Merge branch 'master' of ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6

53 files changed, 517 insertions, 401 deletions

diff --git a/drivers/net/wireless/adm8211.c b/drivers/net/wireless/adm8211.c
index e6ca3eb4c0d3..547912e6843f 100644
--- a/drivers/net/wireless/adm8211.c
+++ b/drivers/net/wireless/adm8211.c
@@ -302,18 +302,6 @@ static int adm8211_get_stats(struct ieee80211_hw *dev,
         return 0;
 }
 
-static int adm8211_get_tx_stats(struct ieee80211_hw *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct adm8211_priv *priv = dev->priv;
-
-        stats[0].len = priv->cur_tx - priv->dirty_tx;
-        stats[0].limit = priv->tx_ring_size - 2;
-        stats[0].count = priv->dirty_tx;
-
-        return 0;
-}
-
 static void adm8211_interrupt_tci(struct ieee80211_hw *dev)
 {
         struct adm8211_priv *priv = dev->priv;
@@ -1773,7 +1761,6 @@ static const struct ieee80211_ops adm8211_ops = {
         .prepare_multicast      = adm8211_prepare_multicast,
         .configure_filter       = adm8211_configure_filter,
         .get_stats              = adm8211_get_stats,
-        .get_tx_stats           = adm8211_get_tx_stats,
         .get_tsf                = adm8211_get_tsft
 };
 
diff --git a/drivers/net/wireless/ath/ar9170/ar9170.h b/drivers/net/wireless/ath/ar9170/ar9170.h
index b99a8c2053d8..8c8ce67971e9 100644
--- a/drivers/net/wireless/ath/ar9170/ar9170.h
+++ b/drivers/net/wireless/ath/ar9170/ar9170.h
@@ -144,6 +144,12 @@ struct ar9170_sta_tid {
         bool active;
 };
 
+struct ar9170_tx_queue_stats {
+        unsigned int len;
+        unsigned int limit;
+        unsigned int count;
+};
+
 #define AR9170_QUEUE_TIMEOUT            64
 #define AR9170_TX_TIMEOUT               8
 #define AR9170_BA_TIMEOUT               4
@@ -211,7 +217,7 @@ struct ar9170 {
 
         /* qos queue settings */
         spinlock_t tx_stats_lock;
-        struct ieee80211_tx_queue_stats tx_stats[5];
+        struct ar9170_tx_queue_stats tx_stats[5];
         struct ieee80211_tx_queue_params edcf[5];
 
         spinlock_t cmdlock;
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 4d27f7f67c76..91797cb6e0e8 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -2396,18 +2396,6 @@ static int ar9170_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int ar9170_get_tx_stats(struct ieee80211_hw *hw,
-                               struct ieee80211_tx_queue_stats *tx_stats)
-{
-        struct ar9170 *ar = hw->priv;
-
-        spin_lock_bh(&ar->tx_stats_lock);
-        memcpy(tx_stats, ar->tx_stats, sizeof(tx_stats[0]) * hw->queues);
-        spin_unlock_bh(&ar->tx_stats_lock);
-
-        return 0;
-}
-
 static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
                           const struct ieee80211_tx_queue_params *param)
 {
@@ -2509,7 +2497,6 @@ static const struct ieee80211_ops ar9170_ops = {
         .set_key                = ar9170_set_key,
         .sta_notify             = ar9170_sta_notify,
         .get_stats              = ar9170_get_stats,
-        .get_tx_stats           = ar9170_get_tx_stats,
         .ampdu_action           = ar9170_ampdu_action,
 };
 
diff --git a/drivers/net/wireless/ath/ath5k/ath5k.h b/drivers/net/wireless/ath/ath5k/ath5k.h
index ad4d446f0264..ac67f02e26d8 100644
--- a/drivers/net/wireless/ath/ath5k/ath5k.h
+++ b/drivers/net/wireless/ath/ath5k/ath5k.h
@@ -541,7 +541,6 @@ struct ath5k_txq_info {
 /*
  * Transmit packet types.
  * used on tx control descriptor
- * TODO: Use them inside base.c corectly
  */
 enum ath5k_pkt_type {
         AR5K_PKT_TYPE_NORMAL            = 0,
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index edb6c90e376f..8dce0077b023 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -241,8 +241,6 @@ static int ath5k_set_key(struct ieee80211_hw *hw,
                 struct ieee80211_key_conf *key);
 static int ath5k_get_stats(struct ieee80211_hw *hw,
                 struct ieee80211_low_level_stats *stats);
-static int ath5k_get_tx_stats(struct ieee80211_hw *hw,
-                struct ieee80211_tx_queue_stats *stats);
 static u64 ath5k_get_tsf(struct ieee80211_hw *hw);
 static void ath5k_set_tsf(struct ieee80211_hw *hw, u64 tsf);
 static void ath5k_reset_tsf(struct ieee80211_hw *hw);
@@ -269,7 +267,6 @@ static const struct ieee80211_ops ath5k_hw_ops = {
         .set_key        = ath5k_set_key,
         .get_stats      = ath5k_get_stats,
         .conf_tx        = NULL,
-        .get_tx_stats   = ath5k_get_tx_stats,
         .get_tsf        = ath5k_get_tsf,
         .set_tsf        = ath5k_set_tsf,
         .reset_tsf      = ath5k_reset_tsf,
@@ -1249,6 +1246,29 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
         return 0;
 }
 
+static enum ath5k_pkt_type get_hw_packet_type(struct sk_buff *skb)
+{
+        struct ieee80211_hdr *hdr;
+        enum ath5k_pkt_type htype;
+        __le16 fc;
+
+        hdr = (struct ieee80211_hdr *)skb->data;
+        fc = hdr->frame_control;
+
+        if (ieee80211_is_beacon(fc))
+                htype = AR5K_PKT_TYPE_BEACON;
+        else if (ieee80211_is_probe_resp(fc))
+                htype = AR5K_PKT_TYPE_PROBE_RESP;
+        else if (ieee80211_is_atim(fc))
+                htype = AR5K_PKT_TYPE_ATIM;
+        else if (ieee80211_is_pspoll(fc))
+                htype = AR5K_PKT_TYPE_PSPOLL;
+        else
+                htype = AR5K_PKT_TYPE_NORMAL;
+
+        return htype;
+}
+
 static int
 ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                   struct ath5k_txq *txq)
@@ -1303,7 +1323,8 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
                         sc->vif, pktlen, info));
         }
         ret = ah->ah_setup_tx_desc(ah, ds, pktlen,
-                ieee80211_get_hdrlen_from_skb(skb), AR5K_PKT_TYPE_NORMAL,
+                ieee80211_get_hdrlen_from_skb(skb),
+                get_hw_packet_type(skb),
                 (sc->power_level * 2),
                 hw_rate,
                 info->control.rates[0].count, keyidx, ah->ah_tx_ant, flags,
@@ -1332,7 +1353,6 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf,
 
         spin_lock_bh(&txq->lock);
         list_add_tail(&bf->list, &txq->q);
-        sc->tx_stats[txq->qnum].len++;
         if (txq->link == NULL) /* is this first packet? */
                 ath5k_hw_set_txdp(ah, txq->qnum, bf->daddr);
         else /* no, so only link it */
@@ -1581,7 +1601,6 @@ ath5k_txq_drainq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 ath5k_txbuf_free(sc, bf);
 
                 spin_lock_bh(&sc->txbuflock);
-                sc->tx_stats[txq->qnum].len--;
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
                 spin_unlock_bh(&sc->txbuflock);
@@ -2011,10 +2030,8 @@ ath5k_tx_processq(struct ath5k_softc *sc, struct ath5k_txq *txq)
                 }
 
                 ieee80211_tx_status(sc->hw, skb);
-                sc->tx_stats[txq->qnum].count++;
 
                 spin_lock(&sc->txbuflock);
-                sc->tx_stats[txq->qnum].len--;
                 list_move_tail(&bf->list, &sc->txbuf);
                 sc->txbuf_len++;
                 spin_unlock(&sc->txbuflock);
@@ -3116,17 +3133,6 @@ ath5k_get_stats(struct ieee80211_hw *hw,
         return 0;
 }
 
-static int
-ath5k_get_tx_stats(struct ieee80211_hw *hw,
-                struct ieee80211_tx_queue_stats *stats)
-{
-        struct ath5k_softc *sc = hw->priv;
-
-        memcpy(stats, &sc->tx_stats, sizeof(sc->tx_stats));
-
-        return 0;
-}
-
 static u64
 ath5k_get_tsf(struct ieee80211_hw *hw)
 {
diff --git a/drivers/net/wireless/ath/ath5k/base.h b/drivers/net/wireless/ath/ath5k/base.h
index 952b3a21bbc3..7e1a88a5abdb 100644
--- a/drivers/net/wireless/ath/ath5k/base.h
+++ b/drivers/net/wireless/ath/ath5k/base.h
@@ -117,7 +117,6 @@ struct ath5k_softc {
         struct pci_dev          *pdev;          /* for dma mapping */
         void __iomem            *iobase;        /* address of the device */
         struct mutex            lock;           /* dev-level lock */
-        struct ieee80211_tx_queue_stats tx_stats[AR5K_NUM_TX_QUEUES];
         struct ieee80211_low_level_stats ll_stats;
         struct ieee80211_hw     *hw;            /* IEEE 802.11 common */
         struct ieee80211_supported_band sbands[IEEE80211_NUM_BANDS];
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 0ea340fd071c..83c7ea4c007f 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -267,6 +267,7 @@ void ath_tx_aggr_start(struct ath_softc *sc, struct ieee80211_sta *sta,
                        u16 tid, u16 *ssn);
 void ath_tx_aggr_stop(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
 void ath_tx_aggr_resume(struct ath_softc *sc, struct ieee80211_sta *sta, u16 tid);
+void ath9k_enable_ps(struct ath_softc *sc);
 
