Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

26 files changed, 471 insertions, 220 deletions

diff --git a/drivers/net/wireless/at76c50x-usb.c b/drivers/net/wireless/at76c50x-usb.c
index 5ad74c85a038..3df0146b797e 100644
--- a/drivers/net/wireless/at76c50x-usb.c
+++ b/drivers/net/wireless/at76c50x-usb.c
@@ -1122,12 +1122,12 @@ exit:
 static void at76_dump_mib_local(struct at76_priv *priv)
 {
         int ret;
-        struct mib_local *m = kmalloc(sizeof(struct mib_phy), GFP_KERNEL);
+        struct mib_local *m = kmalloc(sizeof(*m), GFP_KERNEL);
 
         if (!m)
                 return;
 
-        ret = at76_get_mib(priv->udev, MIB_LOCAL, m, sizeof(struct mib_local));
+        ret = at76_get_mib(priv->udev, MIB_LOCAL, m, sizeof(*m));
         if (ret < 0) {
                 wiphy_err(priv->hw->wiphy,
                           "at76_get_mib (LOCAL) failed: %d\n", ret);
diff --git a/drivers/net/wireless/brcm80211/Kconfig b/drivers/net/wireless/brcm80211/Kconfig
index c5104533e24e..b480088b3dbe 100644
--- a/drivers/net/wireless/brcm80211/Kconfig
+++ b/drivers/net/wireless/brcm80211/Kconfig
@@ -36,6 +36,15 @@ config BRCMFMAC_SDIO
           IEEE802.11n embedded FullMAC WLAN driver. Say Y if you want to
           use the driver for a SDIO wireless card.
 
+config BRCMFMAC_SDIO_OOB
+        bool "Out of band interrupt support for SDIO interface chipset"
+        depends on BRCMFMAC_SDIO
+        ---help---
+          This option enables out-of-band interrupt support for Broadcom
+          SDIO Wifi chipset using fullmac in order to gain better
+          performance and deep sleep wake up capability on certain
+          platforms. Say N if you are unsure.
+
 config BRCMFMAC_USB
         bool "USB bus interface support for FullMAC driver"
         depends on USB
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
index e925290b432b..4add7da24681 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
@@ -39,37 +39,113 @@
 
 #define SDIOH_API_ACCESS_RETRY_LIMIT    2
 
-static void brcmf_sdioh_irqhandler(struct sdio_func *func)
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+static irqreturn_t brcmf_sdio_irqhandler(int irq, void *dev_id)
 {
-        struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(&func->card->dev);
+        struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(dev_id);
 
-        brcmf_dbg(TRACE, "***IRQHandler\n");
+        brcmf_dbg(INTR, "oob intr triggered\n");
 
-        sdio_release_host(func);
+        /*
+         * out-of-band interrupt is level-triggered which won't
+         * be cleared until dpc
+         */
+        if (sdiodev->irq_en) {
+                disable_irq_nosync(irq);
+                sdiodev->irq_en = false;
+        }
 
         brcmf_sdbrcm_isr(sdiodev->bus);
 
-        sdio_claim_host(func);
+        return IRQ_HANDLED;
+}
+
+int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
+{
+        int ret = 0;
+        u8 data;
+        unsigned long flags;
+
+        brcmf_dbg(TRACE, "Entering\n");
+
+        brcmf_dbg(ERROR, "requesting irq %d\n", sdiodev->irq);
+        ret = request_irq(sdiodev->irq, brcmf_sdio_irqhandler,
+                          sdiodev->irq_flags, "brcmf_oob_intr",
+                          &sdiodev->func[1]->card->dev);
+        if (ret != 0)
+                return ret;
+        spin_lock_init(&sdiodev->irq_en_lock);
+        spin_lock_irqsave(&sdiodev->irq_en_lock, flags);
+        sdiodev->irq_en = true;
+        spin_unlock_irqrestore(&sdiodev->irq_en_lock, flags);
+
+        ret = enable_irq_wake(sdiodev->irq);
+        if (ret != 0)
+                return ret;
+        sdiodev->irq_wake = true;
+
+        /* must configure SDIO_CCCR_IENx to enable irq */
+        data = brcmf_sdcard_cfg_read(sdiodev, SDIO_FUNC_0,
+                                     SDIO_CCCR_IENx, &ret);
+        data |= 1 << SDIO_FUNC_1 | 1 << SDIO_FUNC_2 | 1;
+        brcmf_sdcard_cfg_write(sdiodev, SDIO_FUNC_0, SDIO_CCCR_IENx,
+                               data, &ret);
+
+        /* redirect, configure ane enable io for interrupt signal */
+        data = SDIO_SEPINT_MASK | SDIO_SEPINT_OE;
+        if (sdiodev->irq_flags | IRQF_TRIGGER_HIGH)
+                data |= SDIO_SEPINT_ACT_HI;
+        brcmf_sdcard_cfg_write(sdiodev, SDIO_FUNC_0, SDIO_CCCR_BRCM_SEPINT,
+                               data, &ret);
+
+        return 0;
+}
+
+int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
+{
+        brcmf_dbg(TRACE, "Entering\n");
+
+        brcmf_sdcard_cfg_write(sdiodev, SDIO_FUNC_0, SDIO_CCCR_BRCM_SEPINT,
+                               0, NULL);
+        brcmf_sdcard_cfg_write(sdiodev, SDIO_FUNC_0, SDIO_CCCR_IENx, 0, NULL);
+
+        if (sdiodev->irq_wake) {
+                disable_irq_wake(sdiodev->irq);
+                sdiodev->irq_wake = false;
+        }
+        free_irq(sdiodev->irq, &sdiodev->func[1]->card->dev);
+        sdiodev->irq_en = false;
+
+        return 0;
+}
+#else           /* CONFIG_BRCMFMAC_SDIO_OOB */
+static void brcmf_sdio_irqhandler(struct sdio_func *func)
+{
+        struct brcmf_sdio_dev *sdiodev = dev_get_drvdata(&func->card->dev);
+
+        brcmf_dbg(INTR, "ib intr triggered\n");
+
+        brcmf_sdbrcm_isr(sdiodev->bus);
 }
 
 /* dummy handler for SDIO function 2 interrupt */
-static void brcmf_sdioh_dummy_irq_handler(struct sdio_func *func)
+static void brcmf_sdio_dummy_irqhandler(struct sdio_func *func)
 {
 }
 
-int brcmf_sdcard_intr_reg(struct brcmf_sdio_dev *sdiodev)
+int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev)
 {
         brcmf_dbg(TRACE, "Entering\n");
 
         sdio_claim_host(sdiodev->func[1]);
-        sdio_claim_irq(sdiodev->func[1], brcmf_sdioh_irqhandler);
-        sdio_claim_irq(sdiodev->func[2], brcmf_sdioh_dummy_irq_handler);
+        sdio_claim_irq(sdiodev->func[1], brcmf_sdio_irqhandler);
+        sdio_claim_irq(sdiodev->func[2], brcmf_sdio_dummy_irqhandler);
         sdio_release_host(sdiodev->func[1]);
 
         return 0;
 }
 
-int brcmf_sdcard_intr_dereg(struct brcmf_sdio_dev *sdiodev)
+int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev)
 {
         brcmf_dbg(TRACE, "Entering\n");
 
