
 {
         int i;
-        struct mrvlietypes_ratesparamset *rate_tlv =
-                (struct mrvlietypes_ratesparamset *) tlv;
+        struct mrvlietypes_ratesparamset *rate_tlv = (void *)tlv;
 
         rate_tlv->header.type = cpu_to_le16(TLV_TYPE_RATES);
         tlv += sizeof(rate_tlv->header);
@@ -492,24 +460,22 @@ static int lbs_scan_add_rates_tlv(u8 *tlv)
  * Generate the CMD_802_11_SCAN command with the proper tlv
  * for a bunch of channels.
  */
-static int lbs_do_scan(struct lbs_private *priv,
-        u8 bsstype,
-        struct chanscanparamset *chan_list,
-        int chan_count,
-        const struct lbs_ioctl_user_scan_cfg *user_cfg)
+static int lbs_do_scan(struct lbs_private *priv, uint8_t bsstype,
+                       struct chanscanparamset *chan_list, int chan_count,
+                       const struct lbs_ioctl_user_scan_cfg *user_cfg)
 {
         int ret = -ENOMEM;
-        struct lbs_scan_cmd_config *scan_cmd;
-        u8 *tlv;    /* pointer into our current, growing TLV storage area */
+        struct cmd_ds_802_11_scan *scan_cmd;
+        uint8_t *tlv;   /* pointer into our current, growing TLV storage area */
 
-        lbs_deb_enter_args(LBS_DEB_SCAN, "bsstype %d, chanlist[].chan %d, "
-                "chan_count %d",
-                bsstype, chan_list[0].channumber, chan_count);
+        lbs_deb_enter_args(LBS_DEB_SCAN, "bsstype %d, chanlist[].chan %d, chan_count %d",
+                           bsstype, chan_list[0].channumber, chan_count);
 
         /* create the fixed part for scan command */
         scan_cmd = kzalloc(MAX_SCAN_CFG_ALLOC, GFP_KERNEL);
         if (scan_cmd == NULL)
                 goto out;
+
         tlv = scan_cmd->tlvbuffer;
         if (user_cfg)
                 memcpy(scan_cmd->bssid, user_cfg->bssid, ETH_ALEN);
@@ -523,13 +489,16 @@ static int lbs_do_scan(struct lbs_private *priv,
         tlv += lbs_scan_add_rates_tlv(tlv);
 
         /* This is the final data we are about to send */
-        scan_cmd->tlvbufferlen = tlv - scan_cmd->tlvbuffer;
-        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd, 1+6);
+        scan_cmd->hdr.size = cpu_to_le16(tlv - (uint8_t *)scan_cmd);
+        lbs_deb_hex(LBS_DEB_SCAN, "SCAN_CMD", (void *)scan_cmd,
+                    sizeof(*scan_cmd));
         lbs_deb_hex(LBS_DEB_SCAN, "SCAN_TLV", scan_cmd->tlvbuffer,
-                scan_cmd->tlvbufferlen);
+                    tlv - scan_cmd->tlvbuffer);
+
+        ret = __lbs_cmd(priv, CMD_802_11_SCAN, &scan_cmd->hdr,
+                        le16_to_cpu(scan_cmd->hdr.size),
+                        lbs_ret_80211_scan, 0);
 
-        ret = lbs_prepare_and_send_command(priv, CMD_802_11_SCAN, 0,
-                CMD_OPTION_WAITFORRSP, 0, scan_cmd);
 out:
         kfree(scan_cmd);
         lbs_deb_leave_args(LBS_DEB_SCAN, "ret %d", ret);
@@ -553,14 +522,14 @@ out:
  *  @return              0 or < 0 if error
  */
 int lbs_scan_networks(struct lbs_private *priv,
-        const struct lbs_ioctl_user_scan_cfg *user_cfg,
-                       int full_scan)
+                      const struct lbs_ioctl_user_scan_cfg *user_cfg,
+                      int full_scan)
 {
         int ret = -ENOMEM;
         struct chanscanparamset *chan_list;
         struct chanscanparamset *curr_chans;
         int chan_count;
-        u8 bsstype = CMD_BSS_TYPE_ANY;
+        uint8_t bsstype = CMD_BSS_TYPE_ANY;
         int numchannels = MRVDRV_CHANNELS_PER_SCAN_CMD;
         int filteredscan = 0;
         union iwreq_data wrqu;
@@ -570,8 +539,7 @@ int lbs_scan_networks(struct lbs_private *priv,
         DECLARE_MAC_BUF(mac);
 #endif
 
-        lbs_deb_enter_args(LBS_DEB_SCAN, "full_scan %d",
-                full_scan);
+        lbs_deb_enter_args(LBS_DEB_SCAN, "full_scan %d", full_scan);
 
         /* Cancel any partial outstanding partial scans if this scan
          * is a full scan.
@@ -583,26 +551,24 @@ int lbs_scan_networks(struct lbs_private *priv,
         if (user_cfg) {
                 if (user_cfg->bsstype)
                         bsstype = user_cfg->bsstype;
-                if (compare_ether_addr(user_cfg->bssid, &zeromac[0]) != 0) {
+                if (!is_zero_ether_addr(user_cfg->bssid)) {
                         numchannels = MRVDRV_MAX_CHANNELS_PER_SCAN;
                         filteredscan = 1;
                 }
         }
-        lbs_deb_scan("numchannels %d, bsstype %d, "
-                "filteredscan %d\n",
-                numchannels, bsstype, filteredscan);
+        lbs_deb_scan("numchannels %d, bsstype %d, filteredscan %d\n",
+                     numchannels, bsstype, filteredscan);
 
         /* Create list of channels to scan */
         chan_list = kzalloc(sizeof(struct chanscanparamset) *
-                                LBS_IOCTL_USER_SCAN_CHAN_MAX, GFP_KERNEL);
+                            LBS_IOCTL_USER_SCAN_CHAN_MAX, GFP_KERNEL);
         if (!chan_list) {
                 lbs_pr_alert("SCAN: chan_list empty\n");
                 goto out;
         }
 