 /********/
 /* VIFs */
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 422454fe4ff0..d088ebfe63a6 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -577,6 +577,13 @@ static void ath_beacon_config_sta(struct ath_softc *sc,
         u64 tsf;
         int num_beacons, offset, dtim_dec_count, cfp_dec_count;
 
+        /* No need to configure beacon if we are not associated */
+        if (!common->curaid) {
+                ath_print(common, ATH_DBG_BEACON,
+                         "STA is not yet associated..skipping beacon config\n");
+                return;
+        }
+
         memset(&bs, 0, sizeof(bs));
         intval = conf->beacon_interval & ATH9K_BEACON_PERIOD;
 
@@ -739,7 +746,6 @@ void ath_beacon_config(struct ath_softc *sc, struct ieee80211_vif *vif)
         enum nl80211_iftype iftype;
 
         /* Setup the beacon configuration parameters */
-
         if (vif) {
                 struct ieee80211_bss_conf *bss_conf = &vif->bss_conf;
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index f15fee76a4e2..f00f5c744f48 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -1217,6 +1217,17 @@ void ath9k_hw_init_global_settings(struct ath_hw *ah)
         /* As defined by IEEE 802.11-2007 17.3.8.6 */
         slottime = ah->slottime + 3 * ah->coverage_class;
         acktimeout = slottime + sifstime;
+
+        /*
+         * Workaround for early ACK timeouts, add an offset to match the
+         * initval's 64us ack timeout value.
+         * This was initially only meant to work around an issue with delayed
+         * BA frames in some implementations, but it has been found to fix ACK
+         * timeout issues in other cases as well.
+         */
+        if (conf->channel && conf->channel->band == IEEE80211_BAND_2GHZ)
+                acktimeout += 64 - sifstime - ah->slottime;
+
         ath9k_hw_setslottime(ah, slottime);
         ath9k_hw_set_ack_timeout(ah, acktimeout);
         ath9k_hw_set_cts_timeout(ah, acktimeout);
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 4b5e54848683..623c2f884987 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -622,7 +622,8 @@ void ath9k_set_hw_capab(struct ath_softc *sc, struct ieee80211_hw *hw)
                 IEEE80211_HW_SIGNAL_DBM |
                 IEEE80211_HW_SUPPORTS_PS |
                 IEEE80211_HW_PS_NULLFUNC_STACK |
-                IEEE80211_HW_SPECTRUM_MGMT;
+                IEEE80211_HW_SPECTRUM_MGMT |
+                IEEE80211_HW_REPORTS_TX_ACK_STATUS;
 
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_HT)
                  hw->flags |= IEEE80211_HW_AMPDU_AGGREGATION;
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 6796d5cdc293..9c8f925c2093 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -809,6 +809,7 @@ static void ath_key_delete(struct ath_common *common, struct ieee80211_key_conf
 
         clear_bit(key->hw_key_idx + 64, common->keymap);
         if (common->splitmic) {
+                ath9k_hw_keyreset(ah, key->hw_key_idx + 32);
                 clear_bit(key->hw_key_idx + 32, common->keymap);
                 clear_bit(key->hw_key_idx + 64 + 32, common->keymap);
         }
@@ -1492,6 +1493,19 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
         mutex_unlock(&sc->mutex);
 }
 
+void ath9k_enable_ps(struct ath_softc *sc)
+{
+        sc->ps_enabled = true;
+        if (!(sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_AUTOSLEEP)) {
+                if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
+                        sc->imask |= ATH9K_INT_TIM_TIMER;
+                        ath9k_hw_set_interrupts(sc->sc_ah,
+                                        sc->imask);
+                }
+        }
+        ath9k_hw_setrxabort(sc->sc_ah, 1);
+}
+
 static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath_wiphy *aphy = hw->priv;
@@ -1546,22 +1560,13 @@ static int ath9k_config(struct ieee80211_hw *hw, u32 changed)
         if (changed & IEEE80211_CONF_CHANGE_PS) {
                 if (conf->flags & IEEE80211_CONF_PS) {
                         sc->ps_flags |= PS_ENABLED;
-                        if (!(ah->caps.hw_caps &
-                              ATH9K_HW_CAP_AUTOSLEEP)) {
-                                if ((sc->imask & ATH9K_INT_TIM_TIMER) == 0) {
-                                        sc->imask |= ATH9K_INT_TIM_TIMER;
-                                        ath9k_hw_set_interrupts(sc->sc_ah,
-                                                        sc->imask);
-                                }
-                        }
                         /*
                          * At this point we know hardware has received an ACK
                          * of a previously sent null data frame.
                          */
                         if ((sc->ps_flags & PS_NULLFUNC_COMPLETED)) {
                                 sc->ps_flags &= ~PS_NULLFUNC_COMPLETED;
-                                sc->ps_enabled = true;
-                                ath9k_hw_setrxabort(sc->sc_ah, 1);
+                                ath9k_enable_ps(sc);
                         }
                 } else {
                         sc->ps_enabled = false;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 3c790a4f38f7..f5cbbcb9a4aa 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2048,10 +2048,9 @@ static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
                  */
                 if (bf->bf_isnullfunc &&
                     (ds->ds_txstat.ts_status & ATH9K_TX_ACKED)) {
-                        if ((sc->ps_flags & PS_ENABLED)) {
-                                sc->ps_enabled = true;
-                                ath9k_hw_setrxabort(sc->sc_ah, 1);
-                        } else
+                        if ((sc->ps_flags & PS_ENABLED))
+                                ath9k_enable_ps(sc);
+                        else
                                 sc->ps_flags |= PS_NULLFUNC_COMPLETED;
                 }
 
diff --git a/drivers/net/wireless/ath/regd.c b/drivers/net/wireless/ath/regd.c
index 039ac490465c..04abd1f556b7 100644
--- a/drivers/net/wireless/ath/regd.c
+++ b/drivers/net/wireless/ath/regd.c
@@ -110,8 +110,9 @@ static const struct ieee80211_regdomain ath_world_regdom_67_68_6A = {
 
 static inline bool is_wwr_sku(u16 regd)
 {
-        return ((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
-                (regd == WORLD);
+        return ((regd & COUNTRY_ERD_FLAG) != COUNTRY_ERD_FLAG) &&
+                (((regd & WORLD_SKU_MASK) == WORLD_SKU_PREFIX) ||
+                (regd == WORLD));
 }
 
 static u16 ath_regd_get_eepromRD(struct ath_regulatory *reg)
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index 54d6085a887b..6a6ab0f630e5 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -115,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 615af22c49fd..be7abf8916ad 100644
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -1369,7 +1369,6 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
                 b43err(dev->wl, "DMA tx mapping failure\n");
                 goto out;
         }
-        ring->nr_tx_packets++;
         if ((free_slots(ring) < TX_SLOTS_PER_FRAME) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
@@ -1500,22 +1499,6 @@ void b43_dma_handle_txstatus(struct b43_wldev *dev,
         }
 }
 
-void b43_dma_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43_dmaring *ring;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                ring = select_ring_by_priority(dev, i);
-
-                stats[i].len = ring->used_slots / TX_SLOTS_PER_FRAME;
-                stats[i].limit = ring->nr_slots / TX_SLOTS_PER_FRAME;
-                stats[i].count = ring->nr_tx_packets;
-        }
-}
-
 static void dma_rx(struct b43_dmaring *ring, int *slot)
 {
         const struct b43_dma_ops *ops = ring->ops;
diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
index f7ab37c4cdbc..dc91944d6022 100644
--- a/drivers/net/wireless/b43/dma.h
+++ b/drivers/net/wireless/b43/dma.h
@@ -228,8 +228,6 @@ struct b43_dmaring {
         int used_slots;
         /* Currently used slot in the ring. */
         int current_slot;
-        /* Total number of packets sent. Statistics only. */
-        unsigned int nr_tx_packets;
         /* Frameoffset in octets. */
         u32 frameoffset;
         /* Descriptor buffer size. */
@@ -278,9 +276,6 @@ void b43_dma_free(struct b43_wldev *dev);
 void b43_dma_tx_suspend(struct b43_wldev *dev);
 void b43_dma_tx_resume(struct b43_wldev *dev);
 
-void b43_dma_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats);
-
 int b43_dma_tx(struct b43_wldev *dev,
                struct sk_buff *skb);
 void b43_dma_handle_txstatus(struct b43_wldev *dev,
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 316a913860d7..aa33d741e5e6 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -637,10 +637,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
@@ -3349,27 +3356,6 @@ out_unlock:
         return err;
 }
 
-static int b43_op_get_tx_stats(struct ieee80211_hw *hw,
-                               struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43_wl *wl = hw_to_b43_wl(hw);
-        struct b43_wldev *dev;
-        int err = -ENODEV;
-
-        mutex_lock(&wl->mutex);
-        dev = wl->current_dev;
-        if (dev && b43_status(dev) >= B43_STAT_STARTED) {
-                if (b43_using_pio_transfers(dev))
-                        b43_pio_get_tx_stats(dev, stats);
-                else
-                        b43_dma_get_tx_stats(dev, stats);
-                err = 0;
-        }
-        mutex_unlock(&wl->mutex);
-
-        return err;
-}
-
 static int b43_op_get_stats(struct ieee80211_hw *hw,
                             struct ieee80211_low_level_stats *stats)
 {
@@ -3980,6 +3966,7 @@ static int b43_wireless_core_start(struct b43_wldev *dev)
         }
 
         /* We are ready to run. */
+        ieee80211_wake_queues(dev->wl->hw);
         b43_set_status(dev, B43_STAT_STARTED);
 