@@ -80,6 +156,7 @@ int brcmf_sdcard_intr_dereg(struct brcmf_sdio_dev *sdiodev)
 
         return 0;
 }
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
 
 u8 brcmf_sdcard_cfg_read(struct brcmf_sdio_dev *sdiodev, uint fnc_num, u32 addr,
                          int *err)
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
index 758c115b556e..dd07d33a927c 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh_sdmmc.c
@@ -27,6 +27,7 @@
 #include <linux/errno.h>
 #include <linux/sched.h>        /* request_irq() */
 #include <linux/module.h>
+#include <linux/platform_device.h>
 #include <net/cfg80211.h>
 
 #include <defs.h>
@@ -55,6 +56,15 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = {
 };
 MODULE_DEVICE_TABLE(sdio, brcmf_sdmmc_ids);
 
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+static struct list_head oobirq_lh;
+struct brcmf_sdio_oobirq {
+        unsigned int irq;
+        unsigned long flags;
+        struct list_head list;
+};
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
+
 static bool
 brcmf_pm_resume_error(struct brcmf_sdio_dev *sdiodev)
 {
@@ -107,7 +117,8 @@ static inline int brcmf_sdioh_f0_write_byte(struct brcmf_sdio_dev *sdiodev,
                         }
                         sdio_release_host(sdfunc);
                 }
-        } else if (regaddr == SDIO_CCCR_ABORT) {
+        } else if ((regaddr == SDIO_CCCR_ABORT) ||
+                   (regaddr == SDIO_CCCR_IENx)) {
                 sdfunc = kmemdup(sdiodev->func[0], sizeof(struct sdio_func),
                                  GFP_KERNEL);
                 if (!sdfunc)
@@ -467,12 +478,40 @@ void brcmf_sdioh_detach(struct brcmf_sdio_dev *sdiodev)
 
 }
 
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+static int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
+{
+        struct brcmf_sdio_oobirq *oobirq_entry;
+
+        if (list_empty(&oobirq_lh)) {
+                brcmf_dbg(ERROR, "no valid oob irq resource\n");
+                return -ENXIO;
+        }
+
+        oobirq_entry = list_first_entry(&oobirq_lh, struct brcmf_sdio_oobirq,
+                                        list);
+
+        sdiodev->irq = oobirq_entry->irq;
+        sdiodev->irq_flags = oobirq_entry->flags;
+        list_del(&oobirq_entry->list);
+        kfree(oobirq_entry);
+
+        return 0;
+}
+#else
+static inline int brcmf_sdio_getintrcfg(struct brcmf_sdio_dev *sdiodev)
+{
+        return 0;
+}
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
+
 static int brcmf_ops_sdio_probe(struct sdio_func *func,
                               const struct sdio_device_id *id)
 {
         int ret = 0;
         struct brcmf_sdio_dev *sdiodev;
         struct brcmf_bus *bus_if;
+
         brcmf_dbg(TRACE, "Enter\n");
         brcmf_dbg(TRACE, "func->class=%x\n", func->class);
         brcmf_dbg(TRACE, "sdio_vendor: 0x%04x\n", func->vendor);
@@ -511,6 +550,10 @@ static int brcmf_ops_sdio_probe(struct sdio_func *func,
                 sdiodev = dev_get_drvdata(&func->card->dev);
                 if ((!sdiodev) || (sdiodev->func[1]->card != func->card))
                         return -ENODEV;
+
+                ret = brcmf_sdio_getintrcfg(sdiodev);
+                if (ret)
+                        return ret;
                 sdiodev->func[2] = func;
 
                 bus_if = sdiodev->bus_if;
@@ -603,6 +646,65 @@ static struct sdio_driver brcmf_sdmmc_driver = {
 #endif  /* CONFIG_PM_SLEEP */
 };
 
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+static int brcmf_sdio_pd_probe(struct platform_device *pdev)
+{
+        struct resource *res;
+        struct brcmf_sdio_oobirq *oobirq_entry;
+        int i, ret;
+
+        INIT_LIST_HEAD(&oobirq_lh);
+
+        for (i = 0; ; i++) {
+                res = platform_get_resource(pdev, IORESOURCE_IRQ, i);
+                if (!res)
+                        break;
+
+                oobirq_entry = kzalloc(sizeof(struct brcmf_sdio_oobirq),
+                                       GFP_KERNEL);
+                oobirq_entry->irq = res->start;
+                oobirq_entry->flags = res->flags & IRQF_TRIGGER_MASK;
+                list_add_tail(&oobirq_entry->list, &oobirq_lh);
+        }
+        if (i == 0)
+                return -ENXIO;
+
+        ret = sdio_register_driver(&brcmf_sdmmc_driver);
+
+        if (ret)
+                brcmf_dbg(ERROR, "sdio_register_driver failed: %d\n", ret);
+
+        return ret;
+}
+
+static struct platform_driver brcmf_sdio_pd = {
+        .probe          = brcmf_sdio_pd_probe,
+        .driver         = {
+                .name   = "brcmf_sdio_pd"
+        }
+};
+
+void brcmf_sdio_exit(void)
+{
+        brcmf_dbg(TRACE, "Enter\n");
+
+        sdio_unregister_driver(&brcmf_sdmmc_driver);
+
+        platform_driver_unregister(&brcmf_sdio_pd);
+}
+
+void brcmf_sdio_init(void)
+{
+        int ret;
+
+        brcmf_dbg(TRACE, "Enter\n");
+
+        ret = platform_driver_register(&brcmf_sdio_pd);
+
+        if (ret)
+                brcmf_dbg(ERROR, "platform_driver_register failed: %d\n", ret);
+}
+#else
 void brcmf_sdio_exit(void)
 {
         brcmf_dbg(TRACE, "Enter\n");
@@ -621,3 +723,4 @@ void brcmf_sdio_init(void)
         if (ret)
                 brcmf_dbg(ERROR, "sdio_register_driver failed: %d\n", ret);
 }
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
index a80b840051a7..149ee67beb2e 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/dhd_sdio.c
@@ -2352,6 +2352,24 @@ static void brcmf_sdbrcm_bus_stop(struct device *dev)
         up(&bus->sdsem);
 }
 
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&bus->sdiodev->irq_en_lock, flags);
+        if (!bus->sdiodev->irq_en && !bus->ipend) {
+                enable_irq(bus->sdiodev->irq);
+                bus->sdiodev->irq_en = true;
+        }
+        spin_unlock_irqrestore(&bus->sdiodev->irq_en_lock, flags);
+}
+#else
+static inline void brcmf_sdbrcm_clrintr(struct brcmf_sdio *bus)
+{
+}
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
+
 static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
 {
         u32 intstatus, newstatus = 0;
@@ -2509,6 +2527,8 @@ static bool brcmf_sdbrcm_dpc(struct brcmf_sdio *bus)
         bus->intstatus = intstatus;
 
 clkwait:
+        brcmf_sdbrcm_clrintr(bus);
+
         if (data_ok(bus) && bus->ctrl_frame_stat &&
                 (bus->clkstate == CLK_AVAIL)) {
                 int ret, i;
@@ -3508,8 +3528,14 @@ static int brcmf_sdbrcm_bus_init(struct device *dev)
         brcmf_sdcard_cfg_write(bus->sdiodev, SDIO_FUNC_1,
                                SBSDIO_FUNC1_CHIPCLKCSR, saveclk, &err);
 