         /* We want to scan all channels */
-        chan_count = lbs_scan_create_channel_list(priv, chan_list,
-                filteredscan);
+        chan_count = lbs_scan_create_channel_list(priv, chan_list, filteredscan);
 
         netif_stop_queue(priv->dev);
         netif_carrier_off(priv->dev);
@@ -629,9 +595,9 @@ int lbs_scan_networks(struct lbs_private *priv,
         while (chan_count) {
                 int to_scan = min(numchannels, chan_count);
                 lbs_deb_scan("scanning %d of %d channels\n",
-                        to_scan, chan_count);
+                             to_scan, chan_count);
                 ret = lbs_do_scan(priv, bsstype, curr_chans,
-                        to_scan, user_cfg);
+                                  to_scan, user_cfg);
                 if (ret) {
                         lbs_pr_err("SCAN_CMD failed\n");
                         goto out2;
@@ -640,8 +606,7 @@ int lbs_scan_networks(struct lbs_private *priv,
                 chan_count -= to_scan;
 
                 /* somehow schedule the next part of the scan */
-                if (chan_count &&
-                    !full_scan &&
+                if (chan_count && !full_scan &&
                     !priv->surpriseremoved) {
                         /* -1 marks just that we're currently scanning */
                         if (priv->scan_channel < 0)
@@ -650,7 +615,7 @@ int lbs_scan_networks(struct lbs_private *priv,
                                 priv->scan_channel += to_scan;
                         cancel_delayed_work(&priv->scan_work);
                         queue_delayed_work(priv->work_thread, &priv->scan_work,
-                                msecs_to_jiffies(300));
+                                           msecs_to_jiffies(300));
                         /* skip over GIWSCAN event */
                         goto out;
                 }
@@ -665,8 +630,8 @@ int lbs_scan_networks(struct lbs_private *priv,
         lbs_deb_scan("scan table:\n");
         list_for_each_entry(iter, &priv->network_list, list)
                 lbs_deb_scan("%02d: BSSID %s, RSSI %d, SSID '%s'\n",
-                       i++, print_mac(mac, iter->bssid), (s32) iter->rssi,
-                       escape_essid(iter->ssid, iter->ssid_len));
+                             i++, print_mac(mac, iter->bssid), (int)iter->rssi,
+                             escape_essid(iter->ssid, iter->ssid_len));
         mutex_unlock(&priv->lock);
 #endif
 
@@ -711,7 +676,7 @@ out:
  *  @return             0 or -1
  */
 static int lbs_process_bss(struct bss_descriptor *bss,
-                                u8 ** pbeaconinfo, int *bytesleft)
+                           uint8_t **pbeaconinfo, int *bytesleft)
 {
         struct ieeetypes_fhparamset *pFH;
         struct ieeetypes_dsparamset *pDS;
@@ -719,9 +684,9 @@ static int lbs_process_bss(struct bss_descriptor *bss,
         struct ieeetypes_ibssparamset *pibss;
         DECLARE_MAC_BUF(mac);
         struct ieeetypes_countryinfoset *pcountryinfo;
-        u8 *pos, *end, *p;
-        u8 n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
-        u16 beaconsize = 0;
+        uint8_t *pos, *end, *p;
+        uint8_t n_ex_rates = 0, got_basic_rates = 0, n_basic_rates = 0;
+        uint16_t beaconsize = 0;
         int ret;
 
         lbs_deb_enter(LBS_DEB_SCAN);
@@ -793,12 +758,11 @@ static int lbs_process_bss(struct bss_descriptor *bss,
 
         /* process variable IE */
         while (pos <= end - 2) {
-                struct ieee80211_info_element * elem =
-                        (struct ieee80211_info_element *) pos;
+                struct ieee80211_info_element * elem = (void *)pos;
 
                 if (pos + elem->len > end) {
                         lbs_deb_scan("process_bss: error in processing IE, "
-                               "bytes left < IE length\n");
+                                     "bytes left < IE length\n");
                         break;
                 }
 
@@ -812,7 +776,7 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         break;
 
                 case MFIE_TYPE_RATES:
-                        n_basic_rates = min_t(u8, MAX_RATES, elem->len);
+                        n_basic_rates = min_t(uint8_t, MAX_RATES, elem->len);
                         memcpy(bss->rates, elem->data, n_basic_rates);
                         got_basic_rates = 1;
                         lbs_deb_scan("got RATES IE\n");
@@ -853,19 +817,16 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         lbs_deb_scan("got COUNTRY IE\n");
                         if (pcountryinfo->len < sizeof(pcountryinfo->countrycode)
                             || pcountryinfo->len > 254) {
-                                lbs_deb_scan("process_bss: 11D- Err "
-                                       "CountryInfo len %d, min %zd, max 254\n",
-                                       pcountryinfo->len,
-                                       sizeof(pcountryinfo->countrycode));
+                                lbs_deb_scan("process_bss: 11D- Err CountryInfo len %d, min %zd, max 254\n",
+                                             pcountryinfo->len, sizeof(pcountryinfo->countrycode));
                                 ret = -1;
                                 goto done;
                         }
 
-                        memcpy(&bss->countryinfo,
-                               pcountryinfo, pcountryinfo->len + 2);
+                        memcpy(&bss->countryinfo, pcountryinfo, pcountryinfo->len + 2);
                         lbs_deb_hex(LBS_DEB_SCAN, "process_bss: 11d countryinfo",
-                                (u8 *) pcountryinfo,
-                                (u32) (pcountryinfo->len + 2));
+                                    (uint8_t *) pcountryinfo,
+                                    (int) (pcountryinfo->len + 2));
                         break;
 
                 case MFIE_TYPE_RATES_EX:
@@ -889,26 +850,19 @@ static int lbs_process_bss(struct bss_descriptor *bss,
 