         /* Start data flow (TX/RX). */
@@ -4389,8 +4376,6 @@ static int b43_wireless_core_init(struct b43_wldev *dev)
 
         ieee80211_wake_queues(dev->wl->hw);
 
-        ieee80211_wake_queues(dev->wl->hw);
-
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
 out:
@@ -4596,7 +4581,6 @@ static const struct ieee80211_ops b43_hw_ops = {
         .set_key                = b43_op_set_key,
         .update_tkip_key        = b43_op_update_tkip_key,
         .get_stats              = b43_op_get_stats,
-        .get_tx_stats           = b43_op_get_tx_stats,
         .get_tsf                = b43_op_get_tsf,
         .set_tsf                = b43_op_set_tsf,
         .start                  = b43_op_start,
diff --git a/drivers/net/wireless/b43/phy_n.c b/drivers/net/wireless/b43/phy_n.c
index 6392da25efed..795bb1e3345d 100644
--- a/drivers/net/wireless/b43/phy_n.c
+++ b/drivers/net/wireless/b43/phy_n.c
@@ -68,6 +68,10 @@ static void b43_nphy_set_rf_sequence(struct b43_wldev *dev, u8 cmd,
                                         u8 *events, u8 *delays, u8 length);
 static void b43_nphy_force_rf_sequence(struct b43_wldev *dev,
                                        enum b43_nphy_rf_sequence seq);
+static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
+                                                u16 value, u8 core, bool off);
+static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
+                                                u16 value, u8 core);
 
 void b43_nphy_set_rxantenna(struct b43_wldev *dev, int antenna)
 {//TODO
@@ -498,8 +502,8 @@ static void b43_nphy_rx_cal_phy_setup(struct b43_wldev *dev, u8 core)
                 b43_phy_set(dev, B43_NPHY_AFECTL_OVER, 0x0007);
         }
 
-        /* TODO: Call N PHY RF Ctrl Intc Override with 2, 0, 3 as arguments */
-        /* TODO: Call N PHY RF Intc Override with 8, 0, 3, 0 as arguments */
+        b43_nphy_rf_control_intc_override(dev, 2, 0, 3);
+        b43_nphy_rf_control_override(dev, 8, 0, 3, false);
         b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RX2TX);
 
         if (core == 0) {
@@ -509,9 +513,8 @@ static void b43_nphy_rx_cal_phy_setup(struct b43_wldev *dev, u8 core)
                 rxval = 4;
                 txval = 2;
         }
-
-        /* TODO: Call N PHY RF Ctrl Intc Override with 1, rxval, (core + 1) */
-        /* TODO: Call N PHY RF Ctrl Intc Override with 1, txval, (2 - core) */
+        b43_nphy_rf_control_intc_override(dev, 1, rxval, (core + 1));
+        b43_nphy_rf_control_intc_override(dev, 1, txval, (2 - core));
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalcRxIqComp */
@@ -714,6 +717,67 @@ static void b43_nphy_stop_playback(struct b43_wldev *dev)
                 b43_nphy_stay_in_carrier_search(dev, 0);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SpurWar */
+static void b43_nphy_spur_workaround(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        unsigned int channel;
+        int tone[2] = { 57, 58 };
+        u32 noise[2] = { 0x3FF, 0x3FF };
+
+        B43_WARN_ON(dev->phy.rev < 3);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        /* FIXME: channel = radio_chanspec */
+
+        if (nphy->gband_spurwar_en) {
+                /* TODO: N PHY Adjust Analog Pfbw (7) */
+                if (channel == 11 && dev->phy.is_40mhz)
+                        ; /* TODO: N PHY Adjust Min Noise Var(2, tone, noise)*/
+                else
+                        ; /* TODO: N PHY Adjust Min Noise Var(0, NULL, NULL)*/
+                /* TODO: N PHY Adjust CRS Min Power (0x1E) */
+        }
+
+        if (nphy->aband_spurwar_en) {
+                if (channel == 54) {
+                        tone[0] = 0x20;
+                        noise[0] = 0x25F;
+                } else if (channel == 38 || channel == 102 || channel == 118) {
+                        if (0 /* FIXME */) {
+                                tone[0] = 0x20;
+                                noise[0] = 0x21F;
+                        } else {
+                                tone[0] = 0;
+                                noise[0] = 0;
+                        }
+                } else if (channel == 134) {
+                        tone[0] = 0x20;
+                        noise[0] = 0x21F;
+                } else if (channel == 151) {
+                        tone[0] = 0x10;
+                        noise[0] = 0x23F;
+                } else if (channel == 153 || channel == 161) {
+                        tone[0] = 0x30;
+                        noise[0] = 0x23F;
+                } else {
+                        tone[0] = 0;
+                        noise[0] = 0;
+                }
+
+                if (!tone[0] && !noise[0])
+                        ; /* TODO: N PHY Adjust Min Noise Var(1, tone, noise)*/
+                else
+                        ; /* TODO: N PHY Adjust Min Noise Var(0, NULL, NULL)*/
+        }
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/WorkaroundsGainCtrl */
 static void b43_nphy_gain_crtl_workarounds(struct b43_wldev *dev)
 {
@@ -953,6 +1017,33 @@ static void b43_nphy_workarounds(struct b43_wldev *dev)
                 b43_nphy_stay_in_carrier_search(dev, 0);
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/LoadSampleTable */
+static int b43_nphy_load_samples(struct b43_wldev *dev,
+                                        struct b43_c32 *samples, u16 len) {
+        struct b43_phy_n *nphy = dev->phy.n;
+        u16 i;
+        u32 *data;
+
+        data = kzalloc(len * sizeof(u32), GFP_KERNEL);
+        if (!data) {
+                b43err(dev->wl, "allocation for samples loading failed\n");
+                return -ENOMEM;
+        }
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        for (i = 0; i < len; i++) {
+                data[i] = (samples[i].i & 0x3FF << 10);
+                data[i] |= samples[i].q & 0x3FF;
+        }
+        b43_ntab_write_bulk(dev, B43_NTAB32(17, 0), len, data);
+
+        kfree(data);
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+        return 0;
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/GenLoadSamples */
 static u16 b43_nphy_gen_load_samples(struct b43_wldev *dev, u32 freq, u16 max,
                                         bool test)
@@ -978,6 +1069,10 @@ static u16 b43_nphy_gen_load_samples(struct b43_wldev *dev, u32 freq, u16 max,
         }
 
         samples = kzalloc(len * sizeof(struct b43_c32), GFP_KERNEL);
+        if (!samples) {
+                b43err(dev->wl, "allocation for samples generation failed\n");
+                return 0;
+        }
         rot = (((freq * 36) / bw) << 16) / 100;
         angle = 0;
 
@@ -988,9 +1083,9 @@ static u16 b43_nphy_gen_load_samples(struct b43_wldev *dev, u32 freq, u16 max,
                 samples[i].i = CORDIC_CONVERT(samples[i].i * max);
         }
 
-        /* TODO: Call N PHY Load Sample Table with buffer, len as arguments */
+        i = b43_nphy_load_samples(dev, samples, len);
         kfree(samples);
-        return len;
+        return (i < 0) ? 0 : len;
 }
 
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RunSamples */
@@ -1264,6 +1359,104 @@ static void b43_nphy_rf_control_override(struct b43_wldev *dev, u16 field,
         }
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RFCtrlIntcOverride */
+static void b43_nphy_rf_control_intc_override(struct b43_wldev *dev, u8 field,
+                                                u16 value, u8 core)
+{
+        u8 i, j;
+        u16 reg, tmp, val;
+
+        B43_WARN_ON(dev->phy.rev < 3);
+        B43_WARN_ON(field > 4);
+
+        for (i = 0; i < 2; i++) {
+                if ((core == 1 && i == 1) || (core == 2 && !i))
+                        continue;
+
+                reg = (i == 0) ?
+                        B43_NPHY_RFCTL_INTC1 : B43_NPHY_RFCTL_INTC2;
+                b43_phy_mask(dev, reg, 0xFBFF);
+
+                switch (field) {
+                case 0:
+                        b43_phy_write(dev, reg, 0);
+                        b43_nphy_force_rf_sequence(dev, B43_RFSEQ_RESET2RX);
+                        break;
+                case 1:
+                        if (!i) {
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_INTC1,
+                                                0xFC3F, (value << 6));
+                                b43_phy_maskset(dev, B43_NPHY_TXF_40CO_B1S1,
+                                                0xFFFE, 1);
+                                b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                                                B43_NPHY_RFCTL_CMD_START);
+                                for (j = 0; j < 100; j++) {
+                                        if (b43_phy_read(dev, B43_NPHY_RFCTL_CMD) & B43_NPHY_RFCTL_CMD_START) {
+                                                j = 0;
+                                                break;
+                                        }
+                                        udelay(10);
+                                }
+                                if (j)
+                                        b43err(dev->wl,
+                                                "intc override timeout\n");
+                                b43_phy_mask(dev, B43_NPHY_TXF_40CO_B1S1,
+                                                0xFFFE);
+                        } else {
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_INTC2,
+                                                0xFC3F, (value << 6));
+                                b43_phy_maskset(dev, B43_NPHY_RFCTL_OVER,
+                                                0xFFFE, 1);
+                                b43_phy_set(dev, B43_NPHY_RFCTL_CMD,
+                                                B43_NPHY_RFCTL_CMD_RXTX);
+                                for (j = 0; j < 100; j++) {
+                                        if (b43_phy_read(dev, B43_NPHY_RFCTL_CMD) & B43_NPHY_RFCTL_CMD_RXTX) {
+                                                j = 0;
+                                                break;
+                                        }
+                                        udelay(10);
+                                }
+                                if (j)
+                                        b43err(dev->wl,
+                                                "intc override timeout\n");
+                                b43_phy_mask(dev, B43_NPHY_RFCTL_OVER,
+                                                0xFFFE);
+                        }
+                        break;
+                case 2:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0020;
+                                val = value << 5;
+                        } else {
+                                tmp = 0x0010;
+                                val = value << 4;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                case 3:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0001;
+                                val = value;
+                        } else {
+                                tmp = 0x0004;
+                                val = value << 2;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                case 4:
+                        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ) {
+                                tmp = 0x0002;
+                                val = value << 1;
+                        } else {
+                                tmp = 0x0008;
+                                val = value << 3;
+                        }
+                        b43_phy_maskset(dev, reg, ~tmp, val);
+                        break;
+                }
+        }
+}
+
 static void b43_nphy_bphy_init(struct b43_wldev *dev)
 {
         unsigned int i;
@@ -2161,9 +2354,9 @@ static void b43_nphy_tx_cal_phy_setup(struct b43_wldev *dev)
                 regs[7] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC1);
                 regs[8] = b43_phy_read(dev, B43_NPHY_RFCTL_INTC2);
 