+        if (ret == 0) {
+                ret = brcmf_sdio_intr_register(bus->sdiodev);
+                if (ret != 0)
+                        brcmf_dbg(ERROR, "intr register failed:%d\n", ret);
+        }
+
         /* If we didn't come up, turn off backplane clock */
-        if (!ret)
+        if (bus_if->state != BRCMF_BUS_DATA)
                 brcmf_sdbrcm_clkctl(bus, CLK_NONE, false);
 
 exit:
@@ -3867,7 +3893,7 @@ static void brcmf_sdbrcm_release(struct brcmf_sdio *bus)
 
         if (bus) {
                 /* De-register interrupt handler */
-                brcmf_sdcard_intr_dereg(bus->sdiodev);
+                brcmf_sdio_intr_unregister(bus->sdiodev);
 
                 if (bus->sdiodev->bus_if->drvr) {
                         brcmf_detach(bus->sdiodev->dev);
@@ -3968,15 +3994,6 @@ void *brcmf_sdbrcm_probe(u32 regsva, struct brcmf_sdio_dev *sdiodev)
                 goto fail;
         }
 
-        /* Register interrupt callback, but mask it (not operational yet). */
-        brcmf_dbg(INTR, "disable SDIO interrupts (not interested yet)\n");
-        ret = brcmf_sdcard_intr_reg(bus->sdiodev);
-        if (ret != 0) {
-                brcmf_dbg(ERROR, "FAILED: sdcard_intr_reg returned %d\n", ret);
-                goto fail;
-        }
-        brcmf_dbg(INTR, "registered SDIO interrupt function ok\n");
-
         brcmf_dbg(INFO, "completed!!\n");
 
         /* if firmware path present try to download and bring up bus */
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
index 0281d207d998..7010eaf71f99 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
+++ b/drivers/net/wireless/brcm80211/brcmfmac/sdio_host.h
@@ -43,6 +43,13 @@
 /* as of sdiod rev 0, supports 3 functions */
 #define SBSDIO_NUM_FUNCTION             3
 
+/* function 0 vendor specific CCCR registers */
+#define SDIO_CCCR_BRCM_SEPINT           0xf2
+
+#define  SDIO_SEPINT_MASK               0x01
+#define  SDIO_SEPINT_OE                 0x02
+#define  SDIO_SEPINT_ACT_HI             0x04
+
 /* function 1 miscellaneous registers */
 
 /* sprom command and status */
@@ -144,13 +151,18 @@ struct brcmf_sdio_dev {
         wait_queue_head_t request_buffer_wait;
         struct device *dev;
         struct brcmf_bus *bus_if;
+#ifdef CONFIG_BRCMFMAC_SDIO_OOB
+        unsigned int irq;               /* oob interrupt number */
+        unsigned long irq_flags;        /* board specific oob flags */
+        bool irq_en;                    /* irq enable flags */
+        spinlock_t irq_en_lock;
+        bool irq_wake;                  /* irq wake enable flags */
+#endif          /* CONFIG_BRCMFMAC_SDIO_OOB */
 };
 
-/* Register/deregister device interrupt handler. */
-extern int
-brcmf_sdcard_intr_reg(struct brcmf_sdio_dev *sdiodev);
-
-extern int brcmf_sdcard_intr_dereg(struct brcmf_sdio_dev *sdiodev);
+/* Register/deregister interrupt handler. */
+extern int brcmf_sdio_intr_register(struct brcmf_sdio_dev *sdiodev);
+extern int brcmf_sdio_intr_unregister(struct brcmf_sdio_dev *sdiodev);
 
 /* Access SDIO address space (e.g. CCCR) using CMD52 (single-byte interface).
  *   fn:   function number
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index c72136c07774..9cfae0c08707 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -1963,10 +1963,8 @@ static int ipw2100_wdev_init(struct net_device *dev)
         wdev->wiphy->n_cipher_suites = ARRAY_SIZE(ipw_cipher_suites);
 
         set_wiphy_dev(wdev->wiphy, &priv->pci_dev->dev);
-        if (wiphy_register(wdev->wiphy)) {
-                ipw2100_down(priv);
+        if (wiphy_register(wdev->wiphy))
                 return -EIO;
-        }
         return 0;
 }
 
@@ -6331,6 +6329,11 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
         printk(KERN_INFO DRV_NAME
                ": Detected Intel PRO/Wireless 2100 Network Connection\n");
 
+        err = ipw2100_wdev_init(dev);
+        if (err)
+                goto fail;
+        registered = 1;
+
         /* Bring up the interface.  Pre 0.46, after we registered the
          * network device we would call ipw2100_up.  This introduced a race
          * condition with newer hotplug configurations (network was coming
@@ -6347,11 +6350,7 @@ static int ipw2100_pci_init_one(struct pci_dev *pci_dev,
                        "Error calling register_netdev.\n");
                 goto fail;
         }
-        registered = 1;
-
-        err = ipw2100_wdev_init(dev);
-        if (err)
-                goto fail;
+        registered = 2;
 
         mutex_lock(&priv->action_mutex);
 
@@ -6390,13 +6389,16 @@ out:
 
       fail_unlock:
         mutex_unlock(&priv->action_mutex);
-        wiphy_unregister(priv->ieee->wdev.wiphy);
-        kfree(priv->ieee->bg_band.channels);
       fail:
         if (dev) {
-                if (registered)
+                if (registered >= 2)
                         unregister_netdev(dev);
 
+                if (registered) {
+                        wiphy_unregister(priv->ieee->wdev.wiphy);
+                        kfree(priv->ieee->bg_band.channels);
+                }
+
                 ipw2100_hw_stop_adapter(priv);
 
                 ipw2100_disable_interrupts(priv);
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index b3707dadad15..0036737fe8e3 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -11443,20 +11443,6 @@ static void ipw_bg_down(struct work_struct *work)
         mutex_unlock(&priv->mutex);
 }
 
-/* Called by register_netdev() */
-static int ipw_net_init(struct net_device *dev)
-{
-        int rc = 0;
-        struct ipw_priv *priv = libipw_priv(dev);
-
-        mutex_lock(&priv->mutex);
-        if (ipw_up(priv))
-                rc = -EIO;
-        mutex_unlock(&priv->mutex);
-
-        return rc;
-}
-
 static int ipw_wdev_init(struct net_device *dev)
 {
         int i, rc = 0;
@@ -11725,7 +11711,6 @@ static void ipw_prom_free(struct ipw_priv *priv)
 #endif
 
 static const struct net_device_ops ipw_netdev_ops = {
-        .ndo_init               = ipw_net_init,
         .ndo_open               = ipw_net_open,
         .ndo_stop               = ipw_net_stop,
         .ndo_set_rx_mode        = ipw_net_set_multicast_list,
@@ -11848,17 +11833,24 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                 goto out_release_irq;
         }
 
-        mutex_unlock(&priv->mutex);
-        err = register_netdev(net_dev);
-        if (err) {
-                IPW_ERROR("failed to register network device\n");
+        if (ipw_up(priv)) {
+                mutex_unlock(&priv->mutex);
+                err = -EIO;
                 goto out_remove_sysfs;
         }
 
+        mutex_unlock(&priv->mutex);
+
         err = ipw_wdev_init(net_dev);
         if (err) {
                 IPW_ERROR("failed to register wireless device\n");
-                goto out_unregister_netdev;
+                goto out_remove_sysfs;
+        }
+
+        err = register_netdev(net_dev);
+        if (err) {
+                IPW_ERROR("failed to register network device\n");
+                goto out_unregister_wiphy;
         }
 