                 case MFIE_TYPE_GENERIC:
                         if (elem->len >= 4 &&
-                            elem->data[0] == 0x00 &&
-                            elem->data[1] == 0x50 &&
-                            elem->data[2] == 0xf2 &&
-                            elem->data[3] == 0x01) {
-                                bss->wpa_ie_len = min(elem->len + 2,
-                                                      MAX_WPA_IE_LEN);
+                            elem->data[0] == 0x00 && elem->data[1] == 0x50 &&
+                            elem->data[2] == 0xf2 && elem->data[3] == 0x01) {
+                                bss->wpa_ie_len = min(elem->len + 2, MAX_WPA_IE_LEN);
                                 memcpy(bss->wpa_ie, elem, bss->wpa_ie_len);
                                 lbs_deb_scan("got WPA IE\n");
-                                lbs_deb_hex(LBS_DEB_SCAN, "WPA IE", bss->wpa_ie,
-                                            elem->len);
+                                lbs_deb_hex(LBS_DEB_SCAN, "WPA IE", bss->wpa_ie, elem->len);
                         } else if (elem->len >= MARVELL_MESH_IE_LENGTH &&
-                            elem->data[0] == 0x00 &&
-                            elem->data[1] == 0x50 &&
-                            elem->data[2] == 0x43 &&
-                            elem->data[3] == 0x04) {
+                                   elem->data[0] == 0x00 && elem->data[1] == 0x50 &&
+                                   elem->data[2] == 0x43 && elem->data[3] == 0x04) {
                                 lbs_deb_scan("got mesh IE\n");
                                 bss->mesh = 1;
                         } else {
-                                lbs_deb_scan("got generiec IE: "
-                                        "%02x:%02x:%02x:%02x, len %d\n",
+                                lbs_deb_scan("got generic IE: %02x:%02x:%02x:%02x, len %d\n",
                                         elem->data[0], elem->data[1],
                                         elem->data[2], elem->data[3],
                                         elem->len);
@@ -920,12 +874,12 @@ static int lbs_process_bss(struct bss_descriptor *bss,
                         bss->rsn_ie_len = min(elem->len + 2, MAX_WPA_IE_LEN);
                         memcpy(bss->rsn_ie, elem, bss->rsn_ie_len);
                         lbs_deb_hex(LBS_DEB_SCAN, "process_bss: RSN_IE",
-                                bss->rsn_ie, elem->len);
+                                    bss->rsn_ie, elem->len);
                         break;
 
                 default:
                         lbs_deb_scan("got IE 0x%04x, len %d\n",
-                                elem->id, elem->len);
+                                     elem->id, elem->len);
                         break;
                 }
 
@@ -955,18 +909,17 @@ done:
  *  @return         index in BSSID list, or error return code (< 0)
  */
 struct bss_descriptor *lbs_find_bssid_in_list(struct lbs_private *priv,
-                u8 * bssid, u8 mode)
+                                              uint8_t *bssid, uint8_t mode)
 {
-        struct bss_descriptor * iter_bss;
-        struct bss_descriptor * found_bss = NULL;
+        struct bss_descriptor *iter_bss;
+        struct bss_descriptor *found_bss = NULL;
 
         lbs_deb_enter(LBS_DEB_SCAN);
 
         if (!bssid)
                 goto out;
 
-        lbs_deb_hex(LBS_DEB_SCAN, "looking for",
-                bssid, ETH_ALEN);
+        lbs_deb_hex(LBS_DEB_SCAN, "looking for", bssid, ETH_ALEN);
 
         /* Look through the scan table for a compatible match.  The loop will
          *   continue past a matched bssid that is not compatible in case there
@@ -1008,10 +961,11 @@ out:
  *  @return         index in BSSID list
  */
 struct bss_descriptor *lbs_find_ssid_in_list(struct lbs_private *priv,
-                   u8 *ssid, u8 ssid_len, u8 * bssid, u8 mode,
-                   int channel)
+                                             uint8_t *ssid, uint8_t ssid_len,
+                                             uint8_t *bssid, uint8_t mode,
+                                             int channel)
 {
-        u8 bestrssi = 0;
+        uint8_t bestrssi = 0;
         struct bss_descriptor * iter_bss = NULL;
         struct bss_descriptor * found_bss = NULL;
         struct bss_descriptor * tmp_oldest = NULL;
@@ -1026,7 +980,7 @@ struct bss_descriptor *lbs_find_ssid_in_list(struct lbs_private *priv,
                         tmp_oldest = iter_bss;
 
                 if (lbs_ssid_cmp(iter_bss->ssid, iter_bss->ssid_len,
-                                      ssid, ssid_len) != 0)
+                                 ssid, ssid_len) != 0)
                         continue; /* ssid doesn't match */
                 if (bssid && compare_ether_addr(iter_bss->bssid, bssid) != 0)
                         continue; /* bssid doesn't match */
@@ -1076,13 +1030,12 @@ out:
  *
  *  @return         index in BSSID list
  */
-static struct bss_descriptor *lbs_find_best_ssid_in_list(
-        struct lbs_private *priv,
-        u8 mode)
+static struct bss_descriptor *lbs_find_best_ssid_in_list(struct lbs_private *priv,
+                                                         uint8_t mode)
 {
-        u8 bestrssi = 0;
-        struct bss_descriptor * iter_bss;
-        struct bss_descriptor * best_bss = NULL;
+        uint8_t bestrssi = 0;
+        struct bss_descriptor *iter_bss;
+        struct bss_descriptor *best_bss = NULL;
 
         lbs_deb_enter(LBS_DEB_SCAN);
 
@@ -1124,11 +1077,12 @@ static struct bss_descriptor *lbs_find_best_ssid_in_list(
  *
  *  @return             0--success, otherwise--fail
  */
-int lbs_find_best_network_ssid(struct lbs_private *priv,
-                u8 *out_ssid, u8 *out_ssid_len, u8 preferred_mode, u8 *out_mode)
+int lbs_find_best_network_ssid(struct lbs_private *priv, uint8_t *out_ssid,
+                               uint8_t *out_ssid_len, uint8_t preferred_mode,
+                               uint8_t *out_mode)
 {
         int ret = -1;
-        struct bss_descriptor * found;
+        struct bss_descriptor *found;
 
         lbs_deb_enter(LBS_DEB_SCAN);
 