-                /* TODO: Call N PHY RF Ctrl Intc Override with 2, 1, 3 */
-                /* TODO: Call N PHY RF Ctrl Intc Override with 1, 2, 1 */
-                /* TODO: Call N PHY RF Ctrl Intc Override with 1, 8, 2 */
+                b43_nphy_rf_control_intc_override(dev, 2, 1, 3);
+                b43_nphy_rf_control_intc_override(dev, 1, 2, 1);
+                b43_nphy_rf_control_intc_override(dev, 1, 8, 2);
 
                 regs[9] = b43_phy_read(dev, B43_NPHY_PAPD_EN0);
                 regs[10] = b43_phy_read(dev, B43_NPHY_PAPD_EN1);
@@ -2194,6 +2387,55 @@ static void b43_nphy_tx_cal_phy_setup(struct b43_wldev *dev)
         }
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/SaveCal */
+static void b43_nphy_save_cal(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+
+        struct b43_phy_n_iq_comp *rxcal_coeffs = NULL;
+        u16 *txcal_radio_regs = NULL;
+        u8 *iqcal_chanspec;
+        u16 *table = NULL;
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 1);
+
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_2GHZ) {
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_2G;
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_2G;
+                iqcal_chanspec = &nphy->iqcal_chanspec_2G;
+                table = nphy->cal_cache.txcal_coeffs_2G;
+        } else {
+                rxcal_coeffs = &nphy->cal_cache.rxcal_coeffs_5G;
+                txcal_radio_regs = nphy->cal_cache.txcal_radio_regs_5G;
+                iqcal_chanspec = &nphy->iqcal_chanspec_5G;
+                table = nphy->cal_cache.txcal_coeffs_5G;
+        }
+
+        b43_nphy_rx_iq_coeffs(dev, false, rxcal_coeffs);
+        /* TODO use some definitions */
+        if (dev->phy.rev >= 3) {
+                txcal_radio_regs[0] = b43_radio_read(dev, 0x2021);
+                txcal_radio_regs[1] = b43_radio_read(dev, 0x2022);
+                txcal_radio_regs[2] = b43_radio_read(dev, 0x3021);
+                txcal_radio_regs[3] = b43_radio_read(dev, 0x3022);
+                txcal_radio_regs[4] = b43_radio_read(dev, 0x2023);
+                txcal_radio_regs[5] = b43_radio_read(dev, 0x2024);
+                txcal_radio_regs[6] = b43_radio_read(dev, 0x3023);
+                txcal_radio_regs[7] = b43_radio_read(dev, 0x3024);
+        } else {
+                txcal_radio_regs[0] = b43_radio_read(dev, 0x8B);
+                txcal_radio_regs[1] = b43_radio_read(dev, 0xBA);
+                txcal_radio_regs[2] = b43_radio_read(dev, 0x8D);
+                txcal_radio_regs[3] = b43_radio_read(dev, 0xBC);
+        }
+        *iqcal_chanspec = nphy->radio_chanspec;
+        b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 8, table);
+
+        if (nphy->hang_avoid)
+                b43_nphy_stay_in_carrier_search(dev, 0);
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/RestoreCal */
 static void b43_nphy_restore_cal(struct b43_wldev *dev)
 {
@@ -2486,6 +2728,39 @@ static int b43_nphy_cal_tx_iq_lo(struct b43_wldev *dev,
         return error;
 }
 
+/* http://bcm-v4.sipsolutions.net/802.11/PHY/N/ReapplyTxCalCoeffs */
+static void b43_nphy_reapply_tx_cal_coeffs(struct b43_wldev *dev)
+{
+        struct b43_phy_n *nphy = dev->phy.n;
+        u8 i;
+        u16 buffer[7];
+        bool equal = true;
+
+        if (!nphy->txiqlocal_coeffsvalid || 1 /* FIXME */)
+                return;
+
+        b43_ntab_read_bulk(dev, B43_NTAB16(15, 80), 7, buffer);
+        for (i = 0; i < 4; i++) {
+                if (buffer[i] != nphy->txiqlocal_bestc[i]) {
+                        equal = false;
+                        break;
+                }
+        }
+
+        if (!equal) {
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 80), 4,
+                                        nphy->txiqlocal_bestc);
+                for (i = 0; i < 4; i++)
+                        buffer[i] = 0;
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 88), 4,
+                                        buffer);
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 85), 2,
+                                        &nphy->txiqlocal_bestc[5]);
+                b43_ntab_write_bulk(dev, B43_NTAB16(15, 93), 2,
+                                        &nphy->txiqlocal_bestc[5]);
+        }
+}
+
 /* http://bcm-v4.sipsolutions.net/802.11/PHY/N/CalRxIqRev2 */
 static int b43_nphy_rev2_cal_rx_iq(struct b43_wldev *dev,
                         struct nphy_txgains target, u8 type, bool debug)
@@ -2516,7 +2791,7 @@ static int b43_nphy_rev2_cal_rx_iq(struct b43_wldev *dev,
         b43_nphy_stay_in_carrier_search(dev, 1);
 
         if (dev->phy.rev < 2)
-                ;/* TODO: Call N PHY Reapply TX Cal Coeffs */
+                b43_nphy_reapply_tx_cal_coeffs(dev);
         b43_ntab_read_bulk(dev, B43_NTAB16(7, 0x110), 2, gain_save);
         for (i = 0; i < 2; i++) {
                 b43_nphy_iq_cal_gain_params(dev, i, target, &cal_params[i]);
@@ -2858,7 +3133,7 @@ int b43_phy_initn(struct b43_wldev *dev)
 
         if (!b43_nphy_cal_tx_iq_lo(dev, target, true, false)) {
                 if (b43_nphy_cal_rx_iq(dev, target, 2, 0) == 0)
-                        ;/* Call N PHY Save Cal */
+                        b43_nphy_save_cal(dev);
                 else if (nphy->mphase_cal_phase_id == 0)
                         ;/* N PHY Periodic Calibration with argument 3 */
         } else {
@@ -2872,7 +3147,8 @@ int b43_phy_initn(struct b43_wldev *dev)
         if (phy->rev >= 3 && phy->rev <= 6)
                 b43_phy_write(dev, B43_NPHY_PLOAD_CSENSE_EXTLEN, 0x0014);
         b43_nphy_tx_lp_fbw(dev);
-        /* TODO N PHY Spur Workaround */
+        if (phy->rev >= 3)
+                b43_nphy_spur_workaround(dev);
 
         b43err(dev->wl, "IEEE 802.11n devices are not supported, yet.\n");
         return 0;
diff --git a/drivers/net/wireless/b43/phy_n.h b/drivers/net/wireless/b43/phy_n.h
index ae82f0fc2096..403aad3f894f 100644
--- a/drivers/net/wireless/b43/phy_n.h
+++ b/drivers/net/wireless/b43/phy_n.h
@@ -975,6 +975,7 @@ struct b43_phy_n {
         u16 papd_epsilon_offset[2];
         s32 preamble_override;
         u32 bb_mult_save;
+        u16 radio_chanspec;
 
         bool gain_boost;
         bool elna_gain_config;
@@ -1001,6 +1002,9 @@ struct b43_phy_n {
         u16 classifier_state;
         u16 clip_state[2];
 
+        bool aband_spurwar_en;
+        bool gband_spurwar_en;
+
         bool ipa2g_on;
         u8 iqcal_chanspec_2G;
         u8 rssical_chanspec_2G;
diff --git a/drivers/net/wireless/b43/pio.c b/drivers/net/wireless/b43/pio.c
index c01b8e02412f..a6062c3e89a5 100644
--- a/drivers/net/wireless/b43/pio.c
+++ b/drivers/net/wireless/b43/pio.c
@@ -559,7 +559,6 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
                 b43err(dev->wl, "PIO transmission failure\n");
                 goto out;
         }
-        q->nr_tx_packets++;
 
         B43_WARN_ON(q->buffer_used > q->buffer_size);
         if (((q->buffer_size - q->buffer_used) < roundup(2 + 2 + 6, 4)) ||
@@ -605,22 +604,6 @@ void b43_pio_handle_txstatus(struct b43_wldev *dev,
         }
 }
 