 #ifdef CONFIG_IPW2200_PROMISCUOUS
@@ -11867,10 +11859,8 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
                 if (err) {
                         IPW_ERROR("Failed to register promiscuous network "
                                   "device (error %d).\n", err);
-                        wiphy_unregister(priv->ieee->wdev.wiphy);
-                        kfree(priv->ieee->a_band.channels);
-                        kfree(priv->ieee->bg_band.channels);
-                        goto out_unregister_netdev;
+                        unregister_netdev(priv->net_dev);
+                        goto out_unregister_wiphy;
                 }
         }
 #endif
@@ -11882,8 +11872,10 @@ static int __devinit ipw_pci_probe(struct pci_dev *pdev,
 
         return 0;
 
-      out_unregister_netdev:
-        unregister_netdev(priv->net_dev);
+      out_unregister_wiphy:
+        wiphy_unregister(priv->ieee->wdev.wiphy);
+        kfree(priv->ieee->a_band.channels);
+        kfree(priv->ieee->bg_band.channels);
       out_remove_sysfs:
         sysfs_remove_group(&pdev->dev.kobj, &ipw_attribute_group);
       out_release_irq:
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index e1c2bb802050..01dc44267317 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -186,76 +186,8 @@ done:
 /*
  * BT coex
  */
-/*
- * Macros to access the lookup table.
- *
- * The lookup table has 7 inputs: bt3_prio, bt3_txrx, bt_rf_act, wifi_req,
-* wifi_prio, wifi_txrx and wifi_sh_ant_req.
- *
- * It has three outputs: WLAN_ACTIVE, WLAN_KILL and ANT_SWITCH
- *
- * The format is that "registers" 8 through 11 contain the WLAN_ACTIVE bits
- * one after another in 32-bit registers, and "registers" 0 through 7 contain
- * the WLAN_KILL and ANT_SWITCH bits interleaved (in that order).
- *
- * These macros encode that format.
- */
-#define LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, wifi_req, wifi_prio, \
-                  wifi_txrx, wifi_sh_ant_req) \
-        (bt3_prio | (bt3_txrx << 1) | (bt_rf_act << 2) | (wifi_req << 3) | \
-        (wifi_prio << 4) | (wifi_txrx << 5) | (wifi_sh_ant_req << 6))
-
-#define LUT_PTA_WLAN_ACTIVE_OP(lut, op, val) \
-        lut[8 + ((val) >> 5)] op (cpu_to_le32(BIT((val) & 0x1f)))
-#define LUT_TEST_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                                 wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        (!!(LUT_PTA_WLAN_ACTIVE_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, \
-                                   bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
-                                   wifi_sh_ant_req))))
-#define LUT_SET_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                                wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        LUT_PTA_WLAN_ACTIVE_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, \
-                               bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
-                               wifi_sh_ant_req))
-#define LUT_CLEAR_PTA_WLAN_ACTIVE(lut, bt3_prio, bt3_txrx, bt_rf_act, \
-                                  wifi_req, wifi_prio, wifi_txrx, \
-                                  wifi_sh_ant_req) \
-        LUT_PTA_WLAN_ACTIVE_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, \
-                               bt_rf_act, wifi_req, wifi_prio, wifi_txrx, \
-                               wifi_sh_ant_req))
-
-#define LUT_WLAN_KILL_OP(lut, op, val) \
-        lut[(val) >> 4] op (cpu_to_le32(BIT(((val) << 1) & 0x1e)))
-#define LUT_TEST_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                           wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        (!!(LUT_WLAN_KILL_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                             wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))))
-#define LUT_SET_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                          wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        LUT_WLAN_KILL_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                         wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
-#define LUT_CLEAR_WLAN_KILL(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                            wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        LUT_WLAN_KILL_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                         wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
-
-#define LUT_ANT_SWITCH_OP(lut, op, val) \
-        lut[(val) >> 4] op (cpu_to_le32(BIT((((val) << 1) & 0x1e) + 1)))
-#define LUT_TEST_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                            wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        (!!(LUT_ANT_SWITCH_OP(lut, &, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                              wifi_req, wifi_prio, wifi_txrx, \
-                              wifi_sh_ant_req))))
-#define LUT_SET_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                           wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        LUT_ANT_SWITCH_OP(lut, |=, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                          wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
-#define LUT_CLEAR_ANT_SWITCH(lut, bt3_prio, bt3_txrx, bt_rf_act, wifi_req, \
-                             wifi_prio, wifi_txrx, wifi_sh_ant_req) \
-        LUT_ANT_SWITCH_OP(lut, &= ~, LUT_VALUE(bt3_prio, bt3_txrx, bt_rf_act, \
-                          wifi_req, wifi_prio, wifi_txrx, wifi_sh_ant_req))
-
-static const __le32 iwlagn_def_3w_lookup[12] = {
+/* Notmal TDM */
+static const __le32 iwlagn_def_3w_lookup[IWLAGN_BT_DECISION_LUT_SIZE] = {
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaeaaaaaa),
@@ -270,7 +202,25 @@ static const __le32 iwlagn_def_3w_lookup[12] = {
         cpu_to_le32(0xf0005000),
 };
 
-static const __le32 iwlagn_concurrent_lookup[12] = {
+
+/* Loose Coex */
+static const __le32 iwlagn_loose_lookup[IWLAGN_BT_DECISION_LUT_SIZE] = {
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xaeaaaaaa),
+        cpu_to_le32(0xaaaaaaaa),
+        cpu_to_le32(0xcc00ff28),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0xcc00aaaa),
+        cpu_to_le32(0x0000aaaa),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0x00000000),
+        cpu_to_le32(0xf0005000),
+        cpu_to_le32(0xf0005000),
+};
+
+/* Full concurrency */
+static const __le32 iwlagn_concurrent_lookup[IWLAGN_BT_DECISION_LUT_SIZE] = {
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaaaaaaaa),
         cpu_to_le32(0xaaaaaaaa),
@@ -325,6 +275,7 @@ void iwlagn_send_advance_bt_config(struct iwl_priv *priv)
 
         basic.kill_ack_mask = priv->kill_ack_mask;
         basic.kill_cts_mask = priv->kill_cts_mask;
+        basic.reduce_txpower = priv->reduced_txpower;
         basic.valid = priv->bt_valid;
 
         /*
@@ -610,29 +561,62 @@ static void iwlagn_print_uartmsg(struct iwl_priv *priv,
                         BT_UART_MSG_FRAME7CONNECTABLE_POS);
 }
 
-static void iwlagn_set_kill_msk(struct iwl_priv *priv,
+static bool iwlagn_set_kill_msk(struct iwl_priv *priv,
                                 struct iwl_bt_uart_msg *uart_msg)
 {
-        u8 kill_msk;
-        static const __le32 bt_kill_ack_msg[2] = {
+        bool need_update = false;
+        u8 kill_msk = IWL_BT_KILL_REDUCE;
+        static const __le32 bt_kill_ack_msg[3] = {
                 IWLAGN_BT_KILL_ACK_MASK_DEFAULT,
-                IWLAGN_BT_KILL_ACK_CTS_MASK_SCO };
-        static const __le32 bt_kill_cts_msg[2] = {
+                IWLAGN_BT_KILL_ACK_CTS_MASK_SCO,
+                IWLAGN_BT_KILL_ACK_CTS_MASK_REDUCE};
+        static const __le32 bt_kill_cts_msg[3] = {
                 IWLAGN_BT_KILL_CTS_MASK_DEFAULT,
-                IWLAGN_BT_KILL_ACK_CTS_MASK_SCO };
+                IWLAGN_BT_KILL_ACK_CTS_MASK_SCO,
+                IWLAGN_BT_KILL_ACK_CTS_MASK_REDUCE};
 