@@ -1163,14 +1117,14 @@ out:
  *
  *  @return                0-success, otherwise fail
  */
-int lbs_send_specific_ssid_scan(struct lbs_private *priv,
-                        u8 *ssid, u8 ssid_len, u8 clear_ssid)
+int lbs_send_specific_ssid_scan(struct lbs_private *priv, uint8_t *ssid,
+                                uint8_t ssid_len, uint8_t clear_ssid)
 {
         struct lbs_ioctl_user_scan_cfg scancfg;
         int ret = 0;
 
         lbs_deb_enter_args(LBS_DEB_SCAN, "SSID '%s', clear %d",
-                escape_essid(ssid, ssid_len), clear_ssid);
+                           escape_essid(ssid, ssid_len), clear_ssid);
 
         if (!ssid_len)
                 goto out;
@@ -1204,17 +1158,17 @@ out:
 #define MAX_CUSTOM_LEN 64
 
 static inline char *lbs_translate_scan(struct lbs_private *priv,
-                                        char *start, char *stop,
-                                        struct bss_descriptor *bss)
+                                       char *start, char *stop,
+                                       struct bss_descriptor *bss)
 {
         struct chan_freq_power *cfp;
         char *current_val;      /* For rates */
         struct iw_event iwe;    /* Temporary buffer */
         int j;
-#define PERFECT_RSSI ((u8)50)
-#define WORST_RSSI   ((u8)0)
-#define RSSI_DIFF    ((u8)(PERFECT_RSSI - WORST_RSSI))
-        u8 rssi;
+#define PERFECT_RSSI ((uint8_t)50)
+#define WORST_RSSI   ((uint8_t)0)
+#define RSSI_DIFF    ((uint8_t)(PERFECT_RSSI - WORST_RSSI))
+        uint8_t rssi;
 
         lbs_deb_enter(LBS_DEB_SCAN);
 
@@ -1234,7 +1188,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
         /* SSID */
         iwe.cmd = SIOCGIWESSID;
         iwe.u.data.flags = 1;
-        iwe.u.data.length = min((u32) bss->ssid_len, (u32) IW_ESSID_MAX_SIZE);
+        iwe.u.data.length = min((uint32_t) bss->ssid_len, (uint32_t) IW_ESSID_MAX_SIZE);
         start = iwe_stream_add_point(start, stop, &iwe, bss->ssid);
 
         /* Mode */
@@ -1255,28 +1209,26 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
 
         rssi = iwe.u.qual.level - MRVDRV_NF_DEFAULT_SCAN_VALUE;
         iwe.u.qual.qual =
-            (100 * RSSI_DIFF * RSSI_DIFF - (PERFECT_RSSI - rssi) *
-             (15 * (RSSI_DIFF) + 62 * (PERFECT_RSSI - rssi))) /
-            (RSSI_DIFF * RSSI_DIFF);
+                (100 * RSSI_DIFF * RSSI_DIFF - (PERFECT_RSSI - rssi) *
+                 (15 * (RSSI_DIFF) + 62 * (PERFECT_RSSI - rssi))) /
+                (RSSI_DIFF * RSSI_DIFF);
         if (iwe.u.qual.qual > 100)
                 iwe.u.qual.qual = 100;
 
         if (priv->NF[TYPE_BEACON][TYPE_NOAVG] == 0) {
                 iwe.u.qual.noise = MRVDRV_NF_DEFAULT_SCAN_VALUE;
         } else {
-                iwe.u.qual.noise =
-                    CAL_NF(priv->NF[TYPE_BEACON][TYPE_NOAVG]);
+                iwe.u.qual.noise = CAL_NF(priv->NF[TYPE_BEACON][TYPE_NOAVG]);
         }
 
         /* Locally created ad-hoc BSSs won't have beacons if this is the
          * only station in the adhoc network; so get signal strength
          * from receive statistics.
          */
-        if ((priv->mode == IW_MODE_ADHOC)
-            && priv->adhoccreate
+        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate
             && !lbs_ssid_cmp(priv->curbssparams.ssid,
-                                  priv->curbssparams.ssid_len,
-                                  bss->ssid, bss->ssid_len)) {
+                             priv->curbssparams.ssid_len,
+                             bss->ssid, bss->ssid_len)) {
                 int snr, nf;
                 snr = priv->SNR[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
                 nf = priv->NF[TYPE_RXPD][TYPE_AVG] / AVG_SCALE;
@@ -1307,14 +1259,13 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
                 current_val = iwe_stream_add_value(start, current_val,
                                          stop, &iwe, IW_EV_PARAM_LEN);
         }
-        if ((bss->mode == IW_MODE_ADHOC)
+        if ((bss->mode == IW_MODE_ADHOC) && priv->adhoccreate
             && !lbs_ssid_cmp(priv->curbssparams.ssid,
-                                  priv->curbssparams.ssid_len,
-                                  bss->ssid, bss->ssid_len)
-            && priv->adhoccreate) {
+                             priv->curbssparams.ssid_len,
+                             bss->ssid, bss->ssid_len)) {
                 iwe.u.bitrate.value = 22 * 500000;
                 current_val = iwe_stream_add_value(start, current_val,
-                                         stop, &iwe, IW_EV_PARAM_LEN);
+                                                   stop, &iwe, IW_EV_PARAM_LEN);
         }
         /* Check if we added any event */
         if((current_val - start) > IW_EV_LCP_LEN)
@@ -1343,8 +1294,7 @@ static inline char *lbs_translate_scan(struct lbs_private *priv,
                 char *p = custom;
 
                 iwe.cmd = IWEVCUSTOM;
-                p += snprintf(p, MAX_CUSTOM_LEN - (p - custom),
-                              "mesh-type: olpc");
+                p += snprintf(p, MAX_CUSTOM_LEN, "mesh-type: olpc");
                 iwe.u.data.length = p - custom;
                 if (iwe.u.data.length)
                         start = iwe_stream_add_point(start, stop, &iwe, custom);
@@ -1367,7 +1317,7 @@ out:
  *  @return             0 --success, otherwise fail
  */
 int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
-                  struct iw_param *wrqu, char *extra)
+                 struct iw_param *wrqu, char *extra)
 {
         struct lbs_private *priv = dev->priv;
 