-void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43_pio_txqueue *q;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                q = select_queue_by_priority(dev, i);
-
-                stats[i].len = B43_PIO_MAX_NR_TXPACKETS - q->free_packet_slots;
-                stats[i].limit = B43_PIO_MAX_NR_TXPACKETS;
-                stats[i].count = q->nr_tx_packets;
-        }
-}
-
 /* Returns whether we should fetch another frame. */
 static bool pio_rx_frame(struct b43_pio_rxqueue *q)
 {
diff --git a/drivers/net/wireless/b43/pio.h b/drivers/net/wireless/b43/pio.h
index 7b3c42f93a16..1e516147424f 100644
--- a/drivers/net/wireless/b43/pio.h
+++ b/drivers/net/wireless/b43/pio.h
@@ -90,9 +90,6 @@ struct b43_pio_txqueue {
         struct b43_pio_txpacket packets[B43_PIO_MAX_NR_TXPACKETS];
         struct list_head packets_list;
 
-        /* Total number of transmitted packets. */
-        unsigned int nr_tx_packets;
-
         /* Shortcut to the 802.11 core revision. This is to
          * avoid horrible pointer dereferencing in the fastpaths. */
         u8 rev;
@@ -160,8 +157,6 @@ void b43_pio_free(struct b43_wldev *dev);
 int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb);
 void b43_pio_handle_txstatus(struct b43_wldev *dev,
                              const struct b43_txstatus *status);
-void b43_pio_get_tx_stats(struct b43_wldev *dev,
-                          struct ieee80211_tx_queue_stats *stats);
 void b43_pio_rx(struct b43_pio_rxqueue *q);
 
 void b43_pio_tx_suspend(struct b43_wldev *dev);
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index 0a86bdf53154..8b9387c6ff36 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1411,7 +1411,6 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 b43legacyerr(dev->wl, "DMA tx mapping failure\n");
                 goto out_unlock;
         }
-        ring->nr_tx_packets++;
         if ((free_slots(ring) < SLOTS_PER_PACKET) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
@@ -1527,25 +1526,6 @@ void b43legacy_dma_handle_txstatus(struct b43legacy_wldev *dev,
         spin_unlock(&ring->lock);
 }
 
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43legacy_dmaring *ring;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                ring = priority_to_txring(dev, i);
-
-                spin_lock_irqsave(&ring->lock, flags);
-                stats[i].len = ring->used_slots / SLOTS_PER_PACKET;
-                stats[i].limit = ring->nr_slots / SLOTS_PER_PACKET;
-                stats[i].count = ring->nr_tx_packets;
-                spin_unlock_irqrestore(&ring->lock, flags);
-        }
-}
-
 static void dma_rx(struct b43legacy_dmaring *ring,
                    int *slot)
 {
diff --git a/drivers/net/wireless/b43legacy/dma.h b/drivers/net/wireless/b43legacy/dma.h
index 2f186003c31e..f9681041c2d8 100644
--- a/drivers/net/wireless/b43legacy/dma.h
+++ b/drivers/net/wireless/b43legacy/dma.h
@@ -243,8 +243,6 @@ struct b43legacy_dmaring {
         int used_slots;
         /* Currently used slot in the ring. */
         int current_slot;
-        /* Total number of packets sent. Statistics only. */
-        unsigned int nr_tx_packets;
         /* Frameoffset in octets. */
         u32 frameoffset;
         /* Descriptor buffer size. */
@@ -292,9 +290,6 @@ void b43legacy_dma_free(struct b43legacy_wldev *dev);
 void b43legacy_dma_tx_suspend(struct b43legacy_wldev *dev);
 void b43legacy_dma_tx_resume(struct b43legacy_wldev *dev);
 
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats);
-
 int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb);
 void b43legacy_dma_handle_txstatus(struct b43legacy_wldev *dev,
@@ -315,11 +310,6 @@ void b43legacy_dma_free(struct b43legacy_wldev *dev)
 {
 }
 static inline
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline
 int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb)
 {
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index 874a64a6c610..1d070be5a678 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2446,29 +2446,6 @@ static int b43legacy_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
         return 0;
 }
 
-static int b43legacy_op_get_tx_stats(struct ieee80211_hw *hw,
-                                     struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
-        struct b43legacy_wldev *dev = wl->current_dev;
-        unsigned long flags;
-        int err = -ENODEV;
-
-        if (!dev)
-                goto out;
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        if (likely(b43legacy_status(dev) >= B43legacy_STAT_STARTED)) {
-                if (b43legacy_using_pio(dev))
-                        b43legacy_pio_get_tx_stats(dev, stats);
-                else
-                        b43legacy_dma_get_tx_stats(dev, stats);
-                err = 0;
-        }
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-out:
-        return err;
-}
-
 static int b43legacy_op_get_stats(struct ieee80211_hw *hw,
                                   struct ieee80211_low_level_stats *stats)
 {
@@ -2923,6 +2900,7 @@ static int b43legacy_wireless_core_start(struct b43legacy_wldev *dev)
                 goto out;
         }
         /* We are ready to run. */
+        ieee80211_wake_queues(dev->wl->hw);
         b43legacy_set_status(dev, B43legacy_STAT_STARTED);
 
         /* Start data flow (TX/RX) */
@@ -3343,6 +3321,7 @@ static int b43legacy_wireless_core_init(struct b43legacy_wldev *dev)
         b43legacy_security_init(dev);
         b43legacy_rng_init(wl);
 
+        ieee80211_wake_queues(dev->wl->hw);
         b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
 
         b43legacy_leds_init(dev);
@@ -3511,7 +3490,6 @@ static const struct ieee80211_ops b43legacy_hw_ops = {
         .bss_info_changed       = b43legacy_op_bss_info_changed,
         .configure_filter       = b43legacy_op_configure_filter,
         .get_stats              = b43legacy_op_get_stats,
-        .get_tx_stats           = b43legacy_op_get_tx_stats,
         .start                  = b43legacy_op_start,
         .stop                   = b43legacy_op_stop,
         .set_tim                = b43legacy_op_beacon_set_tim,
diff --git a/drivers/net/wireless/b43legacy/pio.c b/drivers/net/wireless/b43legacy/pio.c
index 51866c9a2769..017c0e9c37ef 100644
--- a/drivers/net/wireless/b43legacy/pio.c
+++ b/drivers/net/wireless/b43legacy/pio.c
@@ -477,7 +477,6 @@ int b43legacy_pio_tx(struct b43legacy_wldev *dev,
 
         list_move_tail(&packet->list, &queue->txqueue);
         queue->nr_txfree--;
-        queue->nr_tx_packets++;
         B43legacy_WARN_ON(queue->nr_txfree >= B43legacy_PIO_MAXTXPACKETS);
 
         tasklet_schedule(&queue->txtask);
@@ -546,18 +545,6 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
                 tasklet_schedule(&queue->txtask);
 }
 
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                                struct ieee80211_tx_queue_stats *stats)
-{
-        struct b43legacy_pio *pio = &dev->pio;
-        struct b43legacy_pioqueue *queue;
-
-        queue = pio->queue1;
-        stats[0].len = B43legacy_PIO_MAXTXPACKETS - queue->nr_txfree;
-        stats[0].limit = B43legacy_PIO_MAXTXPACKETS;
-        stats[0].count = queue->nr_tx_packets;
-}
-
 static void pio_rx_error(struct b43legacy_pioqueue *queue,
                          int clear_buffers,
                          const char *error)
diff --git a/drivers/net/wireless/b43legacy/pio.h b/drivers/net/wireless/b43legacy/pio.h
index 464fec05a06d..8e6773ea6e75 100644
--- a/drivers/net/wireless/b43legacy/pio.h
+++ b/drivers/net/wireless/b43legacy/pio.h
@@ -74,10 +74,6 @@ struct b43legacy_pioqueue {
          * posted to the device. We are waiting for the txstatus.
          */
         struct list_head txrunning;
-        /* Total number or packets sent.
-         * (This counter can obviously wrap).
-         */
-        unsigned int nr_tx_packets;
         struct tasklet_struct txtask;
         struct b43legacy_pio_txpacket
                          tx_packets_cache[B43legacy_PIO_MAXTXPACKETS];
@@ -106,8 +102,6 @@ int b43legacy_pio_tx(struct b43legacy_wldev *dev,
                    struct sk_buff *skb);
 void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
                                  const struct b43legacy_txstatus *status);
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats);
 void b43legacy_pio_rx(struct b43legacy_pioqueue *queue);
 
 /* Suspend TX queue in hardware. */
@@ -140,11 +134,6 @@ void b43legacy_pio_handle_txstatus(struct b43legacy_wldev *dev,
 {
 }
 static inline
-void b43legacy_pio_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-}
-static inline
 void b43legacy_pio_rx(struct b43legacy_pioqueue *queue)
 {
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-1000.c b/drivers/net/wireless/iwlwifi/iwl-1000.c
index 9d1820676f30..694ceef88590 100644
--- a/drivers/net/wireless/iwlwifi/iwl-1000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-1000.c
@@ -247,6 +247,7 @@ struct iwl_cfg iwl1000_bgn_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl1000_bg_cfg = {
@@ -274,6 +275,7 @@ struct iwl_cfg iwl1000_bg_cfg = {
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 MODULE_FIRMWARE(IWL1000_MODULE_FIRMWARE(IWL1000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 6d5988901341..f3d662c8cbcf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -179,14 +179,24 @@ static void iwl5000_gain_computation(struct iwl_priv *priv,
                         data->delta_gain_code[i] = 0;
                         continue;
                 }
-                delta_g = (1000 * ((s32)average_noise[default_chain] -
+
+                delta_g = (priv->cfg->chain_noise_scale *
+                        ((s32)average_noise[default_chain] -
                         (s32)average_noise[i])) / 1500;
+
                 /* bound gain by 2 bits value max, 3rd bit is sign */
                 data->delta_gain_code[i] =
                         min(abs(delta_g), (long) CHAIN_NOISE_MAX_DELTA_GAIN_CODE);
 
                 if (delta_g < 0)
-                        /* set negative sign */
+                        /*
+                         * set negative sign ...
+                         * note to Intel developers:  This is uCode API format,
+                         *   not the format of any internal device registers.
+                         *   Do not change this format for e.g. 6050 or similar
+                         *   devices.  Change format only if more resolution
+                         *   (i.e. more than 2 bits magnitude) is needed.
+                         */
                         data->delta_gain_code[i] |= (1 << 2);
         }
 