-        kill_msk = (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3)
-                ? 1 : 0;
+        if (!priv->reduced_txpower)
+                kill_msk = (BT_UART_MSG_FRAME3SCOESCO_MSK & uart_msg->frame3)
+                        ? IWL_BT_KILL_OVERRIDE : IWL_BT_KILL_DEFAULT;
         if (priv->kill_ack_mask != bt_kill_ack_msg[kill_msk] ||
             priv->kill_cts_mask != bt_kill_cts_msg[kill_msk]) {
                 priv->bt_valid |= IWLAGN_BT_VALID_KILL_ACK_MASK;
                 priv->kill_ack_mask = bt_kill_ack_msg[kill_msk];
                 priv->bt_valid |= IWLAGN_BT_VALID_KILL_CTS_MASK;
                 priv->kill_cts_mask = bt_kill_cts_msg[kill_msk];
+                need_update = true;
+        }
+        return need_update;
+}
 
-                /* schedule to send runtime bt_config */
-                queue_work(priv->workqueue, &priv->bt_runtime_config);
+static bool iwlagn_fill_txpower_mode(struct iwl_priv *priv,
+                                struct iwl_bt_uart_msg *uart_msg)
+{
+        bool need_update = false;
+
+        if (!priv->reduced_txpower &&
+            !iwl_is_associated(priv, IWL_RXON_CTX_PAN) &&
+            (uart_msg->frame3 & (BT_UART_MSG_FRAME3ACL_MSK |
+            BT_UART_MSG_FRAME3OBEX_MSK)) &&
+            !(uart_msg->frame3 & (BT_UART_MSG_FRAME3SCOESCO_MSK |
+            BT_UART_MSG_FRAME3SNIFF_MSK | BT_UART_MSG_FRAME3A2DP_MSK))) {
+                /* enabling reduced tx power */
+                priv->reduced_txpower = true;
+                priv->bt_valid |= IWLAGN_BT_VALID_REDUCED_TX_PWR;
+                need_update = true;
+        } else if (priv->reduced_txpower &&
+                   (iwl_is_associated(priv, IWL_RXON_CTX_PAN) ||
+                   (uart_msg->frame3 & (BT_UART_MSG_FRAME3SCOESCO_MSK |
+                   BT_UART_MSG_FRAME3SNIFF_MSK | BT_UART_MSG_FRAME3A2DP_MSK)) ||
+                   !(uart_msg->frame3 & (BT_UART_MSG_FRAME3ACL_MSK |
+                   BT_UART_MSG_FRAME3OBEX_MSK)))) {
+                /* disable reduced tx power */
+                priv->reduced_txpower = false;
+                priv->bt_valid &= ~IWLAGN_BT_VALID_REDUCED_TX_PWR;
+                need_update = true;
         }
+
+        return need_update;
 }
 
 int iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
@@ -680,7 +664,12 @@ int iwlagn_bt_coex_profile_notif(struct iwl_priv *priv,
                 }
         }
 
-        iwlagn_set_kill_msk(priv, uart_msg);
+        /* schedule to send runtime bt_config */
+        /* check reduce power before change ack/cts kill mask */
+        if (iwlagn_fill_txpower_mode(priv, uart_msg) ||
+            iwlagn_set_kill_msk(priv, uart_msg))
+                queue_work(priv->workqueue, &priv->bt_runtime_config);
+
 
         /* FIXME: based on notification, adjust the prio_boost */
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index 779f819cc8cb..18a383798e5d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -764,7 +764,8 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
         fraglen = len - hdrlen;
 
         if (fraglen) {
-                int offset = (void *)hdr - rxb_addr(rxb) + rxb_offset(rxb);
+                int offset = (void *)hdr + hdrlen -
+                             rxb_addr(rxb) + rxb_offset(rxb);
 
                 skb_add_rx_frag(skb, 0, rxb_steal_page(rxb), offset,
                                 fraglen, rxb->truesize);
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8bd9610a5d68..8d7637083fcf 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1307,6 +1307,9 @@ static int iwl_init_geos(struct iwl_priv *priv)
                 priv->hw_params.sku &= ~EEPROM_SKU_CAP_BAND_52GHZ;
         }
 
+        if (iwlwifi_mod_params.disable_5ghz)
+                priv->bands[IEEE80211_BAND_5GHZ].n_channels = 0;
+
         IWL_INFO(priv, "Tunable channels: %d 802.11bg, %d 802.11a channels\n",
                    priv->bands[IEEE80211_BAND_2GHZ].n_channels,
                    priv->bands[IEEE80211_BAND_5GHZ].n_channels);
@@ -1417,38 +1420,37 @@ void iwl_set_hw_params(struct iwl_priv *priv)
 
 
 
-void iwl_debug_config(struct iwl_priv *priv)
+/* show what optional capabilities we have */
+void iwl_option_config(struct iwl_priv *priv)
 {
-        dev_printk(KERN_INFO, priv->trans->dev, "CONFIG_IWLWIFI_DEBUG "
 #ifdef CONFIG_IWLWIFI_DEBUG
-                "enabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEBUG enabled\n");
 #else
-                "disabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEBUG disabled\n");
 #endif
-        dev_printk(KERN_INFO, priv->trans->dev, "CONFIG_IWLWIFI_DEBUGFS "
+
 #ifdef CONFIG_IWLWIFI_DEBUGFS
-                "enabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEBUGFS enabled\n");
 #else
-                "disabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEBUGFS disabled\n");
 #endif
-        dev_printk(KERN_INFO, priv->trans->dev, "CONFIG_IWLWIFI_DEVICE_TRACING "
+
 #ifdef CONFIG_IWLWIFI_DEVICE_TRACING
-                "enabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TRACING enabled\n");
 #else
-                "disabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TRACING disabled\n");
 #endif
 
-        dev_printk(KERN_INFO, priv->trans->dev, "CONFIG_IWLWIFI_DEVICE_TESTMODE "
 #ifdef CONFIG_IWLWIFI_DEVICE_TESTMODE
-                "enabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TESTMODE enabled\n");
 #else
-                "disabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_DEVICE_TESTMODE disabled\n");
 #endif
-        dev_printk(KERN_INFO, priv->trans->dev, "CONFIG_IWLWIFI_P2P "
+
 #ifdef CONFIG_IWLWIFI_P2P
-                "enabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_P2P enabled\n");
 #else
-                "disabled\n");
+        IWL_INFO(priv, "CONFIG_IWLWIFI_P2P disabled\n");
 #endif
 }
 
@@ -1567,8 +1569,7 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
 
         SET_IEEE80211_DEV(priv->hw, priv->trans->dev);
 
-        /* show what debugging capabilities we have */
-        iwl_debug_config(priv);
+        iwl_option_config(priv);
 
         IWL_DEBUG_INFO(priv, "*** LOAD DRIVER ***\n");
 
@@ -1586,7 +1587,6 @@ static struct iwl_op_mode *iwl_op_mode_dvm_start(struct iwl_trans *trans,
         /* these spin locks will be used in apm_ops.init and EEPROM access
          * we should init now
          */
-        spin_lock_init(&priv->trans->reg_lock);
         spin_lock_init(&priv->statistics.lock);
 