@@ -1391,7 +1341,7 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
 
         if (!delayed_work_pending(&priv->scan_work))
                 queue_delayed_work(priv->work_thread, &priv->scan_work,
-                        msecs_to_jiffies(50));
+                                   msecs_to_jiffies(50));
         /* set marker that currently a scan is taking place */
         priv->scan_channel = -1;
 
@@ -1414,15 +1364,15 @@ int lbs_set_scan(struct net_device *dev, struct iw_request_info *info,
  *  @return             0 --success, otherwise fail
  */
 int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
-                  struct iw_point *dwrq, char *extra)
+                 struct iw_point *dwrq, char *extra)
 {
 #define SCAN_ITEM_SIZE 128
         struct lbs_private *priv = dev->priv;
         int err = 0;
         char *ev = extra;
         char *stop = ev + dwrq->length;
-        struct bss_descriptor * iter_bss;
-        struct bss_descriptor * safe;
+        struct bss_descriptor *iter_bss;
+        struct bss_descriptor *safe;
 
         lbs_deb_enter(LBS_DEB_SCAN);
 
@@ -1431,14 +1381,13 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                 return -EAGAIN;
 
         /* Update RSSI if current BSS is a locally created ad-hoc BSS */
-        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate) {
+        if ((priv->mode == IW_MODE_ADHOC) && priv->adhoccreate)
                 lbs_prepare_and_send_command(priv, CMD_802_11_RSSI, 0,
-                                        CMD_OPTION_WAITFORRSP, 0, NULL);
-        }
+                                             CMD_OPTION_WAITFORRSP, 0, NULL);
 
         mutex_lock(&priv->lock);
         list_for_each_entry_safe (iter_bss, safe, &priv->network_list, list) {
-                char * next_ev;
+                char *next_ev;
                 unsigned long stale_time;
 
                 if (stop - ev < SCAN_ITEM_SIZE) {
@@ -1453,8 +1402,7 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
                 /* Prune old an old scan result */
                 stale_time = iter_bss->last_scanned + DEFAULT_MAX_SCAN_AGE;
                 if (time_after(jiffies, stale_time)) {
-                        list_move_tail (&iter_bss->list,
-                                        &priv->network_free_list);
+                        list_move_tail(&iter_bss->list, &priv->network_free_list);
                         clear_bss_descriptor(iter_bss);
                         continue;
                 }
@@ -1485,44 +1433,6 @@ int lbs_get_scan(struct net_device *dev, struct iw_request_info *info,
 
 
 /**
- *  @brief Prepare a scan command to be sent to the firmware
- *
- *  Called via lbs_prepare_and_send_command(priv, CMD_802_11_SCAN, ...)
- *  from cmd.c
- *
- *  Sends a fixed length data part (specifying the BSS type and BSSID filters)
- *  as well as a variable number/length of TLVs to the firmware.
- *
- *  @param priv       A pointer to struct lbs_private structure
- *  @param cmd        A pointer to cmd_ds_command structure to be sent to
- *                    firmware with the cmd_DS_801_11_SCAN structure
- *  @param pdata_buf  Void pointer cast of a lbs_scan_cmd_config struct used
- *                    to set the fields/TLVs for the command sent to firmware
- *
- *  @return           0 or -1
- */
-int lbs_cmd_80211_scan(struct lbs_private *priv,
-        struct cmd_ds_command *cmd, void *pdata_buf)
-{
-        struct cmd_ds_802_11_scan *pscan = &cmd->params.scan;
-        struct lbs_scan_cmd_config *pscancfg = pdata_buf;
-
-        lbs_deb_enter(LBS_DEB_SCAN);
-
-        /* Set fixed field variables in scan command */
-        pscan->bsstype = pscancfg->bsstype;
-        memcpy(pscan->bssid, pscancfg->bssid, ETH_ALEN);
-        memcpy(pscan->tlvbuffer, pscancfg->tlvbuffer, pscancfg->tlvbufferlen);
-
-        /* size is equal to the sizeof(fixed portions) + the TLV len + header */
-        cmd->size = cpu_to_le16(sizeof(pscan->bsstype) + ETH_ALEN
-                                + pscancfg->tlvbufferlen + S_DS_GEN);
-
-        lbs_deb_leave(LBS_DEB_SCAN);
-        return 0;
-}
-
-/**
  *  @brief This function handles the command response of scan
  *
  *  Called from handle_cmd_response() in cmdrespc.
@@ -1548,13 +1458,14 @@ int lbs_cmd_80211_scan(struct lbs_private *priv,
  *
  *  @return        0 or -1
  */
-int lbs_ret_80211_scan(struct lbs_private *priv, struct cmd_ds_command *resp)
+static int lbs_ret_80211_scan(struct lbs_private *priv, unsigned long dummy,
+                              struct cmd_header *resp)
 {
-        struct cmd_ds_802_11_scan_rsp *pscan;
-        struct bss_descriptor * iter_bss;
-        struct bss_descriptor * safe;
-        u8 *pbssinfo;
-        u16 scanrespsize;
+        struct cmd_ds_802_11_scan_rsp *scanresp = (void *)resp;
+        struct bss_descriptor *iter_bss;
+        struct bss_descriptor *safe;
+        uint8_t *bssinfo;
+        uint16_t scanrespsize;
         int bytesleft;
         int idx;
         int tlvbufsize;
@@ -1571,48 +1482,45 @@ int lbs_ret_80211_scan(struct lbs_private *priv, struct cmd_ds_command *resp)
                 clear_bss_descriptor(iter_bss);
         }
 