@@ -1587,6 +1597,7 @@ struct iwl_cfg iwl5300_agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5100_bgn_cfg = {
@@ -1612,6 +1623,7 @@ struct iwl_cfg iwl5100_bgn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5100_abg_cfg = {
@@ -1635,6 +1647,7 @@ struct iwl_cfg iwl5100_abg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5100_agn_cfg = {
@@ -1660,6 +1673,7 @@ struct iwl_cfg iwl5100_agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5350_agn_cfg = {
@@ -1685,6 +1699,7 @@ struct iwl_cfg iwl5350_agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5150_agn_cfg = {
@@ -1710,6 +1725,7 @@ struct iwl_cfg iwl5150_agn_cfg = {
         .use_rts_for_ht = true, /* use rts/cts protection */
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl5150_abg_cfg = {
@@ -1733,6 +1749,7 @@ struct iwl_cfg iwl5150_abg_cfg = {
         .led_compensation = 51,
         .chain_noise_num_beacons = IWL_CAL_NUM_BEACONS,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_LONG_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 MODULE_FIRMWARE(IWL5000_MODULE_FIRMWARE(IWL5000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index a9f8551e0e40..782e23a26984 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -277,21 +277,6 @@ static const struct iwl_ops iwl6000_ops = {
         .led = &iwlagn_led_ops,
 };
 
-static struct iwl_hcmd_utils_ops iwl6050_hcmd_utils = {
-        .get_hcmd_size = iwl5000_get_hcmd_size,
-        .build_addsta_hcmd = iwl5000_build_addsta_hcmd,
-        .rts_tx_cmd_flag = iwl5000_rts_tx_cmd_flag,
-        .calc_rssi = iwl5000_calc_rssi,
-};
-
-static const struct iwl_ops iwl6050_ops = {
-        .ucode = &iwl5000_ucode,
-        .lib = &iwl6000_lib,
-        .hcmd = &iwl5000_hcmd,
-        .utils = &iwl6050_hcmd_utils,
-        .led = &iwlagn_led_ops,
-};
-
 /*
  * "i": Internal configuration, use internal Power Amplifier
  */
@@ -324,6 +309,7 @@ struct iwl_cfg iwl6000i_2agn_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl6000i_2abg_cfg = {
@@ -354,6 +340,7 @@ struct iwl_cfg iwl6000i_2abg_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl6000i_2bg_cfg = {
@@ -384,6 +371,7 @@ struct iwl_cfg iwl6000i_2bg_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 struct iwl_cfg iwl6050_2agn_cfg = {
@@ -392,7 +380,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G|IWL_SKU_N,
-        .ops = &iwl6050_ops,
+        .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
@@ -415,6 +403,7 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 
 struct iwl_cfg iwl6050_2abg_cfg = {
@@ -423,7 +412,7 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .ucode_api_max = IWL6050_UCODE_API_MAX,
         .ucode_api_min = IWL6050_UCODE_API_MIN,
         .sku = IWL_SKU_A|IWL_SKU_G,
-        .ops = &iwl6050_ops,
+        .ops = &iwl6000_ops,
         .eeprom_size = OTP_LOW_IMAGE_SIZE,
         .eeprom_ver = EEPROM_6050_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
@@ -445,6 +434,7 @@ struct iwl_cfg iwl6050_2abg_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1500,
 };
 
 struct iwl_cfg iwl6000_3agn_cfg = {
@@ -476,6 +466,7 @@ struct iwl_cfg iwl6000_3agn_cfg = {
         .adv_thermal_throttle = true,
         .support_ct_kill_exit = true,
         .plcp_delta_threshold = IWL_MAX_PLCP_ERR_THRESHOLD_DEF,
+        .chain_noise_scale = 1000,
 };
 
 MODULE_FIRMWARE(IWL6000_MODULE_FIRMWARE(IWL6000_UCODE_API_MAX));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index d0268280d679..1854c720b5e0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -2631,7 +2631,7 @@ static int iwl_mac_setup_register(struct iwl_priv *priv)
          */
         hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
 
-        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX;
+        hw->wiphy->max_scan_ssids = PROBE_OPTION_MAX + 1;
         /* we create the 802.11 header and a zero-length SSID element */
         hw->wiphy->max_scan_ie_len = IWL_MAX_PROBE_REQUEST - 24 - 2;
 
@@ -3440,7 +3440,6 @@ static struct ieee80211_ops iwl_hw_ops = {
         .set_key = iwl_mac_set_key,
         .update_tkip_key = iwl_mac_update_tkip_key,
         .get_stats = iwl_mac_get_stats,
-        .get_tx_stats = iwl_mac_get_tx_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 02bf17ecaf54..d390eef2efe5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2787,6 +2787,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                 if ((le16_to_cpu(priv->staging_rxon.channel) != ch))
                         priv->staging_rxon.flags = 0;
 
+                iwl_set_rxon_ht(priv, ht_conf);
                 iwl_set_rxon_channel(priv, conf->channel);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
@@ -2850,42 +2851,6 @@ out:
 }
 EXPORT_SYMBOL(iwl_mac_config);
 
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats)
-{
-        struct iwl_priv *priv = hw->priv;
-        int i, avail;
-        struct iwl_tx_queue *txq;
-        struct iwl_queue *q;
-        unsigned long flags;
-
-        IWL_DEBUG_MAC80211(priv, "enter\n");
-
-        if (!iwl_is_ready_rf(priv)) {
-                IWL_DEBUG_MAC80211(priv, "leave - RF not ready\n");
-                return -EIO;
-        }
-
-        spin_lock_irqsave(&priv->lock, flags);
-
-        for (i = 0; i < AC_NUM; i++) {
-                txq = &priv->txq[i];
-                q = &txq->q;
-                avail = iwl_queue_space(q);
-
-                stats[i].len = q->n_window - avail;
-                stats[i].limit = q->n_window - q->high_mark;
-                stats[i].count = q->n_window;
-
-        }
-        spin_unlock_irqrestore(&priv->lock, flags);
-
-        IWL_DEBUG_MAC80211(priv, "leave\n");
-
-        return 0;
-}
-EXPORT_SYMBOL(iwl_mac_get_tx_stats);
-
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw)
 {
         struct iwl_priv *priv = hw->priv;
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index ec1fe1d7cc9a..8f0c564e68b0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -293,6 +293,7 @@ struct iwl_cfg {
         bool support_ct_kill_exit;
         const bool support_wimax_coexist;
         u8 plcp_delta_threshold;
+        s32 chain_noise_scale;
 };
 
 /***************************
@@ -341,8 +342,6 @@ void iwl_mac_remove_interface(struct ieee80211_hw *hw,
                               struct ieee80211_vif *vif);
 int iwl_mac_config(struct ieee80211_hw *hw, u32 changed);
 void iwl_config_ap(struct iwl_priv *priv);
-int iwl_mac_get_tx_stats(struct ieee80211_hw *hw,
-                         struct ieee80211_tx_queue_stats *stats);
 void iwl_mac_reset_tsf(struct ieee80211_hw *hw);
 int iwl_alloc_txq_mem(struct iwl_priv *priv);
 void iwl_free_txq_mem(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 08faafae8497..f786a407638f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -651,9 +651,20 @@ u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
         if (left < 0)
                 return 0;
         *pos++ = WLAN_EID_SSID;
-        *pos++ = 0;
-
-        len += 2;
+        if (!priv->is_internal_short_scan &&
+            priv->scan_request->n_ssids) {
+                struct cfg80211_ssid *ssid =
+                        priv->scan_request->ssids;
+
+                /* Broadcast if ssid_len is 0 */
+                *pos++ = ssid->ssid_len;
+                memcpy(pos, ssid->ssid, ssid->ssid_len);
+                pos += ssid->ssid_len;
+                len += 2 + ssid->ssid_len;
+        } else {
+                *pos++ = 0;
+                len += 2;
+        }
 