         /***********************
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.h b/drivers/net/wireless/iwlwifi/iwl-agn.h
index 34900e6523dd..79c0fe06f4db 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.h
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.h
@@ -523,7 +523,7 @@ static inline const char *iwl_dvm_get_cmd_string(u8 cmd)
 void iwl_setup_deferred_work(struct iwl_priv *priv);
 int iwl_send_wimax_coex(struct iwl_priv *priv);
 int iwl_send_bt_env(struct iwl_priv *priv, u8 action, u8 type);
-void iwl_debug_config(struct iwl_priv *priv);
+void iwl_option_config(struct iwl_priv *priv);
 void iwl_set_hw_params(struct iwl_priv *priv);
 void iwl_init_context(struct iwl_priv *priv, u32 ucode_flags);
 int iwl_init_drv(struct iwl_priv *priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl-commands.h b/drivers/net/wireless/iwlwifi/iwl-commands.h
index 296347a8290f..83a6930f3658 100644
--- a/drivers/net/wireless/iwlwifi/iwl-commands.h
+++ b/drivers/net/wireless/iwlwifi/iwl-commands.h
@@ -1877,9 +1877,16 @@ struct iwl_bt_cmd {
 
 #define IWLAGN_BT3_T7_DEFAULT           1
 
+enum iwl_bt_kill_idx {
+        IWL_BT_KILL_DEFAULT = 0,
+        IWL_BT_KILL_OVERRIDE = 1,
+        IWL_BT_KILL_REDUCE = 2,
+};
+
 #define IWLAGN_BT_KILL_ACK_MASK_DEFAULT cpu_to_le32(0xffff0000)
 #define IWLAGN_BT_KILL_CTS_MASK_DEFAULT cpu_to_le32(0xffff0000)
 #define IWLAGN_BT_KILL_ACK_CTS_MASK_SCO cpu_to_le32(0xffffffff)
+#define IWLAGN_BT_KILL_ACK_CTS_MASK_REDUCE      cpu_to_le32(0)
 
 #define IWLAGN_BT3_PRIO_SAMPLE_DEFAULT  2
 
@@ -1891,7 +1898,7 @@ struct iwl_bt_cmd {
 #define IWLAGN_BT_VALID_3W_TIMERS       cpu_to_le16(BIT(3))
 #define IWLAGN_BT_VALID_KILL_ACK_MASK   cpu_to_le16(BIT(4))
 #define IWLAGN_BT_VALID_KILL_CTS_MASK   cpu_to_le16(BIT(5))
-#define IWLAGN_BT_VALID_BT4_TIMES       cpu_to_le16(BIT(6))
+#define IWLAGN_BT_VALID_REDUCED_TX_PWR  cpu_to_le16(BIT(6))
 #define IWLAGN_BT_VALID_3W_LUT          cpu_to_le16(BIT(7))
 
 #define IWLAGN_BT_ALL_VALID_MSK         (IWLAGN_BT_VALID_ENABLE_FLAGS | \
@@ -1900,9 +1907,11 @@ struct iwl_bt_cmd {
                                         IWLAGN_BT_VALID_3W_TIMERS | \
                                         IWLAGN_BT_VALID_KILL_ACK_MASK | \
                                         IWLAGN_BT_VALID_KILL_CTS_MASK | \
-                                        IWLAGN_BT_VALID_BT4_TIMES | \
+                                        IWLAGN_BT_VALID_REDUCED_TX_PWR | \
                                         IWLAGN_BT_VALID_3W_LUT)
 
+#define IWLAGN_BT_DECISION_LUT_SIZE     12
+
 struct iwl_basic_bt_cmd {
         u8 flags;
         u8 ledtime; /* unused */
@@ -1913,8 +1922,9 @@ struct iwl_basic_bt_cmd {
         u8 bt3_prio_sample_time;
         u8 bt3_timer_t2_value;
         __le16 bt4_reaction_time; /* unused */
-        __le32 bt3_lookup_table[12];
-        __le16 bt4_decision_time; /* unused */
+        __le32 bt3_lookup_table[IWLAGN_BT_DECISION_LUT_SIZE];
+        u8 reduce_txpower;
+        u8 reserved;
         __le16 valid;
 };
 
@@ -3634,6 +3644,9 @@ enum iwl_bt_coex_profile_traffic_load {
                 (0x3<<BT_UART_MSG_2_FRAME7RESERVED_POS)
 
 
+#define BT_ENABLE_REDUCED_TXPOWER_THRESHOLD     (-62)
+#define BT_DISABLE_REDUCED_TXPOWER_THRESHOLD    (-65)
+
 struct iwl_bt_uart_msg {
         u8 header;
         u8 frame1;
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index f70219c3b122..70062379d0ec 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -921,6 +921,7 @@ struct iwl_priv {
         __le32 kill_ack_mask;
         __le32 kill_cts_mask;
         __le16 bt_valid;
+        bool reduced_txpower;
         u16 bt_on_thresh;
         u16 bt_duration;
         u16 dynamic_frag_thresh;
diff --git a/drivers/net/wireless/iwlwifi/iwl-drv.c b/drivers/net/wireless/iwlwifi/iwl-drv.c
index 05302d6f989f..3c72bad0ae56 100644
--- a/drivers/net/wireless/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/iwlwifi/iwl-drv.c
@@ -66,6 +66,7 @@
 #include <linux/module.h>
 
 #include "iwl-drv.h"
+#include "iwl-debug.h"
 #include "iwl-trans.h"
 #include "iwl-op-mode.h"
 #include "iwl-agn-hw.h"
@@ -892,10 +893,9 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
         int ret;
 
         drv = kzalloc(sizeof(*drv), GFP_KERNEL);
-        if (!drv) {
-                dev_printk(KERN_ERR, trans->dev, "Couldn't allocate iwl_drv");
+        if (!drv)
                 return NULL;
-        }
+
         drv->trans = trans;
         drv->dev = trans->dev;
         drv->cfg = cfg;
@@ -905,7 +905,7 @@ struct iwl_drv *iwl_drv_start(struct iwl_trans *trans,
         ret = iwl_request_firmware(drv, true);
 
         if (ret) {
-                dev_printk(KERN_ERR, trans->dev, "Couldn't request the fw");
+                IWL_ERR(trans, "Couldn't request the fw\n");
                 kfree(drv);
                 drv = NULL;
         }
@@ -1012,3 +1012,7 @@ module_param_named(auto_agg, iwlwifi_mod_params.auto_agg,
                 bool, S_IRUGO);
 MODULE_PARM_DESC(auto_agg,
                  "enable agg w/o check traffic load (default: enable)");
+
+module_param_named(5ghz_disable, iwlwifi_mod_params.disable_5ghz,
+                bool, S_IRUGO);
+MODULE_PARM_DESC(5ghz_disable, "disable 5GHz band (default: 0 [enabled])");
diff --git a/drivers/net/wireless/iwlwifi/iwl-modparams.h b/drivers/net/wireless/iwlwifi/iwl-modparams.h
index 558b2e63c5cf..d9a86d6b2bd7 100644
--- a/drivers/net/wireless/iwlwifi/iwl-modparams.h
+++ b/drivers/net/wireless/iwlwifi/iwl-modparams.h
@@ -60,8 +60,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  *
  *****************************************************************************/
-#ifndef __iwl_shared_h__
-#define __iwl_shared_h__
+#ifndef __iwl_modparams_h__
+#define __iwl_modparams_h__
 