-        pscan = &resp->params.scanresp;
-
-        if (pscan->nr_sets > MAX_NETWORK_COUNT) {
-                lbs_deb_scan(
-                       "SCAN_RESP: too many scan results (%d, max %d)!!\n",
-                       pscan->nr_sets, MAX_NETWORK_COUNT);
+        if (scanresp->nr_sets > MAX_NETWORK_COUNT) {
+                lbs_deb_scan("SCAN_RESP: too many scan results (%d, max %d)\n",
+                             scanresp->nr_sets, MAX_NETWORK_COUNT);
                 ret = -1;
                 goto done;
         }
 
-        bytesleft = le16_to_cpu(pscan->bssdescriptsize);
+        bytesleft = le16_to_cpu(scanresp->bssdescriptsize);
         lbs_deb_scan("SCAN_RESP: bssdescriptsize %d\n", bytesleft);
 
         scanrespsize = le16_to_cpu(resp->size);
-        lbs_deb_scan("SCAN_RESP: scan results %d\n", pscan->nr_sets);
+        lbs_deb_scan("SCAN_RESP: scan results %d\n", scanresp->nr_sets);
 
-        pbssinfo = pscan->bssdesc_and_tlvbuffer;
+        bssinfo = scanresp->bssdesc_and_tlvbuffer;
 
         /* The size of the TLV buffer is equal to the entire command response
          *   size (scanrespsize) minus the fixed fields (sizeof()'s), the
          *   BSS Descriptions (bssdescriptsize as bytesLef) and the command
          *   response header (S_DS_GEN)
          */
-        tlvbufsize = scanrespsize - (bytesleft + sizeof(pscan->bssdescriptsize)
-                                     + sizeof(pscan->nr_sets)
+        tlvbufsize = scanrespsize - (bytesleft + sizeof(scanresp->bssdescriptsize)
+                                     + sizeof(scanresp->nr_sets)
                                      + S_DS_GEN);
 
         /*
-         *  Process each scan response returned (pscan->nr_sets).  Save
+         *  Process each scan response returned (scanresp->nr_sets). Save
          *    the information in the newbssentry and then insert into the
          *    driver scan table either as an update to an existing entry
          *    or as an addition at the end of the table
          */
-        for (idx = 0; idx < pscan->nr_sets && bytesleft; idx++) {
+        for (idx = 0; idx < scanresp->nr_sets && bytesleft; idx++) {
                 struct bss_descriptor new;
-                struct bss_descriptor * found = NULL;
-                struct bss_descriptor * oldest = NULL;
+                struct bss_descriptor *found = NULL;
+                struct bss_descriptor *oldest = NULL;
                 DECLARE_MAC_BUF(mac);
 
                 /* Process the data fields and IEs returned for this BSS */
                 memset(&new, 0, sizeof (struct bss_descriptor));
-                if (lbs_process_bss(&new, &pbssinfo, &bytesleft) != 0) {
+                if (lbs_process_bss(&new, &bssinfo, &bytesleft) != 0) {
                         /* error parsing the scan response, skipped */
                         lbs_deb_scan("SCAN_RESP: process_bss returned ERROR\n");
                         continue;
@@ -1647,8 +1555,7 @@ int lbs_ret_80211_scan(struct lbs_private *priv, struct cmd_ds_command *resp)
                         continue;
                 }
 
-                lbs_deb_scan("SCAN_RESP: BSSID %s\n",
-                             print_mac(mac, new.bssid));
+                lbs_deb_scan("SCAN_RESP: BSSID %s\n", print_mac(mac, new.bssid));
 
                 /* Copy the locally created newbssentry to the scan table */
                 memcpy(found, &new, offsetof(struct bss_descriptor, list));
diff --git a/drivers/net/wireless/libertas/scan.h b/drivers/net/wireless/libertas/scan.h
index 319f70dde350..10d1196acf78 100644
--- a/drivers/net/wireless/libertas/scan.h
+++ b/drivers/net/wireless/libertas/scan.h
@@ -17,57 +17,16 @@
  */
 #define LBS_IOCTL_USER_SCAN_CHAN_MAX  50
 
-//! Infrastructure BSS scan type in lbs_scan_cmd_config
+//! Infrastructure BSS scan type in cmd_ds_802_11_scan
 #define LBS_SCAN_BSS_TYPE_BSS         1
 
-//! Adhoc BSS scan type in lbs_scan_cmd_config
+//! Adhoc BSS scan type in cmd_ds_802_11_scan
 #define LBS_SCAN_BSS_TYPE_IBSS        2
 
-//! Adhoc or Infrastructure BSS scan type in lbs_scan_cmd_config, no filter
+//! Adhoc or Infrastructure BSS scan type in cmd_ds_802_11_scan, no filter
 #define LBS_SCAN_BSS_TYPE_ANY         3
 
 /**
- * @brief Structure used internally in the wlan driver to configure a scan.
- *
- * Sent to the command processing module to configure the firmware
- *   scan command prepared by lbs_cmd_80211_scan.
- *
- * @sa lbs_scan_networks
- *
- */
-struct lbs_scan_cmd_config {
-    /**
-     *  @brief BSS type to be sent in the firmware command
-     *
-     *  Field can be used to restrict the types of networks returned in the
-     *    scan.  valid settings are:
-     *
-     *   - LBS_SCAN_BSS_TYPE_BSS  (infrastructure)
-     *   - LBS_SCAN_BSS_TYPE_IBSS (adhoc)
-     *   - LBS_SCAN_BSS_TYPE_ANY  (unrestricted, adhoc and infrastructure)
-     */
-        u8 bsstype;
-
-    /**
-     *  @brief Specific BSSID used to filter scan results in the firmware
-     */
-        u8 bssid[ETH_ALEN];
-
-    /**
-     *  @brief length of TLVs sent in command starting at tlvBuffer
-     */
-        int tlvbufferlen;
-
-    /**
-     *  @brief SSID TLV(s) and ChanList TLVs to be sent in the firmware command
-     *
-     *  @sa TLV_TYPE_CHANLIST, mrvlietypes_chanlistparamset_t
-     *  @sa TLV_TYPE_SSID, mrvlietypes_ssidparamset_t
-     */
-        u8 tlvbuffer[1];        //!< SSID TLV(s) and ChanList TLVs are stored here
-};
-
-/**
  *  @brief IOCTL channel sub-structure sent in lbs_ioctl_user_scan_cfg
  *
  *  Multiple instances of this structure are included in the IOCTL command
@@ -179,13 +138,6 @@ int lbs_find_best_network_ssid(struct lbs_private *priv, u8 *out_ssid,
 int lbs_send_specific_ssid_scan(struct lbs_private *priv, u8 *ssid,
                                 u8 ssid_len, u8 clear_ssid);
 