         if (WARN_ON(left < ie_len))
                 return len;
@@ -782,20 +793,26 @@ static void iwl_bg_request_scan(struct work_struct *data)
         if (priv->is_internal_short_scan) {
                 IWL_DEBUG_SCAN(priv, "Start internal passive scan.\n");
         } else if (priv->scan_request->n_ssids) {
-                int i, p = 0;
                 IWL_DEBUG_SCAN(priv, "Kicking off active scan\n");
-                for (i = 0; i < priv->scan_request->n_ssids; i++) {
-                        /* always does wildcard anyway */
-                        if (!priv->scan_request->ssids[i].ssid_len)
-                                continue;
-                        scan->direct_scan[p].id = WLAN_EID_SSID;
-                        scan->direct_scan[p].len =
-                                priv->scan_request->ssids[i].ssid_len;
-                        memcpy(scan->direct_scan[p].ssid,
-                               priv->scan_request->ssids[i].ssid,
-                               priv->scan_request->ssids[i].ssid_len);
-                        n_probes++;
-                        p++;
+                /*
+                 * The first SSID to scan is stuffed into the probe request
+                 * template and the remaining ones are handled through the
+                 * direct_scan array.
+                 */
+                if (priv->scan_request->n_ssids > 1) {
+                        int i, p = 0;
+                        for (i = 1; i < priv->scan_request->n_ssids; i++) {
+                                if (!priv->scan_request->ssids[i].ssid_len)
+                                        continue;
+                                scan->direct_scan[p].id = WLAN_EID_SSID;
+                                scan->direct_scan[p].len =
+                                        priv->scan_request->ssids[i].ssid_len;
+                                memcpy(scan->direct_scan[p].ssid,
+                                       priv->scan_request->ssids[i].ssid,
+                                       priv->scan_request->ssids[i].ssid_len);
+                                n_probes++;
+                                p++;
+                        }
                 }
                 is_active = true;
         } else
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 119da54116de..eac2b9a95711 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3835,7 +3835,6 @@ static struct ieee80211_ops iwl3945_hw_ops = {
         .config = iwl_mac_config,
         .configure_filter = iwl_configure_filter,
         .set_key = iwl3945_mac_set_key,
-        .get_tx_stats = iwl_mac_get_tx_stats,
         .conf_tx = iwl_mac_conf_tx,
         .reset_tsf = iwl_mac_reset_tsf,
         .bss_info_changed = iwl_bss_info_changed,
diff --git a/drivers/net/wireless/libertas/cmdresp.c b/drivers/net/wireless/libertas/cmdresp.c
index 0334a58820ee..e7470442f76b 100644
--- a/drivers/net/wireless/libertas/cmdresp.c
+++ b/drivers/net/wireless/libertas/cmdresp.c
@@ -240,11 +240,6 @@ int lbs_process_command_response(struct lbs_private *priv, u8 *data, u32 len)
         /* Now we got response from FW, cancel the command timer */
         del_timer(&priv->command_timer);
         priv->cmd_timed_out = 0;
-        if (priv->nr_retries) {
-                lbs_pr_info("Received result %x to command %x after %d retries\n",
-                            result, curcmd, priv->nr_retries);
-                priv->nr_retries = 0;
-        }
 
         /* Store the response code to cur_cmd_retcode. */
         priv->cur_cmd_retcode = result;
diff --git a/drivers/net/wireless/libertas/dev.h b/drivers/net/wireless/libertas/dev.h
index c348aff8f309..6977ee820214 100644
--- a/drivers/net/wireless/libertas/dev.h
+++ b/drivers/net/wireless/libertas/dev.h
@@ -109,7 +109,6 @@ struct lbs_private {
         struct list_head cmdpendingq; /* pending command buffers */
         wait_queue_head_t cmd_pending;
         struct timer_list command_timer;
-        int nr_retries;
         int cmd_timed_out;
 
         /* Command responses sent from the hardware to the driver */
diff --git a/drivers/net/wireless/libertas/if_spi.c b/drivers/net/wireless/libertas/if_spi.c
index bf4bfbae6227..3ea03f259ee7 100644
--- a/drivers/net/wireless/libertas/if_spi.c
+++ b/drivers/net/wireless/libertas/if_spi.c
@@ -23,6 +23,7 @@
 #include <linux/kthread.h>
 #include <linux/list.h>
 #include <linux/netdevice.h>
+#include <linux/semaphore.h>
 #include <linux/spi/libertas_spi.h>
 #include <linux/spi/spi.h>
 
diff --git a/drivers/net/wireless/libertas/main.c b/drivers/net/wireless/libertas/main.c
index 60bde1233a30..cd8ed7fdafad 100644
--- a/drivers/net/wireless/libertas/main.c
+++ b/drivers/net/wireless/libertas/main.c
@@ -536,31 +536,14 @@ static int lbs_thread(void *data)
                 if (priv->cmd_timed_out && priv->cur_cmd) {
                         struct cmd_ctrl_node *cmdnode = priv->cur_cmd;
 
-                        if (++priv->nr_retries > 3) {
-                                lbs_pr_info("Excessive timeouts submitting "
-                                        "command 0x%04x\n",
-                                        le16_to_cpu(cmdnode->cmdbuf->command));
-                                lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
-                                priv->nr_retries = 0;
-                                if (priv->reset_card)
-                                        priv->reset_card(priv);
-                        } else {
-                                priv->cur_cmd = NULL;
-                                priv->dnld_sent = DNLD_RES_RECEIVED;
-                                lbs_pr_info("requeueing command 0x%04x due "
-                                        "to timeout (#%d)\n",
-                                        le16_to_cpu(cmdnode->cmdbuf->command),
-                                        priv->nr_retries);
-
-                                /* Stick it back at the _top_ of the pending queue
-                                   for immediate resubmission */
-                                list_add(&cmdnode->list, &priv->cmdpendingq);
-                        }
+                        lbs_pr_info("Timeout submitting command 0x%04x\n",
+                                le16_to_cpu(cmdnode->cmdbuf->command));
+                        lbs_complete_command(priv, cmdnode, -ETIMEDOUT);
+                        if (priv->reset_card)
+                                priv->reset_card(priv);
                 }
                 priv->cmd_timed_out = 0;
 
-
-
                 if (!priv->fw_ready)
                         continue;
 
@@ -732,7 +715,7 @@ done:
  *  This function handles the timeout of command sending.
  *  It will re-send the same command again.
  */
-static void command_timer_fn(unsigned long data)
+static void lbs_cmd_timeout_handler(unsigned long data)
 {
         struct lbs_private *priv = (struct lbs_private *)data;
         unsigned long flags;
@@ -851,7 +834,7 @@ static int lbs_init_adapter(struct lbs_private *priv)
 
         mutex_init(&priv->lock);
 
-        setup_timer(&priv->command_timer, command_timer_fn,
+        setup_timer(&priv->command_timer, lbs_cmd_timeout_handler,
                 (unsigned long)priv);
         setup_timer(&priv->auto_deepsleep_timer, auto_deepsleep_timer_fn,
                         (unsigned long)priv);
diff --git a/drivers/net/wireless/libertas_tf/main.c b/drivers/net/wireless/libertas_tf/main.c
index ba3eb0101d55..6ab30033c26c 100644
--- a/drivers/net/wireless/libertas_tf/main.c
+++ b/drivers/net/wireless/libertas_tf/main.c
@@ -555,6 +555,9 @@ struct lbtf_private *lbtf_add_card(void *card, struct device *dmdev)
         priv->band.n_channels = ARRAY_SIZE(lbtf_channels);
         priv->band.channels = priv->channels;
         hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+        hw->wiphy->interface_modes =
+                BIT(NL80211_IFTYPE_STATION) |
+                BIT(NL80211_IFTYPE_ADHOC);
         skb_queue_head_init(&priv->bc_ps_buf);
 
         SET_IEEE80211_DEV(hw, dmdev);
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 0dbda8dfbd99..00ffe6dd435e 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -32,6 +32,10 @@ static int radios = 2;
 module_param(radios, int, 0444);
 MODULE_PARM_DESC(radios, "Number of simulated radios");
 
+static bool fake_hw_scan;
+module_param(fake_hw_scan, bool, 0444);
+MODULE_PARM_DESC(fake_hw_scan, "Install fake (no-op) hw-scan handler");
+
 /**
  * enum hwsim_regtest - the type of regulatory tests we offer
  *
@@ -908,8 +912,43 @@ static void mac80211_hwsim_flush(struct ieee80211_hw *hw, bool drop)
          */
 }
 
+struct hw_scan_done {
+        struct delayed_work w;
+        struct ieee80211_hw *hw;
+};
 
-static const struct ieee80211_ops mac80211_hwsim_ops =
+static void hw_scan_done(struct work_struct *work)
+{
+        struct hw_scan_done *hsd =
+                container_of(work, struct hw_scan_done, w.work);
+
+        ieee80211_scan_completed(hsd->hw, false);
+        kfree(hsd);
+}
+
+static int mac80211_hwsim_hw_scan(struct ieee80211_hw *hw,
+                                  struct cfg80211_scan_request *req)
+{
+        struct hw_scan_done *hsd = kzalloc(sizeof(*hsd), GFP_KERNEL);
+        int i;
+
+        if (!hsd)
+                return -ENOMEM;
+
+        hsd->hw = hw;
+        INIT_DELAYED_WORK(&hsd->w, hw_scan_done);
+
+        printk(KERN_DEBUG "hwsim scan request\n");
+        for (i = 0; i < req->n_channels; i++)
+                printk(KERN_DEBUG "hwsim scan freq %d\n",
+                        req->channels[i]->center_freq);
+
+        ieee80211_queue_delayed_work(hw, &hsd->w, 2 * HZ);
+
+        return 0;
+}
+
+static struct ieee80211_ops mac80211_hwsim_ops =
 {
         .tx = mac80211_hwsim_tx,
         .start = mac80211_hwsim_start,
@@ -1119,6 +1158,9 @@ static int __init init_mac80211_hwsim(void)
         if (radios < 1 || radios > 100)
                 return -EINVAL;
 
+        if (fake_hw_scan)
+                mac80211_hwsim_ops.hw_scan = mac80211_hwsim_hw_scan;
+
         spin_lock_init(&hwsim_radio_lock);
         INIT_LIST_HEAD(&hwsim_radios);
 
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index f0f08f3919cc..0cfdb9db66f7 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -119,7 +119,7 @@ struct mwl8k_tx_queue {
         /* sw appends here */
         int tail;
 
-        struct ieee80211_tx_queue_stats stats;
+        unsigned int len;
         struct mwl8k_tx_desc *txd;
         dma_addr_t txd_dma;
         struct sk_buff **skb;
@@ -1136,8 +1136,7 @@ static int mwl8k_txq_init(struct ieee80211_hw *hw, int index)
         int size;
         int i;
 
-        memset(&txq->stats, 0, sizeof(struct ieee80211_tx_queue_stats));
-        txq->stats.limit = MWL8K_TX_DESCS;
+        txq->len = 0;
         txq->head = 0;
         txq->tail = 0;
 