 #include <linux/types.h>
 #include <linux/spinlock.h>
@@ -103,6 +103,7 @@ enum iwl_power_level {
  * @ant_coupling: antenna coupling in dB, default = 0
  * @bt_ch_announce: BT channel inhibition, default = enable
  * @auto_agg: enable agg. without check, default = true
+ * @disable_5ghz: disable 5GHz capability, default = false
  */
 struct iwl_mod_params {
         int sw_crypto;
@@ -119,6 +120,7 @@ struct iwl_mod_params {
         int ant_coupling;
         bool bt_ch_announce;
         bool auto_agg;
+        bool disable_5ghz;
 };
 
-#endif /* #__iwl_shared_h__ */
+#endif /* #__iwl_modparams_h__ */
diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
index 63557bb85cda..2e57161854b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
+++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie.c
@@ -2175,6 +2175,7 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,
 
         /* Initialize the wait queue for commands */
         init_waitqueue_head(&trans->wait_command_queue);
+        spin_lock_init(&trans->reg_lock);
 
         return trans;
 
diff --git a/drivers/net/wireless/libertas/firmware.c b/drivers/net/wireless/libertas/firmware.c
index 77f6504fd55d..601f2075355e 100644
--- a/drivers/net/wireless/libertas/firmware.c
+++ b/drivers/net/wireless/libertas/firmware.c
@@ -2,6 +2,7 @@
  * Firmware loading and handling functions.
  */
 
+#include <linux/sched.h>
 #include <linux/firmware.h>
 #include <linux/firmware.h>
 #include <linux/module.h>
diff --git a/drivers/net/wireless/mwifiex/Kconfig b/drivers/net/wireless/mwifiex/Kconfig
index 7f91cc694787..8e384fae3e68 100644
--- a/drivers/net/wireless/mwifiex/Kconfig
+++ b/drivers/net/wireless/mwifiex/Kconfig
@@ -10,12 +10,12 @@ config MWIFIEX
           mwifiex.
 
 config MWIFIEX_SDIO
-        tristate "Marvell WiFi-Ex Driver for SD8787/SD8797"
+        tristate "Marvell WiFi-Ex Driver for SD8786/SD8787/SD8797"
         depends on MWIFIEX && MMC
         select FW_LOADER
         ---help---
           This adds support for wireless adapters based on Marvell
-          8787/8797 chipsets with SDIO interface.
+          8786/8787/8797 chipsets with SDIO interface.
 
           If you choose to build it as a module, it will be called
           mwifiex_sdio.
diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
index 2a2cabadb9b5..5f6adeb9b950 100644
--- a/drivers/net/wireless/mwifiex/fw.h
+++ b/drivers/net/wireless/mwifiex/fw.h
@@ -993,8 +993,7 @@ struct mwifiex_ie_types_wmm_queue_status {
 struct ieee_types_vendor_header {
         u8 element_id;
         u8 len;
-        u8 oui[3];
-        u8 oui_type;
+        u8 oui[4];      /* 0~2: oui, 3: oui_type */
         u8 oui_subtype;
         u8 version;
 } __packed;
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 1aa45c4295bb..e0377473282f 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -253,6 +253,8 @@ static int mwifiex_sdio_resume(struct device *dev)
         return 0;
 }
 
+/* Device ID for SD8786 */
+#define SDIO_DEVICE_ID_MARVELL_8786   (0x9116)
 /* Device ID for SD8787 */
 #define SDIO_DEVICE_ID_MARVELL_8787   (0x9119)
 /* Device ID for SD8797 */
@@ -260,6 +262,7 @@ static int mwifiex_sdio_resume(struct device *dev)
 
 /* WLAN IDs */
 static const struct sdio_device_id mwifiex_ids[] = {
+        {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8786)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8787)},
         {SDIO_DEVICE(SDIO_VENDOR_ID_MARVELL, SDIO_DEVICE_ID_MARVELL_8797)},
         {},
@@ -1599,6 +1602,9 @@ static int mwifiex_register_dev(struct mwifiex_adapter *adapter)
         adapter->dev = &func->dev;
 
         switch (func->device) {
+        case SDIO_DEVICE_ID_MARVELL_8786:
+                strcpy(adapter->fw_name, SD8786_DEFAULT_FW_NAME);
+                break;
         case SDIO_DEVICE_ID_MARVELL_8797:
                 strcpy(adapter->fw_name, SD8797_DEFAULT_FW_NAME);
                 break;
@@ -1807,5 +1813,6 @@ MODULE_AUTHOR("Marvell International Ltd.");
 MODULE_DESCRIPTION("Marvell WiFi-Ex SDIO Driver version " SDIO_VERSION);
 MODULE_VERSION(SDIO_VERSION);
 MODULE_LICENSE("GPL v2");
+MODULE_FIRMWARE(SD8786_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(SD8787_DEFAULT_FW_NAME);
 MODULE_FIRMWARE(SD8797_DEFAULT_FW_NAME);
diff --git a/drivers/net/wireless/mwifiex/sdio.h b/drivers/net/wireless/mwifiex/sdio.h
index 0ead152e3d1e..21033738ef0c 100644
--- a/drivers/net/wireless/mwifiex/sdio.h
+++ b/drivers/net/wireless/mwifiex/sdio.h
@@ -28,6 +28,7 @@
 
 #include "main.h"
 
+#define SD8786_DEFAULT_FW_NAME "mrvl/sd8786_uapsta.bin"
 #define SD8787_DEFAULT_FW_NAME "mrvl/sd8787_uapsta.bin"
 #define SD8797_DEFAULT_FW_NAME "mrvl/sd8797_uapsta.bin"
 
diff --git a/drivers/net/wireless/rt2x00/rt2800.h b/drivers/net/wireless/rt2x00/rt2800.h
index d91f4f628f65..9348521e0832 100644
--- a/drivers/net/wireless/rt2x00/rt2800.h
+++ b/drivers/net/wireless/rt2x00/rt2800.h
@@ -102,6 +102,8 @@
 #define BBP_SIZE                        0x00ff
 #define RF_BASE                         0x0004
 #define RF_SIZE                         0x0010
+#define RFCSR_BASE                      0x0000
+#define RFCSR_SIZE                      0x0040
 
 /*
  * Number of TX queues.
diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c
index 1cd16b416024..dfc90d34be6d 100644
--- a/drivers/net/wireless/rt2x00/rt2800lib.c
+++ b/drivers/net/wireless/rt2x00/rt2800lib.c
@@ -836,6 +836,13 @@ const struct rt2x00debug rt2800_rt2x00debug = {
                 .word_size      = sizeof(u32),
                 .word_count     = RF_SIZE / sizeof(u32),
         },
+        .rfcsr  = {
+                .read           = rt2800_rfcsr_read,
+                .write          = rt2800_rfcsr_write,
+                .word_base      = RFCSR_BASE,
+                .word_size      = sizeof(u8),
+                .word_count     = RFCSR_SIZE / sizeof(u8),
+        },
 };
 EXPORT_SYMBOL_GPL(rt2800_rt2x00debug);
 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index 78787fcc919e..3bb8cafbac59 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -70,6 +70,7 @@ struct rt2x00debug_intf {
          *     - eeprom offset/value files
          *     - bbp offset/value files
          *     - rf offset/value files
+         *     - rfcsr offset/value files
          *   - queue folder
          *     - frame dump file
          *     - queue stats file
@@ -89,6 +90,8 @@ struct rt2x00debug_intf {
         struct dentry *bbp_val_entry;
         struct dentry *rf_off_entry;
         struct dentry *rf_val_entry;
+        struct dentry *rfcsr_off_entry;
+        struct dentry *rfcsr_val_entry;
         struct dentry *queue_folder;
         struct dentry *queue_frame_dump_entry;
         struct dentry *queue_stats_entry;
@@ -131,6 +134,7 @@ struct rt2x00debug_intf {
         unsigned int offset_eeprom;
         unsigned int offset_bbp;
         unsigned int offset_rf;
+        unsigned int offset_rfcsr;
 };
 