-int lbs_cmd_80211_scan(struct lbs_private *priv,
-                                struct cmd_ds_command *cmd,
-                                void *pdata_buf);
-
-int lbs_ret_80211_scan(struct lbs_private *priv,
-                                struct cmd_ds_command *resp);
-
 int lbs_scan_networks(struct lbs_private *priv,
         const struct lbs_ioctl_user_scan_cfg *puserscanin,
                 int full_scan);
diff --git a/drivers/net/wireless/libertas/types.h b/drivers/net/wireless/libertas/types.h
index f0d57958b34b..4031be420862 100644
--- a/drivers/net/wireless/libertas/types.h
+++ b/drivers/net/wireless/libertas/types.h
@@ -239,4 +239,17 @@ struct mrvlietypes_ledgpio {
         struct led_pin ledpin[1];
 } __attribute__ ((packed));
 
+struct led_bhv {
+        uint8_t firmwarestate;
+        uint8_t led;
+        uint8_t ledstate;
+        uint8_t ledarg;
+} __attribute__ ((packed));
+
+
+struct mrvlietypes_ledbhv {
+        struct mrvlietypesheader header;
+        struct led_bhv ledbhv[1];
+} __attribute__ ((packed));
+
 #endif
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.c b/drivers/net/wireless/zd1211rw/zd_chip.c
index db96adf90ae2..0acb5c345734 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.c
+++ b/drivers/net/wireless/zd1211rw/zd_chip.c
@@ -809,6 +809,7 @@ static int hw_init_hmac(struct zd_chip *chip)
                 { CR_AFTER_PNP,                 0x1 },
                 { CR_WEP_PROTECT,               0x114 },
                 { CR_IFS_VALUE,                 IFS_VALUE_DEFAULT },
+                { CR_CAM_MODE,                  MODE_AP_WDS},
         };
 
         ZD_ASSERT(mutex_is_locked(&chip->mutex));
diff --git a/drivers/net/wireless/zd1211rw/zd_chip.h b/drivers/net/wireless/zd1211rw/zd_chip.h
index 5b6e3a3751ba..f8c061a9b6ec 100644
--- a/drivers/net/wireless/zd1211rw/zd_chip.h
+++ b/drivers/net/wireless/zd1211rw/zd_chip.h
@@ -489,6 +489,7 @@ enum {
 
 #define CR_RX_OFFSET                    CTL_REG(0x065c)
 
+#define CR_BCN_LENGTH                   CTL_REG(0x0664)
 #define CR_PHY_DELAY                    CTL_REG(0x066C)
 #define CR_BCN_FIFO                     CTL_REG(0x0670)
 #define CR_SNIFFER_ON                   CTL_REG(0x0674)
@@ -545,6 +546,8 @@ enum {
 #define RX_FILTER_CTRL (RX_FILTER_RTS | RX_FILTER_CTS | \
         RX_FILTER_CFEND | RX_FILTER_CFACK)
 
+#define BCN_MODE_IBSS                   0x2000000
+
 /* Monitor mode sets filter to 0xfffff */
 
 #define CR_ACK_TIMEOUT_EXT              CTL_REG(0x0690)
@@ -578,6 +581,11 @@ enum {
 
 /* CAM: Continuous Access Mode (power management) */
 #define CR_CAM_MODE                     CTL_REG(0x0700)
+#define MODE_IBSS                       0x0
+#define MODE_AP                         0x1
+#define MODE_STA                        0x2
+#define MODE_AP_WDS                     0x3
+
 #define CR_CAM_ROLL_TB_LOW              CTL_REG(0x0704)
 #define CR_CAM_ROLL_TB_HIGH             CTL_REG(0x0708)
 #define CR_CAM_ADDRESS                  CTL_REG(0x070C)
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index f90f03f676de..69c45ca99051 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -475,6 +475,46 @@ static void cs_set_control(struct zd_mac *mac, struct zd_ctrlset *cs,
         /* FIXME: Management frame? */
 }
 
+void zd_mac_config_beacon(struct ieee80211_hw *hw, struct sk_buff *beacon)
+{
+        struct zd_mac *mac = zd_hw_mac(hw);
+        u32 tmp, j = 0;
+        /* 4 more bytes for tail CRC */
+        u32 full_len = beacon->len + 4;
+        zd_iowrite32(&mac->chip, CR_BCN_FIFO_SEMAPHORE, 0);
+        zd_ioread32(&mac->chip, CR_BCN_FIFO_SEMAPHORE, &tmp);
+        while (tmp & 0x2) {
+                zd_ioread32(&mac->chip, CR_BCN_FIFO_SEMAPHORE, &tmp);
+                if ((++j % 100) == 0) {
+                        printk(KERN_ERR "CR_BCN_FIFO_SEMAPHORE not ready\n");
+                        if (j >= 500)  {
+                                printk(KERN_ERR "Giving up beacon config.\n");
+                                return;
+                        }
+                }
+                msleep(1);
+        }
+
+        zd_iowrite32(&mac->chip, CR_BCN_FIFO, full_len - 1);
+        if (zd_chip_is_zd1211b(&mac->chip))
+                zd_iowrite32(&mac->chip, CR_BCN_LENGTH, full_len - 1);
+
+        for (j = 0 ; j < beacon->len; j++)
+                zd_iowrite32(&mac->chip, CR_BCN_FIFO,
+                                *((u8 *)(beacon->data + j)));
+
+        for (j = 0; j < 4; j++)
+                zd_iowrite32(&mac->chip, CR_BCN_FIFO, 0x0);
+
+        zd_iowrite32(&mac->chip, CR_BCN_FIFO_SEMAPHORE, 1);
+        /* 802.11b/g 2.4G CCK 1Mb
+         * 802.11a, not yet implemented, uses different values (see GPL vendor
+         * driver)
+         */
+        zd_iowrite32(&mac->chip, CR_BCN_PLCP_CFG, 0x00000400 |
+                        (full_len << 19));
+}
+
 static int fill_ctrlset(struct zd_mac *mac,
                         struct sk_buff *skb,
                         struct ieee80211_tx_control *control)
@@ -709,6 +749,7 @@ static int zd_op_add_interface(struct ieee80211_hw *hw,
 