@@ -1213,7 +1212,7 @@ static void mwl8k_dump_tx_rings(struct ieee80211_hw *hw)
                 printk(KERN_ERR "%s: txq[%d] len=%d head=%d tail=%d "
                        "fw_owned=%d drv_owned=%d unused=%d\n",
                        wiphy_name(hw->wiphy), i,
-                       txq->stats.len, txq->head, txq->tail,
+                       txq->len, txq->head, txq->tail,
                        fw_owned, drv_owned, unused);
         }
 }
@@ -1299,7 +1298,7 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
         int processed;
 
         processed = 0;
-        while (txq->stats.len > 0 && limit--) {
+        while (txq->len > 0 && limit--) {
                 int tx;
                 struct mwl8k_tx_desc *tx_desc;
                 unsigned long addr;
@@ -1321,8 +1320,8 @@ mwl8k_txq_reclaim(struct ieee80211_hw *hw, int index, int limit, int force)
                 }
 
                 txq->head = (tx + 1) % MWL8K_TX_DESCS;
-                BUG_ON(txq->stats.len == 0);
-                txq->stats.len--;
+                BUG_ON(txq->len == 0);
+                txq->len--;
                 priv->pending_tx_pkts--;
 
                 addr = le32_to_cpu(tx_desc->pkt_phys_addr);
@@ -1454,8 +1453,7 @@ mwl8k_txq_xmit(struct ieee80211_hw *hw, int index, struct sk_buff *skb)
         wmb();
         tx->status = cpu_to_le32(MWL8K_TXD_STATUS_FW_OWNED | txstatus);
 
-        txq->stats.count++;
-        txq->stats.len++;
+        txq->len++;
         priv->pending_tx_pkts++;
 
         txq->tail++;
@@ -3818,24 +3816,6 @@ static int mwl8k_conf_tx(struct ieee80211_hw *hw, u16 queue,
         return rc;
 }
 
-static int mwl8k_get_tx_stats(struct ieee80211_hw *hw,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_tx_queue *txq;
-        int index;
-
-        spin_lock_bh(&priv->tx_lock);
-        for (index = 0; index < MWL8K_TX_QUEUES; index++) {
-                txq = priv->txq + index;
-                memcpy(&stats[index], &txq->stats,
-                        sizeof(struct ieee80211_tx_queue_stats));
-        }
-        spin_unlock_bh(&priv->tx_lock);
-
-        return 0;
-}
-
 static int mwl8k_get_stats(struct ieee80211_hw *hw,
                            struct ieee80211_low_level_stats *stats)
 {
@@ -3871,7 +3851,6 @@ static const struct ieee80211_ops mwl8k_ops = {
         .set_rts_threshold      = mwl8k_set_rts_threshold,
         .sta_notify             = mwl8k_sta_notify,
         .conf_tx                = mwl8k_conf_tx,
-        .get_tx_stats           = mwl8k_get_tx_stats,
         .get_stats              = mwl8k_get_stats,
         .ampdu_action           = mwl8k_ampdu_action,
 };
diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c
index 26428e4c9c60..3fe6366e567c 100644
--- a/drivers/net/wireless/p54/main.c
+++ b/drivers/net/wireless/p54/main.c
@@ -358,16 +358,6 @@ static int p54_get_stats(struct ieee80211_hw *dev,
         return 0;
 }
 
-static int p54_get_tx_stats(struct ieee80211_hw *dev,
-                            struct ieee80211_tx_queue_stats *stats)
-{
-        struct p54_common *priv = dev->priv;
-
-        memcpy(stats, &priv->tx_stats[P54_QUEUE_DATA],
-               sizeof(stats[0]) * dev->queues);
-        return 0;
-}
-
 static void p54_bss_info_changed(struct ieee80211_hw *dev,
                                  struct ieee80211_vif *vif,
                                  struct ieee80211_bss_conf *info,
@@ -522,7 +512,6 @@ static const struct ieee80211_ops p54_ops = {
         .configure_filter       = p54_configure_filter,
         .conf_tx                = p54_conf_tx,
         .get_stats              = p54_get_stats,
-        .get_tx_stats           = p54_get_tx_stats
 };
 
 struct ieee80211_hw *p54_init_common(size_t priv_data_len)
diff --git a/drivers/net/wireless/p54/p54.h b/drivers/net/wireless/p54/p54.h
index 1afc39410e85..43a3b2ead81a 100644
--- a/drivers/net/wireless/p54/p54.h
+++ b/drivers/net/wireless/p54/p54.h
@@ -157,6 +157,12 @@ struct p54_led_dev {
 
 #endif /* CONFIG_P54_LEDS */
 
+struct p54_tx_queue_stats {
+        unsigned int len;
+        unsigned int limit;
+        unsigned int count;
+};
+
 struct p54_common {
         struct ieee80211_hw *hw;
         struct ieee80211_vif *vif;
@@ -183,7 +189,7 @@ struct p54_common {
         /* (e)DCF / QOS state */
         bool use_short_slot;
         spinlock_t tx_stats_lock;
-        struct ieee80211_tx_queue_stats tx_stats[8];
+        struct p54_tx_queue_stats tx_stats[8];
         struct p54_edcf_queue_param qos_params[8];
 
         /* Radio data */
diff --git a/drivers/net/wireless/p54/txrx.c b/drivers/net/wireless/p54/txrx.c
index b6dda2b27fb5..0e8f69461ffe 100644
--- a/drivers/net/wireless/p54/txrx.c
+++ b/drivers/net/wireless/p54/txrx.c
@@ -183,7 +183,7 @@ static int p54_tx_qos_accounting_alloc(struct p54_common *priv,
                                        struct sk_buff *skb,
                                        const u16 p54_queue)
 {
-        struct ieee80211_tx_queue_stats *queue;
+        struct p54_tx_queue_stats *queue;
         unsigned long flags;
 
         if (WARN_ON(p54_queue > P54_QUEUE_NUM))
diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index aa579eb8723f..108982762d45 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1561,7 +1561,6 @@ static const struct ieee80211_ops rt2400pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2400pci_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2400pci_get_tsf,
         .tx_last_beacon         = rt2400pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 77ee1df7933f..f6440bb0e5f6 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1859,7 +1859,6 @@ static const struct ieee80211_ops rt2500pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2x00mac_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2500pci_get_tsf,
         .tx_last_beacon         = rt2500pci_tx_last_beacon,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index 9e6f865c57f2..81ca4ec068db 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1761,7 +1761,6 @@ static const struct ieee80211_ops rt2500usb_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2x00mac_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
 
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 529a37364eb0..a45e027f2d1f 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -2297,7 +2297,6 @@ const struct ieee80211_ops rt2800_mac80211_ops = {
         .set_rts_threshold      = rt2800_set_rts_threshold,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt2800_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt2800_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index 096da85a66fa..43b70c6e4e9c 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -1044,8 +1044,6 @@ int rt2x00mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
 #endif /* CONFIG_RT2X00_LIB_CRYPTO */
 int rt2x00mac_get_stats(struct ieee80211_hw *hw,
                         struct ieee80211_low_level_stats *stats);
-int rt2x00mac_get_tx_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_tx_queue_stats *stats);
 void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_bss_conf *bss_conf,
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 00f1f939f1bb..abbd857ec759 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -555,22 +555,6 @@ int rt2x00mac_get_stats(struct ieee80211_hw *hw,
 }
 EXPORT_SYMBOL_GPL(rt2x00mac_get_stats);
 
-int rt2x00mac_get_tx_stats(struct ieee80211_hw *hw,
-                           struct ieee80211_tx_queue_stats *stats)
-{
-        struct rt2x00_dev *rt2x00dev = hw->priv;
-        unsigned int i;
-
-        for (i = 0; i < rt2x00dev->ops->tx_queues; i++) {
-                stats[i].len = rt2x00dev->tx[i].length;
-                stats[i].limit = rt2x00dev->tx[i].limit;
-                stats[i].count = rt2x00dev->tx[i].count;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL_GPL(rt2x00mac_get_tx_stats);
-
 void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
                                 struct ieee80211_vif *vif,
                                 struct ieee80211_bss_conf *bss_conf,
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 1f97a797bc41..74de53e68b4e 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2730,7 +2730,6 @@ static const struct ieee80211_ops rt61pci_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt61pci_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt61pci_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index a02691294395..3781eb7b4aa0 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -2245,7 +2245,6 @@ static const struct ieee80211_ops rt73usb_mac80211_ops = {
         .get_stats              = rt2x00mac_get_stats,
         .bss_info_changed       = rt2x00mac_bss_info_changed,
         .conf_tx                = rt73usb_conf_tx,
-        .get_tx_stats           = rt2x00mac_get_tx_stats,
         .get_tsf                = rt73usb_get_tsf,
         .rfkill_poll            = rt2x00mac_rfkill_poll,
 };
diff --git a/drivers/net/wireless/wl12xx/wl1251_main.c b/drivers/net/wireless/wl12xx/wl1251_main.c
index a717dde4822e..24ae6a360ac8 100644
--- a/drivers/net/wireless/wl12xx/wl1251_main.c
+++ b/drivers/net/wireless/wl12xx/wl1251_main.c
@@ -1144,9 +1144,10 @@ static int wl1251_op_conf_tx(struct ieee80211_hw *hw, u16 queue,
         if (ret < 0)
                 goto out;
 
+        /* mac80211 uses units of 32 usec */
         ret = wl1251_acx_ac_cfg(wl, wl1251_tx_get_queue(queue),
                                 params->cw_min, params->cw_max,
-                                params->aifs, params->txop);
+                                params->aifs, params->txop * 32);
         if (ret < 0)
                 goto out_sleep;