 void rt2x00debug_update_crypto(struct rt2x00_dev *rt2x00dev,
@@ -525,6 +529,7 @@ RT2X00DEBUGFS_OPS(csr, "0x%.8x\n", u32);
 RT2X00DEBUGFS_OPS(eeprom, "0x%.4x\n", u16);
 RT2X00DEBUGFS_OPS(bbp, "0x%.2x\n", u8);
 RT2X00DEBUGFS_OPS(rf, "0x%.8x\n", u32);
+RT2X00DEBUGFS_OPS(rfcsr, "0x%.2x\n", u8);
 
 static ssize_t rt2x00debug_read_dev_flags(struct file *file,
                                           char __user *buf,
@@ -614,7 +619,7 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
         const struct rt2x00debug *debug = intf->debug;
         char *data;
 
-        data = kzalloc(8 * MAX_LINE_LENGTH, GFP_KERNEL);
+        data = kzalloc(9 * MAX_LINE_LENGTH, GFP_KERNEL);
         if (!data)
                 return NULL;
 
@@ -624,22 +629,22 @@ static struct dentry *rt2x00debug_create_file_chipset(const char *name,
         data += sprintf(data, "revision:\t%04x\n", intf->rt2x00dev->chip.rev);
         data += sprintf(data, "\n");
         data += sprintf(data, "register\tbase\twords\twordsize\n");
-        data += sprintf(data, "csr\t%d\t%d\t%d\n",
-                        debug->csr.word_base,
-                        debug->csr.word_count,
-                        debug->csr.word_size);
-        data += sprintf(data, "eeprom\t%d\t%d\t%d\n",
-                        debug->eeprom.word_base,
-                        debug->eeprom.word_count,
-                        debug->eeprom.word_size);
-        data += sprintf(data, "bbp\t%d\t%d\t%d\n",
-                        debug->bbp.word_base,
-                        debug->bbp.word_count,
-                        debug->bbp.word_size);
-        data += sprintf(data, "rf\t%d\t%d\t%d\n",
-                        debug->rf.word_base,
-                        debug->rf.word_count,
-                        debug->rf.word_size);
+#define RT2X00DEBUGFS_SPRINTF_REGISTER(__name)                  \
+{                                                               \
+        if(debug->__name.read)                                  \
+                data += sprintf(data, __stringify(__name)       \
+                                "\t%d\t%d\t%d\n",               \
+                                debug->__name.word_base,        \
+                                debug->__name.word_count,       \
+                                debug->__name.word_size);       \
+}
+        RT2X00DEBUGFS_SPRINTF_REGISTER(csr);
+        RT2X00DEBUGFS_SPRINTF_REGISTER(eeprom);
+        RT2X00DEBUGFS_SPRINTF_REGISTER(bbp);
+        RT2X00DEBUGFS_SPRINTF_REGISTER(rf);
+        RT2X00DEBUGFS_SPRINTF_REGISTER(rfcsr);
+#undef RT2X00DEBUGFS_SPRINTF_REGISTER
+
         blob->size = strlen(blob->data);
 
         return debugfs_create_blob(name, S_IRUSR, intf->driver_folder, blob);
@@ -694,31 +699,34 @@ void rt2x00debug_register(struct rt2x00_dev *rt2x00dev)
         if (IS_ERR(intf->register_folder) || !intf->register_folder)
                 goto exit;
 
-#define RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(__intf, __name)     \
-({                                                              \
-        (__intf)->__name##_off_entry =                          \
-            debugfs_create_u32(__stringify(__name) "_offset",   \
-                               S_IRUSR | S_IWUSR,               \
-                               (__intf)->register_folder,       \
-                               &(__intf)->offset_##__name);     \
-        if (IS_ERR((__intf)->__name##_off_entry)                \
-                        || !(__intf)->__name##_off_entry)       \
-                goto exit;                                      \
-                                                                \
-        (__intf)->__name##_val_entry =                          \
-            debugfs_create_file(__stringify(__name) "_value",   \
-                                S_IRUSR | S_IWUSR,              \
-                                (__intf)->register_folder,      \
-                                (__intf), &rt2x00debug_fop_##__name);\
-        if (IS_ERR((__intf)->__name##_val_entry)                \
-                        || !(__intf)->__name##_val_entry)       \
-                goto exit;                                      \
+#define RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(__intf, __name)                     \
+({                                                                              \
+        if(debug->__name.read) {                                                \
+                (__intf)->__name##_off_entry =                                  \
+                debugfs_create_u32(__stringify(__name) "_offset",               \
+                                       S_IRUSR | S_IWUSR,                       \
+                                       (__intf)->register_folder,               \
+                                       &(__intf)->offset_##__name);             \
+                if (IS_ERR((__intf)->__name##_off_entry)                        \
+                                || !(__intf)->__name##_off_entry)               \
+                        goto exit;                                              \
+                                                                                \
+                (__intf)->__name##_val_entry =                                  \
+                debugfs_create_file(__stringify(__name) "_value",               \
+                                        S_IRUSR | S_IWUSR,                      \
+                                        (__intf)->register_folder,              \
+                                        (__intf), &rt2x00debug_fop_##__name);   \
+                if (IS_ERR((__intf)->__name##_val_entry)                        \
+                                || !(__intf)->__name##_val_entry)               \
+                        goto exit;                                              \
+        }                                                                       \
 })
 
         RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, csr);
         RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, eeprom);
         RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, bbp);
         RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, rf);
+        RT2X00DEBUGFS_CREATE_REGISTER_ENTRY(intf, rfcsr);
 
 #undef RT2X00DEBUGFS_CREATE_REGISTER_ENTRY
 
@@ -770,6 +778,8 @@ void rt2x00debug_deregister(struct rt2x00_dev *rt2x00dev)
         debugfs_remove(intf->queue_stats_entry);
         debugfs_remove(intf->queue_frame_dump_entry);
         debugfs_remove(intf->queue_folder);
+        debugfs_remove(intf->rfcsr_val_entry);
+        debugfs_remove(intf->rfcsr_off_entry);
         debugfs_remove(intf->rf_val_entry);
         debugfs_remove(intf->rf_off_entry);
         debugfs_remove(intf->bbp_val_entry);
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.h b/drivers/net/wireless/rt2x00/rt2x00debug.h
index fa11409cb5c6..e11d39bdfef7 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.h
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.h
@@ -65,6 +65,7 @@ struct rt2x00debug {
         RT2X00DEBUGFS_REGISTER_ENTRY(eeprom, u16);
         RT2X00DEBUGFS_REGISTER_ENTRY(bbp, u8);
         RT2X00DEBUGFS_REGISTER_ENTRY(rf, u32);
+        RT2X00DEBUGFS_REGISTER_ENTRY(rfcsr, u8);
 };
 
 #endif /* RT2X00DEBUG_H */