         switch (conf->type) {
         case IEEE80211_IF_TYPE_MNTR:
+        case IEEE80211_IF_TYPE_MESH_POINT:
         case IEEE80211_IF_TYPE_STA:
                 mac->type = conf->type;
                 break;
@@ -738,15 +779,43 @@ static int zd_op_config_interface(struct ieee80211_hw *hw,
                                    struct ieee80211_if_conf *conf)
 {
         struct zd_mac *mac = zd_hw_mac(hw);
+        int associated;
+
+        if (mac->type == IEEE80211_IF_TYPE_MESH_POINT) {
+                associated = true;
+                if (conf->beacon) {
+                        zd_mac_config_beacon(hw, conf->beacon);
+                        kfree_skb(conf->beacon);
+                        zd_set_beacon_interval(&mac->chip, BCN_MODE_IBSS |
+                                        hw->conf.beacon_int);
+                }
+        } else
+                associated = is_valid_ether_addr(conf->bssid);
 
         spin_lock_irq(&mac->lock);
-        mac->associated = is_valid_ether_addr(conf->bssid);
+        mac->associated = associated;
         spin_unlock_irq(&mac->lock);
 
         /* TODO: do hardware bssid filtering */
         return 0;
 }
 
+void zd_process_intr(struct work_struct *work)
+{
+        u16 int_status;
+        struct zd_mac *mac = container_of(work, struct zd_mac, process_intr);
+
+        int_status = le16_to_cpu(*(u16 *)(mac->intr_buffer+4));
+        if (int_status & INT_CFG_NEXT_BCN) {
+                if (net_ratelimit())
+                        dev_dbg_f(zd_mac_dev(mac), "INT_CFG_NEXT_BCN\n");
+        } else
+                dev_dbg_f(zd_mac_dev(mac), "Unsupported interrupt\n");
+
+        zd_chip_enable_hwint(&mac->chip);
+}
+
+
 static void set_multicast_hash_handler(struct work_struct *work)
 {
         struct zd_mac *mac =
@@ -912,7 +981,8 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
 
         hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &mac->band;
 
-        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS;
+        hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
+                    IEEE80211_HW_HOST_GEN_BEACON_TEMPLATE;
         hw->max_rssi = 100;
         hw->max_signal = 100;
 
@@ -926,6 +996,7 @@ struct ieee80211_hw *zd_mac_alloc_hw(struct usb_interface *intf)
         INIT_WORK(&mac->set_multicast_hash_work, set_multicast_hash_handler);
         INIT_WORK(&mac->set_rts_cts_work, set_rts_cts_work);
         INIT_WORK(&mac->set_rx_filter_work, set_rx_filter_handler);
+        INIT_WORK(&mac->process_intr, zd_process_intr);
 
         SET_IEEE80211_DEV(hw, &intf->dev);
         return hw;
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.h b/drivers/net/wireless/zd1211rw/zd_mac.h
index 67dea9739c8f..71170244d2c9 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.h
+++ b/drivers/net/wireless/zd1211rw/zd_mac.h
@@ -172,12 +172,15 @@ struct zd_tx_skb_control_block {
 struct zd_mac {
         struct zd_chip chip;
         spinlock_t lock;
+        spinlock_t intr_lock;
         struct ieee80211_hw *hw;
         struct housekeeping housekeeping;
         struct work_struct set_multicast_hash_work;
         struct work_struct set_rts_cts_work;
         struct work_struct set_rx_filter_work;
+        struct work_struct process_intr;
         struct zd_mc_hash multicast_hash;
+        u8 intr_buffer[USB_MAX_EP_INT_BUFFER];
         u8 regdomain;
         u8 default_regdomain;
         int type;
diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index 7942b15acfe7..e34675c2f8fc 100644
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -97,6 +97,7 @@ MODULE_DEVICE_TABLE(usb, usb_ids);
 #define FW_ZD1211B_PREFIX       "zd1211/zd1211b_"
 
 /* USB device initialization */
+static void int_urb_complete(struct urb *urb);
 
 static int request_fw_file(
         const struct firmware **fw, const char *name, struct device *device)
@@ -336,11 +337,18 @@ static inline void handle_regs_int(struct urb *urb)
         struct zd_usb *usb = urb->context;
         struct zd_usb_interrupt *intr = &usb->intr;
         int len;
+        u16 int_num;
 
         ZD_ASSERT(in_interrupt());
         spin_lock(&intr->lock);
 
-        if (intr->read_regs_enabled) {
+        int_num = le16_to_cpu(*(u16 *)(urb->transfer_buffer+2));
+        if (int_num == CR_INTERRUPT) {
+                struct zd_mac *mac = zd_hw_mac(zd_usb_to_hw(urb->context));
+                memcpy(&mac->intr_buffer, urb->transfer_buffer,
+                                USB_MAX_EP_INT_BUFFER);
+                schedule_work(&mac->process_intr);
+        } else if (intr->read_regs_enabled) {
                 intr->read_regs.length = len = urb->actual_length;
 
                 if (len > sizeof(intr->read_regs.buffer))
@@ -351,7 +359,6 @@ static inline void handle_regs_int(struct urb *urb)
                 goto out;
         }
 
-        dev_dbg_f(urb_dev(urb), "regs interrupt ignored\n");
 out:
         spin_unlock(&intr->lock);
 }